[dependabot]

Summary

Upgrade Codex and its TypeScript SDK from 0.163.0 to 0.164.0 across the SDK, MCP app, and triage evals while preserving recovery from oversized MCP responses. The dependency-only update exposed a native transport change that silently discarded responses above 16 MiB and left requests waiting for a timeout.

Changes

• Update the coordinated package pins and platform lockfile resolutions.
• Use a shared stdio transport that returns a correlated error before a response exceeds the native client's 16 MiB line limit. Byte accounting uses the MCP SDK serializer. Ordinary responses and the existing inbound checkpoint handling are preserved.
• Explain how paged reads can recover, while warning that a write may already have completed. The shared entrypoint covers normal MCP, discovery, reducer, and resumed workers without new settings or CLI surface.
• Exercise production stdio recovery and retain the real 64 MiB code-mode IPC test through a local HTTP transport. Both use the original approximately 114 MiB synthetic payload and verify complete evidence, source accounting, finding identities, and history.
• Consolidate repeated saved-result coverage and finding-history logic, preserving row identity, deduplication, and copy-on-append behavior while reducing duplicate code.

Testing

• Frozen installs for the SDK, MCP app, and triage evals passed.
• All five required portable plugin source checks passed: Ruff lint, Ruff format, CI compilation, source compatibility, and all nine compatibility-checker tests.
• SDK/eval compilation, combined SDK/MCP type checks, formatting, and universal plugin build passed.
• Both real transport recovery cases and all three diagnostic-report cases passed; all four transport boundary tests passed.
• Focused worker/launcher tests passed: 62 passed and six platform skips. Existing ownership-sensitive tests were rerun with normal filesystem ownership after sandbox UID remapping caused local fixture failures.
• Independent review and differential checks verified the saved-result cleanup, including malformed collections, row identity, deduplication, and copy-on-append behavior. All 479 existing recovery tests and six final history/rejection tests passed.
• The full local MCP run reported 585 passes, two skips, and one fixture failure caused by host Git tracing writing into the test target. The affected storage test passed after directing the still-enabled trace output outside the fixture; production checks and test expectations were unchanged.
• All required hosted checks and the full node-ci run 40001799138 passed on the final PR head, including Linux, macOS, Windows, and all 586 MCP tests (two platform skips).

Risk and rollout

The response limit is imposed by the upgraded native transport; the wrapper reports it promptly instead of allowing a silent discard and timeout. It does not truncate successful output or automatically repeat writes. Existing source evidence remains available for smaller paged reads. The original native IPC regression coverage remains enabled. There are no new public flags, settings, environment variables, or dependency install hooks.

Public disclosure review

• No customer, partner, prospect, or user identities, data, or identifying details are included.
• No credentials, personal data, private source, scan findings, or nonpublic links or tickets are included.
• I reviewed the branch name, title, description, commits, changes, comments, logs, screenshots, attachments, and links for public disclosure.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
🔒 Security Review	✅ Completed 2026-10-23T18:17:43.761080Z	ecf37a6	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mldangelo-oai]

Reviewed the final upgrade, shared stdio recovery transport, native recovery fixtures, and saved-result simplification with an independent reviewer. Exact-head node-ci run 39997675759 passed, including 586 MCP tests, both real transport recovery cases, portable source checks, packaging, and Linux/macOS/Windows SDK tests. All four required checks pass and no review threads remain. The merged dependency upgrades combine cleanly with this change.

[mldangelo-oai]

Re-reviewed the refreshed head: it combines the reviewed repair with the other dependency upgrades and changes no repair source. Fresh source CI run 40001799138 passed all Linux, macOS, Windows, MCP, portable-source, and package checks. All required checks pass, no review threads remain, and the PR reports clean merge status.