diff --git a/.bazelrc b/.bazelrc
index 911e0802b5..6357eb83e4 100644
--- a/.bazelrc
+++ b/.bazelrc
@@ -193,5 +193,10 @@ common --@v8//:v8_enable_sandbox=True
 common:v8-release-compat --@v8//:v8_enable_pointer_compression=False
 common:v8-release-compat --@v8//:v8_enable_sandbox=False
 
+# Match rusty_v8's upstream GN release contract for published artifacts: every
+# target object uses Chromium's custom libc++ headers and the archive folds in
+# the matching runtime objects.
+common:rusty-v8-upstream-libcxx --@v8//:v8_use_rusty_v8_custom_libcxx=True
+
 # Optional per-user local overrides.
 try-import %workspace%/user.bazelrc
diff --git a/.codex/skills/update-v8-version/SKILL.md b/.codex/skills/update-v8-version/SKILL.md
new file mode 100644
index 0000000000..512cc0d5a7
--- /dev/null
+++ b/.codex/skills/update-v8-version/SKILL.md
@@ -0,0 +1,72 @@
+---
+name: update-v8-version
+description: Update Codex's pinned `v8` / `rusty_v8` versions, validate the release-candidate path, and investigate failed V8 canary or artifact builds. Use when asked to bump V8, update `rusty_v8` artifacts, prepare or validate a V8 release candidate, check `v8-canary`, or diagnose why a V8 version update no longer builds.
+---
+
+# Update V8 Version
+
+## Core Workflow
+
+1. Read `third_party/v8/README.md` and follow its version-bump sequence. Treat
+   that document as the release-process source of truth.
+2. Inspect and update the concrete repo surfaces that carry the pin:
+   - `codex-rs/Cargo.toml`
+   - `codex-rs/Cargo.lock`
+   - `MODULE.bazel`
+   - `third_party/v8/BUILD.bazel`
+   - `third_party/v8/README.md`
+   - the matching `third_party/v8/rusty_v8_<version>.sha256` manifest when the
+     remaining prebuilt inputs change
+3. Keep the existing checksum helpers in the loop:
+
+   ```bash
+   python3 .github/scripts/rusty_v8_bazel.py update-module-bazel
+   python3 .github/scripts/rusty_v8_bazel.py check-module-bazel
+   python3 -m unittest discover -s .github/scripts -p test_rusty_v8_bazel.py
+   ```
+
+4. Validate the release-candidate path before broadening the work:
+   - Prefer checking the `v8-canary` CI result for the candidate branch or PR
+     when one exists, using GitHub check tooling or `gh` as appropriate.
+   - If CI is unavailable or the user asked for a local-only check, run the
+     closest local validation that is practical for the changed surface and say
+     explicitly that it is a local substitute, not the full hosted canary.
+5. If the canary path passes, stop there. Summarize the result and encourage the
+   user to commit the candidate changes or proceed with the release flow they
+   requested. Do not publish tags, releases, or pushes unless the user asked.
+
+## Failure Path
+
+Enter this path only when the canary or local build path fails.
+
+1. Capture the failing target, workflow job, and first actionable error.
+2. Compare the currently pinned version with the target version at the relevant
+   upstream tag or SHA. Inspect both:
+   - `denoland/rusty_v8`
+   - upstream V8 source at the target Bazel-pinned version
+3. Track build-relevant deltas rather than broad source churn:
+   - generated binding layout changes
+   - archive or asset naming changes
+   - GN/Bazel target changes
+   - custom libc++ / libc++abi / llvm-libc inputs
+   - sandbox or pointer-compression feature relationships
+   - patch hunks in `patches/` that no longer apply or no longer match upstream
+4. Trace each failing delta back into Codex's build graph:
+   - `MODULE.bazel`
+   - `third_party/v8/BUILD.bazel`
+   - `.github/scripts/rusty_v8_bazel.py`
+   - `.github/workflows/v8-canary.yml`
+   - `.github/workflows/rusty-v8-release.yml`
+5. Update only the pieces required to restore the target version's build and
+   artifact contract. Keep patch explanations and doc changes close to the
+   affected files.
+6. Re-run the focused validation. If it becomes green, return to the normal
+   workflow and stop with a concise summary plus the remaining release step.
+
+## Reporting
+
+- Say whether validation came from hosted `v8-canary` or from a local
+  substitute.
+- Distinguish "version bump complete" from "release published".
+- When blocked, report the upstream delta that matters, the Codex file it hits,
+  and the next concrete fix to try.
diff --git a/.codex/skills/update-v8-version/agents/openai.yaml b/.codex/skills/update-v8-version/agents/openai.yaml
new file mode 100644
index 0000000000..36e7af80d8
--- /dev/null
+++ b/.codex/skills/update-v8-version/agents/openai.yaml
@@ -0,0 +1,4 @@
+interface:
+  display_name: "Update V8 Version"
+  short_description: "Guide V8 bumps and release validation"
+  default_prompt: "Use $update-v8-version to update Codex to a new v8 release and validate the release-candidate path."
diff --git a/.github/ISSUE_TEMPLATE/3-cli.yml b/.github/ISSUE_TEMPLATE/3-cli.yml
index 37229c7f2b..cfd368c0ba 100644
--- a/.github/ISSUE_TEMPLATE/3-cli.yml
+++ b/.github/ISSUE_TEMPLATE/3-cli.yml
@@ -11,6 +11,8 @@ body:
 
         Make sure you are running the [latest](https://npmjs.com/package/@openai/codex) version of Codex CLI. The bug you are experiencing may already have been fixed.
 
+        If your version supports it, please run `codex doctor --json` and paste the output in the "Codex doctor report" field below. This helps us diagnose install, config, auth, terminal, MCP, network, and local state issues.
+
   - type: input
     id: version
     attributes:
@@ -43,6 +45,16 @@ body:
       description: |
         Also note any multiplexer in use (screen / tmux / zellij).
         E.g., VS Code, Terminal.app, iTerm2, Ghostty, Windows Terminal (WSL / PowerShell)
+  - type: textarea
+    id: doctor
+    attributes:
+      label: Codex doctor report
+      description: |
+        If available, run `codex doctor --json` and paste the full output here.
+
+        The report is designed to redact secrets, but please review it before submitting.
+        If your Codex version does not support `doctor`, write `not available`.
+      render: json
   - type: textarea
     id: actual
     attributes:
diff --git a/.github/actions/setup-rusty-v8-musl/action.yml b/.github/actions/setup-rusty-v8-musl/action.yml
index 871c73a268..fbec1feb46 100644
--- a/.github/actions/setup-rusty-v8-musl/action.yml
+++ b/.github/actions/setup-rusty-v8-musl/action.yml
@@ -31,16 +31,14 @@ runs:
         archive_path="${binding_dir}/librusty_v8_release_${TARGET}.a.gz"
         binding_path="${binding_dir}/src_binding_release_${TARGET}.rs"
         checksums_path="${binding_dir}/rusty_v8_release_${TARGET}.sha256"
-        checksums_source="${GITHUB_WORKSPACE}/third_party/v8/rusty_v8_${version//./_}.sha256"
 
         mkdir -p "${binding_dir}"
         curl -fsSL "${base_url}/librusty_v8_release_${TARGET}.a.gz" -o "${archive_path}"
         curl -fsSL "${base_url}/src_binding_release_${TARGET}.rs" -o "${binding_path}"
-        grep -E "  (librusty_v8_release_${TARGET}[.]a[.]gz|src_binding_release_${TARGET}[.]rs)$" \
-          "${checksums_source}" > "${checksums_path}"
+        curl -fsSL "${base_url}/rusty_v8_release_${TARGET}.sha256" -o "${checksums_path}"
 
         if [[ "$(wc -l < "${checksums_path}")" -ne 2 ]]; then
-          echo "Expected exactly two checksums for ${TARGET} in ${checksums_source}" >&2
+          echo "Expected exactly two checksums for ${TARGET} in ${checksums_path}" >&2
           exit 1
         fi
 
diff --git a/.github/scripts/rusty_v8_bazel.py b/.github/scripts/rusty_v8_bazel.py
index 5ad6d3c408..2f46daf45e 100644
--- a/.github/scripts/rusty_v8_bazel.py
+++ b/.github/scripts/rusty_v8_bazel.py
@@ -5,17 +5,18 @@ from __future__ import annotations
 import argparse
 import gzip
 import hashlib
+import os
 import re
 import shutil
 import subprocess
 import sys
-import tempfile
 import tomllib
 from pathlib import Path
 
 from rusty_v8_module_bazel import (
     RustyV8ChecksumError,
     check_module_bazel,
+    rusty_v8_http_file_versions,
     update_module_bazel,
 )
 
@@ -23,12 +24,16 @@ from rusty_v8_module_bazel import (
 ROOT = Path(__file__).resolve().parents[2]
 MODULE_BAZEL = ROOT / "MODULE.bazel"
 RUSTY_V8_CHECKSUMS_DIR = ROOT / "third_party" / "v8"
-MUSL_RUNTIME_ARCHIVE_LABELS = [
-    "@llvm//runtimes/libcxx:libcxx.static",
-    "@llvm//runtimes/libcxx:libcxxabi.static",
-]
-LLVM_AR_LABEL = "@llvm//tools:llvm-ar"
-LLVM_RANLIB_LABEL = "@llvm//tools:llvm-ranlib"
+RELEASE_ARTIFACT_PROFILE = "release"
+SANDBOX_ARTIFACT_PROFILE = "ptrcomp_sandbox_release"
+ARTIFACT_BAZEL_CONFIGS = ["rusty-v8-upstream-libcxx"]
+
+
+def bazel_remote_args() -> list[str]:
+    buildbuddy_api_key = os.environ.get("BUILDBUDDY_API_KEY")
+    if not buildbuddy_api_key:
+        return []
+    return [f"--remote_header=x-buildbuddy-api-key={buildbuddy_api_key}"]
 
 
 def bazel_execroot() -> Path:
@@ -75,6 +80,7 @@ def bazel_output_files(
             compilation_mode,
             f"--platforms=@llvm//platforms:{platform}",
             *[f"--config={config}" for config in bazel_configs],
+            *bazel_remote_args(),
             "--output=files",
             expression,
         ],
@@ -91,8 +97,10 @@ def bazel_build(
     labels: list[str],
     compilation_mode: str = "fastbuild",
     bazel_configs: list[str] | None = None,
+    download_toplevel: bool = False,
 ) -> None:
     bazel_configs = bazel_configs or []
+    download_args = ["--remote_download_toplevel"] if download_toplevel else []
     subprocess.run(
         [
             "bazel",
@@ -101,6 +109,8 @@ def bazel_build(
             compilation_mode,
             f"--platforms=@llvm//platforms:{platform}",
             *[f"--config={config}" for config in bazel_configs],
+            *bazel_remote_args(),
+            *download_args,
             *labels,
         ],
         cwd=ROOT,
@@ -114,11 +124,15 @@ def ensure_bazel_output_files(
     compilation_mode: str = "fastbuild",
     bazel_configs: list[str] | None = None,
 ) -> list[Path]:
-    outputs = bazel_output_files(platform, labels, compilation_mode, bazel_configs)
-    if all(path.exists() for path in outputs):
-        return outputs
-
-    bazel_build(platform, labels, compilation_mode, bazel_configs)
+    # Bazel output paths can be reused across config flips, so existence alone
+    # does not prove the files match the requested flags.
+    bazel_build(
+        platform,
+        labels,
+        compilation_mode,
+        bazel_configs,
+        download_toplevel=True,
+    )
     outputs = bazel_output_files(platform, labels, compilation_mode, bazel_configs)
     missing = [str(path) for path in outputs if not path.exists()]
     if missing:
@@ -126,9 +140,18 @@ def ensure_bazel_output_files(
     return outputs
 
 
-def release_pair_label(target: str) -> str:
+def artifact_bazel_configs(bazel_configs: list[str] | None = None) -> list[str]:
+    configured = list(ARTIFACT_BAZEL_CONFIGS)
+    for config in bazel_configs or []:
+        if config not in configured:
+            configured.append(config)
+    return configured
+
+
+def release_pair_label(target: str, sandbox: bool = False) -> str:
     target_suffix = target.replace("-", "_")
-    return f"//third_party/v8:rusty_v8_release_pair_{target_suffix}"
+    pair_kind = "sandbox_release_pair" if sandbox else "release_pair"
+    return f"//third_party/v8:rusty_v8_{pair_kind}_{target_suffix}"
 
 
 def resolved_v8_crate_version() -> str:
@@ -169,6 +192,16 @@ def rusty_v8_checksum_manifest_path(version: str) -> Path:
 def command_version(version: str | None) -> str:
     if version is not None:
         return version
+
+    manifest_versions = rusty_v8_http_file_versions(MODULE_BAZEL.read_text())
+    if len(manifest_versions) == 1:
+        return manifest_versions[0]
+    if len(manifest_versions) > 1:
+        raise SystemExit(
+            "expected at most one rusty_v8 http_file version in MODULE.bazel, "
+            f"found: {manifest_versions}; pass --version explicitly"
+        )
+
     return resolved_v8_crate_version()
 
 
@@ -180,66 +213,76 @@ def command_manifest_path(manifest: Path | None, version: str) -> Path:
     return ROOT / manifest
 
 
-def staged_archive_name(target: str, source_path: Path) -> str:
-    if source_path.suffix == ".lib":
-        return f"rusty_v8_release_{target}.lib.gz"
-    return f"librusty_v8_release_{target}.a.gz"
+def staged_archive_name(target: str, source_path: Path, artifact_profile: str) -> str:
+    if target.endswith("-pc-windows-msvc"):
+        return f"rusty_v8_{artifact_profile}_{target}.lib.gz"
+    return f"librusty_v8_{artifact_profile}_{target}.a.gz"
 
 
-def is_musl_archive_target(target: str, source_path: Path) -> bool:
-    return target.endswith("-unknown-linux-musl") and source_path.suffix == ".a"
+def staged_binding_name(target: str, artifact_profile: str) -> str:
+    return f"src_binding_{artifact_profile}_{target}.rs"
 
 
-def single_bazel_output_file(
-    platform: str,
-    label: str,
-    compilation_mode: str = "fastbuild",
-    bazel_configs: list[str] | None = None,
-) -> Path:
-    outputs = ensure_bazel_output_files(platform, [label], compilation_mode, bazel_configs)
-    if len(outputs) != 1:
-        raise SystemExit(f"expected exactly one output for {label}, found {outputs}")
-    return outputs[0]
+def staged_checksums_name(target: str, artifact_profile: str) -> str:
+    return f"rusty_v8_{artifact_profile}_{target}.sha256"
 
 
-def merged_musl_archive(
-    platform: str,
+def stage_artifacts(
+    target: str,
     lib_path: Path,
-    compilation_mode: str = "fastbuild",
-    bazel_configs: list[str] | None = None,
-) -> Path:
-    llvm_ar = single_bazel_output_file(platform, LLVM_AR_LABEL, compilation_mode, bazel_configs)
-    llvm_ranlib = single_bazel_output_file(
-        platform,
-        LLVM_RANLIB_LABEL,
-        compilation_mode,
-        bazel_configs,
-    )
-    runtime_archives = [
-        single_bazel_output_file(platform, label, compilation_mode, bazel_configs)
-        for label in MUSL_RUNTIME_ARCHIVE_LABELS
-    ]
+    binding_path: Path,
+    output_dir: Path,
+    sandbox: bool,
+) -> None:
+    missing_paths = [str(path) for path in [lib_path, binding_path] if not path.exists()]
+    if missing_paths:
+        raise SystemExit(f"missing release outputs for {target}: {missing_paths}")
 
-    temp_dir = Path(tempfile.mkdtemp(prefix="rusty-v8-musl-stage-"))
-    merged_archive = temp_dir / lib_path.name
-    merge_commands = "\n".join(
-        [
-            f"create {merged_archive}",
-            f"addlib {lib_path}",
-            *[f"addlib {archive}" for archive in runtime_archives],
-            "save",
-            "end",
-        ]
-    )
-    subprocess.run(
-        [str(llvm_ar), "-M"],
-        cwd=ROOT,
-        check=True,
-        input=merge_commands,
-        text=True,
-    )
-    subprocess.run([str(llvm_ranlib), str(merged_archive)], cwd=ROOT, check=True)
-    return merged_archive
+    output_dir.mkdir(parents=True, exist_ok=True)
+    artifact_profile = SANDBOX_ARTIFACT_PROFILE if sandbox else RELEASE_ARTIFACT_PROFILE
+    staged_library = output_dir / staged_archive_name(target, lib_path, artifact_profile)
+    staged_binding = output_dir / staged_binding_name(target, artifact_profile)
+
+    with lib_path.open("rb") as src, staged_library.open("wb") as dst:
+        with gzip.GzipFile(
+            filename="",
+            mode="wb",
+            fileobj=dst,
+            compresslevel=6,
+            mtime=0,
+        ) as gz:
+            shutil.copyfileobj(src, gz)
+
+    shutil.copyfile(binding_path, staged_binding)
+
+    staged_checksums = output_dir / staged_checksums_name(target, artifact_profile)
+    with staged_checksums.open("w", encoding="utf-8") as checksums:
+        for path in [staged_library, staged_binding]:
+            digest = hashlib.sha256()
+            with path.open("rb") as artifact:
+                for chunk in iter(lambda: artifact.read(1024 * 1024), b""):
+                    digest.update(chunk)
+            checksums.write(f"{digest.hexdigest()}  {path.name}\n")
+
+    print(staged_library)
+    print(staged_binding)
+    print(staged_checksums)
+
+
+def upstream_release_pair_paths(source_root: Path, target: str) -> tuple[Path, Path]:
+    lib_name = "rusty_v8.lib" if target.endswith("-pc-windows-msvc") else "librusty_v8.a"
+    gn_out = source_root / "target" / target / "release" / "gn_out"
+    return gn_out / "obj" / lib_name, gn_out / "src_binding.rs"
+
+
+def stage_upstream_release_pair(
+    source_root: Path,
+    target: str,
+    output_dir: Path,
+    sandbox: bool = False,
+) -> None:
+    lib_path, binding_path = upstream_release_pair_paths(source_root, target)
+    stage_artifacts(target, lib_path, binding_path, output_dir, sandbox)
 
 
 def stage_release_pair(
@@ -248,10 +291,12 @@ def stage_release_pair(
     output_dir: Path,
     compilation_mode: str = "fastbuild",
     bazel_configs: list[str] | None = None,
+    sandbox: bool = False,
 ) -> None:
+    bazel_configs = artifact_bazel_configs(bazel_configs)
     outputs = ensure_bazel_output_files(
         platform,
-        [release_pair_label(target)],
+        [release_pair_label(target, sandbox)],
         compilation_mode,
         bazel_configs,
     )
@@ -266,39 +311,7 @@ def stage_release_pair(
     except StopIteration as exc:
         raise SystemExit(f"missing Rust binding output for {target}") from exc
 
-    output_dir.mkdir(parents=True, exist_ok=True)
-    staged_library = output_dir / staged_archive_name(target, lib_path)
-    staged_binding = output_dir / f"src_binding_release_{target}.rs"
-    source_archive = (
-        merged_musl_archive(platform, lib_path, compilation_mode, bazel_configs)
-        if is_musl_archive_target(target, lib_path)
-        else lib_path
-    )
-
-    with source_archive.open("rb") as src, staged_library.open("wb") as dst:
-        with gzip.GzipFile(
-            filename="",
-            mode="wb",
-            fileobj=dst,
-            compresslevel=6,
-            mtime=0,
-        ) as gz:
-            shutil.copyfileobj(src, gz)
-
-    shutil.copyfile(binding_path, staged_binding)
-
-    staged_checksums = output_dir / f"rusty_v8_release_{target}.sha256"
-    with staged_checksums.open("w", encoding="utf-8") as checksums:
-        for path in [staged_library, staged_binding]:
-            digest = hashlib.sha256()
-            with path.open("rb") as artifact:
-                for chunk in iter(lambda: artifact.read(1024 * 1024), b""):
-                    digest.update(chunk)
-            checksums.write(f"{digest.hexdigest()}  {path.name}\n")
-
-    print(staged_library)
-    print(staged_binding)
-    print(staged_checksums)
+    stage_artifacts(target, lib_path, binding_path, output_dir, sandbox)
 
 
 def parse_args() -> argparse.Namespace:
@@ -309,6 +322,7 @@ def parse_args() -> argparse.Namespace:
     stage_release_pair_parser.add_argument("--platform", required=True)
     stage_release_pair_parser.add_argument("--target", required=True)
     stage_release_pair_parser.add_argument("--output-dir", required=True)
+    stage_release_pair_parser.add_argument("--sandbox", action="store_true")
     stage_release_pair_parser.add_argument(
         "--bazel-config",
         action="append",
@@ -321,6 +335,14 @@ def parse_args() -> argparse.Namespace:
         choices=["fastbuild", "opt", "dbg"],
     )
 
+    stage_upstream_release_pair_parser = subparsers.add_parser(
+        "stage-upstream-release-pair"
+    )
+    stage_upstream_release_pair_parser.add_argument("--source-root", type=Path, required=True)
+    stage_upstream_release_pair_parser.add_argument("--target", required=True)
+    stage_upstream_release_pair_parser.add_argument("--output-dir", required=True)
+    stage_upstream_release_pair_parser.add_argument("--sandbox", action="store_true")
+
     subparsers.add_parser("resolved-v8-crate-version")
 
     check_module_bazel_parser = subparsers.add_parser("check-module-bazel")
@@ -353,6 +375,15 @@ def main() -> int:
             output_dir=Path(args.output_dir),
             compilation_mode=args.compilation_mode,
             bazel_configs=args.bazel_configs,
+            sandbox=args.sandbox,
+        )
+        return 0
+    if args.command == "stage-upstream-release-pair":
+        stage_upstream_release_pair(
+            source_root=args.source_root,
+            target=args.target,
+            output_dir=Path(args.output_dir),
+            sandbox=args.sandbox,
         )
         return 0
     if args.command == "resolved-v8-crate-version":
diff --git a/.github/scripts/rusty_v8_module_bazel.py b/.github/scripts/rusty_v8_module_bazel.py
index 7f474fc5d2..5d5dec08d5 100644
--- a/.github/scripts/rusty_v8_module_bazel.py
+++ b/.github/scripts/rusty_v8_module_bazel.py
@@ -9,6 +9,7 @@ from pathlib import Path
 
 SHA256_RE = re.compile(r"[0-9a-f]{64}")
 HTTP_FILE_BLOCK_RE = re.compile(r"(?ms)^http_file\(\n.*?^\)\n?")
+HTTP_FILE_VERSION_RE = re.compile(r"^rusty_v8_([0-9]+)_([0-9]+)_([0-9]+)_")
 
 
 class RustyV8ChecksumError(ValueError):
@@ -95,6 +96,18 @@ def rusty_v8_http_files(module_bazel: str, version: str) -> list[RustyV8HttpFile
     return entries
 
 
+def rusty_v8_http_file_versions(module_bazel: str) -> list[str]:
+    versions = set()
+    for match in HTTP_FILE_BLOCK_RE.finditer(module_bazel):
+        name = string_field(match.group(0), "name")
+        if not name:
+            continue
+        version_match = HTTP_FILE_VERSION_RE.match(name)
+        if version_match:
+            versions.add(".".join(version_match.groups()))
+    return sorted(versions)
+
+
 def module_entry_set_errors(
     entries: list[RustyV8HttpFile],
     checksums: dict[str, str],
diff --git a/.github/scripts/test_rusty_v8_bazel.py b/.github/scripts/test_rusty_v8_bazel.py
index e86e82e8b2..19690dbece 100644
--- a/.github/scripts/test_rusty_v8_bazel.py
+++ b/.github/scripts/test_rusty_v8_bazel.py
@@ -4,11 +4,270 @@ from __future__ import annotations
 
 import textwrap
 import unittest
+from os import environ
+from pathlib import Path
+from tempfile import TemporaryDirectory
+from unittest.mock import patch
 
+import rusty_v8_bazel
 import rusty_v8_module_bazel
 
 
 class RustyV8BazelTest(unittest.TestCase):
+    def test_consumer_selectors_track_resolved_crate_version(self) -> None:
+        build_bazel = (
+            rusty_v8_bazel.ROOT / "third_party" / "v8" / "BUILD.bazel"
+        ).read_text()
+        version_suffix = rusty_v8_bazel.resolved_v8_crate_version().replace(".", "_")
+
+        for selector in [
+            "aarch64_apple_darwin_bazel",
+            "aarch64_pc_windows_gnullvm",
+            "aarch64_pc_windows_msvc",
+            "aarch64_unknown_linux_gnu_bazel",
+            "aarch64_unknown_linux_musl_release_base",
+            "x86_64_apple_darwin_bazel",
+            "x86_64_pc_windows_gnullvm",
+            "x86_64_pc_windows_msvc",
+            "x86_64_unknown_linux_gnu_bazel",
+            "x86_64_unknown_linux_musl_release",
+        ]:
+            self.assertIn(
+                f":v8_{version_suffix}_{selector}",
+                build_bazel,
+            )
+
+        for selector in [
+            "aarch64_apple_darwin",
+            "aarch64_pc_windows_gnullvm",
+            "aarch64_pc_windows_msvc",
+            "aarch64_unknown_linux_gnu",
+            "aarch64_unknown_linux_musl",
+            "x86_64_apple_darwin",
+            "x86_64_pc_windows_gnullvm",
+            "x86_64_pc_windows_msvc",
+            "x86_64_unknown_linux_gnu",
+            "x86_64_unknown_linux_musl",
+        ]:
+            self.assertIn(
+                f":src_binding_release_{selector}_{version_suffix}_release",
+                build_bazel,
+            )
+
+    def test_command_version_tracks_remaining_http_file_assets(self) -> None:
+        with TemporaryDirectory() as temp_dir:
+            module_bazel = Path(temp_dir) / "MODULE.bazel"
+            module_bazel.write_text(
+                textwrap.dedent(
+                    """\
+                    http_file(
+                        name = "rusty_v8_146_4_0_x86_64_unknown_linux_gnu_archive",
+                        downloaded_file_path = "librusty_v8_release_x86_64-unknown-linux-gnu.a.gz",
+                        urls = ["https://example.test/archive.gz"],
+                    )
+                    """
+                )
+            )
+
+            with patch.object(rusty_v8_bazel, "MODULE_BAZEL", module_bazel):
+                self.assertEqual("146.4.0", rusty_v8_bazel.command_version(None))
+
+    def test_artifact_bazel_configs_always_enable_upstream_libcxx(self) -> None:
+        self.assertEqual(
+            ["rusty-v8-upstream-libcxx"],
+            rusty_v8_bazel.artifact_bazel_configs(),
+        )
+        self.assertEqual(
+            ["rusty-v8-upstream-libcxx", "v8-release-compat"],
+            rusty_v8_bazel.artifact_bazel_configs(["v8-release-compat"]),
+        )
+        self.assertEqual(
+            ["rusty-v8-upstream-libcxx", "v8-release-compat"],
+            rusty_v8_bazel.artifact_bazel_configs(
+                ["rusty-v8-upstream-libcxx", "v8-release-compat"]
+            ),
+        )
+
+    def test_bazel_remote_args_include_buildbuddy_header_when_present(self) -> None:
+        with patch.dict(environ, {"BUILDBUDDY_API_KEY": "token"}, clear=False):
+            self.assertEqual(
+                ["--remote_header=x-buildbuddy-api-key=token"],
+                rusty_v8_bazel.bazel_remote_args(),
+            )
+
+        with patch.dict(environ, {}, clear=True):
+            self.assertEqual([], rusty_v8_bazel.bazel_remote_args())
+
+    def test_release_pair_labels_and_staged_names_distinguish_sandbox_artifacts(self) -> None:
+        self.assertEqual(
+            "//third_party/v8:rusty_v8_release_pair_x86_64_unknown_linux_musl",
+            rusty_v8_bazel.release_pair_label("x86_64-unknown-linux-musl"),
+        )
+        self.assertEqual(
+            "//third_party/v8:rusty_v8_sandbox_release_pair_x86_64_unknown_linux_musl",
+            rusty_v8_bazel.release_pair_label("x86_64-unknown-linux-musl", sandbox=True),
+        )
+        self.assertEqual(
+            "//third_party/v8:rusty_v8_sandbox_release_pair_x86_64_apple_darwin",
+            rusty_v8_bazel.release_pair_label("x86_64-apple-darwin", sandbox=True),
+        )
+        self.assertEqual(
+            "librusty_v8_release_x86_64-unknown-linux-musl.a.gz",
+            rusty_v8_bazel.staged_archive_name(
+                "x86_64-unknown-linux-musl",
+                Path("libv8.a"),
+                rusty_v8_bazel.RELEASE_ARTIFACT_PROFILE,
+            ),
+        )
+        self.assertEqual(
+            "rusty_v8_ptrcomp_sandbox_release_x86_64-pc-windows-msvc.lib.gz",
+            rusty_v8_bazel.staged_archive_name(
+                "x86_64-pc-windows-msvc",
+                Path("v8.a"),
+                rusty_v8_bazel.SANDBOX_ARTIFACT_PROFILE,
+            ),
+        )
+        self.assertEqual(
+            "src_binding_ptrcomp_sandbox_release_x86_64-unknown-linux-musl.rs",
+            rusty_v8_bazel.staged_binding_name(
+                "x86_64-unknown-linux-musl",
+                rusty_v8_bazel.SANDBOX_ARTIFACT_PROFILE,
+            ),
+        )
+        self.assertEqual(
+            "rusty_v8_ptrcomp_sandbox_release_x86_64-unknown-linux-musl.sha256",
+            rusty_v8_bazel.staged_checksums_name(
+                "x86_64-unknown-linux-musl",
+                rusty_v8_bazel.SANDBOX_ARTIFACT_PROFILE,
+            ),
+        )
+
+    def test_stage_artifacts(self) -> None:
+        with TemporaryDirectory() as source_dir, TemporaryDirectory() as output_dir:
+            source_root = Path(source_dir)
+            archive = source_root / "librusty_v8.a"
+            binding = source_root / "src_binding.rs"
+            archive.write_bytes(b"archive")
+            binding.write_text("binding")
+
+            rusty_v8_bazel.stage_artifacts(
+                "aarch64-apple-darwin",
+                archive,
+                binding,
+                Path(output_dir),
+                sandbox=True,
+            )
+
+            self.assertEqual(
+                {
+                    "librusty_v8_ptrcomp_sandbox_release_aarch64-apple-darwin.a.gz",
+                    "src_binding_ptrcomp_sandbox_release_aarch64-apple-darwin.rs",
+                    "rusty_v8_ptrcomp_sandbox_release_aarch64-apple-darwin.sha256",
+                },
+                {path.name for path in Path(output_dir).iterdir()},
+            )
+
+    def test_upstream_release_pair_paths(self) -> None:
+        self.assertEqual(
+            (
+                Path(
+                    "/tmp/rusty_v8/target/x86_64-apple-darwin/release/gn_out/obj/"
+                    "librusty_v8.a"
+                ),
+                Path(
+                    "/tmp/rusty_v8/target/x86_64-apple-darwin/release/gn_out/"
+                    "src_binding.rs"
+                ),
+            ),
+            rusty_v8_bazel.upstream_release_pair_paths(
+                Path("/tmp/rusty_v8"),
+                "x86_64-apple-darwin",
+            ),
+        )
+        self.assertEqual(
+            (
+                Path(
+                    "/tmp/rusty_v8/target/x86_64-pc-windows-msvc/release/gn_out/"
+                    "obj/rusty_v8.lib"
+                ),
+                Path(
+                    "/tmp/rusty_v8/target/x86_64-pc-windows-msvc/release/gn_out/"
+                    "src_binding.rs"
+                ),
+            ),
+            rusty_v8_bazel.upstream_release_pair_paths(
+                Path("/tmp/rusty_v8"),
+                "x86_64-pc-windows-msvc",
+            ),
+        )
+
+    def test_stage_upstream_release_pair(self) -> None:
+        with TemporaryDirectory() as source_dir, TemporaryDirectory() as output_dir:
+            source_root = Path(source_dir)
+            gn_out = (
+                source_root
+                / "target"
+                / "x86_64-pc-windows-msvc"
+                / "release"
+                / "gn_out"
+            )
+            (gn_out / "obj").mkdir(parents=True)
+            (gn_out / "obj" / "rusty_v8.lib").write_bytes(b"archive")
+            (gn_out / "src_binding.rs").write_text("binding")
+
+            rusty_v8_bazel.stage_upstream_release_pair(
+                source_root,
+                "x86_64-pc-windows-msvc",
+                Path(output_dir),
+                sandbox=True,
+            )
+
+            self.assertEqual(
+                {
+                    "rusty_v8_ptrcomp_sandbox_release_x86_64-pc-windows-msvc.lib.gz",
+                    "src_binding_ptrcomp_sandbox_release_x86_64-pc-windows-msvc.rs",
+                    "rusty_v8_ptrcomp_sandbox_release_x86_64-pc-windows-msvc.sha256",
+                },
+                {path.name for path in Path(output_dir).iterdir()},
+            )
+
+    def test_ensure_bazel_output_files_rebuilds_existing_outputs(self) -> None:
+        with TemporaryDirectory() as output_dir:
+            output = Path(output_dir) / "libv8.a"
+            output.write_bytes(b"archive")
+
+            with (
+                patch.object(rusty_v8_bazel, "bazel_build") as bazel_build,
+                patch.object(
+                    rusty_v8_bazel,
+                    "bazel_output_files",
+                    return_value=[output],
+                ) as bazel_output_files,
+            ):
+                self.assertEqual(
+                    [output],
+                    rusty_v8_bazel.ensure_bazel_output_files(
+                        "macos_arm64",
+                        ["//third_party/v8:pair"],
+                        "opt",
+                        ["rusty-v8-upstream-libcxx"],
+                    ),
+                )
+
+            bazel_build.assert_called_once_with(
+                "macos_arm64",
+                ["//third_party/v8:pair"],
+                "opt",
+                ["rusty-v8-upstream-libcxx"],
+                download_toplevel=True,
+            )
+            bazel_output_files.assert_called_once_with(
+                "macos_arm64",
+                ["//third_party/v8:pair"],
+                "opt",
+                ["rusty-v8-upstream-libcxx"],
+            )
+
     def test_update_module_bazel_replaces_and_inserts_sha256(self) -> None:
         module_bazel = textwrap.dedent(
             """\
@@ -121,6 +380,34 @@ class RustyV8BazelTest(unittest.TestCase):
                 "146.4.0",
             )
 
+    def test_rusty_v8_http_file_versions(self) -> None:
+        module_bazel = textwrap.dedent(
+            """\
+            http_file(
+                name = "rusty_v8_146_4_0_x86_64_unknown_linux_gnu_archive",
+                downloaded_file_path = "archive.gz",
+                urls = ["https://example.test/archive.gz"],
+            )
+
+            http_file(
+                name = "rusty_v8_147_4_0_x86_64_unknown_linux_gnu_archive",
+                downloaded_file_path = "new-archive.gz",
+                urls = ["https://example.test/new-archive.gz"],
+            )
+
+            http_file(
+                name = "unrelated_archive",
+                downloaded_file_path = "other.gz",
+                urls = ["https://example.test/other.gz"],
+            )
+            """
+        )
+
+        self.assertEqual(
+            ["146.4.0", "147.4.0"],
+            rusty_v8_module_bazel.rusty_v8_http_file_versions(module_bazel),
+        )
+
 
 if __name__ == "__main__":
     unittest.main()
diff --git a/.github/workflows/bazel.yml b/.github/workflows/bazel.yml
index cc3968d306..11c0988ceb 100644
--- a/.github/workflows/bazel.yml
+++ b/.github/workflows/bazel.yml
@@ -17,10 +17,10 @@ concurrency:
   cancel-in-progress: ${{ github.ref_name != 'main' }}
 jobs:
   test:
-    # PRs use a fast Windows cross-compiled test leg for pre-merge signal.
-    # Post-merge pushes to main also run the native Windows test job below for
-    # broader Windows signal without putting PR latency back on the critical
-    # path. Cargo CI owns V8/code-mode test coverage for now.
+    # PRs use the sharded Windows cross-compiled test jobs below. Post-merge
+    # pushes to main also run the native Windows test job for broader Windows
+    # signal without putting PR latency back on the critical path. Cargo CI
+    # owns V8/code-mode test coverage for now.
     timeout-minutes: 30
     strategy:
       fail-fast: false
@@ -44,12 +44,6 @@ jobs:
           # - os: ubuntu-24.04-arm
           #   target: aarch64-unknown-linux-gnu
 
-          # Windows fast path: build the windows-gnullvm binaries with Linux
-          # RBE, then run the resulting Windows tests on the Windows runner.
-          # Cargo CI preserves V8/code-mode coverage while Bazel CI keeps broad
-          # non-code-mode signal.
-          - os: windows-latest
-            target: x86_64-pc-windows-gnullvm
     runs-on: ${{ matrix.os }}
 
     # Configure a human readable name for each job
@@ -108,13 +102,6 @@ jobs:
             --test_verbose_timeout_warnings
             --build_metadata=COMMIT_SHA=${GITHUB_SHA}
           )
-          if [[ "${RUNNER_OS}" == "Windows" ]]; then
-            bazel_wrapper_args+=(
-              --windows-cross-compile
-              --remote-download-toplevel
-            )
-          fi
-
           ./.github/scripts/run-bazel-ci.sh \
             "${bazel_wrapper_args[@]}" \
             -- \
@@ -141,6 +128,118 @@ jobs:
           path: ${{ steps.prepare_bazel.outputs.repository-cache-path }}
           key: ${{ steps.prepare_bazel.outputs.repository-cache-key }}
 
+  test-windows-shard:
+    # Split the Windows Bazel test leg across separate Windows
+    # hosts. Each shard still uses Linux RBE for build actions, but the test
+    # execution itself happens on its own Windows runner.
+    timeout-minutes: 30
+    strategy:
+      fail-fast: false
+      matrix:
+        shard:
+          - 1
+          - 2
+          - 3
+          - 4
+    runs-on: windows-latest
+    name: Bazel test on windows-latest for x86_64-pc-windows-gnullvm shard ${{ matrix.shard }}/4
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          ref: ${{ github.event_name == 'pull_request' && github.event.pull_request.head.sha || github.sha }}
+          persist-credentials: false
+
+      - name: Prepare Bazel CI
+        id: prepare_bazel
+        uses: ./.github/actions/prepare-bazel-ci
+        with:
+          target: x86_64-pc-windows-gnullvm
+          # Reuse the former monolithic Windows test cache for restores. Do
+          # not save it from every shard below; duplicate uploads would sit on
+          # the PR-blocking critical path after the useful test work is done.
+          cache-scope: bazel-test
+          install-test-prereqs: "true"
+
+      - name: bazel test shard
+        env:
+          BAZEL_TEST_SHARD: ${{ matrix.shard }}
+          BAZEL_TEST_SHARD_COUNT: 4
+          BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          bazel_test_query='tests(//...) except tests(//third_party/v8:all) except //codex-rs/code-mode:code-mode-unit-tests except //codex-rs/v8-poc:v8-poc-unit-tests except attr(tags, "manual", tests(//...))'
+          mapfile -t bazel_targets < <(
+            MSYS2_ARG_CONV_EXCL='*' bazel query --output=label "${bazel_test_query}" \
+              | LC_ALL=C sort
+          )
+
+          selected_targets=()
+          for bazel_target in "${bazel_targets[@]}"; do
+            target_bucket="$(
+              printf '%s\n' "${bazel_target}" \
+                | cksum \
+                | awk -v shard_count="${BAZEL_TEST_SHARD_COUNT}" '{ print ($1 % shard_count) + 1 }'
+            )"
+            if [[ "${target_bucket}" == "${BAZEL_TEST_SHARD}" ]]; then
+              selected_targets+=("${bazel_target}")
+            fi
+          done
+
+          if [[ ${#selected_targets[@]} -eq 0 ]]; then
+            echo "No Bazel test targets selected for Windows shard ${BAZEL_TEST_SHARD}/${BAZEL_TEST_SHARD_COUNT}." >&2
+            exit 1
+          fi
+
+          echo "Selected ${#selected_targets[@]} of ${#bazel_targets[@]} Bazel test targets for Windows shard ${BAZEL_TEST_SHARD}/${BAZEL_TEST_SHARD_COUNT}."
+
+          bazel_test_args=(
+            test
+            --skip_incompatible_explicit_targets
+            --test_tag_filters=-argument-comment-lint
+            --test_verbose_timeout_warnings
+            --build_metadata=COMMIT_SHA=${GITHUB_SHA}
+            --build_metadata=TAG_windows_test_shard=${BAZEL_TEST_SHARD}
+          )
+
+          ./.github/scripts/run-bazel-ci.sh \
+            --print-failed-action-summary \
+            --print-failed-test-logs \
+            --windows-cross-compile \
+            --remote-download-toplevel \
+            -- \
+            "${bazel_test_args[@]}" \
+            -- \
+            "${selected_targets[@]}"
+
+      - name: Upload Bazel execution logs
+        if: always() && !cancelled()
+        continue-on-error: true
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: bazel-execution-logs-test-x86_64-pc-windows-gnullvm-shard-${{ matrix.shard }}
+          path: ${{ runner.temp }}/bazel-execution-logs
+          if-no-files-found: ignore
+
+  test-windows:
+    # Preserve the existing required-check surface while the real work happens
+    # in the sharded Windows jobs above.
+    if: always()
+    needs: test-windows-shard
+    runs-on: ubuntu-24.04
+    name: Bazel test on windows-latest for x86_64-pc-windows-gnullvm
+
+    steps:
+      - name: Confirm Windows Bazel test shards passed
+        shell: bash
+        run: |
+          if [[ "${{ needs.test-windows-shard.result }}" != "success" ]]; then
+            echo "Windows Bazel test shards finished with result: ${{ needs.test-windows-shard.result }}" >&2
+            exit 1
+          fi
+
   test-windows-native-main:
     # Native Windows Bazel tests are slower and frequently approach the
     # 30-minute PR budget. Run this only for post-merge commits to main and give
diff --git a/.github/workflows/issue-deduplicator.yml b/.github/workflows/issue-deduplicator.yml
index 11b4e914fe..f15c190102 100644
--- a/.github/workflows/issue-deduplicator.yml
+++ b/.github/workflows/issue-deduplicator.yml
@@ -15,14 +15,8 @@ jobs:
     permissions:
       contents: read
     outputs:
-      issues_json: ${{ steps.normalize-all.outputs.issues_json }}
-      reason: ${{ steps.normalize-all.outputs.reason }}
-      has_matches: ${{ steps.normalize-all.outputs.has_matches }}
+      codex_output: ${{ steps.codex-all.outputs.final-message }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
       - name: Prepare Codex inputs
         env:
           GH_TOKEN: ${{ github.token }}
@@ -67,6 +61,8 @@ jobs:
         with:
           openai-api-key: ${{ secrets.CODEX_OPENAI_API_KEY }}
           allow-users: "*"
+          safety-strategy: drop-sudo
+          sandbox: read-only
           prompt: |
             You are an assistant that triages new GitHub issues by identifying potential duplicates.
 
@@ -100,10 +96,21 @@ jobs:
               "additionalProperties": false
             }
 
+  normalize-duplicates-all:
+    name: Normalize pass 1 output
+    needs: gather-duplicates-all
+    if: ${{ needs.gather-duplicates-all.result == 'success' }}
+    runs-on: ubuntu-latest
+    permissions: {}
+    outputs:
+      issues_json: ${{ steps.normalize-all.outputs.issues_json }}
+      reason: ${{ steps.normalize-all.outputs.reason }}
+      has_matches: ${{ steps.normalize-all.outputs.has_matches }}
+    steps:
       - id: normalize-all
         name: Normalize pass 1 output
         env:
-          CODEX_OUTPUT: ${{ steps.codex-all.outputs.final-message }}
+          CODEX_OUTPUT: ${{ needs.gather-duplicates-all.outputs.codex_output }}
           CURRENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
         run: |
           set -eo pipefail
@@ -146,21 +153,15 @@ jobs:
 
   gather-duplicates-open:
     name: Identify potential duplicates (open issues fallback)
-    # Pass 1 may drop sudo on the runner, so run the fallback in a fresh job.
-    needs: gather-duplicates-all
-    if: ${{ needs.gather-duplicates-all.result == 'success' && needs.gather-duplicates-all.outputs.has_matches != 'true' }}
+    # Pass 1 Codex execution drops sudo on its runner, so run the fallback in a fresh job.
+    needs: normalize-duplicates-all
+    if: ${{ needs.normalize-duplicates-all.result == 'success' && needs.normalize-duplicates-all.outputs.has_matches != 'true' }}
     runs-on: ubuntu-latest
     permissions:
       contents: read
     outputs:
-      issues_json: ${{ steps.normalize-open.outputs.issues_json }}
-      reason: ${{ steps.normalize-open.outputs.reason }}
-      has_matches: ${{ steps.normalize-open.outputs.has_matches }}
+      codex_output: ${{ steps.codex-open.outputs.final-message }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
       - name: Prepare Codex inputs
         env:
           GH_TOKEN: ${{ github.token }}
@@ -203,6 +204,8 @@ jobs:
         with:
           openai-api-key: ${{ secrets.CODEX_OPENAI_API_KEY }}
           allow-users: "*"
+          safety-strategy: drop-sudo
+          sandbox: read-only
           prompt: |
             You are an assistant that triages new GitHub issues by identifying potential duplicates.
 
@@ -236,10 +239,21 @@ jobs:
               "additionalProperties": false
             }
 
+  normalize-duplicates-open:
+    name: Normalize pass 2 output
+    needs: gather-duplicates-open
+    if: ${{ needs.gather-duplicates-open.result == 'success' }}
+    runs-on: ubuntu-latest
+    permissions: {}
+    outputs:
+      issues_json: ${{ steps.normalize-open.outputs.issues_json }}
+      reason: ${{ steps.normalize-open.outputs.reason }}
+      has_matches: ${{ steps.normalize-open.outputs.has_matches }}
+    steps:
       - id: normalize-open
         name: Normalize pass 2 output
         env:
-          CODEX_OUTPUT: ${{ steps.codex-open.outputs.final-message }}
+          CODEX_OUTPUT: ${{ needs.gather-duplicates-open.outputs.codex_output }}
           CURRENT_ISSUE_NUMBER: ${{ github.event.issue.number }}
         run: |
           set -eo pipefail
@@ -283,9 +297,9 @@ jobs:
   select-final:
     name: Select final duplicate set
     needs:
-      - gather-duplicates-all
-      - gather-duplicates-open
-    if: ${{ always() && needs.gather-duplicates-all.result == 'success' && (needs.gather-duplicates-open.result == 'success' || needs.gather-duplicates-open.result == 'skipped') }}
+      - normalize-duplicates-all
+      - normalize-duplicates-open
+    if: ${{ always() && needs.normalize-duplicates-all.result == 'success' && (needs.normalize-duplicates-open.result == 'success' || needs.normalize-duplicates-open.result == 'skipped') }}
     runs-on: ubuntu-latest
     permissions:
       contents: read
@@ -295,12 +309,12 @@ jobs:
       - id: select-final
         name: Select final duplicate set
         env:
-          PASS1_ISSUES: ${{ needs.gather-duplicates-all.outputs.issues_json }}
-          PASS1_REASON: ${{ needs.gather-duplicates-all.outputs.reason }}
-          PASS2_ISSUES: ${{ needs.gather-duplicates-open.outputs.issues_json }}
-          PASS2_REASON: ${{ needs.gather-duplicates-open.outputs.reason }}
-          PASS1_HAS_MATCHES: ${{ needs.gather-duplicates-all.outputs.has_matches }}
-          PASS2_HAS_MATCHES: ${{ needs.gather-duplicates-open.outputs.has_matches }}
+          PASS1_ISSUES: ${{ needs.normalize-duplicates-all.outputs.issues_json }}
+          PASS1_REASON: ${{ needs.normalize-duplicates-all.outputs.reason }}
+          PASS2_ISSUES: ${{ needs.normalize-duplicates-open.outputs.issues_json }}
+          PASS2_REASON: ${{ needs.normalize-duplicates-open.outputs.reason }}
+          PASS1_HAS_MATCHES: ${{ needs.normalize-duplicates-all.outputs.has_matches }}
+          PASS2_HAS_MATCHES: ${{ needs.normalize-duplicates-open.outputs.has_matches }}
         run: |
           set -eo pipefail
 
diff --git a/.github/workflows/issue-labeler.yml b/.github/workflows/issue-labeler.yml
index a0bba631cd..77fe5d07c8 100644
--- a/.github/workflows/issue-labeler.yml
+++ b/.github/workflows/issue-labeler.yml
@@ -17,15 +17,13 @@ jobs:
     outputs:
       codex_output: ${{ steps.codex.outputs.final-message }}
     steps:
-      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
-        with:
-          persist-credentials: false
-
       - id: codex
         uses: openai/codex-action@5c3f4ccdb2b8790f73d6b21751ac00e602aa0c02 # v1.7
         with:
           openai-api-key: ${{ secrets.CODEX_OPENAI_API_KEY }}
           allow-users: "*"
+          safety-strategy: drop-sudo
+          sandbox: read-only
           prompt: |
             You are an assistant that reviews GitHub issues for the repository.
 
diff --git a/.github/workflows/rust-ci-full.yml b/.github/workflows/rust-ci-full.yml
index de37faa4ca..b3c25b3f03 100644
--- a/.github/workflows/rust-ci-full.yml
+++ b/.github/workflows/rust-ci-full.yml
@@ -524,10 +524,9 @@ jobs:
   tests:
     name: Tests — ${{ matrix.runner }} - ${{ matrix.target }}${{ matrix.remote_env == 'true' && ' (remote)' || '' }}
     runs-on: ${{ matrix.runs_on || matrix.runner }}
-    # Perhaps we can bring this back down to 30m once we finish the cutover
-    # from tui_app_server/ to tui/. Incidentally, windows-arm64 was the main
-    # offender for exceeding the timeout.
-    timeout-minutes: 45
+    # Windows ARM64 is the long pole here, and nextest retries plus targeted
+    # Windows timeout headroom need more than 45m to finish reliably.
+    timeout-minutes: 60
     defaults:
       run:
         working-directory: codex-rs
@@ -688,6 +687,14 @@ jobs:
           RUST_MIN_STACK: "8388608" # 8 MiB
           NEXTEST_STATUS_LEVEL: leak
 
+      - name: Upload nextest JUnit report
+        if: always()
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: nextest-junit-rust-ci-${{ matrix.runner }}-${{ matrix.target }}-${{ matrix.profile }}
+          path: codex-rs/target/nextest/default/junit.xml
+          if-no-files-found: warn
+
       - name: Upload Cargo timings (nextest)
         if: always()
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
diff --git a/.github/workflows/rust-release-prepare.yml b/.github/workflows/rust-release-prepare.yml
index e998efb54c..67e542efa9 100644
--- a/.github/workflows/rust-release-prepare.yml
+++ b/.github/workflows/rust-release-prepare.yml
@@ -16,6 +16,9 @@ jobs:
   prepare:
     # Prevent scheduled runs on forks (no secrets, wastes Actions minutes)
     if: github.repository == 'openai/codex'
+    environment:
+      name: rust-release-prepare
+      deployment: false
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
diff --git a/.github/workflows/rust-release.yml b/.github/workflows/rust-release.yml
index f9c4b4655c..50953506d3 100644
--- a/.github/workflows/rust-release.yml
+++ b/.github/workflows/rust-release.yml
@@ -4,12 +4,46 @@
 # git tag -a rust-v0.1.0 -m "Release 0.1.0"
 # git push origin rust-v0.1.0
 # ```
+#
+# To use external macOS signing, manually dispatch `release_mode=build_unsigned`,
+# sign the unsigned macOS artifacts in a secure enclave, upload the signed handoff
+# archive as a GitHub Release asset, then manually dispatch
+# `release_mode=promote_signed` with `unsigned_run_id` and `signed_macos_asset`.
+# The signed handoff archive should contain target or artifact directories such
+# as `aarch64-apple-darwin/` with signed binaries.
 
 name: rust-release
 on:
   push:
     tags:
       - "rust-v*.*.*"
+  workflow_dispatch:
+    inputs:
+      release_mode:
+        description: "build_unsigned creates unsigned macOS handoff artifacts; promote_signed finishes a release from signed macOS handoff artifacts."
+        required: false
+        type: choice
+        default: build_unsigned
+        options:
+          - build_unsigned
+          - promote_signed
+      sign_macos:
+        description: "Deprecated compatibility input; use release_mode instead."
+        required: false
+        type: boolean
+        default: false
+      unsigned_run_id:
+        description: "For promote_signed: workflow run id from the build_unsigned run."
+        required: false
+        type: string
+      signed_macos_asset:
+        description: "For promote_signed: exact GitHub Release asset name containing signed macOS handoff artifacts."
+        required: false
+        type: string
+      signed_macos_sha256:
+        description: "For promote_signed: optional SHA-256 of signed_macos_asset."
+        required: false
+        type: string
 
 concurrency:
   group: ${{ github.workflow }}
@@ -25,10 +59,60 @@ jobs:
       - uses: dtolnay/rust-toolchain@a0b273b48ed29de4470960879e8381ff45632f26 # 1.93.0
       - name: Validate tag matches Cargo.toml version
         shell: bash
+        env:
+          RELEASE_MODE: ${{ github.event_name == 'workflow_dispatch' && inputs.release_mode || 'signed' }}
+          REQUESTED_SIGN_MACOS: ${{ inputs.sign_macos }}
+          SIGNED_MACOS_ASSET: ${{ inputs.signed_macos_asset }}
+          UNSIGNED_RUN_ID: ${{ inputs.unsigned_run_id }}
         run: |
           set -euo pipefail
           echo "::group::Tag validation"
 
+          case "${RELEASE_MODE}" in
+            signed)
+              if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" ]]; then
+                echo "❌  Manual rust-release runs must use release_mode=build_unsigned or release_mode=promote_signed"
+                exit 1
+              fi
+              ;;
+            build_unsigned)
+              if [[ "${GITHUB_EVENT_NAME}" != "workflow_dispatch" ]]; then
+                echo "❌  release_mode=build_unsigned is only valid for manual runs"
+                exit 1
+              fi
+              ;;
+            promote_signed)
+              if [[ "${GITHUB_EVENT_NAME}" != "workflow_dispatch" ]]; then
+                echo "❌  release_mode=promote_signed is only valid for manual runs"
+                exit 1
+              fi
+              if [[ ! "${UNSIGNED_RUN_ID}" =~ ^[0-9]+$ ]]; then
+                echo "❌  release_mode=promote_signed requires unsigned_run_id to be a workflow run id"
+                exit 1
+              fi
+              if [[ -z "${SIGNED_MACOS_ASSET}" ]]; then
+                echo "❌  release_mode=promote_signed requires signed_macos_asset"
+                exit 1
+              fi
+              if [[ "${SIGNED_MACOS_ASSET}" == */* || "${SIGNED_MACOS_ASSET}" == *"*"* || "${SIGNED_MACOS_ASSET}" == *"?"* || "${SIGNED_MACOS_ASSET}" == *"["* ]]; then
+                echo "❌  signed_macos_asset must be an exact release asset name, not a path or glob"
+                exit 1
+              fi
+              if [[ "${UNSIGNED_RUN_ID}" == "${GITHUB_RUN_ID}" ]]; then
+                echo "❌  unsigned_run_id must refer to the earlier build_unsigned run, not this run"
+                exit 1
+              fi
+              ;;
+            *)
+              echo "❌  Unknown release_mode '${RELEASE_MODE}'"
+              exit 1
+              ;;
+          esac
+
+          if [[ "${GITHUB_EVENT_NAME}" == "workflow_dispatch" && "${REQUESTED_SIGN_MACOS}" == "true" ]]; then
+            echo "::warning title=Deprecated sign_macos input ignored::Use release_mode=build_unsigned or release_mode=promote_signed instead."
+          fi
+
           # 1. Must be a tag and match the regex
           [[ "${GITHUB_REF_TYPE}" == "tag" ]] \
             || { echo "❌  Not a tag push"; exit 1; }
@@ -48,6 +132,7 @@ jobs:
           echo "::endgroup::"
 
   build:
+    if: ${{ github.event_name != 'workflow_dispatch' || inputs.release_mode != 'promote_signed' }}
     needs: tag-check
     name: Build - ${{ matrix.runner }} - ${{ matrix.target }} - ${{ matrix.bundle }}
     runs-on: ${{ matrix.runs_on || matrix.runner }}
@@ -64,11 +149,36 @@ jobs:
       # 2026-03-04: temporarily change releases to use thin LTO because
       # Ubuntu ARM is timing out at 60 minutes.
       CARGO_PROFILE_RELEASE_LTO: ${{ contains(github.ref_name, '-alpha') && 'thin' || 'thin' }}
+      SIGN_MACOS: ${{ github.event_name != 'workflow_dispatch' }}
 
     strategy:
       fail-fast: false
       matrix:
         include:
+          - runner: macos-15-xlarge
+            target: aarch64-apple-darwin
+            bundle: primary
+            artifact_name: aarch64-apple-darwin
+            binaries: "codex codex-responses-api-proxy"
+            build_dmg: "true"
+          - runner: macos-15-xlarge
+            target: aarch64-apple-darwin
+            bundle: app-server
+            artifact_name: aarch64-apple-darwin-app-server
+            binaries: "codex-app-server"
+            build_dmg: "false"
+          - runner: macos-15-xlarge
+            target: x86_64-apple-darwin
+            bundle: primary
+            artifact_name: x86_64-apple-darwin
+            binaries: "codex codex-responses-api-proxy"
+            build_dmg: "true"
+          - runner: macos-15-xlarge
+            target: x86_64-apple-darwin
+            bundle: app-server
+            artifact_name: x86_64-apple-darwin-app-server
+            binaries: "codex-app-server"
+            build_dmg: "false"
           # Release artifacts intentionally ship MUSL-linked Linux binaries.
           - runner: ubuntu-24.04
             target: x86_64-unknown-linux-musl
@@ -95,7 +205,7 @@ jobs:
             binaries: "codex-app-server"
             build_dmg: "false"
 
-    steps: &rust_release_build_steps
+    steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
           persist-credentials: false
@@ -271,6 +381,39 @@ jobs:
           path: codex-rs/target/**/cargo-timings/cargo-timing.html
           if-no-files-found: warn
 
+      - if: ${{ runner.os == 'macOS' && env.SIGN_MACOS != 'true' }}
+        name: Stage unsigned macOS artifacts
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          target="${{ matrix.target }}"
+          release_dir="target/${target}/release"
+          dest="unsigned-dist/${target}"
+          mkdir -p "$dest"
+
+          for binary in ${{ matrix.binaries }}; do
+            binary_path="${release_dir}/${binary}"
+            unsigned_name="${binary}-${target}-unsigned"
+            unsigned_path="${dest}/${unsigned_name}"
+            if [[ ! -f "${binary_path}" ]]; then
+              echo "Binary ${binary_path} not found"
+              exit 1
+            fi
+
+            cp "${binary_path}" "${unsigned_path}"
+            tar -C "$dest" -czf "${unsigned_path}.tar.gz" "${unsigned_name}"
+            zstd -T0 -19 --rm "${unsigned_path}"
+          done
+
+      - if: ${{ runner.os == 'macOS' && env.SIGN_MACOS != 'true' }}
+        name: Upload unsigned macOS artifacts
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: ${{ matrix.artifact_name }}-unsigned
+          path: codex-rs/unsigned-dist/${{ matrix.target }}/*
+          if-no-files-found: error
+
       - if: ${{ contains(matrix.target, 'linux') }}
         name: Cosign Linux artifacts
         uses: ./.github/actions/linux-code-sign
@@ -279,7 +422,7 @@ jobs:
           artifacts-dir: ${{ github.workspace }}/codex-rs/target/${{ matrix.target }}/release
           binaries: ${{ matrix.binaries }}
 
-      - if: ${{ runner.os == 'macOS' }}
+      - if: ${{ runner.os == 'macOS' && env.SIGN_MACOS == 'true' }}
         name: MacOS code signing (binaries)
         uses: ./.github/actions/macos-code-sign
         with:
@@ -293,7 +436,7 @@ jobs:
           apple-notarization-key-id: ${{ secrets.APPLE_NOTARIZATION_KEY_ID }}
           apple-notarization-issuer-id: ${{ secrets.APPLE_NOTARIZATION_ISSUER_ID }}
 
-      - if: ${{ runner.os == 'macOS' && matrix.build_dmg == 'true' }}
+      - if: ${{ runner.os == 'macOS' && matrix.build_dmg == 'true' && env.SIGN_MACOS == 'true' }}
         name: Build macOS dmg
         shell: bash
         run: |
@@ -333,7 +476,7 @@ jobs:
             exit 1
           fi
 
-      - if: ${{ runner.os == 'macOS' && matrix.build_dmg == 'true' }}
+      - if: ${{ runner.os == 'macOS' && matrix.build_dmg == 'true' && env.SIGN_MACOS == 'true' }}
         name: MacOS code signing (dmg)
         uses: ./.github/actions/macos-code-sign
         with:
@@ -347,6 +490,7 @@ jobs:
           apple-notarization-issuer-id: ${{ secrets.APPLE_NOTARIZATION_ISSUER_ID }}
 
       - name: Stage artifacts
+        if: ${{ runner.os != 'macOS' || env.SIGN_MACOS == 'true' }}
         shell: bash
         run: |
           dest="dist/${{ matrix.target }}"
@@ -376,7 +520,7 @@ jobs:
           fi
 
       - name: Build Python runtime wheel
-        if: ${{ matrix.bundle == 'primary' }}
+        if: ${{ matrix.bundle == 'primary' && (runner.os != 'macOS' || env.SIGN_MACOS == 'true') }}
         shell: bash
         run: |
           set -euo pipefail
@@ -389,10 +533,10 @@ jobs:
               platform_tag="macosx_10_9_x86_64"
               ;;
             aarch64-unknown-linux-musl)
-              platform_tag="musllinux_1_1_aarch64"
+              platform_tag="manylinux_2_17_aarch64"
               ;;
             x86_64-unknown-linux-musl)
-              platform_tag="musllinux_1_1_x86_64"
+              platform_tag="manylinux_2_17_x86_64"
               ;;
             *)
               echo "No Python runtime wheel platform tag for ${{ matrix.target }}"
@@ -427,7 +571,7 @@ jobs:
           "${RUNNER_TEMP}/python-runtime-build-venv/bin/python" -m build --wheel --outdir "$wheel_dir" "$stage_dir"
 
       - name: Upload Python runtime wheel
-        if: ${{ matrix.bundle == 'primary' }}
+        if: ${{ matrix.bundle == 'primary' && (runner.os != 'macOS' || env.SIGN_MACOS == 'true') }}
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
           name: python-runtime-wheel-${{ matrix.target }}
@@ -435,6 +579,7 @@ jobs:
           if-no-files-found: error
 
       - name: Compress artifacts
+        if: ${{ runner.os != 'macOS' || env.SIGN_MACOS == 'true' }}
         shell: bash
         run: |
           # Path that contains the uncompressed binaries for the current
@@ -471,6 +616,7 @@ jobs:
           done
 
       - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        if: ${{ runner.os != 'macOS' || env.SIGN_MACOS == 'true' }}
         with:
           name: ${{ matrix.artifact_name }}
           # Upload the per-binary .zst files, .tar.gz equivalents, and any
@@ -478,56 +624,233 @@ jobs:
           path: |
             codex-rs/dist/${{ matrix.target }}/*
 
-  build-macos:
+  stage-signed-macos:
+    if: ${{ github.event_name == 'workflow_dispatch' && inputs.release_mode == 'promote_signed' }}
     needs: tag-check
-    name: Build - ${{ matrix.runner }} - ${{ matrix.target }} - ${{ matrix.bundle }}
-    runs-on: ${{ matrix.runs_on || matrix.runner }}
-    # Release builds can take a long time, so leave some headroom to avoid
-    # having to restart the full workflow due to a timeout.
-    timeout-minutes: 90
-    environment: macos-signing
+    name: Stage signed macOS handoff - ${{ matrix.target }} - ${{ matrix.bundle }}
+    runs-on: macos-15-xlarge
+    timeout-minutes: 30
     permissions:
       contents: read
     defaults:
       run:
         working-directory: codex-rs
-    env:
-      # Preserve the LTO setting from the original combined release build matrix.
-      # Linux ARM is why this currently resolves to thin for every target.
-      CARGO_PROFILE_RELEASE_LTO: ${{ contains(github.ref_name, '-alpha') && 'thin' || 'thin' }}
 
     strategy:
       fail-fast: false
       matrix:
         include:
-          - runner: macos-15-xlarge
-            target: aarch64-apple-darwin
+          - target: aarch64-apple-darwin
             bundle: primary
             artifact_name: aarch64-apple-darwin
             binaries: "codex codex-responses-api-proxy"
-            build_dmg: "true"
-          - runner: macos-15-xlarge
-            target: aarch64-apple-darwin
+            build_dmg: "false"
+          - target: aarch64-apple-darwin
             bundle: app-server
             artifact_name: aarch64-apple-darwin-app-server
             binaries: "codex-app-server"
             build_dmg: "false"
-          - runner: macos-15-xlarge
-            target: x86_64-apple-darwin
+          - target: x86_64-apple-darwin
             bundle: primary
             artifact_name: x86_64-apple-darwin
             binaries: "codex codex-responses-api-proxy"
-            build_dmg: "true"
-          - runner: macos-15-xlarge
-            target: x86_64-apple-darwin
+            build_dmg: "false"
+          - target: x86_64-apple-darwin
             bundle: app-server
             artifact_name: x86_64-apple-darwin-app-server
             binaries: "codex-app-server"
             build_dmg: "false"
 
-    steps: *rust_release_build_steps
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
+        with:
+          persist-credentials: false
+
+      - name: Download signed macOS handoff
+        shell: bash
+        env:
+          GH_TOKEN: ${{ github.token }}
+          SIGNED_MACOS_ASSET: ${{ inputs.signed_macos_asset }}
+          SIGNED_MACOS_SHA256: ${{ inputs.signed_macos_sha256 }}
+        run: |
+          set -euo pipefail
+
+          download_dir="${RUNNER_TEMP}/signed-macos-download"
+          handoff_dir="${RUNNER_TEMP}/signed-macos-handoff"
+          rm -rf "$download_dir" "$handoff_dir"
+          mkdir -p "$download_dir" "$handoff_dir"
+
+          gh release download "$GITHUB_REF_NAME" \
+            --repo "$GITHUB_REPOSITORY" \
+            --pattern "$SIGNED_MACOS_ASSET" \
+            --dir "$download_dir"
+
+          asset_count="$(find "$download_dir" -maxdepth 1 -type f | wc -l | tr -d '[:space:]')"
+          if [[ "$asset_count" != "1" ]]; then
+            echo "Expected exactly one signed macOS handoff asset named ${SIGNED_MACOS_ASSET}; found ${asset_count}"
+            find "$download_dir" -maxdepth 1 -type f -print
+            exit 1
+          fi
+
+          asset_path="$(find "$download_dir" -maxdepth 1 -type f -print -quit)"
+          if [[ -n "${SIGNED_MACOS_SHA256}" ]]; then
+            expected_sha="$(printf '%s' "$SIGNED_MACOS_SHA256" | tr '[:upper:]' '[:lower:]')"
+            actual_sha="$(shasum -a 256 "$asset_path" | awk '{print $1}')"
+            if [[ "$actual_sha" != "$expected_sha" ]]; then
+              echo "signed_macos_sha256 mismatch for ${SIGNED_MACOS_ASSET}"
+              echo "expected: ${expected_sha}"
+              echo "actual:   ${actual_sha}"
+              exit 1
+            fi
+          fi
+
+          asset_name="$(basename "$asset_path")"
+          case "$asset_name" in
+            *.tar.zst)
+              zstd -dc "$asset_path" | tar -C "$handoff_dir" -xf -
+              ;;
+            *.tar.gz|*.tgz)
+              tar -C "$handoff_dir" -xzf "$asset_path"
+              ;;
+            *.zip)
+              ditto -x -k "$asset_path" "$handoff_dir"
+              ;;
+            *)
+              echo "Unsupported signed macOS handoff archive format: ${asset_name}"
+              exit 1
+              ;;
+          esac
+
+          echo "SIGNED_MACOS_HANDOFF_DIR=$handoff_dir" >> "$GITHUB_ENV"
+
+      - name: Stage signed macOS artifacts
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          target="${{ matrix.target }}"
+          artifact_name="${{ matrix.artifact_name }}"
+          source_dir="${SIGNED_MACOS_HANDOFF_DIR}/${artifact_name}"
+          if [[ ! -d "$source_dir" && -d "${SIGNED_MACOS_HANDOFF_DIR}/dist/${artifact_name}" ]]; then
+            source_dir="${SIGNED_MACOS_HANDOFF_DIR}/dist/${artifact_name}"
+          fi
+          if [[ ! -d "$source_dir" && -d "${SIGNED_MACOS_HANDOFF_DIR}/${target}" ]]; then
+            source_dir="${SIGNED_MACOS_HANDOFF_DIR}/${target}"
+          fi
+          if [[ ! -d "$source_dir" && -d "${SIGNED_MACOS_HANDOFF_DIR}/dist/${target}" ]]; then
+            source_dir="${SIGNED_MACOS_HANDOFF_DIR}/dist/${target}"
+          fi
+          if [[ ! -d "$source_dir" ]]; then
+            echo "Signed macOS handoff is missing ${artifact_name}/"
+            echo "Expected either:"
+            echo "  ${SIGNED_MACOS_HANDOFF_DIR}/${artifact_name}"
+            echo "  ${SIGNED_MACOS_HANDOFF_DIR}/dist/${artifact_name}"
+            echo "  ${SIGNED_MACOS_HANDOFF_DIR}/${target}"
+            echo "  ${SIGNED_MACOS_HANDOFF_DIR}/dist/${target}"
+            find "$SIGNED_MACOS_HANDOFF_DIR" -maxdepth 3 -type f -print
+            exit 1
+          fi
+
+          dest="dist/${target}"
+          mkdir -p "$dest"
+
+          for binary in ${{ matrix.binaries }}; do
+            source_path="${source_dir}/${binary}"
+            if [[ ! -f "$source_path" ]]; then
+              source_path="${source_dir}/${binary}-${target}"
+            fi
+            if [[ ! -f "$source_path" ]]; then
+              echo "Signed macOS handoff is missing ${binary} for ${artifact_name}"
+              exit 1
+            fi
+
+            release_path="${dest}/${binary}-${target}"
+            ditto "$source_path" "$release_path"
+            chmod 0755 "$release_path"
+            codesign --verify --strict --verbose=2 "$release_path"
+          done
+
+          # DMG staging is disabled for signed promotion because we no longer
+          # distribute DMGs from this release path. Keep the branch here so the
+          # handoff can opt back in by flipping matrix.build_dmg if needed.
+          if [[ "${{ matrix.build_dmg }}" == "true" ]]; then
+            dmg_name="codex-${target}.dmg"
+            dmg_source="${source_dir}/${dmg_name}"
+            if [[ ! -f "$dmg_source" ]]; then
+              echo "Signed macOS handoff is missing ${dmg_name} for ${artifact_name}"
+              exit 1
+            fi
+
+            codesign --verify --strict --verbose=2 "$dmg_source"
+            xcrun stapler validate "$dmg_source"
+            cp "$dmg_source" "$dest/$dmg_name"
+          fi
+
+      - name: Build Python runtime wheel
+        if: ${{ matrix.bundle == 'primary' }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          case "${{ matrix.target }}" in
+            aarch64-apple-darwin)
+              platform_tag="macosx_11_0_arm64"
+              ;;
+            x86_64-apple-darwin)
+              platform_tag="macosx_10_9_x86_64"
+              ;;
+            *)
+              echo "No Python runtime wheel platform tag for ${{ matrix.target }}"
+              exit 1
+              ;;
+          esac
+
+          python3 -m venv "${RUNNER_TEMP}/python-runtime-build-venv"
+          "${RUNNER_TEMP}/python-runtime-build-venv/bin/python" -m pip install build
+
+          stage_dir="${RUNNER_TEMP}/openai-codex-cli-bin-${{ matrix.target }}"
+          wheel_dir="${GITHUB_WORKSPACE}/python-runtime-dist/${{ matrix.target }}"
+          python3 \
+            "${GITHUB_WORKSPACE}/sdk/python/scripts/update_sdk_artifacts.py" \
+            stage-runtime \
+            "$stage_dir" \
+            "${GITHUB_WORKSPACE}/codex-rs/dist/${{ matrix.target }}/codex-${{ matrix.target }}" \
+            --codex-version "${GITHUB_REF_NAME}" \
+            --platform-tag "$platform_tag"
+          "${RUNNER_TEMP}/python-runtime-build-venv/bin/python" -m build --wheel --outdir "$wheel_dir" "$stage_dir"
+
+      - name: Upload Python runtime wheel
+        if: ${{ matrix.bundle == 'primary' }}
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: python-runtime-wheel-${{ matrix.target }}
+          path: python-runtime-dist/${{ matrix.target }}/*.whl
+          if-no-files-found: error
+
+      - name: Compress artifacts
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          dest="dist/${{ matrix.target }}"
+          for f in "$dest"/*; do
+            base="$(basename "$f")"
+            if [[ "$base" == *.tar.gz || "$base" == *.tar.zst || "$base" == *.zip || "$base" == *.dmg ]]; then
+              continue
+            fi
+
+            tar -C "$dest" -czf "$dest/${base}.tar.gz" "$base"
+            zstd -T0 -19 --rm "$dest/$base"
+          done
+
+      - uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: ${{ matrix.artifact_name }}
+          path: |
+            codex-rs/dist/${{ matrix.target }}/*
 
   build-windows:
+    if: ${{ github.event_name != 'workflow_dispatch' || inputs.release_mode != 'promote_signed' }}
     needs: tag-check
     uses: ./.github/workflows/rust-release-windows.yml
     with:
@@ -535,6 +858,7 @@ jobs:
     secrets: inherit
 
   argument-comment-lint-release-assets:
+    if: ${{ github.event_name != 'workflow_dispatch' || inputs.release_mode != 'promote_signed' }}
     name: argument-comment-lint release assets
     needs: tag-check
     uses: ./.github/workflows/rust-release-argument-comment-lint.yml
@@ -542,25 +866,57 @@ jobs:
       publish: true
 
   zsh-release-assets:
+    if: ${{ github.event_name != 'workflow_dispatch' || inputs.release_mode != 'promote_signed' }}
     name: zsh release assets
     needs: tag-check
     uses: ./.github/workflows/rust-release-zsh.yml
 
   release:
     needs:
+      - tag-check
       - build
-      - build-macos
+      - stage-signed-macos
       - build-windows
       - argument-comment-lint-release-assets
       - zsh-release-assets
+    if: >-
+      ${{
+        always() &&
+        needs.tag-check.result == 'success' &&
+        (
+          (
+            github.event_name == 'workflow_dispatch' &&
+            inputs.release_mode == 'promote_signed' &&
+            needs.stage-signed-macos.result == 'success' &&
+            needs.build.result == 'skipped' &&
+            needs.build-windows.result == 'skipped' &&
+            needs.argument-comment-lint-release-assets.result == 'skipped' &&
+            needs.zsh-release-assets.result == 'skipped'
+          ) ||
+          (
+            (github.event_name != 'workflow_dispatch' || inputs.release_mode != 'promote_signed') &&
+            needs.build.result == 'success' &&
+            needs.stage-signed-macos.result == 'skipped' &&
+            needs.build-windows.result == 'success' &&
+            needs.argument-comment-lint-release-assets.result == 'success' &&
+            needs.zsh-release-assets.result == 'success'
+          )
+        )
+      }}
     name: release
     runs-on: ubuntu-latest
     permissions:
       contents: write
       actions: read
+    env:
+      RELEASE_MODE: ${{ github.event_name == 'workflow_dispatch' && inputs.release_mode || 'signed' }}
+      SIGN_MACOS: ${{ github.event_name != 'workflow_dispatch' || inputs.release_mode == 'promote_signed' }}
+      SIGNED_MACOS_ASSET: ${{ inputs.signed_macos_asset }}
+      UNSIGNED_RUN_ID: ${{ inputs.unsigned_run_id }}
     outputs:
       version: ${{ steps.release_name.outputs.name }}
       tag: ${{ github.ref_name }}
+      sign_macos: ${{ steps.release_mode.outputs.sign_macos }}
       should_publish_npm: ${{ steps.npm_publish_settings.outputs.should_publish }}
       npm_tag: ${{ steps.npm_publish_settings.outputs.npm_tag }}
       should_publish_python_runtime: ${{ steps.python_runtime_publish_settings.outputs.should_publish }}
@@ -571,6 +927,12 @@ jobs:
         with:
           persist-credentials: false
 
+      - name: Define release mode
+        id: release_mode
+        run: |
+          echo "release_mode=${RELEASE_MODE}" >> "$GITHUB_OUTPUT"
+          echo "sign_macos=${SIGN_MACOS}" >> "$GITHUB_OUTPUT"
+
       - name: Generate release notes from tag commit message
         id: release_notes
         shell: bash
@@ -595,9 +957,121 @@ jobs:
         with:
           path: dist
 
+      - name: Validate unsigned build run
+        if: ${{ env.RELEASE_MODE == 'promote_signed' }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+
+          run_summary="$(gh run view "$UNSIGNED_RUN_ID" \
+            --repo "$GITHUB_REPOSITORY" \
+            --json conclusion,event,headBranch,headSha,status,workflowName,url \
+            --jq '[.workflowName, .event, .headBranch, .headSha, .status, .conclusion, .url] | @tsv')"
+          IFS=$'\t' read -r workflow_name event head_branch head_sha status conclusion run_url <<< "$run_summary"
+          expected_head_sha="$(git rev-parse "${GITHUB_SHA}^{commit}")"
+
+          if [[ "$workflow_name" != "$GITHUB_WORKFLOW" ]]; then
+            echo "unsigned_run_id ${UNSIGNED_RUN_ID} is for workflow '${workflow_name}', expected '${GITHUB_WORKFLOW}'"
+            echo "Run URL: ${run_url}"
+            exit 1
+          fi
+
+          if [[ "$event" != "workflow_dispatch" ]]; then
+            echo "unsigned_run_id ${UNSIGNED_RUN_ID} was triggered by '${event}', expected 'workflow_dispatch'"
+            echo "Run URL: ${run_url}"
+            exit 1
+          fi
+
+          if [[ "$head_branch" != "$GITHUB_REF_NAME" ]]; then
+            echo "unsigned_run_id ${UNSIGNED_RUN_ID} used ref '${head_branch}', expected '${GITHUB_REF_NAME}'"
+            echo "Run URL: ${run_url}"
+            exit 1
+          fi
+
+          if [[ "$head_sha" != "$expected_head_sha" ]]; then
+            echo "unsigned_run_id ${UNSIGNED_RUN_ID} used head SHA '${head_sha}', expected '${expected_head_sha}'"
+            echo "Run URL: ${run_url}"
+            exit 1
+          fi
+
+          if [[ "$status" != "completed" || "$conclusion" != "success" ]]; then
+            echo "unsigned_run_id ${UNSIGNED_RUN_ID} is ${status}/${conclusion}, expected completed/success"
+            echo "Run URL: ${run_url}"
+            exit 1
+          fi
+
+      - name: Download artifacts from unsigned build run
+        if: ${{ env.RELEASE_MODE == 'promote_signed' }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+          gh run download "$UNSIGNED_RUN_ID" \
+            --repo "$GITHUB_REPOSITORY" \
+            --dir dist
+
+      - name: Remove unsigned macOS staging artifacts
+        if: ${{ env.RELEASE_MODE == 'promote_signed' }}
+        run: |
+          set -euo pipefail
+          find dist -mindepth 1 -maxdepth 1 -type d \
+            -name '*-apple-darwin*-unsigned' \
+            -exec rm -rf {} +
+
+      - name: Re-upload promoted Linux x64 artifacts
+        if: ${{ env.RELEASE_MODE == 'promote_signed' }}
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: x86_64-unknown-linux-musl
+          path: dist/x86_64-unknown-linux-musl/*
+          if-no-files-found: error
+
+      - name: Re-upload promoted Linux arm64 artifacts
+        if: ${{ env.RELEASE_MODE == 'promote_signed' }}
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: aarch64-unknown-linux-musl
+          path: dist/aarch64-unknown-linux-musl/*
+          if-no-files-found: error
+
+      - name: Re-upload promoted Windows x64 artifacts
+        if: ${{ env.RELEASE_MODE == 'promote_signed' }}
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: x86_64-pc-windows-msvc
+          path: dist/x86_64-pc-windows-msvc/*
+          if-no-files-found: error
+
+      - name: Re-upload promoted Windows arm64 artifacts
+        if: ${{ env.RELEASE_MODE == 'promote_signed' }}
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
+        with:
+          name: aarch64-pc-windows-msvc
+          path: dist/aarch64-pc-windows-msvc/*
+          if-no-files-found: error
+
       - name: List
         run: ls -R dist/
 
+      - name: Prune artifacts excluded from unsigned macOS release
+        if: ${{ env.SIGN_MACOS == 'false' }}
+        run: |
+          find dist -mindepth 1 -maxdepth 1 -type d \
+            ! -name '*-apple-darwin*-unsigned' \
+            ! -name 'aarch64-unknown-linux-musl' \
+            ! -name 'aarch64-unknown-linux-musl-app-server' \
+            ! -name 'x86_64-unknown-linux-musl' \
+            ! -name 'x86_64-unknown-linux-musl-app-server' \
+            ! -name 'aarch64-pc-windows-msvc' \
+            ! -name 'x86_64-pc-windows-msvc' \
+            -exec rm -rf {} +
+
+          if ! find dist -type f -name '*-apple-darwin*-unsigned*' | grep -q .; then
+            echo "No unsigned macOS artifacts found in downloaded workflow artifacts."
+            exit 1
+          fi
+
       - name: Delete entries from dist/ that should not go in the release
         run: |
           rm -rf dist/windows-binaries*
@@ -629,6 +1103,12 @@ jobs:
           set -euo pipefail
           version="${VERSION}"
 
+          if [[ "${SIGN_MACOS}" != "true" ]]; then
+            echo "should_publish=false" >> "$GITHUB_OUTPUT"
+            echo "npm_tag=" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
           if [[ "${version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
             echo "should_publish=true" >> "$GITHUB_OUTPUT"
             echo "npm_tag=" >> "$GITHUB_OUTPUT"
@@ -648,6 +1128,11 @@ jobs:
           set -euo pipefail
           version="${VERSION}"
 
+          if [[ "${SIGN_MACOS}" != "true" ]]; then
+            echo "should_publish=false" >> "$GITHUB_OUTPUT"
+            exit 0
+          fi
+
           if [[ "${version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
             echo "should_publish=true" >> "$GITHUB_OUTPUT"
           elif [[ "${version}" =~ ^[0-9]+\.[0-9]+\.[0-9]+-alpha\.[0-9]+$ ]]; then
@@ -657,32 +1142,39 @@ jobs:
           fi
 
       - name: Setup pnpm
+        if: ${{ env.SIGN_MACOS == 'true' }}
         uses: pnpm/action-setup@a8198c4bff370c8506180b035930dea56dbd5288 # v5
         with:
           run_install: false
 
       - name: Setup Node.js for npm packaging
+        if: ${{ env.SIGN_MACOS == 'true' }}
         uses: actions/setup-node@53b83947a5a98c8d113130e565377fae1a50d02f # v6.3.0
         with:
           node-version: 22
 
       - name: Install dependencies
+        if: ${{ env.SIGN_MACOS == 'true' }}
         run: pnpm install --frozen-lockfile
 
       # stage_npm_packages.py requires DotSlash when staging releases.
       - uses: facebook/install-dotslash@1e4e7b3e07eaca387acb98f1d4720e0bee8dbb6a # v2
       - name: Stage npm packages
+        if: ${{ env.SIGN_MACOS == 'true' }}
         env:
           GH_TOKEN: ${{ github.token }}
           RELEASE_VERSION: ${{ steps.release_name.outputs.name }}
         run: |
+          workflow_url="${GITHUB_SERVER_URL}/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}"
           ./scripts/stage_npm_packages.py \
             --release-version "$RELEASE_VERSION" \
+            --workflow-url "$workflow_url" \
             --package codex \
             --package codex-responses-api-proxy \
             --package codex-sdk
 
       - name: Stage installer scripts
+        if: ${{ env.SIGN_MACOS == 'true' }}
         run: |
           cp scripts/install/install.sh dist/install.sh
           cp scripts/install/install.ps1 dist/install.ps1
@@ -694,25 +1186,56 @@ jobs:
           tag_name: ${{ github.ref_name }}
           body_path: ${{ steps.release_notes.outputs.path }}
           files: dist/**
+          overwrite_files: true
+          make_latest: ${{ env.SIGN_MACOS == 'true' && !contains(steps.release_name.outputs.name, '-') }}
           # Mark as prerelease only when the version has a suffix after x.y.z
           # (e.g. -alpha, -beta). Otherwise publish a normal release.
           prerelease: ${{ contains(steps.release_name.outputs.name, '-') }}
 
-      - uses: facebook/dotslash-publish-release@9c9ec027515c34db9282a09a25a9cab5880b2c52 # v2
+      - name: Clean up signed promotion handoff assets
+        if: ${{ env.RELEASE_MODE == 'promote_signed' }}
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: |
+          set -euo pipefail
+
+          release_id="$(gh api "repos/${GITHUB_REPOSITORY}/releases/tags/${GITHUB_REF_NAME}" --jq '.id')"
+          gh api --paginate "repos/${GITHUB_REPOSITORY}/releases/${release_id}/assets" \
+            --jq '.[] | [.id, .name] | @tsv' |
+            while IFS=$'\t' read -r asset_id asset_name; do
+              if [[ -z "$asset_id" || -z "$asset_name" ]]; then
+                continue
+              fi
+
+              delete_asset=false
+              if [[ "$asset_name" == *unsigned* || "$asset_name" == "$SIGNED_MACOS_ASSET" ]]; then
+                delete_asset=true
+              fi
+
+              if [[ "$delete_asset" == "true" ]]; then
+                echo "Deleting release asset ${asset_name}"
+                gh api -X DELETE "repos/${GITHUB_REPOSITORY}/releases/assets/${asset_id}"
+              fi
+            done
+
+      - if: ${{ env.SIGN_MACOS == 'true' }}
+        uses: facebook/dotslash-publish-release@9c9ec027515c34db9282a09a25a9cab5880b2c52 # v2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
           tag: ${{ github.ref_name }}
           config: .github/dotslash-config.json
 
-      - uses: facebook/dotslash-publish-release@9c9ec027515c34db9282a09a25a9cab5880b2c52 # v2
+      - if: ${{ env.SIGN_MACOS == 'true' }}
+        uses: facebook/dotslash-publish-release@9c9ec027515c34db9282a09a25a9cab5880b2c52 # v2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
           tag: ${{ github.ref_name }}
           config: .github/dotslash-zsh-config.json
 
-      - uses: facebook/dotslash-publish-release@9c9ec027515c34db9282a09a25a9cab5880b2c52 # v2
+      - if: ${{ env.SIGN_MACOS == 'true' }}
+        uses: facebook/dotslash-publish-release@9c9ec027515c34db9282a09a25a9cab5880b2c52 # v2
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
         with:
@@ -722,7 +1245,7 @@ jobs:
       - name: Trigger developers.openai.com deploy
         # Only trigger the deploy if the release is not a pre-release.
         # The deploy is used to update the developers.openai.com website with the new config schema json file.
-        if: ${{ !contains(steps.release_name.outputs.name, '-') }}
+        if: ${{ env.SIGN_MACOS == 'true' && !contains(steps.release_name.outputs.name, '-') }}
         continue-on-error: true
         env:
           DEV_WEBSITE_VERCEL_DEPLOY_HOOK_URL: ${{ secrets.DEV_WEBSITE_VERCEL_DEPLOY_HOOK_URL }}
@@ -737,7 +1260,15 @@ jobs:
   # npm docs: https://docs.npmjs.com/trusted-publishers
   publish-npm:
     # Publish to npm for stable releases and alpha pre-releases with numeric suffixes.
-    if: ${{ needs.release.outputs.should_publish_npm == 'true' }}
+    # promote_signed intentionally skips build jobs that are ancestors of release;
+    # include the !cancelled() status function so Actions does not apply its implicit
+    # success() check to the whole dependency chain before evaluating release outputs.
+    if: >-
+      ${{
+        !cancelled() &&
+        needs.release.result == 'success' &&
+        needs.release.outputs.should_publish_npm == 'true'
+      }}
     name: publish-npm
     needs: release
     runs-on: ubuntu-latest
@@ -895,7 +1426,12 @@ jobs:
   # need release follow-up, but should not invalidate the Rust release itself.
   publish-python-runtime:
     # Publish to PyPI for stable releases and alpha pre-releases with numeric suffixes.
-    if: ${{ needs.release.outputs.should_publish_python_runtime == 'true' }}
+    if: >-
+      ${{
+        !cancelled() &&
+        needs.release.result == 'success' &&
+        needs.release.outputs.should_publish_python_runtime == 'true'
+      }}
     name: publish-python-runtime
     needs: release
     runs-on: ubuntu-latest
@@ -936,7 +1472,13 @@ jobs:
     needs: release
     # Only publish stable/mainline releases to WinGet; pre-releases include a
     # '-' in the semver string (e.g., 1.2.3-alpha.1).
-    if: ${{ !contains(needs.release.outputs.version, '-') }}
+    if: >-
+      ${{
+        !cancelled() &&
+        needs.release.result == 'success' &&
+        needs.release.outputs.sign_macos == 'true' &&
+        !contains(needs.release.outputs.version, '-')
+      }}
     # This job only invokes a GitHub Action to open/update the winget-pkgs PR;
     # it does not execute Windows-only tooling, so Linux is sufficient.
     runs-on: ubuntu-latest
@@ -956,6 +1498,12 @@ jobs:
 
   update-branch:
     name: Update latest-alpha-cli branch
+    if: >-
+      ${{
+        !cancelled() &&
+        needs.release.result == 'success' &&
+        needs.release.outputs.sign_macos == 'true'
+      }}
     permissions:
       contents: write
     needs: release
diff --git a/.github/workflows/rusty-v8-release.yml b/.github/workflows/rusty-v8-release.yml
index 5a436722bb..3b56a1e93f 100644
--- a/.github/workflows/rusty-v8-release.yml
+++ b/.github/workflows/rusty-v8-release.yml
@@ -46,14 +46,14 @@ jobs:
           expected_release_tag="rusty-v8-v${V8_VERSION}"
           release_tag="${GITHUB_REF_NAME}"
           if [[ "${release_tag}" != "${expected_release_tag}" ]]; then
-            echo "Tag ${release_tag} does not match resolved v8 crate version ${V8_VERSION}." >&2
+            echo "Tag ${release_tag} does not match expected release tag ${expected_release_tag}." >&2
             exit 1
           fi
 
           echo "release_tag=${release_tag}" >> "$GITHUB_OUTPUT"
 
   build:
-    name: Build ${{ matrix.target }}
+    name: Build ${{ matrix.variant }} ${{ matrix.target }}
     needs: metadata
     runs-on: ${{ matrix.runner }}
     permissions:
@@ -64,11 +64,77 @@ jobs:
       matrix:
         include:
           - runner: ubuntu-24.04
-            platform: linux_amd64_musl
-            target: x86_64-unknown-linux-musl
+            bazel_config: ci-v8
+            platform: linux_amd64
+            sandbox: false
+            target: x86_64-unknown-linux-gnu
+            variant: release
+          - runner: ubuntu-24.04
+            bazel_config: ci-v8
+            platform: linux_amd64
+            sandbox: true
+            target: x86_64-unknown-linux-gnu
+            variant: ptrcomp-sandbox
           - runner: ubuntu-24.04-arm
+            bazel_config: ci-v8
+            platform: linux_arm64
+            sandbox: false
+            target: aarch64-unknown-linux-gnu
+            variant: release
+          - runner: ubuntu-24.04-arm
+            bazel_config: ci-v8
+            platform: linux_arm64
+            sandbox: true
+            target: aarch64-unknown-linux-gnu
+            variant: ptrcomp-sandbox
+          - runner: macos-15-xlarge
+            bazel_config: ci-macos
+            platform: macos_amd64
+            sandbox: false
+            target: x86_64-apple-darwin
+            variant: release
+          - runner: macos-15-xlarge
+            bazel_config: ci-macos
+            platform: macos_amd64
+            sandbox: true
+            target: x86_64-apple-darwin
+            variant: ptrcomp-sandbox
+          - runner: macos-15-xlarge
+            bazel_config: ci-macos
+            platform: macos_arm64
+            sandbox: false
+            target: aarch64-apple-darwin
+            variant: release
+          - runner: macos-15-xlarge
+            bazel_config: ci-macos
+            platform: macos_arm64
+            sandbox: true
+            target: aarch64-apple-darwin
+            variant: ptrcomp-sandbox
+          - runner: ubuntu-24.04
+            bazel_config: ci-v8
+            platform: linux_amd64_musl
+            sandbox: false
+            target: x86_64-unknown-linux-musl
+            variant: release
+          - runner: ubuntu-24.04-arm
+            bazel_config: ci-v8
             platform: linux_arm64_musl
+            sandbox: false
             target: aarch64-unknown-linux-musl
+            variant: release
+          - runner: ubuntu-24.04
+            bazel_config: ci-v8
+            platform: linux_amd64_musl
+            sandbox: true
+            target: x86_64-unknown-linux-musl
+            variant: ptrcomp-sandbox
+          - runner: ubuntu-24.04-arm
+            bazel_config: ci-v8
+            platform: linux_arm64_musl
+            sandbox: true
+            target: aarch64-unknown-linux-musl
+            variant: ptrcomp-sandbox
 
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
@@ -85,61 +151,115 @@ jobs:
         with:
           python-version: "3.12"
 
+      - name: Set up Rust toolchain for Cargo smoke
+        uses: dtolnay/rust-toolchain@a0b273b48ed29de4470960879e8381ff45632f26 # 1.93.0
+        with:
+          toolchain: "1.93.0"
+
       - name: Build Bazel V8 release pair
         env:
           BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
           PLATFORM: ${{ matrix.platform }}
+          SANDBOX: ${{ matrix.sandbox }}
           TARGET: ${{ matrix.target }}
         shell: bash
         run: |
           set -euo pipefail
 
           target_suffix="${TARGET//-/_}"
-          pair_target="//third_party/v8:rusty_v8_release_pair_${target_suffix}"
-          extra_targets=()
-          if [[ "${TARGET}" == *-unknown-linux-musl ]]; then
-            extra_targets=(
-              "@llvm//runtimes/libcxx:libcxx.static"
-              "@llvm//runtimes/libcxx:libcxxabi.static"
-            )
+          pair_kind="release_pair"
+          if [[ "${SANDBOX}" == "true" ]]; then
+            pair_kind="sandbox_release_pair"
           fi
+          pair_target="//third_party/v8:rusty_v8_${pair_kind}_${target_suffix}"
 
           bazel_args=(
             build
             -c
             opt
             "--platforms=@llvm//platforms:${PLATFORM}"
-            --config=v8-release-compat
+            --config=rusty-v8-upstream-libcxx
             "${pair_target}"
-            "${extra_targets[@]}"
             --build_metadata=COMMIT_SHA=$(git rev-parse HEAD)
           )
+          if [[ "${SANDBOX}" != "true" ]]; then
+            bazel_args+=(--config=v8-release-compat)
+          fi
 
           bazel \
             --noexperimental_remote_repo_contents_cache \
             "${bazel_args[@]}" \
-            --config=ci-v8 \
+            "--config=${{ matrix.bazel_config }}" \
             "--remote_header=x-buildbuddy-api-key=${BUILDBUDDY_API_KEY}"
 
       - name: Stage release pair
         env:
+          BAZEL_CONFIG: ${{ matrix.bazel_config }}
+          BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
           PLATFORM: ${{ matrix.platform }}
+          SANDBOX: ${{ matrix.sandbox }}
           TARGET: ${{ matrix.target }}
         shell: bash
         run: |
           set -euo pipefail
 
-          python3 .github/scripts/rusty_v8_bazel.py stage-release-pair \
-            --platform "${PLATFORM}" \
-            --target "${TARGET}" \
-            --compilation-mode opt \
-            --bazel-config v8-release-compat \
+          stage_args=(
+            --platform "${PLATFORM}"
+            --target "${TARGET}"
+            --compilation-mode opt
             --output-dir "dist/${TARGET}"
+            --bazel-config "${BAZEL_CONFIG}"
+          )
+          if [[ "${SANDBOX}" == "true" ]]; then
+            stage_args+=(--sandbox)
+          else
+            stage_args+=(--bazel-config v8-release-compat)
+          fi
 
-      - name: Upload staged musl artifacts
+          python3 .github/scripts/rusty_v8_bazel.py stage-release-pair "${stage_args[@]}"
+
+      - name: Smoke test staged artifact with Cargo
+        env:
+          SANDBOX: ${{ matrix.sandbox }}
+          TARGET: ${{ matrix.target }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          host_arch="$(uname -m)"
+          case "${TARGET}:${host_arch}" in
+            x86_64-apple-darwin:x86_64|aarch64-apple-darwin:arm64|x86_64-unknown-linux-gnu:x86_64|aarch64-unknown-linux-gnu:aarch64)
+              ;;
+            *)
+              echo "Skipping non-native Cargo smoke for ${TARGET} on ${host_arch}."
+              exit 0
+              ;;
+          esac
+
+          archive="$(find "dist/${TARGET}" -maxdepth 1 -type f -name 'librusty_v8_*.a.gz' -print -quit)"
+          binding="$(find "dist/${TARGET}" -maxdepth 1 -type f -name 'src_binding_*.rs' -print -quit)"
+          if [[ -z "${archive}" || -z "${binding}" ]]; then
+            echo "Missing staged archive or binding for ${TARGET}." >&2
+            exit 1
+          fi
+
+          cargo_args=(test -p codex-v8-poc)
+          if [[ "${SANDBOX}" == "true" ]]; then
+            cargo_args+=(--features sandbox)
+          fi
+
+          (
+            cd codex-rs
+            CARGO_TARGET_DIR="${RUNNER_TEMP}/rusty-v8-cargo-smoke-${TARGET}-${SANDBOX}" \
+            RUSTY_V8_ARCHIVE="${GITHUB_WORKSPACE}/${archive}" \
+            RUSTY_V8_SRC_BINDING_PATH="${GITHUB_WORKSPACE}/${binding}" \
+            cargo "${cargo_args[@]}"
+          )
+
+      - name: Upload staged artifacts
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
-          name: rusty-v8-${{ needs.metadata.outputs.v8_version }}-${{ matrix.target }}
+          name: rusty-v8-${{ needs.metadata.outputs.v8_version }}-${{ matrix.variant }}-${{ matrix.target }}
           path: dist/${{ matrix.target }}/*
 
   publish-release:
@@ -152,7 +272,8 @@ jobs:
       actions: read
 
     steps:
-      - name: Ensure release tag is new
+      - name: Check whether release already exists
+        id: release
         env:
           GH_TOKEN: ${{ github.token }}
           RELEASE_TAG: ${{ needs.metadata.outputs.release_tag }}
@@ -161,8 +282,9 @@ jobs:
           set -euo pipefail
 
           if gh release view "${RELEASE_TAG}" --repo "${GITHUB_REPOSITORY}" > /dev/null 2>&1; then
-            echo "Release tag ${RELEASE_TAG} already exists; musl artifact tags are immutable." >&2
-            exit 1
+            echo "exists=true" >> "${GITHUB_OUTPUT}"
+          else
+            echo "exists=false" >> "${GITHUB_OUTPUT}"
           fi
 
       - uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
@@ -170,6 +292,7 @@ jobs:
           path: dist
 
       - name: Create GitHub Release
+        if: ${{ steps.release.outputs.exists != 'true' }}
         uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
         with:
           tag_name: ${{ needs.metadata.outputs.release_tag }}
@@ -177,3 +300,14 @@ jobs:
           files: dist/**
           # Keep V8 artifact releases out of Codex's normal "latest release" channel.
           prerelease: true
+
+      - name: Amend existing GitHub Release
+        if: ${{ steps.release.outputs.exists == 'true' }}
+        uses: softprops/action-gh-release@153bb8e04406b158c6c84fc1615b65b24149a1fe # v2.6.1
+        with:
+          tag_name: ${{ needs.metadata.outputs.release_tag }}
+          name: ${{ needs.metadata.outputs.release_tag }}
+          files: dist/**
+          overwrite_files: true
+          # Keep V8 artifact releases out of Codex's normal "latest release" channel.
+          prerelease: true
diff --git a/.github/workflows/v8-canary.yml b/.github/workflows/v8-canary.yml
index 6e71367d1f..979e991504 100644
--- a/.github/workflows/v8-canary.yml
+++ b/.github/workflows/v8-canary.yml
@@ -3,28 +3,36 @@ name: v8-canary
 on:
   pull_request:
     paths:
+      - ".bazelrc"
       - ".github/actions/setup-bazel-ci/**"
       - ".github/scripts/rusty_v8_bazel.py"
+      - ".github/scripts/rusty_v8_module_bazel.py"
       - ".github/workflows/rusty-v8-release.yml"
       - ".github/workflows/v8-canary.yml"
       - "MODULE.bazel"
       - "MODULE.bazel.lock"
       - "codex-rs/Cargo.toml"
       - "patches/BUILD.bazel"
+      - "patches/llvm_*.patch"
+      - "patches/rules_cc_*.patch"
       - "patches/v8_*.patch"
       - "third_party/v8/**"
   push:
     branches:
       - main
     paths:
+      - ".bazelrc"
       - ".github/actions/setup-bazel-ci/**"
       - ".github/scripts/rusty_v8_bazel.py"
+      - ".github/scripts/rusty_v8_module_bazel.py"
       - ".github/workflows/rusty-v8-release.yml"
       - ".github/workflows/v8-canary.yml"
       - "MODULE.bazel"
       - "MODULE.bazel.lock"
       - "codex-rs/Cargo.toml"
       - "patches/BUILD.bazel"
+      - "patches/llvm_*.patch"
+      - "patches/rules_cc_*.patch"
       - "patches/v8_*.patch"
       - "third_party/v8/**"
   workflow_dispatch:
@@ -59,7 +67,7 @@ jobs:
           echo "version=${version}" >> "$GITHUB_OUTPUT"
 
   build:
-    name: Build ${{ matrix.target }}
+    name: Build ${{ matrix.variant }} ${{ matrix.target }}
     needs: metadata
     runs-on: ${{ matrix.runner }}
     permissions:
@@ -70,12 +78,77 @@ jobs:
       matrix:
         include:
           - runner: ubuntu-24.04
-            platform: linux_amd64_musl
-            target: x86_64-unknown-linux-musl
+            bazel_config: ci-v8
+            platform: linux_amd64
+            sandbox: false
+            target: x86_64-unknown-linux-gnu
+            variant: release
+          - runner: ubuntu-24.04
+            bazel_config: ci-v8
+            platform: linux_amd64
+            sandbox: true
+            target: x86_64-unknown-linux-gnu
+            variant: ptrcomp-sandbox
           - runner: ubuntu-24.04-arm
+            bazel_config: ci-v8
+            platform: linux_arm64
+            sandbox: false
+            target: aarch64-unknown-linux-gnu
+            variant: release
+          - runner: ubuntu-24.04-arm
+            bazel_config: ci-v8
+            platform: linux_arm64
+            sandbox: true
+            target: aarch64-unknown-linux-gnu
+            variant: ptrcomp-sandbox
+          - runner: macos-15-xlarge
+            bazel_config: ci-macos
+            platform: macos_amd64
+            sandbox: false
+            target: x86_64-apple-darwin
+            variant: release
+          - runner: macos-15-xlarge
+            bazel_config: ci-macos
+            platform: macos_amd64
+            sandbox: true
+            target: x86_64-apple-darwin
+            variant: ptrcomp-sandbox
+          - runner: macos-15-xlarge
+            bazel_config: ci-macos
+            platform: macos_arm64
+            sandbox: false
+            target: aarch64-apple-darwin
+            variant: release
+          - runner: macos-15-xlarge
+            bazel_config: ci-macos
+            platform: macos_arm64
+            sandbox: true
+            target: aarch64-apple-darwin
+            variant: ptrcomp-sandbox
+          - runner: ubuntu-24.04
+            bazel_config: ci-v8
+            platform: linux_amd64_musl
+            sandbox: false
+            target: x86_64-unknown-linux-musl
+            variant: release
+          - runner: ubuntu-24.04
+            bazel_config: ci-v8
+            platform: linux_amd64_musl
+            sandbox: true
+            target: x86_64-unknown-linux-musl
+            variant: ptrcomp-sandbox
+          - runner: ubuntu-24.04-arm
+            bazel_config: ci-v8
             platform: linux_arm64_musl
+            sandbox: false
             target: aarch64-unknown-linux-musl
-
+            variant: release
+          - runner: ubuntu-24.04-arm
+            bazel_config: ci-v8
+            platform: linux_arm64_musl
+            sandbox: true
+            target: aarch64-unknown-linux-musl
+            variant: ptrcomp-sandbox
     steps:
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
         with:
@@ -92,53 +165,247 @@ jobs:
         with:
           python-version: "3.12"
 
+      - name: Set up Rust toolchain for Cargo smoke
+        uses: dtolnay/rust-toolchain@a0b273b48ed29de4470960879e8381ff45632f26 # 1.93.0
+        with:
+          toolchain: "1.93.0"
+
       - name: Build Bazel V8 release pair
         env:
           BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
           PLATFORM: ${{ matrix.platform }}
+          SANDBOX: ${{ matrix.sandbox }}
           TARGET: ${{ matrix.target }}
         shell: bash
         run: |
           set -euo pipefail
 
           target_suffix="${TARGET//-/_}"
-          pair_target="//third_party/v8:rusty_v8_release_pair_${target_suffix}"
-          extra_targets=(
-            "@llvm//runtimes/libcxx:libcxx.static"
-            "@llvm//runtimes/libcxx:libcxxabi.static"
-          )
+          pair_kind="release_pair"
+          if [[ "${SANDBOX}" == "true" ]]; then
+            pair_kind="sandbox_release_pair"
+          fi
+          pair_target="//third_party/v8:rusty_v8_${pair_kind}_${target_suffix}"
 
           bazel_args=(
             build
             "--platforms=@llvm//platforms:${PLATFORM}"
-            --config=v8-release-compat
+            --config=rusty-v8-upstream-libcxx
             "${pair_target}"
-            "${extra_targets[@]}"
             --build_metadata=COMMIT_SHA=$(git rev-parse HEAD)
           )
+          if [[ "${SANDBOX}" != "true" ]]; then
+            bazel_args+=(--config=v8-release-compat)
+          fi
 
           bazel \
             --noexperimental_remote_repo_contents_cache \
             "${bazel_args[@]}" \
-            --config=ci-v8 \
+            "--config=${{ matrix.bazel_config }}" \
             "--remote_header=x-buildbuddy-api-key=${BUILDBUDDY_API_KEY}"
 
       - name: Stage release pair
         env:
+          BAZEL_CONFIG: ${{ matrix.bazel_config }}
+          BUILDBUDDY_API_KEY: ${{ secrets.BUILDBUDDY_API_KEY }}
           PLATFORM: ${{ matrix.platform }}
+          SANDBOX: ${{ matrix.sandbox }}
           TARGET: ${{ matrix.target }}
         shell: bash
         run: |
           set -euo pipefail
 
-          python3 .github/scripts/rusty_v8_bazel.py stage-release-pair \
-            --platform "${PLATFORM}" \
-            --target "${TARGET}" \
-            --bazel-config v8-release-compat \
+          stage_args=(
+            --platform "${PLATFORM}"
+            --target "${TARGET}"
             --output-dir "dist/${TARGET}"
+            --bazel-config "${BAZEL_CONFIG}"
+          )
+          if [[ "${SANDBOX}" == "true" ]]; then
+            stage_args+=(--sandbox)
+          else
+            stage_args+=(--bazel-config v8-release-compat)
+          fi
 
-      - name: Upload staged musl artifacts
+          python3 .github/scripts/rusty_v8_bazel.py stage-release-pair "${stage_args[@]}"
+
+      - name: Smoke test staged artifact with Cargo
+        env:
+          SANDBOX: ${{ matrix.sandbox }}
+          TARGET: ${{ matrix.target }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          host_arch="$(uname -m)"
+          case "${TARGET}:${host_arch}" in
+            x86_64-apple-darwin:x86_64|aarch64-apple-darwin:arm64|x86_64-unknown-linux-gnu:x86_64|aarch64-unknown-linux-gnu:aarch64)
+              ;;
+            *)
+              echo "Skipping non-native Cargo smoke for ${TARGET} on ${host_arch}."
+              exit 0
+              ;;
+          esac
+
+          archive="$(find "dist/${TARGET}" -maxdepth 1 -type f -name 'librusty_v8_*.a.gz' -print -quit)"
+          binding="$(find "dist/${TARGET}" -maxdepth 1 -type f -name 'src_binding_*.rs' -print -quit)"
+          if [[ -z "${archive}" || -z "${binding}" ]]; then
+            echo "Missing staged archive or binding for ${TARGET}." >&2
+            exit 1
+          fi
+
+          cargo_args=(test -p codex-v8-poc)
+          if [[ "${SANDBOX}" == "true" ]]; then
+            cargo_args+=(--features sandbox)
+          fi
+
+          (
+            cd codex-rs
+            CARGO_TARGET_DIR="${RUNNER_TEMP}/rusty-v8-cargo-smoke-${TARGET}-${SANDBOX}" \
+            RUSTY_V8_ARCHIVE="${GITHUB_WORKSPACE}/${archive}" \
+            RUSTY_V8_SRC_BINDING_PATH="${GITHUB_WORKSPACE}/${binding}" \
+            cargo "${cargo_args[@]}"
+          )
+
+      - name: Upload staged artifacts
         uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7.0.0
         with:
-          name: v8-canary-${{ needs.metadata.outputs.v8_version }}-${{ matrix.target }}
+          name: v8-canary-${{ needs.metadata.outputs.v8_version }}-${{ matrix.variant }}-${{ matrix.target }}
+          path: dist/${{ matrix.target }}/*
+
+  build-windows-source:
+    name: Build ptrcomp-sandbox ${{ matrix.target }} from source
+    needs: metadata
+    runs-on: ${{ matrix.runner }}
+    permissions:
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - runner: windows-2022
+            target: x86_64-pc-windows-msvc
+          - runner: windows-2022
+            target: aarch64-pc-windows-msvc
+
+    steps:
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+
+      - name: Configure git for upstream checkout
+        shell: bash
+        run: git config --global core.symlinks true
+
+      - name: Check out upstream rusty_v8
+        uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        with:
+          repository: denoland/rusty_v8
+          ref: v${{ needs.metadata.outputs.v8_version }}
+          path: upstream-rusty-v8
+          submodules: recursive
+
+      - name: Set up Python
+        uses: actions/setup-python@a309ff8b426b58ec0e2a45f0f869d46889d02405 # v6
+        with:
+          python-version: "3.11"
+          architecture: x64
+
+      - name: Set up Codex Rust toolchain for Cargo smoke
+        uses: dtolnay/rust-toolchain@a0b273b48ed29de4470960879e8381ff45632f26 # 1.93.0
+        with:
+          toolchain: "1.93.0"
+          targets: ${{ matrix.target }}
+
+      - name: Install rusty_v8 Rust toolchain
+        env:
+          TARGET: ${{ matrix.target }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          rustup toolchain install 1.91.0 --profile minimal --no-self-update
+          rustup target add --toolchain 1.91.0 "${TARGET}"
+
+      - name: Write upstream submodule status
+        shell: bash
+        working-directory: upstream-rusty-v8
+        run: git submodule status --recursive > git_submodule_status.txt
+
+      - name: Restore upstream source-build cache
+        uses: actions/cache@668228422ae6a00e4ad889ee87cd7109ec5666a7 # v5
+        with:
+          path: |
+            upstream-rusty-v8/target/sccache
+            upstream-rusty-v8/target/${{ matrix.target }}/release/gn_out
+          key: rusty-v8-source-${{ matrix.target }}-sandbox-${{ hashFiles('upstream-rusty-v8/Cargo.lock', 'upstream-rusty-v8/build.rs', 'upstream-rusty-v8/git_submodule_status.txt') }}
+          restore-keys: |
+            rusty-v8-source-${{ matrix.target }}-sandbox-
+
+      - name: Install and start sccache
+        shell: pwsh
+        env:
+          SCCACHE_CACHE_SIZE: 256M
+          SCCACHE_DIR: ${{ github.workspace }}/upstream-rusty-v8/target/sccache
+          SCCACHE_IDLE_TIMEOUT: 0
+        run: |
+          $version = "v0.8.2"
+          $platform = "x86_64-pc-windows-msvc"
+          $basename = "sccache-$version-$platform"
+          $url = "https://github.com/mozilla/sccache/releases/download/$version/$basename.tar.gz"
+          cd ~
+          curl -LO $url
+          tar -xzvf "$basename.tar.gz"
+          . $basename/sccache --start-server
+          echo "$(pwd)/$basename" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append
+
+      - name: Install Chromium clang for ARM64 MSVC cross build
+        if: matrix.target == 'aarch64-pc-windows-msvc'
+        shell: bash
+        working-directory: upstream-rusty-v8
+        run: python3 tools/clang/scripts/update.py
+
+      - name: Build upstream rusty_v8 sandbox release pair
+        env:
+          SCCACHE_IDLE_TIMEOUT: 0
+          TARGET: ${{ matrix.target }}
+          V8_FROM_SOURCE: "1"
+        shell: bash
+        working-directory: upstream-rusty-v8
+        run: cargo +1.91.0 build --locked --release --target "${TARGET}" --features v8_enable_sandbox
+
+      - name: Stage upstream sandbox release pair
+        env:
+          TARGET: ${{ matrix.target }}
+        shell: bash
+        run: |
+          set -euo pipefail
+          python3 .github/scripts/rusty_v8_bazel.py stage-upstream-release-pair \
+            --source-root upstream-rusty-v8 \
+            --target "${TARGET}" \
+            --output-dir "dist/${TARGET}" \
+            --sandbox
+
+      - name: Smoke link staged artifact with Cargo
+        env:
+          TARGET: ${{ matrix.target }}
+        shell: bash
+        run: |
+          set -euo pipefail
+
+          archive="$(find "dist/${TARGET}" -maxdepth 1 -type f -name 'rusty_v8_*.lib.gz' -print -quit)"
+          binding="$(find "dist/${TARGET}" -maxdepth 1 -type f -name 'src_binding_*.rs' -print -quit)"
+          if [[ -z "${archive}" || -z "${binding}" ]]; then
+            echo "Missing staged archive or binding for ${TARGET}." >&2
+            exit 1
+          fi
+
+          (
+            cd codex-rs
+            RUSTY_V8_ARCHIVE="${GITHUB_WORKSPACE}/${archive}" \
+            RUSTY_V8_SRC_BINDING_PATH="${GITHUB_WORKSPACE}/${binding}" \
+            cargo +1.93.0 test -p codex-v8-poc --target "${TARGET}" --features sandbox --no-run
+          )
+
+      - name: Upload staged artifacts
+        uses: actions/upload-artifact@bbbca2ddaa5d8feaa63e36b76fdaad77386f024f # v7
+        with:
+          name: v8-canary-${{ needs.metadata.outputs.v8_version }}-ptrcomp-sandbox-${{ matrix.target }}
           path: dist/${{ matrix.target }}/*
diff --git a/MODULE.bazel b/MODULE.bazel
index f675038791..81f16b7b9e 100644
--- a/MODULE.bazel
+++ b/MODULE.bazel
@@ -10,6 +10,7 @@ single_version_override(
     module_name = "llvm",
     patch_strip = 1,
     patches = [
+        "//patches:llvm_rusty_v8_custom_libcxx.patch",
         "//patches:llvm_windows_symlink_extract.patch",
     ],
 )
@@ -77,6 +78,13 @@ use_repo(osx, "macos_sdk")
 # Needed to disable xcode...
 bazel_dep(name = "apple_support", version = "2.1.0")
 bazel_dep(name = "rules_cc", version = "0.2.16")
+single_version_override(
+    module_name = "rules_cc",
+    patch_strip = 1,
+    patches = [
+        "//patches:rules_cc_rusty_v8_custom_libcxx.patch",
+    ],
+)
 bazel_dep(name = "rules_platform", version = "0.1.0")
 bazel_dep(name = "rules_rs", version = "0.0.58")
 # `rules_rs` still does not model `windows-gnullvm` as a distinct Windows exec
@@ -407,18 +415,18 @@ crate.annotation(
 
 inject_repo(crate, "alsa_lib")
 
-bazel_dep(name = "v8", version = "14.6.202.9")
+bazel_dep(name = "v8", version = "14.7.173.20")
 archive_override(
     module_name = "v8",
-    integrity = "sha256-JphDwLAzsd9KvgRZ7eQvNtPU6qGd3XjFt/a/1QITAJU=",
+    integrity = "sha256-v/x6I4X38a2wckzUIft3Dh0SUdkuOTokwxyF7lzW8Lc=",
     patch_strip = 3,
     patches = [
         "//patches:v8_module_deps.patch",
         "//patches:v8_bazel_rules.patch",
         "//patches:v8_source_portability.patch",
     ],
-    strip_prefix = "v8-14.6.202.9",
-    urls = ["https://github.com/v8/v8/archive/refs/tags/14.6.202.9.tar.gz"],
+    strip_prefix = "v8-14.7.173.20",
+    urls = ["https://github.com/v8/v8/archive/refs/tags/14.7.173.20.tar.gz"],
 )
 
 http_archive(
@@ -430,93 +438,53 @@ http_archive(
     urls = ["https://static.crates.io/crates/v8/v8-146.4.0.crate"],
 )
 
