Skip to content

chore: add reproducible Codex Cloud environment - #1438

Merged
BigSimmo merged 2 commits into
mainfrom
codex/chat-codex-cloud-setup-c1a2
Jul 30, 2026
Merged

chore: add reproducible Codex Cloud environment#1438
BigSimmo merged 2 commits into
mainfrom
codex/chat-codex-cloud-setup-c1a2

Conversation

@BigSimmo

Copy link
Copy Markdown
Owner

Summary

  • Add reproducible Codex Cloud setup and maintenance scripts for the repository's Node/npm, Deno, Python/OCR, and Playwright toolchain.
  • Default Cloud agent shells to provider-free demo/offline behavior and explicitly remove known provider and GitHub shell credentials.
  • Add a static/runtime Cloud acceptance checker, a focused contract test, and setup documentation covering local parity, secrets, and GitHub connector boundaries.

Why

Codex Cloud is an isolated Linux environment and does not inherit Windows files, .env.local, desktop sessions, plugins, OAuth sessions, local services, or uncommitted work. The checked-in environment contract makes the supported overlap with local development reproducible without copying credentials or enabling live providers.

Files and areas touched

  • AGENTS.md, README.md, and docs indexes
  • docs/codex-cloud.md
  • scripts/setup-codex-cloud.sh
  • scripts/maintain-codex-cloud.sh
  • scripts/check-codex-cloud-setup.mjs
  • package.json scripts
  • tests/codex-cloud-setup.test.ts

Verification

  • npm ci --include=dev — passed under the repository exclusive coordinator; 648 packages installed.
  • npm run check:installed-lock-parity — passed for Next 16.2.12, React/ReactDOM 19.2.8, ESLint 9.39.5, Playwright 1.62.0, TypeScript 6.0.3, and Vitest 4.1.10.
  • npm test -- tests/codex-cloud-setup.test.ts — 1 file passed, 2 tests passed.
  • npm run check:codex-cloud — passed.
  • npm run docs:check-scripts — 386 npm-run references resolved.
  • npm run docs:check-links — 1,357 repo path references resolved.
  • npm run docs:check-index — all 31 top-level modules/routes and schema tables indexed.
  • Git Bash bash -n for both Cloud shell scripts — passed.
  • node --check scripts/check-codex-cloud-setup.mjs — passed.
  • npm run format — passed across the repository; only the intended ten files changed.
  • npm run check:rag:fixtures — passed, 36 golden cases and 21 suites.
  • npm run verify:pr-local -- --files ... — runtime, installed-lock parity, changed-file formatting, and lint passed. The command stopped before typecheck because another worktree's Chromium run filled coordinator capacity.
  • git diff --check and staged diff check — passed.
  • Pre-push committed-SHA formatting hook — passed.

Checks not run

  • The PR-local typecheck, full test suite, and production build were not run because the shared repository coordinator denied the typecheck phase while another worktree owned focused capacity.
  • The setup script was not executed end to end in an OpenAI-managed Linux Cloud container; the documented first Cloud task performs that final runtime acceptance.
  • No provider-backed checks, hosted CI mutations, deployments, production data access, or live API tests were run.

Risks and limitations

  • Browser and OCR package installation depends on the managed Linux image and setup-time internet; reset the Cloud environment cache if a required executable is missing.
  • GitHub repository discovery/clone permission is separate from agent-shell git push/gh credentials. The setup intentionally does not add a PAT; publishing should use the Codex GitHub integration.
  • Local npm reported 9 high-severity dependency advisories during install. This PR does not change dependency versions and did not apply forced audit fixes.

RAG impact: no retrieval behaviour change — Cloud setup, documentation, and tests only.

@coderabbitai

coderabbitaiBot commented Jul 30, 2026

Copy link
Copy Markdown
Contributor

Warning

Review limit reached

You’ve reached a temporary PR review limit under our Fair Usage Limits Policy.

Your recent review volume is higher than typical usage, so adaptive limits are currently applied.

