Repository navigation
[WRONG BRANCH] release: promote frozen tip c68885b5f1 to main as 2.95.0 - #8034
Merged
Merged
Conversation
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
…ew (#7939) * feat(gui): show distinct first-response states on the provider overview Distinguish provider configuration saved, model discovery and selection readiness, client routing application in Connect, and completion probe verification on the provider overview instead of labeling every configured provider Connected. Select newly added providers in the workspace when none is open, show the raw provider config ID next to the display name when they differ, and join per-provider discovery status into the revision-bound model snapshot. * fix(gui): align overview Status row with effective OAuth state and expand guidance tests * fix(gui): prefer settled model snapshot over stale pending config and preserve probe state on cancel
…7881) Native Opus 5.5 on api.anthropic.com always forced display "updates" plus the updates beta. An explicit reasoning.summary of "concise" or "detailed" now selects display "summarized" without the beta, and the selected display drives beta and response classification on every request, including adapter reuse. "auto" (the Codex default), "none" and an omitted summary keep the #7143 updates default. Closes #7728 Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
* fix(codex): report main-pool affinity decisions in request logs (#7799) The selection that resolves the main login rotating as main-pool already computes a CodexAffinityDecision, but only the stored-pool context carried it, so request preparation logged affinity/affinityReason for pool selections alone. Carry the same decision on the main-pool context and copy it into the existing log fields. Selection, binding and credential ownership are unchanged. * test(codex): expect the main-pool affinity decision and keep auth-context under its cap Two exact-shape main-pool assertions in codex-main-rotation now include the carried affinity decision. Fold two main-pool type comments so src/codex/auth-context.ts stays at its 1999-line size and below the 2000-line ratchet threshold. * test(codex): cover the main-pool affinity request-log copy Move the request-log copy of the selection's affinity decision into noteCodexSelectionAffinity (src/server/request-log.ts) and test it for stored-pool, main-pool, missing-decision and request-owned main contexts. The auth-context regression now uses a bindable thread identity and checks new_bind followed by reused. --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
#7854) (#7885) The ancestry guard test bounded its PowerShell child at 10s and failed on a hosted Windows shard with empty stdout/stderr (killed at the deadline). On a busy Windows host the script body finished in under 0.7s even with 24 copies running at once, while the PowerShell process around it took 2-8s to start and exit, so the bound was measuring process lifecycle, not the guard. Replay the same probe once in a beforeAll through warmColdSpawn, as the sibling desktop-compatibility trust and launch tests already do, and keep the measured 10s bound unchanged. The script now writes phase markers to stderr, which survive a deadline kill and name the last completed step; PowerShell only flushes the JSON verdict at exit. Closes #7854 Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
…ets (#7887) * fix(codex): bound combo backoff for local account cooldowns Carry process-local Response provenance for ordinary account cooldown refusals through combo failure reconstruction. Use capped local target backoff without changing client retry advice or account admission and policy state. Keep upstream retry directives and all policy subclasses unchanged; cover account recovery, wire-copy forgery, the 24-hour ceiling and hard-lock behavior. * fix(codex): mint local cooldown provenance at the Responses auth-error mapper Move the exact-class provenance mark from cooldownErrorResponse into mapCodexAuthContextErrorToResponse, the single mapping every combo child's local auth refusal goes through. This keeps src/codex/auth-context.ts at its 1999-line size, below the 2000-line file-size ratchet threshold, and the tests now mint the refusal through that mapper. * fix(codex): keep local cooldown provenance through response lifetime wrappers Retained compaction v2 delivers each child response through finalizeAccountLease, which re-creates the Response and dropped the process-local cooldown mark, so a late local refusal could again record the account's long Retry-After against the combo target. Carry the mark in both core-lifetime wrappers and cover the lease boundary with a regression. --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
…ost candidates (#7893) * fix(messaging): reserve SSH forward ports and recover lost candidates * fix(messaging): preserve initiating forward failures through pair shutdown Keep intrinsic I/O and pre-cleanup exit failure provenance on each helper. Join diagnostic output and pair cleanup before classifying readiness failures, so cleanup-induced sibling rejection cannot mask an explicit lost forward port. Independent failures, cancellation and incomplete cleanup remain terminal. Add deterministic L/R delayed-stderr recovery and exhaustion regressions plus terminal-failure controls. Keep reservation handoff, setup deadline and the three-attempt ceiling unchanged. Validation: regression 11 pass/4 fail before, 15 pass/0 fail after; requested eight focused files 85 pass/15 skip/0 fail; test:changed 769 pass/112 skip/0 fail; typecheck, structure:check, privacy:scan and git diff --check passed. --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