-http_file(
-    name = "rusty_v8_146_4_0_aarch64_apple_darwin_archive",
-    downloaded_file_path = "librusty_v8_release_aarch64-apple-darwin.a.gz",
-    sha256 = "bfe2c9be32a56c28546f0f965825ee68fbf606405f310cc4e17b448a568cf98a",
-    urls = [
-        "https://github.com/denoland/rusty_v8/releases/download/v146.4.0/librusty_v8_release_aarch64-apple-darwin.a.gz",
-    ],
+http_archive(
+    name = "v8_crate_147_4_0",
+    build_file = "//third_party/v8:v8_crate.BUILD.bazel",
+    sha256 = "2df8fffd507fb18ed000673a83d937f58e60fb07f3306b2274284125b15137cd",
+    strip_prefix = "v8-147.4.0",
+    type = "tar.gz",
+    urls = ["https://static.crates.io/crates/v8/v8-147.4.0.crate"],
+)
+
+git_repository = use_repo_rule("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")
+
+git_repository(
+    name = "rusty_v8_libcxx",
+    build_file = "//third_party/v8:libcxx.BUILD.bazel",
+    commit = "7ab65651aed6802d2599dcb7a73b1f82d5179d05",
+    remote = "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxx.git",
+)
+
+git_repository(
+    name = "rusty_v8_libcxxabi",
+    build_file = "//third_party/v8:libcxxabi.BUILD.bazel",
+    commit = "8f11bb1d4438d0239d0dfc1bd9456a9f31629dda",
+    remote = "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libcxxabi.git",
+)
+
+git_repository(
+    name = "rusty_v8_llvm_libc",
+    build_file = "//third_party/v8:llvm_libc.BUILD.bazel",
+    commit = "b3aa5bb702ff9e890179fd1e7d3ba346e17ecf8e",
+    remote = "https://chromium.googlesource.com/external/github.com/llvm/llvm-project/libc.git",
 )
 
 http_file(
-    name = "rusty_v8_146_4_0_aarch64_unknown_linux_gnu_archive",
-    downloaded_file_path = "librusty_v8_release_aarch64-unknown-linux-gnu.a.gz",
-    sha256 = "dbf165b07c81bdb054bc046b43d23e69fcf7bcc1a4c1b5b4776983a71062ecd8",
-    urls = [
-        "https://github.com/denoland/rusty_v8/releases/download/v146.4.0/librusty_v8_release_aarch64-unknown-linux-gnu.a.gz",
-    ],
-)
-
-http_file(
-    name = "rusty_v8_146_4_0_aarch64_pc_windows_msvc_archive",
+    name = "rusty_v8_147_4_0_aarch64_pc_windows_msvc_archive",
     downloaded_file_path = "rusty_v8_release_aarch64-pc-windows-msvc.lib.gz",
-    sha256 = "ed13363659c6d08583ac8fdc40493445c5767d8b94955a4d5d7bb8d5a81f6bf8",
+    sha256 = "1fa3f94d9e09cff1f6bcce94c478e5cb072c0755f6a0357abadb9dd3b48d8127",
     urls = [
-        "https://github.com/denoland/rusty_v8/releases/download/v146.4.0/rusty_v8_release_aarch64-pc-windows-msvc.lib.gz",
+        "https://github.com/denoland/rusty_v8/releases/download/v147.4.0/rusty_v8_release_aarch64-pc-windows-msvc.lib.gz",
     ],
 )
 
 http_file(
-    name = "rusty_v8_146_4_0_x86_64_apple_darwin_archive",
-    downloaded_file_path = "librusty_v8_release_x86_64-apple-darwin.a.gz",
-    sha256 = "630cd240f1bbecdb071417dc18387ab81cf67c549c1c515a0b4fcf9eba647bb7",
-    urls = [
-        "https://github.com/denoland/rusty_v8/releases/download/v146.4.0/librusty_v8_release_x86_64-apple-darwin.a.gz",
-    ],
-)
-
-http_file(
-    name = "rusty_v8_146_4_0_x86_64_unknown_linux_gnu_archive",
-    downloaded_file_path = "librusty_v8_release_x86_64-unknown-linux-gnu.a.gz",
-    sha256 = "e64b4d99e4ae293a2e846244a89b80178ba10382c13fb591c1fa6968f5291153",
-    urls = [
-        "https://github.com/denoland/rusty_v8/releases/download/v146.4.0/librusty_v8_release_x86_64-unknown-linux-gnu.a.gz",
-    ],
-)
-
-http_file(
-    name = "rusty_v8_146_4_0_x86_64_pc_windows_msvc_archive",
+    name = "rusty_v8_147_4_0_x86_64_pc_windows_msvc_archive",
     downloaded_file_path = "rusty_v8_release_x86_64-pc-windows-msvc.lib.gz",
-    sha256 = "90a9a2346acd3685a355e98df85c24dbe406cb124367d16259a4b5d522621862",
+    sha256 = "e2827ff98b1a9d4c0343000fc5124ac30dfab3007bc0129c168c9355fc2fcd7c",
     urls = [
-        "https://github.com/denoland/rusty_v8/releases/download/v146.4.0/rusty_v8_release_x86_64-pc-windows-msvc.lib.gz",
-    ],
-)
-
-http_file(
-    name = "rusty_v8_146_4_0_aarch64_unknown_linux_musl_archive",
-    downloaded_file_path = "librusty_v8_release_aarch64-unknown-linux-musl.a.gz",
-    sha256 = "27a08ed26c34297bfd93e514692ccc44b85f8b15c6aa39cf34e784f84fb37e8e",
-    urls = [
-        "https://github.com/openai/codex/releases/download/rusty-v8-v146.4.0/librusty_v8_release_aarch64-unknown-linux-musl.a.gz",
-    ],
-)
-
-http_file(
-    name = "rusty_v8_146_4_0_aarch64_unknown_linux_musl_binding",
-    downloaded_file_path = "src_binding_release_aarch64-unknown-linux-musl.rs",
-    sha256 = "09f8900ced8297c229246c7a50b2e0ec23c54d0a554f369619cc29863f38dd1a",
-    urls = [
-        "https://github.com/openai/codex/releases/download/rusty-v8-v146.4.0/src_binding_release_aarch64-unknown-linux-musl.rs",
-    ],
-)
-
-http_file(
-    name = "rusty_v8_146_4_0_x86_64_unknown_linux_musl_archive",
-    downloaded_file_path = "librusty_v8_release_x86_64-unknown-linux-musl.a.gz",
-    sha256 = "20d8271ad712323d352c1383c36e3c4b755abc41ece35819c49c75ec7134d2f8",
-    urls = [
-        "https://github.com/openai/codex/releases/download/rusty-v8-v146.4.0/librusty_v8_release_x86_64-unknown-linux-musl.a.gz",
-    ],
-)
-
-http_file(
-    name = "rusty_v8_146_4_0_x86_64_unknown_linux_musl_binding",
-    downloaded_file_path = "src_binding_release_x86_64-unknown-linux-musl.rs",
-    sha256 = "09f8900ced8297c229246c7a50b2e0ec23c54d0a554f369619cc29863f38dd1a",
-    urls = [
-        "https://github.com/openai/codex/releases/download/rusty-v8-v146.4.0/src_binding_release_x86_64-unknown-linux-musl.rs",
+        "https://github.com/denoland/rusty_v8/releases/download/v147.4.0/rusty_v8_release_x86_64-pc-windows-msvc.lib.gz",
     ],
 )
 
diff --git a/MODULE.bazel.lock b/MODULE.bazel.lock
index ce362f0978..571ab3c33e 100644
--- a/MODULE.bazel.lock
+++ b/MODULE.bazel.lock
@@ -723,7 +723,7 @@
       "cached_0.56.0": "{\"dependencies\":[{\"default_features\":false,\"name\":\"ahash\",\"optional\":true,\"req\":\"^0.8\"},{\"features\":[\"attributes\"],\"kind\":\"dev\",\"name\":\"async-std\",\"req\":\"^1.6\"},{\"name\":\"async-trait\",\"optional\":true,\"req\":\"^0.1\"},{\"name\":\"cached_proc_macro\",\"optional\":true,\"req\":\"^0.25.0\"},{\"name\":\"cached_proc_macro_types\",\"optional\":true,\"req\":\"^0.1.1\"},{\"kind\":\"dev\",\"name\":\"copy_dir\",\"req\":\"^0.1.3\"},{\"name\":\"directories\",\"optional\":true,\"req\":\"^6.0\"},{\"default_features\":false,\"name\":\"futures\",\"optional\":true,\"req\":\"^0.3\"},{\"kind\":\"dev\",\"name\":\"googletest\",\"req\":\"^0.11.0\"},{\"default_features\":false,\"features\":[\"inline-more\"],\"name\":\"hashbrown\",\"req\":\"^0.15\"},{\"name\":\"once_cell\",\"req\":\"^1\"},{\"name\":\"r2d2\",\"optional\":true,\"req\":\"^0.8\"},{\"features\":[\"r2d2\"],\"name\":\"redis\",\"optional\":true,\"req\":\"^0.32\"},{\"name\":\"rmp-serde\",\"optional\":true,\"req\":\"^1.1\"},{\"features\":[\"derive\"],\"name\":\"serde\",\"optional\":true,\"req\":\"^1.0\"},{\"name\":\"serde_json\",\"optional\":true,\"req\":\"^1.0\"},{\"kind\":\"dev\",\"name\":\"serial_test\",\"req\":\"^3\"},{\"name\":\"sled\",\"optional\":true,\"req\":\"^0.34\"},{\"kind\":\"dev\",\"name\":\"smartstring\",\"req\":\"^1\"},{\"kind\":\"dev\",\"name\":\"tempfile\",\"req\":\"^3.10.1\"},{\"name\":\"thiserror\",\"req\":\"^2\"},{\"features\":[\"macros\",\"time\",\"sync\",\"parking_lot\"],\"name\":\"tokio\",\"optional\":true,\"req\":\"^1\"},{\"name\":\"web-time\",\"req\":\"^1.1.0\"}],\"features\":{\"ahash\":[\"dep:ahash\",\"hashbrown/default\"],\"async\":[\"futures\",\"tokio\",\"async-trait\"],\"async_tokio_rt_multi_thread\":[\"async\",\"tokio/rt-multi-thread\"],\"default\":[\"proc_macro\",\"ahash\"],\"disk_store\":[\"sled\",\"serde\",\"rmp-serde\",\"directories\"],\"proc_macro\":[\"cached_proc_macro\",\"cached_proc_macro_types\"],\"redis_ahash\":[\"redis_store\",\"redis/ahash\"],\"redis_async_std\":[\"redis_store\",\"async\",\"redis/aio\",\"redis/async-std-comp\",\"redis/tls\",\"redis/async-std-tls-comp\"],\"redis_connection_manager\":[\"redis_store\",\"redis/connection-manager\"],\"redis_store\":[\"redis\",\"r2d2\",\"serde\",\"serde_json\"],\"redis_tokio\":[\"redis_store\",\"async\",\"redis/aio\",\"redis/tokio-comp\",\"redis/tls\",\"redis/tokio-native-tls-comp\"],\"wasm\":[]}}",
       "cached_proc_macro_0.25.0": "{\"dependencies\":[{\"name\":\"darling\",\"req\":\"^0.20.8\"},{\"name\":\"proc-macro2\",\"req\":\"^1.0.49\"},{\"name\":\"quote\",\"req\":\"^1.0.6\"},{\"name\":\"syn\",\"req\":\"^2.0.52\"}],\"features\":{}}",
       "cached_proc_macro_types_0.1.1": "{\"dependencies\":[],\"features\":{}}",
-      "calendrical_calculations_0.2.3": "{\"dependencies\":[{\"default_features\":false,\"name\":\"core_maths\",\"req\":\"^0.1.0\"},{\"default_features\":false,\"name\":\"displaydoc\",\"req\":\"^0.2.3\"},{\"default_features\":false,\"name\":\"log\",\"optional\":true,\"req\":\"^0.4.17\"}],\"features\":{\"logging\":[\"dep:log\"]}}",
+      "calendrical_calculations_0.2.4": "{\"dependencies\":[{\"default_features\":false,\"name\":\"core_maths\",\"req\":\"^0.1.0\"},{\"default_features\":false,\"name\":\"displaydoc\",\"req\":\"^0.2.3\"},{\"default_features\":false,\"name\":\"log\",\"optional\":true,\"req\":\"^0.4.17\"}],\"features\":{\"logging\":[\"dep:log\"]}}",
       "camino_1.2.2": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"bincode\",\"req\":\"^1\"},{\"name\":\"proptest\",\"optional\":true,\"req\":\"^1.0.0\"},{\"features\":[\"derive\"],\"kind\":\"dev\",\"name\":\"serde\",\"req\":\"^1.0.223\"},{\"kind\":\"dev\",\"name\":\"serde_bytes\",\"req\":\"^0.11.8\"},{\"name\":\"serde_core\",\"optional\":true,\"req\":\"^1\"}],\"features\":{\"proptest1\":[\"dep:proptest\"],\"serde1\":[\"dep:serde_core\"]}}",
       "cargo-platform_0.3.2": "{\"dependencies\":[{\"name\":\"serde\",\"req\":\"^1.0.228\",\"target\":\"cfg(any())\"},{\"name\":\"serde_core\",\"req\":\"^1.0.228\"}],\"features\":{}}",
       "cargo_metadata_0.23.1": "{\"dependencies\":[{\"features\":[\"serde1\"],\"name\":\"camino\",\"req\":\"^1.1.10\"},{\"name\":\"cargo-platform\",\"req\":\"^0.3.0\"},{\"name\":\"derive_builder\",\"optional\":true,\"req\":\"^0.20\"},{\"features\":[\"serde\"],\"name\":\"semver\",\"req\":\"^1.0.26\"},{\"features\":[\"derive\"],\"name\":\"serde\",\"req\":\"^1.0.219\"},{\"features\":[\"unbounded_depth\"],\"name\":\"serde_json\",\"req\":\"^1.0.142\"},{\"name\":\"thiserror\",\"req\":\"^2.0.12\"}],\"features\":{\"builder\":[\"derive_builder\"],\"default\":[],\"unstable\":[]}}",
@@ -849,9 +849,9 @@
       "difflib_0.4.0": "{\"dependencies\":[],\"features\":{}}",
       "diffy_0.4.2": "{\"dependencies\":[{\"name\":\"nu-ansi-term\",\"req\":\"^0.50\"}],\"features\":{}}",
       "digest_0.10.7": "{\"dependencies\":[{\"name\":\"blobby\",\"optional\":true,\"req\":\"^0.3\"},{\"name\":\"block-buffer\",\"optional\":true,\"req\":\"^0.10\"},{\"name\":\"const-oid\",\"optional\":true,\"req\":\"^0.9\"},{\"name\":\"crypto-common\",\"req\":\"^0.1.3\"},{\"default_features\":false,\"name\":\"subtle\",\"optional\":true,\"req\":\"^2.4\"}],\"features\":{\"alloc\":[],\"core-api\":[\"block-buffer\"],\"default\":[\"core-api\"],\"dev\":[\"blobby\"],\"mac\":[\"subtle\"],\"oid\":[\"const-oid\"],\"rand_core\":[\"crypto-common/rand_core\"],\"std\":[\"alloc\",\"crypto-common/std\"]}}",
-      "diplomat-runtime_0.14.0": "{\"dependencies\":[{\"name\":\"jni\",\"optional\":true,\"req\":\"^0.21\"},{\"name\":\"log\",\"optional\":true,\"req\":\"^0.4\"}],\"features\":{\"jvm-callback-support\":[\"dep:jni\"],\"log\":[\"dep:log\"]}}",
-      "diplomat_0.14.0": "{\"dependencies\":[{\"default_features\":false,\"name\":\"diplomat_core\",\"req\":\"^0.14.0\"},{\"kind\":\"dev\",\"name\":\"insta\",\"req\":\"^1.7.1\"},{\"kind\":\"dev\",\"name\":\"prettyplease\",\"req\":\"^0.2.30\"},{\"name\":\"proc-macro2\",\"req\":\"^1.0.27\"},{\"name\":\"quote\",\"req\":\"^1.0\"},{\"features\":[\"full\",\"extra-traits\"],\"name\":\"syn\",\"req\":\"^2.0\"},{\"kind\":\"dev\",\"name\":\"tempfile\",\"req\":\"^3.2.0\"}],\"features\":{}}",
-      "diplomat_core_0.14.0": "{\"dependencies\":[{\"name\":\"displaydoc\",\"optional\":true,\"req\":\"^0.2\"},{\"default_features\":false,\"name\":\"either\",\"optional\":true,\"req\":\"^1.9.0\"},{\"features\":[\"yaml\"],\"kind\":\"dev\",\"name\":\"insta\",\"req\":\"^1.7.1\"},{\"name\":\"proc-macro2\",\"req\":\"^1.0.27\"},{\"name\":\"quote\",\"req\":\"^1.0\"},{\"default_features\":false,\"features\":[\"derive\",\"alloc\"],\"name\":\"serde\",\"req\":\"^1.0\"},{\"name\":\"smallvec\",\"req\":\"^1.9.0\"},{\"features\":[\"ident\"],\"name\":\"strck\",\"req\":\"^1.0\"},{\"features\":[\"full\",\"extra-traits\"],\"name\":\"syn\",\"req\":\"^2\"}],\"features\":{\"hir\":[\"either\"]}}",
+      "diplomat-runtime_0.15.1": "{\"dependencies\":[{\"name\":\"jni\",\"optional\":true,\"req\":\"^0.22\"},{\"name\":\"log\",\"optional\":true,\"req\":\"^0.4\"}],\"features\":{\"jvm-callback-support\":[\"dep:jni\"],\"log\":[\"dep:log\"]}}",
+      "diplomat_0.15.0": "{\"dependencies\":[{\"default_features\":false,\"name\":\"diplomat_core\",\"req\":\"^0.15.0\"},{\"kind\":\"dev\",\"name\":\"insta\",\"req\":\"^1.7.1\"},{\"kind\":\"dev\",\"name\":\"prettyplease\",\"req\":\"^0.2.30\"},{\"name\":\"proc-macro2\",\"req\":\"^1.0.27\"},{\"name\":\"quote\",\"req\":\"^1.0\"},{\"features\":[\"full\",\"extra-traits\"],\"name\":\"syn\",\"req\":\"^2.0\"},{\"kind\":\"dev\",\"name\":\"tempfile\",\"req\":\"^3.2.0\"}],\"features\":{}}",
+      "diplomat_core_0.15.0": "{\"dependencies\":[{\"name\":\"displaydoc\",\"optional\":true,\"req\":\"^0.2\"},{\"default_features\":false,\"name\":\"either\",\"optional\":true,\"req\":\"^1.9.0\"},{\"features\":[\"yaml\"],\"kind\":\"dev\",\"name\":\"insta\",\"req\":\"^1.7.1\"},{\"name\":\"proc-macro2\",\"req\":\"^1.0.27\"},{\"name\":\"quote\",\"req\":\"^1.0\"},{\"default_features\":false,\"features\":[\"derive\",\"alloc\"],\"name\":\"serde\",\"req\":\"^1.0\"},{\"name\":\"smallvec\",\"req\":\"^1.9.0\"},{\"features\":[\"ident\"],\"name\":\"strck\",\"req\":\"^1.0\"},{\"features\":[\"full\",\"extra-traits\"],\"name\":\"syn\",\"req\":\"^2\"}],\"features\":{\"hir\":[\"either\"]}}",
       "dirs-next_2.0.0": "{\"dependencies\":[{\"name\":\"cfg-if\",\"req\":\"^1.0.0\"},{\"name\":\"dirs-sys-next\",\"req\":\"^0.1\"}],\"features\":{}}",
       "dirs-sys-next_0.1.2": "{\"dependencies\":[{\"name\":\"libc\",\"req\":\"^0.2\",\"target\":\"cfg(unix)\"},{\"default_features\":false,\"name\":\"redox_users\",\"req\":\"^0.4.0\",\"target\":\"cfg(target_os = \\\"redox\\\")\"},{\"features\":[\"knownfolders\",\"objbase\",\"shlobj\",\"winbase\",\"winerror\"],\"name\":\"winapi\",\"req\":\"^0.3\",\"target\":\"cfg(windows)\"}],\"features\":{}}",
       "dirs-sys_0.5.0": "{\"dependencies\":[{\"name\":\"libc\",\"req\":\"^0.2\",\"target\":\"cfg(unix)\"},{\"name\":\"option-ext\",\"req\":\"^0.2.0\"},{\"default_features\":false,\"name\":\"redox_users\",\"req\":\"^0.5\",\"target\":\"cfg(target_os = \\\"redox\\\")\"},{\"features\":[\"Win32_UI_Shell\",\"Win32_Foundation\",\"Win32_Globalization\",\"Win32_System_Com\"],\"name\":\"windows-sys\",\"req\":\">=0.59.0\",\"target\":\"cfg(windows)\"}],\"features\":{}}",
@@ -914,7 +914,7 @@
       "find-crate_0.6.3": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"proc-macro2\",\"req\":\"^1\"},{\"kind\":\"dev\",\"name\":\"quote\",\"req\":\"^1\"},{\"kind\":\"dev\",\"name\":\"semver\",\"req\":\"^0.11\"},{\"name\":\"toml\",\"req\":\"^0.5.2\"}],\"features\":{}}",
       "find-msvc-tools_0.1.9": "{\"dependencies\":[],\"features\":{}}",
       "findshlibs_0.10.2": "{\"dependencies\":[{\"kind\":\"build\",\"name\":\"cc\",\"req\":\"^1.0.67\"},{\"name\":\"lazy_static\",\"req\":\"^1.4\",\"target\":\"cfg(any(target_os = \\\"macos\\\", target_os = \\\"ios\\\"))\"},{\"name\":\"libc\",\"req\":\"^0.2.104\"},{\"features\":[\"psapi\",\"memoryapi\",\"libloaderapi\",\"processthreadsapi\"],\"name\":\"winapi\",\"req\":\"^0.3.9\",\"target\":\"cfg(target_os = \\\"windows\\\")\"}],\"features\":{}}",
-      "fixed_decimal_0.7.1": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"criterion\",\"req\":\"^0.5.0\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"default_features\":false,\"name\":\"displaydoc\",\"req\":\"^0.2.3\"},{\"features\":[\"wasm_js\"],\"kind\":\"dev\",\"name\":\"getrandom\",\"req\":\"^0.3\"},{\"kind\":\"dev\",\"name\":\"rand\",\"req\":\"^0.9\"},{\"kind\":\"dev\",\"name\":\"rand_distr\",\"req\":\"^0.5\"},{\"kind\":\"dev\",\"name\":\"rand_pcg\",\"req\":\"^0.9\"},{\"default_features\":false,\"features\":[\"small\"],\"name\":\"ryu\",\"optional\":true,\"req\":\"^1.0.5\"},{\"default_features\":false,\"name\":\"smallvec\",\"req\":\"^1.10.0\"},{\"default_features\":false,\"features\":[\"alloc\"],\"name\":\"writeable\",\"req\":\"^0.6.0\"}],\"features\":{\"experimental\":[],\"ryu\":[\"dep:ryu\"]}}",
+      "fixed_decimal_0.7.2": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"criterion\",\"req\":\"^0.5.0\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"default_features\":false,\"name\":\"displaydoc\",\"req\":\"^0.2.3\"},{\"features\":[\"wasm_js\"],\"kind\":\"dev\",\"name\":\"getrandom\",\"req\":\"^0.3\"},{\"kind\":\"dev\",\"name\":\"rand\",\"req\":\"^0.9\"},{\"kind\":\"dev\",\"name\":\"rand_distr\",\"req\":\"^0.5\"},{\"kind\":\"dev\",\"name\":\"rand_pcg\",\"req\":\"^0.9\"},{\"default_features\":false,\"features\":[\"small\"],\"name\":\"ryu\",\"optional\":true,\"req\":\"^1.0.5\"},{\"default_features\":false,\"features\":[\"const_new\"],\"name\":\"smallvec\",\"req\":\"^1.10.0\"},{\"default_features\":false,\"features\":[\"alloc\"],\"name\":\"writeable\",\"req\":\"^0.6.1\"}],\"features\":{\"ryu\":[\"dep:ryu\"]}}",
       "fixedbitset_0.4.2": "{\"dependencies\":[{\"features\":[\"derive\"],\"name\":\"serde\",\"optional\":true,\"req\":\"^1.0\"},{\"kind\":\"dev\",\"name\":\"serde_json\",\"req\":\"^1.0\"}],\"features\":{\"default\":[\"std\"],\"std\":[]}}",
       "fixedbitset_0.5.7": "{\"dependencies\":[{\"name\":\"serde\",\"optional\":true,\"req\":\"^1.0\"},{\"kind\":\"dev\",\"name\":\"serde_json\",\"req\":\"^1.0\"}],\"features\":{\"default\":[\"std\"],\"std\":[]}}",
       "flate2_1.1.8": "{\"dependencies\":[{\"name\":\"cloudflare-zlib-sys\",\"optional\":true,\"req\":\"^0.3.6\"},{\"name\":\"crc32fast\",\"req\":\"^1.2.0\"},{\"name\":\"document-features\",\"optional\":true,\"req\":\"^0.2\"},{\"default_features\":false,\"kind\":\"dev\",\"name\":\"futures\",\"req\":\"^0.3\"},{\"name\":\"libz-ng-sys\",\"optional\":true,\"req\":\"^1.1.16\"},{\"default_features\":false,\"name\":\"libz-sys\",\"optional\":true,\"req\":\"^1.1.20\"},{\"default_features\":false,\"features\":[\"with-alloc\",\"simd\"],\"name\":\"miniz_oxide\",\"req\":\"^0.8.5\",\"target\":\"cfg(all(target_arch = \\\"wasm32\\\", not(target_os = \\\"emscripten\\\")))\"},{\"default_features\":false,\"features\":[\"with-alloc\",\"simd\"],\"name\":\"miniz_oxide\",\"optional\":true,\"req\":\"^0.8.5\"},{\"default_features\":false,\"kind\":\"dev\",\"name\":\"quickcheck\",\"req\":\"^1.0\"},{\"kind\":\"dev\",\"name\":\"rand\",\"req\":\"^0.9\"},{\"default_features\":false,\"features\":[\"std\",\"rust-allocator\"],\"name\":\"zlib-rs\",\"optional\":true,\"req\":\"^0.5.5\"}],\"features\":{\"any_c_zlib\":[\"any_zlib\"],\"any_impl\":[],\"any_zlib\":[\"any_impl\"],\"cloudflare_zlib\":[\"any_c_zlib\",\"cloudflare-zlib-sys\"],\"default\":[\"rust_backend\"],\"miniz-sys\":[\"rust_backend\"],\"rust_backend\":[\"miniz_oxide\",\"any_impl\"],\"zlib\":[\"any_c_zlib\",\"libz-sys\"],\"zlib-default\":[\"any_c_zlib\",\"libz-sys/default\"],\"zlib-ng\":[\"any_c_zlib\",\"libz-ng-sys\"],\"zlib-ng-compat\":[\"zlib\",\"libz-sys/zlib-ng\"],\"zlib-rs\":[\"any_zlib\",\"dep:zlib-rs\"]}}",
@@ -1079,19 +1079,28 @@
       "i18n-embed_0.15.4": "{\"dependencies\":[{\"name\":\"arc-swap\",\"optional\":true,\"req\":\"^1\"},{\"kind\":\"dev\",\"name\":\"doc-comment\",\"req\":\"^0.3\"},{\"kind\":\"dev\",\"name\":\"env_logger\",\"req\":\"^0.11\"},{\"name\":\"fluent\",\"optional\":true,\"req\":\"^0.16\"},{\"name\":\"fluent-langneg\",\"req\":\"^0.13\"},{\"name\":\"fluent-syntax\",\"optional\":true,\"req\":\"^0.11\"},{\"name\":\"gettext\",\"optional\":true,\"req\":\"^0.4\"},{\"name\":\"i18n-embed-impl\",\"optional\":true,\"req\":\"^0.8.4\"},{\"name\":\"intl-memoizer\",\"req\":\"^0.5\"},{\"name\":\"locale_config\",\"optional\":true,\"req\":\"^0.3\"},{\"name\":\"log\",\"req\":\"^0.4\"},{\"kind\":\"dev\",\"name\":\"maplit\",\"req\":\"^1.0\"},{\"name\":\"notify\",\"optional\":true,\"req\":\"^8.0.0\"},{\"name\":\"parking_lot\",\"optional\":true,\"req\":\"^0.12\"},{\"kind\":\"dev\",\"name\":\"pretty_assertions\",\"req\":\"^1.4\"},{\"name\":\"rust-embed\",\"optional\":true,\"req\":\"^8.0\"},{\"kind\":\"dev\",\"name\":\"serial_test\",\"req\":\"^3.0\"},{\"name\":\"thiserror\",\"req\":\"^1.0\"},{\"default_features\":false,\"name\":\"tr\",\"optional\":true,\"req\":\"^0.1\"},{\"name\":\"unic-langid\",\"req\":\"^0.9\"},{\"name\":\"walkdir\",\"optional\":true,\"req\":\"^2.4\"},{\"features\":[\"Window\",\"Navigator\"],\"name\":\"web-sys\",\"optional\":true,\"req\":\"^0.3\"}],\"features\":{\"autoreload\":[\"notify\"],\"default\":[\"rust-embed\"],\"desktop-requester\":[\"locale_config\"],\"filesystem-assets\":[\"walkdir\"],\"fluent-system\":[\"fluent\",\"fluent-syntax\",\"parking_lot\",\"i18n-embed-impl\",\"i18n-embed-impl/fluent-system\",\"arc-swap\"],\"gettext-system\":[\"tr\",\"tr/gettext\",\"dep:gettext\",\"parking_lot\",\"i18n-embed-impl\",\"i18n-embed-impl/gettext-system\"],\"web-sys-requester\":[\"web-sys\"]}}",
       "iana-time-zone-haiku_0.1.2": "{\"dependencies\":[{\"kind\":\"build\",\"name\":\"cc\",\"req\":\"^1.0.79\"}],\"features\":{}}",
       "iana-time-zone_0.1.65": "{\"dependencies\":[{\"name\":\"android_system_properties\",\"req\":\"^0.1.5\",\"target\":\"cfg(target_os = \\\"android\\\")\"},{\"kind\":\"dev\",\"name\":\"chrono-tz\",\"req\":\"^0.10.1\"},{\"name\":\"core-foundation-sys\",\"req\":\"^0.8.6\",\"target\":\"cfg(target_vendor = \\\"apple\\\")\"},{\"kind\":\"dev\",\"name\":\"getrandom\",\"req\":\"^0.2.1\"},{\"features\":[\"js\"],\"kind\":\"dev\",\"name\":\"getrandom\",\"req\":\"^0.2.1\",\"target\":\"cfg(all(target_arch = \\\"wasm32\\\", target_os = \\\"unknown\\\"))\"},{\"name\":\"iana-time-zone-haiku\",\"req\":\"^0.1.1\",\"target\":\"cfg(target_os = \\\"haiku\\\")\"},{\"name\":\"js-sys\",\"req\":\"^0.3.66\",\"target\":\"cfg(all(target_arch = \\\"wasm32\\\", target_os = \\\"unknown\\\"))\"},{\"name\":\"log\",\"req\":\"^0.4.14\",\"target\":\"cfg(all(target_arch = \\\"wasm32\\\", target_os = \\\"unknown\\\"))\"},{\"name\":\"wasm-bindgen\",\"req\":\"^0.2.89\",\"target\":\"cfg(all(target_arch = \\\"wasm32\\\", target_os = \\\"unknown\\\"))\"},{\"kind\":\"dev\",\"name\":\"wasm-bindgen-test\",\"req\":\"^0.3.46\",\"target\":\"cfg(all(target_arch = \\\"wasm32\\\", target_os = \\\"unknown\\\"))\"},{\"name\":\"windows-core\",\"req\":\">=0.56, <=0.62\",\"target\":\"cfg(target_os = \\\"windows\\\")\"}],\"features\":{\"fallback\":[]}}",
-      "icu_calendar_2.1.1": "{\"dependencies\":[{\"default_features\":false,\"name\":\"calendrical_calculations\",\"req\":\"^0.2.3\"},{\"kind\":\"dev\",\"name\":\"criterion\",\"req\":\"^0.5.0\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"databake\",\"optional\":true,\"req\":\"^0.2.0\"},{\"default_features\":false,\"name\":\"displaydoc\",\"req\":\"^0.2.3\"},{\"default_features\":false,\"name\":\"icu_calendar_data\",\"optional\":true,\"req\":\"~2.1.1\"},{\"default_features\":false,\"name\":\"icu_locale\",\"optional\":true,\"req\":\"~2.1.1\"},{\"default_features\":false,\"name\":\"icu_locale_core\",\"req\":\"^2.1.1\"},{\"default_features\":false,\"name\":\"icu_provider\",\"req\":\"^2.1.1\"},{\"kind\":\"dev\",\"name\":\"itertools\",\"req\":\"^0.14.0\"},{\"default_features\":false,\"name\":\"ixdtf\",\"optional\":true,\"req\":\"^0.6.0\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"serde\",\"optional\":true,\"req\":\"^1.0.220\"},{\"default_features\":false,\"features\":[\"derive\",\"alloc\"],\"kind\":\"dev\",\"name\":\"serde\",\"req\":\"^1.0.220\"},{\"kind\":\"dev\",\"name\":\"serde_json\",\"req\":\"^1.0.45\"},{\"kind\":\"dev\",\"name\":\"simple_logger\",\"req\":\"^5.0.0\"},{\"default_features\":false,\"features\":[\"zerovec\"],\"name\":\"tinystr\",\"req\":\"^0.8.0\"},{\"kind\":\"dev\",\"name\":\"ureq\",\"req\":\"^3.0.0\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"zerovec\",\"req\":\"^0.11.3\"}],\"features\":{\"alloc\":[\"icu_locale_core/alloc\",\"tinystr/alloc\",\"serde?/alloc\"],\"compiled_data\":[\"dep:icu_calendar_data\",\"dep:icu_locale\",\"icu_locale?/compiled_data\",\"icu_provider/baked\"],\"datagen\":[\"serde\",\"dep:databake\",\"zerovec/databake\",\"tinystr/databake\",\"alloc\",\"icu_provider/export\"],\"default\":[\"compiled_data\",\"ixdtf\"],\"ixdtf\":[\"dep:ixdtf\"],\"logging\":[\"calendrical_calculations/logging\"],\"serde\":[\"dep:serde\",\"zerovec/serde\",\"tinystr/serde\",\"icu_provider/serde\"],\"unstable\":[]}}",
-      "icu_calendar_data_2.1.1": "{\"dependencies\":[],\"features\":{}}",
+      "icu_calendar_2.2.1": "{\"dependencies\":[{\"default_features\":false,\"name\":\"calendrical_calculations\",\"req\":\"^0.2.4\"},{\"default_features\":false,\"name\":\"chrono\",\"optional\":true,\"req\":\"^0.4\"},{\"kind\":\"dev\",\"name\":\"criterion\",\"req\":\"^0.5.0\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"databake\",\"optional\":true,\"req\":\"^0.2.0\"},{\"default_features\":false,\"name\":\"displaydoc\",\"req\":\"^0.2.3\"},{\"default_features\":false,\"name\":\"icu_calendar_data\",\"optional\":true,\"req\":\"~2.2.0\"},{\"default_features\":false,\"name\":\"icu_locale\",\"optional\":true,\"req\":\"~2.2.0\"},{\"default_features\":false,\"name\":\"icu_locale_core\",\"req\":\"^2.2.0\"},{\"default_features\":false,\"name\":\"icu_provider\",\"req\":\"^2.2.0\"},{\"kind\":\"dev\",\"name\":\"insta\",\"req\":\"^1.38.0\"},{\"kind\":\"dev\",\"name\":\"itertools\",\"req\":\"^0.14.0\"},{\"default_features\":false,\"name\":\"ixdtf\",\"optional\":true,\"req\":\"^0.6.5\"},{\"default_features\":false,\"name\":\"jiff\",\"optional\":true,\"req\":\"^0.2\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"serde\",\"optional\":true,\"req\":\"^1.0.220\"},{\"default_features\":false,\"features\":[\"derive\",\"alloc\"],\"kind\":\"dev\",\"name\":\"serde\",\"req\":\"^1.0.220\"},{\"kind\":\"dev\",\"name\":\"serde_json\",\"req\":\"^1.0.45\"},{\"kind\":\"dev\",\"name\":\"simple_logger\",\"req\":\"^5.0.0\"},{\"default_features\":false,\"name\":\"time\",\"optional\":true,\"req\":\"^0.3\"},{\"default_features\":false,\"features\":[\"large-dates\"],\"kind\":\"dev\",\"name\":\"time\",\"req\":\"^0.3\"},{\"default_features\":false,\"features\":[\"zerovec\"],\"name\":\"tinystr\",\"req\":\"^0.8.3\"},{\"kind\":\"dev\",\"name\":\"ureq\",\"req\":\"^3.0.0\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"zerovec\",\"req\":\"^0.11.6\"}],\"features\":{\"alloc\":[\"icu_locale_core/alloc\",\"tinystr/alloc\",\"serde?/alloc\"],\"compiled_data\":[\"dep:icu_calendar_data\",\"dep:icu_locale\",\"icu_locale?/compiled_data\",\"icu_provider/baked\"],\"datagen\":[\"serde\",\"dep:databake\",\"zerovec/databake\",\"tinystr/databake\",\"alloc\",\"icu_provider/export\"],\"default\":[\"compiled_data\",\"ixdtf\"],\"ixdtf\":[\"dep:ixdtf\"],\"logging\":[\"calendrical_calculations/logging\"],\"serde\":[\"dep:serde\",\"zerovec/serde\",\"tinystr/serde\",\"icu_provider/serde\"],\"unstable\":[],\"unstable_chrono_0_4\":[\"dep:chrono\"],\"unstable_jiff_0_2\":[\"dep:jiff\"],\"unstable_time_0_3\":[\"dep:time\"]}}",
+      "icu_calendar_data_2.2.0": "{\"dependencies\":[],\"features\":{}}",
       "icu_collections_2.1.1": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"criterion\",\"req\":\"^0.5.0\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"databake\",\"optional\":true,\"req\":\"^0.2.0\"},{\"default_features\":false,\"name\":\"displaydoc\",\"req\":\"^0.2.3\"},{\"kind\":\"dev\",\"name\":\"iai\",\"req\":\"^0.1.1\"},{\"default_features\":false,\"features\":[\"alloc\"],\"kind\":\"dev\",\"name\":\"postcard\",\"req\":\"^1.0.3\"},{\"default_features\":false,\"features\":[\"zerovec\"],\"name\":\"potential_utf\",\"req\":\"^0.1.3\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"serde\",\"optional\":true,\"req\":\"^1.0.220\"},{\"default_features\":false,\"features\":[\"derive\"],\"kind\":\"dev\",\"name\":\"serde\",\"req\":\"^1.0.220\"},{\"kind\":\"dev\",\"name\":\"serde_json\",\"req\":\"^1.0.45\"},{\"default_features\":false,\"features\":[\"parse\"],\"kind\":\"dev\",\"name\":\"toml\",\"req\":\"^0.8.0\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"yoke\",\"req\":\"^0.8.0\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"zerofrom\",\"req\":\"^0.1.3\"},{\"default_features\":false,\"features\":[\"derive\",\"yoke\"],\"name\":\"zerovec\",\"req\":\"^0.11.3\"}],\"features\":{\"alloc\":[\"serde?/alloc\",\"zerovec/alloc\"],\"databake\":[\"dep:databake\",\"zerovec/databake\"],\"serde\":[\"dep:serde\",\"zerovec/serde\",\"potential_utf/serde\",\"alloc\"]}}",
-      "icu_decimal_2.1.1": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"criterion\",\"req\":\"^0.5.0\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"databake\",\"optional\":true,\"req\":\"^0.2.0\"},{\"default_features\":false,\"name\":\"fixed_decimal\",\"req\":\"^0.7.0\"},{\"features\":[\"wasm_js\"],\"kind\":\"dev\",\"name\":\"getrandom\",\"req\":\"^0.3\"},{\"default_features\":false,\"name\":\"icu_decimal_data\",\"optional\":true,\"req\":\"~2.1.1\"},{\"default_features\":false,\"name\":\"icu_locale\",\"optional\":true,\"req\":\"~2.1.1\"},{\"default_features\":false,\"name\":\"icu_locale_core\",\"req\":\"^2.1.1\"},{\"default_features\":false,\"name\":\"icu_provider\",\"req\":\"^2.1.1\"},{\"kind\":\"dev\",\"name\":\"rand\",\"req\":\"^0.9\"},{\"kind\":\"dev\",\"name\":\"rand_distr\",\"req\":\"^0.5\"},{\"kind\":\"dev\",\"name\":\"rand_pcg\",\"req\":\"^0.9\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"serde\",\"optional\":true,\"req\":\"^1.0.220\"},{\"default_features\":false,\"name\":\"writeable\",\"req\":\"^0.6.0\"},{\"default_features\":false,\"features\":[\"alloc\"],\"name\":\"zerovec\",\"req\":\"^0.11.3\"}],\"features\":{\"alloc\":[\"serde?/alloc\",\"zerovec/alloc\"],\"compiled_data\":[\"dep:icu_decimal_data\",\"dep:icu_locale\",\"icu_locale?/compiled_data\",\"icu_provider/baked\"],\"datagen\":[\"serde\",\"dep:databake\",\"zerovec/databake\",\"icu_provider/export\",\"alloc\"],\"default\":[\"compiled_data\"],\"ryu\":[\"fixed_decimal/ryu\"],\"serde\":[\"dep:serde\",\"icu_provider/serde\",\"zerovec/serde\"]}}",
-      "icu_decimal_data_2.1.1": "{\"dependencies\":[],\"features\":{}}",
-      "icu_locale_2.1.1": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"criterion\",\"req\":\"^0.5.0\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"databake\",\"optional\":true,\"req\":\"^0.2.0\"},{\"default_features\":false,\"name\":\"icu_collections\",\"req\":\"~2.1.1\"},{\"default_features\":false,\"features\":[\"alloc\",\"zerovec\"],\"name\":\"icu_locale_core\",\"req\":\"^2.1.1\"},{\"default_features\":false,\"name\":\"icu_locale_data\",\"optional\":true,\"req\":\"~2.1.1\"},{\"default_features\":false,\"features\":[\"alloc\"],\"name\":\"icu_provider\",\"req\":\"^2.1.1\"},{\"default_features\":false,\"features\":[\"alloc\",\"zerovec\"],\"name\":\"potential_utf\",\"req\":\"^0.1.3\"},{\"default_features\":false,\"features\":[\"derive\",\"alloc\"],\"name\":\"serde\",\"optional\":true,\"req\":\"^1.0.220\"},{\"default_features\":false,\"features\":[\"derive\"],\"kind\":\"dev\",\"name\":\"serde\",\"req\":\"^1.0.220\"},{\"kind\":\"dev\",\"name\":\"serde_json\",\"req\":\"^1.0.45\"},{\"default_features\":false,\"features\":[\"alloc\",\"zerovec\"],\"name\":\"tinystr\",\"req\":\"^0.8.0\"},{\"default_features\":false,\"features\":[\"alloc\",\"yoke\"],\"name\":\"zerovec\",\"req\":\"^0.11.3\"}],\"features\":{\"compiled_data\":[\"dep:icu_locale_data\",\"icu_provider/baked\"],\"datagen\":[\"serde\",\"dep:databake\",\"zerovec/databake\",\"icu_locale_core/databake\",\"tinystr/databake\",\"icu_collections/databake\",\"icu_provider/export\"],\"default\":[\"compiled_data\"],\"serde\":[\"dep:serde\",\"icu_locale_core/serde\",\"tinystr/serde\",\"zerovec/serde\",\"icu_provider/serde\",\"potential_utf/serde\",\"icu_collections/serde\"]}}",
+      "icu_collections_2.2.0": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"criterion\",\"req\":\"^0.5.0\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"databake\",\"optional\":true,\"req\":\"^0.2.0\"},{\"default_features\":false,\"name\":\"displaydoc\",\"req\":\"^0.2.3\"},{\"kind\":\"dev\",\"name\":\"iai\",\"req\":\"^0.1.1\"},{\"default_features\":false,\"features\":[\"alloc\"],\"kind\":\"dev\",\"name\":\"postcard\",\"req\":\"^1.0.3\"},{\"default_features\":false,\"features\":[\"zerovec\"],\"name\":\"potential_utf\",\"req\":\"^0.1.3\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"serde\",\"optional\":true,\"req\":\"^1.0.220\"},{\"default_features\":false,\"features\":[\"derive\"],\"kind\":\"dev\",\"name\":\"serde\",\"req\":\"^1.0.220\"},{\"kind\":\"dev\",\"name\":\"serde_json\",\"req\":\"^1.0.45\"},{\"default_features\":false,\"features\":[\"parse\"],\"kind\":\"dev\",\"name\":\"toml\",\"req\":\"^0.8.0\"},{\"default_features\":false,\"name\":\"utf8_iter\",\"req\":\"^1.0.2\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"yoke\",\"req\":\"^0.8.2\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"zerofrom\",\"req\":\"^0.1.6\"},{\"default_features\":false,\"features\":[\"derive\",\"yoke\"],\"name\":\"zerovec\",\"req\":\"^0.11.6\"}],\"features\":{\"alloc\":[\"serde?/alloc\",\"zerovec/alloc\"],\"databake\":[\"dep:databake\",\"zerovec/databake\"],\"serde\":[\"dep:serde\",\"zerovec/serde\",\"potential_utf/serde\",\"alloc\"]}}",
+      "icu_decimal_2.2.0": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"criterion\",\"req\":\"^0.5.0\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"databake\",\"optional\":true,\"req\":\"^0.2.0\"},{\"default_features\":false,\"name\":\"displaydoc\",\"req\":\"^0.2.3\"},{\"default_features\":false,\"name\":\"fixed_decimal\",\"req\":\"^0.7.2\"},{\"features\":[\"wasm_js\"],\"kind\":\"dev\",\"name\":\"getrandom\",\"req\":\"^0.3\"},{\"default_features\":false,\"name\":\"icu_decimal_data\",\"optional\":true,\"req\":\"~2.2.0\"},{\"default_features\":false,\"name\":\"icu_locale\",\"optional\":true,\"req\":\"~2.2.0\"},{\"default_features\":false,\"name\":\"icu_locale_core\",\"req\":\"^2.2.0\"},{\"default_features\":false,\"features\":[\"zerovec\"],\"name\":\"icu_pattern\",\"optional\":true,\"req\":\"^0.4.2\"},{\"default_features\":false,\"name\":\"icu_plurals\",\"optional\":true,\"req\":\"~2.2.0\"},{\"default_features\":false,\"name\":\"icu_provider\",\"req\":\"^2.2.0\"},{\"kind\":\"dev\",\"name\":\"rand\",\"req\":\"^0.9\"},{\"kind\":\"dev\",\"name\":\"rand_distr\",\"req\":\"^0.5\"},{\"kind\":\"dev\",\"name\":\"rand_pcg\",\"req\":\"^0.9\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"serde\",\"optional\":true,\"req\":\"^1.0.220\"},{\"default_features\":false,\"name\":\"writeable\",\"req\":\"^0.6.1\"},{\"default_features\":false,\"features\":[\"alloc\"],\"name\":\"zerovec\",\"req\":\"^0.11.6\"}],\"features\":{\"alloc\":[\"serde?/alloc\",\"zerovec/alloc\"],\"compiled_data\":[\"dep:icu_decimal_data\",\"dep:icu_locale\",\"icu_locale?/compiled_data\",\"icu_provider/baked\",\"icu_plurals?/compiled_data\"],\"datagen\":[\"serde\",\"dep:databake\",\"zerovec/databake\",\"icu_provider/export\",\"alloc\",\"icu_plurals?/datagen\"],\"default\":[\"compiled_data\"],\"ryu\":[\"fixed_decimal/ryu\"],\"serde\":[\"alloc\",\"dep:serde\",\"icu_provider/serde\",\"zerovec/serde\",\"icu_pattern?/serde\",\"icu_plurals?/serde\"],\"unstable\":[\"dep:icu_pattern\",\"dep:icu_plurals\"]}}",
+      "icu_decimal_data_2.2.0": "{\"dependencies\":[],\"features\":{}}",
+      "icu_locale_2.2.0": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"criterion\",\"req\":\"^0.5.0\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"databake\",\"optional\":true,\"req\":\"^0.2.0\"},{\"default_features\":false,\"name\":\"icu_collections\",\"req\":\"~2.2.0\"},{\"default_features\":false,\"features\":[\"alloc\",\"zerovec\"],\"name\":\"icu_locale_core\",\"req\":\"^2.2.0\"},{\"default_features\":false,\"name\":\"icu_locale_data\",\"optional\":true,\"req\":\"~2.2.0\"},{\"default_features\":false,\"features\":[\"alloc\"],\"name\":\"icu_provider\",\"req\":\"^2.2.0\"},{\"default_features\":false,\"features\":[\"alloc\",\"zerovec\"],\"name\":\"potential_utf\",\"req\":\"^0.1.3\"},{\"default_features\":false,\"features\":[\"derive\",\"alloc\"],\"name\":\"serde\",\"optional\":true,\"req\":\"^1.0.220\"},{\"default_features\":false,\"features\":[\"derive\"],\"kind\":\"dev\",\"name\":\"serde\",\"req\":\"^1.0.220\"},{\"kind\":\"dev\",\"name\":\"serde_json\",\"req\":\"^1.0.45\"},{\"default_features\":false,\"features\":[\"alloc\",\"zerovec\"],\"name\":\"tinystr\",\"req\":\"^0.8.3\"},{\"default_features\":false,\"features\":[\"alloc\",\"yoke\"],\"name\":\"zerovec\",\"req\":\"^0.11.6\"}],\"features\":{\"compiled_data\":[\"dep:icu_locale_data\",\"icu_provider/baked\"],\"datagen\":[\"serde\",\"dep:databake\",\"zerovec/databake\",\"icu_locale_core/databake\",\"tinystr/databake\",\"icu_collections/databake\",\"icu_provider/export\"],\"default\":[\"compiled_data\"],\"serde\":[\"dep:serde\",\"icu_locale_core/serde\",\"tinystr/serde\",\"zerovec/serde\",\"icu_provider/serde\",\"potential_utf/serde\",\"icu_collections/serde\"]}}",
       "icu_locale_core_2.1.1": "{\"dependencies\":[{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"databake\",\"optional\":true,\"req\":\"^0.2.0\"},{\"default_features\":false,\"name\":\"displaydoc\",\"req\":\"^0.2.3\"},{\"default_features\":false,\"name\":\"litemap\",\"req\":\"^0.8.0\"},{\"default_features\":false,\"name\":\"serde\",\"optional\":true,\"req\":\"^1.0.220\"},{\"default_features\":false,\"name\":\"tinystr\",\"req\":\"^0.8.0\"},{\"default_features\":false,\"name\":\"writeable\",\"req\":\"^0.6.0\"},{\"default_features\":false,\"name\":\"zerovec\",\"optional\":true,\"req\":\"^0.11.3\"}],\"features\":{\"alloc\":[\"litemap/alloc\",\"tinystr/alloc\",\"writeable/alloc\",\"serde?/alloc\"],\"databake\":[\"dep:databake\",\"alloc\"],\"serde\":[\"dep:serde\",\"tinystr/serde\"],\"zerovec\":[\"dep:zerovec\",\"tinystr/zerovec\"]}}",
-      "icu_locale_data_2.1.2": "{\"dependencies\":[],\"features\":{}}",
+      "icu_locale_core_2.2.0": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"criterion\",\"req\":\"^0.5.0\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"databake\",\"optional\":true,\"req\":\"^0.2.0\"},{\"default_features\":false,\"name\":\"displaydoc\",\"req\":\"^0.2.3\"},{\"kind\":\"dev\",\"name\":\"iai\",\"req\":\"^0.1.1\"},{\"default_features\":false,\"name\":\"litemap\",\"req\":\"^0.8.0\"},{\"default_features\":false,\"features\":[\"testing\"],\"kind\":\"dev\",\"name\":\"litemap\",\"req\":\"^0.8.0\"},{\"default_features\":false,\"features\":[\"use-std\"],\"kind\":\"dev\",\"name\":\"postcard\",\"req\":\"^1.0.3\"},{\"default_features\":false,\"kind\":\"dev\",\"name\":\"potential_utf\",\"req\":\"^0.1.3\"},{\"default_features\":false,\"name\":\"serde\",\"optional\":true,\"req\":\"^1.0.220\"},{\"default_features\":false,\"features\":[\"derive\"],\"kind\":\"dev\",\"name\":\"serde\",\"req\":\"^1.0.220\"},{\"kind\":\"dev\",\"name\":\"serde_json\",\"req\":\"^1.0.45\"},{\"default_features\":false,\"name\":\"tinystr\",\"req\":\"^0.8.3\"},{\"default_features\":false,\"name\":\"writeable\",\"req\":\"^0.6.1\"},{\"default_features\":false,\"name\":\"zerovec\",\"optional\":true,\"req\":\"^0.11.6\"}],\"features\":{\"alloc\":[\"litemap/alloc\",\"tinystr/alloc\",\"writeable/alloc\",\"serde?/alloc\"],\"databake\":[\"dep:databake\",\"alloc\"],\"serde\":[\"dep:serde\",\"tinystr/serde\"],\"zerovec\":[\"dep:zerovec\",\"tinystr/zerovec\"]}}",
+      "icu_locale_data_2.2.0": "{\"dependencies\":[],\"features\":{}}",
       "icu_normalizer_2.1.1": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"arraystring\",\"req\":\"^0.3.0\"},{\"default_features\":false,\"kind\":\"dev\",\"name\":\"arrayvec\",\"req\":\"^0.7.2\"},{\"kind\":\"dev\",\"name\":\"atoi\",\"req\":\"^2.0.0\"},{\"kind\":\"dev\",\"name\":\"criterion\",\"req\":\"^0.5.0\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"databake\",\"optional\":true,\"req\":\"^0.2.0\"},{\"kind\":\"dev\",\"name\":\"detone\",\"req\":\"^1.0.0\"},{\"default_features\":false,\"name\":\"icu_collections\",\"req\":\"~2.1.1\"},{\"default_features\":false,\"name\":\"icu_normalizer_data\",\"optional\":true,\"req\":\"~2.1.1\"},{\"default_features\":false,\"name\":\"icu_properties\",\"optional\":true,\"req\":\"~2.1.1\"},{\"default_features\":false,\"name\":\"icu_provider\",\"req\":\"^2.1.1\"},{\"default_features\":false,\"features\":[\"derive\",\"alloc\"],\"name\":\"serde\",\"optional\":true,\"req\":\"^1.0.220\"},{\"default_features\":false,\"name\":\"smallvec\",\"req\":\"^1.10.0\"},{\"default_features\":false,\"name\":\"utf16_iter\",\"optional\":true,\"req\":\"^1.0.2\"},{\"default_features\":false,\"name\":\"utf8_iter\",\"optional\":true,\"req\":\"^1.0.2\"},{\"default_features\":false,\"features\":[\"alloc\"],\"name\":\"write16\",\"optional\":true,\"req\":\"^1.0.0\"},{\"default_features\":false,\"features\":[\"arrayvec\",\"smallvec\"],\"kind\":\"dev\",\"name\":\"write16\",\"req\":\"^1.0.0\"},{\"default_features\":false,\"name\":\"zerovec\",\"req\":\"^0.11.3\"}],\"features\":{\"compiled_data\":[\"dep:icu_normalizer_data\",\"icu_properties?/compiled_data\",\"icu_provider/baked\"],\"datagen\":[\"serde\",\"dep:databake\",\"icu_properties\",\"icu_collections/databake\",\"zerovec/databake\",\"icu_properties?/datagen\",\"icu_provider/export\"],\"default\":[\"compiled_data\",\"utf8_iter\",\"utf16_iter\"],\"experimental\":[],\"icu_properties\":[\"dep:icu_properties\"],\"serde\":[\"dep:serde\",\"icu_collections/serde\",\"zerovec/serde\",\"icu_properties?/serde\",\"icu_provider/serde\"],\"utf16_iter\":[\"dep:utf16_iter\",\"dep:write16\"],\"utf8_iter\":[\"dep:utf8_iter\"],\"write16\":[]}}",
+      "icu_normalizer_2.2.0": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"arraystring\",\"req\":\"^0.3.0\"},{\"default_features\":false,\"kind\":\"dev\",\"name\":\"arrayvec\",\"req\":\"^0.7.2\"},{\"kind\":\"dev\",\"name\":\"atoi\",\"req\":\"^2.0.0\"},{\"kind\":\"dev\",\"name\":\"criterion\",\"req\":\"^0.5.0\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"databake\",\"optional\":true,\"req\":\"^0.2.0\"},{\"kind\":\"dev\",\"name\":\"detone\",\"req\":\"^1.0.0\"},{\"default_features\":false,\"name\":\"harfbuzz-traits\",\"optional\":true,\"req\":\"^0.6.0\"},{\"default_features\":false,\"name\":\"icu_collections\",\"req\":\"~2.2.0\"},{\"default_features\":false,\"name\":\"icu_normalizer_data\",\"optional\":true,\"req\":\"~2.2.0\"},{\"default_features\":false,\"name\":\"icu_properties\",\"optional\":true,\"req\":\"~2.2.0\"},{\"default_features\":false,\"name\":\"icu_provider\",\"req\":\"^2.2.0\"},{\"default_features\":false,\"features\":[\"derive\",\"alloc\"],\"name\":\"serde\",\"optional\":true,\"req\":\"^1.0.220\"},{\"default_features\":false,\"name\":\"smallvec\",\"req\":\"^1.10.0\"},{\"default_features\":false,\"name\":\"utf16_iter\",\"optional\":true,\"req\":\"^1.0.2\"},{\"default_features\":false,\"name\":\"utf8_iter\",\"optional\":true,\"req\":\"^1.0.2\"},{\"default_features\":false,\"features\":[\"alloc\"],\"name\":\"write16\",\"optional\":true,\"req\":\"^1.0.0\"},{\"default_features\":false,\"features\":[\"arrayvec\",\"smallvec\"],\"kind\":\"dev\",\"name\":\"write16\",\"req\":\"^1.0.0\"},{\"default_features\":false,\"name\":\"zerovec\",\"req\":\"^0.11.6\"}],\"features\":{\"compiled_data\":[\"dep:icu_normalizer_data\",\"icu_properties?/compiled_data\",\"icu_provider/baked\"],\"datagen\":[\"serde\",\"dep:databake\",\"icu_properties\",\"icu_collections/databake\",\"zerovec/databake\",\"icu_properties?/datagen\",\"icu_provider/export\"],\"default\":[\"compiled_data\",\"utf8_iter\",\"utf16_iter\"],\"harfbuzz_traits\":[\"dep:harfbuzz-traits\"],\"icu_properties\":[\"dep:icu_properties\"],\"serde\":[\"dep:serde\",\"icu_collections/serde\",\"zerovec/serde\",\"icu_properties?/serde\",\"icu_provider/serde\"],\"utf16_iter\":[\"dep:utf16_iter\",\"dep:write16\"],\"utf8_iter\":[\"dep:utf8_iter\"],\"write16\":[]}}",
       "icu_normalizer_data_2.1.1": "{\"dependencies\":[],\"features\":{}}",
+      "icu_normalizer_data_2.2.0": "{\"dependencies\":[],\"features\":{}}",
+      "icu_plurals_2.2.0": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"criterion\",\"req\":\"^0.5.0\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"databake\",\"optional\":true,\"req\":\"^0.2.0\"},{\"default_features\":false,\"name\":\"displaydoc\",\"optional\":true,\"req\":\"^0.2.3\"},{\"default_features\":false,\"name\":\"fixed_decimal\",\"req\":\"^0.7.2\"},{\"default_features\":false,\"name\":\"icu_locale\",\"optional\":true,\"req\":\"~2.2.0\"},{\"default_features\":false,\"name\":\"icu_plurals_data\",\"optional\":true,\"req\":\"~2.2.0\"},{\"default_features\":false,\"features\":[\"alloc\"],\"name\":\"icu_provider\",\"req\":\"^2.2.0\"},{\"default_features\":false,\"features\":[\"alloc\"],\"kind\":\"dev\",\"name\":\"postcard\",\"req\":\"^1.0.3\"},{\"default_features\":false,\"features\":[\"derive\",\"alloc\"],\"name\":\"serde\",\"optional\":true,\"req\":\"^1.0.220\"},{\"default_features\":false,\"features\":[\"derive\"],\"kind\":\"dev\",\"name\":\"serde\",\"req\":\"^1.0.220\"},{\"kind\":\"dev\",\"name\":\"serde_json\",\"req\":\"^1.0.45\"},{\"default_features\":false,\"features\":[\"alloc\",\"yoke\"],\"name\":\"zerovec\",\"req\":\"^0.11.6\"}],\"features\":{\"compiled_data\":[\"dep:icu_plurals_data\",\"dep:icu_locale\",\"icu_locale?/compiled_data\",\"icu_provider/baked\"],\"datagen\":[\"serde\",\"zerovec/databake\",\"dep:databake\",\"icu_provider/export\"],\"default\":[\"compiled_data\"],\"icu_normalizer_data\":[],\"serde\":[\"dep:serde\",\"zerovec/serde\",\"icu_provider/serde\",\"dep:displaydoc\"],\"unstable\":[]}}",
+      "icu_plurals_data_2.2.0": "{\"dependencies\":[],\"features\":{}}",
       "icu_properties_2.1.2": "{\"dependencies\":[{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"databake\",\"optional\":true,\"req\":\"^0.2.0\"},{\"default_features\":false,\"name\":\"icu_collections\",\"req\":\"~2.1.1\"},{\"default_features\":false,\"features\":[\"zerovec\"],\"name\":\"icu_locale_core\",\"req\":\"^2.1.1\"},{\"default_features\":false,\"name\":\"icu_properties_data\",\"optional\":true,\"req\":\"~2.1.2\"},{\"default_features\":false,\"name\":\"icu_provider\",\"req\":\"^2.1.1\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"serde\",\"optional\":true,\"req\":\"^1.0.220\"},{\"default_features\":false,\"name\":\"unicode-bidi\",\"optional\":true,\"req\":\"^0.3.11\"},{\"default_features\":false,\"features\":[\"yoke\",\"zerofrom\"],\"name\":\"zerotrie\",\"req\":\"^0.2.0\"},{\"default_features\":false,\"features\":[\"derive\",\"yoke\"],\"name\":\"zerovec\",\"req\":\"^0.11.3\"}],\"features\":{\"alloc\":[\"zerovec/alloc\",\"icu_collections/alloc\",\"serde?/alloc\"],\"compiled_data\":[\"dep:icu_properties_data\",\"icu_provider/baked\"],\"datagen\":[\"serde\",\"dep:databake\",\"zerovec/databake\",\"icu_collections/databake\",\"icu_locale_core/databake\",\"zerotrie/databake\",\"icu_provider/export\"],\"default\":[\"compiled_data\"],\"serde\":[\"dep:serde\",\"icu_locale_core/serde\",\"zerovec/serde\",\"icu_collections/serde\",\"icu_provider/serde\",\"zerotrie/serde\"],\"unicode_bidi\":[\"dep:unicode-bidi\"]}}",
+      "icu_properties_2.2.0": "{\"dependencies\":[{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"databake\",\"optional\":true,\"req\":\"^0.2.0\"},{\"default_features\":false,\"name\":\"harfbuzz-traits\",\"optional\":true,\"req\":\"^0.6.0\"},{\"default_features\":false,\"name\":\"icu_collections\",\"req\":\"~2.2.0\"},{\"default_features\":false,\"features\":[\"zerovec\"],\"name\":\"icu_locale_core\",\"req\":\"^2.2.0\"},{\"default_features\":false,\"name\":\"icu_properties_data\",\"optional\":true,\"req\":\"~2.2.0\"},{\"default_features\":false,\"name\":\"icu_provider\",\"req\":\"^2.2.0\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"serde\",\"optional\":true,\"req\":\"^1.0.220\"},{\"default_features\":false,\"name\":\"unicode-bidi\",\"optional\":true,\"req\":\"^0.3.11\"},{\"default_features\":false,\"features\":[\"yoke\",\"zerofrom\"],\"name\":\"zerotrie\",\"req\":\"^0.2.4\"},{\"default_features\":false,\"features\":[\"derive\",\"yoke\"],\"name\":\"zerovec\",\"req\":\"^0.11.6\"}],\"features\":{\"alloc\":[\"zerovec/alloc\",\"icu_collections/alloc\",\"serde?/alloc\"],\"compiled_data\":[\"dep:icu_properties_data\",\"icu_provider/baked\"],\"datagen\":[\"serde\",\"dep:databake\",\"zerovec/databake\",\"icu_collections/databake\",\"icu_locale_core/databake\",\"zerotrie/databake\",\"icu_provider/export\"],\"default\":[\"compiled_data\"],\"harfbuzz_traits\":[\"dep:harfbuzz-traits\"],\"serde\":[\"dep:serde\",\"icu_locale_core/serde\",\"zerovec/serde\",\"icu_collections/serde\",\"icu_provider/serde\",\"zerotrie/serde\"],\"unicode_bidi\":[\"dep:unicode-bidi\"]}}",
       "icu_properties_data_2.1.2": "{\"dependencies\":[],\"features\":{}}",
+      "icu_properties_data_2.2.0": "{\"dependencies\":[],\"features\":{}}",
       "icu_provider_2.1.1": "{\"dependencies\":[{\"name\":\"bincode\",\"optional\":true,\"req\":\"^1.3.1\"},{\"kind\":\"dev\",\"name\":\"criterion\",\"req\":\"^0.5.0\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"databake\",\"optional\":true,\"req\":\"^0.2.0\"},{\"default_features\":false,\"name\":\"displaydoc\",\"req\":\"^0.2.3\"},{\"name\":\"erased-serde\",\"optional\":true,\"req\":\"^0.4.0\"},{\"default_features\":false,\"name\":\"icu_locale_core\",\"req\":\"^2.1.1\"},{\"default_features\":false,\"name\":\"log\",\"optional\":true,\"req\":\"^0.4.17\"},{\"default_features\":false,\"name\":\"postcard\",\"optional\":true,\"req\":\"^1.0.3\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"serde\",\"optional\":true,\"req\":\"^1.0.220\"},{\"name\":\"serde_json\",\"optional\":true,\"req\":\"^1.0.45\"},{\"kind\":\"dev\",\"name\":\"serde_json\",\"req\":\"^1.0.45\"},{\"default_features\":false,\"name\":\"stable_deref_trait\",\"optional\":true,\"req\":\"^1.2.0\"},{\"default_features\":false,\"name\":\"writeable\",\"optional\":true,\"req\":\"^0.6.0\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"yoke\",\"req\":\"^0.8.0\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"zerofrom\",\"req\":\"^0.1.3\"},{\"default_features\":false,\"name\":\"zerotrie\",\"optional\":true,\"req\":\"^0.2.0\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"zerovec\",\"req\":\"^0.11.3\"}],\"features\":{\"alloc\":[\"icu_locale_core/alloc\",\"serde?/alloc\",\"yoke/alloc\",\"zerofrom/alloc\",\"zerovec/alloc\",\"zerotrie?/alloc\",\"dep:stable_deref_trait\",\"dep:writeable\"],\"baked\":[\"dep:zerotrie\",\"dep:writeable\"],\"deserialize_bincode_1\":[\"serde\",\"dep:bincode\",\"std\"],\"deserialize_json\":[\"serde\",\"dep:serde_json\"],\"deserialize_postcard_1\":[\"serde\",\"dep:postcard\"],\"export\":[\"serde\",\"dep:erased-serde\",\"dep:databake\",\"std\",\"sync\",\"dep:postcard\",\"zerovec/databake\"],\"logging\":[\"dep:log\"],\"serde\":[\"dep:serde\",\"yoke/serde\"],\"std\":[\"alloc\"],\"sync\":[],\"zerotrie\":[]}}",
+      "icu_provider_2.2.0": "{\"dependencies\":[{\"name\":\"bincode\",\"optional\":true,\"req\":\"^1.3.1\"},{\"kind\":\"dev\",\"name\":\"criterion\",\"req\":\"^0.5.0\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"databake\",\"optional\":true,\"req\":\"^0.2.0\"},{\"default_features\":false,\"name\":\"displaydoc\",\"req\":\"^0.2.3\"},{\"name\":\"erased-serde\",\"optional\":true,\"req\":\"^0.4.0\"},{\"default_features\":false,\"name\":\"icu_locale_core\",\"req\":\"^2.2.0\"},{\"default_features\":false,\"name\":\"log\",\"optional\":true,\"req\":\"^0.4.17\"},{\"default_features\":false,\"name\":\"postcard\",\"optional\":true,\"req\":\"^1.0.3\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"serde\",\"optional\":true,\"req\":\"^1.0.220\"},{\"name\":\"serde_json\",\"optional\":true,\"req\":\"^1.0.45\"},{\"kind\":\"dev\",\"name\":\"serde_json\",\"req\":\"^1.0.45\"},{\"default_features\":false,\"name\":\"stable_deref_trait\",\"optional\":true,\"req\":\"^1.2.0\"},{\"default_features\":false,\"name\":\"writeable\",\"optional\":true,\"req\":\"^0.6.1\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"yoke\",\"req\":\"^0.8.2\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"zerofrom\",\"req\":\"^0.1.6\"},{\"default_features\":false,\"name\":\"zerotrie\",\"optional\":true,\"req\":\"^0.2.4\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"zerovec\",\"req\":\"^0.11.6\"}],\"features\":{\"alloc\":[\"icu_locale_core/alloc\",\"serde?/alloc\",\"yoke/alloc\",\"zerofrom/alloc\",\"zerovec/alloc\",\"zerotrie?/alloc\",\"dep:stable_deref_trait\",\"dep:writeable\"],\"baked\":[\"dep:zerotrie\",\"dep:writeable\"],\"deserialize_bincode_1\":[\"serde\",\"dep:bincode\",\"std\"],\"deserialize_json\":[\"serde\",\"dep:serde_json\"],\"deserialize_postcard_1\":[\"serde\",\"dep:postcard\"],\"export\":[\"serde\",\"dep:erased-serde\",\"dep:databake\",\"std\",\"sync\",\"dep:postcard\",\"zerovec/databake\"],\"logging\":[\"dep:log\"],\"serde\":[\"dep:serde\",\"yoke/serde\"],\"std\":[\"alloc\"],\"sync\":[],\"zerotrie\":[]}}",
       "id-arena_2.3.0": "{\"dependencies\":[{\"name\":\"rayon\",\"optional\":true,\"req\":\"^1.0.3\"}],\"features\":{\"default\":[\"std\"],\"std\":[]}}",
       "ident_case_1.0.1": "{\"dependencies\":[],\"features\":{}}",
       "idna_1.1.0": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"assert_matches\",\"req\":\"^1.3\"},{\"kind\":\"dev\",\"name\":\"bencher\",\"req\":\"^0.1\"},{\"name\":\"idna_adapter\",\"req\":\"^1\"},{\"kind\":\"dev\",\"name\":\"serde_json\",\"req\":\"^1.0\"},{\"features\":[\"const_generics\"],\"name\":\"smallvec\",\"req\":\"^1.13.1\"},{\"kind\":\"dev\",\"name\":\"tester\",\"req\":\"^0.9\"},{\"name\":\"utf8_iter\",\"req\":\"^1.0.4\"}],\"features\":{\"alloc\":[],\"compiled_data\":[\"idna_adapter/compiled_data\"],\"default\":[\"std\",\"compiled_data\"],\"std\":[\"alloc\"]}}",
@@ -1413,7 +1422,7 @@
       "regex-syntax_0.8.8": "{\"dependencies\":[{\"features\":[\"derive\"],\"name\":\"arbitrary\",\"optional\":true,\"req\":\"^1.3.0\"}],\"features\":{\"arbitrary\":[\"dep:arbitrary\"],\"default\":[\"std\",\"unicode\"],\"std\":[],\"unicode\":[\"unicode-age\",\"unicode-bool\",\"unicode-case\",\"unicode-gencat\",\"unicode-perl\",\"unicode-script\",\"unicode-segment\"],\"unicode-age\":[],\"unicode-bool\":[],\"unicode-case\":[],\"unicode-gencat\":[],\"unicode-perl\":[],\"unicode-script\":[],\"unicode-segment\":[]}}",
       "regex_1.12.3": "{\"dependencies\":[{\"default_features\":false,\"name\":\"aho-corasick\",\"optional\":true,\"req\":\"^1.0.0\"},{\"kind\":\"dev\",\"name\":\"anyhow\",\"req\":\"^1.0.69\"},{\"kind\":\"dev\",\"name\":\"doc-comment\",\"req\":\"^0.3\"},{\"default_features\":false,\"features\":[\"atty\",\"humantime\",\"termcolor\"],\"kind\":\"dev\",\"name\":\"env_logger\",\"req\":\"^0.9.3\"},{\"default_features\":false,\"name\":\"memchr\",\"optional\":true,\"req\":\"^2.6.0\"},{\"default_features\":false,\"kind\":\"dev\",\"name\":\"quickcheck\",\"req\":\"^1.0.3\"},{\"default_features\":false,\"features\":[\"alloc\",\"syntax\",\"meta\",\"nfa-pikevm\"],\"name\":\"regex-automata\",\"req\":\"^0.4.12\"},{\"default_features\":false,\"name\":\"regex-syntax\",\"req\":\"^0.8.5\"},{\"kind\":\"dev\",\"name\":\"regex-test\",\"req\":\"^0.1.0\"}],\"features\":{\"default\":[\"std\",\"perf\",\"unicode\",\"regex-syntax/default\"],\"logging\":[\"aho-corasick?/logging\",\"memchr?/logging\",\"regex-automata/logging\"],\"pattern\":[],\"perf\":[\"perf-cache\",\"perf-dfa\",\"perf-onepass\",\"perf-backtrack\",\"perf-inline\",\"perf-literal\"],\"perf-backtrack\":[\"regex-automata/nfa-backtrack\"],\"perf-cache\":[],\"perf-dfa\":[\"regex-automata/hybrid\"],\"perf-dfa-full\":[\"regex-automata/dfa-build\",\"regex-automata/dfa-search\"],\"perf-inline\":[\"regex-automata/perf-inline\"],\"perf-literal\":[\"dep:aho-corasick\",\"dep:memchr\",\"regex-automata/perf-literal\"],\"perf-onepass\":[\"regex-automata/dfa-onepass\"],\"std\":[\"aho-corasick?/std\",\"memchr?/std\",\"regex-automata/std\",\"regex-syntax/std\"],\"unicode\":[\"unicode-age\",\"unicode-bool\",\"unicode-case\",\"unicode-gencat\",\"unicode-perl\",\"unicode-script\",\"unicode-segment\",\"regex-automata/unicode\",\"regex-syntax/unicode\"],\"unicode-age\":[\"regex-automata/unicode-age\",\"regex-syntax/unicode-age\"],\"unicode-bool\":[\"regex-automata/unicode-bool\",\"regex-syntax/unicode-bool\"],\"unicode-case\":[\"regex-automata/unicode-case\",\"regex-syntax/unicode-case\"],\"unicode-gencat\":[\"regex-automata/unicode-gencat\",\"regex-syntax/unicode-gencat\"],\"unicode-perl\":[\"regex-automata/unicode-perl\",\"regex-automata/unicode-word-boundary\",\"regex-syntax/unicode-perl\"],\"unicode-script\":[\"regex-automata/unicode-script\",\"regex-syntax/unicode-script\"],\"unicode-segment\":[\"regex-automata/unicode-segment\",\"regex-syntax/unicode-segment\"],\"unstable\":[\"pattern\"],\"use_std\":[\"std\"]}}",
       "reqwest_0.12.28": "{\"dependencies\":[{\"name\":\"base64\",\"req\":\"^0.22\"},{\"kind\":\"dev\",\"name\":\"brotli_crate\",\"package\":\"brotli\",\"req\":\"^8\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"name\":\"bytes\",\"req\":\"^1.2\"},{\"name\":\"cookie_crate\",\"optional\":true,\"package\":\"cookie\",\"req\":\"^0.18.0\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"name\":\"cookie_store\",\"optional\":true,\"req\":\"^0.22.0\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"kind\":\"dev\",\"name\":\"doc-comment\",\"req\":\"^0.3\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"name\":\"encoding_rs\",\"optional\":true,\"req\":\"^0.8\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"kind\":\"dev\",\"name\":\"env_logger\",\"req\":\"^0.10\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"kind\":\"dev\",\"name\":\"flate2\",\"req\":\"^1.0.13\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"name\":\"futures-channel\",\"optional\":true,\"req\":\"^0.3\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"default_features\":false,\"name\":\"futures-core\",\"req\":\"^0.3.28\"},{\"default_features\":false,\"name\":\"futures-util\",\"optional\":true,\"req\":\"^0.3.28\"},{\"default_features\":false,\"features\":[\"std\",\"alloc\"],\"kind\":\"dev\",\"name\":\"futures-util\",\"req\":\"^0.3.28\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"name\":\"h2\",\"optional\":true,\"req\":\"^0.4\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"name\":\"h3\",\"optional\":true,\"req\":\"^0.0.8\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"name\":\"h3-quinn\",\"optional\":true,\"req\":\"^0.0.10\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"features\":[\"tokio\"],\"name\":\"hickory-resolver\",\"optional\":true,\"req\":\"^0.25\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"name\":\"http\",\"req\":\"^1.1\"},{\"name\":\"http-body\",\"req\":\"^1\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"name\":\"http-body-util\",\"req\":\"^0.1.2\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"features\":[\"http1\",\"client\"],\"name\":\"hyper\",\"req\":\"^1.1\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"default_features\":false,\"features\":[\"http1\",\"http2\",\"client\",\"server\"],\"kind\":\"dev\",\"name\":\"hyper\",\"req\":\"^1.1.0\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"default_features\":false,\"features\":[\"http1\",\"tls12\"],\"name\":\"hyper-rustls\",\"optional\":true,\"req\":\"^0.27.0\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"name\":\"hyper-tls\",\"optional\":true,\"req\":\"^0.6\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"features\":[\"http1\",\"client\",\"client-legacy\",\"client-proxy\",\"tokio\"],\"name\":\"hyper-util\",\"req\":\"^0.1.12\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"features\":[\"http1\",\"http2\",\"client\",\"client-legacy\",\"server-auto\",\"server-graceful\",\"tokio\"],\"kind\":\"dev\",\"name\":\"hyper-util\",\"req\":\"^0.1.12\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"name\":\"js-sys\",\"req\":\"^0.3.77\",\"target\":\"cfg(target_arch = \\\"wasm32\\\")\"},{\"kind\":\"dev\",\"name\":\"libc\",\"req\":\"^0\"},{\"name\":\"log\",\"req\":\"^0.4.17\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"name\":\"mime\",\"optional\":true,\"req\":\"^0.3.16\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"default_features\":false,\"name\":\"mime_guess\",\"optional\":true,\"req\":\"^2.0\"},{\"name\":\"native-tls-crate\",\"optional\":true,\"package\":\"native-tls\",\"req\":\"^0.2.10\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"kind\":\"dev\",\"name\":\"num_cpus\",\"req\":\"^1.0\"},{\"name\":\"once_cell\",\"optional\":true,\"req\":\"^1.18\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"name\":\"percent-encoding\",\"req\":\"^2.3\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"name\":\"pin-project-lite\",\"req\":\"^0.2.11\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"default_features\":false,\"features\":[\"rustls\",\"runtime-tokio\"],\"name\":\"quinn\",\"optional\":true,\"req\":\"^0.11.1\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"default_features\":false,\"features\":[\"std\",\"tls12\"],\"name\":\"rustls\",\"optional\":true,\"req\":\"^0.23.4\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"name\":\"rustls-native-certs\",\"optional\":true,\"req\":\"^0.8.0\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"features\":[\"std\"],\"name\":\"rustls-pki-types\",\"optional\":true,\"req\":\"^1.9.0\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"name\":\"serde\",\"req\":\"^1.0\"},{\"features\":[\"derive\"],\"kind\":\"dev\",\"name\":\"serde\",\"req\":\"^1.0\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"name\":\"serde_json\",\"req\":\"^1.0\",\"target\":\"cfg(target_arch = \\\"wasm32\\\")\"},{\"name\":\"serde_json\",\"optional\":true,\"req\":\"^1.0\"},{\"name\":\"serde_urlencoded\",\"req\":\"^0.7.1\"},{\"features\":[\"futures\"],\"name\":\"sync_wrapper\",\"req\":\"^1.0\"},{\"default_features\":false,\"features\":[\"net\",\"time\"],\"name\":\"tokio\",\"req\":\"^1.0\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"default_features\":false,\"features\":[\"macros\",\"rt-multi-thread\"],\"kind\":\"dev\",\"name\":\"tokio\",\"req\":\"^1.0\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"name\":\"tokio-native-tls\",\"optional\":true,\"req\":\"^0.3.0\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"default_features\":false,\"features\":[\"tls12\"],\"name\":\"tokio-rustls\",\"optional\":true,\"req\":\"^0.26\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"default_features\":false,\"features\":[\"io\"],\"name\":\"tokio-util\",\"optional\":true,\"req\":\"^0.7.9\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"default_features\":false,\"features\":[\"retry\",\"timeout\",\"util\"],\"name\":\"tower\",\"req\":\"^0.5.2\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"default_features\":false,\"features\":[\"limit\"],\"kind\":\"dev\",\"name\":\"tower\",\"req\":\"^0.5.2\"},{\"default_features\":false,\"features\":[\"follow-redirect\"],\"name\":\"tower-http\",\"req\":\"^0.6.8\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"name\":\"tower-service\",\"req\":\"^0.3\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"name\":\"url\",\"req\":\"^2.4\"},{\"name\":\"wasm-bindgen\",\"req\":\"^0.2.89\",\"target\":\"cfg(target_arch = \\\"wasm32\\\")\"},{\"features\":[\"serde-serialize\"],\"kind\":\"dev\",\"name\":\"wasm-bindgen\",\"req\":\"^0.2.89\",\"target\":\"cfg(target_arch = \\\"wasm32\\\")\"},{\"name\":\"wasm-bindgen-futures\",\"req\":\"^0.4.18\",\"target\":\"cfg(target_arch = \\\"wasm32\\\")\"},{\"kind\":\"dev\",\"name\":\"wasm-bindgen-test\",\"req\":\"^0.3\",\"target\":\"cfg(target_arch = \\\"wasm32\\\")\"},{\"name\":\"wasm-streams\",\"optional\":true,\"req\":\"^0.4\",\"target\":\"cfg(target_arch = \\\"wasm32\\\")\"},{\"features\":[\"AbortController\",\"AbortSignal\",\"Headers\",\"Request\",\"RequestInit\",\"RequestMode\",\"Response\",\"Window\",\"FormData\",\"Blob\",\"BlobPropertyBag\",\"ServiceWorkerGlobalScope\",\"RequestCredentials\",\"File\",\"ReadableStream\",\"RequestCache\"],\"name\":\"web-sys\",\"req\":\"^0.3.28\",\"target\":\"cfg(target_arch = \\\"wasm32\\\")\"},{\"name\":\"webpki-roots\",\"optional\":true,\"req\":\"^1\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"kind\":\"dev\",\"name\":\"zstd_crate\",\"package\":\"zstd\",\"req\":\"^0.13\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"}],\"features\":{\"__rustls\":[\"dep:hyper-rustls\",\"dep:tokio-rustls\",\"dep:rustls\",\"__tls\"],\"__rustls-ring\":[\"hyper-rustls?/ring\",\"tokio-rustls?/ring\",\"rustls?/ring\",\"quinn?/ring\"],\"__tls\":[\"dep:rustls-pki-types\",\"tokio/io-util\"],\"blocking\":[\"dep:futures-channel\",\"futures-channel?/sink\",\"dep:futures-util\",\"futures-util?/io\",\"futures-util?/sink\",\"tokio/sync\"],\"brotli\":[\"tower-http/decompression-br\"],\"charset\":[\"dep:encoding_rs\",\"dep:mime\"],\"cookies\":[\"dep:cookie_crate\",\"dep:cookie_store\"],\"default\":[\"default-tls\",\"charset\",\"http2\",\"system-proxy\"],\"default-tls\":[\"dep:hyper-tls\",\"dep:native-tls-crate\",\"__tls\",\"dep:tokio-native-tls\"],\"deflate\":[\"tower-http/decompression-deflate\"],\"gzip\":[\"tower-http/decompression-gzip\"],\"hickory-dns\":[\"dep:hickory-resolver\",\"dep:once_cell\"],\"http2\":[\"h2\",\"hyper/http2\",\"hyper-util/http2\",\"hyper-rustls?/http2\"],\"http3\":[\"rustls-tls-manual-roots\",\"dep:h3\",\"dep:h3-quinn\",\"dep:quinn\",\"tokio/macros\"],\"json\":[\"dep:serde_json\"],\"macos-system-configuration\":[\"system-proxy\"],\"multipart\":[\"dep:mime_guess\",\"dep:futures-util\"],\"native-tls\":[\"default-tls\"],\"native-tls-alpn\":[\"native-tls\",\"native-tls-crate?/alpn\",\"hyper-tls?/alpn\"],\"native-tls-vendored\":[\"native-tls\",\"native-tls-crate?/vendored\"],\"rustls-tls\":[\"rustls-tls-webpki-roots\"],\"rustls-tls-manual-roots\":[\"rustls-tls-manual-roots-no-provider\",\"__rustls-ring\"],\"rustls-tls-manual-roots-no-provider\":[\"__rustls\"],\"rustls-tls-native-roots\":[\"rustls-tls-native-roots-no-provider\",\"__rustls-ring\"],\"rustls-tls-native-roots-no-provider\":[\"dep:rustls-native-certs\",\"hyper-rustls?/native-tokio\",\"__rustls\"],\"rustls-tls-no-provider\":[\"rustls-tls-manual-roots-no-provider\"],\"rustls-tls-webpki-roots\":[\"rustls-tls-webpki-roots-no-provider\",\"__rustls-ring\"],\"rustls-tls-webpki-roots-no-provider\":[\"dep:webpki-roots\",\"hyper-rustls?/webpki-tokio\",\"__rustls\"],\"socks\":[],\"stream\":[\"tokio/fs\",\"dep:futures-util\",\"dep:tokio-util\",\"dep:wasm-streams\"],\"system-proxy\":[\"hyper-util/client-proxy-system\"],\"trust-dns\":[],\"zstd\":[\"tower-http/decompression-zstd\"]}}",
-      "resb_0.1.1": "{\"dependencies\":[{\"name\":\"indexmap\",\"optional\":true,\"req\":\"^2.0.0\"},{\"default_features\":false,\"name\":\"log\",\"optional\":true,\"req\":\"^0.4.17\"},{\"name\":\"nom\",\"optional\":true,\"req\":\"^7.0.0\"},{\"default_features\":false,\"name\":\"potential_utf\",\"req\":\"^0.1.3\"},{\"default_features\":false,\"features\":[\"alloc\"],\"name\":\"serde_core\",\"req\":\"^1.0.220\"}],\"features\":{\"default\":[],\"logging\":[\"dep:log\"],\"serialize\":[\"std\"],\"std\":[],\"text\":[\"dep:indexmap\",\"dep:nom\",\"std\"]}}",
+      "resb_0.1.2": "{\"dependencies\":[{\"name\":\"indexmap\",\"optional\":true,\"req\":\"^2.0.0\"},{\"default_features\":false,\"name\":\"log\",\"optional\":true,\"req\":\"^0.4.17\"},{\"name\":\"nom\",\"optional\":true,\"req\":\"^7.0.0\"},{\"default_features\":false,\"name\":\"potential_utf\",\"req\":\"^0.1.3\"},{\"default_features\":false,\"features\":[\"alloc\"],\"name\":\"serde_core\",\"req\":\"^1.0.220\"}],\"features\":{\"default\":[],\"logging\":[\"dep:log\"],\"serialize\":[\"std\"],\"std\":[],\"text\":[\"dep:indexmap\",\"dep:nom\",\"std\"]}}",
       "resolv-conf_0.7.6": "{\"dependencies\":[],\"features\":{\"system\":[]}}",
       "rfc6979_0.4.0": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"hex-literal\",\"req\":\"^0.3\"},{\"default_features\":false,\"features\":[\"reset\"],\"name\":\"hmac\",\"req\":\"^0.12\"},{\"kind\":\"dev\",\"name\":\"sha2\",\"req\":\"^0.10\"},{\"default_features\":false,\"name\":\"subtle\",\"req\":\"^2\"}],\"features\":{}}",
       "ring_0.17.14": "{\"dependencies\":[{\"default_features\":false,\"kind\":\"build\",\"name\":\"cc\",\"req\":\"^1.2.8\"},{\"default_features\":false,\"name\":\"cfg-if\",\"req\":\"^1.0.0\"},{\"name\":\"getrandom\",\"req\":\"^0.2.10\"},{\"default_features\":false,\"name\":\"libc\",\"req\":\"^0.2.148\",\"target\":\"cfg(all(any(all(target_arch = \\\"aarch64\\\", target_endian = \\\"little\\\"), all(target_arch = \\\"arm\\\", target_endian = \\\"little\\\")), any(target_os = \\\"android\\\", target_os = \\\"linux\\\")))\"},{\"default_features\":false,\"name\":\"libc\",\"req\":\"^0.2.155\",\"target\":\"cfg(all(all(target_arch = \\\"aarch64\\\", target_endian = \\\"little\\\"), target_vendor = \\\"apple\\\", any(target_os = \\\"ios\\\", target_os = \\\"macos\\\", target_os = \\\"tvos\\\", target_os = \\\"visionos\\\", target_os = \\\"watchos\\\")))\"},{\"default_features\":false,\"kind\":\"dev\",\"name\":\"libc\",\"req\":\"^0.2.148\",\"target\":\"cfg(any(unix, windows, target_os = \\\"wasi\\\"))\"},{\"name\":\"untrusted\",\"req\":\"^0.9\"},{\"default_features\":false,\"features\":[\"std\"],\"kind\":\"dev\",\"name\":\"wasm-bindgen-test\",\"req\":\"^0.3.37\",\"target\":\"cfg(all(target_arch = \\\"wasm32\\\", target_os = \\\"unknown\\\"))\"},{\"features\":[\"Win32_Foundation\",\"Win32_System_Threading\"],\"name\":\"windows-sys\",\"req\":\"^0.52\",\"target\":\"cfg(all(all(target_arch = \\\"aarch64\\\", target_endian = \\\"little\\\"), target_os = \\\"windows\\\"))\"}],\"features\":{\"alloc\":[],\"default\":[\"alloc\",\"dev_urandom_fallback\"],\"dev_urandom_fallback\":[],\"less-safe-getrandom-custom-or-rdrand\":[],\"less-safe-getrandom-espidf\":[],\"slow_tests\":[],\"std\":[\"alloc\"],\"test_logging\":[],\"unstable-testing-arm-no-hw\":[],\"unstable-testing-arm-no-neon\":[],\"wasm32_unknown_unknown_js\":[\"getrandom/js\"]}}",
@@ -1482,6 +1491,7 @@
       "serde_derive_1.0.228": "{\"dependencies\":[{\"default_features\":false,\"features\":[\"proc-macro\"],\"name\":\"proc-macro2\",\"req\":\"^1.0.74\"},{\"default_features\":false,\"features\":[\"proc-macro\"],\"name\":\"quote\",\"req\":\"^1.0.35\"},{\"kind\":\"dev\",\"name\":\"serde\",\"req\":\"^1\"},{\"default_features\":false,\"features\":[\"clone-impls\",\"derive\",\"parsing\",\"printing\",\"proc-macro\"],\"name\":\"syn\",\"req\":\"^2.0.81\"}],\"features\":{\"default\":[],\"deserialize_in_place\":[]}}",
       "serde_derive_internals_0.29.1": "{\"dependencies\":[{\"default_features\":false,\"name\":\"proc-macro2\",\"req\":\"^1.0.74\"},{\"default_features\":false,\"name\":\"quote\",\"req\":\"^1.0.35\"},{\"default_features\":false,\"features\":[\"clone-impls\",\"derive\",\"parsing\",\"printing\"],\"name\":\"syn\",\"req\":\"^2.0.46\"}],\"features\":{}}",
       "serde_html_form_0.3.2": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"assert_matches2\",\"req\":\"^0.1.0\"},{\"kind\":\"dev\",\"name\":\"divan\",\"req\":\"^0.1.11\"},{\"default_features\":false,\"features\":[\"alloc\"],\"name\":\"form_urlencoded\",\"req\":\"^1.0.1\"},{\"default_features\":false,\"name\":\"indexmap\",\"req\":\"^2.0.0\"},{\"kind\":\"dev\",\"name\":\"insta\",\"req\":\"^1.45.0\"},{\"name\":\"itoa\",\"req\":\"^1.0.1\"},{\"name\":\"ryu\",\"optional\":true,\"req\":\"^1.0.9\"},{\"features\":[\"derive\"],\"kind\":\"dev\",\"name\":\"serde\",\"req\":\"^1.0.221\"},{\"default_features\":false,\"features\":[\"alloc\"],\"name\":\"serde_core\",\"req\":\"^1.0.221\"},{\"kind\":\"dev\",\"name\":\"serde_urlencoded\",\"req\":\"^0.7.1\"}],\"features\":{\"default\":[\"ryu\",\"std\"],\"std\":[]}}",
+      "serde_ignored_0.1.14": "{\"dependencies\":[{\"default_features\":false,\"name\":\"serde\",\"req\":\"^1.0.220\",\"target\":\"cfg(any())\"},{\"kind\":\"dev\",\"name\":\"serde\",\"req\":\"^1.0.220\"},{\"default_features\":false,\"features\":[\"alloc\"],\"name\":\"serde_core\",\"req\":\"^1.0.220\"},{\"kind\":\"dev\",\"name\":\"serde_derive\",\"req\":\"^1.0.220\"},{\"kind\":\"dev\",\"name\":\"serde_json\",\"req\":\"^1.0.110\"}],\"features\":{}}",
       "serde_json_1.0.149": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"automod\",\"req\":\"^1.0.11\"},{\"name\":\"indexmap\",\"optional\":true,\"req\":\"^2.2.3\"},{\"kind\":\"dev\",\"name\":\"indoc\",\"req\":\"^2.0.2\"},{\"name\":\"itoa\",\"req\":\"^1.0\"},{\"default_features\":false,\"name\":\"memchr\",\"req\":\"^2\"},{\"kind\":\"dev\",\"name\":\"ref-cast\",\"req\":\"^1.0.18\"},{\"kind\":\"dev\",\"name\":\"rustversion\",\"req\":\"^1.0.13\"},{\"default_features\":false,\"name\":\"serde\",\"req\":\"^1.0.220\",\"target\":\"cfg(any())\"},{\"features\":[\"derive\"],\"kind\":\"dev\",\"name\":\"serde\",\"req\":\"^1.0.194\"},{\"kind\":\"dev\",\"name\":\"serde_bytes\",\"req\":\"^0.11.10\"},{\"default_features\":false,\"name\":\"serde_core\",\"req\":\"^1.0.220\"},{\"kind\":\"dev\",\"name\":\"serde_derive\",\"req\":\"^1.0.166\"},{\"kind\":\"dev\",\"name\":\"serde_stacker\",\"req\":\"^0.1.8\"},{\"features\":[\"diff\"],\"kind\":\"dev\",\"name\":\"trybuild\",\"req\":\"^1.0.108\"},{\"name\":\"zmij\",\"req\":\"^1.0\"}],\"features\":{\"alloc\":[\"serde_core/alloc\"],\"arbitrary_precision\":[],\"default\":[\"std\"],\"float_roundtrip\":[],\"preserve_order\":[\"indexmap\",\"std\"],\"raw_value\":[],\"std\":[\"memchr/std\",\"serde_core/std\"],\"unbounded_depth\":[]}}",
       "serde_path_to_error_0.1.20": "{\"dependencies\":[{\"name\":\"itoa\",\"req\":\"^1.0\"},{\"default_features\":false,\"name\":\"serde\",\"req\":\"^1.0.220\",\"target\":\"cfg(any())\"},{\"kind\":\"dev\",\"name\":\"serde\",\"req\":\"^1.0.220\"},{\"default_features\":false,\"features\":[\"alloc\"],\"name\":\"serde_core\",\"req\":\"^1.0.220\"},{\"kind\":\"dev\",\"name\":\"serde_derive\",\"req\":\"^1.0.220\"},{\"kind\":\"dev\",\"name\":\"serde_json\",\"req\":\"^1.0.100\"}],\"features\":{}}",
       "serde_repr_0.1.20": "{\"dependencies\":[{\"name\":\"proc-macro2\",\"req\":\"^1.0.74\"},{\"name\":\"quote\",\"req\":\"^1.0.35\"},{\"kind\":\"dev\",\"name\":\"rustversion\",\"req\":\"^1.0.13\"},{\"kind\":\"dev\",\"name\":\"serde\",\"req\":\"^1.0.166\"},{\"kind\":\"dev\",\"name\":\"serde_json\",\"req\":\"^1.0.100\"},{\"name\":\"syn\",\"req\":\"^2.0.46\"},{\"features\":[\"diff\"],\"kind\":\"dev\",\"name\":\"trybuild\",\"req\":\"^1.0.81\"}],\"features\":{}}",
@@ -1563,8 +1573,8 @@
       "tar_0.4.45": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"astral-tokio-tar\",\"req\":\"^0.5\"},{\"name\":\"filetime\",\"req\":\"^0.2.8\"},{\"name\":\"libc\",\"req\":\"^0.2\",\"target\":\"cfg(unix)\"},{\"features\":[\"small_rng\"],\"kind\":\"dev\",\"name\":\"rand\",\"req\":\"^0.8\"},{\"kind\":\"dev\",\"name\":\"tempfile\",\"req\":\"^3\"},{\"features\":[\"macros\",\"rt\"],\"kind\":\"dev\",\"name\":\"tokio\",\"req\":\"^1\"},{\"kind\":\"dev\",\"name\":\"tokio-stream\",\"req\":\"^0.1\"},{\"name\":\"xattr\",\"optional\":true,\"req\":\"^1.1.3\",\"target\":\"cfg(unix)\"}],\"features\":{\"default\":[\"xattr\"]}}",
       "target-lexicon_0.13.3": "{\"dependencies\":[{\"name\":\"serde\",\"optional\":true,\"req\":\"^1.0\"},{\"kind\":\"dev\",\"name\":\"serde_json\",\"req\":\"^1.0\"}],\"features\":{\"arch_z80\":[],\"arch_zkasm\":[],\"default\":[],\"serde_support\":[\"serde\",\"std\"],\"std\":[]}}",
       "tempfile_3.27.0": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"doc-comment\",\"req\":\"^0.3\"},{\"name\":\"fastrand\",\"req\":\"^2.1.1\"},{\"default_features\":false,\"name\":\"getrandom\",\"optional\":true,\"req\":\">=0.3.0, <0.5\",\"target\":\"cfg(any(unix, windows, target_os = \\\"wasi\\\"))\"},{\"default_features\":false,\"features\":[\"std\"],\"name\":\"once_cell\",\"req\":\"^1.19.0\"},{\"features\":[\"fs\"],\"name\":\"rustix\",\"req\":\"^1.1.4\",\"target\":\"cfg(any(unix, target_os = \\\"wasi\\\"))\"},{\"features\":[\"Win32_Storage_FileSystem\",\"Win32_Foundation\"],\"name\":\"windows-sys\",\"req\":\">=0.52, <0.62\",\"target\":\"cfg(windows)\"}],\"features\":{\"default\":[\"getrandom\"],\"nightly\":[]}}",
-      "temporal_capi_0.1.2": "{\"dependencies\":[{\"default_features\":false,\"name\":\"diplomat\",\"req\":\"^0.14.0\"},{\"default_features\":false,\"name\":\"diplomat-runtime\",\"req\":\"^0.14.0\"},{\"default_features\":false,\"features\":[\"unstable\"],\"name\":\"icu_calendar\",\"req\":\"^2.1.0\"},{\"name\":\"icu_locale\",\"req\":\"^2.1.0\"},{\"default_features\":false,\"name\":\"num-traits\",\"req\":\"^0.2.19\"},{\"default_features\":false,\"name\":\"temporal_rs\",\"req\":\"^0.1.2\"},{\"name\":\"timezone_provider\",\"req\":\"^0.1.2\"},{\"name\":\"writeable\",\"req\":\"^0.6.0\"},{\"name\":\"zoneinfo64\",\"optional\":true,\"req\":\"^0.2.0\"}],\"features\":{\"compiled_data\":[\"temporal_rs/compiled_data\"],\"zoneinfo64\":[\"dep:zoneinfo64\",\"timezone_provider/zoneinfo64\"]}}",
-      "temporal_rs_0.1.2": "{\"dependencies\":[{\"name\":\"core_maths\",\"req\":\"^0.1.1\"},{\"name\":\"iana-time-zone\",\"optional\":true,\"req\":\"^0.1.64\"},{\"default_features\":false,\"features\":[\"unstable\",\"compiled_data\"],\"name\":\"icu_calendar\",\"req\":\"^2.1.0\"},{\"name\":\"icu_locale\",\"req\":\"^2.1.0\"},{\"features\":[\"duration\"],\"name\":\"ixdtf\",\"req\":\"^0.6.4\"},{\"name\":\"log\",\"optional\":true,\"req\":\"^0.4.28\"},{\"default_features\":false,\"name\":\"num-traits\",\"req\":\"^0.2.19\"},{\"name\":\"timezone_provider\",\"req\":\"^0.1.2\"},{\"name\":\"tinystr\",\"req\":\"^0.8.0\"},{\"name\":\"web-time\",\"optional\":true,\"req\":\"^1.1.0\"},{\"name\":\"writeable\",\"req\":\"^0.6.0\"}],\"features\":{\"compiled_data\":[\"tzdb\"],\"default\":[\"sys\"],\"float64_representable_durations\":[],\"log\":[\"dep:log\"],\"std\":[],\"sys\":[\"std\",\"compiled_data\",\"dep:web-time\",\"dep:iana-time-zone\"],\"tzdb\":[\"std\",\"timezone_provider/tzif\"]}}",
+      "temporal_capi_0.2.3": "{\"dependencies\":[{\"default_features\":false,\"name\":\"diplomat\",\"req\":\"^0.15.0\"},{\"default_features\":false,\"name\":\"diplomat-runtime\",\"req\":\"^0.15.0\"},{\"default_features\":false,\"name\":\"icu_calendar\",\"req\":\"^2.2.1\"},{\"name\":\"icu_locale_core\",\"req\":\"^2.1.0\"},{\"default_features\":false,\"name\":\"num-traits\",\"req\":\"^0.2.19\"},{\"default_features\":false,\"name\":\"temporal_rs\",\"req\":\"^0.2.3\"},{\"default_features\":false,\"name\":\"timezone_provider\",\"req\":\"^0.2.3\"},{\"name\":\"writeable\",\"req\":\"^0.6.0\"},{\"name\":\"zoneinfo64\",\"optional\":true,\"req\":\"^0.3.0\"}],\"features\":{\"compiled_data\":[\"temporal_rs/compiled_data\"],\"zoneinfo64\":[\"dep:zoneinfo64\",\"timezone_provider/zoneinfo64\"]}}",
+      "temporal_rs_0.2.3": "{\"dependencies\":[{\"name\":\"calendrical_calculations\",\"req\":\"^0.2.4\"},{\"name\":\"core_maths\",\"req\":\"^0.1.1\"},{\"name\":\"iana-time-zone\",\"optional\":true,\"req\":\"^0.1.64\"},{\"default_features\":false,\"features\":[\"compiled_data\"],\"name\":\"icu_calendar\",\"req\":\"^2.2.1\"},{\"name\":\"icu_locale_core\",\"req\":\"^2.1.0\"},{\"features\":[\"duration\"],\"name\":\"ixdtf\",\"req\":\"^0.6.4\"},{\"name\":\"log\",\"optional\":true,\"req\":\"^0.4.28\"},{\"default_features\":false,\"name\":\"num-traits\",\"req\":\"^0.2.19\"},{\"default_features\":false,\"name\":\"timezone_provider\",\"req\":\"^0.2.3\"},{\"name\":\"tinystr\",\"req\":\"^0.8.0\"},{\"name\":\"web-time\",\"optional\":true,\"req\":\"^1.1.0\"},{\"name\":\"writeable\",\"req\":\"^0.6.0\"}],\"features\":{\"compiled_data\":[\"tzdb\"],\"default\":[\"sys-local\"],\"float64_representable_durations\":[],\"log\":[\"dep:log\"],\"std\":[],\"sys\":[\"std\",\"compiled_data\",\"dep:web-time\"],\"sys-local\":[\"sys\",\"dep:iana-time-zone\"],\"tzdb\":[\"std\",\"timezone_provider/tzif\"]}}",
       "term_0.7.0": "{\"dependencies\":[{\"name\":\"dirs-next\",\"req\":\"^2\"},{\"name\":\"rustversion\",\"req\":\"^1\",\"target\":\"cfg(windows)\"},{\"features\":[\"consoleapi\",\"wincon\",\"handleapi\",\"fileapi\"],\"name\":\"winapi\",\"req\":\"^0.3\",\"target\":\"cfg(windows)\"}],\"features\":{\"default\":[]}}",
       "termcolor_1.4.1": "{\"dependencies\":[{\"name\":\"winapi-util\",\"req\":\"^0.1.3\",\"target\":\"cfg(windows)\"}],\"features\":{}}",
       "terminal_size_0.4.3": "{\"dependencies\":[{\"features\":[\"termios\"],\"name\":\"rustix\",\"req\":\"^1.0.1\",\"target\":\"cfg(unix)\"},{\"features\":[\"Win32_Foundation\",\"Win32_System_Console\"],\"name\":\"windows-sys\",\"req\":\"^0.60.0\",\"target\":\"cfg(windows)\"}],\"features\":{}}",
@@ -1586,10 +1596,11 @@
       "time-core_0.1.8": "{\"dependencies\":[],\"features\":{\"large-dates\":[]}}",
       "time-macros_0.2.27": "{\"dependencies\":[{\"name\":\"num-conv\",\"req\":\"^0.2.0\"},{\"name\":\"time-core\",\"req\":\"=0.1.8\"}],\"features\":{\"formatting\":[],\"large-dates\":[],\"parsing\":[],\"serde\":[]}}",
       "time_0.3.47": "{\"dependencies\":[{\"default_features\":false,\"kind\":\"dev\",\"name\":\"criterion\",\"req\":\"^0.8.1\",\"target\":\"cfg(bench)\"},{\"features\":[\"powerfmt\"],\"name\":\"deranged\",\"req\":\"^0.5.2\"},{\"name\":\"itoa\",\"optional\":true,\"req\":\"^1.0.1\"},{\"name\":\"js-sys\",\"optional\":true,\"req\":\"^0.3.58\",\"target\":\"cfg(all(target_family = \\\"wasm\\\", not(any(target_os = \\\"emscripten\\\", target_os = \\\"wasi\\\"))))\"},{\"name\":\"libc\",\"optional\":true,\"req\":\"^0.2.98\",\"target\":\"cfg(target_family = \\\"unix\\\")\"},{\"name\":\"num-conv\",\"req\":\"^0.2.0\"},{\"kind\":\"dev\",\"name\":\"num-conv\",\"req\":\"^0.2.0\"},{\"name\":\"num_threads\",\"optional\":true,\"req\":\"^0.1.2\",\"target\":\"cfg(target_family = \\\"unix\\\")\"},{\"default_features\":false,\"name\":\"powerfmt\",\"req\":\"^0.2.0\"},{\"default_features\":false,\"name\":\"quickcheck\",\"optional\":true,\"req\":\"^1.0.3\"},{\"kind\":\"dev\",\"name\":\"quickcheck_macros\",\"req\":\"^1.0.0\"},{\"default_features\":false,\"name\":\"rand08\",\"optional\":true,\"package\":\"rand\",\"req\":\"^0.8.4\"},{\"default_features\":false,\"kind\":\"dev\",\"name\":\"rand08\",\"package\":\"rand\",\"req\":\"^0.8.4\"},{\"default_features\":false,\"name\":\"rand09\",\"optional\":true,\"package\":\"rand\",\"req\":\"^0.9.2\"},{\"default_features\":false,\"features\":[\"small_rng\"],\"kind\":\"dev\",\"name\":\"rand09\",\"package\":\"rand\",\"req\":\"^0.9.2\"},{\"default_features\":false,\"kind\":\"dev\",\"name\":\"rstest\",\"req\":\"^0.26.1\"},{\"kind\":\"dev\",\"name\":\"rstest_reuse\",\"req\":\"^0.7.0\"},{\"default_features\":false,\"features\":[\"derive\"],\"kind\":\"dev\",\"name\":\"serde\",\"req\":\"^1.0.184\"},{\"default_features\":false,\"name\":\"serde_core\",\"optional\":true,\"req\":\"^1.0.220\"},{\"kind\":\"dev\",\"name\":\"serde_json\",\"req\":\"^1.0.68\"},{\"kind\":\"dev\",\"name\":\"serde_test\",\"req\":\"^1.0.126\"},{\"name\":\"time-core\",\"req\":\"=0.1.8\"},{\"name\":\"time-macros\",\"optional\":true,\"req\":\"=0.2.27\"},{\"kind\":\"dev\",\"name\":\"time-macros\",\"req\":\"=0.2.27\"},{\"kind\":\"dev\",\"name\":\"trybuild\",\"req\":\"^1.0.102\",\"target\":\"cfg(__ui_tests)\"}],\"features\":{\"alloc\":[\"serde_core?/alloc\"],\"default\":[\"std\"],\"formatting\":[\"dep:itoa\",\"std\",\"time-macros?/formatting\"],\"large-dates\":[\"time-core/large-dates\",\"time-macros?/large-dates\"],\"local-offset\":[\"std\",\"dep:libc\",\"dep:num_threads\"],\"macros\":[\"dep:time-macros\"],\"parsing\":[\"time-macros?/parsing\"],\"quickcheck\":[\"dep:quickcheck\",\"alloc\",\"deranged/quickcheck\"],\"rand\":[\"rand08\",\"rand09\"],\"rand08\":[\"dep:rand08\",\"deranged/rand08\"],\"rand09\":[\"dep:rand09\",\"deranged/rand09\"],\"serde\":[\"dep:serde_core\",\"time-macros?/serde\",\"deranged/serde\"],\"serde-human-readable\":[\"serde\",\"formatting\",\"parsing\"],\"serde-well-known\":[\"serde\",\"formatting\",\"parsing\"],\"std\":[\"alloc\"],\"wasm-bindgen\":[\"dep:js-sys\"]}}",
-      "timezone_provider_0.1.2": "{\"dependencies\":[{\"name\":\"combine\",\"optional\":true,\"req\":\"^4.6.7\"},{\"features\":[\"derive\"],\"name\":\"databake\",\"optional\":true,\"req\":\"^0.2.0\"},{\"name\":\"jiff-tzdb\",\"optional\":true,\"req\":\"^0.1.4\"},{\"features\":[\"derive\"],\"name\":\"serde\",\"optional\":true,\"req\":\"^1.0.225\"},{\"name\":\"serde_json\",\"optional\":true,\"req\":\"^1.0.145\"},{\"features\":[\"zerovec\"],\"name\":\"tinystr\",\"req\":\"^0.8.0\"},{\"name\":\"tzif\",\"optional\":true,\"req\":\"^0.4.0\"},{\"features\":[\"derive\"],\"name\":\"yoke\",\"optional\":true,\"req\":\"^0.8.0\"},{\"name\":\"zerotrie\",\"req\":\"^0.2.0\"},{\"features\":[\"derive\",\"alloc\"],\"name\":\"zerovec\",\"req\":\"^0.11.0\"},{\"name\":\"zoneinfo64\",\"optional\":true,\"req\":\"^0.2.0\"},{\"features\":[\"std\"],\"name\":\"zoneinfo_rs\",\"optional\":true,\"req\":\"^0.0.18\"}],\"features\":{\"datagen\":[\"std\",\"dep:serde\",\"dep:databake\",\"dep:yoke\",\"dep:serde_json\",\"tinystr/serde\",\"tinystr/databake\",\"zerotrie/serde\",\"zerotrie/databake\",\"zerovec/serde\",\"zerovec/databake\",\"zerovec/derive\",\"dep:zoneinfo_rs\",\"experimental_tzif\"],\"default\":[],\"experimental_tzif\":[],\"std\":[],\"tzif\":[\"dep:tzif\",\"dep:jiff-tzdb\",\"dep:combine\",\"std\"],\"zoneinfo64\":[\"dep:zoneinfo64\"]}}",
+      "timezone_provider_0.2.3": "{\"dependencies\":[{\"name\":\"combine\",\"optional\":true,\"req\":\"^4.6.7\"},{\"features\":[\"derive\"],\"name\":\"databake\",\"optional\":true,\"req\":\"^0.2.0\"},{\"features\":[\"compiled_data\"],\"kind\":\"dev\",\"name\":\"icu_time\",\"req\":\"^2\"},{\"name\":\"jiff-tzdb\",\"optional\":true,\"req\":\"^0.1.4\"},{\"features\":[\"derive\"],\"name\":\"serde\",\"optional\":true,\"req\":\"^1.0.225\"},{\"name\":\"serde_json\",\"optional\":true,\"req\":\"^1.0.145\"},{\"features\":[\"zerovec\"],\"name\":\"tinystr\",\"req\":\"^0.8.0\"},{\"name\":\"tzif\",\"optional\":true,\"req\":\"^0.4.0\"},{\"features\":[\"derive\"],\"name\":\"yoke\",\"optional\":true,\"req\":\"^0.8.0\"},{\"name\":\"zerofrom\",\"optional\":true,\"req\":\"^0.1.6\"},{\"name\":\"zerotrie\",\"req\":\"^0.2.0\"},{\"features\":[\"derive\",\"alloc\"],\"name\":\"zerovec\",\"req\":\"^0.11.0\"},{\"name\":\"zoneinfo64\",\"optional\":true,\"req\":\"^0.3.0\"},{\"default_features\":false,\"features\":[\"std\",\"unstable\"],\"name\":\"zoneinfo_rs\",\"optional\":true,\"req\":\"^0.1.0\"}],\"features\":{\"datagen\":[\"std\",\"dep:serde\",\"dep:databake\",\"dep:yoke\",\"dep:serde_json\",\"tinystr/serde\",\"tinystr/databake\",\"zerotrie/serde\",\"zerotrie/databake\",\"zerovec/serde\",\"zerovec/databake\",\"zerovec/derive\",\"dep:zoneinfo_rs\",\"experimental_tzif\"],\"default\":[],\"experimental_tzif\":[\"dep:zerofrom\",\"zerofrom/derive\"],\"std\":[],\"tzif\":[\"dep:tzif\",\"dep:jiff-tzdb\",\"dep:combine\",\"std\"],\"zoneinfo64\":[\"dep:zoneinfo64\"]}}",
       "tiny-keccak_2.0.2": "{\"dependencies\":[{\"name\":\"crunchy\",\"req\":\"^0.2.2\"}],\"features\":{\"cshake\":[],\"default\":[],\"fips202\":[\"keccak\",\"shake\",\"sha3\"],\"k12\":[],\"keccak\":[],\"kmac\":[\"cshake\"],\"parallel_hash\":[\"cshake\"],\"sha3\":[],\"shake\":[],\"sp800\":[\"cshake\",\"kmac\",\"tuple_hash\"],\"tuple_hash\":[\"cshake\"]}}",
       "tiny_http_0.12.0": "{\"dependencies\":[{\"name\":\"ascii\",\"req\":\"^1.0\"},{\"name\":\"chunked_transfer\",\"req\":\"^1\"},{\"kind\":\"dev\",\"name\":\"fdlimit\",\"req\":\"^0.1\"},{\"name\":\"httpdate\",\"req\":\"^1.0.2\"},{\"name\":\"log\",\"req\":\"^0.4.4\"},{\"name\":\"openssl\",\"optional\":true,\"req\":\"^0.10\"},{\"kind\":\"dev\",\"name\":\"rustc-serialize\",\"req\":\"^0.3\"},{\"name\":\"rustls\",\"optional\":true,\"req\":\"^0.20\"},{\"name\":\"rustls-pemfile\",\"optional\":true,\"req\":\"^0.2.1\"},{\"kind\":\"dev\",\"name\":\"sha1\",\"req\":\"^0.6.0\"},{\"name\":\"zeroize\",\"optional\":true,\"req\":\"^1\"}],\"features\":{\"default\":[],\"ssl\":[\"ssl-openssl\"],\"ssl-openssl\":[\"openssl\",\"zeroize\"],\"ssl-rustls\":[\"rustls\",\"rustls-pemfile\",\"zeroize\"]}}",
       "tinystr_0.8.2": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"bincode\",\"req\":\"^1.3.1\"},{\"kind\":\"dev\",\"name\":\"criterion\",\"req\":\"^0.5.0\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"default_features\":false,\"name\":\"databake\",\"optional\":true,\"req\":\"^0.2.0\"},{\"default_features\":false,\"name\":\"displaydoc\",\"req\":\"^0.2.3\"},{\"default_features\":false,\"features\":[\"use-std\"],\"kind\":\"dev\",\"name\":\"postcard\",\"req\":\"^1.0.3\"},{\"features\":[\"small_rng\"],\"kind\":\"dev\",\"name\":\"rand\",\"req\":\"^0.9\"},{\"default_features\":false,\"name\":\"serde_core\",\"optional\":true,\"req\":\"^1.0.220\"},{\"features\":[\"alloc\"],\"kind\":\"dev\",\"name\":\"serde_json\",\"req\":\"^1.0.45\"},{\"default_features\":false,\"name\":\"zerovec\",\"optional\":true,\"req\":\"^0.11.3\"}],\"features\":{\"alloc\":[\"serde_core?/alloc\",\"zerovec?/alloc\"],\"databake\":[\"dep:databake\"],\"default\":[\"alloc\"],\"serde\":[\"dep:serde_core\"],\"std\":[],\"zerovec\":[\"dep:zerovec\"]}}",
+      "tinystr_0.8.3": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"bincode\",\"req\":\"^1.3.1\"},{\"kind\":\"dev\",\"name\":\"criterion\",\"req\":\"^0.5.0\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"default_features\":false,\"name\":\"databake\",\"optional\":true,\"req\":\"^0.2.0\"},{\"default_features\":false,\"name\":\"displaydoc\",\"req\":\"^0.2.3\"},{\"default_features\":false,\"features\":[\"use-std\"],\"kind\":\"dev\",\"name\":\"postcard\",\"req\":\"^1.0.3\"},{\"features\":[\"small_rng\"],\"kind\":\"dev\",\"name\":\"rand\",\"req\":\"^0.9\"},{\"default_features\":false,\"name\":\"serde_core\",\"optional\":true,\"req\":\"^1.0.220\"},{\"features\":[\"alloc\"],\"kind\":\"dev\",\"name\":\"serde_json\",\"req\":\"^1.0.45\"},{\"default_features\":false,\"name\":\"zerovec\",\"optional\":true,\"req\":\"^0.11.6\"}],\"features\":{\"alloc\":[\"serde_core?/alloc\",\"zerovec?/alloc\"],\"databake\":[\"dep:databake\"],\"default\":[\"alloc\"],\"serde\":[\"dep:serde_core\"],\"std\":[],\"zerovec\":[\"dep:zerovec\"]}}",
       "tinyvec_1.10.0": "{\"dependencies\":[{\"name\":\"arbitrary\",\"optional\":true,\"req\":\"^1\"},{\"default_features\":false,\"name\":\"borsh\",\"optional\":true,\"req\":\"^1.2.0\"},{\"kind\":\"dev\",\"name\":\"criterion\",\"req\":\"^0.3.0\"},{\"kind\":\"dev\",\"name\":\"debugger_test\",\"req\":\"^0.1\"},{\"kind\":\"dev\",\"name\":\"debugger_test_parser\",\"req\":\"^0.1\"},{\"default_features\":false,\"name\":\"generic-array\",\"optional\":true,\"req\":\"^1.1.1\"},{\"default_features\":false,\"name\":\"serde\",\"optional\":true,\"req\":\"^1.0\"},{\"kind\":\"dev\",\"name\":\"serde_test\",\"req\":\"^1.0\"},{\"kind\":\"dev\",\"name\":\"smallvec\",\"req\":\"^1\"},{\"name\":\"tinyvec_macros\",\"optional\":true,\"req\":\"^0.1\"}],\"features\":{\"alloc\":[\"tinyvec_macros\"],\"debugger_visualizer\":[],\"default\":[],\"experimental_write_impl\":[],\"grab_spare_slice\":[],\"latest_stable_rust\":[\"rustc_1_61\"],\"nightly_slice_partition_dedup\":[],\"real_blackbox\":[\"criterion/real_blackbox\"],\"rustc_1_40\":[],\"rustc_1_55\":[],\"rustc_1_57\":[],\"rustc_1_61\":[\"rustc_1_57\"],\"std\":[\"alloc\"]}}",
       "tinyvec_macros_0.1.1": "{\"dependencies\":[],\"features\":{}}",
       "tokio-graceful_0.2.2": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"bytes\",\"req\":\"^1\",\"target\":\"cfg(not(loom))\"},{\"kind\":\"dev\",\"name\":\"http-body-util\",\"req\":\"^0.1\",\"target\":\"cfg(not(loom))\"},{\"features\":[\"server\",\"http1\",\"http2\"],\"kind\":\"dev\",\"name\":\"hyper\",\"req\":\"^1.0.1\",\"target\":\"cfg(not(loom))\"},{\"features\":[\"server\",\"server-auto\",\"http1\",\"http2\",\"tokio\"],\"kind\":\"dev\",\"name\":\"hyper-util\",\"req\":\"^0.1.1\",\"target\":\"cfg(not(loom))\"},{\"features\":[\"futures\",\"checkpoint\"],\"name\":\"loom\",\"req\":\"^0.7\",\"target\":\"cfg(loom)\"},{\"name\":\"pin-project-lite\",\"req\":\"^0.2\"},{\"kind\":\"dev\",\"name\":\"rand\",\"req\":\"^0.8\"},{\"name\":\"slab\",\"req\":\"^0.4\"},{\"features\":[\"rt\",\"signal\",\"sync\",\"macros\",\"time\"],\"name\":\"tokio\",\"req\":\"^1\"},{\"features\":[\"net\",\"rt-multi-thread\",\"io-util\",\"test-util\"],\"kind\":\"dev\",\"name\":\"tokio\",\"req\":\"^1\"},{\"name\":\"tracing\",\"req\":\"^0.1\"},{\"features\":[\"env-filter\"],\"kind\":\"dev\",\"name\":\"tracing-subscriber\",\"req\":\"^0.3\"}],\"features\":{}}",
@@ -1676,7 +1687,7 @@
       "utf8_iter_1.0.4": "{\"dependencies\":[],\"features\":{}}",
       "utf8parse_0.2.2": "{\"dependencies\":[],\"features\":{\"default\":[],\"nightly\":[]}}",
       "uuid_1.20.0": "{\"dependencies\":[{\"name\":\"arbitrary\",\"optional\":true,\"req\":\"^1.1.3\"},{\"default_features\":false,\"name\":\"atomic\",\"optional\":true,\"req\":\"^0.6\"},{\"default_features\":false,\"name\":\"borsh\",\"optional\":true,\"req\":\"^1\"},{\"default_features\":false,\"name\":\"borsh-derive\",\"optional\":true,\"req\":\"^1\"},{\"features\":[\"derive\"],\"name\":\"bytemuck\",\"optional\":true,\"req\":\"^1.20.0\"},{\"name\":\"getrandom\",\"optional\":true,\"req\":\"^0.3\",\"target\":\"cfg(not(all(target_arch = \\\"wasm32\\\", any(target_os = \\\"unknown\\\", target_os = \\\"none\\\"))))\"},{\"default_features\":false,\"name\":\"js-sys\",\"optional\":true,\"req\":\"^0.3\",\"target\":\"cfg(all(target_arch = \\\"wasm32\\\", any(target_os = \\\"unknown\\\", target_os = \\\"none\\\"), target_feature = \\\"atomics\\\"))\"},{\"default_features\":false,\"name\":\"md-5\",\"optional\":true,\"req\":\"^0.10\"},{\"name\":\"rand\",\"optional\":true,\"req\":\"^0.9\",\"target\":\"cfg(not(all(target_arch = \\\"wasm32\\\", any(target_os = \\\"unknown\\\", target_os = \\\"none\\\"))))\"},{\"kind\":\"dev\",\"name\":\"rustversion\",\"req\":\"^1\"},{\"kind\":\"dev\",\"name\":\"serde\",\"req\":\"^1.0.221\"},{\"default_features\":false,\"name\":\"serde_core\",\"optional\":true,\"req\":\"^1.0.221\"},{\"kind\":\"dev\",\"name\":\"serde_derive\",\"req\":\"^1.0.221\"},{\"kind\":\"dev\",\"name\":\"serde_json\",\"req\":\"^1.0\"},{\"kind\":\"dev\",\"name\":\"serde_test\",\"req\":\"^1.0.56\"},{\"default_features\":false,\"name\":\"sha1_smol\",\"optional\":true,\"req\":\"^1\"},{\"name\":\"slog\",\"optional\":true,\"req\":\"^2\"},{\"kind\":\"dev\",\"name\":\"trybuild\",\"req\":\"^1.0.52\"},{\"name\":\"uuid-rng-internal-lib\",\"optional\":true,\"package\":\"uuid-rng-internal\",\"req\":\"^1.20.0\",\"target\":\"cfg(all(target_arch = \\\"wasm32\\\", any(target_os = \\\"unknown\\\", target_os = \\\"none\\\")))\"},{\"default_features\":false,\"features\":[\"msrv\"],\"name\":\"wasm-bindgen\",\"optional\":true,\"req\":\"^0.2\",\"target\":\"cfg(all(target_arch = \\\"wasm32\\\", any(target_os = \\\"unknown\\\", target_os = \\\"none\\\")))\"},{\"kind\":\"dev\",\"name\":\"wasm-bindgen\",\"req\":\"^0.2\",\"target\":\"cfg(all(target_arch = \\\"wasm32\\\", any(target_os = \\\"unknown\\\", target_os = \\\"none\\\")))\"},{\"kind\":\"dev\",\"name\":\"wasm-bindgen-test\",\"req\":\"^0.3\",\"target\":\"cfg(all(target_arch = \\\"wasm32\\\", any(target_os = \\\"unknown\\\", target_os = \\\"none\\\")))\"},{\"features\":[\"derive\"],\"name\":\"zerocopy\",\"optional\":true,\"req\":\"^0.8\"}],\"features\":{\"atomic\":[\"dep:atomic\"],\"borsh\":[\"dep:borsh\",\"dep:borsh-derive\"],\"default\":[\"std\"],\"fast-rng\":[\"rng\",\"dep:rand\"],\"js\":[\"dep:wasm-bindgen\",\"dep:js-sys\"],\"macro-diagnostics\":[],\"md5\":[\"dep:md-5\"],\"rng\":[\"dep:getrandom\"],\"rng-getrandom\":[\"rng\",\"dep:getrandom\",\"uuid-rng-internal-lib\",\"uuid-rng-internal-lib/getrandom\"],\"rng-rand\":[\"rng\",\"dep:rand\",\"uuid-rng-internal-lib\",\"uuid-rng-internal-lib/rand\"],\"serde\":[\"dep:serde_core\"],\"sha1\":[\"dep:sha1_smol\"],\"std\":[\"wasm-bindgen?/std\",\"js-sys?/std\"],\"v1\":[\"atomic\"],\"v3\":[\"md5\"],\"v4\":[\"rng\"],\"v5\":[\"sha1\"],\"v6\":[\"atomic\"],\"v7\":[\"rng\"],\"v8\":[]}}",
-      "v8_146.4.0": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"align-data\",\"req\":\"^0.1.0\"},{\"kind\":\"build\",\"name\":\"bindgen\",\"req\":\"^0.72\"},{\"kind\":\"dev\",\"name\":\"bindgen\",\"req\":\"^0.72\"},{\"name\":\"bitflags\",\"req\":\"^2.5\"},{\"kind\":\"dev\",\"name\":\"bytes\",\"req\":\"^1\"},{\"kind\":\"build\",\"name\":\"fslock\",\"req\":\"^0.2\"},{\"kind\":\"dev\",\"name\":\"fslock\",\"req\":\"^0.2\"},{\"kind\":\"build\",\"name\":\"gzip-header\",\"req\":\"^1.0.0\"},{\"kind\":\"dev\",\"name\":\"gzip-header\",\"req\":\"^1.0.0\"},{\"kind\":\"build\",\"name\":\"home\",\"req\":\"^0\"},{\"kind\":\"dev\",\"name\":\"home\",\"req\":\"^0\"},{\"kind\":\"build\",\"name\":\"miniz_oxide\",\"req\":\"^0.8.8\"},{\"kind\":\"dev\",\"name\":\"miniz_oxide\",\"req\":\"^0.8.8\"},{\"name\":\"paste\",\"req\":\"^1.0\"},{\"kind\":\"dev\",\"name\":\"rustversion\",\"req\":\"^1\"},{\"features\":[\"zoneinfo64\"],\"name\":\"temporal_capi\",\"req\":\"^0.1.2\"},{\"kind\":\"dev\",\"name\":\"trybuild\",\"req\":\"^1.0.96\"},{\"kind\":\"build\",\"name\":\"which\",\"req\":\"^6\"},{\"kind\":\"dev\",\"name\":\"which\",\"req\":\"^6\"}],\"features\":{\"default\":[\"use_custom_libcxx\"],\"use_custom_libcxx\":[],\"v8_enable_pointer_compression\":[],\"v8_enable_sandbox\":[\"v8_enable_pointer_compression\"],\"v8_enable_v8_checks\":[]}}",
+      "v8_147.4.0": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"align-data\",\"req\":\"^0.1.0\"},{\"kind\":\"build\",\"name\":\"bindgen\",\"req\":\"^0.72\"},{\"kind\":\"dev\",\"name\":\"bindgen\",\"req\":\"^0.72\"},{\"name\":\"bitflags\",\"req\":\"^2.5\"},{\"kind\":\"dev\",\"name\":\"bytes\",\"req\":\"^1\"},{\"kind\":\"build\",\"name\":\"fslock\",\"req\":\"^0.2\"},{\"kind\":\"dev\",\"name\":\"fslock\",\"req\":\"^0.2\"},{\"kind\":\"build\",\"name\":\"gzip-header\",\"req\":\"^1.0.0\"},{\"kind\":\"dev\",\"name\":\"gzip-header\",\"req\":\"^1.0.0\"},{\"kind\":\"build\",\"name\":\"home\",\"req\":\"^0\"},{\"kind\":\"dev\",\"name\":\"home\",\"req\":\"^0\"},{\"kind\":\"build\",\"name\":\"miniz_oxide\",\"req\":\"^0.8.8\"},{\"kind\":\"dev\",\"name\":\"miniz_oxide\",\"req\":\"^0.8.8\"},{\"name\":\"paste\",\"req\":\"^1.0\"},{\"kind\":\"dev\",\"name\":\"rustversion\",\"req\":\"^1\"},{\"features\":[\"zoneinfo64\"],\"name\":\"temporal_capi\",\"req\":\"^0.2.3\"},{\"kind\":\"dev\",\"name\":\"trybuild\",\"req\":\"^1.0.96\"},{\"kind\":\"build\",\"name\":\"which\",\"req\":\"^6\"},{\"kind\":\"dev\",\"name\":\"which\",\"req\":\"^6\"}],\"features\":{\"default\":[\"use_custom_libcxx\"],\"simdutf\":[],\"use_custom_libcxx\":[],\"v8_enable_pointer_compression\":[],\"v8_enable_sandbox\":[\"v8_enable_pointer_compression\"],\"v8_enable_v8_checks\":[]}}",
       "valuable_0.1.1": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"criterion\",\"req\":\"^0.3\"},{\"name\":\"valuable-derive\",\"optional\":true,\"req\":\"=0.1.1\"}],\"features\":{\"alloc\":[],\"default\":[\"std\"],\"derive\":[\"valuable-derive\"],\"std\":[\"alloc\"]}}",
       "vcpkg_0.2.15": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"lazy_static\",\"req\":\"^1\"},{\"kind\":\"dev\",\"name\":\"tempdir\",\"req\":\"^0.3.7\"}],\"features\":{}}",
       "version-compare_0.2.1": "{\"dependencies\":[],\"features\":{}}",
@@ -1812,7 +1823,9 @@
       "yansi_1.0.1": "{\"dependencies\":[{\"name\":\"is-terminal\",\"optional\":true,\"req\":\"^0.4.11\"}],\"features\":{\"_nightly\":[],\"alloc\":[],\"default\":[\"std\"],\"detect-env\":[\"std\"],\"detect-tty\":[\"is-terminal\",\"std\"],\"hyperlink\":[\"std\"],\"std\":[\"alloc\"]}}",
       "yasna_0.5.2": "{\"dependencies\":[{\"default_features\":false,\"features\":[\"std\"],\"name\":\"bit-vec\",\"optional\":true,\"req\":\"^0.6.1\"},{\"name\":\"num-bigint\",\"optional\":true,\"req\":\"^0.4\"},{\"default_features\":false,\"kind\":\"dev\",\"name\":\"num-traits\",\"req\":\"^0.2\"},{\"default_features\":false,\"features\":[\"std\"],\"name\":\"time\",\"optional\":true,\"req\":\"^0.3.1\"}],\"features\":{\"default\":[],\"std\":[]}}",
       "yoke-derive_0.8.1": "{\"dependencies\":[{\"name\":\"proc-macro2\",\"req\":\"^1.0.61\"},{\"name\":\"quote\",\"req\":\"^1.0.28\"},{\"features\":[\"fold\"],\"name\":\"syn\",\"req\":\"^2.0.21\"},{\"name\":\"synstructure\",\"req\":\"^0.13.0\"}],\"features\":{}}",
+      "yoke-derive_0.8.2": "{\"dependencies\":[{\"name\":\"proc-macro2\",\"req\":\"^1.0.61\"},{\"name\":\"quote\",\"req\":\"^1.0.44\"},{\"features\":[\"fold\"],\"name\":\"syn\",\"req\":\"^2.0.21\"},{\"name\":\"synstructure\",\"req\":\"^0.13.0\"}],\"features\":{}}",
       "yoke_0.8.1": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"bincode\",\"req\":\"^1.3.1\"},{\"default_features\":false,\"kind\":\"dev\",\"name\":\"postcard\",\"req\":\"^1.0.3\"},{\"default_features\":false,\"kind\":\"dev\",\"name\":\"serde\",\"req\":\"^1.0.220\"},{\"default_features\":false,\"name\":\"stable_deref_trait\",\"req\":\"^1.2.0\"},{\"default_features\":false,\"name\":\"yoke-derive\",\"optional\":true,\"req\":\"^0.8.0\"},{\"default_features\":false,\"name\":\"zerofrom\",\"optional\":true,\"req\":\"^0.1.3\"}],\"features\":{\"alloc\":[\"stable_deref_trait/alloc\",\"zerofrom/alloc\"],\"default\":[\"alloc\",\"zerofrom\"],\"derive\":[\"dep:yoke-derive\",\"zerofrom/derive\"],\"serde\":[],\"zerofrom\":[\"dep:zerofrom\"]}}",
+      "yoke_0.8.2": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"bincode\",\"req\":\"^1.3.1\"},{\"default_features\":false,\"kind\":\"dev\",\"name\":\"postcard\",\"req\":\"^1.0.3\"},{\"default_features\":false,\"kind\":\"dev\",\"name\":\"serde\",\"req\":\"^1.0.220\"},{\"default_features\":false,\"name\":\"stable_deref_trait\",\"req\":\"^1.2.0\"},{\"default_features\":false,\"name\":\"yoke-derive\",\"optional\":true,\"req\":\"^0.8.2\"},{\"default_features\":false,\"name\":\"zerofrom\",\"optional\":true,\"req\":\"^0.1.6\"}],\"features\":{\"alloc\":[\"stable_deref_trait/alloc\",\"zerofrom/alloc\"],\"default\":[\"alloc\",\"zerofrom\"],\"derive\":[\"dep:yoke-derive\",\"zerofrom/derive\"],\"serde\":[],\"zerofrom\":[\"dep:zerofrom\"]}}",
       "zbus_4.4.0": "{\"dependencies\":[{\"name\":\"async-broadcast\",\"req\":\"^0.7.0\"},{\"name\":\"async-executor\",\"optional\":true,\"req\":\"^1.11.0\"},{\"name\":\"async-fs\",\"optional\":true,\"req\":\"^2.1.2\"},{\"name\":\"async-io\",\"optional\":true,\"req\":\"^2.3.2\"},{\"name\":\"async-lock\",\"optional\":true,\"req\":\"^3.3.0\"},{\"name\":\"async-process\",\"req\":\"^2.2.2\",\"target\":\"cfg(target_os = \\\"macos\\\")\"},{\"name\":\"async-recursion\",\"req\":\"^1.1.1\",\"target\":\"cfg(any(target_os = \\\"macos\\\", windows))\"},{\"name\":\"async-task\",\"optional\":true,\"req\":\"^4.7.1\"},{\"name\":\"async-trait\",\"req\":\"^0.1.80\"},{\"name\":\"blocking\",\"optional\":true,\"req\":\"^1.6.0\"},{\"kind\":\"dev\",\"name\":\"doc-comment\",\"req\":\"^0.3.3\"},{\"features\":[\"serde\"],\"name\":\"enumflags2\",\"req\":\"^0.7.9\"},{\"name\":\"event-listener\",\"req\":\"^5.3.0\"},{\"name\":\"futures-core\",\"req\":\"^0.3.30\"},{\"name\":\"futures-sink\",\"req\":\"^0.3.30\"},{\"default_features\":false,\"features\":[\"sink\",\"std\"],\"name\":\"futures-util\",\"req\":\"^0.3.30\"},{\"kind\":\"dev\",\"name\":\"futures-util\",\"req\":\"^0.3.30\"},{\"name\":\"hex\",\"req\":\"^0.4.3\"},{\"default_features\":false,\"features\":[\"socket\",\"uio\",\"user\"],\"name\":\"nix\",\"req\":\"^0.29\",\"target\":\"cfg(unix)\"},{\"kind\":\"dev\",\"name\":\"ntest\",\"req\":\"^0.9.2\"},{\"name\":\"ordered-stream\",\"req\":\"^0.2\"},{\"name\":\"rand\",\"req\":\"^0.8.5\"},{\"features\":[\"derive\"],\"name\":\"serde\",\"req\":\"^1.0.200\"},{\"name\":\"serde_repr\",\"req\":\"^0.1.19\"},{\"features\":[\"std\"],\"name\":\"sha1\",\"req\":\"^0.10.6\"},{\"name\":\"static_assertions\",\"req\":\"^1.1.0\"},{\"kind\":\"dev\",\"name\":\"tempfile\",\"req\":\"^3.10.1\"},{\"default_features\":false,\"features\":[\"trace\"],\"kind\":\"dev\",\"name\":\"test-log\",\"req\":\"^0.2.16\"},{\"features\":[\"rt\",\"net\",\"time\",\"fs\",\"io-util\",\"process\",\"sync\",\"tracing\"],\"name\":\"tokio\",\"optional\":true,\"req\":\"^1.37.0\"},{\"features\":[\"macros\",\"rt-multi-thread\",\"fs\",\"io-util\",\"net\",\"sync\"],\"kind\":\"dev\",\"name\":\"tokio\",\"req\":\"^1.37.0\"},{\"name\":\"tokio-vsock\",\"optional\":true,\"req\":\"^0.4\"},{\"name\":\"tracing\",\"req\":\"^0.1.40\"},{\"default_features\":false,\"features\":[\"env-filter\",\"fmt\",\"ansi\"],\"kind\":\"dev\",\"name\":\"tracing-subscriber\",\"req\":\"^0.3.18\"},{\"name\":\"uds_windows\",\"req\":\"^1.1.0\",\"target\":\"cfg(windows)\"},{\"name\":\"vsock\",\"optional\":true,\"req\":\"^0.5.0\"},{\"features\":[\"Win32_Foundation\",\"Win32_Security_Authorization\",\"Win32_System_Memory\",\"Win32_Networking\",\"Win32_Networking_WinSock\",\"Win32_NetworkManagement\",\"Win32_NetworkManagement_IpHelper\",\"Win32_System_Threading\"],\"name\":\"windows-sys\",\"req\":\"^0.52\",\"target\":\"cfg(windows)\"},{\"name\":\"xdg-home\",\"req\":\"^1.1.0\"},{\"name\":\"zbus_macros\",\"req\":\"=4.4.0\"},{\"name\":\"zbus_names\",\"req\":\"^3.0\"},{\"kind\":\"dev\",\"name\":\"zbus_xml\",\"req\":\"^4.0.0\"},{\"default_features\":false,\"features\":[\"enumflags2\"],\"name\":\"zvariant\",\"req\":\"^4.2.0\"}],\"features\":{\"async-io\":[\"dep:async-io\",\"async-executor\",\"async-task\",\"async-lock\",\"async-fs\",\"blocking\",\"futures-util/io\"],\"bus-impl\":[\"p2p\"],\"chrono\":[\"zvariant/chrono\"],\"default\":[\"async-io\"],\"heapless\":[\"zvariant/heapless\"],\"option-as-array\":[\"zvariant/option-as-array\"],\"p2p\":[],\"time\":[\"zvariant/time\"],\"tokio\":[\"dep:tokio\"],\"tokio-vsock\":[\"dep:tokio-vsock\",\"tokio\"],\"url\":[\"zvariant/url\"],\"uuid\":[\"zvariant/uuid\"],\"vsock\":[\"dep:vsock\",\"dep:async-io\"]}}",
       "zbus_macros_4.4.0": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"async-io\",\"req\":\"^2.3.2\"},{\"default_features\":false,\"kind\":\"dev\",\"name\":\"futures-util\",\"req\":\"^0.3.30\"},{\"name\":\"proc-macro-crate\",\"req\":\"^3.1.0\"},{\"name\":\"proc-macro2\",\"req\":\"^1.0.81\"},{\"name\":\"quote\",\"req\":\"^1.0.36\"},{\"kind\":\"dev\",\"name\":\"rustversion\",\"req\":\"^1.0.15\"},{\"features\":[\"derive\"],\"kind\":\"dev\",\"name\":\"serde\",\"req\":\"^1.0.200\"},{\"features\":[\"extra-traits\",\"fold\",\"full\"],\"name\":\"syn\",\"req\":\"^2.0.64\"},{\"kind\":\"dev\",\"name\":\"trybuild\",\"req\":\"^1.0.93\"},{\"name\":\"zvariant_utils\",\"req\":\"=2.1.0\"}],\"features\":{}}",
       "zbus_names_3.0.0": "{\"dependencies\":[{\"features\":[\"derive\"],\"name\":\"serde\",\"req\":\"^1.0\"},{\"name\":\"static_assertions\",\"req\":\"^1.1.0\"},{\"default_features\":false,\"features\":[\"enumflags2\"],\"name\":\"zvariant\",\"req\":\"^4.0.0\"}],\"features\":{}}",
@@ -1825,14 +1838,17 @@
       "zeroize_1.8.2": "{\"dependencies\":[{\"default_features\":false,\"name\":\"serde\",\"optional\":true,\"req\":\"^1.0\"},{\"name\":\"zeroize_derive\",\"optional\":true,\"req\":\"^1.3\"}],\"features\":{\"aarch64\":[],\"alloc\":[],\"default\":[\"alloc\"],\"derive\":[\"zeroize_derive\"],\"simd\":[],\"std\":[\"alloc\"]}}",
       "zeroize_derive_1.4.3": "{\"dependencies\":[{\"name\":\"proc-macro2\",\"req\":\"^1\"},{\"name\":\"quote\",\"req\":\"^1\"},{\"features\":[\"full\",\"extra-traits\",\"visit\"],\"name\":\"syn\",\"req\":\"^2\"}],\"features\":{}}",
       "zerotrie_0.2.3": "{\"dependencies\":[{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"databake\",\"optional\":true,\"req\":\"^0.2.0\"},{\"default_features\":false,\"name\":\"displaydoc\",\"req\":\"^0.2.3\"},{\"default_features\":false,\"features\":[\"alloc\"],\"name\":\"litemap\",\"optional\":true,\"req\":\"^0.8.0\"},{\"default_features\":false,\"name\":\"serde_core\",\"optional\":true,\"req\":\"^1.0.220\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"yoke\",\"optional\":true,\"req\":\"^0.8.0\"},{\"default_features\":false,\"name\":\"zerofrom\",\"optional\":true,\"req\":\"^0.1.3\"},{\"default_features\":false,\"name\":\"zerovec\",\"optional\":true,\"req\":\"^0.11.3\"}],\"features\":{\"alloc\":[],\"databake\":[\"dep:databake\",\"zerovec?/databake\"],\"default\":[],\"litemap\":[\"dep:litemap\",\"alloc\"],\"serde\":[\"dep:serde_core\",\"dep:litemap\",\"alloc\",\"litemap/serde\",\"zerovec?/serde\"],\"yoke\":[\"dep:yoke\"],\"zerofrom\":[\"dep:zerofrom\"]}}",
+      "zerotrie_0.2.4": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"bincode\",\"req\":\"^1.3.1\"},{\"kind\":\"dev\",\"name\":\"criterion\",\"req\":\"^0.5.0\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"databake\",\"optional\":true,\"req\":\"^0.2.0\"},{\"default_features\":false,\"name\":\"displaydoc\",\"req\":\"^0.2.3\"},{\"default_features\":false,\"features\":[\"alloc\"],\"kind\":\"dev\",\"name\":\"icu_locale_core\",\"req\":\"^2.2.0\"},{\"kind\":\"dev\",\"name\":\"itertools\",\"req\":\"^0.14.0\"},{\"default_features\":false,\"features\":[\"alloc\"],\"name\":\"litemap\",\"optional\":true,\"req\":\"^0.8.0\"},{\"default_features\":false,\"features\":[\"alloc\"],\"kind\":\"dev\",\"name\":\"postcard\",\"req\":\"^1.0.3\"},{\"kind\":\"dev\",\"name\":\"rand\",\"req\":\"^0.9\"},{\"kind\":\"dev\",\"name\":\"rand_pcg\",\"req\":\"^0.9\"},{\"kind\":\"dev\",\"name\":\"rmp-serde\",\"req\":\"^1.2.0\"},{\"default_features\":false,\"features\":[\"derive\"],\"kind\":\"dev\",\"name\":\"serde\",\"req\":\"^1.0.220\"},{\"default_features\":false,\"name\":\"serde_core\",\"optional\":true,\"req\":\"^1.0.220\"},{\"kind\":\"dev\",\"name\":\"serde_json\",\"req\":\"^1.0.45\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"yoke\",\"optional\":true,\"req\":\"^0.8.2\"},{\"default_features\":false,\"name\":\"zerofrom\",\"optional\":true,\"req\":\"^0.1.6\"},{\"default_features\":false,\"name\":\"zerovec\",\"optional\":true,\"req\":\"^0.11.6\"}],\"features\":{\"alloc\":[\"zerovec?/alloc\"],\"databake\":[\"dep:databake\",\"zerovec?/databake\"],\"default\":[],\"dense\":[\"dep:zerovec\"],\"litemap\":[\"dep:litemap\",\"alloc\"],\"serde\":[\"dep:serde_core\",\"dep:litemap\",\"alloc\",\"litemap/serde\",\"zerovec?/serde\"],\"yoke\":[\"dep:yoke\"],\"zerofrom\":[\"dep:zerofrom\"],\"zerovec\":[\"dep:zerovec\"]}}",
       "zerovec-derive_0.11.2": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"bincode\",\"req\":\"^1.3.1\"},{\"name\":\"proc-macro2\",\"req\":\"^1.0.61\"},{\"name\":\"quote\",\"req\":\"^1.0.28\"},{\"default_features\":false,\"features\":[\"derive\"],\"kind\":\"dev\",\"name\":\"serde\",\"req\":\"^1.0.220\"},{\"kind\":\"dev\",\"name\":\"serde_json\",\"req\":\"^1.0.45\"},{\"features\":[\"extra-traits\"],\"name\":\"syn\",\"req\":\"^2.0.21\"}],\"features\":{}}",
+      "zerovec-derive_0.11.3": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"bincode\",\"req\":\"^1.3.1\"},{\"name\":\"proc-macro2\",\"req\":\"^1.0.61\"},{\"name\":\"quote\",\"req\":\"^1.0.44\"},{\"default_features\":false,\"features\":[\"derive\"],\"kind\":\"dev\",\"name\":\"serde\",\"req\":\"^1.0.220\"},{\"kind\":\"dev\",\"name\":\"serde_json\",\"req\":\"^1.0.45\"},{\"features\":[\"extra-traits\"],\"name\":\"syn\",\"req\":\"^2.0.21\"}],\"features\":{}}",
       "zerovec_0.11.5": "{\"dependencies\":[{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"databake\",\"optional\":true,\"req\":\"^0.2.0\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"serde\",\"optional\":true,\"req\":\"^1.0.220\"},{\"default_features\":false,\"features\":[\"xxhash64\"],\"name\":\"twox-hash\",\"optional\":true,\"req\":\"^2.0.0\"},{\"default_features\":false,\"name\":\"yoke\",\"optional\":true,\"req\":\"^0.8.0\"},{\"default_features\":false,\"name\":\"zerofrom\",\"req\":\"^0.1.3\"},{\"default_features\":false,\"name\":\"zerovec-derive\",\"optional\":true,\"req\":\"^0.11.1\"}],\"features\":{\"alloc\":[\"serde?/alloc\"],\"databake\":[\"dep:databake\"],\"derive\":[\"dep:zerovec-derive\"],\"hashmap\":[\"dep:twox-hash\",\"alloc\"],\"serde\":[\"dep:serde\"],\"std\":[],\"yoke\":[\"dep:yoke\"]}}",
+      "zerovec_0.11.6": "{\"dependencies\":[{\"kind\":\"dev\",\"name\":\"bincode\",\"req\":\"^1.3.1\"},{\"kind\":\"dev\",\"name\":\"criterion\",\"req\":\"^0.5.0\",\"target\":\"cfg(not(target_arch = \\\"wasm32\\\"))\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"databake\",\"optional\":true,\"req\":\"^0.2.0\"},{\"features\":[\"wasm_js\"],\"kind\":\"dev\",\"name\":\"getrandom\",\"req\":\"^0.3\"},{\"kind\":\"dev\",\"name\":\"iai\",\"req\":\"^0.1.1\"},{\"features\":[\"json\"],\"kind\":\"dev\",\"name\":\"insta\",\"req\":\"^1.43.2\"},{\"default_features\":false,\"features\":[\"use-std\"],\"kind\":\"dev\",\"name\":\"postcard\",\"req\":\"^1.0.3\"},{\"kind\":\"dev\",\"name\":\"rand\",\"req\":\"^0.9\"},{\"kind\":\"dev\",\"name\":\"rand_distr\",\"req\":\"^0.5\"},{\"kind\":\"dev\",\"name\":\"rand_pcg\",\"req\":\"^0.9\"},{\"kind\":\"dev\",\"name\":\"rmp-serde\",\"req\":\"^1.2.0\"},{\"default_features\":false,\"name\":\"schemars\",\"optional\":true,\"req\":\"^1.0.4\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"serde\",\"optional\":true,\"req\":\"^1.0.220\"},{\"default_features\":false,\"features\":[\"derive\"],\"kind\":\"dev\",\"name\":\"serde\",\"req\":\"^1.0.220\"},{\"kind\":\"dev\",\"name\":\"serde_json\",\"req\":\"^1.0.45\"},{\"default_features\":false,\"features\":[\"xxhash64\"],\"name\":\"twox-hash\",\"optional\":true,\"req\":\"^2.0.0\"},{\"default_features\":false,\"name\":\"yoke\",\"optional\":true,\"req\":\"^0.8.2\"},{\"default_features\":false,\"features\":[\"derive\"],\"kind\":\"dev\",\"name\":\"yoke\",\"req\":\"^0.8.2\"},{\"default_features\":false,\"name\":\"zerofrom\",\"req\":\"^0.1.6\"},{\"default_features\":false,\"name\":\"zerovec-derive\",\"optional\":true,\"req\":\"^0.11.3\"}],\"features\":{\"alloc\":[\"serde?/alloc\"],\"databake\":[\"dep:databake\"],\"derive\":[\"dep:zerovec-derive\"],\"hashmap\":[\"dep:twox-hash\",\"alloc\"],\"schemars\":[\"dep:schemars\",\"alloc\"],\"serde\":[\"dep:serde\"],\"std\":[],\"yoke\":[\"dep:yoke\"]}}",
       "zip_0.6.6": "{\"dependencies\":[{\"name\":\"aes\",\"optional\":true,\"req\":\"^0.8.2\"},{\"kind\":\"dev\",\"name\":\"bencher\",\"req\":\"^0.1.5\"},{\"name\":\"byteorder\",\"req\":\"^1.4.3\"},{\"name\":\"bzip2\",\"optional\":true,\"req\":\"^0.4.3\"},{\"name\":\"constant_time_eq\",\"optional\":true,\"req\":\"^0.1.5\"},{\"name\":\"crc32fast\",\"req\":\"^1.3.2\"},{\"name\":\"crossbeam-utils\",\"req\":\"^0.8.8\",\"target\":\"cfg(any(all(target_arch = \\\"arm\\\", target_pointer_width = \\\"32\\\"), target_arch = \\\"mips\\\", target_arch = \\\"powerpc\\\"))\"},{\"default_features\":false,\"name\":\"flate2\",\"optional\":true,\"req\":\"^1.0.23\"},{\"kind\":\"dev\",\"name\":\"getrandom\",\"req\":\"^0.2.5\"},{\"features\":[\"reset\"],\"name\":\"hmac\",\"optional\":true,\"req\":\"^0.12.1\"},{\"name\":\"pbkdf2\",\"optional\":true,\"req\":\"^0.11.0\"},{\"name\":\"sha1\",\"optional\":true,\"req\":\"^0.10.1\"},{\"default_features\":false,\"features\":[\"std\"],\"name\":\"time\",\"optional\":true,\"req\":\"^0.3.7\"},{\"features\":[\"formatting\",\"macros\"],\"kind\":\"dev\",\"name\":\"time\",\"req\":\"^0.3.7\"},{\"kind\":\"dev\",\"name\":\"walkdir\",\"req\":\"^2.3.2\"},{\"name\":\"zstd\",\"optional\":true,\"req\":\"^0.11.2\"}],\"features\":{\"aes-crypto\":[\"aes\",\"constant_time_eq\",\"hmac\",\"pbkdf2\",\"sha1\"],\"default\":[\"aes-crypto\",\"bzip2\",\"deflate\",\"time\",\"zstd\"],\"deflate\":[\"flate2/rust_backend\"],\"deflate-miniz\":[\"flate2/default\"],\"deflate-zlib\":[\"flate2/zlib\"],\"unreserved\":[]}}",
       "zip_2.4.2": "{\"dependencies\":[{\"name\":\"aes\",\"optional\":true,\"req\":\"^0.8\"},{\"kind\":\"dev\",\"name\":\"anyhow\",\"req\":\"^1.0.95\"},{\"features\":[\"derive\"],\"name\":\"arbitrary\",\"req\":\"^1.4.1\",\"target\":\"cfg(fuzzing)\"},{\"kind\":\"dev\",\"name\":\"bencher\",\"req\":\"^0.1.5\"},{\"name\":\"bzip2\",\"optional\":true,\"req\":\"^0.5.0\"},{\"name\":\"chrono\",\"optional\":true,\"req\":\"^0.4\"},{\"features\":[\"derive\"],\"kind\":\"dev\",\"name\":\"clap\",\"req\":\"=4.4.18\"},{\"name\":\"constant_time_eq\",\"optional\":true,\"req\":\"^0.3\"},{\"name\":\"crc32fast\",\"req\":\"^1.4\"},{\"name\":\"crossbeam-utils\",\"req\":\"^0.8.21\",\"target\":\"cfg(any(all(target_arch = \\\"arm\\\", target_pointer_width = \\\"32\\\"), target_arch = \\\"mips\\\", target_arch = \\\"powerpc\\\"))\"},{\"name\":\"deflate64\",\"optional\":true,\"req\":\"^0.1.9\"},{\"default_features\":false,\"name\":\"displaydoc\",\"req\":\"^0.2\"},{\"default_features\":false,\"name\":\"flate2\",\"optional\":true,\"req\":\"^1.0\"},{\"features\":[\"wasm_js\",\"std\"],\"name\":\"getrandom\",\"optional\":true,\"req\":\"^0.3.1\"},{\"features\":[\"wasm_js\",\"std\"],\"kind\":\"dev\",\"name\":\"getrandom\",\"req\":\"^0.3.1\"},{\"features\":[\"reset\"],\"name\":\"hmac\",\"optional\":true,\"req\":\"^0.12\"},{\"name\":\"indexmap\",\"req\":\"^2\"},{\"default_features\":false,\"name\":\"lzma-rs\",\"optional\":true,\"req\":\"^0.3\"},{\"name\":\"memchr\",\"req\":\"^2.7\"},{\"default_features\":false,\"name\":\"nt-time\",\"optional\":true,\"req\":\"^0.10.6\"},{\"name\":\"pbkdf2\",\"optional\":true,\"req\":\"^0.12\"},{\"name\":\"sha1\",\"optional\":true,\"req\":\"^0.10\"},{\"kind\":\"dev\",\"name\":\"tempfile\",\"req\":\"^3.15\"},{\"name\":\"thiserror\",\"req\":\"^2\"},{\"default_features\":false,\"features\":[\"std\"],\"name\":\"time\",\"optional\":true,\"req\":\"^0.3.37\"},{\"default_features\":false,\"features\":[\"formatting\",\"macros\"],\"kind\":\"dev\",\"name\":\"time\",\"req\":\"^0.3.37\"},{\"kind\":\"dev\",\"name\":\"walkdir\",\"req\":\"^2.5\"},{\"name\":\"xz2\",\"optional\":true,\"req\":\"^0.1.7\"},{\"features\":[\"zeroize_derive\"],\"name\":\"zeroize\",\"optional\":true,\"req\":\"^1.8\"},{\"name\":\"zopfli\",\"optional\":true,\"req\":\"^0.8\"},{\"default_features\":false,\"name\":\"zstd\",\"optional\":true,\"req\":\"^0.13\"}],\"features\":{\"_all-features\":[],\"_deflate-any\":[],\"aes-crypto\":[\"aes\",\"constant_time_eq\",\"hmac\",\"pbkdf2\",\"sha1\",\"getrandom\",\"zeroize\"],\"chrono\":[\"chrono/default\"],\"default\":[\"aes-crypto\",\"bzip2\",\"deflate64\",\"deflate\",\"lzma\",\"time\",\"zstd\",\"xz\"],\"deflate\":[\"flate2/rust_backend\",\"deflate-zopfli\",\"deflate-flate2\"],\"deflate-flate2\":[\"_deflate-any\"],\"deflate-miniz\":[\"deflate\",\"deflate-flate2\"],\"deflate-zlib\":[\"flate2/zlib\",\"deflate-flate2\"],\"deflate-zlib-ng\":[\"flate2/zlib-ng\",\"deflate-flate2\"],\"deflate-zopfli\":[\"zopfli\",\"_deflate-any\"],\"lzma\":[\"lzma-rs/stream\"],\"nt-time\":[\"dep:nt-time\"],\"unreserved\":[],\"xz\":[\"dep:xz2\"]}}",
       "zlib-rs_0.6.3": "{\"dependencies\":[{\"features\":[\"derive\"],\"name\":\"arbitrary\",\"optional\":true,\"req\":\"^1.0\"},{\"kind\":\"dev\",\"name\":\"crc32fast\",\"req\":\"^1.3.2\"},{\"kind\":\"dev\",\"name\":\"memoffset\",\"req\":\"^0.9.1\"},{\"default_features\":false,\"name\":\"quickcheck\",\"optional\":true,\"req\":\"^1.0.3\"},{\"default_features\":false,\"kind\":\"dev\",\"name\":\"quickcheck\",\"req\":\"^1.0.3\"}],\"features\":{\"ZLIB_DEBUG\":[],\"__internal-api\":[],\"__internal-fuzz\":[\"arbitrary\"],\"__internal-fuzz-disable-checksum\":[],\"__internal-test\":[\"quickcheck\"],\"avx512\":[\"vpclmulqdq\"],\"c-allocator\":[],\"default\":[\"std\",\"c-allocator\"],\"rust-allocator\":[],\"std\":[\"rust-allocator\"],\"vpclmulqdq\":[]}}",
       "zmij_1.0.19": "{\"dependencies\":[{\"default_features\":false,\"kind\":\"dev\",\"name\":\"criterion\",\"req\":\"^0.8\",\"target\":\"cfg(not(miri))\"},{\"name\":\"no-panic\",\"optional\":true,\"req\":\"^0.1.36\"},{\"kind\":\"dev\",\"name\":\"num-bigint\",\"req\":\"^0.4\"},{\"kind\":\"dev\",\"name\":\"num-integer\",\"req\":\"^0.1\"},{\"kind\":\"dev\",\"name\":\"num_cpus\",\"req\":\"^1.8\"},{\"kind\":\"dev\",\"name\":\"opt-level\",\"req\":\"^1\"},{\"kind\":\"dev\",\"name\":\"rand\",\"req\":\"^0.9\"},{\"kind\":\"dev\",\"name\":\"ryu\",\"req\":\"^1\"}],\"features\":{}}",
       "zmij_1.0.21": "{\"dependencies\":[{\"default_features\":false,\"kind\":\"dev\",\"name\":\"criterion\",\"req\":\"^0.8\",\"target\":\"cfg(not(miri))\"},{\"name\":\"no-panic\",\"optional\":true,\"req\":\"^0.1.36\"},{\"kind\":\"dev\",\"name\":\"num-bigint\",\"req\":\"^0.4\"},{\"kind\":\"dev\",\"name\":\"num-integer\",\"req\":\"^0.1\"},{\"kind\":\"dev\",\"name\":\"num_cpus\",\"req\":\"^1.8\"},{\"kind\":\"dev\",\"name\":\"opt-level\",\"req\":\"^1\"},{\"kind\":\"dev\",\"name\":\"rand\",\"req\":\"^0.10\"},{\"kind\":\"dev\",\"name\":\"ryu\",\"req\":\"^1\"}],\"features\":{}}",
-      "zoneinfo64_0.2.1": "{\"dependencies\":[{\"default_features\":false,\"name\":\"calendrical_calculations\",\"req\":\"^0.2.3\"},{\"name\":\"chrono\",\"optional\":true,\"req\":\"^0.4\"},{\"kind\":\"dev\",\"name\":\"chrono-tz\",\"req\":\"^0.10.4\"},{\"default_features\":false,\"name\":\"icu_locale_core\",\"req\":\"^2.1.0\"},{\"kind\":\"dev\",\"name\":\"itertools\",\"req\":\"^0.14.0\"},{\"default_features\":false,\"features\":[\"tzdb-bundle-always\",\"std\"],\"kind\":\"dev\",\"name\":\"jiff\",\"req\":\"^0.2.15\"},{\"default_features\":false,\"name\":\"potential_utf\",\"req\":\"^0.1.3\"},{\"default_features\":false,\"name\":\"resb\",\"req\":\"^0.1.0\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"serde\",\"req\":\"^1.0.220\"}],\"features\":{\"chrono\":[\"dep:chrono\"]}}",
+      "zoneinfo64_0.3.0": "{\"dependencies\":[{\"default_features\":false,\"name\":\"calendrical_calculations\",\"req\":\"^0.2.4\"},{\"name\":\"chrono\",\"optional\":true,\"req\":\"^0.4\"},{\"kind\":\"dev\",\"name\":\"chrono-tz\",\"req\":\"^0.10.4\"},{\"default_features\":false,\"name\":\"icu_locale_core\",\"req\":\"^2.2.0\"},{\"kind\":\"dev\",\"name\":\"itertools\",\"req\":\"^0.14.0\"},{\"default_features\":false,\"features\":[\"tzdb-bundle-always\",\"std\"],\"kind\":\"dev\",\"name\":\"jiff\",\"req\":\"^0.2\"},{\"default_features\":false,\"name\":\"potential_utf\",\"req\":\"^0.1.3\"},{\"default_features\":false,\"name\":\"resb\",\"req\":\"^0.1.2\"},{\"default_features\":false,\"features\":[\"derive\"],\"name\":\"serde\",\"req\":\"^1.0.220\"}],\"features\":{\"chrono\":[\"dep:chrono\"]}}",
       "zopfli_0.8.3": "{\"dependencies\":[{\"name\":\"bumpalo\",\"req\":\"^3.19.0\"},{\"default_features\":false,\"name\":\"crc32fast\",\"optional\":true,\"req\":\"^1.5.0\"},{\"name\":\"log\",\"optional\":true,\"req\":\"^0.4.28\"},{\"kind\":\"dev\",\"name\":\"miniz_oxide\",\"req\":\"^0.8.9\"},{\"kind\":\"dev\",\"name\":\"proptest\",\"req\":\"^1.7.0\"},{\"kind\":\"dev\",\"name\":\"proptest-derive\",\"req\":\"^0.6.0\"},{\"default_features\":false,\"name\":\"simd-adler32\",\"optional\":true,\"req\":\"^0.3.7\"}],\"features\":{\"default\":[\"gzip\",\"std\",\"zlib\"],\"gzip\":[\"dep:crc32fast\"],\"nightly\":[\"crc32fast?/nightly\"],\"std\":[\"crc32fast?/std\",\"dep:log\",\"simd-adler32?/std\"],\"zlib\":[\"dep:simd-adler32\"]}}",
       "zstd-safe_5.0.2+zstd.1.5.2": "{\"dependencies\":[{\"name\":\"libc\",\"req\":\"^0.2.21\"},{\"default_features\":false,\"name\":\"zstd-sys\",\"req\":\"^2.0.1\"}],\"features\":{\"arrays\":[],\"bindgen\":[\"zstd-sys/bindgen\"],\"debug\":[\"zstd-sys/debug\"],\"default\":[\"legacy\",\"arrays\",\"zdict_builder\"],\"doc-cfg\":[],\"experimental\":[\"zstd-sys/experimental\"],\"legacy\":[\"zstd-sys/legacy\"],\"no_asm\":[\"zstd-sys/no_asm\"],\"pkg-config\":[\"zstd-sys/pkg-config\"],\"std\":[\"zstd-sys/std\"],\"thin\":[\"zstd-sys/thin\"],\"zdict_builder\":[\"zstd-sys/zdict_builder\"],\"zstdmt\":[\"zstd-sys/zstdmt\"]}}",
       "zstd-safe_7.2.4": "{\"dependencies\":[{\"default_features\":false,\"name\":\"zstd-sys\",\"req\":\"^2.0.15\"}],\"features\":{\"arrays\":[],\"bindgen\":[\"zstd-sys/bindgen\"],\"debug\":[\"zstd-sys/debug\"],\"default\":[\"legacy\",\"arrays\",\"zdict_builder\"],\"doc-cfg\":[],\"experimental\":[\"zstd-sys/experimental\"],\"fat-lto\":[\"zstd-sys/fat-lto\"],\"legacy\":[\"zstd-sys/legacy\"],\"no_asm\":[\"zstd-sys/no_asm\"],\"pkg-config\":[\"zstd-sys/pkg-config\"],\"seekable\":[\"zstd-sys/seekable\"],\"std\":[\"zstd-sys/std\"],\"thin\":[\"zstd-sys/thin\"],\"thin-lto\":[\"zstd-sys/thin-lto\"],\"zdict_builder\":[\"zstd-sys/zdict_builder\"],\"zstdmt\":[\"zstd-sys/zstdmt\"]}}",
diff --git a/codex-cli/bin/codex.js b/codex-cli/bin/codex.js
index 67ab3e2d95..475239549a 100755
--- a/codex-cli/bin/codex.js
+++ b/codex-cli/bin/codex.js
@@ -2,7 +2,7 @@
 // Unified entry point for the Codex CLI.
 
