feat(ci): download macOS preview DMGs without signing in

[t3dotgg]

Preview DMGs from preview:mac PRs upload as Actions artifacts, and GitHub requires a signed-in account to download those. That breaks testing on headless devices. For a public repo the login gate adds no real protection, since any GitHub account can already download them.

Now the workflow publishes each DMG as an asset on a rolling desktop-preview prerelease. Release assets download anonymously with a stable URL, so curl from a headless box works. The PR comment links to that URL.

How it stays safe and tidy:

• The build job keeps a read-only token and still runs PR code. A new publish job holds the write token, and it only downloads the built artifact and talks to the GitHub API. It never checks out PR code.
• One rolling prerelease holds all preview DMGs. Publishing a new build uploads an asset instead of creating a release, so release watchers get no notification and the releases page gets no clutter. The desktop-preview tag does not match the v*.*.* pattern in release.yml.
• Each PR keeps one DMG on the release. A new build replaces the old one.
• A cleanup job deletes the PR's DMG and updates the comment when the PR closes or the label comes off. This replaces the old 7-day artifact expiry.

Build restrictions are unchanged: same-repo PRs with the preview:mac label only, unsigned build, no Apple secrets.

Change made by Claude Fable 5 running in Claude Code.

---

Note

Medium Risk
Introduces release publishing and asset deletion driven by PR events, but mitigated by isolating write permissions to jobs that do not run PR code and by filename and PR-state guards against cross-PR clobbering.

Overview
macOS preview builds no longer rely on Actions artifacts (which require a GitHub login). A new publish job uploads each DMG to a rolling desktop-preview prerelease and the PR comment links to the public release asset URL so headless testers can curl without signing in.

The build job still runs PR code with read-onlycontents; publish and cleanup hold contents: write and never check out PR code. publish re-checks that the PR is still open and labeled before and after upload, and refuses filenames that lack this PR’s ‑pr.N. marker so one build cannot touch another PR’s assets. cleanup runs on PR close or preview:mac removal, deletes matching release assets, and updates the comment; it skips if the label was re-applied.

Workflow triggers now include unlabeled and closed. Concurrency is split into separate build vs cleanup groups so in-flight cleanups are not canceled mid-delete and unrelated label events do not cancel builds.

^{Reviewed by Cursor Bugbot for commit 5c4c7e4. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Publish macOS preview DMGs as public release assets

• Adds a publish job that uploads the built DMG to a rolling prerelease tagged desktop-preview, so download links are public and require no GitHub sign-in. Prior assets for the same PR are deleted before upload, and the upload is reverted if the PR is closed or loses the preview:mac label mid-publish.
• Adds a cleanup job that deletes a PR's DMG from the release when the PR is closed or the preview:mac label is removed, then updates the PR comment to note removal.
• Reworks workflow concurrency to distinguish build runs from cleanup runs so cleanup is never canceled mid-delete; build runs are still canceled on superseding pushes.
• The build job now exposes dmg_name and version as job outputs for publish to consume, and skips on closed or unlabeled events.
• Risk: publish uses a rolling tag desktop-preview with multiple PR assets coexisting; the deletion logic in publish and cleanup matches assets by the -pr.<PR_NUMBER>. filename marker, so any asset not matching that pattern will not be managed or removed.

^{Macroscope summarized 5c4c7e4.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: bc404ffb-5ee4-4300-8fb6-d5c00d3afb90

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	−15 B (−0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+3 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−18 B (−0.3%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	55.6 KiB	−44 B (−0.1%)	66.4 KiB	✅
Codex	Live turn messages	11	10	−1 (−9.1%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	−17 B (−0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+2 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−19 B (−0.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.4 KiB	−44 B (−0.1%)	66.4 KiB	✅
Claude	Live turn messages	11	10	−1 (−9.1%)	21	✅

Baseline: 5041777 · PR result: 5c4c7e4 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[github-actions]

macOS preview

The preview download was removed because this PR closed or the preview label was removed.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 12d31ce. Configure here.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This adds a new public DMG distribution workflow with release creation, asset replacement/deletion, PR-comment updates, and write permissions driven by PR events. The release lifecycle and permission-boundary changes have broader operational impact than a minor CI tweak.

^{You can add or adjust custom eligibility rules. Learn more.}

[t3dotgg]

Preview DMGs from preview:mac PRs upload as Actions artifacts, and GitHub requires a signed-in account to download those. That breaks testing on headless devices. For a public repo the login gate adds no real protection, since any GitHub account can already download them.

