Conversation
…127.0.0.1 Root cause: POST /api/link/join admitted only a paired session, which a standalone never issues, so no computer could become a Child from its own dashboard. A link Child also routed Codex through an env_key provider table (http://localhost:<port>/v1 + OPENCODEX_API_AUTH_TOKEN) that a GUI-launched Codex cannot satisfy, and its relay kept the 4 MiB / 15 s management-relay bounds, forwarded caller credentials, relayed /readyz without a key, 404ed the Responses WebSocket probe, refused chunked uploads, and ran on Bun's 10 s idle default with the per-request idle timer still armed. Fix: - Join admits the same dashboard session as the Home-side routes (paired, or the current standalone loopback session on trusted loopback ingress) and answers 409 join_port_mismatch before any SSH when the live port is not the configured port. joinAvailable follows the same gates. - A link Child keeps the standalone root form openai_base_url = http://127.0.0.1:<port>/v1 (no provider table, no env_key); for the same port the join writes the bytes the standalone wrote. - The link data plane (src/client/link-ingress.ts): standalone Host/Origin gate before any upstream fetch, 426 for a /v1/responses upgrade, local /readyz, 503 link_credential_unavailable without the committed key. A relayed request lifts its own idle timer (server.timeout(req, 0)), as a standalone data route does, so a quiet stretch longer than 255 s inside a long generation is not cut. - The relay drops Authorization, x-api-key, x-opencodex-api-key, chatgpt-account-id and cookie and sends the link key as a Bearer (x-opencodex-api-key for GET /v1/usage), so the Home serves with its own accounts. A lone Transfer-Encoding: chunked without Content-Length is admitted (the listener already de-chunked it); any other framing ambiguity still answers 400. - The Child listener serves its own read-only GET/HEAD /api/link/status (src/client/link-status.ts) and advertises its origin as the shared plane. - Dashboard: pre-join notice, /healthz pid read, 1 s /healthz poll after the 202, reload only onto role client with a new pid. The wait never gives up: past the server's handoff budget (60 s drain + 70 s replacement + 15 s) it shows a slow notice and keeps polling every 5 s, so a late Child still reloads the page. childJoinUnavailable removed in all 10 locales, join_port_mismatch and restart.slow added. Structure docs, route registry and docs-site guides (8 locales) updated. Performance: standalone and hub transport paths are unchanged (hub keeps the 4 MiB bound and default idle limit). In link mode the request body streams chunk by chunk with the caller's Content-Length and a byte-counting cap at the inbound limit (256 MiB default) instead of buffering up to 4 MiB; the header deadline is 300 s with caller abort; the link key is read once and cached, so no relayed request touches the disk; both the Child machine listener and the Home hub-link listener bind with idleTimeout 255, and each relayed request lifts its idle timer with one O(1) call (a probe cut a 5 s SSE gap at idleTimeout 1 without it). The idle-timer helper is local, so the Child does not load the Responses WebSocket upstream modules. No new server timers; the only new poll is the browser's /healthz read while a join restart is pending. Security: auth-boundary change. The Child's 127.0.0.1:<port> becomes a keyless local path to the Home's providers, the same trust a standalone loopback bind gives, with browsers held off by the Host/Origin gate; the Child's own credentials no longer cross the tunnel. The loopback dashboard session can now join, the same casual-path trade apply already makes (key-only SSH, confirmed host key, 5-minute TTL, CSRF). The key is never logged or returned. Chunked admission is limited to the link data plane; the hub management relay stays strict. Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Contributor
|
Important Review skippedAuto reviews are disabled on base/target branches other than the default branch. 🗂️ Base branches to auto review (2)
Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Repository: lidge-jun/opencodex/.coderabbit.yaml Review profile: ASSERTIVE Plan: Advanced Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Contributor
|
✅ Deterministic PR hygiene checks passed. |
3 tasks
Owner
Author
리뷰 · 우선순위 63 / 80이 PR은 내 컴퓨터의 대시보드에서 이 컴퓨터를 자식으로 켜게 합니다. 지금까지 가입 뒤 Codex 주소는 기준 브랜치는 #5928 gui/src/pages/RemoteLink.tsx:382 - gui/src/remote-link-api.ts 메인테이너의 판단이 필요한 지점 자식의 #5928이 너의 추천 방향은 맞습니다. 포트 안내를 세션 실패와 나누고, 독립형으로 남아 있으면 기다림에서 나오게 하는 쪽이 안전합니다. #5928이 이 댓글은 grok-bot이 작성했습니다 |
This was referenced Sep 26, 2026
lidge-jun
added a commit
that referenced
this pull request
Sep 27, 2026
