[WRONG BRANCH] release: 2.77.0 - #6550
Merged
Merged
Conversation
Keep paired-only join authorization. Allow the existing attested CLI grant flow only for the configured literal loopback origin in standalone mode, with runtime address/port checks, a kernel-local redemption peer, one-use codes, fixed five-minute sessions, and role/origin invalidation. Ordinary automatic sessions remain unpaired. Expose explicit code entry during local link setup. Omit stale shared credentials only for the pairing exchange, retaining separate machine-relay credentials and normal API authentication. Add grant/session negatives, a real CLI-capability/session-control/guarded-route composition test (SSH join stubbed), and browser transport/form regressions. Validation here: complete session/capability modules with relevant auth helper excerpts: original 3 pass/4 fail, patched 7 pass/0 fail. Complete browser API module with a minimal Window adapter: original 0 pass/2 fail, patched 2 pass/0 fail. All changed TS/TSX files syntax-transpiled. Full Bun, React, repository typecheck, full server HTTP transport and native SSH/restart suites were not run locally. Independent security review and exact-head CI remain required; keep this PR in Draft.
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* fix(gui): keep dashboard scrolling on the document * test(gui): cover shared scroll geometry and drawer locking * test(gui): normalize preserved build directory paths
Replace six relocated guide and API-reference URLs with their direct destinations. Provider endpoints, routing, and configuration remain unchanged. Carries #6474 by @hedging8563. Co-authored-by: hedging8563 <45883076+hedging8563@users.noreply.github.com>
Suggestion rationale could emit terminal controls in human-readable output. Escape shared human lines while preserving JSON values and multiline exports. Add public guidance alongside the contributor regression tests. Carries #6459 by @luvs01. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
Seed image capabilities for M3 and M3.1 in both Coding Plan regions. Exercise saved overrides, ID-only discovery, static fallback, and Combo gating. Carries #6445 by @xianhongtao. Co-authored-by: xianhongtao <74975356+xianhongtao@users.noreply.github.com>
Model toggles now respond immediately while writes retain click order. Keep newer intent through reconciliation and cancel stale target observations. Carries #6426 by @andrew05060414. Closes #6425 Co-authored-by: andrew05060414 <59988150+andrew05060414@users.noreply.github.com>
Windows Start at Login registered an ambiguous unquoted executable path. Carry the Windows-only quoted writer and enabled-entry migration while preserving opt-outs. Native Windows registry and upgrade verification remains required for #6473. Carries #6479 by @Yuxin-Qiao. Co-authored-by: Yuxin-Qiao <104957188+Yuxin-Qiao@users.noreply.github.com>
Home-directory launches incorrectly excluded default Scoop Node npm paths. Carry physical-path validation for the narrow default current and bin layouts. Strengthen the reviewed launch-directory regression so it exercises cwd exclusion on every platform. Carries #6119 by @kdm1jkm. Co-authored-by: kdm1jkm <15812797+kdm1jkm@users.noreply.github.com>
Recovery logging expanded filesystem-derived backup names as cmd syntax. Use fixed success text while retaining exact read-only recognition of historical wrappers. Preserve the Bun placeholder gate and document the operator-visible log change. Carries #6455 by @luvs01. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
Aggregate measured output tokens over elapsed time for summary, model and provider scopes. Fix invalid-sample poisoning, missing provider fallback, and tooltip translations. Add the missing summary display and rendered-cell regressions beyond the PR. Carries #6471 by @lcxhh521. Closes #6309 Co-authored-by: lcxhh521 <59329914+lcxhh521@users.noreply.github.com>
Lifecycle eligibility returns could leave an older exported picker key on disk. Run the existing best-effort cleanup before every unbound startup attempt. Preserve skip reasons, single-flight startup, and direct runtime cleanup. Carries #6457 by @luvs01. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
Dropped liveness dials could abort updates after a tailnet listener stopped. Carry a bounded literal-IP bind fallback and single-settlement responses. Replace the routing-dependent remote-address test with a deterministic held local port. Carries #6477 by @andrew05060414. Co-authored-by: andrew05060414 <59988150+andrew05060414@users.noreply.github.com>
