Repository navigation
release: promote the verified 2.62.0 tree to main - #5603
Merged
Merged
Conversation
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* fix(release): name standalone checksums after their archives * fix(release): verify Tauri prehashed minisign signature boxes
…ts attach (#5555) GitHub freezes a release when it is published, so the attach step's upload came back HTTP 422 "Cannot upload assets to an immutable release". Every release from v2.55.0 to v2.60.0 therefore shipped with zero assets and the desktop updater had nothing to download. Create the release as a draft and flip it to published in attach-release, after the verified bundle is uploaded. Release notes still come from the validated notes file written at creation.
…5567) * ci: scope macOS, Rust and app-bundle jobs to the shipping boundary An ordinary source pull request started the full cross-platform matrix: two macOS suite shards, the macOS widget plus Tauri app-bundle build, the Linux Rust toolchain job, and the macOS legs of the keyring and npm-global matrices. A proxy-logic change under src/ paid a Rust build and an app bundle it cannot affect, and dev pushes started the same matrix a second time after the pull request had already proven the change. Add a native path filter to the changes job and gate platform-macos, widget and desktop-shell behind it, so those jobs run on the promotion pushes to main and preview, on explicit dispatch, and on a pull request only when the inputs they build actually moved. The keyring and npm-global matrices take their leg list from a validated JSON output of the same job, keeping ubuntu and windows unconditional while the macOS leg follows the native selection. Drop dev from the push trigger: its integration evidence is the pull request run, and workflow_dispatch covers anything a maintainer wants proven by hand. main and preview stay on the push trigger because release.yml requires a successful push-event Cross-platform CI run for the exact release SHA and states that a pull-request run does not qualify. The aggregate ci gate learns the native dimension so a deliberately unselected job reads as not-requested while a job that was requested and then skipped still fails by name. An empty matrix include list would report success over zero legs, so the emitter validates both JSON outputs before they are consumed. Accepted coverage loss: a green pull request no longer proves the macOS suite, the Rust toolchain, or the app bundle. Those reach publication only through the promotion push, which still runs them. Local checks: NOT RUN. * test(ci): feed the aggregate gate the results shape needs actually has The new harness passed a flat job-to-string map as RESULTS, but the gate reads .value.result out of it, so jq failed on the first entry and the heredoc feeding the check loop came back empty. The loop never ran, which made the requested-then-skipped assertion fail with an empty accumulator and — worse — made the green-path assertion pass over nothing. Shape the map the way the needs context serializes it. Local checks: NOT RUN.
* fix(cursor): bound output quarantine and retain adjacent echo findings Carries #5476, including same-line marker attribution and upstream-error ordering regressions. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(cursor): replace duplicate replay entries in constant time Partially carries #5474. Preserve complete-history turn and invocation fidelity; defer the raw-message cutoff because it can discard the initiating instruction. Add long-history regression coverage. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(cursor): bound invocation argument restoration allocations Carries #5458. Reuse serialized arguments, probe UTF-8 length within the remaining envelope budget, and preserve final encoded-cost validation. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * test(cursor): pin bounded oversized-frame classification Document the intentional per-frame prefix boundary and verify late matches pass through without corrective retry while leading-match regressions remain intact. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> --------- Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
…Lite catalogs (#5508) * fix(responses): bound native steering routes and replay memory Native steering and injection accepted requests on routes that were never meant to carry them, and their replay buffers grew without an upper bound, so a long-lived WebSocket exchange could retain an unbounded amount of app-owned memory. Restrict steering to the routes that declare it, cap the replay and body sizes, and release the stores when an exchange settles. Preexisting negative route tests are retained, and the injection docs now cross-link the steering contract. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(responses): enforce native injection tool authorization Carry #5470 onto the bounded native-control path. Configure the resolved request-local catalog before attachment, reject undeclared added/done/terminal items before relay, and preserve structured rejection codes. Retain declared rich-result continuations and the existing size and rollback controls. Local checks: NOT RUN by instruction. Hosted CI remains required. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(subagents): recognize Responses Lite plaintext V2 catalogs Carry #5492. Recognize the first developer additional_tools catalog only when top-level tools is absent. Preserve opt-in, canonical destination, explicit catalog precedence, conflict checks and response restoration. Include unit and server-boundary regressions and clarify the Chinese catalog wording. Local checks: NOT RUN by instruction. Hosted CI remains required. