fix: bound multipart encrypted agent task recovery

[lidge-jun]

Summary

Recover one ordered, consecutive run of up to 32 complete encrypted task parts through the existing authenticated ChatGPT recovery request. The aggregate ciphertext limit stays 2 MiB, cache identity includes part boundaries/order, and input is revalidated before replacement. No additional upstream retries are introduced.

Relates to #3661. Bounded split-token detection prevents otherwise unreadable fragments from becoming plaintext during normalization, but does not reconstruct tokens or claim upstream multipart fidelity. Independent readable task text retains the existing mixed-content policy. #3794 diagnostics remain intact.

This PR is independent of plaintext-prevention PR #4351; both target dev. Read-only merge previews against current dev and between siblings are clean. Neither PR closes #3661.

This stacked tip also carries the hub browser pairing panel from #4378. Capture of that panel on the current GUI build:

Verification

• Local tests, suites, builds, typecheck and install: NOT RUN, explicitly prohibited by the maintainer for this lane.
• Focused checks after restacking onto current dev: bun run typecheck; bun test of the touched catalog/pairing/French files.
• git diff --check: passed (whitespace only).
• Regression code covers multipart order/cache isolation, byte/count limits, malformed slots, asynchronous input mutation, split-token refusal, mixed plaintext compatibility and single-attempt HTTP 503 diagnostics.
• Independent agent static security review: PASS; this is not maintainer approval.
• Current tip is the stacked head after merging origin/dev 4a49d7f34. Earlier heads are not verification evidence.
• No live backend canary was run. Split-token recovery and general upstream fidelity remain unresolved acceptance criteria.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[lidge-jun]

리뷰 · 우선순위 71 / 80

이 PR은 암호화된 agent task recovery가 한 번에 최대 32개의 연속·완전한 Fernet 파트만 한 번의 인증된 ChatGPT recovery 요청으로 복구하게 합니다. 합산 ciphertext는 2MiB 한도를 유지하고, 캐시 키에 파트 경계·순서를 넣으며, 치환 전에 input 스냅샷으로 재검증합니다. 추가 upstream 재시도는 없습니다. #3661 관련이고, 지금은 MERGEABLE draft입니다.

findEnvelope는 예전처럼 단일 ciphertext만 고르지 않고, 연속 encrypted_content 런을 모읍니다. 각 슬롯은 구조적으로 유효한 Fernet 토큰 하나여야 하고, 중간에 다른 파트가 끼면 null입니다. injectAssignment는 JSON.stringify(item) === inputSnapshot일 때만 splice로 여러 파트를 하나의 plaintext assignment로 바꿉니다. encrypted-payload.ts의 splitFernetParts는 조각난 토큰을 "감지"만 하고, 합쳐서 recovery를 허가하지는 않습니다.

현재 dev에 이미 agent-task-recovery.ts / encrypted-payload.ts가 있고, 이 PR은 그 위를 안전하게 확장합니다. 테스트가 security·multipart 경계·33파트 거부·바이트 오버플로·비연속 런을 꽤 잘 덮습니다. v2_contracts 플랜 문서가 같이 들어오지만 런타임과 분리되어 있습니다.

라인 / 심볼 - findEnvelope - 비문자 encrypted_content면 즉시 null. 맞지만, 부분 성공 없이 전체 거부여서 운영 로그에 이유가 안 남을 수 있음(원하면 debug만)
경로/심볼 - splitFernetParts - 감지용 join이 recovery 경로와 분리된 것은 좋음. sanitize가 protectedFragments를 건너뛰는지 tip 테스트가 초록인지 확인
경로/심볼 - cacheKey가 JSON.stringify(ciphertexts) 사용 - 순서·중복 유지(32개 동일 토큰 허용 테스트 있음). 의도 명확함
경로/심볼 - MAX_AGENT_TASK_* 상수를 encrypted-payload로 옮김 - recovery와 sanitize가 같은 한도를 쓰게 되어 일관적
경로/심볼 - 로컬 테스트 NOT RUN by maintainer instruction - hosted CI 결과만으로 ready 판단할지

메인테이너의 판단이 필요한 지점

• draft를 CI 초록 확인 직후 ready로 올릴지
• 플랜 문서(devlog/_plan/260912_v2_contracts)를 같은 PR에 둘지, 런타임 픽스만 먼저 랜딩할지
• unreadable_encrypted_agent_task intermittently fails routed V2 subagent dispatch (strict recovery envelope; no retry during chatgpt.com 5xx windows) #3661 이슈를 이 PR로 닫을지, recovery UX 이슈는 남길지

너의 추천
CI·보안 테스트가 tip에서 통과하면 draft 해제 후 dev에 우선 랜딩 후보로 둔다. 플랜 md가 거슬리면 런타임+테스트만 남기고 문서는 후속 PR로 분리해도 된다. 중복 recovery PR이 있으면 이쪽을 남기고 나머지는 close.

이 댓글은 grok-bot이 작성했습니다

[github-actions]

✅ READY

• all PR quality gates passed.

Hygiene

✅ Deterministic PR hygiene checks passed.

[lidge-jun]

Maintainer integration record — singles lane tip, merged by @lidge-jun.

Tip of the cumulative singles chain. Merging with a merge commit lands all nine and lets GitHub close each link as MERGED: #4356 (empty forced-answer retry), #4363 (Cursor overflow and thread remints), #4367 (sideband handshake validation), #4366 (oversized inline image shrinking), #4378 (hub browser pairing guidance), #4402 (opencode management catalog authority), #4414 (coordinator refusal phase evidence), #4353 (auxiliary listener diagnosis), and #4364 (bounded multipart encrypted agent task recovery).

These nine share no ordering dependency beyond two pairs — #4356/#4363 both touch src/web-search/loop.ts, and #4367/#4353 both touch src/server/index.ts — so the chain preserves their relative order. It exists to collapse nine CI runs into one.

• Exact head at integration: f05925178b84ec805ecab6902f6e93f6a8532814.
• CI evidence: Cross-platform CI run https://github.com/lidge-jun/opencodex/actions/runs/34732904764 — ci aggregate, gates, Linux shards 1-4 and both macOS shards all pass on this head.
• Ancestry verified with git merge-base --is-ancestor for all eight links against this tip, which is what lets them close as merged rather than by hand.
• Earlier failures on this tip were real and lane-caused, not dev drift: an untranslated connection.pairing.hub French catalog key, a sidecar?.vision.enabled crash in DashboardSidecarPanels that timed out two pairing tests, and two opencode-management-transport cases relying on Bun's global fetch honouring HTTP_PROXY. All were fixed on this head.
• Non-tip links carried [skip ci] by design. Tip-only CI for this batch is an explicit repository-owner decision; MAINTAINERS.md otherwise requires a per-PR check, so this is a recorded deviation rather than something the maintainer-integration clause grants.
• enforce-target reports missing UI screenshot because the cumulative tip carries dashboard and pairing UI work. By owner decision the screenshots for this batch are collected into one follow-up pull request alongside the regression audit, so this gate is not a merge blocker here.
• Review state: no outstanding maintainer change requests.
• Security review: not applicable — no authentication, credential, OAuth, workflow, release-automation, or dependency-installation surface.
• Local verification on the lane: typecheck, structure:check, privacy:scan passed; focused tests passed per link. No local full-suite run was used as evidence.

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-13T02:46:04.243166Z	f059251	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.