Conversation
|
Important Review skippedReview was skipped as selected files did not have any reviewable changes. ⚙️ Run configurationConfiguration used: Repository: lidge-jun/opencodex/.coderabbit.yaml Review profile: ASSERTIVE Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Repository: lidge-jun/opencodex/.coderabbit.yaml Review profile: ASSERTIVE Plan: Advanced Run ID: 📒 Files selected for processing (2)
Included review availability: Your plan provides up to 10 included reviews per hour; 9 remain after this review. 📝 WalkthroughWalkthroughThe management OAuth route now requires a ChangesMeta Muse OAuth authorization
Priority: ⬇️ Low Estimated code review effort: 2 (Simple) | ~10 minutes Change: Bug fix 🚥 Pre-merge checks | ✅ 4 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (4 passed)
✨ Finishing Touches 💡 1🛠️ Fix failing CI checks 💡
🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
github-actions
Bot
added
the
intake: hygiene-blocked
|
✅ READY
Hygiene✅ Deterministic PR hygiene checks passed. |
|
You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard. |
리뷰 · 우선순위 67 / 80이 PR은 Meta Muse 로그인을 막을 때, “관리 토큰만 있으면 된다”는 길을 닫습니다. Muse 로그인은 macOS 키체인에 있는 비밀을 읽어 OpenCodex에 넣습니다. 예전에는 지금은 서버가 이미 정해 둔 베이스는 라인 - src/server/management/oauth-account-routes.ts:180 - 서버가 보는 것은 라인 - tests/oauth/oauth-public-surface.test.ts:84 - “문을 통과했다”는 신호를 없는 계정 404로 잡습니다. 나중에 reauth/accountId 검사가 바뀌면 이 신호가 흔들릴 수 있습니다. 지금 구조에서는 키체인 읽기 전에 멈추므로 안전합니다. 메인테이너의 판단이 필요한 지점
너의 추천 방향은 맞습니다. 관리 토큰으로 키체인 가져오기를 시작하던 구멍을 서버에서 닫고, 헤더가 아니라 이 댓글은 grok-bot이 작성했습니다 |
|
This PR is held at the gate on unsponsored_surface: it touches src/server/management/oauth-account-routes.ts (authentication surface). The change only narrows Meta Muse import consent to the server-resolved gui-session principal; other OAuth providers are unchanged. Requesting maintainer review and the maintainer-sponsored label. |
github-actions
Bot
removed
the
intake: hygiene-blocked
|
Consolidated into #5591 as a single related-function aggregate. Source head: This is a complete Meta-login feature consolidation, not removal through an unrelated types.ts/config.ts split. The complete merge-head contribution has stable patch ID ef98ff4a8e236591db2b2fd7aaada4815909a6b1, equal to source f781737 carried as 2251d3f. The replacement retains the server-resolved gui-session admission gate and forged-header refusal for local import/device/add-account/reauth, with other provider and direct CLI policies unchanged. Its 76-case pinned Bun verification includes the admission matrix and actual bounded device-reader integration. The review concern about preserving this distinct login fix is therefore retained in the focused replacement. Maintainer sponsorship/security review and readiness remain pending there; no per-checkbox consent proof is claimed. Closing this duplicate standalone review entry as part of the requested consolidation after verifying coverage. This is not a merge or release claim; remaining integration checks and reviews are tracked on the replacement. Original branches are retained. |
… fixes (#5619) * fix(cursor): bound capability reads and buffered tool budgets (#5533) Carries #5533 (and the closed #5233 it consolidates) onto current dev. Co-authored-by: Epinephrine <luvs01@hanmail.net> * fix(moonshot): bound normalized tool-schema expansion (#5547) Carries #5547, which consolidates #5464 and the request-wide inline budget, onto current dev. Co-authored-by: yeongjunyoo <47925973+yeongjunyoo@users.noreply.github.com> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: Epinephrine <luvs01@hanmail.net> * fix(moonshot): restore rejected inline budgets and charge nested growth once A rejected sibling-reference expansion now restores the byte, node and expansion allowances it consumed, and outer growth no longer re-charges nested copies, so later independent expansions in the same request keep their allowance. Documents the provider-driven object type inference as a deliberate tradeoff and rewrites ADR-0355 in English. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * feat(reasoning): consolidate replay, opt-in tag parsing, and summary policy (#5566) Carries #5566, which consolidates #5449, #5205 and #5491, onto current dev. The provider guide keeps the current bridge replay paragraph and adds the inline-tag and summary paragraphs. Co-authored-by: Joonsuh Park <trckstr4422@gmail.com> Co-authored-by: Daniel Sjöstrand <16033062+Danielsjostrand1979@users.noreply.github.com> Co-authored-by: alexph-dev <alexph-dev@users.noreply.github.com> Co-authored-by: Yum-wu <1172989563@qq.com> * fix: bound Fernet slot runs, Kiro error-body read, and skill-path line slice (#5310) Carries #5310 onto current dev. The follow-up commit makes the Fernet run cap fail closed and moves the Kiro regression out of the capped stream suite. * docs(reasoning): reconcile inline-tag whitespace contract Interleaved inline-tag parsing preserves answer whitespace; only Kiro single-block mode drops the whitespace after its leading block. