node-tests-0.156.0.log

✔ settings commit atomically, preserve cache after write failure, and recover the queue (26.261375ms)
✔ settings isolate nested defaults, saved snapshots and readers, while preserving write order (10.948584ms)
✔ malformed settings are retained for recovery and never treated as valid stored settings (2.172625ms)
✔ renderer trust requires exact document, origin, credentials absence and the main frame (0.346292ms)
✔ the IPC registration guard protects callbacks without changing results (0.164334ms)
✔ updater accepts only official HTTPS hosts and complete digests (0.228125ms)
✔ download commits only verified complete bytes and rechecks a later modified file (24.632875ms)
✔ failed downloads keep the previous final file and remove all partial files (5.344542ms)
✔ downloads reject redirect escapes, loops and absent release digests before committing (1.407792ms)
✔ installer launch rejects a spawn failure and waits for successful process startup (0.2185ms)
✔ Windows signature verification checks both publisher identities and quotes literal paths (0.241833ms)
✔ macOS updater rolls back after relaunch failure, preserving the prior app (1602.352583ms)
✔ explicit client stop rejects pending RPCs and announces fully cleared state (0.685584ms)
✔ production stop handler expires requests and turns before reused server wire IDs (4.371834ms)
✔ production startup still creates the window when the debug log cannot be written (0.902ms)
✔ Codex app-server contract covers auth, thread read/write, resume, steer, review, fork, and formatting (42.81825ms)
✔ contract fake server requires experimentalApi for experimental thread history fields (34.461125ms)
﹣ authenticated actual CLI: streamed reply, persisted reload, search, occurrences, resume and fork (0.069583ms) # Set CODEX_MESSENGER_AUTHENTICATED_LIVE_TEST=1 for existing CLI authentication only
✔ preserves configured integrations unless isolation explicitly requested (0.147042ms)
✔ UTF8 split across chunks preserves accents and emoji (0.585792ms)
✔ RPC response arriving synchronously during write is resolved (0.337375ms)
✔ failed command resolution can be retried (0.841334ms)
✔ stale process exit cannot clear a replacement connection (0.509834ms)
✔ write errors reject immediately and retain RPC error metadata (0.279292ms)
✔ modern modes, named permissions, tiers and dynamic efforts survive saved settings (0.190375ms)
✔ history requests full items and permissions are exclusive with sandbox (0.273916ms)
✔ command deltas append to the same item while retaining the command and cwd (0.471042ms)
✔ interleaved items preserve separate streamed output (0.157208ms)
✔ subagent completion interleaved with a parent response preserves the parent stream (0.160209ms)
✔ public reasoning summaries assemble by index without exposing raw reasoning (0.194958ms)
✔ patch updates replace the previous file snapshot with the actual new diff (0.261125ms)
✔ MCP progress updates preserve tool attribution (0.189833ms)
✔ MCP progress preserves the result once and replaces the previous progress (0.097542ms)
✔ later MCP progress keeps the completed authoritative result body (0.107125ms)
✔ completed snapshots explicitly end pending items and replace streamed output (0.073416ms)
✔ deltas received before a snapshot create one visible item (0.061ms)
✔ plan activities keep one stable identity per turn and preserve server steps (0.210375ms)
✔ plans from separate threads sharing a contact and turn ID retain separate identities (0.069542ms)
✔ token usage distinguishes real zero counts from unavailable counts (0.109459ms)
✔ turn diff activity displays the actual diff and has a stable per-turn ID (0.044666ms)
✔ unknown activities and raw reasoning activity do not create transcript text (0.043667ms)
✔ bounded output decoder preserves UTF-8 bytes independently across stdout and stderr (0.433625ms)
✔ process handles decode separately from other processes (0.114917ms)
✔ decoder limits displayed chunks and clear resets its state (0.149792ms)
✔ decoder reports when the current chunk was clipped (0.06275ms)
✔ decoder never retains more than the configured stream count (0.17875ms)
✔ invalid base64 cannot create output or consume a stream slot (0.038917ms)
✔ command and combined process output remain within the 256k display cap (0.299709ms)