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(responses): reject oversized injection before enqueueing Validate the serialized injection before reserving call identities or queue bytes. A result exceeding the configured body limit is refused synchronously even when another result awaits acknowledgement, leaving the retained socket usable for corrected input. Add a two-call regression on subscription and public API routes covering the typed refusal, unchanged replay retention, first acknowledgement, corrected second result and final cleanup. Preserve immediate refusal and authorization coverage, and align the public and structure contracts. Independent static review: PASS. Local checks: NOT RUN by instruction; revised-head hosted CI remains required before integration. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> --------- Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
* fix(config): preserve concurrent edits across refresh and desktop apply Carry #5478 with detached snapshot reconciliation, committed Claude subtree adoption, and cached asynchronous policy probes. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(codex): reject conflicting retained provider tables Carry #5450 while keeping its end-to-end compensation regression in a focused sibling below the file-size limit. Register the sibling additively in both layout authorities. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(doctor): bound live catalog reads and verify fallback behavior Carry #5433 with behavioral default-transport coverage for byte caps and redirects, exact row and identifier limits, and malformed-row fallback. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * docs(claude): record asynchronous desktop policy probe contract Document the nonblocking single-flight and cache contract carried from #5478, as identified in the final static review. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(claude): adopt committed gateway state before policy probes Rebase the live Claude subtree to the durable gateway transaction and retain pending disjoint edits. Cover hand edits, failed adoption, and a first-party switch while an earlier policy probe is pending. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(config): capture persisted deletion intent before detached rebasing Apply current disk tombstones after reconciliation without allowing a temporary stale value to erase deletion intent. Cover persisted discovery deletion, explicit reintroduction, and unchanged live precedence. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(codex): preserve multiline TOML in retained provider comparisons Share lossless structural lines with the native defaults editor, capture separated provider spans, and compare isolated parsed provider values. Preserve raw values and the document BOM while rejecting malformed or ambiguous definitions. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(claude): pin committed gateway leaves after live adoption --------- Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
…c and config output (#5573) * fix(lab): combine host-redaction hardening for socket markers and connect-to failures Combines three fork PRs into one change on current dev: bare destinations after resolver/socket markers are redacted only where grammar proves the position (sole argument or after 'lookup'), connect-to failures redact the bare target when a failure term follows, and rewrites splice at the tail offset so a marker word that repeats the destination cannot take the [host] itself. bun test tests/lab/lab-evidence-sanitization.test.ts: 31 pass (cherry picked from commit 69990d9) Source: #5538 commit b90139f Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(lab): redact socket destinations carrying a sentence-final period Classify the token without its trailing period and leave the period outside the mask: ECONNREFUSED redis. -> ECONNREFUSED [host]. Previously the punctuation defeated host classification and leaked the destination. (cherry picked from commit a74038c) Source: #5538 commit d8042a5 Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(config): avoid logging operator-supplied credential/group identifiers in credentialGroups diagnostics (cherry picked from commit 0354bd9) Source: #5538 commit fc57a55 Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(config): align comments with indexed messages and cover every issue shape (cherry picked from commit f8a67b3) Source: #5538 commit 038c0fa Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(cli): redact proxy credentials in config output (cherry picked from commit 73946f3) Source: #5538 commit b31732a Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(cli): keep non-secret proxy values readable in config output Mask only credential-bearing proxy URLs (userinfo stripped via redactUrlForLog, host/port kept); direct and credential-less values print unchanged. Clarify that config export stays raw for restore. (cherry picked from commit acdbb1c) Source: #5538 commit dc4d273 Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(quota): sanitize Anthropic quota labels (cherry picked from commit ee716bf) Source: #5538 commit 4a04458 Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(quota): drop unrecognized Anthropic display_name from quota labels Per review on #5463: stripping terminal control characters still left attacker-chosen residue on the quota line. parseClaudeLimit now returns null unless the name reduces to a recognized model (Fable, Opus, Sonnet); the test asserts the residue is not emitted and adds a recognized-name positive case. (cherry picked from commit a9a6bac) Source: #5538 commit aaffe75 Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * docs(providers): state canonical quota label boundary Source: #5538 commit 62c677c Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(diagnostics): preserve redaction across path aliases and resolver prose Use normalized config keys for get and mutation output. Preserve direct resolver destinations when explanatory text follows, while retaining socket prose exclusions. Add focused regressions and align output contracts. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * docs(structure): keep runtime doc within its line budget --------- Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> Co-authored-by: Epinephrine <luvs01@hanmail.net>
