Carl723000 · Oct 15, 2026 · Oct 5, 2026 · Oct 5, 2026 · Oct 5, 2026 · Oct 5, 2026
@@ -36,11 +36,23 @@ jobs:
         run: npm ci
       - name: Run Node tests
         run: npm test
+      - name: Setup Node.js for native Zstd coverage
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: '22'
+      - name: Verify native compressed-log compatibility
+        run: |
+          node -e "if (!require('./out/providers/codex/codexZstd').supportsCodexZstd()) throw new Error('Native Zstd is unavailable')"
+          node --test out/test/codexZstd.test.js out/test/codexManifest.test.js out/test/codexCompressed*.test.js
 
-  ui:
-    name: UI Test
+  ui_shards:
+    name: UI Shard ${{ matrix.shard }}/4
     runs-on: ubuntu-latest
-    timeout-minutes: 20
+    timeout-minutes: 35
+    strategy:
+      fail-fast: false
+      matrix:
+        shard: [1, 2, 3, 4]
     container:
       image: mcr.microsoft.com/playwright:v1.61.1-noble
       options: --ipc=host
@@ -57,7 +69,19 @@ jobs:
       - name: Install dependencies
         run: npm ci
       - name: Run full Webview gate
-        run: npm run test:ui
+        run: npm run test:ui -- --fully-parallel --workers=1 --shard=${{ matrix.shard }}/4
+
+  # Preserve the stable required check and fail closed on any failed,
+  # cancelled or skipped shard. Each shard has its own VM/server/storage.
+  ui:
+    name: UI Test
+    needs: [ui_shards]
+    if: always()
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    steps:
+      - name: Require every UI shard to pass
+        run: test '${{ needs.ui_shards.result }}' = 'success'
 
   package:
     name: Release Package

@@ -15,10 +15,34 @@ Simplified-Chinese review copy lives in [AGENTS.zh-CN.md](AGENTS.zh-CN.md).
   the same provider-aware render functions and the same CSS contract.
 - Prefer token-attribution accuracy over billing precision. Keep exact totals,
   labelled estimates, and point-in-time quota observations as separate concepts.
-- Keep the extension local-first, lightweight, and read-mostly. Never modify
-  Claude or Codex conversation JSONL files. Treat credential handling as security-sensitive
-  and preserve the existing reviewed behavior.
-- Add no new runtime dependencies in v2.3.0.
+- Keep the extension local-first, lightweight, and read-mostly. Usage ingestion
+  and derived-data clearing never rewrite or delete provider conversation JSONL.
+  The existing, separately opt-in Session Actions feature may move exactly one
+  confirmed Claude log to the OS trash; this is not authority for an agent to
+  delete logs. Codex source logs remain read-only. Treat credential handling as
+  security-sensitive and preserve the existing reviewed behavior.
+- Add no new runtime dependencies for the current candidate without explicit
+  maintainer approval.
+
+## Maintainer decisions and agent execution
+
+- The maintainer owns user value, feature scope, defaults, disclosure and release
+  promises. Agents own implementation, counterexamples, regression tests,
+  performance measurements and evidence integration within the authorized scope.
+  Routine implementation choices do not require a new product decision.
+- For a feature, identify the user question, observable result, default/off/reset
+  behavior and privacy/resource constraints. Prefer the smallest coherent change;
+  code size, badge counts and green-test totals are not measures of user benefit.
+- Read documentation by task: `ARCHITECTURE.md` for module/data-flow changes,
+  `LOCAL-DATA.md` and its versioned baseline for retained/exported fields and
+  clearing, and `CONTRIBUTING.md` for test/package/release workflows. Small copy
+  edits do not require replaying every historical plan. Task-local worktree paths,
+  permissions and acceptance status belong in the current handoff, not this policy.
+- Distinguish source integration, synthetic tests, native behavior and user
+  acceptance. Missing data is not zero; passing fixtures do not establish that
+  upstream logs always satisfy the same assumptions. Reuse relevant independent
+  findings; seek a new bounded assessment for a substantive unresolved question,
+  not for every routine fix or delivery.
 
