sync: upstream v2.46.0 (bba63222)

[cursor]

Summary

Merge upstream release v2.46.0 (bba63222d3eeb5c8e397edae35798225e4fa1a6f) into origin/dev (8c6b592aa41f963b791ecbb61bc2d06d63abc7ef) after the fork sync Action stopped at decision-handoff / conflict.

• Took upstream for all upstream-owned conflict paths per docs/fork/OWNED.md.
• Applied the package.json recipe (@yansigit/opencodex, version 2.46.0, fork script preservation).
• Re-fit shared hotspots (src/server/responses/core.ts, src/providers/quota.ts) by starting from the v2.45 resolved fork overlay and applying the v2.45→v2.46 upstream delta via three-way git merge-file (upstream control flow + fork Antigravity/Cursor carousel behavior).
• Restored fork i18n catalogs (dev base + 43 upstream-only v2.46 strings across all locales).
• Aligned upstream-owned GitHub workflows, docker bootstrap, and compose.yaml with vendor/main; kept fork-only workflow files.

Tag SHA: bba63222d3eeb5c8e397edae35798225e4fa1a6f

1. Merge vendor/main v2.46.0 / bba6322 — done
2. Resolve shared hotspots per OWNED.md (src/server/responses/core.ts, src/providers/quota.ts) — done
3. Rebase onto origin/dev — pending (gh pr view --json mergeable)
4. CI ci / enforce-target / hygiene — pending (known new_suppression in upstream gui/src/pages/Models.tsx may need suppression-approved)

Verification

Confirmed event identity before merging:

v2.46.0 = bba63222d3eeb5c8e397edae35798225e4fa1a6f
origin/dev = 8c6b592aa41f963b791ecbb61bc2d06d63abc7ef
vendor/main = bba63222d3eeb5c8e397edae35798225e4fa1a6f
merge-base = 07b48da8fd63881e848d26e0bd50087864f5573e
published head = b8c6c20f1993b49c10272963576bbd1f34c06f7d

Commands run on published head:

bun run typecheck
# exit 0

bun test tests/claude-integration/claude-compatibility.test.ts \
  tests/claude-integration/claude-inbound.test.ts \
  tests/claude-integration/claude-messages-endpoint.test.ts \
  tests/claude-integration/claude-source-envelope.test.ts \
  tests/oauth/oauth-store-multi.test.ts \
  tests/adapters/anthropic/anthropic-sidecar-account-failover.test.ts \
  tests/usage/usage-log.test.ts \
  tests/ci-workflows/ci-workflows.test.ts \
  tests/service/container-bootstrap.test.ts
# 397 pass / 0 fail

(cd gui && bun run build)
# exit 0

bun run lint:workflows && bun run audit:high && bun run privacy:scan
# all exit 0

bun run test
# interrupted at repo 900s parallel budget (container); 1 timeout in tests/fork/sync-publish.test.ts

Conflict decision table

File / hunk	Upstream intent	Fork invariant	Class	Options	Recommendation	Tests
.github/workflows/ci.yml	v2.46 CI matrix, path filters, macOS timeouts	Fork uses same upstream CI contract on released pin	upstream-owned	A) upstream B) fork	A — upstream	bun test tests/ci-workflows/ci-workflows.test.ts
Dockerfile + docker/* + compose.yaml	v2.46 container bootstrap + compatibility snapshot	Fork runs same deployment surface on released pin	upstream-owned	A) upstream B) fork docker fork	A — upstream	bun test tests/service/container-bootstrap.test.ts
package.json	v2.46 metadata/deps/scripts	Keep @yansigit/opencodex, non-decreasing version, fork scripts (prepush, audit:high, …)	recipe	recipe / manual	recipe → 2.46.0 + fork identity	bun run typecheck
src/server/responses/core.ts	v2.46 sidecar precedence + OAuth dispatch APIs	Antigravity 429 carousel before opaque blob; Cursor OAuth pool rotation	shared-hotspot	manual merge	manual — v2.45 resolved overlay + v2.46 delta	bun run typecheck; bun run test (shared runtime)
src/providers/quota.ts	v2.46 Anthropic header quota + pinned Antigravity transport	Per-account Antigravity probes + host-aware failover path	shared-hotspot	manual merge	manual — v2.45 resolved overlay + v2.46 delta	bun test tests/usage/usage-log.test.ts; bun run typecheck
Claude stack (src/claude/*, src/server/claude-messages.ts, claude tests)	v2.46 Claude protocol + compatibility logging	Fork keeps shadow/enforce compatibility telemetry already on dev	upstream-owned	A) upstream B) fork	A — upstream	bun test tests/claude-integration/*.test.ts
GUI (gui/src/pages/Logs.tsx, Models.tsx, i18n *.ts, logs test)	v2.46 models/logs UX + display names	Fork dashboard/server-listener + agent-kind filters + subagent role strings	upstream-owned + locale merge	upstream pages + dev i18n base + upstream-only keys	upstream pages; merged locales	(cd gui && bun run build)
Docs-site remote-hub + providers pages (all locales)	v2.46 remote hub + provider docs	Fork docs track upstream on released pin	upstream-owned	A) upstream	A — upstream	docs compile via CI
src/cli/init.ts, src/codex/catalog.ts, src/oauth/anthropic-routing.ts, management routes, src/usage/log.ts	v2.46 init/config/catalog/oauth surfaces	Fork cursor-oauth recovery kinds + agentKind logging + catalog export	mixed	upstream code + fork log/type ports	upstream + re-port fork telemetry	bun run typecheck
scripts/test-layout/layout.json, tests/fixtures/test-layout-expected.json	v2.46 test layout	Fork obeys same layout guard	upstream-owned	A) upstream	A — upstream	bun test tests/test-layout.test.ts
OAuth/Anthropic/service tests (conflict list)	Match upstream v2.46 behavior	Fork preserves existing regression coverage paths	upstream-owned	A) upstream	A — upstream	focused files above