…ch 9E) (#5998) Carry the owner's Remote Link, restart, desktop supervision and Codex routing fixes onto dev in their original order, then carry RHODIZSECURITY's combo reasoning fix as one attributed commit. | PR | Change | Author | | --- | --- | --- | | #5970 | Turn a standalone computer into a Child from its dashboard; keep Codex on its local loopback URL and protect the linked data plane. | lidge-jun | | #5973 | Reconnect the Child's SSH tunnel after sleep, outages and crashes. | lidge-jun | | #5972 | Heal opencodex-owned Codex routing left on a dead loopback endpoint, with ownership and race gates. | lidge-jun | | #5971 | Keep a proxy on the configured port through a Child restart. | lidge-jun | | #5974 | Let the desktop app supervise runtime restarts and unexpected exits. | lidge-jun | | #5990 | Apply forced combo defaults over declared none/minimal reasoning sentinels. | RHODIZSECURITY | The carry keeps the 9D one-use sibling handoff and passes link status, cached key and tunnel gate through the Child listener. Separate integration commits bound the port-conflict regression test and keep carried files below the file-size guard, including newer dev's layout entries. The five owner commits retain JUN's authorship; the #5990 squash retains RHODIZSECURITY's commit identity and noreply co-author trailer. An independent review found four integration defects. Each repair is a separate Codex-authored commit: | Finding | Commit | Repair | | --- | --- | --- | | Linked requests could fetch without a connected tunnel. | 6a29f7b | Require a positive supervisor connected verdict before every fetch; missing, failed and stopped supervision return 503 without forwarding key or body. | | IPv4 and IPv6 destinations on one port shared one probe/streak key. | 8903998 | Probe and track each hostname and port separately; a live endpoint blocks healing and an address change starts a fresh dead-probe streak. | | A same-port route change could pass the locked write guard. | f62e43b | Abort when admitted config bytes or the complete destination set changes under the lock, then require fresh probes. | | Orphan reaping could KILL a reused PID. | e0ef426 | Record the process start identity and revalidate argv, start time and orphan status before TERM and before KILL; legacy records lacking start identity never authorize a signal. | A second review confirmed those four repairs and found two remaining blockers: | Finding | Commit | Repair | | --- | --- | --- | | A competing local listener received the readiness key and private relay traffic before SSH bound the tunnel port. | 39f246a | Require an exclusive local LISTEN socket owner PID matching the SSH child before every keyed probe and relay admission; adopted processes also need matching pidfile argv and start time. Unknown scans fail closed. | | Newer dev mappings made the merge result exceed the layout file-size guard. | 3bb2ab6, 46ee24f | Merge origin/dev at a91568e, then compact formatting while retaining every explicit mapping. | A third review confirmed the competing-listener and layout repairs, then found three lookup defects: | Finding | Commit | Repair | | --- | --- | --- | | Minimal Linux lacks lsof/netstat and never proves the SSH listener. | 9c66251 | Use tool-independent async /proc/net/tcp{,6} inode lookup, checking the expected SSH PID's fd symlinks first. | | A foreign ::1 listener shares the numeric port with the owned IPv4 forward. | 9c66251 | Match only the exact 127.0.0.1 address and port on Linux, macOS and Windows. | | Synchronous owner scans block Bun on every relayed fetch. | b5e565d | Use bounded async lookups and a one-second positive proof keyed by port, SSH PID, start identity and tunnel generation; re-prove after restart. | The branch also merged current dev at 35f267d in 51747c9. The merged test registries retain both lanes' mappings and the management contract retains Kiro's account projection and Child join. Current dev through `2a3cfa5abe` was merged again in `5856179cd1` without conflicts. It brings #6012's macOS plugin ACL fix and dev's Kiro projection test clock correction; `scripts/test-layout/layout.json` stays at 1,997 lines. The merge changes no link/relay or server-management-auth files. A fourth review found that a one-second proof cache could survive a local port takeover, and that an adopted PID's start identity was only checked at adoption: | Finding | Commit | Repair | | --- | --- | --- | | Cached ownership authorized the next keyed probe or relay after a port takeover. | b8142ad | Every keyed probe and every relayed fetch now obtains a fresh bounded asynchronous socket-owner proof; concurrent admissions do not share a cached success. | | A reused adopted PID retained its old trusted start identity. | b8142ad | Re-read current argv and start time on every adopted admission, invalidate trust and mark the link failed on mismatch. | | The TCP listener can change after the check and before connect. | bee1613 | Record this pre-existing residual race and a private Unix-domain SSH forward as future hardening in the link structure contract. | A fifth review found that transient unreadable adopted identity was treated like a confirmed replacement: | Finding | Commit | Repair | | --- | --- | --- | | One null or timed-out identity read permanently disabled a live adopted link. | 0eefebf | Return an explicit unknown verdict; deny only the current keyed admission