Repository navigation
Fix Codex orchestration, task delivery, folder trust and quotas - #151
pepechka-kun wants to merge 22 commits into
Conversation
Problem: automated Codex tasks could reach startup menus, or remain pasted without submission because the paste-burst detector consumed Enter. Solution: frame initial/follow-up prompts as bracketed paste and submit only after this launch's composer is ready; discard cancelled, timed-out or superseded input. Preserve paste-only drafts and other providers. Regression tests cover multiline text, startup menus and restart races.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e8e6cab3f7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Problem: API-backed Codex profiles reject account/rateLimits/read, but HOME reported this expected limitation as a generic protocol error and could keep old subscription windows after switching profiles. Solution: inspect structured account/read metadata without refreshing tokens, report an explicit API-profile status in Russian and English, and clear old quota windows. Preserve signed-out and genuine protocol failure statuses. Validation: API-key and custom-provider cases, auth/protocol failures, profile switching and actual HOME row rendering are covered. The real installed Codex with the Jev API profile now returns api-profile.
pepechka-kun
changed the title
Problem: automated task delivery timed out when Codex displayed an alternate built-in empty-composer placeholder. Solution: recognize exact built-in placeholders while rejecting human drafts and startup gates. Exercise delivery through the terminal manager for every supported placeholder. Validation: 65 focused launch/control tests, typecheck and secret audit passed.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 2891dd0587
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Problem: built-in side-thread placeholders were missed; active MCP startup could accept tasks while final startup warnings blocked input. Solution: cover the full native placeholder lists and gate only active Starting/Booting MCP states. Add delivery regressions for each transition.
Problem: a long-lived app-server kept stale API/ChatGPT provider metadata when config.toml changed without an account switch. Solution: restart on configuration fingerprint changes and discard old quota windows, while reusing the child for unchanged configuration. Test both profile transitions with an unchanged login. Validation: 87 focused input, lifecycle and account-scope tests passed; typecheck passed.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 0140f4a786
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Problem: transcript suggestions could hide a person's current draft, while wrapped or clipped placeholders stalled narrow terminals. Solution: inspect the last composer, reconstruct soft-wrapped rows and accept clipped prefixes only with Codex placeholder styling. Cover both delivery paths with real xterm states.
Problem: API-backed Codex profiles cannot report the ChatGPT subscription quota used behind OmniRoute. Solution: explicitly bind a local gateway connection and read its real usage through the installed CLI. Validate provider/active state, preserve real windows, exclude review quotas from the model gauge and never copy OAuth credentials or substitute another local account. Validation: live connection quota read and HOME rendering passed; 100 focused integration tests and typecheck passed.
pepechka-kun
changed the title
Problem: macOS GUI launches inherit a restricted PATH, so the OmniRoute npm CLI could not find Node even though CanvasTTY resolved Codex. Solution: pass the existing resolved CLI child environment to quota reads and cover a restricted GUI PATH. Typecheck and the quota integration suite passed.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: daea420c9f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Problem: isolated Codex could not save the folder-trust decision because its config.toml is protected from agent writes. Solution: confirm new local folders in the authenticated CanvasTTY UI and save only their trust through the host's Codex API, with a version check and private backup. Reuse the bounded RPC transport; keep agent settings and backup access blocked. Validation: full suite passed (2210 passed, 4 skipped); focused trust/protection tests, typecheck, packaged macOS smoke and secret audit passed. Real Codex on a temporary profile retained trust across launches and reached its composer under CanvasTTY isolation without a trust/persist error.
Problem: OmniRoute quota reset times used seconds where HOME expects milliseconds, and a cached composer-ready flag could submit a later human draft or menu. Solution: retain epoch milliseconds and keep readiness only for an automation-owned paste-only draft. Submitted tasks and person input require a fresh composer check. Validation: 45 focused quota, HOME and Codex delivery tests passed, including countdown semantics, later drafts/menus and person edits to automation drafts.
pepechka-kun
changed the title
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 1e4ee3fe96
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Empty user layers can arrive as JSON text, and symlinked profile paths fail lexical matching. Decode object layers and use canonical config paths for guarded trust writes and backups; reject alias changes during confirmation. Validation: serialized and malformed layers, fresh and trusted aliases, canonical backups and alias changes. Installed Codex 0.162.1 persisted trust across repeated temporary-profile launches.
