Conversation
Add one-shot inverse queue/steer submission, allow steering any queued item, and expand each row's safe drag target. Model: gpt-5
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
Model: gpt-5
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 31de8acad2
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Model: gpt-5
Model: gpt-5
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 16c85a460a
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Model: gpt-5
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 31582d5354
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Model: gpt-5
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: feeb1180cf
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Model: gpt-5
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: b0ba37d550
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
Model: gpt-5
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4e97db58bd
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| error: 'This machine does not support exact queued-message steering.', | ||
| }; | ||
| } | ||
| if (await canUseLocalMachineRpc(machineId)) { |
There was a problem hiding this comment.
In Electron, when the router has already resolved this machine as local but the preload Machine RPC sender is unavailable, canUseLocalMachineRpc() returns false and this new control continues through the authorization check into getMachineRpcClient(). In dual-sync builds that sends a local session control over Streams—and in local-only builds it makes the action depend on unrelated authorization state—instead of reporting the failed local bridge. Branch on the resolved plane and return a local transport error rather than falling through.
AGENTS.md reference: packages/components/src/providers/AGENTS.md:L65-L67
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 5758984a60
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| const authorizedMachineIds = deps.getAuthorizedMachineIds?.() ?? null; | ||
| if (!authorizedMachineIds?.has(machineId)) { |
There was a problem hiding this comment.
Fresh evidence beyond the earlier requester-identity fix is that local-project authorization is a separate predicate: isSessionVisibleToUser requires visibleLocalProjectKeys, and the daemon's normal verifySessionMachineAccess forwards meta.project.localProjectId. Here the source check only tests whether the machine occurs in convexAuthorizedMachineIds, while the target steerQueuedMessage performs no access check. Consequently, a workspace member authorized for a team-shared machine but not one of its private local projects can submit known session/turn/queue IDs to consume that project's queued row and cancel its active turn. Gate this operation on the session's project access, or provide authenticated target-side authorization, rather than relying on machine visibility alone.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 6964227412
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if (nativeOperation && queuedTurn.id !== nativeOperation.userTurnId) return null; | ||
| return { ...queuedTurn, userId: authenticatedRequesterUserId }; | ||
| }, | ||
| { publishDispatch: !useNativeSteer } |
There was a problem hiding this comment.
When native Steer is available, publishDispatch: false leaves the selected CRDT queue row present after its frozen pending_apply entry is created. While persistence, provider submission, and acknowledgement are awaited, another renderer can successfully edit or remove that same $cid; the native path still executes the frozen entry and later deletes the row, so the accepted edit is lost—or a removed message still runs. Reserve against ordinary mutations and durably remove the row before calling steerPrompt.
Useful? React with 👍 / 👎.
Separate queue delivery policy from live turn ownership, serialize revision-checked queue mutations, and persist removal before native submission. Remove legacy daemon steering paths and retain conflicting edit drafts. Model: gpt-6
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c4afc9f16d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if (!deps.getAuthorizedMachineIds?.()?.has(machineId)) { | ||
| throw new Error('Source authorization for this machine is unavailable or denied.'); |
There was a problem hiding this comment.
When a collaborator is authorized for a shared machine but not for one of its private local projects, this machine-only check still permits session/queue-mutate. The target handler forwards that RPC directly to mutateQueuedMessage, whose only ownership check is meta.machineId, while normal session visibility separately requires visibleLocalProjectKeys; a caller with known session and queue IDs can therefore edit, remove, or reorder messages in an inaccessible project. Gate the request on authenticated session/project visibility at the source, or add an authenticated target-side authorization boundary.
AGENTS.md reference: packages/loro-streams-rpc/AGENTS.md:L58-L59
Useful? React with 👍 / 👎.
Share source-side session authorization across queue controls, preserve routing planes on transport failure, and allow safe pre-history recovery retries. Model: gpt-6
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 446cd45c62
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| return isSessionVisibleToUser( | ||
| meta, | ||
| authorization.visibleMachineIds, | ||
| authorization.visibleLocalProjectKeys, | ||
| authorization.currentUserId |
There was a problem hiding this comment.
When a collaborator owns the cached Session but their access to its machine has been revoked, this delegates authorization to isSessionVisibleToUser, whose owner fast path returns true whenever meta.userId === currentUserId without consulting visibleMachineIds. The facade can therefore append session/queue-steer or session/queue-mutate using stale machine metadata even though the authenticated Convex snapshot no longer contains that machine; the target handlers perform no requester access check, so the revoked user can still consume, edit, or remove queued work and cancel an active turn. Require authenticated machine/project authorization independently of the Session-owner visibility fallback.
AGENTS.md reference: packages/components/src/providers/AGENTS.md:L59-L61
Useful? React with 👍 / 👎.