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(responses): fail closed on Fernet run overflow and keep the Kiro suite under its cap A slot with more than 64 structurally valid Fernet runs is now treated as unreadable or omitted as a whole, so no unexamined tail reaches the provider as text. The bounded Kiro fallback error-body regression moves byte for byte into a registered sibling file, and the Kiro, Responses and inbound contracts document the new bounds. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(reasoning): scan inline think tags with a moving cursor The parser copied, rescanned and reserved the whole remaining response after every block, so one upstream chunk carrying many short blocks cost quadratic work. It now scans each chunk from an offset and charges the translator budget only for retained carry: undecided leading input or a trailing tag fragment. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(reasoning): keep undecided leading whitespace incremental Before the format was decided, every content delta rebuilt, trimmed and re-reserved the whole leading prefix, so a stream of one-character whitespace deltas cost quadratic work. Leading whitespace is now kept in segments whose bytes are reserved once and joined only when the format is decided or the stream flushes. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(meta-muse): consolidate login admission and bounded response handling (#5591) Carries #5591, which consolidates the closed #5234 and #5432, onto current dev. The provider contract keeps the inline-tag paragraph and adds the Meta Muse admission paragraph. Co-authored-by: Epinephrine <luvs01@hanmail.net> * fix(claude-desktop): keep applied state consistent across profile edits (#5590) Carries #5590, which consolidates the closed #5337, onto current dev. Co-authored-by: Epinephrine <luvs01@hanmail.net> Co-authored-by: luvs01 <luvs01@users.noreply.github.com> * fix(claude-desktop): commit applied markers only over the observed baseline Both Desktop writers, provider-change auto-apply and client sync, now capture the desired profile and its applied marker before the Desktop write and commit the new marker only if profile presence, content, fingerprint and timestamp are unchanged. A concurrent edit, deletion or newer marker keeps its state and the write reports a skipped marker. The provider-change path no longer saves a whole stale config snapshot. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(claude-desktop): commit profile edits against the persisted marker The Desktop profile PUT built its response from an earlier snapshot and saved that whole snapshot, so a marker committed by another writer during the awaited state build could be replaced by an older one. The edit now commits in one persisted-config mutation that keeps the latest marker for unchanged content and answers 409 when the profile itself changed meanwhile. The Meta Muse overflow test now asserts that the bounded-body limit, not a generic failure, produced the error. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(claude-desktop): report an unreadable config separately from an edit conflict A missing or invalid config now answers 500 with its reason; only a concurrent profile change or exhausted rebase answers 409. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * feat(desktop): consolidate consent-based runtime takeover and ownership contracts (#5564) Carries #5564, which consolidates #5459 and #5457, onto current dev. The review screenshot stays in the pull request description rather than the tree. Co-authored-by: jun <bitkyc08@gmail.com> Co-authored-by: sanggyulee <andy53295774@gmail.com> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(desktop): bind takeover stop to the approved runtime and fail closed Desktop takeover re-resolves ownership immediately before stopping and passes the approved PID, endpoint, config home, CLI version and compatibility token to an opt-in guarded stop. The guard is checked under the ownership mutation lease before any manager or signal stop; the approved PID and endpoint must settle and the service manager must then be proven inactive, otherwise the stop answers approval-changed or manager-still-active and the desktop neither waits for silence nor claims. Unreadable or unparseable stop output is terminal as well. A second unreadable service-state read now blocks takeover, Windows managing-CLI discovery follows PATHEXT with file-only candidates and refuses command-interpreter metacharacters, the claim refusal test uses real sandbox state, and the runtime and desktop contracts record that the claim token is a consistency check rather than consent proof. Plain ocx stop is unchanged. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(desktop): keep plain stop entry points and format the takeover changes Desktop exit keeps its plain runtime_stop::run entry while takeover uses run_approved, AttachPlan::Ask no longer carries an unread field, the Rust changes follow rustfmt, the plain CLI stop path keeps its literal outcome return, the stop source oracles follow the reader and outcome union that now include the two guarded refusals, and the runtime contract fits its 600-line budget. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(desktop): run takeover seam tests without tokio macros and harden manager and shim checks The two async takeover seam tests now run on the shell runtime already used by the crate instead of tokio test macros, which this crate does not enable. Windows command-shim probes refuse command-interpreter metacharacters in every recorded argument as well as the executable, and the guarded stop re-inspects the service manager identity immediately before the manager command, answering approval-changed without stopping if it moved. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(responses): keep effort-based reasoning visible after routing Final-route normalization recomputed hideThinkingSummary without the validated active-effort condition, so routed Chat and Kiro requests with an active effort and an omitted summary still hid raw reasoning. It now uses the same predicate as the parser; explicit "none" and requests without an active effort stay hidden. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(service): match the running CLI case-insensitively only on Windows On case-sensitive filesystems a PATH executable that differs only in case is a different file, so it must get its own version probe instead of reporting the running CLI version. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(meta-muse): require the dashboard session for manual login codes The manual-code continuation now applies the same dashboard-session admission as the login start, so a management token cannot advance a pending Meta Muse login. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(reasoning): reserve the joined leading-whitespace copy Joining retained leading whitespace allocated a second copy outside the translator budget; the join is now reserved first and released once the segments are cleared. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(service): skip CLI probes for an absent runtime and treat failed systemd units as stopped Resolve no longer spawns managing-CLI version probes when no runtime is live, since takeover is only offered for a live runtime. A systemd unit reported failed with no main PID is stopped, so a guarded stop that leaves it failed succeeds and a leftover failed unit does not block takeover. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(service): keep failed systemd units fail-closed and assess takeover only for a live runtime in tests systemd can report failed before an automatic restart, so failed with no main PID is again treated as unknown rather than stopped. The resolve contract tests that assert ownership and takeover fields now use a live runtime, matching the skip of managing-CLI probes when no runtime is live. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> --------- Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> Co-authored-by: Epinephrine <luvs01@hanmail.net> Co-authored-by: yeongjunyoo <47925973+yeongjunyoo@users.noreply.github.com> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: Joonsuh Park <trckstr4422@gmail.com> Co-authored-by: Daniel Sjöstrand <16033062+Danielsjostrand1979@users.noreply.github.com> Co-authored-by: alexph-dev <alexph-dev@users.noreply.github.com> Co-authored-by: Yum-wu <1172989563@qq.com> Co-authored-by: luvs01 <luvs01@users.noreply.github.com> Co-authored-by: sanggyulee <andy53295774@gmail.com>
2 participants
Summary
/api/oauth/loginadmitted any holder of a management credential for every public OAuth provider. Formeta-muse, starting login imports an existing credential from the user's macOS Keychain and persists it in OpenCodex — a credential move with vendor ToS implications that administrative access alone does not prove a person acknowledged.gui-sessionprincipal formeta-muselogins so the import can only start through the dashboard acknowledgement path; other providers are unchanged. Non-GUI callers receive403withcode: "oauth_consent_required".x-opencodex-gui-originand the CSRF token are forgeable by an admin-token holder and are not evidence of consent.Verification
bun test tests/oauth/oauth-public-surface.test.ts— 15 pass, including new coverage:undefined,admin-token, andgui-pair-capabilityprincipals each receive 403oauth_consent_required; agui-sessionrequest passes the gate and stops at 404 (unknown account) before any platform-specific import runs.bun x tsc --noEmit— clean.Checklist