chore(effect): bump published provider/sandbox pins to 0.4.16/0.4.19 - #212
Conversation
|
@codex review |
|
@codex security review |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4bea52dad4
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Align the private Effect bridge with published Coder releases and their exact @ai-sdk/provider 4.0.15 dependency. Remove the unused 4.0.14 lockfile entries. Signed-off-by: Thomas Kosiewski <tk@coder.com> --- _Generated with [`xum`](https://github.com/coder/xum) • Model: `coder:openai/gpt-6-astra` • Thinking: `xhigh`_ Change-Id: I7b111d2e658f7f2f65babf3afeaec0a2f8caf971
4bea52d to
c9ad73c
Compare
|
@codex review |
|
@codex security review |
|
Codex Review: Didn't find any major issues. 🎉 Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
🛡️ Codex Security ReviewSecurity review completed. No security issues were found in this pull request. Reviewed commit: Only the user who started this review can view the report in Codex. ℹ️ About Codex security reviews in GitHubThis is an experimental Codex feature. Security reviews are triggered when:
Once complete, Codex will leave suggestions, or a comment if no findings are found. |
1 participant
Summary
Refresh the private, unpublished Effect bridge to the published Coder releases.
@coder/ai-sdk-provider0.4.150.4.16@coder/ai-sdk-sandbox0.4.180.4.19@ai-sdk/provider4.0.144.0.15npm view @coder/ai-sdk-provider@0.4.16 dependenciesconfirms the published provider requires exactly@ai-sdk/provider: 4.0.15.Scope follows #195/#200/#206: only
packages/effect/package.json,pnpm-lock.yaml,pnpm-workspace.yaml, and the three pinned-version rows inpackages/effect/README.mdchange. The two existing release-age exclusions are replaced with exact@coder/ai-sdk-provider@0.4.16and@coder/ai-sdk-sandbox@0.4.19entries. This is the explicitly authorized under-24h exception for our own just-released packages; no other exclusion changes.No other dependency versions, peer ranges, package files, or CHANGELOG.md change.
@ai-sdk/provider4.0.16 and the September 16 18:35Z AI SDK wave remain out of scope. Provider 4.0.15 was published September 15 at 17:21Z and is over 24 hours old.pnpm why @ai-sdk/providerandpnpm why -r @ai-sdk/providerresolve only 4.0.15.grep -c "@ai-sdk/provider@" pnpm-lock.yamlreturns 2: one package entry and one snapshot entry for that version. The unused 4.0.14 entries are removed.Effect remains
private: trueand outsiderelease-please-config.json. No published package paths change, so no release PR is expected; release-please will be checked after merge.Validation
Final tree committed as
c9ad73c3188ba53d652e8d955ec95c33dfa6df28, with Node 26.8.2 and pnpm 11.27.0.mise install: passed during initial setup.pnpm format: passed after updating the README rows.pnpm install --frozen-lockfile: passed, after removing rootnode_modulesand using a new, empty policy-cache directory. pnpm verified 456 entries in 1.9s at 20:32:19Z and wrote one new verdict; no cached policy verification was reused. Package tarballs were reused from the content store.pnpm check: passed (format, lint, typecheck).pnpm -r build: passed.pnpm -r test: 640 passed — agent 369, sandbox 191, effect 45, provider 22, release tooling 13.pnpm publintandpnpm attw: passed.The original two-file revision failed fresh CI because its Coder pins were not exempted. The authorized four-file revision fixes those exclusions and the stale README rows. Both Codex findings are addressed; current-head CI and refreshed code/security verdicts are required before merge.
Fresh-install policy verification
Deleting
node_modulesalone does not remove pnpm's external policy cache. The fresh run used a process-local, empty cache directory outside the checkout:Live dogfood
This existing 7/7 live run is retained for the final head: the lockfile and dependency graph are byte-for-byte unchanged by the README/exclusion fixes. It was not rerun.
Ambient authentication was verified with
coder whoamiagainsthttps://dogfood.cdr.dev, serverv2.37.1-devel+feca38ec74. No token lifecycle changes were made.mise install pnpm install --frozen-lockfile coder whoami cd packages/agent npx vitest run test/e2eVerification tiers: dependency/release-scope claims verified against registry metadata and repository source; agent behavior verified live against dogfood. The screenshot and 5.28-second video below show the final result from this same live run. The video is an accelerated terminal-output replay, not real-time playback or a second test run. The raw recording spans 39.855 seconds including authentication/setup; Vitest ran for 32.55 seconds and finished at 20:15:10Z. The recorder later timed out waiting for its shell-completion marker, after Vitest and tee had both exited 0. The terminal snapshot independently confirms those exit codes.
Live e2e screenshot, condensed recording, and complete test output
live-e2e.webm
Generated with
xum• Model:coder:openai/gpt-6-astra• Thinking:xhigh