Add opt-in rolling window auto-start#1481
Conversation
|
Codex review: needs real behavior proof before merge. Reviewed June 14, 2026, 12:06 PM ET / 16:06 UTC. Summary Reproducibility: not applicable. this is a new opt-in feature rather than a broken current behavior. I did not run live provider validation because AGENTS.md cautions against unrequested live provider or Keychain-prompting checks. Review metrics: 3 noteworthy metrics.
Merge readiness Overall follows the weaker of proof and patch quality, so missing proof can cap an otherwise strong patch. Rank-up moves:
Proof guidance:
Risk before merge
Maintainer options:
Next step before merge
Security Review detailsBest possible solution: Land only after conflict resolution, redacted live proof for the intended provider account path, green final-head validation, and explicit maintainer approval for opt-in background quota-consuming prompts. Do we have a high-confidence way to reproduce the issue? Not applicable: this is a new opt-in feature rather than a broken current behavior. I did not run live provider validation because AGENTS.md cautions against unrequested live provider or Keychain-prompting checks. Is this the best way to solve the issue? Unclear until maintainer product/auth approval and live proof are available; the patch uses existing provider refresh and account-routing seams with focused tests, but it intentionally starts provider windows in the background. AGENTS.md: found and applied where relevant. Codex review notes: model internal, reasoning high; reviewed against 06770308831e. Label changesLabel justifications:
Evidence reviewedWhat I checked:
Likely related people:
What the crustacean ranks mean
Shiny media proof means a screenshot, video, or linked artifact directly shows the changed behavior. Runtime, network, CSP, and security claims still need visible diagnostics. How this review workflow works
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b3b30e47b7
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
clawsweeper
Bot
added
rating: 🧂 unranked krab
- Commit staged repository changes
- Guard stale refresh generations before scheduling pings - Add scheduler isolation, retry, and focused tests
- Replace the default ping text with a clearer stop instruction\n- Keep the Codex rolling-window test aligned with the new prompt
- Build the ping environment with ProviderRegistry.makeEnvironment - Assert managed Codex pings inherit the selected home path
steipete
force-pushed
the
feature/reset-rolling-windows
branch
from
8437fd7 to
61e66dc
Compare
steipete
changed the title
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 61e66dc389
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
Current head
Proof:
This remains prepared but not approved for merge. It intentionally consumes provider quota and still needs maintainer product/auth sign-off plus redacted real-provider proof from the current head. @clawsweeper re-review |
|
🦞🧹 I asked ClawSweeper to review this item again. Re-review progress:
|
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5bd5754680
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| environment: environment, | ||
| runner: runner) | ||
| self.rollingWindowAutoStartStatus[provider] = "Ping prompt sent." | ||
| await self.refreshProvider(provider, coalesceIfRefreshing: true) |
There was a problem hiding this comment.
When this task is launched from the refresh that detected the expired window, that same refresh generation can still be present in providerRefreshTasks until its async cleanup runs. If the ping command returns quickly (for example with an overridden binary/prompt or a cached local CLI response), coalesceIfRefreshing: true only waits on that already-scheduled generation and then returns, so no post-ping fetch happens and the menu can keep showing the expired/no-window state until the next timer. Start an uncoalesced refresh after the ping, or wait for the scheduling refresh to be removed before coalescing.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Valid, the post-ping refresh was coalescing with a still-registered triggering refresh generation. I changed it to call refreshProvider(provider) uncoalesced so a successful ping always schedules a fresh provider fetch.
Added a test with a lingering completed refresh state in providerRefreshTasks; it verifies the scheduler still performs a new refresh after the ping.
- Start a new refresh after a successful ping - Cover the lingering refresh task race in tests
- Drop ephemeral mode from Codex rolling pings - Assert the Codex ping command keeps session output
- Log each auto-start attempt with route metadata - Log provider responses and verification outcome - Include stable timestamps for inactive-window tracing
- Redact managed account route labels in auto-start logs - Cover route labels and timestamp metadata formatting
- Allow openai-web and claude web or oauth routing checks\n- Block auto-start when the prompt account cannot be verified\n- Add coverage for scheduler routing and exhausted quota windows
- Schedule dashboard-owned Codex rolling window pings - Ignore Claude model-specific exhaustion for Haiku pings
- Add precise skip messages for routing block reasons - Document session-window handling and fail closed for unsupported routes - Cover OpenAI web dashboard overwrite behavior
- Treat text-only rolling windows as active when appropriate - Track one-shot auto-start attempts without cached resets - Add coverage for dashboard and scheduler verification paths
- Treat expired reset timestamps as inactive - Restrict no-history starts to OpenAI web snapshots
- Track reset source explicitly in auto-start logs - Clear stale route retry state on source changes and verified starts
- Keep stale refreshed resets from clearing retry state - Cover expired refreshed reset verification
2 participants
Summary
Adds an opt-in Auto-start rolling window setting for Codex and Claude.
After a previously active five-hour window expires, a refresh that confirms no active replacement can send one tiny prompt through the matching provider CLI, then refresh usage again.
Safety boundaries
--no-session-persistence.Commands
codex exec --skip-git-repo-check -m gpt-5.4-mini -c model_reasoning_effort=lowclaude -p --no-session-persistence --model haikuThe prompt, timeout, binary, model, and reasoning level remain locally overridable through the documented
CODEXBAR_ROLLING_WINDOW_<PROVIDER>_*environment keys.Validation
swift test --filter RollingWindowAutoStartTests— 16 tests passedmake check— passed, 0 lint violationsclaude --help— confirms--no-session-persistenceis supported only with print modecodex exec --help— confirms--skip-git-repo-checkorigin/main— clean, no accepted/actionable findings, correctness confidence 0.785bd575468051b8905af48958bea172295e2b807dMerge status
Prepared, not approved for merge. This intentionally consumes provider quota in the background and still needs maintainer product/auth sign-off plus redacted real-provider behavior proof from the current head.