[WRONG BRANCH] release: promote verified 2.49.0 product tree to main - #4117
Merged
Conversation
chore(release): open dev at 2.49.0 before releasing 2.48.0
docs(devlog): archive the 2.48.0 release train record
(cherry picked from commit 7e56b63)
(cherry picked from commit f651611)
(cherry picked from commit 18530f8)
(cherry picked from commit 4b705e9)
The carried CodeBuddy commits predate the tests/ modularization, so their two test files landed at the tests/ root where the layout guard rejects them. Move them under tests/providers and register both in layout.json and the expected-layout fixture.
(cherry picked from commit 4ac98bd)
Same drift as the CodeBuddy layer: the carried Qoder commit predates the tests/ modularization. Move both files under tests/providers and register them in layout.json and the expected-layout fixture.
…rors The Qoder catalog branch was written against the pre-#3601 shape of provider-fetch.ts, so it merged cleanly while dropping captured.effectiveAlias from all four hint applications; a Qoder row would carry whatever alias the cached row already held instead of the decision captured at flight admission. The shared coding-agent result classifier matched the bare word authentication anywhere in vendor text, turning transient upstream wording into a 401 credential verdict that drives reauth messaging and key-pool rotation. Anchor it to credential phrasing; the existing 'Not logged in; invalid token' fixture still classifies as 401.
(cherry picked from commit a4e8050)
…3989) Configure `sourcePreservingYaml: { path: ["providers", "opencodex"] }` for Hermes Agent in `INTEGRATION_CLIENTS`. Hermes Agent is a multi-provider autonomous agent whose configuration (`~/.hermes/config.yaml`) typically hosts multiple providers, vision models, and comments. Previously, Hermes was registered without source preservation, causing `classifyIntegration` to fail-closed (`state: "conflict", reason: "foreign-edit"`) whenever a user modified sibling providers or comments. In the dashboard UI, this locked the toggle and threatened a destructive full-file restore ("Replace"). By giving Hermes source-preserving YAML semantics (joining OMP and DSH): - OpenCodex mutates only `providers.opencodex` in-place. - Sibling provider configurations, user comments, and formatting remain untouched. - Unit and invariant test suites updated with dedicated regression coverage. - Public documentation in `guides/integrations.md` updated accordingly. Closes #3989 (cherry picked from commit a1fe9ca)
…ss Gemini and CCA
Google Gemini (via Cloud Code Assist / Antigravity, Vertex AI, and AI Studio)
rejects requests whose conversation history ends on a model turn with HTTP 400
INVALID_ARGUMENT ("Requests ending with a model turn are not supported.").
Previously, the continue nudge was only attached for Claude-on-Antigravity under
the assumption that Gemini natively accepts model-tail histories. In practice,
autonomous multi-turn loops (such as subagent orchestration and continuation turns
in Codex CLI) produce histories ending in an assistant message, triggering the 400.
This patch:
- Injects a synthetic user `(continue)` nudge in `messagesToGeminiFormat` whenever
the reconstructed `contents` ends with `role: "model"` or is empty.
- Broadens the post-replay Antigravity tail check to cover all Google models.
- Updates unit tests to verify that Gemini 3.7 Flash, Gemini 3.8 Flash, and
AI Studio endpoints all receive the continue nudge on model-tail contexts.
Co-authored-by: CommandCodeBot <noreply@commandcode.ai>
(cherry picked from commit 1837b8f)
qoder and qoder-cn landed without an icon alias or display name, so the dashboard drew them as an initial tile with a raw config id underneath; codebuddy and codebuddy-cn had the same gap. Every other first-class provider carries both. Qoder ships its own square symbol as the declared site icon, byte-identical across qoder.com, qoder.cn, qoder.com.cn and the schema.org Organization logo, and neither terms document restricts its use; it is committed verbatim and wired to both ids. CodeBuddy keeps the initials tile on purpose: section 9.3 of the Tencent service agreement forbids using Tencent brand features under any circumstances without written consent. Both decisions, with sources and clauses, are recorded in the provider-icons README so the refusal is not silently re-litigated. Also publishes the Qoder Global/CN section in the docs-site providers guide (the repo-level docs/qoder-cli-provider.md is not built) and lists the qoder adapter in the configuration reference.
