Repository navigation
[WRONG BRANCH] release: promote frozen tip 2606f6f922 to preview as 2.93.0-preview.20261027 - #7796
Merged
Merged
Conversation
…continuation tests and MiMo envelope repair (#7122, #7152, #7068, #7214) (#7218) Carried from #7122, #7152, #7068, #7214 (one commit per source PR, original authors preserved). #7095 held out. Remote exact-head validation (hosted GitHub Actions stalled; local tests not run by maintainer rule): union candidate codex/prr-integ-6 (368006f, tree 27fdc37) on mini (Windows) and lidge (Linux), typecheck + full suite, compared with base-dev 4ae4936 on each host. Co-authored-by: Bortlesboat <169967362+Bortlesboat@users.noreply.github.com> Co-authored-by: AK <info@atelier-sai.jp> Co-authored-by: Aditya Rawat <adirwt852@gmail.com> Co-authored-by: shirruy <shirruy@users.noreply.github.com> Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
…, #7124) (#7219) Carried from #7134, #7124 (one commit per source PR, original authors preserved). Remote exact-head validation (hosted GitHub Actions stalled; local tests not run by maintainer rule): union candidate codex/prr-integ-6 (368006f, tree 27fdc37) on mini (Windows) and lidge (Linux), typecheck + full suite, compared with base-dev 4ae4936 on each host. Co-authored-by: Epinephrine <luvs01@hanmail.net> Co-authored-by: Flowershangfromthebranches <152056395+Flowershangfromthebranches@users.noreply.github.com>
…#6718) (#7163) Carried from #6718. Remote exact-head validation (hosted GitHub Actions stalled; local tests not run by maintainer rule): union candidate codex/prr-integ-6 (368006f, tree 27fdc37) on mini (Windows) and lidge (Linux), typecheck + full suite, compared with base-dev 4ae4936 on each host. Co-authored-by: Ingwannu <ingwannu@users.noreply.github.com> Co-authored-by: baozheng <17285571+bi-boo@users.noreply.github.com> Co-authored-by: bi-boo <bi-boo@users.noreply.github.com>
…6937) (#7135) Carried from #6937. Remote exact-head validation (hosted GitHub Actions stalled; local tests not run by maintainer rule): union candidate codex/prr-integ-6 (368006f, tree 27fdc37) on mini (Windows) and lidge (Linux), typecheck + full suite, compared with base-dev 4ae4936 on each host. Co-authored-by: GSL-R <174104911+GSL-R@users.noreply.github.com>
Contributed by @lcxhh521. Remote exact-head validation (hosted GitHub Actions stalled; local tests not run by maintainer rule): union candidate codex/prr-integ-6 (368006f, tree 27fdc37) on mini (Windows) and lidge (Linux), typecheck + full suite, compared with base-dev 4ae4936 on each host. Co-authored-by: lcxhh <lcxhh521@gmail.com>
…evidence fixes (#7191, #7204, #7187, #7209, #7175, #7185, #7193, #7197, #7198) (#7224) Carried from #7191, #7204, #7187, #7209, #7175, #7185, #7193, #7197, #7198 (one commit per source PR, original author preserved). Security review follow-up: the Anthropic 402 combo cooldown now validates the sending credential's ownership before cooling an account. Remote validation (hosted GitHub Actions unreliable; local tests not run by maintainer rule): union candidate codex/prr-integ-8 = dev c03eafd + #7224 + #7223 + #7225 + #7217 + #6454 + #6594 plus a Gentle Shell import-cycle fix (integ-9 e1f289c: typecheck + full suite on mini (Windows) and lidge (Linux), compared with the same host's dev runs) and a test-only Windows path-escaping fix for the reasoning-retention routing test (integ-10 0d4cba7, tree a2b309a: that file re-run on both hosts). Co-authored-by: Vadym O <bolein95@gmail.com>