✔ output caps preserve valid Unicode at the clipping boundary (0.066125ms)
✔ file output deltas append once and keep the latest authoritative patch (0.135292ms)
✔ terminal interaction status does not store or echo a secret stdin value (0.04825ms)
✔ invalid output cannot evict a stream waiting for its remaining Unicode bytes (0.064083ms)
✔ custom stopped status flushes partial text and clears only the stopped contact (0.605625ms)
✔ exit status cleans up a busy conversation without a recognized notice text (0.103541ms)
✔ error status cleans up a busy conversation without a recognized notice text (0.078458ms)
✔ completed status preserves pending asynchronous questions and queued deltas (0.094833ms)
✔ ready status preserves pending asynchronous questions and queued deltas (0.066584ms)
✔ conversation routing accepts its worker envelopes and rejects another thread (0.073959ms)
✔ public agent metadata attaches to its item without storing private fields (0.134375ms)
✔ legacy metadata targets the latest agent answer and unknown item IDs do not fall back (0.053292ms)
✔ completed turn finalizes partial answer and plan without rewriting their source (0.127ms)
✔ interrupted turn finalizes partial answer and plan without rewriting their source (0.032542ms)
✔ failed turn finalizes partial answer and plan without rewriting their source (0.03175ms)
✔ worker turn finalization cannot stop the parent stream with an identical turn ID (0.073708ms)
✔ worker lifecycle stops the worker conversation when opened and keeps its parent active (0.05825ms)
﹣ current local CLI feature catalog truthfully reports unavailable runtime methods without account or network (0.035208ms) # Set CODEX_MESSENGER_LIVE_PROTOCOL_TEST=1 to check the installed CLI
✔ the catalog uses real capabilities and preserves independent sections on an unsupported endpoint (1.316417ms)
✔ a catalog without a conversation omits thread-only calls (0.19425ms)
✔ catalog pagination fetches every page and detects repeated cursors (0.833083ms)
✔ goal edits send only requested fields, support explicit pause, and validate budgets (0.781708ms)
✔ skill and app mentions must belong to the installed effective runtime (0.288291ms)
✔ connector authentication and reload use schema-supported methods (0.166458ms)
✔ credit consumption requires explicit confirmation and fresh eligibility, and reuses its idempotency key (0.315ms)
✔ archive, restore, rename and terminal actions target only the verified conversation (0.252625ms)
✔ the IPC surface never accepts an arbitrary RPC method (0.137208ms)
✔ model options use advertised reasoning and service values and clear incompatible selections (0.193041ms)
✔ quota rendering prefers multi-bucket usage and does not invent unavailable usage (0.123292ms)
✔ account login cancellation targets only Messenger login IDs and logout requires explicit confirmation (0.1455ms)
✔ unreported model modalities stay unknown (0.036667ms)
✔ an uncertain successful reset is reconciled with its original key after fresh quotas changed (0.382916ms)
✔ text queue CRUD preserves correlation IDs and reorders the complete current queue (1.560667ms)
✔ queue edits cannot silently replace attachments or another conversation (0.211042ms)
✔ an uncertain queue send is reconciled without replaying its submission (0.696208ms)
✔ memory mode is an explicit accepted action rather than an invented readable toggle (0.255958ms)
✔ server thread search preserves cursors and hides conversations outside the selected contact (0.296542ms)
✔ server occurrence search uses exact thread scope and UTF-16 match metadata (0.1685ms)
✔ manual compact checks fresh idle direct-input metadata and sends only the schema threadId (0.177584ms)
✔ modern history revert requires explicit confirmation and freshly verified last user turn (0.591125ms)
✔ Codex 0.156.0 does not dispatch the removed legacy rollback RPC (0.267083ms)
✔ lost successful history revert cannot delete another turn on a stale retry (0.37175ms)
✔ same-service historical mutations serialize before any second deletion RPC (0.603334ms)
✔ unmaterialized paginated history preserves visible server refusal and performs no mutation (0.288375ms)
✔ usage dashboard reads account and verified thread scopes without fabricating missing counters (0.239875ms)
✔ usage provider failures remain independent and unknown daily activity remains null (0.276375ms)
