[WRONG BRANCH] release: bring preview onto the verified 2.57.0 product tree - #4831
Merged
Merged
Conversation
[WRONG BRANCH] chore(release): promote verified candidate to 2.43.0
…lease-244-main-07c0
chore(release): promote validated 2.44.0 to main
Promote frozen dev source cf9f662; no new runtime changes. Candidate CI34061274315 and service34061276621 are the validation references. Publication waits for successful validation and the final main push CI at the exact release SHA.
Promote frozen dev source cf9f662 as 2.45.0. The repository owner explicitly authorized this main/preview release promotion and admin PR-only merge. This is a release-specific owner decision, not an independent approval or the dev-only maintainer exception. Frozen candidate full CI34061274315 passed all25jobs after one unchanged-source rerun of Windows5; the initial holder busy assertion remains recorded without a root-cause resolution claim. Service lifecycle34061276621 passed Linux/macOS/Windows. Dev version pre-move3812 is merged. Publication still requires this actual main merge SHA's own successful push CI and Service lifecycle. No local suites were run.
[WRONG BRANCH] chore(release): promote verified 2.46.0 to main
[WRONG BRANCH] release: promote 2.47.0 to main
[WRONG BRANCH] release: apply final roster correction to main
[WRONG BRANCH] release: promote 2.48.0 to main
release: promote verified 2.49.0 product tree to main
[WRONG BRANCH] release: promote verified 2.50.0 product tree to main
[WRONG BRANCH] release: promote verified 2.51.0 product tree to main
Product tree is dev at 7bfb2ad. Only package.json differs, carrying the stable channel version 2.52.0. This promotion follows a CI repair and a regression sweep: dev had drifted 79 commits past its last finished run and the one run allowed to complete had failed. #4390 fixed an integration test that never denied anything and had been red on dev since #4342; #4396/#4397/#4398 closed four gaps in the quota avoidance contract #4368 introduced; #4403 made a port fixture deterministic.
release: promote verified 2.52.0 product tree to main
Product tree is dev at eb81eaa, byte-identical (dev already carries the 2.53.0 version line). This promotion follows a 364-commit regression audit (origin/main..981b53e) by 15 parallel subagent lanes plus two audit-spawned fixes reviewed and merged to dev: #4496 (live sideband connect watchdog) and #4497 (chat image part shapes). Zero unresolved P0/P1 at promotion time. Exact-head hosted CI green on eb81eaa (run 34750934849). Local suite NOT RUN per task rule; hosted exact-head CI is the gate.
[WRONG BRANCH] release: promote verified 2.53.0 product tree to main
Product tree is dev at a84e6e8, byte-identical (dev already carries the 2.54.0 version line). Headed by the Codex model-picker incident fix (#4531). On Codex 0.154.0-alpha.6.2 a paginated-history preflight vetoed the entire Codex config write, so model_catalog_json never reached config.toml and both the Codex app and the CLI fell back to their six built-in models, while ocx sync reported that failure as success. The refusal is now scoped to the conversation-history relabel unit on the apply direction only, narrowed to the one permanent reason, and a provider table the home already published survives the write. Exact-head hosted CI green on a84e6e8 via #4531 (run 34772128322): all four Linux test shards, both macOS shards, gates, hygiene, storage policy, api usage, keyring x3, npm-global x3, docker smoke, react-doctor. Local suite NOT RUN per task rule; hosted exact-head CI is the gate.
[WRONG BRANCH] release: promote verified 2.54.0 product tree to main
…cation fix(vision): fail closed on truncated sidecar captions (#4727)
…refresh_token_invalidated as revoked (#4737) Maintainer integration: exact-head hosted CI is green at 7d3c6bd (Cross-platform CI 35044663972, React Doctor 35044663932). The branch merges cleanly onto current dev; a rebase would invalidate the green exact-head evidence without changing the touched contract. Host-owned merge decision; no local suite, typecheck, build, or install was run.