…d Gentle Shell (#7195, #6767, #6691, #7213) (#7223) Carried from #7195, #6767, #6691, #7213 (one commit per source PR, original authors preserved). #4649 held for security review. Security review follow-up: the Windows picker relay binds only when picker activation or selected-profile recovery needs it. Remote validation (hosted GitHub Actions unreliable; local tests not run by maintainer rule): union candidate codex/prr-integ-8 = dev c03eafd + #7224 + #7223 + #7225 + #7217 + #6454 + #6594 plus a Gentle Shell import-cycle fix (integ-9 e1f289c: typecheck + full suite on mini (Windows) and lidge (Linux), compared with the same host's dev runs) and a test-only Windows path-escaping fix for the reasoning-retention routing test (integ-10 0d4cba7, tree a2b309a: that file re-run on both hosts). Co-authored-by: xianhongtao <xianhongtao2022@outlook.com> Co-authored-by: 김민우 <minwokim@gmarket.com> Co-authored-by: hyuntae park <bluestar218ht@gmail.com> Co-authored-by: randalo-trc <randalo@trociuk.com>
…s and usage metering (#7194, #7201, #7176, #7177, #7178, #7179, #7199, #7202, #7189, #7190, #7200) (#7225) Carried from #7194, #7201, #7176, #7177, #7178, #7179, #7199, #7202, #7189, #7190, #7200 (one commit per source PR, original author preserved). #7205 held: replay can relocate server-tool exchanges into an earlier assistant turn. Remote validation (hosted GitHub Actions unreliable; local tests not run by maintainer rule): union candidate codex/prr-integ-8 = dev c03eafd + #7224 + #7223 + #7225 + #7217 + #6454 + #6594 plus a Gentle Shell import-cycle fix (integ-9 e1f289c: typecheck + full suite on mini (Windows) and lidge (Linux), compared with the same host's dev runs) and a test-only Windows path-escaping fix for the reasoning-retention routing test (integ-10 0d4cba7, tree a2b309a: that file re-run on both hosts). Co-authored-by: Vadym O <bolein95@gmail.com>
#6759, #6930, #6603, #6758) (#7217) Carried from #6759, #6930, #6603, #6758 (one commit per source PR, original authors preserved). Retention across account/model switches is opt-in and defaults off. Remote validation (hosted GitHub Actions unreliable; local tests not run by maintainer rule): union candidate codex/prr-integ-8 = dev c03eafd + #7224 + #7223 + #7225 + #7217 + #6454 + #6594 plus a Gentle Shell import-cycle fix (integ-9 e1f289c: typecheck + full suite on mini (Windows) and lidge (Linux), compared with the same host's dev runs) and a test-only Windows path-escaping fix for the reasoning-retention routing test (integ-10 0d4cba7, tree a2b309a: that file re-run on both hosts). Co-authored-by: fliaping <269832017@qq.com> Co-authored-by: panyuanyuan <panyuanyuan@hetao101.com> Co-authored-by: yuanyuanlove <yuanyuanlove@users.noreply.github.com>
…modules) (#6454) Contributed by @lcxhh521; refreshed onto dev by the maintainer (dev merge, deferred quota account-row edge to keep the cycle baseline from growing). Remote validation (hosted GitHub Actions unreliable; local tests not run by maintainer rule): union candidate codex/prr-integ-8 = dev c03eafd + #7224 + #7223 + #7225 + #7217 + #6454 + #6594 plus a Gentle Shell import-cycle fix (integ-9 e1f289c: typecheck + full suite on mini (Windows) and lidge (Linux), compared with the same host's dev runs) and a test-only Windows path-escaping fix for the reasoning-retention routing test (integ-10 0d4cba7, tree a2b309a: that file re-run on both hosts). Co-authored-by: lcxhh <lcxhh521@gmail.com>
…59 -> 35) (#6594) Contributed by @lcxhh521 (stacked on #6454); refreshed onto dev by the maintainer. Remote validation (hosted GitHub Actions unreliable; local tests not run by maintainer rule): union candidate codex/prr-integ-8 = dev c03eafd + #7224 + #7223 + #7225 + #7217 + #6454 + #6594 plus a Gentle Shell import-cycle fix (integ-9 e1f289c: typecheck + full suite on mini (Windows) and lidge (Linux), compared with the same host's dev runs) and a test-only Windows path-escaping fix for the reasoning-retention routing test (integ-10 0d4cba7, tree a2b309a: that file re-run on both hosts). Co-authored-by: lcxhh <lcxhh521@gmail.com>