…nect trailers (#5574) * fix(devin): suppress untrusted Connect trailer text Connect-RPC EOS trailers propagated upstream-controlled error.message text into adapter error events, API responses, and diagnostic logs, and that text can reflect the credential carried by the request. Parse trailers with an allowlist for known Connect codes, keep the raw message inside the parser for quota/opaque-denial detection, and throw content-free errors carrying only the allowlisted code and hex trace id. (cherry picked from commit 50eab5a) (cherry picked from commit 6efc759) * fix(devin): preserve stated reset delay on content-free trailer errors The trailer suppression left the thrown CloudChatError without the upstream "limit will reset in N" sentence that streamChatEventsWithResetRetry scraped for its cooldown, so a stated-reset 429 failed immediately instead of waiting out the quota window. Parse the delay inside the trailer parser while the raw text still exists and carry it as a typed retryAfterSeconds field; the retry prefers that field and keeps the message scrape for errors whose text still carries a hint. Adds a regression test that drives the real Connect EOS trailer path. (cherry picked from commit 7b7a8b8) (cherry picked from commit b841abd) * fix(devin): carry the stated reset delay in the outward trailer error (cherry picked from commit 4b723ef) (cherry picked from commit 82d452c) * fix(devin): prevent reset waits from holding active-turn capacity (cherry picked from commit df07bc6) (cherry picked from commit 98c9298) * fix(devin): pin the adapter's zero reset wait and correct the surface comment (cherry picked from commit 0e73736) (cherry picked from commit a2936ca) * test(devin): prove the zero reset wait through the adapter's own sends The module-mock spy leaked into sibling test files in the same bun test process, so devin-stated-reset-retry and devin-stated-reset-hardening saw a stubbed helper. Drive the real runTurn with a stubbed fetch returning a Connect EOS-trailer refusal instead: the asserted signals are the surfaced error text and the physical GetChatMessage count, which fail fast under the 5s abort signal if the adapter's maxWaitMs: 0 pin is removed or weakened. Register the file in the test layout map and fixture. (cherry picked from commit 1abc035) (cherry picked from commit 2c4bf00) * fix(devin): bind alias tenant host to credential key (cherry picked from commit d225fc2) (cherry picked from commit 9b54aeb) * test(devin): verify sanitized reset refusals across bound tenants Reconcile #5455 zero-wait coverage with #5143 content-free Connect diagnostics: retain 429 and generated retry timing while proving reflected credentials do not escape and only one inference send occurs. Exercise a matching deprecated alias credential through tenant dispatch and the same refusal path. Preserve the zero wait pin, host allowlist, credential binding, and typed reset field. Document the safe typed retry delay and opt-in helper replay contract. (cherry picked from commit 6f2901b) * fix(devin): select tenant host from the account that owns the transmitted key The consolidated fix bound alias-slot tenant hosts to the transmitted key but still returned the active literal slot's host for any key. Devin keeps several accounts per provider id and the request path injects the admitted account's token, which need not be the active one, while a configured key, a forwarded bearer, or a test token is not stored at all. Each of those could inherit another account's EU or FedStart tenant. resolveDevinApiServer now looks up the stored credential whose access token is exactly the transmitted key, in the configured provider id first and then its deprecated alias, active account first. Only that owner's validated host is used; an owner with an unusable host, an unmatched key, or no key falls back to the validated configured base URL and then the US default. The lookup uses getCredential and listAccounts, which store mocks elsewhere in the suite leave real. Tests pass the owning key where a stored tenant is expected, so the invalid alias-host case now reaches the host validator. New cases cover a mismatched literal slot, an alias owner beside an occupied literal slot, a key neither slot owns, a missing key, a non-active owning account, and a configured key at the adapter boundary. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> --------- Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> Co-authored-by: Epinephrine <luvs01@hanmail.net>
