Repository navigation
[WRONG BRANCH] release: sync preview to main 2.85.0 - #7096
Merged
Merged
Conversation
[WRONG BRANCH] release: 2.80.0 dependency audit fix
`ocx logs explain <id>` passed the pretty-printed route decision to printData as a single entry. printData escapes control characters per entry for terminal safety, so every line break was printed as a literal `\x0a` and the whole decision came out on one line. Pass one entry per line instead; values keep the same terminal-safety escaping, and --json output is unchanged.
…6711) * release: v2.33.0-preview.20260825 * release: v2.34.0-preview.20260827 * release: v2.36.0-preview.20260829 * fix(release): pass the bump job's permissions through the reusable-workflow call (#3262) Both v2.40.0 release dispatches (33615174183 preview, 33615177849 main) died at startup_failure: a workflow_call cannot grant its callee more than the calling job holds, and dev-version-bump.yml's job declares contents+pull- requests write. #3129 wired the call but never dispatched a release, so this is its first live run. The caller job now declares exactly the callee's two permissions; no other job in release.yml gains anything. Co-authored-by: jun <jun@lidge.dev> (cherry picked from commit 7ce0ba5) * release: set preview channel version 2.48.0-preview.20260908 * release: set main channel version 2.48.0 * chore(release): promote 2.55.0-preview.20260914 to preview Promotes the dev product snapshot 62f0222 to the preview train. The 2.55.0 line carries the #4546 cost-guard work: one send budget per logical request with a shared final-recovery reserve, zero-is-zero refusals with a typed error rather than a synthetic 502, compact and the Kiro inner retries admitted against that budget, a finite send ceiling per root workflow with an interactive reserve a fan-out cannot take, and a healthy detour promoted on transient-hold expiry instead of released cold. The previous preview tip 2.54.0-preview.20260914 is already tagged and published and is outranked by v2.54.0, so it could not be re-released; this is a new candidate rather than a re-cut. * chore(release): promote the verified 2.55.0 product tree to main Same product tree as preview 7bdd1b2 / 2.55.0-preview.20260914, which published successfully with its registry smoke green. Only package.json version differs. * ci(release): expose Linux bundler diagnostics for stable artifacts * fix(release): prepare stable platform bundles * fix(desktop): carry native sidecar packaging repair to main (#5532) * chore(ci): refresh main release verification (#5534) * fix(release): carry lipo argument fix to main (#5537) * fix(release): carry checksum and signature repair to main (#5546) * fix(release): carry Windows checksum record support to main (#5552) * fix(release): publish the GitHub release only after its verified assets attach (#5555) (#5558) GitHub freezes a release when it is published, so the attach step's upload came back HTTP 422 "Cannot upload assets to an immutable release". Every release from v2.55.0 to v2.60.0 therefore shipped with zero assets and the desktop updater had nothing to download. Create the release as a draft and flip it to published in attach-release, after the verified bundle is uploaded. Release notes still come from the validated notes file written at creation. * release: prepare 2.63.0 version metadata (#5612) * release: prepare 2.69.0 version metadata * fix(release): sign the packaged macOS keyring addons before notarization (#6271) * fix(release): sign the packaged macOS keyring addons before notarization Notarization rejected the 2.73.0 preview app: Resources/keyring/*.node, bundled since #6161, were unsigned or ad-hoc and had no secure timestamp, and Tauri does not sign files under Resources. Sign each darwin addon in place with the Developer ID identity, hardened runtime and timestamp after the certificate import and before tauri build, verify the result, and fail a real release that lacks signing material. * fix(release): match keyring signature fields without a pipe (cherry picked from commit 11782ee) * chore(release): 2.74.0 * fix: demote developer to user for OrcaSAQ-2 leading-system template The OrcaSAQ-2-Cyber-27B GGUF pins the same chat-template contract as Qwen3.8-27B — a non-leading `system` raises and `developer` is unsupported — so translated requests carrying a mid-conversation developer reminder failed upstream with a 500 template error. Widen the leading-system matcher to the OrcaSAQ family (org prefix optional, quant tag optional) so the reminder keeps its slot as `user`. --------- Co-authored-by: JUN <bitkyc08@gmail.com> Co-authored-by: jun <jun@junui-MacBookPro.local> Co-authored-by: jun <jun@lidge.dev> Co-authored-by: lidge-jun <243035832+lidge-jun@users.noreply.github.com> Co-authored-by: t <a@b.com> Co-authored-by: JUN <jun@lidgeai.com>