…trols (#7211, #7212, #6381, #7172, #6152) (#7222) Carried from #7211, #7212 (both opened against main; carried onto dev), #6381, #7172, #6152 (one commit per source PR, original authors preserved). Custom provider routing consent defaults to No and the CLI update plan is read-only. Remote validation (hosted test shards passed on the head; local tests not run by maintainer rule): exact head b4d6376 (contains dev 7a42860) typecheck + full suite on lidge (Linux) and mini (Windows), compared with the same host's dev 7a42860 runs. Security review of the #7172/#6152 carries: PASS. Co-authored-by: Matt Van Horn <mvanhorn@users.noreply.github.com> Co-authored-by: lcxhh <lcxhh521@gmail.com> Co-authored-by: xianlubird <xianlubird@gmail.com> Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
Restore the keep-native row that #7220 removed, while keeping its uniform settings rows and the auto-review override. Standard rows span the grid. Only the v2 qualifier sits in the right column, with a single-column fallback below 1160px. The four keep-native-v1 GUI tests that fail on dev 4ed45e9 pass on this head. Co-authored-by: sechmachine <97589681+sechmachine727@users.noreply.github.com> Co-authored-by: Jonathan Li <47408717+jonathanli12@users.noreply.github.com>
API-key cooldown from a 401/429 is now charged only to the distributed key that was actually sent. Ownership is captured at the physical fetch on native Responses, compact, Chat and Messages. Requests whose credential was changed after selection no longer cool down a pooled key. Configured same-key 429 retries are unchanged. Co-authored-by: GSL-R <174104911+GSL-R@users.noreply.github.com>
On Windows, homedir() follows USERPROFILE. The owner-registry and service-state isolation fixtures changed that variable to a worker home while still expecting the registry and mirror seeded in the startup home. The fixtures now keep the default home stable while switching OPENCODEX_HOME, and every existing assertion is retained. Product behavior is unchanged.
…ns (#7238) #7216 added native wire pins for OpenCode Go Gemini and Qwen models. An existing config with a formerly valid override, such as modelAdapters["qwen3.7-plus"] = "openai-chat", then failed validation, and the whole saved config fell back to defaults. Both the runtime load path and diagnostics now normalize these overrides before validation, so the native pin wins and providers, accounts and routing survive. Strict validation still applies to new writes and malformed values. Co-authored-by: Georgiy Bukharov <souljorje@gmail.com> Co-authored-by: norths7ar <guicaitiandu@gmail.com>
The import-cycle scanner now canonicalizes its root before scanning. Bun resolves import targets to physical paths, so on macOS (/var -> /private/var) and under any symlinked root, cycle edges pointed at missing nodes and directory-index cycles went unreported. Adds symlinked-root coverage for ts, tsx and mts directory indexes. Co-authored-by: lcxhh <lcxhh521@gmail.com>
#7239) When a translated combo compaction fails over to a canonical native target, the readable reasoning withheld before compaction is now returned after the native compaction item, or as an archive notice whose file survives a successful replacement. Previously it was dropped and its archive deleted. Cleanup on failure and cancellation is unchanged. Co-authored-by: panyuanyuan <panyuanyuan@hetao101.com> Co-authored-by: yuanyuanlove <yuanyuanlove@users.noreply.github.com>
A Windows Claude Desktop picker that started with intent off previously returned 503 picker_proxy_unavailable on a later enable. The controller now stays dormant and binds the picker relay under its enable lock after the mode, integration and preference checks. Startup stays relay-, timer- and credential-free while intent is off. Concurrent enables share one relay, and shutdown closes it. Co-authored-by: hyuntae park <bluestar218ht@gmail.com>
Rust 1.99 clippy (-D warnings) rejects the hand-written no-op waker in the desktop process_spawn test, which failed the desktop shell job on main and dev. The test now uses std::task::Waker::noop(), stable since Rust 1.85, under the crate's Rust 1.88 minimum.