Now the workflow publishes each DMG as an asset on a rolling desktop-preview prerelease. Release assets download anonymously with a stable URL, so curl from a headless box works. The PR comment links to that URL.

How it stays safe and tidy:

• The build job keeps a read-only token and still runs PR code. A new publish job holds the write token, and it only downloads the built artifact and talks to the GitHub API. It never checks out PR code.
• One rolling prerelease holds all preview DMGs. Publishing a new build uploads an asset instead of creating a release, so release watchers get no notification and the releases page gets no clutter. The desktop-preview tag does not match the v*.*.* pattern in release.yml.
• Each PR keeps one DMG on the release. A new build replaces the old one.
• A cleanup job deletes the PR's DMG and updates the comment when the PR closes or the label comes off. This replaces the old 7-day artifact expiry.

Build restrictions are unchanged: same-repo PRs with the preview:mac label only, unsigned build, no Apple secrets.

Change made by Claude Fable 5 running in Claude Code.

---

Note

Medium Risk
Introduces release publishing and asset deletion driven by PR events, but mitigated by isolating write permissions to jobs that do not run PR code and by filename and PR-state guards against cross-PR clobbering.

Overview
macOS preview builds no longer rely on Actions artifacts (which require a GitHub login). A new publish job uploads each DMG to a rolling desktop-preview prerelease and the PR comment links to the public release asset URL so headless testers can curl without signing in.

The build job still runs PR code with read-onlycontents; publish and cleanup hold contents: write and never check out PR code. publish re-checks that the PR is still open and labeled before and after upload, and refuses filenames that lack this PR’s ‑pr.N. marker so one build cannot touch another PR’s assets. cleanup runs on PR close or preview:mac removal, deletes matching release assets, and updates the comment; it skips if the label was re-applied.

Workflow triggers now include unlabeled and closed. Concurrency is split into separate build vs cleanup groups so in-flight cleanups are not canceled mid-delete and unrelated label events do not cancel builds.

^{Reviewed by Cursor Bugbot for commit 5c4c7e4. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Publish macOS preview DMGs as public release assets

• Adds a publish job that uploads the built DMG to a rolling prerelease tagged desktop-preview, so download links are public and require no GitHub sign-in. Prior assets for the same PR are deleted before upload, and the upload is reverted if the PR is closed or loses the preview:mac label mid-publish.
• Adds a cleanup job that deletes a PR's DMG from the release when the PR is closed or the preview:mac label is removed, then updates the PR comment to note removal.
• Reworks workflow concurrency to distinguish build runs from cleanup runs so cleanup is never canceled mid-delete; build runs are still canceled on superseding pushes.
• The build job now exposes dmg_name and version as job outputs for publish to consume, and skips on closed or unlabeled events.
• Risk: publish uses a rolling tag desktop-preview with multiple PR assets coexisting; the deletion logic in publish and cleanup matches assets by the -pr.<PR_NUMBER>. filename marker, so any asset not matching that pattern will not be managed or removed.

^{Macroscope summarized 5c4c7e4.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: bc404ffb-5ee4-4300-8fb6-d5c00d3afb90

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	−15 B (−0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+3 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−18 B (−0.3%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	55.6 KiB	−44 B (−0.1%)	66.4 KiB	✅
Codex	Live turn messages	11	10	−1 (−9.1%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	−17 B (−0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+2 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−19 B (−0.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.4 KiB	−44 B (−0.1%)	66.4 KiB	✅
Claude	Live turn messages	11	10	−1 (−9.1%)	21	✅

Baseline: 5041777 · PR result: 5c4c7e4 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[github-actions]

macOS preview

The preview download was removed because this PR closed or the preview label was removed.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 12d31ce. Configure here.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This adds a new public DMG distribution workflow with release creation, asset replacement/deletion, PR-comment updates, and write permissions driven by PR events. The release lifecycle and permission-boundary changes have broader operational impact than a minor CI tweak.

^{You can add or adjust custom eligibility rules. Learn more.}

[t3dotgg]

Preview DMGs from preview:mac PRs upload as Actions artifacts, and GitHub requires a signed-in account to download those. That breaks testing on headless devices. For a public repo the login gate adds no real protection, since any GitHub account can already download them.

