Fix 26.803 startup and sync upstream main - #8
Merged
robustonian merged 145 commits intoAug 8, 2026
Conversation
Add opt-in Codex Micro Linux support
Signed-off-by: Daniel Castrillon <112592276+danielcadev@users.noreply.github.com>
…ar-dependency chore(nix): update tar to 7.5.22
…rve-acceptance-source Preserve acceptance source provenance on early failures
…-cli-detection fix(computer-use): support Arch ydotool raw CLI
…#1147) * test(launcher): add window reopen behavior harness * test(launcher): close resident reopen review gaps * test(launcher): prove resident mutation sensitivity --------- Co-authored-by: Yo-DDV <116607353+Yo-DDV@users.noreply.github.com> Co-authored-by: Gary Lysenko <igor@herox.com>
…less-warm-start fix(lifecycle): prevent windowless warm-start survivors
* fix(ssh-command-wrapper): reject partial bundle patches * fix(ssh-command-wrapper): preserve editor round trips * ci(ssh-command-wrapper): gate current DMG patches * test(nix): cover SSH wrapper feature profile * fix(ci): read transactional SSH patch report * fix(ssh-command-wrapper): validate complete helper bodies
…ettings-contract Stabilize Dock settings matching across minified aliases
…re-patch-drift HEROX-1165: Fix current DMG optional feature patch drift
Add the current settings-page Personal group patch with idempotence, drift, and smoke coverage.\n\nFixes ilysenko#1168
…op-navigation Fix Linux desktop settings navigation grouping
* Recover stale npm CLI upgrades * Serialize managed npm CLI installs * Bump updater for npm recovery * Serialize PATH-dependent builder test * Make stale CLI repair explicit * Harden explicit stale CLI repair * Deduplicate CLI repair completion * Bound orphaned npm process groups * Prevent npm descendants from retaining the install lock * Harden npm supervisor failure cleanup * Fail closed on npm process discovery * Make npm group cleanup hidepid safe * Fix npm overlap group probe --------- Co-authored-by: Gary Lysenko <igor@herox.com>
…n-env-cache Fix Chrome plugin env compatibility and stale cache refresh
…-linux-cve-2026-13697-undici fix: scope undici override to 7.29.0 for @electron/get (CVE-2026-13697)
Retarget project Last updated sorting to Codex 26.730
…tchdog-26-730 Retarget Dock icon to the current main bundle
- Move automatic-build preferences into a disabled-by-default feature policy. - Revalidate or redownload pending DMGs before explicit builds and recover legacy state safely. - Bump updater 0.11.0 with bridge, patch, test, and documentation coverage.
…d-user-subreaper fix(shared-app-server-socket): support systemd user adoption
- Keep deferred candidates stable during fresh and unchanged-HEAD checks. - Restore pending state when offline refreshes fail. - Cover fresh, stale, and offline candidate behavior.
- Let fresh --if-stale checks continue resumed automatic builds. - Preserve deferred candidates across periodic offline checks. - Cover resumed-build and repeated offline refresh behavior.
…ggle updater: add automatic build toggle
* Fix upstream DMG drift watchdog-v2-action: commit-source * Fix upstream DMG drift watchdog-v2-action: commit-source * Fix upstream DMG drift watchdog-v2-action: commit-source
* Fix optional upstream DMG drift optional-drift-watchdog-action: source-commit * Fix optional upstream DMG drift optional-drift-watchdog-action: source-commit
* Fix Linux tray startup and watchdog metadata * Harden watchdog reconciliation metadata * Trust only maintainer-owned watchdog issues * Normalize watchdog issues after create races
…senko#1248) - Update minified sorter and call-site needles for the current webview bundle. - Refresh the fixture and asset filename for 26.803 drift coverage.