✔ a thread usage estimate cannot expose another thread billing route (0.172417ms)
✔ plugin inventory uses installed booleans and MCP capabilities only as advertised (0.24625ms)
✔ observed resume mode is readonly sanitized runtime metadata and never pins user settings (0.446917ms)
﹣ actual 0.156.0 binary: discovery, metadata and unmaterialized history capability (0.035708ms) # SKIP
✔ normalizes Codex option aliases used by saved settings (0.074125ms)
✔ maps UI sandbox choices to app-server sandboxPolicy payloads (0.048625ms)
✔ labels option values for toolbar summaries (0.048625ms)
✔ normalizes language choices and returns Codex language instructions (0.101083ms)
✔ detects explicit Codex CLI path and reads version/login status (175.126375ms)
✔ reports Codex login status success and failure (323.210167ms)
✔ checks the minimum supported Codex CLI version (0.495709ms)
✔ automatic discovery skips an old PATH Codex for the first supported fallback (0.179708ms)
✔ automatic discovery preserves a supported PATH command before later candidates (0.09575ms)
✔ an unreadable candidate version does not hide a compatible fallback (0.119833ms)
✔ a candidate without a parseable version is not treated as supported (0.090166ms)
✔ discovery keeps the first command when no candidate has a verified supported version (0.091125ms)
✔ a manual Codex path is preserved even when its version is unsupported (165.408167ms)
✔ an explicit environment Codex override is preserved without automatic replacement (175.116667ms)
✔ resolves the official npm package executable for this platform (5.501667ms)
✔ resolves the installed official optional platform package executable (3.944542ms)
✔ the resolved npm executable runs when Node is absent from PATH (360.118791ms)
✔ keeps the original command for a non-Codex npm package or missing vendor executable (7.86525ms)
✔ does not select another platform's npm vendor executable (4.664417ms)
✔ every 0.156.0 generated ThreadItem type retains its identity and a display representation (1.097958ms)
✔ user and agent messages preserve actual text, question metadata and media descriptors (0.426958ms)
✔ commands and patches keep complete stdout, exit zero, cwd and authoritative diffs (0.136333ms)
✔ MCP, dynamic and code-mode function outputs display only provided result content (0.340708ms)
✔ agent collaboration, subagent activity and web searches remain attributable (0.225583ms)
✔ reasoning displays server-provided summaries without exposing raw content (0.151666ms)
✔ future item types have a visible safe fallback rather than disappearing (0.092125ms)
✔ plan, diff, usage and status notifications produce authoritative partial snapshots (0.143042ms)
✔ item deltas distinguish append updates from replacement patches and progress (0.10325ms)
✔ base64 command and process notifications stay connection-scoped and decode split Unicode (0.1645ms)
✔ unknown and malformed notifications are ignored; actual lifecycle items remain visible (0.116375ms)
✔ 0.156.0 file-backed image descriptors retain IDs without inventing a URL (0.147792ms)
✔ 0.156.0 MCP UI descriptors preserve the resource and advertised display preference (0.117583ms)
✔ resume observes the server mode before a first prompt without overriding user Auto choices (0.33375ms)
✔ observations are independent per thread, reset on old responses and stop, and never replace explicit choices (0.250083ms)
✔ malformed collaboration modes remain unobserved and raw instructions are never retained (0.065167ms)
✔ preload forwards the exact readonly voice getter and scalar preference setter contracts (1.790541ms)
✔ a resume response settled immediately before stop cannot restore stale loaded state or mode (0.290958ms)
✔ Enter confirms IME input without sending; Shift+Enter remains a newline (0.093042ms)
✔ mixed image and local-file attachments preserve every path and use real input types (0.26975ms)
✔ image-only drafts can send without inserting fictional text labels (0.123041ms)
✔ invalid attachment paths are excluded and attachment count is bounded (0.1255ms)
✔ slash commands do not swallow trailing instructions (0.170666ms)
✔ structured skill and connector input is retained with bounded canonical fields (0.280583ms)
✔ rejects oversized, unknown, empty and malformed sends (0.224958ms)
✔ MediaRecorder codec parameters and limits are validated (0.329875ms)