Now the workflow publishes each DMG as an asset on a rolling desktop-preview prerelease. Release assets download anonymously with a stable URL, so curl from a headless box works. The PR comment links to that URL.

How it stays safe and tidy:

• The build job keeps a read-only token and still runs PR code. A new publish job holds the write token, and it only downloads the built artifact and talks to the GitHub API. It never checks out PR code.
• One rolling prerelease holds all preview DMGs. Publishing a new build uploads an asset instead of creating a release, so release watchers get no notification and the releases page gets no clutter. The desktop-preview tag does not match the v*.*.* pattern in release.yml.
• Each PR keeps one DMG on the release. A new build replaces the old one.
• A cleanup job deletes the PR's DMG and updates the comment when the PR closes or the label comes off. This replaces the old 7-day artifact expiry.

Build restrictions are unchanged: same-repo PRs with the preview:mac label only, unsigned build, no Apple secrets.

Change made by Claude Fable 5 running in Claude Code.

---

Note

Medium Risk
Introduces release publishing and asset deletion driven by PR events, but mitigated by isolating write permissions to jobs that do not run PR code and by filename and PR-state guards against cross-PR clobbering.

Overview
macOS preview builds no longer rely on Actions artifacts (which require a GitHub login). A new publish job uploads each DMG to a rolling desktop-preview prerelease and the PR comment links to the public release asset URL so headless testers can curl without signing in.

The build job still runs PR code with read-onlycontents; publish and cleanup hold contents: write and never check out PR code. publish re-checks that the PR is still open and labeled before and after upload, and refuses filenames that lack this PR’s ‑pr.N. marker so one build cannot touch another PR’s assets. cleanup runs on PR close or preview:mac removal, deletes matching release assets, and updates the comment; it skips if the label was re-applied.

Workflow triggers now include unlabeled and closed. Concurrency is split into separate build vs cleanup groups so in-flight cleanups are not canceled mid-delete and unrelated label events do not cancel builds.

^{Reviewed by Cursor Bugbot for commit 5c4c7e4. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Publish macOS preview DMGs as public release assets

• Adds a publish job that uploads the built DMG to a rolling prerelease tagged desktop-preview, so download links are public and require no GitHub sign-in. Prior assets for the same PR are deleted before upload, and the upload is reverted if the PR is closed or loses the preview:mac label mid-publish.
• Adds a cleanup job that deletes a PR's DMG from the release when the PR is closed or the preview:mac label is removed, then updates the PR comment to note removal.
• Reworks workflow concurrency to distinguish build runs from cleanup runs so cleanup is never canceled mid-delete; build runs are still canceled on superseding pushes.
• The build job now exposes dmg_name and version as job outputs for publish to consume, and skips on closed or unlabeled events.
• Risk: publish uses a rolling tag desktop-preview with multiple PR assets coexisting; the deletion logic in publish and cleanup matches assets by the -pr.<PR_NUMBER>. filename marker, so any asset not matching that pattern will not be managed or removed.

^{Macroscope summarized 5c4c7e4.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: bc404ffb-5ee4-4300-8fb6-d5c00d3afb90

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	−15 B (−0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+3 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−18 B (−0.3%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	55.6 KiB	−44 B (−0.1%)	66.4 KiB	✅
Codex	Live turn messages	11	10	−1 (−9.1%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	−17 B (−0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+2 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−19 B (−0.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.4 KiB	−44 B (−0.1%)	66.4 KiB	✅
Claude	Live turn messages	11	10	−1 (−9.1%)	21	✅

Baseline: 5041777 · PR result: 5c4c7e4 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[github-actions]

macOS preview

The preview download was removed because this PR closed or the preview label was removed.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 12d31ce. Configure here.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This adds a new public DMG distribution workflow with release creation, asset replacement/deletion, PR-comment updates, and write permissions driven by PR events. The release lifecycle and permission-boundary changes have broader operational impact than a minor CI tweak.

^{You can add or adjust custom eligibility rules. Learn more.}

[t3dotgg]

Preview DMGs from preview:mac PRs upload as Actions artifacts, and GitHub requires a signed-in account to download those. That breaks testing on headless devices. For a public repo the login gate adds no real protection, since any GitHub account can already download them.

Now the workflow publishes each DMG as an asset on a rolling desktop-preview prerelease. Release assets download anonymously with a stable URL, so curl from a headless box works. The PR comment links to that URL.

