Live AWS E2E hit ERR_MODULE_NOT_FOUND on the box: tsdown externalizes
package.json dependencies, so the shipped dist was never self-contained
and the bundle channel installed no deps (the npm channel gets them from
npm install). Bundle staging now prunes the manifest (workspace: specs
are compiled into dist; devDependencies/scripts/pnpm never ship) and
bootstrap runs a script-free production npm install after extraction.
Portable manifests keep byte-identical staging so receipts stay stable.
Launcher failure forensics keep the stderr head where Node names the
missing module.
* fix(gateway): hot-reload worktrees.cleanup config instead of restarting the gateway
* fix(ci): drop unused settings-ui type exports and SECTION_META re-export
* feat(codex): read the account email with app-server usage
The Codex-harness usage snapshot now carries the account identity: the
usage fetch runs account/rateLimits/read and account/read over one
app-server session (new withCodexAppServerJsonClient seam, which the
single-request helper now delegates to), so the email is guaranteed to
belong to the same account as the windows. Identity stays best-effort;
rate limits survive an account read failure.
* style(test): scanner-safe app-server marker fixture
* test(codex): keep scanner-neutral hunks around app-server marker literals
* fix(codex): bound the best-effort account read within the usage deadline
Review P2: account/read shared the outer usage deadline, so a slow or hung
identity read could reject the whole snapshot with a timeout instead of
returning the already-fetched rate-limit windows. Race the account read
against a local timer bounded to min(4s, usageTimeoutMs/3) and drop the
identity on timeout; a regression test hangs account/read and asserts the
windows still return.
* fix(codex): send account/read params and bound identity by the remaining deadline
Second review round: account/read (GetAccount) requires a params object per
the app-server protocol, so send an empty {} (refreshToken defaults false);
without it a real app-server rejects the request. Bound the best-effort
identity read by the time left before the shared usage deadline (minus a
margin) instead of the original budget, so a slow rate-limit read can no
longer let the identity read trip the outer timeout and discard the
already-fetched windows.
* fix(codex): reserve the isolated shutdown budget in the usage deadline
Third review round: withCodexAppServerJsonClient awaits the isolated
client's closeAndWait inside the outer timeout, so a hung account/read
could reach the deadline during force-kill/exit cleanup and discard the
already-fetched windows. The usage read now passes a cheap isolatedShutdown
(force-kill 200ms + exit 300ms) and the identity bound reserves that plus a
250ms margin (750ms) of the remaining deadline, so cleanup always finishes
before the outer timeout.
* style(codex): rename scoped-request generic to avoid shadowing
crabbox run rsyncs the invoking repo by default, which blew the setup
budget when the gateway provisioned from a source checkout. Workspace
transfer is owned by the worker tunnel, so setup passes --no-sync.
Live AWS E2E hit the designed fail-stop: worker bootstrap requires Node on
the leased host, and bare AWS leases ship without it. Implement the plan's
provider setup phase as an opt-in `setup` profile key: after the lease is
SSH-ready the provider runs the command via `crabbox run --keep=true`,
gets its own timeout budget on top of provision, and stops the lease
before surfacing a failure so no unbootstrapped box leaks. Setup runs on
every provision attempt (including replay adoption), so commands must be
idempotent.
Replaces the Settings -> Worktrees column grid (which collapsed to unlabeled
stacked cells at common window widths) with list-item rows: name + status
chip, repo/branch/owner meta line, right-aligned last-active + actions.
Rows sort by most recent activity. Deletes the now-unused generic .table
CSS family and stale column-header i18n keys.
Live cloud-worker E2E surfaced that sessions.dispatch was advertised but
dispatched as 'unknown method': the handler existed in sessions.ts but was
never added to the lazy method-to-loader table — the same class of break
terminal.attach/list/text shipped with. Add the route and broaden the
existing terminal.*-only completeness test to every core descriptor
(aux-injected and control-ui methods excluded explicitly).
Both settings grant local UI automation, so run PeekabooBridge only while
Allow Computer Control is on. The toggle now reflects the effective state and
is disabled when Computer Control is off; users drive Peekaboo via its own Mac
app in that case. Removes the confusing standalone bridge switch.
The settings shell capped page headers at 1120px while narrow settings
pages use a 760px column, leaving the title floating left of the
content. The header now adopts the column width of the page below it
(760px default, 1120px for wide pages); fill-height surfaces without a
settings-page column are unchanged.
