Takes the upstream delta e4fe007150..00910569e0 from just-every/code, our
proximate upstream. hanzo/dev has no merge-base with any upstream (its history
was rewritten, so every SHA differs while the root trees are identical), so
this lands as a 3-way apply of the delta rather than a merge. Zero conflicts:
the upstream delta touches 249 files, our fork diverges in 140, and the two
sets intersect in exactly 2 files (protocol.rs, chatwidget.rs), both pure
additions that leave every Hanzo identity line alone.
Carries the surface the sandbox agent needs, with the codex PR numbers intact:
57f42a8113 tool search: no clone of immutable metadata on cache hits (#37279)
e1831db7c3 reuse MCP handlers across sampling steps (#37273)
bfb6a6ea22 plugin roots in the host skill loader (#37267)
1151b23f01 start cached MCP servers lazily for subagents (#37261)
7a0e974e08 harden network proxy MITM authorization (#37211)
98da2c4499 reserve the `tool_search` namespace for the search tool (#37188)
1dc93cdeb0 refresh the codex-rs mirror to codex main
codex-rs/ is a vendored mirror that just-every refreshes wholesale; patching it
directly would be overwritten by the next refresh, so we take their refresh
instead of cherry-picking from openai/codex.
Our history is just-every's with author emails rewritten, so the graphs are
disjoint and git finds no merge base. Supplied one by hand: d1f1f51a41, the
just-every commit matching our Oct-2025 fork point (22 files apart). 9618
upstream commits, 7004 files, +1.81M/-159k, 37 conflicts.
Resolution:
- Upstream code where our side was the Oct-2025 prototype of a feature they
have since reimplemented 3-5x larger (agent_runs, browser_sessions,
history_cell/{agent,browser}, the vt100 harness and its snapshots).
- Upstream's config.rs module split (builder/defaults/sources/validation)
kept; zen5-coder and the provider-follows-model rule re-applied on top.
- Ours where the file IS the identity: README, package.json, postinstall,
release notes pipeline, integration-zed.
- Hybrid where upstream improved a file we had branded: updates.rs (their
release-repo migration, our hanzoai/dev), release.yml (their fail-fast npm
auth check, our package name), chatwidget.rs (their turn handling, our
HANZO_USER_KEY hint), exec human output (their 237 lines, our banner).
Superseded and dropped deliberately: our resume_command_name() coder-alias
hack — upstream's derive_resume_command_name() reads the invocation basename
generically, which yields "dev" for us.
LLM.md now records the real topology and the sync point; AGENTS.md and
CLAUDE.md are symlinks to it again. Single parent on purpose: adopting
jecode/main as a second parent would re-import 13,742 commits carrying the
upstream author emails a prior rewrite deliberately removed.
Version 0.2.188 -> 0.2.189.
Co-authored-by: Hanzo Dev <[email protected]>
zeekay
