fix: integrate reviewed provider, client, and desktop recovery train by lidge-jun · Pull Request #6487 · lidge-jun/opencodex

lidge-jun · 2026-10-03T06:07:09Z

Summary

Integrate the reviewed A–D recovery train now; the two additional Claude-subagent/Remote-Link issue implementations will follow in a separate PR. This preserves 31 recovered carry commits, including the already-landed #6474 duplicate, and delivers the remaining 27 source-PR changes with their contributor history. #6459, #6455 and #6457 have already landed independently under this recovery.

Correct provider/Responses compatibility, SSE framing, forced-search declarations, opt-in replay metadata and safe header forwarding, and generation-window metrics.
Preserve explicit credit-spending consent, account scope, OAuth quarantine, bundle trust and bounded image/stream handling.
Repair Windows updater/autostart/shim behavior, ordered model visibility saves, weighted usage throughput, compaction scoping, Droid defaults, client exports and pt-BR catalogs.
Recovery review additionally fixed split-CRLF terminal handling, an extra search dispatch at the iteration cap, bounded/nonblocking readiness inspection, and portable Windows test fixtures.

Source PR/commit attribution is recorded in devlog/_plan/261003_train_recovery/030_carry_ledger.md. Deferred items remain deferred. #6220 and #6473 remain open: mock replay tests and source/native-junction tests do not establish real launcher or Windows login acceptance.

Closes #6425
Closes #6309
Closes #6464
Closes #6465

Verification

Root bun run typecheck and GUI bun x tsc --noEmit -p .: passed on this assembled candidate.
Review follow-ups: quarantine persistence rejection preserves the original refusal within adapter recovery (150 focused tests); completed empty PATH scans now report inactive, while scan errors report unverified (39 tests, one platform skip). Both reported review threads are fixed and resolved.
CI follow-ups: corrected the credit-only snapshot test contract (72 focused tests passed); three React Doctor diagnostics fixed (29 GUI tests passed; pinned checker now clean).
Union checks: 78 tests passed across layout, core/Lab boundary, operating skill and CLI-capability guards.
Lane evidence: A 348 focused tests; B 1,034 focused tests; C 56 focused, 18 layout and 81 shim tests with platform skips recorded; D 276 focused tests. These are per-lane counts with overlapping coverage, not a full-suite total.
Both newly found runtime defects and the FIFO hang were reproduced before repair. Independent implementation/security reviews returned PASS. Structure, size-ratchet, privacy and whitespace checks passed.
Real Windows/Bun 1.3.14 execution of tests/update/update-npm-invocation.test.ts: 15 passed, zero failures/skips, including physical junction containment and target preservation. Recorded file blobs match this candidate.
Rendered real GUI components against an isolated fixture API: ordered/refused model saves, usage telemetry, >300-model compaction selection, Droid target resets and Portuguese narrow layouts. Fixture runs resumed after harness-only corrections; no live account configuration changed.
The user explicitly prohibited full local suites/heavy builds. Final required PR CI remains pending; comprehensive lane=all is reserved for final dev after the follow-up lands. Packaged installers, Windows login registry behavior and live provider/client sessions are not claimed verified.

Maintainer review dispositions

This is an owner-sponsored carry of the reviewed commits, not approval of later contributor heads. #6416 documentation/locale requests, #6192 selective auth cleanup and behavioral replay coverage, #6119 canonical paths plus real Windows junction proof, and #6149/#6151 locale/provenance/per-target cases are addressed and verified. Original source review states were not rewritten. For #6192, independent security review and privacy checks are supplied here; exact-head functional CI must pass before this owner-sponsored candidate lands. Existing unrelated Kiro identity policy is unchanged. Any objection on this candidate remains a separate merge gate.

GUI evidence

Real page components and production CSS; synthetic fixture data, not a live account or packaged-app screenshot.

Checklist

Scope stays focused and avoids unrelated cleanup.
Docs or release notes were updated when needed.
Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Maintainer integration decision

Owner lidge-jun elects maintainer integration into dev at a79ef3e4a52874dc05f9aaa5e71c5e494a978485. Exact-head pull_request CI 37103625693, attempt 1, completed successfully: all four Linux shards, both macOS shards, requested smoke/docs/structure gates, macOS widget bundle and Linux AppImage/deb packaged-shell E2E passed. React Doctor and Service lifecycle also passed. Dispatch-only Windows suite/macOS control were not run here and remain scheduled after the feature follow-up lands. Both actionable Codex findings were fixed with negative regressions and their threads resolved. Independent lane/security reviews and local privacy scan are recorded above. CodeRabbit skipped its full review due to the file limit; no claim of its code-review coverage is made. This is maintainer integration, not self-approval.