…ion (#7891) * fix(config): re-arm atomic writer ACL timeout memos Reimplement the intent of #7843 on the current dev atomic writer. Opt normal sync, streamed and async writes into the existing destination-keyed recovery policy while keeping both residual cleanup paths from consuming recovery. Required hardening, identity checks and publication ordering remain intact. Cover all five harden calls, cooldown boundaries, continued stalls, permission denial and cleanup with deterministic runner/clock regressions. Document the recovery behavior and retain the current config-root ACL settlement boundary. Fixes #7834 Co-authored-by: JohnnyXu <xubenqiang@users.noreply.github.com> * fix(config): retain destination ACL admission until child reap Reserve default atomic-writer destinations across active writes and retained Windows ACL children. Refuse overlapping sync, streamed and async writers without spending timeout recovery or relinquishing removal ownership. Cover repeated re-arm windows, mixed writers and recovery after actual reap. Restore both principal runners before resetting regression identity state so subsequent native ACL tests use the real account. * test(config): require atomic ACL timeout recovery admission Keep the exact required/destination assertion and require the explicit retryTimedOutOnce opt-in added for #7834. The old exact options object rejects the intended recovery contract during test:changed. * fix(config): allow healthy overlapping Windows atomic writes --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com> Co-authored-by: JohnnyXu <xubenqiang@users.noreply.github.com>
Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
…7908) * test: add offline fixtures for claude-cli schema-constrained output (Issue #6469) * test: fix claude-cli offline fixtures per CodeRabbit review * test: fix claude-cli offline fixtures per CodeRabbit review round 2 * test(claude-cli): exercise real abort and two-turn tool replay Complete authoritative tool stops, assert matching and mismatched replayed IDs on stdin, and observe tool callbacks before terminal completion. Abort through the request signal and assert process/input/prompt cleanup. Co-authored-by: Aditya Rawat <246880058+adirwt852-cloud@users.noreply.github.com> --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
* fix(openai-responses): drop the include entry xAI rejects `xai/grok-4.7` over the Responses path answers HTTP 400 with `Argument not supported: "output.encrypted_content" in "include" field`. Codex Desktop asks for that OpenAI reasoning blob on every turn, and xAI rejects the request instead of ignoring the unknown entry, so the model only works when the user maps it to the `openai-chat` adapter. Strip exactly that entry for xAI Responses destinations. Other include entries (and the key itself when something remains) are preserved, and every other destination is untouched. * fix(xai): recognize the US Responses endpoint for include normalization Cover the regional request body and exact HTTPS host matching, including lookalike and nonstandard-port rejection. Document the include compatibility. Co-authored-by: xubenqiang <30436552+xubenqiang@users.noreply.github.com> * docs(xai): keep Responses wire contract within its line budget Co-authored-by: xubenqiang <30436552+xubenqiang@users.noreply.github.com> --------- Co-authored-by: xubenqiang <xubenqiang@users.noreply.github.com> Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
* fix(gui): preserve Muse reset countdown after quota exhaustion * fix(gui): drop an expired Muse refusal observation at its reset time The summary bar now re-renders at the observed reset and builds rows without an observation whose window has reset, so the exhausted row leaves without another successful poll and stays gone after a failed one. Native Muse quota reports are unchanged. Co-authored-by: stephen-drew <98895569+stephen-drew@users.noreply.github.com> * fix(gui): read the observed Muse reset through the typed quota parser ProviderQuotaReportView.quota is unknown; reading customWindows directly failed the GUI type build. Co-authored-by: stephen-drew <98895569+stephen-drew@users.noreply.github.com> * docs(structure): record the observed Muse quota row and its reset-time expiry Co-authored-by: stephen-drew <98895569+stephen-drew@users.noreply.github.com> * fix(gui): select Muse observation by request start time Read the server-bounded retained matching history instead of its last finalized row, then select the greatest valid start timestamp for the active final account. Keep native reports and the existing subscription-refusal gate authoritative. Four regressions fail before the fix: overlapping success/refusal completion orders, more than fifty older finalizations, and malformed/cross-account rows. Update the provider and dashboard contracts without changing the visual layout. Co-authored-by: stephen-drew <98895569+stephen-drew@users.noreply.github.com> --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