Approved custom Codex provider injection now rechecks the persisted integration intent under the Codex/config locks, so it can no longer undo integration OFF. Approval-record inspection, stale native-journal cleanup and URL publication share one write section, which fixes an unlocked read that #7222 added. The shared Codex config write lock now records the destination inode after acquiring the lock. Before, a writer that replaced the file just ahead of acquisition left a stale witness, and concurrent syncs failed. ocx usage compare binds both windows to one connection, usage owner, destination and credential fingerprint, and aborts with a retry message when they differ. Co-authored-by: Matt Van Horn <mvanhorn@users.noreply.github.com> Co-authored-by: xianlubird <xianlubird@gmail.com>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
…7252) The carry-attribution window is capped at 80 characters and could cut a reference in half. The #7223 subject "carry ... (#7195, #6767" was read as #676, an unrelated PR, so the hygiene gate demanded a co-author trailer for the wrong person (seen on the 2.87.0 promotion #7249). When no sentence boundary falls inside the window, the window now finishes a number that started before the cap. Sentence and newline bounds, qualified-reference handling, and the exclusion of references that start after the cap are unchanged.
#7230, #7231, #7232, #7233) (#7236) Carries four vadymhimself follow-ups onto dev: - #7230: the combo sibling check peeks the round-robin ring without advancing it, while the failed account's cooldown is still recorded. - #7231: a Codex account move after a 402 is recorded as quota recovery, separate from 429 rate recovery, through persistence, metrics, analytics and Logs labels. - #7232: the Anthropic server-tool input buffer is capped on the incoming fragment (4,096 code units), so one oversized fragment cannot exceed the bound. - #7233: refused-then-served usage rows are priced from the served attempt, and client cancels keep an unknown cost. A usage-less refusal never changes a row's pricing classification. A row with a leading refusal summarizes exactly like the same row without it, under dev's existing partial-cost contract. Co-authored-by: Vadym O <bolein95@gmail.com>
When the Codex startup intent gate is closed (Codex OFF, a sibling, or a hub without local integration), startup now skips the two native-Codex service-manager ownership inspections and native-main preparation. On Windows those inspections run synchronous Task Scheduler/service children before the runtime record is published, and the disabled lifecycle never uses their answers. Enabled startup keeps both ownership decisions, including the fresh second listing that detects a concurrent installer. ACL hardening, live-owner discovery and startup deadlines are unchanged. The claim is limited to removing unnecessary probes; the reported 45-second owner-start timeout is not shown to be resolved.
… lane (carry #7205) (#7251) Carries vadymhimself #7205, including its newest head 53a3ca2. On the translated Claude lane, an Anthropic server-tool exchange (web search/fetch) from history is replayed only into the assistant turn that produced it. An anchor that occurs exactly once replays. An ambiguous (repeated) anchor drops the exchange, so a later identical turn can no longer take over an earlier exchange. A result is replayed only after its matching call with the same id and type earlier in the turn. A call must carry a plain-object input with a nonblank query or url. Orphan results never synthesize a call. Anything that cannot be proven valid is dropped, which is the pre-#7205 behaviour. The anchor turn's text is preserved byte-for-byte. Co-authored-by: Vadym O <bolein95@gmail.com>
…yed history (#7254) * fix(google): stop replayed Gemini progress text from spreading leaked planning * fix(google): scope progress trimming to pre-call text and real sentence ends * fix(google): end the progress lead at other scripts sentence terminators
Co-authored-by: Ingwannu <ingwannu@users.noreply.github.com>
Co-authored-by: Juan de Urtubey <juan@develophealth.io>
) successCostUsd passed the aggregate `unreported` status to estimateRequestCost, so a usage-less 429 before a measured send stayed unpriced in /api/routing-analytics while /api/usage priced it. It now reuses computeEntryCost, the same attempt-aware pricing. Co-authored-by: Claude Code <noreply@anthropic.com>
Carries the buffered half of #7711 onto dev for #7456. A buffered native combo child that ignores a required tool_choice now fails with required_tool_contract_unsatisfied (502, fallback-eligible), or 400 with retry suppression after a hosted effect. Streaming enforcement remains open. Co-authored-by: chenyb999-zhcn <259507278+chenyb999-zhcn@users.noreply.github.com>