* fix(codex): renew main credit evidence before expiry * test(codex): cover main credit evidence recovery * fix(codex): distinguish stale credit evidence in refusal hints * test(codex): use existing auth error response mapper * test(codex): isolate main credit recovery generations * docs(codex): explain historical credit spendability check * fix(codex): renew opted-in main credits before expiry (#6692) Restrict renewal to valid previously spendable identity-bound credit evidence from three minutes of age. Prepare a token before WHAM and recheck eligibility. Preserve reauth during passive renewal and identity retries, retaining pacing. Remove the out-of-scope refusal-message and retry-hint changes from #6669. Co-authored-by: AiriDea <28827642+AiriDea@users.noreply.github.com> * fix(codex): preserve joiner auth behavior during passive renewal --------- Co-authored-by: OpenCodex Tier Replay <opencodex-tier-replay@local.invalid> Co-authored-by: JUN <jun@lidgeai.com> Co-authored-by: AiriDea <28827642+AiriDea@users.noreply.github.com>
* fix(antigravity): rotate web-search validation refusals * refactor(antigravity): share validation refusal predicate * test(antigravity): assert cancelled refusal stays healthy * fix: narrow Antigravity web-search rotation to structured refusals Match ordinary dispatch gates, keep durable account health unchanged, and charge Antigravity sidecar rotations once per physical send. Co-authored-by: 重音 <hi.baozheng@gmail.com> * fix: preserve Antigravity search refusals and refund unsent hops --------- Co-authored-by: JUN <jun@lidgeai.com>
* fix(claude): stop re-attaching the token footer as a user turn * docs: align translated Claude token footer guidance
* fix(kiro): surface a dead refresh token as needing re-auth * fix(oauth): project Kiro refresh attention in canonical health
…6724) * fix(lifecycle): propose shorter restart drain grace Separate the proposed two-second active/scoped-drain grace from the existing sixty-second cleanup watchdog and seventy-second replacement-readiness budget. Keep API and dashboard timing aligned, cover lifecycle timing and ownership with synthetic clocks, and document interrupted-execution uncertainty. Proposal for owner review of the shared lifecycle default; does not authorize automatic replay or guarantee a two-second recovery. Refs #6643 * feat(lifecycle): make shorter restart grace an explicit API option Signed-off-by: BigHulk <happyhls@gmail.com> * docs: describe explicit restart grace in localized API pages Signed-off-by: BigHulk <happyhls@gmail.com> * docs(api): clarify replacement readiness in French * fix(lifecycle): cut turns at a sub-200ms restart grace without shortening the flush window The restart drain always started 200ms after acceptance so the 202 response could flush, which meant an explicit drainGraceMs below 200 cancelled active turns late. Arm a separate early-cut timer at acceptance + grace for those values; cleanup, listener stop and process exit still wait for the 200ms flush window, and a pending veto cancels the timer. Default and >=200ms grace arm nothing new. Co-authored-by: Hulk <happyhls@gmail.com> --------- Signed-off-by: BigHulk <happyhls@gmail.com> Co-authored-by: Hulk <happyhls@gmail.com>
Map the upstream reasoning subset without changing inclusive output totals. Cover final cumulative SSE usage and buffered/streamed Chat and Responses projections. Co-authored-by: Ingwannu <186453546+Ingwannu@users.noreply.github.com> Co-authored-by: daehwanahn <31888220+daehwanahn@users.noreply.github.com>
… did not start (#6722) * fix(server): serve the desktop bundle's dashboard from an ocx the app did not start * test(server): cover every packaged dashboard layout, source fallback and absent resources
…ady revoked (#6707) * fix(codex): stop refreshing pool accounts whose refresh grant is already revoked A pool account whose refresh grant the token endpoint declared revoked or expired is persisted with a terminal validation verdict, but passive quota reads (dashboard polls, account listings, priming, recovery probes) still called getValidCodexToken on every pass. With no cached quota, or with the credits switch forcing a cache bypass, each pass POSTed the dead refresh token again and logged the same `[codex] pool refresh: reauth status=401` line. fetchPoolAccountQuota now answers those passive reads with the stored `refresh_failed` reauthentication result and re-marks the generation-scoped runtime flag, without a token request. An explicit dashboard refresh (validatePending), a post-reset readback, and source-linked credentials still probe. Any credential write or completed validation already drops the terminal marker, so a re-login recovers the account as before. * fix(codex): keep explicit admin refresh probing a dead pool grant `POST /api/codex-auth/accounts/refresh` sets validatePending only for a dashboard session, so `ocx account refresh` (a raw-admin POST) hit the new dead-grant hold and made no token request. Thread a separate explicitRefresh intent from that route through the account listing to fetchPoolAccountQuota so any explicit refresh command retries the grant once, without changing validatePending (inference consent stays GUI-only). Passive reads stay held: GET listings including `?refresh=1`, dashboard quota polls, priming, and recovery probes. Adds a raw-admin POST case next to the GUI-session case.