…ld usage after commit (#7433) * Kiro usage: log what Kiro reports, on every inbound wire Problem 1. A combo child logs into its own context. The combo copies that context into the request context once, when the child commits. The bridge binds the adapter usage later, at the terminal frame, so the request context never learned that usage came from the bridge. The request log then re-read the bridged Responses wire. That wire has no providerCredits, zero-fills the cache detail, and derives the input count from the context checkpoint. The log row showed a high input count, zero cache and no credits on /v1/messages, /v1/responses and /v1/chat/completions alike. Problem 2. Every Kiro row was marked estimated and raised to the local input estimate, even when Kiro sent a tokenUsage block. Fix 1. The combo passes each child onBridgeUsageBound. The transport calls it when it binds bridge usage. After the child commits, the combo sets usageFromBridge and usage on its own context. Fix 2. The Kiro parser marks usage read from tokenUsage as upstreamReported. A two-leg turn keeps the mark only when both legs have it. usageForFinalLog and finalizedUsage skip the provider-wide estimated mark and the input floor for marked usage. Usage without the mark, and usage read off a wire, stays estimated. The wire that the client receives is unchanged. Tests: new tests/server/server-kiro-usage-log-e2e.test.ts replays one Kiro stream (metering and tokenUsage, then no tokenUsage, then two legs with tools) through /v1/responses, /v1/messages (stream and non-stream) and /v1/chat/completions, on a direct route and on a combo route. A unit test in request-log-estimate-cap.test.ts covers the mark. The Kiro stream test now expects the mark. 15 of the 21 new cases fail without the fix. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> * Combo: forward child usage only after the child commits The combo forwarded bridge usage to the request context when the child set childCommitted. The flag was set before callbackGate.commit(). If the commit threw, a later usage binding of that child still reached the request context. The combo now keeps two flags for each target: childCommitted, set after the commit, and childUsageBound, set by the callback. It forwards only when both are true. A binding that comes before the commit waits for the commit. A target that fails or never commits forwards nothing. The callback takes no argument now, because the combo already holds the child context. Tests: new tests/responses/responses-combo-bridge-usage.test.ts drives executeComboResponses with a fake dispatcher. It covers a binding after the commit, a binding before the commit, a refused first target with a committed second target, and a commit that throws. A new case in request-log-estimate-cap.test.ts pins the aggregate rule: the upstreamReported mark needs usage on every attempt, and an empty list or attempts without usage give no mark. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com> --------- Co-authored-by: bylinelog-bot <bylinelog-bot@users.noreply.github.com> Co-authored-by: Claude Sonnet 5.5 <noreply@anthropic.com> Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
#7769) * feat(claude-desktop): per-client model visibility for the Desktop list Claude Desktop's gateway list carried every available model, and the only dashboard levers (tier moves, family defaults) did not hide anything. Add claudeCode.desktopModelVisibility, an include or exclude list of routes that narrows only the Desktop 3P inferenceModels list. - The generator filters emitted rows by route after building the full alias registry, so a running session holding a just-hidden alias still routes. A hidden family default hands its role to a remaining member; a selection that would empty the list falls back to the full list. - Every writer reads it through desktop3pModelOptions: local apply, catalog refresh, and the hub's Desktop export. - PUT /api/claude-desktop accepts visibility (omit keeps, null clears) and refuses a selection with no visible available model. GET returns it with per-model visible flags and the list the next apply writes; status returns the applied list. - Dashboard: per-model checkboxes, search, provider filter, bulk select, new-model policy, selected/available/applied counts, an added/removed preview, and a "saved, not applied" status. The two status strings that read as contradictory now name their scope. - Invalid hand-edited values fail validation at their own path and salvage drops only that field. Closes #7702 * fix(claude): preserve Desktop visibility intent and projection state Keep saved-versus-applied status independent of draft edits, match the next-apply DTO to the existing writer fallback, and refuse concurrent visibility replacement during discovery. Isolate lifecycle locks and await fixture background work on Windows. * docs: describe Desktop visibility save conflicts Co-authored-by: ljluestc <63439129+ljluestc@users.noreply.github.com> * fix(gui): describe stale Desktop configuration without assuming external edits Cover saving a changed family default without applying, including cleared applied state and unchanged Desktop models. Use neutral wording in every locale. Co-authored-by: ljluestc <63439129+ljluestc@users.noreply.github.com> * fix(gui): clarify Desktop visibility scope and profile observations Name all matching rows in bulk actions and describe matching IDs as an on-disk profile observation. Update all locales, regression coverage, fallback docs, required profile writes, and nullable status shape. Co-authored-by: ljluestc <63439129+ljluestc@users.noreply.github.com> * fix(gui): clarify Desktop deselection and apply order Co-authored-by: ljluestc <63439129+ljluestc@users.noreply.github.com> --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