Maintainer integration of the carried #4729 implementation. Exact head 39d0649 passed Cross-platform CI run 35070233415 and React Doctor 35070233385. The carry preserves original author attribution and includes the parser/layout contract fixes found by exact hosted CI. Host-owned rebase and merge; no local suite, typecheck, build, or install was run.
Maintainer integration for the 2.57.0 stabilization scope. Exact head 4f4ccea has a green aggregate ci check with no failing job. The change is 18 lines of CSS plus an opt-in browser regression harness; no default is altered and no src runtime path is touched. Host-owned merge decision; no local suite, typecheck, build, or install was run.
Maintainer integration for the 2.57.0 stabilization scope. Exact head a28a7ef has a green aggregate ci check with no failing job. The retained event set is exactly what the consumers read, overflow drops only the replay record while content, terminal reason and usage still pass through, and preserving usage from completed legs when the continuation factory throws is a real fix. The accepted cost is recorded: on overflow a thinking-heavy turn loses the guard nudge rather than losing output. Host-owned merge decision; no local suite, typecheck, build, or install was run.
…etry (#4741) (#4798) Maintainer integration for the 2.57.0 stabilization scope. Exact head 2ea335f has a green aggregate ci check with no failing job. This carries #4741 and corrects the half that would have made things worse: the refusal was reported as 502, which the Codex client retries up to four times, so the proxy stopped replaying and handed the amplification to the client. It now answers 429 with upstream_reset_replay_refused, and because a 429 then stops being sufficient evidence of a provider rate limit, all ten call sites that read it that way consult isNonReplayableResponse first and record the transport outcome rather than the client-facing status, so pool health sees exactly what it saw before. The owning structure section is rewritten to separate a refusal this proxy made from an upstream reset reported mid-stream or after a terminal, and the WebSocket post-send verdicts are explicitly unchanged. Host-owned merge decision; no local suite, typecheck, build, or install was run.
…mbership by wire (#4736, #4735) (#4799) Maintainer integration for the 2.57.0 stabilization scope. Exact head e80d2ed has a green aggregate ci check with no failing job. Two carries. The catalog guard moves to the shared write boundary so both writers apply one rule, which matters because the same source-invalid rejection was reachable through convergence and therefore through every dashboard toggle, combo edit and account login, and because running before the clamp could drop the row the clamp would have kept; the stated producer of the duplicate slugs is still unidentified so the reporting issue is deliberately not closed. The tool guard keeps the declared set flowing on every wire and scopes only the membership refusal, so an explicitly empty catalog still means no client tool may be called; scoping the refusal off the chat and Anthropic wires is recorded in the owning structure sections with #1700 named. Host-owned merge decision; no local suite, typecheck, build, or install was run.
…vents (#4775, #4743) (#4801) Maintainer integration for the 2.57.0 stabilization scope. Exact head 14b4d30 has a green aggregate ci check with no failing job. Carries #4775 and #4743 with their review fixes. The #4743 event bound was raised because the original 1,000 counted every held argument delta, so a sizeable client-executed apply_patch could cross it and the leg would discard a legitimate tool call; the count is now derived from the code-unit budget that is the real memory guard, and overflow reports as a proxy-side bound instead of blaming the upstream read. Host-owned merge decision; no local suite, typecheck, build, or install was run.
, #4778) (#4797) Maintainer integration for the 2.57.0 stabilization scope. The exact head has a green aggregate ci check with no failing job. Selection now drops only accounts whose own confirmed roster definitively omits the requested model, inside the existing eligibility gate and ahead of the priority tier, restoring the full list whenever filtering would leave no candidate; unknown and expired rosters stay unknown, so this cannot make a model vanish the way a fail-closed gate would. A conversation carrying uploaded files keeps its issuing account, which is the one documented invariant change and is recorded in the owning structure section. The operator pin is exempt, because filtering it out beforehand would have re-enabled the tiers the operator excluded rather than merely demoting the account. Host-owned merge decision; no local suite, typecheck, build, or install was run.
