sync: upstream v2.48.0 (9a27e869) into dev - #325
Draft
cursor[bot] wants to merge 83 commits into
Draft
Conversation
lidge-jun#3931) fix(gui): separate fallback choices from the refreshed subagent roster
Carries the five-language documentation correction from lidge-jun#3890 at 7b2c7ba onto current dev. Original contribution by @luvs01. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
…-token-docs-f627 Final maintainer-integration decision for `cb350719d4acfe0964023f0ece9f13809f6dbf8e` into `dev`: Live `GET /repos/lidge-jun/opencodex/rules/branches/dev` reports PR/review, deletion and non-fast-forward rules, and no required status-check rule. `gh pr checks --required` likewise reports no required checks. The remaining `enforce-target` workflow is waiting for a hosted runner; it has not passed and is not counted as passing evidence. The earlier plan to await every advisory management workflow was more restrictive than the actual integration contract; no user-required CI or security criterion is being removed. The owner explicitly authorized this lane's final-tip CI-gated dev merge. The exact-head [Cross-platform CI](https://github.com/lidge-jun/opencodex/actions/runs/34148799339) is successful, hygiene/CodeRabbit are successful, and the isolated exact-head documentation build passed all 425 pages. Runtime jobs were intentionally skipped for the docs-only scope; local suites/build/install/typecheck were NOT RUN. `scripts/ci/assert-mergeable-review.sh --maintainer-integration 3936 lidge-jun/opencodex` passed for the current maintainer account. There are no outstanding maintainer objections or review threads. Ingwannu approved the original five-file contribution, and the carried blobs are identical. The maintainer-integration exception in `MAINTAINERS.md` permits dev integration without a second maintainer approval; it does not change branch rules or manufacture an approval/status. Proceed using the authorized dev-only maintainer path, with the current head/base/actor refreshed and an exact head match. This records the advisory workflow's actual pending state rather than waiting for it as a new, unrequested hard gate. Contributor credit is retained, and the original PR closes only after fetched dev ancestry and the five document blobs prove landing. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
…ebSocket quota (lidge-jun#3937) * docs(devlog): plan the B-track continuation/quota stack delivery Records the dependency-ordered branch chain for lidge-jun#3889 and lidge-jun#3934, the CI trigger contract that keeps the lower layer PR-free, and the original-author preservation requirement. * fix(responses): recover expired forward continuation over WebSocket A Codex WebSocket task stopped with a non-retryable 400 when its canonical ChatGPT forward replay entry expired or was missing. The proxy correctly refuses to forward a context-free delta, but reported invalid_request_error, which Codex treats as terminal. Return the existing previous_response_not_found classification instead, so Codex reconnects and resends its full retained input, including completed tool calls and their results. Rejection still happens before provider credential resolution, adapter construction, and upstream I/O; the cache TTL and capacity bounds are unchanged. HTTP clients must explicitly replay their full context. (cherry picked from commit e8d82a1) Co-authored-by: ykvv <229483879+y2ambition-ai@users.noreply.github.com> * fix(codex): fence late WebSocket quota by credential generation A streaming Codex request could keep receiving WebSocket quota metadata after its pool credential was replaced under the same local account ID. A late frame then repopulated the quota cleared for that replacement, making the new credential look exhausted. Capture the selected pool credential generation when the response's quota observer is created and ignore later observations once that generation is no longer live. Existing configuration-generation fencing and the main-pool writer are unchanged: main-pool carries no credential generation and keeps its own mainQuotaWriter identity check. (cherry picked from commit e5c01f4) Co-authored-by: luvs01 <luvs01@hanmail.net> --------- Co-authored-by: t <a@b.com> Co-authored-by: ykvv <229483879+y2ambition-ai@users.noreply.github.com> Co-authored-by: luvs01 <luvs01@hanmail.net>
