Repository navigation
[WRONG BRANCH] release: promote frozen tip 03bcf789e9 to main as 2.92.0 - #7634
Merged
Merged
Conversation
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Stop fetchWithTransientRetry's same-target transient ladder when the upstream gateway status carries the exact x-should-retry: false verdict, returning the original response with its body intact. Carries #7505. Signed-off-by: Platinum-Scripts <133908028+Platinum-Scripts@users.noreply.github.com> Co-authored-by: Platinum-Scripts <133908028+Platinum-Scripts@users.noreply.github.com>
* chore(providers): deprecate mimo-free * fix(providers): narrow mimo-free deprecation evidence and cover init discovery State the observed failure (the configured mimo-auto is rejected with 400 "Unsupported model") instead of claiming the vendor ended access for every model, and record the retained-vs-new-discovery contract in the adapter structure docs. The deprecated-entry invariant now also asserts the init menu excludes the entry, closing the one surface CodeRabbit found unverified.
* fix(service): preserve unrelated authenticated loopback proxies * fix(service): recognize owned intercept URLs across port changes --------- Co-authored-by: JUN <jun@lidgeai.com>
* fix(messaging): reject macOS ACL-exposed state * fix(messaging): close temporary files when ACL inspection fails * test(messaging): reject unexpected descriptor cleanup errors * fix(messaging): report uncertain publication after ACL probe failure * test(messaging): verify native ACL refusal by stable error code * fix(messaging): classify temporary ACL refusal before publication --------- Co-authored-by: JUN <jun@lidgeai.com>
* fix(cli): revalidate usage compare runtime * fix(cli): bind local usage reads to attested capabilities * test(cli): attest usage comparison workflow requests * fix(cli): retain attested usage failure diagnostics --------- Co-authored-by: JUN <jun@lidgeai.com>
* fix(codex): distrust picker freshness without binding evidence * docs(codex): describe desktop restart as an attempt * fix(codex): prefer known stale picker evidence --------- Co-authored-by: JUN <jun@lidgeai.com>
…7550) * docs(subagents): explain how spawn_agent fills its five model slots When fewer than five models are featured, Codex fills the remaining spawn_agent slots with the next picker-visible rows by priority. Document which rows those are (routed rows at priority 5 alphabetically, or account-qualified native rows when account selectors exist), how to control the list, and that opencodex v2 guidance never names the filler rows. English plus the seven existing locale translations. Refs #7366 * docs(subagents): describe the spawn_agent window as up to five The FAQ said Codex always fills five slots; with fewer eligible picker rows (for example after v2 skips "disabled" rows) it lists fewer. Applied to every locale copy. Refs #7366
…es not wait on a cold PowerShell (#7548) * fix(windows): read the effective SID in-process instead of a cold PowerShell child On Windows x64 the service mutation lock resolved the token SID by spawning powershell.exe, and a cold start on a loaded runner exceeded the 30s budget, so ocx service install refused (#7544). Read the SID through advapi32 via bun:ffi, mirroring the LocalAppData known-folder path. PowerShell stays only where FFI is unavailable (ARM64); native API failures refuse without falling back. * test(layout): register the current-SID test in the codex collision shard layout.json sits one line under the 2000-line file-size ratchet; the entry added in the previous commit pushed it to 2000 and macos 3/3 failed with NEW_OVERSIZED. Move the entry to the existing codex-integration explicit shard so layout.json is unchanged from dev.
…hem (#7556) * fix(antigravity): route models only to accounts whose roster serves them An Antigravity account whose fresh discovered roster omits the requested model is no longer a fallback candidate. Preference, 429 rotation and auth-refusal rotation answer no account instead of reusing it, and the transport replaces an omitting planned account with a usable listing or not-yet-discovered sibling when proactive preference is enabled, or refuses locally with 403 permission_denied before any upstream send. Refs #7500 * fix(antigravity): recheck the model roster on every OAuth admission The roster check ran only on the initial admission, so a 401 recovery or failover rebind that followed a concurrent selection change could still send to an account whose roster omits the model. commitResolvedOAuthSelection now refuses such a candidate, and the initial path answers with the explicit 403 before committing. Refs #7500 * fix(antigravity): distinct refusal when the failover replacement is unusable With failover on, an omitting account that still resolved means the chosen sibling could not be used. The refusal no longer advises enabling a setting that is already on; it says the replacement could not be used and to retry. Refs #7500 * test(layout): register the roster-routing test in a shard to stay under the layout.json size cap
