fix(windows): complete M19-B1 canonical Rust sync - #7
Merged
Conversation
Replace the Windows shared Rust workspace and C header with the exact Native source at f820b06fd99a53cada8495338bd7d58898525a7b. That checkpoint contains the merged M19-B0 secure-storage implementation and the recovered Windows portability sequence, so the Windows shared tree no longer carries a local patch stack. Keep crates/ and vendor/ byte-identical to the Native Git object, apart from the Windows-owned vendor/tokscale-core/SYNC.md provenance record. Map the Native CTB header to include/ctb.h without changing C ABI signatures or ownership, and copy the provider-quota-pace-v3 fixture to the path consumed by the Rust serializer-lock test while retaining byte parity with the Windows cross-check fixture. The synchronized engine preserves source-message-cache-v2 format 2 as the active cache. Format-1 shards rebuild cold, and the legacy schema-32 source-message-cache.bin remains unread, unmodified, and undeleted. It also brings the canonical provider transport, publication generation, model aliases, source discovery, and parser fixes across the Native-to-Windows boundary. Pin CI and cross-check documentation to the same Native commit. Add a C# regression through TbCore.DecodeEnvelope<AgentUsagePayload> to prove that the additive publicationGeneration field remains wire-compatible without adding a Windows DTO property or coordinator. Verification includes the hermetic macOS check script, 276 Core tests, the release Rust workspace suite, a focused no-deps Clippy pass, exact source and fixture comparisons, git diff checking, and the 119-case Swift/C# cross-check with zero material differences. Repository-wide formatting drift and the existing Grok wrong_self_convention Clippy finding remain identical to the Native canonical baseline.
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f9fde63a2e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Route DashboardModel and TrayFeed through one process-wide AgentUsageFetchCoordinator so overlapping UI cadences share the same blocking TbCore.AgentUsage call instead of queueing a second full provider run behind the Rust publication gate. The coordinator keeps only the current in-flight Task under a lock and clears that exact Task on both success and failure. A later poll therefore starts a fresh fetch without caching a completed payload or a fault. AgentUsageFetchCoordinatorTests covers concurrent Task identity, single provider invocation, success reset, and failure reset. The TokenBar.Core test suite passes all 278 tests. Co-Authored-By: Claude <noreply@anthropic.com>
Use the shared fs_atomic replacement primitive for Antigravity credential refreshes so Windows performs a replace-existing, write-through commit with the existing bounded sharing/access retry behavior. A successful replacement is now the commit point. Unix directory sync is best-effort afterward, while true replacement failures still remove the temporary file and keep the refresh uncacheable. This prevents hosted Windows runs from reporting persistence failure after installing the credential bytes, which previously returned no cache binding and disabled same-account transient fallback. The focused Antigravity suite passes all 22 tests locally. Hosted Windows CI remains the runtime gate for MoveFileExW and the two previously failing cache-binding assertions. Co-Authored-By: Claude <noreply@anthropic.com>
Advance the Windows shared Rust source from Native M19-B0 commit f820b06f to the PR #101 merge commit 7abd205a. The exact sync carries the canonical Antigravity credential commit-point implementation, Kimi Code empty-root fallback, and vendor reportability ledger without creating a Windows-only Rust patch. Update the GitHub Actions Swift reference, CrossCheck documentation, and Windows-only SYNC record to the new immutable Native SHA. The shared-tree local patch table remains empty; active source cache format 2, the inert schema-32 monolith, the C ABI header, and provider-v3 fixture remain unchanged. Byte comparison confirms 17 crates files, 64 vendor files, the C header, and both fixture copies match Native 7abd205a, excluding only the documented adapter files. Focused Antigravity and Kimi tests pass, all 278 TokenBar.Core tests pass, rustfmt/diff checks pass, and hosted Windows CI remains the runtime gate. Co-Authored-By: Claude <noreply@anthropic.com>
There was a problem hiding this comment.
