[lcxhh521]

Summary

• Add opt-in macOS forwarding for codex-cloud-backend.chatgpt.com:443 through OpenCodex's existing outbound proxy. The server owns IPv4/IPv6 loopback listeners, preserves end-to-end TLS, and reports configured, active, and unavailable states separately. The existing app-server shim remains independently configurable.
• Add ocx chatgpt network status|install|enable|disable|recover|uninstall and authenticated local management actions. Administrator-approved installation creates a fixed-domain recovery helper; routing stays off until explicitly enabled. The helper journals its owned hosts mapping, recovers when the runtime disconnects, and retries incomplete recovery after restart. The hostname mapping affects all OS-resolver clients of that hostname.
• Adapt the change to current upstream dev, reuse its shared opaque tunnel implementation, preserve desktop launch/trust checks, and add focused lifecycle, recovery, installer, and TLS regressions with documentation and test-layout registration.

Verification

Current-head cloud validation (2026-10-21)

Validated head: 69e2db3cc0d384f105bfcac1ed8e6699beb3e570, parent c607e76fdc37b1dd7d5210bcb8dffa1e5c322c38, against dev 12025981e5a304cdb6b1b54f525ba8554f623977. Published tree d7b66e7c74781a027c862845708f54fd2b769c46 was verified identical to the tested candidate.

The new fix makes --json order-independent for network status/enable/disable/recover, preserving their existing JSON payloads. Install/uninstall reject it before effects and retain their separate confirmation/administrator boundary. Capability usage, documentation and regression tests match that scope; the existing JSON-contract test is unchanged.

With Bun 1.4.3 (c6da4a4d3), repository HOME/config isolation and mocked command transport:

• bun test --isolate tests/cli/cli-json-contract.test.ts tests/clients/desktop-cloud-network.test.ts tests/cli/cli-capability-data.test.ts tests/ci-workflows/skill-ocx.test.ts: 76 passed, 0 failed, 945 assertions.
• bun test --isolate tests/ci-workflows/file-size-ratchet.test.ts: 9 passed, 0 failed, 85 assertions.
• Typecheck, structure, generated-surface, privacy and whitespace checks passed. The docs build passed: 585 pages and 83,185 internal links.

Broader validation is not green. During repair, bun scripts/test.ts --changed=HEAD (HEAD was c607e76) ran 1,817 tests across 65 files: 1,770 passed, 1 skipped, 46 failed. A clean c607e76 checkout running the same 65 files returned 1,766 passed, 1 skipped, 47 failed, 1 error. Forty-five failures matched, including temporary-directory ownership refusal, Unix-socket restrictions, proxy failures and subsequent ledger-owner errors. The patch-only five-second lifecycle timeout passed alone on the final candidate (1 passed); baseline-only differences were the original JSON contract and a status-subprocess failure. Final focused tests and checks above were rerun after documentation and test-isolation corrections. These results do not establish a complete repository-suite pass.

No macOS run was performed for 69e2db3. The 276-test cloud and 50-test isolated macOS receipts below apply only to c607e76, not this new head. No real helper installation, hosts/DNS/443 change or signed-in application acceptance was performed.

Historical 2026-10-20 cloud validation (c607e76)

Validated head: c607e76fdc37b1dd7d5210bcb8dffa1e5c322c38, integrating upstream dev at 12025981e5a304cdb6b1b54f525ba8554f623977 (27 commits newer than the previous integrated base). The published tree eb9b1f405383f7dd1d509b0e270ad1d98d9bb441 was verified identical to the locally tested final candidate by fetching the published branch and comparing trees.

The follow-up fix cancels an abandoned client's pending CONNECT/SOCKS dial without stopping the listener, and rejects normalized proxy aliases that point back to the relay, including IPv4-mapped IPv6 loopback on port 443. Three new regression cases failed before the fix and passed afterward. The existing global-stop cancellation test also passed. Before isolated macOS execution, a further test-only fix bound subprocess recovery and failed-stop retries to the fixture socket rather than the default system helper. Its new regression verified all three recovery calls use the fixture path, failed before the fix, and passed afterward. These preliminary red/green runs are excluded from the distinct-test total below.