* fix(oauth): sanitize Antigravity discovery failure diagnostics * fix(oauth): surface sanitized Antigravity discovery failures * fix(oauth): end Antigravity onboarding explicitly on a null body A JSON null onboardUser body threw a TypeError on data.done. Without a loadCodeAssist account that onboarding call has no catch, so the TypeError replaced the recorded discovery error with generic OAuth text. Return no project instead, keeping the existing one-poll budget. --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
* feat(kiro): add IAM Identity Center login to dashboard * test(kiro): preserve IAM product name in locale guards * fix(kiro): address IAM login review findings * fix(kiro): preserve accepted device commits across expiry * test(kiro): budget repeated device credential writes Use the existing STORE_BUDGET_MS for the 40-flow retention test. The case performs real protected credential/config writes; retain every iteration and assertion. The Windows default 5s budget expired after 5.05s. Retaining both the completed flow and config snapshot still fails at the cleanup assertion under the store budget (0 pass, 1 fail in 0.71s). Co-authored-by: Martin Becerra <197874+martinbcg@users.noreply.github.com> * test(kiro): budget the IAM credential-write pressure scenario Apply STORE_BUDGET_MS to the other repeated protected-write case after its 5s default timeout under Windows contention. Keep all 14 completions, the active-flow cap and owner-scoped profile-selection assertions. Ablating terminal-only eviction fails at the preserved live-flow assertion (0 pass, 1 fail in 2.31s) within the store budget. Co-authored-by: Martin Becerra <197874+martinbcg@users.noreply.github.com> --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com> Co-authored-by: Martin Becerra <197874+martinbcg@users.noreply.github.com>
#7891 brought scripts/test-layout/layout.json to 2000 lines on dev, which the ratchet rejects as NEW_OVERSIZED. Move its registration onto the preceding windows line; the mapping is unchanged. Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
* fix(providers): move Moonshot API default and retired K2.5 to K3.1 Pro Follow the vendor's current successor recommendation, retain the still-served K2.6/K2.7 API seeds, and preserve coding-plan and reseller catalogs. Refresh only exact legacy capability seeds and keep the pre-K3.1 roster repair working after the retired-id migration. Cover saved-config persistence, custom destination/metadata preservation, registry parity and catalog output. Refs #7653 * fix(providers): keep explicit K3.1 Pro values when migrating Moonshot K2.5 The K2.5 rename refreshed any successor value equal to the legacy seed, including values a user had saved under kimi-k3.1-pro before the migration. The registry never seeded K3.1 Pro with those values, so the Moonshot rename now refreshes only metadata carried over from K2.5 (targetSeedRefresh.onlyTransferred). The Kimi coding renames keep their existing behavior. * fix(providers): keep an explicit K3.1 Pro no-reasoning classification in the Moonshot migration The no-reasoning cleanup still dropped kimi-k3.1-pro when its saved efforts matched the legacy seed, even with no K2.5 left in the config. With onlyTransferred it now removes only the retired id. --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
* fix(openai-chat): normalize LM Studio instructions to one leading system message Add a preset-scoped, typed singleLeadingSystemMessage compatibility policy. Preserve outbound instruction text, user/tool ordering, and input immutability for translated and native Chat requests. Keep every other preset unchanged. Validate and preserve the optional boolean through config/editor boundaries; document the chronology tradeoff and existing IR system-message hoisting. Refs #7761 * docs(providers): count nine carried settings in the save table * fix(openai-chat): preserve developer documents with single-system policy --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
