This repository was archived by the owner on Sep 13, 2026. It is now read-only.
sync: upstream v2.52.0 (4d37c351) into dev - #336
Draft
cursor[bot] wants to merge 792 commits into
Draft
cursor[bot] wants to merge 792 commits into
cursor[bot] wants to merge 792 commits into
Conversation
…helper The audit named readPaths, previousWorkspaceUris and the fileStates keys as fields a later extension could leak. Record that in the code rather than only in the review thread.
…point-shape feat(cursor): report decoded checkpoint shape so coverage is answerable from logs
* docs(devlog): open the account pool unification unit * docs(devlog): fold two audit rounds into the account pool unification plan * docs(devlog): write the five phase documents for the account pool unit --------- Co-authored-by: Codex <codex@users.noreply.github.com>
The audit drove the first version of these tests red on the parent branch: all three passed with the production change reverted, because they only re-asserted what resetCodexRoutingForManualSelection and the deliberately exempt failover promote already did. Three defects fall out of that. Deletion reaches routing through clearCodexUpstreamHealthForAccount, which did not revoke the preference, so a preference could outlive its account and suppress every later write. The generation sweep had the same hole. The model-detour promote wrote over the operator's selection while preemption next to it yielded. The independent-scope preference entries were written and consumed but never read by any guard. Co-authored-by: Heisenberg <audit@localhost>
Guarding it failed 8 cases in codex-routing.test.ts. A model detour runs because the operator account cannot serve the model at all, and under a rotating strategy the promote moves only the process-local cursor, never the persisted selection.
reconcileCodexRoutingHealth had no test at all, so the preference sweep added for the delete-path blocker was verified by reading rather than by running. Both halves are covered now: an account the generation no longer lists loses its preference, and one that is still listed keeps it. Red control: removing the four sweep lines makes the first case read undefined.
…ards clearCodexUpstreamHealth dropped every health map but kept lastReconciledGeneration and liveHealthAccountIds, so after a full reset recordCodexUpstreamOutcome would still discard a writer whose generation predated the watermark for any account missing from the equally stale live set. Found because the watermark leaked between test files: the new generation-sweep coverage failed two unrelated cases in codex-routing.test.ts when both files ran in one process.
feat(providers): pick a warm API key before the first attempt
refactor(oauth): move the pool rotation kernel out of the Codex namespace
…-followup docs(structure): close the review findings on the SSOT gate
…it-boundary codex-ws: settle post-send failures as honest gateway statuses and replace the fixed prelude deadline with liveness
…on-wins fix(codex): let an operator account selection outrank the pool cursor
…sions Issue distinct tokens for one proven user so refresh and rotation cases exercise a changed fingerprint, keep the root-mismatch regression on an authenticated admission, and assert the superseded caller bearer stops matching.
The deadline now starts before credential selection, so a client that leaves during that wait must be reported as a hangup with nothing dispatched and the admitted turn released.
…dex key Security review found the relay unreachable in its only supported configuration: the default bind is loopback, admission there never reads a token, and the injector only rewrites the base URL for loopback hosts, so every history call returned 403 even with a valid key. The relay now asks the identity question separately from admission - a context request presenting a real opencodex key owns its sessions, one presenting none is still refused - and a regression exercises the real resolver instead of a hand-built admission.
…wnership Security re-audit found the previous fix one-sided: the relay could name a loopback caller but the model turn still recorded ownership from admission alone, so a correctly named caller found no entry and got 409. Both paths now use resolveContextPrincipal. The guides and structure doc now state what actually works - a remote bind with a configured key, or a client that sends x-opencodex-api-key - because the built-in loopback injection cannot carry that header, and whether a loopback bind should identify callers is left as a maintainer decision rather than a relaxed refusal.
…ental opt-in The opt-in only guarded the injected base URL, so the ten endpoints and the ownership registry stayed live for any caller able to reach the data plane, including one posting the paths directly. contextRelayActivated reads Codex own config and now guards the relay handler and the recording path as well; absent, unreadable or malformed config is not an opt-in, and the decision is cached against config identity so turning it off applies without a restart. Regressions assert 404 on both prefixes, no owner recorded and zero upstream calls while it is off.
Resolve the Codex home inside the try rather than in a default parameter, since those evaluate before the body and this gate now runs during model turns, where an unreadable CODEX_HOME would abort a turn upstream already served. Gate the route match as well so a disabled feature takes no turn lease. Pin cache invalidation without the reset seam and the unreadable-home refusal, and restore the Korean disable paragraph.
Add the lidge-jun#3433 transport matrix with actual Chat handler and captured canonical Responses request. Preserve key and original header spellings; no identity synthesis. Synthetic fixtures do not establish Hermes emission or cache-hit improvement. Local suites NOT RUN; hosted CI pending.
…cache-hermes test(chat): verify native outbound conversation identity (lidge-jun#3433)
The fallback-port fixture records a port from allocateFreePort, which reports the port it has already released. On a four-shard runner every other test binding an ephemeral port is a candidate to take it, and when that happens status finds a listener on the recorded port, reports the record as live, and the assertion fails against something the test never set up. It failed exactly that way on the preview promotion run while the same commit passed on dev. Confirm the recorded port refuses immediately before and immediately after the status probe, and re-allocate when something took it in between. The assertion is unchanged and no weaker: a run only counts when the endpoint demonstrably refused across the whole probe, and exhausting the attempts fails with that reason rather than silently passing.
