Merge pull request #140 from closedloop-ai/FEA-763

FEA-763: Persist onboarding profile and filter Codex diagnostics

Author: shafty023

apps/desktop/package.json

@@ -1,6 +1,6 @@
 {
   "name": "desktop",
-  "version": "0.14.7",
+  "version": "0.14.8",
   "description": "ClosedLoop Desktop",
   "author": "ClosedLoop AI <support@closedloop.ai>",
   "private": true,

apps/desktop/src/main/app.ts

@@ -800,18 +800,7 @@ export class DesktopApplication {
     if (this.shouldStopManagedOnboardingRun(run, "managed key persistence")) {
       return;
     }
-    this.apiKeyStore.setApiKey(claimResult.apiKey, "DESKTOP_MANAGED");
-    this.persistActiveProfileKey(claimResult.apiKey, "DESKTOP_MANAGED");
     const keyPair = this.gatewaySigningKeyStore.load(activeGatewayId);
-    this.persistActiveConfigManagedMetadata({
-      apiKeySource: "DESKTOP_MANAGED",
-      gatewayId: activeGatewayId,
-      ...(keyPair.ok
-        ? { gatewayPublicKeyPem: keyPair.keyPair.publicKeySpkiPem }
-        : {}),
-      desktopSecurityUpgradeProtocolVersion: 1,
-      pendingOnboardingAttemptId: null,
-    });
     const sandboxBaseDirectory = normalizeScopePath(
       payload.sandboxBaseDirectory,
     );
@@ -820,6 +809,7 @@ export class DesktopApplication {
         ? sandboxBaseDirectory
         : null;
 
+    this.apiKeyStore.setApiKey(claimResult.apiKey, "DESKTOP_MANAGED");
     this.settingsStore.update({
       apiOrigin: trustedConfig.config.apiOrigin,
       relayOrigin: trustedConfig.config.relayOrigin,
@@ -831,10 +821,21 @@ export class DesktopApplication {
           }
         : { onboardingCompleted: false }),
     });
-    this.settingsStore.updateActiveConfigOrigins({
-      apiOrigin: trustedConfig.config.apiOrigin,
-      relayOrigin: trustedConfig.config.relayOrigin,
-      webAppOrigin: payload.webAppOrigin,
+    const activeConfig =
+      this.settingsStore.ensureActiveConfigForCurrentOrigins();
+    this.apiKeyStore.saveProfileKey(
+      activeConfig.id,
+      claimResult.apiKey,
+      "DESKTOP_MANAGED",
+    );
+    this.settingsStore.updateConfigManagedMetadata(activeConfig.id, {
+      apiKeySource: "DESKTOP_MANAGED",
+      gatewayId: activeGatewayId,
+      ...(keyPair.ok
+        ? { gatewayPublicKeyPem: keyPair.keyPair.publicKeySpkiPem }
+        : {}),
+      desktopSecurityUpgradeProtocolVersion: 1,
+      pendingOnboardingAttemptId: null,
     });
 
     if (safeSandboxBaseDirectory) {

apps/desktop/src/main/settings-store.ts

@@ -34,6 +34,7 @@ type SavedConfigOriginsPatch = Pick<
   "relayOrigin" | "apiOrigin" | "webAppOrigin"
 >;
 
+const DEFAULT_MANAGED_ONBOARDING_CONFIG_NAME = "Default";
 const UUID_V4_RE =
   /^[0-9a-f]{8}-[0-9a-f]{4}-4[0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 
@@ -283,6 +284,62 @@ export class SettingsStore {
     );
   }
 