* feat(catalog): opt in to omitting disabled native models * fix(catalog): advance omitted native templates through upgrades * fix(catalog): pass the upgrade rule into the native template instead of importing metadata native-template.ts importing shouldUpgradeToUpstreamEntry from metadata.ts closed a load-time cycle metadata -> bundled -> native-template that the import-cycle ratchet rejects. Both writers already import the rule and now pass it in. * fix(catalog): address review on disabled-native omission - Leave control-plane rows in place when an omission pass drops nothing, so the opt-in flag cannot change a catalog it did not filter. - Drop the copied "descriptions below" sentence from seven locale tables. - Add the catalog reference page to the Configuration sidebar. - Map src/types/config.ts to structure/config.md and regenerate INDEX.md. - Register the new test on the inline layout line so layout.json keeps its line count under the file-size cap. --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
…le domain (#7697) (#7745) * fix(service): recognize headless GUI-domain launchctl exit 125 as a domain answer On a headless macOS session launchctl print gui/<uid>/<label> exits 125 ("Domain does not support specified action") before ever looking at the label. The probe returned unknown at that point, skipping the user-domain query and the plist checks, so absence could never be proven and every admission-gated write was fenced on a machine with nothing installed. 125 from the gui/ domain is now counted like 112 - a label-independent answer about the domain - and the probe continues to the user domain and the on-disk definition checks. A user-domain 125 stays unknown: the fallback must be able to answer, so its failure is a failure to ask. * docs(structure): record the headless GUI-domain launchctl 125 rule Co-authored-by: chenyb999-zhcn <chenyb999-zhcn@users.noreply.github.com> * fix(service): corroborate launchctl GUI 125 with session evidence Require a bounded read of the complete IOConsoleUsers UID roster before treating GUI-domain 125 as unreachable. Keep matching, malformed, unreadable and timed-out evidence unknown, including switched-out GUI sessions. Preserve the independent user-domain and plist checks, and clarify that 113 is service-scoped. Cover the probe and downstream write admission with Windows-portable injected runners; sync the owning structure clause. * test(service): make the GUI-125 fixture exercise the ioreg to plutil contract ioreg now returns a plist holding 0.IOConsoleUsers, and plutil answers only the exact extraction of that input. Mutating the production extraction key turns four positive cases red. --------- Co-authored-by: chenyb999-zhcn <chenyb999-zhcn@users.noreply.github.com> Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
…ngth (#7892) * fix: fail over combo context-length refusals (#7443) * fix(combos): ignore quoted caller values in context-overflow evidence A parameter validation error that quotes the caller's own value, such as Invalid 'tools[0].function.name': 'prompt is too long', matched the context-overflow phrase list. The combo then hopped to a backup target and relabelled the validation failure as context_length_exceeded on exhaustion. Strip quoted spans that open after a boundary before matching, so in-word apostrophes (model's, you're) still read as provider prose. * fix(combos): judge validation provenance instead of stripping quotes Stripping quoted spans missed values with an embedded apostrophe and removed genuine verdicts that an SDK error wrapper quotes. Refuse context evidence when the provider record is a parameter validation (code invalid_value/invalid_type, or a param naming a field other than the conversation) or the message opens with Invalid '<param>' syntax, and keep reading quoted SDK-wrapped verdicts as evidence. * fix(combos): refuse validation markers anywhere and accept budget params A Python SDK error wrapper that serializes a parameter validation record bypassed the prefix check and hopped. Read validation markers (invalid_value, invalid_type, a non-conversation param, Invalid '<x>', Invalid tool/function ...) anywhere in plain-text evidence. Accept context refusals whose param names a token budget (max_tokens, max_completion_tokens, max_output_tokens) or vLLM's input_tokens/input_text. * fix(combos): anchor the new context verdicts to provider positions The three phrases added for #7443 are short enough for a validation error to echo them as the caller's value (Invalid value: '...', Invalid value at '...', Pydantic input_value='...'). Accept them only at the start of the leaf message or right after an SDK wrapper's message key, and Anthropic's only with its token counts; the phrases dev already matched keep their substring behavior, so nothing new can hop that dev would not. Also treat Invalid value, input_value= and Pydantic "validation error for" as validation markers. * fix(combos): read anchored verdicts only from the leaf or an SDK wrapper Accepting a quoted message key anywhere let a schema error that echoes the caller's object ({'message': 'Please reduce the length ...'}) hop. The anchored verdicts now match only at the start of the leaf message, or at the start of the first message value when the leaf is a recognized "Error code: NNN - {" SDK wrapper. * fix(combos): count the new context verdicts only at the start of the leaf message SDK-wrapper recognition let a caller-controlled message key authorize a hop. The three verdicts added for #7443 now count only at the start of the unwrapped provider message; dev's existing substring phrases keep reading SDK-wrapped OpenAI verdicts. Document the anchoring and validation exclusions. * fix(combos): retain context refusal on replay exhaustion * docs(combos): limit the exhaustion promise to confirmed HTTP 400 context refusals Context refusals sent with 413 or 422 also advance, but only a confirmed HTTP 400 refusal is retained and returned on exhaustion (core-combo.ts). Align the English failure table and its seven locales. --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