💡 Codex Review
Restore Windows OAuth client artifact paths
When the Antigravity access token expires and the OAuth client is not supplied through environment variables, Windows now searches only macOS application-bundle paths. A standard Windows installation under %LOCALAPPDATA%\Programs\antigravity\resources\bin\language_server.exe is therefore ignored, resolve_oauth_client() returns None, and token refresh—and consequently the Antigravity quota card—fails. Keep the macOS candidates behind their platform guard and restore the Windows installation candidates.
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Nanako0129
changed the title
Exact-sync the shared Rust and vendor surfaces from Native PR #102 candidate `4bde99d777c4e1ef33b2ed881fb79b754ec494ff` into the Windows M19-B1 branch. This brings the cfg-gated Antigravity PowerShell/CIM discovery path, platform-suffixed language-server matching, Windows-safe format-2 shard replacement lifecycle, Copilot Desktop malformed dependency handling, and portable cc-mirror/Kiro fixtures into the downstream consumer without creating a Windows-only shared-core patch. Preserve the Native-owned cache and ABI contracts: format 2 remains active under `source-message-cache-v2`, format-1 shards rebuild cold, the schema-32 monolith remains inert, and `include/ctb.h` plus both provider-v3 fixture copies remain byte-identical to the candidate. The Windows shared-tree local patch table stays empty; only the Native repository-guidance adapter `vendor/AGENTS.md` is intentionally excluded because Windows keeps local agent guides untracked. Point hosted CrossCheck at the exact tested Native candidate and record the candidate boundary in `vendor/tokscale-core/SYNC.md` and `crosscheck/README.md`. This commit is a pre-merge validation source, not the final Native merge SHA; after Native merge authorization, M19-B1 must repeat the exact sync against the actual merge commit before final Windows gates. Verification: `cargo test --workspace --release` passed with 1,289 vendor tests, 1 ignored, and all remaining workspace targets green; `git diff --check` passed; independent committed-tree comparison confirmed byte identity for `crates/`, all runtime `vendor/` files except Windows-only `SYNC.md` while intentionally excluding Native-only `vendor/AGENTS.md`, `include/ctb.h`, and both provider-v3 fixture copies. The fixture remains 7,625 bytes with SHA-256 `412f6ffd05f23f00266820c243376f265d29024d9e419217e55f8e1559b36c50`. Co-Authored-By: Claude <noreply@anthropic.com>
Resynchronize the Windows shared Rust tree to the exact tested Native PR #102 candidate c1ba62b5bd4215119ae6b2055bcb0a2c80af55a0. Update hosted CrossCheck and sync provenance to the same immutable source while keeping the candidate explicitly pre-merge and requiring another exact sync to the eventual Native merge SHA. Bring across the Native-canonical Windows test fixes: pin TOKSCALE_CONFIG_DIR to each cache sandbox, open mtime fixtures with writable handles, and release manually serialized stale-shard writers before subsequent reads or replacements. These changes prevent runner AppData contamination and Windows file-handle failures without changing production cache persistence, format 2, parser output, provider behavior, FFI, the C ABI, C#, or UI code. The complete crates tree, runtime vendor tree, C header, and both provider-v3 fixture copies are byte-identical to the source candidate. Verification passed with 1,604 release workspace tests, one ignored test, git diff --check, zero remaining 4bde99d7 provenance references, and fresh outcome verification CONFIRMED. Co-Authored-By: Claude <noreply@anthropic.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: f415029d99
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Advance the M19-B1 shared-tree candidate from Native PR #102 commit `c1ba62b5` to the reviewed `dcef36ed25129462b5f646f156add3c7f8a8f2dd` head. The Windows `crates/` tree, runtime `vendor/` tree, C header, and both provider-v3 fixture copies remain byte-identical to that immutable Native object, excluding only Native's repository adapter and Windows' provenance record. CI, CrossCheck instructions, and `SYNC.md` now name the same candidate. Consume the shared Codex OAuth credential commit change through `tokscale_core::fs_atomic::replace_file`, including Windows lock regressions for transient success and persistent failure without original-file loss. Preserve the existing temp-file, sync, live-token revalidation, JSON sibling, receipt/lineage, and rollback boundaries. Consume the Copilot duplicate-span time-envelope correction and advance only the Copilot parser identity from 3 to 4. The same-fingerprint stale-v3 regression rejects the old independent-duration result and persists the corrected earliest start through latest endpoint while global cache format 2 and every other parser namespace remain unchanged. Use the scanner-returned path spelling when shipping cache fixtures seed or query entries. This matches the production Windows cache key when explicit-home resolution uses `/` but `TempDir::join` constructs the same physical path with `\`, addressing the eight remaining hosted-runner assertions without a Windows-local production patch. Verification: - exact comparison: 17 crates files and 63 runtime vendor files - `ctb.h`: 4,636 bytes, SHA-256 bc3c674f1ba2a15dae452e66442b5a131aaf84f0764e0319119754e8099c2a94 - provider-v3 fixture: 7,625 bytes, SHA-256 412f6ffd05f23f00266820c243376f265d29024d9e419217e55f8e1559b36c50 - `cargo test --workspace --release`: 1,605 passed, 1 ignored - `git diff --check` - fresh exact-sync verifier: CONFIRMED Co-Authored-By: Claude <noreply@anthropic.com>