On 2026-10-20, the repository's official test wrapper passed 276 distinct tests, 0 failures using pinned Bun 1.4.3 (c6da4a4d3), its HOME/config isolation and preload guard, with HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY http_proxy https_proxy all_proxy no_proxy unset:

• bun scripts/test.ts --changed=12025981e5a304cdb6b1b54f525ba8554f623977 ./tests/clients/desktop-cloud-runtime.test.ts ./tests/clients/desktop-cloud-entry.test.ts ./tests/clients/desktop-cloud-management.test.ts ./tests/clients/desktop-cloud-network.test.ts ./tests/clients/desktop-cloud-recovery.test.ts ./tests/clients/desktop-chatgpt-config.test.ts -t 'optional listeners|cloud config|normalized self-listener|journal recovery|cache-flush failure|server-owned cloud lifecycle|ChatGPT desktop config|integrated cloud network CLI|source and packaged helper|management refuses|persistence failure|stopping the entry|client .* cancels only|journal before|unknown journals|OS-held helper lock|process fixture recovery stays' — 39 passed, 10 filtered out, 264 assertions.
• bun scripts/test.ts ./tests/routing/jev-quota-activation.test.ts ./tests/routing/jev-quota-core-boundary.test.ts ./tests/server/link-listener-lifecycle.test.ts ./tests/cli/cli-registry.test.ts ./tests/cli/cli-capabilities.test.ts ./tests/cli/cli-capabilities-arguments.test.ts ./tests/cli/cli-capability-data.test.ts ./tests/codex-integration/codex-shim-autorestore.test.ts ./tests/server/management-route-registry.test.ts ./tests/ci-workflows/skill-ocx.test.ts ./tests/test-layout.test.ts ./tests/test-layout-tooling.test.ts ./tests/ci-workflows/file-size-ratchet.test.ts ./tests/lab/core-lab-boundary.test.ts — 237 passed, 4,400 assertions.

Also passed on the final tree: bun run typecheck, bun run structure:check, bun run skill:surface:check (all nine generated files current), bun run privacy:scan, and git diff 12025981e5a304cdb6b1b54f525ba8554f623977 --check. Independent source review covered the upstream composition, both production fixes, and the test-fixture isolation correction.

GUI dependency installation succeeded this time, so the historical DNS dependency-install failure below no longer blocks these scoped wrapper runs. This is still a focused validation exception, not a full-suite pass: Unix-domain-socket integration is unavailable in this cloud sandbox. An unfiltered seven-file desktop run on the pre-fix merged tree produced 35 passes and 11 failures at Unix-socket listen before those integrations could execute. An unfiltered changed-test run on that pre-fix candidate was interrupted after review identified the two fixes and supplies no passing evidence. The c607e76 macOS run below covers the Unix-socket cases unavailable in that cloud run; it does not validate the newer 69e2db3 head. Privileged installation and live application acceptance remain unverified.

Historical 2026-10-20 isolated macOS validation (c607e76)

On 2026-10-20, the exact published head c607e76fdc37b1dd7d5210bcb8dffa1e5c322c38 and tree eb9b1f405383f7dd1d509b0e270ad1d98d9bb441 were verified in a fresh temporary checkout on macOS 26.5.1 (25F80), arm64, using Bun 1.4.3 (c6da4a4d3). The following official wrapper run completed with 50 passed, 0 failed, 0 skipped, 359 assertions; exit 0:

bun scripts/test.ts --parallel=1 ./tests/clients/desktop-cloud-install.test.ts ./tests/clients/desktop-cloud-runtime.test.ts ./tests/clients/desktop-cloud-management.test.ts ./tests/clients/desktop-cloud-recovery.test.ts ./tests/clients/desktop-cloud-entry.test.ts ./tests/clients/desktop-cloud-network.test.ts ./tests/clients/desktop-chatgpt-config.test.ts

Per-file passes: install 1, runtime 21, management 3, recovery 9, entry 4, network 5, config 7. This includes all 11 Unix-socket integration cases unavailable in the cloud sandbox, along with the current cancellation, loopback-alias and fixture-recovery regressions. These macOS cases overlap the cloud selection; they are not 50 additional distinct tests to add to the cloud total.

