sync fork with upstream 2026-08-20

.github/dependabot.yml

@@ -27,6 +27,11 @@ updates:
       prefix: chore
       include: scope
     open-pull-requests-limit: 5
+    ignore:
+      # rails-paradedb 0.10+ requires ParadeDB 0.25+, while Console runs 0.23.
+      - dependency-name: rails-paradedb
+        versions:
+          - ">= 0.10.0"
     groups:
       ruby-dependencies:
         patterns:
@@ -59,6 +64,11 @@ updates:
       prefix: chore
       include: scope
     open-pull-requests-limit: 5
+    ignore:
+      # Starlark 0.13 uses hashbrown 0.14, which allocative 0.3.6+ no longer supports.
+      - dependency-name: allocative
+        versions:
+          - ">= 0.3.6"
     groups:
       harness-server-dependencies:
         patterns:

.github/workflows/ci.yml

@@ -140,7 +140,7 @@ jobs:
         with:
           persist-credentials: false
 
-      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
+      - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
         with:
           toolchain: stable
           components: rustfmt, clippy
@@ -183,7 +183,7 @@ jobs:
           working-directory: services/console
           bundler-cache: true
 
-      - uses: dtolnay/rust-toolchain@e97e2d8cc328f1b50210efc529dca0028893a2d9 # v1
+      - uses: dtolnay/rust-toolchain@6c977a6ca4077a0ceb28ffbe03f59d46e9ac8772 # v1
         with:
           toolchain: stable
           components: rustfmt, clippy
@@ -322,7 +322,7 @@ jobs:
         with:
           python-version: "3.11"
 
-      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
           prune-cache: true
@@ -354,7 +354,7 @@ jobs:
         with:
           python-version: "3.11"
 
-      - uses: astral-sh/setup-uv@c771a70e6277c0a99b617c7a806ffedaca235ff9 # v9.0.0
+      - uses: astral-sh/setup-uv@20cfd1bf945f4377ade1205e4dbc17946fc9a30d # v10.0.1
         with:
           enable-cache: true
           prune-cache: true

.github/workflows/close-stale-draft-prs.yml

@@ -15,7 +15,7 @@ jobs:
     timeout-minutes: 5
     steps:
       - name: Close inactive draft pull requests
-        uses: actions/github-script@d746ffe35508b1917358783b479e04febd2b8f71 # v9.0.0
+        uses: actions/github-script@3a2844b7e9c422d3c10d287c895573f7108da1b3 # v9.0.0
         with:
           script: |
             const inactivityCutoff = Date.now() - 14 * 24 * 60 * 60 * 1000;

.github/workflows/docs.yml

@@ -61,12 +61,8 @@ jobs:
       - name: Build docs
         run: npm run build
 
-      - name: Skip Cloudflare deploy
-        if: ${{ env.CLOUDFLARE_ACCOUNT_ID == '' || env.CLOUDFLARE_API_TOKEN == '' }}
-        run: echo "Cloudflare credentials are not configured; docs build completed without deployment."
-
       - name: Deploy
-        if: github.event_name != 'pull_request'
+        if: ${{ github.event_name != 'pull_request' && env.CLOUDFLARE_ACCOUNT_ID != '' && env.CLOUDFLARE_API_TOKEN != '' }}
         uses: cloudflare/wrangler-action@ebbaa1584979971c8614a24965b4405ff95890e0 # v4.0.0
         with:
           apiToken: ${{ secrets.CLOUDFLARE_API_TOKEN }}

contrib/chart/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: centaur
 description: Helm chart for the trusted Centaur control plane
 type: application
-version: 0.1.119
+version: 0.1.124
 appVersion: "0.1.0"
 dependencies:
   - name: connect