…#6460) Path-based role mirror reads could race replacement or block on a FIFO. Carry descriptor-bound validation with exact bigint identity checks and guaranteed close. Preserve existing mirror refusal statuses and document special-file behavior. Carries #6460 by @luvs01. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
* docs: plan first-party Claude agent reconciliation * fix(claude): reconcile agent roster after first-party setup * docs: record hosted-only verification for Claude agent fix
…6415) Temporary fnm paths could strand shims after the shell exited. Resolve only the launcher parent and report first-PATH-hit readiness during connect. Fix host-independent readiness scanning and move fnm tests under the size ratchet. Carries #6415 by @andrew05060414. Co-authored-by: andrew05060414 <59988150+andrew05060414@users.noreply.github.com>
…ixes stay warm (#6482) Grok Build sends its conversation identity as x-grok-conv-id and the body prompt_cache_key but never the session_id header Codex clients send. The ChatGPT Codex backend only reuses a warmed prefix when session_id is present, so every Grok turn on an OpenAI model started cold (13.6% cached input vs 97.1% for the same model from Codex). On the managed Grok surface (x-opencodex-grok: 1) with no caller session header, a well-formed x-grok-conv-id is promoted to session_id before handleResponses; explicit session_id/session-id/thread-id still win. Codex pool account affinity (thread-id keyed) is unchanged. Maintainer self-integration under MAINTAINERS.md: exact-head CI green on 95b56ed. Closes #6481
Desktop page zoom reset across launches and clipped sidebar footer controls. Carry persisted macOS/Linux zoom and capture-phase events that preempt older shell hotkeys. Keep native shell defaults, Windows behavior, localization, and the existing IPC permission unchanged. Carries #6335 by @sungyongcho. Co-authored-by: sungyongcho <46742040+sungyongcho@users.noreply.github.com>
Keep synthetic search declared while serving over-budget calls paired limit results. Fix fetch-loop cap termination and avoid unused runTurn dispatch at the ceiling. Add both-transport budget, cap, caller-tool, cancellation, and commitment regressions. Carries #6470 by @lcxhh521. Closes #6464 Co-authored-by: lcxhh521 <59329914+lcxhh521@users.noreply.github.com>
Carry JSON output guidance into system roots and active continuation actions. Include the output format in checkpoint lineage to invalidate changed schemas. Keep the documented prompt-only fallback; omit unrelated explanatory comments. Carries #6417 by @arikon. Co-authored-by: arikon <75247+arikon@users.noreply.github.com>
Add default-off input-ID and private-message-metadata compatibility options. Keep ordinary stripping and xAI repair, including invalid IDs and stored requests. Document the privacy boundary; live launcher acceptance for #6220 remains unverified. Carries #6254 by @codingbooo. Co-authored-by: codingbooo <9621077+codingbooo@users.noreply.github.com>
#6382) Support opt-in metadata forwarding with provider header precedence. Narrow the contributor denylist design to four supported non-secret metadata names. Reject arbitrary names at config boundaries and filter again at runtime. Reimplements #6382 by @2836048681. Co-authored-by: 2836048681 <121647131+2836048681@users.noreply.github.com>
Persist the first output-item and last output-delta timing pair, including reasoning. Prefer that window for estimated decode throughput and retain the legacy TTFT fallback. Keep end-to-end speed unchanged and synchronize unavailable-window locale copy. Carries #6416 by @xyjk0511. Co-authored-by: xyjk0511 <127614382+xyjk0511@users.noreply.github.com>
Share CR, LF, and CRLF field and event rules across validation and projection. Retain exact identity bytes, bounded accounting, and live terminal behavior. Carry the reviewed late-LF callback fix and await regression fixture cleanup. Carries #6461 by @luvs01. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
fix(combos): preserve plan-model refusal evidence through error projection
docs: record native account carry publication
Check the existing ledger policy against each charge's scopes before translating a refused booking. Capacity and duplicate failures cannot authorize another send under a configured ceiling. Preserve observe-only and post-reported behavior. Co-authored-by: Epinephrine <luvs01@hanmail.net>
fix(spend): refuse unbooked dispatches under applicable ceilings
…ublic docs: record scoped release stabilization and verification gates
…-http fix(combo): preserve bounded nested HTTP refusal semantics
…e-isolation test: isolate release fixtures and release holder leases cooperatively
