Skip to content

test(codex): gate the 0.145 CLI upgrade with JSONL replay - #1508

Open
aaight wants to merge 2 commits into
devfrom
fix/mng-1753-codex-cli-0.145
Open

test(codex): gate the 0.145 CLI upgrade with JSONL replay#1508
aaight wants to merge 2 commits into
devfrom
fix/mng-1753-codex-cli-0.145

Conversation

@aaight

@aaight aaight commented Jul 28, 2026

Copy link
Copy Markdown
Collaborator

Summary

  • completes the MNG-1753 drift gates for the Codex CLI 0.145.0 pin already present on dev
  • adds sanitized codex exec --json recordings from 0.141.0 and 0.145.0
  • replays both streams through the parser and engine, asserting no unrecognized-event canary logs
  • pins 0.145.0 resumed-turn cumulative usage and verifies the reconstructed second-turn delta
  • documents fixture refresh steps and why the codex_core::tools::router stderr detector remains required

Canary evidence

Verification

  • npx vitest run --project unit-backends tests/unit/backends/codex-jsonlParser.test.ts tests/unit/backends/codex.test.ts tests/unit/backends/codex-cost.test.ts (153 passed)
  • npm run typecheck
  • scoped biome check --write on changed TypeScript files

Issue: https://linear.app/issue/MNG-1753

🕵️ codex · gpt-5.6-sol · run details

Cascade Bot and others added 2 commits July 28, 2026 17:00
Cascade Bot
test(codex): gate the 0.145 CLI upgrade with JSONL replay
421c9f6
Cascade Bot @claude
fix(deps): resolve high-severity prod audit failures (axios, js-yaml,…
b566323 
… brace-expansion)

The `npm audit --omit=dev --audit-level=high` CI step failed on three newly
published high-severity advisories in production dependencies:

- axios (<1.18.0): multiple DoS / prototype-pollution advisories → bump
  override to ^1.18.0
- js-yaml (<4.3.0): YAML merge-key quadratic CPU DoS → bump direct dep to
  ^4.3.0
- brace-expansion (<=5.0.7): unbounded expansion OOM DoS → bump override to
  ^5.0.8. brace-expansion 5.x drops the default ESM export that minimatch@9
  imports, so also override minimatch to ^10.0.3 (uses the named `expand`
  import) to keep the tree consistent.

Full unit suite (10,942 tests), typecheck, lint, build, and prod audit all
pass locally.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
@aaight

aaight commented Jul 28, 2026

Copy link
Copy Markdown
Collaborator Author

CI Failures Resolved

The lint-and-test check was failing at the Audit production dependencies step (npm audit --omit=dev --audit-level=high) due to three newly-published high-severity advisories in production dependencies. These are unrelated to the PR's test-only changes.

Fixes Applied

  • axios (<1.18.0, multiple DoS / prototype-pollution advisories) → bumped overrides pin to ^1.18.0
  • js-yaml (<4.3.0, YAML merge-key quadratic-CPU DoS) → bumped direct dependency to ^4.3.0
  • brace-expansion (<=5.0.7, unbounded-expansion OOM DoS) → bumped overrides pin to ^5.0.8. Since brace-expansion@5 drops the default ESM export that minimatch@9 imports, also pinned minimatch to ^10.0.3 (uses the named expand import) to keep the dependency tree consistent.

Only package.json and package-lock.json changed.

Verification (local)

  • npm audit --omit=dev --audit-level=high — passes (exit 0; only moderate remain)
  • npm run build / npm run typecheck — pass
  • npm run lint — passes
  • Full unit suite — 10,942 tests pass (603 files)
  • Pre-push hook re-ran the full suite successfully

Changes pushed to fix/mng-1753-codex-cli-0.145.

🕵️ claude-code · claude-opus-4-8 · run details

nhopeatall
nhopeatall approved these changes Jul 28, 2026
View reviewed changes

@nhopeatall nhopeatall left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Summary

APPROVE — the JSONL replay gate is correct, well-verified, and faithfully implements the MNG-1753 drift checklist. The bundled dependency bumps are a CI-audit-forced security fix that I confirmed leaves the lockfile in sync and the prod audit green.

Verification performed

  • npx vitest run --project unit-backends codex-jsonlParser.test.ts codex.test.ts codex-cost.test.ts → 153 passed
  • npm run typecheck → exit 0
  • Fixtures are valid JSONL, internally consistent; cumulative-usage delta math checks out (30875 − 15428 = 15447, 13 − 6 = 7)
  • Traced both fixtures through jsonlParser.ts extractUsage and index.ts computeTurnDelta/persistTurnLlmCall — the parser usage assertions and the engine's last-call delta assertion ({15447, 7, cached 15104}) match the real code paths
  • npm install --package-lock-only → no drift; npm audit --omit=dev --audit-level=high and --audit-level=critical → exit 0
  • npm ls minimatch/brace-expansion --all → tree fully deduped to minimatch@10.2.6 / brace-expansion@5.0.8, no unmet peers

Drift-checklist coverage (MNG-1753)

  • #1 JSONL replay — covered (parser + engine replay, no Unrecognized Codex event canary).
  • #2 Cumulative-usage semantics — covered; the resumed-turn fixture pins the cumulative→delta reconstruction. Note the "lower cumulative usage" WARN is only implicitly exercised (this fixture's usage increases monotonically, so a clamp can't fire) — the delta assertion is the effective canary here, which is fine.
  • #3 SHELL_CORRUPTED_RE still matches — the codex_core::tools::router detector tests are preserved (codex.test.ts §"shell-state corruption").
  • #4 Upstream status — documented in the new fixtures README (#18578 open, #28895 merged but different path).

Observations (non-blocking)

  • Scope mix: a test-only PR also carries prod-dependency security bumps (js-yaml, axios, brace-expansion, new minimatch override). This is justified — the audit step would otherwise block the merge on newly-published CVEs — and the override cascade is well-reasoned and documented in the CI Fix Summary comment. Flagging only so the extra churn in package*.json is an expected part of this PR, not an accidental inclusion.

LGTM.

🕵️ claude-code · claude-opus-4-8 · run details

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@nhopeatall nhopeatall nhopeatall approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@aaight @nhopeatall