Next review available in:2 minutes

Your organization has reached its usage spending cap. Adjust your spending cap in the billing tab.

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 40a28296-84e7-442c-af34-211460031a84

📥 Commits

Reviewing files that changed from the base of the PR and between 040ce97 and f13c261.

📒 Files selected for processing (10)
  • AGENTS.md
  • README.md
  • docs/README.md
  • docs/codex-cloud.md
  • docs/scripts-index.md
  • package.json
  • scripts/check-codex-cloud-setup.mjs
  • scripts/maintain-codex-cloud.sh
  • scripts/setup-codex-cloud.sh
  • tests/codex-cloud-setup.test.ts

Comment @coderabbitai help to get the list of available commands.

@supabase

supabaseBot commented Jul 30, 2026

Copy link
Copy Markdown

This pull request has been ignored for the connected project sjrfecxgysukkwxsowpy because there are no changes detected in supabase directory. You can change this behaviour in Project Integrations Settings ↗︎.


Preview Branches by Supabase.
Learn more about Supabase Branching ↗︎.

@chatgpt-codex-connectorchatgpt-codex-connectorBot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit:55541027c4

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Comment threadpackage.json
Comment threadscripts/maintain-codex-cloud.sh
@BigSimmo

Copy link
Copy Markdown
OwnerAuthor

@codex resolve actionable Codex review findings for this pull request and current head using the repository instructions. This is the pull request's single automatic repair pass: do not perform a fresh review, create new standalone findings, or request another review. Work only the existing unresolved Codex threads on the current head. Always fix P0 and P1 findings. For P2 and lower findings, fix only clear, scoped, low-risk issues; otherwise disposition them with a concise reason. After fixing or dispositioning a thread, reply in that thread with as the first line, followed by a concise summary; that marker authorizes the workflow to close that exact thread. If human input or new authorization is required, do not use the marker and leave the thread open with the blocker. Finish only after every actionable thread is fixed or dispositioned and closed, or explicitly left open for a human decision. Do not update the branch from main, address unrelated reviews, broaden scope, or create more than one scoped fix commit. Do not use external APIs, paid services, credentials, dependency changes, or broad refactors unless explicitly authorized. Add targeted tests where behavior changes and run the narrowest relevant validation.