Make local/remote mutation outcomes and successful Effect guard completion explicit, and align the machine registration assertion with queueItemSteer v2.\n\nModel: gpt-5
Require current machine and local-project access for queue controls, remove the session-owner authorization fallback, and cover revoked-owner requests with end-to-end in-memory traces. Model: gpt-6
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 64fc2f1d1d
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| } | ||
| yield* flush(); | ||
| yield* removeReservedRow(doc, marker); | ||
| const submitting = yield* write(sessionId, { ...marker, phase: 'submitting' }); |
There was a problem hiding this comment.
Fresh evidence beyond the earlier rejected-delivery thread is that nativeSteerEffect can throw PersistenceFailure while building prompt blocks or applying configuration, before steerPrompt is called. This marker is nevertheless advanced to submitting, and the surrounding pipe falls back only for ProviderRejected and StaleTurn; the outer handler merely returns the persistence error. Recovery therefore treats a provably unsubmitted turn as indeterminate, fails its pending_apply history entry, and never dispatches the already-removed queue row. Keep the marker reserved through pre-submission preparation or explicitly route those failures through fallback.
AGENTS.md reference: apps/cli/src/session/AGENTS.md:L59-L61
Useful? React with 👍 / 👎.
Complete preparation before journaling submission, recover preparation failures as ordinary dispatch, and prevent replay after indeterminate provider failures. Model: gpt-6
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 48e21a9b21
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| if (!meta || meta.machineId !== machineId || !authorization?.visibleMachineIds.has(machineId)) | ||
| return false; | ||
| // Display ownership is not a control grant; revoked machine access always denies control. | ||
| if (meta.project?.kind === 'local') { |
There was a problem hiding this comment.
When a collaborator can access the shared machine but not a private local project, this conditional trusts the shared Loro SessionMeta.project value and grants control for every absent or non-local value. Fresh evidence beyond the earlier project-access findings is that the new Spec itself states collaborators can write shared Session metadata, while getSessionMeta reads that metadata directly from the repo; changing or omitting project therefore bypasses the authoritative project-key check, and the target queue-steer/mutate handlers perform no requester/project authorization before consuming, editing, or removing queued work. Resolve the session-to-project binding from an authenticated authority or fail closed rather than trusting this mutable field.
AGENTS.md reference: packages/components/src/providers/AGENTS.md:L59-L61
Useful? React with 👍 / 👎.
| Effect.catchTag('ProviderRejected', (error) => | ||
| fallback( | ||
| sessionId, | ||
| doc, | ||
| submitting, |
There was a problem hiding this comment.
When submitSteer returns ProviderRejected before injection and the first marker write inside fallback fails transiently, the durable marker remains submitting. Fresh evidence beyond the earlier failed-requeue thread is that recovery now treats that surviving phase as indeterminate and eventually fails the pending_apply turn instead of dispatching it, even though this tagged result proved the provider did not receive it; retries also cannot repair it while the old prompt remains owned. Preserve a durable/retryable non-delivery decision so failure to record the fallback transition cannot permanently drop the selected message.
AGENTS.md reference: apps/cli/src/session/AGENTS.md:L59-L61
Useful? React with 👍 / 👎.
1 participant
Related issue
Internal maintainer request; no intake issue required.
Problem / pressure
Queue ordering and Steer are separate actions: selecting C must steer C without rearranging A/B. Native delivery also crosses durable storage and irreversible provider effects. Keeping a reserved row editable could silently discard another client's edit; machine-only authorization could expose private-project sessions.
Summary
Mod+Shift+Enterfor a one-shot inverse Queue/Steer choice, without changing the saved preference. Expand queue dragging to the number and message body; action buttons remain separate.queueItemSteerv2 for every queued-row Steer button. Older daemons have no Queue Steer compatibility path, including the head. Composer routing is unchanged.QueueSteerServiceowns selection, validation, durable evidence, fallback and receipts;ActiveTurnSteerPortretains live-turn ownership, provider submission, handoff and Stop serialization. Effect 3.18.4 scopes local resources and typed failures, not reversible provider delivery.session/queue-mutate, sharing daemon reservation authority. Native Steer persists frozen history and queue removal before submission; conflicting edits fail visibly and retain their drafts. Failed mutation RPCs never fall back to direct writes.Contract and rationale: draft Spec, Effect ownership decision. Both language versions are updated; implementation does not approve the Spec.
Visual explanation
Without native capability, the daemon persists the selected ordinary follow-up before cancelling only T. Scope releases local ownership; it cannot undo provider acceptance.
Before / after
Test plan
Latest boundary-fix verification at
446cd45c:session-execution-service,doc-user-turn, andsession-queue-steer-operation-store.workspace-machine-rpc-facade,workspace-writer,create-workspace-runtime-meta-recovery, andmessage-queue-row-editing.git diff --checkpassed. Targeted oxlint: zero errors, 11 warnings. Docs check: zero errors, 34 existing warnings.pnpm checkandpnpm formatcannot start in this environment becausecorepackis missing; the checks above are not a full-workspace run.Context handoff
Instructions for reviewing agents
Authoring context