 import { spawn } from "node:child_process";
-import { existsSync } from "fs";
+import { existsSync, realpathSync } from "fs";
 import { createRequire } from "node:module";
 import path from "path";
 import { fileURLToPath } from "url";
@@ -171,6 +171,7 @@ const packageManagerEnvVar =
     ? "CODEX_MANAGED_BY_BUN"
     : "CODEX_MANAGED_BY_NPM";
 env[packageManagerEnvVar] = "1";
+env.CODEX_MANAGED_PACKAGE_ROOT = realpathSync(path.join(__dirname, ".."));
 
 const child = spawn(binaryPath, process.argv.slice(2), {
   stdio: "inherit",
diff --git a/codex-rs/.cargo/config.toml b/codex-rs/.cargo/config.toml
index 5d5eb8fd6f..8a6f2c11ee 100644
--- a/codex-rs/.cargo/config.toml
+++ b/codex-rs/.cargo/config.toml
@@ -1,5 +1,5 @@
 [target.'cfg(all(windows, target_env = "msvc"))']
-rustflags = ["-C", "link-arg=/STACK:8388608"]
+rustflags = ["-C", "link-arg=/STACK:8388608", "-C", "target-feature=+crt-static"]
 
 # MSVC emits a warning about code that may trip "Cortex-A53 MPCore processor bug #843419" (see
 # https://developer.arm.com/documentation/epm048406/latest) which is sometimes emitted by LLVM.
diff --git a/codex-rs/.config/nextest.toml b/codex-rs/.config/nextest.toml
index 86d00e4637..399caae16a 100644
--- a/codex-rs/.config/nextest.toml
+++ b/codex-rs/.config/nextest.toml
@@ -1,6 +1,10 @@
 [profile.default]
-# Do not increase, fix your test instead
+# Retry once so one transient failure does not fail full-CI outright.
 slow-timeout = { period = "15s", terminate-after = 2 }
+retries = 1
+
+[profile.default.junit]
+path = "junit.xml"
 
 [test-groups.app_server_protocol_codegen]
 max-threads = 1
@@ -14,6 +18,9 @@ max-threads = 1
 [test-groups.windows_sandbox_legacy_sessions]
 max-threads = 1
 
+[test-groups.windows_process_heavy]
+max-threads = 2
+
 [[profile.default.overrides]]
 # Do not add new tests here
 filter = 'test(rmcp_client) | test(humanlike_typing_1000_chars_appears_live_no_placeholder)'
@@ -44,3 +51,18 @@ test-group = 'core_apply_patch_cli_integration'
 # Serialize them to avoid exhausting Windows session/global desktop resources in CI.
 filter = 'package(codex-windows-sandbox) & test(legacy_)'
 test-group = 'windows_sandbox_legacy_sessions'
+
+[[profile.default.overrides]]
+# This Codex-home startup path still exceeded the broader Windows-heavy ceiling
+# in both Windows full-CI lanes after contention was reduced.
+platform = 'cfg(windows)'
+filter = 'test(start_thread_uses_all_default_environments_from_codex_home)'
+slow-timeout = { period = "1m", terminate-after = 2 }
+
+[[profile.default.overrides]]
+# These Windows-heavy tests spawn subprocesses, session files, or JSON-RPC
+# clients and have been the dominant source of 30s full-CI timeouts.
+platform = 'cfg(windows)'
+filter = 'test(suite::resume::) | test(suite::cli_stream::) | test(suite::auth_env::) | test(start_thread_uses_all_default_environments_from_codex_home) | test(connect_stdio_command_initializes_json_rpc_client_on_windows)'
+test-group = 'windows_process_heavy'
+slow-timeout = { period = "45s", terminate-after = 2 }
diff --git a/codex-rs/Cargo.lock b/codex-rs/Cargo.lock
index 4a23797cc3..1950939e65 100644
--- a/codex-rs/Cargo.lock
+++ b/codex-rs/Cargo.lock
@@ -1518,9 +1518,9 @@ checksum = "ade8366b8bd5ba243f0a58f036cc0ca8a2f069cff1a2351ef1cac6b083e16fc0"
 
 [[package]]
 name = "calendrical_calculations"
-version = "0.2.3"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3a0b39595c6ee54a8d0900204ba4c401d0ab4eb45adaf07178e8d017541529e7"
+checksum = "5abbd6eeda6885048d357edc66748eea6e0268e3dd11f326fff5bd248d779c26"
 dependencies = [
  "core_maths",
  "displaydoc",
@@ -1902,12 +1902,12 @@ dependencies = [
  "codex-feedback",
  "codex-file-search",
  "codex-file-watcher",
- "codex-git-attribution",
  "codex-git-utils",
  "codex-guardian",
  "codex-hooks",
  "codex-login",
  "codex-mcp",
+ "codex-memories-extension",
  "codex-memories-write",
  "codex-model-provider",
  "codex-model-provider-info",
@@ -2221,6 +2221,7 @@ dependencies = [
  "assert_matches",
  "clap",
  "clap_complete",
+ "codex-api",
  "codex-app-server",
  "codex-app-server-daemon",
  "codex-app-server-protocol",
@@ -2235,11 +2236,14 @@ dependencies = [
  "codex-exec-server",
  "codex-execpolicy",
  "codex-features",
+ "codex-install-context",
  "codex-login",
  "codex-mcp",
  "codex-mcp-server",
  "codex-memories-write",
+ "codex-model-provider",
  "codex-models-manager",
+ "codex-plugin",
  "codex-protocol",
  "codex-responses-api-proxy",
  "codex-rmcp-client",
@@ -2254,11 +2258,14 @@ dependencies = [
  "codex-utils-cli",
  "codex-utils-path",
  "codex-windows-sandbox",
+ "crossterm",
+ "http 1.4.0",
  "libc",
  "owo-colors",
  "predicates",
  "pretty_assertions",
  "regex-lite",
+ "serde",
  "serde_json",
  "sqlx",
  "supports-color 3.0.2",
@@ -2432,6 +2439,7 @@ dependencies = [
  "prost 0.14.3",
  "schemars 0.8.22",
  "serde",
+ "serde_ignored",
  "serde_json",
  "serde_path_to_error",
  "sha2",
@@ -2628,6 +2636,7 @@ dependencies = [
  "libc",
  "pretty_assertions",
  "reqwest",
+ "semver",
  "serde",
  "serde_json",
  "tar",
@@ -2708,6 +2717,7 @@ dependencies = [
  "codex-utils-cargo-bin",
  "codex-utils-cli",
  "codex-utils-oss",
+ "codex-utils-sandbox-summary",
  "core_test_support",
  "libc",
  "opentelemetry",
@@ -2739,6 +2749,7 @@ dependencies = [
  "axum",
  "base64 0.22.1",
  "bytes",
+ "codex-api",
  "codex-app-server-protocol",
  "codex-client",
  "codex-file-system",
@@ -2750,6 +2761,7 @@ dependencies = [
  "codex-utils-rustls-provider",
  "ctor 0.6.3",
  "futures",
+ "http 1.4.0",
  "pretty_assertions",
  "prost 0.14.3",
  "reqwest",
@@ -2818,6 +2830,7 @@ dependencies = [
 name = "codex-extension-api"
 version = "0.0.0"
 dependencies = [
+ "async-trait",
  "codex-protocol",
  "codex-tools",
 ]
@@ -2911,16 +2924,6 @@ dependencies = [
  "tracing",
 ]
 
-[[package]]
-name = "codex-git-attribution"
-version = "0.0.0"
-dependencies = [
- "codex-core",
- "codex-extension-api",
- "codex-features",
- "pretty_assertions",
-]
-
 [[package]]
 name = "codex-git-utils"
 version = "0.0.0"
@@ -2945,10 +2948,23 @@ dependencies = [
  "walkdir",
 ]
 
+[[package]]
+name = "codex-goal-extension"
+version = "0.0.0"
+dependencies = [
+ "async-trait",
+ "codex-extension-api",
+ "codex-protocol",
+ "codex-tools",
+ "serde",
+ "serde_json",
+]
+
 [[package]]
 name = "codex-guardian"
 version = "0.0.0"
 dependencies = [
+ "async-trait",
  "codex-core",
  "codex-extension-api",
  "codex-protocol",
@@ -3141,6 +3157,7 @@ dependencies = [
 name = "codex-memories-extension"
 version = "0.0.0"
 dependencies = [
+ "async-trait",
  "codex-core",
  "codex-extension-api",
  "codex-features",
@@ -3481,6 +3498,7 @@ version = "0.0.0"
 dependencies = [
  "anyhow",
  "axum",
+ "base64 0.22.1",
  "bytes",
  "codex-api",
  "codex-client",
@@ -3732,6 +3750,7 @@ dependencies = [
 name = "codex-tools"
 version = "0.0.0"
 dependencies = [
+ "async-trait",
  "codex-app-server-protocol",
  "codex-code-mode",
  "codex-features",
@@ -3785,6 +3804,7 @@ dependencies = [
  "codex-protocol",
  "codex-realtime-webrtc",
  "codex-rollout",
+ "codex-sandboxing",
  "codex-shell-command",
  "codex-state",
  "codex-terminal-detection",
@@ -3794,10 +3814,10 @@ dependencies = [
  "codex-utils-cli",
  "codex-utils-elapsed",
  "codex-utils-fuzzy-match",
+ "codex-utils-home-dir",
  "codex-utils-oss",
  "codex-utils-path",
  "codex-utils-plugins",
- "codex-utils-pty",
  "codex-utils-sandbox-summary",
  "codex-utils-sleep-inhibitor",
  "codex-utils-string",
@@ -3914,6 +3934,7 @@ version = "0.0.0"
 dependencies = [
  "clap",
  "codex-protocol",
+ "codex-shell-command",
  "pretty_assertions",
  "serde",
  "toml 0.9.11+spec-1.1.0",
@@ -5078,9 +5099,9 @@ dependencies = [
 
 [[package]]
 name = "diplomat"
-version = "0.14.0"
+version = "0.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "9adb46b05e2f53dcf6a7dfc242e4ce9eb60c369b6b6eb10826a01e93167f59c6"
+checksum = "7935649d00000f5c5d735448ad3dc07b9738160727017914cf42138b8e8e6611"
 dependencies = [
  "diplomat_core",
  "proc-macro2",
@@ -5090,15 +5111,15 @@ dependencies = [
 
 [[package]]
 name = "diplomat-runtime"
-version = "0.14.0"
+version = "0.15.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "0569bd3caaf13829da7ee4e83dbf9197a0e1ecd72772da6d08f0b4c9285c8d29"
+checksum = "970ac38ad677632efcee6d517e783958da9bc78ec206d8d5e35b459ffc5e4864"
 
 [[package]]
 name = "diplomat_core"
-version = "0.14.0"
+version = "0.15.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "51731530ed7f2d4495019abc7df3744f53338e69e2863a6a64ae91821c763df1"
+checksum = "9cf41b94101a4bce993febaf0098092b0bb31deaf0ecaf6e0a2562465f61b383"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -5454,7 +5475,7 @@ source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "39cab71617ae0d63f51a36d69f866391735b51691dbda63cf6f96d042b63efeb"
 dependencies = [
  "libc",
- "windows-sys 0.61.2",
+ "windows-sys 0.52.0",
 ]
 
 [[package]]
@@ -5642,9 +5663,9 @@ dependencies = [
 
 [[package]]
 name = "fixed_decimal"
-version = "0.7.1"
+version = "0.7.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "35eabf480f94d69182677e37571d3be065822acfafd12f2f085db44fbbcc8e57"
+checksum = "79c3c892f121fff406e5dd6b28c1b30096b95111c30701a899d4f2b18da6d1bd"
 dependencies = [
  "displaydoc",
  "smallvec",
@@ -7487,9 +7508,9 @@ dependencies = [
 
 [[package]]
 name = "icu_calendar"
-version = "2.1.1"
+version = "2.2.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d6f0e52e009b6b16ba9c0693578796f2dd4aaa59a7f8f920423706714a89ac4e"
+checksum = "a2b2acc6263f494f1df50685b53ff8e57869e47d5c6fe39c23d518ae9a4f3e45"
 dependencies = [
  "calendrical_calculations",
  "displaydoc",
@@ -7503,18 +7524,19 @@ dependencies = [
 
 [[package]]
 name = "icu_calendar_data"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "527f04223b17edfe0bd43baf14a0cb1b017830db65f3950dc00224860a9a446d"
+checksum = "118577bcf3a0fa7c6ac0a7d6e951814da84ee56b9b1f68fb4d8d10b08cefaf4d"
 
 [[package]]
 name = "icu_collections"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "4c6b649701667bbe825c3b7e6388cb521c23d88644678e83c0c4d0a621a34b43"
+checksum = "2984d1cd16c883d7935b9e07e44071dca8d917fd52ecc02c04d5fa0b5a3f191c"
 dependencies = [
  "displaydoc",
  "potential_utf",
+ "utf8_iter",
  "yoke",
  "zerofrom",
  "zerovec",
@@ -7522,14 +7544,16 @@ dependencies = [
 
 [[package]]
 name = "icu_decimal"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a38c52231bc348f9b982c1868a2af3195199623007ba2c7650f432038f5b3e8e"
+checksum = "288247df2e32aa776ac54fdd64de552149ac43cb840f2761811f0e8d09719dd4"
 dependencies = [
+ "displaydoc",
  "fixed_decimal",
  "icu_decimal_data",
  "icu_locale",
  "icu_locale_core",
+ "icu_plurals",
  "icu_provider",
  "writeable",
  "zerovec",
@@ -7537,15 +7561,15 @@ dependencies = [
 
 [[package]]
 name = "icu_decimal_data"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2905b4044eab2dd848fe84199f9195567b63ab3a93094711501363f63546fef7"
+checksum = "6f14a5ca9e8af29eef62064f269078424283d90dbaffeac5225addf62aaabc22"
 
 [[package]]
 name = "icu_locale"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "532b11722e350ab6bf916ba6eb0efe3ee54b932666afec989465f9243fe6dd60"
+checksum = "d5a396343c7208121dc86e35623d3dfe19814a7613cfd14964994cdc9c9a2e26"
 dependencies = [
  "icu_collections",
  "icu_locale_core",
@@ -7558,9 +7582,9 @@ dependencies = [
 
 [[package]]
 name = "icu_locale_core"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "edba7861004dd3714265b4db54a3c390e880ab658fec5f7db895fae2046b5bb6"
+checksum = "92219b62b3e2b4d88ac5119f8904c10f8f61bf7e95b640d25ba3075e6cac2c29"
 dependencies = [
  "displaydoc",
  "litemap",
@@ -7572,15 +7596,15 @@ dependencies = [
 
 [[package]]
 name = "icu_locale_data"
-version = "2.1.2"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "1c5f1d16b4c3a2642d3a719f18f6b06070ab0aef246a6418130c955ae08aa831"
+checksum = "d5fdcc9ac77c6d74ff5cf6e65ef3181d6af32003b16fce3a77fb451d2f695993"
 
 [[package]]
 name = "icu_normalizer"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "5f6c8828b67bf8908d82127b2054ea1b4427ff0230ee9141c54251934ab1b599"
+checksum = "c56e5ee99d6e3d33bd91c5d85458b6005a22140021cc324cea84dd0e72cff3b4"
 dependencies = [
  "icu_collections",
  "icu_normalizer_data",
@@ -7592,15 +7616,34 @@ dependencies = [
 
 [[package]]
 name = "icu_normalizer_data"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7aedcccd01fc5fe81e6b489c15b247b8b0690feb23304303a9e560f37efc560a"
+checksum = "da3be0ae77ea334f4da67c12f149704f19f81d1adf7c51cf482943e84a2bad38"
+
+[[package]]
+name = "icu_plurals"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "2a50023f1d49ad5c4333380328a0d4a19e4b9d6d842ec06639affd5ba47c8103"
+dependencies = [
+ "fixed_decimal",
+ "icu_locale",
+ "icu_plurals_data",
+ "icu_provider",
+ "zerovec",
+]
+
+[[package]]
+name = "icu_plurals_data"
+version = "2.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "8485497155dc865f901decb93ecc20d3e467df67bfeceb91e3ba34e2b11e8e1d"
 
 [[package]]
 name = "icu_properties"
-version = "2.1.2"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "020bfc02fe870ec3a66d93e677ccca0562506e5872c650f893269e08615d74ec"
+checksum = "bee3b67d0ea5c2cca5003417989af8996f8604e34fb9ddf96208a033901e70de"
 dependencies = [
  "icu_collections",
  "icu_locale_core",
@@ -7612,15 +7655,15 @@ dependencies = [
 
 [[package]]
 name = "icu_properties_data"
-version = "2.1.2"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "616c294cf8d725c6afcd8f55abc17c56464ef6211f9ed59cccffe534129c77af"
+checksum = "8e2bbb201e0c04f7b4b3e14382af113e17ba4f63e2c9d2ee626b720cbce54a14"
 
 [[package]]
 name = "icu_provider"
-version = "2.1.1"
+version = "2.2.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "85962cf0ce02e1e0a629cc34e7ca3e373ce20dda4c4d7294bbd0bf1fdb59e614"
+checksum = "139c4cf31c8b5f33d7e199446eff9c1e02decfc2f0eec2c8d71f65befa45b421"
 dependencies = [
  "displaydoc",
  "icu_locale_core",
@@ -10875,9 +10918,9 @@ dependencies = [
 
 [[package]]
 name = "resb"
-version = "0.1.1"
+version = "0.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6a067ab3b5ca3b4dc307d0de9cf75f9f5e6ca9717b192b2f28a36c83e5de9e76"
+checksum = "22d392791f3c6802a1905a509e9d1a6039cbbcb5e9e00e5a6d3661f7c874f390"
 dependencies = [
  "potential_utf",
  "serde_core",
@@ -11641,6 +11684,16 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "serde_ignored"
+version = "0.1.14"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "115dffd5f3853e06e746965a20dcbae6ee747ae30b543d91b0e089668bb07798"
+dependencies = [
+ "serde",
+ "serde_core",
+]
+
 [[package]]
 name = "serde_json"
 version = "1.0.149"
@@ -12594,14 +12647,14 @@ dependencies = [
 
 [[package]]
 name = "temporal_capi"
-version = "0.1.2"
+version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "a151e402c2bdb6a3a2a2f3f225eddaead2e7ce7dd5d3fa2090deb11b17aa4ed8"
+checksum = "8a2a1f001e756a9f5f2d175a9965c4c0b3a054f09f30de3a75ab49765f2deb36"
 dependencies = [
  "diplomat",
  "diplomat-runtime",
  "icu_calendar",
- "icu_locale",
+ "icu_locale_core",
  "num-traits",
  "temporal_rs",
  "timezone_provider",
@@ -12611,13 +12664,14 @@ dependencies = [
 
 [[package]]
 name = "temporal_rs"
-version = "0.1.2"
+version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "88afde3bd75d2fc68d77a914bece426aa08aa7649ffd0cdd4a11c3d4d33474d1"
+checksum = "9a902a45282e5175186b21d355efc92564601efe6e2d92818dc9e333d50bd4de"
 dependencies = [
+ "calendrical_calculations",
  "core_maths",
  "icu_calendar",
- "icu_locale",
+ "icu_locale_core",
  "ixdtf",
  "num-traits",
  "timezone_provider",
@@ -12834,9 +12888,9 @@ dependencies = [
 
 [[package]]
 name = "timezone_provider"
-version = "0.1.2"
+version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "df9ba0000e9e73862f3e7ca1ff159e2ddf915c9d8bb11e38a7874760f445d993"
+checksum = "c48f9b04628a2b813051e4dfe97c65281e49625eabd09ec343190e31e399a8c2"
 dependencies = [
  "tinystr",
  "zerotrie",
@@ -12867,9 +12921,9 @@ dependencies = [
 
 [[package]]
 name = "tinystr"
-version = "0.8.2"
+version = "0.8.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "42d3e9c45c09de15d06dd8acf5f4e0e399e85927b7f00711024eb7ae10fa4869"
+checksum = "c8323304221c2a851516f22236c5722a72eaa19749016521d6dff0824447d96d"
 dependencies = [
  "displaydoc",
  "serde_core",
@@ -13683,9 +13737,9 @@ dependencies = [
 
 [[package]]
 name = "v8"
-version = "146.4.0"
+version = "147.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "d97bcac5cdc5a195a4813f1855a6bc658f240452aac36caa12fd6c6f16026ab1"
+checksum = "2df8fffd507fb18ed000673a83d937f58e60fb07f3306b2274284125b15137cd"
 dependencies = [
  "bindgen",
  "bitflags 2.10.0",
@@ -14835,9 +14889,9 @@ dependencies = [
 
 [[package]]
 name = "yoke"
-version = "0.8.1"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "72d6e5c6afb84d73944e5cedb052c4680d5657337201555f9f2a16b7406d4954"
+checksum = "abe8c5fda708d9ca3df187cae8bfb9ceda00dd96231bed36e445a1a48e66f9ca"
 dependencies = [
  "stable_deref_trait",
  "yoke-derive",
@@ -14846,9 +14900,9 @@ dependencies = [
 
 [[package]]
 name = "yoke-derive"
-version = "0.8.1"
+version = "0.8.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b659052874eb698efe5b9e8cf382204678a0086ebf46982b79d6ca3182927e5d"
+checksum = "de844c262c8848816172cef550288e7dc6c7b7814b4ee56b3e1553f275f1858e"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -14981,20 +15035,21 @@ dependencies = [
 
 [[package]]
 name = "zerotrie"
-version = "0.2.3"
+version = "0.2.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2a59c17a5562d507e4b54960e8569ebee33bee890c70aa3fe7b97e85a9fd7851"
+checksum = "0f9152d31db0792fa83f70fb2f83148effb5c1f5b8c7686c3459e361d9bc20bf"
 dependencies = [
  "displaydoc",
  "yoke",
  "zerofrom",
+ "zerovec",
 ]
 
 [[package]]
 name = "zerovec"
-version = "0.11.5"
+version = "0.11.6"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "6c28719294829477f525be0186d13efa9a3c602f7ec202ca9e353d310fb9a002"
+checksum = "90f911cbc359ab6af17377d242225f4d75119aec87ea711a880987b18cd7b239"
 dependencies = [
  "serde",
  "yoke",
@@ -15004,9 +15059,9 @@ dependencies = [
 
 [[package]]
 name = "zerovec-derive"
-version = "0.11.2"
+version = "0.11.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "eadce39539ca5cb3985590102671f2567e659fca9666581ad3411d59207951f3"
+checksum = "625dc425cab0dca6dc3c3319506e6593dcb08a9f387ea3b284dbd52a92c40555"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -15077,9 +15132,9 @@ checksum = "3ff05f8caa9038894637571ae6b9e29466c1f4f829d26c9b28f869a29cbe3445"
 
 [[package]]
 name = "zoneinfo64"
-version = "0.2.1"
+version = "0.3.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "bb2e5597efbe7c421da8a7fd396b20b571704e787c21a272eecf35dfe9d386f0"
+checksum = "ed6eb2607e906160c457fd573e9297e65029669906b9ac8fb1b5cd5e055f0705"
 dependencies = [
  "calendrical_calculations",
  "icu_locale_core",
diff --git a/codex-rs/Cargo.toml b/codex-rs/Cargo.toml
index bd0bcec66a..ec38a87cff 100644
--- a/codex-rs/Cargo.toml
+++ b/codex-rs/Cargo.toml
@@ -45,8 +45,8 @@ members = [
     "execpolicy",
     "execpolicy-legacy",
     "ext/extension-api",
+    "ext/goal",
     "ext/guardian",
-    "ext/git-attribution",
     "ext/memories",
     "external-agent-migration",
     "external-agent-sessions",
@@ -163,8 +163,8 @@ codex-file-system = { path = "file-system" }
 codex-exec-server = { path = "exec-server" }
 codex-execpolicy = { path = "execpolicy" }
 codex-extension-api = { path = "ext/extension-api" }
+codex-goal-extension = { path = "ext/goal" }
 codex-guardian = { path = "ext/guardian" }
-codex-git-attribution = { path = "ext/git-attribution" }
 codex-external-agent-migration = { path = "external-agent-migration" }
 codex-external-agent-sessions = { path = "external-agent-sessions" }
 codex-experimental-api-macros = { path = "codex-experimental-api-macros" }
@@ -352,6 +352,7 @@ seccompiler = "0.5.0"
 semver = "1.0"
 sentry = "0.46.0"
 serde = "1"
+serde_ignored = "0.1.14"
 serde_json = "1"
 serde_path_to_error = "0.1.20"
 serde_with = "3.17"
@@ -412,7 +413,7 @@ unicode-width = "0.2"
 url = "2"
 urlencoding = "2.1"
 uuid = "1"
-v8 = "=146.4.0"
+v8 = "=147.4.0"
 vt100 = "0.16.2"
 walkdir = "2.5.0"
 webbrowser = "1.0"
@@ -471,7 +472,7 @@ unwrap_used = "deny"
 [workspace.metadata.cargo-shear]
 ignored = [
     "codex-agent-graph-store",
-    "codex-memories-extension",
+    "codex-goal-extension",
     "icu_provider",
     "openssl-sys",
     "codex-v8-poc",
diff --git a/codex-rs/analytics/src/analytics_client_tests.rs b/codex-rs/analytics/src/analytics_client_tests.rs
index 5b4a72229b..c744eb3f6e 100644
--- a/codex-rs/analytics/src/analytics_client_tests.rs
+++ b/codex-rs/analytics/src/analytics_client_tests.rs
@@ -138,7 +138,6 @@ use codex_protocol::protocol::AskForApproval;
 use codex_protocol::protocol::HookEventName;
 use codex_protocol::protocol::HookRunStatus;
 use codex_protocol::protocol::HookSource;
-use codex_protocol::protocol::SandboxPolicy;
 use codex_protocol::protocol::SessionSource;
 use codex_protocol::protocol::SubAgentSource;
 use codex_protocol::protocol::ThreadSource;
@@ -201,11 +200,11 @@ fn sample_thread_start_response(
         model_provider: "openai".to_string(),
         service_tier: None,
         cwd: test_path_buf("/tmp").abs(),
+        runtime_workspace_roots: Vec::new(),
         instruction_sources: Vec::new(),
         approval_policy: AppServerAskForApproval::OnFailure,
         approvals_reviewer: AppServerApprovalsReviewer::User,
         sandbox: AppServerSandboxPolicy::DangerFullAccess,
-        permission_profile: None,
         active_permission_profile: None,
         reasoning_effort: None,
     })
@@ -257,11 +256,11 @@ fn sample_thread_resume_response_with_source(
         model_provider: "openai".to_string(),
         service_tier: None,
         cwd: test_path_buf("/tmp").abs(),
+        runtime_workspace_roots: Vec::new(),
         instruction_sources: Vec::new(),
         approval_policy: AppServerAskForApproval::OnFailure,
         approvals_reviewer: AppServerApprovalsReviewer::User,
         sandbox: AppServerSandboxPolicy::DangerFullAccess,
-        permission_profile: None,
         active_permission_profile: None,
         reasoning_effort: None,
     })
@@ -279,6 +278,7 @@ fn sample_turn_start_request(thread_id: &str, request_id: i64) -> ClientRequest
                 },
                 UserInput::Image {
                     url: "https://example.com/a.png".to_string(),
+                    detail: None,
                 },
             ],
             ..Default::default()
@@ -366,9 +366,7 @@ fn sample_turn_resolved_config(thread_id: &str, turn_id: &str) -> TurnResolvedCo
         session_source: SessionSource::Exec,
         model: "gpt-5".to_string(),
         model_provider: "openai".to_string(),
-        permission_profile: CorePermissionProfile::from_legacy_sandbox_policy(
-            &SandboxPolicy::new_read_only_policy(),
-        ),
+        permission_profile: CorePermissionProfile::read_only(),
         permission_profile_cwd: PathBuf::from("/tmp"),
         reasoning_effort: None,
         reasoning_summary: None,
@@ -399,6 +397,7 @@ fn sample_turn_steer_request(
                 },
                 UserInput::LocalImage {
                     path: "/tmp/a.png".into(),
+                    detail: None,
                 },
             ],
             responsesapi_client_metadata: None,
diff --git a/codex-rs/analytics/src/client_tests.rs b/codex-rs/analytics/src/client_tests.rs
index 71c46d808a..bfb224d899 100644
--- a/codex-rs/analytics/src/client_tests.rs
+++ b/codex-rs/analytics/src/client_tests.rs
@@ -12,7 +12,6 @@ use codex_app_server_protocol::ApprovalsReviewer as AppServerApprovalsReviewer;
 use codex_app_server_protocol::AskForApproval as AppServerAskForApproval;
 use codex_app_server_protocol::ClientRequest;
 use codex_app_server_protocol::ClientResponsePayload;
-use codex_app_server_protocol::PermissionProfile as AppServerPermissionProfile;
 use codex_app_server_protocol::RequestId;
 use codex_app_server_protocol::SandboxPolicy as AppServerSandboxPolicy;
 use codex_app_server_protocol::SessionSource as AppServerSessionSource;
@@ -29,7 +28,6 @@ use codex_app_server_protocol::TurnStartResponse;
 use codex_app_server_protocol::TurnStatus as AppServerTurnStatus;
 use codex_app_server_protocol::TurnSteerParams;
 use codex_app_server_protocol::TurnSteerResponse;
-use codex_protocol::models::PermissionProfile as CorePermissionProfile;
 use codex_utils_absolute_path::test_support::PathBufExt;
 use codex_utils_absolute_path::test_support::test_path_buf;
 use std::collections::HashSet;
@@ -142,10 +140,6 @@ fn sample_thread(thread_id: &str) -> Thread {
     }
 }
 
-fn sample_permission_profile() -> AppServerPermissionProfile {
-    CorePermissionProfile::Disabled.into()
-}
-
 fn sample_thread_start_response() -> ClientResponsePayload {
     ClientResponsePayload::ThreadStart(ThreadStartResponse {
         thread: sample_thread("thread-1"),
@@ -153,11 +147,11 @@ fn sample_thread_start_response() -> ClientResponsePayload {
         model_provider: "openai".to_string(),
         service_tier: None,
         cwd: test_path_buf("/tmp").abs(),
+        runtime_workspace_roots: Vec::new(),
         instruction_sources: Vec::new(),
         approval_policy: AppServerAskForApproval::OnFailure,
         approvals_reviewer: AppServerApprovalsReviewer::User,
         sandbox: AppServerSandboxPolicy::DangerFullAccess,
-        permission_profile: Some(sample_permission_profile()),
         active_permission_profile: None,
         reasoning_effort: None,
     })
@@ -170,11 +164,11 @@ fn sample_thread_resume_response() -> ClientResponsePayload {
         model_provider: "openai".to_string(),
         service_tier: None,
         cwd: test_path_buf("/tmp").abs(),
+        runtime_workspace_roots: Vec::new(),
         instruction_sources: Vec::new(),
         approval_policy: AppServerAskForApproval::OnFailure,
         approvals_reviewer: AppServerApprovalsReviewer::User,
         sandbox: AppServerSandboxPolicy::DangerFullAccess,
-        permission_profile: Some(sample_permission_profile()),
         active_permission_profile: None,
         reasoning_effort: None,
     })
@@ -187,11 +181,11 @@ fn sample_thread_fork_response() -> ClientResponsePayload {
         model_provider: "openai".to_string(),
         service_tier: None,
         cwd: test_path_buf("/tmp").abs(),
+        runtime_workspace_roots: Vec::new(),
         instruction_sources: Vec::new(),
         approval_policy: AppServerAskForApproval::OnFailure,
         approvals_reviewer: AppServerApprovalsReviewer::User,
         sandbox: AppServerSandboxPolicy::DangerFullAccess,
-        permission_profile: Some(sample_permission_profile()),
         active_permission_profile: None,
         reasoning_effort: None,
     })
diff --git a/codex-rs/analytics/src/events.rs b/codex-rs/analytics/src/events.rs
index d107a5a367..f7c64e0e74 100644
--- a/codex-rs/analytics/src/events.rs
+++ b/codex-rs/analytics/src/events.rs
@@ -990,6 +990,7 @@ fn analytics_hook_event_name(event_name: HookEventName) -> &'static str {
         HookEventName::PostCompact => "PostCompact",
         HookEventName::SessionStart => "SessionStart",
         HookEventName::UserPromptSubmit => "UserPromptSubmit",
+        HookEventName::SubagentStart => "SubagentStart",
         HookEventName::Stop => "Stop",
     }
 }
diff --git a/codex-rs/app-server-client/src/lib.rs b/codex-rs/app-server-client/src/lib.rs
index cd5dcf6649..c7f5b9889a 100644
--- a/codex-rs/app-server-client/src/lib.rs
+++ b/codex-rs/app-server-client/src/lib.rs
@@ -336,6 +336,8 @@ pub struct InProcessClientStartArgs {
     pub cli_overrides: Vec<(String, TomlValue)>,
     /// Loader override knobs used by config API paths.
     pub loader_overrides: LoaderOverrides,
+    /// Whether config API paths should reject unknown config fields.
+    pub strict_config: bool,
     /// Preloaded cloud requirements provider.
     pub cloud_requirements: CloudRequirementsLoader,
     /// Feedback sink used by app-server/core telemetry and logs.
@@ -402,6 +404,7 @@ impl InProcessClientStartArgs {
             config: self.config,
             cli_overrides: self.cli_overrides,
             loader_overrides: self.loader_overrides,
+            strict_config: self.strict_config,
             cloud_requirements: self.cloud_requirements,
             thread_config_loader,
             feedback: self.feedback,
@@ -1030,6 +1033,7 @@ mod tests {
             config,
             cli_overrides: Vec::new(),
             loader_overrides: LoaderOverrides::default(),
+            strict_config: false,
             cloud_requirements: CloudRequirementsLoader::default(),
             feedback: CodexFeedback::new(),
             log_db: None,
@@ -2174,11 +2178,13 @@ mod tests {
         let environment_manager = Arc::new(
             EnvironmentManager::create_for_tests(
                 Some("ws://127.0.0.1:8765".to_string()),
-                ExecServerRuntimePaths::new(
-                    std::env::current_exe().expect("current exe"),
-                    /*codex_linux_sandbox_exe*/ None,
-                )
-                .expect("runtime paths"),
+                Some(
+                    ExecServerRuntimePaths::new(
+                        std::env::current_exe().expect("current exe"),
+                        /*codex_linux_sandbox_exe*/ None,
+                    )
+                    .expect("runtime paths"),
+                ),
             )
             .await,
         );
@@ -2188,6 +2194,7 @@ mod tests {
             config: config.clone(),
             cli_overrides: Vec::new(),
             loader_overrides: LoaderOverrides::default(),
+            strict_config: false,
             cloud_requirements: CloudRequirementsLoader::default(),
             feedback: CodexFeedback::new(),
             log_db: None,
@@ -2228,6 +2235,7 @@ mod tests {
             config: Arc::new(config),
             cli_overrides: Vec::new(),
             loader_overrides: LoaderOverrides::default(),
+            strict_config: false,
             cloud_requirements: CloudRequirementsLoader::default(),
             feedback: CodexFeedback::new(),
             log_db: None,
diff --git a/codex-rs/app-server-daemon/src/backend/mod.rs b/codex-rs/app-server-daemon/src/backend/mod.rs
index 5e92dd5261..d40df07a0e 100644
--- a/codex-rs/app-server-daemon/src/backend/mod.rs
+++ b/codex-rs/app-server-daemon/src/backend/mod.rs
@@ -1,5 +1,6 @@
 mod pid;
 
+use std::path::Path;
 use std::path::PathBuf;
 
 use serde::Serialize;
@@ -31,3 +32,15 @@ pub(crate) fn pid_backend(paths: BackendPaths) -> PidBackend {
 pub(crate) fn pid_update_loop_backend(paths: BackendPaths) -> PidBackend {
     PidBackend::new_update_loop(paths.codex_bin, paths.update_pid_file)
 }
+
+pub(crate) async fn append_stderr_log_tail_context(pid_file: &Path, context: &mut String) {
+    match pid::read_stderr_log_tail(pid_file).await {
+        Ok(Some(tail)) => tail.append_to_context(context),
+        Ok(None) => {}
+        Err(err) => {
+            context.push_str(&format!(
+                "\n\nFailed to read managed app-server stderr log: {err:#}"
+            ));
+        }
+    }
+}
diff --git a/codex-rs/app-server-daemon/src/backend/pid.rs b/codex-rs/app-server-daemon/src/backend/pid.rs
index 7f8aa1660d..f5f4fc5b66 100644
--- a/codex-rs/app-server-daemon/src/backend/pid.rs
+++ b/codex-rs/app-server-daemon/src/backend/pid.rs
@@ -1,3 +1,4 @@
+use std::io::SeekFrom;
 use std::path::Path;
 use std::path::PathBuf;
 #[cfg(unix)]
@@ -10,6 +11,8 @@ use anyhow::bail;
 use serde::Deserialize;
 use serde::Serialize;
 use tokio::fs;
+use tokio::io::AsyncReadExt;
+use tokio::io::AsyncSeekExt;
 #[cfg(unix)]
 use tokio::process::Command;
 use tokio::time::sleep;
@@ -18,6 +21,7 @@ const STOP_POLL_INTERVAL: Duration = Duration::from_millis(50);
 const STOP_GRACE_PERIOD: Duration = Duration::from_secs(60);
 const STOP_TIMEOUT: Duration = Duration::from_secs(70);
 const START_TIMEOUT: Duration = Duration::from_secs(10);
+const STDERR_LOG_TAIL_BYTES: u64 = 4096;
 
 #[derive(Debug)]
 #[cfg_attr(not(unix), allow(dead_code))]
@@ -35,6 +39,25 @@ struct PidRecord {
     process_start_time: String,
 }
 
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct PidLogTail {
+    pub(crate) path: PathBuf,
+    pub(crate) contents: String,
+}
+
+impl PidLogTail {
+    pub(crate) fn append_to_context(&self, context: &mut String) {
+        context.push_str(&format!(
+            "\n\nManaged app-server stderr ({}):",
+            self.path.display()
+        ));
+        for line in self.contents.lines() {
+            context.push_str("\n  ");
+            context.push_str(line);
+        }
+    }
+}
+
 #[derive(Debug, Clone, PartialEq, Eq)]
 enum PidFileState {
     Missing,
@@ -129,11 +152,18 @@ impl PidBackend {
             }
         };
         let mut command = Command::new(&self.codex_bin);
+        let stderr_log = match self.open_stderr_log().await {
+            Ok(stderr_log) => stderr_log,
+            Err(err) => {
+                let _ = fs::remove_file(&self.pid_file).await;
+                return Err(err);
+            }
+        };
         command
             .args(self.command_args())
             .stdin(Stdio::null())
             .stdout(Stdio::null())
-            .stderr(Stdio::null());
+            .stderr(Stdio::from(stderr_log.into_std().await));
 
         #[cfg(unix)]
         {
@@ -169,8 +199,11 @@ impl PidBackend {
             },
             Err(err) => {
                 let _ = self.terminate_process(pid);
+                let mut context =
+                    format!("failed to record pid-managed app-server process {pid} startup");
+                super::append_stderr_log_tail_context(&self.pid_file, &mut context).await;
                 let _ = fs::remove_file(&self.pid_file).await;
-                return Err(err);
+                return Err(err).context(context);
             }
         };
         let contents = serde_json::to_vec(&record).context("failed to serialize pid record")?;
@@ -344,6 +377,23 @@ impl PidBackend {
         Ok(reservation_lock)
     }
 
+    #[cfg(unix)]
+    async fn open_stderr_log(&self) -> Result<fs::File> {
+        let stderr_log_file = stderr_log_file_for_pid_file(&self.pid_file);
+        fs::OpenOptions::new()
+            .create(true)
+            .truncate(true)
+            .write(true)
+            .open(&stderr_log_file)
+            .await
+            .with_context(|| {
+                format!(
+                    "failed to open stderr log for pid-managed app server {}",
+                    stderr_log_file.display()
+                )
+            })
+    }
+
     #[cfg(unix)]
     fn command_args(&self) -> Vec<&'static str> {
         match self.command_kind {
@@ -376,6 +426,56 @@ impl PidBackend {
     }
 }
 
+pub(crate) async fn read_stderr_log_tail(pid_file: &Path) -> Result<Option<PidLogTail>> {
+    let path = stderr_log_file_for_pid_file(pid_file);
+    let Some(contents) = read_log_tail(&path, STDERR_LOG_TAIL_BYTES).await? else {
+        return Ok(None);
+    };
+    Ok(Some(PidLogTail { path, contents }))
+}
+
+fn stderr_log_file_for_pid_file(pid_file: &Path) -> PathBuf {
+    pid_file.with_extension("stderr.log")
+}
+
+async fn read_log_tail(path: &Path, byte_limit: u64) -> Result<Option<String>> {
+    let mut file = match fs::File::open(path).await {
+        Ok(file) => file,
+        Err(err) if err.kind() == std::io::ErrorKind::NotFound => return Ok(None),
+        Err(err) => {
+            return Err(err)
+                .with_context(|| format!("failed to open stderr log {}", path.display()));
+        }
+    };
+    let len = file
+        .metadata()
+        .await
+        .with_context(|| format!("failed to inspect stderr log {}", path.display()))?
+        .len();
+    if len == 0 {
+        return Ok(None);
+    }
+
+    let start = len.saturating_sub(byte_limit);
+    file.seek(SeekFrom::Start(start))
+        .await
+        .with_context(|| format!("failed to seek stderr log {}", path.display()))?;
+    let mut bytes = Vec::new();
+    file.read_to_end(&mut bytes)
+        .await
+        .with_context(|| format!("failed to read stderr log {}", path.display()))?;
+    if start > 0
+        && let Some(newline_index) = bytes.iter().position(|byte| *byte == b'\n')
+    {
+        bytes.drain(..=newline_index);
+    }
+    let contents = String::from_utf8_lossy(&bytes).trim_end().to_string();
+    if contents.is_empty() {
+        return Ok(None);
+    }
+    Ok(Some(contents))
+}
+
 #[cfg(unix)]
 fn process_exists(pid: u32) -> bool {
     let Ok(pid) = libc::pid_t::try_from(pid) else {
diff --git a/codex-rs/app-server-daemon/src/backend/pid_tests.rs b/codex-rs/app-server-daemon/src/backend/pid_tests.rs
index dc279794c2..4c3a0e4414 100644
--- a/codex-rs/app-server-daemon/src/backend/pid_tests.rs
+++ b/codex-rs/app-server-daemon/src/backend/pid_tests.rs
@@ -6,7 +6,10 @@ use tempfile::TempDir;
 use super::PidBackend;
 use super::PidCommandKind;
 use super::PidFileState;
+use super::PidLogTail;
 use super::PidRecord;
+use super::read_stderr_log_tail;
+use super::stderr_log_file_for_pid_file;
 use super::try_lock_file;
 
 #[tokio::test]
@@ -156,3 +159,38 @@ fn update_loop_uses_hidden_app_server_subcommand() {
         vec!["app-server", "daemon", "pid-update-loop"]
     );
 }
+
+#[test]
+fn app_server_remote_control_uses_runtime_flag() {
+    let backend = PidBackend::new(
+        "codex".into(),
+        "app-server.pid".into(),
+        /*remote_control_enabled*/ true,
+    );
+
+    assert_eq!(
+        backend.command_args(),
+        vec!["app-server", "--remote-control", "--listen", "unix://"]
+    );
+}
+
+#[tokio::test]
+async fn read_stderr_log_tail_returns_recent_complete_lines() {
+    let temp_dir = TempDir::new().expect("temp dir");
+    let pid_file = temp_dir.path().join("app-server.pid");
+    let log_file = stderr_log_file_for_pid_file(&pid_file);
+    let contents = format!("{}\nrecent error\nusage", "x".repeat(4100));
+    tokio::fs::write(&log_file, contents)
+        .await
+        .expect("write stderr log");
+
+    assert_eq!(
+        read_stderr_log_tail(&pid_file)
+            .await
+            .expect("read stderr log"),
+        Some(PidLogTail {
+            path: log_file,
+            contents: "recent error\nusage".to_string(),
+        })
+    );
+}
diff --git a/codex-rs/app-server-daemon/src/client.rs b/codex-rs/app-server-daemon/src/client.rs
index 44fccda394..8c771ba1f2 100644
--- a/codex-rs/app-server-daemon/src/client.rs
+++ b/codex-rs/app-server-daemon/src/client.rs
@@ -5,6 +5,7 @@ use anyhow::Context;
 use anyhow::Result;
 use anyhow::anyhow;
 use codex_app_server_protocol::ClientInfo;
+use codex_app_server_protocol::InitializeCapabilities;
 use codex_app_server_protocol::InitializeParams;
 use codex_app_server_protocol::InitializeResponse;
 use codex_app_server_protocol::JSONRPCMessage;
@@ -14,12 +15,16 @@ use codex_app_server_protocol::RequestId;
 use codex_uds::UnixStream;
 use futures::SinkExt;
 use futures::StreamExt;
+use tokio::io::AsyncRead;
+use tokio::io::AsyncWrite;
 use tokio::time::timeout;
+use tokio_tungstenite::WebSocketStream;
 use tokio_tungstenite::client_async;
 use tokio_tungstenite::tungstenite::Message;
 
-const PROBE_TIMEOUT: Duration = Duration::from_secs(2);
+pub(crate) const CONTROL_SOCKET_RESPONSE_TIMEOUT: Duration = Duration::from_secs(2);
 const CLIENT_NAME: &str = "codex_app_server_daemon";
+const INITIALIZE_REQUEST_ID: RequestId = RequestId::Integer(1);
 
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub(crate) struct ProbeInfo {
@@ -27,7 +32,7 @@ pub(crate) struct ProbeInfo {
 }
 
 pub(crate) async fn probe(socket_path: &Path) -> Result<ProbeInfo> {
-    timeout(PROBE_TIMEOUT, probe_inner(socket_path))
+    timeout(CONTROL_SOCKET_RESPONSE_TIMEOUT, probe_inner(socket_path))
         .await
         .with_context(|| {
             format!(
@@ -38,54 +43,14 @@ pub(crate) async fn probe(socket_path: &Path) -> Result<ProbeInfo> {
 }
 
 async fn probe_inner(socket_path: &Path) -> Result<ProbeInfo> {
-    let stream = UnixStream::connect(socket_path)
-        .await
-        .with_context(|| format!("failed to connect to {}", socket_path.display()))?;
-    let (mut websocket, _response) = client_async("ws://localhost/", stream)
-        .await
-        .with_context(|| format!("failed to upgrade {}", socket_path.display()))?;
-
-    let initialize = JSONRPCMessage::Request(JSONRPCRequest {
-        id: RequestId::Integer(1),
-        method: "initialize".to_string(),
-        params: Some(serde_json::to_value(InitializeParams {
-            client_info: ClientInfo {
-                name: CLIENT_NAME.to_string(),
-                title: Some("Codex App Server Daemon".to_string()),
-                version: env!("CARGO_PKG_VERSION").to_string(),
-            },
-            capabilities: None,
-        })?),
-        trace: None,
-    });
-    websocket
-        .send(Message::Text(serde_json::to_string(&initialize)?.into()))
-        .await
-        .context("failed to send initialize request")?;
-
-    let response = loop {
-        let frame = websocket
-            .next()
-            .await
-            .ok_or_else(|| anyhow!("app-server closed before initialize response"))??;
-        let Message::Text(payload) = frame else {
-            continue;
-        };
-        let message = serde_json::from_str::<JSONRPCMessage>(&payload)?;
-        if let JSONRPCMessage::Response(response) = message
-            && response.id == RequestId::Integer(1)
-        {
-            break response;
-        }
-    };
-    let initialize_response = serde_json::from_value::<InitializeResponse>(response.result)?;
+    let mut websocket = connect(socket_path).await?;
 
+    let initialize_response = initialize(&mut websocket, /*experimental_api*/ false).await?;
     let initialized = JSONRPCMessage::Notification(JSONRPCNotification {
         method: "initialized".to_string(),
         params: None,
     });
-    websocket
-        .send(Message::Text(serde_json::to_string(&initialized)?.into()))
+    send_message(&mut websocket, &initialized)
         .await
         .context("failed to send initialized notification")?;
     websocket.close(None).await.ok();
@@ -95,6 +60,91 @@ async fn probe_inner(socket_path: &Path) -> Result<ProbeInfo> {
     })
 }
 
+pub(crate) async fn connect(socket_path: &Path) -> Result<WebSocketStream<UnixStream>> {
+    let stream = UnixStream::connect(socket_path)
+        .await
+        .with_context(|| format!("failed to connect to {}", socket_path.display()))?;
+    let (websocket, _response) = client_async("ws://localhost/", stream)
+        .await
+        .with_context(|| format!("failed to upgrade {}", socket_path.display()))?;
+    Ok(websocket)
+}
+
+pub(crate) async fn initialize<S>(
+    websocket: &mut WebSocketStream<S>,
+    experimental_api: bool,
+) -> Result<InitializeResponse>
+where
+    S: AsyncRead + AsyncWrite + Unpin,
+{
+    let initialize = JSONRPCMessage::Request(JSONRPCRequest {
+        id: INITIALIZE_REQUEST_ID,
+        method: "initialize".to_string(),
+        params: Some(serde_json::to_value(InitializeParams {
+            client_info: ClientInfo {
+                name: CLIENT_NAME.to_string(),
+                title: Some("Codex App Server Daemon".to_string()),
+                version: env!("CARGO_PKG_VERSION").to_string(),
+            },
+            capabilities: if experimental_api {
+                Some(InitializeCapabilities {
+                    experimental_api: true,
+                    ..Default::default()
+                })
+            } else {
+                None
+            },
+        })?),
+        trace: None,
+    });
+    send_message(websocket, &initialize)
+        .await
+        .context("failed to send initialize request")?;
+
+    let response = loop {
+        let message = timeout(CONTROL_SOCKET_RESPONSE_TIMEOUT, read_message(websocket))
+            .await
+            .context("timed out waiting for initialize response")??;
+        if let JSONRPCMessage::Response(response) = message
+            && response.id == INITIALIZE_REQUEST_ID
+        {
+            break response;
+        }
+    };
+    serde_json::from_value::<InitializeResponse>(response.result)
+        .context("failed to parse initialize response")
+}
+
+pub(crate) async fn send_message<S>(
+    websocket: &mut WebSocketStream<S>,
+    message: &JSONRPCMessage,
+) -> Result<()>
+where
+    S: AsyncRead + AsyncWrite + Unpin,
+{
+    websocket
+        .send(Message::Text(serde_json::to_string(message)?.into()))
+        .await?;
+    Ok(())
+}
+
+pub(crate) async fn read_message<S>(websocket: &mut WebSocketStream<S>) -> Result<JSONRPCMessage>
+where
+    S: AsyncRead + AsyncWrite + Unpin,
+{
+    loop {
+        let frame = websocket
+            .next()
+            .await
+            .ok_or_else(|| anyhow!("app-server closed the control socket"))??;
+        let Message::Text(payload) = frame else {
+            continue;
+        };
+        return serde_json::from_str::<JSONRPCMessage>(&payload)
+            .context("failed to parse app-server JSON-RPC message");
+    }
+}
+
 fn parse_version_from_user_agent(user_agent: &str) -> Result<String> {
     let (_originator, rest) = user_agent
         .split_once('/')
diff --git a/codex-rs/app-server-daemon/src/lib.rs b/codex-rs/app-server-daemon/src/lib.rs
index 826acbae68..62864fd5b7 100644
--- a/codex-rs/app-server-daemon/src/lib.rs
+++ b/codex-rs/app-server-daemon/src/lib.rs
@@ -1,6 +1,7 @@
 mod backend;
 mod client;
 mod managed_install;
+mod remote_control_client;
 mod settings;
 mod update_loop;
 
@@ -13,6 +14,7 @@ use anyhow::Result;
 use anyhow::anyhow;
 pub use backend::BackendKind;
 use backend::BackendPaths;
+use codex_app_server_protocol::RemoteControlConnectionStatus;
 use codex_app_server_transport::app_server_control_socket_path;
 use codex_utils_home_dir::find_codex_home;
 use managed_install::managed_codex_bin;
@@ -58,6 +60,8 @@ pub struct LifecycleOutput {
     pub backend: Option<BackendKind>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub pid: Option<u32>,
+    pub managed_codex_path: PathBuf,
+    pub managed_codex_version: Option<String>,
     pub socket_path: PathBuf,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub cli_version: Option<String>,
@@ -84,6 +88,7 @@ pub struct BootstrapOutput {
     pub auto_update_enabled: bool,
     pub remote_control_enabled: bool,
     pub managed_codex_path: PathBuf,
+    pub managed_codex_version: Option<String>,
     pub socket_path: PathBuf,
     pub cli_version: String,
     pub app_server_version: String,
@@ -96,6 +101,20 @@ pub enum RemoteControlStartOutput {
     Start(LifecycleOutput),
 }
 
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct RemoteControlReadyStatus {
+    pub status: RemoteControlConnectionStatus,
+    pub server_name: String,
+    pub environment_id: Option<String>,
+    pub timed_out: bool,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct RemoteControlReadyOutput {
+    pub daemon: RemoteControlStartOutput,
+    pub remote_control: RemoteControlReadyStatus,
+}
+
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum RemoteControlMode {
     Enabled,
@@ -179,6 +198,27 @@ pub async fn ensure_remote_control_started() -> Result<RemoteControlStartOutput>
         .await
 }
 
+pub async fn ensure_remote_control_ready() -> Result<RemoteControlReadyOutput> {
+    ensure_supported_platform()?;
+    Daemon::from_environment()?
+        .ensure_remote_control_ready()
+        .await
+}
+
+pub async fn enable_remote_control_on_socket(
+    socket_path: &Path,
+    connect_timeout: Duration,
+    connect_retry_delay: Duration,
+) -> Result<RemoteControlReadyStatus> {
+    ensure_supported_platform()?;
+    remote_control_client::enable_remote_control_with_connect_retry(
+        socket_path,
+        connect_timeout,
+        connect_retry_delay,
+    )
+    .await
+}
+
 pub async fn set_remote_control(mode: RemoteControlMode) -> Result<RemoteControlOutput> {
     ensure_supported_platform()?;
     Daemon::from_environment()?.set_remote_control(mode).await
@@ -248,33 +288,39 @@ impl Daemon {
     async fn start(&self) -> Result<LifecycleOutput> {
         let settings = self.load_settings().await?;
         if let Ok(info) = client::probe(&self.socket_path).await {
-            return Ok(self.output(
-                LifecycleStatus::AlreadyRunning,
-                self.running_backend(&settings).await?,
-                /*pid*/ None,
-                Some(info.app_server_version),
-            ));
+            return Ok(self
+                .output(
+                    LifecycleStatus::AlreadyRunning,
+                    self.running_backend(&settings).await?,
+                    /*pid*/ None,
+                    Some(info.app_server_version),
+                )
+                .await);
         }
 
         if self.running_backend_instance(&settings).await?.is_some() {
             let info = self.wait_until_ready().await?;
-            return Ok(self.output(
-                LifecycleStatus::AlreadyRunning,
-                Some(BackendKind::Pid),
-                /*pid*/ None,
-                Some(info.app_server_version),
-            ));
+            return Ok(self
+                .output(
+                    LifecycleStatus::AlreadyRunning,
+                    Some(BackendKind::Pid),
+                    /*pid*/ None,
+                    Some(info.app_server_version),
+                )
+                .await);
         }
 
         self.ensure_managed_codex_bin()?;
         let pid = self.start_managed_backend(&settings).await?;
         let info = self.wait_until_ready().await?;
-        Ok(self.output(
-            LifecycleStatus::Started,
-            Some(BackendKind::Pid),
-            pid,
-            Some(info.app_server_version),
-        ))
+        Ok(self
+            .output(
+                LifecycleStatus::Started,
+                Some(BackendKind::Pid),
+                pid,
+                Some(info.app_server_version),
+            )
+            .await)
     }
 
     async fn restart(&self) -> Result<LifecycleOutput> {
@@ -294,12 +340,14 @@ impl Daemon {
 
         let pid = self.start_managed_backend(&settings).await?;
         let info = self.wait_until_ready().await?;
-        Ok(self.output(
-            LifecycleStatus::Restarted,
-            Some(BackendKind::Pid),
-            pid,
-            Some(info.app_server_version),
-        ))
+        Ok(self
+            .output(
+                LifecycleStatus::Restarted,
+                Some(BackendKind::Pid),
+                pid,
+                Some(info.app_server_version),
+            )
+            .await)
     }
 
     #[cfg(unix)]
@@ -352,12 +400,14 @@ impl Daemon {
         let settings = self.load_settings().await?;
         if let Some(backend) = self.running_backend_instance(&settings).await? {
             backend.stop().await?;
-            return Ok(self.output(
-                LifecycleStatus::Stopped,
-                Some(BackendKind::Pid),
-                /*pid*/ None,
-                /*app_server_version*/ None,
-            ));
+            return Ok(self
+                .output(
+                    LifecycleStatus::Stopped,
+                    Some(BackendKind::Pid),
+                    /*pid*/ None,
+                    /*app_server_version*/ None,
+                )
+                .await);
         }
 
         if client::probe(&self.socket_path).await.is_ok() {
@@ -366,23 +416,27 @@ impl Daemon {
             ));
         }
 
-        Ok(self.output(
-            LifecycleStatus::NotRunning,
-            /*backend*/ None,
-            /*pid*/ None,
-            /*app_server_version*/ None,
-        ))
+        Ok(self
+            .output(
+                LifecycleStatus::NotRunning,
+                /*backend*/ None,
+                /*pid*/ None,
+                /*app_server_version*/ None,
+            )
+            .await)
     }
 
     async fn version(&self) -> Result<LifecycleOutput> {
         let settings = self.load_settings().await?;
         let info = client::probe(&self.socket_path).await?;
-        Ok(self.output(
-            LifecycleStatus::Running,
-            self.running_backend(&settings).await?,
-            /*pid*/ None,
-            Some(info.app_server_version),
-        ))
+        Ok(self
+            .output(
+                LifecycleStatus::Running,
+                self.running_backend(&settings).await?,
+                /*pid*/ None,
+                Some(info.app_server_version),
+            )
+            .await)
     }
 
     async fn wait_until_ready(&self) -> Result<client::ProbeInfo> {
@@ -395,17 +449,34 @@ impl Daemon {
                     sleep(START_POLL_INTERVAL).await;
                 }
                 Err(err) => {
-                    return Err(err).with_context(|| {
-                        format!(
-                            "app server did not become ready on {}",
-                            self.socket_path.display()
-                        )
-                    });
+                    let context = self.app_server_not_ready_context().await;
+                    return Err(err).context(context);
                 }
             }
         }
     }
 
+    async fn app_server_not_ready_context(&self) -> String {
+        let mut context = format!(
+            "app server did not become ready on {}",
+            self.socket_path.display()
+        );
+        self.append_daemon_app_server_context(&mut context).await;
+        backend::append_stderr_log_tail_context(&self.pid_file, &mut context).await;
+        context
+    }
+
+    async fn append_daemon_app_server_context(&self, context: &mut String) {
+        let managed_codex_version = self
+            .managed_codex_version_best_effort()
+            .await
+            .unwrap_or_else(|| "unknown".to_string());
+        context.push_str(&format!(
+            "\n\nDaemon used app-server:\n  path: {}\n  version: {managed_codex_version}",
+            self.managed_codex_bin.display()
+        ));
+    }
+
     async fn bootstrap(&self, options: BootstrapOptions) -> Result<BootstrapOutput> {
         let _operation_lock = self.acquire_operation_lock().await?;
         self.bootstrap_locked(options).await
@@ -430,6 +501,16 @@ impl Daemon {
         Ok(RemoteControlStartOutput::Bootstrap(output))
     }
 
+    async fn ensure_remote_control_ready(&self) -> Result<RemoteControlReadyOutput> {
+        let daemon = self.ensure_remote_control_started().await?;
+        let remote_control =
+            remote_control_client::enable_remote_control(&self.socket_path).await?;
+        Ok(RemoteControlReadyOutput {
+            daemon,
+            remote_control,
+        })
+    }
+
     async fn set_remote_control(&self, mode: RemoteControlMode) -> Result<RemoteControlOutput> {
         let _operation_lock = self.acquire_operation_lock().await?;
         self.set_remote_control_locked(mode).await
@@ -512,12 +593,14 @@ impl Daemon {
         updater.start().await?;
 
         let info = self.wait_until_ready().await?;
+        let managed_codex_version = self.managed_codex_version_best_effort().await;
         Ok(BootstrapOutput {
             status: BootstrapStatus::Bootstrapped,
             backend: BackendKind::Pid,
             auto_update_enabled: true,
             remote_control_enabled: settings.remote_control_enabled,
             managed_codex_path: self.managed_codex_bin.clone(),
+            managed_codex_version,
             socket_path: self.socket_path.clone(),
             cli_version: env!("CARGO_PKG_VERSION").to_string(),
             app_server_version: info.app_server_version,
@@ -567,12 +650,26 @@ impl Daemon {
             return Ok(());
         }
 
+        let managed_codex_path = self.managed_codex_bin.display();
         Err(anyhow!(
-            "managed standalone Codex install not found at {}; install Codex first",
-            self.managed_codex_bin.display()
+            "managed standalone Codex install not found at {managed_codex_path}\n\n\
+             This command requires the standalone install managed by the Codex installer, because \
+             the daemon starts and updates app-server from that fixed path.\n\n\
+             Install it with:\n  curl -fsSL https://chatgpt.com/codex/install.sh | sh\n\n\
+             Then rerun the command you just tried."
         ))
     }
 
+    #[cfg(unix)]
+    async fn managed_codex_version_best_effort(&self) -> Option<String> {
+        managed_codex_version(&self.managed_codex_bin).await.ok()
+    }
+
+    #[cfg(not(unix))]
+    async fn managed_codex_version_best_effort(&self) -> Option<String> {
+        None
+    }
+
     fn backend_paths(&self, settings: &DaemonSettings) -> BackendPaths {
         self.backend_paths_with_bin(settings, &self.managed_codex_bin)
     }
@@ -632,17 +729,20 @@ impl Daemon {
             })
     }
 
-    fn output(
+    async fn output(
         &self,
         status: LifecycleStatus,
         backend: Option<BackendKind>,
         pid: Option<u32>,
         app_server_version: Option<String>,
     ) -> LifecycleOutput {
+        let managed_codex_version = self.managed_codex_version_best_effort().await;
         LifecycleOutput {
             status,
             backend,
             pid,
+            managed_codex_path: self.managed_codex_bin.clone(),
+            managed_codex_version,
             socket_path: self.socket_path.clone(),
             cli_version: Some(env!("CARGO_PKG_VERSION").to_string()),
             app_server_version,
@@ -731,10 +831,12 @@ fn try_lock_file(_file: &tokio::fs::File) -> Result<bool> {
 #[cfg(all(test, unix))]
 mod tests {
     use pretty_assertions::assert_eq;
+    use tempfile::TempDir;
 
     use super::BackendKind;
     use super::BootstrapOutput;
     use super::BootstrapStatus;
+    use super::Daemon;
     use super::LifecycleOutput;
     use super::LifecycleStatus;
     use super::RemoteControlStartOutput;
@@ -747,22 +849,6 @@ mod tests {
     use super::should_reexec_updater;
     use crate::client::ProbeInfo;
 
-    #[test]
-    fn lifecycle_status_uses_camel_case_json() {
-        assert_eq!(
-            serde_json::to_string(&LifecycleStatus::AlreadyRunning).expect("serialize"),
-            "\"alreadyRunning\""
-        );
-    }
-
-    #[test]
-    fn bootstrap_status_uses_camel_case_json() {
-        assert_eq!(
-            serde_json::to_string(&BootstrapStatus::Bootstrapped).expect("serialize"),
-            "\"bootstrapped\""
-        );
-    }
-
     #[test]
     fn remote_control_status_uses_camel_case_json() {
         assert_eq!(
@@ -843,12 +929,26 @@ mod tests {
             status: LifecycleStatus::AlreadyRunning,
             backend: Some(BackendKind::Pid),
             pid: None,
+            managed_codex_path: "codex".into(),
+            managed_codex_version: Some("1.2.3".to_string()),
             socket_path: "codex.sock".into(),
             cli_version: Some("1.2.3".to_string()),
             app_server_version: Some("1.2.4".to_string()),
         };
         let output = RemoteControlStartOutput::Start(lifecycle_output.clone());
 
+        assert_eq!(
+            serde_json::to_value(&lifecycle_output).expect("serialize"),
+            serde_json::json!({
+                "status": "alreadyRunning",
+                "backend": "pid",
+                "managedCodexPath": "codex",
+                "managedCodexVersion": "1.2.3",
+                "socketPath": "codex.sock",
+                "cliVersion": "1.2.3",
+                "appServerVersion": "1.2.4",
+            })
+        );
         assert_eq!(
             serde_json::to_value(output).expect("serialize"),
             serde_json::to_value(lifecycle_output).expect("serialize")
@@ -860,15 +960,59 @@ mod tests {
             auto_update_enabled: true,
             remote_control_enabled: true,
             managed_codex_path: "codex".into(),
+            managed_codex_version: Some("1.2.3".to_string()),
             socket_path: "codex.sock".into(),
             cli_version: "1.2.3".to_string(),
             app_server_version: "1.2.4".to_string(),
         };
         let output = RemoteControlStartOutput::Bootstrap(bootstrap_output.clone());
 