+  private getAvailableConfigName(preferredName: string): string {
+    const baseName = this.validateConfigName(preferredName);
+    const usedNames = new Set(
+      this.getSavedConfigs().map((config) =>
+        config.name.trim().toLocaleLowerCase(),
+      ),
+    );
+    if (!usedNames.has(baseName.toLocaleLowerCase())) {
+      return baseName;
+    }
+    for (let suffix = 2; suffix < 1000; suffix += 1) {
+      const candidate = `${baseName} ${suffix}`;
+      if (!usedNames.has(candidate.toLocaleLowerCase())) {
+        return candidate;
+      }
+    }
+    throw new Error(`No available config name for "${baseName}"`);
+  }
+
+  /**
+   * Ensures the current runtime origins are represented by an active saved
+   * profile, reusing a matching profile before creating a default one.
+   */
+  ensureActiveConfigForCurrentOrigins(
+    preferredName = DEFAULT_MANAGED_ONBOARDING_CONFIG_NAME,
+  ): SavedConfig {
+    const relayOrigin = this.getRelayOrigin();
+    const apiOrigin = this.getApiOrigin();
+    const webAppOrigin = this.getWebAppOrigin();
+
+    const activeConfig = this.getActiveConfig();
+    if (activeConfig) {
+      return (
+        this.updateActiveConfigOrigins({
+          relayOrigin,
+          apiOrigin,
+          webAppOrigin,
+        }) ?? activeConfig
+      );
+    }
+
+    const matchingConfig = this.findConfigByOrigins(
+      relayOrigin,
+      apiOrigin,
+      webAppOrigin,
+    );
+    if (matchingConfig) {
+      return this.applyConfig(matchingConfig.id);
+    }
+
+    const savedConfig = this.saveConfig(
+      this.getAvailableConfigName(preferredName),
+    );
+    return this.applyConfig(savedConfig.id);
+  }
+
   saveConfig(name: string): SavedConfig {
     const trimmedName = this.validateConfigName(name);
     const configs = this.getSavedConfigs();

apps/desktop/src/server/operations/codex.ts

@@ -14,6 +14,7 @@ import { assertRepoAllowed, ensureWorktreeForReview, resolveWorktreeDir, resolve
 import { json } from "./response-utils.js";
 
 const CODEX_SESSION_ID_REGEX = /session id:\s*([0-9a-f-]{36})/i;
+const CODEX_ROLLOUT_ITEM_RECORDING_DIAGNOSTIC_REGEX = /^\d{4}-\d{2}-\d{2}T[^\s]+\s+ERROR\s+codex_core::session:\s+failed to record rollout items:\s+thread\s+[0-9a-f-]{36}\s+not found$/i;
 const FINDINGS_CODE_BLOCK_REGEX = /```json\s*\n([\s\S]*?)\n\s*```/;
 const FINDINGS_ARRAY_REGEX = /\[[\s\S]*\]/;
 const PR_PREFIX_REGEX = /^pr-/;
@@ -161,17 +162,37 @@ export function extractTextFromNdjsonLog(raw: string, truncated = false): string
     try {
       const event = JSON.parse(line) as { type?: string; content?: string; error?: string };
       if (event.type === "text" && typeof event.content === "string") {
-        parts.push(event.content);
+        const content = stripCodexNonUserDiagnostics(event.content);
+        if (content) {
+          parts.push(content);
+        }
       } else if (event.type === "error" && typeof event.error === "string") {
-        parts.push(event.error);
+        const error = stripCodexNonUserDiagnostics(event.error);
+        if (error) {
+          parts.push(error);
+        }
       }
     } catch {
-      parts.push(line);
+      const content = stripCodexNonUserDiagnostics(line);
+      if (content) {
+        parts.push(content);
+      }
     }
   }
   return parts.join("");
 }
 
+/**
+ * Removes Codex CLI diagnostics that describe local rollout recording failures,
+ * not model review output or actionable user-facing failures.
+ */
+export function stripCodexNonUserDiagnostics(text: string): string {
+  return text
+    .split("\n")
+    .filter((line) => !CODEX_ROLLOUT_ITEM_RECORDING_DIAGNOSTIC_REGEX.test(line.trim()))
+    .join("\n");
+}
+
 function tryKillRunningReview(state: ReviewState): void {
   if (state.status === "running" && state.pid) {
     try {
@@ -848,8 +869,9 @@ export function registerCodexRoutes(
       // Detect context window exhaustion — codex exited mid-review, findings are incomplete
       const isContextError = exitCode !== 0 && /context window|out of room/i.test(stderrHolder.value);
 
-      if (exitCode !== 0 && !isContextError && stderrHolder.value.trim()) {
-        writeEvent(context.response, { type: "error", error: stderrHolder.value.trim() });
+      const stderrForUser = stripCodexNonUserDiagnostics(stderrHolder.value).trim();
+      if (exitCode !== 0 && !isContextError && stderrForUser) {
+        writeEvent(context.response, { type: "error", error: stderrForUser });
       }
 
       const finalState: ReviewState = {
@@ -1764,7 +1786,8 @@ async function streamClaudeReview(
   });
 }
 