The run used a clean environment, temporary HOME/config/cache/runtime directories, repository bunfig/preload isolation, and locked root/GUI dependencies installed with lifecycle scripts disabled. Hosts files, journals and helper sockets were test-owned fixtures; launchctl and resolver flushing were mocked, TLS certificates remained fixture-only, and listeners used ephemeral loopback ports. No real system hosts/DNS/proxy/trust settings or user accounts were changed or used. Working-tree and staged diffs and git status --short were empty afterward, with no test processes left running. This establishes isolated macOS behavior, not real privileged-helper or signed-in application acceptance.

Historical 2026-10-18 cloud validation

Validated head: d9627d5a4c008ade3221546e00eef66b2ddb2116, integrating upstream dev at 8640c2f30edbd2fbb6947ed5c25e2793f5ae72a6. The merge-candidate tree tested on 2026-10-18 (0bb4fe7d7467938519154d675d3ba2d5c23b4944) was verified identical to the published head.

With Bun 1.4.3 (c6da4a4d3), repository bunfig/preload isolation, and HTTP_PROXY HTTPS_PROXY ALL_PROXY NO_PROXY http_proxy https_proxy all_proxy no_proxy unset, the following direct test runs passed: 269 distinct tests, 0 failures.

• bun test ./tests/clients/desktop-cloud-runtime.test.ts ./tests/clients/desktop-chatgpt-config.test.ts -t 'optional listeners|cloud config|journal recovery|cache-flush failure|server-owned cloud lifecycle|ChatGPT Desktop config' — 17 passed, 10 filtered out. These 17 selected cases are in the runtime file; the complete config file was run separately below.
• bun test ./tests/clients/desktop-cloud-network.test.ts ./tests/clients/desktop-cloud-management.test.ts ./tests/clients/desktop-cloud-entry.test.ts -t 'integrated cloud network CLI|source and packaged helper|management refuses|persistence failure|stopping the entry' — 8 passed, 2 filtered out.
• bun test --isolate ./tests/routing/jev-quota-activation.test.ts ./tests/routing/jev-quota-core-boundary.test.ts ./tests/server/link-listener-lifecycle.test.ts — 48 passed.
• bun test ./tests/clients/desktop-chatgpt-config.test.ts — 7 passed.
• bun test --isolate ./tests/cli/cli-registry.test.ts ./tests/cli/cli-capabilities.test.ts ./tests/cli/cli-capabilities-arguments.test.ts ./tests/cli/cli-capability-data.test.ts ./tests/codex-integration/codex-shim-autorestore.test.ts ./tests/server/management-route-registry.test.ts ./tests/ci-workflows/skill-ocx.test.ts — 128 passed.
• bun test --isolate ./tests/test-layout.test.ts ./tests/test-layout-tooling.test.ts ./tests/ci-workflows/file-size-ratchet.test.ts ./tests/lab/core-lab-boundary.test.ts — 61 passed.

Also passed: bun run typecheck, bun run structure:check, bun run skill:surface:check, bun run privacy:scan, and git diff 8640c2f30edbd2fbb6947ed5c25e2793f5ae72a6 --check. The surface check confirmed all nine generated files are current.

The two parameterized optional listeners retain cloud and JEV lifecycle with failed release=false/true cases cover cloud startup before JEV activation, cloud becoming active, release while JEV remains active, independent supervisor cleanup after a failed cloud release, removal of the JEV sink/live observer, and a second stop retrying recovery only when needed before reaching stopped. These use injected cloud handles and temporary filesystem state. The focused runtime and entry runs also cover journal recovery/cache-flush failure and cancellation while an upstream CONNECT handshake is pending.

Three separate mutation checks removed cloud startup, removed JEV activation, or moved JEV before cloud. Each produced two expected assertion failures with bun test ./tests/clients/desktop-cloud-runtime.test.ts -t 'optional listeners'; the original candidate was restored before final validation. These expected-red runs and the preliminary two-test green run are excluded from the 269 total. Independent source review covered the merge composition and regenerated CLI surface.