…ate (#7747) A dashboard update with restart ran a full ocx stop, which restored native Codex and the pristine catalog. A Codex app-server that loaded the catalog before the new proxy's first sync treated routed models as unknown, fell back to generic metadata and could loop on compaction. When the update job will restart the proxy, the update's stop now keeps an exact handover receipt (exit 81) once the stopped proxy confirmed the deferral or a clean service-manager stop took it down; the old proxy exits as a recycle; both updater lanes proceed past 81 under the existing gates; the restarted proxy adopts the handed-over journal during startup recovery and discharges the receipt after its first published sync. An ordinary stop, an update without restart, and a startup with Codex integration off behave as before. Closes #7423
…#7621) * fix(codex): renew credit evidence for namespace-bound Direct accounts * fix(test): supply required port in native pool fixture * test(codex): isolate ACL setup and cold quota child work * test(codex): complete fetch and routing fixture types --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
#7531) * fix(reasoning): separate support, thinking toggles and effort controls * fix(reasoning): address capability and wire review findings * fix(reasoning): preserve custom overrides and native thinking budgets * fix(catalog): preserve retained model reasoning provenance * fix(providers): preserve case-varied capability overrides * fix(providers): attribute reasoning exclusions correctly * fix(reasoning): preserve legacy wires and independent capability projections Address six maintainer findings and preserve legacy Chat behavior across native and translated requests. Cover native effort recovery, Responses extension boundaries, tool omission, case-folded overrides, and Claude discovery. * docs(structure): keep integrations.md within its 600-line budget after merging dev The merge with dev put structure/clients/integrations.md at 601 lines; join the reasoning-projection sentence onto the preceding export-metadata line. * fix(reasoning): preserve legacy empty-ladder discovery signal --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
* fix(codex): preserve hardlink names in catalog heal paths * fix(codex): retain native catalog leaf aliases where safe * fix(codex): fence uncertain catalog entry identity * fix(codex): retain uncertainty after catalog hop exhaustion * fix(catalog): retain uncertainty after symlink lookup failures * fix(test): promote Bun 1.4.4 with independent runner role verification * docs: align Docker Bun comments with unified role defaults * test: use a draining TLS origin for early upload replies * test: confine draining origin to buffered HTTP/1 upload * fix(codex): resolve catalog link target parents with filesystem semantics A relative symlink target containing .. was normalized lexically, so a symlinked intermediate directory made the comparator follow the wrong parent. Walk each intermediate component within the existing read budget: resolve symlinked or missing directories with realpath, treat non-directories and failures as unknown, and keep the leaf for the next lstat hop. * fix(codex): match platform .. semantics in catalog link targets Measured OS behavior splits by platform: Windows normalizes .. lexically across junctions/reparse points and even past missing components, while POSIX resolves each directory and refuses a missing crossing. Keep lexical resolve on Windows; on POSIX walk each intermediate component inside the read budget, record intermediate symlinks in the revalidation snapshot, and treat missing or non-directory crossings as unknown. Regressions assert the independent readFileSync/realpathSync result before the comparator verdict, and the POSIX-only literal-backslash case is an explicit platform skip. * fix(codex): refuse non-directory crossings in POSIX link targets A symlinked intermediate that resolves to a regular file must fail the traversal with ENOTDIR on POSIX; dirname() after realpath would have accepted the wrong catalog. Stat the resolved intermediate inside the read budget, require a directory, and record the resolved identity in the link snapshot so revalidation also catches a target swap. * test(codex): reproduce catalog observation and reanchor regressions * fix(codex): revalidate catalog evidence and reanchor selected publications * fix(codex): retain recovery baseline when publication proof fails * fix(codex): bind heal baselines to published entry evidence * fix(codex): keep the validated heal publication selection * fix(codex): capture publication identity before comparisons --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
…ient cancellation (#7767) A live sideband join now keeps its turn admission until the upstream transport closes when the client cancels after the upstream dial has started; before the dial, cancellation still retires the turn at once.