Advance the exact M19-B1 candidate to Native PR #102 head `56a6e3a7d187d09b206642f3aa5bfd6bb43a1bc5` after the hosted Windows run reduced the Rust suite to one remaining Claude warm-cache fixture failure. CI, CrossCheck instructions, and `SYNC.md` now point to the same immutable Native object, and the shared tree remains byte-identical under the documented Native-AGENTS/Windows-SYNC exclusions. Build the sentinel entry's Claude related-file fingerprint from the same scanner-returned source spelling already used as its cache key. The prior head fixed the entry lookup but still derived `.meta.json` and other related paths from the separately reconstructed `TempDir` spelling; Windows therefore saw a lexically different related-path identity and correctly cold-parsed instead of reusing the sentinel. Production scanner, cache key, and fingerprint behavior remain unchanged. Verification: - focused Claude warm-cache regression - exact comparison: 17 crates files and 63 runtime vendor files - `cargo test --workspace --release`: 1,605 passed, 1 ignored - `git diff --check` - fresh exact-sync verifier: CONFIRMED Co-Authored-By: Claude <noreply@anthropic.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 33ade8f0ba
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Decode the Rust `AgentUsageSnapshot.transportDiagnostic` field into a managed `AgentUsageTransportDiagnostic` carrying only nullable category, status, and OS code values. Add it as a defaulted final snapshot parameter so existing managed constructors remain source-compatible while callers can inspect the structured failure detail documented by the C ABI contract. Keep the additive diagnostic fail-soft at the JSON boundary. A property-scoped converter maps missing, null, or non-object values to no diagnostic; malformed or out-of-Int64 individual fields become null without failing the quota payload or discarding valid sibling fields. Unknown category strings remain available for forward compatibility, while unknown members and raw JSON are never retained. Do not add a Windows logging consumer. `DevLog` is a persistent temporary-file log rather than an equivalent of Native Unified Log privacy, so any future logging must add its own client/category/status/osCode sanitizer instead of writing the DTO or source payload directly. Verification: - `dotnet test src/TokenBar.Core.Tests/TokenBar.Core.Tests.csproj -c Release`: 285 passed - valid HTTP/OS, omitted/null/non-object, malformed-field, range, unknown-category, and sensitive-extra-member regressions - `git diff --check` - read-only security review: REAL/Low, DTO-only boundary - fresh outcome verifier: CONFIRMED Co-Authored-By: Claude <noreply@anthropic.com>
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 24f095b688
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Replace the documented shared crates and vendor surfaces from final merged TokenBar commit 4dfed5ffab26e2707a8cd82ee99864520b75892b with no Windows-local runtime patch. The synced provider code preserves valid Copilot quota rows when quota_reset_date has a non-string type and emits bounded DNS/TLS transport categories from typed resolver and rustls sources without inspecting free-form error text. Regenerate the Windows root lockfile ownership through Cargo so tb_core_ffi directly records hyper-util, tower-service, and rustls while retaining the Windows repository dependency resolution. Update SYNC.md, the crosscheck instructions, and CI canonical checkout to the final Native PR #102 merge SHA; the pre-merge 56a6e3a7 pin is no longer active. Verification: byte-for-byte comparison of all documented shared surfaces; changed-file rustfmt; scripts/check.sh with 309 tb_core_ffi tests, 1290 tokscale-core tests, release build, .NET solution build, 285 Core tests, and P/Invoke smoke; tb_core_ffi all-targets Clippy without dependency linting; provider-v3 and 116-case legacy Swift-to-C# crosschecks with zero material difference; git diff --check. Workspace Clippy retains the same pre-existing canonical Grok naming lint.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Advance M19-B1 by synchronizing the Windows shared Rust core and C header to the exact reviewed Native PR #102 candidate