* feat(vertex): resolve each API key's project with project "auto" An express-mode Vertex API key belongs to one Google Cloud project, but the projectless express endpoint routes to a default region where global-only models such as gemini-4-argon return 404. #7266 fixed this for a single configured provider.project, which cannot serve an apiKeyPool whose keys belong to different projects: every key but one then gets 403. provider.project: "auto" resolves the project of the key each request actually sends. One countTokens call for a nonexistent model to the fixed aiplatform.googleapis.com authority returns a NOT_FOUND that names projects/<number>/; that number is cached per key digest (64-entry LRU), concurrent first requests share one probe, and the request then takes the ordinary project endpoint and per-project replay namespace. A probe that does not reveal a project is not cached and that request uses express, so Google's own 401/403/429 still drives key-pool failover. ADC rejects "auto". Configurations without "auto" are unchanged. * fix(vertex): cancel non-404 probe bodies and normalize auto project case * refactor(vertex): use Bun.CryptoHasher for API key cache digest * fix(vertex): bound probe body and honor request transport and cancellation * fix(vertex): avoid consuming inference admission hooks during project probe * test(layout): register the Vertex key-project test in a shard to stay under the layout.json size cap * docs(vertex): say that failed key-project lookups are probed again --------- Co-authored-by: JUN <jun@lidgeai.com>
…the download section (#7571) * docs(site): show the SignPath attribution and code signing policy on the download section * docs(site): translate the code signing policy link on the French landing page
…d target (#7567) * feat(jev): opt-in session pin keeps a JEV combo session on its decided target (#7525) * fix(jev): end the session pin on every failure path and keep pinned turns in request totals * fix(jev): fence session pins against in-flight writers after a failure * fix(jev): refuse stale pin writers once a failure fence was evicted --------- Co-authored-by: 주니 <junny@juniui-Macmini.local>
Carries #7375 onto current dev and closes the remaining snapshot phase gap for id-less gateway messages. Co-authored-by: lllllhx-lab <272776136+lllllhx-lab@users.noreply.github.com>
…7576) * fix(providers): backfill Token Plan output limits on roster refresh The stale roster migration filled context windows and default efforts for the dated IDs it adds, but not output limits. A custom catalog row passes the saved provider straight to routedMaxOutputTokens, so a row that already had a partial modelMaxOutputTokens map published deepseek-v4.1-flash-1017 without the registry limit whenever discovery and generated metadata had none. The refresh now fills the added IDs into an existing map from the Token Plan seed and keeps any value the operator already saved. Refs #7555 * fix(providers): backfill output limits on already-refreshed Token Plan rows A row the earlier refresh already moved to the current roster no longer matches the previous seed, so it never reached the new output-limit fill and its partial modelMaxOutputTokens map stayed incomplete. A row whose list is exactly the current roster now gets only its missing output limits; operator values and absent maps stay untouched, and windows and efforts are not revisited because the earlier pass already filled them. Refs #7555
…7584) api.moonshot.ai rejects role 'developer' with a 400. The native /v1/chat/completions passthrough only folds the role on an explicit foldDeveloperRoleToSystem record, so let registry entries record it (seeded and backfilled like openaiChatEofTolerance, user value wins) and record true for moonshot.
#7523) (#7566) Carries #7523 onto current dev: retained plaintext reasoning is bound to the admitted caller principal, including bridge combo children and 404 failover; unknown principals fail closed. Maintainer security review posted on the PR. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
* fix(codex): stop guardian refresh of grants persisted as revoked The token guardian's pool sweep decided only from expiresAt and warmup age, so an account whose grant was already stored as terminally revoked (lastCodexValidationTerminal + failed) was re-posted to the token endpoint every time its backoff window lapsed or the process restarted. Skip those records the same way the quota probe already does (source-linked credentials exempt); a re-login or completed validation drops the marker and readmits the account. The pool refresh failure line now carries the redacted p<hex6> label so a multi-account pool can be triaged from the log. Refs #7592 * fix(codex): log the pool account's durable label on refresh failure Normally added pool accounts carry a random durable logLabel, which the dashboard and usage log show; hashing the id produced a different p<hex6>. Resolve the configured label for both the token-endpoint line and the backoff line, keeping the hash only for legacy rows without one. Refs #7592
…7601) * fix(cli): keep the stored strategy when combo set replaces targets `ocx combo set <id> --targets ...` without --strategy sent a fresh failover body, so an existing JEV combo stopped being JEV and lost its decision method, quota policy and session pin. Replacing targets now starts from the stored row like --targets-file and partial edits do: only the target list changes, the stored strategy and its JEV settings stay, and a new combo still defaults to failover. Strategy-only flags are checked against the stored strategy, and a JEV refusal of the new targets says which kept policy the targets were checked against. Refs #7579 * fix(cli): show the kept-JEV message only for target or JEV refusals A combo validation 400 from PUT /api/combos now names the first invalid top-level field in `field`. `ocx combo set --targets` uses it to show the kept-JEV message only when the refusal concerns the targets or a JEV setting; a rename or alias conflict keeps the generic message. The CLI invariant in structure/cli-management.md and the decision-flag wording now describe the effective strategy. Refs #7579
) * fix(catalog): send native ultra effort as max on the wire (#7590) The ChatGPT backend accepts reasoning efforts none..max and rejects ultra with HTTP 400. nativeEffortClamp returned null whenever the pinned upstream ladder listed the requested effort, and the gpt-6-astra and gpt-6.1-sol ladders list ultra. The parser's ultra->max fold also only reached options.reasoning, so the passthrough still serialized the caller's raw ultra. Fold ultra to max in the clamp and feed the raw ultra to it from core-normalize so the wire body is rewritten on /v1/responses, /v1/chat/completions and steering frames. Refs #7590 * docs(catalog): qualify the native ultra wire value by model * test(layout): keep layout.json under the file-size ratchet
…7582) * fix(desktop): revoke usage trials after identity verification fails * test(desktop): verify foreign identity excludes bound streams
…#7497, #7498) (#7541) * perf(chat): avoid rescanning fragmented SSE carry Co-authored-by: Platinum-Scripts <133908028+Platinum-Scripts@users.noreply.github.com> * perf(chat): retain carry fast path within file-size cap Co-authored-by: Platinum-Scripts <133908028+Platinum-Scripts@users.noreply.github.com> * perf(sse): avoid flattening fragmented block carry Co-authored-by: Platinum-Scripts <133908028+Platinum-Scripts@users.noreply.github.com> * fix(sse): keep block-buffer boundary state in step with the carry Record the cached final code unit and scan eligibility as soon as the fragment joins the buffer, before the budget commit, so a throwing commit cannot leave them describing an older carry. Co-authored-by: Platinum-Scripts <133908028+Platinum-Scripts@users.noreply.github.com> --------- Co-authored-by: StreamClash Dev <dev@streamclash.local> Co-authored-by: Platinum-Scripts <133908028+Platinum-Scripts@users.noreply.github.com>
) * docs(cli): an existing JEV combo keeps its stored decision method Refs #7579 * docs(models): scope the ultra wire statement to native ChatGPT requests
Check the first resolved combo target against the locked OpenAI source after the existing pre-admission preview. Keep the hard-lock rewrite classification unchanged. Cover sampled-provider admission followed by a forbidden model pick, and describe taken events as guard admission rather than upstream contact or billing.
* feat(quota): read Abliteration credit balance from /v1/credits Abliteration API keys reported quotaMode unsupported. Probe the documented GET /v1/credits endpoint for any provider whose base URL is the canonical api.abliteration.ai origin and publish total_credits/total_usage as creditsUsd for display and routing. * fix(quota): clear the Abliteration row on an authoritative zero-credit reply A well-formed /v1/credits reply with zero total credits now returns AUTHORITATIVE_EMPTY_QUOTA so the previous bar and routing projection are dropped; malformed replies still keep the last-good row. Addresses CodeRabbit review.
…story on replay (#7573) * fix(responses): always send a title on url_citation and repair old history on replay A web-search source without a title produced a url_citation with no title key. Replaying that message to OpenAI Responses, most visibly through /responses/compact, fails every time with "Missing required parameter: input[N].content[0].annotations[M].title". Generation now falls back to the URL, and the OpenAI-bound request projection fills title and integer start_index/end_index on url_citation annotations already sitting in history. Other gateways are left alone. * fix(responses): reject negative and unsafe url_citation indexes in replay repair
#7606) Bun 1.4.2's bundled root store still trusts emSign ECC Root CA - G3, which signed the eight eMudhra intermediates whose keys are recoverable (October 2026). Bun 1.4.4 ships NSS 3.131.1 roots without it. NODE_USE_SYSTEM_CA does not help: bundled roots stay trusted alongside. Runtime pin only; testRunnerBun stays 1.4.3.
…son stays under its size cap (#7607)
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Contributor
|
Important Review skippedToo many files! This PR contains 356 files, which is 56 over the limit of 300. To get a review, reduce the PR to 300 files or fewer by splitting it into smaller PRs or changing its base branch. Usage-priced reviews support at most 300 files. ⚙️ Run configuration
⛔ Files ignored due to path filters: 3
📒 Files selected for processing: 356
You can disable this status message by setting the
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
|
✅ Deterministic PR hygiene checks passed. |
github-actions
Bot
changed the title
Contributor
⏳ DRAFT
What to do
Its title has been prefixed with |
This was referenced Oct 27, 2026
Merged
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Promotes the frozen
devcandidate03bcf789e95cc01fb809b624e4fb109e351308ebtomainas stable 2.92.0.The promotion head merges in
mainancestry with theoursstrategy, so its tree is exactly the candidate tree. Candidate version sources already say 2.92.0. Dev pre-move to 2.93.0 is merged (#7633).Regression HOTL on mac-studio (
mcp:fa2c8da9) reported VERDICT: PASS for this tip. Cross-platform CI green: https://github.com/lidge-jun/opencodex/actions/runs/39920316970Jun approved UX for this train (WorkBuddy credits, Abliteration meter, SignPath landing, trial revoke, link readiness, etc.).
Post-freeze commits left on
devfor the next train (not in this promote): #7527, #7615.Non-blocking issues filed during regression: #7611, #7612, #7613.
Checklist