…#5509) * chore(dev): retire automatic pre-push validation (#5500) Carry #5500 and align both draft enforcement prompts with scoped validation. Clarify that inherited Git override isolation belongs to the fixture harness. Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com> * ci: root macOS discovery and diagnose owned process waits (#5483) Carry the rooted sharded suite and read-only stall observer without changing control-lane batching, suite budgets, or failure propagation. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * test: isolate Windows runtime discovery and reservation fixtures (#5484) Carry #5484 while avoiding the unnecessary parent LOCALAPPDATA mutation. Preserve real SQLite contention, atomic publication, reservation assertions, and existing deadlines. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(ci): bound translation email scanning (#5454) Carry the at-sign-anchored sanitizer scan, explanatory rationale, and long-token regression without changing mention-defusing semantics. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(ci): redact diagnostic paths and align localized command lists Capture and redact sample output before bounded emission, retain diagnostic child ownership and regression fixtures, and add the missing test:changed command to six locale inventories. Local runtime validation remains NOT RUN by owner instruction. * fix(ci): preserve legacy checklist bodies with durable re-attestation Require author clear-and-retick saves bound to real head/base and persisted server-time checkpoints. Preserve pending state across events, invalidate stale evidence, and refresh live PR and saved proof before readiness. Keep body writes out of migration handling and cover mutation failures and sequential races. Local runtime validation: NOT RUN by owner instruction. Independent static review passed; hosted verification and explicit maintainer security review remain pending. * fix(ci): require saved attestation evidence before readiness promotion The pre-ready readback compared the saved gate comment with the run's expected state, but the gate mutated the listed comment object in place, so a readback that shared it observed this run's own write. Replace the object instead and require the saved state to be a finalized attestation of the live head, base and body before any ready side effect. A wording-only save that keeps its ticks now gets a specific action, so the rejected shortcut is acknowledged in the gate comment instead of being skipped as a byte-identical update. Record the readback as a reviewed read, and move the self-contained exhaustive-deps suppression block byte for byte into a sibling file to keep ci-workflows.test.ts under its size cap. Local runtime validation: NOT RUN by owner instruction; hosted CI verifies. --------- Co-authored-by: JUN <243035832+lidge-jun@users.noreply.github.com> Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
…wers, and sidecar sends (#5575) * fix(web-search): combine replay-cache isolation with deadline-safe quota evidence Combines two fork PRs on the web-search path: isolate the replay cache by request context (#563) and preserve quota evidence when Retry-After would outlive the sidecar deadline (#568), rebased onto current dev. The #568 test's unrecorded-destination case is adapted to the current foldDeveloperRoleToSystem fixture semantics. bun test: web-search-bridge-replay + web-search-sidecar-429 + server-key-failover-e2e + chat-inline-document-bytes: 65 pass * fix(web-search): scope replay cells to key-resolved loopback principals * fix(retries): refuse transient 5xx after an operator-authorized reset replacement * fix(retries): word the replay refusal for the post-response path too * test(responses): keep the inline-document role fixture on its dev contract The carried replay-isolation commit also rewrote this fixture. It is unrelated to replay or retry behavior and the dev version already covers the current role contract, so it stays as dev has it. * fix(web-search): fail closed when a replay caller has no principal A loopback caller that presents no opencodex API key has no caller identity, but the replay scope gave every such caller the shared principal "loopback". Two local processes with the same conversation id and serving route then shared bridged-search replay cells, and a client-visible cell id was enough to recover another caller's retained search result. The scope now carries a principal only when resolveContextPrincipal finds one. Without it bridgeSearchReplayScope yields no scope, so nothing is recorded or restored for that caller. The key-switch regression now seeds under a real key-derived principal, with a positive control that the same seed restores and a keyless case that must leave the cell untouched. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(retries): keep every resend-inducing answer under replay suppression After an ambiguous reset spends the operator-authorized replacement, the first send may already have run the turn. The fence only covered the gateway statuses in isTransientUpstreamStatus, so a replacement that answered 429 or 529 reached the client and the proxy's quota rotation unmarked, and either could send the turn a third time. The fence now covers what actually resends: the client retry table (408, 409, 429, every 5xx) and proxy credential and quota recovery (401, 402). Those settle as the refusal with the replacement body released. Any other error keeps its real status for the caller but is marked non-replayable, so recovery loops such as the opaque-blob rebuild of a 400 cannot resend it. Successful answers are returned unchanged. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(web-search): clear a stale replay principal and document its absence Rewrite the principal field on every request so an absent principal also clears one a reused holder carried, and describe the field as absent for keyless callers instead of naming a shared loopback lane. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(retries): refuse a redirect that would resend a spent replacement A client that follows a 307 or 308 sends the same POST body again, so after a spent replacement those settle as the refusal as well. The regression tables now cover every 5xx class seen in the field and assert that a kept status is never mistaken for a proxy-synthesized refusal. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(web-search): share one physical-send budget across sidecar reset and 429 recovery Every sidecar 429 replay called fetchWithResetRetry with a fresh default allowance of three sends, so resets in front of each of the three quota legs could reach nine paid upstream requests. The sidecar now holds one three-send budget for the whole search: each helper call receives what is left and reports every send it makes, reset retries included. The budget is checked before the 429 body is released, so an exhausted budget ends with the observed 429 as the recorded outcome instead of a send-budget error recorded as a connection failure. The deadline-safe 429 handling from the carried change is unchanged. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * docs(structure): record replay ownership, the sidecar send budget, and the replacement fence Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(codex): keep a non-replayable 400 out of the gated-model account retry The answer to a spent operator replacement is marked non-replayable, and every recovery loop was meant to stop on that marker. The Codex pool's unsupported-model check did not read it, so a marked 400 from a gated model could still rebuild the turn and send it from another account. It now refuses a marked response, like the quota and transient ladders beside it. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(combos): stop on a spent replacement's answer instead of hopping The answer to a spent ambiguous-reset replacement can keep its real status with only an in-memory non-replayable marker. A combo rebuilds a failed attempt as a new response, which dropped that marker, so a context overflow or a 413 read as target-local and the combo sent the same turn to its next target although the first send may already have run it. The consumed failure now records that the attempt was non-replayable, carries the marker onto the rebuilt response, and the combo loop stops on it. A 413 also joins the refusal set, because it is answered to the client as a context overflow the client compacts and resends. A two-target combo regression counts physical sends: the second target must receive none. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(errors): match the whole replay refusal sentence The refusal wording became shorter and more generic, so a provider message containing the phrase could have been labelled as this proxy's refusal in the request log. Match the full sentence the proxy writes. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * docs: state that bridged-search replay needs a caller key Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * docs(structure): add 413 and the combo stop to the replacement fence Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> --------- Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
* feat(anthropic): add Claude Opus 5.5 pricing, 1M context and catalog rows Live Anthropic discovery listed claude-opus-5-5 (released 2026-09-22) before any static row existed, so the picker showed it with no price, no max output, no input modalities and no effort ladder, and every logged request was unpriced. - Anthropic seed: claude-opus-5-5 with a 1M window, which also gives it the low..max effort ladder and text+image input. - Metadata snapshot + regenerated table: anthropic, six Bedrock ids (regional 1.1x), openrouter/vercel/kilo anthropic/claude-opus-5.5 (+ vercel -fast), venice claude-opus-5-5; all 1M context / 128K output. - Price overlays at 4 / 20 / 0.20 cache read (0.05x) / 5.00 cache write for anthropic, anthropic-apikey, cursor (Cursor model page), devin and devin-cli (derived: live catalog lists it, Devin's cost table does not yet). - Opus 5 overlays now cite the published Anthropic price instead of the maintainer confirmation; the tuple is unchanged. - Cursor capability, effort tiers and thinking families for claude-opus-5-5, mirroring the measured Opus 5 ladders; Devin seed and context window. Sources: platform.claude.com pricing, models overview, Opus 5.5 overview, effort and migration pages; cursor.com/docs/models/claude-opus-5-5; models.dev, OpenRouter and Vercel model APIs. Plan and audit: devlog/_plan/260923_opus_5_5_catalog/. * docs(devlog): record Opus 5.5 catalog unit outcome * feat(providers): extend Claude Opus 5.5 to Opper and GitHub Copilot Opper's public catalogue lists a claude-opus-5-5 pool (anthropic, aws eu, vertex, vertex-eu; all 1M / 128K, vision), so the Opper seed carries it beside claude-opus-5. GitHub Copilot announced Opus 5.5 GA on 2026-09-22 at $4 / $20 / $0.20 cached / $5 cache write; the metadata snapshot gains a claude-opus-5-5 row cloned from its claude-opus-5 row with that price. Command Code lists claude-opus-5-5 live but has no static seed; its price, like Opper's and Copilot's, resolves through the Anthropic vendor row, now pinned by the Opus 5.5 usage test. Kiro, opencode-zen/go and the OpenRouter/Venice/Kilo fast tiers publish no Opus 5.5 yet and stay unchanged. Classification: devlog/_plan/260923_opus_5_5_catalog/040_plan_providers.md. * docs(devlog): record Opus 5.5 provider rollout outcome
…fast tiers (#5581) These providers had not published Opus 5.5 on 2026-09-23; the rows are added preemptively, mirroring each provider's Opus 5 entry. - Kiro: claude-opus-5.5 in the model list at 1M, with the output_config native effort field Opus 5 uses. Calls fail upstream until Kiro ships it. - Snapshot rows: opencode-zen claude-opus-5-5 (list price), OpenRouter and Kilo anthropic/claude-opus-5.5-fast (Anthropic fast 8 / 40 / 0.4 / 10), Venice claude-opus-5-5-fast (its 1.2x markup, 9.6 / 48 / 0.48 / 12). - opencode-go carries no Claude model at all and stays unchanged. Plan: devlog/_plan/260923_opus_5_5_catalog/060_plan_preemptive.md.