* fix(advisor): support manual consultations during web search * docs(advisor): document web-search sidecar contracts * fix(advisor): remove exhausted tool for anthropic workers * fix(advisor): account bounded search worker legs once Cover streaming and buffered search ownership, separate consultation and search bounds, hidden calls, real-tool precedence, incomplete calls and usage accounting. Register the regression and align the documented fetch loop allowance. * docs(advisor): remove dangling limitations reference State the retained run-turn and image/video restrictions without referring to an English section that does not describe the image/video sidecar limitations. Co-authored-by: auroraflux-jhkim <126220202+auroraflux-jhkim@users.noreply.github.com> --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
…cleanup paths (#7945) The writer resolves the destination's real parent, and macOS tmpdir() is a symlink, so the unlink fixture never matched and the residual case failed on macOS (dev batch 40819570452). Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
…ts (#7946) * test(windows): budget hosted fixture phases without weakening contracts * test: drain gated metadata fixture before cleanup --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
read() pushed and scheduled another abort on every call, flooding the stream until the abort landed; the SIGTERM case took ~1.3s idle and timed out in loaded full-suite jobs. It now takes ~12ms. Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
…ry fixture (#7949) A reused exited-child PID made the recovery parent look alive, so recovery fenced before the publication stage the failure-fence cases inject into (dev batch 40824593871). Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
Treat a request-history integrity check that has not answered within 30 s as an operational failure: dispose the worker, apply the failure cooldown, and release waiting async readers with a bounded error, while index replacement still waits for the worker's actual exit. Closes #7984
) The routing-health case read the index before corrupting it and relied on PRAGMA shrink_memory to evict the cached pages. macOS's system SQLite kept them, so the read after corruption was served from cache (macOS 2/4 of lane=all run 41056253802, after #7995). Reopen the index after the pre-check so the corruption lands on a connection that has not cached it, like the other corruption cases. Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
* fix(codex): await recovery ACL checks in async parent admission Hold an exact generation across fresh Windows recovery inspection and revalidate pinned identity after awaits. Migrate asynchronous parent callers with a root-bound synchronous commit scope and keep stale-result checks on both admission success and denial. Preserve synchronous compatibility exports and document native validation and remaining synchronous publication boundaries. Follow-up for #7872 item 2; not a completion claim. * test(cli): align async recovery consumers and assert awaited preflight Fix stale mocks, spies and source oracles behind the 11 failures in run 40797643817, plus five reproduced failures in related consumers. Preserve refusal, ordering, timeout and handover assertions. Add three held-promise preflight ordering regressions. Tests: 280 passed across all seven affected test files; typecheck, structure, privacy and layout/size gates passed. No production source changes. * test: keep async parent registration mergeable Relocate the existing async parent test mapping in the registry and independent golden table without changing either mapping or the four-shard execution plan. Preserve the layout size cap. * fix(cli): revalidate ocx v2 state once the awaited admission enters Recovery admission can now wait on ACL checks. Read the native feature state and the OpenCodex config inside the admitted callback, recheck the hybrid-pin guard there, and save that fresh config, so a change made meanwhile is neither overruled nor overwritten. Also restores the executable mode of src/cli/index.ts. * fix(cli): save ocx v2 config changes inside the admitted callback The admission is released before the awaiting command resumes, so a save made after the callback could overwrite a competing write with the read copy. --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
…7624) Tier Codex role auto-assign candidates by measured capability in the role's task domain, using the operator's own Artificial Analysis key, with configured tiers and price rank as fallback. The Hugging Face LMArena parquet source and the hyparquet dependency were removed before merge. The Artificial Analysis key joins configured-credential coverage. Co-authored-by: LilMGenius <97161055+LilMGenius@users.noreply.github.com>
