release: promote verified 2.52.0-preview.20260912 product tree to preview - #4406
Merged
Conversation
Repair three Windows CI failures. Discovery fixtures follow host-native path joins; credential paths follow the explicit platform argument while retaining override validation.
…pair test(update): use host-native pnpm shim fixtures
…vin-windows fix(devin-cli): honor platform path semantics in credential discovery
…ge owner Carry #3663 from 8e0b53b with two contract changes: context ownership is partitioned by the admission principal minted for the matched opencodex API key and bound to the stable user the accepted credential proves, and one deadline covers the whole relay starting before the body is read. Local product tests NOT RUN per explicit user instruction; hosted CI follows. Co-authored-by: ykvv <229483879+y2ambition-ai@users.noreply.github.com> Co-authored-by: nbbb26 <259064678+nbbb26@users.noreply.github.com>
…before relay dispatch Address review of the relay carry: a caller bearer must be the exact credential an accepted model turn used, a credential proving no stable user cannot rebind an entry by sharing its workspace id, conflicting user claims poison the existing entry, and admission is re-resolved against the listener policy before dispatch. Tests updated for the new signatures with regressions for each rule. Local product tests NOT RUN per explicit user instruction.
…sions Issue distinct tokens for one proven user so refresh and rotation cases exercise a changed fingerprint, keep the root-mismatch regression on an authenticated admission, and assert the superseded caller bearer stops matching.
The deadline now starts before credential selection, so a client that leaves during that wait must be reported as a hangup with nothing dispatched and the admitted turn released.
…dex key Security review found the relay unreachable in its only supported configuration: the default bind is loopback, admission there never reads a token, and the injector only rewrites the base URL for loopback hosts, so every history call returned 403 even with a valid key. The relay now asks the identity question separately from admission - a context request presenting a real opencodex key owns its sessions, one presenting none is still refused - and a regression exercises the real resolver instead of a hand-built admission.
…wnership Security re-audit found the previous fix one-sided: the relay could name a loopback caller but the model turn still recorded ownership from admission alone, so a correctly named caller found no entry and got 409. Both paths now use resolveContextPrincipal. The guides and structure doc now state what actually works - a remote bind with a configured key, or a client that sends x-opencodex-api-key - because the built-in loopback injection cannot carry that header, and whether a loopback bind should identify callers is left as a maintainer decision rather than a relaxed refusal.
…ental opt-in The opt-in only guarded the injected base URL, so the ten endpoints and the ownership registry stayed live for any caller able to reach the data plane, including one posting the paths directly. contextRelayActivated reads Codex own config and now guards the relay handler and the recording path as well; absent, unreadable or malformed config is not an opt-in, and the decision is cached against config identity so turning it off applies without a restart. Regressions assert 404 on both prefixes, no owner recorded and zero upstream calls while it is off.
Resolve the Codex home inside the try rather than in a default parameter, since those evaluate before the body and this gate now runs during model turns, where an unreadable CODEX_HOME would abort a turn upstream already served. Gate the route match as well so a disabled feature takes no turn lease. Pin cache invalidation without the reset seam and the unreadable-home refusal, and restore the Korean disable paragraph.
Add the #3433 transport matrix with actual Chat handler and captured canonical Responses request. Preserve key and original header spellings; no identity synthesis. Synthetic fixtures do not establish Hermes emission or cache-hit improvement. Local suites NOT RUN; hosted CI pending.
test(chat): verify native outbound conversation identity (#3433)
The fallback-port fixture records a port from allocateFreePort, which reports the port it has already released. On a four-shard runner every other test binding an ephemeral port is a candidate to take it, and when that happens status finds a listener on the recorded port, reports the record as live, and the assertion fails against something the test never set up. It failed exactly that way on the preview promotion run while the same commit passed on dev. Confirm the recorded port refuses immediately before and immediately after the status probe, and re-allocate when something took it in between. The assertion is unchanged and no weaker: a run only counts when the endpoint demonstrably refused across the whole probe, and exhausting the attempts fails with that reason rather than silently passing.
feat(codex): relay experimental context history under a least-privilege owner
chore(release): open dev at 2.53.0 before releasing 2.52.0
test(cli): stop judging a stale record on a port another test can take
…view Product tree is dev at 7bfb2ad, which carries the CI repair, the four quota-avoidance fixes, and the deterministic status port fixture. Only package.json differs, carrying the preview channel version.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Contributor
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (43)
📝 WalkthroughWalkthroughThe pull request adds experimental Codex context routing with authenticated history and notes relays, per-session ownership tracking, compatible URL handling, and Chat identity tests. It also updates restore failure reporting, platform-specific credential paths, pnpm fixtures, stale-port tests, documentation, and CI records. ChangesCodex context relay
Supporting repairs and verification
Estimated code review effort: 5 (Critical) | ~90 minutes Change: Other ✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
|
✅ Deterministic PR hygiene checks passed. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
2.52.0-preview.20260912. The merged tree is identical to dev at7bfb2ad8a6except for thepackage.jsonversion line.Verification
devlog/_plan/260912_release_regression_train/025_sweep_results.md.enforce-targetrejects this PR because it targetspreview; that is the promotion exception in the branch policy.Checklist
Summary by CodeRabbit
New Features
Bug Fixes
Documentation