release: promote verified 2.52.0 product tree to main - #4407
Merged
Conversation
…n actually sends A client-tool turn suspends before turnEnded, and upstream sends that turns checkpoint right after toolCallStarted - after the 50ms drain grace, so it was cancelled away and every such turn full-replayed with cached_tokens 0. Measured live with the tool catalog held constant: 50ms captures nothing, 1500ms captures 3036 bytes. Extend once, bounded, before finalizeAfterDrain (which terminates the event state), and fire early from the capture site so a turn that does send a checkpoint pays arrival latency instead of the whole window. The native wire-model gate is untouched: capturedAfterClientTool proves arrival, not coverage.
…capture fix(cursor): capture the conversation checkpoint a suspended tool turn actually sends
…4282) Splits the DeepSeek thinking set by who serves the route (first-party deepseek-flash vs gateway deepseek-v4.1-flash), removes the retired deepseek-v4-pro from every static roster, and excludes it from the routed catalog on live-discovery providers where deleting a row would strip capabilities instead of the model. Carries the Command Code effort ladders from #4258. Maintainer integration into dev per MAINTAINERS.md with all checks passing at the exact head.
…le from logs Every checkpoint diagnostic reported bytes, which cannot distinguish a snapshot that contains the suspended tool call from one that merely arrived after it - the exact gap that leaves the native wire-model gate undecidable in #4245. cursorCheckpointShape returns counts only, never content, and the decode is skipped unless provider debug is on.
…helper The audit named readPaths, previousWorkspaceUris and the fileStates keys as fields a later extension could leak. Record that in the code rather than only in the review thread.
feat(cursor): report decoded checkpoint shape so coverage is answerable from logs
* docs(devlog): open the account pool unification unit * docs(devlog): fold two audit rounds into the account pool unification plan * docs(devlog): write the five phase documents for the account pool unit --------- Co-authored-by: Codex <codex@users.noreply.github.com>
The audit drove the first version of these tests red on the parent branch: all three passed with the production change reverted, because they only re-asserted what resetCodexRoutingForManualSelection and the deliberately exempt failover promote already did. Three defects fall out of that. Deletion reaches routing through clearCodexUpstreamHealthForAccount, which did not revoke the preference, so a preference could outlive its account and suppress every later write. The generation sweep had the same hole. The model-detour promote wrote over the operator's selection while preemption next to it yielded. The independent-scope preference entries were written and consumed but never read by any guard. Co-authored-by: Heisenberg <audit@localhost>
Guarding it failed 8 cases in codex-routing.test.ts. A model detour runs because the operator account cannot serve the model at all, and under a rotating strategy the promote moves only the process-local cursor, never the persisted selection.
reconcileCodexRoutingHealth had no test at all, so the preference sweep added for the delete-path blocker was verified by reading rather than by running. Both halves are covered now: an account the generation no longer lists loses its preference, and one that is still listed keeps it. Red control: removing the four sweep lines makes the first case read undefined.
…ards clearCodexUpstreamHealth dropped every health map but kept lastReconciledGeneration and liveHealthAccountIds, so after a full reset recordCodexUpstreamOutcome would still discard a writer whose generation predated the watermark for any account missing from the equally stale live set. Found because the watermark leaked between test files: the new generation-sweep coverage failed two unrelated cases in codex-routing.test.ts when both files ran in one process.
feat(providers): pick a warm API key before the first attempt
refactor(oauth): move the pool rotation kernel out of the Codex namespace
…vin-windows fix(devin-cli): honor platform path semantics in credential discovery
…ge owner Carry #3663 from 8e0b53b with two contract changes: context ownership is partitioned by the admission principal minted for the matched opencodex API key and bound to the stable user the accepted credential proves, and one deadline covers the whole relay starting before the body is read. Local product tests NOT RUN per explicit user instruction; hosted CI follows. Co-authored-by: ykvv <229483879+y2ambition-ai@users.noreply.github.com> Co-authored-by: nbbb26 <259064678+nbbb26@users.noreply.github.com>
…before relay dispatch Address review of the relay carry: a caller bearer must be the exact credential an accepted model turn used, a credential proving no stable user cannot rebind an entry by sharing its workspace id, conflicting user claims poison the existing entry, and admission is re-resolved against the listener policy before dispatch. Tests updated for the new signatures with regressions for each rule. Local product tests NOT RUN per explicit user instruction.
…sions Issue distinct tokens for one proven user so refresh and rotation cases exercise a changed fingerprint, keep the root-mismatch regression on an authenticated admission, and assert the superseded caller bearer stops matching.
The deadline now starts before credential selection, so a client that leaves during that wait must be reported as a hangup with nothing dispatched and the admitted turn released.
…dex key Security review found the relay unreachable in its only supported configuration: the default bind is loopback, admission there never reads a token, and the injector only rewrites the base URL for loopback hosts, so every history call returned 403 even with a valid key. The relay now asks the identity question separately from admission - a context request presenting a real opencodex key owns its sessions, one presenting none is still refused - and a regression exercises the real resolver instead of a hand-built admission.