How it stays safe and tidy:

• The build job keeps a read-only token and still runs PR code. A new publish job holds the write token, and it only downloads the built artifact and talks to the GitHub API. It never checks out PR code.
• One rolling prerelease holds all preview DMGs. Publishing a new build uploads an asset instead of creating a release, so release watchers get no notification and the releases page gets no clutter. The desktop-preview tag does not match the v*.*.* pattern in release.yml.
• Each PR keeps one DMG on the release. A new build replaces the old one.
• A cleanup job deletes the PR's DMG and updates the comment when the PR closes or the label comes off. This replaces the old 7-day artifact expiry.

Build restrictions are unchanged: same-repo PRs with the preview:mac label only, unsigned build, no Apple secrets.

Change made by Claude Fable 5 running in Claude Code.

---

Note

Medium Risk
Introduces release publishing and asset deletion driven by PR events, but mitigated by isolating write permissions to jobs that do not run PR code and by filename and PR-state guards against cross-PR clobbering.

Overview
macOS preview builds no longer rely on Actions artifacts (which require a GitHub login). A new publish job uploads each DMG to a rolling desktop-preview prerelease and the PR comment links to the public release asset URL so headless testers can curl without signing in.

The build job still runs PR code with read-onlycontents; publish and cleanup hold contents: write and never check out PR code. publish re-checks that the PR is still open and labeled before and after upload, and refuses filenames that lack this PR’s ‑pr.N. marker so one build cannot touch another PR’s assets. cleanup runs on PR close or preview:mac removal, deletes matching release assets, and updates the comment; it skips if the label was re-applied.

Workflow triggers now include unlabeled and closed. Concurrency is split into separate build vs cleanup groups so in-flight cleanups are not canceled mid-delete and unrelated label events do not cancel builds.

^{Reviewed by Cursor Bugbot for commit 5c4c7e4. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Publish macOS preview DMGs as public release assets

• Adds a publish job that uploads the built DMG to a rolling prerelease tagged desktop-preview, so download links are public and require no GitHub sign-in. Prior assets for the same PR are deleted before upload, and the upload is reverted if the PR is closed or loses the preview:mac label mid-publish.
• Adds a cleanup job that deletes a PR's DMG from the release when the PR is closed or the preview:mac label is removed, then updates the PR comment to note removal.
• Reworks workflow concurrency to distinguish build runs from cleanup runs so cleanup is never canceled mid-delete; build runs are still canceled on superseding pushes.
• The build job now exposes dmg_name and version as job outputs for publish to consume, and skips on closed or unlabeled events.
• Risk: publish uses a rolling tag desktop-preview with multiple PR assets coexisting; the deletion logic in publish and cleanup matches assets by the -pr.<PR_NUMBER>. filename marker, so any asset not matching that pattern will not be managed or removed.

^{Macroscope summarized 5c4c7e4.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: bc404ffb-5ee4-4300-8fb6-d5c00d3afb90

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	−15 B (−0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+3 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−18 B (−0.3%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	55.6 KiB	−44 B (−0.1%)	66.4 KiB	✅
Codex	Live turn messages	11	10	−1 (−9.1%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	−17 B (−0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+2 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−19 B (−0.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.4 KiB	−44 B (−0.1%)	66.4 KiB	✅
Claude	Live turn messages	11	10	−1 (−9.1%)	21	✅

Baseline: 5041777 · PR result: 5c4c7e4 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[github-actions]

macOS preview

The preview download was removed because this PR closed or the preview label was removed.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 12d31ce. Configure here.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This adds a new public DMG distribution workflow with release creation, asset replacement/deletion, PR-comment updates, and write permissions driven by PR events. The release lifecycle and permission-boundary changes have broader operational impact than a minor CI tweak.

^{You can add or adjust custom eligibility rules. Learn more.}

[t3dotgg]

Preview DMGs from preview:mac PRs upload as Actions artifacts, and GitHub requires a signed-in account to download those. That breaks testing on headless devices. For a public repo the login gate adds no real protection, since any GitHub account can already download them.

Now the workflow publishes each DMG as an asset on a rolling desktop-preview prerelease. Release assets download anonymously with a stable URL, so curl from a headless box works. The PR comment links to that URL.

