Repository navigation
Conversation
Carried from lidge-jun#6049 into merge train round 3. Co-authored-by: Epinephrine <luvs01@hanmail.net>
Carried from lidge-jun#6042 into merge train round 3. Co-authored-by: Epinephrine <luvs01@hanmail.net>
Carried from lidge-jun#6037 into merge train round 3. Resolved the src/update/job.ts import conflict with dev by keeping both imports. Co-authored-by: Epinephrine <luvs01@hanmail.net>
Carried from lidge-jun#6020 into merge train round 3. Co-authored-by: Terry Tan <tmy1995hflc@gmail.com>
Follow-up to lidge-jun#6020, from the review on that PR. Retry records carry the credential generation, so a replaced or reauthenticated credential no longer waits out its predecessor backoff, and a failure that raced a replacement is not recorded. A local native-main admission refusal retries after one minute without doubling the upstream backoff. main account unavailable stays in the growing backoff; generation keying already lets a later token start clean.
Fixes lidge-jun#5494. A 429 saying "Your token-plan 1-week quota has been exhausted" took the 60-second default cooldown, so the combo offered the dead target again every minute; with one transient failure on the other target, every request in between got 503 No available targets. The phrase now counts as account-window exhaustion, which holds the target for the existing ten-minute cap. The match is anchored to the token-plan wording so per-minute quota messages keep the short cooldown.
Carried from lidge-jun#6050 into merge train round 3. Clearing the selection now succeeds while main is paused, so the dev test that pinned the old 409 is removed; codex-account-clear-paused.test.ts covers the new contract, including that an explicit paused-main selection still gets 409. Co-authored-by: Epinephrine <luvs01@hanmail.net>
Merge train round 3 B3: quota activation, update launcher, link join, settings reads, account clear, token-plan exhaustion
…#6043) Carried from lidge-jun#6043 into merge train round 3. Co-authored-by: Epinephrine <luvs01@hanmail.net>
Merge train round 3 B4: keep a recovery fence on native-main release (lidge-jun#6043)
Fixes lidge-jun#5180. Without a retryOn429 knob, a single Command Code key failed a long muse-spark turn on the first 429, because a single key cannot fail over and the Codex client does not retry 429. Key-auth rows at the canonical Command Code endpoints now get the patient same-key policy OpenCode Go already has (6 replays, 10 s interval, 60 s cap, Retry-After honored). OAuth rows are never replayed, an explicit retryOn429 including enabled:false still wins, and a custom relay keeps fail-fast.
…asoning exhaustion (lidge-jun#5953) Carried from lidge-jun#5953 into merge train round 3. Co-authored-by: codingbo <cnsdbo@163.com>
Follow-up to lidge-jun#5953, from the review that held it. The mitigation now applies only on Z.AI endpoints, only at an effective high or max effort, and only to the checkpoint shape: a summary instruction plus a <conversation> transcript of at least 2000 characters. A summarization prompt with a short user message is left alone. Each tiny cap field (1-1024) is raised on its own to 8192, so a larger caller cap is never shrunk. Negative tests cover each boundary.
…cache (lidge-jun#6027) Carried from lidge-jun#6027 into merge train round 3. The layout registries were unioned with the entries that landed first. Co-authored-by: codingbo <cnsdbo@163.com>
Follow-up to lidge-jun#6027, answering the three blockers in its review. A body with more than one <skills_instructions> block across its instructions and developer/system content now passes through untouched instead of having every block rewritten to one catalog, which also bounds the substitution to one block. A known snapshot is still substituted before parsing, but a new catalog is stored only when request preparation reaches its success return, so a request rejected by parsing or admission pins nothing. Without a named principal, snapshots are shared by conversation id only on a server that requires no data-plane auth. One regression test per blocker; all three fail on the PR head.
The reference still said remote binds never get a session. A trusted Tailscale identity or a pairing grant mints a 12-hour session that each authorized request extends (lidge-jun#2776); other remote operators use the admin token. Found while closing lidge-jun#4055.
