Repository navigation
fix(server): enforce live sessions and bounded agent requests - #255
Conversation
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars.
 |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6aec0adf9a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if (res.destroyed || res.writableEnded) return; | ||
| if ( | ||
| activeControllers.has(sessionId) || | ||
| (activeUsers.get(owner) ?? 0) >= 2 || |
There was a problem hiding this comment.
When legacySessionsOwner is configured, that authenticated user can access both legacy sessions stored under demo and new sessions stored under oidc:<sub>. Because ownerOf() returns the storage owner, these sessions use separate admission counters, allowing the same user to run four simultaneous model turns despite the documented two-turn limit. Key the admission counter and its cleanup by the authenticated subject (falling back to the default user in unauthenticated mode), while retaining the storage owner for the ADK invocation.
Useful? React with 👍 / 👎.
An identity-provider outage no longer destroys a valid knowledge-library session. Live validation updates current identity without allowing stale requests to overwrite rotated refresh credentials; short access-token lifetimes renew early, and a refresh followed by a temporary UserInfo failure retains the new credential in a pending, fail-closed state.
Agent turns now have bounded request size, per-session and authenticated-user concurrency, deadlines, model-call and token budgets, and cancellation when the client disconnects. Compaction calls count toward the budget and implicit SDK retries are disabled. Shared packages move together to 0.1.8; app version is 0.12.9.
Validation: full verify passed (1,440 unit tests, 67 browser cases, 2 existing manual-only skips, independent packed-package consumers), bundle and gate checks passed. Three local CLI review rounds ended with no actionable finding; rubric review and fresh-context review completed. The PR review finding about legacy storage owners splitting per-user quotas is fixed in the final commit: admission is keyed by the authenticated caller, with a regression covering legacy and current session ownership.
Two tested review revisions after initial publication; no CI failure reruns, no gate weakening. Latest commit CI and security scans passed before explicit squash merge. Customer application still requires registry-package installation and its own real Core/account acceptance before deployment.