56a6e3a7. This is the pre-merge hosted-Windows candidate, not the final Native merge SHA; after Native merge authorization, the shared tree will be synchronized again to the actual merge commit and all affected gates rerun.crates/, runtimevendor/, andSources/CTB/include/ctb.hfrom the exact Native object, with the header mapped toinclude/ctb.hvendor/AGENTS.mdis intentionally excluded because Windows keeps local agent guides untrackedtransportDiagnosticin the managed snapshot through a fail-soft DTO boundary without adding persistent loggingpublicationGenerationcompatibility coverageSource-of-truth boundary
56a6e3a756a6e3a7; Native-onlyvendor/AGENTS.mdis excluded and Windows adds onlyvendor/tokscale-core/SYNC.mdprovenanceSources/CTB/include/ctb.his byte-identical to Windowsinclude/ctb.hFixtures/CrossCheck/provider-quota-pace-v3.json, the Windows Rust serializer-lock copy, and the Windows cross-check copy are byte-identicalThe active cache remains format 2 under
source-message-cache-v2. Format-1 shards rebuild cold under format 2, and the legacy schema-32source-message-cache.binremains inert, unread, unmodified, and undeleted. The Copilot parser identity advances from 3 to 4 because correctedduration_msis serialized parser output; every other parser namespace remains warm. The fixed 111-row Native vendor ledger remains79/0/0/18/13/1.Portability recovery
Windows Antigravity local discovery uses the absolute system PowerShell host without a visible console, obtains
Win32_Processcommand lines through CIM, accepts the platform-suffixedlanguage_server*.exefamily, and bindsGet-NetTCPConnectionlisteners to the originating PID before constructing per-process token candidates. Loopback-only requests, local-before-OAuth precedence, strict Rust command-line qualification, and secret-safe fixed errors remain unchanged.Format-2 shard writes flush and sync the temporary writer, release its Windows handle before
MoveFileExW, reopen the installed shard read/write, and sync the final file. Copilot Desktop rejects malformed non-directorysession-stateentries with a non-NotFounddependency error so existing callers cold-parse instead of accepting a stale warm result. The cc-mirror JSON and Kiro path fixtures remain platform-native.Hosted Windows testing exposed fixture-only portability gaps. Message-cache sandboxes pin
TOKSCALE_CONFIG_DIRbecause Windows Known Folder resolution can ignore HOME/XDG. Mtime fixtures open writable handles forSetFileTime, and manually serialized stale-shard writers are dropped before the next read or replacement. Shipping cache fixtures now build related-file fingerprints, seed, and query with the scanner-returned path spelling because explicit-home scanning can return/whileTempDir::joinreconstructs the same physical Windows path with\; production cache keys and related-path identity deliberately preserve the discovered spelling, so the fixture must use that spelling rather than a lexical reconstruction. Production cache identity and scanner output are unchanged.Current-head review corrections
Codex OAuth credential write-back now commits the staged
auth.jsonthroughtokscale_core::fs_atomic::replace_file. Windows therefore receives the existing five-attempt retry policy for transientERROR_ACCESS_DENIEDandERROR_SHARING_VIOLATIONfailures. The unique sibling temp,create_new, file sync, cleanup, Unix directory sync, live-token revalidation, JSON sibling preservation, receipt/lineage ordering, and rollback boundary remain unchanged. Windows-only regressions hold the destination without delete sharing to cover both eventual success inside the retry budget and persistent failure that preserves the original bytes.Duplicate Copilot OTEL records now preserve the earliest start and latest known endpoint. Each endpoint is computed against its original start before the anchor moves, then the merged duration is
max(endpoint) - min(start)with saturating arithmetic; token buckets still use per-field maxima rather than additive replay. The regression uses[60s, 70s]plus[55s, 61s]and requires[55s, 70s]. A same-fingerprint parser-v3 shard containing the old 10-second result is rejected and rebuilt to 15 seconds under parser version 4.The managed
AgentUsageSnapshotnow preserves optionaltransportDiagnosticas nullable category/status/osCode values. Its property-scoped converter mirrors Native fail-soft semantics: missing, null, or non-object diagnostics become absent; malformed or out-of-Int64 individual fields become null without failing the quota payload; unknown categories remain forward-compatible; and unknown members or raw JSON are never retained. Windows does not log the DTO becauseDevLogis a persistent file rather than a Unified Log privacy equivalent.Earlier review fixes retained
Antigravity credential refresh uses the shared atomic replacement primitive as its commit point. A successful Windows replacement is no longer reported as failed when ordinary Rust directory flushing is unavailable, so the trusted same-account cache binding survives and transient last-good fallback remains eligible. Account-switch, logout, marker-lineage, re-read, and true replacement-failure gates are unchanged.