@hedging8563

Replace six relocated guide and API-reference URLs with their direct destinations. Provider endpoints, routing, and configuration remain unchanged. Carries #6474 by @hedging8563. Co-authored-by: hedging8563 <45883076+hedging8563@users.noreply.github.com>

@lcxhh521

Read used_percent as exhaustion evidence alongside usedPercent. Preserve usage values and existing spend-control and non-quota blockers. Carries #6463 by @lcxhh521. Co-authored-by: lcxhh521 <59329914+lcxhh521@users.noreply.github.com>

@luvs01

Suggestion rationale could emit terminal controls in human-readable output. Escape shared human lines while preserving JSON values and multiline exports. Add public guidance alongside the contributor regression tests. Carries #6459 by @luvs01. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>

@xianhongtao

Seed image capabilities for M3 and M3.1 in both Coding Plan regions. Exercise saved overrides, ID-only discovery, static fallback, and Combo gating. Carries #6445 by @xianhongtao. Co-authored-by: xianhongtao <74975356+xianhongtao@users.noreply.github.com>

@andrew05060414

Model toggles now respond immediately while writes retain click order. Keep newer intent through reconciliation and cancel stale target observations. Carries #6426 by @andrew05060414. Closes #6425 Co-authored-by: andrew05060414 <59988150+andrew05060414@users.noreply.github.com>

@Yuxin-Qiao

Windows Start at Login registered an ambiguous unquoted executable path. Carry the Windows-only quoted writer and enabled-entry migration while preserving opt-outs. Native Windows registry and upgrade verification remains required for #6473. Carries #6479 by @Yuxin-Qiao. Co-authored-by: Yuxin-Qiao <104957188+Yuxin-Qiao@users.noreply.github.com>

@kdm1jkm

Home-directory launches incorrectly excluded default Scoop Node npm paths. Carry physical-path validation for the narrow default current and bin layouts. Strengthen the reviewed launch-directory regression so it exercises cwd exclusion on every platform. Carries #6119 by @kdm1jkm. Co-authored-by: kdm1jkm <15812797+kdm1jkm@users.noreply.github.com>

@luvs01

Recovery logging expanded filesystem-derived backup names as cmd syntax. Use fixed success text while retaining exact read-only recognition of historical wrappers. Preserve the Bun placeholder gate and document the operator-visible log change. Carries #6455 by @luvs01. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>

@lcxhh521

Aggregate measured output tokens over elapsed time for summary, model and provider scopes. Fix invalid-sample poisoning, missing provider fallback, and tooltip translations. Add the missing summary display and rendered-cell regressions beyond the PR. Carries #6471 by @lcxhh521. Closes #6309 Co-authored-by: lcxhh521 <59329914+lcxhh521@users.noreply.github.com>

@luvs01

Lifecycle eligibility returns could leave an older exported picker key on disk. Run the existing best-effort cleanup before every unbound startup attempt. Preserve skip reasons, single-flight startup, and direct runtime cleanup. Carries #6457 by @luvs01. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>

@andrew05060414

Dropped liveness dials could abort updates after a tailnet listener stopped. Carry a bounded literal-IP bind fallback and single-settlement responses. Replace the routing-dependent remote-address test with a deterministic held local port. Carries #6477 by @andrew05060414. Co-authored-by: andrew05060414 <59988150+andrew05060414@users.noreply.github.com>

@luvs01

…#6460) Path-based role mirror reads could race replacement or block on a FIFO. Carry descriptor-bound validation with exact bigint identity checks and guaranteed close. Preserve existing mirror refusal statuses and document special-file behavior. Carries #6460 by @luvs01. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>

@andrew05060414

…6415) Temporary fnm paths could strand shims after the shell exited. Resolve only the launcher parent and report first-PATH-hit readiness during connect. Fix host-independent readiness scanning and move fnm tests under the size ratchet. Carries #6415 by @andrew05060414. Co-authored-by: andrew05060414 <59988150+andrew05060414@users.noreply.github.com>

@sungyongcho

Desktop page zoom reset across launches and clipped sidebar footer controls. Carry persisted macOS/Linux zoom and capture-phase events that preempt older shell hotkeys. Keep native shell defaults, Windows behavior, localization, and the existing IPC permission unchanged. Carries #6335 by @sungyongcho. Co-authored-by: sungyongcho <46742040+sungyongcho@users.noreply.github.com>

@lcxhh521

Keep synthetic search declared while serving over-budget calls paired limit results. Fix fetch-loop cap termination and avoid unused runTurn dispatch at the ceiling. Add both-transport budget, cap, caller-tool, cancellation, and commitment regressions. Carries #6470 by @lcxhh521. Closes #6464 Co-authored-by: lcxhh521 <59329914+lcxhh521@users.noreply.github.com>

@arikon

Carry JSON output guidance into system roots and active continuation actions. Include the output format in checkpoint lineage to invalidate changed schemas. Keep the documented prompt-only fallback; omit unrelated explanatory comments. Carries #6417 by @arikon. Co-authored-by: arikon <75247+arikon@users.noreply.github.com>

@codingbooo

Add default-off input-ID and private-message-metadata compatibility options. Keep ordinary stripping and xAI repair, including invalid IDs and stored requests. Document the privacy boundary; live launcher acceptance for #6220 remains unverified. Carries #6254 by @codingbooo. Co-authored-by: codingbooo <9621077+codingbooo@users.noreply.github.com>

