chore(upstream): sync stable v1.24.0

.agents/skills/codex-review-loop/SKILL.md

@@ -59,7 +59,13 @@ Launch the adversarial review as a background process.
    cat <prompt-file> | bash <skill-dir>/scripts/codex-subagent.sh --uncommitted
    ```
 2. Inform the user the review is running (~20-50 min).
-3. The script parses Codex output and returns the final review text.
+3. The script parses Codex output and returns the final review text. Review
+   rollouts intentionally remain persistent. If terminal output is lost, use
+   `codex resume --include-non-interactive` to locate the review, or
+   `codex resume <SESSION_ID>` when its ID is known. Do not add
+   `--ephemeral` to the wrapper. The wrapper also relies on the configured
+   non-interactive approval/sandbox policy because Codex CLI 0.147.0 removed
+   the historical `--full-auto` argument from `exec review`.
 
 ### Error handling
 

.agents/skills/codex-review-loop/scripts/codex-subagent.sh

@@ -33,7 +33,11 @@ while [[ $# -gt 0 ]]; do
   esac
 done
 
-CODEX_ARGS+=("--full-auto" "--ephemeral")
+# Reviews commonly outlive the invoking terminal or exceed its output cap, so
+# do not add `--ephemeral`: the persistent rollout is the recovery path after
+# either failure. Also do not restore the historical `--full-auto` argument;
+# Codex CLI 0.147.0 removed it from `exec review`, which already uses the
+# configured non-interactive approval and sandbox policy.
 
 # --- Model overrides ---
 if [[ -n "${CODEX_REVIEW_MODEL:-}" ]]; then

.all-contributorsrc

@@ -1223,6 +1223,96 @@
         "code"
       ]
     },
+    {
+      "login": "kidclone3",
+      "name": "DuyBui",
+      "avatar_url": "https://avatars.githubusercontent.com/u/54184969?v=4",
+      "profile": "https://github.com/kidclone3",
+      "contributions": [
+        "code",
+        "test"
+      ]
+    },
+    {
+      "login": "kevinsslin",
+      "name": "Kevin Lin",
+      "avatar_url": "https://avatars.githubusercontent.com/u/86810837?v=4",
+      "profile": "https://github.com/kevinsslin",
+      "contributions": [
+        "code",
+        "test"
+      ]
+    },
+    {
+      "login": "Borealin",
+      "name": "Borealin",
+      "avatar_url": "https://avatars.githubusercontent.com/u/41241077?v=4",
+      "profile": "https://github.com/Borealin",
+      "contributions": [
+        "code",
+        "test"
+      ]
+    },
+    {
+      "login": "BrenticusMaximus",
+      "name": "BrenticusMaximus",
+      "avatar_url": "https://avatars.githubusercontent.com/u/32489248?v=4",
+      "profile": "https://github.com/BrenticusMaximus",
+      "contributions": [
+        "code",
+        "test"
+      ]
+    },
+    {
+      "login": "sakthimaran-venom",
+      "name": "Sakthimaran",
+      "avatar_url": "https://avatars.githubusercontent.com/u/233523816?v=4",
+      "profile": "https://github.com/sakthimaran-venom",
+      "contributions": [
+        "code",
+        "test"
+      ]
+    },
+    {
+      "login": "evan-choi",
+      "name": "Evan",
+      "avatar_url": "https://avatars.githubusercontent.com/u/9690415?v=4",
+      "profile": "https://github.com/evan-choi",
+      "contributions": [
+        "code"
+      ]
+    },
+    {
+      "login": "chaoxu",
+      "name": "Chao Xu",
+      "avatar_url": "https://avatars.githubusercontent.com/u/18860?v=4",
+      "profile": "https://chaoxu.prof/",
+      "contributions": [
+        "code",
+        "test"
+      ]
+    },
+    {
+      "login": "zenasharp",
+      "name": "zenasharp",
+      "avatar_url": "https://avatars.githubusercontent.com/u/170236008?v=4",
+      "profile": "https://github.com/zenasharp",
+      "contributions": [
+        "code",
+        "test",
+        "doc"
+      ]
+    },
+    {
+      "login": "hanseo0507",
+      "name": "HanSu Lee",
+      "avatar_url": "https://avatars.githubusercontent.com/u/56479293?v=4",
+      "profile": "https://github.com/hanseo0507",
+      "contributions": [
+        "code",
+        "test"
+      ]
+    },
     {
       "login": "hongzexin",
       "name": "Jason HONG",
@@ -1231,7 +1321,7 @@
       "contributions": [
         "code",
         "test",
-        "doc"
+        "maintenance"
       ]
     }
   ],