+        assert_eq!(
+            serde_json::to_value(&bootstrap_output).expect("serialize"),
+            serde_json::json!({
+                "status": "bootstrapped",
+                "backend": "pid",
+                "autoUpdateEnabled": true,
+                "remoteControlEnabled": true,
+                "managedCodexPath": "codex",
+                "managedCodexVersion": "1.2.3",
+                "socketPath": "codex.sock",
+                "cliVersion": "1.2.3",
+                "appServerVersion": "1.2.4",
+            })
+        );
         assert_eq!(
             serde_json::to_value(output).expect("serialize"),
             serde_json::to_value(bootstrap_output).expect("serialize")
         );
     }
+
+    #[tokio::test]
+    async fn not_ready_context_reports_daemon_app_server_before_stderr() {
+        let temp_dir = TempDir::new().expect("temp dir");
+        let daemon = Daemon {
+            socket_path: temp_dir.path().join("app-server-control.sock"),
+            pid_file: temp_dir.path().join("app-server.pid"),
+            update_pid_file: temp_dir.path().join("app-server-updater.pid"),
+            operation_lock_file: temp_dir.path().join("daemon.lock"),
+            settings_file: temp_dir.path().join("settings.json"),
+            managed_codex_bin: temp_dir.path().join("missing-codex"),
+        };
+        let stderr_log = daemon.pid_file.with_extension("stderr.log");
+        tokio::fs::write(&stderr_log, "unexpected argument")
+            .await
+            .expect("write stderr log");
+
+        assert_eq!(
+            daemon.app_server_not_ready_context().await,
+            format!(
+                "app server did not become ready on {}\n\n\
+                 Daemon used app-server:\n  path: {}\n  version: unknown\n\n\
+                 Managed app-server stderr ({}):\n  unexpected argument",
+                daemon.socket_path.display(),
+                daemon.managed_codex_bin.display(),
+                stderr_log.display()
+            )
+        );
+    }
 }
diff --git a/codex-rs/app-server-daemon/src/remote_control_client.rs b/codex-rs/app-server-daemon/src/remote_control_client.rs
new file mode 100644
index 0000000000..cc32e50dde
--- /dev/null
+++ b/codex-rs/app-server-daemon/src/remote_control_client.rs
@@ -0,0 +1,459 @@
+use std::path::Path;
+use std::time::Duration;
+
+use anyhow::Context;
+use anyhow::Result;
+use anyhow::anyhow;
+use codex_app_server_protocol::JSONRPCMessage;
+use codex_app_server_protocol::JSONRPCNotification;
+use codex_app_server_protocol::JSONRPCRequest;
+use codex_app_server_protocol::RemoteControlConnectionStatus;
+use codex_app_server_protocol::RemoteControlEnableResponse;
+use codex_app_server_protocol::RemoteControlStatusChangedNotification;
+use codex_app_server_protocol::RequestId;
+use tokio::io::AsyncRead;
+use tokio::io::AsyncWrite;
+use tokio::time::Instant;
+use tokio::time::sleep;
+use tokio::time::timeout;
+use tokio_tungstenite::WebSocketStream;
+
+use crate::RemoteControlReadyStatus;
+use crate::client;
+
+const REMOTE_CONTROL_READY_TIMEOUT: Duration = Duration::from_secs(10);
+const REMOTE_CONTROL_ENABLE_REQUEST_ID: RequestId = RequestId::Integer(2);
+
+pub(crate) async fn enable_remote_control(socket_path: &Path) -> Result<RemoteControlReadyStatus> {
+    let mut websocket = client::connect(socket_path).await?;
+    enable_remote_control_with_timeout(&mut websocket, REMOTE_CONTROL_READY_TIMEOUT).await
+}
+
+pub(crate) async fn enable_remote_control_with_connect_retry(
+    socket_path: &Path,
+    connect_timeout: Duration,
+    connect_retry_delay: Duration,
+) -> Result<RemoteControlReadyStatus> {
+    let mut websocket =
+        connect_with_retry(socket_path, connect_timeout, connect_retry_delay).await?;
+    enable_remote_control_with_timeout(&mut websocket, REMOTE_CONTROL_READY_TIMEOUT).await
+}
+
+async fn enable_remote_control_with_timeout<S>(
+    websocket: &mut WebSocketStream<S>,
+    ready_timeout: Duration,
+) -> Result<RemoteControlReadyStatus>
+where
+    S: AsyncRead + AsyncWrite + Unpin,
+{
+    client::initialize(websocket, /*experimental_api*/ true).await?;
+    let initialized = JSONRPCMessage::Notification(JSONRPCNotification {
+        method: "initialized".to_string(),
+        params: None,
+    });
+    client::send_message(websocket, &initialized)
+        .await
+        .context("failed to send initialized notification")?;
+
+    let enable = JSONRPCMessage::Request(JSONRPCRequest {
+        id: REMOTE_CONTROL_ENABLE_REQUEST_ID,
+        method: "remoteControl/enable".to_string(),
+        params: None,
+        trace: None,
+    });
+    client::send_message(websocket, &enable)
+        .await
+        .context("failed to send remoteControl/enable request")?;
+
+    let mut latest = read_enable_response(websocket).await?;
+    if latest.status == RemoteControlConnectionStatus::Connecting {
+        latest = wait_for_remote_control_status(websocket, latest, ready_timeout).await?;
+    }
+    websocket.close(None).await.ok();
+    Ok(latest)
+}
+
+async fn connect_with_retry(
+    socket_path: &Path,
+    connect_timeout: Duration,
+    connect_retry_delay: Duration,
+) -> Result<WebSocketStream<codex_uds::UnixStream>> {
+    let deadline = Instant::now() + connect_timeout;
+    loop {
+        match client::connect(socket_path).await {
+            Ok(websocket) => return Ok(websocket),
+            Err(_) if Instant::now() < deadline => {
+                sleep(connect_retry_delay).await;
+            }
+            Err(error) => {
+                return Err(error).with_context(|| {
+                    format!(
+                        "app server did not become ready on {}",
+                        socket_path.display()
+                    )
+                });
+            }
+        }
+    }
+}
+
+async fn read_enable_response<S>(
+    websocket: &mut WebSocketStream<S>,
+) -> Result<RemoteControlReadyStatus>
+where
+    S: AsyncRead + AsyncWrite + Unpin,
+{
+    loop {
+        let message = timeout(
+            client::CONTROL_SOCKET_RESPONSE_TIMEOUT,
+            client::read_message(websocket),
+        )
+        .await
+        .context("timed out waiting for remoteControl/enable response")??;
+        match message {
+            JSONRPCMessage::Response(response)
+                if response.id == REMOTE_CONTROL_ENABLE_REQUEST_ID =>
+            {
+                let response =
+                    serde_json::from_value::<RemoteControlEnableResponse>(response.result)
+                        .context("failed to parse remoteControl/enable response")?;
+                return Ok(RemoteControlReadyStatus::from(response));
+            }
+            JSONRPCMessage::Error(err) if err.id == REMOTE_CONTROL_ENABLE_REQUEST_ID => {
+                return Err(anyhow!(
+                    "remoteControl/enable failed: {}",
+                    err.error.message
+                ));
+            }
+            JSONRPCMessage::Notification(notification)
+                if remote_control_status_notification(&notification).is_some() =>
+            {
+                continue;
+            }
+            _ => {}
+        }
+    }
+}
+
+async fn wait_for_remote_control_status<S>(
+    websocket: &mut WebSocketStream<S>,
+    mut latest: RemoteControlReadyStatus,
+    ready_timeout: Duration,
+) -> Result<RemoteControlReadyStatus>
+where
+    S: AsyncRead + AsyncWrite + Unpin,
+{
+    let deadline = tokio::time::Instant::now() + ready_timeout;
+    while tokio::time::Instant::now() < deadline {
+        let remaining = deadline.saturating_duration_since(tokio::time::Instant::now());
+        let message = match timeout(remaining, client::read_message(websocket)).await {
+            Ok(Ok(message)) => message,
+            Ok(Err(err)) => return Err(err),
+            Err(_) => {
+                latest.timed_out = true;
+                return Ok(latest);
+            }
+        };
+        let JSONRPCMessage::Notification(notification) = message else {
+            continue;
+        };
+        let Some(status) = remote_control_status_notification(&notification) else {
+            continue;
+        };
+        latest = RemoteControlReadyStatus::from(status);
+        if latest.status != RemoteControlConnectionStatus::Connecting {
+            return Ok(latest);
+        }
+    }
+    latest.timed_out = true;
+    Ok(latest)
+}
+
+fn remote_control_status_notification(
+    notification: &JSONRPCNotification,
+) -> Option<RemoteControlStatusChangedNotification> {
+    if notification.method != "remoteControl/status/changed" {
+        return None;
+    }
+    let params = notification.params.clone()?;
+    serde_json::from_value(params).ok()
+}
+
+impl From<RemoteControlEnableResponse> for RemoteControlReadyStatus {
+    fn from(response: RemoteControlEnableResponse) -> Self {
+        let RemoteControlEnableResponse {
+            status,
+            server_name,
+            installation_id: _,
+            environment_id,
+        } = response;
+        Self {
+            status,
+            server_name,
+            environment_id,
+            timed_out: false,
+        }
+    }
+}
+
+impl From<RemoteControlStatusChangedNotification> for RemoteControlReadyStatus {
+    fn from(notification: RemoteControlStatusChangedNotification) -> Self {
+        let RemoteControlStatusChangedNotification {
+            status,
+            server_name,
+            installation_id: _,
+            environment_id,
+        } = notification;
+        Self {
+            status,
+            server_name,
+            environment_id,
+            timed_out: false,
+        }
+    }
+}
+
+#[cfg(all(test, unix))]
+mod tests {
+    use anyhow::Result;
+    use codex_app_server_protocol::JSONRPCResponse;
+    use codex_uds::UnixListener;
+    use pretty_assertions::assert_eq;
+    use tempfile::TempDir;
+    use tokio_tungstenite::accept_async;
+
+    use super::*;
+
+    const INITIALIZE_REQUEST_ID: RequestId = RequestId::Integer(1);
+    const TEST_INSTALLATION_ID: &str = "11111111-1111-4111-8111-111111111111";
+    const TEST_SERVER_NAME: &str = "owen-mbp";
+    const TEST_CODEX_HOME: &str = "/tmp/codex-home";
+
+    #[tokio::test]
+    async fn enable_remote_control_uses_connected_enable_response_without_later_notification()
+    -> Result<()> {
+        let status = run_enable_remote_control_scenario(EnableScenario {
+            initial_notification: Some(remote_control_status(
+                RemoteControlConnectionStatus::Connected,
+                Some("env_test"),
+            )),
+            enable_response: remote_control_status(
+                RemoteControlConnectionStatus::Connected,
+                Some("env_test"),
+            ),
+            after_enable_notification: None,
+            ready_timeout: Duration::from_millis(20),
+        })
+        .await?;
+
+        assert_eq!(
+            status,
+            RemoteControlReadyStatus {
+                status: RemoteControlConnectionStatus::Connected,
+                server_name: TEST_SERVER_NAME.to_string(),
+                environment_id: Some("env_test".to_string()),
+                timed_out: false,
+            }
+        );
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn enable_remote_control_waits_for_connected_notification() -> Result<()> {
+        let status = run_enable_remote_control_scenario(EnableScenario {
+            initial_notification: None,
+            enable_response: remote_control_status(
+                RemoteControlConnectionStatus::Connecting,
+                /*environment_id*/ None,
+            ),
+            after_enable_notification: Some(remote_control_status(
+                RemoteControlConnectionStatus::Connected,
+                Some("env_test"),
+            )),
+            ready_timeout: Duration::from_secs(1),
+        })
+        .await?;
+
+        assert_eq!(
+            status,
+            RemoteControlReadyStatus {
+                status: RemoteControlConnectionStatus::Connected,
+                server_name: TEST_SERVER_NAME.to_string(),
+                environment_id: Some("env_test".to_string()),
+                timed_out: false,
+            }
+        );
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn enable_remote_control_reports_connecting_after_timeout() -> Result<()> {
+        let status = run_enable_remote_control_scenario(EnableScenario {
+            initial_notification: None,
+            enable_response: remote_control_status(
+                RemoteControlConnectionStatus::Connecting,
+                /*environment_id*/ None,
+            ),
+            after_enable_notification: None,
+            ready_timeout: Duration::from_millis(20),
+        })
+        .await?;
+
+        assert_eq!(
+            status,
+            RemoteControlReadyStatus {
+                status: RemoteControlConnectionStatus::Connecting,
+                server_name: TEST_SERVER_NAME.to_string(),
+                environment_id: None,
+                timed_out: true,
+            }
+        );
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn enable_remote_control_returns_errored_enable_response() -> Result<()> {
+        let status = run_enable_remote_control_scenario(EnableScenario {
+            initial_notification: None,
+            enable_response: remote_control_status(
+                RemoteControlConnectionStatus::Errored,
+                /*environment_id*/ None,
+            ),
+            after_enable_notification: None,
+            ready_timeout: Duration::from_millis(20),
+        })
+        .await?;
+
+        assert_eq!(
+            status,
+            RemoteControlReadyStatus {
+                status: RemoteControlConnectionStatus::Errored,
+                server_name: TEST_SERVER_NAME.to_string(),
+                environment_id: None,
+                timed_out: false,
+            }
+        );
+        Ok(())
+    }
+
+    struct EnableScenario {
+        initial_notification: Option<RemoteControlStatusChangedNotification>,
+        enable_response: RemoteControlStatusChangedNotification,
+        after_enable_notification: Option<RemoteControlStatusChangedNotification>,
+        ready_timeout: Duration,
+    }
+
+    async fn run_enable_remote_control_scenario(
+        scenario: EnableScenario,
+    ) -> Result<RemoteControlReadyStatus> {
+        let dir = TempDir::new()?;
+        let socket_path = dir.path().join("app-server.sock");
+        let listener = UnixListener::bind(&socket_path).await?;
+        let ready_timeout = scenario.ready_timeout;
+        let server_task = tokio::spawn(serve_enable_remote_control_scenario(listener, scenario));
+
+        let mut websocket = client::connect(&socket_path).await?;
+        let status = enable_remote_control_with_timeout(&mut websocket, ready_timeout).await?;
+        server_task.await??;
+        Ok(status)
+    }
+
+    async fn serve_enable_remote_control_scenario(
+        mut listener: UnixListener,
+        scenario: EnableScenario,
+    ) -> Result<()> {
+        let stream = listener.accept().await?;
+        let mut websocket = accept_async(stream).await?;
+
+        let initialize = client::read_message(&mut websocket).await?;
+        let JSONRPCMessage::Request(initialize) = initialize else {
+            panic!("expected initialize request");
+        };
+        assert_eq!(initialize.id, INITIALIZE_REQUEST_ID);
+        assert_eq!(initialize.method, "initialize");
+        let Some(initialize_params) = initialize.params else {
+            panic!("expected initialize params");
+        };
+        assert_eq!(
+            initialize_params["capabilities"]["experimentalApi"],
+            serde_json::Value::Bool(true)
+        );
+        client::send_message(
+            &mut websocket,
+            &JSONRPCMessage::Response(JSONRPCResponse {
+                id: INITIALIZE_REQUEST_ID,
+                result: serde_json::json!({
+                    "userAgent": "codex_app_server/1.2.3",
+                    "codexHome": TEST_CODEX_HOME,
+                    "platformFamily": "unix",
+                    "platformOs": "macos",
+                }),
+            }),
+        )
+        .await?;
+
+        let initialized = client::read_message(&mut websocket).await?;
+        let JSONRPCMessage::Notification(initialized) = initialized else {
+            panic!("expected initialized notification");
+        };
+        assert_eq!(initialized.method, "initialized");
+
+        if let Some(status) = scenario.initial_notification {
+            send_remote_control_status(&mut websocket, status).await?;
+        }
+
+        let enable = client::read_message(&mut websocket).await?;
+        let JSONRPCMessage::Request(enable) = enable else {
+            panic!("expected remoteControl/enable request");
+        };
+        assert_eq!(enable.id, REMOTE_CONTROL_ENABLE_REQUEST_ID);
+        assert_eq!(enable.method, "remoteControl/enable");
+        client::send_message(
+            &mut websocket,
+            &JSONRPCMessage::Response(JSONRPCResponse {
+                id: REMOTE_CONTROL_ENABLE_REQUEST_ID,
+                result: serde_json::to_value(RemoteControlEnableResponse::from(
+                    scenario.enable_response,
+                ))?,
+            }),
+        )
+        .await?;
+
+        if let Some(status) = scenario.after_enable_notification {
+            send_remote_control_status(&mut websocket, status).await?;
+        } else {
+            tokio::time::sleep(Duration::from_millis(50)).await;
+        }
+
+        Ok(())
+    }
+
+    async fn send_remote_control_status<S>(
+        websocket: &mut WebSocketStream<S>,
+        status: RemoteControlStatusChangedNotification,
+    ) -> Result<()>
+    where
+        S: tokio::io::AsyncRead + tokio::io::AsyncWrite + Unpin,
+    {
+        client::send_message(
+            websocket,
+            &JSONRPCMessage::Notification(JSONRPCNotification {
+                method: "remoteControl/status/changed".to_string(),
+                params: Some(serde_json::to_value(status)?),
+            }),
+        )
+        .await
+    }
+
+    fn remote_control_status(
+        status: RemoteControlConnectionStatus,
+        environment_id: Option<&str>,
+    ) -> RemoteControlStatusChangedNotification {
+        RemoteControlStatusChangedNotification {
+            status,
+            server_name: TEST_SERVER_NAME.to_string(),
+            installation_id: TEST_INSTALLATION_ID.to_string(),
+            environment_id: environment_id.map(str::to_string),
+        }
+    }
+}
diff --git a/codex-rs/app-server-protocol/schema/json/ClientRequest.json b/codex-rs/app-server-protocol/schema/json/ClientRequest.json
index a6fe99b35e..58aa1c4449 100644
--- a/codex-rs/app-server-protocol/schema/json/ClientRequest.json
+++ b/codex-rs/app-server-protocol/schema/json/ClientRequest.json
@@ -591,6 +591,13 @@
             "integer",
             "null"
           ]
+        },
+        "threadId": {
+          "description": "Optional loaded thread id. Pass this when showing feature state for an existing thread so enablement is computed from that thread's refreshed config, including project-local config for the thread's cwd.",
+          "type": [
+            "string",
+            "null"
+          ]
         }
       },
       "type": "object"
@@ -719,202 +726,6 @@
       ],
       "type": "object"
     },
-    "FileSystemAccessMode": {
-      "enum": [
-        "read",
-        "write",
-        "none"
-      ],
-      "type": "string"
-    },
-    "FileSystemPath": {
-      "oneOf": [
-        {
-          "properties": {
-            "path": {
-              "$ref": "#/definitions/AbsolutePathBuf"
-            },
-            "type": {
-              "enum": [
-                "path"
-              ],
-              "title": "PathFileSystemPathType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "path",
-            "type"
-          ],
-          "title": "PathFileSystemPath",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "pattern": {
-              "type": "string"
-            },
-            "type": {
-              "enum": [
-                "glob_pattern"
-              ],
-              "title": "GlobPatternFileSystemPathType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "pattern",
-            "type"
-          ],
-          "title": "GlobPatternFileSystemPath",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "special"
-              ],
-              "title": "SpecialFileSystemPathType",
-              "type": "string"
-            },
-            "value": {
-              "$ref": "#/definitions/FileSystemSpecialPath"
-            }
-          },
-          "required": [
-            "type",
-            "value"
-          ],
-          "title": "SpecialFileSystemPath",
-          "type": "object"
-        }
-      ]
-    },
-    "FileSystemSandboxEntry": {
-      "properties": {
-        "access": {
-          "$ref": "#/definitions/FileSystemAccessMode"
-        },
-        "path": {
-          "$ref": "#/definitions/FileSystemPath"
-        }
-      },
-      "required": [
-        "access",
-        "path"
-      ],
-      "type": "object"
-    },
-    "FileSystemSpecialPath": {
-      "oneOf": [
-        {
-          "properties": {
-            "kind": {
-              "enum": [
-                "root"
-              ],
-              "type": "string"
-            }
-          },
-          "required": [
-            "kind"
-          ],
-          "title": "RootFileSystemSpecialPath",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "kind": {
-              "enum": [
-                "minimal"
-              ],
-              "type": "string"
-            }
-          },
-          "required": [
-            "kind"
-          ],
-          "title": "MinimalFileSystemSpecialPath",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "kind": {
-              "enum": [
-                "project_roots"
-              ],
-              "type": "string"
-            },
-            "subpath": {
-              "type": [
-                "string",
-                "null"
-              ]
-            }
-          },
-          "required": [
-            "kind"
-          ],
-          "title": "KindFileSystemSpecialPath",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "kind": {
-              "enum": [
-                "tmpdir"
-              ],
-              "type": "string"
-            }
-          },
-          "required": [
-            "kind"
-          ],
-          "title": "TmpdirFileSystemSpecialPath",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "kind": {
-              "enum": [
-                "slash_tmp"
-              ],
-              "type": "string"
-            }
-          },
-          "required": [
-            "kind"
-          ],
-          "title": "SlashTmpFileSystemSpecialPath",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "kind": {
-              "enum": [
-                "unknown"
-              ],
-              "type": "string"
-            },
-            "path": {
-              "type": "string"
-            },
-            "subpath": {
-              "type": [
-                "string",
-                "null"
-              ]
-            }
-          },
-          "required": [
-            "kind",
-            "path"
-          ],
-          "type": "object"
-        }
-      ]
-    },
     "FsCopyParams": {
       "description": "Copy a file or directory tree on the host filesystem.",
       "properties": {
@@ -1235,8 +1046,6 @@
     },
     "ImageDetail": {
       "enum": [
-        "auto",
-        "low",
         "high",
         "original"
       ],
@@ -1732,194 +1541,6 @@
       ],
       "type": "string"
     },
-    "PermissionProfile": {
-      "oneOf": [
-        {
-          "description": "Codex owns sandbox construction for this profile.",
-          "properties": {
-            "fileSystem": {
-              "$ref": "#/definitions/PermissionProfileFileSystemPermissions"
-            },
-            "network": {
-              "$ref": "#/definitions/PermissionProfileNetworkPermissions"
-            },
-            "type": {
-              "enum": [
-                "managed"
-              ],
-              "title": "ManagedPermissionProfileType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "fileSystem",
-            "network",
-            "type"
-          ],
-          "title": "ManagedPermissionProfile",
-          "type": "object"
-        },
-        {
-          "description": "Do not apply an outer sandbox.",
-          "properties": {
-            "type": {
-              "enum": [
-                "disabled"
-              ],
-              "title": "DisabledPermissionProfileType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "DisabledPermissionProfile",
-          "type": "object"
-        },
-        {
-          "description": "Filesystem isolation is enforced by an external caller.",
-          "properties": {
-            "network": {
-              "$ref": "#/definitions/PermissionProfileNetworkPermissions"
-            },
-            "type": {
-              "enum": [
-                "external"
-              ],
-              "title": "ExternalPermissionProfileType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "network",
-            "type"
-          ],
-          "title": "ExternalPermissionProfile",
-          "type": "object"
-        }
-      ]
-    },
-    "PermissionProfileFileSystemPermissions": {
-      "oneOf": [
-        {
-          "properties": {
-            "entries": {
-              "items": {
-                "$ref": "#/definitions/FileSystemSandboxEntry"
-              },
-              "type": "array"
-            },
-            "globScanMaxDepth": {
-              "format": "uint",
-              "minimum": 1.0,
-              "type": [
-                "integer",
-                "null"
-              ]
-            },
-            "type": {
-              "enum": [
-                "restricted"
-              ],
-              "title": "RestrictedPermissionProfileFileSystemPermissionsType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "entries",
-            "type"
-          ],
-          "title": "RestrictedPermissionProfileFileSystemPermissions",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "unrestricted"
-              ],
-              "title": "UnrestrictedPermissionProfileFileSystemPermissionsType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "UnrestrictedPermissionProfileFileSystemPermissions",
-          "type": "object"
-        }
-      ]
-    },
-    "PermissionProfileModificationParams": {
-      "oneOf": [
-        {
-          "description": "Additional concrete directory that should be writable.",
-          "properties": {
-            "path": {
-              "$ref": "#/definitions/AbsolutePathBuf"
-            },
-            "type": {
-              "enum": [
-                "additionalWritableRoot"
-              ],
-              "title": "AdditionalWritableRootPermissionProfileModificationParamsType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "path",
-            "type"
-          ],
-          "title": "AdditionalWritableRootPermissionProfileModificationParams",
-          "type": "object"
-        }
-      ]
-    },
-    "PermissionProfileNetworkPermissions": {
-      "properties": {
-        "enabled": {
-          "type": "boolean"
-        }
-      },
-      "required": [
-        "enabled"
-      ],
-      "type": "object"
-    },
-    "PermissionProfileSelectionParams": {
-      "oneOf": [
-        {
-          "description": "Select a named built-in or user-defined profile and optionally apply bounded modifications that Codex knows how to validate.",
-          "properties": {
-            "id": {
-              "type": "string"
-            },
-            "modifications": {
-              "items": {
-                "$ref": "#/definitions/PermissionProfileModificationParams"
-              },
-              "type": [
-                "array",
-                "null"
-              ]
-            },
-            "type": {
-              "enum": [
-                "profile"
-              ],
-              "title": "ProfilePermissionProfileSelectionParamsType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "id",
-            "type"
-          ],
-          "title": "ProfilePermissionProfileSelectionParams",
-          "type": "object"
-        }
-      ]
-    },
     "Personality": {
       "enum": [
         "none",
@@ -1955,6 +1576,31 @@
       ],
       "type": "object"
     },
+    "PluginInstalledParams": {
+      "properties": {
+        "cwds": {
+          "description": "Optional working directories used to discover repo marketplaces.",
+          "items": {
+            "$ref": "#/definitions/AbsolutePathBuf"
+          },
+          "type": [
+            "array",
+            "null"
+          ]
+        },
+        "installSuggestionPluginNames": {
+          "description": "Additional uninstalled plugin names that should be returned when present locally. This is used by mention surfaces that intentionally expose install entrypoints.",
+          "items": {
+            "type": "string"
+          },
+          "type": [
+            "array",
+            "null"
+          ]
+        }
+      },
+      "type": "object"
+    },
     "PluginListMarketplaceKind": {
       "enum": [
         "local",
@@ -2788,6 +2434,22 @@
           "title": "CompactionResponseItem",
           "type": "object"
         },
+        {
+          "properties": {
+            "type": {
+              "enum": [
+                "compaction_trigger"
+              ],
+              "title": "CompactionTriggerResponseItemType",
+              "type": "string"
+            }
+          },
+          "required": [
+            "type"
+          ],
+          "title": "CompactionTriggerResponseItem",
+          "type": "object"
+        },
         {
           "properties": {
             "encrypted_content": {
@@ -3345,7 +3007,7 @@
       "type": "object"
     },
     "ThreadForkParams": {
-      "description": "There are two ways to fork a thread: 1. By thread_id: load the thread from disk by thread_id and fork it into a new thread. 2. By path: load the thread from disk by path and fork it into a new thread.\n\nIf using path, the thread_id param will be ignored.\n\nPrefer using thread_id whenever possible.",
+      "description": "There are two ways to fork a thread: 1. By thread_id: load the thread from disk by thread_id and fork it into a new thread. 2. By path: load the thread from disk by path and fork it into a new thread.\n\nIf using a non-empty path, the thread_id param will be ignored. Empty string path values are treated as absent.\n\nPrefer using thread_id whenever possible.",
       "properties": {
         "approvalPolicy": {
           "anyOf": [
@@ -3449,6 +3111,8 @@
       "enum": [
         "active",
         "paused",
+        "blocked",
+        "usageLimited",
         "budgetLimited",
         "complete"
       ],
@@ -3749,7 +3413,7 @@
       ]
     },
     "ThreadResumeParams": {
-      "description": "There are three ways to resume a thread: 1. By thread_id: load the thread from disk by thread_id and resume it. 2. By history: instantiate the thread from memory and resume it. 3. By path: load the thread from disk by path and resume it.\n\nThe precedence is: history > path > thread_id. If using history or path, the thread_id param will be ignored.\n\nPrefer using thread_id whenever possible.",
+      "description": "There are three ways to resume a thread: 1. By thread_id: load the thread from disk by thread_id and resume it. 2. By history: instantiate the thread from memory and resume it. 3. By path: load the thread from disk by path and resume it.\n\nFor non-running threads, the precedence is: history > non-empty path > thread_id. If using history or a non-empty path for a non-running thread, the thread_id param will be ignored.\n\nIf thread_id identifies a running thread, app-server rejoins that thread and treats a non-empty path as a consistency check against the active rollout path. Empty string path values are treated as absent.\n\nPrefer using thread_id whenever possible.",
       "properties": {
         "approvalPolicy": {
           "anyOf": [
@@ -4293,6 +3957,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "type": {
               "enum": [
                 "image"
@@ -4313,6 +3988,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "path": {
               "type": "string"
             },
@@ -4966,6 +4652,30 @@
       "title": "Plugin/listRequest",
       "type": "object"
     },
+    {
+      "properties": {
+        "id": {
+          "$ref": "#/definitions/RequestId"
+        },
+        "method": {
+          "enum": [
+            "plugin/installed"
+          ],
+          "title": "Plugin/installedRequestMethod",
+          "type": "string"
+        },
+        "params": {
+          "$ref": "#/definitions/PluginInstalledParams"
+        }
+      },
+      "required": [
+        "id",
+        "method",
+        "params"
+      ],
+      "title": "Plugin/installedRequest",
+      "type": "object"
+    },
     {
       "properties": {
         "id": {
diff --git a/codex-rs/app-server-protocol/schema/json/CommandExecutionRequestApprovalParams.json b/codex-rs/app-server-protocol/schema/json/CommandExecutionRequestApprovalParams.json
index 5b6c4cd185..922db80f2f 100644
--- a/codex-rs/app-server-protocol/schema/json/CommandExecutionRequestApprovalParams.json
+++ b/codex-rs/app-server-protocol/schema/json/CommandExecutionRequestApprovalParams.json
@@ -277,7 +277,7 @@
       "enum": [
         "read",
         "write",
-        "none"
+        "deny"
       ],
       "type": "string"
     },
diff --git a/codex-rs/app-server-protocol/schema/json/PermissionsRequestApprovalParams.json b/codex-rs/app-server-protocol/schema/json/PermissionsRequestApprovalParams.json
index 1383da6124..337a469890 100644
--- a/codex-rs/app-server-protocol/schema/json/PermissionsRequestApprovalParams.json
+++ b/codex-rs/app-server-protocol/schema/json/PermissionsRequestApprovalParams.json
@@ -62,7 +62,7 @@
       "enum": [
         "read",
         "write",
-        "none"
+        "deny"
       ],
       "type": "string"
     },
diff --git a/codex-rs/app-server-protocol/schema/json/PermissionsRequestApprovalResponse.json b/codex-rs/app-server-protocol/schema/json/PermissionsRequestApprovalResponse.json
index 3e775a3da9..5cce2cdc5a 100644
--- a/codex-rs/app-server-protocol/schema/json/PermissionsRequestApprovalResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/PermissionsRequestApprovalResponse.json
@@ -62,7 +62,7 @@
       "enum": [
         "read",
         "write",
-        "none"
+        "deny"
       ],
       "type": "string"
     },
diff --git a/codex-rs/app-server-protocol/schema/json/ServerNotification.json b/codex-rs/app-server-protocol/schema/json/ServerNotification.json
index dd7f04d96a..fc23c6f922 100644
--- a/codex-rs/app-server-protocol/schema/json/ServerNotification.json
+++ b/codex-rs/app-server-protocol/schema/json/ServerNotification.json
@@ -1085,7 +1085,7 @@
       "enum": [
         "read",
         "write",
-        "none"
+        "deny"
       ],
       "type": "string"
     },
@@ -1740,6 +1740,7 @@
         "postCompact",
         "sessionStart",
         "userPromptSubmit",
+        "subagentStart",
         "stop"
       ],
       "type": "string"
@@ -1947,6 +1948,13 @@
       ],
       "type": "string"
     },
+    "ImageDetail": {
+      "enum": [
+        "high",
+        "original"
+      ],
+      "type": "string"
+    },
     "ItemCompletedNotification": {
       "properties": {
         "completedAtMs": {
@@ -2763,12 +2771,16 @@
         "installationId": {
           "type": "string"
         },
+        "serverName": {
+          "type": "string"
+        },
         "status": {
           "$ref": "#/definitions/RemoteControlConnectionStatus"
         }
       },
       "required": [
         "installationId",
+        "serverName",
         "status"
       ],
       "type": "object"
@@ -3261,6 +3273,8 @@
       "enum": [
         "active",
         "paused",
+        "blocked",
+        "usageLimited",
         "budgetLimited",
         "complete"
       ],
@@ -4604,6 +4618,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "type": {
               "enum": [
                 "image"
@@ -4624,6 +4649,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "path": {
               "type": "string"
             },
diff --git a/codex-rs/app-server-protocol/schema/json/ServerRequest.json b/codex-rs/app-server-protocol/schema/json/ServerRequest.json
index 697cb22e92..411095f2c2 100644
--- a/codex-rs/app-server-protocol/schema/json/ServerRequest.json
+++ b/codex-rs/app-server-protocol/schema/json/ServerRequest.json
@@ -631,7 +631,7 @@
       "enum": [
         "read",
         "write",
-        "none"
+        "deny"
       ],
       "type": "string"
     },
diff --git a/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json b/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json
index d833b5e14e..70088bdf19 100644
--- a/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json
+++ b/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.schemas.json
@@ -757,6 +757,30 @@
           "title": "Plugin/listRequest",
           "type": "object"
         },
+        {
+          "properties": {
+            "id": {
+              "$ref": "#/definitions/v2/RequestId"
+            },
+            "method": {
+              "enum": [
+                "plugin/installed"
+              ],
+              "title": "Plugin/installedRequestMethod",
+              "type": "string"
+            },
+            "params": {
+              "$ref": "#/definitions/v2/PluginInstalledParams"
+            }
+          },
+          "required": [
+            "id",
+            "method",
+            "params"
+          ],
+          "title": "Plugin/installedRequest",
+          "type": "object"
+        },
         {
           "properties": {
             "id": {
@@ -5607,14 +5631,6 @@
           "id": {
             "description": "Identifier from `default_permissions` or the implicit built-in default, such as `:workspace` or a user-defined `[permissions.<id>]` profile.",
             "type": "string"
-          },
-          "modifications": {
-            "default": [],
-            "description": "Bounded user-requested modifications applied on top of the named profile, if any.",
-            "items": {
-              "$ref": "#/definitions/v2/ActivePermissionProfileModification"
-            },
-            "type": "array"
           }
         },
         "required": [
@@ -5622,31 +5638,6 @@
         ],
         "type": "object"
       },
-      "ActivePermissionProfileModification": {
-        "oneOf": [
-          {
-            "description": "Additional concrete directory that should be writable.",
-            "properties": {
-              "path": {
-                "$ref": "#/definitions/v2/AbsolutePathBuf"
-              },
-              "type": {
-                "enum": [
-                  "additionalWritableRoot"
-                ],
-                "title": "AdditionalWritableRootActivePermissionProfileModificationType",
-                "type": "string"
-              }
-            },
-            "required": [
-              "path",
-              "type"
-            ],
-            "title": "AdditionalWritableRootActivePermissionProfileModification",
-            "type": "object"
-          }
-        ]
-      },
       "AddCreditsNudgeCreditType": {
         "enum": [
           "credits",
@@ -6323,6 +6314,25 @@
           }
         ]
       },
+      "AutoCompactTokenLimitScope": {
+        "description": "Selects which part of the active context is charged against `model_auto_compact_token_limit`.",
+        "oneOf": [
+          {
+            "description": "Count the full active context against the limit.",
+            "enum": [
+              "total"
+            ],
+            "type": "string"
+          },
+          {
+            "description": "Count sampled output and later growth after the carried window prefix.",
+            "enum": [
+              "body_after_prefix"
+            ],
+            "type": "string"
+          }
+        ]
+      },
       "AutoReviewDecisionSource": {
         "description": "[UNSTABLE] Source that produced a terminal approval auto-review decision.",
         "enum": [
@@ -7119,6 +7129,13 @@
               "null"
             ]
           },
+          "desktop": {
+            "additionalProperties": true,
+            "type": [
+              "object",
+              "null"
+            ]
+          },
           "developer_instructions": {
             "type": [
               "string",
@@ -7126,9 +7143,13 @@
             ]
           },
           "forced_chatgpt_workspace_id": {
-            "type": [
-              "string",
-              "null"
+            "anyOf": [
+              {
+                "$ref": "#/definitions/v2/ForcedChatgptWorkspaceIds"
+              },
+              {
+                "type": "null"
+              }
             ]
           },
           "forced_login_method": {
@@ -7160,6 +7181,16 @@
               "null"
             ]
           },
+          "model_auto_compact_token_limit_scope": {
+            "anyOf": [
+              {
+                "$ref": "#/definitions/v2/AutoCompactTokenLimitScope"
+              },
+              {
+                "type": "null"
+              }
+            ]
+          },
           "model_context_window": {
             "format": "int64",
             "type": [
@@ -7423,6 +7454,13 @@
                 ],
                 "description": "This is the path to the user's config.toml file, though it is not guaranteed to exist."
               },
+              "profile": {
+                "description": "Name of the selected profile-v2 config layered on top of the base user config, when this layer represents one.",
+                "type": [
+                  "string",
+                  "null"
+                ]
+              },
               "type": {
                 "enum": [
                   "user"
@@ -8185,6 +8223,13 @@
               "integer",
               "null"
             ]
+          },
+          "threadId": {
+            "description": "Optional loaded thread id. Pass this when showing feature state for an existing thread so enablement is computed from that thread's refreshed config, including project-local config for the thread's cwd.",
+            "type": [
+              "string",
+              "null"
+            ]
           }
         },
         "title": "ExperimentalFeatureListParams",
@@ -8479,7 +8524,7 @@
         "enum": [
           "read",
           "write",
-          "none"
+          "deny"
         ],
         "type": "string"
       },
@@ -8690,6 +8735,20 @@
         ],
         "type": "object"
       },
+      "ForcedChatgptWorkspaceIds": {
+        "anyOf": [
+          {
+            "type": "string"
+          },
+          {
+            "items": {
+              "type": "string"
+            },
+            "type": "array"
+          }
+        ],
+        "description": "Backward-compatible API shape for ChatGPT workspace login restrictions."
+      },
       "ForcedLoginMethod": {
         "enum": [
           "chatgpt",
@@ -9565,6 +9624,7 @@
           "postCompact",
           "sessionStart",
           "userPromptSubmit",
+          "subagentStart",
           "stop"
         ],
         "type": "string"
@@ -9936,8 +9996,6 @@
       },
       "ImageDetail": {
         "enum": [
-          "auto",
-          "low",
           "high",
           "original"
         ],
@@ -10472,6 +10530,12 @@
             },
             "type": "array"
           },
+          "SubagentStart": {
+            "items": {
+              "$ref": "#/definitions/v2/ConfiguredHookMatcherGroup"
+            },
+            "type": "array"
+          },
           "UserPromptSubmit": {
             "items": {
               "$ref": "#/definitions/v2/ConfiguredHookMatcherGroup"
@@ -10499,6 +10563,7 @@
           "PreToolUse",
           "SessionStart",
           "Stop",
+          "SubagentStart",
           "UserPromptSubmit"
         ],
         "type": "object"
@@ -11637,194 +11702,6 @@
           }
         ]
       },
-      "PermissionProfile": {
-        "oneOf": [
-          {
-            "description": "Codex owns sandbox construction for this profile.",
-            "properties": {
-              "fileSystem": {
-                "$ref": "#/definitions/v2/PermissionProfileFileSystemPermissions"
-              },
-              "network": {
-                "$ref": "#/definitions/v2/PermissionProfileNetworkPermissions"
-              },
-              "type": {
-                "enum": [
-                  "managed"
-                ],
-                "title": "ManagedPermissionProfileType",
-                "type": "string"
-              }
-            },
-            "required": [
-              "fileSystem",
-              "network",
-              "type"
-            ],
-            "title": "ManagedPermissionProfile",
-            "type": "object"
-          },
-          {
-            "description": "Do not apply an outer sandbox.",
-            "properties": {
-              "type": {
-                "enum": [
-                  "disabled"
-                ],
-                "title": "DisabledPermissionProfileType",
-                "type": "string"
-              }
-            },
-            "required": [
-              "type"
-            ],
-            "title": "DisabledPermissionProfile",
-            "type": "object"
-          },
-          {
-            "description": "Filesystem isolation is enforced by an external caller.",
-            "properties": {
-              "network": {
-                "$ref": "#/definitions/v2/PermissionProfileNetworkPermissions"
-              },
-              "type": {
-                "enum": [
-                  "external"
-                ],
-                "title": "ExternalPermissionProfileType",
-                "type": "string"
-              }
-            },
-            "required": [
-              "network",
-              "type"
-            ],
-            "title": "ExternalPermissionProfile",
-            "type": "object"
-          }
-        ]
-      },
-      "PermissionProfileFileSystemPermissions": {
-        "oneOf": [
-          {
-            "properties": {
-              "entries": {
-                "items": {
-                  "$ref": "#/definitions/v2/FileSystemSandboxEntry"
-                },
-                "type": "array"
-              },
-              "globScanMaxDepth": {
-                "format": "uint",
-                "minimum": 1.0,
-                "type": [
-                  "integer",
-                  "null"
-                ]
-              },
-              "type": {
-                "enum": [
-                  "restricted"
-                ],
-                "title": "RestrictedPermissionProfileFileSystemPermissionsType",
-                "type": "string"
-              }
-            },
-            "required": [
-              "entries",
-              "type"
-            ],
-            "title": "RestrictedPermissionProfileFileSystemPermissions",
-            "type": "object"
-          },
-          {
-            "properties": {
-              "type": {
-                "enum": [
-                  "unrestricted"
-                ],
-                "title": "UnrestrictedPermissionProfileFileSystemPermissionsType",
-                "type": "string"
-              }
-            },
-            "required": [
-              "type"
-            ],
-            "title": "UnrestrictedPermissionProfileFileSystemPermissions",
-            "type": "object"
-          }
-        ]
-      },
-      "PermissionProfileModificationParams": {
-        "oneOf": [
-          {
-            "description": "Additional concrete directory that should be writable.",
-            "properties": {
-              "path": {
-                "$ref": "#/definitions/v2/AbsolutePathBuf"
-              },
-              "type": {
-                "enum": [
-                  "additionalWritableRoot"
-                ],
-                "title": "AdditionalWritableRootPermissionProfileModificationParamsType",
-                "type": "string"
-              }
-            },
-            "required": [
-              "path",
-              "type"
-            ],
-            "title": "AdditionalWritableRootPermissionProfileModificationParams",
-            "type": "object"
-          }
-        ]
-      },
-      "PermissionProfileNetworkPermissions": {
-        "properties": {
-          "enabled": {
-            "type": "boolean"
-          }
-        },
-        "required": [
-          "enabled"
-        ],
-        "type": "object"
-      },
-      "PermissionProfileSelectionParams": {
-        "oneOf": [
-          {
-            "description": "Select a named built-in or user-defined profile and optionally apply bounded modifications that Codex knows how to validate.",
-            "properties": {
-              "id": {
-                "type": "string"
-              },
-              "modifications": {
-                "items": {
-                  "$ref": "#/definitions/v2/PermissionProfileModificationParams"
-                },
-                "type": [
-                  "array",
-                  "null"
-                ]
-              },
-              "type": {
-                "enum": [
-                  "profile"
-                ],
-                "title": "ProfilePermissionProfileSelectionParamsType",
-                "type": "string"
-              }
-            },
-            "required": [
-              "id",
-              "type"
-            ],
-            "title": "ProfilePermissionProfileSelectionParams",
-            "type": "object"
-          }
-        ]
-      },
       "Personality": {
         "enum": [
           "none",
@@ -12031,6 +11908,56 @@
         "title": "PluginInstallResponse",
         "type": "object"
       },
+      "PluginInstalledParams": {
+        "$schema": "http://json-schema.org/draft-07/schema#",
+        "properties": {
+          "cwds": {
+            "description": "Optional working directories used to discover repo marketplaces.",
+            "items": {
+              "$ref": "#/definitions/v2/AbsolutePathBuf"
+            },
+            "type": [
+              "array",
+              "null"
+            ]
+          },
+          "installSuggestionPluginNames": {
+            "description": "Additional uninstalled plugin names that should be returned when present locally. This is used by mention surfaces that intentionally expose install entrypoints.",
+            "items": {
+              "type": "string"
+            },
+            "type": [
+              "array",
+              "null"
+            ]
+          }
+        },
+        "title": "PluginInstalledParams",
+        "type": "object"
+      },
+      "PluginInstalledResponse": {
+        "$schema": "http://json-schema.org/draft-07/schema#",
+        "properties": {
+          "marketplaceLoadErrors": {
+            "default": [],
+            "items": {
+              "$ref": "#/definitions/v2/MarketplaceLoadErrorInfo"
+            },
+            "type": "array"
+          },
+          "marketplaces": {
+            "items": {
+              "$ref": "#/definitions/v2/PluginMarketplaceEntry"
+            },
+            "type": "array"
+          }
+        },
+        "required": [
+          "marketplaces"
+        ],
+        "title": "PluginInstalledResponse",
+        "type": "object"
+      },
       "PluginInterface": {
         "properties": {
           "brandColor": {
@@ -13521,12 +13448,16 @@
           "installationId": {
             "type": "string"
           },
+          "serverName": {
+            "type": "string"
+          },
           "status": {
             "$ref": "#/definitions/v2/RemoteControlConnectionStatus"
           }
         },
         "required": [
           "installationId",
+          "serverName",
           "status"
         ],
         "title": "RemoteControlStatusChangedNotification",
@@ -14140,6 +14071,22 @@
             "title": "CompactionResponseItem",
             "type": "object"
           },
+          {
+            "properties": {
+              "type": {
+                "enum": [
+                  "compaction_trigger"
+                ],
+                "title": "CompactionTriggerResponseItemType",
+                "type": "string"
+              }
+            },
+            "required": [
+              "type"
+            ],
+            "title": "CompactionTriggerResponseItem",
+            "type": "object"
+          },
           {
             "properties": {
               "encrypted_content": {
@@ -15438,7 +15385,7 @@
       },
       "ThreadForkParams": {
         "$schema": "http://json-schema.org/draft-07/schema#",
-        "description": "There are two ways to fork a thread: 1. By thread_id: load the thread from disk by thread_id and fork it into a new thread. 2. By path: load the thread from disk by path and fork it into a new thread.\n\nIf using path, the thread_id param will be ignored.\n\nPrefer using thread_id whenever possible.",
+        "description": "There are two ways to fork a thread: 1. By thread_id: load the thread from disk by thread_id and fork it into a new thread. 2. By path: load the thread from disk by path and fork it into a new thread.\n\nIf using a non-empty path, the thread_id param will be ignored. Empty string path values are treated as absent.\n\nPrefer using thread_id whenever possible.",
         "properties": {
           "approvalPolicy": {
             "anyOf": [
@@ -15586,7 +15533,7 @@
                 "$ref": "#/definitions/v2/SandboxPolicy"
               }
             ],
-            "description": "Legacy sandbox policy retained for compatibility. Experimental clients should prefer `permissionProfile` when they need exact runtime permissions."
+            "description": "Legacy sandbox policy retained for compatibility. Experimental clients should prefer `activePermissionProfile` for profile provenance."
           },
           "serviceTier": {
             "type": [
@@ -15673,6 +15620,8 @@
         "enum": [
           "active",
           "paused",
+          "blocked",
+          "usageLimited",
           "budgetLimited",
           "complete"
         ],
@@ -16934,7 +16883,7 @@
       },
       "ThreadResumeParams": {
         "$schema": "http://json-schema.org/draft-07/schema#",
-        "description": "There are three ways to resume a thread: 1. By thread_id: load the thread from disk by thread_id and resume it. 2. By history: instantiate the thread from memory and resume it. 3. By path: load the thread from disk by path and resume it.\n\nThe precedence is: history > path > thread_id. If using history or path, the thread_id param will be ignored.\n\nPrefer using thread_id whenever possible.",
+        "description": "There are three ways to resume a thread: 1. By thread_id: load the thread from disk by thread_id and resume it. 2. By history: instantiate the thread from memory and resume it. 3. By path: load the thread from disk by path and resume it.\n\nFor non-running threads, the precedence is: history > non-empty path > thread_id. If using history or a non-empty path for a non-running thread, the thread_id param will be ignored.\n\nIf thread_id identifies a running thread, app-server rejoins that thread and treats a non-empty path as a consistency check against the active rollout path. Empty string path values are treated as absent.\n\nPrefer using thread_id whenever possible.",
         "properties": {
           "approvalPolicy": {
             "anyOf": [
@@ -17078,7 +17027,7 @@
                 "$ref": "#/definitions/v2/SandboxPolicy"
               }
             ],
-            "description": "Legacy sandbox policy retained for compatibility. Experimental clients should prefer `permissionProfile` when they need exact runtime permissions."
+            "description": "Legacy sandbox policy retained for compatibility. Experimental clients should prefer `activePermissionProfile` for profile provenance."
           },
           "serviceTier": {
             "type": [
@@ -17386,7 +17335,7 @@
                 "$ref": "#/definitions/v2/SandboxPolicy"
               }
             ],
-            "description": "Legacy sandbox policy retained for compatibility. Experimental clients should prefer `permissionProfile` when they need exact runtime permissions."
+            "description": "Legacy sandbox policy retained for compatibility. Experimental clients should prefer `activePermissionProfile` for profile provenance."
           },
           "serviceTier": {
             "type": [
@@ -17708,12 +17657,6 @@
       },
       "ToolsV2": {
         "properties": {
-          "view_image": {
-            "type": [
-              "boolean",
-              "null"
-            ]
-          },
           "web_search": {
             "anyOf": [
               {
@@ -18195,6 +18138,17 @@
           },
           {
             "properties": {
+              "detail": {
+                "anyOf": [
+                  {
+                    "$ref": "#/definitions/v2/ImageDetail"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "default": null
+              },
               "type": {
                 "enum": [
                   "image"
@@ -18215,6 +18169,17 @@
           },
           {
             "properties": {
+              "detail": {
+                "anyOf": [
+                  {
+                    "$ref": "#/definitions/v2/ImageDetail"
+                  },
+                  {
+                    "type": "null"
+                  }
+                ],
+                "default": null
+              },
               "path": {
                 "type": "string"
               },
diff --git a/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json b/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json
index 4df7402c8c..64dd46ce69 100644
--- a/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json
+++ b/codex-rs/app-server-protocol/schema/json/codex_app_server_protocol.v2.schemas.json
@@ -143,14 +143,6 @@
         "id": {
           "description": "Identifier from `default_permissions` or the implicit built-in default, such as `:workspace` or a user-defined `[permissions.<id>]` profile.",
           "type": "string"
-        },
-        "modifications": {
-          "default": [],
-          "description": "Bounded user-requested modifications applied on top of the named profile, if any.",
-          "items": {
-            "$ref": "#/definitions/ActivePermissionProfileModification"
-          },
-          "type": "array"
         }
       },
       "required": [
@@ -158,31 +150,6 @@
       ],
       "type": "object"
     },
-    "ActivePermissionProfileModification": {
-      "oneOf": [
-        {
-          "description": "Additional concrete directory that should be writable.",
-          "properties": {
-            "path": {
-              "$ref": "#/definitions/AbsolutePathBuf"
-            },
-            "type": {
-              "enum": [
-                "additionalWritableRoot"
-              ],
-              "title": "AdditionalWritableRootActivePermissionProfileModificationType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "path",
-            "type"
-          ],
-          "title": "AdditionalWritableRootActivePermissionProfileModification",
-          "type": "object"
-        }
-      ]
-    },
     "AddCreditsNudgeCreditType": {
       "enum": [
         "credits",
@@ -859,6 +826,25 @@
         }
       ]
     },
+    "AutoCompactTokenLimitScope": {
+      "description": "Selects which part of the active context is charged against `model_auto_compact_token_limit`.",
+      "oneOf": [
+        {
+          "description": "Count the full active context against the limit.",
+          "enum": [
+            "total"
+          ],
+          "type": "string"
+        },
+        {
+          "description": "Count sampled output and later growth after the carried window prefix.",
+          "enum": [
+            "body_after_prefix"
+          ],
+          "type": "string"
+        }
+      ]
+    },
     "AutoReviewDecisionSource": {
       "description": "[UNSTABLE] Source that produced a terminal approval auto-review decision.",
       "enum": [
@@ -1497,6 +1483,30 @@
           "title": "Plugin/listRequest",
           "type": "object"
         },
+        {
+          "properties": {
+            "id": {
+              "$ref": "#/definitions/RequestId"
+            },
+            "method": {
+              "enum": [
+                "plugin/installed"
+              ],
+              "title": "Plugin/installedRequestMethod",
+              "type": "string"
+            },
+            "params": {
+              "$ref": "#/definitions/PluginInstalledParams"
+            }
+          },
+          "required": [
+            "id",
+            "method",
+            "params"
+          ],
+          "title": "Plugin/installedRequest",
+          "type": "object"
+        },
         {
           "properties": {
             "id": {
@@ -3508,6 +3518,13 @@
             "null"
           ]
         },
+        "desktop": {
+          "additionalProperties": true,
+          "type": [
+            "object",
+            "null"
+          ]
+        },
         "developer_instructions": {
           "type": [
             "string",
@@ -3515,9 +3532,13 @@
           ]
         },
         "forced_chatgpt_workspace_id": {
-          "type": [
-            "string",
-            "null"
+          "anyOf": [
+            {
+              "$ref": "#/definitions/ForcedChatgptWorkspaceIds"
+            },
+            {
+              "type": "null"
+            }
           ]
         },
         "forced_login_method": {
@@ -3549,6 +3570,16 @@
             "null"
           ]
         },
+        "model_auto_compact_token_limit_scope": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/AutoCompactTokenLimitScope"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
         "model_context_window": {
           "format": "int64",
           "type": [
@@ -3812,6 +3843,13 @@
               ],
               "description": "This is the path to the user's config.toml file, though it is not guaranteed to exist."
             },
+            "profile": {
+              "description": "Name of the selected profile-v2 config layered on top of the base user config, when this layer represents one.",
+              "type": [
+                "string",
+                "null"
+              ]
+            },
             "type": {
               "enum": [
                 "user"
@@ -4574,6 +4612,13 @@
             "integer",
             "null"
           ]
+        },
+        "threadId": {
+          "description": "Optional loaded thread id. Pass this when showing feature state for an existing thread so enablement is computed from that thread's refreshed config, including project-local config for the thread's cwd.",
+          "type": [
+            "string",
+            "null"
+          ]
         }
       },
       "title": "ExperimentalFeatureListParams",
@@ -4868,7 +4913,7 @@
       "enum": [
         "read",
         "write",
-        "none"
+        "deny"
       ],
       "type": "string"
     },
@@ -5079,6 +5124,20 @@
       ],
       "type": "object"
     },
+    "ForcedChatgptWorkspaceIds": {
+      "anyOf": [
+        {
+          "type": "string"
+        },
+        {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      ],
+      "description": "Backward-compatible API shape for ChatGPT workspace login restrictions."
+    },
     "ForcedLoginMethod": {
       "enum": [
         "chatgpt",
@@ -6065,6 +6124,7 @@
         "postCompact",
         "sessionStart",
         "userPromptSubmit",
+        "subagentStart",
         "stop"
       ],
       "type": "string"
@@ -6436,8 +6496,6 @@
     },
     "ImageDetail": {
       "enum": [
-        "auto",
-        "low",
         "high",
         "original"
       ],
@@ -7021,6 +7079,12 @@
           },
           "type": "array"
         },
+        "SubagentStart": {
+          "items": {
+            "$ref": "#/definitions/ConfiguredHookMatcherGroup"
+          },
+          "type": "array"
+        },
         "UserPromptSubmit": {
           "items": {
             "$ref": "#/definitions/ConfiguredHookMatcherGroup"
@@ -7048,6 +7112,7 @@
         "PreToolUse",
         "SessionStart",
         "Stop",
+        "SubagentStart",
         "UserPromptSubmit"
       ],
       "type": "object"
@@ -8186,194 +8251,6 @@
         }
       ]
     },
-    "PermissionProfile": {
-      "oneOf": [
-        {
-          "description": "Codex owns sandbox construction for this profile.",
-          "properties": {
-            "fileSystem": {
-              "$ref": "#/definitions/PermissionProfileFileSystemPermissions"
-            },
-            "network": {
-              "$ref": "#/definitions/PermissionProfileNetworkPermissions"
-            },
-            "type": {
-              "enum": [
-                "managed"
-              ],
-              "title": "ManagedPermissionProfileType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "fileSystem",
-            "network",
-            "type"
-          ],
-          "title": "ManagedPermissionProfile",
-          "type": "object"
-        },
-        {
-          "description": "Do not apply an outer sandbox.",
-          "properties": {
-            "type": {
-              "enum": [
-                "disabled"
-              ],
-              "title": "DisabledPermissionProfileType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "DisabledPermissionProfile",
-          "type": "object"
-        },
-        {
-          "description": "Filesystem isolation is enforced by an external caller.",
-          "properties": {
-            "network": {
-              "$ref": "#/definitions/PermissionProfileNetworkPermissions"
-            },
-            "type": {
-              "enum": [
-                "external"
-              ],
-              "title": "ExternalPermissionProfileType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "network",
-            "type"
-          ],
-          "title": "ExternalPermissionProfile",
-          "type": "object"
-        }
-      ]
-    },
-    "PermissionProfileFileSystemPermissions": {
-      "oneOf": [
-        {
-          "properties": {
-            "entries": {
-              "items": {
-                "$ref": "#/definitions/FileSystemSandboxEntry"
-              },
-              "type": "array"
-            },
-            "globScanMaxDepth": {
-              "format": "uint",
-              "minimum": 1.0,
-              "type": [
-                "integer",
-                "null"
-              ]
-            },
-            "type": {
-              "enum": [
-                "restricted"
-              ],
-              "title": "RestrictedPermissionProfileFileSystemPermissionsType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "entries",
-            "type"
-          ],
-          "title": "RestrictedPermissionProfileFileSystemPermissions",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "unrestricted"
-              ],
-              "title": "UnrestrictedPermissionProfileFileSystemPermissionsType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "UnrestrictedPermissionProfileFileSystemPermissions",
-          "type": "object"
-        }
-      ]
-    },
-    "PermissionProfileModificationParams": {
-      "oneOf": [
-        {
-          "description": "Additional concrete directory that should be writable.",
-          "properties": {
-            "path": {
-              "$ref": "#/definitions/AbsolutePathBuf"
-            },
-            "type": {
-              "enum": [
-                "additionalWritableRoot"
-              ],
-              "title": "AdditionalWritableRootPermissionProfileModificationParamsType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "path",
-            "type"
-          ],
-          "title": "AdditionalWritableRootPermissionProfileModificationParams",
-          "type": "object"
-        }
-      ]
-    },
-    "PermissionProfileNetworkPermissions": {
-      "properties": {
-        "enabled": {
-          "type": "boolean"
-        }
-      },
-      "required": [
-        "enabled"
-      ],
-      "type": "object"
-    },
-    "PermissionProfileSelectionParams": {
-      "oneOf": [
-        {
-          "description": "Select a named built-in or user-defined profile and optionally apply bounded modifications that Codex knows how to validate.",
-          "properties": {
-            "id": {
-              "type": "string"
-            },
-            "modifications": {
-              "items": {
-                "$ref": "#/definitions/PermissionProfileModificationParams"
-              },
-              "type": [
-                "array",
-                "null"
-              ]
-            },
-            "type": {
-              "enum": [
-                "profile"
-              ],
-              "title": "ProfilePermissionProfileSelectionParamsType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "id",
-            "type"
-          ],
-          "title": "ProfilePermissionProfileSelectionParams",
-          "type": "object"
-        }
-      ]
-    },
     "Personality": {
       "enum": [
         "none",
@@ -8580,6 +8457,56 @@
       "title": "PluginInstallResponse",
       "type": "object"
     },
+    "PluginInstalledParams": {
+      "$schema": "http://json-schema.org/draft-07/schema#",
+      "properties": {
+        "cwds": {
+          "description": "Optional working directories used to discover repo marketplaces.",
+          "items": {
+            "$ref": "#/definitions/AbsolutePathBuf"
+          },
+          "type": [
+            "array",
+            "null"
+          ]
+        },
+        "installSuggestionPluginNames": {
+          "description": "Additional uninstalled plugin names that should be returned when present locally. This is used by mention surfaces that intentionally expose install entrypoints.",
+          "items": {
+            "type": "string"
+          },
+          "type": [
+            "array",
+            "null"
+          ]
+        }
+      },
+      "title": "PluginInstalledParams",
+      "type": "object"
+    },
+    "PluginInstalledResponse": {
+      "$schema": "http://json-schema.org/draft-07/schema#",
+      "properties": {
+        "marketplaceLoadErrors": {
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/MarketplaceLoadErrorInfo"
+          },
+          "type": "array"
+        },
+        "marketplaces": {
+          "items": {
+            "$ref": "#/definitions/PluginMarketplaceEntry"
+          },
+          "type": "array"
+        }
+      },
+      "required": [
+        "marketplaces"
+      ],
+      "title": "PluginInstalledResponse",
+      "type": "object"
+    },
     "PluginInterface": {
       "properties": {
         "brandColor": {
@@ -10070,12 +9997,16 @@
         "installationId": {
           "type": "string"
         },
+        "serverName": {
+          "type": "string"
+        },
         "status": {
           "$ref": "#/definitions/RemoteControlConnectionStatus"
         }
       },
       "required": [
         "installationId",
+        "serverName",
         "status"
       ],
       "title": "RemoteControlStatusChangedNotification",
@@ -10689,6 +10620,22 @@
           "title": "CompactionResponseItem",
           "type": "object"
         },
+        {
+          "properties": {
+            "type": {
+              "enum": [
+                "compaction_trigger"
+              ],
+              "title": "CompactionTriggerResponseItemType",
+              "type": "string"
+            }
+          },
+          "required": [
+            "type"
+          ],
+          "title": "CompactionTriggerResponseItem",
+          "type": "object"
+        },
         {
           "properties": {
             "encrypted_content": {
@@ -13262,7 +13209,7 @@
     },
     "ThreadForkParams": {
       "$schema": "http://json-schema.org/draft-07/schema#",
-      "description": "There are two ways to fork a thread: 1. By thread_id: load the thread from disk by thread_id and fork it into a new thread. 2. By path: load the thread from disk by path and fork it into a new thread.\n\nIf using path, the thread_id param will be ignored.\n\nPrefer using thread_id whenever possible.",
+      "description": "There are two ways to fork a thread: 1. By thread_id: load the thread from disk by thread_id and fork it into a new thread. 2. By path: load the thread from disk by path and fork it into a new thread.\n\nIf using a non-empty path, the thread_id param will be ignored. Empty string path values are treated as absent.\n\nPrefer using thread_id whenever possible.",
       "properties": {
         "approvalPolicy": {
           "anyOf": [
@@ -13410,7 +13357,7 @@
               "$ref": "#/definitions/SandboxPolicy"
             }
           ],
-          "description": "Legacy sandbox policy retained for compatibility. Experimental clients should prefer `permissionProfile` when they need exact runtime permissions."
+          "description": "Legacy sandbox policy retained for compatibility. Experimental clients should prefer `activePermissionProfile` for profile provenance."
         },
         "serviceTier": {
           "type": [
@@ -13497,6 +13444,8 @@
       "enum": [
         "active",
         "paused",
+        "blocked",
+        "usageLimited",
         "budgetLimited",
         "complete"
       ],
@@ -14758,7 +14707,7 @@
     },
     "ThreadResumeParams": {
       "$schema": "http://json-schema.org/draft-07/schema#",
-      "description": "There are three ways to resume a thread: 1. By thread_id: load the thread from disk by thread_id and resume it. 2. By history: instantiate the thread from memory and resume it. 3. By path: load the thread from disk by path and resume it.\n\nThe precedence is: history > path > thread_id. If using history or path, the thread_id param will be ignored.\n\nPrefer using thread_id whenever possible.",
+      "description": "There are three ways to resume a thread: 1. By thread_id: load the thread from disk by thread_id and resume it. 2. By history: instantiate the thread from memory and resume it. 3. By path: load the thread from disk by path and resume it.\n\nFor non-running threads, the precedence is: history > non-empty path > thread_id. If using history or a non-empty path for a non-running thread, the thread_id param will be ignored.\n\nIf thread_id identifies a running thread, app-server rejoins that thread and treats a non-empty path as a consistency check against the active rollout path. Empty string path values are treated as absent.\n\nPrefer using thread_id whenever possible.",
       "properties": {
         "approvalPolicy": {
           "anyOf": [
@@ -14902,7 +14851,7 @@
               "$ref": "#/definitions/SandboxPolicy"
             }
           ],
-          "description": "Legacy sandbox policy retained for compatibility. Experimental clients should prefer `permissionProfile` when they need exact runtime permissions."
+          "description": "Legacy sandbox policy retained for compatibility. Experimental clients should prefer `activePermissionProfile` for profile provenance."
         },
         "serviceTier": {
           "type": [
@@ -15210,7 +15159,7 @@
               "$ref": "#/definitions/SandboxPolicy"
             }
           ],
-          "description": "Legacy sandbox policy retained for compatibility. Experimental clients should prefer `permissionProfile` when they need exact runtime permissions."
+          "description": "Legacy sandbox policy retained for compatibility. Experimental clients should prefer `activePermissionProfile` for profile provenance."
         },
         "serviceTier": {
           "type": [
@@ -15532,12 +15481,6 @@
     },
     "ToolsV2": {
       "properties": {
-        "view_image": {
-          "type": [
-            "boolean",
-            "null"
-          ]
-        },
         "web_search": {
           "anyOf": [
             {
@@ -16019,6 +15962,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "type": {
               "enum": [
                 "image"
@@ -16039,6 +15993,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "path": {
               "type": "string"
             },
diff --git a/codex-rs/app-server-protocol/schema/json/v2/CommandExecParams.json b/codex-rs/app-server-protocol/schema/json/v2/CommandExecParams.json
index f29483862c..d00a0b60e5 100644
--- a/codex-rs/app-server-protocol/schema/json/v2/CommandExecParams.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/CommandExecParams.json
@@ -27,202 +27,6 @@
       ],
       "type": "object"
     },
-    "FileSystemAccessMode": {
-      "enum": [
-        "read",
-        "write",
-        "none"
-      ],
-      "type": "string"
-    },
-    "FileSystemPath": {
-      "oneOf": [
-        {
-          "properties": {
-            "path": {
-              "$ref": "#/definitions/AbsolutePathBuf"
-            },
-            "type": {
-              "enum": [
-                "path"
-              ],
-              "title": "PathFileSystemPathType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "path",
-            "type"
-          ],
-          "title": "PathFileSystemPath",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "pattern": {
-              "type": "string"
-            },
-            "type": {
-              "enum": [
-                "glob_pattern"
-              ],
-              "title": "GlobPatternFileSystemPathType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "pattern",
-            "type"
-          ],
-          "title": "GlobPatternFileSystemPath",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "special"
-              ],
-              "title": "SpecialFileSystemPathType",
-              "type": "string"
-            },
-            "value": {
-              "$ref": "#/definitions/FileSystemSpecialPath"
-            }
-          },
-          "required": [
-            "type",
-            "value"
-          ],
-          "title": "SpecialFileSystemPath",
-          "type": "object"
-        }
-      ]
-    },
-    "FileSystemSandboxEntry": {
-      "properties": {
-        "access": {
-          "$ref": "#/definitions/FileSystemAccessMode"
-        },
-        "path": {
-          "$ref": "#/definitions/FileSystemPath"
-        }
-      },
-      "required": [
-        "access",
-        "path"
-      ],
-      "type": "object"
-    },
-    "FileSystemSpecialPath": {
-      "oneOf": [
-        {
-          "properties": {
-            "kind": {
-              "enum": [
-                "root"
-              ],
-              "type": "string"
-            }
-          },
-          "required": [
-            "kind"
-          ],
-          "title": "RootFileSystemSpecialPath",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "kind": {
-              "enum": [
-                "minimal"
-              ],
-              "type": "string"
-            }
-          },
-          "required": [
-            "kind"
-          ],
-          "title": "MinimalFileSystemSpecialPath",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "kind": {
-              "enum": [
-                "project_roots"
-              ],
-              "type": "string"
-            },
-            "subpath": {
-              "type": [
-                "string",
-                "null"
-              ]
-            }
-          },
-          "required": [
-            "kind"
-          ],
-          "title": "KindFileSystemSpecialPath",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "kind": {
-              "enum": [
-                "tmpdir"
-              ],
-              "type": "string"
-            }
-          },
-          "required": [
-            "kind"
-          ],
-          "title": "TmpdirFileSystemSpecialPath",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "kind": {
-              "enum": [
-                "slash_tmp"
-              ],
-              "type": "string"
-            }
-          },
-          "required": [
-            "kind"
-          ],
-          "title": "SlashTmpFileSystemSpecialPath",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "kind": {
-              "enum": [
-                "unknown"
-              ],
-              "type": "string"
-            },
-            "path": {
-              "type": "string"
-            },
-            "subpath": {
-              "type": [
-                "string",
-                "null"
-              ]
-            }
-          },
-          "required": [
-            "kind",
-            "path"
-          ],
-          "type": "object"
-        }
-      ]
-    },
     "NetworkAccess": {
       "enum": [
         "restricted",
@@ -230,135 +34,6 @@
       ],
       "type": "string"
     },
-    "PermissionProfile": {
-      "oneOf": [
-        {
-          "description": "Codex owns sandbox construction for this profile.",
-          "properties": {
-            "fileSystem": {
-              "$ref": "#/definitions/PermissionProfileFileSystemPermissions"
-            },
-            "network": {
-              "$ref": "#/definitions/PermissionProfileNetworkPermissions"
-            },
-            "type": {
-              "enum": [
-                "managed"
-              ],
-              "title": "ManagedPermissionProfileType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "fileSystem",
-            "network",
-            "type"
-          ],
-          "title": "ManagedPermissionProfile",
-          "type": "object"
-        },
-        {
-          "description": "Do not apply an outer sandbox.",
-          "properties": {
-            "type": {
-              "enum": [
-                "disabled"
-              ],
-              "title": "DisabledPermissionProfileType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "DisabledPermissionProfile",
-          "type": "object"
-        },
-        {
-          "description": "Filesystem isolation is enforced by an external caller.",
-          "properties": {
-            "network": {
-              "$ref": "#/definitions/PermissionProfileNetworkPermissions"
-            },
-            "type": {
-              "enum": [
-                "external"
-              ],
-              "title": "ExternalPermissionProfileType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "network",
-            "type"
-          ],
-          "title": "ExternalPermissionProfile",
-          "type": "object"
-        }
-      ]
-    },
-    "PermissionProfileFileSystemPermissions": {
-      "oneOf": [
-        {
-          "properties": {
-            "entries": {
-              "items": {
-                "$ref": "#/definitions/FileSystemSandboxEntry"
-              },
-              "type": "array"
-            },
-            "globScanMaxDepth": {
-              "format": "uint",
-              "minimum": 1.0,
-              "type": [
-                "integer",
-                "null"
-              ]
-            },
-            "type": {
-              "enum": [
-                "restricted"
-              ],
-              "title": "RestrictedPermissionProfileFileSystemPermissionsType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "entries",
-            "type"
-          ],
-          "title": "RestrictedPermissionProfileFileSystemPermissions",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "unrestricted"
-              ],
-              "title": "UnrestrictedPermissionProfileFileSystemPermissionsType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "UnrestrictedPermissionProfileFileSystemPermissions",
-          "type": "object"
-        }
-      ]
-    },
-    "PermissionProfileNetworkPermissions": {
-      "properties": {
-        "enabled": {
-          "type": "boolean"
-        }
-      },
-      "required": [
-        "enabled"
-      ],
-      "type": "object"
-    },
     "SandboxPolicy": {
       "oneOf": [
         {
diff --git a/codex-rs/app-server-protocol/schema/json/v2/ConfigReadResponse.json b/codex-rs/app-server-protocol/schema/json/v2/ConfigReadResponse.json
index 87a826e5af..7595f7fd00 100644
--- a/codex-rs/app-server-protocol/schema/json/v2/ConfigReadResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ConfigReadResponse.json
@@ -188,6 +188,25 @@
         }
       ]
     },
+    "AutoCompactTokenLimitScope": {
+      "description": "Selects which part of the active context is charged against `model_auto_compact_token_limit`.",
+      "oneOf": [
+        {
+          "description": "Count the full active context against the limit.",
+          "enum": [
+            "total"
+          ],
+          "type": "string"
+        },
+        {
+          "description": "Count sampled output and later growth after the carried window prefix.",
+          "enum": [
+            "body_after_prefix"
+          ],
+          "type": "string"
+        }
+      ]
+    },
     "Config": {
       "additionalProperties": true,
       "properties": {
@@ -228,6 +247,13 @@
             "null"
           ]
         },
+        "desktop": {
+          "additionalProperties": true,
+          "type": [
+            "object",
+            "null"
+          ]
+        },
         "developer_instructions": {
           "type": [
             "string",
@@ -235,9 +261,13 @@
           ]
         },
         "forced_chatgpt_workspace_id": {
-          "type": [
-            "string",
-            "null"
+          "anyOf": [
+            {
+              "$ref": "#/definitions/ForcedChatgptWorkspaceIds"
+            },
+            {
+              "type": "null"
+            }
           ]
         },
         "forced_login_method": {
@@ -269,6 +299,16 @@
             "null"
           ]
         },
+        "model_auto_compact_token_limit_scope": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/AutoCompactTokenLimitScope"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
         "model_context_window": {
           "format": "int64",
           "type": [
@@ -482,6 +522,13 @@
               ],
               "description": "This is the path to the user's config.toml file, though it is not guaranteed to exist."
             },
+            "profile": {
+              "description": "Name of the selected profile-v2 config layered on top of the base user config, when this layer represents one.",
+              "type": [
+                "string",
+                "null"
+              ]
+            },
             "type": {
               "enum": [
                 "user"
@@ -574,6 +621,20 @@
         }
       ]
     },
+    "ForcedChatgptWorkspaceIds": {
+      "anyOf": [
+        {
+          "type": "string"
+        },
+        {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      ],
+      "description": "Backward-compatible API shape for ChatGPT workspace login restrictions."
+    },
     "ForcedLoginMethod": {
       "enum": [
         "chatgpt",
@@ -748,12 +809,6 @@
     },
     "ToolsV2": {
       "properties": {
-        "view_image": {
-          "type": [
-            "boolean",
-            "null"
-          ]
-        },
         "web_search": {
           "anyOf": [
             {
diff --git a/codex-rs/app-server-protocol/schema/json/v2/ConfigRequirementsReadResponse.json b/codex-rs/app-server-protocol/schema/json/v2/ConfigRequirementsReadResponse.json
index 41bd337dec..577cd7bbc9 100644
--- a/codex-rs/app-server-protocol/schema/json/v2/ConfigRequirementsReadResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ConfigRequirementsReadResponse.json
@@ -261,6 +261,12 @@
           },
           "type": "array"
         },
+        "SubagentStart": {
+          "items": {
+            "$ref": "#/definitions/ConfiguredHookMatcherGroup"
+          },
+          "type": "array"
+        },
         "UserPromptSubmit": {
           "items": {
             "$ref": "#/definitions/ConfiguredHookMatcherGroup"
@@ -288,6 +294,7 @@
         "PreToolUse",
         "SessionStart",
         "Stop",
+        "SubagentStart",
         "UserPromptSubmit"
       ],
       "type": "object"
diff --git a/codex-rs/app-server-protocol/schema/json/v2/ConfigWriteResponse.json b/codex-rs/app-server-protocol/schema/json/v2/ConfigWriteResponse.json
index 631318a8bd..37816463b6 100644
--- a/codex-rs/app-server-protocol/schema/json/v2/ConfigWriteResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ConfigWriteResponse.json
@@ -84,6 +84,13 @@
               ],
               "description": "This is the path to the user's config.toml file, though it is not guaranteed to exist."
             },
+            "profile": {
+              "description": "Name of the selected profile-v2 config layered on top of the base user config, when this layer represents one.",
+              "type": [
+                "string",
+                "null"
+              ]
+            },
             "type": {
               "enum": [
                 "user"
diff --git a/codex-rs/app-server-protocol/schema/json/v2/ExperimentalFeatureListParams.json b/codex-rs/app-server-protocol/schema/json/v2/ExperimentalFeatureListParams.json
index ab562edbf2..13fa2efb98 100644
--- a/codex-rs/app-server-protocol/schema/json/v2/ExperimentalFeatureListParams.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ExperimentalFeatureListParams.json
@@ -16,6 +16,13 @@
         "integer",
         "null"
       ]
+    },
+    "threadId": {
+      "description": "Optional loaded thread id. Pass this when showing feature state for an existing thread so enablement is computed from that thread's refreshed config, including project-local config for the thread's cwd.",
+      "type": [
+        "string",
+        "null"
+      ]
     }
   },
   "title": "ExperimentalFeatureListParams",
diff --git a/codex-rs/app-server-protocol/schema/json/v2/HookCompletedNotification.json b/codex-rs/app-server-protocol/schema/json/v2/HookCompletedNotification.json
index 24f0d35e0d..2df5f62b75 100644
--- a/codex-rs/app-server-protocol/schema/json/v2/HookCompletedNotification.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/HookCompletedNotification.json
@@ -14,6 +14,7 @@
         "postCompact",
         "sessionStart",
         "userPromptSubmit",
+        "subagentStart",
         "stop"
       ],
       "type": "string"
diff --git a/codex-rs/app-server-protocol/schema/json/v2/HookStartedNotification.json b/codex-rs/app-server-protocol/schema/json/v2/HookStartedNotification.json
index 64b99592a2..622377a0d4 100644
--- a/codex-rs/app-server-protocol/schema/json/v2/HookStartedNotification.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/HookStartedNotification.json
@@ -14,6 +14,7 @@
         "postCompact",
         "sessionStart",
         "userPromptSubmit",
+        "subagentStart",
         "stop"
       ],
       "type": "string"
diff --git a/codex-rs/app-server-protocol/schema/json/v2/HooksListResponse.json b/codex-rs/app-server-protocol/schema/json/v2/HooksListResponse.json
index f2a7c80cf0..913962b603 100644
--- a/codex-rs/app-server-protocol/schema/json/v2/HooksListResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/HooksListResponse.json
@@ -29,6 +29,7 @@
         "postCompact",
         "sessionStart",
         "userPromptSubmit",
+        "subagentStart",
         "stop"
       ],
       "type": "string"
diff --git a/codex-rs/app-server-protocol/schema/json/v2/ItemCompletedNotification.json b/codex-rs/app-server-protocol/schema/json/v2/ItemCompletedNotification.json
index 6909415c2a..7aed9d9722 100644
--- a/codex-rs/app-server-protocol/schema/json/v2/ItemCompletedNotification.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ItemCompletedNotification.json
@@ -285,6 +285,13 @@
       ],
       "type": "object"
     },
+    "ImageDetail": {
+      "enum": [
+        "high",
+        "original"
+      ],
+      "type": "string"
+    },
     "McpToolCallError": {
       "properties": {
         "message": {
@@ -1179,6 +1186,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "type": {
               "enum": [
                 "image"
@@ -1199,6 +1217,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "path": {
               "type": "string"
             },
diff --git a/codex-rs/app-server-protocol/schema/json/v2/ItemGuardianApprovalReviewCompletedNotification.json b/codex-rs/app-server-protocol/schema/json/v2/ItemGuardianApprovalReviewCompletedNotification.json
index 991d4de050..a366c99a41 100644
--- a/codex-rs/app-server-protocol/schema/json/v2/ItemGuardianApprovalReviewCompletedNotification.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ItemGuardianApprovalReviewCompletedNotification.json
@@ -69,7 +69,7 @@
       "enum": [
         "read",
         "write",
-        "none"
+        "deny"
       ],
       "type": "string"
     },
diff --git a/codex-rs/app-server-protocol/schema/json/v2/ItemGuardianApprovalReviewStartedNotification.json b/codex-rs/app-server-protocol/schema/json/v2/ItemGuardianApprovalReviewStartedNotification.json
index 75ffeb753a..bc081c7be9 100644
--- a/codex-rs/app-server-protocol/schema/json/v2/ItemGuardianApprovalReviewStartedNotification.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ItemGuardianApprovalReviewStartedNotification.json
@@ -62,7 +62,7 @@
       "enum": [
         "read",
         "write",
-        "none"
+        "deny"
       ],
       "type": "string"
     },
diff --git a/codex-rs/app-server-protocol/schema/json/v2/ItemStartedNotification.json b/codex-rs/app-server-protocol/schema/json/v2/ItemStartedNotification.json
index 758ceba32d..80a3cd2425 100644
--- a/codex-rs/app-server-protocol/schema/json/v2/ItemStartedNotification.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ItemStartedNotification.json
@@ -285,6 +285,13 @@
       ],
       "type": "object"
     },
+    "ImageDetail": {
+      "enum": [
+        "high",
+        "original"
+      ],
+      "type": "string"
+    },
     "McpToolCallError": {
       "properties": {
         "message": {
@@ -1179,6 +1186,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "type": {
               "enum": [
                 "image"
@@ -1199,6 +1217,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "path": {
               "type": "string"
             },
diff --git a/codex-rs/app-server-protocol/schema/json/v2/PluginInstalledParams.json b/codex-rs/app-server-protocol/schema/json/v2/PluginInstalledParams.json
new file mode 100644
index 0000000000..f3ec95a5da
--- /dev/null
+++ b/codex-rs/app-server-protocol/schema/json/v2/PluginInstalledParams.json
@@ -0,0 +1,33 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "definitions": {
+    "AbsolutePathBuf": {
+      "description": "A path that is guaranteed to be absolute and normalized (though it is not guaranteed to be canonicalized or exist on the filesystem).\n\nIMPORTANT: When deserializing an `AbsolutePathBuf`, a base path must be set using [AbsolutePathBufGuard::new]. If no base path is set, the deserialization will fail unless the path being deserialized is already absolute.",
+      "type": "string"
+    }
+  },
+  "properties": {
+    "cwds": {
+      "description": "Optional working directories used to discover repo marketplaces.",
+      "items": {
+        "$ref": "#/definitions/AbsolutePathBuf"
+      },
+      "type": [
+        "array",
+        "null"
+      ]
+    },
+    "installSuggestionPluginNames": {
+      "description": "Additional uninstalled plugin names that should be returned when present locally. This is used by mention surfaces that intentionally expose install entrypoints.",
+      "items": {
+        "type": "string"
+      },
+      "type": [
+        "array",
+        "null"
+      ]
+    }
+  },
+  "title": "PluginInstalledParams",
+  "type": "object"
+}
\ No newline at end of file
diff --git a/codex-rs/app-server-protocol/schema/json/v2/PluginInstalledResponse.json b/codex-rs/app-server-protocol/schema/json/v2/PluginInstalledResponse.json
new file mode 100644
index 0000000000..ffe20e8c55
--- /dev/null
+++ b/codex-rs/app-server-protocol/schema/json/v2/PluginInstalledResponse.json
@@ -0,0 +1,525 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "definitions": {
+    "AbsolutePathBuf": {
+      "description": "A path that is guaranteed to be absolute and normalized (though it is not guaranteed to be canonicalized or exist on the filesystem).\n\nIMPORTANT: When deserializing an `AbsolutePathBuf`, a base path must be set using [AbsolutePathBufGuard::new]. If no base path is set, the deserialization will fail unless the path being deserialized is already absolute.",
+      "type": "string"
+    },
+    "MarketplaceInterface": {
+      "properties": {
+        "displayName": {
+          "type": [
+            "string",
+            "null"
+          ]
+        }
+      },
+      "type": "object"
+    },
+    "MarketplaceLoadErrorInfo": {
+      "properties": {
+        "marketplacePath": {
+          "$ref": "#/definitions/AbsolutePathBuf"
+        },
+        "message": {
+          "type": "string"
+        }
+      },
+      "required": [
+        "marketplacePath",
+        "message"
+      ],
+      "type": "object"
+    },
+    "PluginAuthPolicy": {
+      "enum": [
+        "ON_INSTALL",
+        "ON_USE"
+      ],
+      "type": "string"
+    },
+    "PluginAvailability": {
+      "oneOf": [
+        {
+          "enum": [
+            "DISABLED_BY_ADMIN"
+          ],
+          "type": "string"
+        },
+        {
+          "description": "Plugin-service currently sends `\"ENABLED\"` for available remote plugins. Codex app-server exposes `\"AVAILABLE\"` in its API; the alias keeps decoding compatible with that upstream response.",
+          "enum": [
+            "AVAILABLE"
+          ],
+          "type": "string"
+        }
+      ]
+    },
+    "PluginInstallPolicy": {
+      "enum": [
+        "NOT_AVAILABLE",
+        "AVAILABLE",
+        "INSTALLED_BY_DEFAULT"
+      ],
+      "type": "string"
+    },
+    "PluginInterface": {
+      "properties": {
+        "brandColor": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "capabilities": {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "category": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "composerIcon": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/AbsolutePathBuf"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Local composer icon path, resolved from the installed plugin package."
+        },
+        "composerIconUrl": {
+          "description": "Remote composer icon URL from the plugin catalog.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "defaultPrompt": {
+          "description": "Starter prompts for the plugin. Capped at 3 entries with a maximum of 128 characters per entry.",
+          "items": {
+            "type": "string"
+          },
+          "type": [
+            "array",
+            "null"
+          ]
+        },
+        "developerName": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "displayName": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "logo": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/AbsolutePathBuf"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Local logo path, resolved from the installed plugin package."
+        },
+        "logoUrl": {
+          "description": "Remote logo URL from the plugin catalog.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "longDescription": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "privacyPolicyUrl": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "screenshotUrls": {
+          "description": "Remote screenshot URLs from the plugin catalog.",
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "screenshots": {
+          "description": "Local screenshot paths, resolved from the installed plugin package.",
+          "items": {
+            "$ref": "#/definitions/AbsolutePathBuf"
+          },
+          "type": "array"
+        },
+        "shortDescription": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "termsOfServiceUrl": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "websiteUrl": {
+          "type": [
+            "string",
+            "null"
+          ]
+        }
+      },
+      "required": [
+        "capabilities",
+        "screenshotUrls",
+        "screenshots"
+      ],
+      "type": "object"
+    },
+    "PluginMarketplaceEntry": {
+      "properties": {
+        "interface": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/MarketplaceInterface"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "name": {
+          "type": "string"
+        },
+        "path": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/AbsolutePathBuf"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Local marketplace file path when the marketplace is backed by a local file. Remote-only catalog marketplaces do not have a local path."
+        },
+        "plugins": {
+          "items": {
+            "$ref": "#/definitions/PluginSummary"
+          },
+          "type": "array"
+        }
+      },
+      "required": [
+        "name",
+        "plugins"
+      ],
+      "type": "object"
+    },
+    "PluginShareContext": {
+      "properties": {
+        "creatorAccountUserId": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "creatorName": {
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "discoverability": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/PluginShareDiscoverability"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "remotePluginId": {
+          "type": "string"
+        },
+        "remoteVersion": {
+          "default": null,
+          "description": "Version of the remote shared plugin release when available.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "sharePrincipals": {
+          "items": {
+            "$ref": "#/definitions/PluginSharePrincipal"
+          },
+          "type": [
+            "array",
+            "null"
+          ]
+        },
+        "shareUrl": {
+          "type": [
+            "string",
+            "null"
+          ]
+        }
+      },
+      "required": [
+        "remotePluginId"
+      ],
+      "type": "object"
+    },
+    "PluginShareDiscoverability": {
+      "enum": [
+        "LISTED",
+        "UNLISTED",
+        "PRIVATE"
+      ],
+      "type": "string"
+    },
+    "PluginSharePrincipal": {
+      "properties": {
+        "name": {
+          "type": "string"
+        },
+        "principalId": {
+          "type": "string"
+        },
+        "principalType": {
+          "$ref": "#/definitions/PluginSharePrincipalType"
+        },
+        "role": {
+          "$ref": "#/definitions/PluginSharePrincipalRole"
+        }
+      },
+      "required": [
+        "name",
+        "principalId",
+        "principalType",
+        "role"
+      ],
+      "type": "object"
+    },
+    "PluginSharePrincipalRole": {
+      "enum": [
+        "reader",
+        "editor",
+        "owner"
+      ],
+      "type": "string"
+    },
+    "PluginSharePrincipalType": {
+      "enum": [
+        "user",
+        "group",
+        "workspace"
+      ],
+      "type": "string"
+    },
+    "PluginSource": {
+      "oneOf": [
+        {
+          "properties": {
+            "path": {
+              "$ref": "#/definitions/AbsolutePathBuf"
+            },
+            "type": {
+              "enum": [
+                "local"
+              ],
+              "title": "LocalPluginSourceType",
+              "type": "string"
+            }
+          },
+          "required": [
+            "path",
+            "type"
+          ],
+          "title": "LocalPluginSource",
+          "type": "object"
+        },
+        {
+          "properties": {
+            "path": {
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "refName": {
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "sha": {
+              "type": [
+                "string",
+                "null"
+              ]
+            },
+            "type": {
+              "enum": [
+                "git"
+              ],
+              "title": "GitPluginSourceType",
+              "type": "string"
+            },
+            "url": {
+              "type": "string"
+            }
+          },
+          "required": [
+            "type",
+            "url"
+          ],
+          "title": "GitPluginSource",
+          "type": "object"
+        },
+        {
+          "description": "The plugin is available in the remote catalog. Download metadata is kept server-side and is not exposed through the app-server API.",
+          "properties": {
+            "type": {
+              "enum": [
+                "remote"
+              ],
+              "title": "RemotePluginSourceType",
+              "type": "string"
+            }
+          },
+          "required": [
+            "type"
+          ],
+          "title": "RemotePluginSource",
+          "type": "object"
+        }
+      ]
+    },
+    "PluginSummary": {
+      "properties": {
+        "authPolicy": {
+          "$ref": "#/definitions/PluginAuthPolicy"
+        },
+        "availability": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/PluginAvailability"
+            }
+          ],
+          "default": "AVAILABLE",
+          "description": "Availability state for installing and using the plugin."
+        },
+        "enabled": {
+          "type": "boolean"
+        },
+        "id": {
+          "type": "string"
+        },
+        "installPolicy": {
+          "$ref": "#/definitions/PluginInstallPolicy"
+        },
+        "installed": {
+          "type": "boolean"
+        },
+        "interface": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/PluginInterface"
+            },
+            {
+              "type": "null"
+            }
+          ]
+        },
+        "keywords": {
+          "default": [],
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        },
+        "localVersion": {
+          "default": null,
+          "description": "Version of the locally materialized plugin package when available.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "name": {
+          "type": "string"
+        },
+        "remotePluginId": {
+          "description": "Backend remote plugin identifier when available.",
+          "type": [
+            "string",
+            "null"
+          ]
+        },
+        "shareContext": {
+          "anyOf": [
+            {
+              "$ref": "#/definitions/PluginShareContext"
+            },
+            {
+              "type": "null"
+            }
+          ],
+          "description": "Remote sharing context associated with this plugin when available."
+        },
+        "source": {
+          "$ref": "#/definitions/PluginSource"
+        }
+      },
+      "required": [
+        "authPolicy",
+        "enabled",
+        "id",
+        "installPolicy",
+        "installed",
+        "name",
+        "source"
+      ],
+      "type": "object"
+    }
+  },
+  "properties": {
+    "marketplaceLoadErrors": {
+      "default": [],
+      "items": {
+        "$ref": "#/definitions/MarketplaceLoadErrorInfo"
+      },
+      "type": "array"
+    },
+    "marketplaces": {
+      "items": {
+        "$ref": "#/definitions/PluginMarketplaceEntry"
+      },
+      "type": "array"
+    }
+  },
+  "required": [
+    "marketplaces"
+  ],
+  "title": "PluginInstalledResponse",
+  "type": "object"
+}
\ No newline at end of file
diff --git a/codex-rs/app-server-protocol/schema/json/v2/PluginReadResponse.json b/codex-rs/app-server-protocol/schema/json/v2/PluginReadResponse.json
index 0c9f897dc9..6d2a0b5d56 100644
--- a/codex-rs/app-server-protocol/schema/json/v2/PluginReadResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/PluginReadResponse.json
@@ -46,6 +46,7 @@
         "postCompact",
         "sessionStart",
         "userPromptSubmit",
+        "subagentStart",
         "stop"
       ],
       "type": "string"
diff --git a/codex-rs/app-server-protocol/schema/json/v2/RawResponseItemCompletedNotification.json b/codex-rs/app-server-protocol/schema/json/v2/RawResponseItemCompletedNotification.json
index 6973d15baa..74420ea57e 100644
--- a/codex-rs/app-server-protocol/schema/json/v2/RawResponseItemCompletedNotification.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/RawResponseItemCompletedNotification.json
@@ -145,8 +145,6 @@
     },
     "ImageDetail": {
       "enum": [
-        "auto",
-        "low",
         "high",
         "original"
       ],
@@ -732,6 +730,22 @@
           "title": "CompactionResponseItem",
           "type": "object"
         },
+        {
+          "properties": {
+            "type": {
+              "enum": [
+                "compaction_trigger"
+              ],
+              "title": "CompactionTriggerResponseItemType",
+              "type": "string"
+            }
+          },
+          "required": [
+            "type"
+          ],
+          "title": "CompactionTriggerResponseItem",
+          "type": "object"
+        },
         {
           "properties": {
             "encrypted_content": {
diff --git a/codex-rs/app-server-protocol/schema/json/v2/RemoteControlStatusChangedNotification.json b/codex-rs/app-server-protocol/schema/json/v2/RemoteControlStatusChangedNotification.json
index 85be3316d7..2f305c7d78 100644
--- a/codex-rs/app-server-protocol/schema/json/v2/RemoteControlStatusChangedNotification.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/RemoteControlStatusChangedNotification.json
@@ -22,12 +22,16 @@
     "installationId": {
       "type": "string"
     },
+    "serverName": {
+      "type": "string"
+    },
     "status": {
       "$ref": "#/definitions/RemoteControlConnectionStatus"
     }
   },
   "required": [
     "installationId",
+    "serverName",
     "status"
   ],
   "title": "RemoteControlStatusChangedNotification",
diff --git a/codex-rs/app-server-protocol/schema/json/v2/ReviewStartResponse.json b/codex-rs/app-server-protocol/schema/json/v2/ReviewStartResponse.json
index 9afd1ae514..882fa1f598 100644
--- a/codex-rs/app-server-protocol/schema/json/v2/ReviewStartResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ReviewStartResponse.json
@@ -422,6 +422,13 @@
       ],
       "type": "object"
     },
+    "ImageDetail": {
+      "enum": [
+        "high",
+        "original"
+      ],
+      "type": "string"
+    },
     "McpToolCallError": {
       "properties": {
         "message": {
@@ -1452,6 +1459,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "type": {
               "enum": [
                 "image"
@@ -1472,6 +1490,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "path": {
               "type": "string"
             },
diff --git a/codex-rs/app-server-protocol/schema/json/v2/ThreadForkParams.json b/codex-rs/app-server-protocol/schema/json/v2/ThreadForkParams.json
index 29d67403cd..9d2f834dd8 100644
--- a/codex-rs/app-server-protocol/schema/json/v2/ThreadForkParams.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadForkParams.json
@@ -1,10 +1,6 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
   "definitions": {
-    "AbsolutePathBuf": {
-      "description": "A path that is guaranteed to be absolute and normalized (though it is not guaranteed to be canonicalized or exist on the filesystem).\n\nIMPORTANT: When deserializing an `AbsolutePathBuf`, a base path must be set using [AbsolutePathBufGuard::new]. If no base path is set, the deserialization will fail unless the path being deserialized is already absolute.",
-      "type": "string"
-    },
     "ApprovalsReviewer": {
       "description": "Configures who approval requests are routed to for review. Examples include sandbox escapes, blocked network access, MCP approval prompts, and ARC escalations. Defaults to `user`. `auto_review` uses a carefully prompted subagent to gather relevant context and apply a risk-based decision framework before approving or denying the request. The legacy value `guardian_subagent` is accepted for compatibility.",
       "enum": [
@@ -64,65 +60,6 @@
         }
       ]
     },
-    "PermissionProfileModificationParams": {
-      "oneOf": [
-        {
-          "description": "Additional concrete directory that should be writable.",
-          "properties": {
-            "path": {
-              "$ref": "#/definitions/AbsolutePathBuf"
-            },
-            "type": {
-              "enum": [
-                "additionalWritableRoot"
-              ],
-              "title": "AdditionalWritableRootPermissionProfileModificationParamsType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "path",
-            "type"
-          ],
-          "title": "AdditionalWritableRootPermissionProfileModificationParams",
-          "type": "object"
-        }
-      ]
-    },
-    "PermissionProfileSelectionParams": {
-      "oneOf": [
-        {
-          "description": "Select a named built-in or user-defined profile and optionally apply bounded modifications that Codex knows how to validate.",
-          "properties": {
-            "id": {
-              "type": "string"
-            },
-            "modifications": {
-              "items": {
-                "$ref": "#/definitions/PermissionProfileModificationParams"
-              },
-              "type": [
-                "array",
-                "null"
-              ]
-            },
-            "type": {
-              "enum": [
-                "profile"
-              ],
-              "title": "ProfilePermissionProfileSelectionParamsType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "id",
-            "type"
-          ],
-          "title": "ProfilePermissionProfileSelectionParams",
-          "type": "object"
-        }
-      ]
-    },
     "SandboxMode": {
       "enum": [
         "read-only",
@@ -140,7 +77,7 @@
       "type": "string"
     }
   },
-  "description": "There are two ways to fork a thread: 1. By thread_id: load the thread from disk by thread_id and fork it into a new thread. 2. By path: load the thread from disk by path and fork it into a new thread.\n\nIf using path, the thread_id param will be ignored.\n\nPrefer using thread_id whenever possible.",
+  "description": "There are two ways to fork a thread: 1. By thread_id: load the thread from disk by thread_id and fork it into a new thread. 2. By path: load the thread from disk by path and fork it into a new thread.\n\nIf using a non-empty path, the thread_id param will be ignored. Empty string path values are treated as absent.\n\nPrefer using thread_id whenever possible.",
   "properties": {
     "approvalPolicy": {
       "anyOf": [
diff --git a/codex-rs/app-server-protocol/schema/json/v2/ThreadForkResponse.json b/codex-rs/app-server-protocol/schema/json/v2/ThreadForkResponse.json
index 6e74ab4ac8..3d66152a60 100644
--- a/codex-rs/app-server-protocol/schema/json/v2/ThreadForkResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadForkResponse.json
@@ -18,14 +18,6 @@
         "id": {
           "description": "Identifier from `default_permissions` or the implicit built-in default, such as `:workspace` or a user-defined `[permissions.<id>]` profile.",
           "type": "string"
-        },
-        "modifications": {
-          "default": [],
-          "description": "Bounded user-requested modifications applied on top of the named profile, if any.",
-          "items": {
-            "$ref": "#/definitions/ActivePermissionProfileModification"
-          },
-          "type": "array"
         }
       },
       "required": [
@@ -33,31 +25,6 @@
       ],
       "type": "object"
     },
-    "ActivePermissionProfileModification": {
-      "oneOf": [
-        {
-          "description": "Additional concrete directory that should be writable.",
-          "properties": {
-            "path": {
-              "$ref": "#/definitions/AbsolutePathBuf"
-            },
-            "type": {
-              "enum": [
-                "additionalWritableRoot"
-              ],
-              "title": "AdditionalWritableRootActivePermissionProfileModificationType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "path",
-            "type"
-          ],
-          "title": "AdditionalWritableRootActivePermissionProfileModification",
-          "type": "object"
-        }
-      ]
-    },
     "AgentPath": {
       "type": "string"
     },
@@ -503,202 +470,6 @@
       ],
       "type": "string"
     },
-    "FileSystemAccessMode": {
-      "enum": [
-        "read",
-        "write",
-        "none"
-      ],
-      "type": "string"
-    },
-    "FileSystemPath": {
-      "oneOf": [
-        {
-          "properties": {
-            "path": {
-              "$ref": "#/definitions/AbsolutePathBuf"
-            },
-            "type": {
-              "enum": [
-                "path"
-              ],
-              "title": "PathFileSystemPathType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "path",
-            "type"
-          ],
-          "title": "PathFileSystemPath",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "pattern": {
-              "type": "string"
-            },
-            "type": {
-              "enum": [
-                "glob_pattern"
-              ],
-              "title": "GlobPatternFileSystemPathType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "pattern",
-            "type"
-          ],
-          "title": "GlobPatternFileSystemPath",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "special"
-              ],
-              "title": "SpecialFileSystemPathType",
-              "type": "string"
-            },
-            "value": {
-              "$ref": "#/definitions/FileSystemSpecialPath"
-            }
-          },
-          "required": [
-            "type",
-            "value"
-          ],
-          "title": "SpecialFileSystemPath",
-          "type": "object"
-        }
-      ]
-    },
-    "FileSystemSandboxEntry": {
-      "properties": {
-        "access": {
-          "$ref": "#/definitions/FileSystemAccessMode"
-        },
-        "path": {
-          "$ref": "#/definitions/FileSystemPath"
-        }
-      },
-      "required": [
-        "access",
-        "path"
-      ],
-      "type": "object"
-    },
-    "FileSystemSpecialPath": {
-      "oneOf": [
-        {
-          "properties": {
-            "kind": {
-              "enum": [
-                "root"
-              ],
-              "type": "string"
-            }
-          },
-          "required": [
-            "kind"
-          ],
-          "title": "RootFileSystemSpecialPath",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "kind": {
-              "enum": [
-                "minimal"
-              ],
-              "type": "string"
-            }
-          },
-          "required": [
-            "kind"
-          ],
-          "title": "MinimalFileSystemSpecialPath",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "kind": {
-              "enum": [
-                "project_roots"
-              ],
-              "type": "string"
-            },
-            "subpath": {
-              "type": [
-                "string",
-                "null"
-              ]
-            }
-          },
-          "required": [
-            "kind"
-          ],
-          "title": "KindFileSystemSpecialPath",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "kind": {
-              "enum": [
-                "tmpdir"
-              ],
-              "type": "string"
-            }
-          },
-          "required": [
-            "kind"
-          ],
-          "title": "TmpdirFileSystemSpecialPath",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "kind": {
-              "enum": [
-                "slash_tmp"
-              ],
-              "type": "string"
-            }
-          },
-          "required": [
-            "kind"
-          ],
-          "title": "SlashTmpFileSystemSpecialPath",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "kind": {
-              "enum": [
-                "unknown"
-              ],
-              "type": "string"
-            },
-            "path": {
-              "type": "string"
-            },
-            "subpath": {
-              "type": [
-                "string",
-                "null"
-              ]
-            }
-          },
-          "required": [
-            "kind",
-            "path"
-          ],
-          "type": "object"
-        }
-      ]
-    },
     "FileUpdateChange": {
       "properties": {
         "diff": {
@@ -756,6 +527,13 @@
       ],
       "type": "object"
     },
+    "ImageDetail": {
+      "enum": [
+        "high",
+        "original"
+      ],
+      "type": "string"
+    },
     "McpToolCallError": {
       "properties": {
         "message": {
@@ -937,135 +715,6 @@
         }
       ]
     },
-    "PermissionProfile": {
-      "oneOf": [
-        {
-          "description": "Codex owns sandbox construction for this profile.",
-          "properties": {
-            "fileSystem": {
-              "$ref": "#/definitions/PermissionProfileFileSystemPermissions"
-            },
-            "network": {
-              "$ref": "#/definitions/PermissionProfileNetworkPermissions"
-            },
-            "type": {
-              "enum": [
-                "managed"
-              ],
-              "title": "ManagedPermissionProfileType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "fileSystem",
-            "network",
-            "type"
-          ],
-          "title": "ManagedPermissionProfile",
-          "type": "object"
-        },
-        {
-          "description": "Do not apply an outer sandbox.",
-          "properties": {
-            "type": {
-              "enum": [
-                "disabled"
-              ],
-              "title": "DisabledPermissionProfileType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "DisabledPermissionProfile",
-          "type": "object"
-        },
-        {
-          "description": "Filesystem isolation is enforced by an external caller.",
-          "properties": {
-            "network": {
-              "$ref": "#/definitions/PermissionProfileNetworkPermissions"
-            },
-            "type": {
-              "enum": [
-                "external"
-              ],
-              "title": "ExternalPermissionProfileType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "network",
-            "type"
-          ],
-          "title": "ExternalPermissionProfile",
-          "type": "object"
-        }
-      ]
-    },
-    "PermissionProfileFileSystemPermissions": {
-      "oneOf": [
-        {
-          "properties": {
-            "entries": {
-              "items": {
-                "$ref": "#/definitions/FileSystemSandboxEntry"
-              },
-              "type": "array"
-            },
-            "globScanMaxDepth": {
-              "format": "uint",
-              "minimum": 1.0,
-              "type": [
-                "integer",
-                "null"
-              ]
-            },
-            "type": {
-              "enum": [
-                "restricted"
-              ],
-              "title": "RestrictedPermissionProfileFileSystemPermissionsType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "entries",
-            "type"
-          ],
-          "title": "RestrictedPermissionProfileFileSystemPermissions",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "unrestricted"
-              ],
-              "title": "UnrestrictedPermissionProfileFileSystemPermissionsType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "UnrestrictedPermissionProfileFileSystemPermissions",
-          "type": "object"
-        }
-      ]
-    },
-    "PermissionProfileNetworkPermissions": {
-      "properties": {
-        "enabled": {
-          "type": "boolean"
-        }
-      },
-      "required": [
-        "enabled"
-      ],
-      "type": "object"
-    },
     "ReasoningEffort": {
       "description": "See https://platform.openai.com/docs/guides/reasoning?api-mode=responses#get-started-with-reasoning",
       "enum": [
@@ -2370,6 +2019,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "type": {
               "enum": [
                 "image"
@@ -2390,6 +2050,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "path": {
               "type": "string"
             },
@@ -2605,7 +2276,7 @@
           "$ref": "#/definitions/SandboxPolicy"
         }
       ],
-      "description": "Legacy sandbox policy retained for compatibility. Experimental clients should prefer `permissionProfile` when they need exact runtime permissions."
+      "description": "Legacy sandbox policy retained for compatibility. Experimental clients should prefer `activePermissionProfile` for profile provenance."
     },
     "serviceTier": {
       "type": [
diff --git a/codex-rs/app-server-protocol/schema/json/v2/ThreadGoalUpdatedNotification.json b/codex-rs/app-server-protocol/schema/json/v2/ThreadGoalUpdatedNotification.json
index 52a2e905a2..cbb04eaab2 100644
--- a/codex-rs/app-server-protocol/schema/json/v2/ThreadGoalUpdatedNotification.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadGoalUpdatedNotification.json
@@ -51,6 +51,8 @@
       "enum": [
         "active",
         "paused",
+        "blocked",
+        "usageLimited",
         "budgetLimited",
         "complete"
       ],
diff --git a/codex-rs/app-server-protocol/schema/json/v2/ThreadListResponse.json b/codex-rs/app-server-protocol/schema/json/v2/ThreadListResponse.json
index f78fbaf27e..0693b19028 100644
--- a/codex-rs/app-server-protocol/schema/json/v2/ThreadListResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadListResponse.json
@@ -448,6 +448,13 @@
       ],
       "type": "object"
     },
+    "ImageDetail": {
+      "enum": [
+        "high",
+        "original"
+      ],
+      "type": "string"
+    },
     "McpToolCallError": {
       "properties": {
         "message": {
@@ -1827,6 +1834,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "type": {
               "enum": [
                 "image"
@@ -1847,6 +1865,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "path": {
               "type": "string"
             },
diff --git a/codex-rs/app-server-protocol/schema/json/v2/ThreadMetadataUpdateResponse.json b/codex-rs/app-server-protocol/schema/json/v2/ThreadMetadataUpdateResponse.json
index 4268ad203a..d2e4ca6728 100644
--- a/codex-rs/app-server-protocol/schema/json/v2/ThreadMetadataUpdateResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadMetadataUpdateResponse.json
@@ -448,6 +448,13 @@
       ],
       "type": "object"
     },
+    "ImageDetail": {
+      "enum": [
+        "high",
+        "original"
+      ],
+      "type": "string"
+    },
     "McpToolCallError": {
       "properties": {
         "message": {
@@ -1827,6 +1834,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "type": {
               "enum": [
                 "image"
@@ -1847,6 +1865,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "path": {
               "type": "string"
             },
diff --git a/codex-rs/app-server-protocol/schema/json/v2/ThreadReadResponse.json b/codex-rs/app-server-protocol/schema/json/v2/ThreadReadResponse.json
index fb0d80a047..431ca759de 100644
--- a/codex-rs/app-server-protocol/schema/json/v2/ThreadReadResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadReadResponse.json
@@ -448,6 +448,13 @@
       ],
       "type": "object"
     },
+    "ImageDetail": {
+      "enum": [
+        "high",
+        "original"
+      ],
+      "type": "string"
+    },
     "McpToolCallError": {
       "properties": {
         "message": {
@@ -1827,6 +1834,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "type": {
               "enum": [
                 "image"
@@ -1847,6 +1865,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "path": {
               "type": "string"
             },
diff --git a/codex-rs/app-server-protocol/schema/json/v2/ThreadResumeParams.json b/codex-rs/app-server-protocol/schema/json/v2/ThreadResumeParams.json
index 5f07fe0149..027989479a 100644
--- a/codex-rs/app-server-protocol/schema/json/v2/ThreadResumeParams.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadResumeParams.json
@@ -1,10 +1,6 @@
 {
   "$schema": "http://json-schema.org/draft-07/schema#",
   "definitions": {
-    "AbsolutePathBuf": {
-      "description": "A path that is guaranteed to be absolute and normalized (though it is not guaranteed to be canonicalized or exist on the filesystem).\n\nIMPORTANT: When deserializing an `AbsolutePathBuf`, a base path must be set using [AbsolutePathBufGuard::new]. If no base path is set, the deserialization will fail unless the path being deserialized is already absolute.",
-      "type": "string"
-    },
     "ApprovalsReviewer": {
       "description": "Configures who approval requests are routed to for review. Examples include sandbox escapes, blocked network access, MCP approval prompts, and ARC escalations. Defaults to `user`. `auto_review` uses a carefully prompted subagent to gather relevant context and apply a risk-based decision framework before approving or denying the request. The legacy value `guardian_subagent` is accepted for compatibility.",
       "enum": [
@@ -208,8 +204,6 @@
     },
     "ImageDetail": {
       "enum": [
-        "auto",
-        "low",
         "high",
         "original"
       ],
@@ -298,65 +292,6 @@
         }
       ]
     },
-    "PermissionProfileModificationParams": {
-      "oneOf": [
-        {
-          "description": "Additional concrete directory that should be writable.",
-          "properties": {
-            "path": {
-              "$ref": "#/definitions/AbsolutePathBuf"
-            },
-            "type": {
-              "enum": [
-                "additionalWritableRoot"
-              ],
-              "title": "AdditionalWritableRootPermissionProfileModificationParamsType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "path",
-            "type"
-          ],
-          "title": "AdditionalWritableRootPermissionProfileModificationParams",
-          "type": "object"
-        }
-      ]
-    },
-    "PermissionProfileSelectionParams": {
-      "oneOf": [
-        {
-          "description": "Select a named built-in or user-defined profile and optionally apply bounded modifications that Codex knows how to validate.",
-          "properties": {
-            "id": {
-              "type": "string"
-            },
-            "modifications": {
-              "items": {
-                "$ref": "#/definitions/PermissionProfileModificationParams"
-              },
-              "type": [
-                "array",
-                "null"
-              ]
-            },
-            "type": {
-              "enum": [
-                "profile"
-              ],
-              "title": "ProfilePermissionProfileSelectionParamsType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "id",
-            "type"
-          ],
-          "title": "ProfilePermissionProfileSelectionParams",
-          "type": "object"
-        }
-      ]
-    },
     "Personality": {
       "enum": [
         "none",
@@ -862,6 +797,22 @@
           "title": "CompactionResponseItem",
           "type": "object"
         },
+        {
+          "properties": {
+            "type": {
+              "enum": [
+                "compaction_trigger"
+              ],
+              "title": "CompactionTriggerResponseItemType",
+              "type": "string"
+            }
+          },
+          "required": [
+            "type"
+          ],
+          "title": "CompactionTriggerResponseItem",
+          "type": "object"
+        },
         {
           "properties": {
             "encrypted_content": {
@@ -1012,7 +963,7 @@
       "type": "string"
     }
   },
-  "description": "There are three ways to resume a thread: 1. By thread_id: load the thread from disk by thread_id and resume it. 2. By history: instantiate the thread from memory and resume it. 3. By path: load the thread from disk by path and resume it.\n\nThe precedence is: history > path > thread_id. If using history or path, the thread_id param will be ignored.\n\nPrefer using thread_id whenever possible.",
+  "description": "There are three ways to resume a thread: 1. By thread_id: load the thread from disk by thread_id and resume it. 2. By history: instantiate the thread from memory and resume it. 3. By path: load the thread from disk by path and resume it.\n\nFor non-running threads, the precedence is: history > non-empty path > thread_id. If using history or a non-empty path for a non-running thread, the thread_id param will be ignored.\n\nIf thread_id identifies a running thread, app-server rejoins that thread and treats a non-empty path as a consistency check against the active rollout path. Empty string path values are treated as absent.\n\nPrefer using thread_id whenever possible.",
   "properties": {
     "approvalPolicy": {
       "anyOf": [
diff --git a/codex-rs/app-server-protocol/schema/json/v2/ThreadResumeResponse.json b/codex-rs/app-server-protocol/schema/json/v2/ThreadResumeResponse.json
index 727b7a3fb2..f379455b59 100644
--- a/codex-rs/app-server-protocol/schema/json/v2/ThreadResumeResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadResumeResponse.json
@@ -18,14 +18,6 @@
         "id": {
           "description": "Identifier from `default_permissions` or the implicit built-in default, such as `:workspace` or a user-defined `[permissions.<id>]` profile.",
           "type": "string"
-        },
-        "modifications": {
-          "default": [],
-          "description": "Bounded user-requested modifications applied on top of the named profile, if any.",
-          "items": {
-            "$ref": "#/definitions/ActivePermissionProfileModification"
-          },
-          "type": "array"
         }
       },
       "required": [
@@ -33,31 +25,6 @@
       ],
       "type": "object"
     },
-    "ActivePermissionProfileModification": {
-      "oneOf": [
-        {
-          "description": "Additional concrete directory that should be writable.",
-          "properties": {
-            "path": {
-              "$ref": "#/definitions/AbsolutePathBuf"
-            },
-            "type": {
-              "enum": [
-                "additionalWritableRoot"
-              ],
-              "title": "AdditionalWritableRootActivePermissionProfileModificationType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "path",
-            "type"
-          ],
-          "title": "AdditionalWritableRootActivePermissionProfileModification",
-          "type": "object"
-        }
-      ]
-    },
     "AgentPath": {
       "type": "string"
     },
@@ -503,202 +470,6 @@
       ],
       "type": "string"
     },
-    "FileSystemAccessMode": {
-      "enum": [
-        "read",
-        "write",
-        "none"
-      ],
-      "type": "string"
-    },
-    "FileSystemPath": {
-      "oneOf": [
-        {
-          "properties": {
-            "path": {
-              "$ref": "#/definitions/AbsolutePathBuf"
-            },
-            "type": {
-              "enum": [
-                "path"
-              ],
-              "title": "PathFileSystemPathType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "path",
-            "type"
-          ],
-          "title": "PathFileSystemPath",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "pattern": {
-              "type": "string"
-            },
-            "type": {
-              "enum": [
-                "glob_pattern"
-              ],
-              "title": "GlobPatternFileSystemPathType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "pattern",
-            "type"
-          ],
-          "title": "GlobPatternFileSystemPath",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "special"
-              ],
-              "title": "SpecialFileSystemPathType",
-              "type": "string"
-            },
-            "value": {
-              "$ref": "#/definitions/FileSystemSpecialPath"
-            }
-          },
-          "required": [
-            "type",
-            "value"
-          ],
-          "title": "SpecialFileSystemPath",
-          "type": "object"
-        }
-      ]
-    },
-    "FileSystemSandboxEntry": {
-      "properties": {
-        "access": {
-          "$ref": "#/definitions/FileSystemAccessMode"
-        },
-        "path": {
-          "$ref": "#/definitions/FileSystemPath"
-        }
-      },
-      "required": [
-        "access",
-        "path"
-      ],
-      "type": "object"
-    },
-    "FileSystemSpecialPath": {
-      "oneOf": [
-        {
-          "properties": {
-            "kind": {
-              "enum": [
-                "root"
-              ],
-              "type": "string"
-            }
-          },
-          "required": [
-            "kind"
-          ],
-          "title": "RootFileSystemSpecialPath",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "kind": {
-              "enum": [
-                "minimal"
-              ],
-              "type": "string"
-            }
-          },
-          "required": [
-            "kind"
-          ],
-          "title": "MinimalFileSystemSpecialPath",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "kind": {
-              "enum": [
-                "project_roots"
-              ],
-              "type": "string"
-            },
-            "subpath": {
-              "type": [
-                "string",
-                "null"
-              ]
-            }
-          },
-          "required": [
-            "kind"
-          ],
-          "title": "KindFileSystemSpecialPath",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "kind": {
-              "enum": [
-                "tmpdir"
-              ],
-              "type": "string"
-            }
-          },
-          "required": [
-            "kind"
-          ],
-          "title": "TmpdirFileSystemSpecialPath",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "kind": {
-              "enum": [
-                "slash_tmp"
-              ],
-              "type": "string"
-            }
-          },
-          "required": [
-            "kind"
-          ],
-          "title": "SlashTmpFileSystemSpecialPath",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "kind": {
-              "enum": [
-                "unknown"
-              ],
-              "type": "string"
-            },
-            "path": {
-              "type": "string"
-            },
-            "subpath": {
-              "type": [
-                "string",
-                "null"
-              ]
-            }
-          },
-          "required": [
-            "kind",
-            "path"
-          ],
-          "type": "object"
-        }
-      ]
-    },
     "FileUpdateChange": {
       "properties": {
         "diff": {
@@ -756,6 +527,13 @@
       ],
       "type": "object"
     },
+    "ImageDetail": {
+      "enum": [
+        "high",
+        "original"
+      ],
+      "type": "string"
+    },
     "McpToolCallError": {
       "properties": {
         "message": {
@@ -937,135 +715,6 @@
         }
       ]
     },
-    "PermissionProfile": {
-      "oneOf": [
-        {
-          "description": "Codex owns sandbox construction for this profile.",
-          "properties": {
-            "fileSystem": {
-              "$ref": "#/definitions/PermissionProfileFileSystemPermissions"
-            },
-            "network": {
-              "$ref": "#/definitions/PermissionProfileNetworkPermissions"
-            },
-            "type": {
-              "enum": [
-                "managed"
-              ],
-              "title": "ManagedPermissionProfileType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "fileSystem",
-            "network",
-            "type"
-          ],
-          "title": "ManagedPermissionProfile",
-          "type": "object"
-        },
-        {
-          "description": "Do not apply an outer sandbox.",
-          "properties": {
-            "type": {
-              "enum": [
-                "disabled"
-              ],
-              "title": "DisabledPermissionProfileType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "DisabledPermissionProfile",
-          "type": "object"
-        },
-        {
-          "description": "Filesystem isolation is enforced by an external caller.",
-          "properties": {
-            "network": {
-              "$ref": "#/definitions/PermissionProfileNetworkPermissions"
-            },
-            "type": {
-              "enum": [
-                "external"
-              ],
-              "title": "ExternalPermissionProfileType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "network",
-            "type"
-          ],
-          "title": "ExternalPermissionProfile",
-          "type": "object"
-        }
-      ]
-    },
-    "PermissionProfileFileSystemPermissions": {
-      "oneOf": [
-        {
-          "properties": {
-            "entries": {
-              "items": {
-                "$ref": "#/definitions/FileSystemSandboxEntry"
-              },
-              "type": "array"
-            },
-            "globScanMaxDepth": {
-              "format": "uint",
-              "minimum": 1.0,
-              "type": [
-                "integer",
-                "null"
-              ]
-            },
-            "type": {
-              "enum": [
-                "restricted"
-              ],
-              "title": "RestrictedPermissionProfileFileSystemPermissionsType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "entries",
-            "type"
-          ],
-          "title": "RestrictedPermissionProfileFileSystemPermissions",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "unrestricted"
-              ],
-              "title": "UnrestrictedPermissionProfileFileSystemPermissionsType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "UnrestrictedPermissionProfileFileSystemPermissions",
-          "type": "object"
-        }
-      ]
-    },
-    "PermissionProfileNetworkPermissions": {
-      "properties": {
-        "enabled": {
-          "type": "boolean"
-        }
-      },
-      "required": [
-        "enabled"
-      ],
-      "type": "object"
-    },
     "ReasoningEffort": {
       "description": "See https://platform.openai.com/docs/guides/reasoning?api-mode=responses#get-started-with-reasoning",
       "enum": [
@@ -2370,6 +2019,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "type": {
               "enum": [
                 "image"
@@ -2390,6 +2050,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "path": {
               "type": "string"
             },
@@ -2605,7 +2276,7 @@
           "$ref": "#/definitions/SandboxPolicy"
         }
       ],
-      "description": "Legacy sandbox policy retained for compatibility. Experimental clients should prefer `permissionProfile` when they need exact runtime permissions."
+      "description": "Legacy sandbox policy retained for compatibility. Experimental clients should prefer `activePermissionProfile` for profile provenance."
     },
     "serviceTier": {
       "type": [
diff --git a/codex-rs/app-server-protocol/schema/json/v2/ThreadRollbackResponse.json b/codex-rs/app-server-protocol/schema/json/v2/ThreadRollbackResponse.json
index 204828c732..8d807d76cb 100644
--- a/codex-rs/app-server-protocol/schema/json/v2/ThreadRollbackResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadRollbackResponse.json
@@ -448,6 +448,13 @@
       ],
       "type": "object"
     },
+    "ImageDetail": {
+      "enum": [
+        "high",
+        "original"
+      ],
+      "type": "string"
+    },
     "McpToolCallError": {
       "properties": {
         "message": {
@@ -1827,6 +1834,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "type": {
               "enum": [
                 "image"
@@ -1847,6 +1865,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "path": {
               "type": "string"
             },
diff --git a/codex-rs/app-server-protocol/schema/json/v2/ThreadStartParams.json b/codex-rs/app-server-protocol/schema/json/v2/ThreadStartParams.json
index 9a60049a61..99b25490ab 100644
--- a/codex-rs/app-server-protocol/schema/json/v2/ThreadStartParams.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadStartParams.json
@@ -90,65 +90,6 @@
       ],
       "type": "object"
     },
-    "PermissionProfileModificationParams": {
-      "oneOf": [
-        {
-          "description": "Additional concrete directory that should be writable.",
-          "properties": {
-            "path": {
-              "$ref": "#/definitions/AbsolutePathBuf"
-            },
-            "type": {
-              "enum": [
-                "additionalWritableRoot"
-              ],
-              "title": "AdditionalWritableRootPermissionProfileModificationParamsType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "path",
-            "type"
-          ],
-          "title": "AdditionalWritableRootPermissionProfileModificationParams",
-          "type": "object"
-        }
-      ]
-    },
-    "PermissionProfileSelectionParams": {
-      "oneOf": [
-        {
-          "description": "Select a named built-in or user-defined profile and optionally apply bounded modifications that Codex knows how to validate.",
-          "properties": {
-            "id": {
-              "type": "string"
-            },
-            "modifications": {
-              "items": {
-                "$ref": "#/definitions/PermissionProfileModificationParams"
-              },
-              "type": [
-                "array",
-                "null"
-              ]
-            },
-            "type": {
-              "enum": [
-                "profile"
-              ],
-              "title": "ProfilePermissionProfileSelectionParamsType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "id",
-            "type"
-          ],
-          "title": "ProfilePermissionProfileSelectionParams",
-          "type": "object"
-        }
-      ]
-    },
     "Personality": {
       "enum": [
         "none",
diff --git a/codex-rs/app-server-protocol/schema/json/v2/ThreadStartResponse.json b/codex-rs/app-server-protocol/schema/json/v2/ThreadStartResponse.json
index bf03f0fb55..7d31c52f1c 100644
--- a/codex-rs/app-server-protocol/schema/json/v2/ThreadStartResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadStartResponse.json
@@ -18,14 +18,6 @@
         "id": {
           "description": "Identifier from `default_permissions` or the implicit built-in default, such as `:workspace` or a user-defined `[permissions.<id>]` profile.",
           "type": "string"
-        },
-        "modifications": {
-          "default": [],
-          "description": "Bounded user-requested modifications applied on top of the named profile, if any.",
-          "items": {
-            "$ref": "#/definitions/ActivePermissionProfileModification"
-          },
-          "type": "array"
         }
       },
       "required": [
@@ -33,31 +25,6 @@
       ],
       "type": "object"
     },
-    "ActivePermissionProfileModification": {
-      "oneOf": [
-        {
-          "description": "Additional concrete directory that should be writable.",
-          "properties": {
-            "path": {
-              "$ref": "#/definitions/AbsolutePathBuf"
-            },
-            "type": {
-              "enum": [
-                "additionalWritableRoot"
-              ],
-              "title": "AdditionalWritableRootActivePermissionProfileModificationType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "path",
-            "type"
-          ],
-          "title": "AdditionalWritableRootActivePermissionProfileModification",
-          "type": "object"
-        }
-      ]
-    },
     "AgentPath": {
       "type": "string"
     },
@@ -503,202 +470,6 @@
       ],
       "type": "string"
     },
-    "FileSystemAccessMode": {
-      "enum": [
-        "read",
-        "write",
-        "none"
-      ],
-      "type": "string"
-    },
-    "FileSystemPath": {
-      "oneOf": [
-        {
-          "properties": {
-            "path": {
-              "$ref": "#/definitions/AbsolutePathBuf"
-            },
-            "type": {
-              "enum": [
-                "path"
-              ],
-              "title": "PathFileSystemPathType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "path",
-            "type"
-          ],
-          "title": "PathFileSystemPath",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "pattern": {
-              "type": "string"
-            },
-            "type": {
-              "enum": [
-                "glob_pattern"
-              ],
-              "title": "GlobPatternFileSystemPathType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "pattern",
-            "type"
-          ],
-          "title": "GlobPatternFileSystemPath",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "special"
-              ],
-              "title": "SpecialFileSystemPathType",
-              "type": "string"
-            },
-            "value": {
-              "$ref": "#/definitions/FileSystemSpecialPath"
-            }
-          },
-          "required": [
-            "type",
-            "value"
-          ],
-          "title": "SpecialFileSystemPath",
-          "type": "object"
-        }
-      ]
-    },
-    "FileSystemSandboxEntry": {
-      "properties": {
-        "access": {
-          "$ref": "#/definitions/FileSystemAccessMode"
-        },
-        "path": {
-          "$ref": "#/definitions/FileSystemPath"
-        }
-      },
-      "required": [
-        "access",
-        "path"
-      ],
-      "type": "object"
-    },
-    "FileSystemSpecialPath": {
-      "oneOf": [
-        {
-          "properties": {
-            "kind": {
-              "enum": [
-                "root"
-              ],
-              "type": "string"
-            }
-          },
-          "required": [
-            "kind"
-          ],
-          "title": "RootFileSystemSpecialPath",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "kind": {
-              "enum": [
-                "minimal"
-              ],
-              "type": "string"
-            }
-          },
-          "required": [
-            "kind"
-          ],
-          "title": "MinimalFileSystemSpecialPath",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "kind": {
-              "enum": [
-                "project_roots"
-              ],
-              "type": "string"
-            },
-            "subpath": {
-              "type": [
-                "string",
-                "null"
-              ]
-            }
-          },
-          "required": [
-            "kind"
-          ],
-          "title": "KindFileSystemSpecialPath",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "kind": {
-              "enum": [
-                "tmpdir"
-              ],
-              "type": "string"
-            }
-          },
-          "required": [
-            "kind"
-          ],
-          "title": "TmpdirFileSystemSpecialPath",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "kind": {
-              "enum": [
-                "slash_tmp"
-              ],
-              "type": "string"
-            }
-          },
-          "required": [
-            "kind"
-          ],
-          "title": "SlashTmpFileSystemSpecialPath",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "kind": {
-              "enum": [
-                "unknown"
-              ],
-              "type": "string"
-            },
-            "path": {
-              "type": "string"
-            },
-            "subpath": {
-              "type": [
-                "string",
-                "null"
-              ]
-            }
-          },
-          "required": [
-            "kind",
-            "path"
-          ],
-          "type": "object"
-        }
-      ]
-    },
     "FileUpdateChange": {
       "properties": {
         "diff": {
@@ -756,6 +527,13 @@
       ],
       "type": "object"
     },
+    "ImageDetail": {
+      "enum": [
+        "high",
+        "original"
+      ],
+      "type": "string"
+    },
     "McpToolCallError": {
       "properties": {
         "message": {
@@ -937,135 +715,6 @@
         }
       ]
     },
-    "PermissionProfile": {
-      "oneOf": [
-        {
-          "description": "Codex owns sandbox construction for this profile.",
-          "properties": {
-            "fileSystem": {
-              "$ref": "#/definitions/PermissionProfileFileSystemPermissions"
-            },
-            "network": {
-              "$ref": "#/definitions/PermissionProfileNetworkPermissions"
-            },
-            "type": {
-              "enum": [
-                "managed"
-              ],
-              "title": "ManagedPermissionProfileType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "fileSystem",
-            "network",
-            "type"
-          ],
-          "title": "ManagedPermissionProfile",
-          "type": "object"
-        },
-        {
-          "description": "Do not apply an outer sandbox.",
-          "properties": {
-            "type": {
-              "enum": [
-                "disabled"
-              ],
-              "title": "DisabledPermissionProfileType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "DisabledPermissionProfile",
-          "type": "object"
-        },
-        {
-          "description": "Filesystem isolation is enforced by an external caller.",
-          "properties": {
-            "network": {
-              "$ref": "#/definitions/PermissionProfileNetworkPermissions"
-            },
-            "type": {
-              "enum": [
-                "external"
-              ],
-              "title": "ExternalPermissionProfileType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "network",
-            "type"
-          ],
-          "title": "ExternalPermissionProfile",
-          "type": "object"
-        }
-      ]
-    },
-    "PermissionProfileFileSystemPermissions": {
-      "oneOf": [
-        {
-          "properties": {
-            "entries": {
-              "items": {
-                "$ref": "#/definitions/FileSystemSandboxEntry"
-              },
-              "type": "array"
-            },
-            "globScanMaxDepth": {
-              "format": "uint",
-              "minimum": 1.0,
-              "type": [
-                "integer",
-                "null"
-              ]
-            },
-            "type": {
-              "enum": [
-                "restricted"
-              ],
-              "title": "RestrictedPermissionProfileFileSystemPermissionsType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "entries",
-            "type"
-          ],
-          "title": "RestrictedPermissionProfileFileSystemPermissions",
-          "type": "object"
-        },
-        {
-          "properties": {
-            "type": {
-              "enum": [
-                "unrestricted"
-              ],
-              "title": "UnrestrictedPermissionProfileFileSystemPermissionsType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "type"
-          ],
-          "title": "UnrestrictedPermissionProfileFileSystemPermissions",
-          "type": "object"
-        }
-      ]
-    },
-    "PermissionProfileNetworkPermissions": {
-      "properties": {
-        "enabled": {
-          "type": "boolean"
-        }
-      },
-      "required": [
-        "enabled"
-      ],
-      "type": "object"
-    },
     "ReasoningEffort": {
       "description": "See https://platform.openai.com/docs/guides/reasoning?api-mode=responses#get-started-with-reasoning",
       "enum": [
@@ -2370,6 +2019,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "type": {
               "enum": [
                 "image"
@@ -2390,6 +2050,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "path": {
               "type": "string"
             },
@@ -2605,7 +2276,7 @@
           "$ref": "#/definitions/SandboxPolicy"
         }
       ],
-      "description": "Legacy sandbox policy retained for compatibility. Experimental clients should prefer `permissionProfile` when they need exact runtime permissions."
+      "description": "Legacy sandbox policy retained for compatibility. Experimental clients should prefer `activePermissionProfile` for profile provenance."
     },
     "serviceTier": {
       "type": [
diff --git a/codex-rs/app-server-protocol/schema/json/v2/ThreadStartedNotification.json b/codex-rs/app-server-protocol/schema/json/v2/ThreadStartedNotification.json
index 759b5990be..3ec843e817 100644
--- a/codex-rs/app-server-protocol/schema/json/v2/ThreadStartedNotification.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadStartedNotification.json
@@ -448,6 +448,13 @@
       ],
       "type": "object"
     },
+    "ImageDetail": {
+      "enum": [
+        "high",
+        "original"
+      ],
+      "type": "string"
+    },
     "McpToolCallError": {
       "properties": {
         "message": {
@@ -1827,6 +1834,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "type": {
               "enum": [
                 "image"
@@ -1847,6 +1865,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "path": {
               "type": "string"
             },
diff --git a/codex-rs/app-server-protocol/schema/json/v2/ThreadUnarchiveResponse.json b/codex-rs/app-server-protocol/schema/json/v2/ThreadUnarchiveResponse.json
index f64400129a..ea48e34180 100644
--- a/codex-rs/app-server-protocol/schema/json/v2/ThreadUnarchiveResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/ThreadUnarchiveResponse.json
@@ -448,6 +448,13 @@
       ],
       "type": "object"
     },
+    "ImageDetail": {
+      "enum": [
+        "high",
+        "original"
+      ],
+      "type": "string"
+    },
     "McpToolCallError": {
       "properties": {
         "message": {
@@ -1827,6 +1834,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "type": {
               "enum": [
                 "image"
@@ -1847,6 +1865,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "path": {
               "type": "string"
             },
diff --git a/codex-rs/app-server-protocol/schema/json/v2/TurnCompletedNotification.json b/codex-rs/app-server-protocol/schema/json/v2/TurnCompletedNotification.json
index e5e2558e9c..40b81e5a34 100644
--- a/codex-rs/app-server-protocol/schema/json/v2/TurnCompletedNotification.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/TurnCompletedNotification.json
@@ -422,6 +422,13 @@
       ],
       "type": "object"
     },
+    "ImageDetail": {
+      "enum": [
+        "high",
+        "original"
+      ],
+      "type": "string"
+    },
     "McpToolCallError": {
       "properties": {
         "message": {
@@ -1452,6 +1459,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "type": {
               "enum": [
                 "image"
@@ -1472,6 +1490,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "path": {
               "type": "string"
             },
diff --git a/codex-rs/app-server-protocol/schema/json/v2/TurnStartParams.json b/codex-rs/app-server-protocol/schema/json/v2/TurnStartParams.json
index 1ef33d4301..ecea8f1997 100644
--- a/codex-rs/app-server-protocol/schema/json/v2/TurnStartParams.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/TurnStartParams.json
@@ -99,6 +99,13 @@
       ],
       "type": "object"
     },
+    "ImageDetail": {
+      "enum": [
+        "high",
+        "original"
+      ],
+      "type": "string"
+    },
     "ModeKind": {
       "description": "Initial collaboration mode to use when the TUI starts.",
       "enum": [
@@ -114,65 +121,6 @@
       ],
       "type": "string"
     },
-    "PermissionProfileModificationParams": {
-      "oneOf": [
-        {
-          "description": "Additional concrete directory that should be writable.",
-          "properties": {
-            "path": {
-              "$ref": "#/definitions/AbsolutePathBuf"
-            },
-            "type": {
-              "enum": [
-                "additionalWritableRoot"
-              ],
-              "title": "AdditionalWritableRootPermissionProfileModificationParamsType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "path",
-            "type"
-          ],
-          "title": "AdditionalWritableRootPermissionProfileModificationParams",
-          "type": "object"
-        }
-      ]
-    },
-    "PermissionProfileSelectionParams": {
-      "oneOf": [
-        {
-          "description": "Select a named built-in or user-defined profile and optionally apply bounded modifications that Codex knows how to validate.",
-          "properties": {
-            "id": {
-              "type": "string"
-            },
-            "modifications": {
-              "items": {
-                "$ref": "#/definitions/PermissionProfileModificationParams"
-              },
-              "type": [
-                "array",
-                "null"
-              ]
-            },
-            "type": {
-              "enum": [
-                "profile"
-              ],
-              "title": "ProfilePermissionProfileSelectionParamsType",
-              "type": "string"
-            }
-          },
-          "required": [
-            "id",
-            "type"
-          ],
-          "title": "ProfilePermissionProfileSelectionParams",
-          "type": "object"
-        }
-      ]
-    },
     "Personality": {
       "enum": [
         "none",
@@ -410,6 +358,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "type": {
               "enum": [
                 "image"
@@ -430,6 +389,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "path": {
               "type": "string"
             },
diff --git a/codex-rs/app-server-protocol/schema/json/v2/TurnStartResponse.json b/codex-rs/app-server-protocol/schema/json/v2/TurnStartResponse.json
index a2eff7fdd8..ffe0a28d15 100644
--- a/codex-rs/app-server-protocol/schema/json/v2/TurnStartResponse.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/TurnStartResponse.json
@@ -422,6 +422,13 @@
       ],
       "type": "object"
     },
+    "ImageDetail": {
+      "enum": [
+        "high",
+        "original"
+      ],
+      "type": "string"
+    },
     "McpToolCallError": {
       "properties": {
         "message": {
@@ -1452,6 +1459,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "type": {
               "enum": [
                 "image"
@@ -1472,6 +1490,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "path": {
               "type": "string"
             },
diff --git a/codex-rs/app-server-protocol/schema/json/v2/TurnStartedNotification.json b/codex-rs/app-server-protocol/schema/json/v2/TurnStartedNotification.json
index 0952db2aca..cbde541e52 100644
--- a/codex-rs/app-server-protocol/schema/json/v2/TurnStartedNotification.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/TurnStartedNotification.json
@@ -422,6 +422,13 @@
       ],
       "type": "object"
     },
+    "ImageDetail": {
+      "enum": [
+        "high",
+        "original"
+      ],
+      "type": "string"
+    },
     "McpToolCallError": {
       "properties": {
         "message": {
@@ -1452,6 +1459,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "type": {
               "enum": [
                 "image"
@@ -1472,6 +1490,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "path": {
               "type": "string"
             },
diff --git a/codex-rs/app-server-protocol/schema/json/v2/TurnSteerParams.json b/codex-rs/app-server-protocol/schema/json/v2/TurnSteerParams.json
index a064d9e7e3..1b7cfbf400 100644
--- a/codex-rs/app-server-protocol/schema/json/v2/TurnSteerParams.json
+++ b/codex-rs/app-server-protocol/schema/json/v2/TurnSteerParams.json
@@ -20,6 +20,13 @@
       ],
       "type": "object"
     },
+    "ImageDetail": {
+      "enum": [
+        "high",
+        "original"
+      ],
+      "type": "string"
+    },
     "TextElement": {
       "properties": {
         "byteRange": {
@@ -75,6 +82,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "type": {
               "enum": [
                 "image"
@@ -95,6 +113,17 @@
         },
         {
           "properties": {
+            "detail": {
+              "anyOf": [
+                {
+                  "$ref": "#/definitions/ImageDetail"
+                },
+                {
+                  "type": "null"
+                }
+              ],
+              "default": null
+            },
             "path": {
               "type": "string"
             },
diff --git a/codex-rs/app-server-protocol/schema/typescript/AutoCompactTokenLimitScope.ts b/codex-rs/app-server-protocol/schema/typescript/AutoCompactTokenLimitScope.ts
new file mode 100644
index 0000000000..3d9a56c82a
--- /dev/null
+++ b/codex-rs/app-server-protocol/schema/typescript/AutoCompactTokenLimitScope.ts
@@ -0,0 +1,9 @@
+// GENERATED CODE! DO NOT MODIFY BY HAND!
+
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+
+/**
+ * Selects which part of the active context is charged against
+ * `model_auto_compact_token_limit`.
+ */
+export type AutoCompactTokenLimitScope = "total" | "body_after_prefix";
diff --git a/codex-rs/app-server-protocol/schema/typescript/ClientRequest.ts b/codex-rs/app-server-protocol/schema/typescript/ClientRequest.ts
index 28371c7106..7f017ed700 100644
--- a/codex-rs/app-server-protocol/schema/typescript/ClientRequest.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/ClientRequest.ts
@@ -43,6 +43,7 @@ import type { McpServerToolCallParams } from "./v2/McpServerToolCallParams";
 import type { ModelListParams } from "./v2/ModelListParams";
 import type { ModelProviderCapabilitiesReadParams } from "./v2/ModelProviderCapabilitiesReadParams";
 import type { PluginInstallParams } from "./v2/PluginInstallParams";
+import type { PluginInstalledParams } from "./v2/PluginInstalledParams";
 import type { PluginListParams } from "./v2/PluginListParams";
 import type { PluginReadParams } from "./v2/PluginReadParams";
 import type { PluginShareCheckoutParams } from "./v2/PluginShareCheckoutParams";
@@ -80,4 +81,4 @@ import type { WindowsSandboxSetupStartParams } from "./v2/WindowsSandboxSetupSta
 /**
  * Request from the client to the server.
  */
-export type ClientRequest ={ "method": "initialize", id: RequestId, params: InitializeParams, } | { "method": "thread/start", id: RequestId, params: ThreadStartParams, } | { "method": "thread/resume", id: RequestId, params: ThreadResumeParams, } | { "method": "thread/fork", id: RequestId, params: ThreadForkParams, } | { "method": "thread/archive", id: RequestId, params: ThreadArchiveParams, } | { "method": "thread/unsubscribe", id: RequestId, params: ThreadUnsubscribeParams, } | { "method": "thread/name/set", id: RequestId, params: ThreadSetNameParams, } | { "method": "thread/metadata/update", id: RequestId, params: ThreadMetadataUpdateParams, } | { "method": "thread/unarchive", id: RequestId, params: ThreadUnarchiveParams, } | { "method": "thread/compact/start", id: RequestId, params: ThreadCompactStartParams, } | { "method": "thread/shellCommand", id: RequestId, params: ThreadShellCommandParams, } | { "method": "thread/approveGuardianDeniedAction", id: RequestId, params: ThreadApproveGuardianDeniedActionParams, } | { "method": "thread/rollback", id: RequestId, params: ThreadRollbackParams, } | { "method": "thread/list", id: RequestId, params: ThreadListParams, } | { "method": "thread/loaded/list", id: RequestId, params: ThreadLoadedListParams, } | { "method": "thread/read", id: RequestId, params: ThreadReadParams, } | { "method": "thread/inject_items", id: RequestId, params: ThreadInjectItemsParams, } | { "method": "skills/list", id: RequestId, params: SkillsListParams, } | { "method": "hooks/list", id: RequestId, params: HooksListParams, } | { "method": "marketplace/add", id: RequestId, params: MarketplaceAddParams, } | { "method": "marketplace/remove", id: RequestId, params: MarketplaceRemoveParams, } | { "method": "marketplace/upgrade", id: RequestId, params: MarketplaceUpgradeParams, } | { "method": "plugin/list", id: RequestId, params: PluginListParams, } | { "method": "plugin/read", id: RequestId, params: PluginReadParams, } | { "method": "plugin/skill/read", id: RequestId, params: PluginSkillReadParams, } | { "method": "plugin/share/save", id: RequestId, params: PluginShareSaveParams, } | { "method": "plugin/share/updateTargets", id: RequestId, params: PluginShareUpdateTargetsParams, } | { "method": "plugin/share/list", id: RequestId, params: PluginShareListParams, } | { "method": "plugin/share/checkout", id: RequestId, params: PluginShareCheckoutParams, } | { "method": "plugin/share/delete", id: RequestId, params: PluginShareDeleteParams, } | { "method": "app/list", id: RequestId, params: AppsListParams, } | { "method": "fs/readFile", id: RequestId, params: FsReadFileParams, } | { "method": "fs/writeFile", id: RequestId, params: FsWriteFileParams, } | { "method": "fs/createDirectory", id: RequestId, params: FsCreateDirectoryParams, } | { "method": "fs/getMetadata", id: RequestId, params: FsGetMetadataParams, } | { "method": "fs/readDirectory", id: RequestId, params: FsReadDirectoryParams, } | { "method": "fs/remove", id: RequestId, params: FsRemoveParams, } | { "method": "fs/copy", id: RequestId, params: FsCopyParams, } | { "method": "fs/watch", id: RequestId, params: FsWatchParams, } | { "method": "fs/unwatch", id: RequestId, params: FsUnwatchParams, } | { "method": "skills/config/write", id: RequestId, params: SkillsConfigWriteParams, } | { "method": "plugin/install", id: RequestId, params: PluginInstallParams, } | { "method": "plugin/uninstall", id: RequestId, params: PluginUninstallParams, } | { "method": "turn/start", id: RequestId, params: TurnStartParams, } | { "method": "turn/steer", id: RequestId, params: TurnSteerParams, } | { "method": "turn/interrupt", id: RequestId, params: TurnInterruptParams, } | { "method": "review/start", id: RequestId, params: ReviewStartParams, } | { "method": "model/list", id: RequestId, params: ModelListParams, } | { "method": "modelProvider/capabilities/read", id: RequestId, params: ModelProviderCapabilitiesReadParams, } | { "method": "experimentalFeature/list", id: RequestId, params: ExperimentalFeatureListParams, } | { "method": "experimentalFeature/enablement/set", id: RequestId, params: ExperimentalFeatureEnablementSetParams, } | { "method": "mcpServer/oauth/login", id: RequestId, params: McpServerOauthLoginParams, } | { "method": "config/mcpServer/reload", id: RequestId, params: undefined, } | { "method": "mcpServerStatus/list", id: RequestId, params: ListMcpServerStatusParams, } | { "method": "mcpServer/resource/read", id: RequestId, params: McpResourceReadParams, } | { "method": "mcpServer/tool/call", id: RequestId, params: McpServerToolCallParams, } | { "method": "windowsSandbox/setupStart", id: RequestId, params: WindowsSandboxSetupStartParams, } | { "method": "windowsSandbox/readiness", id: RequestId, params: undefined, } | { "method": "account/login/start", id: RequestId, params: LoginAccountParams, } | { "method": "account/login/cancel", id: RequestId, params: CancelLoginAccountParams, } | { "method": "account/logout", id: RequestId, params: undefined, } | { "method": "account/rateLimits/read", id: RequestId, params: undefined, } | { "method": "account/sendAddCreditsNudgeEmail", id: RequestId, params: SendAddCreditsNudgeEmailParams, } | { "method": "feedback/upload", id: RequestId, params: FeedbackUploadParams, } | { "method": "command/exec", id: RequestId, params: CommandExecParams, } | { "method": "command/exec/write", id: RequestId, params: CommandExecWriteParams, } | { "method": "command/exec/terminate", id: RequestId, params: CommandExecTerminateParams, } | { "method": "command/exec/resize", id: RequestId, params: CommandExecResizeParams, } | { "method": "config/read", id: RequestId, params: ConfigReadParams, } | { "method": "externalAgentConfig/detect", id: RequestId, params: ExternalAgentConfigDetectParams, } | { "method": "externalAgentConfig/import", id: RequestId, params: ExternalAgentConfigImportParams, } | { "method": "config/value/write", id: RequestId, params: ConfigValueWriteParams, } | { "method": "config/batchWrite", id: RequestId, params: ConfigBatchWriteParams, } | { "method": "configRequirements/read", id: RequestId, params: undefined, } | { "method": "account/read", id: RequestId, params: GetAccountParams, } | { "method": "getConversationSummary", id: RequestId, params: GetConversationSummaryParams, } | { "method": "gitDiffToRemote", id: RequestId, params: GitDiffToRemoteParams, } | { "method": "getAuthStatus", id: RequestId, params: GetAuthStatusParams, } | { "method": "fuzzyFileSearch", id: RequestId, params: FuzzyFileSearchParams, };
+export type ClientRequest ={ "method": "initialize", id: RequestId, params: InitializeParams, } | { "method": "thread/start", id: RequestId, params: ThreadStartParams, } | { "method": "thread/resume", id: RequestId, params: ThreadResumeParams, } | { "method": "thread/fork", id: RequestId, params: ThreadForkParams, } | { "method": "thread/archive", id: RequestId, params: ThreadArchiveParams, } | { "method": "thread/unsubscribe", id: RequestId, params: ThreadUnsubscribeParams, } | { "method": "thread/name/set", id: RequestId, params: ThreadSetNameParams, } | { "method": "thread/metadata/update", id: RequestId, params: ThreadMetadataUpdateParams, } | { "method": "thread/unarchive", id: RequestId, params: ThreadUnarchiveParams, } | { "method": "thread/compact/start", id: RequestId, params: ThreadCompactStartParams, } | { "method": "thread/shellCommand", id: RequestId, params: ThreadShellCommandParams, } | { "method": "thread/approveGuardianDeniedAction", id: RequestId, params: ThreadApproveGuardianDeniedActionParams, } | { "method": "thread/rollback", id: RequestId, params: ThreadRollbackParams, } | { "method": "thread/list", id: RequestId, params: ThreadListParams, } | { "method": "thread/loaded/list", id: RequestId, params: ThreadLoadedListParams, } | { "method": "thread/read", id: RequestId, params: ThreadReadParams, } | { "method": "thread/inject_items", id: RequestId, params: ThreadInjectItemsParams, } | { "method": "skills/list", id: RequestId, params: SkillsListParams, } | { "method": "hooks/list", id: RequestId, params: HooksListParams, } | { "method": "marketplace/add", id: RequestId, params: MarketplaceAddParams, } | { "method": "marketplace/remove", id: RequestId, params: MarketplaceRemoveParams, } | { "method": "marketplace/upgrade", id: RequestId, params: MarketplaceUpgradeParams, } | { "method": "plugin/list", id: RequestId, params: PluginListParams, } | { "method": "plugin/installed", id: RequestId, params: PluginInstalledParams, } | { "method": "plugin/read", id: RequestId, params: PluginReadParams, } | { "method": "plugin/skill/read", id: RequestId, params: PluginSkillReadParams, } | { "method": "plugin/share/save", id: RequestId, params: PluginShareSaveParams, } | { "method": "plugin/share/updateTargets", id: RequestId, params: PluginShareUpdateTargetsParams, } | { "method": "plugin/share/list", id: RequestId, params: PluginShareListParams, } | { "method": "plugin/share/checkout", id: RequestId, params: PluginShareCheckoutParams, } | { "method": "plugin/share/delete", id: RequestId, params: PluginShareDeleteParams, } | { "method": "app/list", id: RequestId, params: AppsListParams, } | { "method": "fs/readFile", id: RequestId, params: FsReadFileParams, } | { "method": "fs/writeFile", id: RequestId, params: FsWriteFileParams, } | { "method": "fs/createDirectory", id: RequestId, params: FsCreateDirectoryParams, } | { "method": "fs/getMetadata", id: RequestId, params: FsGetMetadataParams, } | { "method": "fs/readDirectory", id: RequestId, params: FsReadDirectoryParams, } | { "method": "fs/remove", id: RequestId, params: FsRemoveParams, } | { "method": "fs/copy", id: RequestId, params: FsCopyParams, } | { "method": "fs/watch", id: RequestId, params: FsWatchParams, } | { "method": "fs/unwatch", id: RequestId, params: FsUnwatchParams, } | { "method": "skills/config/write", id: RequestId, params: SkillsConfigWriteParams, } | { "method": "plugin/install", id: RequestId, params: PluginInstallParams, } | { "method": "plugin/uninstall", id: RequestId, params: PluginUninstallParams, } | { "method": "turn/start", id: RequestId, params: TurnStartParams, } | { "method": "turn/steer", id: RequestId, params: TurnSteerParams, } | { "method": "turn/interrupt", id: RequestId, params: TurnInterruptParams, } | { "method": "review/start", id: RequestId, params: ReviewStartParams, } | { "method": "model/list", id: RequestId, params: ModelListParams, } | { "method": "modelProvider/capabilities/read", id: RequestId, params: ModelProviderCapabilitiesReadParams, } | { "method": "experimentalFeature/list", id: RequestId, params: ExperimentalFeatureListParams, } | { "method": "experimentalFeature/enablement/set", id: RequestId, params: ExperimentalFeatureEnablementSetParams, } | { "method": "mcpServer/oauth/login", id: RequestId, params: McpServerOauthLoginParams, } | { "method": "config/mcpServer/reload", id: RequestId, params: undefined, } | { "method": "mcpServerStatus/list", id: RequestId, params: ListMcpServerStatusParams, } | { "method": "mcpServer/resource/read", id: RequestId, params: McpResourceReadParams, } | { "method": "mcpServer/tool/call", id: RequestId, params: McpServerToolCallParams, } | { "method": "windowsSandbox/setupStart", id: RequestId, params: WindowsSandboxSetupStartParams, } | { "method": "windowsSandbox/readiness", id: RequestId, params: undefined, } | { "method": "account/login/start", id: RequestId, params: LoginAccountParams, } | { "method": "account/login/cancel", id: RequestId, params: CancelLoginAccountParams, } | { "method": "account/logout", id: RequestId, params: undefined, } | { "method": "account/rateLimits/read", id: RequestId, params: undefined, } | { "method": "account/sendAddCreditsNudgeEmail", id: RequestId, params: SendAddCreditsNudgeEmailParams, } | { "method": "feedback/upload", id: RequestId, params: FeedbackUploadParams, } | { "method": "command/exec", id: RequestId, params: CommandExecParams, } | { "method": "command/exec/write", id: RequestId, params: CommandExecWriteParams, } | { "method": "command/exec/terminate", id: RequestId, params: CommandExecTerminateParams, } | { "method": "command/exec/resize", id: RequestId, params: CommandExecResizeParams, } | { "method": "config/read", id: RequestId, params: ConfigReadParams, } | { "method": "externalAgentConfig/detect", id: RequestId, params: ExternalAgentConfigDetectParams, } | { "method": "externalAgentConfig/import", id: RequestId, params: ExternalAgentConfigImportParams, } | { "method": "config/value/write", id: RequestId, params: ConfigValueWriteParams, } | { "method": "config/batchWrite", id: RequestId, params: ConfigBatchWriteParams, } | { "method": "configRequirements/read", id: RequestId, params: undefined, } | { "method": "account/read", id: RequestId, params: GetAccountParams, } | { "method": "getConversationSummary", id: RequestId, params: GetConversationSummaryParams, } | { "method": "gitDiffToRemote", id: RequestId, params: GitDiffToRemoteParams, } | { "method": "getAuthStatus", id: RequestId, params: GetAuthStatusParams, } | { "method": "fuzzyFileSearch", id: RequestId, params: FuzzyFileSearchParams, };
diff --git a/codex-rs/app-server-protocol/schema/typescript/ImageDetail.ts b/codex-rs/app-server-protocol/schema/typescript/ImageDetail.ts
index a48f07c088..5a62cc32f1 100644
--- a/codex-rs/app-server-protocol/schema/typescript/ImageDetail.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/ImageDetail.ts
@@ -2,4 +2,4 @@
 
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 
-export type ImageDetail = "auto" | "low" | "high" | "original";
+export type ImageDetail = "high" | "original";
diff --git a/codex-rs/app-server-protocol/schema/typescript/ResponseItem.ts b/codex-rs/app-server-protocol/schema/typescript/ResponseItem.ts
index 6fa9beee25..e5e960ff81 100644
--- a/codex-rs/app-server-protocol/schema/typescript/ResponseItem.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/ResponseItem.ts
@@ -14,4 +14,4 @@ export type ResponseItem = { "type": "message", role: string, content: Array<Con
 /**
  * Set when using the Responses API.
  */
-call_id: string | null, status: LocalShellStatus, action: LocalShellAction, } | { "type": "function_call", name: string, namespace?: string, arguments: string, call_id: string, } | { "type": "tool_search_call", call_id: string | null, status?: string, execution: string, arguments: unknown, } | { "type": "function_call_output", call_id: string, output: FunctionCallOutputBody, } | { "type": "custom_tool_call", status?: string, call_id: string, name: string, input: string, } | { "type": "custom_tool_call_output", call_id: string, name?: string, output: FunctionCallOutputBody, } | { "type": "tool_search_output", call_id: string | null, status: string, execution: string, tools: unknown[], } | { "type": "web_search_call", status?: string, action?: WebSearchAction, } | { "type": "image_generation_call", id: string, status: string, revised_prompt?: string, result: string, } | { "type": "compaction", encrypted_content: string, } | { "type": "context_compaction", encrypted_content?: string, } | { "type": "other" };
+call_id: string | null, status: LocalShellStatus, action: LocalShellAction, } | { "type": "function_call", name: string, namespace?: string, arguments: string, call_id: string, } | { "type": "tool_search_call", call_id: string | null, status?: string, execution: string, arguments: unknown, } | { "type": "function_call_output", call_id: string, output: FunctionCallOutputBody, } | { "type": "custom_tool_call", status?: string, call_id: string, name: string, input: string, } | { "type": "custom_tool_call_output", call_id: string, name?: string, output: FunctionCallOutputBody, } | { "type": "tool_search_output", call_id: string | null, status: string, execution: string, tools: unknown[], } | { "type": "web_search_call", status?: string, action?: WebSearchAction, } | { "type": "image_generation_call", id: string, status: string, revised_prompt?: string, result: string, } | { "type": "compaction", encrypted_content: string, } | { "type": "compaction_trigger" } | { "type": "context_compaction", encrypted_content?: string, } | { "type": "other" };
diff --git a/codex-rs/app-server-protocol/schema/typescript/index.ts b/codex-rs/app-server-protocol/schema/typescript/index.ts
index 97ea435601..8be75af546 100644
--- a/codex-rs/app-server-protocol/schema/typescript/index.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/index.ts
@@ -5,6 +5,7 @@ export type { AgentPath } from "./AgentPath";
 export type { ApplyPatchApprovalParams } from "./ApplyPatchApprovalParams";
 export type { ApplyPatchApprovalResponse } from "./ApplyPatchApprovalResponse";
 export type { AuthMode } from "./AuthMode";
+export type { AutoCompactTokenLimitScope } from "./AutoCompactTokenLimitScope";
 export type { ClientInfo } from "./ClientInfo";
 export type { ClientNotification } from "./ClientNotification";
 export type { ClientRequest } from "./ClientRequest";
diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/ActivePermissionProfile.ts b/codex-rs/app-server-protocol/schema/typescript/v2/ActivePermissionProfile.ts
index cbc8c6ef0a..73f9efcab5 100644
--- a/codex-rs/app-server-protocol/schema/typescript/v2/ActivePermissionProfile.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/ActivePermissionProfile.ts
@@ -1,7 +1,6 @@
 // GENERATED CODE! DO NOT MODIFY BY HAND!
 
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { ActivePermissionProfileModification } from "./ActivePermissionProfileModification";
 
 export type ActivePermissionProfile = {
 /**
@@ -13,9 +12,4 @@ id: string,
  * Parent profile identifier once permissions profiles support
  * inheritance. This is currently always `null`.
  */
-extends: string | null,
-/**
- * Bounded user-requested modifications applied on top of the named
- * profile, if any.
- */
-modifications: Array<ActivePermissionProfileModification>, };
+extends: string | null, };
diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/ActivePermissionProfileModification.ts b/codex-rs/app-server-protocol/schema/typescript/v2/ActivePermissionProfileModification.ts
deleted file mode 100644
index 1cbee6868a..0000000000
--- a/codex-rs/app-server-protocol/schema/typescript/v2/ActivePermissionProfileModification.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { AbsolutePathBuf } from "../AbsolutePathBuf";
-
-export type ActivePermissionProfileModification = { "type": "additionalWritableRoot", path: AbsolutePathBuf, };
diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/Config.ts b/codex-rs/app-server-protocol/schema/typescript/v2/Config.ts
index cc7e340ea3..29eae98774 100644
--- a/codex-rs/app-server-protocol/schema/typescript/v2/Config.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/Config.ts
@@ -1,6 +1,7 @@
 // GENERATED CODE! DO NOT MODIFY BY HAND!
 
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { AutoCompactTokenLimitScope } from "../AutoCompactTokenLimitScope";
 import type { ForcedLoginMethod } from "../ForcedLoginMethod";
 import type { ReasoningEffort } from "../ReasoningEffort";
 import type { ReasoningSummary } from "../ReasoningSummary";
@@ -10,13 +11,14 @@ import type { JsonValue } from "../serde_json/JsonValue";
 import type { AnalyticsConfig } from "./AnalyticsConfig";
 import type { ApprovalsReviewer } from "./ApprovalsReviewer";
 import type { AskForApproval } from "./AskForApproval";
+import type { ForcedChatgptWorkspaceIds } from "./ForcedChatgptWorkspaceIds";
 import type { ProfileV2 } from "./ProfileV2";
 import type { SandboxMode } from "./SandboxMode";
 import type { SandboxWorkspaceWrite } from "./SandboxWorkspaceWrite";
 import type { ToolsV2 } from "./ToolsV2";
 
-export type Config = {model: string | null, review_model: string | null, model_context_window: bigint | null, model_auto_compact_token_limit: bigint | null, model_provider: string | null, approval_policy: AskForApproval | null, /**
+export type Config = {model: string | null, review_model: string | null, model_context_window: bigint | null, model_auto_compact_token_limit: bigint | null, model_auto_compact_token_limit_scope: AutoCompactTokenLimitScope | null, model_provider: string | null, approval_policy: AskForApproval | null, /**
  * [UNSTABLE] Optional default for where approval requests are routed for
  * review.
  */
-approvals_reviewer: ApprovalsReviewer | null, sandbox_mode: SandboxMode | null, sandbox_workspace_write: SandboxWorkspaceWrite | null, forced_chatgpt_workspace_id: string | null, forced_login_method: ForcedLoginMethod | null, web_search: WebSearchMode | null, tools: ToolsV2 | null, profile: string | null, profiles: { [key in string]?: ProfileV2 }, instructions: string | null, developer_instructions: string | null, compact_prompt: string | null, model_reasoning_effort: ReasoningEffort | null, model_reasoning_summary: ReasoningSummary | null, model_verbosity: Verbosity | null, service_tier: string | null, analytics: AnalyticsConfig | null} & ({ [key in string]?: number | string | boolean | Array<JsonValue> | { [key in string]?: JsonValue } | null });
+approvals_reviewer: ApprovalsReviewer | null, sandbox_mode: SandboxMode | null, sandbox_workspace_write: SandboxWorkspaceWrite | null, forced_chatgpt_workspace_id: ForcedChatgptWorkspaceIds | null, forced_login_method: ForcedLoginMethod | null, web_search: WebSearchMode | null, tools: ToolsV2 | null, profile: string | null, profiles: { [key in string]?: ProfileV2 }, instructions: string | null, developer_instructions: string | null, compact_prompt: string | null, model_reasoning_effort: ReasoningEffort | null, model_reasoning_summary: ReasoningSummary | null, model_verbosity: Verbosity | null, service_tier: string | null, analytics: AnalyticsConfig | null, desktop: { [key in string]?: JsonValue } | null} & ({ [key in string]?: number | string | boolean | Array<JsonValue> | { [key in string]?: JsonValue } | null });
diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/ConfigLayerSource.ts b/codex-rs/app-server-protocol/schema/typescript/v2/ConfigLayerSource.ts
index 1fe19b6765..08cb8c6bfd 100644
--- a/codex-rs/app-server-protocol/schema/typescript/v2/ConfigLayerSource.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/ConfigLayerSource.ts
@@ -13,4 +13,9 @@ file: AbsolutePathBuf, } | { "type": "user",
  * This is the path to the user's config.toml file, though it is not
  * guaranteed to exist.
  */
-file: AbsolutePathBuf, } | { "type": "project", dotCodexFolder: AbsolutePathBuf, } | { "type": "sessionFlags" } | { "type": "legacyManagedConfigTomlFromFile", file: AbsolutePathBuf, } | { "type": "legacyManagedConfigTomlFromMdm" };
+file: AbsolutePathBuf,
+/**
+ * Name of the selected profile-v2 config layered on top of the base
+ * user config, when this layer represents one.
+ */
+profile: string | null, } | { "type": "project", dotCodexFolder: AbsolutePathBuf, } | { "type": "sessionFlags" } | { "type": "legacyManagedConfigTomlFromFile", file: AbsolutePathBuf, } | { "type": "legacyManagedConfigTomlFromMdm" };
diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/ExperimentalFeatureListParams.ts b/codex-rs/app-server-protocol/schema/typescript/v2/ExperimentalFeatureListParams.ts
index 0a1555d998..c98425b849 100644
--- a/codex-rs/app-server-protocol/schema/typescript/v2/ExperimentalFeatureListParams.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/ExperimentalFeatureListParams.ts
@@ -10,4 +10,10 @@ cursor?: string | null,
 /**
  * Optional page size; defaults to a reasonable server-side value.
  */
-limit?: number | null, };
+limit?: number | null,
+/**
+ * Optional loaded thread id. Pass this when showing feature state for an
+ * existing thread so enablement is computed from that thread's refreshed
+ * config, including project-local config for the thread's cwd.
+ */
+threadId?: string | null, };
diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/FileSystemAccessMode.ts b/codex-rs/app-server-protocol/schema/typescript/v2/FileSystemAccessMode.ts
index b1d801fe41..2dac72777e 100644
--- a/codex-rs/app-server-protocol/schema/typescript/v2/FileSystemAccessMode.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/FileSystemAccessMode.ts
@@ -2,4 +2,4 @@
 
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 
-export type FileSystemAccessMode = "read" | "write" | "none";
+export type FileSystemAccessMode = "read" | "write" | "deny";
diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/PermissionProfileNetworkPermissions.ts b/codex-rs/app-server-protocol/schema/typescript/v2/ForcedChatgptWorkspaceIds.ts
similarity index 51%
rename from codex-rs/app-server-protocol/schema/typescript/v2/PermissionProfileNetworkPermissions.ts
rename to codex-rs/app-server-protocol/schema/typescript/v2/ForcedChatgptWorkspaceIds.ts
index 0b25a769a9..d0582c8f4f 100644
--- a/codex-rs/app-server-protocol/schema/typescript/v2/PermissionProfileNetworkPermissions.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/ForcedChatgptWorkspaceIds.ts
@@ -2,4 +2,7 @@
 
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 
-export type PermissionProfileNetworkPermissions = { enabled: boolean, };
+/**
+ * Backward-compatible API shape for ChatGPT workspace login restrictions.
+ */
+export type ForcedChatgptWorkspaceIds = string | Array<string>;
diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/HookEventName.ts b/codex-rs/app-server-protocol/schema/typescript/v2/HookEventName.ts
index 91c2def709..b12f47169f 100644
--- a/codex-rs/app-server-protocol/schema/typescript/v2/HookEventName.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/HookEventName.ts
@@ -2,4 +2,4 @@
 
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 
-export type HookEventName = "preToolUse" | "permissionRequest" | "postToolUse" | "preCompact" | "postCompact" | "sessionStart" | "userPromptSubmit" | "stop";
+export type HookEventName = "preToolUse" | "permissionRequest" | "postToolUse" | "preCompact" | "postCompact" | "sessionStart" | "userPromptSubmit" | "subagentStart" | "stop";
diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/ManagedHooksRequirements.ts b/codex-rs/app-server-protocol/schema/typescript/v2/ManagedHooksRequirements.ts
index cde0e4a503..2b54af3c6d 100644
--- a/codex-rs/app-server-protocol/schema/typescript/v2/ManagedHooksRequirements.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/ManagedHooksRequirements.ts
@@ -3,4 +3,4 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { ConfiguredHookMatcherGroup } from "./ConfiguredHookMatcherGroup";
 
-export type ManagedHooksRequirements = { managedDir: string | null, windowsManagedDir: string | null, PreToolUse: Array<ConfiguredHookMatcherGroup>, PermissionRequest: Array<ConfiguredHookMatcherGroup>, PostToolUse: Array<ConfiguredHookMatcherGroup>, PreCompact: Array<ConfiguredHookMatcherGroup>, PostCompact: Array<ConfiguredHookMatcherGroup>, SessionStart: Array<ConfiguredHookMatcherGroup>, UserPromptSubmit: Array<ConfiguredHookMatcherGroup>, Stop: Array<ConfiguredHookMatcherGroup>, };
+export type ManagedHooksRequirements = { managedDir: string | null, windowsManagedDir: string | null, PreToolUse: Array<ConfiguredHookMatcherGroup>, PermissionRequest: Array<ConfiguredHookMatcherGroup>, PostToolUse: Array<ConfiguredHookMatcherGroup>, PreCompact: Array<ConfiguredHookMatcherGroup>, PostCompact: Array<ConfiguredHookMatcherGroup>, SessionStart: Array<ConfiguredHookMatcherGroup>, UserPromptSubmit: Array<ConfiguredHookMatcherGroup>, SubagentStart: Array<ConfiguredHookMatcherGroup>, Stop: Array<ConfiguredHookMatcherGroup>, };
diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/PermissionProfile.ts b/codex-rs/app-server-protocol/schema/typescript/v2/PermissionProfile.ts
deleted file mode 100644
index 7642c27650..0000000000
--- a/codex-rs/app-server-protocol/schema/typescript/v2/PermissionProfile.ts
+++ /dev/null
@@ -1,7 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { PermissionProfileFileSystemPermissions } from "./PermissionProfileFileSystemPermissions";
-import type { PermissionProfileNetworkPermissions } from "./PermissionProfileNetworkPermissions";
-
-export type PermissionProfile = { "type": "managed", network: PermissionProfileNetworkPermissions, fileSystem: PermissionProfileFileSystemPermissions, } | { "type": "disabled" } | { "type": "external", network: PermissionProfileNetworkPermissions, };
diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/PermissionProfileFileSystemPermissions.ts b/codex-rs/app-server-protocol/schema/typescript/v2/PermissionProfileFileSystemPermissions.ts
deleted file mode 100644
index 29aeceb433..0000000000
--- a/codex-rs/app-server-protocol/schema/typescript/v2/PermissionProfileFileSystemPermissions.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { FileSystemSandboxEntry } from "./FileSystemSandboxEntry";
-
-export type PermissionProfileFileSystemPermissions = { "type": "restricted", entries: Array<FileSystemSandboxEntry>, globScanMaxDepth?: number, } | { "type": "unrestricted" };
diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/PermissionProfileModificationParams.ts b/codex-rs/app-server-protocol/schema/typescript/v2/PermissionProfileModificationParams.ts
deleted file mode 100644
index c619edcea8..0000000000
--- a/codex-rs/app-server-protocol/schema/typescript/v2/PermissionProfileModificationParams.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { AbsolutePathBuf } from "../AbsolutePathBuf";
-
-export type PermissionProfileModificationParams = { "type": "additionalWritableRoot", path: AbsolutePathBuf, };
diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/PermissionProfileSelectionParams.ts b/codex-rs/app-server-protocol/schema/typescript/v2/PermissionProfileSelectionParams.ts
deleted file mode 100644
index a415bd0028..0000000000
--- a/codex-rs/app-server-protocol/schema/typescript/v2/PermissionProfileSelectionParams.ts
+++ /dev/null
@@ -1,6 +0,0 @@
-// GENERATED CODE! DO NOT MODIFY BY HAND!
-
-// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
-import type { PermissionProfileModificationParams } from "./PermissionProfileModificationParams";
-
-export type PermissionProfileSelectionParams = { "type": "profile", id: string, modifications?: Array<PermissionProfileModificationParams> | null, };
diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/PluginInstalledParams.ts b/codex-rs/app-server-protocol/schema/typescript/v2/PluginInstalledParams.ts
new file mode 100644
index 0000000000..83a564921a
--- /dev/null
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/PluginInstalledParams.ts
@@ -0,0 +1,15 @@
+// GENERATED CODE! DO NOT MODIFY BY HAND!
+
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { AbsolutePathBuf } from "../AbsolutePathBuf";
+
+export type PluginInstalledParams = {
+/**
+ * Optional working directories used to discover repo marketplaces.
+ */
+cwds?: Array<AbsolutePathBuf> | null,
+/**
+ * Additional uninstalled plugin names that should be returned when present locally.
+ * This is used by mention surfaces that intentionally expose install entrypoints.
+ */
+installSuggestionPluginNames?: Array<string> | null, };
diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/PluginInstalledResponse.ts b/codex-rs/app-server-protocol/schema/typescript/v2/PluginInstalledResponse.ts
new file mode 100644
index 0000000000..d9713351ab
--- /dev/null
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/PluginInstalledResponse.ts
@@ -0,0 +1,7 @@
+// GENERATED CODE! DO NOT MODIFY BY HAND!
+
+// This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { MarketplaceLoadErrorInfo } from "./MarketplaceLoadErrorInfo";
+import type { PluginMarketplaceEntry } from "./PluginMarketplaceEntry";
+
+export type PluginInstalledResponse = { marketplaces: Array<PluginMarketplaceEntry>, marketplaceLoadErrors: Array<MarketplaceLoadErrorInfo>, };
diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/RemoteControlStatusChangedNotification.ts b/codex-rs/app-server-protocol/schema/typescript/v2/RemoteControlStatusChangedNotification.ts
index 8c63ab9029..403b0e6457 100644
--- a/codex-rs/app-server-protocol/schema/typescript/v2/RemoteControlStatusChangedNotification.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/RemoteControlStatusChangedNotification.ts
@@ -6,4 +6,4 @@ import type { RemoteControlConnectionStatus } from "./RemoteControlConnectionSta
 /**
  * Current remote-control connection status and remote identity exposed to clients.
  */
-export type RemoteControlStatusChangedNotification = { status: RemoteControlConnectionStatus, installationId: string, environmentId: string | null, };
+export type RemoteControlStatusChangedNotification = { status: RemoteControlConnectionStatus, serverName: string, installationId: string, environmentId: string | null, };
diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/ThreadForkParams.ts b/codex-rs/app-server-protocol/schema/typescript/v2/ThreadForkParams.ts
index 6076a4bb14..c5109b2c7d 100644
--- a/codex-rs/app-server-protocol/schema/typescript/v2/ThreadForkParams.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/ThreadForkParams.ts
@@ -12,7 +12,8 @@ import type { ThreadSource } from "./ThreadSource";
  * 1. By thread_id: load the thread from disk by thread_id and fork it into a new thread.
  * 2. By path: load the thread from disk by path and fork it into a new thread.
  *
- * If using path, the thread_id param will be ignored.
+ * If using a non-empty path, the thread_id param will be ignored.
+ * Empty string path values are treated as absent.
  *
  * Prefer using thread_id whenever possible.
  */
diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/ThreadForkResponse.ts b/codex-rs/app-server-protocol/schema/typescript/v2/ThreadForkResponse.ts
index c44533ec1a..c5b1201c26 100644
--- a/codex-rs/app-server-protocol/schema/typescript/v2/ThreadForkResponse.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/ThreadForkResponse.ts
@@ -16,7 +16,6 @@ instructionSources: Array<AbsolutePathBuf>, approvalPolicy: AskForApproval, /**
  */
 approvalsReviewer: ApprovalsReviewer, /**
  * Legacy sandbox policy retained for compatibility. Experimental clients
- * should prefer `permissionProfile` when they need exact runtime
- * permissions.
+ * should prefer `activePermissionProfile` for profile provenance.
  */
 sandbox: SandboxPolicy, reasoningEffort: ReasoningEffort | null};
diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/ThreadGoalStatus.ts b/codex-rs/app-server-protocol/schema/typescript/v2/ThreadGoalStatus.ts
index 7a4bf332fb..46ec7ddd69 100644
--- a/codex-rs/app-server-protocol/schema/typescript/v2/ThreadGoalStatus.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/ThreadGoalStatus.ts
@@ -2,4 +2,4 @@
 
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 
-export type ThreadGoalStatus = "active" | "paused" | "budgetLimited" | "complete";
+export type ThreadGoalStatus = "active" | "paused" | "blocked" | "usageLimited" | "budgetLimited" | "complete";
diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/ThreadResumeParams.ts b/codex-rs/app-server-protocol/schema/typescript/v2/ThreadResumeParams.ts
index 6d1dbdca4f..0ec8953435 100644
--- a/codex-rs/app-server-protocol/schema/typescript/v2/ThreadResumeParams.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/ThreadResumeParams.ts
@@ -13,8 +13,13 @@ import type { SandboxMode } from "./SandboxMode";
  * 2. By history: instantiate the thread from memory and resume it.
  * 3. By path: load the thread from disk by path and resume it.
  *
- * The precedence is: history > path > thread_id.
- * If using history or path, the thread_id param will be ignored.
+ * For non-running threads, the precedence is: history > non-empty path > thread_id.
+ * If using history or a non-empty path for a non-running thread, the thread_id
+ * param will be ignored.
+ *
+ * If thread_id identifies a running thread, app-server rejoins that thread and
+ * treats a non-empty path as a consistency check against the active rollout path.
+ * Empty string path values are treated as absent.
  *
  * Prefer using thread_id whenever possible.
  */
diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/ThreadResumeResponse.ts b/codex-rs/app-server-protocol/schema/typescript/v2/ThreadResumeResponse.ts
index f91756c7c6..7a4f90377c 100644
--- a/codex-rs/app-server-protocol/schema/typescript/v2/ThreadResumeResponse.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/ThreadResumeResponse.ts
@@ -16,7 +16,6 @@ instructionSources: Array<AbsolutePathBuf>, approvalPolicy: AskForApproval, /**
  */
 approvalsReviewer: ApprovalsReviewer, /**
  * Legacy sandbox policy retained for compatibility. Experimental clients
- * should prefer `permissionProfile` when they need exact runtime
- * permissions.
+ * should prefer `activePermissionProfile` for profile provenance.
  */
 sandbox: SandboxPolicy, reasoningEffort: ReasoningEffort | null};
diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/ThreadStartResponse.ts b/codex-rs/app-server-protocol/schema/typescript/v2/ThreadStartResponse.ts
index 9573bd7dee..38859a3805 100644
--- a/codex-rs/app-server-protocol/schema/typescript/v2/ThreadStartResponse.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/ThreadStartResponse.ts
@@ -16,7 +16,6 @@ instructionSources: Array<AbsolutePathBuf>, approvalPolicy: AskForApproval, /**
  */
 approvalsReviewer: ApprovalsReviewer, /**
  * Legacy sandbox policy retained for compatibility. Experimental clients
- * should prefer `permissionProfile` when they need exact runtime
- * permissions.
+ * should prefer `activePermissionProfile` for profile provenance.
  */
 sandbox: SandboxPolicy, reasoningEffort: ReasoningEffort | null};
diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/ToolsV2.ts b/codex-rs/app-server-protocol/schema/typescript/v2/ToolsV2.ts
index 784991f017..13dc06e915 100644
--- a/codex-rs/app-server-protocol/schema/typescript/v2/ToolsV2.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/ToolsV2.ts
@@ -3,4 +3,4 @@
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
 import type { WebSearchToolConfig } from "../WebSearchToolConfig";
 
-export type ToolsV2 = { web_search: WebSearchToolConfig | null, view_image: boolean | null, };
+export type ToolsV2 = { web_search: WebSearchToolConfig | null, };
diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/UserInput.ts b/codex-rs/app-server-protocol/schema/typescript/v2/UserInput.ts
index 38abc2338b..2ac37c5228 100644
--- a/codex-rs/app-server-protocol/schema/typescript/v2/UserInput.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/UserInput.ts
@@ -1,10 +1,11 @@
 // GENERATED CODE! DO NOT MODIFY BY HAND!
 