How it stays safe and tidy:

• The build job keeps a read-only token and still runs PR code. A new publish job holds the write token, and it only downloads the built artifact and talks to the GitHub API. It never checks out PR code.
• One rolling prerelease holds all preview DMGs. Publishing a new build uploads an asset instead of creating a release, so release watchers get no notification and the releases page gets no clutter. The desktop-preview tag does not match the v*.*.* pattern in release.yml.
• Each PR keeps one DMG on the release. A new build replaces the old one.
• A cleanup job deletes the PR's DMG and updates the comment when the PR closes or the label comes off. This replaces the old 7-day artifact expiry.

Build restrictions are unchanged: same-repo PRs with the preview:mac label only, unsigned build, no Apple secrets.

Change made by Claude Fable 5 running in Claude Code.

---

Note

Medium Risk
Introduces release publishing and asset deletion driven by PR events, but mitigated by isolating write permissions to jobs that do not run PR code and by filename and PR-state guards against cross-PR clobbering.

Overview
macOS preview builds no longer rely on Actions artifacts (which require a GitHub login). A new publish job uploads each DMG to a rolling desktop-preview prerelease and the PR comment links to the public release asset URL so headless testers can curl without signing in.

The build job still runs PR code with read-onlycontents; publish and cleanup hold contents: write and never check out PR code. publish re-checks that the PR is still open and labeled before and after upload, and refuses filenames that lack this PR’s ‑pr.N. marker so one build cannot touch another PR’s assets. cleanup runs on PR close or preview:mac removal, deletes matching release assets, and updates the comment; it skips if the label was re-applied.

Workflow triggers now include unlabeled and closed. Concurrency is split into separate build vs cleanup groups so in-flight cleanups are not canceled mid-delete and unrelated label events do not cancel builds.

^{Reviewed by Cursor Bugbot for commit 5c4c7e4. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Publish macOS preview DMGs as public release assets

• Adds a publish job that uploads the built DMG to a rolling prerelease tagged desktop-preview, so download links are public and require no GitHub sign-in. Prior assets for the same PR are deleted before upload, and the upload is reverted if the PR is closed or loses the preview:mac label mid-publish.
• Adds a cleanup job that deletes a PR's DMG from the release when the PR is closed or the preview:mac label is removed, then updates the PR comment to note removal.
• Reworks workflow concurrency to distinguish build runs from cleanup runs so cleanup is never canceled mid-delete; build runs are still canceled on superseding pushes.
• The build job now exposes dmg_name and version as job outputs for publish to consume, and skips on closed or unlabeled events.
• Risk: publish uses a rolling tag desktop-preview with multiple PR assets coexisting; the deletion logic in publish and cleanup matches assets by the -pr.<PR_NUMBER>. filename marker, so any asset not matching that pattern will not be managed or removed.

^{Macroscope summarized 5c4c7e4.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: bc404ffb-5ee4-4300-8fb6-d5c00d3afb90

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	−15 B (−0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+3 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−18 B (−0.3%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	55.6 KiB	−44 B (−0.1%)	66.4 KiB	✅
Codex	Live turn messages	11	10	−1 (−9.1%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	−17 B (−0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+2 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−19 B (−0.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.4 KiB	−44 B (−0.1%)	66.4 KiB	✅
Claude	Live turn messages	11	10	−1 (−9.1%)	21	✅

Baseline: 5041777 · PR result: 5c4c7e4 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[github-actions]

macOS preview

The preview download was removed because this PR closed or the preview label was removed.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 12d31ce. Configure here.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This adds a new public DMG distribution workflow with release creation, asset replacement/deletion, PR-comment updates, and write permissions driven by PR events. The release lifecycle and permission-boundary changes have broader operational impact than a minor CI tweak.

^{You can add or adjust custom eligibility rules. Learn more.}

[t3dotgg]

Preview DMGs from preview:mac PRs upload as Actions artifacts, and GitHub requires a signed-in account to download those. That breaks testing on headless devices. For a public repo the login gate adds no real protection, since any GitHub account can already download them.

Now the workflow publishes each DMG as an asset on a rolling desktop-preview prerelease. Release assets download anonymously with a stable URL, so curl from a headless box works. The PR comment links to that URL.

How it stays safe and tidy:

• The build job keeps a read-only token and still runs PR code. A new publish job holds the write token, and it only downloads the built artifact and talks to the GitHub API. It never checks out PR code.
• One rolling prerelease holds all preview DMGs. Publishing a new build uploads an asset instead of creating a release, so release watchers get no notification and the releases page gets no clutter. The desktop-preview tag does not match the v*.*.* pattern in release.yml.
• Each PR keeps one DMG on the release. A new build replaces the old one.
• A cleanup job deletes the PR's DMG and updates the comment when the PR closes or the label comes off. This replaces the old 7-day artifact expiry.

