release: v1.1.1 — broker idle self-terminate, test process leak, rm-alias-safe traps - #2
Merged
Conversation
…penai#450) A shared/worktree broker records its owning sessionIds in broker.json and is torn down only once no owner remains. If a co-owning session disappears without running its SessionEnd hook (SIGKILL, OOM, crash, host reboot) or its teardown skips the entry on lock contention, its sessionId lingers forever and no future hook fires for it, orphaning the broker indefinitely. Fix it broker-side: app-server-broker.mjs now self-terminates after an idle timeout with no connected client. This is platform-independent, needs no PID/liveness signal, and covers the abnormal-exit orphan, the dead-co-owner orphan, and the lock-contention skip in one mechanism (see openai#108, openai#380, openai#450). The timeout is configurable via --idle-timeout <ms> or CODEX_COMPANION_BROKER_IDLE_TIMEOUT_MS (default 30m); a value <= 0 disables it. The timer arms on listen and whenever the last client disconnects, and disarms while a client is connected.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…t in tests; CI leak gate; command rm in traps Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…d CI flakes Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…before teardown, refuse late clients during shutdown The idle self-terminate from openai#457 unlinked the socket and pid file but left broker.json behind, so a later SessionEnd loaded a dead record and signalled a PID (and process group) the OS may have recycled. The broker now drops the record when it still points at itself, and teardownBrokerSession proves the recorded PID is this session's broker (ps command line contains app-server-broker.mjs and the endpoint) before signalling it. shutdown() also kept listening while it closed the app-server child: a client accepted in that window got the broker-local initialize and then failed its first RPC with "codex app-server client is closed". The listener is now closed synchronously before the first await and late sockets are destroyed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
1.1.1 — 2026-08-28
CODEX_COMPANION_BROKER_IDLE_TIMEOUT_MS/--idle-timeout), so idle brokers and their app-server children no longer accumulate (app-server brokers never self-terminate → orphaned process/RAM leak (34 chains, 272 procs, ~2.2GB) openai/codex-plugin-cc#543).broker.jsonownership record (a laterSessionEndcould otherwise signal a recycled PID, andstatuscould advertise a dead endpoint), teardown verifies the recorded PID really is this session's broker before signalling it, and the broker stops listening before it closes its app-server child so a client connecting mid-shutdown is refused instead of being served and then failing its first RPC.codex app-server/broker processes (5 s idle timeout in the test environment; CI fails if anycodex-plugin-test-*process survives).command rm -f --in their cleanup trap (no noise fromrmaliases such astrash).Reviews: task gates (Claude), whole-branch review (Claude) + adversarial review (Codex gpt-5.6-sol) → 2 lifecycle races fixed (stale-pid teardown hazard, late clients during shutdown) → scoped re-review clean. Tests 145 → 150; live check: real broker exits after idle timeout.
🤖 Generated with Claude Code