#8001) The refused scenarios only required some error, so a setup failure before the policy read was indistinguishable from the refusal (windows 10/11 of lane=all run 41056253802: reads 0, error unknown). Each scenario now names its expected refusal and the child reports message, cause and code. Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
…does not own (#7996) * fix(update): refuse dashboard restart under a systemd unit OpenCodex does not own Refuse before package mutation when the worker cannot leave the service cgroup or the proxy is not run by OpenCodex's own user unit, and settle a dead worker's job on status reads. Part of #7967. * fix(update): refuse unsupervised dashboard updates with or without restart The update stops the proxy before replacing the package, so restart:false was not a safe fallback. Detect a systemd service from its cgroup too, accept a delegated child cgroup of the own unit, write the settled status from the compared record, and add hard spawn barriers to the refusal test. * fix(update): report a dead worker's job as failed on status without writing it A status poll that wrote the settled record could overwrite a job another process started between its read and its rename. The poll now returns a failed view; the next run's existing stale recovery settles the persisted record. * fix(update): judge the innermost systemd unit and refuse only an update that would run A desktop terminal runs in a scope below user@<uid>.service, which the component check took for a service, and the CI runner's own service preempted the source-checkout refusal. Read the innermost unit of the systemd hierarchy, and consult the supervisor only when an update is available. * fix(update): let the observed cgroup win over an inherited INVOCATION_ID A shell moved into its own systemd-run scope keeps INVOCATION_ID; only a missing cgroup observation falls back to the variable. * docs(structure): state that the observed cgroup unit decides before INVOCATION_ID --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
…g-root ACL flight (#7998) * fix(windows): admit config-root cache writes after the optional config-root ACL flight The provider and Codex account quota caches, the reasoning support cache and the models.dev refresh wrote under the config root while an optional config-root ACL flight could still run, so parent inheritance could race the fresh file's explicit grant. Each write now goes through withConfigDirHardeningSettled with its snapshot built inside the callback. Part of #7815. * fix(windows): invalidate waiting cache writes on cancel and report refused refreshes to joiners A fired cache write waiting for config-root ACL admission now checks a generation that cancel, clear and reset bump; the reasoning support flush seam is admitted too; a joined models.dev refresh receives the shared outcome instead of a coalesced success. * fix(windows): drop a reasoning support flush invalidated while it waited for admission --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
…line (#8003) * test(cli): name the pinned-port holder when a sibling misses its deadline A pinned sibling start that misses its record deadline is ambiguous: the port was taken between probe and bind, the child bound without writing its record, or it never bound. Report whether the port is bindable and, on Windows, the netstat owners of that port (windows 5/11 of lane=all run 41061583113). * test(cli): keep the port-holder diagnostic best effort and read-only while the child lives Review: a missing netstat threw over the original timeout, and the bind probe ran while the child was alive. List sockets before the kill with a bounded, non-throwing netstat, then probe bindability after the child exits. * test(cli): bound the post-kill wait in the port-holder diagnostic * test(cli): skip the bind probe while the killed child may still be alive --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
#7998 made the provider account quota cache write wait for config-root ACL admission, so the deferred-persistence test read the file before it existed on Windows (ENOENT, windows 9/11 of lane=all run 41068188012). Expose the admitted write like settleQuotaPersistenceForTests and await it. Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
…ly suite (#8016) * test(claude): report the hardened local-CA ACL in the first-party apply suite The local-CA ACL inspection spawns PowerShell under the shared 30 s principal budget, which a loaded hosted Windows runner exhausted (windows 1/11 of lane=all run 41073826161: local_ca_path_unsafe after 30095 ms). This suite covers first-party apply; inject the private ACL for the real current SID through the existing seam. Native inspection stays covered by claude-intercept-local-ca-windows.test.ts. * test(claude): read the cached SID inside the injected ACL runner and reset it in finally Review: no separate principal lookup before the environment snapshot; reset the seam even if the hardening drain throws. --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
* fix: compare file identity with bigint stat
NTFS file IDs can exceed 2^53, where adjacent IDs are equal as JS numbers. Take dev/ino from stat calls made with { bigint: true } wherever a module compares file identity, and add a shared FileIdentity helper.