The Models tab opened with a three-row card of fixed sentences whose middle row read "not reported" on every standalone install, because catalogSyncedAt only exists for ocx connect clients. Replace it with a closed <details> line that names the real delivery steps for the current mode (standalone: save -> Codex loads it on restart; client: save on hub -> sync -> Codex loads it on restart) and expands to a per-step explanation plus a pointer to the Reload Codex models button. Trim the subtitle sentences the disclosure now covers and make the save toast mode-neutral. All ten locale catalogs updated.
…984 (#5579) * fix(codex): re-pin the upstream model snapshot to openai/codex 6cfe29984 The pinned catalog still described GPT-5.6-Sol as the "Latest frontier agentic coding model" and ranked it first, while upstream now ships GPT-6-Astra as the listed flagship (priority 1) and describes Sol as the "Reliable agentic workhorse for everyday tasks." (openai/codex #47085). The re-pin also brings 272k/872k 5.6 windows, 0.144.0 client floors, the hidden gpt-5.4 row with its Terra upgrade, the Daybreak rows, and drops the retired gpt-5.4-mini and gpt-5.2 rows (#44250). Upstream stopped shipping top-level base_instructions (#43604), so the pinned-row projection now derives it from model_messages.instructions_template for every row, as it already did for gpt-6-astra. The JSON stays byte-identical to upstream. * test(codex): expect the re-pinned Sol priority (4) in catalog order oracles
* feat(codex): list GPT-6 Sol and Luna, gate GPT-6 Astra Minor OpenAI announced GPT-6 Sol and Luna on 2026-09-22, and the authenticated ChatGPT Codex roster already serves both as full native rows. codex-rs has not bundled them yet, so opencodex never listed them and users could not pick them. The two roster rows (captured 2026-09-23 at client_version 0.155.0) are pinned verbatim in a sibling file, src/codex/data/roster-pinned-models.json, merged after the codex-rs snapshot so a later snapshot re-pin wins automatically. Sol and Luna are self-described flagship natives listed unconditionally, like gpt-6-astra; opencodex does not forward the caller's `version` header, so older Codex clients can use them too. Luna keeps its low..max ladder instead of inheriting ultra. gpt-6-astra-minor appeared only in an Azure playground config and is not served by any roster; it is registered as an account-gated alias of gpt-6-astra, hidden and refused until an authenticated roster lists it. * test(codex): raise the sync-hardening spawnSync buffer for GPT-6 roster rows
…ovider except Cursor (#5584) OpenAI released GPT-6 Sol and Luna on 2026-09-22 (API list price: Sol $2 / $0.20 cached / $10, Luna $0.10 / $0.01 cached / $0.50). Most providers had not published them on 2026-09-23; the rows are added preemptively, mirroring each provider's GPT-5.6 Sol/Luna entry, the same way Opus 5.5 was added in #5581. Cursor is deliberately untouched. - Metadata snapshot + regenerated table: gpt-6-sol / gpt-6-luna for amazon-bedrock, cloudflare-ai-gateway, github-copilot, kilo, openai, openai-codex, opencode-zen, openrouter, vercel-ai-gateway and zenmux, at list price (fields a provider bills at 0, such as Kilo's subscription rows, stay 0). opencode-go has no GPT-5.6 Sol and is skipped. - Registry: OpenAI API key (1,050,000 / 922,000 / 128K and low..max, mirroring gpt-6-astra's API seed), OpenRouter models/windows/service tier, GitHub Copilot models and Responses wire, BizRouter, DigitalOcean, Devin/Devin CLI seeds. - Kiro, CodeBuddy and Devin static rosters, with Kiro's native reasoning field. - Price overlays: verified OpenAI API rows, derived rows for ChatGPT login and Devin; long-context tier rows for both.