 // This file was generated by [ts-rs](https://github.com/Aleph-Alpha/ts-rs). Do not edit this file manually.
+import type { ImageDetail } from "../ImageDetail";
 import type { TextElement } from "./TextElement";
 
 export type UserInput = { "type": "text", text: string,
 /**
  * UI-defined spans within `text` used to render or persist special elements.
  */
-text_elements: Array<TextElement>, } | { "type": "image", url: string, } | { "type": "localImage", path: string, } | { "type": "skill", name: string, path: string, } | { "type": "mention", name: string, path: string, };
+text_elements: Array<TextElement>, } | { "type": "image", detail?: ImageDetail, url: string, } | { "type": "localImage", detail?: ImageDetail, path: string, } | { "type": "skill", name: string, path: string, } | { "type": "mention", name: string, path: string, };
diff --git a/codex-rs/app-server-protocol/schema/typescript/v2/index.ts b/codex-rs/app-server-protocol/schema/typescript/v2/index.ts
index 53f426af07..855f9731d8 100644
--- a/codex-rs/app-server-protocol/schema/typescript/v2/index.ts
+++ b/codex-rs/app-server-protocol/schema/typescript/v2/index.ts
@@ -5,7 +5,6 @@ export type { AccountLoginCompletedNotification } from "./AccountLoginCompletedN
 export type { AccountRateLimitsUpdatedNotification } from "./AccountRateLimitsUpdatedNotification";
 export type { AccountUpdatedNotification } from "./AccountUpdatedNotification";
 export type { ActivePermissionProfile } from "./ActivePermissionProfile";
-export type { ActivePermissionProfileModification } from "./ActivePermissionProfileModification";
 export type { AddCreditsNudgeCreditType } from "./AddCreditsNudgeCreditType";
 export type { AddCreditsNudgeEmailStatus } from "./AddCreditsNudgeEmailStatus";
 export type { AdditionalFileSystemPermissions } from "./AdditionalFileSystemPermissions";
@@ -113,6 +112,7 @@ export type { FileSystemPath } from "./FileSystemPath";
 export type { FileSystemSandboxEntry } from "./FileSystemSandboxEntry";
 export type { FileSystemSpecialPath } from "./FileSystemSpecialPath";
 export type { FileUpdateChange } from "./FileUpdateChange";
+export type { ForcedChatgptWorkspaceIds } from "./ForcedChatgptWorkspaceIds";
 export type { FsChangedNotification } from "./FsChangedNotification";
 export type { FsCopyParams } from "./FsCopyParams";
 export type { FsCopyResponse } from "./FsCopyResponse";
@@ -256,11 +256,6 @@ export type { OverriddenMetadata } from "./OverriddenMetadata";
 export type { PatchApplyStatus } from "./PatchApplyStatus";
 export type { PatchChangeKind } from "./PatchChangeKind";
 export type { PermissionGrantScope } from "./PermissionGrantScope";
-export type { PermissionProfile } from "./PermissionProfile";
-export type { PermissionProfileFileSystemPermissions } from "./PermissionProfileFileSystemPermissions";
-export type { PermissionProfileModificationParams } from "./PermissionProfileModificationParams";
-export type { PermissionProfileNetworkPermissions } from "./PermissionProfileNetworkPermissions";
-export type { PermissionProfileSelectionParams } from "./PermissionProfileSelectionParams";
 export type { PermissionsRequestApprovalParams } from "./PermissionsRequestApprovalParams";
 export type { PermissionsRequestApprovalResponse } from "./PermissionsRequestApprovalResponse";
 export type { PlanDeltaNotification } from "./PlanDeltaNotification";
@@ -271,6 +266,8 @@ export type { PluginHookSummary } from "./PluginHookSummary";
 export type { PluginInstallParams } from "./PluginInstallParams";
 export type { PluginInstallPolicy } from "./PluginInstallPolicy";
 export type { PluginInstallResponse } from "./PluginInstallResponse";
+export type { PluginInstalledParams } from "./PluginInstalledParams";
+export type { PluginInstalledResponse } from "./PluginInstalledResponse";
 export type { PluginInterface } from "./PluginInterface";
 export type { PluginListMarketplaceKind } from "./PluginListMarketplaceKind";
 export type { PluginListParams } from "./PluginListParams";
diff --git a/codex-rs/app-server-protocol/src/export.rs b/codex-rs/app-server-protocol/src/export.rs
index 0f9b33671b..fcaa8a1eb5 100644
--- a/codex-rs/app-server-protocol/src/export.rs
+++ b/codex-rs/app-server-protocol/src/export.rs
@@ -2747,7 +2747,6 @@ export type Config = { stableField: Keep, unstableField: string | null } & ({ [k
         let _guard = TempDirGuard(output_dir.clone());
         let path = output_dir.join("CommandExecParams.ts");
         let content = r#"import type { CommandExecTerminalSize } from "./CommandExecTerminalSize";
-import type { PermissionProfile } from "./PermissionProfile";
 import type { SandboxPolicy } from "./SandboxPolicy";
 
 export type CommandExecParams = {/**
@@ -2770,12 +2769,12 @@ size?: CommandExecTerminalSize | null, /**
  */
 sandboxPolicy?: SandboxPolicy | null,
 /**
- * Optional full permissions profile for this command.
+ * Optional active permissions profile id for this command.
  *
  * Defaults to the user's configured permissions when omitted. Cannot be
  * combined with `sandboxPolicy`.
  */
-permissionProfile?: PermissionProfile | null};
+permissionProfile?: string | null};
 "#;
         fs::write(&path, content)?;
 
@@ -2788,14 +2787,7 @@ permissionProfile?: PermissionProfile | null};
         filter_experimental_type_fields_ts(&output_dir, &[&CUSTOM_FIELD])?;
 
         let filtered = fs::read_to_string(&path)?;
-        assert_eq!(
-            filtered.contains("permissionProfile?: PermissionProfile"),
-            false
-        );
-        assert_eq!(
-            filtered.contains(r#"import type { PermissionProfile } from "./PermissionProfile";"#),
-            false
-        );
+        assert_eq!(filtered.contains("permissionProfile?: string"), false);
         assert_eq!(filtered.contains("sandboxPolicy?: SandboxPolicy"), true);
         assert_eq!(
             filtered.contains(r#"import type { SandboxPolicy } from "./SandboxPolicy";"#),
diff --git a/codex-rs/app-server-protocol/src/protocol/common.rs b/codex-rs/app-server-protocol/src/protocol/common.rs
index b70af1a22b..7a7fe5642c 100644
--- a/codex-rs/app-server-protocol/src/protocol/common.rs
+++ b/codex-rs/app-server-protocol/src/protocol/common.rs
@@ -223,6 +223,7 @@ macro_rules! client_request_definitions {
 
         /// Typed response from the server to the client.
         #[derive(Serialize, Deserialize, Debug, Clone)]
+        #[allow(clippy::large_enum_variant)]
         #[serde(tag = "method", rename_all = "camelCase")]
         pub enum ClientResponse {
             $(
@@ -621,12 +622,17 @@ client_request_definitions! {
     },
     PluginList => "plugin/list" {
         params: v2::PluginListParams,
-        serialization: global_shared_read("plugin-read"),
+        serialization: None,
         response: v2::PluginListResponse,
     },
+    PluginInstalled => "plugin/installed" {
+        params: v2::PluginInstalledParams,
+        serialization: None,
+        response: v2::PluginInstalledResponse,
+    },
     PluginRead => "plugin/read" {
         params: v2::PluginReadParams,
-        serialization: global_shared_read("plugin-read"),
+        serialization: None,
         response: v2::PluginReadResponse,
     },
     PluginSkillRead => "plugin/skill/read" {
@@ -799,6 +805,24 @@ client_request_definitions! {
         serialization: global("config"),
         response: v2::ExperimentalFeatureEnablementSetResponse,
     },
+    #[experimental("remoteControl/enable")]
+    RemoteControlEnable => "remoteControl/enable" {
+        params: #[ts(type = "undefined")] #[serde(skip_serializing_if = "Option::is_none")] Option<()>,
+        serialization: global("remote-control"),
+        response: v2::RemoteControlEnableResponse,
+    },
+    #[experimental("remoteControl/disable")]
+    RemoteControlDisable => "remoteControl/disable" {
+        params: #[ts(type = "undefined")] #[serde(skip_serializing_if = "Option::is_none")] Option<()>,
+        serialization: global("remote-control"),
+        response: v2::RemoteControlDisableResponse,
+    },
+    #[experimental("remoteControl/status/read")]
+    RemoteControlStatusRead => "remoteControl/status/read" {
+        params: #[ts(type = "undefined")] #[serde(skip_serializing_if = "Option::is_none")] Option<()>,
+        serialization: global_shared_read("remote-control"),
+        response: v2::RemoteControlStatusReadResponse,
+    },
     #[experimental("collaborationMode/list")]
     /// Lists collaboration mode presets.
     CollaborationModeList => "collaborationMode/list" {
@@ -1531,6 +1555,7 @@ mod tests {
     use anyhow::Result;
     use codex_protocol::ThreadId;
     use codex_protocol::account::PlanType;
+    use codex_protocol::models::BUILT_IN_PERMISSION_PROFILE_READ_ONLY;
     use codex_protocol::parse_command::ParsedCommand;
     use codex_protocol::protocol::RealtimeConversationVersion;
     use codex_protocol::protocol::RealtimeOutputModality;
@@ -1688,12 +1713,7 @@ mod tests {
                 marketplace_kinds: None,
             },
         };
-        assert_eq!(
-            plugin_list.serialization_scope(),
-            Some(ClientRequestSerializationScope::GlobalSharedRead(
-                "plugin-read"
-            ))
-        );
+        assert_eq!(plugin_list.serialization_scope(), None);
 
         let plugin_read = ClientRequest::PluginRead {
             request_id: request_id(),
@@ -1703,12 +1723,16 @@ mod tests {
                 plugin_name: "plugin-a".to_string(),
             },
         };
-        assert_eq!(
-            plugin_read.serialization_scope(),
-            Some(ClientRequestSerializationScope::GlobalSharedRead(
-                "plugin-read"
-            ))
-        );
+        assert_eq!(plugin_read.serialization_scope(), None);
+
+        let plugin_installed = ClientRequest::PluginInstalled {
+            request_id: request_id(),
+            params: v2::PluginInstalledParams {
+                cwds: None,
+                install_suggestion_plugin_names: None,
+            },
+        };
+        assert_eq!(plugin_installed.serialization_scope(), None);
 
         let plugin_uninstall = ClientRequest::PluginUninstall {
             request_id: request_id(),
@@ -2294,11 +2318,11 @@ mod tests {
                 model_provider: "openai".to_string(),
                 service_tier: None,
                 cwd,
+                runtime_workspace_roots: Vec::new(),
                 instruction_sources: vec![absolute_path("/tmp/AGENTS.md")],
                 approval_policy: v2::AskForApproval::OnFailure,
                 approvals_reviewer: v2::ApprovalsReviewer::User,
                 sandbox: v2::SandboxPolicy::DangerFullAccess,
-                permission_profile: None,
                 active_permission_profile: None,
                 reasoning_effort: None,
             },
@@ -2338,13 +2362,13 @@ mod tests {
                     "modelProvider": "openai",
                     "serviceTier": null,
                     "cwd": absolute_path_string("tmp"),
+                    "runtimeWorkspaceRoots": [],
                     "instructionSources": [absolute_path_string("tmp/AGENTS.md")],
                     "approvalPolicy": "on-failure",
                     "approvalsReviewer": "user",
                     "sandbox": {
                         "type": "dangerFullAccess"
                     },
-                    "permissionProfile": null,
                     "activePermissionProfile": null,
                     "reasoningEffort": null
                 }
@@ -2698,7 +2722,33 @@ mod tests {
                 "id": 8,
                 "params": {
                     "cursor": null,
-                    "limit": null
+                    "limit": null,
+                    "threadId": null
+                }
+            }),
+            serde_json::to_value(&request)?,
+        );
+        Ok(())
+    }
+
+    #[test]
+    fn serialize_list_experimental_features_with_thread_id() -> Result<()> {
+        let request = ClientRequest::ExperimentalFeatureList {
+            request_id: RequestId::Integer(8),
+            params: v2::ExperimentalFeatureListParams {
+                cursor: Some("3".to_string()),
+                limit: Some(2),
+                thread_id: Some("00000000-0000-4000-8000-000000000001".to_string()),
+            },
+        };
+        assert_eq!(
+            json!({
+                "method": "experimentalFeature/list",
+                "id": 8,
+                "params": {
+                    "cursor": "3",
+                    "limit": 2,
+                    "threadId": "00000000-0000-4000-8000-000000000001"
                 }
             }),
             serde_json::to_value(&request)?,
@@ -2945,7 +2995,7 @@ mod tests {
                 env: None,
                 size: None,
                 sandbox_policy: None,
-                permission_profile: Some(v2::PermissionProfile::Disabled),
+                permission_profile: Some(BUILT_IN_PERMISSION_PROFILE_READ_ONLY.to_string()),
             },
         };
 
diff --git a/codex-rs/app-server-protocol/src/protocol/serde_helpers.rs b/codex-rs/app-server-protocol/src/protocol/serde_helpers.rs
index 0e35ebdba7..6d6747a5cc 100644
--- a/codex-rs/app-server-protocol/src/protocol/serde_helpers.rs
+++ b/codex-rs/app-server-protocol/src/protocol/serde_helpers.rs
@@ -1,8 +1,18 @@
+use std::path::PathBuf;
+
 use serde::Deserialize;
 use serde::Deserializer;
 use serde::Serialize;
 use serde::Serializer;
 
+pub fn deserialize_empty_path_as_none<'de, D>(deserializer: D) -> Result<Option<PathBuf>, D::Error>
+where
+    D: Deserializer<'de>,
+{
+    let path = Option::<PathBuf>::deserialize(deserializer)?;
+    Ok(path.filter(|path| !path.as_os_str().is_empty()))
+}
+
 pub fn deserialize_double_option<'de, T, D>(deserializer: D) -> Result<Option<Option<T>>, D::Error>
 where
     T: Deserialize<'de>,
diff --git a/codex-rs/app-server-protocol/src/protocol/thread_history.rs b/codex-rs/app-server-protocol/src/protocol/thread_history.rs
index 1121d3a35b..3918e4a9bd 100644
--- a/codex-rs/app-server-protocol/src/protocol/thread_history.rs
+++ b/codex-rs/app-server-protocol/src/protocol/thread_history.rs
@@ -1077,12 +1077,18 @@ impl ThreadHistoryBuilder {
             });
         }
         if let Some(images) = &payload.images {
-            for image in images {
-                content.push(UserInput::Image { url: image.clone() });
+            for (idx, image) in images.iter().enumerate() {
+                content.push(UserInput::Image {
+                    url: image.clone(),
+                    detail: payload.image_details.get(idx).copied().flatten(),
+                });
             }
         }
-        for path in &payload.local_images {
-            content.push(UserInput::LocalImage { path: path.clone() });
+        for (idx, path) in payload.local_images.iter().enumerate() {
+            content.push(UserInput::LocalImage {
+                path: path.clone(),
+                detail: payload.local_image_details.get(idx).copied().flatten(),
+            });
         }
         content
     }
@@ -1203,6 +1209,7 @@ mod tests {
     use codex_protocol::items::UserMessageItem as CoreUserMessageItem;
     use codex_protocol::items::build_hook_prompt_message;
     use codex_protocol::mcp::CallToolResult;
+    use codex_protocol::models::ImageDetail;
     use codex_protocol::models::MessagePhase as CoreMessagePhase;
     use codex_protocol::models::WebSearchAction as CoreWebSearchAction;
     use codex_protocol::parse_command::ParsedCommand;
@@ -1241,6 +1248,7 @@ mod tests {
                 images: Some(vec!["https://example.com/one.png".into()]),
                 text_elements: Vec::new(),
                 local_images: Vec::new(),
+                ..Default::default()
             }),
             EventMsg::AgentMessage(AgentMessageEvent {
                 message: "Hi there".into(),
@@ -1258,6 +1266,7 @@ mod tests {
                 images: None,
                 text_elements: Vec::new(),
                 local_images: Vec::new(),
+                ..Default::default()
             }),
             EventMsg::AgentMessage(AgentMessageEvent {
                 message: "Reply two".into(),
@@ -1288,6 +1297,7 @@ mod tests {
                     },
                     UserInput::Image {
                         url: "https://example.com/one.png".into(),
+                        detail: None,
                     }
                 ],
             }
@@ -1335,6 +1345,45 @@ mod tests {
         );
     }
 
+    #[test]
+    fn rebuilds_user_message_image_details_from_legacy_events() {
+        let local_path = PathBuf::from("/tmp/local.png");
+        let events = vec![RolloutItem::EventMsg(EventMsg::UserMessage(
+            UserMessageEvent {
+                message: "inspect these".into(),
+                images: Some(vec!["https://example.com/image.png".into()]),
+                image_details: vec![Some(ImageDetail::Original)],
+                local_images: vec![local_path.clone()],
+                local_image_details: vec![Some(ImageDetail::Original)],
+                text_elements: Vec::new(),
+            },
+        ))];
+
+        let turns = build_turns_from_rollout_items(&events);
+
+        assert_eq!(turns.len(), 1);
+        assert_eq!(
+            turns[0].items[0],
+            ThreadItem::UserMessage {
+                id: "item-1".into(),
+                content: vec![
+                    UserInput::Text {
+                        text: "inspect these".into(),
+                        text_elements: Vec::new(),
+                    },
+                    UserInput::Image {
+                        url: "https://example.com/image.png".into(),
+                        detail: Some(ImageDetail::Original),
+                    },
+                    UserInput::LocalImage {
+                        path: local_path,
+                        detail: Some(ImageDetail::Original),
+                    },
+                ],
+            }
+        );
+    }
+
     #[test]
     fn ignores_non_plan_item_lifecycle_events() {
         let turn_id = "turn-1";
@@ -1351,6 +1400,7 @@ mod tests {
                 images: None,
                 text_elements: Vec::new(),
                 local_images: Vec::new(),
+                ..Default::default()
             }),
             EventMsg::ItemStarted(ItemStartedEvent {
                 thread_id,
@@ -1428,6 +1478,7 @@ mod tests {
                 images: None,
                 text_elements: Vec::new(),
                 local_images: Vec::new(),
+                ..Default::default()
             })),
             RolloutItem::EventMsg(EventMsg::ImageGenerationEnd(ImageGenerationEndEvent {
                 call_id: "ig_123".into(),
@@ -1485,6 +1536,7 @@ mod tests {
                 images: None,
                 text_elements: Vec::new(),
                 local_images: Vec::new(),
+                ..Default::default()
             }),
             EventMsg::AgentReasoning(AgentReasoningEvent {
                 text: "first summary".into(),
@@ -1537,6 +1589,7 @@ mod tests {
                 images: None,
                 text_elements: Vec::new(),
                 local_images: Vec::new(),
+                ..Default::default()
             }),
             EventMsg::AgentMessage(AgentMessageEvent {
                 message: "Working...".into(),
@@ -1554,6 +1607,7 @@ mod tests {
                 images: None,
                 text_elements: Vec::new(),
                 local_images: Vec::new(),
+                ..Default::default()
             }),
             EventMsg::AgentMessage(AgentMessageEvent {
                 message: "Second attempt complete.".into(),
@@ -1624,6 +1678,7 @@ mod tests {
                 images: None,
                 text_elements: Vec::new(),
                 local_images: Vec::new(),
+                ..Default::default()
             }),
             EventMsg::AgentMessage(AgentMessageEvent {
                 message: "A1".into(),
@@ -1635,6 +1690,7 @@ mod tests {
                 images: None,
                 text_elements: Vec::new(),
                 local_images: Vec::new(),
+                ..Default::default()
             }),
             EventMsg::AgentMessage(AgentMessageEvent {
                 message: "A2".into(),
@@ -1647,6 +1703,7 @@ mod tests {
                 images: None,
                 text_elements: Vec::new(),
                 local_images: Vec::new(),
+                ..Default::default()
             }),
             EventMsg::AgentMessage(AgentMessageEvent {
                 message: "A3".into(),
@@ -1712,6 +1769,7 @@ mod tests {
                 images: None,
                 text_elements: Vec::new(),
                 local_images: Vec::new(),
+                ..Default::default()
             }),
             EventMsg::AgentMessage(AgentMessageEvent {
                 message: "A1".into(),
@@ -1723,6 +1781,7 @@ mod tests {
                 images: None,
                 text_elements: Vec::new(),
                 local_images: Vec::new(),
+                ..Default::default()
             }),
             EventMsg::AgentMessage(AgentMessageEvent {
                 message: "A2".into(),
@@ -1754,12 +1813,14 @@ mod tests {
                 images: None,
                 text_elements: Vec::new(),
                 local_images: Vec::new(),
+                ..Default::default()
             }),
             EventMsg::UserMessage(UserMessageEvent {
                 message: "Steer".into(),
                 images: None,
                 text_elements: Vec::new(),
                 local_images: Vec::new(),
+                ..Default::default()
             }),
             EventMsg::TurnComplete(TurnCompleteEvent {
                 turn_id: "turn-a".into(),
@@ -1812,6 +1873,7 @@ mod tests {
                 images: None,
                 text_elements: Vec::new(),
                 local_images: Vec::new(),
+                ..Default::default()
             }),
             EventMsg::WebSearchEnd(WebSearchEndEvent {
                 call_id: "search-1".into(),
@@ -1984,6 +2046,7 @@ mod tests {
                 images: None,
                 text_elements: Vec::new(),
                 local_images: Vec::new(),
+                ..Default::default()
             }),
             EventMsg::DynamicToolCallRequest(
                 codex_protocol::dynamic_tools::DynamicToolCallRequest {
@@ -2049,6 +2112,7 @@ mod tests {
                 images: None,
                 text_elements: Vec::new(),
                 local_images: Vec::new(),
+                ..Default::default()
             }),
             EventMsg::ExecCommandEnd(ExecCommandEndEvent {
                 call_id: "exec-declined".into(),
@@ -2138,6 +2202,7 @@ mod tests {
                 images: None,
                 text_elements: Vec::new(),
                 local_images: Vec::new(),
+                ..Default::default()
             }),
             EventMsg::GuardianAssessment(GuardianAssessmentEvent {
                 id: "review-guardian-exec".into(),
@@ -2221,6 +2286,7 @@ mod tests {
                 images: None,
                 text_elements: Vec::new(),
                 local_images: Vec::new(),
+                ..Default::default()
             }),
             EventMsg::GuardianAssessment(GuardianAssessmentEvent {
                 id: "review-guardian-execve".into(),
@@ -2284,6 +2350,7 @@ mod tests {
                 images: None,
                 text_elements: Vec::new(),
                 local_images: Vec::new(),
+                ..Default::default()
             }),
             EventMsg::TurnComplete(TurnCompleteEvent {
                 turn_id: "turn-a".into(),
@@ -2303,6 +2370,7 @@ mod tests {
                 images: None,
                 text_elements: Vec::new(),
                 local_images: Vec::new(),
+                ..Default::default()
             }),
             EventMsg::ExecCommandEnd(ExecCommandEndEvent {
                 call_id: "exec-late".into(),
@@ -2376,6 +2444,7 @@ mod tests {
                 images: None,
                 text_elements: Vec::new(),
                 local_images: Vec::new(),
+                ..Default::default()
             }),
             EventMsg::TurnComplete(TurnCompleteEvent {
                 turn_id: "turn-a".into(),
@@ -2395,6 +2464,7 @@ mod tests {
                 images: None,
                 text_elements: Vec::new(),
                 local_images: Vec::new(),
+                ..Default::default()
             }),
             EventMsg::ExecCommandEnd(ExecCommandEndEvent {
                 call_id: "exec-unknown-turn".into(),
@@ -2463,6 +2533,7 @@ mod tests {
                 images: None,
                 text_elements: Vec::new(),
                 local_images: Vec::new(),
+                ..Default::default()
             }),
             EventMsg::PatchApplyBegin(PatchApplyBeginEvent {
                 call_id: "patch-call".into(),
@@ -2527,6 +2598,7 @@ mod tests {
                 images: None,
                 text_elements: Vec::new(),
                 local_images: Vec::new(),
+                ..Default::default()
             }),
             EventMsg::ApplyPatchApprovalRequest(ApplyPatchApprovalRequestEvent {
                 call_id: "patch-call".into(),
@@ -2591,6 +2663,7 @@ mod tests {
                 images: None,
                 text_elements: Vec::new(),
                 local_images: Vec::new(),
+                ..Default::default()
             }),
             EventMsg::TurnComplete(TurnCompleteEvent {
                 turn_id: "turn-a".into(),
@@ -2610,6 +2683,7 @@ mod tests {
                 images: None,
                 text_elements: Vec::new(),
                 local_images: Vec::new(),
+                ..Default::default()
             }),
             EventMsg::TurnComplete(TurnCompleteEvent {
                 turn_id: "turn-a".into(),
@@ -2657,6 +2731,7 @@ mod tests {
                 images: None,
                 text_elements: Vec::new(),
                 local_images: Vec::new(),
+                ..Default::default()
             }),
             EventMsg::TurnComplete(TurnCompleteEvent {
                 turn_id: "turn-a".into(),
@@ -2676,6 +2751,7 @@ mod tests {
                 images: None,
                 text_elements: Vec::new(),
                 local_images: Vec::new(),
+                ..Default::default()
             }),
             EventMsg::TurnAborted(TurnAbortedEvent {
                 turn_id: Some("turn-a".into()),
@@ -2748,6 +2824,7 @@ mod tests {
                 images: None,
                 text_elements: Vec::new(),
                 local_images: Vec::new(),
+                ..Default::default()
             }),
             EventMsg::CollabResumeEnd(codex_protocol::protocol::CollabResumeEndEvent {
                 call_id: "resume-1".into(),
@@ -2805,6 +2882,7 @@ mod tests {
                 images: None,
                 text_elements: Vec::new(),
                 local_images: Vec::new(),
+                ..Default::default()
             }),
             EventMsg::CollabAgentSpawnEnd(codex_protocol::protocol::CollabAgentSpawnEndEvent {
                 call_id: "spawn-1".into(),
@@ -2866,6 +2944,7 @@ mod tests {
                 images: None,
                 text_elements: Vec::new(),
                 local_images: Vec::new(),
+                ..Default::default()
             }),
             EventMsg::CollabAgentInteractionBegin(
                 codex_protocol::protocol::CollabAgentInteractionBeginEvent {
@@ -2929,6 +3008,7 @@ mod tests {
                 images: None,
                 text_elements: Vec::new(),
                 local_images: Vec::new(),
+                ..Default::default()
             }),
             EventMsg::AgentMessage(AgentMessageEvent {
                 message: "done".into(),
@@ -2965,6 +3045,7 @@ mod tests {
                 images: None,
                 text_elements: Vec::new(),
                 local_images: Vec::new(),
+                ..Default::default()
             }),
             EventMsg::TurnComplete(TurnCompleteEvent {
                 turn_id: "turn-a".into(),
@@ -3020,6 +3101,7 @@ mod tests {
                 images: None,
                 text_elements: Vec::new(),
                 local_images: Vec::new(),
+                ..Default::default()
             }),
             EventMsg::Error(ErrorEvent {
                 message: "stream failure".into(),
@@ -3077,6 +3159,7 @@ mod tests {
                 images: None,
                 text_elements: Vec::new(),
                 local_images: Vec::new(),
+                ..Default::default()
             })),
             RolloutItem::ResponseItem(hook_prompt),
             RolloutItem::EventMsg(EventMsg::TurnComplete(TurnCompleteEvent {
diff --git a/codex-rs/app-server-protocol/src/protocol/v1.rs b/codex-rs/app-server-protocol/src/protocol/v1.rs
index 95ab710a6b..3c45c20b8f 100644
--- a/codex-rs/app-server-protocol/src/protocol/v1.rs
+++ b/codex-rs/app-server-protocol/src/protocol/v1.rs
@@ -22,6 +22,7 @@ use serde::Serialize;
 use ts_rs::TS;
 
 use crate::protocol::common::AuthMode;
+use crate::protocol::v2::ForcedChatgptWorkspaceIds;
 
 #[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Default, JsonSchema, TS)]
 #[serde(rename_all = "camelCase")]
@@ -201,7 +202,7 @@ pub struct UserSavedConfig {
     pub approval_policy: Option<AskForApproval>,
     pub sandbox_mode: Option<SandboxMode>,
     pub sandbox_settings: Option<SandboxSettings>,
-    pub forced_chatgpt_workspace_id: Option<String>,
+    pub forced_chatgpt_workspace_id: Option<ForcedChatgptWorkspaceIds>,
     pub forced_login_method: Option<ForcedLoginMethod>,
     pub model: Option<String>,
     pub model_reasoning_effort: Option<ReasoningEffort>,
@@ -228,7 +229,6 @@ pub struct Profile {
 #[serde(rename_all = "camelCase")]
 pub struct Tools {
     pub web_search: Option<bool>,
-    pub view_image: Option<bool>,
 }
 
 #[derive(Deserialize, Debug, Clone, PartialEq, Serialize, JsonSchema, TS)]
diff --git a/codex-rs/app-server-protocol/src/protocol/v2/command_exec.rs b/codex-rs/app-server-protocol/src/protocol/v2/command_exec.rs
index ff0cecf4f9..8f913b5bcf 100644
--- a/codex-rs/app-server-protocol/src/protocol/v2/command_exec.rs
+++ b/codex-rs/app-server-protocol/src/protocol/v2/command_exec.rs
@@ -1,4 +1,3 @@
-use super::PermissionProfile;
 use super::SandboxPolicy;
 use codex_experimental_api_macros::ExperimentalApi;
 use schemars::JsonSchema;
@@ -100,13 +99,13 @@ pub struct CommandExecParams {
     /// combined with `permissionProfile`.
     #[ts(optional = nullable)]
     pub sandbox_policy: Option<SandboxPolicy>,
-    /// Optional full permissions profile for this command.
+    /// Optional active permissions profile id for this command.
     ///
     /// Defaults to the user's configured permissions when omitted. Cannot be
     /// combined with `sandboxPolicy`.
     #[experimental("command/exec.permissionProfile")]
     #[ts(optional = nullable)]
-    pub permission_profile: Option<PermissionProfile>,
+    pub permission_profile: Option<String>,
 }
 
 /// Final buffered result for `command/exec`.
diff --git a/codex-rs/app-server-protocol/src/protocol/v2/config.rs b/codex-rs/app-server-protocol/src/protocol/v2/config.rs
index 2c0e2df8e5..0b7741c656 100644
--- a/codex-rs/app-server-protocol/src/protocol/v2/config.rs
+++ b/codex-rs/app-server-protocol/src/protocol/v2/config.rs
@@ -3,6 +3,7 @@ use super::AskForApproval;
 use super::SandboxMode;
 use super::shared::default_enabled;
 use codex_experimental_api_macros::ExperimentalApi;
+use codex_protocol::config_types::AutoCompactTokenLimitScope;
 use codex_protocol::config_types::ForcedLoginMethod;
 use codex_protocol::config_types::ReasoningSummary;
 use codex_protocol::config_types::Verbosity;
@@ -51,6 +52,10 @@ pub enum ConfigLayerSource {
         /// This is the path to the user's config.toml file, though it is not
         /// guaranteed to exist.
         file: AbsolutePathBuf,
+
+        /// Name of the selected profile-v2 config layered on top of the base
+        /// user config, when this layer represents one.
+        profile: Option<String>,
     },
 
     /// Path to a .codex/ folder within a project. There could be multiple of
@@ -84,7 +89,13 @@ impl ConfigLayerSource {
         match self {
             ConfigLayerSource::Mdm { .. } => 0,
             ConfigLayerSource::System { .. } => 10,
-            ConfigLayerSource::User { .. } => 20,
+            ConfigLayerSource::User { profile, .. } => {
+                if profile.is_some() {
+                    21
+                } else {
+                    20
+                }
+            }
             ConfigLayerSource::Project { .. } => 25,
             ConfigLayerSource::SessionFlags => 30,
             ConfigLayerSource::LegacyManagedConfigTomlFromFile { .. } => 40,
@@ -120,7 +131,6 @@ pub struct SandboxWorkspaceWrite {
 #[ts(export_to = "v2/")]
 pub struct ToolsV2 {
     pub web_search: Option<WebSearchToolConfig>,
-    pub view_image: Option<bool>,
 }
 
 #[derive(Serialize, Deserialize, Debug, Clone, PartialEq, JsonSchema, TS, ExperimentalApi)]
@@ -216,6 +226,24 @@ pub struct AppsConfig {
     pub apps: HashMap<String, AppConfig>,
 }
 
+/// Backward-compatible API shape for ChatGPT workspace login restrictions.
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)]
+#[serde(untagged)]
+#[ts(export_to = "v2/")]
+pub enum ForcedChatgptWorkspaceIds {
+    Single(String),
+    Multiple(Vec<String>),
+}
+
+impl ForcedChatgptWorkspaceIds {
+    pub fn into_vec(self) -> Vec<String> {
+        match self {
+            Self::Single(value) => vec![value],
+            Self::Multiple(values) => values,
+        }
+    }
+}
+
 #[derive(Serialize, Deserialize, Debug, Clone, PartialEq, JsonSchema, TS, ExperimentalApi)]
 #[serde(rename_all = "snake_case")]
 #[ts(export_to = "v2/")]
@@ -224,6 +252,7 @@ pub struct Config {
     pub review_model: Option<String>,
     pub model_context_window: Option<i64>,
     pub model_auto_compact_token_limit: Option<i64>,
+    pub model_auto_compact_token_limit_scope: Option<AutoCompactTokenLimitScope>,
     pub model_provider: Option<String>,
     #[experimental(nested)]
     pub approval_policy: Option<AskForApproval>,
@@ -233,7 +262,7 @@ pub struct Config {
     pub approvals_reviewer: Option<ApprovalsReviewer>,
     pub sandbox_mode: Option<SandboxMode>,
     pub sandbox_workspace_write: Option<SandboxWorkspaceWrite>,
-    pub forced_chatgpt_workspace_id: Option<String>,
+    pub forced_chatgpt_workspace_id: Option<ForcedChatgptWorkspaceIds>,
     pub forced_login_method: Option<ForcedLoginMethod>,
     pub web_search: Option<WebSearchMode>,
     pub tools: Option<ToolsV2>,
@@ -252,6 +281,7 @@ pub struct Config {
     #[experimental("config/read.apps")]
     #[serde(default)]
     pub apps: Option<AppsConfig>,
+    pub desktop: Option<HashMap<String, JsonValue>>,
     #[serde(default, flatten)]
     pub additional: HashMap<String, JsonValue>,
 }
@@ -393,6 +423,9 @@ pub struct ManagedHooksRequirements {
     #[serde(rename = "UserPromptSubmit")]
     #[ts(rename = "UserPromptSubmit")]
     pub user_prompt_submit: Vec<ConfiguredHookMatcherGroup>,
+    #[serde(rename = "SubagentStart")]
+    #[ts(rename = "SubagentStart")]
+    pub subagent_start: Vec<ConfiguredHookMatcherGroup>,
     #[serde(rename = "Stop")]
     #[ts(rename = "Stop")]
     pub stop: Vec<ConfiguredHookMatcherGroup>,
diff --git a/codex-rs/app-server-protocol/src/protocol/v2/experimental_feature.rs b/codex-rs/app-server-protocol/src/protocol/v2/experimental_feature.rs
index 6adc21b6ef..a16f45216b 100644
--- a/codex-rs/app-server-protocol/src/protocol/v2/experimental_feature.rs
+++ b/codex-rs/app-server-protocol/src/protocol/v2/experimental_feature.rs
@@ -14,6 +14,11 @@ pub struct ExperimentalFeatureListParams {
     /// Optional page size; defaults to a reasonable server-side value.
     #[ts(optional = nullable)]
     pub limit: Option<u32>,
+    /// Optional loaded thread id. Pass this when showing feature state for an
+    /// existing thread so enablement is computed from that thread's refreshed
+    /// config, including project-local config for the thread's cwd.
+    #[ts(optional = nullable)]
+    pub thread_id: Option<String>,
 }
 
 #[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)]
diff --git a/codex-rs/app-server-protocol/src/protocol/v2/hook.rs b/codex-rs/app-server-protocol/src/protocol/v2/hook.rs
index 5f247d2532..580ffdcce9 100644
--- a/codex-rs/app-server-protocol/src/protocol/v2/hook.rs
+++ b/codex-rs/app-server-protocol/src/protocol/v2/hook.rs
@@ -18,7 +18,7 @@ use ts_rs::TS;
 
 v2_enum_from_core!(
     pub enum HookEventName from CoreHookEventName {
-        PreToolUse, PermissionRequest, PostToolUse, PreCompact, PostCompact, SessionStart, UserPromptSubmit, Stop
+        PreToolUse, PermissionRequest, PostToolUse, PreCompact, PostCompact, SessionStart, UserPromptSubmit, SubagentStart, Stop
     }
 );
 
diff --git a/codex-rs/app-server-protocol/src/protocol/v2/permissions.rs b/codex-rs/app-server-protocol/src/protocol/v2/permissions.rs
index 86614a6aeb..15eea54e14 100644
--- a/codex-rs/app-server-protocol/src/protocol/v2/permissions.rs
+++ b/codex-rs/app-server-protocol/src/protocol/v2/permissions.rs
@@ -5,17 +5,13 @@ use codex_protocol::approvals::NetworkApprovalProtocol as CoreNetworkApprovalPro
 use codex_protocol::approvals::NetworkPolicyAmendment as CoreNetworkPolicyAmendment;
 use codex_protocol::approvals::NetworkPolicyRuleAction as CoreNetworkPolicyRuleAction;
 use codex_protocol::models::ActivePermissionProfile as CoreActivePermissionProfile;
-use codex_protocol::models::ActivePermissionProfileModification as CoreActivePermissionProfileModification;
 use codex_protocol::models::AdditionalPermissionProfile as CoreAdditionalPermissionProfile;
 use codex_protocol::models::FileSystemPermissions as CoreFileSystemPermissions;
-use codex_protocol::models::ManagedFileSystemPermissions as CoreManagedFileSystemPermissions;
 use codex_protocol::models::NetworkPermissions as CoreNetworkPermissions;
-use codex_protocol::models::PermissionProfile as CorePermissionProfile;
 use codex_protocol::permissions::FileSystemAccessMode as CoreFileSystemAccessMode;
 use codex_protocol::permissions::FileSystemPath as CoreFileSystemPath;
 use codex_protocol::permissions::FileSystemSandboxEntry as CoreFileSystemSandboxEntry;
 use codex_protocol::permissions::FileSystemSpecialPath as CoreFileSystemSpecialPath;
-use codex_protocol::permissions::NetworkSandboxPolicy as CoreNetworkSandboxPolicy;
 use codex_protocol::protocol::NetworkAccess as CoreNetworkAccess;
 use codex_protocol::request_permissions::PermissionGrantScope as CorePermissionGrantScope;
 use codex_protocol::request_permissions::RequestPermissionProfile as CoreRequestPermissionProfile;
@@ -135,13 +131,6 @@ pub struct AdditionalNetworkPermissions {
     pub enabled: Option<bool>,
 }
 
-#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)]
-#[serde(rename_all = "camelCase")]
-#[ts(export_to = "v2/")]
-pub struct PermissionProfileNetworkPermissions {
-    pub enabled: bool,
-}
-
 impl From<CoreNetworkPermissions> for AdditionalNetworkPermissions {
     fn from(value: CoreNetworkPermissions) -> Self {
         Self {
@@ -158,24 +147,6 @@ impl From<AdditionalNetworkPermissions> for CoreNetworkPermissions {
     }
 }
 
-impl From<CoreNetworkSandboxPolicy> for PermissionProfileNetworkPermissions {
-    fn from(value: CoreNetworkSandboxPolicy) -> Self {
-        Self {
-            enabled: value.is_enabled(),
-        }
-    }
-}
-
-impl From<PermissionProfileNetworkPermissions> for CoreNetworkSandboxPolicy {
-    fn from(value: PermissionProfileNetworkPermissions) -> Self {
-        if value.enabled {
-            Self::Enabled
-        } else {
-            Self::Restricted
-        }
-    }
-}
-
 #[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)]
 #[serde(rename_all = "camelCase")]
 #[serde(deny_unknown_fields)]
@@ -207,7 +178,7 @@ v2_enum_from_core!(
     pub enum FileSystemAccessMode from CoreFileSystemAccessMode {
         Read,
         Write,
-        None
+        Deny
     }
 );
 
@@ -316,116 +287,6 @@ impl From<FileSystemSandboxEntry> for CoreFileSystemSandboxEntry {
     }
 }
 
-#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)]
-#[serde(tag = "type", rename_all = "camelCase")]
-#[ts(tag = "type")]
-#[ts(export_to = "v2/")]
-pub enum PermissionProfileFileSystemPermissions {
-    #[serde(rename_all = "camelCase")]
-    #[ts(rename_all = "camelCase")]
-    Restricted {
-        entries: Vec<FileSystemSandboxEntry>,
-        #[serde(default, skip_serializing_if = "Option::is_none")]
-        #[ts(optional)]
-        glob_scan_max_depth: Option<NonZeroUsize>,
-    },
-    Unrestricted,
-}
-
-impl From<CoreManagedFileSystemPermissions> for PermissionProfileFileSystemPermissions {
-    fn from(value: CoreManagedFileSystemPermissions) -> Self {
-        match value {
-            CoreManagedFileSystemPermissions::Restricted {
-                entries,
-                glob_scan_max_depth,
-            } => Self::Restricted {
-                entries: entries
-                    .into_iter()
-                    .map(FileSystemSandboxEntry::from)
-                    .collect(),
-                glob_scan_max_depth,
-            },
-            CoreManagedFileSystemPermissions::Unrestricted => Self::Unrestricted,
-        }
-    }
-}
-
-impl From<PermissionProfileFileSystemPermissions> for CoreManagedFileSystemPermissions {
-    fn from(value: PermissionProfileFileSystemPermissions) -> Self {
-        match value {
-            PermissionProfileFileSystemPermissions::Restricted {
-                entries,
-                glob_scan_max_depth,
-            } => Self::Restricted {
-                entries: entries
-                    .into_iter()
-                    .map(CoreFileSystemSandboxEntry::from)
-                    .collect(),
-                glob_scan_max_depth,
-            },
-            PermissionProfileFileSystemPermissions::Unrestricted => Self::Unrestricted,
-        }
-    }
-}
-
-#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)]
-#[serde(tag = "type", rename_all = "camelCase")]
-#[ts(tag = "type")]
-#[ts(export_to = "v2/")]
-pub enum PermissionProfile {
-    /// Codex owns sandbox construction for this profile.
-    #[serde(rename_all = "camelCase")]
-    #[ts(rename_all = "camelCase")]
-    Managed {
-        network: PermissionProfileNetworkPermissions,
-        file_system: PermissionProfileFileSystemPermissions,
-    },
-    /// Do not apply an outer sandbox.
-    Disabled,
-    /// Filesystem isolation is enforced by an external caller.
-    #[serde(rename_all = "camelCase")]
-    #[ts(rename_all = "camelCase")]
-    External {
-        network: PermissionProfileNetworkPermissions,
-    },
-}
-
-impl From<CorePermissionProfile> for PermissionProfile {
-    fn from(value: CorePermissionProfile) -> Self {
-        match value {
-            CorePermissionProfile::Managed {
-                file_system,
-                network,
-            } => Self::Managed {
-                network: network.into(),
-                file_system: file_system.into(),
-            },
-            CorePermissionProfile::Disabled => Self::Disabled,
-            CorePermissionProfile::External { network } => Self::External {
-                network: network.into(),
-            },
-        }
-    }
-}
-
-impl From<PermissionProfile> for CorePermissionProfile {
-    fn from(value: PermissionProfile) -> Self {
-        match value {
-            PermissionProfile::Managed {
-                file_system,
-                network,
-            } => Self::Managed {
-                file_system: file_system.into(),
-                network: network.into(),
-            },
-            PermissionProfile::Disabled => Self::Disabled,
-            PermissionProfile::External { network } => Self::External {
-                network: network.into(),
-            },
-        }
-    }
-}
-
 #[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)]
 #[serde(rename_all = "camelCase")]
 #[ts(export_to = "v2/")]
@@ -437,40 +298,18 @@ pub struct ActivePermissionProfile {
     /// inheritance. This is currently always `null`.
     #[serde(default)]
     pub extends: Option<String>,
-    /// Bounded user-requested modifications applied on top of the named
-    /// profile, if any.
-    #[serde(default)]
-    pub modifications: Vec<ActivePermissionProfileModification>,
 }
 
-#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)]
-#[serde(tag = "type", rename_all = "camelCase")]
-#[ts(tag = "type")]
-#[ts(export_to = "v2/")]
-pub enum ActivePermissionProfileModification {
-    /// Additional concrete directory that should be writable.
-    #[serde(rename_all = "camelCase")]
-    #[ts(rename_all = "camelCase")]
-    AdditionalWritableRoot { path: AbsolutePathBuf },
-}
-
-impl From<CoreActivePermissionProfileModification> for ActivePermissionProfileModification {
-    fn from(value: CoreActivePermissionProfileModification) -> Self {
-        match value {
-            CoreActivePermissionProfileModification::AdditionalWritableRoot { path } => {
-                Self::AdditionalWritableRoot { path }
-            }
+impl ActivePermissionProfile {
+    pub fn new(id: impl Into<String>) -> Self {
+        Self {
+            id: id.into(),
+            extends: None,
         }
     }
-}
 
-impl From<ActivePermissionProfileModification> for CoreActivePermissionProfileModification {
-    fn from(value: ActivePermissionProfileModification) -> Self {
-        match value {
-            ActivePermissionProfileModification::AdditionalWritableRoot { path } => {
-                Self::AdditionalWritableRoot { path }
-            }
-        }
+    pub fn read_only() -> Self {
+        CoreActivePermissionProfile::read_only().into()
     }
 }
 
@@ -479,11 +318,6 @@ impl From<CoreActivePermissionProfile> for ActivePermissionProfile {
         Self {
             id: value.id,
             extends: value.extends,
-            modifications: value
-                .modifications
-                .into_iter()
-                .map(ActivePermissionProfileModification::from)
-                .collect(),
         }
     }
 }
@@ -493,42 +327,10 @@ impl From<ActivePermissionProfile> for CoreActivePermissionProfile {
         Self {
             id: value.id,
             extends: value.extends,
-            modifications: value
-                .modifications
-                .into_iter()
-                .map(CoreActivePermissionProfileModification::from)
-                .collect(),
         }
     }
 }
 
-#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)]
-#[serde(tag = "type", rename_all = "camelCase")]
-#[ts(tag = "type")]
-#[ts(export_to = "v2/")]
-pub enum PermissionProfileSelectionParams {
-    /// Select a named built-in or user-defined profile and optionally apply
-    /// bounded modifications that Codex knows how to validate.
-    #[serde(rename_all = "camelCase")]
-    #[ts(rename_all = "camelCase")]
-    Profile {
-        id: String,
-        #[ts(optional = nullable)]
-        modifications: Option<Vec<PermissionProfileModificationParams>>,
-    },
-}
-
-#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)]
-#[serde(tag = "type", rename_all = "camelCase")]
-#[ts(tag = "type")]
-#[ts(export_to = "v2/")]
-pub enum PermissionProfileModificationParams {
-    /// Additional concrete directory that should be writable.
-    #[serde(rename_all = "camelCase")]
-    #[ts(rename_all = "camelCase")]
-    AdditionalWritableRoot { path: AbsolutePathBuf },
-}
-
 #[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)]
 #[serde(rename_all = "camelCase")]
 #[ts(export_to = "v2/")]
diff --git a/codex-rs/app-server-protocol/src/protocol/v2/plugin.rs b/codex-rs/app-server-protocol/src/protocol/v2/plugin.rs
index 3ffab53218..33c2670077 100644
--- a/codex-rs/app-server-protocol/src/protocol/v2/plugin.rs
+++ b/codex-rs/app-server-protocol/src/protocol/v2/plugin.rs
@@ -125,6 +125,19 @@ pub struct PluginListParams {
     pub marketplace_kinds: Option<Vec<PluginListMarketplaceKind>>,
 }
 
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, JsonSchema, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export_to = "v2/")]
+pub struct PluginInstalledParams {
+    /// Optional working directories used to discover repo marketplaces.
+    #[ts(optional = nullable)]
+    pub cwds: Option<Vec<AbsolutePathBuf>>,
+    /// Additional uninstalled plugin names that should be returned when present locally.
+    /// This is used by mention surfaces that intentionally expose install entrypoints.
+    #[ts(optional = nullable)]
+    pub install_suggestion_plugin_names: Option<Vec<String>>,
+}
+
 #[derive(Serialize, Deserialize, Debug, Clone, Copy, PartialEq, Eq, JsonSchema, TS)]
 #[ts(export_to = "v2/")]
 pub enum PluginListMarketplaceKind {
@@ -150,6 +163,15 @@ pub struct PluginListResponse {
     pub featured_plugin_ids: Vec<String>,
 }
 
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, JsonSchema, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export_to = "v2/")]
+pub struct PluginInstalledResponse {
+    pub marketplaces: Vec<PluginMarketplaceEntry>,
+    #[serde(default)]
+    pub marketplace_load_errors: Vec<MarketplaceLoadErrorInfo>,
+}
+
 #[derive(Serialize, Deserialize, Debug, Clone, PartialEq, JsonSchema, TS)]
 #[serde(rename_all = "camelCase")]
 #[ts(export_to = "v2/")]
diff --git a/codex-rs/app-server-protocol/src/protocol/v2/remote_control.rs b/codex-rs/app-server-protocol/src/protocol/v2/remote_control.rs
index 7dab24c3d4..c8ad617e7d 100644
--- a/codex-rs/app-server-protocol/src/protocol/v2/remote_control.rs
+++ b/codex-rs/app-server-protocol/src/protocol/v2/remote_control.rs
@@ -9,6 +9,37 @@ use ts_rs::TS;
 #[ts(export_to = "v2/")]
 pub struct RemoteControlStatusChangedNotification {
     pub status: RemoteControlConnectionStatus,
+    pub server_name: String,
+    pub installation_id: String,
+    pub environment_id: Option<String>,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export_to = "v2/")]
+pub struct RemoteControlEnableResponse {
+    pub status: RemoteControlConnectionStatus,
+    pub server_name: String,
+    pub installation_id: String,
+    pub environment_id: Option<String>,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export_to = "v2/")]
+pub struct RemoteControlDisableResponse {
+    pub status: RemoteControlConnectionStatus,
+    pub server_name: String,
+    pub installation_id: String,
+    pub environment_id: Option<String>,
+}
+
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema, TS)]
+#[serde(rename_all = "camelCase")]
+#[ts(export_to = "v2/")]
+pub struct RemoteControlStatusReadResponse {
+    pub status: RemoteControlConnectionStatus,
+    pub server_name: String,
     pub installation_id: String,
     pub environment_id: Option<String>,
 }
@@ -22,3 +53,37 @@ pub enum RemoteControlConnectionStatus {
     Connected,
     Errored,
 }
+
+impl From<RemoteControlStatusChangedNotification> for RemoteControlEnableResponse {
+    fn from(notification: RemoteControlStatusChangedNotification) -> Self {
+        let RemoteControlStatusChangedNotification {
+            status,
+            server_name,
+            installation_id,
+            environment_id,
+        } = notification;
+        Self {
+            status,
+            server_name,
+            installation_id,
+            environment_id,
+        }
+    }
+}
+
+impl From<RemoteControlStatusChangedNotification> for RemoteControlDisableResponse {
+    fn from(notification: RemoteControlStatusChangedNotification) -> Self {
+        let RemoteControlStatusChangedNotification {
+            status,
+            server_name,
+            installation_id,
+            environment_id,
+        } = notification;
+        Self {
+            status,
+            server_name,
+            installation_id,
+            environment_id,
+        }
+    }
+}
diff --git a/codex-rs/app-server-protocol/src/protocol/v2/tests.rs b/codex-rs/app-server-protocol/src/protocol/v2/tests.rs
index f7041cc721..8c3ca5e6c6 100644
--- a/codex-rs/app-server-protocol/src/protocol/v2/tests.rs
+++ b/codex-rs/app-server-protocol/src/protocol/v2/tests.rs
@@ -14,8 +14,9 @@ use codex_protocol::mcp::CallToolResult;
 use codex_protocol::memory_citation::MemoryCitation as CoreMemoryCitation;
 use codex_protocol::memory_citation::MemoryCitationEntry as CoreMemoryCitationEntry;
 use codex_protocol::models::AdditionalPermissionProfile as CoreAdditionalPermissionProfile;
+use codex_protocol::models::BUILT_IN_PERMISSION_PROFILE_WORKSPACE;
 use codex_protocol::models::FileSystemPermissions as CoreFileSystemPermissions;
-use codex_protocol::models::ManagedFileSystemPermissions as CoreManagedFileSystemPermissions;
+use codex_protocol::models::ImageDetail;
 use codex_protocol::models::MessagePhase;
 use codex_protocol::models::NetworkPermissions as CoreNetworkPermissions;
 use codex_protocol::models::WebSearchAction as CoreWebSearchAction;
@@ -420,7 +421,7 @@ fn additional_file_system_permissions_preserves_canonical_entries() {
                 path: CoreFileSystemPath::GlobPattern {
                     pattern: "**/*.env".to_string(),
                 },
-                access: CoreFileSystemAccessMode::None,
+                access: CoreFileSystemAccessMode::Deny,
             },
         ],
         glob_scan_max_depth: NonZeroUsize::new(2),
@@ -444,7 +445,7 @@ fn additional_file_system_permissions_preserves_canonical_entries() {
                     path: FileSystemPath::GlobPattern {
                         pattern: "**/*.env".to_string(),
                     },
-                    access: FileSystemAccessMode::None,
+                    access: FileSystemAccessMode::Deny,
                 },
             ]),
         }
@@ -505,48 +506,6 @@ fn additional_file_system_permissions_rejects_zero_glob_scan_depth() {
     .expect_err("zero glob scan depth should fail deserialization");
 }
 
-#[test]
-fn permission_profile_file_system_permissions_preserves_glob_scan_depth() {
-    let core_permissions = CoreManagedFileSystemPermissions::Restricted {
-        entries: vec![CoreFileSystemSandboxEntry {
-            path: CoreFileSystemPath::GlobPattern {
-                pattern: "**/*.env".to_string(),
-            },
-            access: CoreFileSystemAccessMode::None,
-        }],
-        glob_scan_max_depth: NonZeroUsize::new(2),
-    };
-
-    let permissions = PermissionProfileFileSystemPermissions::from(core_permissions.clone());
-
-    assert_eq!(
-        permissions,
-        PermissionProfileFileSystemPermissions::Restricted {
-            entries: vec![FileSystemSandboxEntry {
-                path: FileSystemPath::GlobPattern {
-                    pattern: "**/*.env".to_string(),
-                },
-                access: FileSystemAccessMode::None,
-            }],
-            glob_scan_max_depth: NonZeroUsize::new(2),
-        }
-    );
-    assert_eq!(
-        CoreManagedFileSystemPermissions::from(permissions),
-        core_permissions
-    );
-}
-
-#[test]
-fn permission_profile_file_system_permissions_rejects_zero_glob_scan_depth() {
-    serde_json::from_value::<PermissionProfileFileSystemPermissions>(json!({
-        "type": "restricted",
-        "entries": [],
-        "globScanMaxDepth": 0,
-    }))
-    .expect_err("zero glob scan depth should fail deserialization");
-}
-
 #[test]
 fn legacy_current_working_directory_special_path_deserializes_as_project_roots() {
     let special_path = serde_json::from_value::<FileSystemSpecialPath>(json!({
@@ -655,6 +614,80 @@ fn permissions_request_approval_response_accepts_strict_auto_review() {
     assert_eq!(response.strict_auto_review, Some(true));
 }
 
+#[test]
+fn permission_profile_selection_uses_id_string() {
+    let start: ThreadStartParams = serde_json::from_value(json!({
+        "permissions": BUILT_IN_PERMISSION_PROFILE_WORKSPACE,
+    }))
+    .expect("thread/start params deserialize");
+    assert_eq!(
+        start.permissions,
+        Some(BUILT_IN_PERMISSION_PROFILE_WORKSPACE.to_string())
+    );
+
+    let turn: TurnStartParams = serde_json::from_value(json!({
+        "threadId": "thread-1",
+        "input": [],
+        "permissions": "dev",
+    }))
+    .expect("turn/start params deserialize");
+    assert_eq!(turn.permissions, Some("dev".to_string()));
+
+    let command: CommandExecParams = serde_json::from_value(json!({
+        "command": ["echo", "hello"],
+        "permissionProfile": "dev",
+    }))
+    .expect("command/exec params deserialize");
+    assert_eq!(command.permission_profile, Some("dev".to_string()));
+
+    let resume: ThreadResumeParams = serde_json::from_value(json!({
+        "threadId": "thread-1",
+        "permissions": BUILT_IN_PERMISSION_PROFILE_WORKSPACE,
+    }))
+    .expect("thread/resume params deserialize");
+    assert_eq!(
+        resume.permissions,
+        Some(BUILT_IN_PERMISSION_PROFILE_WORKSPACE.to_string())
+    );
+
+    let fork: ThreadForkParams = serde_json::from_value(json!({
+        "threadId": "thread-1",
+        "permissions": BUILT_IN_PERMISSION_PROFILE_WORKSPACE,
+    }))
+    .expect("thread/fork params deserialize");
+    assert_eq!(
+        fork.permissions,
+        Some(BUILT_IN_PERMISSION_PROFILE_WORKSPACE.to_string())
+    );
+}
+
+#[test]
+fn thread_path_params_deserialize_empty_path_as_none() {
+    let resume: ThreadResumeParams = serde_json::from_value(json!({
+        "threadId": "thread-1",
+        "path": "",
+    }))
+    .expect("thread/resume params deserialize");
+    assert_eq!(resume.path, None);
+
+    let fork: ThreadForkParams = serde_json::from_value(json!({
+        "threadId": "thread-1",
+        "path": "",
+    }))
+    .expect("thread/fork params deserialize");
+    assert_eq!(fork.path, None);
+
+    let resume_with_path: ThreadResumeParams = serde_json::from_value(json!({
+        "threadId": "thread-1",
+        "path": "/tmp/resume-thread.jsonl",
+    }))
+    .expect("thread/resume params deserialize");
+    assert_eq!(
+        resume_with_path.path,
+        Some(PathBuf::from("/tmp/resume-thread.jsonl"))
+    );
+}
+
 #[test]
 fn fs_get_metadata_response_round_trips_minimal_fields() {
     let response = FsGetMetadataResponse {
@@ -1505,6 +1538,7 @@ fn config_granular_approval_policy_is_marked_experimental() {
         review_model: None,
         model_context_window: None,
         model_auto_compact_token_limit: None,
+        model_auto_compact_token_limit_scope: None,
         model_provider: None,
         approval_policy: Some(AskForApproval::Granular {
             sandbox_approval: false,
@@ -1531,6 +1565,7 @@ fn config_granular_approval_policy_is_marked_experimental() {
         service_tier: None,
         analytics: None,
         apps: None,
+        desktop: None,
         additional: HashMap::new(),
     });
 
@@ -1544,6 +1579,7 @@ fn config_approvals_reviewer_is_marked_experimental() {
         review_model: None,
         model_context_window: None,
         model_auto_compact_token_limit: None,
+        model_auto_compact_token_limit_scope: None,
         model_provider: None,
         approval_policy: None,
         approvals_reviewer: Some(ApprovalsReviewer::AutoReview),
@@ -1564,6 +1600,7 @@ fn config_approvals_reviewer_is_marked_experimental() {
         service_tier: None,
         analytics: None,
         apps: None,
+        desktop: None,
         additional: HashMap::new(),
     });
 
@@ -1577,6 +1614,7 @@ fn config_nested_profile_granular_approval_policy_is_marked_experimental() {
         review_model: None,
         model_context_window: None,
         model_auto_compact_token_limit: None,
+        model_auto_compact_token_limit_scope: None,
         model_provider: None,
         approval_policy: None,
         approvals_reviewer: None,
@@ -1619,6 +1657,7 @@ fn config_nested_profile_granular_approval_policy_is_marked_experimental() {
         service_tier: None,
         analytics: None,
         apps: None,
+        desktop: None,
         additional: HashMap::new(),
     });
 
@@ -1632,6 +1671,7 @@ fn config_nested_profile_approvals_reviewer_is_marked_experimental() {
         review_model: None,
         model_context_window: None,
         model_auto_compact_token_limit: None,
+        model_auto_compact_token_limit_scope: None,
         model_provider: None,
         approval_policy: None,
         approvals_reviewer: None,
@@ -1668,6 +1708,7 @@ fn config_nested_profile_approvals_reviewer_is_marked_experimental() {
         service_tier: None,
         analytics: None,
         apps: None,
+        desktop: None,
         additional: HashMap::new(),
     });
 
@@ -2260,9 +2301,11 @@ fn core_turn_item_into_thread_item_converts_supported_variants() {
             },
             CoreUserInput::Image {
                 image_url: "https://example.com/image.png".to_string(),
+                detail: Some(ImageDetail::Original),
             },
             CoreUserInput::LocalImage {
                 path: PathBuf::from("local/image.png"),
+                detail: Some(ImageDetail::Original),
             },
             CoreUserInput::Skill {
                 name: "skill-creator".to_string(),
@@ -2286,9 +2329,11 @@ fn core_turn_item_into_thread_item_converts_supported_variants() {
                 },
                 UserInput::Image {
                     url: "https://example.com/image.png".to_string(),
+                    detail: Some(ImageDetail::Original),
                 },
                 UserInput::LocalImage {
                     path: PathBuf::from("local/image.png"),
+                    detail: Some(ImageDetail::Original),
                 },
                 UserInput::Skill {
                     name: "skill-creator".to_string(),
@@ -2503,6 +2548,33 @@ fn core_turn_item_into_thread_item_converts_supported_variants() {
     );
 }
 
+#[test]
+fn user_input_into_core_preserves_image_detail() {
+    assert_eq!(
+        UserInput::Image {
+            url: "https://example.com/image.png".to_string(),
+            detail: Some(ImageDetail::Original),
+        }
+        .into_core(),
+        CoreUserInput::Image {
+            image_url: "https://example.com/image.png".to_string(),
+            detail: Some(ImageDetail::Original),
+        }
+    );
+
+    assert_eq!(
+        UserInput::LocalImage {
+            path: PathBuf::from("local/image.png"),
+            detail: Some(ImageDetail::Original),
+        }
+        .into_core(),
+        CoreUserInput::LocalImage {
+            path: PathBuf::from("local/image.png"),
+            detail: Some(ImageDetail::Original),
+        }
+    );
+}
+
 #[test]
 fn skills_list_params_serialization_uses_force_reload() {
     assert_eq!(
@@ -2742,6 +2814,27 @@ fn plugin_list_params_serializes_marketplace_kind_filter() {
     );
 }
 
+#[test]
+fn plugin_installed_params_serializes_install_suggestion_names() {
+    assert_eq!(
+        serde_json::to_value(PluginInstalledParams {
+            cwds: None,
+            install_suggestion_plugin_names: Some(vec![
+                "computer-use".to_string(),
+                "chrome".to_string(),
+            ]),
+        })
+        .unwrap(),
+        json!({
+            "cwds": null,
+            "installSuggestionPluginNames": [
+                "computer-use",
+                "chrome",
+            ],
+        }),
+    );
+}
+
 #[test]
 fn plugin_read_params_serialization_uses_install_source_fields() {
     let marketplace_path = if cfg!(windows) {
@@ -3439,9 +3532,6 @@ fn thread_lifecycle_responses_default_missing_optional_fields() {
     assert_eq!(start.instruction_sources, Vec::<AbsolutePathBuf>::new());
     assert_eq!(resume.instruction_sources, Vec::<AbsolutePathBuf>::new());
     assert_eq!(fork.instruction_sources, Vec::<AbsolutePathBuf>::new());
-    assert_eq!(start.permission_profile, None);
-    assert_eq!(resume.permission_profile, None);
-    assert_eq!(fork.permission_profile, None);
     assert_eq!(start.active_permission_profile, None);
     assert_eq!(resume.active_permission_profile, None);
     assert_eq!(fork.active_permission_profile, None);
@@ -3469,6 +3559,7 @@ fn turn_start_params_preserve_explicit_null_service_tier() {
         responsesapi_client_metadata: None,
         environments: None,
         cwd: None,
+        runtime_workspace_roots: None,
         approval_policy: None,
         approvals_reviewer: None,
         sandbox_policy: None,
diff --git a/codex-rs/app-server-protocol/src/protocol/v2/thread.rs b/codex-rs/app-server-protocol/src/protocol/v2/thread.rs
index 458722b3a2..059bef05f2 100644
--- a/codex-rs/app-server-protocol/src/protocol/v2/thread.rs
+++ b/codex-rs/app-server-protocol/src/protocol/v2/thread.rs
@@ -1,8 +1,6 @@
 use super::ActivePermissionProfile;
 use super::ApprovalsReviewer;
 use super::AskForApproval;
-use super::PermissionProfile;
-use super::PermissionProfileSelectionParams;
 use super::SandboxMode;
 use super::SandboxPolicy;
 use super::Thread;
@@ -107,6 +105,11 @@ pub struct ThreadStartParams {
     pub service_tier: Option<Option<String>>,
     #[ts(optional = nullable)]
     pub cwd: Option<String>,
+    /// Replace the thread's runtime workspace roots. Relative paths are
+    /// resolved against the effective cwd for the thread.
+    #[experimental("thread/start.runtimeWorkspaceRoots")]
+    #[ts(optional = nullable)]
+    pub runtime_workspace_roots: Option<Vec<PathBuf>>,
     #[experimental(nested)]
     #[ts(optional = nullable)]
     pub approval_policy: Option<AskForApproval>,
@@ -116,12 +119,10 @@ pub struct ThreadStartParams {
     pub approvals_reviewer: Option<ApprovalsReviewer>,
     #[ts(optional = nullable)]
     pub sandbox: Option<SandboxMode>,
-    /// Named profile selection for this thread. Cannot be combined with
-    /// `sandbox`. Use bounded `modifications` for supported turn/thread
-    /// adjustments instead of replacing the full permissions profile.
+    /// Named profile id for this thread. Cannot be combined with `sandbox`.
     #[experimental("thread/start.permissions")]
     #[ts(optional = nullable)]
-    pub permissions: Option<PermissionProfileSelectionParams>,
+    pub permissions: Option<String>,
     #[ts(optional = nullable)]
     pub config: Option<HashMap<String, JsonValue>>,
     #[ts(optional = nullable)]
@@ -195,6 +196,11 @@ pub struct ThreadStartResponse {
     pub model_provider: String,
     pub service_tier: Option<String>,
     pub cwd: AbsolutePathBuf,
+    /// Thread-scoped runtime workspace roots used to materialize
+    /// `:workspace_roots`.
+    #[experimental("thread/start.runtimeWorkspaceRoots")]
+    #[serde(default)]
+    pub runtime_workspace_roots: Vec<AbsolutePathBuf>,
     /// Instruction source files currently loaded for this thread.
     #[serde(default)]
     pub instruction_sources: Vec<AbsolutePathBuf>,
@@ -203,14 +209,8 @@ pub struct ThreadStartResponse {
     /// Reviewer currently used for approval requests on this thread.
     pub approvals_reviewer: ApprovalsReviewer,
     /// Legacy sandbox policy retained for compatibility. Experimental clients
-    /// should prefer `permissionProfile` when they need exact runtime
-    /// permissions.
+    /// should prefer `activePermissionProfile` for profile provenance.
     pub sandbox: SandboxPolicy,
-    /// Full active permissions for this thread. `activePermissionProfile`
-    /// carries display/provenance metadata for this runtime profile.
-    #[experimental("thread/start.permissionProfile")]
-    #[serde(default)]
-    pub permission_profile: Option<PermissionProfile>,
     /// Named or implicit built-in profile that produced the active
     /// permissions, when known.
     #[experimental("thread/start.activePermissionProfile")]
@@ -229,8 +229,13 @@ pub struct ThreadStartResponse {
 /// 2. By history: instantiate the thread from memory and resume it.
 /// 3. By path: load the thread from disk by path and resume it.
 ///
-/// The precedence is: history > path > thread_id.
-/// If using history or path, the thread_id param will be ignored.
+/// For non-running threads, the precedence is: history > non-empty path > thread_id.
+/// If using history or a non-empty path for a non-running thread, the thread_id
+/// param will be ignored.
+///
+/// If thread_id identifies a running thread, app-server rejoins that thread and
+/// treats a non-empty path as a consistency check against the active rollout path.
+/// Empty string path values are treated as absent.
 ///
 /// Prefer using thread_id whenever possible.
 pub struct ThreadResumeParams {
@@ -244,8 +249,14 @@ pub struct ThreadResumeParams {
     pub history: Option<Vec<ResponseItem>>,
 
     /// [UNSTABLE] Specify the rollout path to resume from.
-    /// If specified, the thread_id param will be ignored.
+    /// If specified for a non-running thread, the thread_id param will be ignored.
+    /// If thread_id identifies a running thread, the path must match the active
+    /// rollout path.
     #[experimental("thread/resume.path")]
+    #[serde(
+        default,
+        deserialize_with = "crate::protocol::serde_helpers::deserialize_empty_path_as_none"
+    )]
     #[ts(optional = nullable)]
     pub path: Option<PathBuf>,
 
@@ -264,6 +275,11 @@ pub struct ThreadResumeParams {
     pub service_tier: Option<Option<String>>,
     #[ts(optional = nullable)]
     pub cwd: Option<String>,
+    /// Replace the thread's runtime workspace roots. Relative paths are
+    /// resolved against the effective cwd for the thread.
+    #[experimental("thread/resume.runtimeWorkspaceRoots")]
+    #[ts(optional = nullable)]
+    pub runtime_workspace_roots: Option<Vec<PathBuf>>,
     #[experimental(nested)]
     #[ts(optional = nullable)]
     pub approval_policy: Option<AskForApproval>,
@@ -273,12 +289,11 @@ pub struct ThreadResumeParams {
     pub approvals_reviewer: Option<ApprovalsReviewer>,
     #[ts(optional = nullable)]
     pub sandbox: Option<SandboxMode>,
-    /// Named profile selection for the resumed thread. Cannot be combined
-    /// with `sandbox`. Use bounded `modifications` for supported thread
-    /// adjustments instead of replacing the full permissions profile.
+    /// Named profile id for the resumed thread. Cannot be combined with
+    /// `sandbox`.
     #[experimental("thread/resume.permissions")]
     #[ts(optional = nullable)]
-    pub permissions: Option<PermissionProfileSelectionParams>,
+    pub permissions: Option<String>,
     #[ts(optional = nullable)]
     pub config: Option<HashMap<String, serde_json::Value>>,
     #[ts(optional = nullable)]
@@ -310,6 +325,11 @@ pub struct ThreadResumeResponse {
     pub model_provider: String,
     pub service_tier: Option<String>,
     pub cwd: AbsolutePathBuf,
+    /// Thread-scoped runtime workspace roots used to materialize
+    /// `:workspace_roots`.
+    #[experimental("thread/resume.runtimeWorkspaceRoots")]
+    #[serde(default)]
+    pub runtime_workspace_roots: Vec<AbsolutePathBuf>,
     /// Instruction source files currently loaded for this thread.
     #[serde(default)]
     pub instruction_sources: Vec<AbsolutePathBuf>,
@@ -318,14 +338,8 @@ pub struct ThreadResumeResponse {
     /// Reviewer currently used for approval requests on this thread.
     pub approvals_reviewer: ApprovalsReviewer,
     /// Legacy sandbox policy retained for compatibility. Experimental clients
-    /// should prefer `permissionProfile` when they need exact runtime
-    /// permissions.
+    /// should prefer `activePermissionProfile` for profile provenance.
     pub sandbox: SandboxPolicy,
-    /// Full active permissions for this thread. `activePermissionProfile`
-    /// carries display/provenance metadata for this runtime profile.
-    #[experimental("thread/resume.permissionProfile")]
-    #[serde(default)]
-    pub permission_profile: Option<PermissionProfile>,
     /// Named or implicit built-in profile that produced the active
     /// permissions, when known.
     #[experimental("thread/resume.activePermissionProfile")]
@@ -343,7 +357,8 @@ pub struct ThreadResumeResponse {
 /// 1. By thread_id: load the thread from disk by thread_id and fork it into a new thread.
 /// 2. By path: load the thread from disk by path and fork it into a new thread.
 ///
-/// If using path, the thread_id param will be ignored.
+/// If using a non-empty path, the thread_id param will be ignored.
+/// Empty string path values are treated as absent.
 ///
 /// Prefer using thread_id whenever possible.
 pub struct ThreadForkParams {
@@ -352,6 +367,10 @@ pub struct ThreadForkParams {
     /// [UNSTABLE] Specify the rollout path to fork from.
     /// If specified, the thread_id param will be ignored.
     #[experimental("thread/fork.path")]
+    #[serde(
+        default,
+        deserialize_with = "crate::protocol::serde_helpers::deserialize_empty_path_as_none"
+    )]
     #[ts(optional = nullable)]
     pub path: Option<PathBuf>,
 
@@ -370,6 +389,11 @@ pub struct ThreadForkParams {
     pub service_tier: Option<Option<String>>,
     #[ts(optional = nullable)]
     pub cwd: Option<String>,
+    /// Replace the thread's runtime workspace roots. Relative paths are
+    /// resolved against the effective cwd for the thread.
+    #[experimental("thread/fork.runtimeWorkspaceRoots")]
+    #[ts(optional = nullable)]
+    pub runtime_workspace_roots: Option<Vec<PathBuf>>,
     #[experimental(nested)]
     #[ts(optional = nullable)]
     pub approval_policy: Option<AskForApproval>,
@@ -379,12 +403,11 @@ pub struct ThreadForkParams {
     pub approvals_reviewer: Option<ApprovalsReviewer>,
     #[ts(optional = nullable)]
     pub sandbox: Option<SandboxMode>,
-    /// Named profile selection for the forked thread. Cannot be combined with
-    /// `sandbox`. Use bounded `modifications` for supported thread
-    /// adjustments instead of replacing the full permissions profile.
+    /// Named profile id for the forked thread. Cannot be combined with
+    /// `sandbox`.
     #[experimental("thread/fork.permissions")]
     #[ts(optional = nullable)]
-    pub permissions: Option<PermissionProfileSelectionParams>,
+    pub permissions: Option<String>,
     #[ts(optional = nullable)]
     pub config: Option<HashMap<String, serde_json::Value>>,
     #[ts(optional = nullable)]
@@ -419,6 +442,11 @@ pub struct ThreadForkResponse {
     pub model_provider: String,
     pub service_tier: Option<String>,
     pub cwd: AbsolutePathBuf,
+    /// Thread-scoped runtime workspace roots used to materialize
+    /// `:workspace_roots`.
+    #[experimental("thread/fork.runtimeWorkspaceRoots")]
+    #[serde(default)]
+    pub runtime_workspace_roots: Vec<AbsolutePathBuf>,
     /// Instruction source files currently loaded for this thread.
     #[serde(default)]
     pub instruction_sources: Vec<AbsolutePathBuf>,
@@ -427,14 +455,8 @@ pub struct ThreadForkResponse {
     /// Reviewer currently used for approval requests on this thread.
     pub approvals_reviewer: ApprovalsReviewer,
     /// Legacy sandbox policy retained for compatibility. Experimental clients
-    /// should prefer `permissionProfile` when they need exact runtime
-    /// permissions.
+    /// should prefer `activePermissionProfile` for profile provenance.
     pub sandbox: SandboxPolicy,
-    /// Full active permissions for this thread. `activePermissionProfile`
-    /// carries display/provenance metadata for this runtime profile.
-    #[experimental("thread/fork.permissionProfile")]
-    #[serde(default)]
-    pub permission_profile: Option<PermissionProfile>,
     /// Named or implicit built-in profile that produced the active
     /// permissions, when known.
     #[experimental("thread/fork.activePermissionProfile")]
@@ -542,6 +564,8 @@ v2_enum_from_core! {
     pub enum ThreadGoalStatus from CoreThreadGoalStatus {
         Active,
         Paused,
+        Blocked,
+        UsageLimited,
         BudgetLimited,
         Complete,
     }
diff --git a/codex-rs/app-server-protocol/src/protocol/v2/turn.rs b/codex-rs/app-server-protocol/src/protocol/v2/turn.rs
index 61a09bfbf5..50660af1d7 100644
--- a/codex-rs/app-server-protocol/src/protocol/v2/turn.rs
+++ b/codex-rs/app-server-protocol/src/protocol/v2/turn.rs
@@ -1,12 +1,12 @@
 use super::ApprovalsReviewer;
 use super::AskForApproval;
-use super::PermissionProfileSelectionParams;
 use super::SandboxPolicy;
 use super::Turn;
 use codex_experimental_api_macros::ExperimentalApi;
 use codex_protocol::config_types::CollaborationMode;
 use codex_protocol::config_types::Personality;
 use codex_protocol::config_types::ReasoningSummary;
+use codex_protocol::models::ImageDetail;
 use codex_protocol::openai_models::ReasoningEffort;
 use codex_protocol::plan_tool::PlanItemArg as CorePlanItemArg;
 use codex_protocol::plan_tool::StepStatus as CorePlanStepStatus;
@@ -64,6 +64,12 @@ pub struct TurnStartParams {
     /// Override the working directory for this turn and subsequent turns.
     #[ts(optional = nullable)]
     pub cwd: Option<PathBuf>,
+    /// Replace the thread's runtime workspace roots for this turn and
+    /// subsequent turns. Relative paths are resolved against the effective
+    /// cwd for the turn.
+    #[experimental("turn/start.runtimeWorkspaceRoots")]
+    #[ts(optional = nullable)]
+    pub runtime_workspace_roots: Option<Vec<PathBuf>>,
     /// Override the approval policy for this turn and subsequent turns.
     #[experimental(nested)]
     #[ts(optional = nullable)]
@@ -75,13 +81,11 @@ pub struct TurnStartParams {
     /// Override the sandbox policy for this turn and subsequent turns.
     #[ts(optional = nullable)]
     pub sandbox_policy: Option<SandboxPolicy>,
-    /// Select a named permissions profile for this turn and subsequent turns.
-    /// Cannot be combined with `sandboxPolicy`. Use bounded `modifications`
-    /// for supported turn adjustments instead of replacing the full
-    /// permissions profile.
+    /// Select a named permissions profile id for this turn and subsequent
+    /// turns. Cannot be combined with `sandboxPolicy`.
     #[experimental("turn/start.permissions")]
     #[ts(optional = nullable)]
-    pub permissions: Option<PermissionProfileSelectionParams>,
+    pub permissions: Option<String>,
     /// Override the model for this turn and subsequent turns.
     #[ts(optional = nullable)]
     pub model: Option<String>,
@@ -243,9 +247,15 @@ pub enum UserInput {
         text_elements: Vec<TextElement>,
     },
     Image {
+        #[serde(default)]
+        #[ts(optional)]
+        detail: Option<ImageDetail>,
         url: String,
     },
     LocalImage {
+        #[serde(default)]
+        #[ts(optional)]
+        detail: Option<ImageDetail>,
         path: PathBuf,
     },
     Skill {
@@ -268,8 +278,11 @@ impl UserInput {
                 text,
                 text_elements: text_elements.into_iter().map(Into::into).collect(),
             },
-            UserInput::Image { url } => CoreUserInput::Image { image_url: url },
-            UserInput::LocalImage { path } => CoreUserInput::LocalImage { path },
+            UserInput::Image { url, detail } => CoreUserInput::Image {
+                image_url: url,
+                detail,
+            },
+            UserInput::LocalImage { path, detail } => CoreUserInput::LocalImage { path, detail },
             UserInput::Skill { name, path } => CoreUserInput::Skill { name, path },
             UserInput::Mention { name, path } => CoreUserInput::Mention { name, path },
         }
@@ -286,8 +299,11 @@ impl From<CoreUserInput> for UserInput {
                 text,
                 text_elements: text_elements.into_iter().map(Into::into).collect(),
             },
-            CoreUserInput::Image { image_url } => UserInput::Image { url: image_url },
-            CoreUserInput::LocalImage { path } => UserInput::LocalImage { path },
+            CoreUserInput::Image { image_url, detail } => UserInput::Image {
+                url: image_url,
+                detail,
+            },
+            CoreUserInput::LocalImage { path, detail } => UserInput::LocalImage { path, detail },
             CoreUserInput::Skill { name, path } => UserInput::Skill { name, path },
             CoreUserInput::Mention { name, path } => UserInput::Mention { name, path },
             _ => unreachable!("unsupported user input variant"),
diff --git a/codex-rs/app-server-transport/src/lib.rs b/codex-rs/app-server-transport/src/lib.rs
index e3f39f60ce..f4eb1fc6a5 100644
--- a/codex-rs/app-server-transport/src/lib.rs
+++ b/codex-rs/app-server-transport/src/lib.rs
@@ -12,6 +12,7 @@ pub use transport::CHANNEL_CAPACITY;
 pub use transport::ConnectionOrigin;
 pub use transport::RemoteControlHandle;
 pub use transport::RemoteControlStartConfig;
+pub use transport::RemoteControlUnavailable;
 pub use transport::TransportEvent;
 pub use transport::app_server_control_socket_path;
 pub use transport::auth;
diff --git a/codex-rs/app-server-transport/src/transport/mod.rs b/codex-rs/app-server-transport/src/transport/mod.rs
index 3e76069f43..a9e806c128 100644
--- a/codex-rs/app-server-transport/src/transport/mod.rs
+++ b/codex-rs/app-server-transport/src/transport/mod.rs
@@ -32,6 +32,7 @@ mod websocket;
 
 pub use remote_control::RemoteControlHandle;
 pub use remote_control::RemoteControlStartConfig;
+pub use remote_control::RemoteControlUnavailable;
 pub use remote_control::start_remote_control;
 pub use stdio::start_stdio_connection;
 pub use unix_socket::start_control_socket_acceptor;
diff --git a/codex-rs/app-server-transport/src/transport/remote_control/enroll.rs b/codex-rs/app-server-transport/src/transport/remote_control/enroll.rs
index 60dfc3d845..9ec6e4d004 100644
--- a/codex-rs/app-server-transport/src/transport/remote_control/enroll.rs
+++ b/codex-rs/app-server-transport/src/transport/remote_control/enroll.rs
@@ -6,7 +6,6 @@ use codex_api::SharedAuthProvider;
 use codex_login::default_client::build_reqwest_client;
 use codex_state::RemoteControlEnrollmentRecord;
 use codex_state::StateRuntime;
-use gethostname::gethostname;
 use std::io;
 use std::io::ErrorKind;
 use tracing::info;
@@ -195,11 +194,11 @@ pub(super) async fn enroll_remote_control_server(
     remote_control_target: &RemoteControlTarget,
     auth: &RemoteControlConnectionAuth,
     installation_id: &str,
+    server_name: &str,
 ) -> io::Result<RemoteControlEnrollment> {
     let enroll_url = &remote_control_target.enroll_url;
-    let server_name = gethostname().to_string_lossy().trim().to_string();
     let request = EnrollRemoteServerRequest {
-        name: server_name.clone(),
+        name: server_name.to_string(),
         os: std::env::consts::OS,
         arch: std::env::consts::ARCH,
         app_server_version: env!("CARGO_PKG_VERSION"),
@@ -255,7 +254,7 @@ pub(super) async fn enroll_remote_control_server(
         account_id: auth.account_id.clone(),
         environment_id: enrollment.environment_id,
         server_id: enrollment.server_id,
-        server_name,
+        server_name: server_name.to_string(),
     })
 }
 
@@ -464,6 +463,7 @@ mod tests {
                 account_id: "account_id".to_string(),
             },
             "11111111-1111-4111-8111-111111111111",
+            "test-server",
         )
         .await
         .expect_err("invalid response should fail to parse");
diff --git a/codex-rs/app-server-transport/src/transport/remote_control/mod.rs b/codex-rs/app-server-transport/src/transport/remote_control/mod.rs
index 9ffe8b60bb..ae6d79462c 100644
--- a/codex-rs/app-server-transport/src/transport/remote_control/mod.rs
+++ b/codex-rs/app-server-transport/src/transport/remote_control/mod.rs
@@ -19,6 +19,9 @@ use codex_app_server_protocol::RemoteControlConnectionStatus;
 use codex_app_server_protocol::RemoteControlStatusChangedNotification;
 use codex_login::AuthManager;
 use codex_state::StateRuntime;
+use gethostname::gethostname;
+use std::error::Error;
+use std::fmt;
 use std::io;
 use std::sync::Arc;
 use tokio::sync::mpsc;
@@ -47,23 +50,96 @@ pub struct RemoteControlHandle {
     state_db_available: bool,
 }
 
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub struct RemoteControlUnavailable;
+
+impl fmt::Display for RemoteControlUnavailable {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(
+            f,
+            "remote control cannot be enabled because sqlite state db is unavailable"
+        )
+    }
+}
+
+impl Error for RemoteControlUnavailable {}
+
 impl RemoteControlHandle {
-    pub fn set_enabled(&self, enabled: bool) {
-        let requested_enabled = enabled;
-        let enabled = enabled && self.state_db_available;
-        if requested_enabled && !self.state_db_available {
+    pub fn enable(
+        &self,
+    ) -> Result<RemoteControlStatusChangedNotification, RemoteControlUnavailable> {
+        if !self.state_db_available {
             warn!("remote control cannot be enabled because sqlite state db is unavailable");
+            return Err(RemoteControlUnavailable);
         }
+
         self.enabled_tx.send_if_modified(|state| {
-            let changed = *state != enabled;
-            *state = enabled;
+            let changed = !*state;
+            *state = true;
             changed
         });
+
+        let status = self.status();
+        if matches!(
+            status.status,
+            RemoteControlConnectionStatus::Connected | RemoteControlConnectionStatus::Connecting
+        ) {
+            return Ok(status);
+        }
+
+        Ok(self.publish_status(RemoteControlConnectionStatus::Connecting))
+    }
+
+    pub fn disable(&self) -> RemoteControlStatusChangedNotification {
+        self.enabled_tx.send_if_modified(|state| {
+            let changed = *state;
+            *state = false;
+            changed
+        });
+
+        self.publish_status(RemoteControlConnectionStatus::Disabled)
+    }
+
+    pub fn status(&self) -> RemoteControlStatusChangedNotification {
+        self.status_tx.borrow().clone()
     }
 
     pub fn status_receiver(&self) -> watch::Receiver<RemoteControlStatusChangedNotification> {
         self.status_tx.subscribe()
     }
+
+    fn publish_status(
+        &self,
+        connection_status: RemoteControlConnectionStatus,
+    ) -> RemoteControlStatusChangedNotification {
+        self.status_tx.send_if_modified(|status| {
+            let next_status =
+                remote_control_status_with_connection_status(status, connection_status);
+            if *status == next_status {
+                return false;
+            }
+
+            *status = next_status;
+            true
+        });
+        self.status()
+    }
+}
+
+fn remote_control_status_with_connection_status(
+    status: &RemoteControlStatusChangedNotification,
+    connection_status: RemoteControlConnectionStatus,
+) -> RemoteControlStatusChangedNotification {
+    RemoteControlStatusChangedNotification {
+        status: connection_status,
+        server_name: status.server_name.clone(),
+        installation_id: status.installation_id.clone(),
+        environment_id: if connection_status == RemoteControlConnectionStatus::Disabled {
+            None
+        } else {
+            status.environment_id.clone()
+        },
+    }
 }
 
 pub async fn start_remote_control(
@@ -88,12 +164,14 @@ pub async fn start_remote_control(
     };
 
     let (enabled_tx, enabled_rx) = watch::channel(initial_enabled);
+    let server_name = gethostname().to_string_lossy().trim().to_string();
     let initial_status = RemoteControlStatusChangedNotification {
         status: if initial_enabled {
             RemoteControlConnectionStatus::Connecting
         } else {
             RemoteControlConnectionStatus::Disabled
         },
+        server_name: server_name.clone(),
         installation_id: config.installation_id.clone(),
         environment_id: None,
     };
@@ -105,6 +183,7 @@ pub async fn start_remote_control(
                 remote_control_url: config.remote_control_url,
                 installation_id: config.installation_id,
                 remote_control_target,
+                server_name,
             },
             state_db,
             auth_manager,
diff --git a/codex-rs/app-server-transport/src/transport/remote_control/tests.rs b/codex-rs/app-server-transport/src/transport/remote_control/tests.rs
index 88b7798827..fb1512fedb 100644
--- a/codex-rs/app-server-transport/src/transport/remote_control/tests.rs
+++ b/codex-rs/app-server-transport/src/transport/remote_control/tests.rs
@@ -121,6 +121,10 @@ fn remote_control_url_for_listener(listener: &TcpListener) -> String {
     format!("http://{addr}/backend-api/")
 }
 
+fn test_server_name() -> String {
+    gethostname().to_string_lossy().trim().to_string()
+}
+
 async fn expect_remote_control_status(
     status_rx: &mut watch::Receiver<RemoteControlStatusChangedNotification>,
     expected_status: Option<RemoteControlConnectionStatus>,
@@ -134,6 +138,7 @@ async fn expect_remote_control_status(
     if let Some(expected_status) = expected_status {
         assert_eq!(status.status, expected_status);
     }
+    assert_eq!(status.server_name, test_server_name());
     assert_eq!(status.installation_id, TEST_INSTALLATION_ID);
     assert_eq!(status.environment_id.as_deref(), expected_environment_id);
 }
@@ -630,6 +635,7 @@ async fn remote_control_start_reports_missing_state_db_as_disabled_when_enabled(
         status_rx.borrow().clone(),
         RemoteControlStatusChangedNotification {
             status: RemoteControlConnectionStatus::Disabled,
+            server_name: test_server_name(),
             installation_id: TEST_INSTALLATION_ID.to_string(),
             environment_id: None,
         }
@@ -639,7 +645,10 @@ async fn remote_control_start_reports_missing_state_db_as_disabled_when_enabled(
         .await
         .expect_err("remote control should not connect without sqlite state db");
 
-    remote_handle.set_enabled(/*enabled*/ true);
+    assert_eq!(
+        remote_handle.enable().expect_err("enable should fail"),
+        super::RemoteControlUnavailable
+    );
     timeout(Duration::from_millis(100), listener.accept())
         .await
         .expect_err("remote control should remain disabled without sqlite state db");
@@ -655,7 +664,7 @@ async fn remote_control_start_reports_missing_state_db_as_disabled_when_enabled(
 }
 
 #[tokio::test]
-async fn remote_control_handle_set_enabled_stops_and_restarts_connections() {
+async fn remote_control_handle_enable_disable_stops_and_restarts_connections() {
     let listener = TcpListener::bind("127.0.0.1:0")
         .await
         .expect("listener should bind");
@@ -695,17 +704,27 @@ async fn remote_control_handle_set_enabled_stops_and_restarts_connections() {
         &mut status_rx,
         RemoteControlStatusChangedNotification {
             status: RemoteControlConnectionStatus::Connected,
+            server_name: test_server_name(),
             installation_id: TEST_INSTALLATION_ID.to_string(),
             environment_id: Some("env_test".to_string()),
         },
     )
     .await;
 
-    remote_handle.set_enabled(/*enabled*/ false);
+    assert_eq!(
+        remote_handle.disable(),
+        RemoteControlStatusChangedNotification {
+            status: RemoteControlConnectionStatus::Disabled,
+            server_name: test_server_name(),
+            installation_id: TEST_INSTALLATION_ID.to_string(),
+            environment_id: None,
+        }
+    );
     expect_remote_control_status_snapshot(
         &mut status_rx,
         RemoteControlStatusChangedNotification {
             status: RemoteControlConnectionStatus::Disabled,
+            server_name: test_server_name(),
             installation_id: TEST_INSTALLATION_ID.to_string(),
             environment_id: None,
         },
@@ -718,13 +737,22 @@ async fn remote_control_handle_set_enabled_stops_and_restarts_connections() {
         .await
         .expect_err("disabled remote control should not reconnect");
 
-    remote_handle.set_enabled(/*enabled*/ true);
+    assert_eq!(
+        remote_handle.enable().expect("enable should succeed"),
+        RemoteControlStatusChangedNotification {
+            status: RemoteControlConnectionStatus::Connecting,
+            server_name: test_server_name(),
+            installation_id: TEST_INSTALLATION_ID.to_string(),
+            environment_id: None,
+        }
+    );
     expect_remote_control_status_snapshot(
         &mut status_rx,
         RemoteControlStatusChangedNotification {
             status: RemoteControlConnectionStatus::Connecting,
+            server_name: test_server_name(),
             installation_id: TEST_INSTALLATION_ID.to_string(),
-            environment_id: Some("env_test".to_string()),
+            environment_id: None,
         },
     )
     .await;
diff --git a/codex-rs/app-server-transport/src/transport/remote_control/websocket.rs b/codex-rs/app-server-transport/src/transport/remote_control/websocket.rs
index 472639bc68..f117aec3b4 100644
--- a/codex-rs/app-server-transport/src/transport/remote_control/websocket.rs
+++ b/codex-rs/app-server-transport/src/transport/remote_control/websocket.rs
@@ -15,6 +15,7 @@ use super::protocol::ClientId;
 use super::protocol::RemoteControlTarget;
 use super::protocol::ServerEnvelope;
 use super::protocol::StreamId;
+use super::remote_control_status_with_connection_status;
 use super::segment::ClientSegmentObservation;
 use super::segment::ClientSegmentReassembler;
 use super::segment::REMOTE_CONTROL_SEGMENT_MAX_BYTES;
@@ -216,6 +217,7 @@ impl WebsocketState {
 pub(crate) struct RemoteControlWebsocket {
     remote_control_url: String,
     installation_id: String,
+    server_name: String,
     remote_control_target: Option<RemoteControlTarget>,
     state_db: Option<Arc<StateRuntime>>,
     auth_manager: Arc<AuthManager>,
@@ -235,6 +237,7 @@ pub(crate) struct RemoteControlWebsocketConfig {
     pub(crate) remote_control_url: String,
     pub(crate) installation_id: String,
     pub(crate) remote_control_target: Option<RemoteControlTarget>,
+    pub(crate) server_name: String,
 }
 
 enum ConnectOutcome {
@@ -260,15 +263,8 @@ impl RemoteControlStatusPublisher {
 
     fn publish_status(&self, connection_status: RemoteControlConnectionStatus) {
         self.tx.send_if_modified(|status| {
-            let next_status = RemoteControlStatusChangedNotification {
-                status: connection_status,
-                installation_id: status.installation_id.clone(),
-                environment_id: if connection_status == RemoteControlConnectionStatus::Disabled {
-                    None
-                } else {
-                    status.environment_id.clone()
-                },
-            };
+            let next_status =
+                remote_control_status_with_connection_status(status, connection_status);
             if *status == next_status {
                 return false;
             }
@@ -285,6 +281,7 @@ impl RemoteControlStatusPublisher {
             }
             let next_status = RemoteControlStatusChangedNotification {
                 status: status.status,
+                server_name: status.server_name.clone(),
                 installation_id: status.installation_id.clone(),
                 environment_id,
             };
@@ -301,6 +298,7 @@ impl RemoteControlStatusPublisher {
 #[derive(Clone, Copy)]
 pub(super) struct RemoteControlConnectOptions<'a> {
     installation_id: &'a str,
+    server_name: &'a str,
     subscribe_cursor: Option<&'a str>,
     app_server_client_name: Option<&'a str>,
 }
@@ -327,6 +325,7 @@ impl RemoteControlWebsocket {
         Self {
             remote_control_url: config.remote_control_url,
             installation_id: config.installation_id,
+            server_name: config.server_name,
             remote_control_target: config.remote_control_target,
             state_db,
             auth_manager,
@@ -454,6 +453,7 @@ impl RemoteControlWebsocket {
             let subscribe_cursor = self.state.lock().await.subscribe_cursor.clone();
             let connect_options = RemoteControlConnectOptions {
                 installation_id: &self.installation_id,
+                server_name: &self.server_name,
                 subscribe_cursor: subscribe_cursor.as_deref(),
                 app_server_client_name,
             };
@@ -1076,7 +1076,10 @@ pub(super) async fn connect_remote_control_websocket(
         if let Some(loaded_enrollment) = loaded_enrollment.as_ref() {
             status_publisher.publish_environment_id(Some(loaded_enrollment.environment_id.clone()));
         }
-        *enrollment = loaded_enrollment;
+        *enrollment = loaded_enrollment.map(|mut enrollment| {
+            enrollment.server_name = connect_options.server_name.to_string();
+            enrollment
+        });
     }
 
     if enrollment.is_none() {
@@ -1088,6 +1091,7 @@ pub(super) async fn connect_remote_control_websocket(
             remote_control_target,
             &auth,
             connect_options.installation_id,
+            connect_options.server_name,
         )
         .await
         {
@@ -1279,6 +1283,7 @@ mod tests {
     ) {
         let (status_tx, status_rx) = watch::channel(RemoteControlStatusChangedNotification {
             status: RemoteControlConnectionStatus::Connecting,
+            server_name: "test-server".to_string(),
             installation_id: TEST_INSTALLATION_ID.to_string(),
             environment_id: None,
         });
@@ -1386,6 +1391,7 @@ mod tests {
             &mut enrollment,
             RemoteControlConnectOptions {
                 installation_id: TEST_INSTALLATION_ID,
+                server_name: "test-server",
                 subscribe_cursor: None,
                 app_server_client_name: None,
             },
@@ -1403,6 +1409,7 @@ mod tests {
             status_rx.borrow().clone(),
             RemoteControlStatusChangedNotification {
                 status: RemoteControlConnectionStatus::Connecting,
+                server_name: "test-server".to_string(),
                 installation_id: TEST_INSTALLATION_ID.to_string(),
                 environment_id: Some("env_test".to_string()),
             }
@@ -1464,6 +1471,7 @@ mod tests {
             &mut enrollment,
             RemoteControlConnectOptions {
                 installation_id: TEST_INSTALLATION_ID,
+                server_name: "test-server",
                 subscribe_cursor: None,
                 app_server_client_name: None,
             },
@@ -1477,6 +1485,7 @@ mod tests {
             status_rx.borrow().clone(),
             RemoteControlStatusChangedNotification {
                 status: RemoteControlConnectionStatus::Connecting,
+                server_name: "test-server".to_string(),
                 installation_id: TEST_INSTALLATION_ID.to_string(),
                 environment_id: Some("env_test".to_string()),
             }
@@ -1546,6 +1555,7 @@ mod tests {
             &mut enrollment,
             RemoteControlConnectOptions {
                 installation_id: TEST_INSTALLATION_ID,
+                server_name: "test-server",
                 subscribe_cursor: None,
                 app_server_client_name: None,
             },
@@ -1599,6 +1609,7 @@ mod tests {
             &mut enrollment,
             RemoteControlConnectOptions {
                 installation_id: TEST_INSTALLATION_ID,
+                server_name: "test-server",
                 subscribe_cursor: None,
                 app_server_client_name: None,
             },
@@ -1647,6 +1658,7 @@ mod tests {
             &mut enrollment,
             RemoteControlConnectOptions {
                 installation_id: TEST_INSTALLATION_ID,
+                server_name: "test-server",
                 subscribe_cursor: None,
                 app_server_client_name: None,
             },
@@ -1665,6 +1677,7 @@ mod tests {
             status_rx.borrow().clone(),
             RemoteControlStatusChangedNotification {
                 status: RemoteControlConnectionStatus::Connecting,
+                server_name: "test-server".to_string(),
                 installation_id: TEST_INSTALLATION_ID.to_string(),
                 environment_id: None,
             }
@@ -1694,6 +1707,7 @@ mod tests {
                         remote_control_url,
                         installation_id: TEST_INSTALLATION_ID.to_string(),
                         remote_control_target: Some(remote_control_target),
+                        server_name: "test-server".to_string(),
                     },
                     /*state_db*/ None,
                     remote_control_auth_manager(),
@@ -1738,6 +1752,7 @@ mod tests {
             status_rx.borrow().clone(),
             RemoteControlStatusChangedNotification {
                 status: RemoteControlConnectionStatus::Connecting,
+                server_name: "test-server".to_string(),
                 installation_id: TEST_INSTALLATION_ID.to_string(),
                 environment_id: Some("env_first".to_string()),
             }
@@ -1759,6 +1774,7 @@ mod tests {
             status_rx.borrow().clone(),
             RemoteControlStatusChangedNotification {
                 status: RemoteControlConnectionStatus::Connected,
+                server_name: "test-server".to_string(),
                 installation_id: TEST_INSTALLATION_ID.to_string(),
                 environment_id: Some("env_first".to_string()),
             }
@@ -1773,6 +1789,7 @@ mod tests {
             status_rx.borrow().clone(),
             RemoteControlStatusChangedNotification {
                 status: RemoteControlConnectionStatus::Connected,
+                server_name: "test-server".to_string(),
                 installation_id: TEST_INSTALLATION_ID.to_string(),
                 environment_id: None,
             }
@@ -1788,6 +1805,7 @@ mod tests {
             status_rx.borrow().clone(),
             RemoteControlStatusChangedNotification {
                 status: RemoteControlConnectionStatus::Disabled,
+                server_name: "test-server".to_string(),
                 installation_id: TEST_INSTALLATION_ID.to_string(),
                 environment_id: None,
             }
diff --git a/codex-rs/app-server/Cargo.toml b/codex-rs/app-server/Cargo.toml
index ecc8d1c25a..95baac4e9e 100644
--- a/codex-rs/app-server/Cargo.toml
+++ b/codex-rs/app-server/Cargo.toml
@@ -42,7 +42,6 @@ codex-external-agent-migration = { workspace = true }
 codex-external-agent-sessions = { workspace = true }
 codex-features = { workspace = true }
 codex-guardian = { workspace = true }
-codex-git-attribution = { workspace = true }
 codex-git-utils = { workspace = true }
 codex-file-watcher = { workspace = true }
 codex-hooks = { workspace = true }
@@ -55,6 +54,7 @@ codex-backend-client = { workspace = true }
 codex-file-search = { workspace = true }
 codex-chatgpt = { workspace = true }
 codex-login = { workspace = true }
+codex-memories-extension = { workspace = true }
 codex-memories-write = { workspace = true }
 codex-mcp = { workspace = true }
 codex-model-provider = { workspace = true }
diff --git a/codex-rs/app-server/README.md b/codex-rs/app-server/README.md
index 8cfc5efe52..b30296dd3d 100644
--- a/codex-rs/app-server/README.md
+++ b/codex-rs/app-server/README.md
@@ -130,10 +130,10 @@ Example with notification opt-out:
 
 ## API Overview
 
-- `thread/start` — create a new thread; emits `thread/started` (including the current `thread.status`) and auto-subscribes you to turn/item events for that thread. When the request includes a `cwd` and the resolved sandbox is `workspace-write` or full access, app-server also marks that project as trusted in the user `config.toml`. Pass `sessionStartSource: "clear"` when starting a replacement thread after clearing the current session so `SessionStart` hooks receive `source: "clear"` instead of the default `"startup"`. For permissions, prefer experimental `permissions` profile selection; the legacy `sandbox` shorthand is still accepted but cannot be combined with `permissions`. Experimental `environments` selects the sticky execution environments for turns on the thread; omit it to use the server default, pass `[]` to disable environments, or pass explicit environment ids with per-environment `cwd`.
+- `thread/start` — create a new thread; emits `thread/started` (including the current `thread.status`) and auto-subscribes you to turn/item events for that thread. When the request includes a `cwd` and the resolved sandbox is `workspace-write` or full access, app-server also marks that project as trusted in the user `config.toml`. Pass `sessionStartSource: "clear"` when starting a replacement thread after clearing the current session so `SessionStart` hooks receive `source: "clear"` instead of the default `"startup"`. Experimental `runtimeWorkspaceRoots` replaces the thread-scoped runtime workspace roots used to materialize `:workspace_roots`; relative paths resolve against the effective thread cwd. For permissions, prefer experimental `permissions` profile selection by id; the legacy `sandbox` shorthand is still accepted but cannot be combined with `permissions`. Experimental `environments` selects the sticky execution environments for turns on the thread; omit it to use the server default, pass `[]` to disable environments, or pass explicit environment ids with per-environment `cwd`.
 - `thread/resume` — reopen an existing thread by id so subsequent `turn/start` calls append to it. Accepts the same permission override rules as `thread/start`.
 - `thread/fork` — fork an existing thread into a new thread id by copying the stored history; if the source thread is currently mid-turn, the fork records the same interruption marker as `turn/interrupt` instead of inheriting an unmarked partial turn suffix. The returned `thread.forkedFromId` points at the source thread when known. Accepts `ephemeral: true` for an in-memory temporary fork, emits `thread/started` (including the current `thread.status`), and auto-subscribes you to turn/item events for the new thread. Experimental clients can pass `excludeTurns: true` when they plan to page fork history via `thread/turns/list` instead of receiving the full turn array immediately. Accepts the same permission override rules as `thread/start`.
-- `thread/start`, `thread/resume`, and `thread/fork` responses include the legacy `sandbox` compatibility projection. Experimental clients can read response `permissionProfile` for the exact active runtime permissions and `activePermissionProfile` for the named or implicit built-in profile identity/provenance when known.
+- `thread/start`, `thread/resume`, and `thread/fork` responses include the legacy `sandbox` compatibility projection. Experimental clients can read `runtimeWorkspaceRoots` for the thread-scoped runtime roots and `activePermissionProfile` for the named or implicit built-in profile identity/provenance when known.
 - `thread/list` — page through stored rollouts; supports cursor-based pagination and optional `modelProviders`, `sourceKinds`, `archived`, `cwd`, and `searchTerm` filters. Each returned `thread` includes `status` (`ThreadStatus`), defaulting to `notLoaded` when the thread is not currently loaded.
 - `thread/loaded/list` — list the thread ids currently loaded in memory.
 - `thread/read` — read a stored thread by id without resuming it; optionally include turns via `includeTurns`. The returned `thread` includes `status` (`ThreadStatus`), defaulting to `notLoaded` when the thread is not currently loaded.
@@ -156,7 +156,7 @@ Example with notification opt-out:
 - `thread/shellCommand` — run a user-initiated `!` shell command against a thread; this runs unsandboxed with full access rather than inheriting the thread sandbox policy. Returns `{}` immediately while progress streams through standard turn/item notifications and any active turn receives the formatted output in its message stream.
 - `thread/backgroundTerminals/clean` — terminate all running background terminals for a thread (experimental; requires `capabilities.experimentalApi`); returns `{}` when the cleanup request is accepted.
 - `thread/rollback` — drop the last N turns from the agent’s in-memory context and persist a rollback marker in the rollout so future resumes see the pruned history; returns the updated `thread` (with `turns` populated) on success.
-- `turn/start` — add user input to a thread and begin Codex generation; responds with the initial `turn` object and streams `turn/started`, `item/*`, and `turn/completed` notifications. Prefer experimental `permissions` profile selection for permission overrides; the legacy `sandboxPolicy` field is still accepted but cannot be combined with `permissions`. For `collaborationMode`, `settings.developer_instructions: null` means "use built-in instructions for the selected mode".
+- `turn/start` — add user input to a thread and begin Codex generation; responds with the initial `turn` object and streams `turn/started`, `item/*`, and `turn/completed` notifications. Experimental `runtimeWorkspaceRoots` replaces the thread-scoped runtime workspace roots used to materialize `:workspace_roots`; relative paths resolve against the effective turn cwd. Prefer experimental `permissions` profile selection by id for permission overrides; the legacy `sandboxPolicy` field is still accepted but cannot be combined with `permissions`. For `collaborationMode`, `settings.developer_instructions: null` means "use built-in instructions for the selected mode".
 - `thread/inject_items` — append raw Responses API items to a loaded thread’s model-visible history without starting a user turn; returns `{}` on success.
 - `turn/steer` — add user input to an already in-flight regular turn without starting a new turn; returns the active `turnId` that accepted the input. Review and manual compaction turns reject `turn/steer`.
 - `turn/interrupt` — request cancellation of an in-flight turn by `(thread_id, turn_id)`; success is an empty `{}` response and the turn finishes with `status: "interrupted"`.
@@ -188,8 +188,8 @@ Example with notification opt-out:
 - `fs/changed` — notification emitted when watched paths change, including the `watchId` and `changedPaths`.
 - `model/list` — list available models (set `includeHidden: true` to include entries with `hidden: true`), with reasoning effort options, `additionalSpeedTiers`, optional legacy `upgrade` model ids, optional `upgradeInfo` metadata (`model`, `upgradeCopy`, `modelLink`, `migrationMarkdown`), and optional `availabilityNux` metadata.
 - `modelProvider/capabilities/read` — read provider-level capabilities for the currently configured model provider.
-- `experimentalFeature/list` — list feature flags with stage metadata (`beta`, `underDevelopment`, `stable`, etc.), enabled/default-enabled state, and cursor pagination. For non-beta flags, `displayName`/`description`/`announcement` are `null`.
-- `experimentalFeature/enablement/set` — patch the in-memory process-wide runtime feature enablement for the currently supported feature keys (`apps`, `memories`, `plugins`, `remote_control`, `tool_search`, `tool_suggest`, `tool_call_mcp_elicitation`). For each feature, precedence is: cloud requirements > --enable <feature_name> > config.toml > experimentalFeature/enablement/set (new) > code default.
+- `experimentalFeature/list` — list feature flags with stage metadata (`beta`, `underDevelopment`, `stable`, etc.), enabled/default-enabled state, and cursor pagination. Pass `threadId` when showing feature state for an existing loaded thread so `enabled` is computed from that thread's refreshed config, including project-local config for the thread's cwd; if omitted, the server uses its default config resolution context. For non-beta flags, `displayName`/`description`/`announcement` are `null`.
+- `experimentalFeature/enablement/set` — patch the in-memory process-wide runtime feature enablement for the currently supported feature keys (`apps`, `memories`, `plugins`, `tool_suggest`, `tool_call_mcp_elicitation`). For each feature, precedence is: cloud requirements > --enable <feature_name> > config.toml > experimentalFeature/enablement/set (new) > code default.
 - `environment/add` — experimental; add or replace a named remote environment by `environmentId` and `execServerUrl` for later selection by `thread/start` or `turn/start`; returns `{}` and does not change the default environment.
 - `collaborationMode/list` — list available collaboration mode presets (experimental, no pagination). Built-in presets do not select a model; the Plan preset selects medium reasoning effort. This response omits built-in developer instructions; clients should either pass `settings.developer_instructions: null` when setting a mode to use Codex's built-in instructions, or provide their own instructions explicitly.
 - `skills/list` — list skills for one or more `cwd` values (optional `forceReload`).
@@ -198,11 +198,15 @@ Example with notification opt-out:
 - `marketplace/remove` — remove a configured marketplace by name from the user marketplace config, and delete its installed marketplace root when one exists.
 - `marketplace/upgrade` — upgrade all configured Git plugin marketplaces, or one named marketplace when `marketplaceName` is provided. Returns selected marketplace names, upgraded roots, and per-marketplace errors.
 - `plugin/list` — list discovered plugin marketplaces and plugin state, including effective marketplace install/auth policy metadata, plugin `availability` (`AVAILABLE` by default or `DISABLED_BY_ADMIN` for remote plugins blocked upstream), fail-open `marketplaceLoadErrors` entries for marketplace files that could not be parsed or loaded, and best-effort `featuredPluginIds` for the official curated marketplace. `interface.category` uses the marketplace category when present; otherwise it falls back to the plugin manifest category (**under development; do not call from production clients yet**).
+- `plugin/installed` — list installed plugin rows plus any explicitly requested local install-suggestion plugin names, without fetching the broader remote catalog. Mention surfaces can use this narrower view when they need plugin mention payloads rather than plugin-page discovery data (**under development; do not call from production clients yet**).
 - `plugin/read` — read one plugin by `marketplacePath` plus `pluginName`, returning marketplace info, a list-style `summary`, manifest descriptions/interface metadata, and bundled skills/hooks/apps/MCP server names. Returned plugin skills include their current `enabled` state after local config filtering; bundled hooks are returned as lightweight declaration summaries keyed for correlation with `hooks/list`. Plugin app summaries also include `needsAuth` when the server can determine connector accessibility (**under development; do not call from production clients yet**).
 - `plugin/skill/read` — read remote plugin skill markdown on demand by `remoteMarketplaceName`, `remotePluginId`, and `skillName`. This lets clients preview uninstalled remote plugin skills without downloading the plugin bundle.
 - `skills/changed` — notification emitted when watched local skill files change.
 - `app/list` — list available apps.
-- `remoteControl/status/changed` — notification emitted when the remote-control status or client-visible environment id changes. `status` is one of `disabled`, `connecting`, `connected`, or `errored`; `environmentId` is a string when the app-server has a current enrollment and `null` when that enrollment is cleared, invalidated, or remote control is disabled. Newly initialized app-server clients always receive the current status snapshot.
+- `remoteControl/enable` — experimental; enable remote control for the current app-server process and return the current remote-control status snapshot. The caller is responsible for persisting the desired setting outside app-server.
+- `remoteControl/disable` — experimental; disable remote control for the current app-server process and return the current remote-control status snapshot. This does not revoke already enrolled controller devices.
+- `remoteControl/status/read` — experimental; read the current remote-control status snapshot. `status` is one of `disabled`, `connecting`, `connected`, or `errored`; `serverName` is the local machine name used by this app-server process; `environmentId` is a string when the app-server has a current enrollment and `null` when that enrollment is cleared, invalidated, or remote control is disabled.
+- `remoteControl/status/changed` — notification emitted when the remote-control status or client-visible environment id changes. `status` is one of `disabled`, `connecting`, `connected`, or `errored`; `serverName` is the local machine name used by this app-server process; `environmentId` is a string when the app-server has a current enrollment and `null` when that enrollment is cleared, invalidated, or remote control is disabled. Newly initialized app-server clients always receive the current status snapshot.
 - `skills/config/write` — write user-level skill config by name or absolute path.
 - `plugin/install` — install a plugin from a discovered marketplace entry, rejecting marketplace entries marked unavailable for install, install MCPs if any, and return the effective plugin auth policy plus any apps that still need auth (**under development; do not call from production clients yet**).
 - `plugin/uninstall` — uninstall a local plugin by `pluginId` in `<plugin>@<marketplace>` form by removing its cached files and clearing its user-level config entry, or uninstall a remote ChatGPT plugin by backend `pluginId` by forwarding the uninstall to the ChatGPT plugin backend and removing any downloaded remote-plugin cache (**under development; do not call from production clients yet**).
@@ -214,11 +218,11 @@ Example with notification opt-out:
 - `mcpServer/tool/call` — call a tool on a thread's configured MCP server by `threadId`, `server`, `tool`, optional `arguments`, and optional `_meta`, returning the MCP tool result.
 - `windowsSandbox/setupStart` — start Windows sandbox setup for the selected mode (`elevated` or `unelevated`); accepts an optional absolute `cwd` to target setup for a specific workspace, returns `{ started: true }` immediately, and later emits `windowsSandbox/setupCompleted`.
 - `feedback/upload` — submit a feedback report (classification + optional reason/logs, conversation_id, and optional `extraLogFiles` attachments array); returns the tracking thread id.
-- `config/read` — fetch the effective config on disk after resolving config layering.
+- `config/read` — fetch the effective config on disk after resolving config layering, including opaque `desktop` values stored in `config.toml`.
 - `externalAgentConfig/detect` — detect migratable external-agent artifacts with `includeHome` and optional `cwds`; each detected item includes `cwd` (`null` for home), and plugin/session migration items may additionally include structured `details` grouping plugin ids or session metadata.
 - `externalAgentConfig/import` — apply selected external-agent migration items by passing explicit `migrationItems` with `cwd` (`null` for home) and any plugin/session `details` returned by detect. When a request includes migration items, the server emits `externalAgentConfig/import/completed` once after the full import finishes (immediately after the response when everything completed synchronously, or after background imports finish).
-- `config/value/write` — write a single config key/value to the user's config.toml on disk.
-- `config/batchWrite` — apply multiple config edits atomically to the user's config.toml on disk, with optional `reloadUserConfig: true` to hot-reload loaded threads.
+- `config/value/write` — write a single config key/value to the user's config.toml on disk; dotted paths such as `desktop.someKey` use the same generic write surface.
+- `config/batchWrite` — apply multiple config edits atomically to the user's config.toml on disk, with optional `reloadUserConfig: true` to hot-reload loaded threads, including multiple `desktop.*` edits.
 - `configRequirements/read` — fetch loaded requirements constraints from `requirements.toml` and/or MDM (or `null` if none are configured), including allow-lists (`allowedApprovalPolicies`, `allowedSandboxModes`, `allowedWebSearchModes`), lifecycle hook lockdown (`allowManagedHooksOnly`), pinned feature values (`featureRequirements`), managed lifecycle hooks (`hooks`), `enforceResidency`, and `network` constraints such as canonical domain/socket permissions plus `managedAllowedDomainsOnly` and `dangerFullAccessDenylistOnly`.
 
 ### Example: Start or resume a thread
@@ -234,7 +238,9 @@ Start a fresh thread when you need a new Codex conversation.
     "approvalPolicy": "never",
     "sandbox": "workspaceWrite",
     // Prefer experimental profile selection:
-    // "permissions": { "type": "profile", "id": ":workspace" }
+    // "permissions": ":workspace"
+    // Experimental runtime roots for :workspace_roots materialization:
+    // "runtimeWorkspaceRoots": ["/Users/me/project", "/Users/me/openai"],
     // Do not send both "sandbox" and "permissions".
     "personality": "friendly",
     "serviceName": "my_app_server_client", // optional metrics tag (`service_name`)
@@ -490,7 +496,7 @@ Experimental: use `memory/reset` to clear local memory artifacts and sqlite-back
 
 ### Example: Set and update a thread goal
 
-Use `thread/goal/set` to create or update the current goal for a materialized thread. Clients can set `budgetLimited` when they stop because a token budget is exhausted or nearly exhausted; the system also sets it when accounting crosses a configured token budget.
+Use `thread/goal/set` to create or update the current goal for a materialized thread. Clients can set `budgetLimited` when they stop because a token budget is exhausted or nearly exhausted, `blocked` when progress is waiting on outside intervention, and `usageLimited` when usage availability stops further work. The system also sets `budgetLimited` when accounting crosses a configured token budget and `usageLimited` when a turn ends on a hard usage-limit error.
 
 ```json
 { "method": "thread/goal/set", "id": 27, "params": {
@@ -523,12 +529,12 @@ Use `thread/goal/set` to create or update the current goal for a materialized th
 ```json
 { "method": "thread/goal/set", "id": 28, "params": {
     "threadId": "thr_123",
-    "status": "paused"
+    "status": "blocked"
 } }
 { "id": 28, "result": { "goal": {
     "threadId": "thr_123",
     "objective": "Keep improving the benchmark until p95 latency is under 120ms",
-    "status": "paused",
+    "status": "blocked",
     "tokenBudget": 200000,
     "tokensUsed": 10000,
     "timeUsedSeconds": 60,
@@ -647,7 +653,9 @@ You can optionally specify config overrides on the new turn. If specified, these
         "networkAccess": true
     },
     // Prefer experimental profile selection:
-    // "permissions": { "type": "profile", "id": ":workspace" }
+    // "permissions": ":workspace"
+    // Experimental runtime roots for :workspace_roots materialization:
+    // "runtimeWorkspaceRoots": ["/Users/me/project", "/Users/me/openai"],
     // Do not send both "sandboxPolicy" and "permissions".
     "model": "gpt-5.1-codex",
     "effort": "medium",
@@ -711,7 +719,7 @@ Invoke an app by including `$<app-slug>` in the text input and adding a `mention
 
 ### Example: Start a turn (invoke a plugin)
 
-Invoke a plugin by including a UI mention token such as `@sample` in the text input and adding a `mention` input item with the exact `plugin://<plugin-name>@<marketplace-name>` path returned by `plugin/list`.
+Invoke a plugin by including a UI mention token such as `@sample` in the text input and adding a `mention` input item with the exact `plugin://<plugin-name>@<marketplace-name>` path returned by `plugin/installed` or `plugin/list`.
 
 ```json
 { "method": "turn/start", "id": 35, "params": {
@@ -824,7 +832,7 @@ Use `thread/backgroundTerminals/clean` to terminate all running background termi
 ### Example: Steer an active turn
 
 Use `turn/steer` to append additional user input to the currently active regular turn. This does
-not emit `turn/started` and does not accept turn context overrides.
+not emit `turn/started` and does not accept thread settings overrides.
 
 ```json
 { "method": "turn/steer", "id": 32, "params": {
@@ -919,14 +927,7 @@ Run a standalone command (argv vector) in the server’s sandbox without creatin
     "cwd": "/Users/me/project",                    // optional; defaults to server cwd
     "env": { "FOO": "override" },                  // optional; merges into the server env and overrides matching names
     "size": { "rows": 40, "cols": 120 },           // optional; PTY size in character cells, only valid with tty=true
-    "permissionProfile": {                         // optional; defaults to user config
-        "type": "managed",
-        "fileSystem": { "type": "restricted", "entries": [
-            { "path": { "type": "special", "value": { "kind": "root" } }, "access": "read" },
-            { "path": { "type": "special", "value": { "kind": "project_roots", "subpath": null } }, "access": "write" }
-        ] },
-        "network": { "enabled": false }
-    },
+    "permissionProfile": ":workspace",             // optional profile id; defaults to user config
     "outputBytesCap": 1048576,                     // optional; per-stream capture cap
     "disableOutputCap": false,                     // optional; cannot be combined with outputBytesCap
     "timeoutMs": 10000,                            // optional; ms timeout; defaults to server timeout
@@ -945,7 +946,7 @@ Run a standalone command (argv vector) in the server’s sandbox without creatin
 Notes:
 