…ervation The English guide now lists Hermes with OMP and DSH as source-preserving YAML writers; the French and Traditional Chinese pages still named it among the clients whose switch locks on sibling edits, contradicting runtime behaviour.
The carried change added the nudge to messagesToGeminiFormat for every Google mode and also widened the post-replay Antigravity check from Claude-only to all models, leaving two injection sites on one request. The second is only a no-op while nothing between them reshapes the tail; the signature sanitizer can. Drop the post-replay copy so the formatter owns the invariant.
feat(provider): add official CodeBuddy Global and CN providers (carry #3340)
feat(provider): add Qoder Global PAT provider (carry #3349)
feat(provider): add Qoder CN PAT provider (carry #3350)
feat(gui): give Qoder its brand mark and name the CLI providers
feat(integrations): support source-preserving YAML for Hermes Agent (carry #3990)
fix(google): guard model-tail histories with user continue nudge across Gemini and CCA (carry #3988)
Roadmap, measured conflict map, mark sourcing decision, two audit rounds, secondary PR dispositions, and the delivery record for #4026-#4031: six layers merged bottom-up into dev at e2bf167 after a green lane=all run (34231255231) on the top head 16d49ce. Local suite/typecheck/build were deliberately NOT RUN; hosted CI is the only execution proof. Closed as _fin because every outcome it records is already in public history.
docs(devlog): record the provider runtime stack landing
* test(lib): make idle deadline reset timing deterministic Carried from #4041 (author luvs01) for maintainer-side CI and sequential integration. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * test: stabilize Windows fixture waits and case cleanup Carried from #4015 (author luvs01) for maintainer-side CI and sequential integration. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * test(codex): verify timeout termination without racing child timers Carried from #4012 (author luvs01) for maintainer-side CI and sequential integration. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * test(codex): hold prompt-probe admission through document edits Carried from #4014 (author luvs01) for maintainer-side CI and sequential integration. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * test(clients): bound transaction fixture child completion Carried from #4004 (author luvs01) for maintainer-side CI and sequential integration. Closes #4003 Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(codex): retain overlapping multiline TOML terminators Carried from #4039 (author luvs01) for maintainer-side CI and sequential integration. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(cli): reject unsupported caps and report ignored legacy values Carried from #4043 (author luvs01) for maintainer-side CI and sequential integration. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(codex): share trigger-only delegation guidance with v1 Carried from #4034 (author luvs01) for maintainer-side CI and sequential integration. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(codex): preserve settings when journal injection hashes are missing Carried from #4006 (author luvs01) for maintainer-side CI and sequential integration. Closes #4005 Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * docs(cli): note that --injection still accepts none and minimal CodeRabbit review on #4049: the effort reference documents caps only, so the new rejection of none/minimal reads as a global removal. --injection keeps both values because it sets the injection effort rather than a cap. --------- Co-authored-by: t <a@b.com> Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
