[WRONG BRANCH] chore(release): promote 2.57.0 to main - #4829
Merged
Merged
Conversation
…read Both consume call sites parsed the upstream answer with resp.json(), which buffers the whole body before anything checks its size. Every neighbouring reset-credit read already goes through readResetCreditJson, which short-circuits an oversized declared length, reads through the shared 64 KiB bounded reader with fatal UTF-8, and rejects a truncated or empty answer. Only these two were left unbounded. The background auto-redeemer now treats an unreadable answer the same way its sibling availability read does and raises. The manual handler marks the operation ambiguous and answers 502, because the spend may already have landed upstream while its outcome code is unreadable, and a replay of that id must never be admitted as new work.
…sent candidate On Windows the candidate-only provenance slice performs no candidate or configuration filesystem I/O, so it never consults the persisted runtime selection. When no proof-captured CODEX_CLI_PATH candidate is present it nevertheless reported reason "candidate_unavailable", asserting that no Codex CLI candidate exists even though availability was never observed. Operators whose runtime resolves through persisted "configured" state therefore saw a missing candidate while the runtime report showed a known version. Report the deferral that actually occurred instead. The defined "windows_inspection_deferred" reason already exists but was reachable only with an environment candidate. POSIX does read persisted state, so its absent-candidate answer is exact and stays unchanged. No filesystem access is added: the Windows path still performs zero I/O, and candidateAvailable, provenance, managed, selectionAttested, versionEvidence and shim status are unchanged. This intentionally replaces the previous test statement that pinned the "candidate_unavailable" wording on Windows.
Record the Windows inspection reason distinction in structure/runtime.md, which owns src/codex/, and qualify the direct-launch candidate_unavailable outcome as POSIX-only in all eight locale agent references.
Two windows let one Codex credential refresh delete another live refresh lock. isRefreshLockStale treated any unreadable lock as stale. The owner creates the file with openSync(path, "wx") and writes its metadata immediately after, so a live lock is briefly empty; a waiter that looked during that window deleted the lock and ran a second concurrent refresh against the same grant. The unreadable case now ages the file itself and only reports stale past the same 60s window, and a lock that has already disappeared reports not stale so the waiter simply retries the create. The release path unlinked by name. If a waiter had reclaimed the path and a second owner recreated it, the first owner deleted the second owner's live lock on its way out. Release now compares the fd identity captured before close against the current path and unlinks only its own file, falling back to the previous behavior when the identity cannot be read. Both cases are pinned in tests/codex-integration/codex-account-store.test.ts and both fail before this change.
…avior after module split
…Assist - Lift blanket rejection on Cloud Code Assist for Gemini models (modelId starting with gemini-) - Route structured output into generationConfig.responseMimeType and responseJsonSchema inside envelope.request - Retain explicit fail-closed rejection for non-Gemini models (such as Claude) served through Cloud Code Assist - Keep existing refusals for image-capable models and schemaless json_schema - Update structure/providers/google.md and tests/adapters/google/google-structured-output.test.ts
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
#4568) * test(codex): compare the injected catalog path as a decoded TOML value The paginated-home regression test asserted that config.toml literally contains the catalog path. A Windows path is written as a TOML basic string with escaped separators, so the raw file text holds C:\\Users\\... while the assertion looked for C:\Users\... . The test failed on every Windows shard and passed everywhere else, which took the whole windows job down for unrelated pull requests. What the picker actually reads is the decoded value, so the assertion now decodes the model_catalog_json basic string and compares that. POSIX behavior is unchanged, since a path with no backslash decodes to itself. * test(codex): require root catalog path readback --------- Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
…y` (#4660) * fix(providers): Baseten routed rows must not advertise text.verbosity Baseten documents its Model APIs as Chat Completions compatible. `text.verbosity` is an OpenAI Responses parameter, so there is nothing on that wire for it to become, but the Baseten registry entry carried no opt-out and every routed row serialized support_verbosity: true with default_verbosity: "low". Codex seeds its picker from that and sends text.verbosity on the turn. Provider-wide rather than per-model, matching the xAI and Ollama opt-outs: Baseten's catalog is live-discovered, so a slug that arrives later supports it no more than the seeded ones do. Closes #4630 * test(catalog): cover the live-discovered baseten slug, not just the seeded one The opt-out is provider-wide because baseten is liveModels: true — a per-model pin would leave tomorrow's discovered id advertising the control again. The original case seeded a static model, so that reasoning was a comment rather than something the suite checked. This one seeds no models and lets a stubbed /models response supply the slug. Raised in review of #4660 by @coderabbitai and @lidge-jun.
Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
* fix(responses): finalize adopted WebSocket stage records * fix: finalize websocket stage before cancel usage logging --------- Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
…vents (#4775, #4743) (#4801) Maintainer integration for the 2.57.0 stabilization scope. Exact head 14b4d30 has a green aggregate ci check with no failing job. Carries #4775 and #4743 with their review fixes. The #4743 event bound was raised because the original 1,000 counted every held argument delta, so a sizeable client-executed apply_patch could cross it and the leg would discard a legitimate tool call; the count is now derived from the code-unit budget that is the real memory guard, and overflow reports as a proxy-side bound instead of blaming the upstream read. Host-owned merge decision; no local suite, typecheck, build, or install was run.
, #4778) (#4797) Maintainer integration for the 2.57.0 stabilization scope. The exact head has a green aggregate ci check with no failing job. Selection now drops only accounts whose own confirmed roster definitively omits the requested model, inside the existing eligibility gate and ahead of the priority tier, restoring the full list whenever filtering would leave no candidate; unknown and expired rosters stay unknown, so this cannot make a model vanish the way a fail-closed gate would. A conversation carrying uploaded files keeps its issuing account, which is the one documented invariant change and is recorded in the owning structure section. The operator pin is exempt, because filtering it out beforehand would have re-enabled the tiers the operator excluded rather than merely demoting the account. Host-owned merge decision; no local suite, typecheck, build, or install was run.
…#4796) Maintainer integration for the 2.57.0 stabilization scope. The exact head has a green aggregate ci check with no failing job. Carries #4785 and folds #4789. The containment half closes the leak in #4762 for future runs. The reclamation half needed correcting before it could ship: as authored, an absent ownership marker fell through to removal, and every directory users have accumulated today was written by a version that stamped nothing, so the rule would have deleted TEMP trees the tool cannot show it created. Reclamation now treats a missing marker as disqualifying and requires the owning pid to be dead. An already-affected workstation is not cleaned by this change; those roots are scanned, skipped and left to the user. Host-owned merge decision; no local suite, typecheck, build, or install was run.
…ence and Retry-After (#4807) Release-blocker fix for 2.57.0, found by the final cross-change regression audit. Exact head has a green aggregate ci check with no failing job. The 429 reclassification that landed in #4798 guarded the call sites that read a 429 as a rate limit but not the ones that write quota evidence, synthesize Retry-After, or reclassify the status on the way out, so in two places the release as it stood invited the replay the change exists to prevent: passthrough recorded the synthetic 429 as quota evidence and attached a default Retry-After, and native Chat dropped the distinct code. Adapter recovery could also replay a refusal produced by a refetch inside an arm, which the single-retry regression could not catch. The invariant is now stated once and recorded: a refusal this proxy made never acquires a Retry-After and never becomes quota evidence. Host-owned merge decision; no local suite, typecheck, build, or install was run.
…e denial lookup behind the read fence (#4806) Release-blocker fix for 2.57.0, found by the final cross-change regression audit. Exact head has a green aggregate ci check with no failing job. Uploaded-file retention did not reach native compact initial account resolution or the encrypted-recovery preview, so a file-carrying conversation could still be moved before the post-429 guard ran, or preview and final authentication could pick different accounts — either one reproduces the failure #4778 removed. Both paths now carry the bit, answered from the same object and predicate the post-429 guard uses. Separately the flagship denial lookup crossed the native-main read fence by validating cached rosters through the physical main token; it now honours the fence and answers unknown there, which changes nothing because unknown never excludes an account. Host-owned merge decision; no local suite, typecheck, build, or install was run.
…4813) Release-blocker fix for 2.57.0 from the second regression audit. Exact head has a green aggregate ci check. A namespaced helper name could donate the bare spelling, so a declaration such as mcp__remote.exec added bare exec to the declared set and an undeclared apply_patch, exec_command or write_stdin was then rewritten to it; the exclusion is now keyed on the name rather than the namespace, and a namespaced exec stays usable as itself. Request preview also computed the native-main read fence without the request-owned credential that final authentication includes, so a thread_spawn request with a forwardable caller bearer could read the physical main token and score main differently from final auth. Host-owned merge decision; no local suite, typecheck, build, or install was run.
