Rebase fork on upstream #471 (RPC override) + #506/#480/#490 + shutdown hardening#4
Merged
Conversation
A shared app-server broker outlives the Claude Code session that spawned it. When the session exits without a clean teardown the broker is reparented to init and stays listening forever, holding its `codex app-server` child open. These accumulate: on one developer machine, 8 orphaned brokers and their children held ~1.3 GB RSS, the oldest alive for 41 hours. Shut the broker down after 15 minutes with no connected clients. Foreground and background jobs hold a connection for their whole lifetime, so an active job always keeps its broker alive; `CODEX_COMPANION_BROKER_IDLE_TIMEOUT_MS` overrides the window and `0` disables the timer. `ensureBrokerSession()` already probes the endpoint and respawns when it finds none, so an idle-exited broker is transparently recreated on the next call. Also close the listener before awaiting async child cleanup, and reject connections that arrive during shutdown, so a reconnect cannot slip into the shutdown window and inherit a closing app-server client. Tests run with a 2s idle window so the suite does not leave detached helpers.
… (RPC thread/start.config override + broker-lock/probe/model-catalog + runtime-identity respawn)
…ords (openai#481 observability) # Conflicts: # plugins/codex/scripts/lib/codex.mjs # tests/fake-codex-fixture.mjs
…out + shutdown-path corrections)
…ai#506 + openai#480 + openai#490 + bounded-shutdown + PID-reuse guard)
…favor of openai#471 reconstruction # Conflicts: # .claude-plugin/marketplace.json # README.md # plugins/codex/.claude-plugin/plugin.json # plugins/codex/commands/adversarial-review.md # plugins/codex/commands/review.md # plugins/codex/scripts/lib/app-server.mjs # plugins/codex/scripts/lib/broker-lifecycle.mjs # tests/commands.test.mjs # tests/runtime.test.mjs
…#471's danger-full-access) openai#471 (commit a6e501a) mapped --write to danger-full-access. Under approvalPolicy: never that removes all containment — --write silently grants full host-filesystem authority. Adversarial review flagged it as a privilege expansion (confidence 0.99). Reverting to workspace-write as in upstream main; asked the openai#471 author for the intent behind the change (openai#471 issuecomment-4991428428).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Replaces the fork's spawn-
-coverride (PR #2,1.0.6-fork.1) with upstream #471's RPCthread/start.configapproach, while preserving the fork's generic shutdown hardening that openai#471 does not include. Plus merges openai#506, openai#480, openai#490.Full rationale and layer breakdown: fork issue #3.
Why
openai#471 is broader/better than our spawn-
-c: per-thread RPC override (no broker respawn needed) + runtime-identity respawn (plugin/codex version) + broker-lock + broker-probe + model-catalog. PR #2 becomes redundant.Contents (4 merges + 2 cherry-picks)
ab75d49(spawn--c) +eb3d78f(tests rewritten to RPC surface).sendBrokerShutdown(2s) — fork's8458741re-applied: Support GPT-5.6 models and refresh stale brokers openai/codex-plugin-cc#471's version is bool-returning but has no timeout; unbounded-await-on-wedged-socket bug stays.478be42re-applied:existingReadygate inteardownExistingBroker(only tree-kill by pid when endpoint confirmed live).09b3a41— Support GPT-5.6 models and refresh stale brokers openai/codex-plugin-cc#471 already does gracefulsendBrokerShutdownbefore teardown.Verified (codex-cli 0.144.4, macOS)
status×2,result,resolveStateDir,task --background; reproduce on purepr-471). 0 regressions. Typecheck clean.--effort high→ rolloutturn_context reasoning_effort:"high"(RPC reaches model); job recordresolved.reasoningEffort="high"(Capture resolved model/effort/sandbox in job records openai/codex-plugin-cc#506); SIGKILL worker → zombie retainsresolved; broker self-exits after idle (Stop orphaned Codex companion brokers openai/codex-plugin-cc#490).Merge notes
1.0.6-fork.2(based on last real upstream release v1.0.6, not on Support GPT-5.6 models and refresh stale brokers openai/codex-plugin-cc#471's claimed-but-unmerged1.0.7).1.0.6-fork.1preserved onfix-app-server-overridesbranch.Fork-internal only — no upstream PR.