Missing, empty, and whitespace-only
KIMI_CODE_HOMEvalues fall back to<home>/.kimi-code; every other non-empty value remains unchanged anduse_env_roots=falsestill ignores the environment. The upstream source report is tokscale #963.AgentUsageFetchCoordinatorshares one blockingTbCore.AgentUsage()task betweenDashboardModelandTrayFeed. Concurrent callers receive the same result, while success and failure both clear the completed task so the next cadence starts a fresh fetch instead of caching a payload or fault.Copilot Desktop lifetime totals still lack per-event temporal provenance in the upstream source; the cross-cutting source-contract issue is tracked as tokscale #962 rather than approximated in Windows. Grok unified-log authority remains session-scoped because the legacy and unified representations have no shared stable turn identity; a timestamp-prefix merge could retain both representations of the same turn and double-count.
Compatibility
The Rust payload includes additive
publicationGenerationand bounded provider transport diagnostics while retaining the existing C signatures and ownership rules. The Windows DTO intentionally does not consumepublicationGeneration; a productionTbCore.DecodeEnvelope<AgentUsagePayload>regression proves that the unknown field is ignored while existing fields decode normally. It now does consume the bounded optionaltransportDiagnosticthrough the fail-soft DTO boundary described above. Windows caller coalescing addresses duplicate concurrent provider runs without changing the wire contract.Verification
56a6e3a7: 17 crates files, 63 runtime vendor files, one header, and two fixture copies; Native-onlyvendor/AGENTS.mdis absent and Windows adds onlySYNC.mdctb.h: 4,636 bytes; SHA-256bc3c674f1ba2a15dae452e66442b5a131aaf84f0764e0319119754e8099c2a94412f6ffd05f23f00266820c243376f265d29024d9e419217e55f8e1559b36c5056a6e3a7: CI passed, Codex returned a clean+1with no inline comments, and fresh outcome verification returnedCONFIRMEDcargo test --workspace --release:tb_core_ffi301 passed;tokscale-core1,290 passed with 1 ignored; remaining targets 14 passed; aggregate 1,605 passed and 1 ignoredTokenBar.Core.Tests: 285 passed, including valid and malformed transport-diagnostic envelope cases; Swift/C# cross-check baseline: 119 cases, zero material differencegit diff --check: passedCONFIRMEDfor the exact shared tree committed as33ade8f24f095b:CONFIRMEDc1ba62b5candidate: 1,261 passed and 8 scanner-path cache assertions faileda566e33: 1,269 passed and 1 ignored before the sole remaining Claude warm-cache sentinel failed because its entry key used the scanner spelling but its related-file fingerprint still used the reconstructed path;33ade8fnow aligns both identitiesRepository-wide formatting and workspace Clippy retain the canonical Native baseline. Workspace Clippy still stops at the inherited
vendor/tokscale-core/src/sessions/grok.rs:153wrong_self_conventionfinding, unrelated to this diff.Deliberate limits
🤖 Generated with Claude Code