✔ longer matching fences preserve shorter fences as literal source (0.303166ms)
✔ unfinished streaming Mermaid stays code and a suffix cannot close its fence (0.254ms)
✔ display equations support paired dollar and bracket blocks without interpreting prices (0.311209ms)
✔ unfinished math and math inside ordinary code retain their literal source (0.098ms)
✔ ordinary Markdown headings, quotes and both list types retain their content (0.604083ms)
✔ rich diagrams bound source and reject external image/CSS resources before rendering (0.395ms)
✔ Codex paths with spaces and source positions open the real local file (0.280542ms)
✔ remote hosts, dangerous schemes, malformed URLs and encoded control characters are not local files (0.366708ms)
✔ native assets return exact known local bytes with MIME and opaque-file CORS (11.211125ms)
✔ native asset allowlist rejects unknown resources, methods, credentials and traversal without disk reads (0.966875ms)
✔ native asset handler refuses symlinks outside the asset root and oversized files (3.465584ms)
✔ every active original emoticon, display picture and wink is readable media (29.9885ms)
✔ background catalog uses the original media and honest callback support (10.575708ms)
✔ 42 preserved exports and 79 classic icons match original pixels and Microsoft labels (50.28025ms)
✔ all 16 decoded dynamic-background members match their SHA256 and size (3.60325ms)
✔ all 68 preserved package members and 8 bundled Ruffle files match original hashes (48.007375ms)
✔ literal asset references and the isolated-player documents are present (40.249667ms)
✔ MSN Flash accepts only the original local WINK and dynamic background sources (0.92875ms)
✔ MSN Flash cannot contact networks, navigate URLs or call host JavaScript (0.056667ms)
✔ realtime uses exact V3 websocket contract and waits for the connected notification (1.114625ms)
✔ V3 validates voices against the actual V1 voice list and enforces one call (0.462459ms)
✔ stop cancels a pending thread lookup before microphone transport starts (0.110917ms)
✔ realtime events stay scoped to a known call and server loss releases call state (0.1265ms)
✔ a Codex voice error cleans the remote session and concurrent stops send one request (0.141875ms)
✔ microphone frames reject corrupt base64, wrong sample rates, stereo and inconsistent lengths (0.465542ms)
✔ unavailable and unauthorized voice errors explain the actual Codex limitation (0.121084ms)
✔ realtime IPC maps only the verified request endpoints (0.339833ms)
✔ PCM encoding clips finite samples and reads little endian interleaved channels (0.807459ms)
✔ PCM resampling preserves fractional timing across input chunk boundaries (5.799708ms)
✔ browser audio captures PCM, immediately mutes the real track and schedules contiguous playback (2.565959ms)
✔ closing a call during the microphone permission prompt stops a late acquired microphone (0.188667ms)
✔ audio congestion closes the microphone instead of retaining an unbounded recording (12.995541ms)
✔ audio worklet averages input channels and sends complete float frames (2.584667ms)
✔ canonical voice transcripts replace compatibility streams without duplicate speech (0.3305ms)
✔ short microphone transport bursts preserve every unmuted PCM frame (6.847291ms)
✔ rapid mute and unmute never replay microphone frames captured before mute (1.351125ms)
✔ a paused playback clock retains a forty second incoming speech burst in order (19.367458ms)
✔ the official F8 call shortcut yields to repeats, modifiers and handled shortcuts (0.107833ms)
✔ voice preference reads the public Codex user setting and writes only its leaf (0.319083ms)
✔ a removed saved voice becomes Auto and uses the discovered server default without rewriting settings (0.313291ms)
✔ voice preference preserves managed overrides and exposes failed writes (0.276792ms)
✔ release metadata is consistent across package, README, and website (4.99825ms)
✔ release build keeps Codex app-server integration stable (0.940791ms)
✔ GitHub workflows keep release and Electron smoke checks stable (0.722083ms)
✔ external URL guard only allows known safe protocols and hosts (0.176125ms)
✔ IPC validation helpers reject unsafe payload shapes (0.254792ms)
✔ server requests retain wire IDs and expose a separate local ID (0.175834ms)
✔ unsupported and malformed requests cannot become actionable prompts (0.161333ms)
✔ command decisions honor server restrictions and exact proposed amendments (0.440625ms)
✔ file approvals use file decisions and display the actual changed files (0.139167ms)
✔ legacy approvals emit the structured denied decision required by Codex (0.264459ms)
✔ question responses require valid question IDs and option labels (0.113208ms)
✔ free answers are accepted only for questions that permit them (0.054042ms)
✔ permission choices reconstruct only the requested paths, entries and network access (0.398292ms)
✔ permission replies cannot escalate requested access or enable unrequested network (0.2995ms)
✔ MCP form validation enforces enum values, numeric limits and real dates (0.980083ms)
✔ MCP replies validate accepted content and clear declined form content (0.417625ms)
✔ server resolution matches typed wire IDs and never sends a reply (0.499875ms)
✔ another contact and stale dialogs cannot answer a pending request (0.35675ms)
✔ invalid answers leave the dialog pending for correction (0.135833ms)
✔ normal turn completion preserves asynchronous questions but expires blocking prompts (0.149084ms)
✔ interruption and process cleanup expire requests without synthesizing approvals (0.124459ms)
✔ turn and thread cleanup leave other conversations intact (0.111709ms)
✔ secret answers reach Codex without appearing in resolution notifications (0.1ms)
✔ requests without a matching conversation return a wire error (0.06775ms)
✔ permission subsets retain every deny restriction (0.248333ms)
✔ secret MCP defaults are removed before a form reaches the conversation (0.094625ms)
✔ MCP URL responses carry an explicit action and no arbitrary answer content (0.063458ms)
✔ duplicate requests are delivered once and wrong-thread resolution has no effect (0.107ms)
✔ a stale local ID cannot answer a reused wire ID after a server restart (0.094ms)
✔ concurrent clicks send one wire response (0.1185ms)
✔ a failed wire send leaves the response available for retry (0.136625ms)
✔ failed dialog delivery does not retain an unreachable request (0.091167ms)
✔ a failed resolution notification cannot report an already-sent answer as unsent (0.096542ms)
✔ a completed subagent turn cannot expire its parent's pending question (0.112792ms)
✔ a interrupted subagent turn cannot expire its parent's pending question (0.530459ms)
✔ a failed subagent turn cannot expire its parent's pending question (0.045792ms)
✔ terminal execution uses exact server PTY fields and selected read-only policy (1.020792ms)
✔ named permissions are sent without an overriding sandbox policy (0.216375ms)
✔ streamed base64 bytes decode split Unicode exactly once and final output is deferred (0.392958ms)
✔ stdin, PTY resize and stop belong exclusively to the initiating window (0.390792ms)
✔ terminal validates commands, dimensions, stdin and session limits before unsafe requests (0.321542ms)
✔ connection failures and renderer closure finish sessions and terminate owned processes (0.276709ms)
✔ the IPC surface exposes only validated terminal operations and the Windows shell is derived locally (0.113708ms)
✔ worker deltas, public message metadata and item lifecycle keep the parent turn active (3.926708ms)
✔ an explicitly opened child conversation receives its own interrupted completion (1.043208ms)
✔ nested workers route to their ancestor contact with bounded cycle-safe public IDs (0.935334ms)
✔ version helpers support package and release tag formats (0.099917ms)
✔ front release asset selection prefers platform installer assets (0.324208ms)
✔ Codex image items expose renderable image attachments (0.743208ms)
✔ Windows update installer script avoids launching a broken root path (0.166083ms)
✔ Windows installer relaunches the app during silent legacy updates (0.528375ms)
✔ project opening chooses the newest active thread, including hidden tabs (0.207666ms)
✔ all supported languages expose update dialog copy (0.194834ms)
✔ production iframe can load only the exact packaged WINK player document (1.148625ms)
✔ development iframe requires the same loopback origin and exact player document (1.137458ms)
✔ main frame remains restricted to the renderer while the player keeps browser sandbox isolation (0.634875ms)
ℹ tests 240
ℹ suites 0
ℹ pass 237
ℹ fail 0
ℹ cancelled 0
ℹ skipped 3
ℹ todo 0
ℹ duration_ms 3388.785792