Update LiteLLM to 1.104.0, OpenAI to 2.54.0, and python-dotenv to 1.2.2.
Raise shared security floors for aiohttp, anyio, urllib3, filelock, fsspec,
and multidict while retaining the compatible OpenAI 2.x SDK line.
Use the existing startup_migration hook to apply the same requirements to
v2.x Docker instances updating to v2.14. Read versions from requirements.txt,
install only when requirements are unmet, and reuse restart_process() to
load the upgraded SDKs before serving requests. Skip current and non-Docker
environments, bound installation time, and propagate installation failures.
Add installed-SDK HTTP tests for Chat Completions, Responses, streaming,
tools, state, usage, fallback, embeddings, and Anthropic cache markers.
Cover dependency migration, restart behavior, and installation failures.
Validation:
- 70 focused dependency, SDK, and self-update tests passed.
- Docker startup upgraded the v2.0-v2.13 SDK pins and became healthy in
24 seconds, with exactly one dependency installation and process restart.
- An already-current startup performed no installation or extra restart.
- pip check passed; live Codex Responses and Moonshot Chat Completions
tasks and follow-ups validated the upgraded SDK versions.
Track rollback snapshots by Git object ID so an existing stash does not
make a successful snapshot look like a failure. Apply the saved object
and resolve its current reflog entry for cleanup, preserving unrelated
stashes and retaining snapshots when restoration fails.
Upgrade installed updater copies through the existing startup migration.
Cover staged, unstaged and untracked changes, changing stash stacks,
conflicts and stale runtimes. All 50 focused tests pass; the installed
framework-runtime check passes and the restarted WebUI returns HTTP 200.
Refresh an existing Codex CLI after successful or already-current self-updates without making npm failures fatal. Bootstrap the new behavior when startup synchronizes a stale runtime updater, and cover both paths with focused regressions.
Add a core startup migration that refreshes /exe/self_update_manager.py from the repository copy when the installed runtime updater is missing the socket-safe backup and Desktop cleanup markers.
Validate the source updater before replacing anything, preserve the previous runtime script as a backup, and leave current or non-regular targets untouched. Add regression coverage for stale runtime replacement, safe no-op/refusal paths, and the real repository updater source.
Add comprehensive file-level DOX documentation across the repo and update directory AGENTS.md indexes. Many new `*.py.dox.md` files were added under api, helpers, tools, plugins, extensions, webui, and other dirs to document endpoint purpose, ownership, runtime contracts, work guidance, and verification. Several AGENTS.md files were created or updated (agents profiles, api, docker, extensions, helpers, plugins, skills, webui components, etc.) to list child DOX files and clarify documentation/work guidance. Also add example and bundled profile DOX files (agent0, default, developer, hacker, researcher) and minor updates to helpers/dirty_json.py and its tests. These changes improve on-disk documentation coverage and establish the convention that each direct runtime file should have a matching `*.dox.md` describing its contracts and verification steps.
- Change @extensible decorator to generate extension paths from full module and qualname hierarchies instead of flattened names
- Update extension path format from `{module}_{qualname}_{start|end}` to `_functions/<module>/<qualname>/{start|end}`
- Move all extension files to new deep directory structure under `_functions/` to match new path format
- Replace PathSpec.from_lines(GitWildMatchPattern, ...) with PathSpec.from_lines
