sync: upstream v2.49.0 (2f3f736) into dev

[cursor]

Summary

Merge upstream release v2.49.0 (2f3f736299dca38861f8fb9c4326a4b4d7c664bc) into origin/dev (785424295fc5d8ef0a66fb8ce94a55fe3b054471).

Resolved the Action decision-handoff conflicts per docs/fork/OWNED.md:

• upstream-owned paths: took vendor/main
• package.json: fork recipe (@yansigit/opencodex, version 2.49.0)
• shared-hotspot src/server/responses/core.ts: kept upstream control flow and re-fit fork shadow/credential flags + clientJson passthrough recording
• fork re-ports on upstream-owned files still required by auto-merged fork code: cursor-oauth-* recovery kinds + agentKind in src/usage/log.ts; UpstreamRedirectError in src/server/responses/fetch-helpers.ts
• Aligned ws-upstream.ts and src/codex/{quota,routing,quota-types}.ts with vendor/main

Tag SHA: 2f3f736299dca38861f8fb9c4326a4b4d7c664bc

1. Merge vendor/main v2.49.0 / 2f3f736 — done
2. Resolve shared hotspot per OWNED.md (src/server/responses/core.ts) — done
3. Rebase onto origin/dev — pending (gh pr view --json mergeable)
4. CI ci / enforce-target / hygiene — pending

Decision table

File / hunk	Upstream intent	Fork / overlay intent	Class	Options	Recommendation	Tests
bun.lock	Upstream dependency graph for v2.49.0	Fork had older lock	upstream-owned	A) theirs B) ours	Take theirs; bun install	bun run typecheck
package.json	Upstream metadata/deps at 2.49.0	Keep @yansigit/opencodex name	recipe	recipe merge	Recipe: fork name + max semver	bun run typecheck
gui/src/components/provider-workspace/ProviderOverview.tsx	Upstream provider overview UI	Fork GUI deltas superseded	upstream-owned	A) theirs B) manual	Take theirs	cd gui && bun test tests/provider-sponsor-overview.test.tsx
gui/src/components/subagents-workspace/SubagentDelegationSection.tsx	Upstream subagent delegation UI	Fork deltas superseded	upstream-owned	A) theirs	Take theirs	cd gui && bun test tests/subagents-ultra-mode.test.tsx
gui/src/pages/Models.tsx	Upstream models page	Fork deltas superseded	upstream-owned	A) theirs	Take theirs	GUI smoke via bun run build:gui
gui/src/pages/Subagents.tsx	Upstream subagents page	Fork deltas superseded	upstream-owned	A) theirs	Take theirs	cd gui && bun test tests/subagents-ultra-mode.test.tsx
gui/src/pages/use-dashboard-data.ts	Upstream dashboard data hooks	Fork deltas superseded	upstream-owned	A) theirs	Take theirs	cd gui && bun test tests/usage-custom-range.test.tsx
gui/tests/subagents-ultra-mode.test.tsx	Upstream test expectations	Fork test drift	upstream-owned	A) theirs	Take theirs	self
gui/tests/usage-custom-range.test.tsx	Upstream usage range tests	Fork test drift	upstream-owned	A) theirs	Take theirs	self
scripts/test-layout/layout.json	Upstream test layout map	Fork layout entries stale	upstream-owned	A) theirs	Take theirs	bun test tests/test-layout.test.ts
scripts/test.ts	Upstream test runner	Fork runner drift	upstream-owned	A) theirs	Take theirs	bun test tests/ci-workflows/test-runner.test.ts
src/codex/inject.ts	Upstream injection path	Fork injection drift	upstream-owned	A) theirs	Take theirs	bun test tests/codex-integration/codex-inject.test.ts
src/oauth/xai.ts	Upstream xAI OAuth	Fork OAuth drift	upstream-owned	A) theirs	Take theirs	bun test tests/providers/xai/xai-oauth-retry.test.ts
src/server/claude-messages.ts	Upstream Claude wire	Fork wire drift	upstream-owned	A) theirs	Take theirs	bun test tests/claude-integration/claude-inbound.test.ts
src/server/management/config-routes.ts	Upstream management config API	Fork route drift	upstream-owned	A) theirs	Take theirs	bun test tests/cli/cli-management-auth.test.ts
src/server/management/provider-routes.ts	Upstream provider routes	Fork route drift	upstream-owned	A) theirs	Take theirs	bun test tests/providers/provider-connection-test.test.ts
src/server/responses/collaboration.ts	Upstream v2 guidance tags/budget	Fork syncCodexSubagentDefaults removed upstream	upstream-owned	A) theirs B) re-port fork field	Take theirs; drop syncCodexSubagentDefaults from core.ts call	bun test tests/codex-integration/multi-agent-compat.test.ts
src/server/responses/fetch-helpers.ts	Upstream fetch wrapper	Fork needs UpstreamRedirectError	upstream-owned + re-port	A) theirs B) re-port error class	Take theirs + re-port UpstreamRedirectError + redirect guard	bun test tests/lib/credential-redirect-guard.test.ts
src/server/responses/core.ts ~3640	Set credentialDomainWasRewritten on shadow intercept	Also track shadowIntercepted	shared-hotspot	A) upstream only B) both flags	Both flags	bun test tests/responses/responses-state.test.ts
src/server/responses/core.ts ~6677	Record passthrough from upstream text	Fork used processed clientJson	shared-hotspot	A) text B) clientJson	clientJson with upstream type	bun test tests/responses/responses-state.test.ts
src/usage/log.ts	Upstream account-label + transport fields	Fork needs agentKind, cursor-oauth-* kinds	upstream-owned + re-port	A) theirs B) re-port fork fields	Take theirs + re-port fork logging fields	bun test tests/usage/request-log.test.ts
tests/ci-workflows/test-home-guard.test.ts	Upstream guard	Fork guard drift	upstream-owned	A) theirs	Take theirs	self
tests/codex-integration/codex-models-cache-invalidate.test.ts	Upstream cache tests	Fork drift	upstream-owned	A) theirs	Take theirs	self
tests/codex-integration/codex-retained-root-serialization.test.ts	Upstream serialization tests	Fork drift	upstream-owned	A) theirs	Take theirs	self
tests/codex-integration/codex-routing.test.ts	Upstream routing/quota semantics	Fork fiveHour window deltas in unstaged codex tree	upstream-owned	A) theirs B) align more codex files	Take theirs; align quota.ts/routing.ts with vendor	bun test tests/codex-integration/codex-routing.test.ts
tests/codex-integration/multi-agent-compat.test.ts	Upstream multi-agent compat	Fork drift	upstream-owned	A) theirs	Take theirs	self
tests/fixtures/test-layout-expected.json	Upstream layout fixture	Fork fixture drift	upstream-owned	A) theirs	Take theirs	bun test tests/test-layout.test.ts
tests/images/loop.test.ts	Upstream image loop tests	Fork drift	upstream-owned	A) theirs	Take theirs	self
tests/lib/process-control-graceful.test.ts	Upstream process control	Fork drift	upstream-owned	A) theirs	Take theirs	self
tests/server/server-xai-responses-streaming.test.ts	Upstream xAI streaming	Fork drift	upstream-owned	A) theirs	Take theirs	self