and retry on the next check without discarding the adopted record. | | A confirmed changed identity left the old adopted PID blocking recovery. | 0eefebf | Release the stale adoption and pidfile without signalling that PID; the next supervisor tick starts its own SSH tunnel. | Windows CI follow-up: `88fbb539af` samples the relay hold clock once per attempt. The initial reconnect wait now receives the full 15-second budget even when the wall clock ticks during admission; later retries still subtract elapsed time. Windows teardown follow-up: `0171b4856c` makes `server.stop(true)` await any timed-out `icacls.exe` child still reaping after config-directory hardening settles. The stop promise now marks the actual handle-release boundary before a caller removes the home. Security review: Child join still refuses Tailscale identity, a non-standalone role and a mismatched live port before SSH. Linked data routes retain the Host/Origin gate, committed-key fingerprint, caller-credential stripping and inbound byte cap. The relay now sends no key or request without positive tunnel supervision, and the supervisor obtains a fresh bounded asynchronous exact-IPv4 owner proof before every keyed probe and relay fetch; adopted processes also have their current argv and start time checked each time. An unknown read refuses only that admission; a confirmed mismatch releases the adopted PID without signalling it. Desktop supervision stays bound to its live parent, and dashboard Stop is refused before teardown while CLI/tray Stop remains available. Routing self-heal writes only owned loopback routing after all distinct endpoints were proven dead and the locked bytes were rechecked. The existing home-bound stop proof and sibling Desktop-write gate remain intact.   Co-authored-by: RHODIZSECURITY <180237049+RHODIZSECURITY@users.noreply.github.com>
Owner
Author
|
Landed on |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Stacked on #5928 (
claude/remote-link-ssh-hosts). Retarget todevafter #5928 lands.A computer could not become a Child from its own dashboard.
POST /api/link/joinadmitted only a paired session, and a standalone never issues one. Even a CLI join left the Child broken for a GUI-launched Codex. Link mode re-pointed Codex at anenv_keyprovider table (http://localhost:<port>/v1+OPENCODEX_API_AUTH_TOKEN) that a GUI app cannot satisfy. The relay also kept the management-relay bounds (4 MiB buffered, 15 s headers), forwarded caller credentials to the Home, relayed/readyzwithout a key, answered 404 to the Responses WebSocket probe and ran on Bun's 10 s idle default. After the restart the dashboard waited forever on a 404/api/link/status.Turn on from the Child's dashboard
POST /api/link/joinadmits the same session as the Home-side routes: a paired session, or the current standalone loopback session on trusted loopback ingress.409 join_port_mismatchbefore any SSH when the live port is not the configured port.joinAvailablefollows the same gates, and the Child card is selectable again.127.0.0.1:<port>/v1passes through as-isopenai_base_url = "http://127.0.0.1:<port>/v1", with no provider table and noenv_key. For the same port the join writes the bytes the standalone already wrote.src/client/link-ingress.ts) applies the standalone Host/Origin gate before any upstream fetch.426to a/v1/responsesupgrade (the same HTTP fallback the standalone uses) and serves/readyzlocally.503 link_credential_unavailablewithout the committed key.Credentials
Authorization,x-api-key,x-opencodex-api-key,chatgpt-account-idandcookie.x-opencodex-api-keyforGET /v1/usage), so the Home serves with its own accounts and the Child's own tokens never cross the tunnel.After the restart
GET/HEAD /api/link/statusand advertises its own origin as the shared plane./healthzafter the202. It reloads only when a Child with a new pid answers.Docs and i18n:
childJoinUnavailableremoved in all 10 locales;join_port_mismatchandrestart.slowadded. Structure docs, route registry andguides/remote-link.md(8 locales) updated.Performance
idleTimeout: 255. Each relayed request lifts its idle timer with one O(1) call, as a standalone data route does.Security review requested
127.0.0.1:<port>becomes a keyless local path to the Home's providers. That is the same trust a standalone loopback bind gives, with browsers held off by the Host/Origin gate.(Screenshots: this branch's built dashboard, served by a proxy with a temporary HOME/OPENCODEX_HOME/CODEX_HOME and demo SSH aliases.)
Verification
bun run typecheck,bun run structure:check,bun run privacy:scan,(cd gui && bunx tsc -b),bun run lint:gui,(cd gui && bun run lint:i18n): pass.client-link-relay,client-machine-listener,client-link-status,client-link-connect,injection-link-websocket,link-join-route,link-management-routes,link-listener-lifecycle): 89 pass, then 37 pass on the files re-touched by the review fixes.gui/tests/remote-link.test.tsxplus locale parity: 47 pass.file-size-ratchetand the test-layout guards: pass./readyz,idleTimeout,/api/link/status;join_port_mismatch;Checklist
🤖 Generated with Claude Code