Stop automatic compaction after turn cancellation - #5509

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1867819793

Automatic compaction now carries the owning turn stop state into provider prompts and checks it again at HTTP/WebSocket admission after hooks. Inspected native cancellation ownership, successor-turn isolation and the held-hook/result regressions; the previous late-admission feedback is addressed.

Re-reviewed this exact commit with an independent reviewer. Static inspection only; no candidate code or local tests executed. Hosted checks remain in progress.

Re-reviewing newly posted security feedback changes my decision at this commit. The existing hard-link finding is valid: openai/openai-agents-js#2122 (comment) .

With a preexisting same-filesystem hard link from a writable workspace to a user-owned installed helper, LocalWriteRoots records the workspace/root and mount-destination identities but not ordinary file aliases. The helper path therefore passes validation while the alias remains writable. A read-only bind at the installed path does not protect the shared inode through the writable alias; an inactive sibling helper can be modified before a later trusted launch, so ETXTBSY on a currently running executable is not a general defense. Reject or safely isolate ordinary hard-link aliases as well, and exercise the real constructor without synthetic mount entries.

This Python layer includes the equivalent LocalWriteRoots guard and inherits the same issue. The earlier fixes remain valid; this is a newly validated remaining blocker. Referencing the existing finding without duplicating its inline comment. Coordinator and independent static review only; no candidate code or local tests executed. Hosted platform checks remain unfinished.

Re-reviewed this exact commit after coordinator and independent static review. The outstanding helper hard-link and reverse bind-mount alias findings are fixed: multiply linked resolved helpers are checked inside grants, including the code-mode host; reverse mappings verify visible candidate inode identity and canonical location. Managed local process cleanup failures remain reported by the scoped tree shutdown check. No remaining actionable blocker found in this increment. The automatic-compaction patches are byte-identical to the previously reviewed versions after renumbering; inherited fixes were verified.

This approval supersedes my earlier request-changes decision after the relevant fixes. Hosted checks on the current commit are still pending/running; no candidate code or local tests were executed.

Requesting changes for the confirmed Python 3.10 test compatibility failure below. Hosted tests (3.10) finished with 6 failed, 3777 passed, 35 skipped. The failures are expected observation timeouts escaping the wrong exception handler, not evidence that cancellation admitted another request. Static source/log review with an independent reviewer; no candidate code or tests executed. Other pending hosted checks remain tracked.

Request changes at 230e6ea for the existing P1 storage-hard-link finding; cross-linking it rather than adding duplicate inline feedback. Coordinator and independent static review confirm that the local executor checks helper-file inodes but checks storage_home only for path/symlink/mount overlap. On Linux, a pre-existing hard link inside a writable workspace to an existing profile SQLite file passes those checks; writes through the alias modify the same trusted DB inode. The SQLite opener has no independent hard-link rejection. Reject writable inode aliases to existing trusted storage before opening the local executor, and add a regression that reopens a profile with such an alias. This applies to the shared local-executor implementation in this stack.

The incremental macOS helper guard and trusted-wrapper resume changes are otherwise sound. Complete-artifact verification and the relevant documentation corrections are sound. The prior Python 3.10 timeout finding is fixed at both asyncio.TimeoutError handlers; compaction patches are unchanged apart from renumbering.

Static source review only; no candidate code/tests executed. Hosted CI remains unfinished.

Approved the current fix increment after coordinator and independent static reviews. The private-storage guard rejects writable hard-link aliases, including relocated SQLite databases and sidecars, while retaining path-overlap protection. Durable resume now validates receipt identities and rejects strict/nondefault sampled resumes without verifiable policy; recognized legacy defaults remain compatible. The Darwin wrapper-identity wait stays within the existing bounded shutdown join. Instruction-file provenance, compaction propagation, runner routing, and late-completion documentation/regressions were also reviewed in this increment. The prior storage finding is addressed; no new actionable issue found.

Hosted validation remains unfinished. No candidate code or local tests executed.

Re-reviewed 8fa83e6. The Linux long-path helper scan safely falls back to component-wise directory opens, rejects descendant symlinks, preserves distinct mount views, and keeps the directory descriptor alive through entry inspection. The patch and manifest propagation are consistent with the previously reviewed stack. No new actionable findings. Hosted CI remains in progress; this was static review only, with no candidate code or local tests executed.

Re-approved 6e5987ea2d5c9507c4c8fbcd2ec309b5f14ddfa1. The complete Git tree is identical to the previously approved commit. No source, configuration, documentation or test changes. Coordinator and independent static review found no new actionable issue.

Fresh hosted native CI remains pending. No candidate code or local tests executed; existing merge holds remain.