Merge train round 3 B5: GLM summary budget, skills catalog snapshots, Command Code 429 wait, remote session docs
…idge-jun#5925) Carried from lidge-jun#5925 into merge train round 3. Co-authored-by: mdwsk88 <924038395@qq.com>
Carried from lidge-jun#5977 into merge train round 3. Co-authored-by: RHODIZSECURITY <180237049+RHODIZSECURITY@users.noreply.github.com>
Follow-up to lidge-jun#5977, closing the hold that kept it out of round 2. The local-read capability authenticates the request, but the client trusted the answer on shape alone, so a process that took the port could supply a protected verdict. The server now signs each local-read response with the attestation proof over the request nonce, PID and port, fetchBoundLocalManagementRead verifies it when a caller opts in, and ocx status opts in. Tests cover the signed server response and unsigned, wrong-nonce and wrong-secret answers.
…-jun#6161) * fix(packaging): ship keyring native addon * fix(packaging): make keyring bundle proof load-only * fix(packaging): resolve keyring addon from wrapper scope * fix(keyring): prefer the standalone-owned addon * fix(packaging): verify compiled keyring roots * fix(ci): cover packaged keyring prerequisites * fix(ci): keep keyring probe under file-size ratchet * style(cli): keep private probes inside size gate * fix(packaging): resolve symlinked keyring wrapper Resolve the wrapper entrypoint before locating its optional native addon, so virtual-store package layouts stage the installed addon. Cover nested and symlinked layouts. --------- Co-authored-by: Ingwannu <ingwannu@users.noreply.github.com> Co-authored-by: JUN <jun@lidgeai.com>
The auxiliary quota fences added for pause also aborted on any selection change, so a report probe in flight during an active-account switch no longer seeded the probed account. Pause, reauth and a replaced token still stop the send; the reading stays attributed to the account that was probed.
…-jun#6247) Carries lidge-jun#6232 by @cshyang: the internal reasoning summary "none" marker is stripped at final outbound serialization so native Responses upstreams do not reject it. Co-authored-by: cshyang <cshyang.chng@gmail.com>
lidge-jun#6234) (lidge-jun#6255) Carries lidge-jun#6234 by @vadymhimself: a 429 attributed to a pooled account that was itself cooled no longer cools the whole combo target, so healthy sibling accounts stay usable; unknown-account 429s still cool the target. Co-authored-by: Vadym O <bolein95@gmail.com>
# Conflicts: # scripts/test-layout/layout.json # src/oauth/anthropic-routing.ts # tests/fixtures/test-layout-expected.json
…carry lidge-jun#6238) (lidge-jun#6258) Carries lidge-jun#6238 by @lcBreathe (fixes lidge-jun#6237): the Windows standalone service wrapper is accepted by the ownership probe, and only a wrapper and registered task that match the standalone generator (quoted OCX_BUN assignment, generator markers and control flow, executable bound to the recorded install state, single wscript.exe Exec action with the exact launcher arguments) can claim ownership. Co-authored-by: lcBreathe <165003424+lcBreathe@users.noreply.github.com>
…ause feat(oauth): support Anthropic account pause and resume
* feat(oauth): add per-account Anthropic usage thresholds * fix(oauth): preserve manual Anthropic threshold intent * test(cli): update Anthropic auto-switch rejection * fix(oauth): fence Anthropic threshold policy ownership * fix(oauth): return committed Anthropic threshold policy * fix(gui): reconcile Anthropic threshold state safely * fix(gui): satisfy threshold lifecycle lint --------- Co-authored-by: Ingwannu <ingwannu@users.noreply.github.com> Co-authored-by: JUN <jun@lidgeai.com>
) * fix(responses): support canonical nonstream delivery * fix(responses): fold canonical SSE for compaction clients * fix(responses): align buffered SSE failure semantics * fix(responses): cancel deferred replay on client disconnect * fix(responses): redact upstream terminal diagnostics before delivery * docs(responses): keep terminal contract within structure budget * fix(responses): redact full failed terminals and synthetic stream errors Delay buffered serving-route publication until deferred replay survives the final abort check. * fix(responses): mask credential in synthetic refusal code * test(responses): include terminal redaction in core owner inventory * fix(responses): mask pooled credential in buffered bare errors * test(responses): abort synchronously in the deferred-replay disconnect case --------- Co-authored-by: Ingwannu <ingwannu@users.noreply.github.com> Co-authored-by: JUN <jun@lidgeai.com>
