chore(reconcile): merge upstream v1.2.0 with fork behaviors retained - #26
Merged
Merged
Conversation
LibreChat-AI#226) * Discover bounded repository instructions for opted-in workspaces * Verify snapshot digests and cross-platform confinement
* feat(code): register explicitly selected project roots * fix(code): reject shared Git metadata for selected projects * fix(code): pin selected project identity through executor admission * fix(code): preserve full filesystem identity precision * Check selected project identity before replay staging * Anchor replay copies to the verified working directory * fix: Bind Selected Project Operations to Held Directory Descriptors * test: Cover Selected Project PTC and Load Native Fixtures Before Platform Simulation * fix: Keep Native Root Bindings Worker-Local and Verify Directory Ancestry * fix: Anchor Project Admission and Preserve Search Permissions
…rors (LibreChat-AI#227) * fix: Distinguish workspace admission capacity from execution expiry * test: Preserve execution uncertainty while classifying blocked follow-ups * fix: Classify admission expiry at the enqueue boundary
…reChat-AI#233) * ci: Fix Release Version Resolution for Untagged and Resumed Runs The release workflow resolved its version in one inline shell block under `set -euo pipefail`, where two paths could not succeed. Filtering tags through `grep` made a no-match fatal. On the ordinary untagged tip of `main`, `git tag --points-at HEAD | grep -E '^v[0-9]+...'` exits 1, and the step died before reaching its skip handling or `next-release-version.sh`, so a deployable commit could not obtain a release version (LibreChat-AI#228). Selecting stable tags now reads exit 1 as an empty answer while exit 2 and above still fail the release, which also lets the missing-previous-tag case report its own error. The rerun-resume path then rejected the tag it had itself chosen. With a stable tag already pointing at `HEAD` and no release published, the version comes from that tag, and the following existence check failed merely because the ref existed (LibreChat-AI#229). It now compares the tag's commit against the release commit, so only a tag on some other commit is a collision; `Create tag` already tolerates a tag that exists. The block moved into `.github/scripts/resolve-release-version.sh`, beside the `next-release-version.sh` it calls, so `tests/release-version-resolution.sh` can cover every path: automatic, resumed, skipped, dispatched, pushed-tag, and the runs that must be refused, each against a throwaway repository with a stubbed `gh`. * fix: harden release resolver execution --------- Co-authored-by: Lia <lia@librechat.ai> Co-authored-by: Danny Avila <danny@librechat.ai>
rschlaefli
marked this pull request as ready for review
September 18, 2026 13:12
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What this does
Merges upstream
v1.2.0(fd9a4fa) into the fork on top of the v1.1.0 baseline, carrying the three upstream changes the fork did not yet have:4c7b224) — bounded repository-instruction discovery for attached workspaces (packages/code,service/src/bridge)95bfcbd) — selected coding-project registration (root-access,project-roots,root-identity, CLI gating)672e195) — workspace admission capacity reported instead of ambiguous timeout errors (service/src/bridge/store.ts)The other two v1.2.0 commits (LibreChat-AI#233 release version resolution, LibreChat-AI#225 read-only tip check) were already ported by PR #25.
The merge is conflict-free and keeps upstream files byte-identical to
v1.2.0except the fork's two recorded deltas already onmain: therelease.ymljob guard (fork note +if: ${{ false }}) and thechmod 0555spec-guard line inci.yml, where upstream's two new test steps are appended unchanged.Why it is safe
fd9a4fa; theci.ymlmerge adds only upstream's two test steps ("Verify fleet admission with isolated Redis", "Selected project root containment tests")..github/workflows/ci.yml; all ten recorded fork behaviors are otherwise untouched, anddocs/fork/patches.mdrecords the new audit basis.Verification
bun run test: 1097 pass / 0 fail / 12 skipbun run test: 481 pass / 0 failv1.2.0checkout on this hosttests/release-version-resolution.shandtests/release-versioning.shpassScope
This PR stops at the verified branch. Merging into
mainis a separate decision; the plan file (docs/project/2026-09-18-upstream-v1.2.0-integration-plan.md) records the package, evidence, and remaining gated dispositions.