API-profile polls discarded successful gateway quotas, hiding them on timeout or malformed replies. Preserve the last gateway snapshot as stale, clearing it on profile changes or revoked connections. Validation: CLI success, timeout, malformed response, recovery and source-isolation regressions. Full suite: 2232 passed, 4 skipped; typecheck, production build and secret audit passed.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3d09039635
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Require dim styling for every nonempty Codex placeholder, including material handoffs, so matching user drafts are never submitted. Treat malformed provider listings as protocol failures and retain the stale quota snapshot. Cover both contracts with regression tests.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f3f296b890
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Plugin sends now wait for the Codex composer and bracket task text. Ignore startup phrases in completed transcript while retaining live footer gates. Route person-initiated history launches through the host trust confirmation and recheck cards after confirmation. Add regressions for startup delivery, transcript quotes, trust refusal and closed cards.
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 745f82661f
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Ranked MCP search could omit explicitly named coordination tools and make an orchestrator report them unavailable. Attach the enabled canvastty_agents catalog directly with Codex's per-server deferred-exposure setting; retain browser discovery and all permission checks. Add allowlist regressions and a real-Codex synthetic smoke with deferred, direct, restricted and empty catalogs. Validation: 2242 tests passed, 4 skipped; typecheck, build, secret audit and all four Codex 0.162.1 smoke cases passed. A real source-level CanvasTTY run verified Sol 6.1 -> MCP -> Auto worker over Jev/OmniRoute, pwd, completed wait and cleanup.
pepechka-kun
changed the title
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 12525f8644
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Restored Codex cards could bypass host trust, concurrent approvals could write stale configuration versions, account changes could reuse gateway quotas, and wrapped startup menus could accept material tasks. Check trust before local restore and hold untrusted families; serialize host trust writes per canonical profile while retaining version checks; discard cross-account quota caches and in-flight gateway results; unwrap the screen before handoff readiness checks. Add regression coverage for each boundary.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: cb3a4cbccb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Any launch option skipped host trust, so isolated Codex could not persist trust even when the plugin kept the local profile. Compare the prepared configuration path before spawning, retain person-scoped trust guards for launch/restart/history, and use read-only trust checks for restoration. Hold descendants until their contributed parent's check finishes. Add coverage for profile identity, isolation ordering, refusal, cancellation and delegation boundaries.
A first launch could fail before sign-in or confirmation because the profile directory did not exist. Create the directory privately before starting app-server and recheck its canonical path; approval remains required to persist folder trust. Add first-launch approval/refusal regressions; verify both decisions and persisted trust with native Codex in temporary profiles.
New threads start another helper with the same PTY bootstrap capability, which was rejected after the first helper consumed it. Let bootstrap join only the same healthy authenticated launch, as the browser bridge does. Share its reconnect capability so later joins do not strand earlier helpers. Disconnected, stale, foreign and revoked launches stay rejected. Add JS/native helper regressions for discovery, scoped worker creation and cleanup, plus gateway identity, expiry and reconnect checks.
Stop hooks kept only 4K characters, and redaction could cut the beginning again. Capture up to 64K, mask the whole reply, and return bounded MCP pages. Refuse closing a child with unread pages and omit duplicate screen output. Keep decision/status limits unchanged and align control responses. Cover JS/native hook-to-MCP delivery, escaping, masking expansion, page ordering, ownership, turn changes, close protection and control-client size.
Short replies returned by wait could be discarded before get_agent_result, leaving later reads outside the subtree. Require an explicit current-result receipt before closing, reset it on follow-up tasks and preserve immediate cancellation of working children. Cover short replies, identical follow-up answers and JS/native MCP parity.
A redundant wait after successful result collection and cleanup returned a subtree error and could be misreported as a failed earlier wait. Keep bounded owner-scoped closure receipts without retaining answers, return closed immediately, and guide orchestration to stop waiting after cleanup. Test read-before-close receipts, active cancellation, foreign/unknown IDs, eviction and JS/native MCP behavior.
|
@codex review |
|
Codex Review: Something went wrong. Try again later by commenting “@codex review”. ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
@codex review |
|
Codex Review: Something went wrong. Try again later by commenting “@codex review”. ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
|
Superseded by independently tested, single-commit PRs from current main:
All original fixes are covered, and the combined branches were verified locally. Closing this accumulated PR to keep review focused. Historical discussion, branches and commits remain available here; working installations were not changed. |
Codex tasks could remain unsent, MCP tools disappear after thread changes, and worker replies be truncated or discarded during cleanup. Isolated folder trust and quota status also failed for API-backed profiles.
Changes:
closedreceipt for a late wait after cleanup. Bound receipt retention to 256 children and retain no answer/output text; foreign or unknown IDs remain denied.Validation:
db0949c.closed, zero wait time and no answer/output. The guard file remained unchanged.