Add opt-in `ocx message sessions` and `ocx message send` for exact loaded local Codex sessions (relates to #6478). Submission sends one experimental `thread/queue/add` JSON-RPC over the same control-socket connection used for discovery and final revalidation, so message bodies never enter process arguments. The control socket and every ancestor directory must pass StrictModes-style ownership and permission checks. Receipts distinguish not_sent / queued / unknown (exit 1 / 0 / 3) and never replay an uncertain submission. Also keeps scripts/test-layout/layout.json under the 2,000-line ratchet (dev was at 2,000) and normalizes Windows glob paths in the activation-boundary test. Exact-head Cross-platform CI 37716039873 (attempt 2) passed at 7a39de1; independent security, correctness and final-head reviews approved. Co-authored-by: JUN <jun@lidgeai.com>
Qoder can now return Codex-owned tool calls as Responses function_call and custom_tool_call items through a request-scoped stdio MCP catalog. Codex keeps approval, sandboxing and execution; Qoder's built-in tools stay disabled. Maintainer hardening on top of the original bridge: Qoder-only history name projection (CodeBuddy unchanged), restricted store:false continuation for function and custom tool pairs that fails closed without valid provider-output provenance, init-handshake gating, translator-budget charging, one identity ledger for complete and partial tool calls, and independent bounds on distinct calls and open capture blocks. Closes #5270
…atchet (#6733) #6721 and #6724 each added one explicit registration and together took scripts/test-layout/layout.json to 2000 lines, over the 1999-line NEW_OVERSIZED ratchet, so file-size ratchet: repository fails on dev and on every PR's merge ref. Fold forty single-entry lines into four-per-line rows (the file's existing compact form). The parsed mapping is unchanged; the file drops to 1970 lines.
…ct (carry #6659) (#6725) Carry #6659 without its new upload cap or idle/absolute deadlines. Close refused and early-replied unfinished uploads after the reply finishes: HTTP/1.1 discards remaining input and ends the socket gracefully (immediate destroy truncated large early replies), HTTP/2 sends RST_STREAM NO_ERROR after a complete response and CANCEL otherwise. Completed uploads and bodyless requests keep existing behavior, including keep-alive on generated 502s. Compact the claude-picker layout registrations to stay under the layout ratchet. Co-authored-by: Epinephrine <luvs01@hanmail.net>
) * feat: allow arbitrary HTTPS JEV decision endpoints * fix(jev): keep exact HTTPS decision paths and refuse empty URL delimiters Review follow-up on #6384: - Reject URLs whose raw text carries an empty query, fragment, or userinfo delimiter; WHATWG URL drops those, so the parsed-field check missed them. - Send an arbitrary HTTPS decision path exactly as configured (a trailing slash is significant); /systemone keeps its trailing-slash normalization. Discovery reports the same URL. - Drop the runtime refusal of non-key authMode values. The decision request only ever carries the row's own apiKey, so the refusal protected nothing and made rows that the dashboard and save validation accept unusable at runtime. Cover oauth/local/forward rows sending only their own key. * fix(jev): refuse control characters before the decision URL userinfo check URL strips tab, CR and LF before parsing, so https:<TAB>//@host evaded the raw empty-userinfo check. Refuse any C0 control or DEL in the configured URL, and cover the validation and runtime send boundaries. * chore(jev): drop the lint suppression on the control-character check src/ is not linted for no-control-regex; src/protocols/dto.ts uses the same expression unsuppressed. --------- Co-authored-by: Vadim Rogachyov <vadim.rogachyov@megafon.ru>
…(carry #6672) (#6729) Stored API-key reveal now requires a dashboard session issued through pairing or a trusted Tailscale identity. Automatic loopback sessions and admin-token-only requests are refused, and the requirement is rechecked after the request body is read. The dashboard expires displayed values when the shared session is cleared or replaced, on browser or desktop-host hide, and on server switch. Successful create and rotate operations reconcile the key list through the sequenced resource refresh. The guides in all locales document the rules. Carries and supersedes #6672. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com>