.github/CONTRIBUTING.md

@@ -193,7 +193,7 @@ PR titles must follow the same format — that's the title release-please reads.
 2. Make atomic commits with Conventional Commit titles.
 3. Run the lint/test gate locally (see above).
 4. Open a PR using the template. Link the relevant issue.
-5. Codex Review (and a human maintainer) will review. Address feedback by
+5. CodeRabbit (and a human maintainer) will review. Address feedback by
    pushing follow-up commits — no force-pushing during active review.
 6. Once approved and CI is green, a maintainer squash-merges with a clean
    Conventional Commits title.
@@ -215,16 +215,11 @@ Before a PR is squash-merged into `main`:
    `CI Required` check is the branch-protection check to require: it
    depends on every CI job and also runs for merge queue synthetic merge
    groups, so a stale PR head cannot bypass a broken merge result.
-2. **`@codex review` must be clean — or its findings addressed — on the
-   merge-target head.** Every PR triggers `@codex review` at least once
-   against the head that's about to be merged. Local `codex review
-   --base origin/main` runs are encouraged but don't substitute for the
-   cloud review (the cloud `@codex review` reliably catches things the
-   local run misses).
-   The `🤖 codex: ok` label is maintained by the trusted
-   `Codex review labels` workflow from current-head CI and current-head
-   Codex review evidence. Treat the label as an audit aid, not as a
-   substitute for branch protection or merge queue checks.
+2. **Actionable CodeRabbit findings must be fixed or explicitly addressed
+   or dismissed in-thread on the merge-target head.** Review the current-head
+   CodeRabbit findings before merging; no finding may be silently skipped.
+   Local `codex review --base origin/main` runs remain an encouraged extra
+   tool, but they are not a merge gate and do not substitute for CodeRabbit.
    - **P1 findings**: fix in the PR, or justify in-thread with a short
      write-up of why the finding doesn't apply. No silent skipping.
    - **P2 findings**: fix in the PR, or open a follow-up issue and link
@@ -297,7 +292,7 @@ self-merge escape hatch applies:
 
 - If a collaborator's PR has been waiting on a maintainer merge for
   **more than 14 days** with **all merge gates met** (CI green,
-  `@codex review` clean or findings addressed, `mergeable=CLEAN`, no
+  CodeRabbit findings addressed, `mergeable=CLEAN`, no
   outstanding requested-changes review, no objection from any other
   active collaborator in the thread), the PR author may self-merge.
 - Self-merge under this clause **must** include a comment on the PR
@@ -311,8 +306,8 @@ self-merge escape hatch applies:
 
 These rules are intentionally lightweight. They don't require:
 
-- A second human reviewer in addition to `@codex review` for every PR.
-  Codex review + the PR author + a maintainer merge is the baseline.
+- A second human reviewer in addition to CodeRabbit for every PR.
+  CodeRabbit review + the PR author + a maintainer merge is the baseline.
 - Squash-merge commit message rewriting beyond the Conventional Commits
   title. The PR description ends up in the body; that's enough.
 - A formal escalation process for disagreements. If a P1 finding is

.github/release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "1.23.0"
+  ".": "1.24.0"
 }

.github/scripts/check_simplicity_budgets.py

@@ -1,9 +1,11 @@
 #!/usr/bin/env python3
-"""Enforce simplicity budgets on README, .env.example, and the dashboard core nav.
+"""Enforce simplicity budgets on README, .env.example, the dashboard core nav, and the tracked root tree.
 
 Budgets live in .github/simplicity-budgets.toml and are enforced by
 .github/workflows/simplicity-budgets.yml. Intentionally stdlib-only so it runs
-on the runner's python3 before project dependencies are installed.
+on the runner's python3 before project dependencies are installed; the
+[root_files] check additionally shells out to `git ls-tree` against the
+checkout's HEAD.
 
