[mintuhouse]

• Upgrade all 14 direct TanStack AI packages to ^1.0.0 and replace obsolete compatibility code with supported v1 types and APIs.

• Preserve committed tool decisions and final authorization checks, delegate MCP header encoding to the SDK, and retain strict input validation and recovery behavior.

• Record reported usage from failed model phases, apply one-hour cache-write pricing, and reject known oversized sandbox artifacts before reading their bytes.

• Deploy Platform and SDK together. The v1 protocol removes deprecated request data and nested error fields, while saved conversations retain their existing format.

• Browser walkthrough in Playwright Chromium, before and after v1. Sampled playback covers Retry, upload preview/reload, history, Stop and the sanitized provider error. See the test plan and results for coverage and limitations.

  

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-23T08:01:31.471646Z	291fc17	PR opened
🔒 Security Review	✅ Completed 2026-10-23T08:03:54.898457Z	291fc17	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[mintuhouse]

Validation results for 291fc1727b935206320f098e36641e3400c253d0

Gate	Result	Test duration
Platform ready	Passed checks/build and 538 tests. The default no-database run skipped 140 integration cases.	17.99s
SDK ready	Passed checks/build and 182 tests.	6.60s
Todos ready	Passed checks/build and 3 tests.	0.091s
Disposable PostgreSQL chat/MCP integration	60 passed, 1 internal worker entry skipped.	10.46s
Standalone Platform binary smoke	Passed startup and health check.
Post-PR Platform default browser suite	14 passed, no failures, flakes, skips or retries.	4m 6.239s
Post-PR Todos app browser suite	66 passed, including 2 preflight checks, no failures, flakes, skips or retries.	2m 23.287s

• Base 8c45fee4 versus this PR: 21 established Playwright Chromium checks passed on each version, covering Retry, drafts, upload preview/reload, history and Stop before/after dispatch. UI and recovery behavior matched. The base sends legacy data plus forwardedProps; v1 sends only forwardedProps, preserving thread/run/client identity. Playback is sampled and normalized, not a timing benchmark.
• All 13 hosted checks passed. Codex code/security reviews and Cursor Bugbot completed without findings, and no inline review threads remain.
• Final review of this exact head against 8c45fee49947081becd001d0a7414d9021b472a4 covered all 33 files, installed v1 API behavior, tool authorization and persistence order, failed-call accounting, MCP header boundaries, sandbox cancellation/size checks, and test value. No additional actionable defects or unnecessary changes were found. The head is unchanged, so the existing validation above remains applicable.
• Five existing live model/tool/attachment cases per revision were blocked by the same configured-provider token_invalidated response. Both show the same sanitized unavailable message. Successful live model/tool execution remains unverified.
• An optional external mocked tool/widget/questionnaire journey was inconclusive for questionnaire submission/reload on both revisions. It is excluded from the passing counts and GIF. Existing SDK tests cover the underlying lifecycle.
• Live sandbox artifact publication/download and remote-provider transfer cancellation remain unverified. Unit tests cover preflight rejection, growth after metadata inspection, metadata failure and signal forwarding. No Docker or cloud sandbox was invoked.
• The working tree is clean. sdk/README.md is unchanged, Phase 2 remains deferred in the chat, and this single commit is unsigned as authorized.

Test plan derived from all 33 touched files

Touched files and blocks	Expected behavior and checks
platform/package.json, sdk/package.json, bun.lock	Coordinated 1.0.0 runtime, SDK bundling, generated API, build and standalone startup. No experimental harness dependency.
chat/adapter.ts, adapter tests, model-providers/test-model.server.ts, model-providers/web.server.ts	Remove obsolete typing defaults, require probe thread IDs, preserve provider routes, credentials, media and current web capability metadata. Compare real assistant replies in browser.
threads/commands.ts and fixtures, chat route schema, OpenAPI, SDK generated API	Preserve supported context, forwardedProps, thread/run identity and saved history while removing deprecated fields. Compare fresh sends and continuations.
chat/chat.ts, chat.test.ts	Strict input policy, safe top-level errors, bounded internal diagnostics. Verify error presentation, Stop and Retry in browser and redaction in unit tests.
threads/stream.ts, stream.test.ts	Commit decisions before effects, check final authority after argument transforms, retain invalid-input failures and unknown external outcomes, persist billed usage before text. Verify host-tool continuation and reload.
usage-limits.ts and tests, usage-cost.ts and tests, chat README	Successful and failed phases accounted once, native/spec error usage supported, one-hour writes priced as a subset. Verify exact amounts through deterministic independent examples.
chat/web.ts, web tests, provider-tool filtering in threads/stream.ts	Preserve native-web replay and prevent provider tools from becoming local tool execution.
mcp/tools.server.ts, tests, architecture docs	Native header encoding retains strict input/output validation, own-property semantics, safe integers, credential isolation, cancellation and no replay after a lost response.
sandbox/sandbox.ts, sandbox/tools.ts, tests, architecture docs	Forward filesystem signals, refuse known oversized regular files before transfer, catch growth after stat, recover from metadata failures. Live provider cancellation and artifact download are separate evidence.
sdk/src/core/session-persistence.test.ts	Public interrupt bindings and request-correlated IDs preserve host tool/widget continuation, hydration safety, Stop/Retry and selection fences.
examples/todos/e2e/pages/chat-widget.ts	Send is confirmed by an actual outgoing transcript message. Apply equivalent synchronization to both comparison versions.

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	www-astralbeam-ai	291fc17	Commit Preview URL Branch Preview URL	Oct 23 2026, 08:00 AM

[mintuhouse]

@cursor review

[cursor]

✅ Bugbot reviewed your changes and found no new issues!

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 291fc17. Configure here.}