Build restrictions are unchanged: same-repo PRs with the preview:mac label only, unsigned build, no Apple secrets.

Change made by Claude Fable 5 running in Claude Code.

---

Note

Medium Risk
Introduces release publishing and asset deletion driven by PR events, but mitigated by isolating write permissions to jobs that do not run PR code and by filename and PR-state guards against cross-PR clobbering.

Overview
macOS preview builds no longer rely on Actions artifacts (which require a GitHub login). A new publish job uploads each DMG to a rolling desktop-preview prerelease and the PR comment links to the public release asset URL so headless testers can curl without signing in.

The build job still runs PR code with read-onlycontents; publish and cleanup hold contents: write and never check out PR code. publish re-checks that the PR is still open and labeled before and after upload, and refuses filenames that lack this PR’s ‑pr.N. marker so one build cannot touch another PR’s assets. cleanup runs on PR close or preview:mac removal, deletes matching release assets, and updates the comment; it skips if the label was re-applied.

Workflow triggers now include unlabeled and closed. Concurrency is split into separate build vs cleanup groups so in-flight cleanups are not canceled mid-delete and unrelated label events do not cancel builds.

^{Reviewed by Cursor Bugbot for commit 5c4c7e4. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Publish macOS preview DMGs as public release assets

• Adds a publish job that uploads the built DMG to a rolling prerelease tagged desktop-preview, so download links are public and require no GitHub sign-in. Prior assets for the same PR are deleted before upload, and the upload is reverted if the PR is closed or loses the preview:mac label mid-publish.
• Adds a cleanup job that deletes a PR's DMG from the release when the PR is closed or the preview:mac label is removed, then updates the PR comment to note removal.
• Reworks workflow concurrency to distinguish build runs from cleanup runs so cleanup is never canceled mid-delete; build runs are still canceled on superseding pushes.
• The build job now exposes dmg_name and version as job outputs for publish to consume, and skips on closed or unlabeled events.
• Risk: publish uses a rolling tag desktop-preview with multiple PR assets coexisting; the deletion logic in publish and cleanup matches assets by the -pr.<PR_NUMBER>. filename marker, so any asset not matching that pattern will not be managed or removed.

^{Macroscope summarized 5c4c7e4.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: bc404ffb-5ee4-4300-8fb6-d5c00d3afb90

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	−15 B (−0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+3 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−18 B (−0.3%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	55.6 KiB	−44 B (−0.1%)	66.4 KiB	✅
Codex	Live turn messages	11	10	−1 (−9.1%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	−17 B (−0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+2 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−19 B (−0.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.4 KiB	−44 B (−0.1%)	66.4 KiB	✅
Claude	Live turn messages	11	10	−1 (−9.1%)	21	✅

Baseline: 5041777 · PR result: 5c4c7e4 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[github-actions]

macOS preview

The preview download was removed because this PR closed or the preview label was removed.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 12d31ce. Configure here.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This adds a new public DMG distribution workflow with release creation, asset replacement/deletion, PR-comment updates, and write permissions driven by PR events. The release lifecycle and permission-boundary changes have broader operational impact than a minor CI tweak.

^{You can add or adjust custom eligibility rules. Learn more.}

[t3dotgg]

Preview DMGs from preview:mac PRs upload as Actions artifacts, and GitHub requires a signed-in account to download those. That breaks testing on headless devices. For a public repo the login gate adds no real protection, since any GitHub account can already download them.

Now the workflow publishes each DMG as an asset on a rolling desktop-preview prerelease. Release assets download anonymously with a stable URL, so curl from a headless box works. The PR comment links to that URL.

How it stays safe and tidy:

• The build job keeps a read-only token and still runs PR code. A new publish job holds the write token, and it only downloads the built artifact and talks to the GitHub API. It never checks out PR code.
• One rolling prerelease holds all preview DMGs. Publishing a new build uploads an asset instead of creating a release, so release watchers get no notification and the releases page gets no clutter. The desktop-preview tag does not match the v*.*.* pattern in release.yml.
• Each PR keeps one DMG on the release. A new build replaces the old one.
• A cleanup job deletes the PR's DMG and updates the comment when the PR closes or the label comes off. This replaces the old 7-day artifact expiry.