-function streamCodexReview(
+/** @internal Streams Codex review stdout to SSE while retaining stderr for diagnostics. */
+export function streamCodexReview(
   child: ChildProcess,
   response: ServerResponse,
   logPath: string,
@@ -1797,8 +1820,6 @@ function streamCodexReview(
     const text = typeof chunk === "string" ? chunk : chunk.toString("utf-8");
     logStream.write(text);
     stderrHolder.value += text;
-    eventCount++;
-    writeEvent(response, { type: "text", content: text });
   });
 
   child.on("close", () => {

apps/desktop/test/codex-log-parsing.test.ts

@@ -4,8 +4,14 @@ import fs from "node:fs/promises";
 import os from "node:os";
 import path from "node:path";
 import { spawn } from "node:child_process";
+import type { ServerResponse } from "node:http";
 import { afterEach, describe, test } from "node:test";
-import { extractTextFromNdjsonLog, extractVerdictTag } from "../src/server/operations/codex.js";
+import {
+  extractTextFromNdjsonLog,
+  extractVerdictTag,
+  streamCodexReview,
+  stripCodexNonUserDiagnostics,
+} from "../src/server/operations/codex.js";
 import { createStreamState, processStreamEvent } from "../src/server/operations/stream-events.js";
 
 const tempPaths: string[] = [];
@@ -102,6 +108,20 @@ describe("extractTextFromNdjsonLog", () => {
 
     assert.equal(extractTextFromNdjsonLog(raw), "");
   });
+
+  test("removes Codex rollout recorder diagnostics from stored log text", () => {
+    const diagnostic = "2026-04-30T15:21:30.628333Z ERROR codex_core::session: failed to record rollout items: thread 019ddefa-3be6-7b32-a969-c0f364fb225c not found";
+    const raw = [
+      "Finding before diagnostic.",
+      diagnostic,
+      JSON.stringify({ type: "text", content: `Finding after diagnostic.\n${diagnostic}\n` }),
+    ].join("\n");
+
+    assert.equal(
+      extractTextFromNdjsonLog(raw),
+      "Finding before diagnostic.Finding after diagnostic.\n"
+    );
+  });
 });
 
 // ---------------------------------------------------------------------------
@@ -295,6 +315,49 @@ describe("streamClaudeReview log write ordering", () => {
 // ---------------------------------------------------------------------------
 
 describe("streamCodexReview flush-gate pattern", () => {
+  test("does not emit Codex stderr diagnostics as review text", async () => {
+    const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "codex-stderr-diagnostic-"));
+    tempPaths.push(tmpDir);
+    const logPath = path.join(tmpDir, "codex-review.log");
+    const diagnostic = "2026-04-30T15:21:30.714121Z ERROR codex_core::session: failed to record rollout items: thread 019ddefa-3a0e-78e2-90fa-c7c3e7bcc247 not found";
+
+    const child = spawn("node", [
+      "-e",
+      `process.stdout.write("review finding\\n"); process.stderr.write(${JSON.stringify(`${diagnostic}\n`)});`,
+    ]);
+
+    const events: Array<Record<string, unknown>> = [];
+    const response = {
+      destroyed: false,
+      writable: true,
+      write: (payload: string) => {
+        events.push(JSON.parse(payload) as Record<string, unknown>);
+        return true;
+      },
+    } as unknown as ServerResponse;
+    const stderrHolder = { value: "" };
+
+    await streamCodexReview(child, response, logPath, { value: undefined }, stderrHolder);
+
+    assert.deepEqual(
+      events.filter((event) => event.type === "text").map((event) => event.content),
+      ["review finding\n"]
+    );
+    assert.equal(events.some((event) => String(event.content ?? "").includes("failed to record rollout items")), false);
+    assert.match(stderrHolder.value, /failed to record rollout items/);
+
+    const logContent = await fs.readFile(logPath, "utf-8");
+    assert.match(logContent, /review finding/);
+    assert.match(logContent, /failed to record rollout items/);
+  });
+
+  test("stripCodexNonUserDiagnostics preserves real stderr failures", () => {
+    const diagnostic = "2026-04-30T15:21:30.628333Z ERROR codex_core::session: failed to record rollout items: thread 019ddefa-3be6-7b32-a969-c0f364fb225c not found";
+    const raw = `${diagnostic}\nreal failure\n${diagnostic}\n`;
+
+    assert.equal(stripCodexNonUserDiagnostics(raw), "real failure\n");
+  });
+
   test("log finish resolves only after all data is flushed from child stdout", async () => {
     const tmpDir = await fs.mkdtemp(path.join(os.tmpdir(), "codex-flush-gate-"));
     tempPaths.push(tmpDir);

