Repository navigation
codex-plugin-cc v1.3.0
Lifecycle correctness: turns that no longer hang, kills that only ever hit the process they were meant for, and a stop gate you can pin.
Highlights
- Terminal
errornotifications end the turn as failed instead of hanging; retried errors keep it running; a subagent's error no longer fails the main turn (openai#698, openai#757, openai#775, openai#781). - Broker lifecycle: bounded connects with
ETIMEDOUTfallback, wedged-broker replacement with a 2 s readiness retry, no signal to a stale or recycled pid, freshly spawned brokers that never become ready are killed as a process group (openai#753, openai#762, openai#768, openai#749, openai#773, openai#782). - Identity-checked kills and reaping on posix (openai#743):
pidIdentityin job records, JSON pid sidecars (legacy integer still read) andbroker.json;cancelkeeps a job running and says so when the kill could not be confirmed; SessionEnd keeps records of workers it did not stop. status <id> --waitexits 1 and prints a timeout line when the wait times out (openai#774).- Stop gate:
setup --review-gate-model <model|inherit> --review-gate-effort <effort|inherit>, default of 3 gate-induced rounds (CODEX_REVIEW_GATE_MAX_ROUNDS=0restores unbounded), signal name and/codex:setup --disable-review-gatehint in every infrastructure failure reason,hooks.jsonwithout a top-leveldescription(openai#769, openai#548, openai#589, openai#483, openai#459). - Transfer honours
CLAUDE_CONFIG_DIR(openai#721). - Model aliases resolve against the local Codex catalogue (
$CODEX_HOME/models_cache.json, thencodex debug models --bundled),astraalias, effort validated per model (openai#468, openai#703, openai#485). - Security: fallback state root is per-user (0700) and per-plugin, symlinked roots refused;
broker.jsonvalidated before use (openai#521, openai#609).
Compatibility
status --waitnow exits 1 on timeout (also with--json; the snapshot keepswaitTimedOut).CODEX_REVIEW_GATE_MAX_ROUNDSunset now means 3 rounds (was unbounded).- Pid sidecars
jobs/<id>.pidare JSON; v1.2.x integer sidecars and records withoutpidIdentitystill work on posix. - Windows: kills from stored records (cancel worker, SessionEnd cleanup, stale-broker replacement, broker teardown) are refused until process identity lands in v1.4.0; leaks are bounded by the broker idle timeout and the turn interrupt is still sent.
- Fallback state under
os.tmpdir()(only whenCLAUDE_PLUGIN_DATAis unset) is keyed by plugin install path and is not carried over across plugin updates.
Validation
- Exact tag target:
78576a5d376524d347e79a46fea7543332f7da3b - Local gate: 313/313 tests, 0 leaked test processes,
npm run build,npm run check-version,claude plugin validate . --strict - GitHub CI: https://github.com/CBEPX/codex-plugin-cc/actions/runs/36351327223
- Review: Codex adversarial review (five passes, final verdict: ship), Claude whole-branch review (with fixes, all addressed)
- Runtime dependency audit:
npm audit --omit=devreports 0 vulnerabilities
Artifact
78e98e2296c9ab2d2cded2798e86f518e5dea7c9252a48641a87d738921f9550 cbepx-codex-plugin-cc-1.3.0.tgz