…rage, history) (#4051) * fix(codex): keep Spark five-hour quota model-scoped Carried from #4018 (author cb8010d6) for maintainer-side CI and sequential integration. Closes #4017 Co-authored-by: cb8010d6 <53855466+cb8010d6@users.noreply.github.com> * fix(codex): retain Spark quota on partial header updates Carried from #4008 (author cb8010d6) for maintainer-side CI and sequential integration. Closes #4007 Co-authored-by: cb8010d6 <53855466+cb8010d6@users.noreply.github.com> * fix(codex): invalidate app-server observations at catalog boundaries Carried from #3981 (author yansigit) for maintainer-side CI and sequential integration. Co-authored-by: yansigit <44089734+yansigit@users.noreply.github.com> * fix(web-search): stop inactivity timing after terminal events Carried from #3979 (author yansigit) for maintainer-side CI and sequential integration. Co-authored-by: yansigit <44089734+yansigit@users.noreply.github.com> * fix(responses): strip Muse web_search fields on direct Meta Carried from #3964 (author ildunari) for maintainer-side CI and sequential integration. Co-authored-by: ildunari <95185577+ildunari@users.noreply.github.com> * fix: preserve combo capabilities and skip referenced archives Carried from #3863 (author x3M3x) for maintainer-side CI and sequential integration. Co-authored-by: x3M3x <98298256+x3M3x@users.noreply.github.com> * fix(codex): recover ocx1-compacted threads for native replay Carried from #3920 (author cb8010d6) for maintainer-side CI and sequential integration. Closes #3916 Co-authored-by: cb8010d6 <53855466+cb8010d6@users.noreply.github.com> --------- Co-authored-by: t <a@b.com> Co-authored-by: cb8010d6 <53855466+cb8010d6@users.noreply.github.com> Co-authored-by: yansigit <44089734+yansigit@users.noreply.github.com> Co-authored-by: ildunari <95185577+ildunari@users.noreply.github.com> Co-authored-by: x3M3x <98298256+x3M3x@users.noreply.github.com>
…lback test (#4053) * test(cli): make stale-port status fixture deterministic Carried from #3980 (author yansigit) for maintainer-side CI and sequential integration. Co-authored-by: yansigit <44089734+yansigit@users.noreply.github.com> * refactor(router): isolate API-key selection capture Carried from #3897 (author parkjs101) for maintainer-side CI and sequential integration. Closes #3894 Co-authored-by: parkjs101 <93533648+parkjs101@users.noreply.github.com> * docs: retire the historical dashboard capture pack Carried from #3963 (author luvs01) for maintainer-side CI and sequential integration. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * refactor(gui): stabilize model feedback callback dependencies Carried from #3984 (author yansigit) for maintainer-side CI and sequential integration. Co-authored-by: yansigit <44089734+yansigit@users.noreply.github.com> * test(gui): pin the publishFeedback callback identity #3984 changes publishFeedback to a useCallback and adds it to saveDisplayName's dependency array, but shipped without coverage, so the hygiene gate flags missing_regression_test. This source-oracle test asserts both halves and fails on dev without the fix (0 pass / 2 fail), so the suppression cannot come back unnoticed. Co-authored-by: yansigit <44089734+yansigit@users.noreply.github.com> * chore(assets): file the #3984 screenshot with the others #3984 added its review screenshot under a new assets/pr-screenshots/ directory. The repository's nineteen existing PR screenshots all live in docs-site/public/pr-screenshots/, so this moves it there and keeps the new top-level directory out of the tree. Co-authored-by: yansigit <44089734+yansigit@users.noreply.github.com> --------- Co-authored-by: t <a@b.com> Co-authored-by: yansigit <44089734+yansigit@users.noreply.github.com> Co-authored-by: parkjs101 <93533648+parkjs101@users.noreply.github.com> Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
…streamAborted
Add two groups of regression tests for the usage-marker parity criterion
in devlog/_plan/260906_opaque_transport_finality/010_failure_boundaries.md:
tee path (consumeForInspection / stream-aborted-marker.test.ts):
- bare { type: "error" } SSE event followed by clean EOF → onTerminal("failed", 502)
with no streamAborted on the persisted attempt (semantic failure, not a read reset)
- read error following a bare error event → streamAborted stays true (onReadError path)
eager path (relaySseEagerBounded / relay-eager.test.ts, 090-13):
- bare error frame + clean upstream EOF → onSynthetic receives ("failed", "upstream_error")
so core.ts onSynthetic can record a semantic failed status without streamAborted
No source changes; all existing tests continue to pass. The implementation
already handles these paths correctly in relay.ts and relay-eager.ts;
these tests make the contract explicit and regression-proof.
