Stack/gui dense workspaces

[batuchek68-ux]

Summary

• Explain the user-visible or maintainer-facing change.

Verification

• List the commands or checks you ran.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

🗂️ Base branches to auto review (2)

• ^dev$
• ^preview$

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 9c188060-4e4a-4830-9b3e-2366a2ce87e6

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

_{Comment @coderabbitai help to get the list of available commands.}

[lidge-jun]

Closing. This pull request contains no work by its author.

The head commit here is byte-identical to a branch that already exists in this repository and was authored by the maintainer. All six of these pull requests have the same shape: fork the repository, push the upstream branches back unchanged, and open them as incoming contributions.

PR	head SHA	identical upstream branch
#798	eef9a86d	codex/260728-tls-altname-diagnosis
#799	d0763bf7	codex/260729-security-md-reporting-path
#800	d380b1b0	codex/260731-pr-merge-round
#802	a64aa585	codex/app-server-restart
#803	b0434ea5	codex/pr533-update-recovery-hardening
#804	f0acc36a	stack/gui-dense-workspaces

Every listed SHA resolves to the same commit on the upstream branch of the same name. The commit authors inside them are lidge-jun, Wibias, ahmetb, aljjang95, hanbinnoh and other existing contributors. The descriptions are the unmodified pull request template with every checklist item unchecked, and #798 additionally carries the maintainer's own commit message pasted in as if it were a summary. Several target main, which AGENTS.md reserves for maintainer-controlled promotion, and two are chained onto each other's heads in a cycle.

This is not a rebase, a resubmission of stalled work, or a fork that drifted. It burns maintainer review time and CI minutes on a diff that is already in the tree, and it presents other people's commits under a new author's pull request. Repository access is being revoked for this account.

[chatgpt-codex-connector]

💡 Codex Review

opencodex/src/server/images.ts

Line 446 in f0acc36

const payload = await upstreamResponse.arrayBuffer();

Stream image responses before enforcing the size cap

When a keyed or ChatGPT-forward image upstream returns an oversized body, this buffers the entire response with arrayBuffer() before checking IMAGES_RESPONSE_MAX_BYTES, so the intended 100 MiB cap is applied only after heap allocation and a malicious or misconfigured provider can exhaust memory instead of receiving the 502 path. Read the body incrementally and cancel once the cap is crossed, as the CCA branch already does.

AGENTS.md reference: src/AGENTS.md:L17-L17

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Use the management token for the opencode catalog fetch

With the new management-auth split, /api/models is a management endpoint and rejects data-plane tokens, but cmdOpencode passes opencodeApiKey(config) here, which resolves to OPENCODEX_API_AUTH_TOKEN, the service-api-token file, config.apiKeys[0], or the fallback ocx. On a normal loopback install the proxy has generated an independent admin-api-token, so this request gets 401 and ocx opencode exits before launching even though the proxy is healthy; use the admin token/runningProxyUpdateHeaders for the catalog fetch while keeping the data-plane key for the child provider config.

Useful? React with 👍 / 👎.

[chatgpt-codex-connector]

Keep populated Claude families expanded by default

When a family has available models, this now still returns that family as collapsed, so a fresh Claude Desktop page with Opus models hides every model row behind an extra click instead of leaving the populated family open as the surrounding contract and regression test expect. Keep the data-driven filter so only empty families are folded by default.

Useful? React with 👍 / 👎.