 Override: the 'simplicity-budget-approved' PR label (passed in via the
 PR_LABELS env var as a JSON array of label names) downgrades violations to
@@ -12,15 +14,16 @@
 
 Exit codes: 0 = within budget (or overridden), 1 = over budget,
 2 = configuration error (the budget config is missing or malformed, a
-budgeted file or the nav array is missing, or an ALL-CONTRIBUTORS-LIST
-block is opened but never closed).
+budgeted file or the nav array is missing, the tracked root tree cannot
+be listed, or an ALL-CONTRIBUTORS-LIST block is opened but never closed).
 """
 
 from __future__ import annotations
 
 import json
 import os
 import re
+import subprocess
 import sys
 import tomllib
 from pathlib import Path
@@ -129,6 +132,34 @@ def count_nav_items(path: Path, array: str) -> int:
     return len(re.findall(r"\bto:\s*[\"']", match.group("body")))
 
 
+def _escape_annotation_value(value: str) -> str:
+    """Escape a contributor-controlled value for a workflow-command line ('%' first, per Actions rules)."""
+    for char, escape in (("%", "%25"), ("\r", "%0D"), ("\n", "%0A"), (":", "%3A"), (",", "%2C")):
+        value = value.replace(char, escape)
+    return value
+
+
+def list_tracked_root_entries() -> list[str]:
+    """List tracked repository-root entries from HEAD; exit 2 loudly if git cannot."""
+    try:
+        proc = subprocess.run(
+            ["git", "ls-tree", "--name-only", "-z", "HEAD"],
+            capture_output=True,
+            encoding="utf-8",
+            # Non-UTF-8 filename bytes become \x escapes: they can never match
+            # an allowlist entry, so they surface as a named violation instead
+            # of a decode crash.
+            errors="backslashreplace",
+            check=True,
+        )
+    except FileNotFoundError:
+        _config_error("[root_files] git executable not found; the root-entry budget needs a git checkout")
+    except subprocess.CalledProcessError as exc:
+        detail = (exc.stderr or "").strip() or f"exit code {exc.returncode}"
+        _config_error(f"[root_files] 'git ls-tree --name-only HEAD' failed: {detail}")
+    return [entry for entry in proc.stdout.split("\0") if entry]
+
+
 def _override_labels() -> list[str]:
     raw = os.environ.get("PR_LABELS") or "[]"
     try:
@@ -164,9 +195,26 @@ def main() -> int:
     except (KeyError, TypeError, ValueError) as exc:
         _config_error(f"budget config '{CONFIG_PATH}' is missing or has a malformed section/key: {exc!r}")
 
+    # [root_files] is optional: absent means the root-entry budget is not
+    # enforced (older configs keep working), present-but-malformed is a
+    # config error like any other section.
+    root_allowed: set[str] | None = None
+    root_cfg = config.get("root_files")
+    if root_cfg is not None:
+        try:
+            allowed_entries = root_cfg["allowed"]
+        except (KeyError, TypeError) as exc:
+            _config_error(f"budget config '{CONFIG_PATH}' has a malformed [root_files] section: {exc!r}")
+        if not isinstance(allowed_entries, list) or not all(isinstance(entry, str) for entry in allowed_entries):
+            _config_error(f"budget config '{CONFIG_PATH}' [root_files] 'allowed' must be an array of strings")
+        root_allowed = set(allowed_entries)
+
     readme_lines = strip_contributors_block(_read_lines(readme_path, "readme"))
     env_lines = _read_lines(env_path, "env_example")
     nav_items = count_nav_items(nav_path, nav_array)
+    unexpected_root_entries: list[str] = []
+    if root_allowed is not None:
+        unexpected_root_entries = sorted(set(list_tracked_root_entries()) - root_allowed)
 
     metrics: list[tuple[str, Path, int, int]] = [
         (
@@ -192,12 +240,25 @@ def main() -> int:
         if actual > budget:
             violations.append((name, path, actual, budget))
 
-    if not violations:
+    if root_allowed is not None:
+        status = "OK" if not unexpected_root_entries else "OVER"
+        print(f"tracked root entries outside allowlist: {len(unexpected_root_entries)}/0 {status}")
+
+    if not violations and not unexpected_root_entries:
         return 0
 
     annotation = "warning" if overridden else "error"
     for name, path, actual, budget in violations:
         print(f"::{annotation} file={path}::simplicity budget exceeded: {name}: {actual} > {budget}")
+    for entry in unexpected_root_entries:
+        # Entry names come from the tree, not the trusted config: escape them
+        # so a crafted filename cannot break or forge workflow-command lines.
+        shown = _escape_annotation_value(entry)
+        print(
+            f"::{annotation} file={shown}::simplicity budget exceeded: tracked root entry '{shown}' is not in "
+            f"the [root_files] allowlist — add it to {CONFIG_PATH} in the same diff, or a maintainer applies "
+            f"the '{OVERRIDE_LABEL}' PR label"
+        )
 
     if overridden:
         print(f"Budgets exceeded, but the '{OVERRIDE_LABEL}' label is applied; passing with warnings. {OVERRIDE_HELP}")