 - Empty `command` arrays are rejected.
-- Prefer `permissionProfile` for command permission overrides. The legacy `sandboxPolicy` field accepts the same shape used by `turn/start` (e.g., `dangerFullAccess`, `readOnly`, `workspaceWrite` with flags, `externalSandbox` with `networkAccess` `restricted|enabled`), but cannot be combined with `permissionProfile`.
+- Prefer `permissionProfile` for command permission overrides. It selects an active profile by id (for example `:read-only`, `:workspace`, or a user-defined `[permissions.<id>]` profile) rather than accepting low-level filesystem/network permissions. The legacy `sandboxPolicy` field accepts the same shape used by `turn/start` (e.g., `dangerFullAccess`, `readOnly`, `workspaceWrite` with flags, `externalSandbox` with `networkAccess` `restricted|enabled`), but cannot be combined with `permissionProfile`.
 - `env` merges into the environment produced by the server's shell environment policy. Matching names are overridden; unspecified variables are left intact.
 - When omitted, `timeoutMs` falls back to the server default.
 - When omitted, `outputBytesCap` falls back to the server default of 1 MiB per stream.
@@ -1678,7 +1679,7 @@ The server also emits `app/list/updated` notifications whenever either source (a
 }
 ```
 
-Invoke an app by inserting `$<app-slug>` in the text input. The slug is derived from the app name and lowercased with non-alphanumeric characters replaced by `-` (for example, "Demo App" becomes `$demo-app`). Add a `mention` input item (recommended) so the server uses the exact `app://<connector-id>` path rather than guessing by name. Plugins use the same `mention` item shape, but with `plugin://<plugin-name>@<marketplace-name>` paths from `plugin/list`.
+Invoke an app by inserting `$<app-slug>` in the text input. The slug is derived from the app name and lowercased with non-alphanumeric characters replaced by `-` (for example, "Demo App" becomes `$demo-app`). Add a `mention` input item (recommended) so the server uses the exact `app://<connector-id>` path rather than guessing by name. Plugins use the same `mention` item shape, but with `plugin://<plugin-name>@<marketplace-name>` paths from `plugin/installed` or `plugin/list`.
 
 Example:
 
diff --git a/codex-rs/app-server/src/bespoke_event_handling.rs b/codex-rs/app-server/src/bespoke_event_handling.rs
index ddd7bf1a38..5b137c1091 100644
--- a/codex-rs/app-server/src/bespoke_event_handling.rs
+++ b/codex-rs/app-server/src/bespoke_event_handling.rs
@@ -2137,6 +2137,7 @@ mod tests {
                 images: None,
                 local_images: Vec::new(),
                 text_elements: Vec::new(),
+                ..Default::default()
             })),
             RolloutItem::EventMsg(EventMsg::AgentMessage(AgentMessageEvent {
                 message: "after rollback".to_string(),
@@ -3210,6 +3211,7 @@ mod tests {
                     images: None,
                     local_images: Vec::new(),
                     text_elements: Vec::new(),
+                    ..Default::default()
                 }),
             );
         }
diff --git a/codex-rs/app-server/src/config/external_agent_config.rs b/codex-rs/app-server/src/config/external_agent_config.rs
index 9de2c184b9..18c276f07d 100644
--- a/codex-rs/app-server/src/config/external_agent_config.rs
+++ b/codex-rs/app-server/src/config/external_agent_config.rs
@@ -507,7 +507,7 @@ impl ExternalAgentConfigService {
                 Ok(config) => {
                     let configured_plugin_ids = config
                         .config_layer_stack
-                        .get_user_layer()
+                        .get_active_user_layer()
                         .and_then(|user_layer| user_layer.config.get("plugins"))
                         .and_then(|plugins| {
                             match plugins.clone().try_into::<HashMap<String, PluginConfig>>() {
diff --git a/codex-rs/app-server/src/config/external_agent_config_tests.rs b/codex-rs/app-server/src/config/external_agent_config_tests.rs
index 8435f9baf5..07b09c5a1e 100644
--- a/codex-rs/app-server/src/config/external_agent_config_tests.rs
+++ b/codex-rs/app-server/src/config/external_agent_config_tests.rs
@@ -422,7 +422,7 @@ async fn detect_repo_skips_hooks_when_only_unsupported_hooks_exist() {
     fs::create_dir_all(repo_root.join(EXTERNAL_AGENT_DIR)).expect("create external agent dir");
     fs::write(
         repo_root.join(EXTERNAL_AGENT_DIR).join("settings.json"),
-        r#"{"hooks":{"PreToolUse":[{"matcher":"Bash","hooks":[{"type":"command","if":"Bash(rm *)","command":"echo blocked"}]}],"SubagentStart":[{"matcher":"worker","hooks":[{"type":"command","command":"echo started"}]}]}}"#,
+        r#"{"hooks":{"PreToolUse":[{"matcher":"Bash","hooks":[{"type":"command","if":"Bash(rm *)","command":"echo blocked"}]}],"UnsupportedEvent":[{"matcher":"worker","hooks":[{"type":"command","command":"echo started"}]}]}}"#,
     )
     .expect("write hooks");
 
diff --git a/codex-rs/app-server/src/config_manager.rs b/codex-rs/app-server/src/config_manager.rs
index 030829fa4b..25fdc5c0cb 100644
--- a/codex-rs/app-server/src/config_manager.rs
+++ b/codex-rs/app-server/src/config_manager.rs
@@ -30,6 +30,7 @@ pub(crate) struct ConfigManager {
     cli_overrides: Arc<RwLock<Vec<(String, TomlValue)>>>,
     runtime_feature_enablement: Arc<RwLock<BTreeMap<String, bool>>>,
     loader_overrides: LoaderOverrides,
+    strict_config: bool,
     cloud_requirements: Arc<RwLock<CloudRequirementsLoader>>,
     arg0_paths: Arg0DispatchPaths,
     thread_config_loader: Arc<RwLock<Arc<dyn ThreadConfigLoader>>>,
@@ -40,6 +41,7 @@ impl ConfigManager {
         codex_home: PathBuf,
         cli_overrides: Vec<(String, TomlValue)>,
         loader_overrides: LoaderOverrides,
+        strict_config: bool,
         cloud_requirements: CloudRequirementsLoader,
         arg0_paths: Arg0DispatchPaths,
         thread_config_loader: Arc<dyn ThreadConfigLoader>,
@@ -49,6 +51,7 @@ impl ConfigManager {
             cli_overrides: Arc::new(RwLock::new(cli_overrides)),
             runtime_feature_enablement: Arc::new(RwLock::new(BTreeMap::new())),
             loader_overrides,
+            strict_config,
             cloud_requirements: Arc::new(RwLock::new(cloud_requirements)),
             arg0_paths,
             thread_config_loader: Arc::new(RwLock::new(thread_config_loader)),
@@ -59,6 +62,10 @@ impl ConfigManager {
         self.codex_home.as_path()
     }
 
+    pub(crate) fn user_config_path(&self) -> std::io::Result<AbsolutePathBuf> {
+        self.loader_overrides.user_config_path(self.codex_home())
+    }
+
     pub(crate) fn current_cli_overrides(&self) -> Vec<(String, TomlValue)> {
         self.cli_overrides
             .read()
@@ -161,6 +168,16 @@ impl ConfigManager {
             self.current_cli_overrides(),
         )
         .await?;
+        if self.loader_overrides.user_config_path.is_some()
+            || self.loader_overrides.user_config_profile.is_some()
+        {
+            let user_config_path = self.loader_overrides.user_config_path(self.codex_home())?;
+            config.config_layer_stack = config.config_layer_stack.with_user_config_profile(
+                &user_config_path,
+                self.loader_overrides.user_config_profile.as_ref(),
+                TomlValue::Table(toml::map::Map::new()),
+            );
+        }
         self.apply_runtime_feature_enablement(&mut config);
         self.apply_arg0_paths(&mut config);
         Ok(config)
@@ -217,6 +234,7 @@ impl ConfigManager {
             .codex_home(self.codex_home.clone())
             .cli_overrides(merged_cli_overrides)
             .loader_overrides(self.loader_overrides.clone())
+            .strict_config(self.strict_config)
             .harness_overrides(typesafe_overrides)
             .fallback_cwd(fallback_cwd)
             .cloud_requirements(self.current_cloud_requirements())
@@ -245,7 +263,10 @@ impl ConfigManager {
             &self.codex_home,
             cwd,
             &self.current_cli_overrides(),
-            self.loader_overrides.clone(),
+            codex_config::ConfigLoadOptions {
+                loader_overrides: self.loader_overrides.clone(),
+                strict_config: self.strict_config,
+            },
             self.current_cloud_requirements(),
             thread_config_loader.as_ref(),
         )
@@ -280,6 +301,7 @@ impl ConfigManager {
             codex_home,
             cli_overrides,
             loader_overrides,
+            /*strict_config*/ false,
             cloud_requirements,
             Arg0DispatchPaths::default(),
             Arc::new(codex_config::NoopThreadConfigLoader),
diff --git a/codex-rs/app-server/src/config_manager_service.rs b/codex-rs/app-server/src/config_manager_service.rs
index aef4393a09..4255b83e62 100644
--- a/codex-rs/app-server/src/config_manager_service.rs
+++ b/codex-rs/app-server/src/config_manager_service.rs
@@ -196,8 +196,9 @@ impl ConfigManager {
         expected_version: Option<String>,
         edits: Vec<(String, JsonValue, MergeStrategy)>,
     ) -> Result<ConfigWriteResponse, ConfigManagerError> {
-        let allowed_path =
-            AbsolutePathBuf::resolve_path_against_base(CONFIG_TOML_FILE, self.codex_home());
+        let allowed_path = self
+            .user_config_path()
+            .map_err(|err| ConfigManagerError::io("failed to resolve user config path", err))?;
         let provided_path = match file_path {
             Some(path) => AbsolutePathBuf::from_absolute_path(PathBuf::from(path))
                 .map_err(|err| ConfigManagerError::io("failed to resolve user config path", err))?,
@@ -215,7 +216,7 @@ impl ConfigManager {
             .load_thread_agnostic_config()
             .await
             .map_err(|err| ConfigManagerError::io("failed to load configuration", err))?;
-        let user_layer = match layers.get_user_layer() {
+        let user_layer = match layers.get_active_user_layer() {
             Some(layer) => Cow::Borrowed(layer),
             None => Cow::Owned(create_empty_user_layer(&allowed_path).await?),
         };
@@ -305,7 +306,7 @@ impl ConfigManager {
         })?;
 
         if !config_edits.is_empty() {
-            ConfigEditsBuilder::new(self.codex_home())
+            ConfigEditsBuilder::for_config_path(provided_path.as_path())
                 .with_edits(config_edits)
                 .apply()
                 .await
@@ -321,7 +322,7 @@ impl ConfigManager {
         Ok(ConfigWriteResponse {
             status,
             version: updated_layers
-                .get_user_layer()
+                .get_active_user_layer()
                 .ok_or_else(|| {
                     ConfigManagerError::write(
                         ConfigWriteErrorCode::UserLayerNotFound,
@@ -375,6 +376,7 @@ async fn create_empty_user_layer(
     Ok(ConfigLayerEntry::new(
         ConfigLayerSource::User {
             file: config_toml.clone(),
+            profile: None,
         },
         toml_value,
     ))
@@ -401,10 +403,47 @@ fn parse_key_path(path: &str) -> Result<Vec<String>, String> {
     if path.trim().is_empty() {
         return Err("keyPath must not be empty".to_string());
     }
-    Ok(path
-        .split('.')
-        .map(std::string::ToString::to_string)
-        .collect())
+
+    let mut segments = Vec::new();
+    let mut segment = String::new();
+    let mut chars = path.chars();
+    let mut quoted = false;
+
+    // Split on dots unless they appear inside a quoted segment. Bare segments
+    // intentionally stay permissive so existing paths like `sample@catalog`
+    // remain valid.
+    while let Some(ch) = chars.next() {
+        match ch {
+            '"' if segment.is_empty() && !quoted => quoted = true,
+            '"' if quoted => quoted = false,
+            '\\' if quoted => {
+                // Quoted segments may escape punctuation that would otherwise
+                // participate in parsing, such as `.` or `"`.
+                let Some(escaped) = chars.next() else {
+                    return Err("unterminated escape in keyPath".to_string());
+                };
+                segment.push(escaped);
+            }
+            '.' if !quoted => {
+                if segment.is_empty() {
+                    return Err("keyPath segments must not be empty".to_string());
+                }
+                segments.push(std::mem::take(&mut segment));
+            }
+            '"' => return Err("invalid quoted keyPath segment".to_string()),
+            _ => segment.push(ch),
+        }
+    }
+
+    if quoted {
+        return Err("unterminated quoted keyPath segment".to_string());
+    }
+    if segment.is_empty() {
+        return Err("keyPath segments must not be empty".to_string());
+    }
+
+    segments.push(segment);
+    Ok(segments)
 }
 
 #[derive(Debug)]
@@ -574,7 +613,7 @@ fn override_message(layer: &ConfigLayerSource) -> String {
             dot_codex_folder.display(),
         ),
         ConfigLayerSource::SessionFlags => "Overridden by session flags".to_string(),
-        ConfigLayerSource::User { file } => {
+        ConfigLayerSource::User { file, .. } => {
             format!("Overridden by user config: {}", file.display())
         }
         ConfigLayerSource::LegacyManagedConfigTomlFromFile { file } => {
@@ -594,7 +633,7 @@ fn compute_override_metadata(
     effective: &TomlValue,
     segments: &[String],
 ) -> Option<OverriddenMetadata> {
-    let user_value = match layers.get_user_layer() {
+    let user_value = match layers.get_active_user_layer() {
         Some(user_layer) => value_at_path(&user_layer.config, segments),
         None => return None,
     };
diff --git a/codex-rs/app-server/src/config_manager_service_tests.rs b/codex-rs/app-server/src/config_manager_service_tests.rs
index e9b0b3c769..c1a081e023 100644
--- a/codex-rs/app-server/src/config_manager_service_tests.rs
+++ b/codex-rs/app-server/src/config_manager_service_tests.rs
@@ -293,7 +293,8 @@ async fn read_includes_origins_and_layers() {
     assert_eq!(
         layers.get(1).unwrap().name,
         ConfigLayerSource::User {
-            file: user_file.clone()
+            file: user_file.clone(),
+            profile: None,
         }
     );
     assert!(matches!(
@@ -454,6 +455,80 @@ async fn write_value_defaults_to_user_config_path() {
     );
 }
 
+#[tokio::test]
+async fn write_value_defaults_to_selected_user_config_path() {
+    let tmp = tempdir().expect("tempdir");
+    std::fs::write(tmp.path().join(CONFIG_TOML_FILE), "model = \"gpt-main\"").unwrap();
+    let selected_path = tmp.path().join("work.config.toml");
+    std::fs::write(&selected_path, "").unwrap();
+
+    let mut loader_overrides =
+        LoaderOverrides::with_managed_config_path_for_tests(tmp.path().join("managed_config.toml"));
+    loader_overrides.user_config_path =
+        Some(AbsolutePathBuf::from_absolute_path(&selected_path).expect("selected config path"));
+    loader_overrides.user_config_profile = Some("work".parse().expect("profile-v2 name"));
+    let service = ConfigManager::new_for_tests(
+        tmp.path().to_path_buf(),
+        vec![],
+        loader_overrides,
+        CloudRequirementsLoader::default(),
+    );
+    service
+        .write_value(ConfigValueWriteParams {
+            file_path: None,
+            key_path: "model".to_string(),
+            value: serde_json::json!("gpt-work"),
+            merge_strategy: MergeStrategy::Replace,
+            expected_version: None,
+        })
+        .await
+        .expect("write succeeds");
+
+    assert_eq!(
+        std::fs::read_to_string(&selected_path).expect("read selected config"),
+        "model = \"gpt-work\"\n"
+    );
+    assert_eq!(
+        std::fs::read_to_string(tmp.path().join(CONFIG_TOML_FILE)).expect("read main config"),
+        "model = \"gpt-main\""
+    );
+}
+
+#[tokio::test]
+async fn load_default_config_preserves_selected_user_config_path_after_load_error() {
+    let tmp = tempdir().expect("tempdir");
+    std::fs::write(tmp.path().join(CONFIG_TOML_FILE), "model = \"gpt-main\"").unwrap();
+    let selected_path = tmp.path().join("work.config.toml");
+    std::fs::write(&selected_path, "not valid toml").unwrap();
+    let selected_file =
+        AbsolutePathBuf::from_absolute_path(&selected_path).expect("selected config path");
+
+    let mut loader_overrides =
+        LoaderOverrides::with_managed_config_path_for_tests(tmp.path().join("managed_config.toml"));
+    loader_overrides.user_config_path = Some(selected_file.clone());
+    loader_overrides.user_config_profile = Some("work".parse().expect("profile-v2 name"));
+    let service = ConfigManager::new_for_tests(
+        tmp.path().to_path_buf(),
+        vec![],
+        loader_overrides,
+        CloudRequirementsLoader::default(),
+    );
+
+    service
+        .load_latest_config(/*fallback_cwd*/ None)
+        .await
+        .expect_err("selected config should fail to load");
+    let config = service
+        .load_default_config()
+        .await
+        .expect("default config loads after selected config error");
+
+    assert_eq!(
+        config.config_layer_stack.get_user_config_file(),
+        Some(&selected_file)
+    );
+}
+
 #[tokio::test]
 async fn invalid_user_value_rejected_even_if_overridden_by_managed() {
     let tmp = tempdir().expect("tempdir");
@@ -665,7 +740,10 @@ async fn read_reports_managed_overrides_user_and_session_flags() {
     assert_eq!(layers.get(1).unwrap().name, ConfigLayerSource::SessionFlags);
     assert_eq!(
         layers.get(2).unwrap().name,
-        ConfigLayerSource::User { file: user_file }
+        ConfigLayerSource::User {
+            file: user_file,
+            profile: None
+        }
     );
 }
 
diff --git a/codex-rs/app-server/src/extensions.rs b/codex-rs/app-server/src/extensions.rs
index 411685e7d8..689eae2e9d 100644
--- a/codex-rs/app-server/src/extensions.rs
+++ b/codex-rs/app-server/src/extensions.rs
@@ -17,8 +17,8 @@ where
     S: AgentSpawner<StartThreadOptions, Spawned = NewThread, Error = CodexErr> + 'static,
 {
     let mut builder = ExtensionRegistryBuilder::<Config>::new();
-    codex_git_attribution::install(&mut builder);
     codex_guardian::install(&mut builder, guardian_agent_spawner);
+    codex_memories_extension::install(&mut builder);
     Arc::new(builder.build())
 }
 
diff --git a/codex-rs/app-server/src/in_process.rs b/codex-rs/app-server/src/in_process.rs
index 29c0dae45a..c75c2d5ad1 100644
--- a/codex-rs/app-server/src/in_process.rs
+++ b/codex-rs/app-server/src/in_process.rs
@@ -119,6 +119,8 @@ pub struct InProcessStartArgs {
     pub cli_overrides: Vec<(String, TomlValue)>,
     /// Loader override knobs used by config API paths.
     pub loader_overrides: LoaderOverrides,
+    /// Whether config API paths should reject unknown config fields.
+    pub strict_config: bool,
     /// Preloaded cloud requirements provider.
     pub cloud_requirements: CloudRequirementsLoader,
     /// Loader used to fetch typed thread config sources before a thread starts.
@@ -409,6 +411,7 @@ async fn start_uninitialized(args: InProcessStartArgs) -> IoResult<InProcessClie
             args.config.codex_home.to_path_buf(),
             args.cli_overrides,
             args.loader_overrides,
+            args.strict_config,
             args.cloud_requirements,
             args.arg0_paths.clone(),
             args.thread_config_loader,
@@ -430,6 +433,7 @@ async fn start_uninitialized(args: InProcessStartArgs) -> IoResult<InProcessClie
                 auth_manager,
                 installation_id,
                 rpc_transport: AppServerRpcTransport::InProcess,
+                remote_control_handle: None,
                 plugin_startup_tasks: crate::PluginStartupTasks::Start,
             }));
             let mut thread_created_rx = processor.thread_created_receiver();
@@ -764,6 +768,7 @@ mod tests {
             config,
             cli_overrides: Vec::new(),
             loader_overrides: LoaderOverrides::default(),
+            strict_config: false,
             cloud_requirements: CloudRequirementsLoader::default(),
             thread_config_loader: Arc::new(codex_config::NoopThreadConfigLoader),
             feedback: CodexFeedback::new(),
diff --git a/codex-rs/app-server/src/lib.rs b/codex-rs/app-server/src/lib.rs
index baff7c8d49..7b7cbc11c3 100644
--- a/codex-rs/app-server/src/lib.rs
+++ b/codex-rs/app-server/src/lib.rs
@@ -41,7 +41,6 @@ use codex_analytics::AppServerRpcTransport;
 use codex_app_server_protocol::ConfigLayerSource;
 use codex_app_server_protocol::ConfigWarningNotification;
 use codex_app_server_protocol::JSONRPCMessage;
-use codex_app_server_protocol::RemoteControlStatusChangedNotification;
 use codex_app_server_protocol::ServerNotification;
 use codex_app_server_protocol::TextPosition as AppTextPosition;
 use codex_app_server_protocol::TextRange as AppTextRange;
@@ -127,7 +126,7 @@ fn configured_thread_config_loader(config: &Config) -> Arc<dyn ThreadConfigLoade
 
 /// Control-plane messages from the processor/transport side to the outbound router task.
 ///
-/// `run_main_with_transport` now uses two loops/tasks:
+/// `run_main_with_transport_options` uses two loops/tasks:
 /// - processor loop: handles incoming JSON-RPC and request dispatch
 /// - outbound loop: performs potentially slow writes to per-connection writers
 ///
@@ -374,16 +373,19 @@ pub async fn run_main(
     arg0_paths: Arg0DispatchPaths,
     cli_config_overrides: CliConfigOverrides,
     loader_overrides: LoaderOverrides,
+    strict_config: bool,
     default_analytics_enabled: bool,
 ) -> IoResult<()> {
-    run_main_with_transport(
+    run_main_with_transport_options(
         arg0_paths,
         cli_config_overrides,
         loader_overrides,
+        strict_config,
         default_analytics_enabled,
         AppServerTransport::Stdio,
         SessionSource::VSCode,
         AppServerWebsocketAuthSettings::default(),
+        AppServerRuntimeOptions::default(),
     )
     .await
 }
@@ -398,6 +400,7 @@ pub enum PluginStartupTasks {
 pub struct AppServerRuntimeOptions {
     pub plugin_startup_tasks: PluginStartupTasks,
     pub remote_control_enabled: bool,
+    pub install_shutdown_signal_handler: bool,
 }
 
 impl Default for AppServerRuntimeOptions {
@@ -405,37 +408,17 @@ impl Default for AppServerRuntimeOptions {
         Self {
             plugin_startup_tasks: PluginStartupTasks::Start,
             remote_control_enabled: false,
+            install_shutdown_signal_handler: true,
         }
     }
 }
 
-pub async fn run_main_with_transport(
-    arg0_paths: Arg0DispatchPaths,
-    cli_config_overrides: CliConfigOverrides,
-    loader_overrides: LoaderOverrides,
-    default_analytics_enabled: bool,
-    transport: AppServerTransport,
-    session_source: SessionSource,
-    auth: AppServerWebsocketAuthSettings,
-) -> IoResult<()> {
-    run_main_with_transport_options(
-        arg0_paths,
-        cli_config_overrides,
-        loader_overrides,
-        default_analytics_enabled,
-        transport,
-        session_source,
-        auth,
-        AppServerRuntimeOptions::default(),
-    )
-    .await
-}
-
 #[allow(clippy::too_many_arguments)]
 pub async fn run_main_with_transport_options(
     arg0_paths: Arg0DispatchPaths,
     cli_config_overrides: CliConfigOverrides,
     loader_overrides: LoaderOverrides,
+    strict_config: bool,
     default_analytics_enabled: bool,
     transport: AppServerTransport,
     session_source: SessionSource,
@@ -462,9 +445,9 @@ pub async fn run_main_with_transport_options(
         arg0_paths.codex_linux_sandbox_exe.clone(),
     )?;
     let environment_manager = if loader_overrides.ignore_user_config {
-        EnvironmentManager::from_env(local_runtime_paths).await
+        EnvironmentManager::from_env(Some(local_runtime_paths)).await
     } else {
-        EnvironmentManager::from_codex_home(codex_home.clone(), local_runtime_paths).await
+        EnvironmentManager::from_codex_home(codex_home.clone(), Some(local_runtime_paths)).await
     }
     .map(Arc::new)
     .map_err(std::io::Error::other)?;
@@ -472,6 +455,7 @@ pub async fn run_main_with_transport_options(
         codex_home.to_path_buf(),
         cli_kv_overrides.clone(),
         loader_overrides,
+        strict_config,
         Default::default(),
         arg0_paths.clone(),
         Arc::new(NoopThreadConfigLoader),
@@ -500,6 +484,10 @@ pub async fn run_main_with_transport_options(
     {
         Ok(config) => (config, true),
         Err(err) => {
+            if strict_config {
+                return Err(err);
+            }
+
             let message = config_warning_from_error("Invalid configuration; using defaults.", &err);
             config_warnings.push(message);
             (
@@ -528,9 +516,15 @@ pub async fn run_main_with_transport_options(
     })?;
     codex_core::otel_init::record_process_start(otel.as_ref(), OTEL_SERVICE_NAME);
     codex_core::otel_init::install_sqlite_telemetry(otel.as_ref(), OTEL_SERVICE_NAME);
-    let state_db_result = rollout_state_db::try_init(&config).await;
-    let state_db_init_error = state_db_result.as_ref().err().map(ToString::to_string);
-    let state_db = state_db_result.ok();
+    let state_db = match rollout_state_db::try_init(&config).await {
+        Ok(state_db) => Some(state_db),
+        Err(err) => {
+            return Err(std::io::Error::other(format!(
+                "failed to initialize sqlite state runtime under {}: {err}",
+                config.sqlite_home.display()
+            )));
+        }
+    };
 
     if should_run_personality_migration {
         let effective_toml = config.config_layer_stack.effective_config();
@@ -595,7 +589,7 @@ pub async fn run_main_with_transport_options(
         });
     }
     if let Some(warning) =
-        codex_core::config::system_bwrap_warning(config.permissions.permission_profile.get())
+        codex_core::config::system_bwrap_warning(config.permissions.permission_profile())
     {
         config_warnings.push(ConfigWarningNotification {
             summary: warning,
@@ -647,16 +641,13 @@ pub async fn run_main_with_transport_options(
         }
     }
     let installation_id = resolve_installation_id(&config.codex_home).await?;
-    if let Some(err) = &state_db_init_error {
-        error!("failed to initialize sqlite state db: {err}");
-    }
-
     let transport_shutdown_token = CancellationToken::new();
     let mut transport_accept_handles = Vec::<JoinHandle<()>>::new();
 
     let single_client_mode = matches!(&transport, AppServerTransport::Stdio);
     let shutdown_when_no_connections = single_client_mode;
-    let graceful_signal_restart_enabled = !single_client_mode;
+    let graceful_signal_restart_enabled =
+        runtime_options.install_shutdown_signal_handler && !single_client_mode;
     let mut app_server_client_name_rx = None;
 
     match &transport {
@@ -807,6 +798,7 @@ pub async fn run_main_with_transport_options(
             auth_manager,
             installation_id,
             rpc_transport: analytics_rpc_transport(&transport),
+            remote_control_handle: Some(remote_control_handle.clone()),
             plugin_startup_tasks: runtime_options.plugin_startup_tasks,
         }));
         let mut thread_created_rx = processor.thread_created_receiver();
@@ -1012,14 +1004,9 @@ pub async fn run_main_with_transport_options(
                             continue;
                         }
                         remote_control_status = status.clone();
+                        let notification = ServerNotification::RemoteControlStatusChanged(status);
                         initialize_notification_sender
-                            .send_server_notification(ServerNotification::RemoteControlStatusChanged(
-                                RemoteControlStatusChangedNotification {
-                                    status: status.status,
-                                    installation_id: status.installation_id,
-                                    environment_id: status.environment_id,
-                                },
-                            ))
+                            .send_server_notification(notification)
                             .await;
                     }
                     created = thread_created_rx.recv(), if listen_for_threads => {
diff --git a/codex-rs/app-server/src/main.rs b/codex-rs/app-server/src/main.rs
index 31a017d17c..6f5ecabf90 100644
--- a/codex-rs/app-server/src/main.rs
+++ b/codex-rs/app-server/src/main.rs
@@ -39,6 +39,10 @@ struct AppServerArgs {
     #[command(flatten)]
     auth: AppServerWebsocketAuthArgs,
 
+    /// Fail if config.toml contains unknown configuration fields.
+    #[arg(long = "strict-config", default_value_t = false)]
+    strict_config: bool,
+
     /// Hidden debug-only test hook used by integration tests that spawn the
     /// production app-server binary.
     #[cfg(debug_assertions)]
@@ -52,7 +56,15 @@ struct AppServerArgs {
 
 fn main() -> anyhow::Result<()> {
     arg0_dispatch_or_else(|arg0_paths: Arg0DispatchPaths| async move {
-        let args = AppServerArgs::parse();
+        let AppServerArgs {
+            listen,
+            session_source,
+            auth,
+            strict_config,
+            #[cfg(debug_assertions)]
+            disable_plugin_startup_tasks_for_tests,
+            remote_control,
+        } = AppServerArgs::parse();
         let loader_overrides = if disable_managed_config_from_debug_env() {
             LoaderOverrides::without_managed_config_for_tests()
         } else {
@@ -60,20 +72,20 @@ fn main() -> anyhow::Result<()> {
                 .map(LoaderOverrides::with_managed_config_path_for_tests)
                 .unwrap_or_default()
         };
-        let transport = args.listen;
-        let session_source = args.session_source;
-        let auth = args.auth.try_into_settings()?;
+        let transport = listen;
+        let auth = auth.try_into_settings()?;
         let mut runtime_options = AppServerRuntimeOptions::default();
         #[cfg(debug_assertions)]
-        if args.disable_plugin_startup_tasks_for_tests {
+        if disable_plugin_startup_tasks_for_tests {
             runtime_options.plugin_startup_tasks = PluginStartupTasks::Skip;
         }
-        runtime_options.remote_control_enabled = args.remote_control;
+        runtime_options.remote_control_enabled = remote_control;
 
         run_main_with_transport_options(
             arg0_paths,
             CliConfigOverrides::default(),
             loader_overrides,
+            strict_config,
             /*default_analytics_enabled*/ false,
             transport,
             session_source,
diff --git a/codex-rs/app-server/src/mcp_refresh.rs b/codex-rs/app-server/src/mcp_refresh.rs
index 31a6f4afd8..f7d32b2ea8 100644
--- a/codex-rs/app-server/src/mcp_refresh.rs
+++ b/codex-rs/app-server/src/mcp_refresh.rs
@@ -207,6 +207,7 @@ mod tests {
             temp_dir.path().to_path_buf(),
             Vec::new(),
             LoaderOverrides::without_managed_config_for_tests(),
+            /*strict_config*/ false,
             CloudRequirementsLoader::default(),
             Arg0DispatchPaths::default(),
             loader.clone(),
diff --git a/codex-rs/app-server/src/message_processor.rs b/codex-rs/app-server/src/message_processor.rs
index 86a3de09e9..fdcd44d01a 100644
--- a/codex-rs/app-server/src/message_processor.rs
+++ b/codex-rs/app-server/src/message_processor.rs
@@ -7,6 +7,7 @@ use std::sync::atomic::AtomicBool;
 use crate::attestation::app_server_attestation_provider;
 use crate::config_manager::ConfigManager;
 use crate::connection_rpc_gate::ConnectionRpcGate;
+use crate::error_code::internal_error;
 use crate::error_code::invalid_request;
 use crate::extensions::guardian_agent_spawner;
 use crate::extensions::thread_extensions;
@@ -30,6 +31,7 @@ use crate::request_processors::MarketplaceRequestProcessor;
 use crate::request_processors::McpRequestProcessor;
 use crate::request_processors::PluginRequestProcessor;
 use crate::request_processors::ProcessExecRequestProcessor;
+use crate::request_processors::RemoteControlRequestProcessor;
 use crate::request_processors::SearchRequestProcessor;
 use crate::request_processors::ThreadGoalRequestProcessor;
 use crate::request_processors::ThreadRequestProcessor;
@@ -42,6 +44,7 @@ use crate::skills_watcher::SkillsWatcher;
 use crate::thread_state::ConnectionCapabilities;
 use crate::thread_state::ThreadStateManager;
 use crate::transport::AppServerTransport;
+use crate::transport::RemoteControlHandle;
 use async_trait::async_trait;
 use codex_analytics::AnalyticsEventsClient;
 use codex_analytics::AppServerRpcTransport;
@@ -163,15 +166,17 @@ pub(crate) struct MessageProcessor {
     command_exec_processor: CommandExecRequestProcessor,
     process_exec_processor: ProcessExecRequestProcessor,
     config_processor: ConfigRequestProcessor,
+    environment_manager: Arc<EnvironmentManager>,
     environment_processor: EnvironmentRequestProcessor,
     external_agent_config_processor: ExternalAgentConfigRequestProcessor,
     feedback_processor: FeedbackRequestProcessor,
-    fs_processor: FsRequestProcessor,
+    fs_processor: Option<FsRequestProcessor>,
     git_processor: GitRequestProcessor,
     initialize_processor: InitializeRequestProcessor,
     marketplace_processor: MarketplaceRequestProcessor,
     mcp_processor: McpRequestProcessor,
     plugin_processor: PluginRequestProcessor,
+    remote_control_processor: RemoteControlRequestProcessor,
     search_processor: SearchRequestProcessor,
     thread_goal_processor: ThreadGoalRequestProcessor,
     thread_processor: ThreadRequestProcessor,
@@ -264,10 +269,28 @@ pub(crate) struct MessageProcessorArgs {
     pub(crate) auth_manager: Arc<AuthManager>,
     pub(crate) installation_id: String,
     pub(crate) rpc_transport: AppServerRpcTransport,
+    pub(crate) remote_control_handle: Option<RemoteControlHandle>,
     pub(crate) plugin_startup_tasks: crate::PluginStartupTasks,
 }
 
 impl MessageProcessor {
+    fn fs_processor(&self) -> Result<&FsRequestProcessor, JSONRPCErrorError> {
+        self.fs_processor
+            .as_ref()
+            .ok_or_else(|| internal_error("local filesystem is not configured"))
+    }
+
+    fn require_local_environment(&self) -> Result<(), JSONRPCErrorError> {
+        // CCA filters these local-only RPCs before they reach app-server, but
+        // keep a Codex-side backstop so no-local app-server modes fail safely
+        // if a client still invokes one directly.
+        self.environment_manager
+            .try_local_environment()
+            .is_some()
+            .then_some(())
+            .ok_or_else(|| internal_error("local environment is not configured"))
+    }
+
     /// Create a new `MessageProcessor`, retaining a handle to the outgoing
     /// `Sender` so handlers can enqueue messages to be written to stdout.
     pub(crate) fn new(args: MessageProcessorArgs) -> Self {
@@ -286,6 +309,7 @@ impl MessageProcessor {
             auth_manager,
             installation_id,
             rpc_transport,
+            remote_control_handle,
             plugin_startup_tasks,
         } = args;
         auth_manager.set_external_auth(Arc::new(ExternalAuthRefreshBridge {
@@ -296,6 +320,7 @@ impl MessageProcessor {
         // affect per-thread behavior, but they must not move newly started,
         // resumed, or forked threads to a different persistence backend/root.
         let thread_store = codex_core::thread_store_from_config(config.as_ref(), state_db.clone());
+        let environment_manager_for_requests = Arc::clone(&environment_manager);
         let thread_manager = Arc::new_cyclic(|thread_manager| {
             ThreadManager::new(
                 config.as_ref(),
@@ -349,6 +374,7 @@ impl MessageProcessor {
             arg0_paths.clone(),
             Arc::clone(&config),
             outgoing.clone(),
+            config_manager.clone(),
         );
         let process_exec_processor = ProcessExecRequestProcessor::new(outgoing.clone());
         let feedback_processor = FeedbackRequestProcessor::new(
@@ -386,6 +412,7 @@ impl MessageProcessor {
             config_manager.clone(),
             workspace_settings_cache,
         );
+        let remote_control_processor = RemoteControlRequestProcessor::new(remote_control_handle);
         let search_processor = SearchRequestProcessor::new(outgoing.clone());
         let thread_goal_processor = ThreadGoalRequestProcessor::new(
             Arc::clone(&thread_manager),
@@ -436,7 +463,6 @@ impl MessageProcessor {
                     Some(on_effective_plugins_changed),
                 );
         }
-        let fs_watch_manager = FsWatchManager::new(outgoing.clone());
         let config_processor = ConfigRequestProcessor::new(
             outgoing.clone(),
             config_manager.clone(),
@@ -454,13 +480,17 @@ impl MessageProcessor {
         );
         let environment_processor =
             EnvironmentRequestProcessor::new(thread_manager.environment_manager());
-        let fs_processor = FsRequestProcessor::new(
-            thread_manager
-                .environment_manager()
-                .local_environment()
-                .get_filesystem(),
-            fs_watch_manager,
-        );
+        // `fs/*` is a local-host filesystem surface. Do not construct it when
+        // the manager intentionally has no local environment.
+        let fs_processor = thread_manager
+            .environment_manager()
+            .try_local_environment()
+            .map(|environment| {
+                FsRequestProcessor::new(
+                    environment.get_filesystem(),
+                    FsWatchManager::new(outgoing.clone()),
+                )
+            });
         let windows_sandbox_processor = WindowsSandboxRequestProcessor::new(
             outgoing.clone(),
             Arc::clone(&config),
@@ -475,6 +505,7 @@ impl MessageProcessor {
             command_exec_processor,
             process_exec_processor,
             config_processor,
+            environment_manager: environment_manager_for_requests,
             environment_processor,
             external_agent_config_processor,
             feedback_processor,
@@ -484,6 +515,7 @@ impl MessageProcessor {
             marketplace_processor,
             mcp_processor,
             plugin_processor,
+            remote_control_processor,
             search_processor,
             thread_goal_processor,
             thread_processor,
@@ -697,7 +729,9 @@ impl MessageProcessor {
     ) {
         session_state.rpc_gate.shutdown().await;
         self.outgoing.connection_closed(connection_id).await;
-        self.fs_processor.connection_closed(connection_id).await;
+        if let Some(fs_processor) = &self.fs_processor {
+            fs_processor.connection_closed(connection_id).await;
+        }
         self.command_exec_processor
             .connection_closed(connection_id)
             .await;
@@ -882,6 +916,18 @@ impl MessageProcessor {
                     .experimental_feature_enablement_set(request_id.clone(), params)
                     .await
             }
+            ClientRequest::RemoteControlEnable { .. } => self
+                .remote_control_processor
+                .enable()
+                .map(|response| Some(response.into())),
+            ClientRequest::RemoteControlDisable { .. } => self
+                .remote_control_processor
+                .disable()
+                .map(|response| Some(response.into())),
+            ClientRequest::RemoteControlStatusRead { .. } => self
+                .remote_control_processor
+                .status_read()
+                .map(|response| Some(response.into())),
             ClientRequest::ConfigRequirementsRead { params: _, .. } => self
                 .config_processor
                 .config_requirements_read()
@@ -891,47 +937,47 @@ impl MessageProcessor {
                 self.environment_processor.environment_add(params).await
             }
             ClientRequest::FsReadFile { params, .. } => self
-                .fs_processor
+                .fs_processor()?
                 .read_file(params)
                 .await
                 .map(|response| Some(response.into())),
             ClientRequest::FsWriteFile { params, .. } => self
-                .fs_processor
+                .fs_processor()?
                 .write_file(params)
                 .await
                 .map(|response| Some(response.into())),
             ClientRequest::FsCreateDirectory { params, .. } => self
-                .fs_processor
+                .fs_processor()?
                 .create_directory(params)
                 .await
                 .map(|response| Some(response.into())),
             ClientRequest::FsGetMetadata { params, .. } => self
-                .fs_processor
+                .fs_processor()?
                 .get_metadata(params)
                 .await
                 .map(|response| Some(response.into())),
             ClientRequest::FsReadDirectory { params, .. } => self
-                .fs_processor
+                .fs_processor()?
                 .read_directory(params)
                 .await
                 .map(|response| Some(response.into())),
             ClientRequest::FsRemove { params, .. } => self
-                .fs_processor
+                .fs_processor()?
                 .remove(params)
                 .await
                 .map(|response| Some(response.into())),
             ClientRequest::FsCopy { params, .. } => self
-                .fs_processor
+                .fs_processor()?
                 .copy(params)
                 .await
                 .map(|response| Some(response.into())),
             ClientRequest::FsWatch { params, .. } => self
-                .fs_processor
+                .fs_processor()?
                 .watch(connection_id, params)
                 .await
                 .map(|response| Some(response.into())),
             ClientRequest::FsUnwatch { params, .. } => self
-                .fs_processor
+                .fs_processor()?
                 .unwatch(connection_id, params)
                 .await
                 .map(|response| Some(response.into())),
@@ -1082,6 +1128,9 @@ impl MessageProcessor {
             ClientRequest::PluginList { params, .. } => {
                 self.plugin_processor.plugin_list(params).await
             }
+            ClientRequest::PluginInstalled { params, .. } => {
+                self.plugin_processor.plugin_installed(params).await
+            }
             ClientRequest::PluginRead { params, .. } => {
                 self.plugin_processor.plugin_read(params).await
             }
@@ -1257,6 +1306,7 @@ impl MessageProcessor {
                 .await
                 .map(|response| Some(response.into())),
             ClientRequest::OneOffCommandExec { params, .. } => {
+                self.require_local_environment()?;
                 self.command_exec_processor
                     .one_off_command_exec(&request_id, params)
                     .await
@@ -1276,11 +1326,13 @@ impl MessageProcessor {
                     .command_exec_terminate(request_id.clone(), params)
                     .await
             }
-            ClientRequest::ProcessSpawn { params, .. } => self
-                .process_exec_processor
-                .process_spawn(request_id.clone(), params)
-                .await
-                .map(|()| None),
+            ClientRequest::ProcessSpawn { params, .. } => {
+                self.require_local_environment()?;
+                self.process_exec_processor
+                    .process_spawn(request_id.clone(), params)
+                    .await
+                    .map(|()| None)
+            }
             ClientRequest::ProcessWriteStdin { params, .. } => {
                 self.process_exec_processor
                     .process_write_stdin(request_id.clone(), params)
diff --git a/codex-rs/app-server/src/message_processor_tracing_tests.rs b/codex-rs/app-server/src/message_processor_tracing_tests.rs
index 452991270a..a9625d3086 100644
--- a/codex-rs/app-server/src/message_processor_tracing_tests.rs
+++ b/codex-rs/app-server/src/message_processor_tracing_tests.rs
@@ -239,6 +239,7 @@ async fn build_test_processor(
         config.codex_home.to_path_buf(),
         Vec::new(),
         LoaderOverrides::default(),
+        /*strict_config*/ false,
         CloudRequirementsLoader::default(),
         Arg0DispatchPaths::default(),
         Arc::new(codex_config::NoopThreadConfigLoader),
@@ -264,6 +265,7 @@ async fn build_test_processor(
         auth_manager,
         installation_id: "11111111-1111-4111-8111-111111111111".to_string(),
         rpc_transport: AppServerRpcTransport::Stdio,
+        remote_control_handle: None,
         plugin_startup_tasks: crate::PluginStartupTasks::Start,
     }));
     (processor, outgoing_rx)
@@ -657,6 +659,7 @@ async fn turn_start_jsonrpc_span_parents_core_turn_spans() -> Result<()> {
                     }],
                     responsesapi_client_metadata: None,
                     cwd: None,
+                    runtime_workspace_roots: None,
                     approval_policy: None,
                     sandbox_policy: None,
                     permissions: None,
diff --git a/codex-rs/app-server/src/request_processors.rs b/codex-rs/app-server/src/request_processors.rs
index cf68f638ba..3e84c397f8 100644
--- a/codex-rs/app-server/src/request_processors.rs
+++ b/codex-rs/app-server/src/request_processors.rs
@@ -103,11 +103,11 @@ use codex_app_server_protocol::MockExperimentalMethodParams;
 use codex_app_server_protocol::MockExperimentalMethodResponse;
 use codex_app_server_protocol::ModelListParams;
 use codex_app_server_protocol::ModelListResponse;
-use codex_app_server_protocol::PermissionProfileModificationParams;
-use codex_app_server_protocol::PermissionProfileSelectionParams;
 use codex_app_server_protocol::PluginDetail;
 use codex_app_server_protocol::PluginInstallParams;
 use codex_app_server_protocol::PluginInstallResponse;
+use codex_app_server_protocol::PluginInstalledParams;
+use codex_app_server_protocol::PluginInstalledResponse;
 use codex_app_server_protocol::PluginInterface;
 use codex_app_server_protocol::PluginListMarketplaceKind;
 use codex_app_server_protocol::PluginListParams;
@@ -259,7 +259,7 @@ use codex_config::ConfigLayerStack;
 use codex_config::loader::project_trust_key;
 use codex_config::types::McpServerTransportConfig;
 use codex_core::CodexThread;
-use codex_core::CodexThreadTurnContextOverrides;
+use codex_core::CodexThreadSettingsOverrides;
 use codex_core::ExternalGoalPreviousStatus;
 use codex_core::ExternalGoalSet;
 use codex_core::ForkSnapshot;
@@ -275,6 +275,7 @@ use codex_core::config::ConfigOverrides;
 use codex_core::config::NetworkProxyAuditMetadata;
 use codex_core::config::edit::ConfigEdit;
 use codex_core::config::edit::ConfigEditsBuilder;
+use codex_core::connectors::AccessibleConnectorsStatus;
 use codex_core::exec::ExecCapturePolicy;
 use codex_core::exec::ExecExpiration;
 use codex_core::exec::ExecParams;
@@ -357,6 +358,7 @@ use codex_protocol::error::Result as CodexResult;
 #[cfg(test)]
 use codex_protocol::items::TurnItem;
 use codex_protocol::models::ResponseItem;
+#[cfg(test)]
 use codex_protocol::permissions::FileSystemSandboxPolicy;
 use codex_protocol::protocol::AgentStatus;
 use codex_protocol::protocol::ConversationAudioParams;
@@ -439,6 +441,7 @@ mod command_exec_processor;
 mod config_processor;
 mod environment_processor;
 mod external_agent_config_processor;
+mod feedback_doctor_report;
 mod feedback_processor;
 mod fs_processor;
 mod git_processor;
@@ -447,6 +450,7 @@ mod marketplace_processor;
 mod mcp_processor;
 mod plugins;
 mod process_exec_processor;
+mod remote_control_processor;
 mod search;
 mod thread_processor;
 mod token_usage_replay;
@@ -468,6 +472,7 @@ pub(crate) use marketplace_processor::MarketplaceRequestProcessor;
 pub(crate) use mcp_processor::McpRequestProcessor;
 pub(crate) use plugins::PluginRequestProcessor;
 pub(crate) use process_exec_processor::ProcessExecRequestProcessor;
+pub(crate) use remote_control_processor::RemoteControlRequestProcessor;
 pub(crate) use search::SearchRequestProcessor;
 pub(crate) use thread_goal_processor::ThreadGoalRequestProcessor;
 pub(crate) use thread_processor::ThreadRequestProcessor;
diff --git a/codex-rs/app-server/src/request_processors/account_processor.rs b/codex-rs/app-server/src/request_processors/account_processor.rs
index f32f87ed15..17d78fb20b 100644
--- a/codex-rs/app-server/src/request_processors/account_processor.rs
+++ b/codex-rs/app-server/src/request_processors/account_processor.rs
@@ -570,11 +570,11 @@ impl AccountRequestProcessor {
             }
         }
 
-        if let Some(expected_workspace) = self.config.forced_chatgpt_workspace_id.as_deref()
-            && chatgpt_account_id != expected_workspace
+        if let Some(expected_workspaces) = self.config.forced_chatgpt_workspace_id.as_deref()
+            && !expected_workspaces.contains(&chatgpt_account_id)
         {
             return Err(invalid_request(format!(
-                "External auth must use workspace {expected_workspace}, but received {chatgpt_account_id:?}."
+                "External auth must use one of workspace(s) {expected_workspaces:?}, but received {chatgpt_account_id:?}.",
             )));
         }
 
diff --git a/codex-rs/app-server/src/request_processors/apps_processor.rs b/codex-rs/app-server/src/request_processors/apps_processor.rs
index da2956dbab..caf60a91a0 100644
--- a/codex-rs/app-server/src/request_processors/apps_processor.rs
+++ b/codex-rs/app-server/src/request_processors/apps_processor.rs
@@ -41,11 +41,19 @@ impl AppsRequestProcessor {
         request_id: &ConnectionRequestId,
         params: AppsListParams,
     ) -> Result<Option<AppsListResponse>, JSONRPCErrorError> {
-        let mut config = self.load_latest_config(/*fallback_cwd*/ None).await?;
-
-        if let Some(thread_id) = params.thread_id.as_deref() {
-            let (_, thread) = self.load_thread(thread_id).await?;
+        let thread = if let Some(thread_id) = params.thread_id.as_deref() {
+            let (_, loaded_thread) = self.load_thread(thread_id).await?;
+            Some(loaded_thread)
+        } else {
+            None
+        };
+        let fallback_cwd = match thread.as_ref() {
+            Some(thread) => Some(thread.config_snapshot().await.cwd.to_path_buf()),
+            None => None,
+        };
+        let mut config = self.load_latest_config(fallback_cwd).await?;
 
+        if let Some(thread) = thread {
             let _ = config
                 .features
                 .set_enabled(Feature::Apps, thread.enabled(Feature::Apps));
@@ -88,8 +96,31 @@ impl AppsRequestProcessor {
         config: Config,
         environment_manager: Arc<EnvironmentManager>,
     ) {
+        let retry_params = params.clone();
+        let retry_config = config.clone();
+        let retry_environment_manager = Arc::clone(&environment_manager);
         let result = Self::apps_list_response(&outgoing, params, config, environment_manager).await;
-        outgoing.send_result(request_id, result).await;
+        let should_retry = result
+            .as_ref()
+            .is_ok_and(|(_, codex_apps_ready)| !codex_apps_ready);
+        outgoing
+            .send_result(request_id, result.map(|(response, _)| response))
+            .await;
+
+        if should_retry && !retry_params.force_refetch {
+            let mut retry_params = retry_params;
+            retry_params.force_refetch = true;
+            if let Err(err) = Self::apps_list_response(
+                &outgoing,
+                retry_params,
+                retry_config,
+                retry_environment_manager,
+            )
+            .await
+            {
+                warn!("failed to refresh app list after codex-apps readiness retry: {err:?}");
+            }
+        }
     }
 
     async fn apps_list_response(
@@ -97,7 +128,7 @@ impl AppsRequestProcessor {
         params: AppsListParams,
         config: Config,
         environment_manager: Arc<EnvironmentManager>,
-    ) -> Result<AppsListResponse, JSONRPCErrorError> {
+    ) -> Result<(AppsListResponse, bool), JSONRPCErrorError> {
         let AppsListParams {
             cursor,
             limit,
@@ -130,7 +161,6 @@ impl AppsRequestProcessor {
                     &environment_manager,
                 )
                 .await
-                .map(|status| status.connectors)
                 .map_err(|err| format!("failed to load accessible apps: {err}"));
             let _ = accessible_tx.send(AppListLoadResult::Accessible(result));
         });
@@ -146,6 +176,7 @@ impl AppsRequestProcessor {
         let app_list_deadline = tokio::time::Instant::now() + APP_LIST_LOAD_TIMEOUT;
         let mut accessible_loaded = false;
         let mut all_loaded = false;
+        let mut codex_apps_ready = true;
         let mut last_notified_apps = None;
 
         if accessible_connectors.is_some() || all_connectors.is_some() {
@@ -178,9 +209,10 @@ impl AppsRequestProcessor {
             };
 
             match result {
-                AppListLoadResult::Accessible(Ok(connectors)) => {
-                    accessible_connectors = Some(connectors);
+                AppListLoadResult::Accessible(Ok(status)) => {
+                    accessible_connectors = Some(status.connectors);
                     accessible_loaded = true;
+                    codex_apps_ready = status.codex_apps_ready;
                 }
                 AppListLoadResult::Accessible(Err(err)) => {
                     return Err(internal_error(err));
@@ -222,7 +254,8 @@ impl AppsRequestProcessor {
             }
 
             if accessible_loaded && all_loaded {
-                return paginate_apps(merged.as_slice(), start, limit);
+                let response = paginate_apps(merged.as_slice(), start, limit)?;
+                return Ok((response, codex_apps_ready));
             }
         }
     }
@@ -279,7 +312,7 @@ impl AppsRequestProcessor {
 const APP_LIST_LOAD_TIMEOUT: Duration = Duration::from_secs(90);
 
 enum AppListLoadResult {
-    Accessible(Result<Vec<AppInfo>, String>),
+    Accessible(Result<AccessibleConnectorsStatus, String>),
     Directory(Result<Vec<AppInfo>, String>),
 }
 
diff --git a/codex-rs/app-server/src/request_processors/catalog_processor.rs b/codex-rs/app-server/src/request_processors/catalog_processor.rs
index 91fabf7616..834f70654d 100644
--- a/codex-rs/app-server/src/request_processors/catalog_processor.rs
+++ b/codex-rs/app-server/src/request_processors/catalog_processor.rs
@@ -285,8 +285,28 @@ impl CatalogRequestProcessor {
         &self,
         params: ExperimentalFeatureListParams,
     ) -> Result<ExperimentalFeatureListResponse, JSONRPCErrorError> {
-        let ExperimentalFeatureListParams { cursor, limit } = params;
-        let config = self.load_latest_config(/*fallback_cwd*/ None).await?;
+        let ExperimentalFeatureListParams {
+            cursor,
+            limit,
+            thread_id,
+        } = params;
+        let config = match thread_id.as_deref() {
+            Some(thread_id) => {
+                let thread_id = ThreadId::from_string(thread_id)
+                    .map_err(|err| invalid_request(format!("invalid thread id: {err}")))?;
+                let thread = self
+                    .thread_manager
+                    .get_thread(thread_id)
+                    .await
+                    .map_err(|_| invalid_request(format!("thread not found: {thread_id}")))?;
+                let thread_config = thread.config().await;
+                self.config_manager
+                    .load_latest_config_for_thread(thread_config.as_ref())
+                    .await
+                    .map_err(|err| internal_error(format!("failed to reload config: {err}")))?
+            }
+            None => self.load_latest_config(/*fallback_cwd*/ None).await?,
+        };
         let auth = self.auth_manager.auth().await;
         let workspace_codex_plugins_enabled = self
             .workspace_codex_plugins_enabled(&config, auth.as_ref())
diff --git a/codex-rs/app-server/src/request_processors/command_exec_processor.rs b/codex-rs/app-server/src/request_processors/command_exec_processor.rs
index 3236a67627..1219eb17f9 100644
--- a/codex-rs/app-server/src/request_processors/command_exec_processor.rs
+++ b/codex-rs/app-server/src/request_processors/command_exec_processor.rs
@@ -5,6 +5,7 @@ pub(crate) struct CommandExecRequestProcessor {
     arg0_paths: Arg0DispatchPaths,
     config: Arc<Config>,
     outgoing: Arc<OutgoingMessageSender>,
+    config_manager: ConfigManager,
     command_exec_manager: CommandExecManager,
 }
 
@@ -13,11 +14,13 @@ impl CommandExecRequestProcessor {
         arg0_paths: Arg0DispatchPaths,
         config: Arc<Config>,
         outgoing: Arc<OutgoingMessageSender>,
+        config_manager: ConfigManager,
     ) -> Self {
         Self {
             arg0_paths,
             config,
             outgoing,
+            config_manager,
             command_exec_manager: CommandExecManager::default(),
         }
     }
@@ -159,28 +162,6 @@ impl CommandExecRequestProcessor {
             },
             None => None,
         };
-        let managed_network_requirements_enabled =
-            self.config.managed_network_requirements_enabled();
-        let started_network_proxy = match self.config.permissions.network.as_ref() {
-            Some(spec) => match spec
-                .start_proxy(
-                    self.config.permissions.permission_profile.get(),
-                    /*policy_decider*/ None,
-                    /*blocked_request_observer*/ None,
-                    managed_network_requirements_enabled,
-                    NetworkProxyAuditMetadata::default(),
-                )
-                .await
-            {
-                Ok(started) => Some(started),
-                Err(err) => {
-                    return Err(internal_error(format!(
-                        "failed to start managed network proxy: {err}"
-                    )));
-                }
-            },
-            None => None,
-        };
         let windows_sandbox_level = WindowsSandboxLevel::from_config(&self.config);
         let output_bytes_cap = if disable_output_cap {
             None
@@ -205,48 +186,39 @@ impl CommandExecRequestProcessor {
         } else {
             self.config.cwd.clone()
         };
-        let exec_params = ExecParams {
-            command,
-            cwd: cwd.clone(),
-            expiration,
-            capture_policy,
-            env,
-            network: started_network_proxy
-                .as_ref()
-                .map(codex_core::config::StartedNetworkProxy::proxy),
-            sandbox_permissions: SandboxPermissions::UseDefault,
-            windows_sandbox_level,
-            windows_sandbox_private_desktop: self
-                .config
-                .permissions
-                .windows_sandbox_private_desktop,
-            justification: None,
-            arg0: None,
-        };
-
-        let effective_permission_profile = if let Some(permission_profile) = permission_profile {
-            let permission_profile =
-                codex_protocol::models::PermissionProfile::from(permission_profile);
-            let (mut file_system_sandbox_policy, network_sandbox_policy) =
-                permission_profile.to_runtime_permissions();
-            let configured_file_system_sandbox_policy =
-                self.config.permissions.file_system_sandbox_policy();
-            Self::preserve_configured_deny_read_restrictions(
-                &mut file_system_sandbox_policy,
-                &configured_file_system_sandbox_policy,
-            );
-            let effective_permission_profile =
-                codex_protocol::models::PermissionProfile::from_runtime_permissions_with_enforcement(
-                    permission_profile.enforcement(),
-                    &file_system_sandbox_policy,
-                    network_sandbox_policy,
-                );
-            self.config
-                .permissions
-                .permission_profile
-                .can_set(&effective_permission_profile)
+        let (
+            effective_permission_profile,
+            network_proxy_spec,
+            network_proxy_permission_profile,
+            managed_network_requirements_enabled,
+        ) = if let Some(permission_profile) = permission_profile {
+            let overrides = ConfigOverrides {
+                cwd: Some(cwd.to_path_buf()),
+                default_permissions: Some(permission_profile),
+                ..Default::default()
+            };
+            let config = self
+                .config_manager
+                .load_for_cwd(
+                    /*request_overrides*/ None,
+                    overrides,
+                    Some(self.config.cwd.to_path_buf()),
+                )
+                .await
                 .map_err(|err| invalid_request(format!("invalid permission profile: {err}")))?;
-            effective_permission_profile
+            if let Some(warning) = config.startup_warnings.iter().find(|warning| {
+                warning.contains("Configured value for `permission_profile` is disallowed")
+            }) {
+                return Err(invalid_request(format!(
+                    "invalid permission profile: {warning}"
+                )));
+            }
+            (
+                config.permissions.effective_permission_profile(),
+                config.permissions.network.clone(),
+                config.permissions.permission_profile().clone(),
+                config.managed_network_requirements_enabled(),
+            )
         } else if let Some(policy) = sandbox_policy.map(|policy| policy.to_core()) {
             self.config
                 .permissions
@@ -264,12 +236,59 @@ impl CommandExecRequestProcessor {
                 );
             self.config
                 .permissions
-                .permission_profile
-                .can_set(&permission_profile)
+                .can_set_permission_profile(&permission_profile)
                 .map_err(|err| invalid_request(format!("invalid sandbox policy: {err}")))?;
-            permission_profile
+            (
+                permission_profile,
+                self.config.permissions.network.clone(),
+                self.config.permissions.permission_profile().clone(),
+                self.config.managed_network_requirements_enabled(),
+            )
         } else {
-            self.config.permissions.permission_profile()
+            (
+                self.config.permissions.effective_permission_profile(),
+                self.config.permissions.network.clone(),
+                self.config.permissions.permission_profile().clone(),
+                self.config.managed_network_requirements_enabled(),
+            )
+        };
+        let started_network_proxy = match network_proxy_spec.as_ref() {
+            Some(spec) => match spec
+                .start_proxy(
+                    &network_proxy_permission_profile,
+                    /*policy_decider*/ None,
+                    /*blocked_request_observer*/ None,
+                    managed_network_requirements_enabled,
+                    NetworkProxyAuditMetadata::default(),
+                )
+                .await
+            {
+                Ok(started) => Some(started),
+                Err(err) => {
+                    return Err(internal_error(format!(
+                        "failed to start managed network proxy: {err}"
+                    )));
+                }
+            },
+            None => None,
+        };
+        let exec_params = ExecParams {
+            command,
+            cwd: cwd.clone(),
+            expiration,
+            capture_policy,
+            env,
+            network: started_network_proxy
+                .as_ref()
+                .map(codex_core::config::StartedNetworkProxy::proxy),
+            sandbox_permissions: SandboxPermissions::UseDefault,
+            windows_sandbox_level,
+            windows_sandbox_private_desktop: self
+                .config
+                .permissions
+                .windows_sandbox_private_desktop,
+            justification: None,
+            arg0: None,
         };
 
         let codex_linux_sandbox_exe = self.arg0_paths.codex_linux_sandbox_exe.clone();
@@ -306,16 +325,4 @@ impl CommandExecRequestProcessor {
             })
             .await
     }
-
-    fn preserve_configured_deny_read_restrictions(
-        file_system_sandbox_policy: &mut FileSystemSandboxPolicy,
-        configured_file_system_sandbox_policy: &FileSystemSandboxPolicy,
-    ) {
-        file_system_sandbox_policy
-            .preserve_deny_read_restrictions_from(configured_file_system_sandbox_policy);
-    }
 }
-
-#[cfg(test)]
-#[path = "command_exec_processor_tests.rs"]
-mod command_exec_processor_tests;
diff --git a/codex-rs/app-server/src/request_processors/command_exec_processor_tests.rs b/codex-rs/app-server/src/request_processors/command_exec_processor_tests.rs
deleted file mode 100644
index 3e026a6a82..0000000000
--- a/codex-rs/app-server/src/request_processors/command_exec_processor_tests.rs
+++ /dev/null
@@ -1,38 +0,0 @@
-use super::*;
-use codex_protocol::permissions::FileSystemAccessMode;
-use codex_protocol::permissions::FileSystemPath;
-use codex_protocol::permissions::FileSystemSandboxEntry;
-use codex_protocol::permissions::FileSystemSandboxPolicy;
-use codex_utils_absolute_path::test_support::PathBufExt;
-use codex_utils_absolute_path::test_support::test_path_buf;
-use pretty_assertions::assert_eq;
-
-#[test]
-fn command_profile_preserves_configured_deny_read_restrictions() {
-    let readable_entry = FileSystemSandboxEntry {
-        path: FileSystemPath::Path {
-            path: test_path_buf("/tmp/project").abs(),
-        },
-        access: FileSystemAccessMode::Read,
-    };
-    let deny_entry = FileSystemSandboxEntry {
-        path: FileSystemPath::GlobPattern {
-            pattern: "/tmp/project/**/*.env".to_string(),
-        },
-        access: FileSystemAccessMode::None,
-    };
-    let mut file_system_sandbox_policy =
-        FileSystemSandboxPolicy::restricted(vec![readable_entry.clone()]);
-    let mut configured_file_system_sandbox_policy =
-        FileSystemSandboxPolicy::restricted(vec![deny_entry.clone()]);
-    configured_file_system_sandbox_policy.glob_scan_max_depth = Some(2);
-
-    CommandExecRequestProcessor::preserve_configured_deny_read_restrictions(
-        &mut file_system_sandbox_policy,
-        &configured_file_system_sandbox_policy,
-    );
-
-    let mut expected = FileSystemSandboxPolicy::restricted(vec![readable_entry, deny_entry]);
-    expected.glob_scan_max_depth = Some(2);
-    assert_eq!(file_system_sandbox_policy, expected);
-}
diff --git a/codex-rs/app-server/src/request_processors/config_processor.rs b/codex-rs/app-server/src/request_processors/config_processor.rs
index f4157ec3a6..f597a79848 100644
--- a/codex-rs/app-server/src/request_processors/config_processor.rs
+++ b/codex-rs/app-server/src/request_processors/config_processor.rs
@@ -53,7 +53,6 @@ const SUPPORTED_EXPERIMENTAL_FEATURE_ENABLEMENT: &[&str] = &[
     "mentions_v2",
     "plugins",
     "remote_control",
-    "tool_search",
     "tool_suggest",
     "tool_call_mcp_elicitation",
 ];
@@ -455,6 +454,7 @@ fn map_hooks_requirements_to_api(hooks: ManagedHooksRequirementsToml) -> Managed
         post_compact,
         session_start,
         user_prompt_submit,
+        subagent_start,
         stop,
     } = hooks;
 
@@ -468,6 +468,7 @@ fn map_hooks_requirements_to_api(hooks: ManagedHooksRequirementsToml) -> Managed
         post_compact: map_hook_matcher_groups_to_api(post_compact),
         session_start: map_hook_matcher_groups_to_api(session_start),
         user_prompt_submit: map_hook_matcher_groups_to_api(user_prompt_submit),
+        subagent_start: map_hook_matcher_groups_to_api(subagent_start),
         stop: map_hook_matcher_groups_to_api(stop),
     }
 }
diff --git a/codex-rs/app-server/src/request_processors/feedback_doctor_report.rs b/codex-rs/app-server/src/request_processors/feedback_doctor_report.rs
new file mode 100644
index 0000000000..3bd9c9fd9b
--- /dev/null
+++ b/codex-rs/app-server/src/request_processors/feedback_doctor_report.rs
@@ -0,0 +1,212 @@
+//! Builds a redacted doctor report attachment for feedback uploads.
+//!
+//! Feedback upload should never depend on doctor succeeding. This module runs
+//! the configured Codex executable as a subprocess, accepts only valid JSON from
+//! `codex doctor --json`, derives a small set of Sentry tags, and otherwise
+//! skips the attachment with a warning. Keeping the report generation out of the
+//! app-server process avoids sharing doctor internals across crates while still
+//! attaching exactly the same JSON a user could copy from the CLI.
+
+use std::collections::BTreeMap;
+use std::time::Duration;
+
+use codex_core::config::Config;
+use codex_feedback::DOCTOR_REPORT_ATTACHMENT_FILENAME;
+use codex_feedback::FeedbackAttachment;
+use serde_json::Value;
+use tokio::process::Command;
+use tokio::time::timeout;
+use tracing::warn;
+
+const DOCTOR_FEEDBACK_REPORT_TIMEOUT: Duration = Duration::from_secs(25);
+const MAX_DOCTOR_TAG_VALUE_LEN: usize = 256;
+
+/// Redacted doctor report data that can be merged into a feedback upload.
+pub(crate) struct DoctorFeedbackReport {
+    /// JSON support report to upload as `codex-doctor-report.json`.
+    pub(crate) attachment: FeedbackAttachment,
+    /// Low-cardinality Sentry tags derived from the report status and check ids.
+    pub(crate) tags: BTreeMap<String, String>,
+}
+
+/// Runs `codex doctor --json` and returns a best-effort feedback attachment.
+///
+/// Failure to spawn Codex, finish before the timeout, or parse JSON means the
+/// feedback upload proceeds without the doctor report. Callers should merge the
+/// returned tags without overriding explicit client-provided tags.
+pub(crate) async fn doctor_feedback_report(config: &Config) -> Option<DoctorFeedbackReport> {
+    let executable = config
+        .codex_self_exe
+        .clone()
+        .or_else(|| std::env::current_exe().ok())?;
+
+    let mut command = Command::new(&executable);
+    command.arg("doctor").arg("--json");
+    command.kill_on_drop(/*kill_on_drop*/ true);
+    let output = match timeout(DOCTOR_FEEDBACK_REPORT_TIMEOUT, command.output()).await {
+        Ok(Ok(output)) => output,
+        Ok(Err(err)) => {
+            warn!(
+                executable = %executable.display(),
+                error = %err,
+                "failed to run doctor report for feedback; skipping attachment"
+            );
+            return None;
+        }
+        Err(_) => {
+            warn!(
+                executable = %executable.display(),
+                "timed out running doctor report for feedback; skipping attachment"
+            );
+            return None;
+        }
+    };
+
+    let stdout = String::from_utf8_lossy(&output.stdout);
+    let Some(json_start) = stdout.find('{') else {
+        warn!(
+            executable = %executable.display(),
+            status = %output.status,
+            stderr = %String::from_utf8_lossy(&output.stderr),
+            "doctor report for feedback did not produce JSON; skipping attachment"
+        );
+        return None;
+    };
+    let json = stdout[json_start..].trim();
+    let report: Value = match serde_json::from_str(json) {
+        Ok(report) => report,
+        Err(err) => {
+            warn!(
+                executable = %executable.display(),
+                status = %output.status,
+                error = %err,
+                "doctor report for feedback was not valid JSON; skipping attachment"
+            );
+            return None;
+        }
+    };
+
+    let pretty = serde_json::to_vec_pretty(&report).unwrap_or_else(|_| json.as_bytes().to_vec());
+    Some(DoctorFeedbackReport {
+        tags: doctor_report_tags(&report),
+        attachment: FeedbackAttachment {
+            filename: DOCTOR_REPORT_ATTACHMENT_FILENAME.to_string(),
+            content_type: Some("application/json".to_string()),
+            buffer: pretty,
+        },
+    })
+}
+
+fn doctor_report_tags(report: &Value) -> BTreeMap<String, String> {
+    let mut tags = BTreeMap::new();
+    if let Some(overall_status) = report.get("overallStatus").and_then(Value::as_str) {
+        tags.insert(
+            "doctor_overall_status".to_string(),
+            truncate_tag_value(overall_status),
+        );
+    }
+
+    let mut ok_count = 0usize;
+    let mut warning_count = 0usize;
+    let mut fail_count = 0usize;
+    let mut failed_checks = Vec::new();
+    let mut warning_checks = Vec::new();
+    if let Some(checks) = report.get("checks") {
+        for check in check_values(checks) {
+            let status = check.get("status").and_then(Value::as_str);
+            let id = check.get("id").and_then(Value::as_str).unwrap_or("unknown");
+            match status {
+                Some("ok") => ok_count += 1,
+                Some("warning") => {
+                    warning_count += 1;
+                    warning_checks.push(id.to_string());
+                }
+                Some("fail") => {
+                    fail_count += 1;
+                    failed_checks.push(id.to_string());
+                }
+                _ => {}
+            }
+        }
+    }
+    tags.insert("doctor_ok_count".to_string(), ok_count.to_string());
+    tags.insert(
+        "doctor_warning_count".to_string(),
+        warning_count.to_string(),
+    );
+    tags.insert("doctor_fail_count".to_string(), fail_count.to_string());
+    if !failed_checks.is_empty() {
+        tags.insert(
+            "doctor_failed_checks".to_string(),
+            truncate_tag_value(&failed_checks.join(",")),
+        );
+    }
+    if !warning_checks.is_empty() {
+        tags.insert(
+            "doctor_warning_checks".to_string(),
+            truncate_tag_value(&warning_checks.join(",")),
+        );
+    }
+
+    tags
+}
+
+/// Iterates checks from both the current keyed JSON shape and older array reports.
+fn check_values(checks: &Value) -> Box<dyn Iterator<Item = &Value> + '_> {
+    match checks {
+        Value::Array(values) => Box::new(values.iter()),
+        Value::Object(values) => Box::new(values.values()),
+        _ => Box::new(std::iter::empty()),
+    }
+}
+
+fn truncate_tag_value(value: &str) -> String {
+    if value.chars().count() <= MAX_DOCTOR_TAG_VALUE_LEN {
+        return value.to_string();
+    }
+    let prefix = value
+        .chars()
+        .take(MAX_DOCTOR_TAG_VALUE_LEN.saturating_sub(3))
+        .collect::<String>();
+    format!("{prefix}...")
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use pretty_assertions::assert_eq;
+    use serde_json::json;
+
+    #[test]
+    fn doctor_report_tags_summarize_status_counts() {
+        let report = json!({
+            "overallStatus": "fail",
+            "checks": {
+                "runtime.provenance": {"id": "runtime.provenance", "status": "ok"},
+                "websocket.reachability": {
+                    "id": "websocket.reachability",
+                    "status": "warning"
+                },
+                "auth.credentials": {"id": "auth.credentials", "status": "fail"}
+            }
+        });
+
+        let tags = doctor_report_tags(&report);
+
+        let expected = BTreeMap::from([
+            ("doctor_fail_count".to_string(), "1".to_string()),
+            (
+                "doctor_failed_checks".to_string(),
+                "auth.credentials".to_string(),
+            ),
+            ("doctor_ok_count".to_string(), "1".to_string()),
+            ("doctor_overall_status".to_string(), "fail".to_string()),
+            (
+                "doctor_warning_checks".to_string(),
+                "websocket.reachability".to_string(),
+            ),
+            ("doctor_warning_count".to_string(), "1".to_string()),
+        ]);
+        assert_eq!(tags, expected);
+    }
+}
diff --git a/codex-rs/app-server/src/request_processors/feedback_processor.rs b/codex-rs/app-server/src/request_processors/feedback_processor.rs
index 5b9039b57d..18f519d3c0 100644
--- a/codex-rs/app-server/src/request_processors/feedback_processor.rs
+++ b/codex-rs/app-server/src/request_processors/feedback_processor.rs
@@ -56,6 +56,7 @@ impl FeedbackRequestProcessor {
             extra_log_files,
             tags,
         } = params;
+        let mut upload_tags = tags.unwrap_or_default();
 
         let conversation_id = match thread_id.as_deref() {
             Some(thread_id) => match ThreadId::from_string(thread_id) {
@@ -197,14 +198,27 @@ impl FeedbackRequestProcessor {
             }
         }
 
+        let mut extra_attachments = Vec::new();
+        if include_logs
+            && let Some(doctor_report) =
+                super::feedback_doctor_report::doctor_feedback_report(&self.config).await
+        {
+            extra_attachments.push(doctor_report.attachment);
+            for (key, value) in doctor_report.tags {
+                upload_tags.entry(key).or_insert(value);
+            }
+        }
+
         let session_source = self.thread_manager.session_source();
 
         let upload_result = tokio::task::spawn_blocking(move || {
+            let tags = (!upload_tags.is_empty()).then_some(&upload_tags);
             snapshot.upload_feedback(FeedbackUploadOptions {
                 classification: &classification,
                 reason: reason.as_deref(),
-                tags: tags.as_ref(),
+                tags,
                 include_logs,
+                extra_attachments: &extra_attachments,
                 extra_attachment_paths: &attachment_paths,
                 session_source: Some(session_source),
                 logs_override: sqlite_feedback_logs,
diff --git a/codex-rs/app-server/src/request_processors/initialize_processor.rs b/codex-rs/app-server/src/request_processors/initialize_processor.rs
index c33af189cf..a40007db11 100644
--- a/codex-rs/app-server/src/request_processors/initialize_processor.rs
+++ b/codex-rs/app-server/src/request_processors/initialize_processor.rs
@@ -13,7 +13,7 @@ use super::*;
 use crate::message_processor::ConnectionSessionState;
 use crate::message_processor::InitializedConnectionSessionState;
 
-const DAEMON_PROBE_CLIENT_NAME: &str = "codex_app_server_daemon";
+const NON_ORIGINATING_CLIENT_NAMES: &[&str] = &["codex_app_server_daemon", "codex-backend"];
 
 #[derive(Clone)]
 pub(crate) struct InitializeRequestProcessor {
@@ -92,7 +92,7 @@ impl InitializeRequestProcessor {
         }
         let originator = name.clone();
         let user_agent_suffix = format!("{name}; {version}");
-        let mutates_global_identity = name != DAEMON_PROBE_CLIENT_NAME;
+        let mutates_global_identity = !NON_ORIGINATING_CLIENT_NAMES.contains(&name.as_str());
         let codex_home = self.config.codex_home.clone();
         if session
             .initialize(InitializedConnectionSessionState {
diff --git a/codex-rs/app-server/src/request_processors/mcp_processor.rs b/codex-rs/app-server/src/request_processors/mcp_processor.rs
index 812108a15c..4bb9431f42 100644
--- a/codex-rs/app-server/src/request_processors/mcp_processor.rs
+++ b/codex-rs/app-server/src/request_processors/mcp_processor.rs
@@ -160,6 +160,7 @@ impl McpRequestProcessor {
             http_headers,
             env_http_headers,
             &resolved_scopes.scopes,
+            server.oauth_client_id(),
             server.oauth_resource.as_deref(),
             timeout_secs,
             config.mcp_oauth_callback_port,
@@ -204,17 +205,14 @@ impl McpRequestProcessor {
             .await;
         let auth = self.auth_manager.auth().await;
         let environment_manager = self.thread_manager.environment_manager();
-        let runtime_environment = match environment_manager.default_environment() {
-            Some(environment) => {
-                // Status listing has no turn cwd. This fallback is used only
-                // by executor-backed stdio MCPs whose config omits `cwd`.
-                McpRuntimeEnvironment::new(environment, config.cwd.to_path_buf())
-            }
-            None => McpRuntimeEnvironment::new(
-                environment_manager.local_environment(),
-                config.cwd.to_path_buf(),
-            ),
-        };
+        // Status listing has no turn cwd. Prefer the configured default env,
+        // then configured local if present; do not manufacture a hidden local
+        // env in no-local modes.
+        let runtime_environment = McpRuntimeEnvironment::new(
+            environment_manager.default_or_local_environment(),
+            environment_manager.try_local_environment(),
+            config.cwd.to_path_buf(),
+        );
 
         tokio::spawn(async move {
             Self::list_mcp_server_status_task(
@@ -368,15 +366,15 @@ impl McpRequestProcessor {
             .to_mcp_config(self.thread_manager.plugins_manager().as_ref())
             .await;
         let auth = self.auth_manager.auth().await;
-        let runtime_environment = {
-            let environment_manager = self.thread_manager.environment_manager();
-            let environment = environment_manager
-                .default_environment()
-                .unwrap_or_else(|| environment_manager.local_environment());
-            // Resource reads without a thread have no turn cwd. This fallback
-            // is used only by executor-backed stdio MCPs whose config omits `cwd`.
-            McpRuntimeEnvironment::new(environment, config.cwd.to_path_buf())
-        };
+        let environment_manager = self.thread_manager.environment_manager();
+        // Resource reads without a thread have no turn cwd. Prefer the
+        // configured default env, then configured local if present; do not
+        // manufacture a hidden local env in no-local modes.
+        let runtime_environment = McpRuntimeEnvironment::new(
+            environment_manager.default_or_local_environment(),
+            environment_manager.try_local_environment(),
+            config.cwd.to_path_buf(),
+        );
         let request_id = request_id.clone();
 
         tokio::spawn(async move {
diff --git a/codex-rs/app-server/src/request_processors/plugins.rs b/codex-rs/app-server/src/request_processors/plugins.rs
index 6980945ae2..199ddf1191 100644
--- a/codex-rs/app-server/src/request_processors/plugins.rs
+++ b/codex-rs/app-server/src/request_processors/plugins.rs
@@ -6,6 +6,7 @@ use codex_app_server_protocol::PluginInstallPolicy;
 use codex_app_server_protocol::PluginSharePrincipalRole;
 use codex_app_server_protocol::PluginShareTargetRole;
 use codex_config::types::McpServerConfig;
+use codex_core_plugins::remote::RemotePluginScope;
 use codex_core_plugins::remote::is_valid_remote_plugin_id;
 use codex_core_plugins::remote::validate_remote_plugin_id;
 use codex_mcp::McpOAuthLoginSupport;
@@ -122,6 +123,39 @@ fn share_context_for_source(
     }
 }
 
+fn convert_configured_marketplace_plugin_to_plugin_summary(
+    plugin: codex_core_plugins::ConfiguredMarketplacePlugin,
+    shared_plugin_ids_by_local_path: &std::collections::BTreeMap<AbsolutePathBuf, String>,
+) -> PluginSummary {
+    let share_context = share_context_for_source(&plugin.source, shared_plugin_ids_by_local_path);
+    PluginSummary {
+        id: plugin.id,
+        remote_plugin_id: None,
+        local_version: plugin.local_version,
+        installed: plugin.installed,
+        enabled: plugin.enabled,
+        name: plugin.name,
+        share_context,
+        source: marketplace_plugin_source_to_info(plugin.source),
+        install_policy: plugin.policy.installation.into(),
+        auth_policy: plugin.policy.authentication.into(),
+        availability: PluginAvailability::Available,
+        interface: plugin.interface.map(local_plugin_interface_to_info),
+        keywords: plugin.keywords,
+    }
+}
+
+fn remote_installed_plugin_visible_scopes(config: &Config) -> Vec<RemotePluginScope> {
+    let mut scopes = Vec::new();
+    if config.features.enabled(Feature::RemotePlugin) {
+        scopes.push(RemotePluginScope::Global);
+    }
+    if config.features.enabled(Feature::PluginSharing) {
+        scopes.push(RemotePluginScope::Workspace);
+    }
+    scopes
+}
+
 fn remote_plugin_share_discoverability(
     discoverability: PluginShareDiscoverability,
 ) -> codex_core_plugins::remote::RemotePluginShareDiscoverability {
@@ -268,6 +302,15 @@ impl PluginRequestProcessor {
             .map(|response| Some(response.into()))
     }
 
+    pub(crate) async fn plugin_installed(
+        &self,
+        params: PluginInstalledParams,
+    ) -> Result<Option<ClientResponsePayload>, JSONRPCErrorError> {
+        self.plugin_installed_response(params)
+            .await
+            .map(|response| Some(response.into()))
+    }
+
     pub(crate) async fn plugin_read(
         &self,
         params: PluginReadParams,
@@ -450,14 +493,15 @@ impl PluginRequestProcessor {
             return Ok(empty_response());
         }
         let plugins_input = config.plugins_config_input();
-        let (mut data, marketplace_load_errors) = if include_local {
+        if include_local || marketplace_kinds.contains(&PluginListMarketplaceKind::SharedWithMe) {
             plugins_manager.maybe_start_plugin_list_background_tasks_for_config(
                 &plugins_input,
                 auth.clone(),
                 &roots,
                 Some(self.effective_plugins_changed_callback()),
             );
-
+        }
+        let (mut data, marketplace_load_errors) = if include_local {
             let config_for_marketplace_listing = plugins_input.clone();
             let plugins_manager_for_marketplace_listing = plugins_manager.clone();
             let shared_plugin_ids_by_local_path = load_shared_plugin_ids_by_local_path(&config)?;
@@ -486,27 +530,10 @@ impl PluginRequestProcessor {
                                 .plugins
                                 .into_iter()
                                 .map(|plugin| {
-                                    let share_context = share_context_for_source(
-                                        &plugin.source,
+                                    convert_configured_marketplace_plugin_to_plugin_summary(
+                                        plugin,
                                         &shared_plugin_ids_by_local_path,
-                                    );
-                                    PluginSummary {
-                                        id: plugin.id,
-                                        remote_plugin_id: None,
-                                        local_version: plugin.local_version,
-                                        installed: plugin.installed,
-                                        enabled: plugin.enabled,
-                                        name: plugin.name,
-                                        share_context,
-                                        source: marketplace_plugin_source_to_info(plugin.source),
-                                        install_policy: plugin.policy.installation.into(),
-                                        auth_policy: plugin.policy.authentication.into(),
-                                        availability: PluginAvailability::Available,
-                                        interface: plugin
-                                            .interface
-                                            .map(local_plugin_interface_to_info),
-                                        keywords: plugin.keywords,
-                                    }
+                                    )
                                 })
                                 .collect(),
                         })
@@ -631,6 +658,193 @@ impl PluginRequestProcessor {
         })
     }
 
+    async fn plugin_installed_response(
+        &self,
+        params: PluginInstalledParams,
+    ) -> Result<PluginInstalledResponse, JSONRPCErrorError> {
+        let plugins_manager = self.thread_manager.plugins_manager();
+        let PluginInstalledParams {
+            cwds,
+            install_suggestion_plugin_names,
+        } = params;
+        let roots = cwds.unwrap_or_default();
+        let install_suggestion_plugin_names = install_suggestion_plugin_names
+            .unwrap_or_default()
+            .into_iter()
+            .collect::<HashSet<_>>();
+
+        let empty_response = || PluginInstalledResponse {
+            marketplaces: Vec::new(),
+            marketplace_load_errors: Vec::new(),
+        };
+        let config = self.load_latest_config(/*fallback_cwd*/ None).await?;
+        if !config.features.enabled(Feature::Plugins) {
+            return Ok(empty_response());
+        }
+        let auth = self.auth_manager.auth().await;
+        if !self
+            .workspace_codex_plugins_enabled(&config, auth.as_ref())
+            .await
+        {
+            return Ok(empty_response());
+        }
+
+        let plugins_input = config.plugins_config_input();
+        let remote_installed_plugin_visible_scopes =
+            remote_installed_plugin_visible_scopes(&config);
+        plugins_manager.maybe_start_remote_installed_plugin_bundle_sync(
+            &plugins_input,
+            auth.clone(),
+            Some(self.effective_plugins_changed_callback()),
+        );
+
+        let (mut data, marketplace_load_errors) = self
+            .load_local_installed_and_suggested_plugins(
+                plugins_manager.clone(),
+                &config,
+                &plugins_input,
+                roots,
+                install_suggestion_plugin_names,
+            )
+            .await?;
+
+        data.extend(
+            self.load_remote_installed_plugins(
+                plugins_manager,
+                &plugins_input,
+                &remote_installed_plugin_visible_scopes,
+                auth.as_ref(),
+            )
+            .await,
+        );
+
+        Ok(PluginInstalledResponse {
+            marketplaces: data,
+            marketplace_load_errors,
+        })
+    }
+
+    async fn load_local_installed_and_suggested_plugins(
+        &self,
+        plugins_manager: Arc<codex_core_plugins::PluginsManager>,
+        config: &Config,
+        plugins_input: &codex_core_plugins::PluginsConfigInput,
+        roots: Vec<AbsolutePathBuf>,
+        install_suggestion_plugin_names: HashSet<String>,
+    ) -> Result<
+        (
+            Vec<PluginMarketplaceEntry>,
+            Vec<codex_app_server_protocol::MarketplaceLoadErrorInfo>,
+        ),
+        JSONRPCErrorError,
+    > {
+        let config_for_marketplace_listing = plugins_input.clone();
+        let shared_plugin_ids_by_local_path = load_shared_plugin_ids_by_local_path(config)?;
+        match tokio::task::spawn_blocking(move || {
+            let outcome = plugins_manager
+                .list_marketplaces_for_config(&config_for_marketplace_listing, &roots)?;
+            Ok::<
+                (
+                    Vec<PluginMarketplaceEntry>,
+                    Vec<codex_app_server_protocol::MarketplaceLoadErrorInfo>,
+                ),
+                MarketplaceError,
+            >((
+                outcome
+                    .marketplaces
+                    .into_iter()
+                    .filter_map(|marketplace| {
+                        let plugins = marketplace
+                            .plugins
+                            .into_iter()
+                            .filter(|plugin| {
+                                plugin.installed
+                                    || install_suggestion_plugin_names.contains(&plugin.name)
+                            })
+                            .map(|plugin| {
+                                convert_configured_marketplace_plugin_to_plugin_summary(
+                                    plugin,
+                                    &shared_plugin_ids_by_local_path,
+                                )
+                            })
+                            .collect::<Vec<_>>();
+
+                        (!plugins.is_empty()).then_some(PluginMarketplaceEntry {
+                            name: marketplace.name,
+                            path: Some(marketplace.path),
+                            interface: marketplace.interface.map(|interface| {
+                                MarketplaceInterface {
+                                    display_name: interface.display_name,
+                                }
+                            }),
+                            plugins,
+                        })
+                    })
+                    .collect(),
+                outcome
+                    .errors
+                    .into_iter()
+                    .map(|err| codex_app_server_protocol::MarketplaceLoadErrorInfo {
+                        marketplace_path: err.path,
+                        message: err.message,
+                    })
+                    .collect(),
+            ))
+        })
+        .await
+        {
+            Ok(Ok(outcome)) => Ok(outcome),
+            Ok(Err(err)) => Err(Self::marketplace_error(
+                err,
+                "list installed and suggested marketplace plugins",
+            )),
+            Err(err) => Err(internal_error(format!(
+                "failed to list installed and suggested plugins: {err}"
+            ))),
+        }
+    }
+
+    async fn load_remote_installed_plugins(
+        &self,
+        plugins_manager: Arc<codex_core_plugins::PluginsManager>,
+        plugins_input: &codex_core_plugins::PluginsConfigInput,
+        visible_scopes: &[RemotePluginScope],
+        auth: Option<&CodexAuth>,
+    ) -> Vec<PluginMarketplaceEntry> {
+        let remote_marketplaces = if let Some(remote_marketplaces) =
+            plugins_manager.build_remote_installed_plugin_marketplaces_from_cache(visible_scopes)
+        {
+            Ok(remote_marketplaces)
+        } else {
+            plugins_manager
+                .build_and_cache_remote_installed_plugin_marketplaces(
+                    plugins_input,
+                    auth,
+                    visible_scopes,
+                    Some(self.effective_plugins_changed_callback()),
+                )
+                .await
+        };
+
+        match remote_marketplaces {
+            Ok(remote_marketplaces) => remote_marketplaces
+                .into_iter()
+                .map(remote_marketplace_to_info)
+                .collect(),
+            Err(
+                RemotePluginCatalogError::AuthRequired
+                | RemotePluginCatalogError::UnsupportedAuthMode,
+            ) => Vec::new(),
+            Err(err) => {
+                warn!(
+                    error = %err,
+                    "plugin/installed remote installed plugin fetch failed; returning local marketplaces only"
+                );
+                Vec::new()
+            }
+        }
+    }
+
     async fn plugin_read_response(
         &self,
         params: PluginReadParams,
@@ -916,6 +1130,9 @@ impl PluginRequestProcessor {
         params: PluginShareUpdateTargetsParams,
     ) -> Result<PluginShareUpdateTargetsResponse, JSONRPCErrorError> {
         let (config, auth) = self.load_plugin_share_config_and_auth().await?;
+        if !config.features.enabled(Feature::PluginSharing) {
+            return Err(invalid_request("plugin sharing is disabled"));
+        }
         let PluginShareUpdateTargetsParams {
             remote_plugin_id,
             discoverability,
@@ -1342,6 +1559,7 @@ impl PluginRequestProcessor {
             let notification_name = name.clone();
 
             tokio::spawn(async move {
+                let oauth_client_id = server.oauth_client_id();
                 let first_attempt = perform_oauth_login_silent(
                     &name,
                     &oauth_config.url,
@@ -1349,6 +1567,7 @@ impl PluginRequestProcessor {
                     oauth_config.http_headers.clone(),
                     oauth_config.env_http_headers.clone(),
                     &resolved_scopes.scopes,
+                    oauth_client_id,
                     server.oauth_resource.as_deref(),
                     callback_port,
                     callback_url.as_deref(),
@@ -1364,6 +1583,7 @@ impl PluginRequestProcessor {
                             oauth_config.http_headers,
                             oauth_config.env_http_headers,
                             &[],
+                            oauth_client_id,
                             server.oauth_resource.as_deref(),
                             callback_port,
                             callback_url.as_deref(),
diff --git a/codex-rs/app-server/src/request_processors/remote_control_processor.rs b/codex-rs/app-server/src/request_processors/remote_control_processor.rs
new file mode 100644
index 0000000000..2fceeb5030
--- /dev/null
+++ b/codex-rs/app-server/src/request_processors/remote_control_processor.rs
@@ -0,0 +1,54 @@
+use crate::error_code::internal_error;
+use crate::error_code::invalid_request;
+use crate::transport::RemoteControlHandle;
+use crate::transport::RemoteControlUnavailable;
+use codex_app_server_protocol::JSONRPCErrorError;
+use codex_app_server_protocol::RemoteControlDisableResponse;
+use codex_app_server_protocol::RemoteControlEnableResponse;
+use codex_app_server_protocol::RemoteControlStatusReadResponse;
+
+#[derive(Clone)]
+pub(crate) struct RemoteControlRequestProcessor {
+    remote_control_handle: Option<RemoteControlHandle>,
+}
+
+impl RemoteControlRequestProcessor {
+    pub(crate) fn new(remote_control_handle: Option<RemoteControlHandle>) -> Self {
+        Self {
+            remote_control_handle,
+        }
+    }
+
+    pub(crate) fn enable(&self) -> Result<RemoteControlEnableResponse, JSONRPCErrorError> {
+        let handle = self.handle()?;
+        handle
+            .enable()
+            .map(RemoteControlEnableResponse::from)
+            .map_err(map_unavailable)
+    }
+
+    pub(crate) fn disable(&self) -> Result<RemoteControlDisableResponse, JSONRPCErrorError> {
+        let handle = self.handle()?;
+        Ok(RemoteControlDisableResponse::from(handle.disable()))
+    }
+
+    pub(crate) fn status_read(&self) -> Result<RemoteControlStatusReadResponse, JSONRPCErrorError> {
+        let status = self.handle()?.status();
+        Ok(RemoteControlStatusReadResponse {
+            status: status.status,
+            server_name: status.server_name,
+            installation_id: status.installation_id,
+            environment_id: status.environment_id,
+        })
+    }
+
+    fn handle(&self) -> Result<&RemoteControlHandle, JSONRPCErrorError> {
+        self.remote_control_handle
+            .as_ref()
+            .ok_or_else(|| internal_error("remote control is unavailable for this app-server"))
+    }
+}
+
+fn map_unavailable(err: RemoteControlUnavailable) -> JSONRPCErrorError {
+    invalid_request(err.to_string())
+}
diff --git a/codex-rs/app-server/src/request_processors/thread_goal_processor.rs b/codex-rs/app-server/src/request_processors/thread_goal_processor.rs
index 57d2575590..cf1e58345b 100644
--- a/codex-rs/app-server/src/request_processors/thread_goal_processor.rs
+++ b/codex-rs/app-server/src/request_processors/thread_goal_processor.rs
@@ -148,14 +148,17 @@ impl ThreadGoalRequestProcessor {
             thread.prepare_external_goal_mutation().await;
         }
 
+        let should_set_thread_preview = objective.is_some();
         let (goal, previous_status) = (if let Some(objective) = objective {
             let existing_goal = state_db
+                .thread_goals()
                 .get_thread_goal(thread_id)
                 .await
                 .map_err(|err| invalid_request(err.to_string()))?;
             if let Some(goal) = existing_goal.as_ref() {
                 let previous_status = ExternalGoalPreviousStatus::from(goal);
                 state_db
+                    .thread_goals()
                     .update_thread_goal(
                         thread_id,
                         codex_state::ThreadGoalUpdate {
@@ -177,6 +180,7 @@ impl ThreadGoalRequestProcessor {
             } else {
                 let previous_status = ExternalGoalPreviousStatus::NewGoal;
                 state_db
+                    .thread_goals()
                     .replace_thread_goal(
                         thread_id,
                         objective,
@@ -188,6 +192,7 @@ impl ThreadGoalRequestProcessor {
             }
         } else {
             let existing_goal = state_db
+                .thread_goals()
                 .get_thread_goal(thread_id)
                 .await
                 .map_err(|err| invalid_request(err.to_string()))?;
@@ -198,6 +203,7 @@ impl ThreadGoalRequestProcessor {
             };
             let previous_status = ExternalGoalPreviousStatus::from(&existing_goal);
             state_db
+                .thread_goals()
                 .update_thread_goal(
                     thread_id,
                     codex_state::ThreadGoalUpdate {
@@ -216,6 +222,13 @@ impl ThreadGoalRequestProcessor {
                 .map(|goal| (goal, previous_status))
         })
         .map_err(|err| invalid_request(err.to_string()))?;
+        if should_set_thread_preview
+            && let Err(err) = state_db
+                .set_thread_preview_if_empty(thread_id, goal.objective.as_str())
+                .await
+        {
+            warn!("failed to set empty thread preview from goal objective for {thread_id}: {err}");
+        }
         let external_goal_set = ExternalGoalSet {
             goal: goal.clone(),
             previous_status,
@@ -246,6 +259,7 @@ impl ThreadGoalRequestProcessor {
         let thread_id = parse_thread_id_for_request(params.thread_id.as_str())?;
         let state_db = self.state_db_for_materialized_thread(thread_id).await?;
         let goal = state_db
+            .thread_goals()
             .get_thread_goal(thread_id)
             .await
             .map_err(|err| internal_error(format!("failed to read thread goal: {err}")))?
@@ -303,6 +317,7 @@ impl ThreadGoalRequestProcessor {
             thread_state.listener_command_tx()
         };
         let cleared = state_db
+            .thread_goals()
             .delete_thread_goal(thread_id)
             .await
             .map_err(|err| internal_error(format!("failed to clear thread goal: {err}")))?;
@@ -447,6 +462,8 @@ fn thread_goal_status_to_state(status: ThreadGoalStatus) -> codex_state::ThreadG
     match status {
         ThreadGoalStatus::Active => codex_state::ThreadGoalStatus::Active,
         ThreadGoalStatus::Paused => codex_state::ThreadGoalStatus::Paused,
+        ThreadGoalStatus::Blocked => codex_state::ThreadGoalStatus::Blocked,
+        ThreadGoalStatus::UsageLimited => codex_state::ThreadGoalStatus::UsageLimited,
         ThreadGoalStatus::BudgetLimited => codex_state::ThreadGoalStatus::BudgetLimited,
         ThreadGoalStatus::Complete => codex_state::ThreadGoalStatus::Complete,
     }
@@ -456,6 +473,8 @@ fn thread_goal_status_from_state(status: codex_state::ThreadGoalStatus) -> Threa
     match status {
         codex_state::ThreadGoalStatus::Active => ThreadGoalStatus::Active,
         codex_state::ThreadGoalStatus::Paused => ThreadGoalStatus::Paused,
+        codex_state::ThreadGoalStatus::Blocked => ThreadGoalStatus::Blocked,
+        codex_state::ThreadGoalStatus::UsageLimited => ThreadGoalStatus::UsageLimited,
         codex_state::ThreadGoalStatus::BudgetLimited => ThreadGoalStatus::BudgetLimited,
         codex_state::ThreadGoalStatus::Complete => ThreadGoalStatus::Complete,
     }
diff --git a/codex-rs/app-server/src/request_processors/thread_lifecycle.rs b/codex-rs/app-server/src/request_processors/thread_lifecycle.rs
index 7dab206d85..c4d5fa6c96 100644
--- a/codex-rs/app-server/src/request_processors/thread_lifecycle.rs
+++ b/codex-rs/app-server/src/request_processors/thread_lifecycle.rs
@@ -604,6 +604,7 @@ pub(super) async fn handle_pending_thread_resume_request(
         permission_profile,
         active_permission_profile,
         cwd,
+        workspace_roots,
         reasoning_effort,
         ..
     } = pending.config_snapshot;
@@ -620,11 +621,11 @@ pub(super) async fn handle_pending_thread_resume_request(
         model_provider: model_provider_id,
         service_tier,
         cwd,
+        runtime_workspace_roots: workspace_roots,
         instruction_sources,
         approval_policy: approval_policy.into(),
         approvals_reviewer: approvals_reviewer.into(),
         sandbox,
-        permission_profile: Some(permission_profile.into()),
         active_permission_profile,
         reasoning_effort,
     };
@@ -675,7 +676,7 @@ pub(super) async fn send_thread_goal_snapshot_notification(
     thread_id: ThreadId,
     state_db: &StateDbHandle,
 ) {
-    match state_db.get_thread_goal(thread_id).await {
+    match state_db.thread_goals().get_thread_goal(thread_id).await {
         Ok(Some(goal)) => {
             outgoing
                 .send_server_notification(ServerNotification::ThreadGoalUpdated(
diff --git a/codex-rs/app-server/src/request_processors/thread_processor.rs b/codex-rs/app-server/src/request_processors/thread_processor.rs
index 46fb8ed80d..6b6e1729a5 100644
--- a/codex-rs/app-server/src/request_processors/thread_processor.rs
+++ b/codex-rs/app-server/src/request_processors/thread_processor.rs
@@ -1,5 +1,7 @@
 use super::*;
 use crate::error_code::method_not_found;
+use codex_protocol::models::BUILT_IN_PERMISSION_PROFILE_DANGER_FULL_ACCESS;
+use codex_protocol::models::BUILT_IN_PERMISSION_PROFILE_WORKSPACE;
 
 const THREAD_LIST_DEFAULT_LIMIT: usize = 25;
 const THREAD_LIST_MAX_LIMIT: usize = 100;
@@ -57,6 +59,25 @@ fn collect_resume_override_mismatches(
             ));
         }
     }
+    if let Some(requested_runtime_workspace_roots) = request.runtime_workspace_roots.as_ref() {
+        let base_cwd = request
+            .cwd
+            .as_deref()
+            .map(|cwd| {
+                AbsolutePathBuf::resolve_path_against_base(cwd, config_snapshot.cwd.as_path())
+            })
+            .unwrap_or_else(|| config_snapshot.cwd.clone());
+        let requested_runtime_workspace_roots = requested_runtime_workspace_roots
+            .iter()
+            .map(|path| AbsolutePathBuf::resolve_path_against_base(path, base_cwd.as_path()))
+            .collect::<Vec<_>>();
+        if requested_runtime_workspace_roots != config_snapshot.workspace_roots {
+            mismatch_details.push(format!(
+                "runtime_workspace_roots requested={requested_runtime_workspace_roots:?} active={:?}",
+                config_snapshot.workspace_roots
+            ));
+        }
+    }
     if let Some(requested_approval) = request.approval_policy.as_ref() {
         let active_approval: AskForApproval = config_snapshot.approval_policy.into();
         if requested_approval != &active_approval {
@@ -802,6 +823,7 @@ impl ThreadRequestProcessor {
             model_provider,
             service_tier,
             cwd,
+            runtime_workspace_roots,
             approval_policy,
             approvals_reviewer,
             sandbox,
@@ -835,6 +857,7 @@ impl ThreadRequestProcessor {
             model_provider,
             service_tier,
             cwd,
+            runtime_workspace_roots,
             approval_policy,
             approvals_reviewer,
             sandbox,
@@ -975,7 +998,7 @@ impl ThreadRequestProcessor {
         let requested_permissions_trust_project =
             requested_permissions_trust_project(&typesafe_overrides, config.cwd.as_path());
         let effective_permissions_trust_project = permission_profile_trusts_project(
-            &config.permissions.permission_profile(),
+            &config.permissions.effective_permission_profile(),
             config.cwd.as_path(),
         );
 
@@ -1171,11 +1194,11 @@ impl ThreadRequestProcessor {
             model_provider: config_snapshot.model_provider_id,
             service_tier: config_snapshot.service_tier,
             cwd: config_snapshot.cwd,
+            runtime_workspace_roots: config_snapshot.workspace_roots,
             instruction_sources,
             approval_policy: config_snapshot.approval_policy.into(),
             approvals_reviewer: config_snapshot.approvals_reviewer.into(),
             sandbox,
-            permission_profile: Some(config_snapshot.permission_profile.into()),
             active_permission_profile,
             reasoning_effort: config_snapshot.reasoning_effort,
         };
@@ -1212,19 +1235,22 @@ impl ThreadRequestProcessor {
         model_provider: Option<String>,
         service_tier: Option<Option<String>>,
         cwd: Option<String>,
+        runtime_workspace_roots: Option<Vec<PathBuf>>,
         approval_policy: Option<codex_app_server_protocol::AskForApproval>,
         approvals_reviewer: Option<codex_app_server_protocol::ApprovalsReviewer>,
         sandbox: Option<SandboxMode>,
-        permissions: Option<PermissionProfileSelectionParams>,
+        permissions: Option<String>,
         base_instructions: Option<String>,
         developer_instructions: Option<String>,
         personality: Option<Personality>,
     ) -> ConfigOverrides {
-        let mut overrides = ConfigOverrides {
+        ConfigOverrides {
             model,
             model_provider,
             service_tier,
             cwd: cwd.map(PathBuf::from),
+            workspace_roots: runtime_workspace_roots,
+            default_permissions: permissions,
             approval_policy: approval_policy
                 .map(codex_app_server_protocol::AskForApproval::to_core),
             approvals_reviewer: approvals_reviewer
@@ -1236,9 +1262,7 @@ impl ThreadRequestProcessor {
             developer_instructions,
             personality,
             ..Default::default()
-        };
-        apply_permission_profile_selection_to_config_overrides(&mut overrides, permissions);
-        overrides
+        }
     }
 
     fn parse_environment_selections(
@@ -1714,6 +1738,16 @@ impl ThreadRequestProcessor {
         if command.is_empty() {
             return Err(invalid_request("command must not be empty"));
         }
+        // `thread/shellCommand` is app-server's local-host shell escape hatch,
+        // not the normal turn-selected shell tool path.
+        if self
+            .thread_manager
+            .environment_manager()
+            .try_local_environment()
+            .is_none()
+        {
+            return Err(internal_error("local environment is not configured"));
+        }
 
         let (_, thread) = self.load_thread(&thread_id).await?;
         self.submit_core_op(
@@ -2349,6 +2383,7 @@ impl ThreadRequestProcessor {
             model_provider,
             service_tier,
             cwd,
+            runtime_workspace_roots,
             approval_policy,
             approvals_reviewer,
             sandbox,
@@ -2384,6 +2419,7 @@ impl ThreadRequestProcessor {
             model_provider,
             service_tier,
             cwd,
+            runtime_workspace_roots,
             approval_policy,
             approvals_reviewer,
             sandbox,
@@ -2521,11 +2557,11 @@ impl ThreadRequestProcessor {
                     model_provider: session_configured.model_provider_id,
                     service_tier: session_configured.service_tier,
                     cwd: session_configured.cwd,
+                    runtime_workspace_roots: config_snapshot.workspace_roots,
                     instruction_sources,
                     approval_policy: session_configured.approval_policy.into(),
                     approvals_reviewer: session_configured.approvals_reviewer.into(),
                     sandbox,
-                    permission_profile: Some(config_snapshot.permission_profile.into()),
                     active_permission_profile,
                     reasoning_effort: session_configured.reasoning_effort,
                 };
@@ -2603,31 +2639,6 @@ impl ThreadRequestProcessor {
                 )));
             }
             None
-        } else if params.path.is_some() {
-            let source_thread = self
-                .read_stored_thread_for_resume(
-                    &params.thread_id,
-                    params.path.as_ref(),
-                    /*include_history*/ true,
-                )
-                .await?;
-            let existing_thread_id = source_thread.thread_id;
-            if let Ok(existing_thread) = self.thread_manager.get_thread(existing_thread_id).await {
-                if let (Some(requested_path), Some(active_path)) = (
-                    params.path.as_ref(),
-                    existing_thread.rollout_path().as_ref(),
-                ) && requested_path != active_path
-                {
-                    return Err(invalid_request(format!(
-                        "cannot resume running thread {existing_thread_id} with stale path: requested `{}`, active `{}`",
-                        requested_path.display(),
-                        active_path.display()
-                    )));
-                }
-                Some((existing_thread_id, existing_thread, source_thread))
-            } else {
-                None
-            }
         } else if let Ok(existing_thread_id) = ThreadId::from_string(&params.thread_id)
             && let Ok(existing_thread) = self.thread_manager.get_thread(existing_thread_id).await
         {
@@ -2650,6 +2661,19 @@ impl ThreadRequestProcessor {
         };
 
         if let Some((existing_thread_id, existing_thread, source_thread)) = running_thread {
+            let existing_thread_rollout_path = existing_thread.rollout_path();
+            let active_path = existing_thread_rollout_path
+                .as_ref()
+                .or(source_thread.rollout_path.as_ref());
+            if let (Some(requested_path), Some(active_path)) = (params.path.as_ref(), active_path)
+                && requested_path != active_path
+            {
+                return Err(invalid_request(format!(
+                    "cannot resume running thread {existing_thread_id} with stale path: requested `{}`, active `{}`",
+                    requested_path.display(),
+                    active_path.display()
+                )));
+            }
             let redact_resume_payloads =
                 should_redact_thread_resume_payloads(app_server_client_name.as_deref());
             let history_items = source_thread
@@ -2985,6 +3009,7 @@ impl ThreadRequestProcessor {
             model_provider,
             service_tier,
             cwd,
+            runtime_workspace_roots,
             approval_policy,
             approvals_reviewer,
             sandbox,
@@ -3050,6 +3075,7 @@ impl ThreadRequestProcessor {
             model_provider,
             service_tier,
             cwd,
+            runtime_workspace_roots,
             approval_policy,
             approvals_reviewer,
             sandbox,
@@ -3179,11 +3205,11 @@ impl ThreadRequestProcessor {
             model_provider: session_configured.model_provider_id,
             service_tier: session_configured.service_tier,
             cwd: session_configured.cwd,
+            runtime_workspace_roots: config_snapshot.workspace_roots,
             instruction_sources,
             approval_policy: session_configured.approval_policy.into(),
             approvals_reviewer: session_configured.approvals_reviewer.into(),
             sandbox,
-            permission_profile: Some(config_snapshot.permission_profile.into()),
             active_permission_profile,
             reasoning_effort: session_configured.reasoning_effort,
         };
@@ -3903,7 +3929,9 @@ fn requested_permissions_trust_project(overrides: &ConfigOverrides, cwd: &Path)
 
     if matches!(
         overrides.default_permissions.as_deref(),
-        Some(":workspace" | ":danger-no-sandbox")
+        Some(
+            BUILT_IN_PERMISSION_PROFILE_WORKSPACE | BUILT_IN_PERMISSION_PROFILE_DANGER_FULL_ACCESS
+        )
     ) {
         return true;
     }
diff --git a/codex-rs/app-server/src/request_processors/thread_processor_tests.rs b/codex-rs/app-server/src/request_processors/thread_processor_tests.rs
index 61a31f9c4d..f4593ab7c4 100644
--- a/codex-rs/app-server/src/request_processors/thread_processor_tests.rs
+++ b/codex-rs/app-server/src/request_processors/thread_processor_tests.rs
@@ -62,6 +62,12 @@ mod thread_processor_behavior_tests {
     use codex_model_provider_info::ModelProviderInfo;
     use codex_model_provider_info::WireApi;
     use codex_protocol::ThreadId;
+    use codex_protocol::config_types::CollaborationMode;
+    use codex_protocol::config_types::ModeKind;
+    use codex_protocol::config_types::Settings;
+    use codex_protocol::models::BUILT_IN_PERMISSION_PROFILE_DANGER_FULL_ACCESS;
+    use codex_protocol::models::BUILT_IN_PERMISSION_PROFILE_READ_ONLY;
+    use codex_protocol::models::BUILT_IN_PERMISSION_PROFILE_WORKSPACE;
     use codex_protocol::openai_models::ReasoningEffort;
     use codex_protocol::permissions::FileSystemAccessMode;
     use codex_protocol::permissions::FileSystemPath;
@@ -211,6 +217,7 @@ mod thread_processor_behavior_tests {
                 images: None,
                 local_images: Vec::new(),
                 text_elements: Vec::new(),
+                ..Default::default()
             },
         ))];
         let active_turn = Turn {
@@ -438,7 +445,7 @@ mod thread_processor_behavior_tests {
                         path: FileSystemPath::GlobPattern {
                             pattern: "/tmp/project/**/*.env".to_string(),
                         },
-                        access: FileSystemAccessMode::None,
+                        access: FileSystemAccessMode::Deny,
                     },
                 ]),
                 NetworkSandboxPolicy::Restricted,
@@ -467,14 +474,16 @@ mod thread_processor_behavior_tests {
         ));
         assert!(requested_permissions_trust_project(
             &ConfigOverrides {
-                default_permissions: Some(":workspace".to_string()),
+                default_permissions: Some(BUILT_IN_PERMISSION_PROFILE_WORKSPACE.to_string()),
                 ..Default::default()
             },
             cwd.as_path()
         ));
         assert!(requested_permissions_trust_project(
             &ConfigOverrides {
-                default_permissions: Some(":danger-no-sandbox".to_string()),
+                default_permissions: Some(
+                    BUILT_IN_PERMISSION_PROFILE_DANGER_FULL_ACCESS.to_string()
+                ),
                 ..Default::default()
             },
             cwd.as_path()
@@ -488,7 +497,7 @@ mod thread_processor_behavior_tests {
         ));
         assert!(!requested_permissions_trust_project(
             &ConfigOverrides {
-                default_permissions: Some(":read-only".to_string()),
+                default_permissions: Some(BUILT_IN_PERMISSION_PROFILE_READ_ONLY.to_string()),
                 ..Default::default()
             },
             cwd.as_path()
@@ -582,6 +591,7 @@ mod thread_processor_behavior_tests {
             temp_dir.path().to_path_buf(),
             Vec::new(),
             LoaderOverrides::default(),
+            /*strict_config*/ false,
             CloudRequirementsLoader::default(),
             Arg0DispatchPaths::default(),
             Arc::new(StaticThreadConfigLoader::new(vec![
@@ -630,6 +640,7 @@ mod thread_processor_behavior_tests {
             model_provider: None,
             service_tier: Some(Some("priority".to_string())),
             cwd: None,
+            runtime_workspace_roots: None,
             approval_policy: None,
             approvals_reviewer: None,
             sandbox: None,
@@ -650,9 +661,20 @@ mod thread_processor_behavior_tests {
             permission_profile: codex_protocol::models::PermissionProfile::Disabled,
             active_permission_profile: None,
             cwd,
+            workspace_roots: Vec::new(),
+            profile_workspace_roots: Vec::new(),
             ephemeral: false,
             reasoning_effort: None,
+            reasoning_summary: None,
             personality: None,
+            collaboration_mode: CollaborationMode {
+                mode: ModeKind::Default,
+                settings: Settings {
+                    model: "gpt-5".to_string(),
+                    reasoning_effort: None,
+                    developer_instructions: None,
+                },
+            },
             session_source: SessionSource::Cli,
             thread_source: None,
         };
diff --git a/codex-rs/app-server/src/request_processors/thread_summary.rs b/codex-rs/app-server/src/request_processors/thread_summary.rs
index 875bd3deaf..fea49b1637 100644
--- a/codex-rs/app-server/src/request_processors/thread_summary.rs
+++ b/codex-rs/app-server/src/request_processors/thread_summary.rs
@@ -175,25 +175,6 @@ pub(super) fn thread_response_active_permission_profile(
     active_permission_profile.map(Into::into)
 }
 
-pub(super) fn apply_permission_profile_selection_to_config_overrides(
-    overrides: &mut ConfigOverrides,
-    permissions: Option<PermissionProfileSelectionParams>,
-) {
-    let Some(PermissionProfileSelectionParams::Profile { id, modifications }) = permissions else {
-        return;
-    };
-    overrides.default_permissions = Some(id);
-    overrides
-        .additional_writable_roots
-        .extend(modifications.unwrap_or_default().into_iter().map(
-            |modification| match modification {
-                PermissionProfileModificationParams::AdditionalWritableRoot { path } => {
-                    path.to_path_buf()
-                }
-            },
-        ));
-}
-
 pub(super) fn thread_response_sandbox_policy(
     permission_profile: &codex_protocol::models::PermissionProfile,
     cwd: &Path,
diff --git a/codex-rs/app-server/src/request_processors/token_usage_replay.rs b/codex-rs/app-server/src/request_processors/token_usage_replay.rs
index b19c4a61a0..b8c65645fc 100644
--- a/codex-rs/app-server/src/request_processors/token_usage_replay.rs
+++ b/codex-rs/app-server/src/request_processors/token_usage_replay.rs
@@ -152,6 +152,7 @@ mod tests {
                 images: None,
                 local_images: Vec::new(),
                 text_elements: Vec::new(),
+                ..Default::default()
             })),
             RolloutItem::EventMsg(EventMsg::AgentMessage(AgentMessageEvent {
                 message: "first answer".to_string(),
@@ -167,6 +168,7 @@ mod tests {
                 images: None,
                 local_images: Vec::new(),
                 text_elements: Vec::new(),
+                ..Default::default()
             })),
         ]
     }
diff --git a/codex-rs/app-server/src/request_processors/turn_processor.rs b/codex-rs/app-server/src/request_processors/turn_processor.rs
index d1dae4ef46..71715e5079 100644
--- a/codex-rs/app-server/src/request_processors/turn_processor.rs
+++ b/codex-rs/app-server/src/request_processors/turn_processor.rs
@@ -16,6 +16,20 @@ pub(crate) struct TurnRequestProcessor {
     skills_watcher: Arc<SkillsWatcher>,
 }
 
+fn resolve_runtime_workspace_roots(
+    workspace_roots: Vec<PathBuf>,
+    base_cwd: &AbsolutePathBuf,
+) -> Vec<AbsolutePathBuf> {
+    let mut resolved_roots = Vec::new();
+    for path in workspace_roots {
+        let root = AbsolutePathBuf::resolve_path_against_base(path, base_cwd.as_path());
+        if !resolved_roots.iter().any(|existing| existing == &root) {
+            resolved_roots.push(root);
+        }
+    }
+    resolved_roots
+}
+
 impl TurnRequestProcessor {
     #[allow(clippy::too_many_arguments)]
     pub(crate) fn new(
@@ -355,8 +369,16 @@ impl TurnRequestProcessor {
             .map(V2UserInput::into_core)
             .collect();
         let turn_has_input = !mapped_items.is_empty();
+        let runtime_workspace_roots_request = params.runtime_workspace_roots.clone();
+        let snapshot = if params.permissions.is_some() || runtime_workspace_roots_request.is_some()
+        {
+            Some(thread.config_snapshot().await)
+        } else {
+            None
+        };
 
         let has_any_overrides = params.cwd.is_some()
+            || runtime_workspace_roots_request.is_some()
             || params.approval_policy.is_some()
             || params.approvals_reviewer.is_some()
             || params.sandbox_policy.is_some()
@@ -375,24 +397,50 @@ impl TurnRequestProcessor {
         }
 
         let cwd = params.cwd;
+        let runtime_workspace_roots = if let Some(workspace_roots) =
+            runtime_workspace_roots_request.clone()
+        {
+            let Some(snapshot) = snapshot.as_ref() else {
+                return Err(internal_error(
+                    "turn/start runtime workspace roots missing thread snapshot",
+                ));
+            };
+            let base_cwd = cwd
+                .as_ref()
+                .map(|cwd| AbsolutePathBuf::resolve_path_against_base(cwd, snapshot.cwd.as_path()))
+                .unwrap_or_else(|| snapshot.cwd.clone());
+            Some(resolve_runtime_workspace_roots(workspace_roots, &base_cwd))
+        } else {
+            None
+        };
         let approval_policy = params.approval_policy.map(AskForApproval::to_core);
         let approvals_reviewer = params
             .approvals_reviewer
             .map(codex_app_server_protocol::ApprovalsReviewer::to_core);
         let sandbox_policy = params.sandbox_policy.map(|p| p.to_core());
-        let (permission_profile, active_permission_profile) =
+        let (permission_profile, active_permission_profile, profile_workspace_roots) =
             if let Some(permissions) = params.permissions {
-                let snapshot = thread.config_snapshot().await;
-                let mut overrides = ConfigOverrides {
+                let Some(snapshot) = snapshot.as_ref() else {
+                    return Err(internal_error(
+                        "turn/start permission selection missing thread snapshot",
+                    ));
+                };
+                let overrides = ConfigOverrides {
                     cwd: cwd.clone(),
+                    workspace_roots: Some(runtime_workspace_roots_request.clone().unwrap_or_else(
+                        || {
+                            snapshot
+                                .workspace_roots
+                                .iter()
+                                .map(AbsolutePathBuf::to_path_buf)
+                                .collect()
+                        },
+                    )),
+                    default_permissions: Some(permissions),
                     codex_linux_sandbox_exe: self.arg0_paths.codex_linux_sandbox_exe.clone(),
                     main_execve_wrapper_exe: self.arg0_paths.main_execve_wrapper_exe.clone(),
                     ..Default::default()
                 };
-                apply_permission_profile_selection_to_config_overrides(
-                    &mut overrides,
-                    Some(permissions),
-                );
                 let config = self
                     .config_manager
                     .load_for_cwd(
@@ -409,15 +457,16 @@ impl TurnRequestProcessor {
                     warning.contains("Configured value for `permission_profile` is disallowed")
                 }) {
                     return Err(invalid_request(format!(
-                        "invalid turn context override: {warning}"
+                        "invalid thread settings override: {warning}"
                     )));
                 }
                 (
-                    Some(config.permissions.permission_profile()),
+                    Some(config.permissions.permission_profile().clone()),
                     config.permissions.active_permission_profile(),
+                    Some(config.permissions.profile_workspace_roots().to_vec()),
                 )
             } else {
-                (None, None)
+                (None, None, None)
             };
         let model = params.model;
         let effort = params.effort.map(Some);
@@ -430,13 +479,15 @@ impl TurnRequestProcessor {
         // still queued together with the input below to preserve submission order.
         if has_any_overrides {
             thread
-                .validate_turn_context_overrides(CodexThreadTurnContextOverrides {
+                .preview_thread_settings_overrides(CodexThreadSettingsOverrides {
                     cwd: cwd.clone(),
+                    workspace_roots: runtime_workspace_roots.clone(),
                     approval_policy,
                     approvals_reviewer,
                     sandbox_policy: sandbox_policy.clone(),
                     permission_profile: permission_profile.clone(),
                     active_permission_profile: active_permission_profile.clone(),
+                    profile_workspace_roots: profile_workspace_roots.clone(),
                     windows_sandbox_level: None,
                     model: model.clone(),
                     effort,
@@ -446,37 +497,36 @@ impl TurnRequestProcessor {
                     personality,
                 })
                 .await
-                .map_err(|err| invalid_request(format!("invalid turn context override: {err}")))?;
+                .map_err(|err| {
+                    invalid_request(format!("invalid thread settings override: {err}"))
+                })?;
         }
 
+        let thread_settings = codex_protocol::protocol::ThreadSettingsOverrides {
+            cwd,
+            workspace_roots: runtime_workspace_roots,
+            profile_workspace_roots,
+            approval_policy,
+            approvals_reviewer,
+            sandbox_policy,
+            permission_profile,
+            active_permission_profile,
+            windows_sandbox_level: None,
+            model,
+            effort,
+            summary,
+            service_tier,
+            collaboration_mode,
+            personality,
+        };
+
         // Start the turn by submitting the user input. Return its submission id as turn_id.
-        let turn_op = if has_any_overrides {
-            Op::UserInputWithTurnContext {
-                items: mapped_items,
-                environments: environment_selections,
-                final_output_json_schema: params.output_schema,
-                responsesapi_client_metadata: params.responsesapi_client_metadata,
-                cwd,
-                approval_policy,
-                approvals_reviewer,
-                sandbox_policy,
-                permission_profile,
-                active_permission_profile,
-                windows_sandbox_level: None,
-                model,
-                effort,
-                summary,
-                service_tier,
-                collaboration_mode,
-                personality,
-            }
-        } else {
-            Op::UserInput {
-                items: mapped_items,
-                environments: environment_selections,
-                final_output_json_schema: params.output_schema,
-                responsesapi_client_metadata: params.responsesapi_client_metadata,
-            }
+        let turn_op = Op::UserInput {
+            items: mapped_items,
+            environments: environment_selections,
+            final_output_json_schema: params.output_schema,
+            responsesapi_client_metadata: params.responsesapi_client_metadata,
+            thread_settings,
         };
         let turn_id = self
             .submit_core_op(&request_id, thread.as_ref(), turn_op)
diff --git a/codex-rs/app-server/src/transport.rs b/codex-rs/app-server/src/transport.rs
index 3d18cf321b..f7222bd28f 100644
--- a/codex-rs/app-server/src/transport.rs
+++ b/codex-rs/app-server/src/transport.rs
@@ -18,7 +18,9 @@ pub(crate) use codex_app_server_transport::ConnectionId;
 pub(crate) use codex_app_server_transport::ConnectionOrigin;
 pub(crate) use codex_app_server_transport::OutgoingMessage;
 pub(crate) use codex_app_server_transport::QueuedOutgoingMessage;
+pub(crate) use codex_app_server_transport::RemoteControlHandle;
 pub(crate) use codex_app_server_transport::RemoteControlStartConfig;
+pub(crate) use codex_app_server_transport::RemoteControlUnavailable;
 pub(crate) use codex_app_server_transport::TransportEvent;
 pub use codex_app_server_transport::app_server_control_socket_path;
 pub use codex_app_server_transport::auth;
diff --git a/codex-rs/app-server/tests/common/mcp_process.rs b/codex-rs/app-server/tests/common/mcp_process.rs
index 81a5b2b401..3445010a7f 100644
--- a/codex-rs/app-server/tests/common/mcp_process.rs
+++ b/codex-rs/app-server/tests/common/mcp_process.rs
@@ -57,6 +57,7 @@ use codex_app_server_protocol::MockExperimentalMethodParams;
 use codex_app_server_protocol::ModelListParams;
 use codex_app_server_protocol::ModelProviderCapabilitiesReadParams;
 use codex_app_server_protocol::PluginInstallParams;
+use codex_app_server_protocol::PluginInstalledParams;
 use codex_app_server_protocol::PluginListParams;
 use codex_app_server_protocol::PluginReadParams;
 use codex_app_server_protocol::PluginSkillReadParams;
@@ -570,6 +571,24 @@ impl McpProcess {
             .await
     }
 
+    /// Send a `remoteControl/enable` JSON-RPC request.
+    pub async fn send_remote_control_enable_request(&mut self) -> anyhow::Result<i64> {
+        self.send_request("remoteControl/enable", /*params*/ None)
+            .await
+    }
+
+    /// Send a `remoteControl/disable` JSON-RPC request.
+    pub async fn send_remote_control_disable_request(&mut self) -> anyhow::Result<i64> {
+        self.send_request("remoteControl/disable", /*params*/ None)
+            .await
+    }
+
+    /// Send a `remoteControl/status/read` JSON-RPC request.
+    pub async fn send_remote_control_status_read_request(&mut self) -> anyhow::Result<i64> {
+        self.send_request("remoteControl/status/read", /*params*/ None)
+            .await
+    }
+
     /// Send an `app/list` JSON-RPC request.
     pub async fn send_apps_list_request(&mut self, params: AppsListParams) -> anyhow::Result<i64> {
         let params = Some(serde_json::to_value(params)?);
@@ -666,6 +685,15 @@ impl McpProcess {
         self.send_request("plugin/list", params).await
     }
 
+    /// Send a `plugin/installed` JSON-RPC request.
+    pub async fn send_plugin_installed_request(
+        &mut self,
+        params: PluginInstalledParams,
+    ) -> anyhow::Result<i64> {
+        let params = Some(serde_json::to_value(params)?);
+        self.send_request("plugin/installed", params).await
+    }
+
     /// Send a `plugin/read` JSON-RPC request.
     pub async fn send_plugin_read_request(
         &mut self,
diff --git a/codex-rs/app-server/tests/suite/conversation_summary.rs b/codex-rs/app-server/tests/suite/conversation_summary.rs
index 754d1f9467..5253850107 100644
--- a/codex-rs/app-server/tests/suite/conversation_summary.rs
+++ b/codex-rs/app-server/tests/suite/conversation_summary.rs
@@ -149,6 +149,7 @@ async fn get_conversation_summary_by_thread_id_reads_pathless_store_thread() ->
         config: Arc::new(config),
         cli_overrides: Vec::new(),
         loader_overrides,
+        strict_config: false,
         cloud_requirements: CloudRequirementsLoader::default(),
         thread_config_loader: Arc::new(codex_config::NoopThreadConfigLoader),
         feedback: CodexFeedback::new(),
diff --git a/codex-rs/app-server/tests/suite/mod.rs b/codex-rs/app-server/tests/suite/mod.rs
index c60f4a32a1..bac309a930 100644
--- a/codex-rs/app-server/tests/suite/mod.rs
+++ b/codex-rs/app-server/tests/suite/mod.rs
@@ -1,4 +1,5 @@
 mod auth;
 mod conversation_summary;
 mod fuzzy_file_search;
+mod strict_config;
 mod v2;
diff --git a/codex-rs/app-server/tests/suite/strict_config.rs b/codex-rs/app-server/tests/suite/strict_config.rs
new file mode 100644
index 0000000000..93784c9752
--- /dev/null
+++ b/codex-rs/app-server/tests/suite/strict_config.rs
@@ -0,0 +1,33 @@
+use std::process::Command;
+
+use anyhow::Result;
+use tempfile::TempDir;
+
+#[test]
+fn strict_config_rejects_unknown_config_fields_for_standalone_app_server() -> Result<()> {
+    let codex_home = TempDir::new()?;
+    std::fs::write(
+        codex_home.path().join("config.toml"),
+        r#"
+foo = "bar"
+"#,
+    )?;
+
+    let output = Command::new(codex_utils_cargo_bin::cargo_bin("codex-app-server")?)
+        .env("CODEX_HOME", codex_home.path())
+        .env(
+            "CODEX_APP_SERVER_MANAGED_CONFIG_PATH",
+            codex_home.path().join("managed_config.toml"),
+        )
+        .args(["--strict-config", "--listen", "off"])
+        .output()?;
+
+    assert!(!output.status.success());
+    let stderr = String::from_utf8(output.stderr)?;
+    assert!(
+        stderr.contains("unknown configuration field `foo`"),
+        "expected strict config error in stderr, got: {stderr}"
+    );
+
+    Ok(())
+}
diff --git a/codex-rs/app-server/tests/suite/v2/account.rs b/codex-rs/app-server/tests/suite/v2/account.rs
index 50c365d633..a15b46abd9 100644
--- a/codex-rs/app-server/tests/suite/v2/account.rs
+++ b/codex-rs/app-server/tests/suite/v2/account.rs
@@ -44,20 +44,30 @@ use std::path::Path;
 use std::time::Duration;
 use tempfile::TempDir;
 use tokio::time::timeout;
+use url::Url;
 use wiremock::Mock;
 use wiremock::MockServer;
 use wiremock::ResponseTemplate;
 use wiremock::matchers::method;
 use wiremock::matchers::path;
 
-const DEFAULT_READ_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(10);
+const DEFAULT_READ_TIMEOUT: std::time::Duration = std::time::Duration::from_secs(60);
 const LOGIN_ISSUER_ENV_VAR: &str = "CODEX_APP_SERVER_LOGIN_ISSUER";
+const WORKSPACE_ID_ALLOWED: &str = "123e4567-e89b-42d3-a456-426614174000";
+const WORKSPACE_ID_SECOND_ALLOWED: &str = "123e4567-e89b-42d3-a456-426614174001";
+const WORKSPACE_ID_DISALLOWED: &str = "123e4567-e89b-42d3-a456-426614174002";
+const WORKSPACE_ID_EMBEDDED: &str = "123e4567-e89b-42d3-a456-426614174010";
+const WORKSPACE_ID_INITIAL: &str = "123e4567-e89b-42d3-a456-426614174011";
+const WORKSPACE_ID_REFRESHED: &str = "123e4567-e89b-42d3-a456-426614174012";
+const WORKSPACE_ID_DEVICE: &str = "123e4567-e89b-42d3-a456-426614174013";
+const WORKSPACE_ID_STALE: &str = "123e4567-e89b-42d3-a456-426614174014";
 
 // Helper to create a minimal config.toml for the app server
 #[derive(Default)]
 struct CreateConfigTomlParams {
     forced_method: Option<String>,
     forced_workspace_id: Option<String>,
+    forced_workspace_ids: Option<Vec<String>>,
     requires_openai_auth: Option<bool>,
     base_url: Option<String>,
     model_provider_id: Option<String>,
@@ -76,6 +86,13 @@ fn create_config_toml(codex_home: &Path, params: CreateConfigTomlParams) -> std:
     };
     let forced_workspace_line = if let Some(ws) = params.forced_workspace_id {
         format!("forced_chatgpt_workspace_id = \"{ws}\"\n")
+    } else if let Some(workspaces) = params.forced_workspace_ids {
+        let workspaces = workspaces
+            .into_iter()
+            .map(|workspace_id| format!("\"{workspace_id}\""))
+            .collect::<Vec<_>>()
+            .join(", ");
+        format!("forced_chatgpt_workspace_id = [{workspaces}]\n")
     } else {
         String::new()
     };
@@ -248,7 +265,7 @@ async fn set_auth_token_updates_account_and_notifies() -> Result<()> {
         &ChatGptIdTokenClaims::new()
             .email("embedded@example.com")
             .plan_type("pro")
-            .chatgpt_account_id("org-embedded"),
+            .chatgpt_account_id(WORKSPACE_ID_EMBEDDED),
     )?;
 
     let mut mcp = McpProcess::new_with_env(codex_home.path(), &[("OPENAI_API_KEY", None)]).await?;
@@ -257,7 +274,7 @@ async fn set_auth_token_updates_account_and_notifies() -> Result<()> {
     let set_id = mcp
         .send_chatgpt_auth_tokens_login_request(
             access_token,
-            "org-embedded".to_string(),
+            WORKSPACE_ID_EMBEDDED.to_string(),
             Some("pro".to_string()),
         )
         .await?;
@@ -322,7 +339,7 @@ async fn account_read_refresh_token_is_noop_in_external_mode() -> Result<()> {
         &ChatGptIdTokenClaims::new()
             .email("embedded@example.com")
             .plan_type("pro")
-            .chatgpt_account_id("org-embedded"),
+            .chatgpt_account_id(WORKSPACE_ID_EMBEDDED),
     )?;
 
     let mut mcp = McpProcess::new_with_env(codex_home.path(), &[("OPENAI_API_KEY", None)]).await?;
@@ -331,7 +348,7 @@ async fn account_read_refresh_token_is_noop_in_external_mode() -> Result<()> {
     let set_id = mcp
         .send_chatgpt_auth_tokens_login_request(
             access_token,
-            "org-embedded".to_string(),
+            WORKSPACE_ID_EMBEDDED.to_string(),
             Some("pro".to_string()),
         )
         .await?;
@@ -441,13 +458,13 @@ async fn external_auth_refreshes_on_unauthorized() -> Result<()> {
         &ChatGptIdTokenClaims::new()
             .email("initial@example.com")
             .plan_type("pro")
-            .chatgpt_account_id("org-initial"),
+            .chatgpt_account_id(WORKSPACE_ID_INITIAL),
     )?;
     let refreshed_access_token = encode_id_token(
         &ChatGptIdTokenClaims::new()
             .email("refreshed@example.com")
             .plan_type("pro")
-            .chatgpt_account_id("org-refreshed"),
+            .chatgpt_account_id(WORKSPACE_ID_REFRESHED),
     )?;
 
     let mut mcp = McpProcess::new_with_env(codex_home.path(), &[("OPENAI_API_KEY", None)]).await?;
@@ -456,7 +473,7 @@ async fn external_auth_refreshes_on_unauthorized() -> Result<()> {
     let set_id = mcp
         .send_chatgpt_auth_tokens_login_request(
             initial_access_token.clone(),
-            "org-initial".to_string(),
+            WORKSPACE_ID_INITIAL.to_string(),
             Some("pro".to_string()),
         )
         .await?;
@@ -499,7 +516,7 @@ async fn external_auth_refreshes_on_unauthorized() -> Result<()> {
     respond_to_refresh_request(
         &mut mcp,
         &refreshed_access_token,
-        "org-refreshed",
+        WORKSPACE_ID_REFRESHED,
         Some("pro"),
     )
     .await?;
@@ -553,7 +570,7 @@ async fn external_auth_refresh_error_fails_turn() -> Result<()> {
         &ChatGptIdTokenClaims::new()
             .email("initial@example.com")
             .plan_type("pro")
-            .chatgpt_account_id("org-initial"),
+            .chatgpt_account_id(WORKSPACE_ID_INITIAL),
     )?;
 
     let mut mcp = McpProcess::new_with_env(codex_home.path(), &[("OPENAI_API_KEY", None)]).await?;
@@ -562,7 +579,7 @@ async fn external_auth_refresh_error_fails_turn() -> Result<()> {
     let set_id = mcp
         .send_chatgpt_auth_tokens_login_request(
             initial_access_token,
-            "org-initial".to_string(),
+            WORKSPACE_ID_INITIAL.to_string(),
             Some("pro".to_string()),
         )
         .await?;
@@ -651,7 +668,7 @@ async fn external_auth_refresh_mismatched_workspace_fails_turn() -> Result<()> {
     create_config_toml(
         codex_home.path(),
         CreateConfigTomlParams {
-            forced_workspace_id: Some("org-expected".to_string()),
+            forced_workspace_id: Some(WORKSPACE_ID_ALLOWED.to_string()),
             requires_openai_auth: Some(true),
             base_url: Some(format!("{}/v1", mock_server.uri())),
             ..Default::default()
@@ -669,13 +686,13 @@ async fn external_auth_refresh_mismatched_workspace_fails_turn() -> Result<()> {
         &ChatGptIdTokenClaims::new()
             .email("initial@example.com")
             .plan_type("pro")
-            .chatgpt_account_id("org-expected"),
+            .chatgpt_account_id(WORKSPACE_ID_ALLOWED),
     )?;
     let refreshed_access_token = encode_id_token(
         &ChatGptIdTokenClaims::new()
             .email("refreshed@example.com")
             .plan_type("pro")
-            .chatgpt_account_id("org-other"),
+            .chatgpt_account_id(WORKSPACE_ID_DISALLOWED),
     )?;
 
     let mut mcp = McpProcess::new_with_env(codex_home.path(), &[("OPENAI_API_KEY", None)]).await?;
@@ -684,7 +701,7 @@ async fn external_auth_refresh_mismatched_workspace_fails_turn() -> Result<()> {
     let set_id = mcp
         .send_chatgpt_auth_tokens_login_request(
             initial_access_token,
-            "org-expected".to_string(),
+            WORKSPACE_ID_ALLOWED.to_string(),
             Some("pro".to_string()),
         )
         .await?;
@@ -738,7 +755,7 @@ async fn external_auth_refresh_mismatched_workspace_fails_turn() -> Result<()> {
         request_id,
         serde_json::to_value(ChatgptAuthTokensRefreshResponse {
             access_token: refreshed_access_token,
-            chatgpt_account_id: "org-other".to_string(),
+            chatgpt_account_id: WORKSPACE_ID_DISALLOWED.to_string(),
             chatgpt_plan_type: Some("pro".to_string()),
         })?,
     )
@@ -790,7 +807,7 @@ async fn external_auth_refresh_invalid_access_token_fails_turn() -> Result<()> {
         &ChatGptIdTokenClaims::new()
             .email("initial@example.com")
             .plan_type("pro")
-            .chatgpt_account_id("org-initial"),
+            .chatgpt_account_id(WORKSPACE_ID_INITIAL),
     )?;
 
     let mut mcp = McpProcess::new_with_env(codex_home.path(), &[("OPENAI_API_KEY", None)]).await?;
@@ -799,7 +816,7 @@ async fn external_auth_refresh_invalid_access_token_fails_turn() -> Result<()> {
     let set_id = mcp
         .send_chatgpt_auth_tokens_login_request(
             initial_access_token,
-            "org-initial".to_string(),
+            WORKSPACE_ID_INITIAL.to_string(),
             Some("pro".to_string()),
         )
         .await?;
@@ -853,7 +870,7 @@ async fn external_auth_refresh_invalid_access_token_fails_turn() -> Result<()> {
