Repository navigation
Persist Codex folder trust and show quotas for API profiles - #154
pepechka-kun wants to merge 1 commit into
Conversation
…rust API profiles reported protocol errors and isolated Codex sessions could not save folder trust. Use bounded app-server RPC, verified local gateway quota reads, and host-only versioned trust writes with protected backups.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: bc0e9e97e6
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if (!reason && step.launch !== "stopped" && this.codexRestoreTrust && record.provider === "codex" | ||
| && !record.parentSessionId && record.role !== "subagent" && !record.ownerPluginId | ||
| && !record.options && !record.environment && !record.environmentChoice) { | ||
| try { await this.codexRestoreTrust(record.cwd); } catch { |
There was a problem hiding this comment.
When restoration contains several runnable top-level local Codex cards and codex app-server is slow or hung, this await runs once per record in a serial for loop. Each check creates a fresh client and can spend up to two 15-second RPC timeouts (initialize and config/read), while TerminalSessionStore accepts up to 1,024 records, so one bad CLI can keep core IPC and startup blocked for minutes or hours. Batch or deduplicate checks for the same canonical profile/folder, or propagate the first transport failure to the remaining records.
Useful? React with 👍 / 👎.
| const configuration = await readFile(join(this.codexHome, "config.toml")) | ||
| .then((contents) => createHash("sha256").update(contents).digest("hex")).catch(() => null); |
There was a problem hiding this comment.
When config.toml is edited while a rate-limit poll is in progress—especially during the two OmniRoute CLI calls—this hash is captured only before the request. The acceptance paths recheck only auth.json, so a quota response produced for the previous native/API profile is returned and stored in providerCache after the switch, appearing fresh for the new profile until TTL expiry. Recompute and compare the configuration fingerprint before accepting either native or gateway windows.
Useful? React with 👍 / 👎.
|
Superseded by #157. The replacement contains all local follow-up fixes in a single topic commit on current main, with fresh local validation. Closing this older history in favor of that PR. |
1 participant
API-backed Codex profiles displayed a misleading protocol error, while isolated Codex sessions could not persist person-approved folder trust.
Share a bounded app-server transport for account/config reads and version-guarded trust writes. Show API-profile availability explicitly and read upstream Codex quotas only from a verified local OmniRoute account. Persist folder trust through authenticated person IPC with private backups; agent settings remain protected, and automatic restoration never grants new trust.
These paths stay together because they use the same app-server/profile boundary. Validation: typecheck; full local suite (2,226 tests: 2,201 passed, 25 platform skips), covering quota refresh/cache/failure behavior, trust concurrency, contributed launches, history/restore and real macOS isolation.
Extracted from #151 into one topical commit directly on the current upstream main. Working installations and services are unchanged.
Companion PRs: #152, #153. All target main and have been tested independently. Their combined merge was also checked locally without conflicts.
Combined validation: typecheck and 153 focused contract checks (151 passed, 2 platform skips).