@chatgpt-codex-connector

Copy link
Copy Markdown

Codex Review: Didn't find any major issues. 🚀

Reviewed commit:f13c261ee9

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@BigSimmo
BigSimmo enabled auto-merge (squash) July 30, 2026 11:19
@BigSimmo
BigSimmo merged commit 95f9333 into mainJul 30, 2026
68 checks passed
@BigSimmo
BigSimmo deleted the codex/chat-codex-cloud-setup-c1a2 branch July 30, 2026 11:23
BigSimmo pushed a commit that referenced this pull request Jul 30, 2026
Codex review is right: the new check accepted `unset` alongside
`unspecified`, and those are not the same state. Per gitattributes, an
Unspecified `merge` attribute is the documented default 3-way text merge —
the contract this PR establishes — while Unset (`-merge`) takes the current
branch's version and declares the merge conflicted, so every two-sided edit
becomes a manual resolution. A global or future attributes file could
therefore have violated the contract with the gate still printing "no merge
driver".
Reproduced before fixing: appending `docs/outstanding-issues.md -merge` made
`git check-attr` report `merge: unset` and the guard passed. It now fails
with a message naming the Unset/Unspecified distinction and telling the
reader to drop the negated attribute rather than add one.
The acceptance decision moves into an exported `mergeAttributeProblem` so
the distinction is unit-tested rather than only reasoned about, with four
cases in tests/repo-hygiene.test.ts: `unspecified` accepted; `unset`,
`union`/`ledger`, and an empty reading all rejected. The empty case matters
because an unparsed check-attr output would otherwise make the whole check
vacuous.
Verified: with `-merge` present the gate fails on the new message; with it
removed it passes "no merge driver". repo-hygiene 47 passed (47).
verify:cheap exit 0 — Test Files 435 passed (435), Tests 4508 passed |
4 skipped (4512). Whole-tree prettier clean. (Test total differs from this
branch's earlier run because it now carries main's #1423/#1427/#1438; this
commit adds four.)
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XrPbbfU9yWuEjEVypCr4ZQ
BigSimmo added a commit that referenced this pull request Jul 30, 2026
* fix(ledger): remove merge=union from the issues ledger, per its own #133
Ledger #133 already recorded union as the wrong driver for this file —
"two sides each bumping the marker produce two `next-id` lines, corrupting
the file silently where a conflict would fail loudly" — but `.gitattributes`
still set it and `check-outstanding-issues.mjs` *required* it, so the repo's
own tested conclusion was contradicted by its own config.
PR #1430 confirmed the cost at scale: four merges in one session, each
reporting success while duplicating the entire open-items table
(`#59 appears 2 times (lines 101, 166)` and so on for every row), each
needing a manual rebuild from origin/main. Union also makes `git merge-tree`
report a clean tree, so the pre-merge conflict check cannot warn.
Unlike docs/branch-review-ledger.md — which keeps its custom `merge=ledger`
driver, union plus exact-row dedupe — this file allocates IDs by
read-modify-write. Concurrent appends therefore need manual renumbering
whatever the driver does (hit twice on 2026-07-30: #125 and #135 collisions),
so union bought nothing and only hid the overlap. Default 3-way merge
conflicts honestly instead.
The gate's attribute check is inverted rather than deleted, so a driver
reappearing here is a red gate. AGENTS.md, docs/process-hardening.md,
.claude/skills/issues/SKILL.md and docs/scripts-index.md are updated to
match, and #133's driver half is marked resolved with its still-open half
(fixed-width padding making every row edit one hunk) left intact.
Verified: reintroducing `docs/outstanding-issues.md merge=union` fails the
gate with "must have NO merge driver (found merge=union)", and removing it
passes with "no merge driver" — the gate bites, not just passes.
verify:cheap exit 0: Test Files 434 passed (434), Tests 4563 passed |
4 skipped (4567). Whole-tree prettier clean.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XrPbbfU9yWuEjEVypCr4ZQ
* fix(gate): reject `-merge` too, not just a named driver
Codex review is right: the new check accepted `unset` alongside
`unspecified`, and those are not the same state. Per gitattributes, an
Unspecified `merge` attribute is the documented default 3-way text merge —
the contract this PR establishes — while Unset (`-merge`) takes the current
branch's version and declares the merge conflicted, so every two-sided edit
becomes a manual resolution. A global or future attributes file could
therefore have violated the contract with the gate still printing "no merge
driver".
Reproduced before fixing: appending `docs/outstanding-issues.md -merge` made
`git check-attr` report `merge: unset` and the guard passed. It now fails
with a message naming the Unset/Unspecified distinction and telling the
reader to drop the negated attribute rather than add one.
The acceptance decision moves into an exported `mergeAttributeProblem` so
the distinction is unit-tested rather than only reasoned about, with four
cases in tests/repo-hygiene.test.ts: `unspecified` accepted; `unset`,
`union`/`ledger`, and an empty reading all rejected. The empty case matters
because an unparsed check-attr output would otherwise make the whole check
vacuous.
Verified: with `-merge` present the gate fails on the new message; with it
removed it passes "no merge driver". repo-hygiene 47 passed (47).
verify:cheap exit 0 — Test Files 435 passed (435), Tests 4508 passed |
4 skipped (4512). Whole-tree prettier clean. (Test total differs from this
branch's earlier run because it now carries main's #1423/#1427/#1438; this
commit adds four.)
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01XrPbbfU9yWuEjEVypCr4ZQ
---------
Co-authored-by: Claude <noreply@anthropic.com>
Sign up for freeto join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant

@BigSimmo