[HAYDEN-OAI]

Summary

• Filter the line-based fast-format input to existing literal files before passing the shared list to Oxlint and Oxfmt.
• Keep the existing handling of spaces, tabs, quotes, leading dashes, CRLF, and a final line without a newline. Existing filenames containing glob characters still work as literal filenames.
• Change only the handwritten wrapper and its existing regression fixture. No generated code, SDK behavior, dependencies, or lockfiles change.

Reproduction

With unrelated.ts present and [u]nrelated.ts absent, a file list containing only [u]nrelated.ts causes both native tools to interpret the missing filename as a glob and modify unrelated.ts. Missing *.ts and brace-looking filenames similarly modify files that were never listed. The commands still exit successfully.

The wrapper now checks each literal path once at the shared input boundary. Missing paths are skipped before either tool sees them; no glob parser or per-tool workaround is added. Regular-file symlinks retain their behavior. Directories and directory symlinks are ignored, consistent with the documented one-file-path-per-line input.

Validation

• Extend the existing native-CLI fixture from 11 to 19 cases. Against the unchanged base wrapper, four regressions fail while 15 controls pass. All 19 pass afterward on exact Node 22.0.0, Node 24.19.0, and Node 26.7.0.
• Independently execute the actual wrapper with the pinned Oxlint/Oxfmt binaries: three missing glob-looking paths modify unlisted files before the change; all eight literal/deleted-path cases pass afterward.
• Independent adversarial review compares 17 baseline/current scenarios, including broken symlinks, existing literal metacharacters, backslashes, leading dashes, spaces, tabs, regular-file symlinks, CRLF, and missing final newlines, using Bash 3.2 and the pinned native tools. No remaining findings.
• Full canonical handwritten suite: 7,892 tests pass across 208 files. An initial run hit local ENOSPC; the complete rerun passed after disk space was restored.
• Canonical formatting/lint, pinned TypeScript 6, Bash syntax, and whitespace checks pass.

The generated suite and remaining ecosystem/packaging checks run in CI.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-07T00:48:18.051561Z	36a245d	PR opened
🔒 Security Review	✅ Completed 2026-09-07T00:48:47.439149Z	36a245d	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[openai-sdks]

OkTest Summary

✅ 237/237 SDK tests passed in 10.414s for Node SDK PR #2670.

Test results — 42 files

Test	Result	Time
tests/chat-completions-complex-body.test.ts	✅ Passed	139ms
tests/chat-completions-create.test.ts	✅ Passed	213ms
tests/chat-completions-stream.test.ts	✅ Passed	228ms
tests/files-content-binary.test.ts	✅ Passed	148ms
tests/files-create-multipart.test.ts	✅ Passed	146ms
tests/files-list-pagination.test.ts	✅ Passed	163ms
tests/initialize-config.test.ts	✅ Passed	233ms
tests/instance-isolation.test.ts	✅ Passed	121ms
tests/models-list.test.ts	✅ Passed	172ms
tests/responses-background-lifecycle.test.ts	✅ Passed	222ms
tests/responses-body-method-errors.test.ts	✅ Passed	396ms
tests/responses-cancel-timeout.test.ts	✅ Passed	200ms
tests/responses-cancel.test.ts	✅ Passed	195ms
tests/responses-compact-retries.test.ts	✅ Passed	245ms
tests/responses-compact.test.ts	✅ Passed	238ms
tests/responses-create-advanced-stream.test.ts	✅ Passed	123ms
tests/responses-create-advanced.test.ts	✅ Passed	184ms
tests/responses-create-disconnect.test.ts	✅ Passed	1.186s
tests/responses-create-errors.test.ts	✅ Passed	212ms
tests/responses-create-malformed-api-responses.test.ts	✅ Passed	192ms
tests/responses-create-retries.test.ts	✅ Passed	283ms
tests/responses-create-stream-failures.test.ts	✅ Passed	226ms
tests/responses-create-stream-timeout.test.ts	✅ Passed	2.167s
tests/responses-create-stream-wire.test.ts	✅ Passed	2.516s
tests/responses-create-stream.test.ts	✅ Passed	96ms
tests/responses-create-terminal-states.test.ts	✅ Passed	231ms
tests/responses-create-timeout.test.ts	✅ Passed	217ms
tests/responses-create.test.ts	✅ Passed	170ms
tests/responses-delete.test.ts	✅ Passed	188ms
tests/responses-input-items-errors.test.ts	✅ Passed	180ms
tests/responses-input-items-list.test.ts	✅ Passed	180ms
tests/responses-input-items-options.test.ts	✅ Passed	105ms
tests/responses-input-tokens-count-timeout.test.ts	✅ Passed	297ms
tests/responses-input-tokens-count.test.ts	✅ Passed	196ms
tests/responses-malformed-inputs.test.ts	✅ Passed	2.229s
tests/responses-not-found-errors.test.ts	✅ Passed	221ms
tests/responses-parse.test.ts	✅ Passed	162ms
tests/responses-retrieve-retries.test.ts	✅ Passed	265ms
tests/responses-retrieve.test.ts	✅ Passed	214ms
tests/responses-stored-method-errors.test.ts	✅ Passed	497ms
tests/retry-behavior.test.ts	✅ Passed	2.988s
tests/sdk-error-shape.test.ts	✅ Passed	303ms

View OkTest run #34070846533

_{SDK merge (f37f4d8257f4) · head (36a245dc2276) · base (fdb038e21509) · OkTest (2b1bdfd25e98)}

[github-actions]

Castiron custom code

✅ No new custom-code files detected.