…-20260909 fix(transport): pin manual redirects at upstream dispatch
fix(server): honor rejected identity checks during port reclaim
oauth/xai: honor Retry-After and stop retrying aborted token requests
…dation oauth/xai: pin discovery endpoints to trusted auth hosts and reject userinfo
…stream-expiry fix(server): close expired dashboard selection streams quietly when no frames are queued
…-windows test(config): platform-policy readiness budget for the config-lock holder child, unmasked readiness failures
fix(codex): restore main policy binding after owned startup
…down fix(codex): fall back to caller main during Pool cooldown
…-20260909 fix(stop): confirm shared teardown before skipping parent restoration
…am-evidence fix(logs): persist transport finality evidence
…-carry fix(auth): keep credentials scoped to the final routed provider (carry of #4081)
The paragraph excluded custom providers by name, but isCanonicalOpenAiForwardProvider classifies on adapter, auth mode and destination, so a custom-named forward entry pointing at the ChatGPT backend takes the same public channel. It also separates the doctor hint, which inspects only the built-in openai row, from the endpoint behaviour it describes.
…rrow the object Dropping a regex-keyed matcher moves its keys to additionalProperties. On a closed object that forbids or re-constrains them, and a dictionary tool whose only matcher was regex-keyed admits nothing once minProperties is 1. Such objects now pass through as written, so an ECMA-compatible destination keeps working and an incompatible one reports the regex instead of receiving an unsatisfiable schema.
…ly warning With a user-owned root openai_base_url the client-compaction path still writes the opencodex table, so the old warning misdescribed the file: it claimed nothing was injected and asked the operator to delete a valid setting, while the history line claimed those threads still reached the proxy. That configuration now reports the table it wrote and says the openai-tagged threads follow the operator destination. The setting is never overwritten and no session history is rewritten.
…guidance feat(doctor): explain ChatGPT public endpoint latency
feat(codex): opt into client-side compaction
fix(openai): drop tool-schema patterns Python re cannot compile
Keep regex-keyed schemas and nonmonotone subtrees unchanged; retain scalar Artifact compatibility in ordinary positive positions. Co-authored-by: itismyfield <itismyfield@users.noreply.github.com>
…schemas fix(openai): preserve composed tool schema contracts
Contributor
|
Important Review skippedToo many files! This PR contains 328 files, which is 28 over the limit of 300. To get a review, reduce the PR to 300 files or fewer by splitting it into smaller PRs or changing its base branch. Usage-priced reviews support at most 300 files. ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Advanced Run ID: ⛔ Files ignored due to path filters (49)
📒 Files selected for processing (328)
You can disable this status message by setting the Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
the
intake: hygiene-blocked
Contributor
|
Contributor
⏳ DRAFT
What to do
Its title has been prefixed with |
github-actions
Bot
changed the title
Owner
Author
리뷰 · 우선순위 73 / 80이 PR은 같은 제품 기준선 main 대비 diff가 큰 이유도 #4116과 같다. 2.48.0(#4011) 이후 지금 체크아웃 기준으로 순서가 핵심이다. 리뷰 작성 시점에 #4116과 #4117은 수십 초 간격으로 둘 다 머지되었고( 경로 base= 메인테이너의 판단이 필요한 지점
너의 추천 이 댓글은 grok-bot이 작성했습니다 |
3 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
6 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Promote audited product baseline
ad36c7be8913f4367fed0f3fa46acd2224914c7aintomainas2.49.0. The owner explicitly authorized main and preview promotions and instructed these promotion PRs to merge immediately without querying or waiting for pre-merge CI. This is owner-directed PR-only integration, not an independent approving review or a claim that every PR check passed.This is the stable 2.49.0 publication candidate. Actual publication follows the required post-promotion checks and release dry-run.
Development version pre-move #4115 is already merged: dev carries 2.50.0; no 2.50 package is being released. This branch preserves the original source commits and authors, including the composed-schema repair #4113.
Verification
62849dfa69c7d53ddacd9b67b03cafe98ac23386is tree-identical to the audited product baseline. Preview conflict resolution was confined to that version line; main composed without conflict.enforce-targetpermits dev/child bases and may reject this maintainer release promotion. This known target-policy exception is explicitly authorized for main/preview, as in [WRONG BRANCH] release: promote 2.48.0 to preview #4010/[WRONG BRANCH] release: promote 2.48.0 to main #4011; no rule or check is modified and a failing check is not relabeled green.Checklist