Codex Manager v0.6.7

Codex Manager v0.6.7

概览

修复 v0.6.6 升级时，接近旧 512 MiB 容量上限的数据库因新增索引而迁移失败、应用无法启动的问题。

Fix a v0.6.6 upgrade failure where new indexes exceeded the former 512 MiB database limit and prevented the application from starting.

本机更新由用户自行操作，安装后启动与真实 OAuth 业务链仍未验收。 / The user will update locally; post-install startup and the real OAuth workflow remain unaccepted.

主要变化

• SQLite 主数据库预算改为固定 1 GiB，按实际 page_size 计算页数上限；重复打开不会自动增加预算。 / Set a fixed 1 GiB SQLite main-database budget, calculating the page limit from the actual page_size; reopening does not automatically increase the budget.
• 保持现有迁移 SQL 与事务回滚行为，不清空历史数据；新增容量、回滚、重试及不同页大小的回归测试。 / Preserve existing migration SQL and transactional rollback without clearing history; add regression coverage for capacity, rollback, retries, and different page sizes.

验证状态

• implemented：修复已进入 v0.6.7 定版源码。 / The fix is included in the source prepared for v0.6.7.
• tested：本地存储测试 19 项、Node 测试 125 项通过。3 项新增存储测试覆盖容量失败回滚、成功重试、重复打开、checkpoint 与旧记录保留、1/4/8 KiB 页大小、固定预算及写满后无部分记录；存储 Clippy 与 Rust 格式检查通过。最终版本源码仍须通过发布工作流门禁。 / Local validation passed 19 storage tests and 125 Node tests. Three new storage tests cover capacity-failure rollback, successful retry, reopening, checkpoint and record preservation, 1/4/8 KiB page sizes, a fixed budget, and no partial records on a full database. Storage Clippy and Rust formatting checks passed. The final versioned source must still pass the release workflow gates.
• observed：真实旧库私有副本复现旧上限下的 SQLITE_FULL；修复后的生产 Store::open 将另一副本从迁移 13 升至 14，主库约 526 MiB，14 张已有业务表行数与全部 ingest checkpoint 不变，quick_check=ok。原数据库和本机安装包未修改。 / A private copy of the real old database reproduced SQLITE_FULL under the former limit. The fixed production Store::open upgraded another copy from migration 13 to 14, resulting in a main database of about 526 MiB, with unchanged row counts across 14 existing business tables, all ingest checkpoints preserved, and quick_check=ok. The original database and installed application were not modified.

详细条件与验证边界记录于源码中的 docs/validation/startup-migration-capacity.md。 / Detailed conditions and validation boundaries are recorded in docs/validation/startup-migration-capacity.md in the source tree.

兼容性与限制

• 支持平台仍为 macOS 13+ Apple silicon；不新增 schema 版本，不改变 Codex 配置格式。 / Platform support remains macOS 13+ on Apple silicon; no new schema version or Codex configuration format change is introduced.
• 1 GiB 是有限的主数据库预算，不包含 WAL 与 SQLite 临时文件。真实磁盘不足、数据库损坏或达到新上限仍可能导致启动或写入失败；本版不修改通用启动异常处理。 / The finite 1 GiB budget excludes WAL and SQLite temporary files. Actual disk exhaustion, corruption, or reaching the new limit can still cause startup or write failures; general startup error handling is unchanged.
• 真实 OAuth 成功请求、上游 5xx、checkpoint 刷新与 Codex Responses 完整业务链及费用验收仍未完成。 / Real OAuth success, upstream 5xx, the complete checkpoint-refresh and Codex Responses workflow, and billing acceptance remain unverified.

隐私与安全

官方 OAuth、CLIProxyAPI OAuth 与 Codex 配置三个信任域及现有秘密存储规则不变；不新增原生权限、网络访问或消息正文采集。真实数据库副本只用于私有本地验证，不进入仓库或发布资产。 / The three trust domains for official OAuth, CLIProxyAPI OAuth, and Codex configuration, and existing secret-storage rules remain unchanged. No native permissions, network access, or message-body collection are added. Real database copies were used only for private local validation and are excluded from the repository and release assets.

发布状态

• published：本文在版本 tag 创建前冻结，不预先宣称 Release 已公开、已签名或已完成公开复验；实际状态以对应发布工作流及独立公开复验证据为准。 / This note is frozen before the version tag is created and does not predeclare publication, signing, or public verification. Actual status is established by the corresponding release workflow and independent public-verification evidence.
• accepted：私有副本迁移验证通过；修复版安装后的真实启动尚未验收。本机更新由用户自行执行，updater 安装不作为本轮代理执行的完成条件，也不标记为通过。真实 OAuth 业务链未验收。 / Private-copy migration validation passed; startup acceptance on an installed fixed build remains pending. The user will update the local application themselves; updater installation is outside the agent's completion criteria for this round and is not reported as passed. The real OAuth workflow remains unaccepted.
• cleanup：验证用私有数据库副本已清理；原数据库未被副本覆盖。发布时的临时证书、Keychain 与签名材料必须由工作流清理并验证后，才能记录发布清理完成。 / Private validation database copies were removed; the original database was not overwritten. Release-time certificates, Keychains, and signing material must be removed and verified by the workflow before release cleanup can be reported complete.

完整性

创建 v0.6.7 tag 和 Publish 前，版本字段、双语 README、适用文档、图片与链接及用户可见状态必须在同一 exact source SHA 同步并通过检查；既有 tag 和资产不得覆盖。Release 正文直接使用本文件，latest.json.notes 从本文件生成。 / Before creating the v0.6.7 tag and publishing, version fields, bilingual READMEs, applicable documentation, images, links, and user-visible status must be synchronized and checked at the same exact source SHA. Existing tags and assets must not be overwritten. The Release body uses this file directly, and latest.json.notes is generated from it.

稳定发布须通过现有签名、公证、stapling、Gatekeeper、updater 验签、哈希、供应链证明及草稿资产回下载门禁；Publish 后须执行独立只读 published 复验。最终 source SHA、Release ID、Actions run、资产与验证结果记录在外部 Actions evidence artifact 的 RELEASE-VERIFICATION.json 及证明文件，不回写不可变 tag。执行及回退规则见发布运行手册。 / Stable publication requires the existing signing, notarization, stapling, Gatekeeper, updater-signature, hash, supply-chain evidence, and draft-asset download gates, followed by independent read-only published verification. The final source SHA, Release ID, Actions run, assets, and verification results are recorded in RELEASE-VERIFICATION.json and supporting files in an external Actions evidence artifact; immutable tags are not rewritten. Execution and rollback rules are documented in the linked release runbook.