* test: register file-identity tests in a layout shard and scan stat calls with balanced parentheses
* test: resolve guard scopes by declaration and ignore strings and comments
* test: mask template text and regex literals, require same-line method bodies and an exact bigint options argument
* test: recognize regex literals after keywords in the identity tripwire
* fix(oauth): name the best-effort catches on the rewritten lock line
* fix(oauth): name the best-effort metadata parse catch beside the lock line
---------
Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
#8023) * fix: compare Codex and remote workspace file identity with bigint stat NTFS file IDs can exceed 2^53, where adjacent IDs are equal as JS numbers. Take dev/ino from bigint stats in the Codex home, coordinator, main-account, native-main, residue, history, shim runtime and remote-workspace identity checks. Persisted shim state keeps its numeric fields. * fix: keep stat millisecond values exact and compare shim runtime identity as bigint Derive *Ms from bigint *Ns with the runtime's own formula so values still match numeric and persisted stats; carry bigint identity through the shim wrapper ownership and inspection checks; fingerprints without identity compare unequal. * test: pin the stat millisecond formula with a deterministic case --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
Regression tests from #8019/#8023 matched the spied path by raw string; code under test stats canonical paths (/private/var on macOS, long names for an 8.3 short TEMP on hosted Windows), so the injection never applied (lane=all run 41136081084). Add tests/helpers/same-path.ts and use it for every target selection. Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
#8031) * fix: compare CLI install and update artifact identity with bigint stat * test: honor bigint stat options in the CLI install fakes --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
…get (#8032) * test: give the Windows apply x64 fixture compile the shared spawn budget * test: report the compile deadline state on the reap assertion too --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com>
Merge main ancestry with the ours strategy: the tree is exactly dev candidate c68885b.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Contributor
|
Important Review skippedToo many files! This PR contains 609 files, which is 309 over the limit of 300. To get a review, reduce the PR to 300 files or fewer by splitting it into smaller PRs or changing its base branch. Usage-priced reviews support at most 300 files.
 |
Contributor
|
✅ Deterministic PR hygiene checks passed. |
github-actions
Bot
changed the title
Contributor
⏳ DRAFT
What to do
Its title has been prefixed with |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0c9edcb46e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Comment on lines
+176
to
+178
| if (isClaudeWebSearchToolName(choice.name) | ||
| && (!Array.isArray(body.tools) || !body.tools.some(tool => isRec(tool) && tool.type === "web_search"))) { | ||
| throw new AnthropicRequestError("Restricted web search cannot be forced on a translated route without an available search declaration"); |
There was a problem hiding this comment.
For a Messages request that declares restricted web search (for example, allowed_domains) and forces it with tool_choice: { type: "tool", name: "web_search" }, this throws even when the destination can receive the original request natively. In handleClaudeMessages, messagesToResponsesTranslation runs before managed-native eligibility is evaluated, so an Anthropic route with managedMessagesNative: true and the search sidecar disabled returns HTTP 400 before reaching native dispatch. That lane preserves the original restricted declaration and previously accepted this request. Defer this rejection until the route is known to require the lossy translation, and add coverage for forced restricted search on the managed-native lane.
Useful? React with 👍 / 👎.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| const captured: { url: string; body: any }[] = []; | ||
| const fetch = (async (url: RequestInfo | URL, init?: RequestInit) => { | ||
| captured.push({ url: String(url), body: JSON.parse(String(init?.body)) }); | ||
| if (String(url).includes("api.anthropic.com")) { |
Owner
Author
|
Maintainer release integration for stable 2.95.0.
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Promotes the frozen
devcandidatec68885b5f16a2a36d8eaa9877ffcae7235128c1btomainas stable 2.95.0. The promotion head0c9edcb46emerges inmainancestry (d844ff4af6, v2.94.0) with theoursstrategy, so its tree is exactly the candidate tree (git diff c68885b5f1 0c9edcb46eis empty). Candidate version sources already say 2.95.0;devmoves to 2.96.0 through #8033, which merges before publication.The candidate carries 84 commits since the 2.94.0 candidate
dc75a3e51: 47 fixes, 10 features and the rest tests, perf and docs. Highlights: measured-capability role auto-assign (#7624), CC-Switch provider import (#7935), per-provider "test all models" (#7742), Kiro IAM Identity Center login (#7690), history integrity scans off the serving thread (#7972/#7997), pool 5-hour window fixes (#7980/#7994/#7992), Windows credential observer and ACL fixes (#7976/#7970/#7931/#7998), bigint file-identity comparison on Windows (#8019/#8023/#8031), provider compatibility fixes for xAI, Azure, Meta Muse, Kiro, Volcengine and sidecars (#7979–#7991), and rustls 0.23.46 (#7942, fixes 4 GHSAs).Verification
c68885b5f1: workflow_dispatch Cross-platform CIlane=all41149878845 concluded success: 31 jobs succeeded, including all four macOS shards, macOS control and all eleven Windows shards; the 7 skipped jobs are PR-only gates and unexpanded matrix placeholders.bun scripts/release-version-sources.ts check 2.95.0on the candidate: all 4 version sources carry 2.95.0.v2.95.0has no tag and no npm publication.origin/mainis an ancestor of this head.release.yml.Checklist