apps/desktop/test/saved-configs.test.ts

@@ -131,6 +131,78 @@ test("findConfigByOrigins returns the matching config or null", () => {
   );
 });
 
+test("ensureActiveConfigForCurrentOrigins creates and activates a default profile", () => {
+  const tmpDir = makeTempDir("saved-configs-ensure-active-");
+  const store = makeSettings(tmpDir);
+  store.setRelayOrigin("https://relay.dev.test");
+  store.setApiOrigin("https://api.dev.test");
+  store.setWebAppOrigin("https://app.dev.test");
+
+  const config = store.ensureActiveConfigForCurrentOrigins("Default");
+
+  assert.equal(config.name, "Default");
+  assert.equal(config.relayOrigin, "https://relay.dev.test");
+  assert.equal(config.apiOrigin, "https://api.dev.test");
+  assert.equal(config.webAppOrigin, "https://app.dev.test");
+  assert.equal(store.getActiveConfigId(), config.id);
+  assert.equal(store.listConfigs().length, 1);
+});
+
+test("ensureActiveConfigForCurrentOrigins syncs origins onto the active profile", () => {
+  const tmpDir = makeTempDir("saved-configs-ensure-active-origins-");
+  const store = makeSettings(tmpDir);
+  store.setRelayOrigin("https://relay.old.test");
+  store.setApiOrigin("https://api.old.test");
+  store.setWebAppOrigin("https://app.old.test");
+  const existing = store.saveConfig("Development");
+  store.applyConfig(existing.id);
+  store.setRelayOrigin("https://relay.new.test");
+  store.setApiOrigin("https://api.new.test");
+  store.setWebAppOrigin("https://app.new.test");
+
+  const config = store.ensureActiveConfigForCurrentOrigins("Default");
+
+  assert.equal(config.id, existing.id);
+  assert.equal(config.relayOrigin, "https://relay.new.test");
+  assert.equal(config.apiOrigin, "https://api.new.test");
+  assert.equal(config.webAppOrigin, "https://app.new.test");
+  assert.equal(store.listConfigs().length, 1);
+});
+
+test("ensureActiveConfigForCurrentOrigins reuses a matching saved profile", () => {
+  const tmpDir = makeTempDir("saved-configs-ensure-reuse-");
+  const store = makeSettings(tmpDir);
+  store.setRelayOrigin("https://relay.dev.test");
+  store.setApiOrigin("https://api.dev.test");
+  store.setWebAppOrigin("https://app.dev.test");
+  const existing = store.saveConfig("Development");
+
+  const config = store.ensureActiveConfigForCurrentOrigins("Default");
+
+  assert.equal(config.id, existing.id);
+  assert.equal(config.name, "Development");
+  assert.equal(store.getActiveConfigId(), existing.id);
+  assert.equal(store.listConfigs().length, 1);
+});
+
+test("ensureActiveConfigForCurrentOrigins chooses an available default name", () => {
+  const tmpDir = makeTempDir("saved-configs-ensure-name-");
+  const store = makeSettings(tmpDir);
+  store.setRelayOrigin("https://relay.one.test");
+  store.setApiOrigin("https://api.one.test");
+  store.setWebAppOrigin("https://app.one.test");
+  store.saveConfig("Default");
+  store.setRelayOrigin("https://relay.two.test");
+  store.setApiOrigin("https://api.two.test");
+  store.setWebAppOrigin("https://app.two.test");
+
+  const config = store.ensureActiveConfigForCurrentOrigins("Default");
+
+  assert.equal(config.name, "Default 2");
+  assert.equal(store.getActiveConfigId(), config.id);
+  assert.equal(store.listConfigs().length, 2);
+});
+
 // --- listConfigs ---
 
 test("listConfigs returns configs in insertion order", () => {