Release v3.8.31 (#4377)

Release v3.8.31 — see CHANGELOG.md [3.8.31] for full notes and contributors.

Merged over known non-blocking reds (all correctness gates green): Integration Tests (2/2) is env/flaky (polls a real upstream batch that did not complete in the poll window); SonarQube/SonarCloud is the advisory server-side new-code quality gate. Unit (8 shards), Coverage, Node 22/24/26, Lint, PR Test Policy, Quality Ratchet, Docs-Strict, Quality-Extended and all 4 CodeQL analyses are green.

src/app/api/cli-tools/codex-settings/route.ts

@@ -15,6 +15,7 @@ import { cliModelConfigSchema } from "@/shared/validation/schemas";
 import { isValidationFailure, validateBody } from "@/shared/validation/helpers";
 import { getApiKeyById } from "@/lib/localDb";
 import { normalizeCodexBaseUrl } from "@/shared/utils/codexBaseUrl";
+import { migrateCodexFeatureFlags } from "@/shared/utils/codexConfig";
 
 const getCodexConfigPath = () => getCliConfigPaths("codex").config;
 const getCodexAuthPath = () => getCliConfigPaths("codex").auth;
@@ -252,6 +253,9 @@ export async function POST(request: Request) {
       /* No existing config */
     }
 
+    // Carry the user's intent forward off the deprecated Codex feature flag (#1327).
+    migrateCodexFeatureFlags(parsed);
+
     // Update only OmniRoute related fields (api_key goes to auth.json, not config.toml)
     parsed._root.model = model;
 
@@ -351,6 +355,9 @@ export async function DELETE(request: Request) {
       throw error;
     }
 
+    // Carry the user's intent forward off the deprecated Codex feature flag (#1327).
+    migrateCodexFeatureFlags(parsed);
+
     // Remove OmniRoute related root fields
     delete parsed._root.openai_base_url;