) * fix(runtime): pin Bun 1.4.2 so Windows streams survive Bun.fetch * fix(ci): split Bun 1.4.2 runtime from 1.4.0 test runner * fix(test): resolve pinned Bun runner outside package script PATH * fix(test): cover remaining local Bun runner entrypoints * fix(test): forward pinned runner termination signals * fix(test): resync README manifest and keep layout.json under the ratchet
…back to the task model (#6727) * fix(catalog): keep Codex's auto-review model so reviews stop falling back to the task model The canonical native catalog dropped codex-auto-review as an unsupported bare Codex slug. Because model_catalog_json replaces Codex's entire catalog, the approval reviewer could no longer find its preferred model and fell back to the parent task model at Low effort. Share the exact control-plane id set with routing and preserve or separately backfill one hidden reviewer row whenever native OpenAI rows are included. Keep its upstream reasoning metadata and exclude it from native synthesis, account clones, picker ordering, public lists and override stamping. Preserve provider/per-model/root reviewer precedence and non-OpenAI fallback behavior. Cover all catalog writers, persisted duplicates, visibility, Low effort, HTTP model lists, shared routing and override selection. Register the new regression file in both layout inventories and document the contract. * fix(catalog): skip the reviewer row when the pin lacks it * fix(catalog): gate and version the hidden auto-review row Project the internal reviewer before multi-agent mode normalization so explicit v2 and native v1 exceptions apply in both catalog builders. Keep it outside account clones, featured/picker ordering and effort synthesis. Require an ordinary bare native OpenAI row in the final catalog before preserving or backfilling a reviewer. Hidden natives count; Reserve, account-only and native-less catalogs do not. Prune persisted orphan reviewers after effort clamps and preserve the missing-pin skip fallback. Add regression coverage for mode projection, suppressed/Reserve-only native sets, account-only catalogs and orphan cleanup. Keep the three CI-failing tests and their expectations unchanged. * test(layout): compact two registrations to restore layout.json headroom
…carry #3833) (#6728) Carries #3833 by @rrmlima onto current dev. Adds an opt-in Command Code client: `ocx commandcode` (alias `ocx cmd`), a Connect-page tab and `ocx export --client commandcode` write `provider.opencodex` into `~/.commandcode/providers.json` with `apiKey: false`, under whichever root the file already uses, with the existing snapshot, lock, drift, journal and restore guarantees. On top of #3833: on Windows the store follows the client's `HOME ?? USERPROFILE` for the OS-default home; undoing a plural-root disable reports `current`; dashboard sync and Models-page saves refresh an owned block like `ocx sync`; Connect guide, CLI reference and Fast-row docs list Command Code in every locale; GUI keep-English allowlists and the reused provider mark are registered; test-layout registrations are compacted under the ratchet. Supersedes #3833. Co-authored-by: Rafael Moreira Lima <rrmlima@gmail.com>
…#6744) * feat(anthropic): add Haiku 5.5 request contract * feat(pricing): add Haiku 5.5 prompt bands and refresh Sonnet cache rates * feat(catalog): seed Haiku 5.5 across Claude and harness providers * chore(cursor): keep the Sonnet 5.5 note beside its own capability row * docs(devlog): record the Haiku 5.5 plan, audit and live evidence
…tartup roots (#6748) * test(claude): drain config-dir ACL hardening before removing picker-startup roots * test(claude): attempt every picker-startup stop and root before rethrowing
…unt (#6753) * docs: record 2.81.0 train recovery and publication gates * docs-site: improve mobile homepage and keep GitHub stars visible
* fix(commandcode): bind restore requests to the selected client * fix(commandcode): refuse unscoped restore on legacy proxies * fix(cli): expose client-bound Command Code restore capability * test(cli): assign Command Code capability to integration chapter