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Contributor
|
✅ Deterministic PR hygiene checks passed. |
Contributor
|
Important Review skippedToo many files! This PR contains 542 files, which is 242 over the limit of 300. To get a review, reduce the PR to 300 files or fewer by splitting it into smaller PRs or changing its base branch. Usage-priced reviews support at most 300 files. ⚙️ Run configuration
⛔ Files ignored due to path filters (1)
📒 Files selected for processing (542)
You can disable this status message by setting the
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
⏳ DRAFT
What to do
Its title has been prefixed with |
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| const EFFORTS = ["low", "medium", "high"] as const; | ||
|
|
||
| function snapshotPath(destination: string): string { | ||
| const key = createHash("sha256").update(destination).digest("hex"); |
| export function bindAnthropicIdentity(access: string, accountUuid: unknown): AnthropicIdentity | undefined { | ||
| if (!access || typeof accountUuid !== "string" || !accountUuid.length || accountUuid.length > 128 | ||
| || accountUuid !== accountUuid.trim() || /[\x00-\x1f\x7f]/.test(accountUuid)) return undefined; | ||
| return { v: 1, accountUuid, bearerSha256: createHash("sha256").update(access).digest("hex") }; |
| " queueMicrotask(() => { emit({ event: 'timeout' }); request.emit('timeout'); });", | ||
| " return request;", | ||
| " };", | ||
| ` eval(${JSON.stringify(args[1])});`, |
3 of 7 tasks
Owner
Author
|
Owner-authorized promotion of the 2.77.0 release candidate to
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
7 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Promote the verified
devcandidate0818ea1812a028e1c14cd0b0511b44863407bc52tomainas stable2.77.0. The merge commit's tree is identical to the candidate (which already carries 2.77.0 in all four version sources); the branch descends fromorigin/mainthrough anoursmerge.main's current tree equals the 2.76.0 candidatee0af52c8a2, an ancestor of0818ea1812, so theoursmerge drops nomaincontent.2.77.0 contents since v2.76.0 (199 commits): Claude
/compactand native context failures stay terminal in Messages (#6516, closes #6504), large native HTTP uploads (#6513, carries #6508), revoked native Codex sessions, stored-main ownership and account-pool attribution (#6515, #6523, carries #6496/#6507), combo fallback refusal evidence and nested HTTP refusal semantics (#6527, #6540, #6505), Ollama tool batches across assistant commentary (#6519, carries #6509), Antigravity Claude 5.5 effort grouping and usage pricing (#6501, #6514), Claude identity across token rotation (#6518, carries #6378), standalone pairing for Child enrollment (#6517, #6076), spend ceilings refusing unbooked dispatches (#6538), the Groksession_idcache fix (#6482), Claude subagent force and Remote Link setup recovery (#6489), the recovered provider/client/desktop train (#6487, #6490), CLI help and typo recovery (#6498, #6500, #6503, #6506), pt-BR dashboard locale (#6458), desktop zoom (#6335), output throughput in usage (#6471), compaction routing by source model (#6149), Droid per-model reasoning defaults (#6151), and the contributor fixes #6119, #6192, #6254, #6382, #6405, #6415-#6417, #6426, #6445, #6449-#6461, #6463, #6466, #6470, #6474, #6477, #6479, #6494, #6495. Canonical #6370 spend recovery stays excluded after its compatibility review.Release authorization: the repository owner asked on 2026-10-04 to stabilize, verify and publish the next production release.
GUI changes carried from dev (screenshots from the source PRs):
Verification
0818ea1812: workflow_dispatch Cross-platform CIlane=allrun 37162399902. Attempt 1: 37 jobs passed;windows 8/9failed once in test teardown (EPERM removing the self-logout case's temp home after its assertions passed). A one-time non-release Windows diagnostic (run 37168238608, same image 20260925.250.1 and Bun 1.4.0) ran that case's teardown cleanly; its owning files are byte-identical to the previous full-green candidate. Attempt 2 re-ranwindows 8/9with the command, assertions and retry schedule unchanged: success, and the run concluded success with all 40 jobs passing except the intentionally unrequested standalone privacy job (the privacy scan insidegatespassed). The intermittent teardown is tracked as a Windows test-cleanup follow-up; the short-path alias gap in the ACL reap matcher is recorded but not shown causal.devat 2.78.0.git diff 0818ea1812 HEADis empty: the merge commit's tree equals the candidate's.release.yml.devlog/_plan/261003_release_stabilization/.Checklist