 ## Architecture boundaries
 
@@ -28,8 +52,9 @@ Simplified-Chinese review copy lives in [AGENTS.zh-CN.md](AGENTS.zh-CN.md).
   and content-analysis reducers retained for exact compatibility.
 - `src/claudeIncrementalIndex.ts`: the production in-memory per-file Claude
   usage index, append-tail parser, exact global deduplication, and materialized
-  dashboard aggregates. Runtime refreshes must not fall back to a full-corpus
-  body read or full-record aggregation.
+  dashboard aggregates. Unchanged warm refreshes must not fall back to a
+  full-corpus body read or full-record aggregation; documented correctness-first
+  content-analysis replay is a separate path, not the default for each watcher event.
 - `src/providers/providerTypes.ts` and provider adapters: provider-neutral token,
   coverage, confidence, and limit contracts. Do not erase provider semantics.
 - `src/providers/codex/`: allowed-root discovery, schema guards, exact-request
@@ -41,7 +66,9 @@ Simplified-Chinese review copy lives in [AGENTS.zh-CN.md](AGENTS.zh-CN.md).
   direct configuration reads.
 - `src/statusBar.ts`: status-bar token/cost/quota/context presentation.
 - `src/webview.ts`: the single provider-aware Claude/Codex dashboard HTML and
-  client behavior. Compare never sums cost or quota across providers.
+  client behavior, plus existing host-side receipt/notice ownership. New pure
+  calculations and eligibility rules belong in domain modules, not another
+  renderer or duplicated scan. Compare never sums cost or quota across providers.
 - `src/i18n.ts`: all user-facing copy for all eight UI locales.
 - `src/types.ts`: shared contracts.
 - Read `ARCHITECTURE.md` before changing module ownership or the data flow. If
@@ -54,8 +81,9 @@ Simplified-Chinese review copy lives in [AGENTS.zh-CN.md](AGENTS.zh-CN.md).
   session IDs, credentials, or local usernames. New v2.3.0 performance
   diagnostics must not log them either; do not broaden older diagnostic output
   without an explicit privacy review.
-- Codex discovery is allowlisted to `$CODEX_HOME/sessions/**/*.jsonl` and
-  `$CODEX_HOME/archived_sessions/**/*.jsonl` (default `~/.codex`). Never read
+- Codex usage discovery is allowlisted to `.jsonl` and `.jsonl.zst` regular files
+  recursively under `$CODEX_HOME/sessions` and `$CODEX_HOME/archived_sessions`
+  (default `~/.codex`); reject symlinks and non-regular files. Never read
   `auth.json`, SQLite databases, config secrets, keychains, browser state, or
   unknown files for Codex usage.
 - Additionally, `$CODEX_HOME/session_index.jsonl` may be streamed solely to
@@ -102,11 +130,12 @@ Simplified-Chinese review copy lives in [AGENTS.zh-CN.md](AGENTS.zh-CN.md).
   returns to the low-power incremental path.
 - Claude runtime refreshes use the in-memory per-file index in
   `claudeIncrementalIndex.ts`. An unchanged refresh reads zero JSONL bodies;
-  append/truncate/replace/move/delete work is limited to affected files and
-  affected aggregate groups while preserving the established response-identity
-  and content-analysis semantics. A new Extension Host may still perform one
-  cold in-memory build; this is distinct from rereading the corpus after every
-  watcher event.
+  an ordinary verified single-file append reads its tail and updates affected
+  groups. With content analysis enabled, unsafe truncation/replacement/deletion,
+  changed source order or UUID first-owner changes can require an ordered wider
+  replay to preserve exact semantics. Report that cost separately; never turn it
+  into unconditional full-corpus work on each watcher event. A new Extension Host
+  may still perform one cold in-memory build.
 - Codex optimization advice uses structural numeric signals only. Never inspect
   or persist prompt/response/command bodies or tool arguments.
 