The official changed-test wrapper, bun scripts/test.ts --changed=8640c2f30edbd2fbb6947ed5c25e2793f5ae72a6 ./tests/clients/desktop-cloud-runtime.test.ts, exited 1 before running any tests: automatic installation of missing GUI dependencies failed with DNSResolveFailed while downloading @types/react@19.2.18 and @types/react-dom@19.2.4. The direct focused runs above do not establish a passing wrapper or full repository suite.

Historical isolated macOS validation

The 2026-10-17 macOS receipt applies only to earlier head f667754edd1f3897dbf96575e7a4cf20af2f8aa6: macOS 26.5.1, Apple Silicon, Bun 1.4.3; install/runtime/management/recovery/entry suites 32 passed, 0 failed, 0 skipped, 201 assertions, including all 11 Unix-domain-socket cases previously blocked by the cloud sandbox.

Those tests used temporary hosts/journal/socket fixtures and mocked launchctl operations. They did not change real system hosts/DNS/proxy settings, install a system service, or exercise a signed-in application. This receipt applies only to f667754; the separate 2026-10-20 run above applies only to c607e76. Neither is macOS validation of the current 69e2db3 head.

Remaining acceptance and CI gates

• Real privileged-helper/launchd installation, port 443 ownership, actual hosts/DNS and resolver-cache recovery, and signed-in ChatGPT/Codex application acceptance remain unverified. applicationHandshake remains unverified. Runtime startup/stop/crash recovery still needs real-system acceptance in addition to the isolated evidence above.
• The renderer /wham/usage gate in [Bug] Codex App (macOS): send button disabled at quota exhaustion - the #5947 intercept never sees the gate reads (they come from the bundled app-server) #6196 is a separate acceptance case; this fixed-host relay has not established that it is resolved, as noted in the earlier intake.
• At 2026-10-21 06:09 UTC, current-head 69e2db3 Cross-platform CI, Catalog async contracts, and React Doctor were completed / action_required, each with zero jobs executed. They require maintainer fork-workflow approval. Prior-head c607e76 Catalog and React Doctor passed after approval; Cross-platform attempt 2 failed only the JSON capability contract in shard 1/4 plus its aggregate check. Shards 2/4, 3/4 and 4/4 passed; later shard-1 batches and macOS/Windows jobs did not run. Those results are not current-head CI evidence.
• At 2026-10-21 06:09 UTC, current-head PR hygiene reports unsponsored_surface for src/server/management-api.ts; target enforcement is still queued. The privileged helper and management boundary require the owner's OS-network/trust/recovery decision and maintainer security review. Sponsorship must follow that review; local source review does not establish maintainer acceptance.

This remains a draft submission with focused validation. The full repository suite, current-head hosted cross-platform validation, and real-system acceptance remain outstanding.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Review readiness checklist

• Required local validation passed; commands, results, and any full-suite exception are documented.

• I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚠️ Deterministic hygiene checks failed.

• unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: src/server/management-api.ts.

[github-actions]

⏳ DRAFT

• hygiene: unsponsored_surface.

What to do

• Fix unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: src/server/management-api.ts.
• Tick all four boxes in the PR description once you're done (currently 1/4).

Review readiness checklist

• ⬜ Required local validation passed; commands, results, and any full-suite exception are documented.
• ✅ I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).
• ⬜ I resolved all correct Codex and CodeRabbit findings.
• ⬜ My PR is ready for review.

1/4 boxes ticked.

This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.
@lcxhh521 Tick the boxes once required local validation has passed with commands, results, and any full-suite exception documented, your branch is on the latest dev commit, and every correct Codex and CodeRabbit finding is resolved.

[lcxhh521]

Validation update for head f667754:

Two follow-up fixes are now on this branch:

• c6a5d90: preserve the recovery obligation when startup fails after changing the mapping or flushing the resolver. Disable/stop must still attempt recovery, and must not report a clean disabled state until recovery succeeds.
• f667754: cancel in-flight upstream proxy dialing when the relay entry stops, including a pending CONNECT handshake, rather than leaving it alive until timeout.