…idge-jun#3942) * docs(devlog): plan the workstream-A Responses compatibility stack Roadmap for landing four Responses-compatibility changes on dev as one dependent branch chain whose tip carries all of them, so a single CI run certifies the set: PR lidge-jun#3906 (Muse Spark Free web_search strip), PR lidge-jun#3886 (Spark Responses Lite header), issue lidge-jun#3922 (Claude tool strict default, new work), and PR lidge-jun#3917 (routed agent_message conversion). Each phase doc carries exact path:line anchors and before/after diffs. Three rounds of independent audit corrected the Layer 2 HTTP/WebSocket coverage boundary, the Claude compatibility semantics, the Layer 3 test that an added strict field breaks, the converted authMode set, and the landing proof for each GitHub merge method. * fix(responses): strip web_search fields for Muse Spark Contributor Free tiers The -free tiers ride the same Zen Responses wire with the same gateway contract, so a Codex web_search carrying search_content_types / indexed_web_access 400s for them exactly like the paid tiers. (cherry picked from commit 11c498b) Co-authored-by: MohamadSabree8 <mohamadsabree8@users.noreply.github.com> * test(responses): cover nested and preview cases for Muse Spark Free tiers The carried fix covered a top-level web_search tool for the two Contributor Free ids. The sanitizer also walks input[].additional_tools.tools, and it must leave web_search_preview alone, so pin both for the free ids the way the paid ids are already pinned. Co-authored-by: MohamadSabree8 <mohamadsabree8@users.noreply.github.com> * fix(responses): disable Lite transport for Spark The canonical backend starts a Spark SSE response with the Responses Lite header but closes it before a terminal event, which the adapter correctly surfaces as adapter_eof. The identical request completes without that header. Select the compatibility exception from the final wire model and remove both caller-provided and statically configured Lite headers only for gpt-5.3-codex-spark. Other canonical models retain the existing metadata path. Regression: cover Spark suppression and unaffected Sol forwarding at the adapter boundary. (cherry picked from commit 83c1d9b) Co-authored-by: R <53855466+cb8010d6@users.noreply.github.com> * docs(devlog): note the layer-1 line drift in the layer-2 anchors Layer 1 inserts two lines above the canonical-forward block, so the phase doc now states both the pinned-base line numbers and where the same code sits on this branch. * fix(claude): carry the source strict intent into translated Responses tools Anthropic enables strict tool use by setting strict: true, while the Responses API reads an omitted strict as permission to normalize the schema into strict mode. Translating a Claude Code tool without the field therefore made every optional input_schema parameter behave as required upstream, so a tool call that omitted one failed even though the client never asked for strict mode. Emit the field from the source tool: an explicit true or false is preserved, an omitted one becomes an explicit false, and a non-boolean value cannot opt the tool into strict mode. The input_schema is forwarded unchanged, hosted web_search leaves the translator before this branch, and native Anthropic passthrough never reaches it. The existing exact expectation on the translated Read tool gains the field. The new regression asserts the three cases on the serialized outbound body built by a real Responses adapter, because parsed._rawBody is the translator's own object and reading it back would prove nothing about the wire. Closes lidge-jun#3922. * fix(adapters): convert Codex agent_message for every routed Responses destination `agent_message` is Codex's private multi-agent input item and exists only in the ChatGPT Codex backend's schema. Codex writes every sub-agent reply into the rollout, so it is replayed in the `input` of every later turn of that thread. A routed Responses destination answers the whole body with `422 unknown item type "agent_message"`, and 422 is a client error nothing fails over, so the thread stays broken until the history is dropped. The plaintext conversion already existed but was scoped to the OpenCode Go destination. Nothing about the rejection is destination-specific, so the conversion now applies to every destination with `authMode` other than "forward". Forward destinations keep the item unchanged, and genuine ciphertext and unknown part types keep their existing fail-closed path; the encrypted v2 task surface still owns those through `unreadable_encrypted_agent_task` and the opt-in recovery route. `isOpenCodeGo` existed only to scope this call and is removed with it. The helper and its tests move to destination-neutral names. Opaque-blob recovery repairs an undecryptable part into an omission marker, which leaves the item entirely plaintext; on a routed retry it is now converted too, which is what lets that retry be accepted at all. Fixes lidge-jun#3911 (cherry picked from commit 2430724) Co-authored-by: mashfromband <matsumoto.yukuhashi@gmail.com> * test(adapters): pin an OAuth destination and narrow the routed-422 wording The carried conversion is gated on authMode rather than on the destination URL, but its regression only exercised key and forward. The reported xAI/Grok failure is an OAuth pool destination, so pin one: a future narrowing of the gate back toward key-only would otherwise pass unnoticed. Also narrow the two reference pages. The conversion is justified by the destinations that actually reported the 422; authMode is an authentication setting, so it cannot establish what every custom upstream accepts. Co-authored-by: mashfromband <matsumoto.yukuhashi@gmail.com> * docs(devlog): drop a trailing blank line in the layer-1 phase doc --------- Co-authored-by: Codex <a@b.com> Co-authored-by: MohamadSabree8 <mohamadsabree8@users.noreply.github.com> Co-authored-by: R <53855466+cb8010d6@users.noreply.github.com> Co-authored-by: mashfromband <matsumoto.yukuhashi@gmail.com>