Build restrictions are unchanged: same-repo PRs with the preview:mac label only, unsigned build, no Apple secrets.

Change made by Claude Fable 5 running in Claude Code.

---

Note

Medium Risk
Introduces release publishing and asset deletion driven by PR events, but mitigated by isolating write permissions to jobs that do not run PR code and by filename and PR-state guards against cross-PR clobbering.

Overview
macOS preview builds no longer rely on Actions artifacts (which require a GitHub login). A new publish job uploads each DMG to a rolling desktop-preview prerelease and the PR comment links to the public release asset URL so headless testers can curl without signing in.

The build job still runs PR code with read-onlycontents; publish and cleanup hold contents: write and never check out PR code. publish re-checks that the PR is still open and labeled before and after upload, and refuses filenames that lack this PR’s ‑pr.N. marker so one build cannot touch another PR’s assets. cleanup runs on PR close or preview:mac removal, deletes matching release assets, and updates the comment; it skips if the label was re-applied.

Workflow triggers now include unlabeled and closed. Concurrency is split into separate build vs cleanup groups so in-flight cleanups are not canceled mid-delete and unrelated label events do not cancel builds.

^{Reviewed by Cursor Bugbot for commit 5c4c7e4. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Publish macOS preview DMGs as public release assets

• Adds a publish job that uploads the built DMG to a rolling prerelease tagged desktop-preview, so download links are public and require no GitHub sign-in. Prior assets for the same PR are deleted before upload, and the upload is reverted if the PR is closed or loses the preview:mac label mid-publish.
• Adds a cleanup job that deletes a PR's DMG from the release when the PR is closed or the preview:mac label is removed, then updates the PR comment to note removal.
• Reworks workflow concurrency to distinguish build runs from cleanup runs so cleanup is never canceled mid-delete; build runs are still canceled on superseding pushes.
• The build job now exposes dmg_name and version as job outputs for publish to consume, and skips on closed or unlabeled events.
• Risk: publish uses a rolling tag desktop-preview with multiple PR assets coexisting; the deletion logic in publish and cleanup matches assets by the -pr.<PR_NUMBER>. filename marker, so any asset not matching that pattern will not be managed or removed.

^{Macroscope summarized 5c4c7e4.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: bc404ffb-5ee4-4300-8fb6-d5c00d3afb90

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	−15 B (−0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+3 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−18 B (−0.3%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	55.6 KiB	−44 B (−0.1%)	66.4 KiB	✅
Codex	Live turn messages	11	10	−1 (−9.1%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	−17 B (−0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+2 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−19 B (−0.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.4 KiB	−44 B (−0.1%)	66.4 KiB	✅
Claude	Live turn messages	11	10	−1 (−9.1%)	21	✅

Baseline: 5041777 · PR result: 5c4c7e4 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[github-actions]

macOS preview

The preview download was removed because this PR closed or the preview label was removed.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 12d31ce. Configure here.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This adds a new public DMG distribution workflow with release creation, asset replacement/deletion, PR-comment updates, and write permissions driven by PR events. The release lifecycle and permission-boundary changes have broader operational impact than a minor CI tweak.

^{You can add or adjust custom eligibility rules. Learn more.}

[t3dotgg]

Preview DMGs from preview:mac PRs upload as Actions artifacts, and GitHub requires a signed-in account to download those. That breaks testing on headless devices. For a public repo the login gate adds no real protection, since any GitHub account can already download them.

Now the workflow publishes each DMG as an asset on a rolling desktop-preview prerelease. Release assets download anonymously with a stable URL, so curl from a headless box works. The PR comment links to that URL.

How it stays safe and tidy:

• The build job keeps a read-only token and still runs PR code. A new publish job holds the write token, and it only downloads the built artifact and talks to the GitHub API. It never checks out PR code.
• One rolling prerelease holds all preview DMGs. Publishing a new build uploads an asset instead of creating a release, so release watchers get no notification and the releases page gets no clutter. The desktop-preview tag does not match the v*.*.* pattern in release.yml.
• Each PR keeps one DMG on the release. A new build replaces the old one.
• A cleanup job deletes the PR's DMG and updates the comment when the PR closes or the label comes off. This replaces the old 7-day artifact expiry.

Build restrictions are unchanged: same-repo PRs with the preview:mac label only, unsigned build, no Apple secrets.

Change made by Claude Fable 5 running in Claude Code.