…#7622) * fix(codex): renew credit evidence for namespace-bound Direct accounts * fix(codex): recover credit retry advice without weakening account boundaries * fix(test): supply required port in native pool fixture * test(codex): isolate ACL setup and cold quota child work * test(codex): complete fetch and routing fixture types * fix(codex): retain the latest applicable credit retry hold --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
* feat(providers): add AI Stupid Level API-key preset Adds AI Stupid Level's Smart Router as an ordinary API-key preset: openai-chat at https://aistupidlevel.info/v1, live discovery from the key-gated GET /v1/models (which also validates the key), and the 15 routing modes seeded with auto-coding as the default. Each routing mode declares a 262,144-token window, 64,000 output tokens and text-only input, limits that hold for any model the router picks. Every inbound stays on Chat: the router's /v1/messages is a passthrough to Anthropic without routing. Preset counts are recounted to 106 total and 85 key-based in all 8 guides, all 8 quickstarts and structure/ops/docs-and-release.md. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(providers): keep every AI Stupid Level model text-only, pinned ids included The preset declared text-only input for its 15 routing modes only. A pinned id from live discovery, such as claude-sonnet-4-6, had no modality evidence, so an attached image was forwarded to the router, which answers 400 unsupported_content. Add a provider-wide inputModalities declaration, the modality counterpart of contextWindow and supportsVerbosity. The registry seeds it, and enrichProviderFromRegistry and routedProviderConfig backfill it for rows saved earlier. isModelVisionSidecarConsumer, requiresVisionPreprocessing, modelAcceptsImageInput and the routing capability evidence fall back to it when no per-model entry lists the id; a per-model entry still wins. The AI Stupid Level preset declares ["text"]. Regression tests: a pinned live id needs vision preprocessing, also for a row saved before the declaration, and an image sent to aistupidlevel/claude-sonnet-4-6 through the proxy never reaches the router. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(providers): read provider-wide modalities only from the routed provider Review follow-up on the provider-wide inputModalities declaration: - Declare inputModalities on DerivedKeyLoginProvider, and copy it in providerConfigFromKeyLoginProvider, so a dashboard key login saves it like a CLI provider add does. - Drop the name-only registry fallback from the routing capability evidence. It applied the preset's ["text"] to a same-named custom destination; the routed provider already carries the declaration, backfilled for the preset destination only. Regression test: a same-named custom destination keeps its own modality evidence and needs no vision preprocessing. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * docs(providers): record the 2026-10-26 re-verification of the AI Stupid Level preset The contract (router docs, terms, key-gated GET /v1/models) was checked again on 2026-10-26: the 15 routing modes are unchanged. The pool of pinnable models has changed since 2026-10-23 (Kimi K2.7 Code is no longer listed), so the limits comment now calls 262,144 a conservative window rather than the current pool minimum. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(providers): keep provider-wide modalities registry-only Review follow-up: a row seeded from the AI Stupid Level preset kept inputModalities: ["text"] after its baseUrl was pointed elsewhere, so a custom image-capable endpoint would have had its images stripped. The declaration is now registry-only, like other destination-bound registry defaults: it is no longer seeded into saved config (CLI add or key login), and enrichProviderFromRegistry and routedProviderConfig fill it only while the provider points at the preset destination. This also drops the src/oauth/login-cli.ts change. The custom-destination test now covers a seeded row moved to another URL as well as a hand-written custom row. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(providers): apply provider-wide modalities at runtime only Review follow-up: enrichProviderFromRegistry copied the preset's inputModalities onto the provider object, and init and management writes persist that object, so a saved copy could still follow a row to another URL. Enrichment no longer copies it. registryInputModalitiesForDestination() returns the registry value only while the row points at the preset destination; vision eligibility applies it to its private copy, and routedProviderConfig applies it to the routed provider. Regression test: enrichment leaves the saved provider without the field, while the runtime classification still holds at the preset destination and not at another URL. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> * fix(providers): validate runtime modality overrides for AI Stupid Level Reject malformed provider-wide modalities at schema and management boundaries, repair tolerant loads to text, and preserve exact model declaration precedence. Cover destination-bound runtime backfill without persisting registry defaults; derive the active key-login test roster from the registry. Co-authored-by: Studio Platforms <ionutvisan@studioplatforms.eu> * fix(providers): retain text-only fallback for renamed presets --------- Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com> Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
…7777) * fix(claude): drain parent ACL flights before intercept secret writes * fix(claude): bound ACL admission and guard picker cleanup steps * test(claude): yield a macrotask before barrier ordering assertions A single microtask yield depended on the current await count; draining queued microtasks with setImmediate keeps the assertions meaningful if later code adds awaits (CodeRabbit review on #7777). * fix(claude): admit nested Claude settings rewrites after the bind await Review r2 F3: startup migration and Desktop first-party removals rewrite the credential-bearing Claude settings file synchronously after an await. A CLAUDE_CONFIG_DIR nested in the opencodex home shares the config-root ACL flight, so gate the migration and every removal through withConfigDirHardeningSettled on the Claude settings home (removeDesktopFirstPartySettled maps a settle timeout to the existing unreadable refusal without writing). Regressions: nested-home migration and settled removal, red without the barrier, green with it. * fix(claude): admit model-default rewrites of a nested Claude home Review r3 F4: POST /api/claude-code/model-defaults rewrites Claude settings, its staged file and recovery backups synchronously after the body await; gate the whole operation through withConfigDirHardeningSettled(claudeConfigDir()) inside the existing failure mapping. N1: the gateway-apply cleanup refusal no longer claims a JSON parse failure. Also asserts that the startup migration actually rewrites the stale proxy URL (CodeRabbit). Regression: model-defaults POST with a held parent flight, red without the barrier. --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
* fix(codex): preserve hardlink names in catalog heal paths * fix(codex): retain native catalog leaf aliases where safe * fix(codex): fence uncertain catalog entry identity * fix(codex): retain uncertainty after catalog hop exhaustion * fix(catalog): retain uncertainty after symlink lookup failures * fix(test): promote Bun 1.4.4 with independent runner role verification * docs: align Docker Bun comments with unified role defaults * test: use a draining TLS origin for early upload replies * test: confine draining origin to buffered HTTP/1 upload * fix(codex): resolve catalog link target parents with filesystem semantics A relative symlink target containing .. was normalized lexically, so a symlinked intermediate directory made the comparator follow the wrong parent. Walk each intermediate component within the existing read budget: resolve symlinked or missing directories with realpath, treat non-directories and failures as unknown, and keep the leaf for the next lstat hop. * fix(codex): match platform .. semantics in catalog link targets Measured OS behavior splits by platform: Windows normalizes .. lexically across junctions/reparse points and even past missing components, while POSIX resolves each directory and refuses a missing crossing. Keep lexical resolve on Windows; on POSIX walk each intermediate component inside the read budget, record intermediate symlinks in the revalidation snapshot, and treat missing or non-directory crossings as unknown. Regressions assert the independent readFileSync/realpathSync result before the comparator verdict, and the POSIX-only literal-backslash case is an explicit platform skip. * fix(codex): refuse non-directory crossings in POSIX link targets A symlinked intermediate that resolves to a regular file must fail the traversal with ENOTDIR on POSIX; dirname() after realpath would have accepted the wrong catalog. Stat the resolved intermediate inside the read budget, require a directory, and record the resolved identity in the link snapshot so revalidation also catches a target swap. * fix(test): drain account fixture config ACL work before removal * fix(config): skip optional directory hardening for non-directories * test(codex): reproduce catalog observation and reanchor regressions * fix(codex): revalidate catalog evidence and reanchor selected publications * fix(codex): retain recovery baseline when publication proof fails --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