@@ -128,6 +157,15 @@ npx @vscode/vsce package
 - User-facing changes require a `CHANGELOG.md` entry and matching documentation.
 - UI changes also require an F5 Extension Development Host smoke test; release
   candidates require an installed-VSIX smoke test on macOS and Linux when available.
+- Before F5, installation or a second Code instance uses fixtures, identify and
+  isolate every writable profile, extension/shared/agent store, global/workspace
+  storage, provider home, derived cache and lock path. A window or worktree alone
+  is not isolation. Follow `tests/native/README.md`, verify actual storage paths
+  and compare selected normal-state metadata/hashes before and after. Unexplained
+  differences remain unknown, not proof of non-disruption. Never replace the
+  daily installation or run a plain default-profile install as a test shortcut.
+- Documentation-only edits verify affected facts, links and document/policy
+  tests. They do not establish new runtime, native, performance or release passes.
 
 ### UI rendering-environment fidelity
 
@@ -138,13 +176,16 @@ that invariant. Visual snapshots produced before this is true are not acceptance
 evidence.
 Variable values must come from the registered values of VS Code's built-in themes;
 do not mix in another color system.
+This is a necessary rendering-fidelity guard, not native acceptance for resource
+URIs, fonts, screen readers, actual zoom or installed-package behavior.
 
 ### Interaction-state acceptance
 
-Webview refresh is a full-page replacement. Every new user-interactive state
-(expand/collapse, sorting, filtering, or selection) must use the existing
-persistence mechanism and include an operation → reload → state-remains test.
-A static assertion of the first render is not acceptance evidence.
+Webview updates may use a full-page replacement or a provider-panel live patch.
+Every new user-interactive state (expand/collapse, sorting, filtering, or
+selection) must use the existing persistence mechanism and include an operation
+→ update → reload → state-remains test, preserving relevant focus and scroll
+anchors. A static assertion of the first render is not acceptance evidence.
 
 ## Localization and review documents
 
@@ -167,7 +208,27 @@ A static assertion of the first render is not acceptance evidence.
 - Tracked files default to mode `100644` and LF endings. Use `100755` only for a
   real directly executed program, register it in the repository policy test,
   and verify modes with `git ls-files --stage` before committing.
-- Keep commits focused. The repository squash-merges reviewed PRs to `main`.
+- This project defaults to **Squash and merge**: each reviewed PR contributes
+  one commit to `main`, including multi-stage features, performance work and
+  version development. A normal merge or rebase merge is an exception only when
+  explicitly specified by the maintainer for that PR.
+- Local progress commits are separate from the PR merge strategy. Preserve
+  meaningful implementation, test and fix commits until the PR is merged so
+  stages remain available for verification and rollback; do not pre-squash them
+  merely to prepare a PR. Preserving their original SHAs in `main` is not the default.
+- Commit at meaningful, verifiable milestones, not per file, agent turn or
+  contribution-graph target. Keep a logical change with its regression tests and
+  necessary documentation together. Fold trivial formatting, wording and immediate
+  fixups into related unpublished work; retain separate commits for independently
+  useful fixes or evidence-backed milestones until merge. Do not rewrite published
+  history or shared branches to apply this default. Leave previously squashed
+  history unchanged; do not reconstruct or re-merge old commits merely to restore
+  contribution-graph counts.
+- Preserve the original PR and truthful authorship when squashing: verify the
+  squash commit author and all applicable `Co-authored-by` trailers. Keep real
+  contributor credit on each Release change entry; an aggregate contributor list
+  is not a substitute. Squashing must not relabel another author's work as the
+  maintainer's or an assistant's.
 - Never copy changes from a contributor pull request into a maintainer PR and
   close the contributor PR as superseded. To preserve attribution, merge the
   contributor's original pull request, or—with explicit authorization—update that
@@ -215,4 +276,4 @@ Co-authored-by: OpenAI Codex <215057067+openai-codex[bot]@users.noreply.github.c
   privileged maintainer-only mention workflow.
 
 ## Codex 工具適配
-瀏覽器操作使用當前 Codex browser／computer-use 工具；原文的 Claude MCP 工具名稱只描述操作意圖，不能直接呼叫。提問依目前模式使用可用工具；Git 操作仍需當次明確授權。
+瀏覽器操作使用當前 Codex browser／computer-use 工具；原文的 Claude MCP 工具名稱只描述操作意圖，不能直接呼叫。提問依目前模式使用可用工具；已授權範圍內的本地小提交可保存進度，推送、PR、合併、tag 與發布仍須維護者明確授權。