---

Note

Medium Risk
Introduces release publishing and asset deletion driven by PR events, but mitigated by isolating write permissions to jobs that do not run PR code and by filename and PR-state guards against cross-PR clobbering.

Overview
macOS preview builds no longer rely on Actions artifacts (which require a GitHub login). A new publish job uploads each DMG to a rolling desktop-preview prerelease and the PR comment links to the public release asset URL so headless testers can curl without signing in.

The build job still runs PR code with read-onlycontents; publish and cleanup hold contents: write and never check out PR code. publish re-checks that the PR is still open and labeled before and after upload, and refuses filenames that lack this PR’s ‑pr.N. marker so one build cannot touch another PR’s assets. cleanup runs on PR close or preview:mac removal, deletes matching release assets, and updates the comment; it skips if the label was re-applied.

Workflow triggers now include unlabeled and closed. Concurrency is split into separate build vs cleanup groups so in-flight cleanups are not canceled mid-delete and unrelated label events do not cancel builds.

^{Reviewed by Cursor Bugbot for commit 5c4c7e4. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Publish macOS preview DMGs as public release assets

• Adds a publish job that uploads the built DMG to a rolling prerelease tagged desktop-preview, so download links are public and require no GitHub sign-in. Prior assets for the same PR are deleted before upload, and the upload is reverted if the PR is closed or loses the preview:mac label mid-publish.
• Adds a cleanup job that deletes a PR's DMG from the release when the PR is closed or the preview:mac label is removed, then updates the PR comment to note removal.
• Reworks workflow concurrency to distinguish build runs from cleanup runs so cleanup is never canceled mid-delete; build runs are still canceled on superseding pushes.
• The build job now exposes dmg_name and version as job outputs for publish to consume, and skips on closed or unlabeled events.
• Risk: publish uses a rolling tag desktop-preview with multiple PR assets coexisting; the deletion logic in publish and cleanup matches assets by the -pr.<PR_NUMBER>. filename marker, so any asset not matching that pattern will not be managed or removed.

^{Macroscope summarized 5c4c7e4.}

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: bc404ffb-5ee4-4300-8fb6-d5c00d3afb90

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

Thread transfer impact

✅ Thread transfer remains within every enforced ceiling.

Provider	Metric	Main baseline	This PR	Impact	PR ceiling
Codex	Total thread wire	13.3 KiB	13.3 KiB	−15 B (−0.1%)	15.1 KiB	✅
Codex	Thread snapshot wire	6.9 KiB	6.9 KiB	+3 B (+0.0%)	7.3 KiB	✅
Codex	Live turn WebSocket wire	6.4 KiB	6.4 KiB	−18 B (−0.3%)	7.8 KiB	✅
Codex	Live turn WebSocket decoded	55.6 KiB	55.6 KiB	−44 B (−0.1%)	66.4 KiB	✅
Codex	Live turn messages	11	10	−1 (−9.1%)	21	✅
Claude	Total thread wire	13.3 KiB	13.3 KiB	−17 B (−0.1%)	15.1 KiB	✅
Claude	Thread snapshot wire	6.9 KiB	6.9 KiB	+2 B (+0.0%)	7.3 KiB	✅
Claude	Live turn WebSocket wire	6.5 KiB	6.4 KiB	−19 B (−0.3%)	7.8 KiB	✅
Claude	Live turn WebSocket decoded	56.4 KiB	56.4 KiB	−44 B (−0.1%)	66.4 KiB	✅
Claude	Live turn messages	11	10	−1 (−9.1%)	21	✅

Baseline: 5041777 · PR result: 5c4c7e4 · Source CI: success

Scenario and decoded snapshot size

10 historical turns, 5 command tools per turn, 878.9 KiB retained MCP result per historical turn, and a 1.05 MiB retained result in the measured turn.

• Codex decoded thread snapshot: 109.4 KiB
• Claude decoded thread snapshot: 110.1 KiB

Updated in place by a trusted workflow. PR artifacts are strictly validated and never executed.

[github-actions]

macOS preview

The preview download was removed because this PR closed or the preview label was removed.

[cursor]

Cursor Bugbot has reviewed your changes using high effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 12d31ce. Configure here.}

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — This adds a new public DMG distribution workflow with release creation, asset replacement/deletion, PR-comment updates, and write permissions driven by PR events. The release lifecycle and permission-boundary changes have broader operational impact than a minor CI tweak.

^{You can add or adjust custom eligibility rules. Learn more.}