contrib/chart/templates/apirs.yaml

@@ -254,8 +254,6 @@ spec:
 {{- end }}
             - name: RUN_MIGRATIONS
               value: {{ .Values.apiRs.runMigrations | quote }}
-            - name: SESSION_CODEX_NANOCODEX_ROLLOUT_PERCENT
-              value: {{ .Values.apiRs.codexNanocodexRolloutPercent | quote }}
             - name: IRON_CONTROL_SYNC_INFRA_SECRETS
               value: {{ .Values.apiRs.syncInfraSecrets | quote }}
             - name: RUST_LOG
@@ -429,6 +427,12 @@ spec:
               value: {{ .Values.sandbox.codexAuthMode | quote }}
             - name: CLAUDE_CODE_AUTH_MODE
               value: {{ .Values.sandbox.claudeCodeAuthMode | quote }}
+{{- if .Values.codex.customProviders }}
+            # Shared provider catalog: api-rs derives hostname-scoped proxy
+            # credentials from the same JSON sandboxes use for Codex config.
+            - name: CODEX_CUSTOM_PROVIDERS
+              value: {{ .Values.codex.customProviders | toJson | quote }}
+{{- end }}
             # Which harness's auth fragment iron-proxy registers (and therefore
             # which placeholder credential lands in the sandbox env). Must agree
             # with the harness the sandbox image CMD actually runs.
@@ -447,6 +451,9 @@ spec:
 {{- if not (hasKey .Values.sandbox.extraEnv "COMPANY_CONTEXT_EMBEDDINGS_MODEL") }}
 {{- $sandboxEnvList = append $sandboxEnvList (dict "name" "COMPANY_CONTEXT_EMBEDDINGS_MODEL" "value" $companyContextEmbeddingsModel) }}
 {{- end }}
+{{- if .Values.codex.customProviders }}
+{{- $sandboxEnvList = append $sandboxEnvList (dict "name" "CODEX_CUSTOM_PROVIDERS" "value" (.Values.codex.customProviders | toJson)) }}
+{{- end }}
 {{- range $k, $v := .Values.sandbox.extraEnv }}
 {{- $sandboxEnvList = append $sandboxEnvList (dict "name" $k "value" ($v | toString)) }}
 {{- end }}

contrib/chart/templates/console.yaml

@@ -127,6 +127,10 @@ spec:
                   name: {{ $secretEnv }}
                   key: {{ printf "%sSLACK_BOT_TOKEN" $prefix }}
                   optional: true
+{{- if .Values.codex.customProviders }}
+            - name: CODEX_CUSTOM_PROVIDERS
+              value: {{ .Values.codex.customProviders | toJson | quote }}
+{{- end }}
 {{- range $name := tuple "CLAUDE_MODEL" "CODEX_MODEL" }}
 {{- if hasKey $.Values.sandbox.extraEnv $name }}
             # Mirror the deployer's harness default-model override
@@ -186,6 +190,10 @@ spec:
             - name: CENTAUR_CONSOLE_PUBLIC_URL
               value: {{ $console.publicUrl | quote }}
 {{- end }}
+{{- with $console.allowedHosts }}
+            - name: CENTAUR_CONSOLE_ALLOWED_HOSTS
+              value: {{ join "," . | quote }}
+{{- end }}
 {{- with $console.sentryDsn }}
             - name: SENTRY_DSN
               value: {{ . | quote }}

contrib/chart/templates/githubbot.yaml

@@ -126,6 +126,10 @@ spec:
             # final flush + exit still fit before the pod is force-killed.
             - name: GITHUBBOT_SHUTDOWN_DRAIN_MS
               value: {{ mul (sub (int .Values.githubbot.terminationGracePeriodSeconds) 10) 1000 | quote }}
+{{- if .Values.codex.customProviders }}
+            - name: CODEX_CUSTOM_PROVIDERS
+              value: {{ .Values.codex.customProviders | toJson | quote }}
+{{- end }}
 {{- range $name, $value := .Values.githubbot.extraEnv }}
             - name: {{ $name }}
               value: {{ $value | quote }}

contrib/chart/templates/linearbot.yaml

@@ -63,6 +63,10 @@ spec:
                   key: {{ printf "%sDATABASE_URL" .Values.secretManager.envPrefix }}
             - name: LINEARBOT_USER_NAME
               value: {{ .Values.linearbot.userName | quote }}
+{{- if .Values.codex.customProviders }}
+            - name: CODEX_CUSTOM_PROVIDERS
+              value: {{ .Values.codex.customProviders | toJson | quote }}
+{{- end }}
 {{- range $name, $value := .Values.linearbot.extraEnv }}
             - name: {{ $name }}
               value: {{ $value | quote }}

contrib/chart/templates/repo-cache.yaml

@@ -89,6 +89,10 @@ spec:
 {{ include "centaur.componentSelectorLabels" (dict "root" . "component" "repo-cache") | nindent 6 }}
   template:
     metadata:
+{{- if $repoCacheHasGithubToken }}
+      annotations:
+        checksum/github-token: {{ include "centaur.secretResourceVersion" (dict "root" . "name" (include "centaur.repoCacheGithubTokenSecretName" .)) | sha256sum }}
+{{- end }}
       labels:
 {{ include "centaur.componentSelectorLabels" (dict "root" . "component" "repo-cache") | nindent 8 }}
     spec:

contrib/chart/templates/slackbotv2.yaml

@@ -43,10 +43,11 @@ spec:
             - name: CENTAUR_API_URL
               value: {{ printf "http://%s:%v" $apiRsName .Values.apiRs.port | quote }}
             # New threads without an explicit --claude/--amp/--codex/
-            # --nanocodex flag run the deployment's default harness. api-rs
-            # applies any configured Codex/Nanocodex rollout.
+            # --nanocodex flag run the deployment's default harness.
             - name: SLACKBOTV2_DEFAULT_HARNESS
               value: {{ .Values.sandbox.harnessEngine | quote }}
+            - name: SLACKBOTV2_CODEX_NANOCODEX_ROLLOUT_PERCENT
+              value: {{ .Values.slackbotv2.codexNanocodexRolloutPercent | quote }}
             - name: SLACK_BOT_TOKEN
               valueFrom:
                 secretKeyRef:
@@ -122,6 +123,10 @@ spec:
             - name: SLACKBOTV2_CHANNEL_DEFAULTS
               value: {{ .Values.slackbotv2.channelDefaults | toJson | quote }}
 {{- end }}
+{{- if .Values.codex.customProviders }}
+            - name: CODEX_CUSTOM_PROVIDERS
+              value: {{ .Values.codex.customProviders | toJson | quote }}
+{{- end }}
 {{- range $name := tuple "CLAUDE_MODEL" "CODEX_MODEL" "CODEX_MODEL_REASONING_EFFORT" }}
 {{- if and (hasKey $.Values.sandbox.extraEnv $name) (not (hasKey $.Values.slackbotv2.extraEnv $name)) }}
             # Mirror the deployer's harness default override (sandbox.extraEnv)

contrib/chart/values.schema.json

@@ -7,6 +7,11 @@
       "properties": {
         "replicaCount": { "type": "integer" },
         "publicUrl": { "type": "string" },
+        "allowedHosts": {
+          "type": "array",
+          "items": { "type": "string" },
+          "uniqueItems": true
+        },
         "sentryDsn": { "type": "string" },
         "railsEnv": { "type": "string" },
         "image": {
@@ -193,6 +198,26 @@
         }
       }
     },
+    "codex": {
+      "type": "object",
+      "properties": {
+        "customProviders": {
+          "type": "object",
+          "propertyNames": { "pattern": "^[a-z][a-z0-9_-]*$" },
+          "additionalProperties": {
+            "type": "object",
+            "properties": {
+              "name": { "type": "string", "minLength": 1 },
+              "baseUrl": { "type": "string", "pattern": "^https://" },
+              "apiKeyEnv": { "type": "string", "pattern": "^[A-Z][A-Z0-9_]*$" },
+              "defaultModel": { "type": "string", "minLength": 1 }
+            },
+            "required": ["name", "baseUrl", "apiKeyEnv"],
+            "additionalProperties": false
+          }
+        }
+      }
+    },
     "sandbox": {
       "type": "object",
       "properties": {
@@ -403,6 +428,11 @@
       "type": "object",
       "properties": {
         "mcpPublicUrl": { "type": "string" },
+        "codexNanocodexRolloutPercent": {
+          "type": "integer",
+          "minimum": 0,
+          "maximum": 100
+        },
         "responseMetadataMode": {
           "type": "string",
           "enum": ["first", "always", "never"]

contrib/chart/values.yaml

@@ -107,6 +107,10 @@ console:
   # When set, the slackbotv2 deployment also links the first assistant message
   # in a Slack thread to the Console session view; leave empty to omit the link.
   publicUrl: ""
+  # Additional exact Host headers accepted by Rails Host Authorization. Use for
+  # service DNS names that differ from the chart's short in-cluster URL;
+  # publicUrl and the short service host are already included.
+  allowedHosts: []
   # Optional Sentry DSN for Console web requests and background jobs. Empty by
   # default, so the Sentry SDK remains disabled unless explicitly configured.
   sentryDsn: ""
@@ -267,6 +271,21 @@ overlays:
   #   toolsSubdir: ""
   #   skillsSubdir: ""
 