…6756) * docs(commandcode): align home resolution and provider copy; clean test fixtures * docs(commandcode): clarify validated Windows home in all affected notes
…6927) * feat(gui): expose Ultra Fast retention in model settings * feat(codex): expose declared Ultra Fast in desktop speed menu * test: keep Ultra Fast layout registration within file budget * test(codex): account for derived Ultra Fast capability --------- Co-authored-by: jun <jun@juns-Mac-Studio.local>
#6990) (#7070) * fix(history): rebuild large request-history indexes on a worker thread (#6990) Split from #6999. A full rebuild of a ledger of at least 1 MiB runs on a Bun Worker that writes a private build file; the serving thread swaps it in once complete. Async readers wait without blocking the event loop; the routing-time sync entry throws RequestHistoryIndexBusyError, which health scoring already reads as unknown evidence. Ingest moves to ingest.ts so the worker and the inline path share it. * test(layout): place the rebuild-worker test by seed instead of explicit entries * fix(history): serve a successful rebuild at the async wait limit; map history in structure Addresses Codex review on #7070: the build that reaches the async wait limit is now refreshed and served instead of reported busy, and structure/manifest.json maps src/routing/history/ to dashboard-and-usage.md. * fix(history): rebuild inline for async readers after a worker failure Addresses CodeRabbit review on #7070: during the worker-failure cooldown, async readers and manual rebuilds fall back to the inline rebuild instead of reporting busy; routing-time reads still never rebuild inline. --------- Co-authored-by: jun <jun@juns-Mac-Studio.local>
…o pool recovery (#7046) (#7076) * fix(codex): answer the main hard lock as a usage limit and clamp retry to pool recovery (#7046) * fix(codex): recovery hint honors gated rosters and every routing hold (#7046 review) * fix(codex): reuse the request-fenced model denials for the recovery hint (#7046) --------- Co-authored-by: jun <jun@juns-Mac-Studio.local>
Rebased onto dev as a single commit for #5955. Resolved the src/server/chat-completions.ts import conflict by keeping both the advisor capability import and the UNDECLARED_TOOL_CALL_ERROR_CODE import from dev. Co-authored-by: leaf <leaf@users.noreply.github.com>
Rebased onto dev as a single commit for #6079. Regenerated structure/INDEX.md with bun run structure:index. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> Co-authored-by: lcxhh521 <59329914+lcxhh521@users.noreply.github.com> Co-authored-by: JUN <jun@lidgeai.com>
…ettings (#6934) * feat(claude): configure CLI tier defaults and explicitly apply user settings Rebased onto dev as a single commit for #6934. Resolved structure/runtime.md by keeping both paragraphs and dropped one blank line in structure/clients/claude-desktop.md to stay within its 600-line doc budget. Co-authored-by: JUN <jun@lidgeai.com> * fix(claude): mark tier-default preview routes as interactive-preview exemptions Dev's capability/route parity gate requires every management route to be covered by a CLI capability or explicitly exempt. The preview/apply pair is a GUI-only fingerprint workflow, which is exactly the interactive-preview exemption. --------- Co-authored-by: GSL-R <174104911+GSL-R@users.noreply.github.com> Co-authored-by: JUN <jun@lidgeai.com> Co-authored-by: jun <jun@juns-Mac-Studio.local>
* feat(clients): add Qoder client integration and config export Rebased onto dev as a single commit for #5950. Kept every client that dev added (Command Code, Kilo, Factory Droid) and placed Qoder beside them in each list, raising the client counts to nineteen. Dev's new CLI integration-plan decoder now lists qoder and accepts its modelConfigs.customModels.