feat(gui): add default-off Codex Desktop sign-in preference

[lidge-jun]

Summary

Carry #3860: Dashboard offers Open Codex without signing in as an explicit default-off preference. Save precedes sync; failed/skipped/catalog-only sync and later settings polling preserve the pending indication until application is confirmed. Upstream credentials and remote admission remain required. Includes the separately committed docs handoff from lane E: seven code-mode integration-guide translations.

Verification

• Cross-platform CI: all required per-chain jobs SUCCESS, exact top head f1b8f2d2f1edee55b68202469f86a5334710688d: Linux 4, macOS 2, gates, storage, API, all keyring/npm smokes and Docker. Overall run status is completed / success; this is not an assertion that every workflow job passed.
• Explicit user policy defers the six Windows test shards and macos control to one run on the final release-train head. They are excluded only from this per-chain LANDABLE decision. Windows keyring/npm smoke jobs remain required. Lower product CI is represented by the cumulative top-head result.
• Attempt 1 macOS 1/2 timed out before a test result in codex-inject-write-lock.test.ts. Main explicitly authorized retrying the failed job at the unchanged head. The required-job evidence above uses each job's latest attempt; earlier failure is retained in run history. Independent Astra diagnosis found no proven C-cache interaction, and the same-head macOS control passed that file.
• Local tests/typecheck/build/install: NOT RUN, explicitly prohibited for this train. Runtime verification is remote CI only.
• git diff --check: passed.
• Jason, independent Astra high explorer: PASS after fixing skipped-sync and settings-poll pending-state loss. Default OFF and auth/runtime boundaries preserved. The subsequent lane E documentation patch also passed independent plan/content review; application code is unchanged by it.

Rendered from the remote CI dashboard artifact with isolated API fixtures; no live proxy settings changed. Artifact build-commit matched f1b8f2d and build-gui-tree matched 3b96491017e3e866e959aea62cab6790b034e101. Browser verified unavailable-model retention, reorder by click and Enter with focus retained, fallback Save feedback, and Desktop false-to-true preference. Screenshot viewport 1440x1013; additional 500px layout inspected. Local build/test/install not run.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Manual dependent PR chain

Native stack: null. Review only this layer’s diff. Main integrates bottom-up after refreshing dev ancestry, live heads/bases, review threads and required gates. This task does not merge. The CI-tested cumulative top tree is the integration target; advancing dev requires another cascade and top-head verification.

Layer	Source	PR	Head
1	#3839	#3873	51b44371860b2ec933d66de1b68ca790be3b81fb
2	#3841	#3874	8eaa5641902b84bec6c97a94de6c2fe6d810c31d
3	#3863	#3875	91b54b79bc780011031b00354621cc9fcaef360e
4	#3860	#3876	abbdb227f385443228656c8440282187cb5dec75
5	#3252	#3878	f1b8f2d2f1edee55b68202469f86a5334710688d

---

Maintainer integration decision (MAINTAINERS.md, dev-only admin integration): @lidge-jun integrates lane C's manual chain (#3873 → #3874 → #3875 → #3876 → #3878) into dev bottom-up. Chain-top evidence at head f1b8f2d2f: Cross-platform CI run 34116228181, aggregate ci = success (attempt 2: macos 1/2 timed out at 20 min in attempt 1 after codex-inject-write-lock.test.ts with no output; independent diagnosis found no causal link to this chain and the same head's macos control passed those tests; the failed job alone was rerun and passed — no code change). Windows 6/6 and macos control also green on this head. Prospective merge tree of origin/dev@522ce5f8c + top = e0b0e5886 = tested tree. Independent source/security/GUI reviews PASS per PR bodies; screenshots from this run's dashboard-preview artifact. Local suites NOT RUN. Maintainer integration, not self-approval.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (2)

• ^dev$
• ^preview$

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Team

Run ID: abb96975-2531-4de2-b33c-ce04c27341cb

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[lidge-jun]

리뷰 · 우선순위 72 / 80

이 PR은 #3860(RobinBially)을 Lane C 4층(base=codex/260907-c3-startup-health)으로 올린 캐리입니다. Dashboard Overview에 Open Codex without signing in을 명시적 default-OFF 선호로 둡니다. 없거나 false면 기존 로그인 요구를 유지하고, 이미 true인 값만 켠 채로 둡니다. 닫힌 #3689(authless Desktop을 default-on으로 강제)와 달리, 메인테이너 방향과 맞는 opt-in default-off입니다. 런타임 라우팅·카탈로그·provider 기본값·원격 admission은 건드리지 않습니다. codexDesktopAuthless API·루프백 계약은 이미 dev에 있고, 이 PR은 GUI 토글·i18n 9개 로케일·문서·테스트를 얹습니다.

동작 계약이 원본 #3860보다 한 단계 단단합니다. 저장이 sync보다 먼저 가고, sync가 실패·skipped·catalog-only여도 pending을 유지합니다. 설정 poll이 GET으로 pending을 지워 버리지 않도록 catalogRefreshPending을 OR로 보존하고, sync 결과에서 ok && status === "applied"일 때만 pending을 지웁니다. 원본 #3860은 sync 성공 응답이면 status와 무관하게 pending을 지웠습니다. 토글은 settingsSaving || syncing일 때 막고, Sync 버튼도 settings 저장 중 비활성화합니다. codexAutoStart와 같은 toggleCodexSetting 헬퍼로 묶었습니다. types/config 분할과 무관합니다.

불변조건 확인: 이 변경은 authless Desktop을 강제 ON 하지 않습니다. settings?.codexDesktopAuthless ?? false와 aria-pressed 기본 false가 그 계약을 UI에 박습니다. #3689 회귀가 아닙니다.

dashboard-overview-sections.tsx Desktop 토글 - default-off switch, syncing/saving 중 disable
use-dashboard-data.ts toggleCodexSetting + pending 보존 - save-before-sync, applied일 때만 pending clear
dashboard-shared.ts SettingsData/SyncResult - codexDesktopAuthless·catalogRefreshPending·status 타입
vision-sidecar-dashboard.test.tsx·codex-inject.test.ts - absent/false/true·pending 회귀
원본 #3860 - 트레인 캐리가 이 PR. 원본은 superseded/landed-via 후보

메인테이너의 판단이 필요한 지점

• fix(service): add safe nonblocking startup-health snapshots #3875 다음 이 레이어를 넣을지
• 원본 #3860을 머지 전 superseded로 닫을지, 머지 후 Landed via #3876으로 닫을지(권장: 머지 후 landed-via, 또는 지금 superseded 코멘트)
• astra 구현/보안 리뷰가 본문에 pending으로 남아 있는데 top CI만으로 undraft할지

너의 추천
Lane C 4층으로 머지하세요. default-off opt-in이 메인테이너 방향과 일치하고, pending/sync 계약은 원본보다 낫습니다. 머지 후 #3860에 Landed via #3876 at <commit> + landed-via-maintainer를 남기고 닫으세요. #3689를 다시 열거나 default-on으로 바꾸지 마세요.

이 댓글은 grok-bot이 작성했습니다

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-07T11:59:17.553471Z	abbdb22	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: abbdb227f3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".