Shared-hotspot preservation notes

src/server/responses/core.ts

• upstream intent: v2.46 media/web-search sidecar precedence and expanded OAuth dispatch/recovery typing
• fork invariant: Antigravity session affinity + 429 carousel before opaque-blob recovery; Cursor OAuth auth/429 rotation
• disposition: preserve on upstream control flow
• evidence: three-way merge from v2.45 resolved fork overlay through v2.45→v2.46 vendor delta
• tests: bun run typecheck, focused claude/oauth/usage tests, full suite gate

src/providers/quota.ts

• upstream intent: Anthropic unified rate-limit header normalization; pinned Antigravity outbound transport URLs
• fork invariant: per-account Antigravity quota probes and cooldown-aware failover semantics
• disposition: preserve on upstream control flow
• evidence: same three-way merge-file strategy as core
• tests: bun test tests/usage/usage-log.test.ts, bun run typecheck

Checklist

• Scope stays focused on upstream v2.46.0 sync and fork hotspot preservation.
• Added/updated tests: existing focused domain tests run green; full suite attempted (container time budget).
• Docs/release notes: upstream docsite conflicts resolved by taking upstream; no separate fork docs change required.
• Security-sensitive paths reviewed: OAuth/quota/core hotspots manually merged; no secret material added.

Blockers for human merge

1. hygiene / new_suppression: upstream v2.46 adds an eslint suppression in gui/src/pages/Models.tsx; may require suppression-approved label on the PR.
2. Preservation attestation: regenerate docs/fork/PRESERVATION.json decisions + bun scripts/fork/sync/cli.ts attest after human review of hotspot table.
3. Full bun run test: not completed within the 900s parallel budget in this environment; re-run on CI / maintainer machine before merge.

Do not squash or rebase this sync PR. Human creates the merge commit into dev.

  

[github-actions]

⚠️ Deterministic hygiene checks failed.

• new_suppression — A new TypeScript, lint, formatter, or similar suppression was added. Fix the underlying issue or obtain suppression-approved. Paths: gui/src/pages/Models.tsx.
• unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: .github/workflows/ci.yml, .github/workflows/cleanup-closed-pr-branches.yml, .github/workflows/dev-version-bump.yml, .github/workflows/enforce-issue-quality.yml, .github/workflows/enforce-pr-target.yml, .github/workflows/issue-quality-tests.yml, .github/workflows/issue-triage.yml, .github/workflows/pr-hygiene.yml, .github/workflows/pr-labeler.yml, .github/workflows/release.yml, .github/workflows/service-lifecycle.yml, package.json, src/lib/windows-secret-acl.ts, src/oauth/anthropic-routing.ts, src/oauth/health.ts.

[github-actions]

PR automation (bot-owned)

• Class: draft (draft)
• Base: 24c66effcd68404dd9e10d9b4782a4f350825fbc
• Head: b8c6c20f1993b49c10272963576bbd1f34c06f7d
• Action: behind
• Exact-head gate: BLOCKED (not-mergeable, base-not-ancestor, base-mismatch, check-not-success)
• Sensitive paths: .github/workflows/ci.yml, .github/workflows/cleanup-closed-pr-branches.yml, .github/workflows/dev-version-bump.yml, .github/workflows/enforce-issue-quality.yml, .github/workflows/enforce-pr-target.yml, .github/workflows/issue-quality-tests.
• Maintainer auto-merge approval: NO
• Bot merge evidence: NO
• Next action: human review required

[github-actions]

⏳ DRAFT

• hygiene: new_suppression. hygiene: unsponsored_surface. sync_baseline

What to do

• Wait for successful exact-head ci, enforce-target, and hygiene checks.
• Fix new_suppression — A new TypeScript, lint, formatter, or similar suppression was added. Fix the underlying issue or obtain suppression-approved. Paths: gui/src/pages/Models.tsx.
• Fix unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: .github/workflows/ci.yml, .github/workflows/cleanup-closed-pr-branches.yml, .github/workflows/dev-version-bump.yml, .github/workflows/enforce-issue-quality.yml, .github/workflows/enforce-pr-target.yml, .github/workflows/issue-quality-tests.yml, .github/workflows/issue-triage.yml, .github/workflows/pr-hygiene.yml, .github/workflows/pr-labeler.yml, .github/workflows/release.yml, .github/workflows/service-lifecycle.yml, package.json, src/lib/windows-secret-acl.ts, src/oauth/anthropic-routing.ts, src/oauth/health.ts.

This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.

[yansigit]

Superseded by the verified v2.47.0 integration merged in #323. The draft branch is retained for history.