* managed path, matching the GUI decoder. * docs(structure): move Qoder ownership notes to clients/qoder.md clients/integrations.md was already at its 600-line budget on dev, so the Qoder section now lives in its own registered doc and is linked from the existing introduction. * fix(gui): complete Qoder strings for the Portuguese locale Dev added a pt catalog after this branch was cut, so it lacked the three Qoder keys. Qoder joins the product-name allowlists for zh-TW and French alongside Kilo and Factory Droid. * fix(clients): honor QODER_CONFIG_DIR and keep Qoder in standard sync paths Addresses the remaining review findings on #5950: - qoderHomeDir resolves QODER_CONFIG_DIR (absolute or ~-relative; relative values are refused) and both the config path and integration detection use it. - Owned-catalog refresh in ocx sync, /api/sync and catalog refresh now includes qoder. - ocx export --client qoder asks the live /api/client-config route, like Raycast and Factory Droid, so the serving process's bind and unauthenticated loopback listener decide the exported URL. The split-port case is covered by the shared listener-policy test. * fix(gui): clarify the Qoder loopback requirement in French --------- Co-authored-by: jun <jun@juns-Mac-Studio.local>
…ses hop) (#7080) * feat(protocols): decode Chat straight into the IR on Antigravity routes Behind protocols.rollout.antigravityDirect (default off), a Chat request whose settled route is one concrete Google Antigravity provider no longer goes through the internal Responses body. The ingress validates and decodes the conversation with chatConversationToIr and hands the Responses core only the request settings (chatSettingsToResponsesBody, built by the same applyChatSettings as the bridge body). The decoded conversation replaces the settings-only parse at the parse seam; the answer uses the direct Chat encoder. The trace reads chat -> ir -> other both ways. The lane is held to the bridge it replaces: the parsed request equals parseRequest(chatCompletionsToResponsesBody(body)) apart from _rawBody and timestamps, refusals match, and the Google wire body is identical. A route that leaves Antigravity after the ingress decided gets the bridge conversation restored before any other reader sees the raw body. Refs #7079 * docs(protocols): describe the Antigravity direct lane Refs #7079 * fix(protocols): keep the Antigravity direct lane equal to the bridge under rewrites Address independent review of the first head: - decline when the core would rewrite conversation text on the bridge body (a skills catalog, a generated-image link) or the cache diagnostic recorder is observing; - restore the bridge conversation right after every route assignment, before sanitization, ciphertext stripping and injected guidance can touch the raw body; - judge ambiguous-resend replay on the body the bridge would have sent; - predict the lane only for standalone routes, not combo children; - skip an own __proto__ parameter key as the schema parse does; - rename the eligibility test so its seed domain matches its registration. Refs #7079 * fix(protocols): decline the direct lane only while cache diagnostics record The cache diagnostic hook is registered whenever its module loads; recording is gated by OPENCODEX_CACHE_DEBUG. Checking registration alone declined every request and made the lane unreachable. The hook now reports its enabled state. Refs #7079
PackyCode is no longer a sponsor. Drop the README sponsor rows, sponsor logo and marketing screenshots, the registry sponsor field, the affiliate dashboard link, the provider overview sponsor card and its localized copy. The packycode provider preset itself stays as an ordinary key preset. Co-authored-by: jun <jun@juns-Mac-Studio.local>
… an unsupervised fallback (#7043) (#7078) * fix(update): dashboard update restarts through launchd/systemd before an unsupervised fallback (#7043) Ports the #7074 manager-first recovery to the dashboard update worker in src/update/job.ts. * fix(update): report every managed fallback exit as unsupervised after a failed manager restart * fix(update): release the update lease before every dashboard manager restart * fix(update): keep service manager stderr out of the dashboard job log --------- Co-authored-by: jun <jun@juns-Mac-Studio.local>