         request_id,
         serde_json::to_value(ChatgptAuthTokensRefreshResponse {
             access_token: "not-a-jwt".to_string(),
-            chatgpt_account_id: "org-initial".to_string(),
+            chatgpt_account_id: WORKSPACE_ID_INITIAL.to_string(),
             chatgpt_plan_type: Some("pro".to_string()),
         })?,
     )
@@ -1062,7 +1079,7 @@ async fn login_account_chatgpt_device_code_succeeds_and_notifies() -> Result<()>
         &ChatGptIdTokenClaims::new()
             .email("device@example.com")
             .plan_type("pro")
-            .chatgpt_account_id("org-device"),
+            .chatgpt_account_id(WORKSPACE_ID_DEVICE),
     )?;
     mock_device_code_oauth_token(&mock_server, &id_token).await;
 
@@ -1378,14 +1395,14 @@ async fn set_auth_token_cancels_active_chatgpt_login() -> Result<()> {
         &ChatGptIdTokenClaims::new()
             .email("embedded@example.com")
             .plan_type("pro")
-            .chatgpt_account_id("org-embedded"),
+            .chatgpt_account_id(WORKSPACE_ID_EMBEDDED),
     )?;
     // Set an external auth token instead of completing the ChatGPT login flow.
     // This should cancel the active login attempt.
     let set_id = mcp
         .send_chatgpt_auth_tokens_login_request(
             access_token,
-            "org-embedded".to_string(),
+            WORKSPACE_ID_EMBEDDED.to_string(),
             Some("pro".to_string()),
         )
         .await?;
@@ -1428,7 +1445,7 @@ async fn login_account_chatgpt_includes_forced_workspace_query_param() -> Result
     create_config_toml(
         codex_home.path(),
         CreateConfigTomlParams {
-            forced_workspace_id: Some("ws-forced".to_string()),
+            forced_workspace_id: Some(WORKSPACE_ID_ALLOWED.to_string()),
             ..Default::default()
         },
     )?;
@@ -1448,12 +1465,56 @@ async fn login_account_chatgpt_includes_forced_workspace_query_param() -> Result
         bail!("unexpected login response: {login:?}");
     };
     assert!(
-        auth_url.contains("allowed_workspace_id=ws-forced"),
+        auth_url.contains(&format!("allowed_workspace_id={WORKSPACE_ID_ALLOWED}")),
         "auth URL should include forced workspace"
     );
     Ok(())
 }
 
+#[tokio::test]
+// Serialize tests that launch the login server since it binds to a fixed port.
+#[serial(login_port)]
+async fn login_account_chatgpt_includes_forced_workspace_allowlist_query_param() -> Result<()> {
+    let codex_home = TempDir::new()?;
+    create_config_toml(
+        codex_home.path(),
+        CreateConfigTomlParams {
+            forced_workspace_ids: Some(vec![
+                WORKSPACE_ID_ALLOWED.to_string(),
+                WORKSPACE_ID_SECOND_ALLOWED.to_string(),
+            ]),
+            ..Default::default()
+        },
+    )?;
+
+    let mut mcp = McpProcess::new(codex_home.path()).await?;
+    timeout(DEFAULT_READ_TIMEOUT, mcp.initialize()).await??;
+
+    let request_id = mcp.send_login_account_chatgpt_request().await?;
+    let resp: JSONRPCResponse = timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(request_id)),
+    )
+    .await??;
+
+    let login: LoginAccountResponse = to_response(resp)?;
+    let LoginAccountResponse::Chatgpt { auth_url, .. } = login else {
+        bail!("unexpected login response: {login:?}");
+    };
+    let auth_url = Url::parse(&auth_url)?;
+    let allowed_workspace_ids = auth_url
+        .query_pairs()
+        .filter_map(|(key, value)| (key == "allowed_workspace_id").then(|| value.into_owned()))
+        .collect::<Vec<_>>();
+    assert_eq!(
+        allowed_workspace_ids,
+        vec![format!(
+            "{WORKSPACE_ID_ALLOWED},{WORKSPACE_ID_SECOND_ALLOWED}"
+        )]
+    );
+    Ok(())
+}
+
 #[tokio::test]
 async fn get_account_no_auth() -> Result<()> {
     let codex_home = TempDir::new()?;
@@ -1662,7 +1723,7 @@ async fn get_account_omits_chatgpt_after_permanent_refresh_failure() -> Result<(
         codex_home.path(),
         ChatGptAuthFixture::new("stale-access-token")
             .refresh_token("stale-refresh-token")
-            .account_id("acct_123")
+            .account_id(WORKSPACE_ID_STALE)
             .email("user@example.com")
             .plan_type("pro")
             .last_refresh(Some(Utc::now() - ChronoDuration::days(9))),
diff --git a/codex-rs/app-server/tests/suite/v2/command_exec.rs b/codex-rs/app-server/tests/suite/v2/command_exec.rs
index 211cec9355..9757767c9f 100644
--- a/codex-rs/app-server/tests/suite/v2/command_exec.rs
+++ b/codex-rs/app-server/tests/suite/v2/command_exec.rs
@@ -13,19 +13,15 @@ use codex_app_server_protocol::CommandExecResponse;
 use codex_app_server_protocol::CommandExecTerminalSize;
 use codex_app_server_protocol::CommandExecTerminateParams;
 use codex_app_server_protocol::CommandExecWriteParams;
-use codex_app_server_protocol::FileSystemAccessMode;
-use codex_app_server_protocol::FileSystemPath;
-use codex_app_server_protocol::FileSystemSandboxEntry;
-use codex_app_server_protocol::FileSystemSpecialPath;
 use codex_app_server_protocol::JSONRPCMessage;
 use codex_app_server_protocol::JSONRPCNotification;
-use codex_app_server_protocol::PermissionProfile;
-use codex_app_server_protocol::PermissionProfileFileSystemPermissions;
-use codex_app_server_protocol::PermissionProfileNetworkPermissions;
 use codex_app_server_protocol::RequestId;
 use codex_app_server_protocol::SandboxPolicy;
+use codex_exec_server::CODEX_EXEC_SERVER_URL_ENV_VAR;
+use codex_protocol::models::BUILT_IN_PERMISSION_PROFILE_READ_ONLY;
 use pretty_assertions::assert_eq;
 use std::collections::HashMap;
+use std::path::Path;
 use tempfile::TempDir;
 use tokio::time::Duration;
 use tokio::time::Instant;
@@ -224,7 +220,7 @@ async fn command_exec_accepts_permission_profile() -> Result<()> {
             env: None,
             size: None,
             sandbox_policy: None,
-            permission_profile: Some(root_read_only_permission_profile()),
+            permission_profile: Some(BUILT_IN_PERMISSION_PROFILE_READ_ONLY.to_string()),
         })
         .await?;
 
@@ -244,6 +240,105 @@ async fn command_exec_accepts_permission_profile() -> Result<()> {
     Ok(())
 }
 
+#[tokio::test]
+async fn command_exec_permission_profile_starts_selected_network_proxy() -> Result<()> {
+    let server = create_mock_responses_server_sequence_unchecked(Vec::new()).await;
+    let codex_home = TempDir::new()?;
+    create_config_toml(codex_home.path(), &server.uri(), "never")?;
+    insert_networked_permission_profile_config(
+        codex_home.path(),
+        /*default_permissions*/ None,
+    )?;
+    let mut mcp = McpProcess::new(codex_home.path()).await?;
+    timeout(DEFAULT_READ_TIMEOUT, mcp.initialize()).await??;
+
+    let command_request_id = mcp
+        .send_command_exec_request(CommandExecParams {
+            command: vec![
+                "sh".to_string(),
+                "-lc".to_string(),
+                "printf '%s' \"${CODEX_NETWORK_PROXY_ACTIVE-unset}\"".to_string(),
+            ],
+            process_id: None,
+            tty: false,
+            stream_stdin: false,
+            stream_stdout_stderr: false,
+            output_bytes_cap: None,
+            disable_output_cap: false,
+            disable_timeout: false,
+            timeout_ms: None,
+            cwd: None,
+            env: None,
+            size: None,
+            sandbox_policy: None,
+            permission_profile: Some("networked".to_string()),
+        })
+        .await?;
+
+    let response = mcp
+        .read_stream_until_response_message(RequestId::Integer(command_request_id))
+        .await?;
+    let response: CommandExecResponse = to_response(response)?;
+    assert_eq!(
+        response,
+        CommandExecResponse {
+            exit_code: 0,
+            stdout: "1".to_string(),
+            stderr: String::new(),
+        }
+    );
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn command_exec_permission_profile_does_not_reuse_default_network_proxy() -> Result<()> {
+    let server = create_mock_responses_server_sequence_unchecked(Vec::new()).await;
+    let codex_home = TempDir::new()?;
+    create_config_toml(codex_home.path(), &server.uri(), "never")?;
+    insert_networked_permission_profile_config(codex_home.path(), Some("networked"))?;
+    let mut mcp = McpProcess::new(codex_home.path()).await?;
+    timeout(DEFAULT_READ_TIMEOUT, mcp.initialize()).await??;
+
+    let command_request_id = mcp
+        .send_command_exec_request(CommandExecParams {
+            command: vec![
+                "sh".to_string(),
+                "-lc".to_string(),
+                "printf '%s' \"${CODEX_NETWORK_PROXY_ACTIVE-unset}\"".to_string(),
+            ],
+            process_id: None,
+            tty: false,
+            stream_stdin: false,
+            stream_stdout_stderr: false,
+            output_bytes_cap: None,
+            disable_output_cap: false,
+            disable_timeout: false,
+            timeout_ms: None,
+            cwd: None,
+            env: None,
+            size: None,
+            sandbox_policy: None,
+            permission_profile: Some(BUILT_IN_PERMISSION_PROFILE_READ_ONLY.to_string()),
+        })
+        .await?;
+
+    let response = mcp
+        .read_stream_until_response_message(RequestId::Integer(command_request_id))
+        .await?;
+    let response: CommandExecResponse = to_response(response)?;
+    assert_eq!(
+        response,
+        CommandExecResponse {
+            exit_code: 0,
+            stdout: "unset".to_string(),
+            stderr: String::new(),
+        }
+    );
+
+    Ok(())
+}
+
 #[cfg(unix)]
 #[tokio::test]
 async fn command_exec_permission_profile_project_roots_use_command_cwd() -> Result<()> {
@@ -252,23 +347,17 @@ async fn command_exec_permission_profile_project_roots_use_command_cwd() -> Resu
     let command_dir = codex_home.path().join("command-cwd");
     std::fs::create_dir(&command_dir)?;
     create_config_toml(codex_home.path(), &server.uri(), "never")?;
+    insert_command_exec_config(
+        codex_home.path(),
+        r#"
+[permissions.command-cwd.filesystem]
+":root" = "read"
+":workspace_roots" = "write"
+"#,
+    )?;
     let mut mcp = McpProcess::new(codex_home.path()).await?;
     timeout(DEFAULT_READ_TIMEOUT, mcp.initialize()).await??;
 
-    let mut permission_profile = root_read_only_permission_profile();
-    let PermissionProfile::Managed { file_system, .. } = &mut permission_profile else {
-        panic!("root read-only helper should use managed permissions");
-    };
-    let PermissionProfileFileSystemPermissions::Restricted { entries, .. } = file_system else {
-        panic!("root read-only helper should use restricted filesystem permissions");
-    };
-    entries.push(FileSystemSandboxEntry {
-        path: FileSystemPath::Special {
-            value: FileSystemSpecialPath::ProjectRoots { subpath: None },
-        },
-        access: FileSystemAccessMode::Write,
-    });
-
     let command_request_id = mcp
         .send_command_exec_request(CommandExecParams {
             command: vec![
@@ -288,7 +377,7 @@ async fn command_exec_permission_profile_project_roots_use_command_cwd() -> Resu
             env: None,
             size: None,
             sandbox_policy: None,
-            permission_profile: Some(permission_profile),
+            permission_profile: Some("command-cwd".to_string()),
         })
         .await?;
 
@@ -306,12 +395,51 @@ async fn command_exec_permission_profile_project_roots_use_command_cwd() -> Resu
     );
     assert!(
         !codex_home.path().join("parent.txt").exists(),
-        "permissionProfile :project_roots write should not grant the server cwd when command cwd differs"
+        "permissionProfile :workspace_roots write should not grant the server cwd when command cwd differs"
     );
 
     Ok(())
 }
 
+#[tokio::test]
+async fn command_exec_returns_error_when_local_environment_is_disabled() -> Result<()> {
+    let server = create_mock_responses_server_sequence_unchecked(Vec::new()).await;
+    let codex_home = TempDir::new()?;
+    create_config_toml(codex_home.path(), &server.uri(), "never")?;
+    let mut mcp = McpProcess::new_with_env(
+        codex_home.path(),
+        &[(CODEX_EXEC_SERVER_URL_ENV_VAR, Some("none"))],
+    )
+    .await?;
+    timeout(DEFAULT_READ_TIMEOUT, mcp.initialize()).await??;
+
+    let command_request_id = mcp
+        .send_command_exec_request(CommandExecParams {
+            command: vec!["sh".to_string(), "-lc".to_string(), "true".to_string()],
+            process_id: None,
+            tty: false,
+            stream_stdin: false,
+            stream_stdout_stderr: false,
+            output_bytes_cap: None,
+            disable_output_cap: false,
+            disable_timeout: false,
+            timeout_ms: None,
+            cwd: None,
+            env: None,
+            size: None,
+            sandbox_policy: None,
+            permission_profile: None,
+        })
+        .await?;
+
+    let error = mcp
+        .read_stream_until_error_message(RequestId::Integer(command_request_id))
+        .await?;
+    assert_eq!(error.error.message, "local environment is not configured");
+
+    Ok(())
+}
+
 #[tokio::test]
 async fn command_exec_rejects_sandbox_policy_with_permission_profile() -> Result<()> {
     let server = create_mock_responses_server_sequence_unchecked(Vec::new()).await;
@@ -335,7 +463,7 @@ async fn command_exec_rejects_sandbox_policy_with_permission_profile() -> Result
             env: None,
             size: None,
             sandbox_policy: Some(SandboxPolicy::DangerFullAccess),
-            permission_profile: Some(root_read_only_permission_profile()),
+            permission_profile: Some(BUILT_IN_PERMISSION_PROFILE_READ_ONLY.to_string()),
         })
         .await?;
 
@@ -1061,19 +1189,41 @@ fn decode_delta_notification(
     serde_json::from_value(params).context("deserialize command/exec/outputDelta notification")
 }
 
-fn root_read_only_permission_profile() -> PermissionProfile {
-    PermissionProfile::Managed {
-        network: PermissionProfileNetworkPermissions { enabled: false },
-        file_system: PermissionProfileFileSystemPermissions::Restricted {
-            entries: vec![FileSystemSandboxEntry {
-                path: FileSystemPath::Special {
-                    value: FileSystemSpecialPath::Root,
-                },
-                access: FileSystemAccessMode::Read,
-            }],
-            glob_scan_max_depth: None,
-        },
-    }
+fn insert_networked_permission_profile_config(
+    codex_home: &Path,
+    default_permissions: Option<&str>,
+) -> Result<()> {
+    let default_permissions = default_permissions
+        .map(|default_permissions| format!("default_permissions = \"{default_permissions}\"\n\n"))
+        .unwrap_or_default();
+    let inserted_config = format!(
+        r#"{default_permissions}[features]
+network_proxy = true
+
+[permissions.networked.filesystem]
+":root" = "read"
+
+[permissions.networked.network]
+enabled = true
+proxy_url = "http://127.0.0.1:0"
+enable_socks5 = false
+
+"#
+    );
+    insert_command_exec_config(codex_home, &inserted_config)?;
+    Ok(())
+}
+
+fn insert_command_exec_config(codex_home: &Path, inserted_config: &str) -> Result<()> {
+    let config_path = codex_home.join("config.toml");
+    let config = std::fs::read_to_string(&config_path)?;
+    let marker = "\n[model_providers.mock_provider]\n";
+    let (prefix, suffix) = config
+        .split_once(marker)
+        .context("test config should include mock provider table")?;
+    let config = format!("{prefix}\n{inserted_config}{marker}{suffix}");
+    std::fs::write(config_path, config)?;
+    Ok(())
 }
 
 async fn read_initialize_response(
diff --git a/codex-rs/app-server/tests/suite/v2/config_rpc.rs b/codex-rs/app-server/tests/suite/v2/config_rpc.rs
index b5f795740c..56c4d0b7d1 100644
--- a/codex-rs/app-server/tests/suite/v2/config_rpc.rs
+++ b/codex-rs/app-server/tests/suite/v2/config_rpc.rs
@@ -14,6 +14,7 @@ use codex_app_server_protocol::ConfigReadParams;
 use codex_app_server_protocol::ConfigReadResponse;
 use codex_app_server_protocol::ConfigValueWriteParams;
 use codex_app_server_protocol::ConfigWriteResponse;
+use codex_app_server_protocol::ForcedChatgptWorkspaceIds;
 use codex_app_server_protocol::JSONRPCError;
 use codex_app_server_protocol::JSONRPCResponse;
 use codex_app_server_protocol::MergeStrategy;
@@ -82,6 +83,7 @@ sandbox_mode = "workspace-write"
         origins.get("model").expect("origin").name,
         ConfigLayerSource::User {
             file: user_file.clone(),
+            profile: None,
         }
     );
     let layers = layers.expect("layers present");
@@ -101,9 +103,6 @@ model = "gpt-user"
 [tools.web_search]
 context_size = "low"
 allowed_domains = ["example.com"]
-
-[tools]
-view_image = false
 "#,
     )?;
     let codex_home_path = codex_home.path().canonicalize()?;
@@ -138,7 +137,6 @@ view_image = false
                 allowed_domains: Some(vec!["example.com".to_string()]),
                 location: None,
             }),
-            view_image: Some(false),
         }
     );
     assert_eq!(
@@ -148,6 +146,7 @@ view_image = false
             .name,
         ConfigLayerSource::User {
             file: user_file.clone(),
+            profile: None,
         }
     );
     assert_eq!(
@@ -157,21 +156,95 @@ view_image = false
             .name,
         ConfigLayerSource::User {
             file: user_file.clone(),
+            profile: None,
         }
     );
-    assert_eq!(
-        origins.get("tools.view_image").expect("origin").name,
-        ConfigLayerSource::User {
-            file: user_file.clone(),
-        }
-    );
-
     let layers = layers.expect("layers present");
     assert_layers_user_then_optional_system(&layers, user_file)?;
 
     Ok(())
 }
 
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn config_read_accepts_legacy_forced_chatgpt_workspace_id() -> Result<()> {
+    const WORKSPACE_ID: &str = "123e4567-e89b-42d3-a456-426614174000";
+
+    let codex_home = TempDir::new()?;
+    write_config(
+        &codex_home,
+        &format!(
+            r#"
+forced_chatgpt_workspace_id = "{WORKSPACE_ID}"
+"#
+        ),
+    )?;
+
+    let mut mcp = McpProcess::new(codex_home.path()).await?;
+    timeout(DEFAULT_READ_TIMEOUT, mcp.initialize()).await??;
+
+    let request_id = mcp
+        .send_config_read_request(ConfigReadParams {
+            include_layers: false,
+            cwd: None,
+        })
+        .await?;
+    let resp: JSONRPCResponse = timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(request_id)),
+    )
+    .await??;
+    let ConfigReadResponse { config, .. } = to_response(resp)?;
+
+    assert_eq!(
+        config.forced_chatgpt_workspace_id,
+        Some(ForcedChatgptWorkspaceIds::Single(WORKSPACE_ID.to_string()))
+    );
+
+    Ok(())
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn config_read_accepts_forced_chatgpt_workspace_id_list() -> Result<()> {
+    const WORKSPACE_ID_A: &str = "123e4567-e89b-42d3-a456-426614174000";
+    const WORKSPACE_ID_B: &str = "123e4567-e89b-42d3-a456-426614174001";
+
+    let codex_home = TempDir::new()?;
+    write_config(
+        &codex_home,
+        &format!(
+            r#"
+forced_chatgpt_workspace_id = ["{WORKSPACE_ID_A}", "{WORKSPACE_ID_B}"]
+"#
+        ),
+    )?;
+
+    let mut mcp = McpProcess::new(codex_home.path()).await?;
+    timeout(DEFAULT_READ_TIMEOUT, mcp.initialize()).await??;
+
+    let request_id = mcp
+        .send_config_read_request(ConfigReadParams {
+            include_layers: false,
+            cwd: None,
+        })
+        .await?;
+    let resp: JSONRPCResponse = timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(request_id)),
+    )
+    .await??;
+    let ConfigReadResponse { config, .. } = to_response(resp)?;
+
+    assert_eq!(
+        config.forced_chatgpt_workspace_id,
+        Some(ForcedChatgptWorkspaceIds::Multiple(vec![
+            WORKSPACE_ID_A.to_string(),
+            WORKSPACE_ID_B.to_string(),
+        ]))
+    );
+
+    Ok(())
+}
+
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn config_read_includes_nested_web_search_tool_config() -> Result<()> {
     let codex_home = TempDir::new()?;
@@ -308,6 +381,7 @@ default_tools_approval_mode = "prompt"
         origins.get("apps.app1.enabled").expect("origin").name,
         ConfigLayerSource::User {
             file: user_file.clone(),
+            profile: None,
         }
     );
     assert_eq!(
@@ -317,6 +391,7 @@ default_tools_approval_mode = "prompt"
             .name,
         ConfigLayerSource::User {
             file: user_file.clone(),
+            profile: None,
         }
     );
     assert_eq!(
@@ -326,6 +401,7 @@ default_tools_approval_mode = "prompt"
             .name,
         ConfigLayerSource::User {
             file: user_file.clone(),
+            profile: None,
         }
     );
 
@@ -335,6 +411,52 @@ default_tools_approval_mode = "prompt"
     Ok(())
 }
 
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn config_read_includes_desktop_settings() -> Result<()> {
+    let codex_home = TempDir::new()?;
+    write_config(
+        &codex_home,
+        r#"
+[desktop]
+appearanceTheme = "dark"
+selected-avatar-id = "codex"
+
+[desktop.workspace]
+collapsed = true
+width = 320
+"#,
+    )?;
+
+    let mut mcp = McpProcess::new(codex_home.path()).await?;
+    timeout(DEFAULT_READ_TIMEOUT, mcp.initialize()).await??;
+
+    let request_id = mcp
+        .send_config_read_request(ConfigReadParams {
+            include_layers: false,
+            cwd: None,
+        })
+        .await?;
+    let resp: JSONRPCResponse = timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(request_id)),
+    )
+    .await??;
+    let ConfigReadResponse { config, .. } = to_response(resp)?;
+
+    let desktop = config.desktop.expect("desktop settings present");
+    assert_eq!(desktop.get("appearanceTheme"), Some(&json!("dark")));
+    assert_eq!(desktop.get("selected-avatar-id"), Some(&json!("codex")));
+    assert_eq!(
+        desktop.get("workspace"),
+        Some(&json!({
+            "collapsed": true,
+            "width": 320,
+        }))
+    );
+
+    Ok(())
+}
+
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn config_read_includes_project_layers_for_cwd() -> Result<()> {
     let codex_home = TempDir::new()?;
@@ -470,6 +592,7 @@ writable_roots = [{}]
         origins.get("sandbox_mode").expect("origin").name,
         ConfigLayerSource::User {
             file: user_file.clone(),
+            profile: None,
         }
     );
 
@@ -496,6 +619,7 @@ writable_roots = [{}]
             .name,
         ConfigLayerSource::User {
             file: user_file.clone(),
+            profile: None,
         }
     );
 
@@ -571,6 +695,50 @@ model = "gpt-old"
     Ok(())
 }
 
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn config_value_write_updates_desktop_settings() -> Result<()> {
+    let temp_dir = TempDir::new()?;
+    let codex_home = temp_dir.path().canonicalize()?;
+    write_config(&temp_dir, "")?;
+
+    let mut mcp = McpProcess::new(&codex_home).await?;
+    timeout(DEFAULT_READ_TIMEOUT, mcp.initialize()).await??;
+
+    let write_id = mcp
+        .send_config_value_write_request(ConfigValueWriteParams {
+            file_path: None,
+            key_path: "desktop.appearanceTheme".to_string(),
+            value: json!("dark"),
+            merge_strategy: MergeStrategy::Replace,
+            expected_version: None,
+        })
+        .await?;
+    let write_resp: JSONRPCResponse = timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(write_id)),
+    )
+    .await??;
+    let write: ConfigWriteResponse = to_response(write_resp)?;
+    assert_eq!(write.status, WriteStatus::Ok);
+
+    let read_id = mcp
+        .send_config_read_request(ConfigReadParams {
+            include_layers: false,
+            cwd: None,
+        })
+        .await?;
+    let read_resp: JSONRPCResponse = timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(read_id)),
+    )
+    .await??;
+    let read: ConfigReadResponse = to_response(read_resp)?;
+    let desktop = read.config.desktop.expect("desktop settings present");
+    assert_eq!(desktop.get("appearanceTheme"), Some(&json!("dark")));
+
+    Ok(())
+}
+
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn config_read_after_pipelined_write_sees_written_value() -> Result<()> {
     let temp_dir = TempDir::new()?;
@@ -725,6 +893,135 @@ async fn config_batch_write_applies_multiple_edits() -> Result<()> {
     Ok(())
 }
 
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn config_batch_write_preserves_dotted_profile_names() -> Result<()> {
+    let tmp_dir = TempDir::new()?;
+    let codex_home = tmp_dir.path().canonicalize()?;
+    write_config(
+        &tmp_dir,
+        r#"
+profile = "team.prod"
+
+[profiles."team.prod"]
+model = "gpt-5.3-spark"
+
+[profiles.team.prod]
+model = "should-stay-put"
+"#,
+    )?;
+
+    let mut mcp = McpProcess::new(&codex_home).await?;
+    timeout(DEFAULT_READ_TIMEOUT, mcp.initialize()).await??;
+
+    let batch_id = mcp
+        .send_config_batch_write_request(ConfigBatchWriteParams {
+            file_path: Some(codex_home.join("config.toml").display().to_string()),
+            edits: vec![
+                ConfigEdit {
+                    key_path: "profiles.\"team.prod\".model".to_string(),
+                    value: json!("gpt-5.5"),
+                    merge_strategy: MergeStrategy::Replace,
+                },
+                ConfigEdit {
+                    key_path: "items.sample@catalog.enabled".to_string(),
+                    value: json!(true),
+                    merge_strategy: MergeStrategy::Replace,
+                },
+            ],
+            expected_version: None,
+            reload_user_config: false,
+        })
+        .await?;
+    let batch_resp: JSONRPCResponse = timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(batch_id)),
+    )
+    .await??;
+    let batch_write: ConfigWriteResponse = to_response(batch_resp)?;
+    assert_eq!(batch_write.status, WriteStatus::Ok);
+
+    let config: toml::Value =
+        toml::from_str(&std::fs::read_to_string(codex_home.join("config.toml"))?)?;
+    assert_eq!(
+        config["profiles"]["team.prod"]["model"].as_str(),
+        Some("gpt-5.5")
+    );
+    assert_eq!(
+        config["profiles"]["team"]["prod"]["model"].as_str(),
+        Some("should-stay-put")
+    );
+    assert_eq!(
+        config["items"]["sample@catalog"]["enabled"].as_bool(),
+        Some(true)
+    );
+
+    Ok(())
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn config_batch_write_updates_multiple_desktop_settings() -> Result<()> {
+    let tmp_dir = TempDir::new()?;
+    let codex_home = tmp_dir.path().canonicalize()?;
+    write_config(&tmp_dir, "")?;
+
+    let mut mcp = McpProcess::new(&codex_home).await?;
+    timeout(DEFAULT_READ_TIMEOUT, mcp.initialize()).await??;
+
+    let batch_id = mcp
+        .send_config_batch_write_request(ConfigBatchWriteParams {
+            file_path: Some(codex_home.join("config.toml").display().to_string()),
+            edits: vec![
+                ConfigEdit {
+                    key_path: "desktop.selected-avatar-id".to_string(),
+                    value: json!("codex"),
+                    merge_strategy: MergeStrategy::Replace,
+                },
+                ConfigEdit {
+                    key_path: "desktop.workspace".to_string(),
+                    value: json!({
+                        "collapsed": true,
+                        "width": 320,
+                    }),
+                    merge_strategy: MergeStrategy::Replace,
+                },
+            ],
+            expected_version: None,
+            reload_user_config: false,
+        })
+        .await?;
+    let batch_resp: JSONRPCResponse = timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(batch_id)),
+    )
+    .await??;
+    let batch_write: ConfigWriteResponse = to_response(batch_resp)?;
+    assert_eq!(batch_write.status, WriteStatus::Ok);
+
+    let read_id = mcp
+        .send_config_read_request(ConfigReadParams {
+            include_layers: false,
+            cwd: None,
+        })
+        .await?;
+    let read_resp: JSONRPCResponse = timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(read_id)),
+    )
+    .await??;
+    let read: ConfigReadResponse = to_response(read_resp)?;
+    let desktop = read.config.desktop.expect("desktop settings present");
+    assert_eq!(desktop.get("selected-avatar-id"), Some(&json!("codex")));
+    assert_eq!(
+        desktop.get("workspace"),
+        Some(&json!({
+            "collapsed": true,
+            "width": 320,
+        }))
+    );
+
+    Ok(())
+}
+
 fn assert_layers_user_then_optional_system(
     layers: &[codex_app_server_protocol::ConfigLayer],
     user_file: AbsolutePathBuf,
@@ -739,7 +1036,10 @@ fn assert_layers_user_then_optional_system(
     assert_eq!(layers.len(), first_index + 2);
     assert_eq!(
         layers[first_index].name,
-        ConfigLayerSource::User { file: user_file }
+        ConfigLayerSource::User {
+            file: user_file,
+            profile: None
+        }
     );
     assert!(matches!(
         layers[first_index + 1].name,
@@ -767,7 +1067,10 @@ fn assert_layers_managed_user_then_optional_system(
     );
     assert_eq!(
         layers[first_index + 1].name,
-        ConfigLayerSource::User { file: user_file }
+        ConfigLayerSource::User {
+            file: user_file,
+            profile: None
+        }
     );
     assert!(matches!(
         layers[first_index + 2].name,
diff --git a/codex-rs/app-server/tests/suite/v2/experimental_feature_list.rs b/codex-rs/app-server/tests/suite/v2/experimental_feature_list.rs
index d50683cf80..d6101995fa 100644
--- a/codex-rs/app-server/tests/suite/v2/experimental_feature_list.rs
+++ b/codex-rs/app-server/tests/suite/v2/experimental_feature_list.rs
@@ -3,6 +3,7 @@ use std::time::Duration;
 use anyhow::Result;
 use app_test_support::ChatGptAuthFixture;
 use app_test_support::McpProcess;
+use app_test_support::create_mock_responses_server_repeating_assistant;
 use app_test_support::to_response;
 use app_test_support::write_chatgpt_auth;
 use codex_app_server_protocol::ConfigReadParams;
@@ -16,6 +17,8 @@ use codex_app_server_protocol::ExperimentalFeatureStage;
 use codex_app_server_protocol::JSONRPCError;
 use codex_app_server_protocol::JSONRPCResponse;
 use codex_app_server_protocol::RequestId;
+use codex_app_server_protocol::ThreadStartParams;
+use codex_app_server_protocol::ThreadStartResponse;
 use codex_config::LoaderOverrides;
 use codex_config::types::AuthCredentialsStoreMode;
 use codex_core::config::ConfigBuilder;
@@ -156,6 +159,104 @@ async fn experimental_feature_list_marks_apps_and_plugins_disabled_by_workspace_
     Ok(())
 }
 
+#[tokio::test]
+async fn experimental_feature_list_resolves_thread_project_config() -> Result<()> {
+    let server = create_mock_responses_server_repeating_assistant("Done").await;
+    let codex_home = TempDir::new()?;
+    let workspace = TempDir::new()?;
+    let server_uri = server.uri();
+    let workspace_key = workspace.path().to_string_lossy().replace('\\', "\\\\");
+    std::fs::write(
+        codex_home.path().join("config.toml"),
+        format!(
+            r#"model = "mock-model"
+approval_policy = "never"
+sandbox_mode = "read-only"
+model_provider = "mock_provider"
+
+[projects."{workspace_key}"]
+trust_level = "trusted"
+
+[model_providers.mock_provider]
+name = "Mock provider for test"
+base_url = "{server_uri}/v1"
+wire_api = "responses"
+request_max_retries = 0
+stream_max_retries = 0
+"#
+        ),
+    )?;
+    let project_config_dir = workspace.path().join(".codex");
+    std::fs::create_dir_all(&project_config_dir)?;
+    std::fs::write(
+        project_config_dir.join("config.toml"),
+        r#"[features]
+memories = true
+"#,
+    )?;
+
+    let mut mcp = McpProcess::new_without_managed_config(codex_home.path()).await?;
+    timeout(DEFAULT_TIMEOUT, mcp.initialize()).await??;
+
+    let thread_start_id = mcp
+        .send_thread_start_request(ThreadStartParams {
+            cwd: Some(workspace.path().display().to_string()),
+            ..Default::default()
+        })
+        .await?;
+    let ThreadStartResponse { thread, .. } =
+        read_response::<ThreadStartResponse>(&mut mcp, thread_start_id).await?;
+
+    let request_id = mcp
+        .send_experimental_feature_list_request(ExperimentalFeatureListParams {
+            cursor: None,
+            limit: None,
+            thread_id: Some(thread.id),
+        })
+        .await?;
+
+    let actual = read_response::<ExperimentalFeatureListResponse>(&mut mcp, request_id).await?;
+    let memories = actual
+        .data
+        .iter()
+        .find(|feature| feature.name == "memories")
+        .expect("memories feature should be present");
+    assert!(memories.enabled);
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn experimental_feature_list_rejects_unknown_thread_id() -> Result<()> {
+    let codex_home = TempDir::new()?;
+    let mut mcp = McpProcess::new(codex_home.path()).await?;
+    timeout(DEFAULT_TIMEOUT, mcp.initialize()).await??;
+
+    let request_id = mcp
+        .send_experimental_feature_list_request(ExperimentalFeatureListParams {
+            cursor: None,
+            limit: None,
+            thread_id: Some("00000000-0000-4000-8000-000000000001".to_string()),
+        })
+        .await?;
+    let JSONRPCError { error, .. } = timeout(
+        DEFAULT_TIMEOUT,
+        mcp.read_stream_until_error_message(RequestId::Integer(request_id)),
+    )
+    .await??;
+
+    assert_eq!(error.code, -32600);
+    assert!(
+        error
+            .message
+            .contains("thread not found: 00000000-0000-4000-8000-000000000001"),
+        "{}",
+        error.message
+    );
+
+    Ok(())
+}
+
 #[tokio::test]
 async fn experimental_feature_enablement_set_applies_to_global_and_thread_config_reads()
 -> Result<()> {
@@ -239,7 +340,6 @@ async fn experimental_feature_enablement_set_only_updates_named_features() -> Re
         BTreeMap::from([
             ("memories".to_string(), true),
             ("plugins".to_string(), true),
-            ("tool_search".to_string(), true),
             ("tool_suggest".to_string(), true),
             ("tool_call_mcp_elicitation".to_string(), false),
         ]),
@@ -252,7 +352,6 @@ async fn experimental_feature_enablement_set_only_updates_named_features() -> Re
             enablement: BTreeMap::from([
                 ("memories".to_string(), true),
                 ("plugins".to_string(), true),
-                ("tool_search".to_string(), true),
                 ("tool_suggest".to_string(), true),
                 ("tool_call_mcp_elicitation".to_string(), false),
             ]),
@@ -282,13 +381,6 @@ async fn experimental_feature_enablement_set_only_updates_named_features() -> Re
             .and_then(|features| features.get("plugins")),
         Some(&json!(true))
     );
-    assert_eq!(
-        config
-            .additional
-            .get("features")
-            .and_then(|features| features.get("tool_search")),
-        Some(&json!(true))
-    );
     assert_eq!(
         config
             .additional
@@ -382,7 +474,7 @@ async fn experimental_feature_enablement_set_rejects_non_allowlisted_feature() -
     );
     assert!(
         error.message.contains(
-            "apps, memories, mentions_v2, plugins, remote_control, tool_search, tool_suggest, tool_call_mcp_elicitation"
+            "apps, memories, mentions_v2, plugins, remote_control, tool_suggest, tool_call_mcp_elicitation"
         ),
         "{}",
         error.message
diff --git a/codex-rs/app-server/tests/suite/v2/fs.rs b/codex-rs/app-server/tests/suite/v2/fs.rs
index a780a51e0b..3ca511a482 100644
--- a/codex-rs/app-server/tests/suite/v2/fs.rs
+++ b/codex-rs/app-server/tests/suite/v2/fs.rs
@@ -14,6 +14,7 @@ use codex_app_server_protocol::FsWatchResponse;
 use codex_app_server_protocol::FsWriteFileParams;
 use codex_app_server_protocol::JSONRPCNotification;
 use codex_app_server_protocol::RequestId;
+use codex_exec_server::CODEX_EXEC_SERVER_URL_ENV_VAR;
 use codex_utils_absolute_path::AbsolutePathBuf;
 use pretty_assertions::assert_eq;
 use serde_json::json;
@@ -119,6 +120,28 @@ async fn fs_get_metadata_returns_only_used_fields() -> Result<()> {
     Ok(())
 }
 
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn fs_methods_return_error_when_local_environment_is_disabled() -> Result<()> {
+    let codex_home = TempDir::new()?;
+    let absolute_file = codex_home.path().join("absolute.txt");
+
+    let mut mcp = McpProcess::new_with_env(
+        codex_home.path(),
+        &[(CODEX_EXEC_SERVER_URL_ENV_VAR, Some("none"))],
+    )
+    .await?;
+    timeout(DEFAULT_READ_TIMEOUT, mcp.initialize()).await??;
+
+    let read_id = mcp
+        .send_fs_read_file_request(codex_app_server_protocol::FsReadFileParams {
+            path: absolute_path(absolute_file),
+        })
+        .await?;
+    expect_error_message(&mut mcp, read_id, "local filesystem is not configured").await?;
+
+    Ok(())
+}
+
 #[cfg(unix)]
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn fs_get_metadata_reports_symlink() -> Result<()> {
diff --git a/codex-rs/app-server/tests/suite/v2/initialize.rs b/codex-rs/app-server/tests/suite/v2/initialize.rs
index 3d3a473fab..47cacdb20e 100644
--- a/codex-rs/app-server/tests/suite/v2/initialize.rs
+++ b/codex-rs/app-server/tests/suite/v2/initialize.rs
@@ -89,6 +89,33 @@ async fn initialize_probe_does_not_override_originator() -> Result<()> {
     Ok(())
 }
 
+#[tokio::test]
+async fn initialize_codex_backend_does_not_override_originator() -> Result<()> {
+    let responses = Vec::new();
+    let server = create_mock_responses_server_sequence_unchecked(responses).await;
+    let codex_home = TempDir::new()?;
+    create_config_toml(codex_home.path(), &server.uri(), "never")?;
+    let mut mcp = McpProcess::new(codex_home.path()).await?;
+
+    let message = timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.initialize_with_client_info(ClientInfo {
+            name: "codex-backend".to_string(),
+            title: Some("Codex Backend".to_string()),
+            version: "0.1.0".to_string(),
+        }),
+    )
+    .await??;
+
+    let JSONRPCMessage::Response(response) = message else {
+        anyhow::bail!("expected initialize response, got {message:?}");
+    };
+    let InitializeResponse { user_agent, .. } = to_response::<InitializeResponse>(response)?;
+
+    assert!(user_agent.starts_with("codex_cli_rs/"));
+    Ok(())
+}
+
 #[tokio::test]
 async fn initialize_respects_originator_override_env_var() -> Result<()> {
     let responses = Vec::new();
diff --git a/codex-rs/app-server/tests/suite/v2/mcp_resource.rs b/codex-rs/app-server/tests/suite/v2/mcp_resource.rs
index a51f4bbd4e..bddf57f666 100644
--- a/codex-rs/app-server/tests/suite/v2/mcp_resource.rs
+++ b/codex-rs/app-server/tests/suite/v2/mcp_resource.rs
@@ -200,6 +200,7 @@ async fn mcp_resource_read_returns_error_for_unknown_thread() -> Result<()> {
         config: Arc::new(config),
         cli_overrides: Vec::new(),
         loader_overrides,
+        strict_config: false,
         cloud_requirements: CloudRequirementsLoader::default(),
         thread_config_loader: Arc::new(codex_config::NoopThreadConfigLoader),
         feedback: CodexFeedback::new(),
diff --git a/codex-rs/app-server/tests/suite/v2/mod.rs b/codex-rs/app-server/tests/suite/v2/mod.rs
index 642be8ad4a..bdbe7b7ddd 100644
--- a/codex-rs/app-server/tests/suite/v2/mod.rs
+++ b/codex-rs/app-server/tests/suite/v2/mod.rs
@@ -38,6 +38,7 @@ mod plugin_uninstall;
 mod process_exec;
 mod rate_limits;
 mod realtime_conversation;
+mod remote_control;
 #[cfg(debug_assertions)]
 mod remote_thread_store;
 mod request_permissions;
diff --git a/codex-rs/app-server/tests/suite/v2/model_list.rs b/codex-rs/app-server/tests/suite/v2/model_list.rs
index e2039d333a..d22bdd2a18 100644
--- a/codex-rs/app-server/tests/suite/v2/model_list.rs
+++ b/codex-rs/app-server/tests/suite/v2/model_list.rs
@@ -1,8 +1,10 @@
 use std::time::Duration;
 
 use anyhow::Result;
+use app_test_support::ChatGptAuthFixture;
 use app_test_support::McpProcess;
 use app_test_support::to_response;
+use app_test_support::write_chatgpt_auth;
 use app_test_support::write_models_cache;
 use codex_app_server_protocol::JSONRPCError;
 use codex_app_server_protocol::JSONRPCResponse;
@@ -13,10 +15,16 @@ use codex_app_server_protocol::ModelServiceTier;
 use codex_app_server_protocol::ModelUpgradeInfo;
 use codex_app_server_protocol::ReasoningEffortOption;
 use codex_app_server_protocol::RequestId;
+use codex_config::types::AuthCredentialsStoreMode;
+use codex_protocol::openai_models::ModelInfo;
 use codex_protocol::openai_models::ModelPreset;
+use codex_protocol::openai_models::ModelsResponse;
+use core_test_support::responses::mount_models_once;
 use pretty_assertions::assert_eq;
+use serde_json::json;
 use tempfile::TempDir;
 use tokio::time::timeout;
+use wiremock::MockServer;
 
 const DEFAULT_TIMEOUT: Duration = Duration::from_secs(10);
 const INVALID_REQUEST_ERROR_CODE: i64 = -32600;
@@ -148,6 +156,101 @@ async fn list_models_includes_hidden_models() -> Result<()> {
     Ok(())
 }
 
+#[tokio::test]
+async fn list_models_uses_chatgpt_remote_catalog_as_source_of_truth() -> Result<()> {
+    let server = MockServer::start().await;
+    let remote_model: ModelInfo = serde_json::from_value(json!({
+        "slug": "chatgpt-remote-only",
+        "display_name": "ChatGPT Remote Only",
+        "description": "Remote-only model for app-server model/list coverage",
+        "default_reasoning_level": "medium",
+        "supported_reasoning_levels": [
+            {"effort": "low", "description": "low"},
+            {"effort": "medium", "description": "medium"}
+        ],
+        "shell_type": "shell_command",
+        "visibility": "list",
+        "minimal_client_version": [0, 1, 0],
+        "supported_in_api": true,
+        "priority": 0,
+        "upgrade": null,
+        "base_instructions": "base instructions",
+        "supports_reasoning_summaries": false,
+        "support_verbosity": false,
+        "default_verbosity": null,
+        "apply_patch_tool_type": null,
+        "truncation_policy": {"mode": "bytes", "limit": 10_000},
+        "supports_parallel_tool_calls": false,
+        "supports_image_detail_original": false,
+        "context_window": 272_000,
+        "max_context_window": 272_000,
+        "experimental_supported_tools": [],
+    }))?;
+    let models_mock = mount_models_once(
+        &server,
+        ModelsResponse {
+            models: vec![remote_model.clone()],
+        },
+    )
+    .await;
+
+    let codex_home = TempDir::new()?;
+    let server_uri = server.uri();
+    std::fs::write(
+        codex_home.path().join("config.toml"),
+        format!(
+            r#"
+model = "mock-model"
+approval_policy = "never"
+sandbox_mode = "read-only"
+openai_base_url = "{server_uri}/v1"
+"#
+        ),
+    )?;
+    write_chatgpt_auth(
+        codex_home.path(),
+        ChatGptAuthFixture::new("chatgpt-access-token").plan_type("pro"),
+        AuthCredentialsStoreMode::File,
+    )?;
+
+    let mut mcp = McpProcess::new_with_env(codex_home.path(), &[("OPENAI_API_KEY", None)]).await?;
+    timeout(DEFAULT_TIMEOUT, mcp.initialize()).await??;
+
+    let request_id = mcp
+        .send_list_models_request(ModelListParams {
+            limit: Some(100),
+            cursor: None,
+            include_hidden: None,
+        })
+        .await?;
+
+    let response: JSONRPCResponse = timeout(
+        DEFAULT_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(request_id)),
+    )
+    .await??;
+
+    let ModelListResponse {
+        data: items,
+        next_cursor,
+    } = to_response::<ModelListResponse>(response)?;
+    let mut expected_presets: Vec<ModelPreset> = vec![remote_model.into()];
+    ModelPreset::mark_default_by_picker_visibility(&mut expected_presets);
+    let expected_items = expected_presets
+        .iter()
+        .map(model_from_preset)
+        .collect::<Vec<_>>();
+
+    assert_eq!(items, expected_items);
+    assert!(next_cursor.is_none());
+    assert_eq!(
+        models_mock.requests().len(),
+        1,
+        "expected a single /models request"
+    );
+    Ok(())
+}
+
 #[tokio::test]
 async fn list_models_pagination_works() -> Result<()> {
     let codex_home = TempDir::new()?;
diff --git a/codex-rs/app-server/tests/suite/v2/plugin_list.rs b/codex-rs/app-server/tests/suite/v2/plugin_list.rs
index 0b2200a9d5..d439a4585b 100644
--- a/codex-rs/app-server/tests/suite/v2/plugin_list.rs
+++ b/codex-rs/app-server/tests/suite/v2/plugin_list.rs
@@ -9,6 +9,8 @@ use app_test_support::write_chatgpt_auth;
 use codex_app_server_protocol::JSONRPCResponse;
 use codex_app_server_protocol::PluginAuthPolicy;
 use codex_app_server_protocol::PluginInstallPolicy;
+use codex_app_server_protocol::PluginInstalledParams;
+use codex_app_server_protocol::PluginInstalledResponse;
 use codex_app_server_protocol::PluginListMarketplaceKind;
 use codex_app_server_protocol::PluginListParams;
 use codex_app_server_protocol::PluginListResponse;
@@ -125,6 +127,95 @@ async fn plugin_list_skips_invalid_marketplace_file_and_reports_error() -> Resul
     Ok(())
 }
 
+#[tokio::test]
+async fn plugin_installed_includes_installed_plugins_and_explicit_install_suggestions() -> Result<()>
+{
+    let codex_home = TempDir::new()?;
+    write_openai_curated_marketplace(
+        codex_home.path(),
+        &["linear", "computer-use", "not-mentioned"],
+    )?;
+    write_installed_plugin(&codex_home, "openai-curated", "linear")?;
+    std::fs::write(
+        codex_home.path().join("config.toml"),
+        r#"[features]
+plugins = true
+
+[plugins."linear@openai-curated"]
+enabled = true
+"#,
+    )?;
+
+    let mut mcp = McpProcess::new(codex_home.path()).await?;
+    timeout(DEFAULT_TIMEOUT, mcp.initialize()).await??;
+
+    let request_id = mcp
+        .send_plugin_installed_request(PluginInstalledParams {
+            cwds: None,
+            install_suggestion_plugin_names: Some(vec!["computer-use".to_string()]),
+        })
+        .await?;
+
+    let response: JSONRPCResponse = timeout(
+        DEFAULT_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(request_id)),
+    )
+    .await??;
+    let response: PluginInstalledResponse = to_response(response)?;
+
+    assert_eq!(response.marketplaces.len(), 1);
+    assert_eq!(response.marketplaces[0].name, "openai-curated");
+    assert_eq!(
+        response.marketplaces[0]
+            .plugins
+            .iter()
+            .map(|plugin| (plugin.id.clone(), plugin.installed, plugin.enabled))
+            .collect::<Vec<_>>(),
+        vec![
+            ("linear@openai-curated".to_string(), true, true),
+            ("computer-use@openai-curated".to_string(), false, false),
+        ]
+    );
+    assert_eq!(response.marketplace_load_errors, Vec::new());
+    Ok(())
+}
+
+#[tokio::test]
+async fn plugin_installed_ignores_local_cache_without_catalog() -> Result<()> {
+    let codex_home = TempDir::new()?;
+    write_installed_plugin(&codex_home, "openai-curated", "linear")?;
+    std::fs::write(
+        codex_home.path().join("config.toml"),
+        r#"[features]
+plugins = true
+
+[plugins."linear@openai-curated"]
+enabled = true
+"#,
+    )?;
+
+    let mut mcp = McpProcess::new(codex_home.path()).await?;
+    timeout(DEFAULT_TIMEOUT, mcp.initialize()).await??;
+
+    let request_id = mcp
+        .send_plugin_installed_request(PluginInstalledParams {
+            cwds: None,
+            install_suggestion_plugin_names: None,
+        })
+        .await?;
+
+    let response: JSONRPCResponse = timeout(
+        DEFAULT_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(request_id)),
+    )
+    .await??;
+    let response: PluginInstalledResponse = to_response(response)?;
+
+    assert_eq!(response.marketplaces, Vec::new());
+    assert_eq!(response.marketplace_load_errors, Vec::new());
+    Ok(())
+}
+
 #[tokio::test]
 async fn plugin_list_rejects_relative_cwds() -> Result<()> {
     let codex_home = TempDir::new()?;
@@ -1710,6 +1801,185 @@ async fn plugin_list_does_not_append_global_remote_when_marketplace_kinds_are_ex
     Ok(())
 }
 
+#[tokio::test]
+async fn plugin_installed_includes_remote_shared_with_me_plugins() -> Result<()> {
+    let codex_home = TempDir::new()?;
+    let server = MockServer::start().await;
+    std::fs::write(
+        codex_home.path().join("config.toml"),
+        format!(
+            r#"chatgpt_base_url = "{}/backend-api/"
+
+[features]
+plugins = true
+remote_plugin = false
+plugin_sharing = true
+"#,
+            server.uri()
+        ),
+    )?;
+    write_chatgpt_auth(
+        codex_home.path(),
+        ChatGptAuthFixture::new("chatgpt-token")
+            .account_id("account-123")
+            .chatgpt_user_id("user-123")
+            .chatgpt_account_id("account-123"),
+        AuthCredentialsStoreMode::File,
+    )?;
+    let mut workspace_installed_body: serde_json::Value =
+        serde_json::from_str(&workspace_remote_plugin_page_body(
+            "plugins~Plugin_22222222222222222222222222222222",
+            "shared-linear",
+            "Shared Linear",
+            "PRIVATE",
+            /*enabled*/ Some(true),
+        ))?;
+    let unlisted_installed_body: serde_json::Value =
+        serde_json::from_str(&workspace_remote_plugin_page_body(
+            "plugins~Plugin_33333333333333333333333333333333",
+            "unlisted-linear",
+            "Unlisted Linear",
+            "UNLISTED",
+            /*enabled*/ Some(false),
+        ))?;
+    workspace_installed_body["plugins"]
+        .as_array_mut()
+        .expect("installed plugins should be an array")
+        .push(unlisted_installed_body["plugins"][0].clone());
+    let workspace_installed_body = serde_json::to_string(&workspace_installed_body)?;
+    let global_installed_body = remote_installed_plugin_body("", "1.2.3", /*enabled*/ true);
+    mount_remote_installed_plugins(&server, "GLOBAL", &global_installed_body).await;
+    mount_remote_installed_plugins(&server, "WORKSPACE", &workspace_installed_body).await;
+
+    let mut mcp = McpProcess::new(codex_home.path()).await?;
+    timeout(DEFAULT_TIMEOUT, mcp.initialize()).await??;
+
+    let request_id = mcp
+        .send_plugin_installed_request(PluginInstalledParams {
+            cwds: None,
+            install_suggestion_plugin_names: None,
+        })
+        .await?;
+
+    let response: JSONRPCResponse = timeout(
+        DEFAULT_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(request_id)),
+    )
+    .await??;
+    let response: PluginInstalledResponse = to_response(response)?;
+
+    assert_eq!(response.marketplaces.len(), 1);
+    let marketplace = &response.marketplaces[0];
+    assert_eq!(marketplace.name, "workspace-shared-with-me");
+    assert_eq!(
+        marketplace
+            .interface
+            .as_ref()
+            .and_then(|interface| interface.display_name.as_deref()),
+        Some("Shared with me")
+    );
+    assert_eq!(
+        marketplace
+            .plugins
+            .iter()
+            .map(|plugin| (plugin.id.clone(), plugin.installed, plugin.enabled))
+            .collect::<Vec<_>>(),
+        vec![
+            (
+                "shared-linear@workspace-shared-with-me".to_string(),
+                true,
+                true
+            ),
+            (
+                "unlisted-linear@workspace-shared-with-me".to_string(),
+                true,
+                false
+            )
+        ]
+    );
+    wait_for_remote_installed_scope_request(&server, "WORKSPACE").await?;
+    wait_for_remote_installed_scope_request(&server, "GLOBAL").await?;
+    Ok(())
+}
+
+#[tokio::test]
+async fn plugin_installed_starts_remote_installed_bundle_sync() -> Result<()> {
+    let codex_home = TempDir::new()?;
+    let server = MockServer::start().await;
+    std::fs::write(
+        codex_home.path().join("config.toml"),
+        format!(
+            r#"chatgpt_base_url = "{}/backend-api/"
+
+[features]
+plugins = true
+remote_plugin = true
+plugin_sharing = false
+"#,
+            server.uri()
+        ),
+    )?;
+    write_chatgpt_auth(
+        codex_home.path(),
+        ChatGptAuthFixture::new("chatgpt-token")
+            .account_id("account-123")
+            .chatgpt_user_id("user-123")
+            .chatgpt_account_id("account-123"),
+        AuthCredentialsStoreMode::File,
+    )?;
+
+    let bundle_url = mount_remote_plugin_bundle(
+        &server,
+        "linear",
+        remote_plugin_bundle_tar_gz_bytes("linear")?,
+    )
+    .await;
+    let global_installed_body =
+        remote_installed_plugin_body(&bundle_url, "1.2.3", /*enabled*/ true);
+    mount_remote_installed_plugins(&server, "GLOBAL", &global_installed_body).await;
+    mount_remote_installed_plugins(&server, "WORKSPACE", empty_remote_installed_plugins_body())
+        .await;
+
+    let mut mcp = McpProcess::new_with_env(
+        codex_home.path(),
+        &[(TEST_ALLOW_HTTP_REMOTE_PLUGIN_BUNDLE_DOWNLOADS, Some("1"))],
+    )
+    .await?;
+    timeout(DEFAULT_TIMEOUT, mcp.initialize()).await??;
+
+    let plugin_installed_request_id = mcp
+        .send_plugin_installed_request(PluginInstalledParams {
+            cwds: None,
+            install_suggestion_plugin_names: None,
+        })
+        .await?;
+    let response: PluginInstalledResponse = to_response(
+        timeout(
+            DEFAULT_TIMEOUT,
+            mcp.read_stream_until_response_message(RequestId::Integer(plugin_installed_request_id)),
+        )
+        .await??,
+    )?;
+
+    assert_eq!(response.marketplaces.len(), 1);
+    assert_eq!(response.marketplaces[0].name, "chatgpt-global");
+    assert_eq!(
+        response.marketplaces[0]
+            .plugins
+            .iter()
+            .map(|plugin| (plugin.id.clone(), plugin.installed, plugin.enabled))
+            .collect::<Vec<_>>(),
+        vec![("linear@chatgpt-global".to_string(), true, true)]
+    );
+    let installed_path = codex_home
+        .path()
+        .join("plugins/cache/chatgpt-global/linear/1.2.3/.codex-plugin/plugin.json");
+    wait_for_path_exists(&installed_path).await?;
+    wait_for_remote_installed_scope_request(&server, "GLOBAL").await?;
+    wait_for_remote_installed_scope_request(&server, "WORKSPACE").await?;
+    Ok(())
+}
+
 #[tokio::test]
 async fn plugin_list_fetches_workspace_directory_kind_without_remote_plugin_flag() -> Result<()> {
     let codex_home = TempDir::new()?;
@@ -1823,6 +2093,18 @@ async fn plugin_list_fetches_shared_with_me_kind() -> Result<()> {
             /*enabled*/ None,
         ))?;
     shared_plugin_body["plugins"][0]["share_principals"] = serde_json::Value::Null;
+    let shared_unlisted_body: serde_json::Value =
+        serde_json::from_str(&workspace_remote_plugin_page_body(
+            "plugins~Plugin_44444444444444444444444444444444",
+            "shared-unlisted-linear",
+            "Shared Unlisted Linear",
+            "UNLISTED",
+            /*enabled*/ None,
+        ))?;
+    shared_plugin_body["plugins"]
+        .as_array_mut()
+        .expect("shared plugins should be an array")
+        .push(shared_unlisted_body["plugins"][0].clone());
     let shared_plugin_body = serde_json::to_string(&shared_plugin_body)?;
     let mut workspace_installed_body: serde_json::Value =
         serde_json::from_str(&workspace_remote_plugin_page_body(
@@ -1846,6 +2128,7 @@ async fn plugin_list_fetches_shared_with_me_kind() -> Result<()> {
         .push(unlisted_installed_body["plugins"][0].clone());
     let workspace_installed_body = serde_json::to_string(&workspace_installed_body)?;
     mount_shared_workspace_plugins(&server, &shared_plugin_body).await;
+    mount_remote_installed_plugins(&server, "GLOBAL", empty_remote_installed_plugins_body()).await;
     mount_remote_installed_plugins(&server, "WORKSPACE", &workspace_installed_body).await;
 
     let mut mcp = McpProcess::new(codex_home.path()).await?;
@@ -1878,10 +2161,10 @@ async fn plugin_list_fetches_shared_with_me_kind() -> Result<()> {
             .and_then(|interface| interface.display_name.as_deref()),
         Some("Shared with me")
     );
-    assert_eq!(marketplace.plugins.len(), 1);
+    assert_eq!(marketplace.plugins.len(), 2);
     assert_eq!(
         marketplace.plugins[0].id,
-        "shared-linear@workspace-shared-with-me-private"
+        "shared-linear@workspace-shared-with-me"
     );
     assert_eq!(
         marketplace.plugins[0].remote_plugin_id.as_deref(),
@@ -1913,6 +2196,29 @@ async fn plugin_list_fetches_shared_with_me_kind() -> Result<()> {
         Some("https://chatgpt.example/plugins/share/share-key-1")
     );
     assert_eq!(share_context.share_principals, None);
+    assert_eq!(
+        marketplace.plugins[1].id,
+        "shared-unlisted-linear@workspace-shared-with-me"
+    );
+    assert_eq!(
+        marketplace.plugins[1].remote_plugin_id.as_deref(),
+        Some("plugins~Plugin_44444444444444444444444444444444")
+    );
+    assert_eq!(marketplace.plugins[1].name, "shared-unlisted-linear");
+    assert_eq!(marketplace.plugins[1].installed, false);
+    assert_eq!(marketplace.plugins[1].enabled, false);
+    let share_context = marketplace.plugins[1]
+        .share_context
+        .as_ref()
+        .expect("expected share context");
+    assert_eq!(
+        share_context.remote_plugin_id,
+        "plugins~Plugin_44444444444444444444444444444444"
+    );
+    assert_eq!(
+        share_context.discoverability,
+        Some(PluginShareDiscoverability::Unlisted)
+    );
 
     let marketplace = response
         .marketplaces
@@ -1929,7 +2235,7 @@ async fn plugin_list_fetches_shared_with_me_kind() -> Result<()> {
     assert_eq!(marketplace.plugins.len(), 1);
     assert_eq!(
         marketplace.plugins[0].id,
-        "unlisted-linear@workspace-shared-with-me-unlisted"
+        "unlisted-linear@workspace-shared-with-me"
     );
     assert_eq!(
         marketplace.plugins[0].remote_plugin_id.as_deref(),
@@ -1951,6 +2257,8 @@ async fn plugin_list_fetches_shared_with_me_kind() -> Result<()> {
         share_context.discoverability,
         Some(PluginShareDiscoverability::Unlisted)
     );
+    wait_for_remote_installed_scope_request(&server, "WORKSPACE").await?;
+    wait_for_remote_installed_scope_request(&server, "GLOBAL").await?;
     wait_for_remote_plugin_request_count(&server, "/ps/plugins/list", /*expected_count*/ 0).await?;
     Ok(())
 }
@@ -2448,6 +2756,29 @@ async fn wait_for_remote_plugin_request_count(
     Ok(())
 }
 
+async fn wait_for_remote_installed_scope_request(server: &MockServer, scope: &str) -> Result<()> {
+    timeout(DEFAULT_TIMEOUT, async {
+        loop {
+            let Some(requests) = server.received_requests().await else {
+                bail!("wiremock did not record requests");
+            };
+            if requests.iter().any(|request| {
+                request.method == "GET"
+                    && request.url.path().ends_with("/ps/plugins/installed")
+                    && request
+                        .url
+                        .query_pairs()
+                        .any(|(name, value)| name == "scope" && value == scope)
+            }) {
+                return Ok::<(), anyhow::Error>(());
+            }
+            tokio::time::sleep(Duration::from_millis(10)).await;
+        }
+    })
+    .await??;
+    Ok(())
+}
+
 async fn wait_for_path_exists(path: &std::path::Path) -> Result<()> {
     timeout(DEFAULT_TIMEOUT, async {
         loop {
diff --git a/codex-rs/app-server/tests/suite/v2/plugin_read.rs b/codex-rs/app-server/tests/suite/v2/plugin_read.rs
index 525a4234aa..812f884a55 100644
--- a/codex-rs/app-server/tests/suite/v2/plugin_read.rs
+++ b/codex-rs/app-server/tests/suite/v2/plugin_read.rs
@@ -300,74 +300,76 @@ async fn plugin_read_returns_share_context_for_shared_remote_plugin() -> Result<
     let mut mcp = McpProcess::new(codex_home.path()).await?;
     timeout(DEFAULT_TIMEOUT, mcp.initialize()).await??;
 
-    let request_id = mcp
-        .send_plugin_read_request(PluginReadParams {
-            marketplace_path: None,
-            remote_marketplace_name: Some("workspace-shared-with-me-private".to_string()),
-            plugin_name: "plugins~Plugin_11111111111111111111111111111111".to_string(),
-        })
-        .await?;
+    for remote_marketplace_name in [
+        "workspace-shared-with-me-private",
+        "workspace-shared-with-me",
+    ] {
+        let request_id = mcp
+            .send_plugin_read_request(PluginReadParams {
+                marketplace_path: None,
+                remote_marketplace_name: Some(remote_marketplace_name.to_string()),
+                plugin_name: "plugins~Plugin_11111111111111111111111111111111".to_string(),
+            })
+            .await?;
 
-    let response: JSONRPCResponse = timeout(
-        DEFAULT_TIMEOUT,
-        mcp.read_stream_until_response_message(RequestId::Integer(request_id)),
-    )
-    .await??;
-    let response: PluginReadResponse = to_response(response)?;
+        let response: JSONRPCResponse = timeout(
+            DEFAULT_TIMEOUT,
+            mcp.read_stream_until_response_message(RequestId::Integer(request_id)),
+        )
+        .await??;
+        let response: PluginReadResponse = to_response(response)?;
 
-    assert_eq!(
-        response.plugin.marketplace_name,
-        "workspace-shared-with-me-private"
-    );
-    assert_eq!(
-        response.plugin.summary.id,
-        "shared-linear@workspace-shared-with-me-private"
-    );
-    assert_eq!(
-        response.plugin.summary.remote_plugin_id.as_deref(),
-        Some("plugins~Plugin_11111111111111111111111111111111")
-    );
-    let share_context = response
-        .plugin
-        .summary
-        .share_context
-        .as_ref()
-        .expect("expected share context");
-    assert_eq!(
-        share_context.remote_plugin_id,
-        "plugins~Plugin_11111111111111111111111111111111"
-    );
-    assert_eq!(share_context.remote_version.as_deref(), Some("2.3.4"));
-    assert_eq!(
-        share_context.discoverability,
-        Some(PluginShareDiscoverability::Private)
-    );
-    assert_eq!(
-        share_context.creator_account_user_id.as_deref(),
-        Some("user-gavin__account-123")
-    );
-    assert_eq!(share_context.creator_name.as_deref(), Some("Gavin"));
-    assert_eq!(
-        share_context.share_url.as_deref(),
-        Some("https://chatgpt.example/plugins/share/share-key-1")
-    );
-    assert_eq!(
-        share_context.share_principals,
-        Some(vec![
-            PluginSharePrincipal {
-                principal_type: PluginSharePrincipalType::User,
-                principal_id: "user-gavin__account-123".to_string(),
-                role: PluginSharePrincipalRole::Owner,
-                name: "Gavin".to_string(),
-            },
-            PluginSharePrincipal {
-                principal_type: PluginSharePrincipalType::User,
-                principal_id: "user-ada__account-123".to_string(),
-                role: PluginSharePrincipalRole::Reader,
-                name: "Ada".to_string(),
-            },
-        ])
-    );
+        assert_eq!(response.plugin.marketplace_name, "workspace-shared-with-me");
+        assert_eq!(
+            response.plugin.summary.id,
+            "shared-linear@workspace-shared-with-me"
+        );
+        assert_eq!(
+            response.plugin.summary.remote_plugin_id.as_deref(),
+            Some("plugins~Plugin_11111111111111111111111111111111")
+        );
+        let share_context = response
+            .plugin
+            .summary
+            .share_context
+            .as_ref()
+            .expect("expected share context");
+        assert_eq!(
+            share_context.remote_plugin_id,
+            "plugins~Plugin_11111111111111111111111111111111"
+        );
+        assert_eq!(share_context.remote_version.as_deref(), Some("2.3.4"));
+        assert_eq!(
+            share_context.discoverability,
+            Some(PluginShareDiscoverability::Private)
+        );
+        assert_eq!(
+            share_context.creator_account_user_id.as_deref(),
+            Some("user-gavin__account-123")
+        );
+        assert_eq!(share_context.creator_name.as_deref(), Some("Gavin"));
+        assert_eq!(
+            share_context.share_url.as_deref(),
+            Some("https://chatgpt.example/plugins/share/share-key-1")
+        );
+        assert_eq!(
+            share_context.share_principals,
+            Some(vec![
+                PluginSharePrincipal {
+                    principal_type: PluginSharePrincipalType::User,
+                    principal_id: "user-gavin__account-123".to_string(),
+                    role: PluginSharePrincipalRole::Owner,
+                    name: "Gavin".to_string(),
+                },
+                PluginSharePrincipal {
+                    principal_type: PluginSharePrincipalType::User,
+                    principal_id: "user-ada__account-123".to_string(),
+                    role: PluginSharePrincipalRole::Reader,
+                    name: "Ada".to_string(),
+                },
+            ])
+        );
+    }
     Ok(())
 }
 
diff --git a/codex-rs/app-server/tests/suite/v2/plugin_share.rs b/codex-rs/app-server/tests/suite/v2/plugin_share.rs
index efe3d291a4..69f93f0b7e 100644
--- a/codex-rs/app-server/tests/suite/v2/plugin_share.rs
+++ b/codex-rs/app-server/tests/suite/v2/plugin_share.rs
@@ -169,7 +169,7 @@ async fn plugin_share_save_uploads_local_plugin() -> Result<()> {
         PluginShareListResponse {
             data: vec![PluginShareListItem {
                 plugin: PluginSummary {
-                    id: "demo-plugin@workspace-shared-with-me-private".to_string(),
+                    id: "demo-plugin@workspace-shared-with-me".to_string(),
                     remote_plugin_id: Some("plugins_123".to_string()),
                     local_version: None,
                     name: "demo-plugin".to_string(),
@@ -573,7 +573,7 @@ async fn plugin_share_list_returns_created_workspace_plugins() -> Result<()> {
         PluginShareListResponse {
             data: vec![PluginShareListItem {
                 plugin: PluginSummary {
-                    id: "demo-plugin@workspace-shared-with-me-private".to_string(),
+                    id: "demo-plugin@workspace-shared-with-me".to_string(),
                     remote_plugin_id: Some("plugins_123".to_string()),
                     local_version: None,
                     name: "demo-plugin".to_string(),
@@ -1038,6 +1038,57 @@ async fn plugin_share_update_targets_updates_share_targets() -> Result<()> {
     Ok(())
 }
 
+#[tokio::test]
+async fn plugin_share_update_targets_rejects_when_plugin_sharing_disabled() -> Result<()> {
+    let codex_home = TempDir::new()?;
+    let server = MockServer::start().await;
+    std::fs::write(
+        codex_home.path().join("config.toml"),
+        format!(
+            r#"
+chatgpt_base_url = "{}/backend-api"
+
+[features]
+plugins = true
+remote_plugin = true
+plugin_sharing = false
+"#,
+            server.uri()
+        ),
+    )?;
+    write_chatgpt_auth(
+        codex_home.path(),
+        ChatGptAuthFixture::new("chatgpt-token")
+            .account_id("account-123")
+            .chatgpt_user_id("user-123")
+            .chatgpt_account_id("account-123"),
+        AuthCredentialsStoreMode::File,
+    )?;
+
+    let mut mcp = McpProcess::new(codex_home.path()).await?;
+    timeout(DEFAULT_TIMEOUT, mcp.initialize()).await??;
+    let request_id = mcp
+        .send_raw_request(
+            "plugin/share/updateTargets",
+            Some(json!({
+                "remotePluginId": "plugins_123",
+                "discoverability": "UNLISTED",
+                "shareTargets": [],
+            })),
+        )
+        .await?;
+
+    let error: JSONRPCError = timeout(
+        DEFAULT_TIMEOUT,
+        mcp.read_stream_until_error_message(RequestId::Integer(request_id)),
+    )
+    .await??;
+
+    assert_eq!(error.error.code, -32600);
+    assert_eq!(error.error.message, "plugin sharing is disabled");
+    Ok(())
+}
+
 #[tokio::test]
 async fn plugin_share_delete_removes_created_workspace_plugin() -> Result<()> {
     let codex_home = TempDir::new()?;
@@ -1123,7 +1174,7 @@ async fn plugin_share_delete_removes_created_workspace_plugin() -> Result<()> {
         PluginShareListResponse {
             data: vec![PluginShareListItem {
                 plugin: PluginSummary {
-                    id: "demo-plugin@workspace-shared-with-me-private".to_string(),
+                    id: "demo-plugin@workspace-shared-with-me".to_string(),
                     remote_plugin_id: Some("plugins_123".to_string()),
                     local_version: None,
                     name: "demo-plugin".to_string(),
diff --git a/codex-rs/app-server/tests/suite/v2/process_exec.rs b/codex-rs/app-server/tests/suite/v2/process_exec.rs
index 5dd3e84b4c..d273257e6e 100644
--- a/codex-rs/app-server/tests/suite/v2/process_exec.rs
+++ b/codex-rs/app-server/tests/suite/v2/process_exec.rs
@@ -6,6 +6,7 @@ use codex_app_server_protocol::ProcessExitedNotification;
 use codex_app_server_protocol::ProcessKillParams;
 use codex_app_server_protocol::ProcessSpawnParams;
 use codex_app_server_protocol::RequestId;
+use codex_exec_server::CODEX_EXEC_SERVER_URL_ENV_VAR;
 use codex_utils_absolute_path::AbsolutePathBuf;
 use pretty_assertions::assert_eq;
 use std::collections::HashMap;
@@ -102,6 +103,33 @@ async fn process_spawn_returns_before_exit_and_emits_exit_notification() -> Resu
     Ok(())
 }
 
+#[tokio::test]
+async fn process_spawn_returns_error_when_local_environment_is_disabled() -> Result<()> {
+    let codex_home = TempDir::new()?;
+    let server = create_mock_responses_server_sequence_unchecked(Vec::new()).await;
+    create_config_toml(codex_home.path(), &server.uri(), "never")?;
+    let mut mcp = McpProcess::new_with_env(
+        codex_home.path(),
+        &[(CODEX_EXEC_SERVER_URL_ENV_VAR, Some("none"))],
+    )
+    .await?;
+    timeout(DEFAULT_READ_TIMEOUT, mcp.initialize()).await??;
+
+    let process_request_id = mcp
+        .send_process_spawn_request(process_spawn_params(
+            "disabled-process".to_string(),
+            codex_home.path(),
+            vec!["sh".to_string(), "-lc".to_string(), "true".to_string()],
+        )?)
+        .await?;
+    let error = mcp
+        .read_stream_until_error_message(RequestId::Integer(process_request_id))
+        .await?;
+    assert_eq!(error.error.message, "local environment is not configured");
+
+    Ok(())
+}
+
 #[tokio::test]
 async fn process_spawn_reports_buffered_output_cap_reached() -> Result<()> {
     let codex_home = TempDir::new()?;
diff --git a/codex-rs/app-server/tests/suite/v2/remote_control.rs b/codex-rs/app-server/tests/suite/v2/remote_control.rs
new file mode 100644
index 0000000000..d71f05bf58
--- /dev/null
+++ b/codex-rs/app-server/tests/suite/v2/remote_control.rs
@@ -0,0 +1,200 @@
+use std::time::Duration;
+
+use anyhow::Context;
+use anyhow::Result;
+use app_test_support::ChatGptAuthFixture;
+use app_test_support::McpProcess;
+use app_test_support::to_response;
+use app_test_support::write_chatgpt_auth;
+use app_test_support::write_mock_responses_config_toml_with_chatgpt_base_url;
+use codex_app_server_protocol::JSONRPCResponse;
+use codex_app_server_protocol::RemoteControlConnectionStatus;
+use codex_app_server_protocol::RemoteControlDisableResponse;
+use codex_app_server_protocol::RemoteControlEnableResponse;
+use codex_app_server_protocol::RemoteControlStatusReadResponse;
+use codex_app_server_protocol::RequestId;
+use codex_config::types::AuthCredentialsStoreMode;
+use pretty_assertions::assert_eq;
+use tempfile::TempDir;
+use tokio::io::AsyncBufReadExt;
+use tokio::io::BufReader;
+use tokio::net::TcpListener;
+use tokio::net::TcpStream;
+use tokio::sync::oneshot;
+use tokio::task::JoinHandle;
+use tokio::time::timeout;
+
+const DEFAULT_TIMEOUT: Duration = Duration::from_secs(10);
+
+#[tokio::test]
+async fn remote_control_disable_returns_disabled_status() -> Result<()> {
+    let codex_home = TempDir::new()?;
+    let mut mcp = McpProcess::new(codex_home.path()).await?;
+    timeout(DEFAULT_TIMEOUT, mcp.initialize()).await??;
+
+    let request_id = mcp.send_remote_control_disable_request().await?;
+    let response: JSONRPCResponse = timeout(
+        DEFAULT_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(request_id)),
+    )
+    .await??;
+    let received: RemoteControlDisableResponse = to_response(response)?;
+
+    assert_eq!(received.status, RemoteControlConnectionStatus::Disabled);
+    assert!(!received.server_name.is_empty());
+    assert_eq!(received.environment_id, None);
+    assert!(!received.installation_id.is_empty());
+    Ok(())
+}
+
+#[tokio::test]
+async fn remote_control_status_read_returns_disabled_status() -> Result<()> {
+    let codex_home = TempDir::new()?;
+    let mut mcp = McpProcess::new(codex_home.path()).await?;
+    timeout(DEFAULT_TIMEOUT, mcp.initialize()).await??;
+
+    let request_id = mcp.send_remote_control_status_read_request().await?;
+    let response: JSONRPCResponse = timeout(
+        DEFAULT_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(request_id)),
+    )
+    .await??;
+    let received: RemoteControlStatusReadResponse = to_response(response)?;
+
+    assert_eq!(received.status, RemoteControlConnectionStatus::Disabled);
+    assert!(!received.server_name.is_empty());
+    assert_eq!(received.environment_id, None);
+    assert!(!received.installation_id.is_empty());
+    Ok(())
+}
+
+#[tokio::test]
+async fn remote_control_enable_returns_connecting_status() -> Result<()> {
+    let codex_home = TempDir::new()?;
+    let _backend = BlockingRemoteControlBackend::start(codex_home.path()).await?;
+    let mut mcp = McpProcess::new(codex_home.path()).await?;
+    timeout(DEFAULT_TIMEOUT, mcp.initialize()).await??;
+
+    let request_id = mcp.send_remote_control_enable_request().await?;
+    let response: JSONRPCResponse = timeout(
+        DEFAULT_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(request_id)),
+    )
+    .await??;
+    let received: RemoteControlEnableResponse = to_response(response)?;
+
+    assert_eq!(received.status, RemoteControlConnectionStatus::Connecting);
+    assert!(!received.server_name.is_empty());
+    assert_eq!(received.environment_id, None);
+    assert!(!received.installation_id.is_empty());
+    Ok(())
+}
+
+#[tokio::test]
+async fn remote_control_status_read_returns_connecting_status_after_enable() -> Result<()> {
+    let codex_home = TempDir::new()?;
+    let mut backend = BlockingRemoteControlBackend::start(codex_home.path()).await?;
+    let mut mcp = McpProcess::new(codex_home.path()).await?;
+    timeout(DEFAULT_TIMEOUT, mcp.initialize()).await??;
+
+    let request_id = mcp.send_remote_control_enable_request().await?;
+    let _: JSONRPCResponse = timeout(
+        DEFAULT_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(request_id)),
+    )
+    .await??;
+
+    let enroll_request = timeout(DEFAULT_TIMEOUT, backend.wait_for_enroll_request()).await??;
+    assert_eq!(
+        enroll_request,
+        "POST /backend-api/wham/remote/control/server/enroll HTTP/1.1"
+    );
+
+    let request_id = mcp.send_remote_control_status_read_request().await?;
+    let response: JSONRPCResponse = timeout(
+        DEFAULT_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(request_id)),
+    )
+    .await??;
+    let received: RemoteControlStatusReadResponse = to_response(response)?;
+
+    assert_eq!(received.status, RemoteControlConnectionStatus::Connecting);
+    assert!(!received.server_name.is_empty());
+    assert_eq!(received.environment_id, None);
+    assert!(!received.installation_id.is_empty());
+    Ok(())
+}
+
+struct BlockingRemoteControlBackend {
+    enroll_request_rx: Option<oneshot::Receiver<Result<String>>>,
+    server_task: JoinHandle<()>,
+}
+
+impl BlockingRemoteControlBackend {
+    async fn start(codex_home: &std::path::Path) -> Result<Self> {
+        let listener = TcpListener::bind("127.0.0.1:0").await?;
+        let remote_control_url = format!("http://{}/backend-api/", listener.local_addr()?);
+        write_mock_responses_config_toml_with_chatgpt_base_url(
+            codex_home,
+            &remote_control_url,
+            &remote_control_url,
+        )?;
+        write_chatgpt_auth(
+            codex_home,
+            ChatGptAuthFixture::new("chatgpt-token")
+                .account_id("account_id")
+                .chatgpt_account_id("account_id"),
+            AuthCredentialsStoreMode::File,
+        )?;
+
+        let (enroll_request_tx, enroll_request_rx) = oneshot::channel();
+        let server_task = tokio::spawn(async move {
+            match read_enroll_request(listener).await {
+                Ok((request_line, _reader)) => {
+                    let _ = enroll_request_tx.send(Ok(request_line));
+                    std::future::pending::<()>().await;
+                }
+                Err(err) => {
+                    let _ = enroll_request_tx.send(Err(err));
+                }
+            }
+        });
+
+        Ok(Self {
+            enroll_request_rx: Some(enroll_request_rx),
+            server_task,
+        })
+    }
+
+    async fn wait_for_enroll_request(&mut self) -> Result<String> {
+        let rx = self
+            .enroll_request_rx
+            .take()
+            .context("enroll request should only be awaited once")?;
+        rx.await?
+    }
+}
+
+impl Drop for BlockingRemoteControlBackend {
+    fn drop(&mut self) {
+        self.server_task.abort();
+    }
+}
+
+async fn read_enroll_request(listener: TcpListener) -> Result<(String, BufReader<TcpStream>)> {
+    let (stream, _) = listener.accept().await?;
+    let mut reader = BufReader::new(stream);
+
+    let mut request_line = String::new();
+    reader.read_line(&mut request_line).await?;
+
+    loop {
+        let mut line = String::new();
+        reader.read_line(&mut line).await?;
+        if line == "\r\n" {
+            break;
+        }
+    }
+
+    Ok((request_line.trim_end().to_string(), reader))
+}
diff --git a/codex-rs/app-server/tests/suite/v2/remote_thread_store.rs b/codex-rs/app-server/tests/suite/v2/remote_thread_store.rs
index e5c0b2c53f..9787868f5c 100644
--- a/codex-rs/app-server/tests/suite/v2/remote_thread_store.rs
+++ b/codex-rs/app-server/tests/suite/v2/remote_thread_store.rs
@@ -75,6 +75,7 @@ async fn thread_start_with_non_local_thread_store_does_not_create_local_persiste
         config: Arc::new(config),
         cli_overrides: Vec::new(),
         loader_overrides,
+        strict_config: false,
         cloud_requirements: CloudRequirementsLoader::default(),
         thread_config_loader: Arc::new(NoopThreadConfigLoader),
         feedback: CodexFeedback::new(),
diff --git a/codex-rs/app-server/tests/suite/v2/skills_list.rs b/codex-rs/app-server/tests/suite/v2/skills_list.rs
index 416b2515ad..db982bc5d0 100644
--- a/codex-rs/app-server/tests/suite/v2/skills_list.rs
+++ b/codex-rs/app-server/tests/suite/v2/skills_list.rs
@@ -614,6 +614,7 @@ async fn skills_changed_notification_is_emitted_after_skill_change() -> Result<(
             model_provider: None,
             service_tier: None,
             cwd: None,
+            runtime_workspace_roots: None,
             approval_policy: None,
             approvals_reviewer: None,
             sandbox: None,
diff --git a/codex-rs/app-server/tests/suite/v2/thread_fork.rs b/codex-rs/app-server/tests/suite/v2/thread_fork.rs
index 3eb262bd2b..cc89dd71cb 100644
--- a/codex-rs/app-server/tests/suite/v2/thread_fork.rs
+++ b/codex-rs/app-server/tests/suite/v2/thread_fork.rs
@@ -454,6 +454,46 @@ async fn thread_fork_rejects_unmaterialized_thread() -> Result<()> {
     Ok(())
 }
 
+#[tokio::test]
+async fn thread_fork_with_empty_path_uses_thread_id() -> Result<()> {
+    let server = create_mock_responses_server_repeating_assistant("Done").await;
+    let codex_home = TempDir::new()?;
+    create_config_toml(codex_home.path(), &server.uri())?;
+
+    let conversation_id = create_fake_rollout(
+        codex_home.path(),
+        "2025-01-05T12-00-00",
+        "2025-01-05T12:00:00Z",
+        "Saved user message",
+        Some("mock_provider"),
+        /*git_info*/ None,
+    )?;
+
+    let mut mcp = McpProcess::new(codex_home.path()).await?;
+    timeout(DEFAULT_READ_TIMEOUT, mcp.initialize()).await??;
+
+    let fork_id = mcp
+        .send_thread_fork_request(ThreadForkParams {
+            thread_id: conversation_id.clone(),
+            path: Some(std::path::PathBuf::new()),
+            thread_source: Some(ThreadSource::User),
+            ..Default::default()
+        })
+        .await?;
+    let fork_resp: JSONRPCResponse = timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(fork_id)),
+    )
+    .await??;
+    let ThreadForkResponse { thread, .. } = to_response::<ThreadForkResponse>(fork_resp)?;
+
+    assert_eq!(
+        thread.forked_from_id.as_deref(),
+        Some(conversation_id.as_str())
+    );
+    Ok(())
+}
+
 #[tokio::test]
 async fn thread_fork_surfaces_cloud_requirements_load_errors() -> Result<()> {
     let server = MockServer::start().await;
diff --git a/codex-rs/app-server/tests/suite/v2/thread_read.rs b/codex-rs/app-server/tests/suite/v2/thread_read.rs
index d6267b8fc0..c8e3e179fb 100644
--- a/codex-rs/app-server/tests/suite/v2/thread_read.rs
+++ b/codex-rs/app-server/tests/suite/v2/thread_read.rs
@@ -375,6 +375,7 @@ async fn thread_turns_list_reads_store_history_without_rollout_path() -> Result<
         config: Arc::new(config),
         cli_overrides: Vec::new(),
         loader_overrides,
+        strict_config: false,
         cloud_requirements: CloudRequirementsLoader::default(),
         thread_config_loader: Arc::new(codex_config::NoopThreadConfigLoader),
         feedback: CodexFeedback::new(),
@@ -440,6 +441,7 @@ async fn thread_read_loaded_include_turns_reads_store_history_without_rollout_pa
         config: Arc::new(config),
         cli_overrides: Vec::new(),
         loader_overrides,
+        strict_config: false,
         cloud_requirements: CloudRequirementsLoader::default(),
         thread_config_loader: Arc::new(codex_config::NoopThreadConfigLoader),
         feedback: CodexFeedback::new(),
@@ -525,6 +527,7 @@ async fn thread_list_includes_store_thread_without_rollout_path() -> Result<()>
         config: Arc::new(config),
         cli_overrides: Vec::new(),
         loader_overrides,
+        strict_config: false,
         cloud_requirements: CloudRequirementsLoader::default(),
         thread_config_loader: Arc::new(codex_config::NoopThreadConfigLoader),
         feedback: CodexFeedback::new(),
@@ -1320,6 +1323,7 @@ fn store_history_items() -> Vec<RolloutItem> {
             images: None,
             local_images: Vec::new(),
             text_elements: Vec::new(),
+            ..Default::default()
         },
     ))]
 }
diff --git a/codex-rs/app-server/tests/suite/v2/thread_resume.rs b/codex-rs/app-server/tests/suite/v2/thread_resume.rs
index 64dfe0beb7..036f2368a0 100644
--- a/codex-rs/app-server/tests/suite/v2/thread_resume.rs
+++ b/codex-rs/app-server/tests/suite/v2/thread_resume.rs
@@ -184,6 +184,143 @@ async fn thread_resume_rejects_unmaterialized_thread() -> Result<()> {
     Ok(())
 }
 
+#[tokio::test]
+async fn thread_resume_with_empty_path_uses_running_thread_id() -> Result<()> {
+    let server = create_mock_responses_server_repeating_assistant("Done").await;
+    let codex_home = TempDir::new()?;
+    create_config_toml(codex_home.path(), &server.uri())?;
+
+    let mut mcp = McpProcess::new(codex_home.path()).await?;
+    timeout(DEFAULT_READ_TIMEOUT, mcp.initialize()).await??;
+
+    let start_id = mcp
+        .send_thread_start_request(ThreadStartParams {
+            model: Some("gpt-5.4".to_string()),
+            ..Default::default()
+        })
+        .await?;
+    let start_resp: JSONRPCResponse = timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(start_id)),
+    )
+    .await??;
+    let ThreadStartResponse { thread, .. } = to_response::<ThreadStartResponse>(start_resp)?;
+
+    let turn_id = mcp
+        .send_turn_start_request(TurnStartParams {
+            thread_id: thread.id.clone(),
+            input: vec![UserInput::Text {
+                text: "materialize rollout".to_string(),
+                text_elements: Vec::new(),
+            }],
+            ..Default::default()
+        })
+        .await?;
+    timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(turn_id)),
+    )
+    .await??;
+    timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_notification_message("turn/completed"),
+    )
+    .await??;
+
+    let resume_id = mcp
+        .send_thread_resume_request(ThreadResumeParams {
+            thread_id: thread.id.clone(),
+            path: Some(PathBuf::new()),
+            exclude_turns: true,
+            ..Default::default()
+        })
+        .await?;
+    let resume_resp: JSONRPCResponse = timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(resume_id)),
+    )
+    .await??;
+    let ThreadResumeResponse {
+        thread: resumed, ..
+    } = to_response::<ThreadResumeResponse>(resume_resp)?;
+
+    assert_eq!(resumed.id, thread.id);
+    Ok(())
+}
+
+#[tokio::test]
+async fn turn_start_updates_runtime_workspace_roots_for_loaded_thread() -> Result<()> {
+    let server = create_mock_responses_server_repeating_assistant("Done").await;
+    let codex_home = TempDir::new()?;
+    create_config_toml(codex_home.path(), &server.uri())?;
+
+    let extra_root_tmp = TempDir::new()?;
+    let extra_root = extra_root_tmp.path().join("extra-root");
+    std::fs::create_dir_all(&extra_root)?;
+
+    let mut mcp = McpProcess::new(codex_home.path()).await?;
+    timeout(DEFAULT_READ_TIMEOUT, mcp.initialize()).await??;
+
+    let start_id = mcp
+        .send_thread_start_request(ThreadStartParams {
+            model: Some("gpt-5.4".to_string()),
+            ..Default::default()
+        })
+        .await?;
+    let start_resp: JSONRPCResponse = timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(start_id)),
+    )
+    .await??;
+    let ThreadStartResponse { thread, .. } = to_response::<ThreadStartResponse>(start_resp)?;
+
+    let turn_id = mcp
+        .send_turn_start_request(TurnStartParams {
+            thread_id: thread.id.clone(),
+            input: vec![UserInput::Text {
+                text: "Hello".to_string(),
+                text_elements: Vec::new(),
+            }],
+            runtime_workspace_roots: Some(vec![extra_root.clone(), extra_root.join(".")]),
+            ..Default::default()
+        })
+        .await?;
+    timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(turn_id)),
+    )
+    .await??;
+    timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_notification_message("turn/completed"),
+    )
+    .await??;
+
+    let resume_id = mcp
+        .send_thread_resume_request(ThreadResumeParams {
+            thread_id: thread.id,
+            exclude_turns: true,
+            ..Default::default()
+        })
+        .await?;
+    let resume_resp: JSONRPCResponse = timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(resume_id)),
+    )
+    .await??;
+    let ThreadResumeResponse {
+        runtime_workspace_roots,
+        ..
+    } = to_response::<ThreadResumeResponse>(resume_resp)?;
+
+    assert_eq!(
+        runtime_workspace_roots,
+        vec![AbsolutePathBuf::from_absolute_path(extra_root)?]
+    );
+
+    Ok(())
+}
+
 #[tokio::test]
 async fn thread_goal_get_rejects_unmaterialized_thread() -> Result<()> {
     let server = create_mock_responses_server_repeating_assistant("Done").await;
@@ -820,6 +957,92 @@ async fn thread_goal_set_preserves_budget_limited_same_objective() -> Result<()>
     Ok(())
 }
 
+#[tokio::test]
+async fn thread_goal_set_persists_resumable_stopped_statuses() -> Result<()> {
+    let server = create_mock_responses_server_repeating_assistant("Done").await;
+    let codex_home = TempDir::new()?;
+    create_config_toml(codex_home.path(), &server.uri())?;
+    let config_path = codex_home.path().join("config.toml");
+    let config = std::fs::read_to_string(&config_path)?;
+    std::fs::write(
+        &config_path,
+        config.replace("personality = true\n", "personality = true\ngoals = true\n"),
+    )?;
+
+    let mut mcp = McpProcess::new_without_managed_config(codex_home.path()).await?;
+    timeout(DEFAULT_READ_TIMEOUT, mcp.initialize()).await??;
+
+    let start_id = mcp
+        .send_thread_start_request(ThreadStartParams {
+            model: Some("gpt-5.2-codex".to_string()),
+            ..Default::default()
+        })
+        .await?;
+    let start_resp: JSONRPCResponse = timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(start_id)),
+    )
+    .await??;
+    let ThreadStartResponse { thread, .. } = to_response::<ThreadStartResponse>(start_resp)?;
+
+    let turn_id = mcp
+        .send_turn_start_request(TurnStartParams {
+            thread_id: thread.id.clone(),
+            input: vec![UserInput::Text {
+                text: "materialize this thread".to_string(),
+                text_elements: Vec::new(),
+            }],
+            ..Default::default()
+        })
+        .await?;
+    let _turn_resp: JSONRPCResponse = timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(turn_id)),
+    )
+    .await??;
+    timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_notification_message("turn/completed"),
+    )
+    .await??;
+
+    for (wire_status, expected_status) in [
+        ("blocked", ThreadGoalStatus::Blocked),
+        ("usageLimited", ThreadGoalStatus::UsageLimited),
+    ] {
+        let goal_id = mcp
+            .send_raw_request(
+                "thread/goal/set",
+                Some(json!({
+                    "threadId": thread.id.clone(),
+                    "objective": "keep polishing",
+                    "status": wire_status,
+                })),
+            )
+            .await?;
+        let goal_resp: JSONRPCResponse = timeout(
+            DEFAULT_READ_TIMEOUT,
+            mcp.read_stream_until_response_message(RequestId::Integer(goal_id)),
+        )
+        .await??;
+        let goal: ThreadGoalSetResponse = to_response(goal_resp)?;
+        assert_eq!(goal.goal.status, expected_status);
+
+        let notification = timeout(
+            DEFAULT_READ_TIMEOUT,
+            mcp.read_stream_until_notification_message("thread/goal/updated"),
+        )
+        .await??;
+        let notification: ServerNotification = notification.try_into()?;
+        let ServerNotification::ThreadGoalUpdated(notification) = notification else {
+            anyhow::bail!("expected thread goal update notification");
+        };
+        assert_eq!(notification.goal.status, expected_status);
+    }
+
+    Ok(())
+}
+
 #[tokio::test]
 async fn thread_goal_set_edits_objective_without_resetting_usage() -> Result<()> {
     let server = create_mock_responses_server_repeating_assistant("Done").await;
@@ -835,7 +1058,7 @@ async fn thread_goal_set_edits_objective_without_resetting_usage() -> Result<()>
         codex_home.path(),
         "2025-01-05T12-00-00",
         "2025-01-05T12:00:00Z",
-        "materialized thread",
+        "",
         Some("mock_provider"),
         /*git_info*/ None,
     )?;
@@ -869,11 +1092,18 @@ async fn thread_goal_set_edits_objective_without_resetting_usage() -> Result<()>
     let state_db =
         StateRuntime::init(codex_home.path().to_path_buf(), "mock_provider".into()).await?;
     let thread_id = ThreadId::from_string(&thread_id)?;
+    let thread_metadata = state_db
+        .get_thread(thread_id)
+        .await?
+        .expect("thread metadata should exist");
+    assert_eq!(thread_metadata.preview.as_deref(), Some("keep polishing"));
     let persisted_goal = state_db
+        .thread_goals()
         .get_thread_goal(thread_id)
         .await?
         .expect("goal should exist");
     state_db
+        .thread_goals()
         .account_thread_goal_usage(
             thread_id,
             /*time_delta_seconds*/ 12,
@@ -901,11 +1131,17 @@ async fn thread_goal_set_edits_objective_without_resetting_usage() -> Result<()>
     .await??;
     let edit: ThreadGoalSetResponse = to_response(edit_resp)?;
     let updated_goal = state_db
+        .thread_goals()
         .get_thread_goal(thread_id)
         .await?
         .expect("goal should still exist");
+    let thread_metadata = state_db
+        .get_thread(thread_id)
+        .await?
+        .expect("thread metadata should still exist");
 
     assert_eq!(persisted_goal.goal_id, updated_goal.goal_id);
+    assert_eq!(thread_metadata.preview.as_deref(), Some("keep polishing"));
     assert_eq!(edit.goal.objective, "keep polishing with clearer wording");
     assert_eq!(edit.goal.status, ThreadGoalStatus::BudgetLimited);
     assert_eq!(edit.goal.token_budget, Some(40));
@@ -1971,7 +2207,7 @@ async fn thread_resume_rejects_history_when_thread_is_running() -> Result<()> {
 }
 
 #[tokio::test]
-async fn thread_resume_uses_path_over_thread_id_when_thread_is_running() -> Result<()> {
+async fn thread_resume_rejects_mismatched_path_for_running_thread_id() -> Result<()> {
     let server = responses::start_mock_server().await;
     let first_body = responses::sse(vec![
         responses::ev_response_created("resp-1"),
@@ -2051,7 +2287,6 @@ async fn thread_resume_uses_path_over_thread_id_when_thread_is_running() -> Resu
     )
     .await??;
 
-    let other_thread_id = ThreadId::new().to_string();
     let stale_path = rollout_path(codex_home.path(), "2025-01-01T00-00-00", &thread_id);
     std::fs::create_dir_all(stale_path.parent().expect("stale path parent"))?;
     let thread_uuid = Uuid::parse_str(&thread_id)?;
@@ -2083,7 +2318,7 @@ async fn thread_resume_uses_path_over_thread_id_when_thread_is_running() -> Resu
 
     let stale_resume_id = primary
         .send_thread_resume_request(ThreadResumeParams {
-            thread_id: other_thread_id.clone(),
+            thread_id: thread_id.clone(),
             path: Some(stale_path),
             ..Default::default()
         })
@@ -2099,23 +2334,6 @@ async fn thread_resume_uses_path_over_thread_id_when_thread_is_running() -> Resu
         stale_resume_err.error.message
     );
 
-    let resume_by_path_id = primary
-        .send_thread_resume_request(ThreadResumeParams {
-            thread_id: other_thread_id.clone(),
-            path: thread.path,
-            ..Default::default()
-        })
-        .await?;
-    let resume_by_path_resp: JSONRPCResponse = timeout(
-        DEFAULT_READ_TIMEOUT,
-        primary.read_stream_until_response_message(RequestId::Integer(resume_by_path_id)),
-    )
-    .await??;
-    let ThreadResumeResponse {
-        thread: resumed, ..
-    } = to_response::<ThreadResumeResponse>(resume_by_path_resp)?;
-    assert_eq!(resumed.id, thread_id);
-
     primary
         .interrupt_turn_and_wait_for_aborted(thread_id, running_turn.id, DEFAULT_READ_TIMEOUT)
         .await?;
@@ -2812,53 +3030,22 @@ async fn thread_resume_surfaces_cloud_requirements_load_errors() -> Result<()> {
 }
 
 #[tokio::test]
-async fn thread_resume_uses_path_over_invalid_thread_id() -> Result<()> {
+async fn thread_resume_uses_path_over_non_running_thread_id() -> Result<()> {
     let server = create_mock_responses_server_repeating_assistant("Done").await;
     let codex_home = TempDir::new()?;
     create_config_toml(codex_home.path(), &server.uri())?;
 
-    let mut mcp = McpProcess::new(codex_home.path()).await?;
-    timeout(DEFAULT_READ_TIMEOUT, mcp.initialize()).await??;
+    let RestartedThreadFixture {
+        mut mcp,
+        thread_id,
+        rollout_file_path,
+        ..
+    } = start_materialized_thread_and_restart(codex_home.path(), "materialize").await?;
 
-    let start_id = mcp
-        .send_thread_start_request(ThreadStartParams {
-            model: Some("gpt-5.4".to_string()),
-            ..Default::default()
-        })
-        .await?;
-    let start_resp: JSONRPCResponse = timeout(
-        DEFAULT_READ_TIMEOUT,
-        mcp.read_stream_until_response_message(RequestId::Integer(start_id)),
-    )
-    .await??;
-    let ThreadStartResponse { thread, .. } = to_response::<ThreadStartResponse>(start_resp)?;
-
-    let turn_id = mcp
-        .send_turn_start_request(TurnStartParams {
-            thread_id: thread.id.clone(),
-            input: vec![UserInput::Text {
-                text: "materialize".to_string(),
-                text_elements: Vec::new(),
-            }],
-            ..Default::default()
-        })
-        .await?;
-    timeout(
-        DEFAULT_READ_TIMEOUT,
-        mcp.read_stream_until_response_message(RequestId::Integer(turn_id)),
-    )
-    .await??;
-    timeout(
-        DEFAULT_READ_TIMEOUT,
-        mcp.read_stream_until_notification_message("turn/completed"),
-    )
-    .await??;
-
-    let thread_path = thread.path.clone().expect("thread path");
     let resume_id = mcp
         .send_thread_resume_request(ThreadResumeParams {
-            thread_id: "not-a-valid-thread-id".to_string(),
-            path: Some(thread_path.to_path_buf()),
+            thread_id: ThreadId::new().to_string(),
+            path: Some(rollout_file_path),
             ..Default::default()
         })
         .await?;
@@ -2871,7 +3058,7 @@ async fn thread_resume_uses_path_over_invalid_thread_id() -> Result<()> {
     let ThreadResumeResponse {
         thread: resumed, ..
     } = to_response::<ThreadResumeResponse>(resume_resp)?;
-    assert_eq!(resumed.id, thread.id);
+    assert_eq!(resumed.id, thread_id);
 
     Ok(())
 }
diff --git a/codex-rs/app-server/tests/suite/v2/thread_shell_command.rs b/codex-rs/app-server/tests/suite/v2/thread_shell_command.rs
index b7cfba2f95..4ab677aca1 100644
--- a/codex-rs/app-server/tests/suite/v2/thread_shell_command.rs
+++ b/codex-rs/app-server/tests/suite/v2/thread_shell_command.rs
@@ -32,6 +32,7 @@ use codex_app_server_protocol::TurnStartParams;
 use codex_app_server_protocol::TurnStartResponse;
 use codex_app_server_protocol::UserInput as V2UserInput;
 use codex_core::shell::default_user_shell;
+use codex_exec_server::CODEX_EXEC_SERVER_URL_ENV_VAR;
 use codex_features::FEATURES;
 use codex_features::Feature;
 use pretty_assertions::assert_eq;
@@ -182,6 +183,49 @@ async fn thread_shell_command_history_responses_exclude_persisted_command_execut
     Ok(())
 }
 
+#[tokio::test]
+async fn thread_shell_command_returns_error_when_local_environment_is_disabled() -> Result<()> {
+    let tmp = TempDir::new()?;
+    let codex_home = tmp.path().join("codex_home");
+    std::fs::create_dir(&codex_home)?;
+    let server = create_mock_responses_server_sequence(vec![]).await;
+    create_config_toml(
+        codex_home.as_path(),
+        &server.uri(),
+        "never",
+        &BTreeMap::default(),
+    )?;
+
+    let mut mcp = McpProcess::new_with_env(
+        codex_home.as_path(),
+        &[(CODEX_EXEC_SERVER_URL_ENV_VAR, Some("none"))],
+    )
+    .await?;
+    timeout(DEFAULT_READ_TIMEOUT, mcp.initialize()).await??;
+
+    let start_id = mcp
+        .send_thread_start_request(ThreadStartParams::default())
+        .await?;
+    let start_resp: JSONRPCResponse = timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(start_id)),
+    )
+    .await??;
+    let ThreadStartResponse { thread, .. } = to_response::<ThreadStartResponse>(start_resp)?;
+    let shell_id = mcp
+        .send_thread_shell_command_request(ThreadShellCommandParams {
+            thread_id: thread.id,
+            command: "pwd".to_string(),
+        })
+        .await?;
+    let error = mcp
+        .read_stream_until_error_message(RequestId::Integer(shell_id))
+        .await?;
+    assert_eq!(error.error.message, "local environment is not configured");
+
+    Ok(())
+}
+
 #[tokio::test]
 async fn thread_shell_command_uses_existing_active_turn() -> Result<()> {
     let tmp = TempDir::new()?;
diff --git a/codex-rs/app-server/tests/suite/v2/thread_start.rs b/codex-rs/app-server/tests/suite/v2/thread_start.rs
index 78155d8c9a..75c124e893 100644
--- a/codex-rs/app-server/tests/suite/v2/thread_start.rs
+++ b/codex-rs/app-server/tests/suite/v2/thread_start.rs
@@ -236,6 +236,89 @@ async fn thread_start_creates_thread_and_emits_started() -> Result<()> {
     Ok(())
 }
 
+#[tokio::test]
+async fn thread_start_resolves_runtime_workspace_roots_against_cwd() -> Result<()> {
+    let server = create_mock_responses_server_repeating_assistant("Done").await;
+    let codex_home = TempDir::new()?;
+    create_config_toml_without_approval_policy(codex_home.path(), &server.uri())?;
+
+    let cwd_tmp = TempDir::new()?;
+    let cwd = cwd_tmp.path().to_path_buf();
+    let relative_root = PathBuf::from("extra-root");
+    std::fs::create_dir_all(cwd.join(&relative_root))?;
+
+    let mut mcp = McpProcess::new(codex_home.path()).await?;
+    timeout(DEFAULT_READ_TIMEOUT, mcp.initialize()).await??;
+
+    let req_id = mcp
+        .send_thread_start_request(ThreadStartParams {
+            cwd: Some(cwd.to_string_lossy().to_string()),
+            runtime_workspace_roots: Some(vec![relative_root.clone()]),
+            ..Default::default()
+        })
+        .await?;
+
+    let resp: JSONRPCResponse = timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(req_id)),
+    )
+    .await??;
+    let ThreadStartResponse {
+        cwd: response_cwd,
+        runtime_workspace_roots,
+        ..
+    } = to_response::<ThreadStartResponse>(resp)?;
+
+    assert_eq!(response_cwd, cwd.abs());
+    assert_eq!(
+        runtime_workspace_roots,
+        vec![cwd_tmp.path().join(relative_root).abs()]
+    );
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn thread_start_excludes_profile_workspace_roots_from_runtime_workspace_roots() -> Result<()>
+{
+    let server = create_mock_responses_server_repeating_assistant("Done").await;
+    let codex_home = TempDir::new()?;
+    let cwd = TempDir::new()?;
+    let profile_root = TempDir::new()?;
+    create_config_toml_with_profile_workspace_root(
+        codex_home.path(),
+        &server.uri(),
+        profile_root.path(),
+    )?;
+
+    let mut mcp = McpProcess::new(codex_home.path()).await?;
+    timeout(DEFAULT_READ_TIMEOUT, mcp.initialize()).await??;
+
+    let req_id = mcp
+        .send_thread_start_request(ThreadStartParams {
+            cwd: Some(cwd.path().to_string_lossy().to_string()),
+            ..Default::default()
+        })
+        .await?;
+
+    let resp: JSONRPCResponse = timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(req_id)),
+    )
+    .await??;
+    let ThreadStartResponse {
+        runtime_workspace_roots,
+        ..
+    } = to_response::<ThreadStartResponse>(resp)?;
+
+    assert_eq!(
+        runtime_workspace_roots,
+        vec![cwd.path().to_path_buf().abs()]
+    );
+
+    Ok(())
+}
+
 #[tokio::test]
 async fn thread_start_rejects_unknown_environment_as_invalid_request() -> Result<()> {
     let server = create_mock_responses_server_repeating_assistant("Done").await;
@@ -980,6 +1063,42 @@ stream_max_retries = 0
     )
 }
 
+fn create_config_toml_with_profile_workspace_root(
+    codex_home: &Path,
+    server_uri: &str,
+    profile_root: &Path,
+) -> std::io::Result<()> {
+    let config_toml = codex_home.join("config.toml");
+    let profile_root_key = profile_root
+        .display()
+        .to_string()
+        .replace('\\', "\\\\")
+        .replace('"', "\\\"");
+    std::fs::write(
+        config_toml,
+        format!(
+            r#"
+model = "mock-model"
+default_permissions = "dev"
+model_provider = "mock_provider"
+
+[model_providers.mock_provider]
+name = "Mock provider for test"
+base_url = "{server_uri}/v1"
+wire_api = "responses"
+request_max_retries = 0
+stream_max_retries = 0
+
+[permissions.dev.workspace_roots]
+"{profile_root_key}" = true
+
+[permissions.dev.filesystem.":workspace_roots"]
+"." = "write"
+"#,
+        ),
+    )
+}
+
 fn create_config_toml_with_chatgpt_base_url(
     codex_home: &Path,
     server_uri: &str,
diff --git a/codex-rs/app-server/tests/suite/v2/thread_unarchive.rs b/codex-rs/app-server/tests/suite/v2/thread_unarchive.rs
index dfc79e9d48..d2f8f268a2 100644
--- a/codex-rs/app-server/tests/suite/v2/thread_unarchive.rs
+++ b/codex-rs/app-server/tests/suite/v2/thread_unarchive.rs
@@ -245,6 +245,7 @@ async fn thread_unarchive_preserves_pathless_store_metadata() -> Result<()> {
         config: Arc::new(config),
         cli_overrides: Vec::new(),
         loader_overrides,
+        strict_config: false,
         cloud_requirements: CloudRequirementsLoader::default(),
         thread_config_loader: Arc::new(codex_config::NoopThreadConfigLoader),
         feedback: CodexFeedback::new(),
diff --git a/codex-rs/app-server/tests/suite/v2/turn_start.rs b/codex-rs/app-server/tests/suite/v2/turn_start.rs
index 524b795b81..66f704f83d 100644
--- a/codex-rs/app-server/tests/suite/v2/turn_start.rs
+++ b/codex-rs/app-server/tests/suite/v2/turn_start.rs
@@ -1,3 +1,4 @@
+use anyhow::Context;
 use anyhow::Result;
 use app_test_support::DEFAULT_CLIENT_NAME;
 use app_test_support::McpProcess;
@@ -34,7 +35,6 @@ use codex_app_server_protocol::JSONRPCNotification;
 use codex_app_server_protocol::JSONRPCResponse;
 use codex_app_server_protocol::PatchApplyStatus;
 use codex_app_server_protocol::PatchChangeKind;
-use codex_app_server_protocol::PermissionProfileSelectionParams;
 use codex_app_server_protocol::RequestId;
 use codex_app_server_protocol::ServerRequest;
 use codex_app_server_protocol::ServerRequestResolvedNotification;
@@ -62,11 +62,14 @@ use codex_protocol::config_types::ModeKind;
 use codex_protocol::config_types::Personality;
 use codex_protocol::config_types::ReasoningSummary;
 use codex_protocol::config_types::Settings;
+use codex_protocol::models::BUILT_IN_PERMISSION_PROFILE_DANGER_FULL_ACCESS;
+use codex_protocol::models::ImageDetail;
 use codex_protocol::openai_models::ReasoningEffort;
 use codex_protocol::user_input::MAX_USER_INPUT_TEXT_CHARS;
 use core_test_support::responses;
 use core_test_support::skip_if_no_network;
 use pretty_assertions::assert_eq;
+use serde_json::Value;
 use serde_json::json;
 use std::collections::BTreeMap;
 use std::collections::HashMap;
@@ -84,6 +87,11 @@ const DEFAULT_READ_TIMEOUT: std::time::Duration = std::time::Duration::from_secs
 const TEST_ORIGINATOR: &str = "codex_vscode";
 const LOCAL_PRAGMATIC_TEMPLATE: &str = "You are a deeply pragmatic, effective software engineer.";
 const INVALID_REQUEST_ERROR_CODE: i64 = -32600;
+const TINY_PNG_BYTES: &[u8] = &[
+    137, 80, 78, 71, 13, 10, 26, 10, 0, 0, 0, 13, 73, 72, 68, 82, 0, 0, 0, 1, 0, 0, 0, 1, 8, 6, 0,
+    0, 0, 31, 21, 196, 137, 0, 0, 0, 11, 73, 68, 65, 84, 120, 156, 99, 96, 0, 2, 0, 0, 5, 0, 1,
+    122, 94, 171, 63, 0, 0, 0, 0, 73, 69, 78, 68, 174, 66, 96, 130,
+];
 
 fn body_contains(req: &wiremock::Request, text: &str) -> bool {
     String::from_utf8(req.body.clone())
@@ -91,6 +99,208 @@ fn body_contains(req: &wiremock::Request, text: &str) -> bool {
         .is_some_and(|body| body.contains(text))
 }
 
+async fn run_local_image_turn(detail: Option<ImageDetail>) -> Result<Vec<Value>> {
+    // Two Codex turns hit the mock model (session start + turn/start).
+    let responses = vec![
+        create_final_assistant_message_sse_response("Done")?,
+        create_final_assistant_message_sse_response("Done")?,
+    ];
+    // Use the unchecked variant because the strict matcher does not currently
+    // cover image-bearing request payloads.
+    let server = create_mock_responses_server_sequence_unchecked(responses).await;
+
+    let codex_home = TempDir::new()?;
+    create_config_toml(
+        codex_home.path(),
+        &server.uri(),
+        "never",
+        &BTreeMap::default(),
+    )?;
+
+    let mut mcp = McpProcess::new(codex_home.path()).await?;
+    timeout(DEFAULT_READ_TIMEOUT, mcp.initialize()).await??;
+
+    let thread_req = mcp
+        .send_thread_start_request(ThreadStartParams {
+            model: Some("mock-model".to_string()),
+            ..Default::default()
+        })
+        .await?;
+    let thread_resp: JSONRPCResponse = timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(thread_req)),
+    )
+    .await??;
+    let ThreadStartResponse { thread, .. } = to_response::<ThreadStartResponse>(thread_resp)?;
+
+    let image_path = codex_home.path().join("image.png");
+    std::fs::write(&image_path, TINY_PNG_BYTES)?;
+
+    let turn_req = mcp
+        .send_turn_start_request(TurnStartParams {
+            thread_id: thread.id.clone(),
+            input: vec![V2UserInput::LocalImage {
+                path: image_path,
+                detail,
+            }],
+            ..Default::default()
+        })
+        .await?;
+    let turn_resp: JSONRPCResponse = timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(turn_req)),
+    )
+    .await??;
+    let TurnStartResponse { turn } = to_response::<TurnStartResponse>(turn_resp)?;
+    assert!(!turn.id.is_empty());
+
+    timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_notification_message("turn/completed"),
+    )
+    .await??;
+
+    received_response_input_images(&server).await
+}
+
+async fn received_response_input_images(server: &wiremock::MockServer) -> Result<Vec<Value>> {
+    let requests = server
+        .received_requests()
+        .await
+        .context("failed to fetch received requests")?;
+    let mut input_images = Vec::new();
+
+    for request in requests {
+        if !request.url.path().ends_with("/responses") {
+            continue;
+        }
+        let body = request
+            .body_json::<Value>()
+            .context("request body should be JSON")?;
+        let Some(input) = body.get("input").and_then(Value::as_array) else {
+            continue;
+        };
+
+        for item in input {
+            if item.get("type").and_then(Value::as_str) != Some("message") {
+                continue;
+            }
+            let Some(content) = item.get("content").and_then(Value::as_array) else {
+                continue;
+            };
+            input_images.extend(
+                content
+                    .iter()
+                    .filter(|span| span.get("type").and_then(Value::as_str) == Some("input_image"))
+                    .cloned(),
+            );
+        }
+    }
+
+    Ok(input_images)
+}
+
+#[tokio::test]
+async fn turn_start_with_empty_input_runs_model_request() -> Result<()> {
+    let responses = vec![create_final_assistant_message_sse_response("Done")?];
+    let server = create_mock_responses_server_sequence_unchecked(responses).await;
+
+    let codex_home = TempDir::new()?;
+    create_config_toml(
+        codex_home.path(),
+        &server.uri(),
+        "never",
+        &BTreeMap::default(),
+    )?;
+
+    let mut mcp = McpProcess::new(codex_home.path()).await?;
+    timeout(DEFAULT_READ_TIMEOUT, mcp.initialize()).await??;
+
+    let thread_req = mcp
+        .send_thread_start_request(ThreadStartParams {
+            model: Some("mock-model".to_string()),
+            thread_source: Some(ThreadSource::User),
+            ..Default::default()
+        })
+        .await?;
+    let thread_resp: JSONRPCResponse = timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(thread_req)),
+    )
+    .await??;
+    let ThreadStartResponse { thread, .. } = to_response::<ThreadStartResponse>(thread_resp)?;
+
+    let turn_req = mcp
+        .send_turn_start_request(TurnStartParams {
+            thread_id: thread.id.clone(),
+            input: Vec::new(),
+            ..Default::default()
+        })
+        .await?;
+    let turn_resp: JSONRPCResponse = timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(turn_req)),
+    )
+    .await??;
+    let TurnStartResponse { turn } = to_response::<TurnStartResponse>(turn_resp)?;
+    assert!(!turn.id.is_empty());
+
+    let started_notif: JSONRPCNotification = timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_notification_message("turn/started"),
+    )
+    .await??;
+    let started: TurnStartedNotification =
+        serde_json::from_value(started_notif.params.expect("params must be present"))?;
+    assert_eq!(started.thread_id, thread.id);
+    assert_eq!(started.turn.id, turn.id);
+    assert_eq!(started.turn.status, TurnStatus::InProgress);
+
+    let completed_notif: JSONRPCNotification = timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_notification_message("turn/completed"),
+    )
+    .await??;
+    let completed: TurnCompletedNotification = serde_json::from_value(
+        completed_notif
+            .params
+            .expect("turn/completed params must be present"),
+    )?;
+    assert_eq!(completed.thread_id, thread.id);
+    assert_eq!(completed.turn.id, turn.id);
+    assert_eq!(completed.turn.status, TurnStatus::Completed);
+
+    let requests = server
+        .received_requests()
+        .await
+        .context("failed to fetch received requests")?;
+    let response_requests = requests
+        .iter()
+        .filter(|request| request.url.path().ends_with("/responses"))
+        .collect::<Vec<_>>();
+    assert_eq!(response_requests.len(), 1);
+    let body = response_requests[0]
+        .body_json::<Value>()
+        .context("request body should be JSON")?;
+    let input = body
+        .get("input")
+        .and_then(Value::as_array)
+        .context("request body should include input array")?;
+    assert!(
+        !input.iter().any(|item| {
+            item.get("type").and_then(Value::as_str) == Some("message")
+                && item.get("role").and_then(Value::as_str) == Some("user")
+                && item
+                    .get("content")
+                    .and_then(Value::as_array)
+                    .is_some_and(Vec::is_empty)
+        }),
+        "empty turn/start should not synthesize an empty user message: {input:?}"
+    );
+
+    Ok(())
+}
+
 #[tokio::test]
 async fn turn_start_sends_originator_header() -> Result<()> {
     let responses = vec![create_final_assistant_message_sse_response("Done")?];
@@ -554,6 +764,7 @@ async fn turn_start_tracks_turn_event_analytics() -> Result<()> {
             thread_id: thread.id.clone(),
             input: vec![V2UserInput::Image {
                 url: "https://example.com/a.png".to_string(),
+                detail: None,
             }],
             ..Default::default()
         })
@@ -779,10 +990,7 @@ async fn turn_start_rejects_invalid_permission_selection_before_starting_turn()
                 text: "Hello".to_string(),
                 text_elements: Vec::new(),
             }],
-            permissions: Some(PermissionProfileSelectionParams::Profile {
-                id: ":danger-no-sandbox".to_string(),
-                modifications: None,
-            }),
+            permissions: Some(BUILT_IN_PERMISSION_PROFILE_DANGER_FULL_ACCESS.to_string()),
             ..Default::default()
         })
         .await?;
@@ -793,7 +1001,11 @@ async fn turn_start_rejects_invalid_permission_selection_before_starting_turn()
     .await??;
 
     assert_eq!(err.error.code, INVALID_REQUEST_ERROR_CODE);
-    assert!(err.error.message.contains("invalid turn context override"));
+    assert!(
+        err.error
+            .message
+            .contains("invalid thread settings override")
+    );
     assert!(
         err.error.message.contains("allowed set [ReadOnly]"),
         "unexpected error message: {}",
@@ -1464,63 +1676,27 @@ async fn turn_start_uses_migrated_pragmatic_personality_without_override_v2() ->
 }
 
 #[tokio::test]
-async fn turn_start_accepts_local_image_input() -> Result<()> {
-    // Two Codex turns hit the mock model (session start + turn/start).
-    let responses = vec![
-        create_final_assistant_message_sse_response("Done")?,
-        create_final_assistant_message_sse_response("Done")?,
-    ];
-    // Use the unchecked variant because the request payload includes a LocalImage
-    // which the strict matcher does not currently cover.
-    let server = create_mock_responses_server_sequence_unchecked(responses).await;
+async fn turn_start_defaults_local_image_detail_to_high() -> Result<()> {
+    let input_images = run_local_image_turn(/*detail*/ None).await?;
 
-    let codex_home = TempDir::new()?;
-    create_config_toml(
-        codex_home.path(),
-        &server.uri(),
-        "never",
-        &BTreeMap::default(),
-    )?;
+    assert_eq!(input_images.len(), 1);
+    assert_eq!(
+        input_images[0].get("detail").and_then(Value::as_str),
+        Some("high")
+    );
 
-    let mut mcp = McpProcess::new(codex_home.path()).await?;
-    timeout(DEFAULT_READ_TIMEOUT, mcp.initialize()).await??;
+    Ok(())
+}
 
-    let thread_req = mcp
-        .send_thread_start_request(ThreadStartParams {
-            model: Some("mock-model".to_string()),
-            ..Default::default()
-        })
-        .await?;
-    let thread_resp: JSONRPCResponse = timeout(
-        DEFAULT_READ_TIMEOUT,
-        mcp.read_stream_until_response_message(RequestId::Integer(thread_req)),
-    )
-    .await??;
-    let ThreadStartResponse { thread, .. } = to_response::<ThreadStartResponse>(thread_resp)?;
+#[tokio::test]
+async fn turn_start_forwards_custom_local_image_detail() -> Result<()> {
+    let input_images = run_local_image_turn(Some(ImageDetail::Original)).await?;
 
-    let image_path = codex_home.path().join("image.png");
-    // No need to actually write the file; we just exercise the input path.
-
-    let turn_req = mcp
-        .send_turn_start_request(TurnStartParams {
-            thread_id: thread.id.clone(),
-            input: vec![V2UserInput::LocalImage { path: image_path }],
-            ..Default::default()
-        })
-        .await?;
-    let turn_resp: JSONRPCResponse = timeout(
-        DEFAULT_READ_TIMEOUT,
-        mcp.read_stream_until_response_message(RequestId::Integer(turn_req)),
-    )
-    .await??;
-    let TurnStartResponse { turn } = to_response::<TurnStartResponse>(turn_resp)?;
-    assert!(!turn.id.is_empty());
-
-    timeout(
-        DEFAULT_READ_TIMEOUT,
-        mcp.read_stream_until_notification_message("turn/completed"),
-    )
-    .await??;
+    assert_eq!(input_images.len(), 1);
+    assert_eq!(
+        input_images[0].get("detail").and_then(Value::as_str),
+        Some("original")
+    );
 
     Ok(())
 }
@@ -1890,13 +2066,14 @@ async fn turn_start_updates_sandbox_and_cwd_between_turns_v2() -> Result<()> {
             }],
             responsesapi_client_metadata: None,
             cwd: Some(first_cwd.clone()),
+            runtime_workspace_roots: None,
             approval_policy: Some(codex_app_server_protocol::AskForApproval::Never),
             approvals_reviewer: None,
             sandbox_policy: Some(codex_app_server_protocol::SandboxPolicy::WorkspaceWrite {
                 writable_roots: vec![first_cwd.try_into()?],
                 network_access: false,
-                exclude_tmpdir_env_var: false,
-                exclude_slash_tmp: false,
+                exclude_tmpdir_env_var: true,
+                exclude_slash_tmp: true,
             }),
             permissions: None,
             model: Some("mock-model".to_string()),
@@ -1931,6 +2108,7 @@ async fn turn_start_updates_sandbox_and_cwd_between_turns_v2() -> Result<()> {
             }],
             responsesapi_client_metadata: None,
             cwd: Some(second_cwd.clone()),
+            runtime_workspace_roots: None,
             approval_policy: Some(codex_app_server_protocol::AskForApproval::Never),
             approvals_reviewer: None,
             sandbox_policy: Some(codex_app_server_protocol::SandboxPolicy::DangerFullAccess),
@@ -1990,6 +2168,152 @@ async fn turn_start_updates_sandbox_and_cwd_between_turns_v2() -> Result<()> {
     Ok(())
 }
 
+#[cfg(unix)]
+#[tokio::test]
+async fn turn_start_permission_profile_rebinds_runtime_workspace_roots_between_turns() -> Result<()>
+{
+    skip_if_no_network!(Ok(()));
+
+    let tmp = TempDir::new()?;
+    let codex_home = tmp.path().join("codex_home");
+    std::fs::create_dir(&codex_home)?;
+    let old_root = tmp.path().join("old-root");
+    let new_root = tmp.path().join("new-root");
+    std::fs::create_dir(&old_root)?;
+    std::fs::create_dir(&new_root)?;
+    let old_root_text = old_root.to_string_lossy().into_owned();
+    let new_root_text = new_root.to_string_lossy().into_owned();
+
+    let server = responses::start_mock_server().await;
+    let response_mock = responses::mount_sse_sequence(
+        &server,
+        vec![
+            responses::sse(vec![
+                responses::ev_response_created("resp-1"),
+                responses::ev_assistant_message("msg-1", "done first"),
+                responses::ev_completed("resp-1"),
+            ]),
+            responses::sse(vec![
+                responses::ev_response_created("resp-2"),
+                responses::ev_assistant_message("msg-2", "done second"),
+                responses::ev_completed("resp-2"),
+            ]),
+        ],
+    )
+    .await;
+    let server_uri = server.uri();
+    std::fs::write(
+        codex_home.join("config.toml"),
+        format!(
+            r#"
+model = "mock-model"
+approval_policy = "never"
+default_permissions = "dev"
+model_provider = "mock_provider"
+
+[model_providers.mock_provider]
+name = "Mock provider for test"
+base_url = "{server_uri}/v1"
+wire_api = "responses"
+request_max_retries = 0
+stream_max_retries = 0
+
+[permissions.dev.filesystem.":workspace_roots"]
+"." = "write"
+"#
+        ),
+    )?;
+
+    let mut mcp = McpProcess::new(&codex_home).await?;
+    timeout(DEFAULT_READ_TIMEOUT, mcp.initialize()).await??;
+
+    let start_id = mcp
+        .send_thread_start_request(ThreadStartParams {
+            model: Some("mock-model".to_string()),
+            ..Default::default()
+        })
+        .await?;
+    let start_resp: JSONRPCResponse = timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(start_id)),
+    )
+    .await??;
+    let ThreadStartResponse { thread, .. } = to_response::<ThreadStartResponse>(start_resp)?;
+
+    let first_turn_id = mcp
+        .send_turn_start_request(TurnStartParams {
+            thread_id: thread.id.clone(),
+            input: vec![V2UserInput::Text {
+                text: "select dev profile".to_string(),
+                text_elements: Vec::new(),
+            }],
+            runtime_workspace_roots: Some(vec![old_root]),
+            permissions: Some("dev".to_string()),
+            ..Default::default()
+        })
+        .await?;
+    timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(first_turn_id)),
+    )
+    .await??;
+    timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_notification_message("turn/completed"),
+    )
+    .await??;
+
+    let second_turn_id = mcp
+        .send_turn_start_request(TurnStartParams {
+            thread_id: thread.id.clone(),
+            input: vec![V2UserInput::Text {
+                text: "write in new root".to_string(),
+                text_elements: Vec::new(),
+            }],
+            runtime_workspace_roots: Some(vec![new_root]),
+            ..Default::default()
+        })
+        .await?;
+    timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_response_message(RequestId::Integer(second_turn_id)),
+    )
+    .await??;
+
+    timeout(
+        DEFAULT_READ_TIMEOUT,
+        mcp.read_stream_until_notification_message("turn/completed"),
+    )
+    .await??;
+
+    let requests = response_mock.requests();
+    assert_eq!(requests.len(), 2, "expected two Responses API requests");
+    let latest_permissions_instructions =
+        |request: &core_test_support::responses::ResponsesRequest| {
+            request
+                .message_input_texts("developer")
+                .into_iter()
+                .rev()
+                .find(|text| text.contains("<permissions instructions>"))
+                .expect("permissions instructions")
+        };
+    let first_permissions = latest_permissions_instructions(&requests[0]);
+    assert!(first_permissions.contains(&old_root_text));
+    assert!(
+        !first_permissions.contains(&new_root_text),
+        "first turn should materialize the initial runtime workspace root"
+    );
+
+    let second_permissions = latest_permissions_instructions(&requests[1]);
+    assert!(second_permissions.contains(&new_root_text));
+    assert!(
+        !second_permissions.contains(&old_root_text),
+        "second turn should rebind :workspace_roots to the updated runtime workspace root"
+    );
+
+    Ok(())
+}
+
 #[tokio::test]
 async fn turn_start_resolves_sticky_thread_local_environment_and_turn_overrides() -> Result<()> {
     let tmp = TempDir::new()?;
@@ -2475,13 +2799,26 @@ async fn turn_start_streams_apply_patch_change_updates_v2() -> Result<()> {
         &server.uri(),
         "never",
         &BTreeMap::from([
-            (Feature::ApplyPatchFreeform, true),
             (Feature::ApplyPatchStreamingEvents, true),
             (Feature::Plugins, false),
             (Feature::RemoteModels, false),
             (Feature::ShellSnapshot, false),
         ]),
     )?;
+    write_models_cache(&codex_home)?;
+    let cache_path = codex_home.join("models_cache.json");
+    let mut cache: serde_json::Value =
+        serde_json::from_str(&std::fs::read_to_string(&cache_path)?)?;
+    let models = cache["models"]
+        .as_array_mut()
+        .expect("models_cache.json models should be an array");
+    let model = models
+        .first_mut()
+        .expect("models_cache.json should contain at least one model");
+    model["slug"] = serde_json::Value::from("mock-model");
+    model["display_name"] = serde_json::Value::from("mock-model");
+    model["apply_patch_tool_type"] = serde_json::Value::from("freeform");
+    std::fs::write(&cache_path, serde_json::to_string_pretty(&cache)?)?;
 
     let mut mcp = McpProcess::new(&codex_home).await?;
     timeout(DEFAULT_READ_TIMEOUT, mcp.initialize()).await??;
@@ -2573,7 +2910,12 @@ async fn turn_start_emits_spawn_agent_item_with_model_metadata_v2() -> Result<()
         |req: &wiremock::Request| body_contains(req, PARENT_PROMPT),
         responses::sse(vec![
             responses::ev_response_created("resp-turn1-1"),
-            responses::ev_function_call(SPAWN_CALL_ID, "spawn_agent", &spawn_args),
+            responses::ev_function_call_with_namespace(
+                SPAWN_CALL_ID,
+                "multi_agent_v1",
+                "spawn_agent",
+                &spawn_args,
+            ),
             responses::ev_completed("resp-turn1-1"),
         ]),
     )
@@ -2770,7 +3112,12 @@ async fn turn_start_emits_spawn_agent_item_with_effective_role_model_metadata_v2
         |req: &wiremock::Request| body_contains(req, PARENT_PROMPT),
         responses::sse(vec![
             responses::ev_response_created("resp-turn1-1"),
-            responses::ev_function_call(SPAWN_CALL_ID, "spawn_agent", &spawn_args),
+            responses::ev_function_call_with_namespace(
+                SPAWN_CALL_ID,
+                "multi_agent_v1",
+                "spawn_agent",
+                &spawn_args,
+            ),
             responses::ev_completed("resp-turn1-1"),
         ]),
     )
diff --git a/codex-rs/app-server/tests/suite/v2/turn_start_zsh_fork.rs b/codex-rs/app-server/tests/suite/v2/turn_start_zsh_fork.rs
index 31247418e5..6fe93e36af 100644
--- a/codex-rs/app-server/tests/suite/v2/turn_start_zsh_fork.rs
+++ b/codex-rs/app-server/tests/suite/v2/turn_start_zsh_fork.rs
@@ -537,8 +537,8 @@ async fn turn_start_shell_zsh_fork_subcommand_decline_marks_parent_declined_v2()
             sandbox_policy: Some(codex_app_server_protocol::SandboxPolicy::WorkspaceWrite {
                 writable_roots: vec![workspace.clone().try_into()?],
                 network_access: false,
-                exclude_tmpdir_env_var: false,
-                exclude_slash_tmp: false,
+                exclude_tmpdir_env_var: true,
+                exclude_slash_tmp: true,
             }),
             model: Some("mock-model".to_string()),
             effort: Some(codex_protocol::openai_models::ReasoningEffort::Medium),
diff --git a/codex-rs/chatgpt/src/chatgpt_client.rs b/codex-rs/chatgpt/src/chatgpt_client.rs
index 05d8186686..372f62e696 100644
--- a/codex-rs/chatgpt/src/chatgpt_client.rs
+++ b/codex-rs/chatgpt/src/chatgpt_client.rs
@@ -6,6 +6,9 @@ use anyhow::Context;
 use serde::de::DeserializeOwned;
 use std::time::Duration;
 
+const OAI_PRODUCT_SKU_HEADER: &str = "OAI-Product-Sku";
+const CODEX_PRODUCT_SKU: &str = "codex";
+
 /// Make a GET request to the ChatGPT backend API.
 pub(crate) async fn chatgpt_get_request<T: DeserializeOwned>(
     config: &Config,
@@ -46,6 +49,7 @@ pub(crate) async fn chatgpt_get_request_with_timeout<T: DeserializeOwned>(
     let mut request = client
         .get(&url)
         .headers(codex_model_provider::auth_provider_from_auth(&auth).to_auth_headers())
+        .header(OAI_PRODUCT_SKU_HEADER, CODEX_PRODUCT_SKU)
         .header("Content-Type", "application/json");
 
     if let Some(timeout) = timeout {
diff --git a/codex-rs/cli/Cargo.toml b/codex-rs/cli/Cargo.toml
index 120d2e497a..627d5d16d1 100644
--- a/codex-rs/cli/Cargo.toml
+++ b/codex-rs/cli/Cargo.toml
@@ -26,6 +26,7 @@ codex-app-server-daemon = { workspace = true }
 codex-app-server-protocol = { workspace = true }
 codex-app-server-test-client = { workspace = true }
 codex-arg0 = { workspace = true }
+codex-api = { workspace = true }
 codex-chatgpt = { workspace = true }
 codex-cloud-tasks = { path = "../cloud-tasks" }
 codex-utils-cli = { workspace = true }
@@ -36,11 +37,14 @@ codex-exec = { workspace = true }
 codex-exec-server = { workspace = true }
 codex-execpolicy = { workspace = true }
 codex-features = { workspace = true }
+codex-install-context = { workspace = true }
 codex-login = { workspace = true }
 codex-memories-write = { workspace = true }
 codex-mcp = { workspace = true }
 codex-mcp-server = { workspace = true }
+codex-model-provider = { workspace = true }
 codex-models-manager = { workspace = true }
+codex-plugin = { workspace = true }
 codex-protocol = { workspace = true }
 codex-responses-api-proxy = { workspace = true }
 codex-rmcp-client = { workspace = true }
@@ -52,18 +56,23 @@ codex-terminal-detection = { workspace = true }
 codex-tui = { workspace = true }
 codex-utils-absolute-path = { workspace = true }
 codex-utils-path = { workspace = true }
+crossterm = { workspace = true }
+http = { workspace = true }
 libc = { workspace = true }
 owo-colors = { workspace = true }
 regex-lite = { workspace = true }
+serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
 supports-color = { workspace = true }
 tempfile = { workspace = true }
 tokio = { workspace = true, features = [
     "io-std",
     "macros",
+    "net",
     "process",
     "rt-multi-thread",
     "signal",
+    "time",
 ] }
 toml = { workspace = true }
 tracing = { workspace = true }
diff --git a/codex-rs/cli/src/debug_sandbox.rs b/codex-rs/cli/src/debug_sandbox.rs
index 2722f69849..bc9d6172f2 100644
--- a/codex-rs/cli/src/debug_sandbox.rs
+++ b/codex-rs/cli/src/debug_sandbox.rs
@@ -190,6 +190,7 @@ async fn run_command_under_sandbox(
             .map_err(anyhow::Error::msg)?,
         codex_linux_sandbox_exe,
         config_options,
+        /*strict_config*/ false,
     )
     .await?;
 
@@ -229,7 +230,7 @@ async fn run_command_under_sandbox(
     let network_proxy = match config.permissions.network.as_ref() {
         Some(spec) => Some(
             spec.start_proxy(
-                config.permissions.permission_profile.get(),
+                config.permissions.permission_profile(),
                 /*policy_decider*/ None,
                 /*blocked_request_observer*/ None,
                 managed_network_requirements_enabled,
@@ -284,7 +285,7 @@ async fn run_command_under_sandbox(
             let args = create_linux_sandbox_command_args_for_permission_profile(
                 command,
                 cwd.as_path(),
-                &config.permissions.permission_profile(),
+                &config.permissions.effective_permission_profile(),
                 sandbox_policy_cwd.as_path(),
                 use_legacy_landlock,
                 allow_network_for_proxy(managed_network_requirements_enabled),
@@ -636,12 +637,14 @@ async fn load_debug_sandbox_config(
     cli_overrides: Vec<(String, TomlValue)>,
     codex_linux_sandbox_exe: Option<PathBuf>,
     options: DebugSandboxConfigOptions,
+    strict_config: bool,
 ) -> anyhow::Result<Config> {
     load_debug_sandbox_config_with_codex_home(
         cli_overrides,
         codex_linux_sandbox_exe,
         options,
         /*codex_home*/ None,
+        strict_config,
     )
     .await
 }
@@ -651,6 +654,7 @@ async fn load_debug_sandbox_config_with_codex_home(
     codex_linux_sandbox_exe: Option<PathBuf>,
     options: DebugSandboxConfigOptions,
     codex_home: Option<PathBuf>,
+    strict_config: bool,
 ) -> anyhow::Result<Config> {
     let DebugSandboxConfigOptions {
         permissions_profile,
@@ -680,6 +684,7 @@ async fn load_debug_sandbox_config_with_codex_home(
         },
         codex_home.clone(),
         managed_requirements_mode,
+        strict_config,
     )
     .await?;
 
@@ -697,6 +702,7 @@ async fn load_debug_sandbox_config_with_codex_home(
         },
         codex_home,
         managed_requirements_mode,
+        strict_config,
     )
     .await
     .map_err(Into::into)
@@ -707,14 +713,16 @@ async fn build_debug_sandbox_config(
     harness_overrides: ConfigOverrides,
     codex_home: Option<PathBuf>,
     managed_requirements_mode: ManagedRequirementsMode,
+    strict_config: bool,
 ) -> std::io::Result<Config> {
     let mut builder = ConfigBuilder::default()
         .cli_overrides(cli_overrides)
-        .harness_overrides(harness_overrides);
-    if let ManagedRequirementsMode::Ignore = managed_requirements_mode {
+        .harness_overrides(harness_overrides)
+        .strict_config(strict_config);
+    if matches!(managed_requirements_mode, ManagedRequirementsMode::Ignore) {
         builder = builder.loader_overrides(LoaderOverrides {
             ignore_managed_requirements: true,
-            ..Default::default()
+            ..LoaderOverrides::default()
         });
     }
     if let Some(codex_home) = codex_home {
@@ -783,6 +791,7 @@ mod tests {
             ConfigOverrides::default(),
             Some(codex_home_path.clone()),
             ManagedRequirementsMode::Include,
+            /*strict_config*/ false,
         )
         .await?;
         let legacy_config = build_debug_sandbox_config(
@@ -793,6 +802,7 @@ mod tests {
             },
             Some(codex_home_path.clone()),
             ManagedRequirementsMode::Include,
+            /*strict_config*/ false,
         )
         .await?;
 
@@ -805,6 +815,7 @@ mod tests {
                 managed_requirements_mode: ManagedRequirementsMode::Include,
             },
             Some(codex_home_path),
+            /*strict_config*/ false,
         )
         .await?;
 
@@ -840,6 +851,7 @@ mod tests {
             ConfigOverrides::default(),
             Some(codex_home_path.clone()),
             ManagedRequirementsMode::Include,
+            /*strict_config*/ false,
         )
         .await?;
         let read_only_config = build_debug_sandbox_config(
@@ -850,6 +862,7 @@ mod tests {
             },
             Some(codex_home_path.clone()),
             ManagedRequirementsMode::Include,
+            /*strict_config*/ false,
         )
         .await?;
 
@@ -862,6 +875,7 @@ mod tests {
                 managed_requirements_mode: ManagedRequirementsMode::Include,
             },
             Some(codex_home_path),
+            /*strict_config*/ false,
         )
         .await?;
 
@@ -905,6 +919,7 @@ mod tests {
             },
             Some(codex_home_path.clone()),
             ManagedRequirementsMode::Include,
+            /*strict_config*/ false,
         )
         .await?;
 
@@ -917,6 +932,7 @@ mod tests {
                 managed_requirements_mode: ManagedRequirementsMode::Include,
             },
             Some(codex_home_path),
+            /*strict_config*/ false,
         )
         .await?;
 
@@ -942,13 +958,22 @@ mod tests {
                 managed_requirements_mode: ManagedRequirementsMode::Ignore,
             },
             Some(codex_home.path().to_path_buf()),
+            /*strict_config*/ false,
         )
         .await?;
 
-        assert_eq!(
-            config.permissions.file_system_sandbox_policy(),
-            codex_protocol::models::PermissionProfile::workspace_write()
-                .file_system_sandbox_policy()
+        let actual = config
+            .permissions
+            .permission_profile()
+            .file_system_sandbox_policy();
+        let expected = codex_protocol::models::PermissionProfile::workspace_write()
+            .file_system_sandbox_policy();
+        assert!(
+            expected
+                .entries
+                .iter()
+                .all(|entry| actual.entries.contains(entry)),
+            "explicit workspace profile should preserve the built-in workspace rules"
         );
 
         Ok(())
@@ -975,13 +1000,22 @@ mod tests {
                 managed_requirements_mode: ManagedRequirementsMode::Ignore,
             },
             Some(codex_home.path().to_path_buf()),
+            /*strict_config*/ false,
         )
         .await?;
 
-        assert_eq!(
-            config.permissions.file_system_sandbox_policy(),
-            codex_protocol::models::PermissionProfile::workspace_write()
-                .file_system_sandbox_policy()
+        let actual = config
+            .permissions
+            .permission_profile()
+            .file_system_sandbox_policy();
+        let expected = codex_protocol::models::PermissionProfile::workspace_write()
+            .file_system_sandbox_policy();
+        assert!(
+            expected
+                .entries
+                .iter()
+                .all(|entry| actual.entries.contains(entry)),
+            "explicit workspace profile should preserve the built-in workspace rules"
         );
 
         Ok(())
@@ -1004,6 +1038,7 @@ mod tests {
                 managed_requirements_mode: ManagedRequirementsMode::Ignore,
             },
             Some(codex_home.path().to_path_buf()),
+            /*strict_config*/ false,
         )
         .await?;
 
@@ -1015,6 +1050,7 @@ mod tests {
             ConfigOverrides::default(),
             Some(codex_home.path().to_path_buf()),
             ManagedRequirementsMode::Include,
+            /*strict_config*/ false,
         )
         .await?;
 
@@ -1040,6 +1076,7 @@ mod tests {
                 managed_requirements_mode: ManagedRequirementsMode::Ignore,
             },
             Some(codex_home.path().to_path_buf()),
+            /*strict_config*/ false,
         )
         .await?;
 
diff --git a/codex-rs/cli/src/doctor.rs b/codex-rs/cli/src/doctor.rs
new file mode 100644
index 0000000000..aec57c1e82
--- /dev/null
+++ b/codex-rs/cli/src/doctor.rs
@@ -0,0 +1,3846 @@
+//! Implements the `codex doctor` diagnostic report.
+//!
+//! Doctor is intentionally read-mostly: checks inspect the current installation,
+//! configuration, authentication, terminal, state paths, and bounded reachability
+//! probes without attempting repair or starting long-lived services. Each check
+//! returns a redacted, serializable row so the same data can back the human
+//! summary and `--json` support report.
+//!
+//! A failing check should describe the problem and remediation, but it should not
+//! mutate user state. That keeps the command safe to run before filing a support
+//! issue or while diagnosing a broken local installation.
+
+use std::collections::BTreeMap;
+use std::collections::BTreeSet;
+use std::collections::HashMap;
+use std::env;
+use std::ffi::OsStr;
+use std::future::Future;
+use std::io::IsTerminal;
+use std::io::Read;
+use std::net::IpAddr;
+use std::path::Path;
+use std::path::PathBuf;
+use std::process::Command;
+use std::sync::Arc;
+use std::time::Duration;
+use std::time::Instant;
+
+use anyhow::Context;
+use clap::Parser;
+use codex_api::ApiError;
+use codex_api::ResponsesWebsocketClient;
+use codex_api::is_azure_responses_provider;
+use codex_arg0::Arg0DispatchPaths;
+use codex_config::types::McpServerConfig;
+use codex_config::types::McpServerTransportConfig;
+use codex_core::config::Config;
+use codex_core::config::ConfigBuilder;
+use codex_core::config::ConfigOverrides;
+use codex_core::config::find_codex_home;
+use codex_features::FEATURES;
+use codex_install_context::InstallContext;
+use codex_install_context::StandalonePlatform;
+use codex_login::AuthDotJson;
+use codex_login::AuthManager;
+use codex_login::CODEX_ACCESS_TOKEN_ENV_VAR;
+use codex_login::CODEX_API_KEY_ENV_VAR;
+use codex_login::CodexAuth;
+use codex_login::OPENAI_API_KEY_ENV_VAR;
+use codex_login::default_client::build_reqwest_client;
+use codex_login::default_client::default_headers;
+use codex_login::load_auth_dot_json;
+use codex_model_provider::create_model_provider;
+use codex_protocol::protocol::AskForApproval;
+use codex_terminal_detection::Multiplexer;
+use codex_terminal_detection::TerminalInfo;
+use codex_terminal_detection::TerminalName;
+use codex_terminal_detection::terminal_info;
+use codex_tui::Cli as TuiCli;
+use codex_utils_cli::CliConfigOverrides;
+use http::HeaderMap;
+use http::HeaderValue;
+use serde::Serialize;
+use supports_color::Stream;
+
+mod background;
+mod output;
+mod progress;
+mod runtime;
+mod updates;
+
+use background::background_server_check;
+use output::HumanOutputOptions;
+use output::redact_detail;
+use output::render_human_report;
+use progress::DoctorProgress;
+use progress::doctor_progress;
+use runtime::runtime_check;
+use runtime::search_check;
+use updates::updates_check;
+
+const OPENAI_BETA_HEADER: &str = "OpenAI-Beta";
+const RESPONSES_WEBSOCKETS_V2_BETA_HEADER_VALUE: &str = "responses_websockets=2026-02-06";
+const WEBSOCKET_IMMEDIATE_CLOSE_GRACE: Duration = Duration::from_millis(250);
+const SLOW_CHECK_PROGRESS_THRESHOLD: Duration = Duration::from_secs(2);
+const SLOW_CHECK_PROGRESS_INTERVAL: Duration = Duration::from_secs(1);
+const PROXY_ENV_VARS: &[&str] = &[
+    "HTTP_PROXY",
+    "HTTPS_PROXY",
+    "ALL_PROXY",
+    "NO_PROXY",
+    "http_proxy",
+    "https_proxy",
+    "all_proxy",
+    "no_proxy",
+];
+const COLOR_ENV_VARS: &[&str] = &[
+    "COLORTERM",
+    "NO_COLOR",
+    "CLICOLOR",
+    "CLICOLOR_FORCE",
+    "FORCE_COLOR",
+    "COLORFGBG",
+];
+const TERMINAL_DIMENSION_ENV_VARS: &[&str] = &["COLUMNS", "LINES"];
+const TERMINFO_ENV_VARS: &[&str] = &["TERMINFO", "TERMINFO_DIRS"];
+const LOCALE_ENV_VARS: &[&str] = &["LC_ALL", "LC_CTYPE", "LANG"];
+#[cfg(windows)]
+const NPM_COMMAND: &str = "npm.cmd";
+#[cfg(not(windows))]
+const NPM_COMMAND: &str = "npm";
+const REMOTE_TERMINAL_ENV_VARS: &[&str] = &[
+    "SSH_TTY",
+    "SSH_CONNECTION",
+    "SSH_CLIENT",
+    "MOSH_IP",
+    "WSL_DISTRO_NAME",
+    "WSL_INTEROP",
+    "VSCODE_INJECTION",
+    "VSCODE_IPC_HOOK_CLI",
+    "WAYLAND_DISPLAY",
+    "DISPLAY",
+    "WT_SESSION",
+];
+const TMUX_OPTION_NAMES: &[&str] = &[
+    "extended-keys",
+    "xterm-keys",
+    "allow-passthrough",
+    "set-clipboard",
+    "focus-events",
+];
+const NARROW_TERMINAL_COLUMNS: u16 = 80;
+const NARROW_TERMINAL_ROWS: u16 = 24;
+
+/// Options for building a local Codex diagnostic report.
+///
+/// The command always runs the full bounded diagnostic set. Human output includes
+/// detailed diagnostics by default; --summary keeps the terminal output compact.
+#[derive(Debug, Parser)]
+pub struct DoctorCommand {
+    /// Emit a redacted machine-readable report.
+    #[arg(long, default_value_t = false)]
+    json: bool,
+
+    /// Only show grouped check rows and the final count summary.
+    #[arg(long, default_value_t = false)]
+    summary: bool,
+
+    /// Expand long lists in detailed human output.
+    #[arg(long, default_value_t = false)]
+    all: bool,
+
+    /// Disable ANSI color in human output.
+    #[arg(long, default_value_t = false)]
+    no_color: bool,
+
+    /// Use ASCII status labels and separators in human output.
+    #[arg(long, default_value_t = false)]
+    ascii: bool,
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq, Ord, PartialOrd, Serialize)]
+#[serde(rename_all = "snake_case")]
+enum CheckStatus {
+    Ok,
+    Warning,
+    Fail,
+}
+
+/// Machine-readable doctor output shared by human and JSON renderers.
+///
+/// The schema is intentionally flat: each check carries its own category,
+/// status, details, remediation, and duration so support tooling can filter or
+/// redact individual rows without understanding the renderer's section layout.
+#[derive(Clone, Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+struct DoctorReport {
+    schema_version: u32,
+    generated_at: String,
+    overall_status: CheckStatus,
+    codex_version: String,
+    checks: Vec<DoctorCheck>,
+}
+
+/// One diagnostic result in the doctor report.
+///
+/// Summaries are safe for compact human output. Details may include local paths
+/// or command output and are redacted before rendering or JSON serialization.
+#[derive(Clone, Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+struct DoctorCheck {
+    id: String,
+    category: String,
+    status: CheckStatus,
+    summary: String,
+    details: Vec<String>,
+    issues: Vec<DoctorIssue>,
+    remediation: Option<String>,
+    duration_ms: u64,
+}
+
+/// Structured cause/remedy metadata for a non-ok doctor check.
+///
+/// Human output uses issues to make warnings and failures self-explanatory:
