Skip to content

Integrate and verify all framework audit fixes - #648

Open
parsakhaz wants to merge 13 commits into
mainfrom
codex/audit-integration
Open

parsakhaz wants to merge 13 commits into
mainfrom
codex/audit-integration

Conversation

@parsakhaz

@parsakhaz parsakhaz commented Sep 14, 2026

Copy link
Copy Markdown
Member

The audit fixes were developed in parallel, and their shared CI configuration and terminal test infrastructure need to work together. This PR combines all eight source PRs into one reviewable tree against main 99791ac (v2.4.106):

Integration preserves every source change and regression test. It combines the maintained browser test lists, keeps the shared remote-font removal, and retains both the contrast and packaged-editor CI gates. The new terminal lifecycle methods use the injected panel manager introduced by #637, and their tests use that same explicit fake. The Windows launch assertion from #647 is retained. Upstream #643 remains intact: archived display names can be reused without sharing worktrees, concurrent creation reserves names through persistence, and failures reach both desktop and remote views.

The existing dependency pins, frozen lockfile, pnpm 10.19 build allowlist, and bundled editor/analytics boundaries remain in effect. The reviewed cross-platform attribution inventory is preserved with the audited lockfile changes. No additional dependency is introduced by integration.

Local validation on the final tree (1dc1b86), including current main:

  • Full lint and workspace typecheck pass.
  • Frontend and main-process production builds pass, including bundled-preload, xterm, and React Scan checks.
  • All 87 tests in seven affected backend suites pass, including the 10 pane-creation regressions and full-snapshot persistence.
  • All 50 tests in the combined maintained browser suite pass, including accessibility, consent, appearance, dropdowns, offline Monaco, session navigation, remote terminal lifecycle, and both new creation-failure notifications.

Broader validation on the combined audit changes before the current-main refresh also passed all 252 frontend unit tests and browser-computed contrast for every maintained gated theme. The full main-process run had 1,001 passing tests, including all affected lifecycle, persistence, queue, and MCP cases; fifteen existing Unix-socket tests hit a local EPERM restriction, independently reproduced with a plain Node listener, and one existing DNS fallback test timed out locally. The full platform matrix remains enabled in CI.

CI passed on exact head 2b6dea4531100419088353b5568af21649f85297: all 10 jobs in Code Quality and React Doctor succeeded. This includes lint, typecheck, full main/frontend unit suites, production frontend and worker build, browser-computed contrast, sandboxed Electron preload, the packaged offline Electron editor, all maintained browser journeys, Windows/macOS main-process tests, and all six wrapper platform/runtime combinations. All 13 reported check runs are green. The source PRs remain available for focused review.

@chatgpt-codex-connector

chatgpt-codex-connector Bot commented Sep 14, 2026

Copy link
Copy Markdown

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review Status Commit Review trigger
📝 Code Review Completed 2026-09-14T15:57:39.233470Z 2b6dea4 PR opened
ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

@socket-security

Copy link
Copy Markdown

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff Package Supply Chain
Security
Vulnerability Quality Maintenance License
Addednpm/​@​radix-ui/​react-dropdown-menu@​2.1.15991007195100

View full report

@github-actions

Copy link
Copy Markdown

React Doctor found 3 new issues in 2 files · 3 warnings · score 81 / 100 (Needs work) · 13 fixed · vs main

3 warnings

src/components/panels/editor/monacoRuntime.ts

  • ⚠️ L1 Heavy library loaded eagerly prefer-dynamic-import
  • ⚠️ L2 Heavy library loaded eagerly prefer-dynamic-import

src/hooks/useSessionView.ts

  • ⚠️ L367 .map().filter(Boolean) loops twice js-flatmap-filter

Reviewed by React Doctor for commit 2b6dea4. See inline comments for fixes.

@@ -0,0 +1,29 @@
import Editor, { loader } from '@monaco-editor/react';

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

React Doctor · react-doctor/prefer-dynamic-import (warning)

"@monaco-editor/react" ships extra code to your users up front & slows page load. Load it on demand with React.lazy() or next/dynamic.

Fix → Load it only when needed: const Component = dynamic(() => import('library'), { ssr: false }) from next/dynamic, or React.lazy().

Docs

@@ -0,0 +1,29 @@
import Editor, { loader } from '@monaco-editor/react';
import * as monaco from 'monaco-editor';

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

React Doctor · react-doctor/prefer-dynamic-import (warning)

"monaco-editor" ships extra code to your users up front & slows page load. Load it on demand with React.lazy() or next/dynamic.

Fix → Load it only when needed: const Component = dynamic(() => import('library'), { ssr: false }) from next/dynamic, or React.lazy().

Docs

const promptsResponse = await API.sessions.getPrompts(activeSession.id);
if (promptsResponse.success && promptsResponse.data?.length > 0) {
return promptsResponse.data.map((p: PromptMarker) => p.prompt_text).filter(Boolean).join('\n\n');
return promptsResponse.data.map((p: { prompt_text: string }) => p.prompt_text).filter(Boolean).join('\n\n');

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

React Doctor · react-doctor/js-flatmap-filter (warning)

This loops over your list twice because .map().filter(Boolean) makes two passes, so use .flatMap() to change & drop items in one pass

Fix → Use .flatMap(item => condition ? [value] : []) to change and drop items in one pass, instead of building a throwaway array in between

Docs

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 2b6dea4531

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment on lines +916 to +917
launchState.agentSessionId = agentSessionId;
launchState.hasClaudeSessionId = true;

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Defer marking fresh Claude IDs as resumable

When a fresh command exits before Claude creates its session—for example because the executable is missing or the arguments are rejected—these fields can still be persisted by initializeTerminal; the retained panel then has a generated agentSessionId and hasClaudeSessionId: true. The next sessions:continue therefore treats that nonexistent ID as resumeId in runSessionClaude and launches with --resume instead of retrying fresh, repeatedly preventing recovery. Mark the ID resumable only after successful startup, or clear this state on launch failure.

Useful? React with 👍 / 👎.

Comment on lines +272 to +273
const executable = config?.claudeExecutablePath
?? (project?.wsl_enabled ? 'claude' : await this.getCliExecutablePath());

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P1 Badge Resolve Claude inside WSL before applying the host override

For a WSL-enabled project on Windows, setting the application-wide Custom Claude executable through the file picker normally stores a Windows host path, but this expression selects that path before checking wsl_enabled. TerminalPanelManager then passes it to WSL's bash -lc, where the unconverted C:\... path is not executable, so every session-level Claude launch for that project fails. Give the WSL branch precedence so it resolves claude inside the distro, as the adjacent comment requires.

Useful? React with 👍 / 👎.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment