[WRONG BRANCH] fix(codex): enforce base variant storage limits

[luvs01]

Motivation

• Prevent caller-supplied six-character IDs from creating new base-variant files and bypassing the MAX_BASE_VARIANTS cap.
• Ensure per-variant body size is validated at the management-route boundary so oversized base prompt bodies cannot be persisted or echoed back in snapshots.

Description

• Require caller-supplied id to refer to an existing variant in src/codex/prompt-layers.ts, making the server-generated-ID path the only way to create new variants.
• Apply normalization and the MAX_BODY_BYTES check in src/server/management/codex-prompt-routes.ts before calling the writer and reject oversized base-variant bodies.
• Pass the normalized body into the writer so stored files and size checks match what is persisted.
• Add route- and storage-level regression tests in tests/codex-prompt-base-variants.test.ts and tests/codex-prompt-route.test.ts that assert a caller-supplied (nonexistent) edit id cannot create a variant and that oversized creates are refused.

Testing

• ✅ Ran the focused management tests with bun test tests/codex-prompt-base-variants.test.ts tests/codex-prompt-route.test.ts --timeout 10000 and the updated cases passed.
• ✅ Ran type checking with bun run typecheck and it succeeded.
• ✅ Ran the privacy check with bun run privacy:scan and it succeeded.
• ⚠️ Ran the full test suite with bun run test; the modified prompt tests passed within the suite but there remain unrelated existing failures elsewhere in the suite (not introduced by these changes).

---

Codex Task

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

Important

• 🔍 Trigger review

This repository does not receive automatic reviews because it has fewer than 10 stars.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: abbca43f-062d-49da-af36-28acc3fd015f

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⏳ DRAFT

• wrong target branch (main); retarget to dev.

What to do

• Retarget this PR to dev — all contributions go to dev.

Its title has been prefixed with [WRONG BRANCH].
This pull request was already a draft. Its draft status will be preserved after every issue above is resolved.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8e7ab4d746

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Enforce the limit on the complete stored variant

When a dashboard-session client supplies a large title, this check measures only body, while writeBaseVariant prepends the unrestricted title to the persisted Markdown file and the subsequent snapshot reads it back. A title approaching the 4 MiB management-request limit therefore bypasses the new 64 KiB storage restriction and can still produce and echo a multi-megabyte base prompt. Validate the title and/or measure the complete serialized variant before writing it.

AGENTS.md reference: src/AGENTS.md:L20-L20

Useful? React with 👍 / 👎.