…wnership Security re-audit found the previous fix one-sided: the relay could name a loopback caller but the model turn still recorded ownership from admission alone, so a correctly named caller found no entry and got 409. Both paths now use resolveContextPrincipal. The guides and structure doc now state what actually works - a remote bind with a configured key, or a client that sends x-opencodex-api-key - because the built-in loopback injection cannot carry that header, and whether a loopback bind should identify callers is left as a maintainer decision rather than a relaxed refusal.
…ental opt-in The opt-in only guarded the injected base URL, so the ten endpoints and the ownership registry stayed live for any caller able to reach the data plane, including one posting the paths directly. contextRelayActivated reads Codex own config and now guards the relay handler and the recording path as well; absent, unreadable or malformed config is not an opt-in, and the decision is cached against config identity so turning it off applies without a restart. Regressions assert 404 on both prefixes, no owner recorded and zero upstream calls while it is off.
Resolve the Codex home inside the try rather than in a default parameter, since those evaluate before the body and this gate now runs during model turns, where an unreadable CODEX_HOME would abort a turn upstream already served. Gate the route match as well so a disabled feature takes no turn lease. Pin cache invalidation without the reset seam and the unreadable-home refusal, and restore the Korean disable paragraph.
Add the #3433 transport matrix with actual Chat handler and captured canonical Responses request. Preserve key and original header spellings; no identity synthesis. Synthetic fixtures do not establish Hermes emission or cache-hit improvement. Local suites NOT RUN; hosted CI pending.
test(chat): verify native outbound conversation identity (#3433)
The fallback-port fixture records a port from allocateFreePort, which reports the port it has already released. On a four-shard runner every other test binding an ephemeral port is a candidate to take it, and when that happens status finds a listener on the recorded port, reports the record as live, and the assertion fails against something the test never set up. It failed exactly that way on the preview promotion run while the same commit passed on dev. Confirm the recorded port refuses immediately before and immediately after the status probe, and re-allocate when something took it in between. The assertion is unchanged and no weaker: a run only counts when the endpoint demonstrably refused across the whole probe, and exhausting the attempts fails with that reason rather than silently passing.
feat(codex): relay experimental context history under a least-privilege owner
chore(release): open dev at 2.53.0 before releasing 2.52.0
test(cli): stop judging a stale record on a port another test can take
Product tree is dev at 7bfb2ad. Only package.json differs, carrying the stable channel version 2.52.0. This promotion follows a CI repair and a regression sweep: dev had drifted 79 commits past its last finished run and the one run allowed to complete had failed. #4390 fixed an integration test that never denied anything and had been red on dev since #4342; #4396/#4397/#4398 closed four gaps in the quota avoidance contract #4368 introduced; #4403 made a port fixture deterministic.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Contributor
|
Important Review skippedToo many files! This PR contains 840 files, which is 540 over the limit of 300. To get a review, reduce the PR to 300 files or fewer by splitting it into smaller PRs or changing its base branch. Usage-priced reviews support at most 300 files. ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Advanced Run ID: ⛔ Files ignored due to path filters (15)
📒 Files selected for processing (840)
You can disable this status message by setting the Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
|
✅ Deterministic PR hygiene checks passed. |
Owner
Author
리뷰 · 우선순위 78 / 80이 PR은 새 기능을 더하는 작업이 아닙니다. 이미 이 리뷰 시점에 이 PR은 이미 머지되어 있습니다. 머지 커밋은
본문이 강조한 수리 축은 실제로 출구를 막던 것들입니다. #4390은 #4342 이후 빨갛게 남아 있던 “아무것도 거절하지 않던” 통합 픽스처를 고쳤고, #4396+#4397+#4398은 #4368이 만든 게이트 쪽은 이전 안정 승격(#4271 2.51.0, #4195 2.50.0 등)과 같은 패턴입니다. 남은 게이트는 발행입니다. 머지 직후 push-event Cross-platform CI 런 34694895923은 이 리뷰 시점에 아직 진행 중(queued/in_progress)입니다. Service lifecycle는 같은 SHA에서 이미 success입니다. 경로 base= 메인테이너의 판단이 필요한 지점
너의 추천 이 댓글은 grok-bot이 작성했습니다 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
mainas2.52.0. The merged tree is identical to dev at7bfb2ad8a6except for thepackage.jsonversion line, which carries the stable channel version.Verification
devlog/_plan/260912_release_regression_train/025_sweep_results.md. Eight read-only lanes, six clean, one already-fixed minor, one blocking finding now landed.4b6849cf12andf2f1783ae0during the repair sequence.mainpush-event Cross-platform CI run on this promotion, plus the Service lifecycle run thatpackage.jsontriggers, are the release gates and have to pass before anything publishes.enforce-targetrejects this PR because it targetsmain; that is the promotion exception in the branch policy.Checklist