Isolated macOS validation on 2026-10-17:

• macOS 26.5.1, Apple Silicon, Bun 1.4.3.
• desktop-cloud install/runtime/management/recovery/entry suites: 32 passed, 0 failed, 0 skipped; 201 assertions.
• All 11 Unix-domain-socket cases previously blocked by the cloud sandbox passed on the Mac.
• Tests used temporary hosts/journal/socket fixtures and mocked launchctl operations. They did not modify real system hosts/DNS/proxy settings, install a system service, or exercise a signed-in ChatGPT/Codex application.

This is isolated test evidence, not completed end-to-end system acceptance. Real launchd installation, privileged port 443, actual hosts/DNS recovery, and signed-in application acceptance remain unverified.

The current GitHub gates still require maintainer action: PR hygiene/target enforcement report unsponsored_surface for src/server/management-api.ts, while the functional workflows are awaiting approval (action_required, no jobs executed). Could a maintainer review the management API/security-sensitive surface, apply maintainer-sponsored if appropriate after that review, and approve the pending CI workflows?

[Ingwannu]

Intake at d9627d5a4c. The macOS 32-test receipt is explicitly for earlier head f667754 and mocked hosts/journal/socket/launchctl fixtures; it does not validate the latest head or actual privileged installation/443 binding, resolver recovery and signed-in applications. Keep that boundary in Verification after subsequent pushes. Current hygiene annotation is unsponsored_surface; this needs the owner's OS-network/trust/recovery decision, not a label added solely to clear CI. #6196's renderer /wham/usage gate is a separate acceptance case and is not established by this different fixed-host relay. Keep Draft, with runtime startup/stop/crash recovery obligations and cancel-during-CONNECT covered at the exact head. No hosts, DNS, proxy, launchd, certificate or live application changes were made here.

[Ingwannu]

Follow-up intake at c607e76fdc37b1dd7d5210bcb8dffa1e5c322c38 against dev 12025981e5a304cdb6b1b54f525ba8554f623977. The refreshed branch adds cancellation of abandoned pending CONNECT/SOCKS dials and loopback-alias recursion controls, with explicit configured/active/unavailable states. This remains a macOS privileged hosts/helper and lifecycle surface, including src/server/index.ts (owner-only CODEOWNER). Current hygiene/enforce-target failures must be resolved by the author before readiness; do not treat a focused mock TLS receipt as installation/recovery acceptance on a real Mac. Keep the fixed-domain ownership journal, administrator consent, partial-recovery obligation and no-clean-disabled-state-before-recovery contracts. No helper installation, hosts edit, live tunnel or sponsorship was performed here.

[lcxhh521]

Following up on the current head c607e76: the latest PR hygiene and enforce-target job logs both report only unsponsored_surface. The gate identifies src/server/management-api.ts and asks for maintainer-sponsored after security review.

The documented 276-test cloud run and 50-test isolated macOS run are focused validation, not full-suite or real privileged-system acceptance. Actual helper/launchd installation, port 443 ownership, hosts/DNS recovery and signed-in application acceptance remain unverified. The PR remains Draft.

Could a maintainer clarify the next steps for security and owner review, including the owner-only src/server/index.ts boundary, and apply sponsorship only if that review supports it? The exact-head Cross-platform CI, Catalog async contracts and React Doctor runs also still require fork-workflow approval. If there are concrete author-side code changes or acceptance evidence needed before either decision, please identify them.

[Ingwannu]

Approved execution of the existing fork workflows at c607e76fdc37b1dd7d5210bcb8dffa1e5c322c38: Cross-platform CI, Catalog contracts, and React Doctor. This follows execution-trust inspection of the diff and unchanged read-only hosted workflow/install surfaces; it does not install the helper or authorize a live hosts/DNS/port-443 change. Sponsorship, privileged-boundary review and the owner-only src/server/index.ts decision remain separate. No sponsorship label or waiver was added.

[lidge-jun]

Thank you for the work here. We're closing this to keep the review queue manageable: a system network helper is outside the current scope, and the branch conflicts with dev and fails CI. You're welcome to reopen this or open a smaller PR against dev.