…ysenko#1246) * fix: GHSA-82j2-j2ch-gfr8 security vulnerability Automated dependency upgrade by OrbisAI Security * fix: bump codex-update-manager to 0.11.1, correct PR metadata Per CONTRIBUTING.md versioning rules, security/maintenance updates to the updater crate require a patch bump. Bumps 0.11.0 → 0.11.1. Also corrects the rustls-webpki advisory description: this PR tracks the 0.103.x patch line (0.103.10 → 0.103.13), not 0.104.0-alpha.7. The 0.103.11–0.103.13 releases include certificate-validation fixes beyond malformed CRL handling. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> --------- Co-authored-by: OrbisAI Security <mediratta01.pally@gmail.com> Co-authored-by: Claude Sonnet 4.6 <noreply@anthropic.com>
* fix(chrome): support concurrent browser clients * test(chrome): satisfy clippy for aborted rollout fixture * fix(chrome): isolate concurrent client I/O * fix(chrome): harden multi-client fanout
Add PipeWire ALSA plugin support to the Nix Electron runtime, preserve explicit ALSA plugin configuration, and exercise the wrapper contract in CI.
The Unix socket listing that in-app-browser discovery walks changed shape
in ChatGPT.dmg 26.803.41515. It used to be a zero-argument helper closing
over the socket directory:
CV=async()=>(await yP(Cb)).map(e=>wP.resolve(Cb,e))
and now resolves the directory from an options argument:
e4=async e=>{let t=ys(e.platform);return(await BE(t)).map(n=>NE.resolve(t,n))}
The pattern matched zero targets, so the `extension-` prefix filter was
never inserted and discovery could pick up extension-host sockets. It is
fail-soft, so nothing in the build reports it — the protection is simply
gone.
Matches the current shape with named groups. The Windows listing has a
similar shape but declares its own pipe prefix and already filters, so it
still cannot match and the exactly-one-target guard is preserved.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
The Computer Use settings component in ChatGPT.dmg 26.803.41515 is
compiled with the React Compiler. Its plugin card is no longer derived
from a plain declaration chain ending in a bare `computerUsePlugin;`
declarator, but inside memo-cache branches:
let x=ee(u,b),S=Ut(u),…,F,I;
…
t[9]!==S||t[10]!==x.availablePlugins?(re=Y(x.availablePlugins,lr,S),…)
The card half of the settings contract matched nothing, and because the
contract requires both halves, the availability half was discarded too —
so `linux-computer-use-ui-availability` skipped entirely and Computer Use
reported itself unavailable on Linux even with the backend built.
The card target is now resolved from the derivation itself: find the
`selector(plugins.availablePlugins, name, path)` call whose name
identifier holds the `computer-use` slug, then inject the synthetic
bundled-marketplace card at the end of the declaration that produces the
plugins query. `findStatementEnd` locates that boundary while ignoring
separators nested in calls, literals, and template substitutions.
Anchoring on the plugin slug also makes the match stricter than before:
the old pattern keyed on shape alone and would have accepted the sibling
derivation for a different plugin.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
…ches fix: re-target two Linux patches missed by the 26.803 drift fixes
…-startup # Conflicts: # CHANGELOG.md # launcher/start.sh.template # scripts/patch-linux-window-ui.test.js
Reject patch-created main bundle syntax errors before writing app.asar, require a compatible Rust toolchain for install-latest, and remove the obsolete multi-callsite titlebar drift test after integrating upstream 26.803 support.
robustonian
marked this pull request as ready for review
August 8, 2026 06:58
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
20 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What changed
upstream/maininto the fork's installer branch.app.asar; patch-created JavaScript syntax errors now reject the candidate without replacing the original bundle.scripts/install-latest.shbefore package/update-manager builds.Why
The 26.803 upstream DMG changed the Linux tray constructor to include a nested ternary. The previous wrapper matched only part of that constructor and generated malformed JavaScript, causing startup to fail with
Unexpected token ')'. Upstream now uses structural constructor parsing for this shape, and the added final syntax gate prevents the same class of damaged bundle from being promoted in the future.Impact
scripts/install-latest.shcan rebuild Codex App 26.803.41515 successfully, and a candidate containing patch-created invalid JavaScript is rejected before it can replace a working app.Validation
node --test scripts/patch-linux-window-ui.test.js— 419 passedbash tests/scripts_smoke.sh— passedcargo check -p codex-update-manager— passedaccepted, required core patches 17/17, no blockers or warningsnode --test linux-features/shared-app-server-socket/test.js— 39 passed, 1 integration test skipped