+codex:
+  # Operator-defined OpenAI-compatible Responses providers. Each provider is
+  # added to sandbox Codex config, exposed through `--provider <id>`, and given
+  # a hostname-scoped iron-proxy bearer-token replacement. `apiKeyEnv` names a
+  # field in the configured secret source; sandboxes receive only a placeholder.
+  # Example:
+  #   customProviders:
+  #     private_responses:
+  #       name: Private Responses
+  #       baseUrl: https://inference.example.com/v1
+  #       apiKeyEnv: PRIVATE_RESPONSES_API_KEY
+  #       # Optional; callers must pass --model when omitted.
+  #       defaultModel: example-model
+  customProviders: {}
+
 sandbox:
   controller: pod
   image:
@@ -396,10 +415,6 @@ apiRs:
     tag: latest
     pullPolicy: Always
   port: 8080
-  # Sticky percentage of session requests for Codex assigned to Nanocodex.
-  # The API hashes the thread key once and persists the resolved harness on the
-  # session. Set to 0 to keep new Codex requests on Codex.
-  codexNanocodexRolloutPercent: 50
   # Public/local MCP endpoint advertised through OAuth protected-resource
   # metadata. Empty falls back to slackbotv2.mcpPublicUrl.
   mcpPublicUrl: ""
@@ -485,6 +500,7 @@ apiRs:
   activitySummary:
     enabled: false
     model: gpt-5.4-nano
+    # Deprecated compatibility fallback. Prefer OPENAI_BASE_URL in apiRs.extraEnv.
     openaiBaseUrl: https://api.openai.com/v1
     minIntervalSecs: 20
     timeoutSecs: 5
@@ -531,6 +547,9 @@ slackbotv2:
   # Join newly-created public channels after subscribed channel_created events.
   # Requires the Slack app to grant channels:read and channels:join.
   autoJoinCreatedChannels: false
+  # Sticky percentage of otherwise-default Codex Slack threads assigned to
+  # Nanocodex. A non-default model selection bypasses the rollout.
+  codexNanocodexRolloutPercent: 0
   # Append model, harness, and reasoning effort to the first live streamed
   # Slack assistant response, every response, or no responses. Independent of
   # the optional Console link below.

contrib/scripts/bootstrap-k8s-secrets.sh

@@ -81,6 +81,12 @@ Console bootstrap:
                                initial admin email (default admin@centaur.local)
   The initial password, API key, the three ActiveRecord encryption keys, and
   SECRET_KEY_BASE are auto-generated when absent (never rotated in place).
+
+Note: harness access-token modes (sandbox.codexAuthMode / claudeCodeAuthMode
+set to access_token) also need a console broker credential (openai-codex /
+anthropic-claude) created out of band with `centaur-perms broker create`;
+without it api-rs fails registration at startup. This script cannot seed it.
+See the Codex/Claude Auth Modes sections in docs/pages/deploying-in-production.mdx.
 EOF
 }
 
@@ -198,12 +204,6 @@ if secret_exists centaur-infra-env; then
   if [[ -n "${OP_CONNECT_TOKEN:-}" ]]; then
     patch_data+=("\"OP_CONNECT_TOKEN\":\"$(printf '%s' "$OP_CONNECT_TOKEN" | base64 | tr -d '\n')\"")
   fi
-  # Top-up IRON_BROKER_TOKEN for clusters bootstrapped before iron-token-broker
-  # support landed. Only generated when absent so we don't rotate it out from
-  # under cached iron-proxy access tokens on every script run.
-  if ! secret_key_present IRON_BROKER_TOKEN; then
-    patch_data+=("\"IRON_BROKER_TOKEN\":\"$(rand_hex | base64 | tr -d '\n')\"")
-  fi
   # GITHUB_TOKEN for the repo-cache DaemonSet. Set whenever present so it can be
   # rotated; harmless when repoCache is disabled.
   if [[ -n "${GITHUB_TOKEN:-}" ]]; then
@@ -315,8 +315,6 @@ else
   secret_args=(
     -n "$NAMESPACE" create secret generic centaur-infra-env
     --from-literal=IRON_MANAGEMENT_API_KEY="$(rand_hex)"
-    --from-literal=IRON_BROKER_TOKEN="$(rand_hex)"
-    --from-literal=SANDBOX_SIGNING_KEY="$(rand_hex)"
     --from-literal=OP_SERVICE_ACCOUNT_TOKEN="$OP_SERVICE_ACCOUNT_TOKEN"
     --from-literal=OP_VAULT="$OP_VAULT"
     --from-literal=SLACK_BOT_TOKEN="$SLACK_BOT_TOKEN"