…Ocean roster oracles (#5586)
…son (#5585) * fix(release): keep the desktop version sources in step with package.json package.json on dev moved to 2.62.0 while desktop/src-tauri/tauri.conf.json, Cargo.toml and the opencodex-desktop Cargo.lock entry stayed at 2.61.0. The desktop build reads its version from those files and the updater manifest from the dispatch input, so a release from this line would ship an app reporting 2.61.0 under a 2.62.0 manifest and the updater would re-offer it forever. Sync the three desktop sources to 2.62.0, and route every version move through scripts/release-version-sources.ts: bump-dev-version.ts and release.ts rewrite all four files, dev-version-bump.yml stages exactly those four and rejects a reused bump branch touching anything else, and release.yml checks all four in package-desktop before building and again before publishing. * fix(release): restore the version sources before validating a reused bump branch The decide step leaves its rewrite in the working tree, so git checkout -B refused to switch to an existing bump branch, and a successful switch would have let the check read this run's edits instead of the branch's commit. Restore the four paths first. * test(release): anchor the workflow slices on whole lines
… a real executable (#5595)
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Contributor
|
Navigate logical layers of code changes, visualize relationships, and explore their blast radius. Note Currently processing new changes in this PR. This may take a few minutes, please wait... ⚙️ Run configurationConfiguration used: Repository: lidge-jun/opencodex/.coderabbit.yaml Review profile: ASSERTIVE Plan: Advanced Run ID: ⛔ Files ignored due to path filters (4)
📒 Files selected for processing (231)
✨ Finishing Touches📝 Generate docstrings
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
|
✅ Deterministic PR hygiene checks passed. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3c663e427c
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Comment on lines
32
to
+33
| push: | ||
| branches: [main, preview, dev] | ||
| branches: [main, preview] |
There was a problem hiding this comment.
Keep dev in the push.branches list, or add an equivalent post-merge exact-SHA gate. When two PRs pass against different base states and are then merged, their combined dev tree can violate the file-size ratchet, an exhaustive union, or another integration invariant even though both PR runs were green; with only main and preview here, that merged SHA receives no automatic Cross-platform CI run, while workflow_dispatch is merely manual. The repository explicitly documents this union-failure mode and prior incidents, so PR evidence is not a substitute for validating the resulting integration head.
AGENTS.md reference: AGENTS.md:L248-L251
Useful? React with 👍 / 👎.
Comment on lines
+250
to
+255
| native: | ||
| - 'app/**' | ||
| - 'desktop/**' | ||
| - 'src/service/**' | ||
| - 'src/cli/index.ts' | ||
| - 'src/lib/bun-runtime.ts' |
There was a problem hiding this comment.
Do not gate the full platform-macos suite on this narrow native filter. For example, a PR changing src/routing/** or the Darwin-only cases in tests/routing/subagent-fallback-handle-responses.test.ts sets ci=true but native=false, so the macOS job is skipped and those cases are skipped on Linux as well; the same applies to other platform-dependent runtime areas and tests outside the listed paths. Gate only the widget/desktop packaging jobs this way, or broaden the macOS test input filter to the complete runtime and test surface.
AGENTS.md reference: .github/AGENTS.md:L18-L18
Useful? React with 👍 / 👎.
3 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Maintainer promotion of the verified
devcandidatea077087b74tomainfor 2.62.0. The owner explicitly requested the stable release.The branch starts at the candidate and merges
origin/mainwith theoursstrategy, so the promoted tree is exactly the verified candidate. Everythingmaincarried that the candidate lacked is release-fix carries already ondevunder other SHAs, earlier version metadata, and promotion merges; no product change is dropped.Verification
a077087b74passed a full-platform Cross-platform CIworkflow_dispatchrun with every job executed and green, including all nine Windows shards, both macOS shards, the widget bundle and the desktop shell: https://github.com/lidge-jun/opencodex/actions/runs/35778197810bun scripts/release-version-sources.ts check 2.62.0.mainmerge SHA gaterelease.ymlbefore publication.Checklist
Owner-controlled promotion using repository admin authority; no rulesets changed.