…#4796) Maintainer integration for the 2.57.0 stabilization scope. The exact head has a green aggregate ci check with no failing job. Carries #4785 and folds #4789. The containment half closes the leak in #4762 for future runs. The reclamation half needed correcting before it could ship: as authored, an absent ownership marker fell through to removal, and every directory users have accumulated today was written by a version that stamped nothing, so the rule would have deleted TEMP trees the tool cannot show it created. Reclamation now treats a missing marker as disqualifying and requires the owning pid to be dead. An already-affected workstation is not cleaned by this change; those roots are scanned, skipped and left to the user. Host-owned merge decision; no local suite, typecheck, build, or install was run.
…ence and Retry-After (#4807) Release-blocker fix for 2.57.0, found by the final cross-change regression audit. Exact head has a green aggregate ci check with no failing job. The 429 reclassification that landed in #4798 guarded the call sites that read a 429 as a rate limit but not the ones that write quota evidence, synthesize Retry-After, or reclassify the status on the way out, so in two places the release as it stood invited the replay the change exists to prevent: passthrough recorded the synthetic 429 as quota evidence and attached a default Retry-After, and native Chat dropped the distinct code. Adapter recovery could also replay a refusal produced by a refetch inside an arm, which the single-retry regression could not catch. The invariant is now stated once and recorded: a refusal this proxy made never acquires a Retry-After and never becomes quota evidence. Host-owned merge decision; no local suite, typecheck, build, or install was run.
…e denial lookup behind the read fence (#4806) Release-blocker fix for 2.57.0, found by the final cross-change regression audit. Exact head has a green aggregate ci check with no failing job. Uploaded-file retention did not reach native compact initial account resolution or the encrypted-recovery preview, so a file-carrying conversation could still be moved before the post-429 guard ran, or preview and final authentication could pick different accounts — either one reproduces the failure #4778 removed. Both paths now carry the bit, answered from the same object and predicate the post-429 guard uses. Separately the flagship denial lookup crossed the native-main read fence by validating cached rosters through the physical main token; it now honours the fence and answers unknown there, which changes nothing because unknown never excludes an account. Host-owned merge decision; no local suite, typecheck, build, or install was run.
…4813) Release-blocker fix for 2.57.0 from the second regression audit. Exact head has a green aggregate ci check. A namespaced helper name could donate the bare spelling, so a declaration such as mcp__remote.exec added bare exec to the declared set and an undeclared apply_patch, exec_command or write_stdin was then rewritten to it; the exclusion is now keyed on the name rather than the namespace, and a namespaced exec stays usable as itself. Request preview also computed the native-main read fence without the request-owned credential that final authentication includes, so a thread_spawn request with a forwardable caller bearer could read the physical main token and score main differently from final auth. Host-owned merge decision; no local suite, typecheck, build, or install was run.
… per-entry store reads (#4814) Release-blocker fix for 2.57.0 from the second regression audit. Exact head has a green aggregate ci check. A transient refresh failure whose description mentioned revoked, invalidated or expired was still classified terminal even when the structured code was server_error, which re-created the false quarantine #2887 exists to prevent; classification now uses the structured code whenever one exists and keeps the substring fallback only for bodies that carry no code at all. Separately a warm flagship request could perform up to 256 synchronous account-store reads because credential identity resolved per cache entry; it now resolves once per denial pass without weakening the check that an entry belongs to the credential it claims. Host-owned merge decision; no local suite, typecheck, build, or install was run.
…lias (#4819) Release-blocker fix for 2.57.0 from the third regression audit. Exact head has a green aggregate ci check. The helper-name fence that landed in #4813 covered the echo-alias path only; the tool_choice compatibility path still manufactured a bare alias, so a request declaring a namespaced exec and selecting it with a bare selector put bare exec into the declared set and an undeclared helper was rewritten onto it. Sweeping for the rule found a third live copy in the passthrough declared catalog, which fenced exactly one name, so a namespaced exec_command or shell_command could also switch nested-helper normalization off for a catalog that genuinely declared the shell. The rule now lives in one place. The follow-up commit corrects an over-strict first attempt: a bare alias does two jobs, identity restoration and declaration, and only the declaration was ever unsafe, so restoration is preserved and a caller-declared, explicitly selected tool keeps working. Host-owned merge decision; no local suite, typecheck, build, or install was run.