…jun#3943) Records the landing of lidge-jun#3937 (ca381ea), the CI evidence that the lower stack layer produced no workflow run, and the limits: local product suites were not run, two cancelled checks remain on the tip, and the CI tree differs from final dev by the separately landed lidge-jun#3936 docs. Co-authored-by: t <a@b.com>
…or stream-health watchdog (lidge-jun#3940) Preserve captured stdout and stderr when a test lane times out. Bound post-exit pipe draining to one second and report incomplete capture as a failure when the child otherwise exited successfully. Scale the Cursor stream-health fixture deadlines from one load-adjusted budget and verify meaningful progress continues for the required interval after the client receives its first text. Carries lidge-jun#3924 and lidge-jun#3930 without changes to their files. The branch commits retain the original author and cherry-pick provenance from: e241632 141077f Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
… init publication recovery (lidge-jun#3941) Bun on Windows misreads the numeric `O_WRONLY | O_CREAT | O_EXCL` combination and drops the creation bit, so every private config temp write failed with ENOENT: the pid file, config.json, the Codex runtime cache, and the OAuth credential store all route through the two atomic writers, and publishInitialConfigNoReplace hit the same wall before first-run `ocx init` could publish anything. All three call sites now use the portable `openSync(path, "wx", 0o600)` spelling. "wx" maps to O_WRONLY|O_CREAT|O_EXCL|O_TRUNC, so it is behaviorally equivalent here rather than bit-identical: exclusive creation rejects an existing name, including a symlink planted at the temp path, so the added O_TRUNC can never truncate anything. The 0o600 mode, Windows ACL hardening order, identity verification, the single hard-link publication, and descriptor-owned cleanup are unchanged. `ocx init` also now separates a required permission-hardening failure from denied hard-link publication, and both messages name OPENCODEX_HOME as the recovery path. Previously a hardening failure fell into the generic "publication did not finish" message with no direction. Landed as a three-layer manual stack through this tip: lidge-jun#3900 carried, the same spelling applied to initialize.ts, then lidge-jun#3896 carried on top. The one conflict was the adjacent hunk where lidge-jun#3896 inserts hardeningFailed directly after the rewritten openSync line; both survive. Closes lidge-jun#3893. Supersedes lidge-jun#3900 and lidge-jun#3896. Co-authored-by: x3M3x <amroeid1999@gmail.com> Co-authored-by: Joonsuh Park <trckstr4422@gmail.com>
The C track landed on dev as 6188458, so its planning unit moves to _fin/ with a terminal outcome record, together with the carried 260907_init_publication_guidance unit. 050_outcome.md records what the delivery established rather than a clean summary: the tip-only CI mechanism worked because no pull request was opened for the lower layers (draft status suppresses nothing, since ci.yml triggers on pull_request with no draft filter); the stale-base rule earned itself back when dev moved twice mid-delivery; the single CI failure was a 15-second PID-poll deadline in an unrelated probe test, recorded as a flake by non-reproducibility rather than by a proven mechanism; and three exclusive opens under src/lab/ share the replaced spelling but were deliberately left out of a config-surface fix. Documentation only. No source, test, or configuration change.
docs: remove account captures from historical quota notes Independently reviewed and verified correction. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
docs: apply consistent retention to quota verification captures Independently reviewed and verified correction. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
Co-authored-by: Vocllum <149675937+Vocllum@users.noreply.github.com>
Preserve the stored JWT as the comparison oracle across clock boundaries. Carries only the JWT slice of lidge-jun#3950. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
Co-authored-by: GPT-6 Astra <noreply@openai.com> Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com> Co-authored-by: David Wang <72378768+david-wang-0@users.noreply.github.com>
fix(release): normalize enforcement markers in release notes Independently reviewed and verified correction. Co-authored-by: Joonsuh Park <trckstr4422@gmail.com>
(cherry picked from commit 7ad7474) Co-authored-by: luvs01 <luvs01@hanmail.net>
test: isolate Santiago timezone state and prove child completion Independently reviewed and verified correction. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
docs(devlog): record C-lane delivery and verification limits Independently reviewed and verified correction.
