Conversation
Security: - OAuth error messages redact token-like strings (40+ char alphanumeric) - All provider error bodies truncated to 500 chars with try/catch - OAuth 429 rate-limit handling with retry-after hint - Credential-field regex input truncated to 200 chars JSON/response validation: - res.json() wrapped in try/catch across all 6 provider files - OAuth token exchange/refresh JSON parse protection - CapSolver postJson/getBalance/createTask/pollTaskResult validation - CapSolver response shape validation (typeof checks) - CapSolver pollTaskResult timeout clamp for negative/NaN values Null safety: - Anthropic tool_use blocks: block.id/name/input defaulted - Anthropic stream content_block_start fields defaulted - CapSolver balance defaults to 0 via nullish coalescing - Streaming accumulator: Array.isArray guard, idx>=0, String coercion Memory leak prevention: - New _cleanupTab() consolidates all per-tab Map/Set cleanup - tabs.onRemoved calls _cleanupTab (Chrome + Firefox background.js) - fetch-with-fallback stores listener ref to prevent double-registration Observability: - SSE stream catch blocks now console.warn with chunk excerpt (all 3 providers) State management: - _doneBlockCount, _recentSubmitClicks initialized in constructor - _runningTabs Set guards concurrent processMessage/processMessageStream - Both methods wrapped in try/finally for lock release Timeout/resource protection: - PDF fetch 60-second AbortController timeout - PDF bytesToBase64 32MB size guard Firefox parity: - safeQuerySelector ported for React-Aria component compatibility - openai_subscription deprecated provider cleanup - Default Claude model aligned to claude-sonnet-4-6 - Content script injection fallback injects accessibility-tree.js - Tab recorder stub routes return descriptive unsupported error - tabs.onRemoved handler added for per-tab state cleanup Concurrency: - AnthropicOAuthProvider._refreshOnce() coalesces concurrent 401 refreshes - Agent _runningTabs prevents overlapping runs on same tab Infrastructure: - Offscreen proxy forwards Content-Type from actual response - fetch-with-fallback uses forwarded Content-Type UI: - Sidepanel copy button data-bound flags cleared on innerHTML restore Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 08df4e920f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
…out through body
1. _cleanupTab now takes { preserveRunGuard } option. clearConversation
passes true so a running processMessage/Stream keeps its _runningTabs
lock until its finally block releases it. Tab close still clears
everything. (Chrome + Firefox)
2. PDF fetch timeout now covers the full request including arrayBuffer()
body download, not just headers. clearTimeout moved to finally block
so a server that sends headers then stalls the body still gets aborted
after 60s. (Chrome + Firefox)
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Collaborator
Author
|
@codex pls check again |
|
Codex Review: Didn't find any major issues. Keep them coming! ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
esokullu
added a commit
that referenced
this pull request
Jul 6, 2026
[codex] Add Tencent Hy3 planner benchmark
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Security
JSON/response validation
res.json()wrapped in try/catch across all 6 provider files (Chrome + Firefox)Null safety
block.id || '',block.input ?? {})Array.isArrayguard,idx >= 0check,String(content ?? '')Memory leak prevention
_cleanupTab()method consolidates all per-tab Map/Set cleanup (10 structures)tabs.onRemovedcalls_cleanupTabin both Chrome and Firefoxfetch-with-fallback.jsstores listener ref to prevent double-registrationConcurrency
AnthropicOAuthProvider._refreshOnce()coalesces concurrent 401 token refreshes_runningTabsSet prevents overlapping agent runs on the same tabFirefox parity
safeQuerySelectorported for React-Aria/Radix component compatibilityopenai_subscriptiondeprecated provider cleanup addedclaude-sonnet-4-6accessibility-tree.jstabs.onRemovedhandler added for per-tab state cleanupObservability
console.warnwith chunk excerpt (all 3 providers)Timeout/resource protection
bytesToBase64: 32MB size guardUI
data-boundflags cleared on innerHTML restoreTest plan
npm test— 195/195 passing🤖 Generated with Claude Code