…relay feat(codex): relay experimental context history under a least-privilege owner
…53.0 chore(release): open dev at 2.53.0 before releasing 2.52.0
…port-flake test(cli): stop judging a stale record on a port another test can take
Product tree is dev at 7bfb2ad. Only package.json differs, carrying the stable channel version 2.52.0. This promotion follows a CI repair and a regression sweep: dev had drifted 79 commits past its last finished run and the one run allowed to complete had failed. lidge-jun#4390 fixed an integration test that never denied anything and had been red on dev since lidge-jun#4342; lidge-jun#4396/lidge-jun#4397/lidge-jun#4398 closed four gaps in the quota avoidance contract lidge-jun#4368 introduced; lidge-jun#4403 made a port fixture deterministic.
release: promote verified 2.52.0 product tree to main
Resolve 88 conflicts per docs/fork/OWNED.md: - upstream-owned: take vendor/main - package.json: fork recipe (name @yansigit/opencodex, version 2.52.0) - shared-hotspot core.ts: upstream control flow + fork v2 bridge, passthrough web-search bridge, and google provider options Co-authored-by: SB Yoon <yansigit@users.noreply.github.com>
…v2.52.0 sync Re-apply fork invariants dropped by upstream-owned merges: - Restore fork config/types with upstream v2.52 fields (privacy, pool, codexPool, etc.) - Merge vendor config.ts and re-export fork helpers - Restore cursor recovery kinds and agentKind in usage log - Add UpstreamRedirectError, ai-studio-web googleMode, requestPacing registry seed Co-authored-by: SB Yoon <yansigit@users.noreply.github.com>
Co-authored-by: SB Yoon <yansigit@users.noreply.github.com>
Re-apply fork SubagentDelegationSection, Subagents, and dashboard hooks after upstream-owned merges, including upstream ultra-mode recommendation handling and codexClientCompaction. Restore upstream computeCodexUsageScore refinement when long windows are known while keeping fiveHour alias normalization. Wire the plaintext-remote test seam into assertServerAuthConfig. Harden hub status tests for owner-only service token files and reword comments that tripped hygiene. Co-authored-by: SB Yoon <yansigit@users.noreply.github.com>
Co-authored-by: SB Yoon <yansigit@users.noreply.github.com>
|
github-actions
Bot
added
the
intake: hygiene-blocked
PR automation (bot-owned)
|
⏳ DRAFT
What to do
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Daily-merge sync of upstream v2.52.0 (
vendor/main@4d37c35155fe283722566d32892b8753c1230be7) ontoorigin/dev@785424295fc5d8ef0a66fb8ce94a55fe3b054471.Stages 3–7 (coordinator handoff): merged
vendor/main, resolved 88 textual conflicts perdocs/fork/OWNED.md, re-applied fork preservation commits (config/types, usage, registry, WS default-off, GUI delegation, hotspotcore.ts), and pushed branchsync/upstream-v2.52.0-4d37c35155fe-785424295fc5(HEADc5d9fe401).Do not squash/rebase. Human merge commit only.
Upstream pin
v2.52.0vendor/main4d37c35155fe283722566d32892b8753c1230be7origin/dev785424295fc5d8ef0a66fb8ce94a55fe3b054471c5d9fe4013e70fa57c4a5082a89e99d7f7d26ed9vendor/mainv2.52.0 / 4d37c35 — donesrc/server/responses/core.tsper OWNED.md — done (manual merge + preservation oracle updated)origin/dev— pending CI (gh pr view --json mergeable)ci/enforce-target/hygiene— local hygiene pass; full CI pendingConflict decision table (88 files)
src/*except hotspots, upstream tests,bun.lock,scripts/test.ts, layout)--theirs, then preservation commits7b11378e3,9f1619775,208fb3681package.json@yansigit/opencodex, non-decreasing versionmergePackageJson()→2.52.0bun run audit:highsrc/server/responses/core.ts(hotspot)bun test tests/responses/core-fork-preservation.test.ts,bun test tests/responses/7b11378e3,9f1619775,208fb3681,c5d9fe401bun run typecheck,bun run build:gui, focused responses testsFull upstream-owned conflict list (86)
bin/ocx.mjs,bun.lock, docs-site claude-code / management-api / installation / providers / server locales, guiAddProviderModal,ProviderCatalog,ProviderOverview,Models,Subagents,use-dashboard-data, gui tests, readme locales,scripts/test-layout/layout.json,scripts/test.ts,skills/ocx/references/01_management_surface.md,src/claude/*,src/cli/status.ts,src/codex/inject.ts,src/codex/quota.ts,src/config.ts,src/lab/subject/behavior-fingerprint.ts,src/oauth/*,src/providers/registry.ts,src/server/claude-messages.ts,src/server/index.ts, management routes,collaboration.ts,compact.ts,fetch-helpers.ts,ws-upstream.ts,src/types/config.ts,src/update/*,src/usage/log.ts,structure/ops/docs-and-release.md, and listed upstream tests undertests/.Hotspot notes (
core.ts)hasUnexpandedPreviousResponse) before fork v2 delegation bridge.commitReasoningReplayServingRoute.credentialDomainWasRewrittenandshadowIntercepted.Verification
Commands run locally on HEAD
c5d9fe401:Known blockers for human follow-up (not green for full responses shard):
tests/responses/ws-failure-stage.test.ts— 4 failures (fallback must not run after open; likely interaction between fork WS default-off and upstream failure-stage reporting).tests/responses/responses-fetch-helpers-boundary.test.ts— import boundary expects fewer runtime imports than preservation-added edges.tests/responses/(v2 native parent override, reasoning allocation admission, V2 routed delegation bridge) — need reconciliation with upstream v2.52 control flow.Full
bun run testnot claimed green; CI required before human merge.Checklist
core-fork-preservation, hub token file mode, hygiene comment wording).--theirs; no separate fork doc change.Review readiness (contributor): leave draft until CI green; then tick local CI / latest dev / review findings / ready-for-review per enforce-target.