* fix(oauth): recover Anthropic reset cooldowns * docs(accounts): document Anthropic cooldown clear * docs(accounts): localize Anthropic cooldown clear * fix(oauth): fence Anthropic quota flights and cache ownership Retire old joinable usage flights during cooldown recovery, reject superseded failures before negative-cache publication, and retain live ownership for cached quota reads. * fix(quota): fence stale Anthropic token failures by cooldown flight --------- Co-authored-by: Ingwannu <ingwannu@users.noreply.github.com> Co-authored-by: JUN <jun@lidgeai.com>
lidge-jun#6261) * fix(keyring): compute packaged addon candidates with the target platform's path rules * test(keyring): cover target-platform path rules from a foreign host
…kenLab per-model wires (lidge-jun#6263) * docs(devlog): plan GPT-6.1 Sol rollout, default swap and TokenLab protocol routing * docs(devlog): record the GPT-6.1 Sol plan audit and JEV deferral * feat(models): add GPT-6.1 Sol across providers and make it the Sol default OpenAI released GPT-6.1 Sol on 2026-09-29 as the upgrade to GPT-6 Sol (Astra and Luna did not move). List it wherever GPT-6 Sol is served: the native Codex row (pinned verbatim from openai/codex models.json after #49318; low..ultra, default low, 272K/872K), the OpenAI API (1.05M / 922K / 128K, low..max), OpenRouter, GitHub Copilot (Responses), CodeBuddy/Kiro/Devin preemptive seeds, and the Bedrock/Cloudflare/Kilo/OpenCode Zen/Vercel metadata rows. Price it at $2 / $0.10 cached / $2.50 write / $10 with the long-context tier. Move every GPT-6 Sol default to GPT-6.1 Sol: the subagent roster default, the configured-native template, docker smoke and docs. Roster migration v3 swaps a bare gpt-6-sol in stored rosters once; GPT-6 Sol stays selectable. * feat(tokenlab): route each model over its declared wire TokenLab publishes per-model request formats (tokenlab.accepted_request_formats on GET /v1/models/{id}). Keep the released Chat preset as the provider-wide wire, and: - send gpt-6-astra, gpt-6.1-sol, gpt-6-sol, gpt-6-luna, grok-4.7, deepseek-v4.1-flash, deepseek-v4-pro, kimi-k3 and glm-5.3 over Responses for Responses inbound (Codex); Chat and Anthropic clients keep Chat, and an explicit modelAdapters entry still wins; - pin claude-* ids to Anthropic Messages (/v1/messages, x-api-key) through the endpoint-bound prefix pin Command Code uses, so a retargeted row is untouched; - leave gemini-3.8-flash and every other model on Chat. No delivery-policy header is sent; the API key policy stays authoritative. * docs(devlog): script the 2.73.0 release bundling RT6 * test(ci): docker smoke expects subagent roster version 3
…#6267) Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
…ion (lidge-jun#6271) * fix(release): sign the packaged macOS keyring addons before notarization Notarization rejected the 2.73.0 preview app: Resources/keyring/*.node, bundled since lidge-jun#6161, were unsigned or ad-hoc and had no secure timestamp, and Tauri does not sign files under Resources. Sign each darwin addon in place with the Developer ID identity, hardened runtime and timestamp after the certificate import and before tauri build, verify the result, and fail a real release that lacks signing material. * fix(release): match keyring signature fields without a pipe
…e-jun#6277) * test(codex): reuse the runner for catalog restore fixtures * test(codex): bound cold namespace setup separately from restore * test(claude): let the kernel reserve picker recovery proxy ports * test: reduce log-guard seed commits and budget cold fixture setup
Run the compiled Unix shim probe in Bun interpreter mode and confine that flag to its supervisor. Use selfLaunchArgv for direct standalone ensure commands in Unix, CMD and PowerShell shims. Add compiled installation/launch regressions and synchronize runtime and user docs. Closes lidge-jun#6276 Carries the probe approach from lidge-jun#6280 (d31e7f0). Co-authored-by: drakeo338 <paranoyouz@gmail.com>
…e-jun#6286) Fixes lidge-jun#6222 by launching packaged startup probes through the standalone-aware entrypoint and recognizing verified macOS desktop login supervision. Failed and stale evidence revoke protection while retaining desktop ownership and desktop-specific recovery guidance. Carries codingbooo’s lidge-jun#6256 and adds packaged subprocess/replacement and fail-closed ownership regressions. Co-authored-by: codingbo <cnsdbo@163.com>