Blocker (human follow-up)

Four tests in tests/codex-integration/codex-routing.test.ts still fail on this merge head while passing on pure vendor/main:

• a live full burst window moves selection off the account (#3029)
• a 502 storm does not pin the pool to an exhausted account (#3425)
• genuine quota transition still retires an exhausted pin during model-scoped selection
• model ineligibility does not preserve a simultaneously exhausted pin

Likely cause: remaining fork deltas under src/codex/ (e.g. account-lifecycle.ts, auth-api.ts, subagent-*) interacting with upstream quota tests. Needs preservation review before merge.

Verification

# Confirmed tag/SHA before merge
git rev-parse v2.49.0^{commit}
# 2f3f736299dca38861f8fb9c4326a4b4d7c664bc

bun install
bun run typecheck
# exit 0

bun test tests/codex-integration/codex-routing.test.ts \
  tests/server/server-xai-responses-streaming.test.ts \
  tests/codex-integration/multi-agent-compat.test.ts \
  tests/responses/responses-state.test.ts \
  tests/usage/request-log.test.ts
# 467 pass, 1 skip, 4 fail (codex-routing account-selection cases)

Checklist

• Scope stays focused on upstream v2.49.0 sync resolution.
• Regression coverage preserved via upstream-owned test files; 4 codex-routing failures documented as blocker.
• Docs/release notes not required for sync branch itself.
• No new secrets/auth surface introduced; conflict resolution only.

Human: merge with a merge commit only (no squash/rebase). Do not merge until the codex-routing blocker is resolved or explicitly waived.

  

[github-actions]

PR automation (bot-owned)

• Class: draft (draft)
• Base: 785424295fc5d8ef0a66fb8ce94a55fe3b054471
• Head: cf5a1a0b18e8b33e8f66338f0d1f9df0a9c5e1e1
• Action: observed
• Exact-head gate: BLOCKED (not-mergeable, check-not-success)
• Sensitive paths: .github/workflows/cleanup-orphaned-workflows.yml, bun.lock, package.json, scripts/release-notes.ts, src/adapters/anthropic.ts, src/adapters/codebuddy/adapter.ts, src/adapters/codebuddy/profiles.ts, src/adapters/coding-agent/profile.ts, src/
• Maintainer auto-merge approval: NO
• Bot merge evidence: NO
• Next action: human review required

[github-actions]

⚠️ Deterministic hygiene checks failed.

• new_suppression — A new TypeScript, lint, formatter, or similar suppression was added. Fix the underlying issue or obtain suppression-approved. Paths: gui/src/pages/Models.tsx.
• empty_catch — An empty catch block was added. Handle, report, or deliberately propagate the error. Paths: tests/codex-integration/codex-retained-root-serialization.test.ts.
• unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: .github/workflows/cleanup-orphaned-workflows.yml, bun.lock, package.json, scripts/release-notes.ts, src/codex/auth-api.ts, src/codex/auth-collision.ts, src/codex/auth-context.ts, src/oauth/chatgpt.ts, src/oauth/xai.ts, src/server/management-api.ts.

[github-actions]

⏳ DRAFT

• hygiene: new_suppression. hygiene: empty_catch. hygiene: unsponsored_surface. sync_baseline

What to do

• Wait for successful exact-head ci, enforce-target, and hygiene checks.
• Fix new_suppression — A new TypeScript, lint, formatter, or similar suppression was added. Fix the underlying issue or obtain suppression-approved. Paths: gui/src/pages/Models.tsx.
• Fix empty_catch — An empty catch block was added. Handle, report, or deliberately propagate the error. Paths: tests/codex-integration/codex-retained-root-serialization.test.ts.
• Fix unsponsored_surface — This changes an authentication, workflow, release-automation, or dependency surface. MAINTAINERS.md requires security review for these; ask a maintainer to apply maintainer-sponsored once they have reviewed it. Paths: .github/workflows/cleanup-orphaned-workflows.yml, bun.lock, package.json, scripts/release-notes.ts, src/codex/auth-api.ts, src/codex/auth-collision.ts, src/codex/auth-context.ts, src/oauth/chatgpt.ts, src/oauth/xai.ts, src/server/management-api.ts.

This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.

[yansigit]

Closing obsolete sync PR in favor of direct upstream alignment.