… per-entry store reads (#4814) Release-blocker fix for 2.57.0 from the second regression audit. Exact head has a green aggregate ci check. A transient refresh failure whose description mentioned revoked, invalidated or expired was still classified terminal even when the structured code was server_error, which re-created the false quarantine #2887 exists to prevent; classification now uses the structured code whenever one exists and keeps the substring fallback only for bodies that carry no code at all. Separately a warm flagship request could perform up to 256 synchronous account-store reads because credential identity resolved per cache entry; it now resolves once per denial pass without weakening the check that an entry belongs to the credential it claims. Host-owned merge decision; no local suite, typecheck, build, or install was run.
…lias (#4819) Release-blocker fix for 2.57.0 from the third regression audit. Exact head has a green aggregate ci check. The helper-name fence that landed in #4813 covered the echo-alias path only; the tool_choice compatibility path still manufactured a bare alias, so a request declaring a namespaced exec and selecting it with a bare selector put bare exec into the declared set and an undeclared helper was rewritten onto it. Sweeping for the rule found a third live copy in the passthrough declared catalog, which fenced exactly one name, so a namespaced exec_command or shell_command could also switch nested-helper normalization off for a catalog that genuinely declared the shell. The rule now lives in one place. The follow-up commit corrects an over-strict first attempt: a bare alias does two jobs, identity restoration and declaration, and only the declaration was ever unsafe, so restoration is preserved and a caller-declared, explicitly selected tool keeps working. Host-owned merge decision; no local suite, typecheck, build, or install was run.
…4.0 (#4821) Release-blocker fix for 2.57.0. The PR aggregate ci check is green at this exact head, and the lane=all dispatch 35113947092 on the same head passed all six Windows shards individually plus both macOS shards, every test shard, gates, keyring, docker and npm-global; only the optional macos control job was cancelled by concurrency. That dispatch is the evidence the Bun pin works: windows 5/6 had failed three release candidates in a row and 1/6 failed the previous dispatch, and all six pass here with the crash masking removed. The suite had been crashing the Bun runtime on every run since 2026-09-08 while reporting green, because a crashed batch was re-run one file per process, which is a configuration in which the defect cannot occur rather than a retry. That verdict now fails. Host-owned merge decision; no local suite, typecheck, build, or install was run.
Four documents: the roadmap, the CI forensics that cleared dev's red tip, the pull-request triage, and the issue triage. No product code changes. Co-authored-by: lidge-jun <lidge-jun@users.noreply.github.com>
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Contributor
|
Important Review skippedToo many files! This PR contains 404 files, which is 104 over the limit of 300. To get a review, reduce the PR to 300 files or fewer by splitting it into smaller PRs or changing its base branch. Usage-priced reviews support at most 300 files. ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Advanced Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (404)
You can disable this status message by setting the Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
|
✅ Deterministic PR hygiene checks passed. |
github-actions
Bot
added
the
chore
github-actions
Bot
changed the title
Contributor
⏳ DRAFT
What to do
Its title has been prefixed with |
Owner
Author
리뷰 · 우선순위 76 / 80이 PR은 기능을 새로 넣는 요청이 아니다. 제품 트리는 tip의 직전 후보 제목에 본문이 고지한 전제 하나가 아직 열려 있다. publish 전에 types.ts/config.ts 스플릿 캠페인은 기능 PR 판정에는 중요하지만, 이번 같은 release chore에는 거의 해당 없다. 이미 라인 단위로 “이 줄이 틀렸다”고 찍을 제품 패치는 없다. 아래는 경로·게이트·전제 위주의 점검이다. 경로 release/2.57.0 → main - 프로모션 base/head가 맞고, head SHA가 현재 메인테이너의 판단이 필요한 지점
너의 추천 이 댓글은 grok-bot이 작성했습니다 |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d78be30da7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| // Conclude the half-open recovery trial BEFORE the admissibility gate below (#4701): an | ||
| // outcome that gate drops still ended this request, and a lease nobody hands back leaves the | ||
| // next trial waiting out its deadline. The settle carries its own fences, so this is safe here. | ||
| settleTransientProbeForOutcome(accountId, meta, classifyCodexUpstreamOutcome(outcome, meta.denial)); |
There was a problem hiding this comment.
When a probe takes longer than its 30-second lease, a replacement probe can be granted and record a newer failure before the original request completes. Although settleTransientProbeForOutcome rejects the original lease as stale or expired, its result is discarded here, so the old outcome continues through recordCodexUpstreamOutcome; a late 2xx can then clear the newer failure state and route traffic back to the unhealthy account. Propagate the settlement result and skip account-health mutations for stale or expired probe outcomes.
Useful? React with 👍 / 👎.
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
Comment on lines
+31
to
+33
| return `k${createHash("sha256").update(JSON.stringify([ | ||
| "ocx-key-account-v1", provider, selection.entryId ?? null, selection.reference, | ||
| ])).digest("hex").slice(0, 32)}`; |
| headers.set("Retry-After", retryAfter); | ||
| } | ||
| return new Response(JSON.stringify({ error }), { | ||
| const response = new Response(JSON.stringify({ error }), { |
…easures (#4830) The first proxy child in native-profile-startup.test.ts published its port at 50.7s against a 45s SPAWN_BUDGET_MS while the next spawn in the same file was ready in 1.8s. Gate the budget to 90s on win32 only, the same way BULK_DURABLE_IO_BUDGET_MS already is. Co-authored-by: lidge-jun <lidge-jun@users.noreply.github.com>
Owner
Author
CodeQL: reviewed, not a blockerThe CodeQL check here fails with "10 new alerts including 8 high severity security vulnerabilities". That count overstates the delta: eight of the ten carry the same alert numbers already open on Exactly one alert is genuinely new: #183, Of the rest, six are in test files ( One finding is real and pre-existing rather than introduced here: Verdict: GO on the security question for 2.57.0. |
Owner
Author
Go decision for 2.57.0Candidate
Merging as a merge commit, matching the 2.56.0 promotion #4694. |
There was a problem hiding this comment.
💡 Codex Review
Admit transient retries through the pool limiter
When many passthrough requests receive transient 5xx responses, this callback records each first attempt but sends every subsequent recovery attempt without calling classifyPoolRecoveryDispatch("retry"). The only retry admission call elsewhere covers Codex account moves, so ordinary fetchWithTransientRetry traffic—the primary retry-storm path—still bypasses the new process-wide recovery ratio and can amplify an upstream outage. Check the limiter before dispatching every non-initial attempt and return the established local retry refusal when it denies admission.
opencodex/src/server/responses/core.ts
Lines 60 to 61 in 1831193
Attribute combo reservations to the active child
For combo requests, the tracker created here closes over the parent logCtx, while executeComboResponses dispatches each target with a separate childLog and does not copy that context back until the target finishes. Consequently, every reservation made during a child send reads the parent's provider: "combo" and usually no accountLogLabel, so durable spend is booked against the synthetic combo pool rather than the provider/account that incurred it; per-pool and per-identity accounting or ceilings therefore cannot identify the real spender. Pass the active child context to the observer, or update the tracker's scope at each physical dispatch.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
This was referenced Sep 16, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
12 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Promotion, not a feature pull request
This promotes the frozen 2.57.0 candidate from
devtomain.enforce-targetfails here with"wrong base (main)" — that gate exists for feature pull requests and every promotion carries the
same red mark, exactly as the 2.55.0 promotion #4619 and the 2.56.0 promotion #4687 did.
What is in it
184 commits since
v2.56.0. The candidate isd78be30da7, whose product tree is identical to2b19983bfd— the only delta is the release-train devlog, and nothing in the build, typecheck ortest path reads from
devlog/.package.jsonreads 2.57.0.devmoves to 2.58.0 in #4827, merged before this publishes, sorelease.yml'sassert-aheadgate is satisfied.Why the candidate is trustworthy
devwas red at its tip for five consecutive Cross-platform CI runs. Those were audited commit bycommit and none is a product regression: they are four independent harness and runtime flake
classes, and the largest — a Bun 1.4.2 Windows segfault entering
codex-prompt-layers.test.ts— isfixed by the candidate itself, which pins Bun back to 1.4.0 (#4821). The full forensics, with run
ids, job ids and file:line for every failing test, are in
devlog/_plan/260917_2570_release_train/010_dev_green.md.Bun 1.4.2 is still the latest stable release and no released version fixes that Windows crash
class, so the 1.4.0 pin stays.
Queue state at the cut
Every open pull request and every recently touched issue was triaged before this cut. No pull
request was merge-ready — heads here typically carry only the four policy checks and no product
test suite — so 2.57.0 ships what was already on
devand nothing else. Two issues were closedagainst the commits that fixed them (#4730, #4688) and the rest carry recorded verdicts. See
020_pr_triage.mdand030_issue_triage.md.Validation
No local suite, typecheck, build or install was run. Evidence is hosted CI at exact SHAs, recorded
in the devlog unit.