…n#6283) * fix(kiro): settle held text across bounded completion retry * fix(kiro): release retry tool progress before EOF * test(kiro): assert buffered retention after event release
…nd refresh by default (lidge-jun#6285) * fix(catalog): discover unpinned native models and refresh the catalog by default GPT-6.1 Sol never reached an install without a release. Four gaps stacked: - catalogAutoRefresh was opt-in, so an absent section left the scheduler dormant. - The authenticated Codex /models roster was read only for entitlement; full rows for models this build does not pin were discarded, so discovery could not add them. - That roster is asked under the installed client version, and upstream's rollout gate served gpt-6.1-sol only from client_version 0.159.0 (its row says 0.153.0) while the installed Codex was 0.158.0-alpha. - The periodic converge read an observe-only bundled memo that expires after 60s, so a Codex binary upgrade's newly bundled rows never reached it. Now an absent section refreshes hourly with a first pass three minutes after start. Each tick re-reads the bundled runtime catalog, warms the entitlement roster, and runs a discovery-only roster request as a newer client (with If-None-Match) that feeds a bounded discovered-native store without touching the entitlement cache. Discovered rows register as self-described natives with their own name, reasoning ladder and context, persist for 14 days since last seen, and go inert once a release pins them. A changed served set records reloadRequired and logs a restart hint when Codex app-servers are running, since they keep a static in-memory list. * fix(catalog): keep default refresh to managed Codex installs and harden the discovery store Review follow-up. An absent catalogAutoRefresh section now refreshes only where this proxy manages the local Codex client; with the integration off it keeps the opt-in meaning, and Codex sources are never read there. The discovery store re-reads and merges the file before each write so another process's rows survive, renews an unchanged row on disk at most hourly so request-time roster fetches rarely write, and the discovery ETag expires after a day so a 304 cannot let a live model age out. * fix(catalog): guard late discovery publication and document the conditional default CodeRabbit follow-up. The discovery step now gets an abort signal tied to its source window and a publication guard tied to the scheduler generation, so a timed-out or stopped tick cannot record rows. The English server reference states that the default applies only to managed Codex installs, and the entitlement-isolation test now proves a cache miss under the discovery version instead of calling the status reader with the wrong argument.
|
✅ Deterministic PR hygiene checks passed. |
⏳ DRAFT
What to do
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved. |
Owner
Author
|
Closing this temporary validation PR without merging. The real Windows baseline reproduced all 16 parenthesized-date failures, and the fix passed all 24 regression cases. The upstream draft is lidge-jun#6298. Baseline evidence: https://github.com/hulkbig/opencodex/actions/runs/36677124460/job/109764421916. Fixed evidence: https://github.com/hulkbig/opencodex/actions/runs/36677358741/job/109766315572. Full-matrix failures are disclosed separately; target-case success is not a claim that the entire matrix passed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Temporary validation PR in this contributor fork only; not upstream-ready and not intended for merge. Adds isolated cmd.exe regression cases for lidge-jun#6290 against unchanged production code to obtain Windows before/after evidence. The cases use disposable directories and a fake child; they do not install, start or stop a real service.
Verification
Baseline production commit: 6538001. Test-only head: 7d8a674.
Linux existing checks pass, but the new cmd.exe cases skip on Linux and are not Windows correctness evidence. Actual Windows baseline failures and fixed results are still required before an upstream PR. This PR is intended to register the existing CI workflow for its supported manual Windows lane; no workflow or permission changes are proposed.
Checklist
Do not merge this validation PR.