32 mixed files remain; 0 existing customizations changed.

Compared fdb038e21509 → 36a245dc2276. Generated baselines verified.

32 existing customizations unchanged

• api.md
• scripts/castiron/README.md
• scripts/castiron/custom_code_report.py
• scripts/castiron/test_custom_code_report.py
• src/client.ts
• src/resources/audio/transcriptions.ts
• src/resources/audio/translations.ts
• src/resources/beta/assistants.ts
• src/resources/beta/beta.ts
• src/resources/beta/index.ts
• src/resources/beta/responses/internal-base.ts
• src/resources/beta/responses/responses.ts
• src/resources/beta/threads/index.ts
• src/resources/beta/threads/runs/index.ts
• src/resources/beta/threads/runs/runs.ts
• src/resources/beta/threads/threads.ts
• src/resources/chat/completions/completions.ts
• src/resources/chat/completions/index.ts
• src/resources/conversations/index.ts
• src/resources/embeddings.ts
• src/resources/files.ts
• src/resources/fine-tuning/checkpoints/permissions.ts
• src/resources/images.ts
• src/resources/responses/internal-base.ts
• src/resources/responses/responses.ts
• src/resources/skills/skills.ts
• src/resources/skills/versions/versions.ts
• src/resources/vector-stores/file-batches.ts
• src/resources/vector-stores/files.ts
• src/resources/webhooks/index.ts
• src/resources/webhooks/webhooks.ts
• tests/lib/data-residency.test.ts

A changed generated baseline means this report cannot reliably identify which handwritten lines changed.

Inspect the custom-code diff

Download the exact patch produced by this run (requires repository access):

gh run download 34070863858 --repo openai/openai-node \
  --name castiron-custom-code-34070863858-1 --dir /tmp/castiron-custom-code-34070863858-1
git apply --stat /tmp/castiron-custom-code-34070863858-1/custom-code.patch
cat /tmp/castiron-custom-code-34070863858-1/custom-code.patch

Or reproduce it from an SDK checkout containing the vendored reporter:

git fetch --no-tags origin fdb038e21509264bcdf81741a40988dd694188b1 36a245dc227660dd21ff5d681e91780df74686d6
python3 scripts/castiron/custom_code_report.py report \
  --base fdb038e21509264bcdf81741a40988dd694188b1 \
  --head 36a245dc227660dd21ff5d681e91780df74686d6 --fetch --require-head-hash --public \
  --out /tmp/castiron-custom-code-36a245dc2276
cat /tmp/castiron-custom-code-36a245dc2276/custom-code.patch

This is the current full custom patch for mixed files, not an attribution of only the handwritten lines changed by this PR.

Full report and patch

[markstuart-oai]

Reviewed 36a245d against fdb038e. No actionable correctness or maintainability findings. Establishing the existing-file invariant once in the shared input list is the right boundary; it avoids a glob parser and per-tool special cases while preserving literal path arguments.

Independent validation: the 19-case native regression suite passes on Node 22.0.0, 24.20.0 and 26.7.0; the same suite with the base wrapper produces four failures and 15 passing controls. A separate 30-scenario base/head matrix passes all head cases, covering metacharacters, whitespace/quotes/backslashes/dashes, CRLF/EOF, regular and broken symlinks, directories, mixed/empty input and formatter-only JSON. Canonical lint/format, Bash 5.2 syntax and diff whitespace checks pass.

Validation qualifications: isolated pinned Oxfmt 0.62.0 reproduces unlisted-file edits for missing glob-looking paths; pinned Oxlint 1.79.0 did not reproduce those edits here, although its literal-file fix controls pass. Ten related generated-lint/config tests pass; one package-command fixture is blocked by pnpm's offline-store SQLite initialization. I did not run the full SDK suite or an actual Bash 3.2 binary.

[jbeckwith-oai]

Reviewed exact head 36a245d. Filtering the shared line-based input to existing regular files before invoking Oxfmt/Oxlint prevents missing literal paths from being reinterpreted as globs while preserving spaces, tabs, quotes, leading dashes, metacharacters, CRLF, and mixed lists. The focused regressions and full CI matrix are green, with no unresolved threads. No in-scope findings.