…roviders, catalog, pricing, docs) (#7779) * feat(providers): add GPT-6.1 Terra alongside existing models * docs(models): document GPT-6.1 Terra across locales * docs(models): drop repeated Terra cross-link paragraphs and source comments * feat(codex): add GPT-6.1 Terra alongside existing native models Pin the supplied upstream row verbatim and register its native 500k/872k context, low-through-ultra ladder, Fast-only tiers and multi-agent v2. Keep GPT-5.6 Terra, defaults, configured-native template and roster version. Apply Terra's client minimum only to per-model absence evidence so unrelated roster success TTLs stay unchanged. Verify native, account-qualified and OpenAI-forward rows, Claude context and labels, and ultra-to-max wire folding. Keep Cursor and other lanes untouched. Validation: 613 affected tests and 38 layout/ratchet tests pass on Bun 1.4.4; typecheck, structure:check and privacy:scan pass. * fix(codex): keep GPT-6.1 Terra entitlement handling on the GPT-6.1 Sol rule * test(providers): give the Terra provider regression a unique layout name * feat(usage): add GPT-6.1 Terra pricing and metadata * fix(usage): price confirmed GPT-6.1 Terra Fast at the documented 2x * test(service): expect OpenRouter GPT-6.1 Terra service-tier capability --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
…1027 (ours merge of preview)
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Contributor
WalkthroughWarning Review details and warnings were omitted to fit the comment limit. |
github-actions
Bot
added
the
intake: hygiene-blocked
Contributor
|
github-actions
Bot
changed the title
Contributor
⏳ DRAFT
What to do
Its title has been prefixed with |
lidge-jun
added
the
suppression-approved
Owner
Author
|
Release captain: |
github-actions
Bot
removed
the
intake: hygiene-blocked
Owner
Author
|
Release-captain promotion record (v2.93.0 procedure step 4). Head 748605e: frozen candidate 2606f6f plus the four version sources at 2.93.0-preview.20261027, ours-merged onto preview. PR CI run 40445260270 success on this head. Candidate gates: lane=all 40434756491 and Service lifecycle 40434760151 on 2606f6f, both success. enforce-target fails only on the promotion exceptions (non-dev base, UI screenshot), as in #7634 and #6630. Merged with a merge commit, not squash, so the dev history stays reachable from preview for the changelog builder (first-parent range plus GitHub generated notes) and for future syncs. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Promotes the frozen
devcandidate2606f6f922d6c897836f4aafc0910f46293e5786topreviewas 2.93.0-preview.20261027. The tree is that candidate plus the four version sources moved to the preview version; the branch descends fromorigin/previewthrough anoursmerge, sogit diff 2606f6f922 HEADis exactlypackage.json,desktop/src-tauri/tauri.conf.json,desktop/src-tauri/Cargo.tomlanddesktop/src-tauri/Cargo.lock.This is the preview cut of v2.93.0 (preview first, then main). Highlights since v2.92.0 include GPT-6.1 Terra support (Codex native, OpenAI API, OpenRouter, Copilot and other providers; not Cursor) (#7779), required-tool enforcement for buffered native combo children (
required_tool_contract_unsatisfied, #7741) alongside translated Chat routes (required_tool_not_called, #7463), Anthropic cache-prefix preservation during routed compaction (#7749; 413 recovery unchanged), update-restart catalog routing handover (#7747, closes #7423), the Windows npm update tree join before stage cleanup (#7751, closed #7737), local stop requests sent directly to the loopback runtime (#7754), and the Windows intercept-CA ACL race fix (#7777).Known issue carried into this release: on a Remote Link Child,
ocx stopleaves Codex pointed at the stopped Child untilocx startorocx sync --restart-codex(from #7564; the native-restore fix #7736 is deferred).Verification
2606f6f922d6c897836f4aafc0910f46293e5786: workflow_dispatch Cross-platform CI lane=all run 40434756491 success (32 success, 4 path/PR-gated skips) and Service lifecycle run 40434760151 success, on that exact SHA, without reruns.bun run typecheck,bun run structure:check,bun run privacy:scan,bun run skill:surface:checkall pass.bun scripts/release-version-sources.ts check 2.93.0-preview.20261027: all 4 version sources carry the preview version;origin/previewis an ancestor of this head.devalready outranks this release: chore(release): open dev at 2.94.0 before releasing 2.93.0 #7795 (736fa50) moveddevto 2.94.0.release.yml.bun run teston this host (the candidate's lane=all run covers the suite on all three platforms).Checklist