Carry lidge-jun#3912 with raw commit-contention retry and independently verified real-database/process regressions. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
Co-authored-by: x3M3x <amroeid1999@gmail.com>
fix(voice): keep diagnostic logs free of frame content
Keep later successful main usage authoritative over delayed readers. Carry actual forced-refresh provenance and its generation edge into manual cooldown settlement; timestamp equality alone cannot admit an external replacement. Adds mocked main publication/hard-lock, frozen-clock replacement, joined-refresh and exact-generation controls. Candidate repair only; local product tests, typecheck, build and runtime NOT RUN by owner instruction. (cherry picked from commit a87a3f62482d7f54e12bdebb06785cdd64c73faf)
Adapt cold-main, saturation and converged-flight coverage plus Korean API and CLI guidance from lidge-jun#3995 at e172453. Retain scoped recovery ownership and publication/refresh provenance. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
…1-go fix(opencode-go): normalize tool catalogs and stateless continuation
…2-xai fix(xai): preserve plaintext string child-result continuation
…3-guidance fix(codex): separate proxy V2 guidance from native policy
…4-preset fix(gui): use server-owned proactive delegation presets
…6-recovery fix(codex): reconcile manual reset cooldowns with owned fresh usage
…close docs: archive six-item bug stack delivery proof
[WRONG BRANCH] release: promote 2.48.0 to main
Resolve conflicts per docs/fork/OWNED.md: - upstream-owned: take vendor/main - package.json: fork name @yansigit/opencodex, version 2.48.0 - shared-hotspot core.ts: upstream passthrough recording on raw text with model field Co-authored-by: SB Yoon <yansigit@users.noreply.github.com>
Re-fit nativeDefaultState resolution onto upstream v2.48.0 guidance tags after taking vendor/main for collaboration.ts. Co-authored-by: SB Yoon <yansigit@users.noreply.github.com>
Co-authored-by: SB Yoon <yansigit@users.noreply.github.com>
Co-authored-by: SB Yoon <yansigit@users.noreply.github.com>
Co-authored-by: SB Yoon <yansigit@users.noreply.github.com>
Restore fork codex-routing.test.ts for fiveHour alias routing deltas. Set explicit strict:false in inbound tool mapping per upstream lidge-jun#3922. Co-authored-by: SB Yoon <yansigit@users.noreply.github.com>
Co-authored-by: SB Yoon <yansigit@users.noreply.github.com>
Co-authored-by: SB Yoon <yansigit@users.noreply.github.com>
Co-authored-by: SB Yoon <yansigit@users.noreply.github.com>
Co-authored-by: SB Yoon <yansigit@users.noreply.github.com>
github-actions
Bot
added
the
intake: hygiene-blocked
|
PR automation (bot-owned)
|
⏳ DRAFT
What to do
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Coordinator handoff for upstream release v2.48.0 at tag SHA
9a27e86992d7a014e0aa92c046199b9fac148201, merged fromvendor/mainonto integration base785424295fc5d8ef0a66fb8ce94a55fe3b054471(origin/dev).Resolved 12 textual conflicts per
docs/fork/OWNED.md, preserved fork-owned behavior (native default sync, test-lane planner, subagents GUI), and re-fit fork deltas onto upstream control flow at shared hotspots.Tag SHA:
9a27e86992d7a014e0aa92c046199b9fac148201vendor/mainv2.48.0 /9a27e869— donesrc/server/responses/core.tsper OWNED.md — done (upstream passthrough recording on rawtext+modelfield)origin/dev— pending CI (gh pr view --json mergeable)ci/enforce-target/hygiene— pendingConflict decision table
package.jsonname/version@bitkyc08/opencodex2.48.0@yansigit/opencodex, non-decreasing semver@yansigit/opencodex+2.48.0bun run typechecksrc/server/responses/core.ts(~6553)text, includemodelclientJsonrecordingrememberPassthroughResponseChecked(JSON.parse(text)…)bun test tests/responses/responses-state.test.tsbun run typecheckbun run testsrc/server/responses/collaboration.ts<opencodex_subagent_guidance>metadata textsyncCodexSubagentDefaults/nativeDefaultStatebun test tests/codex-integration/native-default-authority.test.tsbun test tests/codex-integration/multi-agent-compat.test.tssrc/claude/inbound.tsstrict mappingstrict:falsewhen omitted (lidge-jun#3922)strict: typeof … ? … : falsebun test tests/claude-integration/claude-inbound.test.tsscripts/test.tscaptureTestOutputscripts/ci/test-lanes.tsplanner + Windows terminationcaptureTestOutput/runTestLanebun test tests/ci-workflows/test-runner.test.tsgui/.../SubagentDelegationSection.tsx,gui/pages/Subagents.tsxbun run build:guibun test ./gui/tests/multi-agent-guidance.test.tsxgui/tests/subagents-ultra-mode.test.tsx,usage-custom-range.test.tsxtests/codex-integration/codex-routing.test.tsfiveHour*alias scoringbun test tests/codex-integration/codex-routing.test.tsclaude-messages.ts,collaboration.tsbase,test-home-guard.test.ts,multi-agent-compat.test.tsbase,scripts/test.tsconflicts)vendor/mainthen re-port fork deltas aboveVerification
Confirmed tag matches remote after fetch:
Focused commands (pass on head
d635850f5):Full suite (
bun run test) on head: ~27 failures remain, including fork guidance/claude preservation tests and 3 known container-only systemd failures. Blocker for merge:tests/routing/subagent-code-mode-guidance.test.ts, severaltests/fork/*/ claude-messages preservation tests, and 18 GUI ultra-mode tests still red — human review required before ready-for-review.bun run prepushfails in this environment onoxlintJS plugin load (Unknown file extension ".ts"forgui/.eslint/local-i18n-plugin.ts); not a merge-tree regression.Checklist
src/orgui/src/— partial; remaining failures documented above.Human action: merge with merge commit (do not squash/rebase). Do not merge until CI is green and remaining blockers are resolved.