fix(server): one-click provider updates no longer wedge brew-installed Codex on macOS

[t3dotgg]

Codex broke on a machine right before the stable cut: the provider status check timed out and the model picker showed no models. The cause was not a recent merge. A fresh `brew` cask install of codex left the binary quarantined, and macOS blocked every exec behind a Gatekeeper approval prompt that a background server can never answer. The T3 probe then timed out forever.

Our one-click provider update runs the same command (`brew upgrade codex`), so any stable user with a brew-installed Codex who clicks Update reproduces this exact wedge. This PR passes `--no-quarantine` to `brew upgrade` for Homebrew-managed providers, so the updated binary is never quarantined. The flag is a no-op for formulae and only changes cask behavior. Verified the flag parses with `brew upgrade --dry-run --no-quarantine codex` (exit 0).

Changes by Claude Fable 5 via Claude Code.

---

Note

Low Risk
Narrow change to Homebrew upgrade flags for provider maintenance; slightly relaxes quarantine on cask upgrades but targets a known headless-server failure mode.

Overview
Fixes one-click Homebrew provider updates wedging provider health checks on macOS when the installed tool is a cask whose binary gets quarantined after brew upgrade.

Homebrew-managed provider maintenance now runs brew upgrade --no-quarantine <formula> instead of plain brew upgrade. The flag avoids Gatekeeper quarantine on cask binaries so the T3 server can execute the provider probe without a manual approval dialog; it is documented as a no-op for formulae. Expectations in providerMaintenance.test.ts for Homebrew-resolved binaries are updated to match the new command and args.

^{Reviewed by Cursor Bugbot for commit 3c736e4. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Add --no-quarantine flag to Homebrew update args in makeHomebrewProviderMaintenanceCapabilities

One-click provider updates invoke brew upgrade with a new --no-quarantine argument inserted before the formula identifier. This prevents macOS Gatekeeper quarantine from wedging brew-installed Codex after an update. Tests in providerMaintenance.test.ts are updated to expect the new argument shape.

^{Macroscope summarized 3c736e4.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: e3213020-f054-42cd-a027-b7ba8d79d2e0

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	−2 B (−0.0%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	−2 B (−0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	0 B (0.0%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	55.6 KiB	0 B (0.0%)	66.4 KiB	✅
Codex	Live turn messages	10	10	0 (0.0%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	−19 B (−0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	−4 B (−0.1%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−15 B (−0.2%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.4 KiB	−44 B (−0.1%)	66.4 KiB	✅
Claude	Live turn messages	11	10	−1 (−9.1%)	21	✅

Baseline: badae6a · PR result: 3c736e4 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 3c736e4. Configure here.}

[cursor]

Removed brew flag breaks updates

High Severity

--no-quarantine was disabled in Homebrew 5.1.0 and fully removed in July 2026, so current brew upgrade rejects it with an invalid/unknown-option error. providerMaintenanceRunner treats any non-zero exit as a failed update, so one-click Homebrew updates for Codex (and other brew-routed providers) fail instead of fixing the Gatekeeper wedge.

 

^{Reviewed by Cursor Bugbot for commit 3c736e4. Configure here.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The PR changes production Homebrew update commands and intentionally bypasses binary quarantine for affected providers. An unresolved concrete review finding reports that the added flag is rejected by newer Homebrew versions, potentially causing one-click updates to fail.

^{You can add or adjust custom eligibility rules. Learn more.}