@2836048681

#6382) Support opt-in metadata forwarding with provider header precedence. Narrow the contributor denylist design to four supported non-secret metadata names. Reject arbitrary names at config boundaries and filter again at runtime. Reimplements #6382 by @2836048681. Co-authored-by: 2836048681 <121647131+2836048681@users.noreply.github.com>

@xyjk0511

Persist the first output-item and last output-delta timing pair, including reasoning. Prefer that window for estimated decode throughput and retain the legacy TTFT fallback. Keep end-to-end speed unchanged and synchronize unavailable-window locale copy. Carries #6416 by @xyjk0511. Co-authored-by: xyjk0511 <127614382+xyjk0511@users.noreply.github.com>

@luvs01

Share CR, LF, and CRLF field and event rules across validation and projection. Retain exact identity bytes, bounded accounting, and live terminal behavior. Carry the reviewed late-LF callback fix and await regression fixture cleanup. Carries #6461 by @luvs01. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>

@luvs01

Check concrete decision destinations before resolving credentials or extracting request state. Preserve scoped inference fallback and unrestricted management probes. Carries #6450 by @luvs01. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>

@luvs01

Preflight retained fields, rows and cumulative output before cloning catalog metadata. Stage all additions atomically and preserve original upstream responses on refusal. Carries #6449 by @luvs01. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>

@luvs01

Bound retained routing metadata and preflight expanded JSON and SSE before artifact writes. Reject duplicate snapshot identities while preserving local lifecycle reuse and raw continuation state. Carries #6451 by @luvs01. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>

@luvs01

…rry #6452) Retain delegated event leases under the shared translator budget and cancel readers on early exits. Transfer ciphertext ownership to exact terminal events and release leases on builder refusal or cancellation. Carries #6452 by @luvs01. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>

@luvs01

Apply signature and path ownership checks before either relaunch path can quit or execute a discovered app. Restore validates the app shell without requiring experimental opt-in or the app-server binary. Carries #6453 by @luvs01. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>

@agentHits

Persist verification-required health and retry through account-matched authentication failover. Preserve quarantine across silent refresh, fence stale refusals, and document operator verification recovery. Carries #6192 by @agentHits. Co-authored-by: agentHits <140916359+agentHits@users.noreply.github.com>

@Hylouis233

Keep fresh paid credit evidence separate from included usage and reset tickets. Unlike the proposal, only creditCodexAccountIds opt-ins can override exhaustion; missing or stale balances cannot bypass the default hold. Reuse the canonical credit parser, preserve real cooldowns and main hard-lock policy, and retract omitted balance evidence on explicit upstream refusal. Reimplements #6466 by @Hylouis233. Closes #6465 Co-authored-by: Hylouis233 <88263959+Hylouis233@users.noreply.github.com>

@yuanyuanlove

Restrict compaction overrides with exact selectors or provider-qualified wildcards. Retain fail-closed validation, synthetic suffix matching, and multi-target disclosure fixes. Move panel styles into the dashboard stylesheet instead of raising the global size cap; omit unrelated devlog edits and preserve settings rollback documentation. Carries #6149 by @yuanyuanlove. Co-authored-by: yuanyuanlove <6202754+yuanyuanlove@users.noreply.github.com>

@shawn-kim-ai

Persist Droid defaults in owned rows and bind edits to preview and confirmation. Retain preference provenance and validate exact tiers independently per fallback target. Add empty/incompatible-first-ladder regressions and fix cross-target draft/confirmation leakage. Carries #6151 by @shawn-kim-ai. Co-authored-by: shawn-kim-ai <246239437+shawn-kim-ai@users.noreply.github.com>

@imranshaiedi-byte

Carry effective limits, capabilities, declared defaults and effort ladders into each client dialect. Refresh previously owned OpenCode/Kilo contributions without overwriting unrelated settings. Retain the bounded opt-in wire harness and compact the catalog contract to its existing budget. Carries #6405 by @imranshaiedi-byte. Co-authored-by: imranshaiedi-byte <235239556+imranshaiedi-byte@users.noreply.github.com>

lidge-jun and others added 30 commits October 3, 2026 13:26

lidge-jun merged commit 3ada270 into dev Oct 3, 2026
48 checks passed

lidge-jun deleted the codex/recover-train-261003 branch October 3, 2026 06:55

rhomat27 mentioned this pull request Oct 3, 2026

[Bug]: Claude Desktop picker mode breaks claude.ai chat (sends time out, picker 502s) since the merged chat/Cowork front end; picker off fixes it #6511

Closed

2 tasks done

lidge-jun mentioned this pull request Oct 4, 2026

[WRONG BRANCH] release: 2.77.0 #6550

Merged

3 tasks done

Navigation Menu

Repository navigation

fix: integrate reviewed provider, client, and desktop recovery train - #6487

fix: integrate reviewed provider, client, and desktop recovery train#6487
lidge-jun merged 63 commits into
devfrom
codex/recover-train-261003

lidge-jun commented Oct 3, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Conversation

lidge-jun commented Oct 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Verification

Maintainer review dispositions

GUI evidence

Checklist

Maintainer integration decision

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

lidge-jun commented Oct 3, 2026 •

edited

Loading