…4.0 (#4821) Release-blocker fix for 2.57.0. The PR aggregate ci check is green at this exact head, and the lane=all dispatch 35113947092 on the same head passed all six Windows shards individually plus both macOS shards, every test shard, gates, keyring, docker and npm-global; only the optional macos control job was cancelled by concurrency. That dispatch is the evidence the Bun pin works: windows 5/6 had failed three release candidates in a row and 1/6 failed the previous dispatch, and all six pass here with the crash masking removed. The suite had been crashing the Bun runtime on every run since 2026-09-08 while reporting green, because a crashed batch was re-run one file per process, which is a configuration in which the defect cannot occur rather than a retry. That verdict now fails. Host-owned merge decision; no local suite, typecheck, build, or install was run.
Four documents: the roadmap, the CI forensics that cleared dev's red tip, the pull-request triage, and the issue triage. No product code changes. Co-authored-by: lidge-jun <lidge-jun@users.noreply.github.com>
…easures (#4830) The first proxy child in native-profile-startup.test.ts published its port at 50.7s against a 45s SPAWN_BUDGET_MS while the next spawn in the same file was ready in 1.8s. Gate the budget to 90s on win32 only, the same way BULK_DURABLE_IO_BUDGET_MS already is. Co-authored-by: lidge-jun <lidge-jun@users.noreply.github.com>
[WRONG BRANCH] chore(release): promote 2.57.0 to main
# Conflicts: # package.json
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Contributor
|
Important Review skippedToo many files! This PR contains 404 files, which is 104 over the limit of 300. To get a review, reduce the PR to 300 files or fewer by splitting it into smaller PRs or changing its base branch. Usage-priced reviews support at most 300 files. ⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: ASSERTIVE Plan: Advanced Run ID: ⛔ Files ignored due to path filters (2)
📒 Files selected for processing (404)
You can disable this status message by setting the Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
|
✅ Deterministic PR hygiene checks passed. |
github-actions
Bot
changed the title
Contributor
⏳ DRAFT
What to do
Its title has been prefixed with |
Owner
Author
리뷰 · 우선순위 75 / 80이 PR은 기능을 새로 넣는 요청이 아니다. 2.57.0 릴리스 트레인의 6번째 단계로, 이미 머지 후 트리를 다시 맞춰 봤다. 제목에 [WRONG BRANCH]가 붙고 enforce-target이 빨간 것도 버그가 아니다. 이 게이트는 기능 PR이 릴리스 증거 쪽도 현재 한 가지 남은 바깥 상태는 브랜치가 아니라 npm 태그다. 레지스트리 라인 단위로 “이 줄이 틀렸다”고 찍을 제품 패치는 없다. 아래는 경로·게이트·후속 상태 점검이다. 경로 preview ← codex/260917-preview-2570 - base/head가 프로모션 의도에 맞고, 이미 메인테이너의 판단이 필요한 지점
너의 추천 이 댓글은 grok-bot이 작성했습니다 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
11 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this is
Step 6 of the 2.57.0 release train: bring
previewonto the tree that just shipped, so theprerelease train does not restate a stable that is already published.
previewwas carrying 2.56.0 and the npmpreviewdist-tag still points at2.55.0-preview.20260914. After this mergepreview's tree is identical tomainat44de45dfdc—git diff origin/main HEADis empty.The only conflict was
package.json's version line, resolved tomain's 2.57.0, which is thesame resolution the 2.56.0 promotion #4698 used.
Release evidence
1831193294ondev, Cross-platform CI push run35131181996: success.mainrelease commit44de45dfdc, Cross-platform CI run35133242171and Service lifecyclerun
35133242154: both success.release.ymlrun35135131119withexpected-sha=44de45dfdc33d30af22502d2bed98014fe16d83b,tag=latest,dry-run=false— success. GitHub releasev2.57.0created.enforce-targetis red here for the same reason it is on every promotion: that gate is forfeature pull requests.