…on, 4.6/5.5 by account roster) (#7071) * feat(google): add Gemini 4 Argon (gemini-4-argon) * feat(antigravity): serve Gemini 4 Argon with the CLI User-Agent Adds gemini-4-argon to the google-antigravity picker with low/medium/high mapped to the verified gemini-4-argon-{low,medium,high} wire ids. CCA serves those ids only to the Antigravity CLI User-Agent, so Argon inference and model discovery use antigravity/cli/1.3.4 while every other model keeps the IDE User-Agent. * feat(antigravity): trim the static lineup to 3.8 Flash, 4 Argon, Opus 5.5 and Sonnet 5.5 The static google-antigravity picker now lists gemini-3.8-flash, gemini-4-argon, claude-opus-5-5 and claude-sonnet-5-5. Claude 5.5 gets the same low/medium/high suffix-tier mapping as Argon and 3.8 Flash. Dropped bases (3.7 Flash, 3.1 Pro, 3.1 Flash Image, Claude 4.6, gpt-oss) stay known to routing, discovery collapse and usage identity, so saved selections route unchanged and discovered rows still appear. * fix(antigravity): keep migrations and discovery tests consistent with the trimmed lineup Retired 3.5/3.6 Flash selections now migrate to the live gemini-3.8-flash base (registrySeedsTarget refused 3.7 once it left the lineup). Discovery-only family tests use a hypothetical claude-opus-6-1 because Claude 5.5 now has a static ladder. The static catalog count is 4. * feat(antigravity): filter and route models by each account roster Antigravity gates models per account (Claude 4.6 on some accounts, Claude 5.5 suffix families on others, Gemini 4 Argon on Ultra/Enterprise). Discovery now records each account roster; account selection prefers an account whose roster lists the requested model, skips a known non-listing account, and treats a missing roster as unknown. The catalog keeps exposing only the active account discovery, and the static-lineup drop is no longer warned as drift.
…7081) * feat(protocols): decode Messages straight into the IR on Antigravity routes The Messages ingress plans the Antigravity direct lane before translating: the settings-only body carries the resolved model, prompt-cache key and reasoning settings, the route is previewed on that model, and the conversation is decoded into the IR (messages-ir.ts) only for an eligible route. Routing then settles on the same body; if it moves, the full bridge translation replaces it. Refs #7079. * feat(protocols): turn the Antigravity direct lane on by default protocols.rollout.antigravityDirect now defaults on for the Chat and Messages ingresses. An explicit false turns it off; a non-boolean value or a malformed protocols block fails closed. Requests the eligibility rule declines keep the bridge as before. * docs(protocols): describe the Messages direct lane and its default * fix(protocols): hand an abandoned Messages direct plan's budget back A plan the ingress abandons (an undecodable envelope the bridge retries, or a settled route that moved) released none of the reasoning copies its decode retained, so the bridge translation that followed could answer 413 where the bridge alone fits. The decode now records its retained charges and the plan releases them when it is left. * fix(protocols): release the settings-only body's charge when leaving the plan leaveDirectPlan charged the full translation without handing back the retained charge for the settings-only body it replaced, so a route that settled off the plan (a per-model wire override, say) could answer 413 where the bridge alone fits. It also dropped the stale replay map.
…(Windows file ids exceed 2^53) (#7087) Co-authored-by: jun <jun@juns-Mac-Studio.local>
…own (Windows EBUSY) (#7088) Co-authored-by: jun <jun@juns-Mac-Studio.local>
…pool block (Windows EBUSY) (#7091) Co-authored-by: jun <jun@juns-Mac-Studio.local>
[WRONG BRANCH] release: 2.85.0
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
github-actions
Bot
added
the
intake: hygiene-blocked
Contributor
|
Contributor
WalkthroughWarning Review details and warnings were omitted to fit the comment limit. |
github-actions
Bot
changed the title
Contributor
⏳ DRAFT
What to do
Its title has been prefixed with |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Sync
previewtomainat732fba65b4(stable 2.85.0, #7094). The head merges inpreviewancestry with theoursstrategy, so its tree equalsmain's exactly. No preview release is cut: tagging a2.86.0-preview.*would end the 2.85 patch line (MAINTAINERS.md), and the preview line has been dormant since 2.78.0-preview.20261005.Verification
mainat732fba65b4(candidate devba865da725, Cross-platform CI run 38510591342 green, regression PASS; see [WRONG BRANCH] release: 2.85.0 #7094).--admin). Anenforce-targetwrong_base failure is expected for a non-dev base.Checklist