+/// the row headline says what is wrong, matching detail rows show measured vs.
+/// expected values, and remedies are printed as explicit next actions.
+#[derive(Clone, Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+struct DoctorIssue {
+    severity: CheckStatus,
+    cause: String,
+    measured: Option<String>,
+    expected: Option<String>,
+    remedy: Option<String>,
+    fields: Vec<String>,
+}
+
+impl DoctorIssue {
+    fn new(severity: CheckStatus, cause: impl Into<String>) -> Self {
+        Self {
+            severity,
+            cause: cause.into(),
+            measured: None,
+            expected: None,
+            remedy: None,
+            fields: Vec::new(),
+        }
+    }
+
+    fn measured(mut self, measured: impl Into<String>) -> Self {
+        self.measured = Some(measured.into());
+        self
+    }
+
+    fn expected(mut self, expected: impl Into<String>) -> Self {
+        self.expected = Some(expected.into());
+        self
+    }
+
+    fn remedy(mut self, remedy: impl Into<String>) -> Self {
+        self.remedy = Some(remedy.into());
+        self
+    }
+
+    fn field(mut self, field: impl Into<String>) -> Self {
+        self.fields.push(field.into());
+        self
+    }
+}
+
+impl DoctorCheck {
+    fn new(
+        id: impl Into<String>,
+        category: impl Into<String>,
+        status: CheckStatus,
+        summary: impl Into<String>,
+    ) -> Self {
+        Self {
+            id: id.into(),
+            category: category.into(),
+            status,
+            summary: summary.into(),
+            details: Vec::new(),
+            issues: Vec::new(),
+            remediation: None,
+            duration_ms: 0,
+        }
+    }
+
+    fn detail(mut self, detail: impl Into<String>) -> Self {
+        self.details.push(detail.into());
+        self
+    }
+
+    fn details(mut self, details: Vec<String>) -> Self {
+        self.details.extend(details);
+        self
+    }
+
+    fn remediation(mut self, remediation: impl Into<String>) -> Self {
+        self.remediation = Some(remediation.into());
+        self
+    }
+
+    fn issue(mut self, issue: DoctorIssue) -> Self {
+        self.issues.push(issue);
+        self
+    }
+}
+
+/// Builds, renders, and exits according to the current doctor report.
+///
+/// This is the CLI entry point for codex doctor. It does not repair issues;
+/// failures are represented in the report and cause a non-zero process exit so
+/// scripts can distinguish a clean environment from one that needs attention.
+pub async fn run_doctor(
+    command: DoctorCommand,
+    root_config_overrides: CliConfigOverrides,
+    interactive: &TuiCli,
+    arg0_paths: &Arg0DispatchPaths,
+) -> anyhow::Result<()> {
+    let report = build_report(&command, root_config_overrides, interactive, arg0_paths).await;
+
+    if command.json {
+        println!(
+            "{}",
+            serde_json::to_string_pretty(&redacted_json_report(&report))?
+        );
+    } else {
+        print!(
+            "{}",
+            render_human_report(&report, human_output_options(&command))
+        );
+    }
+
+    if report.overall_status == CheckStatus::Fail {
+        std::process::exit(1);
+    }
+
+    Ok(())
+}
+
+async fn build_report(
+    command: &DoctorCommand,
+    root_config_overrides: CliConfigOverrides,
+    interactive: &TuiCli,
+    arg0_paths: &Arg0DispatchPaths,
+) -> DoctorReport {
+    let progress = doctor_progress(command.json);
+    let mut checks = Vec::new();
+    checks.push(run_sync_check("installation", progress.clone(), || {
+        installation_check(!command.summary)
+    }));
+    checks.push(run_sync_check("runtime", progress.clone(), runtime_check));
+    checks.push(run_sync_check("search", progress.clone(), search_check));
+
+    progress.begin("config");
+    let config_result = load_config(root_config_overrides, interactive, arg0_paths).await;
+    match &config_result {
+        Ok(config) => {
+            let auth_manager =
+                AuthManager::shared_from_config(config, /*enable_codex_api_key_env*/ true).await;
+            let reachability_plan = provider_reachability_plan(config);
+            let (
+                config_check,
+                auth_check,
+                updates_check,
+                network_check,
+                websocket_check,
+                mcp_check,
+                sandbox_check,
+                terminal_check,
+                state_check,
+                background_server_check,
+                reachability_check,
+            ) = tokio::join!(
+                async { run_sync_check("config", progress.clone(), || config_check(config)) },
+                async { run_sync_check("auth", progress.clone(), || auth_check(config)) },
+                async { run_sync_check("updates", progress.clone(), || updates_check(config)) },
+                async { run_sync_check("network", progress.clone(), network_check) },
+                run_async_check(
+                    "websocket",
+                    progress.clone(),
+                    websocket_reachability_check(config, Some(auth_manager)),
+                ),
+                run_async_check("MCP", progress.clone(), mcp_check(config)),
+                async {
+                    run_sync_check("sandbox", progress.clone(), || {
+                        sandbox_check(config, arg0_paths)
+                    })
+                },
+                async {
+                    run_sync_check("terminal", progress.clone(), || {
+                        terminal_check(command.no_color)
+                    })
+                },
+                run_async_check("state", progress.clone(), state_check(config)),
+                async {
+                    run_sync_check("app-server", progress.clone(), || {
+                        background_server_check(config)
+                    })
+                },
+                run_async_check(
+                    "provider reachability",
+                    progress.clone(),
+                    provider_reachability_check(reachability_plan),
+                ),
+            );
+            checks.extend([
+                config_check,
+                auth_check,
+                updates_check,
+                network_check,
+                websocket_check,
+                mcp_check,
+                sandbox_check,
+                terminal_check,
+                state_check,
+                background_server_check,
+                reachability_check,
+            ]);
+        }
+        Err(err) => {
+            let reachability_plan = default_reachability_plan();
+            let (config_check, network_check, terminal_check, state_check, reachability_check) = tokio::join!(
+                async {
+                    run_sync_check("config", progress.clone(), || {
+                        DoctorCheck::new(
+                            "config.load",
+                            "config",
+                            CheckStatus::Fail,
+                            "config could not be loaded",
+                        )
+                        .detail(err.to_string())
+                        .remediation("Fix the reported config error, then rerun codex doctor.")
+                    })
+                },
+                async { run_sync_check("network", progress.clone(), network_check) },
+                async {
+                    run_sync_check("terminal", progress.clone(), || {
+                        terminal_check(command.no_color)
+                    })
+                },
+                async { run_sync_check("state", progress.clone(), fallback_state_check) },
+                run_async_check(
+                    "provider reachability",
+                    progress.clone(),
+                    provider_reachability_check(reachability_plan),
+                ),
+            );
+            checks.extend([
+                config_check,
+                network_check,
+                terminal_check,
+                state_check,
+                reachability_check,
+            ]);
+        }
+    }
+
+    progress.settle();
+
+    let overall_status = overall_status(&checks);
+    DoctorReport {
+        schema_version: 1,
+        generated_at: generated_at(),
+        overall_status,
+        codex_version: env!("CARGO_PKG_VERSION").to_string(),
+        checks,
+    }
+}
+
+async fn load_config(
+    root_config_overrides: CliConfigOverrides,
+    interactive: &TuiCli,
+    arg0_paths: &Arg0DispatchPaths,
+) -> anyhow::Result<Config> {
+    let mut cli_kv_overrides = root_config_overrides
+        .parse_overrides()
+        .map_err(anyhow::Error::msg)?;
+    if interactive.web_search {
+        cli_kv_overrides.push((
+            "web_search".to_string(),
+            toml::Value::String("live".to_string()),
+        ));
+    }
+
+    let overrides = ConfigOverrides {
+        ephemeral: Some(true),
+        ..config_overrides_from_interactive(interactive, arg0_paths)
+    };
+
+    ConfigBuilder::default()
+        .cli_overrides(cli_kv_overrides)
+        .harness_overrides(overrides)
+        .build()
+        .await
+        .context("failed to load Codex config")
+}
+
+fn config_overrides_from_interactive(
+    interactive: &TuiCli,
+    arg0_paths: &Arg0DispatchPaths,
+) -> ConfigOverrides {
+    let approval_policy = if interactive.dangerously_bypass_approvals_and_sandbox {
+        Some(AskForApproval::Never)
+    } else {
+        interactive.approval_policy.map(Into::into)
+    };
+    let sandbox_mode = if interactive.dangerously_bypass_approvals_and_sandbox {
+        Some(codex_protocol::config_types::SandboxMode::DangerFullAccess)
+    } else {
+        interactive.sandbox_mode.map(Into::into)
+    };
+    ConfigOverrides {
+        model: interactive.model.clone(),
+        config_profile: interactive.config_profile.clone(),
+        approval_policy,
+        sandbox_mode,
+        cwd: interactive.cwd.clone(),
+        model_provider: interactive
+            .oss
+            .then(|| interactive.oss_provider.clone())
+            .flatten(),
+        codex_self_exe: arg0_paths.codex_self_exe.clone(),
+        codex_linux_sandbox_exe: arg0_paths.codex_linux_sandbox_exe.clone(),
+        main_execve_wrapper_exe: arg0_paths.main_execve_wrapper_exe.clone(),
+        show_raw_agent_reasoning: interactive.oss.then_some(true),
+        additional_writable_roots: interactive.add_dir.clone(),
+        ..Default::default()
+    }
+}
+
+/// JSON support report emitted by `codex doctor --json`.
+///
+/// The report is keyed by check id so support tooling can fetch paths like
+/// `checks["terminal.metadata"]` without scanning arrays. Human rendering can
+/// reorder or group rows independently, but this JSON shape should stay stable
+/// across cosmetic output changes.
+#[derive(Clone, Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+struct JsonDoctorReport {
+    schema_version: u32,
+    generated_at: String,
+    overall_status: CheckStatus,
+    codex_version: String,
+    checks: BTreeMap<String, JsonDoctorCheck>,
+}
+
+/// One redacted check in the JSON support report.
+#[derive(Clone, Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+struct JsonDoctorCheck {
+    id: String,
+    category: String,
+    status: CheckStatus,
+    summary: String,
+    details: BTreeMap<String, JsonDetailValue>,
+    #[serde(skip_serializing_if = "Vec::is_empty")]
+    issues: Vec<JsonDoctorIssue>,
+    #[serde(skip_serializing_if = "Vec::is_empty")]
+    notes: Vec<String>,
+    remediation: Option<String>,
+    duration_ms: u64,
+}
+
+/// One redacted issue in the JSON support report.
+#[derive(Clone, Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+struct JsonDoctorIssue {
+    severity: CheckStatus,
+    cause: String,
+    measured: Option<String>,
+    expected: Option<String>,
+    remedy: Option<String>,
+    fields: Vec<String>,
+}
+
+/// JSON detail value that preserves repeated detail keys without inventing names.
+#[derive(Clone, Debug, Serialize)]
+#[serde(untagged)]
+enum JsonDetailValue {
+    One(String),
+    Many(Vec<String>),
+}
+
+impl JsonDetailValue {
+    fn push(&mut self, value: String) {
+        match self {
+            JsonDetailValue::One(previous) => {
+                *self = JsonDetailValue::Many(vec![std::mem::take(previous), value]);
+            }
+            JsonDetailValue::Many(values) => values.push(value),
+        }
+    }
+}
+
+fn redacted_json_report(report: &DoctorReport) -> JsonDoctorReport {
+    let checks = report
+        .checks
+        .iter()
+        .map(|check| {
+            let json_check = redacted_json_check(check);
+            (check.id.clone(), json_check)
+        })
+        .collect();
+    JsonDoctorReport {
+        schema_version: report.schema_version,
+        generated_at: report.generated_at.clone(),
+        overall_status: report.overall_status,
+        codex_version: report.codex_version.clone(),
+        checks,
+    }
+}
+
+fn redacted_json_check(check: &DoctorCheck) -> JsonDoctorCheck {
+    let (details, notes) = structured_json_details(&check.details);
+    JsonDoctorCheck {
+        id: check.id.clone(),
+        category: check.category.clone(),
+        status: check.status,
+        summary: check.summary.clone(),
+        details,
+        issues: check.issues.iter().map(redacted_json_issue).collect(),
+        notes,
+        remediation: check.remediation.as_deref().map(redact_detail),
+        duration_ms: check.duration_ms,
+    }
+}
+
+fn redacted_json_issue(issue: &DoctorIssue) -> JsonDoctorIssue {
+    JsonDoctorIssue {
+        severity: issue.severity,
+        cause: redact_detail(&issue.cause),
+        measured: issue.measured.as_deref().map(redact_detail),
+        expected: issue.expected.as_deref().map(redact_detail),
+        remedy: issue.remedy.as_deref().map(redact_detail),
+        fields: issue
+            .fields
+            .iter()
+            .map(|field| redact_detail(field))
+            .collect(),
+    }
+}
+
+/// Converts redacted `label: value` detail strings into JSON key/value fields.
+///
+/// Detail strings that do not follow the doctor detail convention are preserved
+/// as notes instead of being dropped. Repeated labels become arrays so callers
+/// can still retrieve the common scalar case directly while keeping all values.
+fn structured_json_details(details: &[String]) -> (BTreeMap<String, JsonDetailValue>, Vec<String>) {
+    let mut structured: BTreeMap<String, JsonDetailValue> = BTreeMap::new();
+    let mut notes = Vec::new();
+    for detail in details {
+        let redacted = redact_detail(detail);
+        let Some((key, value)) = redacted.split_once(": ") else {
+            notes.push(redacted);
+            continue;
+        };
+        let key = key.trim();
+        if key.is_empty() {
+            notes.push(redacted);
+            continue;
+        }
+        let value = value.to_string();
+        match structured.get_mut(key) {
+            Some(existing) => existing.push(value),
+            None => {
+                structured.insert(key.to_string(), JsonDetailValue::One(value));
+            }
+        }
+    }
+    (structured, notes)
+}
+
+fn run_sync_check(
+    label: &'static str,
+    progress: Arc<dyn DoctorProgress>,
+    f: impl FnOnce() -> DoctorCheck,
+) -> DoctorCheck {
+    progress.begin(label);
+    let start = Instant::now();
+    let mut check = f();
+    check.duration_ms = start.elapsed().as_millis().try_into().unwrap_or(u64::MAX);
+    progress.finish(label, check.status);
+    check
+}
+
+async fn run_async_check<Fut>(
+    label: &'static str,
+    progress: Arc<dyn DoctorProgress>,
+    future: Fut,
+) -> DoctorCheck
+where
+    Fut: Future<Output = DoctorCheck>,
+{
+    progress.begin(label);
+    let start = Instant::now();
+    tokio::pin!(future);
+    let mut progress_interval = tokio::time::interval(SLOW_CHECK_PROGRESS_INTERVAL);
+    loop {
+        tokio::select! {
+            mut check = &mut future => {
+                check.duration_ms = start.elapsed().as_millis().try_into().unwrap_or(u64::MAX);
+                progress.finish(label, check.status);
+                return check;
+            }
+            _ = progress_interval.tick() => {
+                let elapsed = start.elapsed();
+                if elapsed >= SLOW_CHECK_PROGRESS_THRESHOLD {
+                    progress.heartbeat(label, elapsed);
+                }
+            }
+        }
+    }
+}
+
+fn overall_status(checks: &[DoctorCheck]) -> CheckStatus {
+    if checks.iter().any(|check| check.status == CheckStatus::Fail) {
+        CheckStatus::Fail
+    } else if checks
+        .iter()
+        .any(|check| check.status == CheckStatus::Warning)
+    {
+        CheckStatus::Warning
+    } else {
+        CheckStatus::Ok
+    }
+}
+
+fn generated_at() -> String {
+    match std::time::SystemTime::now().duration_since(std::time::UNIX_EPOCH) {
+        Ok(duration) => {
+            let seconds = duration.as_secs();
+            format!("{seconds}s since unix epoch")
+        }
+        Err(_) => "unknown".to_string(),
+    }
+}
+
+fn installation_check(show_details: bool) -> DoctorCheck {
+    let mut details = Vec::new();
+    let current_exe = env::current_exe().ok();
+    push_path_detail(&mut details, "current executable", current_exe.as_deref());
+    let inherited_managed_env = inherited_managed_env_for_cargo_binary(current_exe.as_deref());
+    let install_context = doctor_install_context(current_exe.as_deref());
+    details.push(format!(
+        "install context: {}",
+        describe_install_context(&install_context)
+    ));
+    if inherited_managed_env {
+        details.push(
+            "ignored inherited package-manager launch env for cargo-built binary".to_string(),
+        );
+    }
+    details.push(format!(
+        "managed by npm: {}",
+        doctor_managed_by_npm(current_exe.as_deref())
+    ));
+    details.push(format!(
+        "managed by bun: {}",
+        env::var_os("CODEX_MANAGED_BY_BUN").is_some()
+    ));
+    push_env_path_detail(
+        &mut details,
+        "managed package root",
+        "CODEX_MANAGED_PACKAGE_ROOT",
+    );
+
+    let path_entries = codex_path_entries();
+    let mut status = CheckStatus::Ok;
+    let mut summary = "installation looks consistent".to_string();
+    let mut remediation = None;
+
+    if path_entries.len() > 1 {
+        details.push(format!("PATH codex entries: {}", path_entries.len()));
+    }
+    if show_details || path_entries.len() > 1 {
+        details.extend(
+            path_entries
+                .iter()
+                .enumerate()
+                .map(|(index, path)| format!("PATH codex #{}: {path}", index + 1)),
+        );
+    }
+
+    if doctor_managed_by_npm(current_exe.as_deref()) {
+        match npm_global_root_check() {
+            NpmRootCheck::Match { package_root } => {
+                details.push(format!("npm update target: {}", package_root.display()));
+            }
+            NpmRootCheck::Mismatch {
+                running_package_root,
+                npm_package_root,
+            } => {
+                status = CheckStatus::Fail;
+                summary =
+                    "npm install -g @openai/codex would update a different install".to_string();
+                remediation = Some(format!(
+                    "Fix PATH or npm prefix so the running package root ({}) matches the npm global package root ({}).",
+                    running_package_root.display(),
+                    npm_package_root.display()
+                ));
+                details.push(format!(
+                    "running package root: {}",
+                    running_package_root.display()
+                ));
+                details.push(format!("npm package root: {}", npm_package_root.display()));
+            }
+            NpmRootCheck::MissingPackageRoot => {
+                status = status.max(CheckStatus::Warning);
+                summary = "npm-managed launch is missing package-root provenance".to_string();
+                remediation = Some(
+                    "Reinstall or update Codex so the JS shim provides CODEX_MANAGED_PACKAGE_ROOT."
+                        .to_string(),
+                );
+            }
+            NpmRootCheck::NpmUnavailable(error) => {
+                status = status.max(CheckStatus::Warning);
+                summary = "npm-managed launch could not inspect npm global root".to_string();
+                details.push(format!("npm root -g failed: {error}"));
+            }
+        }
+    }
+
+    let mut check = DoctorCheck::new("installation", "install", status, summary).details(details);
+    if let Some(remediation) = remediation {
+        check = check.remediation(remediation);
+    }
+    check
+}
+
+fn doctor_install_context(current_exe: Option<&Path>) -> InstallContext {
+    if inherited_managed_env_for_cargo_binary(current_exe) {
+        InstallContext::Other
+    } else {
+        InstallContext::current().clone()
+    }
+}
+
+fn doctor_managed_by_npm(current_exe: Option<&Path>) -> bool {
+    env::var_os("CODEX_MANAGED_BY_NPM").is_some()
+        && !inherited_managed_env_for_cargo_binary(current_exe)
+}
+
+fn inherited_managed_env_for_cargo_binary(current_exe: Option<&Path>) -> bool {
+    if env::var_os("CODEX_MANAGED_BY_NPM").is_none()
+        && env::var_os("CODEX_MANAGED_BY_BUN").is_none()
+    {
+        return false;
+    }
+
+    let Some(current_exe) = current_exe else {
+        return false;
+    };
+    let components = current_exe
+        .components()
+        .map(|component| component.as_os_str().to_string_lossy())
+        .collect::<Vec<_>>();
+    components
+        .windows(2)
+        .any(|window| window[0] == "target" && matches!(window[1].as_ref(), "debug" | "release"))
+}
+
+fn describe_install_context(context: &InstallContext) -> String {
+    match context {
+        InstallContext::Standalone {
+            release_dir,
+            resources_dir,
+            platform,
+        } => {
+            let platform = match platform {
+                StandalonePlatform::Unix => "unix",
+                StandalonePlatform::Windows => "windows",
+            };
+            let resources = resources_dir
+                .as_ref()
+                .map(|path| path.display().to_string())
+                .unwrap_or_else(|| "none".to_string());
+            format!(
+                "standalone ({platform}, release {}, resources {resources})",
+                release_dir.display()
+            )
+        }
+        InstallContext::Npm => "npm".to_string(),
+        InstallContext::Bun => "bun".to_string(),
+        InstallContext::Brew => "brew".to_string(),
+        InstallContext::Other => "other".to_string(),
+    }
+}
+
+#[derive(Debug, PartialEq, Eq)]
+enum NpmRootCheck {
+    Match {
+        package_root: PathBuf,
+    },
+    Mismatch {
+        running_package_root: PathBuf,
+        npm_package_root: PathBuf,
+    },
+    MissingPackageRoot,
+    NpmUnavailable(String),
+}
+
+fn npm_global_root_check() -> NpmRootCheck {
+    let Some(running_package_root) = env::var_os("CODEX_MANAGED_PACKAGE_ROOT").map(PathBuf::from)
+    else {
+        return NpmRootCheck::MissingPackageRoot;
+    };
+
+    let output = match run_command(NPM_COMMAND, ["root", "-g"]) {
+        Ok(output) => output,
+        Err(err) => return NpmRootCheck::NpmUnavailable(err),
+    };
+    let Some(npm_root) = output.lines().map(str::trim).find(|line| !line.is_empty()) else {
+        return NpmRootCheck::NpmUnavailable("empty output from npm root -g".to_string());
+    };
+
+    compare_npm_package_roots(&running_package_root, &PathBuf::from(npm_root))
+}
+
+fn compare_npm_package_roots(running_package_root: &Path, npm_root: &Path) -> NpmRootCheck {
+    let npm_package_root = npm_root.join("@openai").join("codex");
+    let running = normalize_path_for_compare(running_package_root);
+    let target = normalize_path_for_compare(&npm_package_root);
+    if running == target {
+        NpmRootCheck::Match {
+            package_root: npm_package_root,
+        }
+    } else {
+        NpmRootCheck::Mismatch {
+            running_package_root: running_package_root.to_path_buf(),
+            npm_package_root,
+        }
+    }
+}
+
+fn normalize_path_for_compare(path: &Path) -> String {
+    let canonical = path.canonicalize().unwrap_or_else(|_| path.to_path_buf());
+    let raw = canonical.to_string_lossy().replace('\\', "/");
+    if cfg!(windows) {
+        raw.to_ascii_lowercase()
+    } else {
+        raw
+    }
+}
+
+fn display_list<T: AsRef<str>>(items: &[T]) -> String {
+    if items.is_empty() {
+        "none".to_string()
+    } else {
+        items
+            .iter()
+            .map(AsRef::as_ref)
+            .collect::<Vec<_>>()
+            .join(", ")
+    }
+}
+
+fn codex_path_entries() -> Vec<String> {
+    #[cfg(windows)]
+    let result = run_command("where", ["codex"]);
+    #[cfg(not(windows))]
+    let result = run_command("which", ["-a", "codex"]);
+
+    result
+        .unwrap_or_default()
+        .lines()
+        .map(str::trim)
+        .filter(|line| !line.is_empty())
+        .map(str::to_string)
+        .collect()
+}
+
+fn run_command<I, S>(program: &str, args: I) -> Result<String, String>
+where
+    I: IntoIterator<Item = S>,
+    S: AsRef<OsStr>,
+{
+    let output = Command::new(program)
+        .args(args)
+        .output()
+        .map_err(|err| err.to_string())?;
+    if !output.status.success() {
+        let stderr = String::from_utf8_lossy(&output.stderr).trim().to_string();
+        if stderr.is_empty() {
+            return Err(format!("exited with status {}", output.status));
+        }
+        return Err(stderr);
+    }
+    Ok(String::from_utf8_lossy(&output.stdout).to_string())
+}
+
+fn config_check(config: &Config) -> DoctorCheck {
+    let mut details = Vec::new();
+    details.push(format!("CODEX_HOME: {}", config.codex_home.display()));
+    details.push(format!("cwd: {}", config.cwd.display()));
+    details.push(format!(
+        "model: {}",
+        config.model.as_deref().unwrap_or("<default>")
+    ));
+    details.push(format!("model provider: {}", config.model_provider_id));
+    details.push(format!("log dir: {}", config.log_dir.display()));
+    details.push(format!("sqlite home: {}", config.sqlite_home.display()));
+    details.push(format!("mcp servers: {}", config.mcp_servers.get().len()));
+    feature_flag_details(config, &mut details);
+    config_toml_details(config, &mut details);
+
+    let status = if config.startup_warnings.is_empty() {
+        CheckStatus::Ok
+    } else {
+        details.extend(
+            config
+                .startup_warnings
+                .iter()
+                .map(|warning| format!("startup warning: {warning}")),
+        );
+        CheckStatus::Warning
+    };
+
+    DoctorCheck::new("config.load", "config", status, "config loaded").details(details)
+}
+
+fn feature_flag_details(config: &Config, details: &mut Vec<String>) {
+    let features = config.features.get();
+    let enabled_features = FEATURES
+        .iter()
+        .filter(|spec| features.enabled(spec.id))
+        .map(|spec| spec.key)
+        .collect::<Vec<_>>();
+    let overrides = FEATURES
+        .iter()
+        .filter(|spec| features.enabled(spec.id) != spec.default_enabled)
+        .map(|spec| format!("{}={}", spec.key, features.enabled(spec.id)))
+        .collect::<Vec<_>>();
+    details.push(format!("feature flags enabled: {}", enabled_features.len()));
+    details.push(format!(
+        "enabled feature flags: {}",
+        display_list(&enabled_features)
+    ));
+    details.push(format!(
+        "feature flag overrides: {}",
+        display_list(&overrides)
+    ));
+    for usage in features.legacy_feature_usages() {
+        details.push(format!(
+            "legacy feature flag: {} -> {}",
+            usage.alias,
+            usage.feature.key()
+        ));
+    }
+}
+
+fn config_toml_details(config: &Config, details: &mut Vec<String>) {
+    let config_path = config.codex_home.join(codex_config::CONFIG_TOML_FILE);
+    details.push(format!("config.toml: {}", config_path.display()));
+    match std::fs::read_to_string(&config_path) {
+        Ok(contents) => match toml::from_str::<toml::Value>(&contents) {
+            Ok(_) => details.push("config.toml parse: ok".to_string()),
+            Err(err) => details.push(format!("config.toml parse: {err}")),
+        },
+        Err(err) if err.kind() == std::io::ErrorKind::NotFound => {
+            details.push("config.toml: missing".to_string());
+        }
+        Err(err) => details.push(format!("config.toml read: {err}")),
+    }
+}
+
+fn auth_check(config: &Config) -> DoctorCheck {
+    let mut details = Vec::new();
+    let auth_path = config.codex_home.join("auth.json");
+    details.push(format!(
+        "auth storage mode: {:?}",
+        config.cli_auth_credentials_store_mode
+    ));
+    details.push(format!("auth file: {}", auth_path.display()));
+
+    let env_auth_vars = [
+        OPENAI_API_KEY_ENV_VAR,
+        CODEX_API_KEY_ENV_VAR,
+        CODEX_ACCESS_TOKEN_ENV_VAR,
+    ]
+    .into_iter()
+    .filter(|name| env_var_present(name))
+    .collect::<Vec<_>>();
+    if !env_auth_vars.is_empty() {
+        details.push(format!(
+            "auth env vars present: {}",
+            env_auth_vars.join(", ")
+        ));
+    }
+    if let Some(check) = provider_specific_auth_check(
+        config.model_provider.requires_openai_auth,
+        config.model_provider.env_key.as_deref(),
+        config.model_provider.env_key_instructions.as_deref(),
+        details.clone(),
+        env_var_present,
+    ) {
+        return check;
+    }
+
+    match load_auth_dot_json(&config.codex_home, config.cli_auth_credentials_store_mode) {
+        Ok(Some(auth)) => {
+            details.push(format!("stored auth mode: {}", stored_auth_mode(&auth)));
+            details.push(format!("stored API key: {}", auth.openai_api_key.is_some()));
+            details.push(format!("stored ChatGPT tokens: {}", auth.tokens.is_some()));
+            details.push(format!(
+                "stored agent identity: {}",
+                auth.agent_identity.is_some()
+            ));
+            let auth_issues = stored_auth_issues(&auth, env_var_present);
+            details.extend(
+                auth_issues
+                    .iter()
+                    .map(|issue| format!("stored auth issue: {issue}")),
+            );
+            let status = if !auth_issues.is_empty() && env_auth_vars.is_empty() {
+                CheckStatus::Fail
+            } else if !auth_issues.is_empty() || env_auth_vars.len() > 1 {
+                CheckStatus::Warning
+            } else {
+                CheckStatus::Ok
+            };
+            let summary = match status {
+                CheckStatus::Ok => "auth is configured",
+                CheckStatus::Warning if !auth_issues.is_empty() => {
+                    "auth is provided by environment, but stored credentials are incomplete"
+                }
+                CheckStatus::Warning => {
+                    "auth is configured, but multiple auth env vars are present"
+                }
+                CheckStatus::Fail => "stored credentials are incomplete",
+            };
+            let mut check =
+                DoctorCheck::new("auth.credentials", "auth", status, summary).details(details);
+            if status == CheckStatus::Fail {
+                check =
+                    check.remediation("Run codex login again or provide a supported auth env var.");
+            }
+            check
+        }
+        Ok(None) if !env_auth_vars.is_empty() => DoctorCheck::new(
+            "auth.credentials",
+            "auth",
+            CheckStatus::Ok,
+            "auth is provided by environment",
+        )
+        .details(details),
+        Ok(None) => DoctorCheck::new(
+            "auth.credentials",
+            "auth",
+            CheckStatus::Fail,
+            "no Codex credentials were found",
+        )
+        .details(details)
+        .remediation("Run codex login or provide an API key through a supported auth env var."),
+        Err(err) => DoctorCheck::new(
+            "auth.credentials",
+            "auth",
+            CheckStatus::Fail,
+            "stored credentials could not be read",
+        )
+        .detail(err.to_string())
+        .remediation("Fix auth storage access or run codex login again."),
+    }
+}
+
+fn provider_specific_auth_check(
+    requires_openai_auth: bool,
+    provider_env_key: Option<&str>,
+    provider_env_key_instructions: Option<&str>,
+    mut details: Vec<String>,
+    env_var_present: impl Fn(&str) -> bool,
+) -> Option<DoctorCheck> {
+    details.push(format!(
+        "model provider requires OpenAI auth: {requires_openai_auth}"
+    ));
+    if requires_openai_auth {
+        return None;
+    }
+
+    match provider_env_key {
+        Some(env_key) if env_var_present(env_key) => {
+            details.push(format!("provider auth env var: {env_key} (present)"));
+            Some(
+                DoctorCheck::new(
+                    "auth.credentials",
+                    "auth",
+                    CheckStatus::Ok,
+                    "auth is provided by the active model provider",
+                )
+                .details(details),
+            )
+        }
+        Some(env_key) => {
+            details.push(format!("provider auth env var: {env_key} (missing)"));
+            let remediation = provider_env_key_instructions
+                .map(str::to_string)
+                .unwrap_or_else(|| format!("Set {env_key} for the active model provider."));
+            Some(
+                DoctorCheck::new(
+                    "auth.credentials",
+                    "auth",
+                    CheckStatus::Fail,
+                    "active model provider auth env var is missing",
+                )
+                .details(details)
+                .remediation(remediation),
+            )
+        }
+        None => Some(
+            DoctorCheck::new(
+                "auth.credentials",
+                "auth",
+                CheckStatus::Ok,
+                "OpenAI auth is not required for the active model provider",
+            )
+            .details(details),
+        ),
+    }
+}
+
+fn stored_auth_mode(auth: &codex_login::AuthDotJson) -> &'static str {
+    match stored_auth_mode_value(auth) {
+        codex_app_server_protocol::AuthMode::ApiKey => "api_key",
+        codex_app_server_protocol::AuthMode::Chatgpt => "chatgpt",
+        codex_app_server_protocol::AuthMode::ChatgptAuthTokens => "chatgpt_auth_tokens",
+        codex_app_server_protocol::AuthMode::AgentIdentity => "agent_identity",
+    }
+}
+
+fn stored_auth_mode_value(auth: &AuthDotJson) -> codex_app_server_protocol::AuthMode {
+    if let Some(mode) = auth.auth_mode {
+        return mode;
+    }
+    if auth.openai_api_key.is_some() {
+        codex_app_server_protocol::AuthMode::ApiKey
+    } else {
+        codex_app_server_protocol::AuthMode::Chatgpt
+    }
+}
+
+fn stored_auth_issues(
+    auth: &AuthDotJson,
+    env_var_present: impl Fn(&str) -> bool,
+) -> Vec<&'static str> {
+    let mut issues = Vec::new();
+    match stored_auth_mode_value(auth) {
+        codex_app_server_protocol::AuthMode::ApiKey => {
+            let stored_key_present = auth
+                .openai_api_key
+                .as_deref()
+                .is_some_and(|key| !key.trim().is_empty());
+            let env_key_present =
+                env_var_present(OPENAI_API_KEY_ENV_VAR) || env_var_present(CODEX_API_KEY_ENV_VAR);
+            if !stored_key_present && !env_key_present {
+                issues.push("API key auth is missing an API key");
+            }
+        }
+        codex_app_server_protocol::AuthMode::Chatgpt => {
+            match auth.tokens.as_ref() {
+                Some(tokens) => {
+                    if tokens.access_token.trim().is_empty() {
+                        issues.push("ChatGPT auth is missing an access token");
+                    }
+                    if tokens.refresh_token.trim().is_empty() {
+                        issues.push("ChatGPT auth is missing a refresh token");
+                    }
+                }
+                None => issues.push("ChatGPT auth is missing token data"),
+            }
+            if auth.last_refresh.is_none() {
+                issues.push("ChatGPT auth is missing refresh metadata");
+            }
+        }
+        codex_app_server_protocol::AuthMode::ChatgptAuthTokens => {
+            match auth.tokens.as_ref() {
+                Some(tokens) => {
+                    if tokens.access_token.trim().is_empty() {
+                        issues.push("external ChatGPT auth is missing an access token");
+                    }
+                    if tokens.account_id.is_none() && tokens.id_token.chatgpt_account_id.is_none() {
+                        issues.push("external ChatGPT auth is missing a ChatGPT account id");
+                    }
+                }
+                None => issues.push("external ChatGPT auth is missing token data"),
+            }
+            if auth.last_refresh.is_none() {
+                issues.push("external ChatGPT auth is missing refresh metadata");
+            }
+        }
+        codex_app_server_protocol::AuthMode::AgentIdentity => {
+            if auth
+                .agent_identity
+                .as_deref()
+                .is_none_or(|token| token.trim().is_empty())
+            {
+                issues.push("agent identity auth is missing an agent identity token");
+            }
+        }
+    }
+    issues
+}
+
+fn network_check() -> DoctorCheck {
+    let mut details = Vec::new();
+    push_proxy_env_details(&mut details);
+
+    let mut status = CheckStatus::Ok;
+    let mut summary = "network-related environment looks readable".to_string();
+    for name in ["CODEX_CA_CERTIFICATE", "SSL_CERT_FILE"] {
+        if let Some(raw) = env::var_os(name) {
+            let path = PathBuf::from(raw);
+            match std::fs::metadata(&path) {
+                Ok(metadata) if metadata.is_file() => {
+                    if let Err(err) = read_probe_file(&path) {
+                        status = CheckStatus::Warning;
+                        summary = "custom CA env var points at an unreadable file".to_string();
+                        details.push(format!("{name}: {} ({err})", path.display()));
+                    } else {
+                        details.push(format!("{name}: readable file {}", path.display()));
+                    }
+                }
+                Ok(_) => {
+                    status = CheckStatus::Warning;
+                    summary = "custom CA env var does not point at a file".to_string();
+                    details.push(format!("{name}: not a file {}", path.display()));
+                }
+                Err(err) => {
+                    status = CheckStatus::Warning;
+                    summary = "custom CA env var points at an unreadable path".to_string();
+                    details.push(format!("{name}: {} ({err})", path.display()));
+                }
+            }
+        }
+    }
+
+    DoctorCheck::new("network.env", "network", status, summary).details(details)
+}
+
+fn push_proxy_env_details(details: &mut Vec<String>) {
+    let present_proxy_vars = PROXY_ENV_VARS
+        .iter()
+        .copied()
+        .filter(|name| env_var_present(name))
+        .collect::<Vec<_>>();
+    if present_proxy_vars.is_empty() {
+        details.push("proxy env vars: none".to_string());
+    } else {
+        details.push(format!(
+            "proxy env vars present: {}",
+            present_proxy_vars.join(", ")
+        ));
+    }
+}
+
+fn read_probe_file(path: &Path) -> std::io::Result<()> {
+    let mut file = std::fs::File::open(path)?;
+    let mut buffer = [0_u8; 1];
+    let _ = file.read(&mut buffer)?;
+    Ok(())
+}
+
+async fn mcp_check(config: &Config) -> DoctorCheck {
+    mcp_check_from_servers(config.mcp_servers.get()).await
+}
+
+async fn mcp_check_from_servers(servers: &HashMap<String, McpServerConfig>) -> DoctorCheck {
+    if servers.is_empty() {
+        return DoctorCheck::new(
+            "mcp.config",
+            "mcp",
+            CheckStatus::Ok,
+            "no MCP servers configured",
+        );
+    }
+
+    let mut details = Vec::new();
+    let mut transport_counts: BTreeMap<&'static str, usize> = BTreeMap::new();
+    let mut disabled = 0usize;
+    let mut missing_env = Vec::new();
+    let mut unreachable_required_http = Vec::new();
+    let mut unreachable_optional_http = Vec::new();
+
+    for (name, server) in servers {
+        let disabled_server = !server.enabled || server.disabled_reason.is_some();
+        if disabled_server {
+            disabled += 1;
+        }
+        match &server.transport {
+            McpServerTransportConfig::Stdio {
+                command,
+                env,
+                env_vars,
+                cwd,
+                ..
+            } => {
+                *transport_counts.entry("stdio").or_default() += 1;
+                if disabled_server {
+                    continue;
+                }
+                if let Some(cwd) = cwd
+                    && !cwd.exists()
+                {
+                    missing_env.push(format!("{name}: cwd does not exist ({})", cwd.display()));
+                }
+                if command.trim().is_empty() {
+                    missing_env.push(format!("{name}: stdio command is empty"));
+                } else if let Err(err) =
+                    stdio_command_resolves(command, cwd.as_deref(), env.as_ref())
+                {
+                    missing_env.push(format!(
+                        "{name}: stdio command {command:?} is not resolvable ({err})"
+                    ));
+                }
+                if let Some(env) = env {
+                    for key in env.keys().filter(|key| key.trim().is_empty()) {
+                        missing_env.push(format!("{name}: empty env key {key}"));
+                    }
+                }
+                for env_var in env_vars {
+                    if env_var.is_remote_source() {
+                        missing_env.push(format!(
+                            "{name}: env_vars entry `{}` uses source `remote`, which requires remote MCP stdio",
+                            env_var.name()
+                        ));
+                    } else if !env_var_present(env_var.name()) {
+                        missing_env.push(format!("{name}: env var {} is not set", env_var.name()));
+                    }
+                }
+            }
+            McpServerTransportConfig::StreamableHttp {
+                url,
+                bearer_token_env_var,
+                env_http_headers,
+                ..
+            } => {
+                *transport_counts.entry("streamable_http").or_default() += 1;
+                if disabled_server {
+                    continue;
+                }
+                if let Some(env_var) = bearer_token_env_var
+                    && !env_var_present(env_var)
+                {
+                    missing_env.push(format!("{name}: bearer token env var {env_var} is not set"));
+                }
+                if let Some(headers) = env_http_headers {
+                    for env_var in headers.values() {
+                        if !env_var_present(env_var) {
+                            missing_env
+                                .push(format!("{name}: header env var {env_var} is not set"));
+                        }
+                    }
+                }
+                if let Err(err) = mcp_http_probe_url(url).await {
+                    let detail = format!("{name}: {url} ({err})");
+                    if server.required {
+                        unreachable_required_http.push(detail);
+                    } else {
+                        unreachable_optional_http.push(detail);
+                    }
+                }
+            }
+        }
+    }
+
+    details.push(format!("configured servers: {}", servers.len()));
+    details.push(format!("disabled servers: {disabled}"));
+    for (transport, count) in transport_counts {
+        details.push(format!("{transport} servers: {count}"));
+    }
+    details.extend(missing_env.iter().cloned());
+    details.extend(
+        unreachable_required_http
+            .iter()
+            .map(|detail| format!("required reachability failed: {detail}")),
+    );
+    details.extend(
+        unreachable_optional_http
+            .iter()
+            .map(|detail| format!("optional reachability failed: {detail}")),
+    );
+
+    let required_missing = servers.iter().any(|(name, server)| {
+        server.required
+            && missing_env
+                .iter()
+                .any(|missing| missing.starts_with(&format!("{name}:")))
+    });
+    let status = if required_missing || !unreachable_required_http.is_empty() {
+        CheckStatus::Fail
+    } else if !missing_env.is_empty() || !unreachable_optional_http.is_empty() {
+        CheckStatus::Warning
+    } else {
+        CheckStatus::Ok
+    };
+    let summary = match status {
+        CheckStatus::Ok => "MCP configuration is locally consistent",
+        CheckStatus::Warning => "MCP configuration has optional issues",
+        CheckStatus::Fail => "MCP configuration has failing required inputs or reachability",
+    };
+
+    let mut check = DoctorCheck::new("mcp.config", "mcp", status, summary).details(details);
+    if status != CheckStatus::Ok {
+        check = check.remediation("Set the missing MCP env vars or disable the affected server.");
+    }
+    check
+}
+
+fn sandbox_check(config: &Config, arg0_paths: &Arg0DispatchPaths) -> DoctorCheck {
+    let mut details = Vec::new();
+    details.push(format!(
+        "approval policy: {:?}",
+        config.permissions.approval_policy.value()
+    ));
+    let file_system_sandbox = config.permissions.file_system_sandbox_policy();
+    details.push(format!("filesystem sandbox: {}", file_system_sandbox.kind));
+    details.push(format!(
+        "network sandbox: {}",
+        config.permissions.network_sandbox_policy()
+    ));
+    push_path_detail(
+        &mut details,
+        "codex-linux-sandbox helper",
+        arg0_paths.codex_linux_sandbox_exe.as_deref(),
+    );
+    push_path_detail(
+        &mut details,
+        "execve wrapper helper",
+        arg0_paths.main_execve_wrapper_exe.as_deref(),
+    );
+
+    let mut status = CheckStatus::Ok;
+    let mut summary = "sandbox configuration is readable".to_string();
+    if let Some(helper) = arg0_paths.codex_linux_sandbox_exe.as_deref()
+        && !helper.exists()
+    {
+        status = CheckStatus::Warning;
+        summary = "Linux sandbox helper path does not exist".to_string();
+    }
+
+    DoctorCheck::new("sandbox.helpers", "sandbox", status, summary).details(details)
+}
+
+#[derive(Clone, Debug)]
+struct TerminalCheckInputs {
+    info: TerminalInfo,
+    env: BTreeMap<String, String>,
+    present_env: BTreeSet<String>,
+    no_color_flag: bool,
+    stdin_is_terminal: bool,
+    stdout_is_terminal: bool,
+    stderr_is_terminal: bool,
+    stream_supports_color: bool,
+    terminal_size: Result<(u16, u16), String>,
+    tmux_details: Vec<String>,
+}
+
+impl TerminalCheckInputs {
+    fn detect(no_color_flag: bool) -> Self {
+        let names = terminal_env_names();
+        let (env, present_env) = collect_env_snapshot(&names);
+        let terminal_size = crossterm::terminal::size().map_err(|err| err.to_string());
+        let info = terminal_info();
+        let tmux_details = if matches!(info.multiplexer, Some(Multiplexer::Tmux { .. })) {
+            tmux_diagnostic_details()
+        } else {
+            Vec::new()
+        };
+        Self {
+            info,
+            env,
+            present_env,
+            no_color_flag,
+            stdin_is_terminal: std::io::stdin().is_terminal(),
+            stdout_is_terminal: std::io::stdout().is_terminal(),
+            stderr_is_terminal: std::io::stderr().is_terminal(),
+            stream_supports_color: supports_color::on(Stream::Stdout).is_some(),
+            terminal_size,
+            tmux_details,
+        }
+    }
+
+    fn env_value(&self, name: &str) -> Option<&str> {
+        self.env.get(name).map(String::as_str)
+    }
+
+    fn env_present(&self, name: &str) -> bool {
+        self.present_env.contains(name)
+    }
+}
+
+fn terminal_check(no_color_flag: bool) -> DoctorCheck {
+    terminal_check_from_inputs(TerminalCheckInputs::detect(no_color_flag))
+}
+
+fn terminal_check_from_inputs(inputs: TerminalCheckInputs) -> DoctorCheck {
+    let info = &inputs.info;
+    let name = info.name;
+    let mut details = vec![format!("terminal: {}", terminal_name(info))];
+    if let Some(term_program) = info.term_program.as_deref() {
+        details.push(format!("TERM_PROGRAM: {term_program}"));
+    }
+    if let Some(version) = info.version.as_deref() {
+        details.push(format!("terminal version: {version}"));
+    }
+    if let Some(term) = info.term.as_deref() {
+        details.push(format!("TERM: {term}"));
+    }
+    if let Some(multiplexer) = info.multiplexer.as_ref() {
+        details.push(format!("multiplexer: {}", multiplexer_name(multiplexer)));
+    }
+    details.push(format!("stdin is terminal: {}", inputs.stdin_is_terminal));
+    details.push(format!("stdout is terminal: {}", inputs.stdout_is_terminal));
+    details.push(format!("stderr is terminal: {}", inputs.stderr_is_terminal));
+    match &inputs.terminal_size {
+        Ok((columns, rows)) => details.push(format!("terminal size: {columns}x{rows}")),
+        Err(err) => details.push(format!("terminal size: unavailable ({err})")),
+    }
+    push_terminal_env_values(&mut details, &inputs, TERMINAL_DIMENSION_ENV_VARS);
+    details.push(format!("color output: {}", color_output_summary(&inputs)));
+    push_terminal_env_values(&mut details, &inputs, COLOR_ENV_VARS);
+    let terminfo_warning = push_terminfo_details(&mut details, &inputs);
+    let locale = effective_locale(&inputs);
+    if let Some(locale) = locale.as_ref() {
+        details.push(format!("effective locale: {locale}"));
+    }
+    push_presence_env_values(&mut details, &inputs, REMOTE_TERMINAL_ENV_VARS);
+    details.extend(inputs.tmux_details.iter().cloned());
+
+    let locale_warning = locale.as_deref().is_some_and(is_non_utf8_locale);
+    let mut issues = Vec::new();
+    if matches!(name, TerminalName::Dumb) {
+        issues.push(
+            DoctorIssue::new(
+                CheckStatus::Fail,
+                "TERM=dumb - colors and cursor control are disabled",
+            )
+            .measured("TERM=dumb")
+            .expected("TERM=xterm-256color or another real terminal type")
+            .remedy("set TERM to a real value, for example xterm-256color")
+            .field("TERM"),
+        );
+    }
+    if locale_warning {
+        let measured = locale.unwrap_or_else(|| "unknown".to_string());
+        issues.push(
+            DoctorIssue::new(
+                CheckStatus::Warning,
+                "locale is not UTF-8 - unicode glyphs may render incorrectly",
+            )
+            .measured(measured)
+            .expected("UTF-8 locale, for example en_US.UTF-8")
+            .remedy("export LANG=en_US.UTF-8 or another UTF-8 locale")
+            .field("effective locale"),
+        );
+    }
+    if terminfo_warning {
+        issues.push(
+            DoctorIssue::new(
+                CheckStatus::Fail,
+                "TERMINFO unreadable - terminal capabilities are unknown",
+            )
+            .expected("readable terminfo file or directory")
+            .remedy("check that $TERMINFO points to a readable directory")
+            .field("TERMINFO")
+            .field("TERMINFO_DIRS entry"),
+        );
+    }
+    issues.extend(terminal_size_issues(&inputs));
+
+    let status = issues
+        .iter()
+        .map(|issue| issue.severity)
+        .max()
+        .unwrap_or(CheckStatus::Ok);
+    let summary = issues
+        .first()
+        .map(|issue| issue.cause.as_str())
+        .unwrap_or("terminal metadata was detected");
+    let mut check = DoctorCheck::new("terminal.env", "terminal", status, summary).details(details);
+    for issue in issues {
+        check = check.issue(issue);
+    }
+    check
+}
+
+fn terminal_name(info: &TerminalInfo) -> &'static str {
+    match info.name {
+        TerminalName::AppleTerminal => "Apple Terminal",
+        TerminalName::Ghostty => "Ghostty",
+        TerminalName::Iterm2 => "iTerm2",
+        TerminalName::WarpTerminal => "Warp",
+        TerminalName::VsCode => "VS Code",
+        TerminalName::WezTerm => "WezTerm",
+        TerminalName::Kitty => "kitty",
+        TerminalName::Alacritty => "Alacritty",
+        TerminalName::Konsole => "Konsole",
+        TerminalName::GnomeTerminal => "GNOME Terminal",
+        TerminalName::Vte => "VTE",
+        TerminalName::WindowsTerminal => "Windows Terminal",
+        TerminalName::Dumb => "dumb",
+        TerminalName::Unknown => "unknown",
+    }
+}
+
+fn multiplexer_name(multiplexer: &Multiplexer) -> String {
+    match multiplexer {
+        Multiplexer::Tmux { version } => match version {
+            Some(version) => format!("tmux {version}"),
+            None => "tmux".to_string(),
+        },
+        Multiplexer::Zellij { version } => match version {
+            Some(version) => format!("zellij {version}"),
+            None => "zellij".to_string(),
+        },
+    }
+}
+
+fn terminal_env_names() -> BTreeSet<&'static str> {
+    let mut names = BTreeSet::from(["TERM", "TERM_PROGRAM", "TERM_PROGRAM_VERSION"]);
+    names.extend(COLOR_ENV_VARS.iter().copied());
+    names.extend(TERMINAL_DIMENSION_ENV_VARS.iter().copied());
+    names.extend(TERMINFO_ENV_VARS.iter().copied());
+    names.extend(LOCALE_ENV_VARS.iter().copied());
+    names.extend(REMOTE_TERMINAL_ENV_VARS.iter().copied());
+    names
+}
+
+fn collect_env_snapshot(
+    names: &BTreeSet<&'static str>,
+) -> (BTreeMap<String, String>, BTreeSet<String>) {
+    let mut values = BTreeMap::new();
+    let mut present = BTreeSet::new();
+    for name in names {
+        if let Some(raw) = env::var_os(name) {
+            present.insert((*name).to_string());
+            let value = raw.to_string_lossy().trim().to_string();
+            if !value.is_empty() {
+                values.insert((*name).to_string(), value);
+            }
+        }
+    }
+    (values, present)
+}
+
+fn push_terminal_env_values(
+    details: &mut Vec<String>,
+    inputs: &TerminalCheckInputs,
+    names: &[&str],
+) {
+    for name in names {
+        if let Some(value) = inputs.env_value(name) {
+            details.push(format!("{name}: {value}"));
+        } else if inputs.env_present(name) {
+            details.push(format!("{name}: present"));
+        }
+    }
+}
+
+fn push_presence_env_values(
+    details: &mut Vec<String>,
+    inputs: &TerminalCheckInputs,
+    names: &[&str],
+) {
+    for name in names {
+        if inputs.env_present(name) {
+            details.push(format!("{name}: present"));
+        }
+    }
+}
+
+fn color_output_summary(inputs: &TerminalCheckInputs) -> String {
+    if should_enable_color(
+        inputs.no_color_flag,
+        inputs.env_present("NO_COLOR"),
+        inputs.env_value("TERM"),
+        inputs.stdout_is_terminal,
+        inputs.stream_supports_color,
+    ) {
+        return "enabled".to_string();
+    }
+
+    let reason = if inputs.no_color_flag {
+        "--no-color"
+    } else if inputs.env_present("NO_COLOR") {
+        "NO_COLOR"
+    } else if inputs.env_value("TERM") == Some("dumb") {
+        "TERM=dumb"
+    } else if !inputs.stdout_is_terminal {
+        "stdout is not a terminal"
+    } else if !inputs.stream_supports_color {
+        "terminal color support not detected"
+    } else {
+        "disabled"
+    };
+    format!("disabled ({reason})")
+}
+
+fn push_terminfo_details(details: &mut Vec<String>, inputs: &TerminalCheckInputs) -> bool {
+    let mut has_warning = false;
+    if let Some(raw) = inputs.env_value("TERMINFO") {
+        let path = PathBuf::from(raw);
+        let (status, warning) = terminal_path_readiness(&path);
+        details.push(format!("TERMINFO: {} ({status})", path.display()));
+        has_warning |= warning;
+    }
+    if let Some(raw) = inputs.env_value("TERMINFO_DIRS") {
+        for path in env::split_paths(raw).filter(|path| !path.as_os_str().is_empty()) {
+            let (status, warning) = terminal_path_readiness(&path);
+            details.push(format!(
+                "TERMINFO_DIRS entry: {} ({status})",
+                path.display()
+            ));
+            has_warning |= warning;
+        }
+    } else if inputs.env_present("TERMINFO_DIRS") {
+        details.push("TERMINFO_DIRS: present".to_string());
+    }
+    has_warning
+}
+
+fn terminal_path_readiness(path: &Path) -> (String, bool) {
+    match std::fs::metadata(path) {
+        Ok(metadata) if metadata.is_dir() => match std::fs::read_dir(path) {
+            Ok(_) => ("dir".to_string(), false),
+            Err(err) => (format!("dir unreadable: {err}"), true),
+        },
+        Ok(metadata) if metadata.is_file() => match read_probe_file(path) {
+            Ok(_) => ("file".to_string(), false),
+            Err(err) => (format!("file unreadable: {err}"), true),
+        },
+        Ok(_) => ("not a file or directory".to_string(), true),
+        Err(err) if err.kind() == std::io::ErrorKind::NotFound => ("missing".to_string(), true),
+        Err(err) => (err.to_string(), true),
+    }
+}
+
+fn effective_locale(inputs: &TerminalCheckInputs) -> Option<String> {
+    LOCALE_ENV_VARS
+        .iter()
+        .find_map(|name| inputs.env_value(name).map(ToString::to_string))
+}
+
+fn is_non_utf8_locale(locale: &str) -> bool {
+    let locale = locale.to_ascii_lowercase();
+    !(locale.contains("utf-8") || locale.contains("utf8"))
+}
+
+fn terminal_size_issues(inputs: &TerminalCheckInputs) -> Vec<DoctorIssue> {
+    let mut issues = Vec::new();
+    if let Ok((columns, rows)) = inputs.terminal_size {
+        if columns > 0 && columns < NARROW_TERMINAL_COLUMNS {
+            issues.push(
+                DoctorIssue::new(
+                    CheckStatus::Warning,
+                    format!("width {columns} cols - output may wrap (recommended >=80)"),
+                )
+                .measured(format!("{columns} x {rows}"))
+                .expected(format!(">= {NARROW_TERMINAL_COLUMNS} columns"))
+                .remedy("resize the window to at least 80 columns")
+                .field("terminal size"),
+            );
+        }
+        if rows > 0 && rows < NARROW_TERMINAL_ROWS {
+            issues.push(
+                DoctorIssue::new(
+                    CheckStatus::Warning,
+                    format!("height {rows} rows - content may scroll off (recommended >=24)"),
+                )
+                .measured(format!("{columns} x {rows}"))
+                .expected(format!(">= {NARROW_TERMINAL_ROWS} rows"))
+                .remedy("resize the window to at least 24 rows")
+                .field("terminal size"),
+            );
+        }
+    }
+
+    if let Some(columns) = inputs
+        .env_value("COLUMNS")
+        .and_then(|columns| columns.parse::<u16>().ok())
+        && columns > 0
+        && columns < NARROW_TERMINAL_COLUMNS
+    {
+        issues.push(
+            DoctorIssue::new(
+                CheckStatus::Warning,
+                format!("COLUMNS={columns} - output may wrap (recommended >=80)"),
+            )
+            .measured(format!("{columns} columns"))
+            .expected(format!(">= {NARROW_TERMINAL_COLUMNS} columns"))
+            .remedy("resize the window to at least 80 columns")
+            .field("COLUMNS"),
+        );
+    }
+    if let Some(rows) = inputs
+        .env_value("LINES")
+        .and_then(|rows| rows.parse::<u16>().ok())
+        && rows > 0
+        && rows < NARROW_TERMINAL_ROWS
+    {
+        issues.push(
+            DoctorIssue::new(
+                CheckStatus::Warning,
+                format!("LINES={rows} - content may scroll off (recommended >=24)"),
+            )
+            .measured(format!("{rows} rows"))
+            .expected(format!(">= {NARROW_TERMINAL_ROWS} rows"))
+            .remedy("resize the window to at least 24 rows")
+            .field("LINES"),
+        );
+    }
+
+    issues
+}
+
+fn tmux_diagnostic_details() -> Vec<String> {
+    let mut details = Vec::new();
+    push_tmux_display_detail(&mut details, "tmux client termtype", "#{client_termtype}");
+    push_tmux_display_detail(&mut details, "tmux client termname", "#{client_termname}");
+    for option in TMUX_OPTION_NAMES {
+        let value = tmux_option_value(option).unwrap_or_else(|| "unavailable".to_string());
+        details.push(format!("tmux {option}: {value}"));
+    }
+    details
+}
+
+fn push_tmux_display_detail(details: &mut Vec<String>, label: &str, format: &str) {
+    if let Some(value) = tmux_display_message(format) {
+        details.push(format!("{label}: {value}"));
+    }
+}
+
+fn tmux_option_value(option: &str) -> Option<String> {
+    let output = Command::new("tmux")
+        .args(["show-options", "-gqv", option])
+        .output()
+        .ok()?;
+    if !output.status.success() {
+        return None;
+    }
+    non_empty_trimmed(String::from_utf8(output.stdout).ok()?)
+}
+
+fn tmux_display_message(format: &str) -> Option<String> {
+    let output = Command::new("tmux")
+        .args(["display-message", "-p", format])
+        .output()
+        .ok()?;
+    if !output.status.success() {
+        return None;
+    }
+    non_empty_trimmed(String::from_utf8(output.stdout).ok()?)
+}
+
+fn non_empty_trimmed(value: String) -> Option<String> {
+    let value = value.trim().to_string();
+    if value.is_empty() { None } else { Some(value) }
+}
+
+async fn state_check(config: &Config) -> DoctorCheck {
+    let mut details = Vec::new();
+    path_readiness(&mut details, "CODEX_HOME", &config.codex_home);
+    path_readiness(&mut details, "log dir", &config.log_dir);
+    path_readiness(&mut details, "sqlite home", &config.sqlite_home);
+    let mut integrity_failures = Vec::new();
+    for db in codex_state::runtime_db_paths(&config.sqlite_home) {
+        path_readiness(&mut details, db.label, &db.path);
+        sqlite_integrity_detail(&mut details, &mut integrity_failures, db.label, &db.path).await;
+    }
+    rollout_stats_details(&mut details, &config.codex_home);
+    standalone_release_cache_details(&mut details);
+
+    let status = if integrity_failures.is_empty() {
+        CheckStatus::Ok
+    } else {
+        CheckStatus::Fail
+    };
+    let summary = if status == CheckStatus::Ok {
+        "state paths and databases are inspectable"
+    } else {
+        "state database integrity check failed"
+    };
+    let mut check = DoctorCheck::new("state.paths", "state", status, summary).details(details);
+    if status == CheckStatus::Fail {
+        check = check
+            .remediation("Back up CODEX_HOME, then remove or repair the affected SQLite database.");
+    }
+    check
+}
+
+async fn sqlite_integrity_detail(
+    details: &mut Vec<String>,
+    integrity_failures: &mut Vec<String>,
+    label: &str,
+    path: &Path,
+) {
+    if !path.is_file() {
+        details.push(format!("{label} integrity: skipped (missing)"));
+        return;
+    }
+
+    match codex_state::sqlite_integrity_check(path).await {
+        Ok(rows) if rows.iter().all(|row| row == "ok") => {
+            details.push(format!("{label} integrity: ok"));
+        }
+        Ok(rows) => {
+            let message = format!("{label} integrity: {}", rows.join("; "));
+            integrity_failures.push(message.clone());
+            details.push(message);
+        }
+        Err(err) => {
+            let message = format!("{label} integrity: {err}");
+            integrity_failures.push(message.clone());
+            details.push(message);
+        }
+    }
+}
+
+fn rollout_stats_details(details: &mut Vec<String>, codex_home: &Path) {
+    let active = collect_rollout_stats(&codex_home.join("sessions"));
+    let archived = collect_rollout_stats(&codex_home.join("archived_sessions"));
+    push_rollout_stats_detail(details, "active rollout files", active);
+    push_rollout_stats_detail(details, "archived rollout files", archived);
+}
+
+fn push_rollout_stats_detail(details: &mut Vec<String>, label: &str, stats: RolloutStats) {
+    match stats.error {
+        Some(error) => details.push(format!("{label}: scan failed ({error})")),
+        None => details.push(format!(
+            "{label}: {} files, {} total bytes, {} average bytes",
+            stats.files,
+            stats.total_bytes,
+            stats.average_bytes()
+        )),
+    }
+}
+
+#[derive(Default)]
+struct RolloutStats {
+    files: u64,
+    total_bytes: u64,
+    error: Option<String>,
+}
+
+impl RolloutStats {
+    fn average_bytes(&self) -> u64 {
+        if self.files == 0 {
+            0
+        } else {
+            self.total_bytes / self.files
+        }
+    }
+}
+
+fn collect_rollout_stats(root: &Path) -> RolloutStats {
+    let mut stats = RolloutStats::default();
+    collect_rollout_stats_inner(root, &mut stats);
+    stats
+}
+
+fn collect_rollout_stats_inner(path: &Path, stats: &mut RolloutStats) {
+    if stats.error.is_some() {
+        return;
+    }
+    let entries = match std::fs::read_dir(path) {
+        Ok(entries) => entries,
+        Err(err) if err.kind() == std::io::ErrorKind::NotFound => return,
+        Err(err) => {
+            stats.error = Some(err.to_string());
+            return;
+        }
+    };
+
+    for entry in entries {
+        let entry = match entry {
+            Ok(entry) => entry,
+            Err(err) => {
+                stats.error = Some(err.to_string());
+                return;
+            }
+        };
+        let path = entry.path();
+        let metadata = match entry.metadata() {
+            Ok(metadata) => metadata,
+            Err(err) => {
+                stats.error = Some(err.to_string());
+                return;
+            }
+        };
+        if metadata.is_dir() {
+            collect_rollout_stats_inner(&path, stats);
+        } else if metadata.is_file() && is_rollout_file(&path) {
+            stats.files += 1;
+            stats.total_bytes = stats.total_bytes.saturating_add(metadata.len());
+        }
+    }
+}
+
+fn is_rollout_file(path: &Path) -> bool {
+    path.extension() == Some(OsStr::new("jsonl"))
+        && path
+            .file_name()
+            .and_then(OsStr::to_str)
+            .is_some_and(|name| name.starts_with("rollout-"))
+}
+
+async fn websocket_reachability_check(
+    config: &Config,
+    auth_manager: Option<Arc<AuthManager>>,
+) -> DoctorCheck {
+    let provider = &config.model_provider;
+    let mut details = vec![
+        format!("model provider: {}", config.model_provider_id),
+        format!("provider name: {}", provider.name),
+        format!("wire API: {}", provider.wire_api),
+        format!("supports websockets: {}", provider.supports_websockets),
+    ];
+    push_proxy_env_details(&mut details);
+
+    if !provider.supports_websockets {
+        return DoctorCheck::new(
+            "network.websocket_reachability",
+            "websocket",
+            CheckStatus::Ok,
+            "Responses WebSocket is not enabled for the active provider",
+        )
+        .details(details);
+    }
+
+    details.push(format!(
+        "connect timeout: {} ms",
+        provider.websocket_connect_timeout().as_millis()
+    ));
+
+    let runtime_provider = create_model_provider(provider.clone(), auth_manager);
+    let auth = runtime_provider.auth().await;
+    details.push(format!(
+        "auth mode: {}",
+        auth.as_ref().map(auth_mode_name).unwrap_or("none")
+    ));
+
+    let api_provider = match runtime_provider.api_provider().await {
+        Ok(api_provider) => api_provider,
+        Err(err) => {
+            return websocket_probe_warning(
+                "Responses WebSocket provider setup failed",
+                details,
+                format!("provider setup failed: {err}"),
+            );
+        }
+    };
+    match api_provider.websocket_url_for_path("responses") {
+        Ok(url) => {
+            details.push(format!("endpoint: {url}"));
+            if let Some(host) = url.host_str()
+                && let Some(port) = url.port_or_known_default()
+            {
+                details.extend(dns_address_family_details(host, port).await);
+            }
+        }
+        Err(err) => {
+            return websocket_probe_warning(
+                "Responses WebSocket endpoint could not be built",
+                details,
+                format!("endpoint build failed: {err}"),
+            );
+        }
+    }
+
+    let api_auth = match runtime_provider.api_auth().await {
+        Ok(api_auth) => api_auth,
+        Err(err) => {
+            return websocket_probe_warning(
+                "Responses WebSocket auth could not be resolved",
+                details,
+                format!("auth resolution failed: {err}"),
+            );
+        }
+    };
+
+    let mut extra_headers = HeaderMap::new();
+    extra_headers.insert(
+        OPENAI_BETA_HEADER,
+        HeaderValue::from_static(RESPONSES_WEBSOCKETS_V2_BETA_HEADER_VALUE),
+    );
+    let client = ResponsesWebsocketClient::new(api_provider, api_auth);
+    match tokio::time::timeout(
+        provider.websocket_connect_timeout(),
+        client.probe_handshake(
+            extra_headers,
+            default_headers(),
+            WEBSOCKET_IMMEDIATE_CLOSE_GRACE,
+        ),
+    )
+    .await
+    {
+        Ok(Ok(probe)) => {
+            details.push(format!("handshake result: HTTP {}", probe.status));
+            details.push(format!("reasoning header: {}", probe.reasoning_included));
+            details.push(format!(
+                "models etag present: {}",
+                probe.models_etag_present
+            ));
+            details.push(format!(
+                "server model present: {}",
+                probe.server_model_present
+            ));
+            if let Some(close) = probe.immediate_close {
+                details.push(format!("immediate close code: {}", close.code));
+                details.push(format!("immediate close reason: {}", close.reason));
+                return DoctorCheck::new(
+                    "network.websocket_reachability",
+                    "websocket",
+                    CheckStatus::Warning,
+                    "Responses WebSocket closed immediately after handshake",
+                )
+                .details(details)
+                .remediation(
+                    "Check proxy, VPN, firewall, DNS, custom CA, and WebSocket policy support.",
+                );
+            }
+            DoctorCheck::new(
+                "network.websocket_reachability",
+                "websocket",
+                CheckStatus::Ok,
+                "Responses WebSocket handshake succeeded",
+            )
+            .details(details)
+        }
+        Ok(Err(err)) => websocket_probe_warning(
+            "Responses WebSocket failed; HTTPS fallback may still work",
+            details,
+            websocket_error_detail(&err),
+        ),
+        Err(_) => websocket_probe_warning(
+            "Responses WebSocket timed out; HTTPS fallback may still work",
+            details,
+            "handshake timed out".to_string(),
+        ),
+    }
+}
+
+fn websocket_probe_warning(
+    summary: &'static str,
+    mut details: Vec<String>,
+    error_detail: String,
+) -> DoctorCheck {
+    details.push(error_detail);
+    DoctorCheck::new(
+        "network.websocket_reachability",
+        "websocket",
+        CheckStatus::Warning,
+        summary,
+    )
+    .details(details)
+    .remediation("Check proxy, VPN, firewall, DNS, custom CA, and WebSocket policy support.")
+}
+
+fn websocket_error_detail(err: &ApiError) -> String {
+    match err {
+        ApiError::Transport(transport) => format!("handshake transport error: {transport}"),
+        ApiError::Api { status, message } => {
+            format!("handshake API error: {status} {message}")
+        }
+        ApiError::Stream(message) => format!("handshake stream error: {message}"),
+        ApiError::ContextWindowExceeded
+        | ApiError::QuotaExceeded
+        | ApiError::UsageNotIncluded
+        | ApiError::Retryable { .. }
+        | ApiError::RateLimit(_)
+        | ApiError::InvalidRequest { .. }
+        | ApiError::CyberPolicy { .. }
+        | ApiError::ServerOverloaded => format!("handshake error: {err}"),
+    }
+}
+
+fn auth_mode_name(auth: &CodexAuth) -> &'static str {
+    match auth.auth_mode() {
+        codex_app_server_protocol::AuthMode::ApiKey => "api_key",
+        codex_app_server_protocol::AuthMode::Chatgpt => "chatgpt",
+        codex_app_server_protocol::AuthMode::ChatgptAuthTokens => "chatgpt_auth_tokens",
+        codex_app_server_protocol::AuthMode::AgentIdentity => "agent_identity",
+    }
+}
+
+async fn dns_address_family_details(host: &str, port: u16) -> Vec<String> {
+    match tokio::net::lookup_host((host, port)).await {
+        Ok(addresses) => {
+            let addresses = addresses.collect::<Vec<_>>();
+            let ipv4_count = addresses
+                .iter()
+                .filter(|address| matches!(address.ip(), IpAddr::V4(_)))
+                .count();
+            let ipv6_count = addresses
+                .iter()
+                .filter(|address| matches!(address.ip(), IpAddr::V6(_)))
+                .count();
+            let first_family = addresses
+                .first()
+                .map(|address| match address.ip() {
+                    IpAddr::V4(_) => "IPv4",
+                    IpAddr::V6(_) => "IPv6",
+                })
+                .unwrap_or("none");
+            vec![format!(
+                "DNS: {ipv4_count} IPv4, {ipv6_count} IPv6, first {first_family}"
+            )]
+        }
+        Err(err) => vec![format!("DNS: lookup failed ({err})")],
+    }
+}
+
+fn fallback_state_check() -> DoctorCheck {
+    let codex_home = find_codex_home();
+    match codex_home {
+        Ok(path) => DoctorCheck::new(
+            "state.paths",
+            "state",
+            CheckStatus::Ok,
+            "CODEX_HOME was resolved without config",
+        )
+        .detail(format!("CODEX_HOME: {}", path.display())),
+        Err(err) => DoctorCheck::new(
+            "state.paths",
+            "state",
+            CheckStatus::Warning,
+            "CODEX_HOME could not be resolved",
+        )
+        .detail(err.to_string()),
+    }
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+struct ReachabilityPlan {
+    description: String,
+    endpoints: Vec<ReachabilityEndpoint>,
+}
+
+#[derive(Clone, Debug, PartialEq, Eq)]
+struct ReachabilityEndpoint {
+    label: String,
+    url: String,
+    required: bool,
+    route_probe_url: Option<String>,
+}
+
+#[derive(Clone, Copy, Debug, PartialEq, Eq)]
+enum ProviderAuthReachabilityMode {
+    NotRequired,
+    ApiKey,
+    Chatgpt,
+}
+
+impl ProviderAuthReachabilityMode {
+    fn description(self) -> &'static str {
+        match self {
+            Self::NotRequired => "provider auth",
+            Self::ApiKey => "API key auth",
+            Self::Chatgpt => "ChatGPT auth",
+        }
+    }
+}
+
+fn provider_reachability_plan(config: &Config) -> ReachabilityPlan {
+    let stored_auth =
+        load_auth_dot_json(&config.codex_home, config.cli_auth_credentials_store_mode)
+            .ok()
+            .flatten();
+    let mode = provider_auth_reachability_mode_from_auth(
+        config.model_provider.requires_openai_auth,
+        env_var_present,
+        stored_auth.as_ref(),
+    );
+    provider_reachability_plan_from_parts(
+        mode,
+        &config.model_provider_id,
+        &config.model_provider.name,
+        config.model_provider.base_url.as_deref(),
+        config.model_provider.query_params.as_ref(),
+        config.model_provider.is_amazon_bedrock(),
+        &config.chatgpt_base_url,
+    )
+}
+
+fn default_reachability_plan() -> ReachabilityPlan {
+    provider_reachability_plan_from_parts(
+        ProviderAuthReachabilityMode::Chatgpt,
+        "openai",
+        "OpenAI",
+        /*provider_base_url*/ None,
+        /*provider_query_params*/ None,
+        /*is_amazon_bedrock*/ false,
+        "https://chatgpt.com/backend-api/",
+    )
+}
+
+fn provider_auth_reachability_mode_from_auth(
+    requires_openai_auth: bool,
+    env_var_present: impl Fn(&str) -> bool,
+    stored_auth: Option<&AuthDotJson>,
+) -> ProviderAuthReachabilityMode {
+    if !requires_openai_auth {
+        return ProviderAuthReachabilityMode::NotRequired;
+    }
+    if env_var_present(OPENAI_API_KEY_ENV_VAR) || env_var_present(CODEX_API_KEY_ENV_VAR) {
+        return ProviderAuthReachabilityMode::ApiKey;
+    }
+    if env_var_present(CODEX_ACCESS_TOKEN_ENV_VAR) {
+        return ProviderAuthReachabilityMode::Chatgpt;
+    }
+    match stored_auth.map(stored_auth_mode_value) {
+        Some(codex_app_server_protocol::AuthMode::ApiKey) => ProviderAuthReachabilityMode::ApiKey,
+        Some(
+            codex_app_server_protocol::AuthMode::Chatgpt
+            | codex_app_server_protocol::AuthMode::ChatgptAuthTokens
+            | codex_app_server_protocol::AuthMode::AgentIdentity,
+        )
+        | None => ProviderAuthReachabilityMode::Chatgpt,
+    }
+}
+
+fn provider_reachability_plan_from_parts(
+    mode: ProviderAuthReachabilityMode,
+    provider_id: &str,
+    provider_name: &str,
+    provider_base_url: Option<&str>,
+    provider_query_params: Option<&HashMap<String, String>>,
+    is_amazon_bedrock: bool,
+    chatgpt_base_url: &str,
+) -> ReachabilityPlan {
+    let provider_route_probe_url = provider_base_url
+        .or_else(|| {
+            (mode == ProviderAuthReachabilityMode::ApiKey).then_some("https://api.openai.com/v1")
+        })
+        .and_then(|url| {
+            should_probe_models_route(provider_name, url, is_amazon_bedrock)
+                .then(|| provider_url_for_path(url, "models", provider_query_params))
+        });
+    let endpoints = match mode {
+        ProviderAuthReachabilityMode::ApiKey => vec![ReachabilityEndpoint {
+            label: format!("{provider_id} API"),
+            url: provider_base_url
+                .unwrap_or("https://api.openai.com/v1")
+                .to_string(),
+            required: true,
+            route_probe_url: provider_route_probe_url,
+        }],
+        ProviderAuthReachabilityMode::Chatgpt => vec![ReachabilityEndpoint {
+            label: "ChatGPT".to_string(),
+            url: chatgpt_base_url.to_string(),
+            required: true,
+            route_probe_url: None,
+        }],
+        ProviderAuthReachabilityMode::NotRequired => provider_base_url
+            .map(|url| {
+                vec![ReachabilityEndpoint {
+                    label: format!("{provider_id} API"),
+                    url: url.to_string(),
+                    required: true,
+                    route_probe_url: provider_route_probe_url,
+                }]
+            })
+            .unwrap_or_default(),
+    };
+    ReachabilityPlan {
+        description: mode.description().to_string(),
+        endpoints,
+    }
+}
+
+fn should_probe_models_route(provider_name: &str, base_url: &str, is_amazon_bedrock: bool) -> bool {
+    !is_amazon_bedrock && !is_azure_responses_provider(provider_name, Some(base_url))
+}
+
+fn provider_url_for_path(
+    base_url: &str,
+    path: &str,
+    query_params: Option<&HashMap<String, String>>,
+) -> String {
+    let base = base_url.trim_end_matches('/');
+    let path = path.trim_start_matches('/');
+    let mut url = if path.is_empty() {
+        base.to_string()
+    } else {
+        format!("{base}/{path}")
+    };
+
+    if let Some(params) = query_params
+        && !params.is_empty()
+    {
+        let separator = if url.contains('?') { '&' } else { '?' };
+        url.push(separator);
+        url.push_str(
+            &params
+                .iter()
+                .map(|(key, value)| format!("{key}={value}"))
+                .collect::<Vec<_>>()
+                .join("&"),
+        );
+    }
+
+    url
+}
+
+async fn provider_reachability_check(plan: ReachabilityPlan) -> DoctorCheck {
+    let mut details = vec![format!("reachability mode: {}", plan.description)];
+    if plan.endpoints.is_empty() {
+        details.push("active provider endpoint: none configured".to_string());
+        return DoctorCheck::new(
+            "network.provider_reachability",
+            "reachability",
+            CheckStatus::Ok,
+            "active provider has no HTTP endpoint to probe",
+        )
+        .details(details);
+    }
+
+    let mut failures = Vec::new();
+    let mut optional_failures = Vec::new();
+    let mut route_failures = Vec::new();
+    let mut route_warnings = Vec::new();
+    let mut issues = Vec::new();
+    for endpoint in plan.endpoints {
+        match http_probe_url(&endpoint.url).await {
+            Ok(status) => details.push(format!(
+                "{} base URL: {} reachable ({status})",
+                endpoint.label, endpoint.url
+            )),
+            Err(err) => {
+                let requirement = if endpoint.required {
+                    "required"
+                } else {
+                    "optional"
+                };
+                details.push(format!(
+                    "{} base URL: {} {err} ({requirement})",
+                    endpoint.label, endpoint.url
+                ));
+                if endpoint.required {
+                    failures.push(endpoint.url);
+                } else {
+                    optional_failures.push(endpoint.url);
+                }
+                continue;
+            }
+        }
+
+        let Some(route_probe_url) = endpoint.route_probe_url.as_deref() else {
+            continue;
+        };
+        match provider_route_probe_url(route_probe_url).await {
+            RouteProbeOutcome::Ok(status) => {
+                details.push(format!(
+                    "{} route probe: {route_probe_url} route exists ({status})",
+                    endpoint.label,
+                ));
+            }
+            RouteProbeOutcome::Warning(status) => {
+                details.push(format!(
+                    "{} route probe: {route_probe_url} returned {status} (warning)",
+                    endpoint.label,
+                ));
+                route_warnings.push(route_probe_url.to_string());
+            }
+            RouteProbeOutcome::Fail(status) => {
+                details.push(format!(
+                    "{} route probe: {route_probe_url} returned {status} (required)",
+                    endpoint.label,
+                ));
+                route_failures.push(route_probe_url.to_string());
+                issues.push(
+                    DoctorIssue::new(
+                        CheckStatus::Fail,
+                        "provider base URL route returned 404 - verify the configured API prefix",
+                    )
+                    .measured(format!("{route_probe_url} returned {status}"))
+                    .expected("GET /models returns 2xx, 401, or 403")
+                    .remedy("Set base_url to the provider API root, for example https://api.openai.com/v1")
+                    .field("route probe"),
+                );
+            }
+            RouteProbeOutcome::TransportError(err) => {
+                details.push(format!(
+                    "{} route probe: {route_probe_url} {err} (required)",
+                    endpoint.label,
+                ));
+                route_failures.push(route_probe_url.to_string());
+                issues.push(
+                    DoctorIssue::new(
+                        CheckStatus::Fail,
+                        "provider route probe could not connect - verify network access to the provider API",
+                    )
+                    .measured(format!("{route_probe_url} {err}"))
+                    .expected("GET /models completes")
+                    .remedy("Check proxy, VPN, firewall, DNS, and custom CA configuration.")
+                    .field("route probe"),
+                );
+            }
+        }
+    }
+
+    let (status, summary) = provider_reachability_outcome(
+        failures.len() + route_failures.len(),
+        optional_failures.len() + route_warnings.len(),
+    );
+    let mut check = DoctorCheck::new(
+        "network.provider_reachability",
+        "reachability",
+        status,
+        summary,
+    )
+    .details(details);
+    for issue in issues {
+        check = check.issue(issue);
+    }
+    if status != CheckStatus::Ok {
+        check = check.remediation("Check proxy, VPN, firewall, DNS, and custom CA configuration.");
+    }
+    check
+}
+
+enum RouteProbeOutcome {
+    Ok(String),
+    Warning(String),
+    Fail(String),
+    TransportError(String),
+}
+
+async fn provider_route_probe_url(url: &str) -> RouteProbeOutcome {
+    match http_get_probe_status_with_timeout(url, Duration::from_secs(3)).await {
+        Ok(status) if (200..300).contains(&status) || matches!(status, 401 | 403) => {
+            RouteProbeOutcome::Ok(format!("HTTP {status}"))
+        }
+        Ok(404) => RouteProbeOutcome::Fail("HTTP 404".to_string()),
+        Ok(status) => RouteProbeOutcome::Warning(format!("HTTP {status}")),
+        Err(err) => RouteProbeOutcome::TransportError(err),
+    }
+}
+
+fn provider_reachability_outcome(
+    required_failures: usize,
+    warnings: usize,
+) -> (CheckStatus, &'static str) {
+    match (required_failures, warnings) {
+        (0, 0) => (
+            CheckStatus::Ok,
+            "active provider endpoints are reachable over HTTP",
+        ),
+        (0, _) => (
+            CheckStatus::Warning,
+            "provider endpoint checks returned warnings",
+        ),
+        (_, _) => (
+            CheckStatus::Fail,
+            "one or more required provider endpoints are unreachable over HTTP",
+        ),
+    }
+}
+
+async fn http_probe_url(url: &str) -> Result<String, String> {
+    http_probe_url_with_timeout(url, Duration::from_secs(3)).await
+}
+
+async fn mcp_http_probe_url(url: &str) -> Result<String, String> {
+    mcp_http_probe_url_with_timeout(url, Duration::from_secs(3)).await
+}
+
+async fn mcp_http_probe_url_with_timeout(url: &str, timeout: Duration) -> Result<String, String> {
+    match http_probe_url_with_timeout(url, timeout).await {
+        Ok(status) => Ok(status),
+        Err(head_err) => match http_get_probe_url_with_timeout(url, timeout).await {
+            Ok(status) => Ok(status),
+            Err(get_err) => Err(format!("HEAD {head_err}; GET {get_err}")),
+        },
+    }
+}
+
+async fn http_probe_url_with_timeout(url: &str, timeout: Duration) -> Result<String, String> {
+    let response = build_reqwest_client()
+        .head(url)
+        .timeout(timeout)
+        .send()
+        .await
+        .map_err(|err| {
+            if err.is_timeout() {
+                "request timed out".to_string()
+            } else if err.is_connect() {
+                "connect failed".to_string()
+            } else if err.is_builder() {
+                "request could not be built".to_string()
+            } else {
+                err.to_string()
+            }
+        })?;
+    Ok(format!("HTTP {}", response.status().as_u16()))
+}
+
+async fn http_get_probe_url_with_timeout(url: &str, timeout: Duration) -> Result<String, String> {
+    http_get_probe_status_with_timeout(url, timeout)
+        .await
+        .map(|status| format!("HTTP {status}"))
+}
+
+async fn http_get_probe_status_with_timeout(url: &str, timeout: Duration) -> Result<u16, String> {
+    let response = build_reqwest_client()
+        .get(url)
+        .timeout(timeout)
+        .send()
+        .await
+        .map_err(|err| {
+            if err.is_timeout() {
+                "request timed out".to_string()
+            } else if err.is_connect() {
+                "connect failed".to_string()
+            } else if err.is_builder() {
+                "request could not be built".to_string()
+            } else {
+                err.to_string()
+            }
+        })?;
+    Ok(response.status().as_u16())
+}
+
+fn stdio_command_resolves(
+    command: &str,
+    cwd: Option<&Path>,
+    server_env: Option<&HashMap<String, String>>,
+) -> Result<(), String> {
+    let command_path = Path::new(command);
+    if command_path.is_absolute() {
+        return executable_path_exists(command_path);
+    }
+
+    if command_path.components().count() > 1 {
+        let base = cwd
+            .map(Path::to_path_buf)
+            .or_else(|| env::current_dir().ok())
+            .unwrap_or_else(|| PathBuf::from("."));
+        return executable_path_exists(&base.join(command_path));
+    }
+
+    let Some(path_env) = server_env
+        .and_then(|env| env.get("PATH").map(String::as_str))
+        .map(std::ffi::OsString::from)
+        .or_else(|| env::var_os("PATH"))
+    else {
+        return Err("PATH is not set".to_string());
+    };
+
+    for dir in env::split_paths(&path_env) {
+        let candidate = dir.join(command);
+        if executable_path_exists(&candidate).is_ok() {
+            return Ok(());
+        }
+        #[cfg(windows)]
+        {
+            let pathext = env::var("PATHEXT").unwrap_or_else(|_| ".COM;.EXE;.BAT;.CMD".to_string());
+            for extension in pathext.split(';').filter(|extension| !extension.is_empty()) {
+                let candidate = dir.join(format!("{command}{extension}"));
+                if executable_path_exists(&candidate).is_ok() {
+                    return Ok(());
+                }
+            }
+        }
+    }
+    Err("not found on PATH".to_string())
+}
+
+fn executable_path_exists(path: &Path) -> Result<(), String> {
+    match std::fs::metadata(path) {
+        Ok(metadata) if metadata.is_file() => executable_file_permission(path, &metadata),
+        Ok(_) => Err("path is not a file".to_string()),
+        Err(err) => Err(err.to_string()),
+    }
+}
+
+#[cfg(unix)]
+fn executable_file_permission(path: &Path, metadata: &std::fs::Metadata) -> Result<(), String> {
+    use std::os::unix::fs::PermissionsExt;
+
+    if metadata.permissions().mode() & 0o111 == 0 {
+        Err(format!("{} is not executable", path.display()))
+    } else {
+        Ok(())
+    }
+}
+
+#[cfg(not(unix))]
+fn executable_file_permission(_path: &Path, _metadata: &std::fs::Metadata) -> Result<(), String> {
+    Ok(())
+}
+
+fn path_readiness(details: &mut Vec<String>, label: &str, path: &Path) {
+    match std::fs::metadata(path) {
+        Ok(metadata) => {
+            let kind = if metadata.is_dir() {
+                "dir"
+            } else if metadata.is_file() {
+                "file"
+            } else {
+                "other"
+            };
+            details.push(format!("{label}: {} ({kind})", path.display()));
+        }
+        Err(err) if err.kind() == std::io::ErrorKind::NotFound => {
+            details.push(format!("{label}: {} (missing)", path.display()));
+        }
+        Err(err) => details.push(format!("{label}: {} ({err})", path.display())),
+    }
+}
+
+fn standalone_release_cache_details(details: &mut Vec<String>) {
+    let InstallContext::Standalone { release_dir, .. } = InstallContext::current() else {
+        return;
+    };
+    let Some(releases_dir) = release_dir.parent() else {
+        return;
+    };
+    let Ok(entries) = std::fs::read_dir(releases_dir) else {
+        return;
+    };
+    let release_count = entries.filter_map(Result::ok).count();
+    details.push(format!(
+        "standalone release cache: {release_count} entries in {}",
+        releases_dir.display()
+    ));
+}
+
+fn push_path_detail(details: &mut Vec<String>, label: &str, path: Option<&Path>) {
+    match path {
+        Some(path) => details.push(format!("{label}: {}", path.display())),
+        None => details.push(format!("{label}: none")),
+    }
+}
+
+fn push_env_path_detail(details: &mut Vec<String>, label: &str, name: &str) {
+    match env::var_os(name) {
+        Some(path) => details.push(format!("{label}: {}", PathBuf::from(path).display())),
+        None => details.push(format!("{label}: not set")),
+    }
+}
+
+fn env_var_present(name: &str) -> bool {
+    env::var_os(name).is_some_and(|value| !value.is_empty())
+}
+
+fn human_output_options(command: &DoctorCommand) -> HumanOutputOptions {
+    let term = env::var("TERM").ok();
+    let color_enabled = should_enable_color(
+        command.no_color,
+        env::var_os("NO_COLOR").is_some(),
+        term.as_deref(),
+        std::io::stdout().is_terminal(),
+        supports_color::on(Stream::Stdout).is_some(),
+    );
+    HumanOutputOptions {
+        show_details: !command.summary,
+        show_all: command.all,
+        ascii: command.ascii,
+        color_enabled,
+    }
+}
+
+fn should_enable_color(
+    no_color_flag: bool,
+    no_color_env: bool,
+    term: Option<&str>,
+    stdout_is_tty: bool,
+    stream_supports_color: bool,
+) -> bool {
+    !no_color_flag
+        && !no_color_env
+        && term != Some("dumb")
+        && stdout_is_tty
+        && stream_supports_color
+}
+
+#[cfg(test)]
+mod tests {
+    use std::io::Read;
+    use std::io::Write;
+    use std::net::TcpListener;
+    use std::sync::Mutex;
+
+    use clap::Parser;
+    use codex_protocol::config_types::SandboxMode;
+    use pretty_assertions::assert_eq;
+
+    use super::*;
+
+    #[derive(Default)]
+    struct RecordingProgress {
+        events: Mutex<Vec<String>>,
+    }
+
+    impl RecordingProgress {
+        fn events(&self) -> Vec<String> {
+            self.events.lock().expect("events lock").clone()
+        }
+    }
+
+    impl DoctorProgress for RecordingProgress {
+        fn begin(&self, label: &'static str) {
+            self.events
+                .lock()
+                .expect("events lock")
+                .push(format!("begin {label}"));
+        }
+
+        fn heartbeat(&self, label: &'static str, elapsed: Duration) {
+            self.events
+                .lock()
+                .expect("events lock")
+                .push(format!("heartbeat {label} {}", elapsed.as_secs()));
+        }
+
+        fn finish(&self, label: &'static str, status: CheckStatus) {
+            self.events
+                .lock()
+                .expect("events lock")
+                .push(format!("finish {label} {status:?}"));
+        }
+
+        fn settle(&self) {
+            self.events
+                .lock()
+                .expect("events lock")
+                .push("settle".to_string());
+        }
+    }
+
+    fn respond_once(listener: &TcpListener, response: &[u8]) {
+        let (mut stream, _) = listener.accept().expect("accept probe request");
+        let mut request = [0; 1024];
+        let _ = stream.read(&mut request);
+        stream.write_all(response).expect("write response");
+    }
+
+    #[test]
+    fn overall_status_prefers_fail() {
+        let checks = vec![
+            DoctorCheck::new("a", "config", CheckStatus::Warning, "warning"),
+            DoctorCheck::new("b", "auth", CheckStatus::Fail, "fail"),
+        ];
+        assert_eq!(overall_status(&checks), CheckStatus::Fail);
+    }
+
+    #[test]
+    fn run_sync_check_notifies_progress() {
+        let progress_impl = Arc::new(RecordingProgress::default());
+        let progress: Arc<dyn DoctorProgress> = progress_impl.clone();
+
+        let check = run_sync_check("test", progress, || {
+            DoctorCheck::new("test", "test", CheckStatus::Ok, "ok")
+        });
+
+        assert_eq!(check.status, CheckStatus::Ok);
+        assert_eq!(
+            progress_impl.events(),
+            vec!["begin test".to_string(), "finish test Ok".to_string()]
+        );
+    }
+
+    #[tokio::test]
+    async fn run_async_check_notifies_progress() {
+        let progress_impl = Arc::new(RecordingProgress::default());
+        let progress: Arc<dyn DoctorProgress> = progress_impl.clone();
+
+        let check = run_async_check("test", progress, async {
+            DoctorCheck::new("test", "test", CheckStatus::Warning, "warning")
+        })
+        .await;
+
+        assert_eq!(check.status, CheckStatus::Warning);
+        assert_eq!(
+            progress_impl.events(),
+            vec!["begin test".to_string(), "finish test Warning".to_string()]
+        );
+    }
+
+    #[test]
+    fn compare_npm_package_roots_detects_match() {
+        let running = PathBuf::from("/prefix/lib/node_modules/@openai/codex");
+        let npm_root = PathBuf::from("/prefix/lib/node_modules");
+        assert_eq!(
+            compare_npm_package_roots(&running, &npm_root),
+            NpmRootCheck::Match {
+                package_root: npm_root.join("@openai").join("codex")
+            }
+        );
+    }
+
+    #[test]
+    fn compare_npm_package_roots_detects_mismatch() {
+        let running = PathBuf::from("/old/lib/node_modules/@openai/codex");
+        let npm_root = PathBuf::from("/new/lib/node_modules");
+        assert_eq!(
+            compare_npm_package_roots(&running, &npm_root),
+            NpmRootCheck::Mismatch {
+                running_package_root: running,
+                npm_package_root: npm_root.join("@openai").join("codex"),
+            }
+        );
+    }
+
+    #[test]
+    fn config_overrides_from_interactive_preserves_global_options() {
+        let interactive = TuiCli::parse_from([
+            "codex",
+            "--oss",
+            "--local-provider",
+            "ollama",
+            "--model",
+            "llama3.2",
+            "--cd",
+            "/tmp",
+            "--sandbox",
+            "danger-full-access",
+            "--ask-for-approval",
+            "never",
+            "--add-dir",
+            "/var/tmp",
+        ]);
+        let arg0_paths = Arg0DispatchPaths {
+            codex_self_exe: Some(PathBuf::from("/bin/codex")),
+            codex_linux_sandbox_exe: Some(PathBuf::from("/bin/codex-linux-sandbox")),
+            main_execve_wrapper_exe: Some(PathBuf::from("/bin/codex-execve-wrapper")),
+        };
+
+        let overrides = config_overrides_from_interactive(&interactive, &arg0_paths);
+
+        assert_eq!(overrides.model.as_deref(), Some("llama3.2"));
+        assert_eq!(overrides.model_provider.as_deref(), Some("ollama"));
+        assert_eq!(overrides.cwd.as_deref(), Some(Path::new("/tmp")));
+        assert_eq!(overrides.approval_policy, Some(AskForApproval::Never));
+        assert_eq!(overrides.sandbox_mode, Some(SandboxMode::DangerFullAccess));
+        assert_eq!(overrides.show_raw_agent_reasoning, Some(true));
+        assert_eq!(
+            overrides.additional_writable_roots,
+            vec![PathBuf::from("/var/tmp")]
+        );
+        assert_eq!(overrides.codex_self_exe, arg0_paths.codex_self_exe);
+        assert_eq!(
+            overrides.codex_linux_sandbox_exe,
+            arg0_paths.codex_linux_sandbox_exe
+        );
+        assert_eq!(
+            overrides.main_execve_wrapper_exe,
+            arg0_paths.main_execve_wrapper_exe
+        );
+    }
+
+    #[test]
+    fn redacted_json_report_structures_and_sanitizes_details() {
+        let report = DoctorReport {
+            schema_version: 1,
+            generated_at: "0s since unix epoch".to_string(),
+            overall_status: CheckStatus::Warning,
+            codex_version: "0.0.0".to_string(),
+            checks: vec![
+                DoctorCheck::new(
+                    "mcp.config",
+                    "mcp",
+                    CheckStatus::Warning,
+                    "MCP configuration has optional issues",
+                )
+                .detail(
+                    "optional reachability failed: remote: https://user:pass@example.com/mcp?x=abc (connect failed)",
+                )
+                .detail("OPENAI_API_KEY: sk-live-secret")
+                .detail("duplicate: one")
+                .detail("duplicate: two")
+                .detail("freeform note")
+                .issue(
+                    DoctorIssue::new(
+                        CheckStatus::Warning,
+                        "remote https://user:pass@example.com/mcp?x=abc is unreachable",
+                    )
+                    .measured("https://user:pass@example.com/mcp?x=abc")
+                    .expected("reachable MCP endpoint")
+                    .remedy("Check https://user:pass@example.com/help?x=abc.")
+                    .field("optional reachability failed"),
+                )
+                .remediation("Open https://user:pass@example.com/help?x=abc."),
+            ],
+        };
+
+        let redacted_report = redacted_json_report(&report);
+        let redacted = serde_json::to_string(&redacted_report).expect("serialize report");
+        let json = serde_json::to_value(redacted_report).expect("report should serialize");
+
+        assert!(!redacted.contains("user:pass"));
+        assert!(!redacted.contains("x=abc"));
+        assert!(!redacted.contains("sk-live-secret"));
+        assert!(redacted.contains("https://example.com/mcp"));
+        assert_eq!(json["checks"].is_object(), true);
+        assert_eq!(json["checks"]["mcp.config"]["id"], "mcp.config");
+        assert_eq!(
+            json["checks"]["mcp.config"]["details"]["OPENAI_API_KEY"],
+            "<redacted>"
+        );
+        assert_eq!(
+            json["checks"]["mcp.config"]["details"]["duplicate"],
+            serde_json::json!(["one", "two"])
+        );
+        assert_eq!(
+            json["checks"]["mcp.config"]["notes"],
+            serde_json::json!(["freeform note"])
+        );
+        assert_eq!(
+            json["checks"]["mcp.config"]["issues"][0]["measured"],
+            "https://example.com/mcp"
+        );
+        assert_eq!(
+            json["checks"]["mcp.config"]["issues"][0]["remedy"],
+            "Check https://example.com/help."
+        );
+    }
+
+    #[tokio::test]
+    async fn mcp_check_ignores_disabled_servers() {
+        let disabled_server: McpServerConfig = toml::from_str(
+            r#"
+                url = "http://127.0.0.1:9/mcp"
+                enabled = false
+                required = true
+                bearer_token_env_var = "CODEX_DOCTOR_DISABLED_MCP_TOKEN"
+            "#,
+        )
+        .expect("should deserialize disabled MCP config");
+        let servers = HashMap::from([("disabled".to_string(), disabled_server)]);
+
+        let check = mcp_check_from_servers(&servers).await;
+
+        assert_eq!(check.status, CheckStatus::Ok);
+        assert_eq!(check.summary, "MCP configuration is locally consistent");
+        assert!(check.details.contains(&"disabled servers: 1".to_string()));
+        assert!(
+            check
+                .details
+                .iter()
+                .all(|detail| !detail.contains("CODEX_DOCTOR_DISABLED_MCP_TOKEN"))
+        );
+        assert!(
+            check
+                .details
+                .iter()
+                .all(|detail| !detail.contains("reachability failed"))
+        );
+    }
+
+    #[tokio::test]
+    async fn mcp_check_warns_for_optional_http_reachability() {
+        let optional_server: McpServerConfig = toml::from_str(
+            r#"
+                url = "http://127.0.0.1:9/mcp"
+            "#,
+        )
+        .expect("should deserialize optional MCP config");
+        let servers = HashMap::from([("optional".to_string(), optional_server)]);
+
+        let check = mcp_check_from_servers(&servers).await;
+
+        assert_eq!(check.status, CheckStatus::Warning);
+        assert_eq!(check.summary, "MCP configuration has optional issues");
+        assert!(
+            check
+                .details
+                .iter()
+                .any(|detail| detail.contains("optional reachability failed: optional:"))
+        );
+    }
+
+    #[tokio::test]
+    async fn mcp_check_fails_required_remote_stdio_env_var() {
+        let command = toml::Value::String(
+            std::env::current_exe()
+                .expect("current exe")
+                .to_string_lossy()
+                .into_owned(),
+        );
+        let required_server: McpServerConfig = toml::from_str(&format!(
+            r#"
+                command = {command}
+                required = true
+                env_vars = [{{ name = "REMOTE_ONLY_TOKEN", source = "remote" }}]
+            "#,
+        ))
+        .expect("should deserialize required MCP config");
+        let servers = HashMap::from([("required".to_string(), required_server)]);
+
+        let check = mcp_check_from_servers(&servers).await;
+
+        assert_eq!(check.status, CheckStatus::Fail);
+        assert!(check.details.iter().any(|detail| {
+            detail.contains(
+                "required: env_vars entry `REMOTE_ONLY_TOKEN` uses source `remote`, which requires remote MCP stdio",
+            )
+        }));
+    }
+
+    #[test]
+    fn provider_specific_auth_allows_non_openai_provider_without_env_key() {
+        let check = provider_specific_auth_check(
+            /*requires_openai_auth*/ false,
+            /*provider_env_key*/ None,
+            /*provider_env_key_instructions*/ None,
+            Vec::new(),
+            |_| false,
+        )
+        .expect("non-OpenAI provider should produce a provider-specific check");
+
+        assert_eq!(check.status, CheckStatus::Ok);
+        assert_eq!(
+            check.summary,
+            "OpenAI auth is not required for the active model provider"
+        );
+    }
+
+    #[test]
+    fn provider_specific_auth_fails_when_provider_env_key_is_missing() {
+        let check = provider_specific_auth_check(
+            /*requires_openai_auth*/ false,
+            Some("PROVIDER_API_KEY"),
+            Some("Set PROVIDER_API_KEY before running Codex."),
+            Vec::new(),
+            |_| false,
+        )
+        .expect("non-OpenAI provider should produce a provider-specific check");
+
+        assert_eq!(check.status, CheckStatus::Fail);
+        assert_eq!(
+            check.summary,
+            "active model provider auth env var is missing"
+        );
+        assert_eq!(
+            check.remediation,
+            Some("Set PROVIDER_API_KEY before running Codex.".to_string())
+        );
+    }
+
+    #[test]
+    fn stored_auth_validation_rejects_missing_api_key() {
+        let auth = AuthDotJson {
+            auth_mode: Some(codex_app_server_protocol::AuthMode::ApiKey),
+            openai_api_key: None,
+            tokens: None,
+            last_refresh: None,
+            agent_identity: None,
+        };
+
+        assert_eq!(
+            stored_auth_issues(&auth, |_| false),
+            vec!["API key auth is missing an API key"]
+        );
+        assert!(stored_auth_issues(&auth, |name| name == OPENAI_API_KEY_ENV_VAR).is_empty());
+    }
+
+    #[test]
+    fn stored_auth_validation_rejects_missing_chatgpt_tokens() {
+        let auth = AuthDotJson {
+            auth_mode: None,
+            openai_api_key: None,
+            tokens: None,
+            last_refresh: None,
+            agent_identity: None,
+        };
+
+        assert_eq!(
+            stored_auth_issues(&auth, |_| false),
+            vec![
+                "ChatGPT auth is missing token data",
+                "ChatGPT auth is missing refresh metadata",
+            ]
+        );
+    }
+
+    #[test]
+    fn provider_reachability_mode_uses_api_key_auth() {
+        let api_key_auth = AuthDotJson {
+            auth_mode: Some(codex_app_server_protocol::AuthMode::ApiKey),
+            openai_api_key: Some("sk-test".to_string()),
+            tokens: None,
+            last_refresh: None,
+            agent_identity: None,
+        };
+
+        assert_eq!(
+            provider_auth_reachability_mode_from_auth(
+                /*requires_openai_auth*/ true,
+                |_| false,
+                Some(&api_key_auth),
+            ),
+            ProviderAuthReachabilityMode::ApiKey
+        );
+        assert_eq!(
+            provider_auth_reachability_mode_from_auth(
+                /*requires_openai_auth*/ true,
+                |name| name == OPENAI_API_KEY_ENV_VAR,
+                /*stored_auth*/ None,
+            ),
+            ProviderAuthReachabilityMode::ApiKey
+        );
+    }
+
+    #[test]
+    fn provider_reachability_uses_active_provider_endpoint() {
+        assert_eq!(
+            provider_reachability_plan_from_parts(
+                ProviderAuthReachabilityMode::NotRequired,
+                "azure",
+                "azure",
+                Some("https://example.openai.azure.com/openai/v1"),
+                /*provider_query_params*/ None,
+                /*is_amazon_bedrock*/ false,
+                "https://chatgpt.com/backend-api/",
+            ),
+            ReachabilityPlan {
+                description: "provider auth".to_string(),
+                endpoints: vec![ReachabilityEndpoint {
+                    label: "azure API".to_string(),
+                    url: "https://example.openai.azure.com/openai/v1".to_string(),
+                    required: true,
+                    route_probe_url: None,
+                }],
+            }
+        );
+    }
+
+    #[test]
+    fn provider_reachability_adds_models_route_probe_for_openai_compatible_base_urls() {
+        let query_params = HashMap::from([("api-version".to_string(), "2026-01-01".to_string())]);
+
+        assert_eq!(
+            provider_reachability_plan_from_parts(
+                ProviderAuthReachabilityMode::NotRequired,
+                "custom",
+                "Custom",
+                Some("https://example.com/openai/v1/"),
+                Some(&query_params),
+                /*is_amazon_bedrock*/ false,
+                "https://chatgpt.com/backend-api/",
+            ),
+            ReachabilityPlan {
+                description: "provider auth".to_string(),
+                endpoints: vec![ReachabilityEndpoint {
+                    label: "custom API".to_string(),
+                    url: "https://example.com/openai/v1/".to_string(),
+                    required: true,
+                    route_probe_url: Some(
+                        "https://example.com/openai/v1/models?api-version=2026-01-01".to_string()
+                    ),
+                }],
+            }
+        );
+    }
+
+    #[test]
+    fn provider_reachability_skips_route_probe_for_bedrock() {
+        let plan = provider_reachability_plan_from_parts(
+            ProviderAuthReachabilityMode::NotRequired,
+            "amazon-bedrock",
+            "Amazon Bedrock",
+            Some("https://bedrock-runtime.us-east-1.amazonaws.com/openai/v1"),
+            /*provider_query_params*/ None,
+            /*is_amazon_bedrock*/ true,
+            "https://chatgpt.com/backend-api/",
+        );
+
+        assert_eq!(plan.endpoints[0].route_probe_url, None);
+    }
+
+    #[test]
+    fn provider_reachability_api_key_does_not_require_chatgpt() {
+        let plan = provider_reachability_plan_from_parts(
+            ProviderAuthReachabilityMode::ApiKey,
+            "openai",
+            "OpenAI",
+            /*provider_base_url*/ None,
+            /*provider_query_params*/ None,
+            /*is_amazon_bedrock*/ false,
+            "https://chatgpt.com/backend-api/",
+        );
+
+        assert_eq!(
+            plan.endpoints,
+            vec![ReachabilityEndpoint {
+                label: "openai API".to_string(),
+                url: "https://api.openai.com/v1".to_string(),
+                required: true,
+                route_probe_url: Some("https://api.openai.com/v1/models".to_string()),
+            }]
+        );
+    }
+
+    #[test]
+    fn provider_reachability_outcome_reports_required_failures() {
+        assert_eq!(
+            provider_reachability_outcome(/*required_failures*/ 0, /*warnings*/ 1,),
+            (
+                CheckStatus::Warning,
+                "provider endpoint checks returned warnings",
+            )
+        );
+        assert_eq!(
+            provider_reachability_outcome(/*required_failures*/ 1, /*warnings*/ 0,),
+            (
+                CheckStatus::Fail,
+                "one or more required provider endpoints are unreachable over HTTP",
+            )
+        );
+    }
+
+    #[tokio::test]
+    async fn provider_reachability_route_404_fails_bad_base_url_path() {
+        let listener = TcpListener::bind("127.0.0.1:0").expect("bind test listener");
+        let addr = listener.local_addr().expect("listener address");
+        let server = std::thread::spawn(move || {
+            respond_once(
+                &listener,
+                b"HTTP/1.1 404 Not Found\r\nContent-Length: 0\r\nConnection: close\r\n\r\n",
+            );
+            respond_once(
+                &listener,
+                b"HTTP/1.1 404 Not Found\r\nContent-Length: 0\r\nConnection: close\r\n\r\n",
+            );
+        });
+        let plan = provider_reachability_plan_from_parts(
+            ProviderAuthReachabilityMode::ApiKey,
+            "openai",
+            "OpenAI",
+            Some(&format!("http://{addr}/xxxx")),
+            /*provider_query_params*/ None,
+            /*is_amazon_bedrock*/ false,
+            "https://chatgpt.com/backend-api/",
+        );
+
+        let check = provider_reachability_check(plan).await;
+        server.join().expect("probe server thread should finish");
+
+        assert_eq!(check.status, CheckStatus::Fail);
+        assert!(
+            check
+                .details
+                .iter()
+                .any(|detail| detail.contains("route probe:") && detail.contains("HTTP 404"))
+        );
+        assert_eq!(check.issues.len(), 1);
+        assert_eq!(
+            check.issues[0].remedy.as_deref(),
+            Some("Set base_url to the provider API root, for example https://api.openai.com/v1")
+        );
+    }
+
+    #[tokio::test]
+    async fn provider_reachability_route_401_keeps_reachability_ok() {
+        let listener = TcpListener::bind("127.0.0.1:0").expect("bind test listener");
+        let addr = listener.local_addr().expect("listener address");
+        let server = std::thread::spawn(move || {
+            respond_once(
+                &listener,
+                b"HTTP/1.1 404 Not Found\r\nContent-Length: 0\r\nConnection: close\r\n\r\n",
+            );
+            respond_once(
+                &listener,
+                b"HTTP/1.1 401 Unauthorized\r\nContent-Length: 0\r\nConnection: close\r\n\r\n",
+            );
+        });
+        let plan = provider_reachability_plan_from_parts(
+            ProviderAuthReachabilityMode::ApiKey,
+            "openai",
+            "OpenAI",
+            Some(&format!("http://{addr}/v1")),
+            /*provider_query_params*/ None,
+            /*is_amazon_bedrock*/ false,
+            "https://chatgpt.com/backend-api/",
+        );
+
+        let check = provider_reachability_check(plan).await;
+        server.join().expect("probe server thread should finish");
+
+        assert_eq!(check.status, CheckStatus::Ok);
+        assert!(
+            check
+                .details
+                .iter()
+                .any(|detail| detail.contains("route exists (HTTP 401)"))
+        );
+    }
+
+    #[test]
+    fn collect_rollout_stats_counts_nested_rollout_files() {
+        let temp = tempfile::tempdir().expect("create temp dir");
+        let nested = temp
+            .path()
+            .join("sessions")
+            .join("2026")
+            .join("05")
+            .join("13");
+        std::fs::create_dir_all(&nested).expect("create nested rollout dir");
+        std::fs::write(
+            nested.join("rollout-2026-05-13T00-00-00-test.jsonl"),
+            "12345",
+        )
+        .expect("write rollout file");
+        std::fs::write(nested.join("not-a-rollout.jsonl"), "ignored").expect("write ignored jsonl");
+
+        let stats = collect_rollout_stats(&temp.path().join("sessions"));
+
+        assert_eq!(stats.files, 1);
+        assert_eq!(stats.total_bytes, 5);
+        assert_eq!(stats.average_bytes(), 5);
+        assert_eq!(stats.error, None);
+    }
+
+    #[tokio::test]
+    async fn http_probe_treats_http_status_as_reachable() {
+        let listener = TcpListener::bind("127.0.0.1:0").expect("bind test listener");
+        let addr = listener.local_addr().expect("listener address");
+        let server = std::thread::spawn(move || {
+            let (mut stream, _) = listener.accept().expect("accept probe request");
+            let mut request = [0; 1024];
+            let _ = stream.read(&mut request);
+            stream
+                .write_all(
+                    b"HTTP/1.1 405 Method Not Allowed\r\nContent-Length: 0\r\nConnection: close\r\n\r\n",
+                )
+                .expect("write response");
+        });
+
+        let status = http_probe_url(&format!("http://{addr}/mcp")).await;
+        server.join().expect("probe server thread should finish");
+
+        assert_eq!(status, Ok("HTTP 405".to_string()));
+    }
+
+    #[tokio::test]
+    async fn mcp_http_probe_falls_back_to_get_when_head_times_out() {
+        let listener = TcpListener::bind("127.0.0.1:0").expect("bind test listener");
+        let addr = listener.local_addr().expect("listener address");
+        let server = std::thread::spawn(move || {
+            let (mut head_stream, _) = listener.accept().expect("accept HEAD probe request");
+            let head = std::thread::spawn(move || {
+                let mut request = [0; 1024];
+                let _ = head_stream.read(&mut request);
+                std::thread::sleep(Duration::from_millis(50));
+            });
+
+            let (mut get_stream, _) = listener.accept().expect("accept GET probe request");
+            let mut request = [0; 1024];
+            let _ = get_stream.read(&mut request);
+            get_stream
+                .write_all(
+                    b"HTTP/1.1 405 Method Not Allowed\r\nContent-Length: 0\r\nConnection: close\r\n\r\n",
+                )
+                .expect("write response");
+            head.join().expect("HEAD holder should finish");
+        });
+
+        let status = mcp_http_probe_url_with_timeout(
+            &format!("http://{addr}/mcp"),
+            Duration::from_millis(10),
+        )
+        .await;
+        server.join().expect("probe server thread should finish");
+
+        assert_eq!(status, Ok("HTTP 405".to_string()));
+    }
+
+    #[tokio::test]
+    async fn mcp_check_fails_required_missing_stdio_command() {
+        let required_server: McpServerConfig = toml::from_str(
+            r#"
+                command = "definitely-missing-codex-doctor-mcp"
+                required = true
+            "#,
+        )
+        .expect("should deserialize required MCP config");
+        let servers = HashMap::from([("required".to_string(), required_server)]);
+
+        let check = mcp_check_from_servers(&servers).await;
+
+        assert_eq!(check.status, CheckStatus::Fail);
+        assert_eq!(
+            check.summary,
+            "MCP configuration has failing required inputs or reachability"
+        );
+        assert!(check.details.iter().any(|detail| {
+            detail.contains(
+                "required: stdio command \"definitely-missing-codex-doctor-mcp\" is not resolvable",
+            )
+        }));
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn read_probe_file_rejects_unreadable_file() {
+        use std::os::unix::fs::PermissionsExt;
+
+        let file = tempfile::NamedTempFile::new().expect("create temp file");
+        std::fs::write(file.path(), "cert").expect("write temp file");
+        let mut permissions = std::fs::metadata(file.path())
+            .expect("metadata")
+            .permissions();
+        permissions.set_mode(0o000);
+        std::fs::set_permissions(file.path(), permissions).expect("remove read permissions");
+
+        let result = read_probe_file(file.path());
+
+        let mut permissions = std::fs::metadata(file.path())
+            .expect("metadata")
+            .permissions();
+        permissions.set_mode(0o600);
+        std::fs::set_permissions(file.path(), permissions).expect("restore read permissions");
+        assert!(result.is_err());
+    }
+
+    #[cfg(unix)]
+    #[test]
+    fn executable_path_exists_rejects_non_executable_file() {
+        use std::os::unix::fs::PermissionsExt;
+
+        let file = tempfile::NamedTempFile::new().expect("create temp file");
+        std::fs::write(file.path(), "#!/bin/sh\n").expect("write temp file");
+        let mut permissions = std::fs::metadata(file.path())
+            .expect("metadata")
+            .permissions();
+        permissions.set_mode(0o600);
+        std::fs::set_permissions(file.path(), permissions).expect("set non-executable mode");
+
+        let result = executable_path_exists(file.path());
+
+        assert!(result.is_err());
+        let mut permissions = std::fs::metadata(file.path())
+            .expect("metadata")
+            .permissions();
+        permissions.set_mode(0o700);
+        std::fs::set_permissions(file.path(), permissions).expect("set executable mode");
+        assert_eq!(executable_path_exists(file.path()), Ok(()));
+    }
+
+    #[test]
+    fn should_enable_color_respects_terminal_inputs() {
+        assert!(should_enable_color(
+            /*no_color_flag*/ false,
+            /*no_color_env*/ false,
+            Some("xterm-256color"),
+            /*stdout_is_tty*/ true,
+            /*stream_supports_color*/ true,
+        ));
+        assert!(!should_enable_color(
+            /*no_color_flag*/ true,
+            /*no_color_env*/ false,
+            Some("xterm-256color"),
+            /*stdout_is_tty*/ true,
+            /*stream_supports_color*/ true,
+        ));
+        assert!(!should_enable_color(
+            /*no_color_flag*/ false,
+            /*no_color_env*/ true,
+            Some("xterm-256color"),
+            /*stdout_is_tty*/ true,
+            /*stream_supports_color*/ true,
+        ));
+        assert!(!should_enable_color(
+            /*no_color_flag*/ false,
+            /*no_color_env*/ false,
+            Some("dumb"),
+            /*stdout_is_tty*/ true,
+            /*stream_supports_color*/ true,
+        ));
+        assert!(!should_enable_color(
+            /*no_color_flag*/ false,
+            /*no_color_env*/ false,
+            Some("xterm-256color"),
+            /*stdout_is_tty*/ false,
+            /*stream_supports_color*/ true,
+        ));
+    }
+
+    fn terminal_inputs() -> TerminalCheckInputs {
+        TerminalCheckInputs {
+            info: TerminalInfo {
+                name: TerminalName::Unknown,
+                term_program: None,
+                version: None,
+                term: Some("xterm-256color".to_string()),
+                multiplexer: None,
+            },
+            env: BTreeMap::from([("TERM".to_string(), "xterm-256color".to_string())]),
+            present_env: BTreeSet::from(["TERM".to_string()]),
+            no_color_flag: false,
+            stdin_is_terminal: true,
+            stdout_is_terminal: true,
+            stderr_is_terminal: true,
+            stream_supports_color: true,
+            terminal_size: Ok((120, 40)),
+            tmux_details: Vec::new(),
+        }
+    }
+
+    fn set_terminal_env(inputs: &mut TerminalCheckInputs, name: &str, value: &str) {
+        inputs.present_env.insert(name.to_string());
+        if value.is_empty() {
+            inputs.env.remove(name);
+        } else {
+            inputs.env.insert(name.to_string(), value.to_string());
+        }
+    }
+
+    #[test]
+    fn terminal_check_warns_for_dumb_terminal() {
+        let mut inputs = terminal_inputs();
+        inputs.info.name = TerminalName::Dumb;
+        inputs.info.term = Some("dumb".to_string());
+        set_terminal_env(&mut inputs, "TERM", "dumb");
+
+        let check = terminal_check_from_inputs(inputs);
+
+        assert_eq!(check.status, CheckStatus::Fail);
+        assert_eq!(
+            check.summary,
+            "TERM=dumb - colors and cursor control are disabled"
+        );
+        assert_eq!(check.issues.len(), 1);
+        assert_eq!(
+            check.issues[0].remedy.as_deref(),
+            Some("set TERM to a real value, for example xterm-256color")
+        );
+    }
+
+    #[test]
+    fn terminal_check_warns_for_narrow_terminal() {
+        let mut inputs = terminal_inputs();
+        inputs.terminal_size = Ok((79, 24));
+
+        let check = terminal_check_from_inputs(inputs);
+
+        assert_eq!(check.status, CheckStatus::Warning);
+        assert_eq!(
+            check.summary,
+            "width 79 cols - output may wrap (recommended >=80)"
+        );
+        assert_eq!(check.issues[0].expected.as_deref(), Some(">= 80 columns"));
+        assert_eq!(
+            check.issues[0].remedy.as_deref(),
+            Some("resize the window to at least 80 columns")
+        );
+    }
+
+    #[test]
+    fn terminal_check_warns_for_declared_narrow_terminal() {
+        let mut inputs = terminal_inputs();
+        set_terminal_env(&mut inputs, "COLUMNS", "60");
+
+        let check = terminal_check_from_inputs(inputs);
+
+        assert_eq!(check.status, CheckStatus::Warning);
+        assert_eq!(
+            check.summary,
+            "COLUMNS=60 - output may wrap (recommended >=80)"
+        );
+        assert!(check.details.contains(&"COLUMNS: 60".to_string()));
+        assert_eq!(check.issues[0].fields, vec!["COLUMNS".to_string()]);
+    }
+
+    #[test]
+    fn terminal_check_warns_for_non_utf8_locale() {
+        let mut inputs = terminal_inputs();
+        set_terminal_env(&mut inputs, "LANG", "C");
+
+        let check = terminal_check_from_inputs(inputs);
+
+        assert_eq!(check.status, CheckStatus::Warning);
+        assert_eq!(
+            check.summary,
+            "locale is not UTF-8 - unicode glyphs may render incorrectly"
+        );
+        assert!(check.details.contains(&"effective locale: C".to_string()));
+        assert_eq!(
+            check.issues[0].remedy.as_deref(),
+            Some("export LANG=en_US.UTF-8 or another UTF-8 locale")
+        );
+    }
+
+    #[test]
+    fn terminal_check_warns_for_unreadable_terminfo_path() {
+        let tempdir = tempfile::tempdir().expect("create tempdir");
+        let missing = tempdir.path().join("missing-terminfo");
+        let mut inputs = terminal_inputs();
+        set_terminal_env(&mut inputs, "TERMINFO", &missing.to_string_lossy());
+
+        let check = terminal_check_from_inputs(inputs);
+
+        assert_eq!(check.status, CheckStatus::Fail);
+        assert_eq!(
+            check.summary,
+            "TERMINFO unreadable - terminal capabilities are unknown"
+        );
+        assert!(
+            check
+                .details
+                .iter()
+                .any(|detail| detail.starts_with("TERMINFO: ") && detail.ends_with(" (missing)"))
+        );
+        assert_eq!(
+            check.issues[0].remedy.as_deref(),
+            Some("check that $TERMINFO points to a readable directory")
+        );
+    }
+
+    #[test]
+    fn terminal_check_reports_remote_indicators_as_present_only() {
+        let mut inputs = terminal_inputs();
+        set_terminal_env(&mut inputs, "SSH_CONNECTION", "10.0.0.1 1 10.0.0.2 22");
+
+        let check = terminal_check_from_inputs(inputs);
+
+        assert!(
+            check
+                .details
+                .contains(&"SSH_CONNECTION: present".to_string())
+        );
+        assert!(
+            !check
+                .details
+                .iter()
+                .any(|detail| detail.contains("10.0.0.1"))
+        );
+    }
+
+    #[test]
+    fn terminal_check_keeps_tmux_probe_failures_non_fatal() {
+        let mut inputs = terminal_inputs();
+        inputs.info.multiplexer = Some(Multiplexer::Tmux { version: None });
+
+        let check = terminal_check_from_inputs(inputs);
+
+        assert_eq!(check.status, CheckStatus::Ok);
+        assert_eq!(check.summary, "terminal metadata was detected");
+    }
+
+    #[test]
+    fn color_output_summary_reports_disabled_reasons() {
+        let mut inputs = terminal_inputs();
+        inputs.no_color_flag = true;
+        assert_eq!(color_output_summary(&inputs), "disabled (--no-color)");
+
+        inputs = terminal_inputs();
+        set_terminal_env(&mut inputs, "NO_COLOR", "");
+        assert_eq!(color_output_summary(&inputs), "disabled (NO_COLOR)");
+
+        inputs = terminal_inputs();
+        inputs.info.term = Some("dumb".to_string());
+        set_terminal_env(&mut inputs, "TERM", "dumb");
+        assert_eq!(color_output_summary(&inputs), "disabled (TERM=dumb)");
+
+        inputs = terminal_inputs();
+        inputs.stdout_is_terminal = false;
+        assert_eq!(
+            color_output_summary(&inputs),
+            "disabled (stdout is not a terminal)"
+        );
+    }
+}
diff --git a/codex-rs/cli/src/doctor/background.rs b/codex-rs/cli/src/doctor/background.rs
new file mode 100644
index 0000000000..0ec5132cd3
--- /dev/null
+++ b/codex-rs/cli/src/doctor/background.rs
@@ -0,0 +1,150 @@
+//! Reports app-server daemon state without starting or stopping the daemon.
+//!
+//! The background-server check is deliberately passive. It reads the daemon
+//! state directory, PID files, settings file, and control socket path, then
+//! attempts only a local socket connection when a socket already exists. That
+//! keeps doctor safe to run while the user is debugging startup or update-loop
+//! issues.
+
+use std::path::Path;
+
+use codex_core::config::Config;
+
+use super::CheckStatus;
+use super::DoctorCheck;
+
+const STATE_DIR_NAME: &str = "app-server-daemon";
+const SETTINGS_FILE_NAME: &str = "settings.json";
+const PID_FILE_NAME: &str = "app-server.pid";
+const UPDATE_PID_FILE_NAME: &str = "app-server-updater.pid";
+
+/// Builds the app-server status row from existing daemon state.
+///
+/// Missing files are expected for the ephemeral/not-running case and should not
+/// be treated as failures. A stale socket is a warning because it can explain
+/// client connection problems without proving the daemon itself is broken.
+pub(super) fn background_server_check(config: &Config) -> DoctorCheck {
+    let mut details = Vec::new();
+    let state_dir = config.codex_home.join(STATE_DIR_NAME);
+    details.push(format!("daemon state dir: {}", state_dir.display()));
+    push_file_detail(
+        &mut details,
+        "settings",
+        &state_dir.join(SETTINGS_FILE_NAME),
+    );
+    push_file_detail(&mut details, "pid file", &state_dir.join(PID_FILE_NAME));
+    push_file_detail(
+        &mut details,
+        "update-loop pid file",
+        &state_dir.join(UPDATE_PID_FILE_NAME),
+    );
+
+    let socket_path = match codex_app_server::app_server_control_socket_path(&config.codex_home) {
+        Ok(socket_path) => socket_path,
+        Err(err) => {
+            return DoctorCheck::new(
+                "app_server.status",
+                "app-server",
+                CheckStatus::Warning,
+                "background server socket path could not be resolved",
+            )
+            .details(details)
+            .detail(err.to_string());
+        }
+    };
+
+    details.push(format!("control socket: {}", socket_path.display()));
+    let status = socket_status(socket_path.as_path());
+    details.push(format!("status: {}", status.detail_label()));
+    details.push(format!("mode: {}", server_mode(&state_dir)));
+
+    let mut check = DoctorCheck::new(
+        "app_server.status",
+        "app-server",
+        status.check_status(),
+        status.summary(),
+    )
+    .details(details);
+    if status.check_status() == CheckStatus::Warning {
+        check = check.remediation("Run codex app-server daemon version for more details.");
+    }
+    check
+}
+
+fn push_file_detail(details: &mut Vec<String>, label: &str, path: &Path) {
+    match std::fs::metadata(path) {
+        Ok(metadata) if metadata.is_file() => {
+            details.push(format!("{label}: {} (file)", path.display()));
+        }
+        Ok(_) => {
+            details.push(format!("{label}: {} (not a file)", path.display()));
+        }
+        Err(err) if err.kind() == std::io::ErrorKind::NotFound => {
+            details.push(format!("{label}: {} (missing)", path.display()));
+        }
+        Err(err) => details.push(format!("{label}: {} ({err})", path.display())),
+    }
+}
+
+fn server_mode(state_dir: &Path) -> &'static str {
+    if state_dir.join(SETTINGS_FILE_NAME).is_file() {
+        "persistent"
+    } else {
+        "ephemeral"
+    }
+}
+
+#[derive(Clone, Copy)]
+enum SocketStatus {
+    NotRunning,
+    Running,
+    #[cfg(unix)]
+    StaleOrUnreachable,
+}
+
+impl SocketStatus {
+    fn check_status(self) -> CheckStatus {
+        match self {
+            Self::NotRunning | Self::Running => CheckStatus::Ok,
+            #[cfg(unix)]
+            Self::StaleOrUnreachable => CheckStatus::Warning,
+        }
+    }
+
+    fn summary(self) -> &'static str {
+        match self {
+            Self::NotRunning => "background server is not running",
+            Self::Running => "background server is running",
+            #[cfg(unix)]
+            Self::StaleOrUnreachable => "background server socket is stale or unreachable",
+        }
+    }
+
+    fn detail_label(self) -> &'static str {
+        match self {
+            Self::NotRunning => "not running",
+            Self::Running => "running",
+            #[cfg(unix)]
+            Self::StaleOrUnreachable => "stale or unreachable",
+        }
+    }
+}
+
+fn socket_status(socket_path: &Path) -> SocketStatus {
+    if !socket_path.exists() {
+        return SocketStatus::NotRunning;
+    }
+
+    #[cfg(unix)]
+    {
+        match std::os::unix::net::UnixStream::connect(socket_path) {
+            Ok(_) => SocketStatus::Running,
+            Err(_) => SocketStatus::StaleOrUnreachable,
+        }
+    }
+
+    #[cfg(not(unix))]
+    {
+        SocketStatus::Running
+    }
+}
diff --git a/codex-rs/cli/src/doctor/output.rs b/codex-rs/cli/src/doctor/output.rs
new file mode 100644
index 0000000000..2e58b1136a
--- /dev/null
+++ b/codex-rs/cli/src/doctor/output.rs
@@ -0,0 +1,1559 @@
+//! Renders doctor reports for terminal users.
+//!
+//! The renderer is intentionally separate from check construction so the JSON
+//! report can stay stable while the human view optimizes for scanability. It
+//! groups checks by concern, colors only status/actionable tokens, and redacts
+//! sensitive detail lines before showing them in detailed output.
+
+mod detail;
+
+use std::fmt::Write as _;
+
+use detail::HumanDetail;
+use detail::detail_lines;
+use owo_colors::OwoColorize;
+use owo_colors::XtermColors;
+
+use super::CheckStatus;
+use super::DoctorCheck;
+use super::DoctorReport;
+
+const NAME_WIDTH: usize = 12;
+const DETAIL_LABEL_WIDTH: usize = 24;
+const SEPARATOR_WIDTH: usize = 61;
+
+const GROUPS: &[OutputGroup] = &[
+    OutputGroup {
+        title: "Environment",
+        keys: &["runtime", "install", "search", "terminal", "state"],
+    },
+    OutputGroup {
+        title: "Configuration",
+        keys: &["config", "auth", "mcp", "sandbox"],
+    },
+    OutputGroup {
+        title: "Updates",
+        keys: &["updates"],
+    },
+    OutputGroup {
+        title: "Connectivity",
+        keys: &["network", "websocket", "reachability"],
+    },
+    OutputGroup {
+        title: "Background Server",
+        keys: &["app-server"],
+    },
+];
+
+struct OutputGroup {
+    title: &'static str,
+    keys: &'static [&'static str],
+}
+
+/// Rendering controls for human doctor output.
+///
+/// These options affect presentation only. They must not change which checks
+/// run or which fields are present in the underlying JSON report.
+#[derive(Clone, Copy, Debug)]
+pub(super) struct HumanOutputOptions {
+    pub(super) show_details: bool,
+    pub(super) show_all: bool,
+    pub(super) ascii: bool,
+    pub(super) color_enabled: bool,
+}
+
+/// Formats a doctor report into the grouped terminal layout.
+///
+/// The renderer expects checks to carry stable categories, but it owns their
+/// display order. Adding a new category without adding it to GROUPS keeps JSON
+/// output intact but hides that row from the human view.
+pub(super) fn render_human_report(report: &DoctorReport, options: HumanOutputOptions) -> String {
+    let mut out = String::new();
+    let _ = writeln!(
+        out,
+        "{} {}",
+        bold("Codex Doctor", options),
+        dim(&header_suffix(report), options)
+    );
+    out.push('\n');
+
+    let notes = notes_for_report(report);
+    if !notes.is_empty() {
+        let _ = writeln!(out, "{}", bold("Notes", options));
+        for note in &notes {
+            write_note_row(&mut out, note, options);
+        }
+        let _ = writeln!(out, "{}", dim(&separator(options), options));
+        out.push('\n');
+    }
+
+    let mut wrote_group = false;
+    for group in GROUPS {
+        let group_checks = checks_for_group(report, group);
+        if group_checks.is_empty() {
+            continue;
+        }
+
+        if wrote_group {
+            out.push('\n');
+        }
+        wrote_group = true;
+
+        let _ = writeln!(out, "{}", bold(group.title, options));
+        for check in group_checks {
+            write_check_row(&mut out, check, options);
+        }
+    }
+
+    out.push('\n');
+    let _ = writeln!(out, "{}", dim(&separator(options), options));
+    let _ = writeln!(out, "{}", summary_line(report, options));
+    out.push('\n');
+    write_footer(&mut out, options);
+    out
+}
+
+fn checks_for_group<'a>(report: &'a DoctorReport, group: &OutputGroup) -> Vec<&'a DoctorCheck> {
+    group
+        .keys
+        .iter()
+        .flat_map(|key| {
+            report
+                .checks
+                .iter()
+                .filter(move |check| check.category == *key)
+        })
+        .collect()
+}
+
+fn write_check_row(out: &mut String, check: &DoctorCheck, options: HumanOutputOptions) {
+    let description = row_description(check, options);
+    let status = display_status(check);
+    let _ = writeln!(
+        out,
+        "  {}{} {}",
+        status_marker_slot(status, options),
+        format_args!("{:<NAME_WIDTH$}", check.category),
+        style_description(&description, status, options)
+    );
+
+    if options.show_details {
+        for detail in detail_lines(check, options) {
+            write_detail_line(out, detail, options);
+        }
+    }
+}
+
+fn write_note_row(out: &mut String, note: &DoctorNote, options: HumanOutputOptions) {
+    let _ = writeln!(
+        out,
+        "   {}{} {}",
+        status_marker_slot(note.status, options),
+        format_args!("{:<NAME_WIDTH$}", note.name),
+        style_note_summary(note, options)
+    );
+}
+
+fn write_detail_line(out: &mut String, detail: HumanDetail, options: HumanOutputOptions) {
+    match detail {
+        HumanDetail::Row {
+            label,
+            value,
+            expected,
+        } => {
+            let is_issue = expected.is_some();
+            let label = format!("{label:<DETAIL_LABEL_WIDTH$}");
+            let value = if let Some(expected) = expected {
+                format!(
+                    "{} {}",
+                    detail_value(&value, options),
+                    dim(&format!("(expected {expected})"), options)
+                )
+            } else {
+                detail_value(&value, options)
+            };
+            let _ = writeln!(
+                out,
+                "    {} {} {}",
+                detail_marker(is_issue, options),
+                detail_label(&label, options),
+                value
+            );
+        }
+        HumanDetail::Continuation(value) => {
+            let spacer = " ".repeat(DETAIL_LABEL_WIDTH);
+            let _ = writeln!(
+                out,
+                "      {} {}",
+                detail_label(&spacer, options),
+                detail_value(&value, options)
+            );
+        }
+        HumanDetail::Bullet(value) => {
+            let _ = writeln!(
+                out,
+                "    {} {}",
+                very_dim(if options.ascii { "-" } else { "·" }, options),
+                dim(&highlight_actions(&value, options), options)
+            );
+        }
+        HumanDetail::Remedy(value) => {
+            let marker = if options.ascii { "->" } else { "→" };
+            let _ = writeln!(
+                out,
+                "    {} {}",
+                orange(marker, options),
+                highlight_actions(&value, options)
+            );
+        }
+    }
+}
+
+fn row_description(check: &DoctorCheck, options: HumanOutputOptions) -> String {
+    if matches!(check.status, CheckStatus::Warning | CheckStatus::Fail) && !check.issues.is_empty()
+    {
+        return issue_summary(check);
+    }
+    if matches!(check.status, CheckStatus::Warning | CheckStatus::Fail)
+        && let Some(remediation) = &check.remediation
+    {
+        let dash = if options.ascii { " - " } else { " — " };
+        let summary = &check.summary;
+        return format!("{summary}{dash}{remediation}");
+    }
+
+    display_summary(check, options)
+}
+
+fn issue_summary(check: &DoctorCheck) -> String {
+    match check.issues.as_slice() {
+        [] => check.summary.clone(),
+        [issue] => issue.cause.clone(),
+        issues => format!(
+            "{} issues - {}",
+            issues.len(),
+            issues
+                .iter()
+                .take(2)
+                .map(|issue| issue.cause.as_str())
+                .collect::<Vec<_>>()
+                .join("; ")
+        ),
+    }
+}
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+enum DisplayStatus {
+    Ok,
+    Update,
+    Note,
+    Warning,
+    Fail,
+    Idle,
+}
+
+struct DoctorNote {
+    status: DisplayStatus,
+    name: String,
+    summary: String,
+}
+
+fn display_status(check: &DoctorCheck) -> DisplayStatus {
+    if check.category == "app-server"
+        && check.status == CheckStatus::Ok
+        && check
+            .details
+            .iter()
+            .any(|detail| detail == "status: not running")
+    {
+        return DisplayStatus::Idle;
+    }
+
+    match check.status {
+        CheckStatus::Ok => DisplayStatus::Ok,
+        CheckStatus::Warning => DisplayStatus::Warning,
+        CheckStatus::Fail => DisplayStatus::Fail,
+    }
+}
+
+fn status_marker(status: DisplayStatus, options: HumanOutputOptions) -> String {
+    let marker = if options.ascii {
+        match status {
+            DisplayStatus::Ok => "[ok]",
+            DisplayStatus::Update => "[up]",
+            DisplayStatus::Note | DisplayStatus::Warning => "[!!]",
+            DisplayStatus::Fail => "[XX]",
+            DisplayStatus::Idle => "[--]",
+        }
+    } else {
+        match status {
+            DisplayStatus::Ok => "✓",
+            DisplayStatus::Update => "↑",
+            DisplayStatus::Note | DisplayStatus::Warning => "⚠",
+            DisplayStatus::Fail => "✗",
+            DisplayStatus::Idle => "○",
+        }
+    };
+
+    match status {
+        DisplayStatus::Ok => green(marker, options),
+        DisplayStatus::Update => amber(marker, options),
+        DisplayStatus::Note | DisplayStatus::Warning => orange(marker, options),
+        DisplayStatus::Fail => red(marker, options),
+        DisplayStatus::Idle => dim(marker, options),
+    }
+}
+
+fn status_marker_slot(status: DisplayStatus, options: HumanOutputOptions) -> String {
+    let marker = status_marker(status, options);
+    format!("{marker} ")
+}
+
+fn style_description(
+    description: &str,
+    status: DisplayStatus,
+    options: HumanOutputOptions,
+) -> String {
+    let highlighted = highlight_actions(description, options);
+    match status {
+        DisplayStatus::Ok | DisplayStatus::Idle => dim(&highlighted, options),
+        DisplayStatus::Update => amber(&highlighted, options),
+        DisplayStatus::Note | DisplayStatus::Warning | DisplayStatus::Fail => highlighted,
+    }
+}
+
+fn detail_marker(is_issue: bool, options: HumanOutputOptions) -> String {
+    if !is_issue {
+        return " ".to_string();
+    }
+    orange(if options.ascii { ">" } else { "▸" }, options)
+}
+
+fn style_note_summary(note: &DoctorNote, options: HumanOutputOptions) -> String {
+    if note.status == DisplayStatus::Update {
+        return style_update_note_summary(&note.summary, options);
+    }
+    style_description(&note.summary, note.status, options)
+}
+
+fn style_update_note_summary(summary: &str, options: HumanOutputOptions) -> String {
+    if !options.color_enabled {
+        return summary.to_string();
+    }
+
+    let Some((version, rest)) = summary.split_once(" available") else {
+        return amber(summary, options);
+    };
+    let Some((action, parenthetical)) = rest.split_once(" (") else {
+        return format!(
+            "{}{}",
+            amber(&format!("{version} available"), options),
+            amber(rest, options)
+        );
+    };
+    format!(
+        "{}{} {}",
+        amber(&format!("{version} available"), options),
+        amber(action, options),
+        dim(&format!("({parenthetical}"), options)
+    )
+}
+
+fn summary_line(report: &DoctorReport, options: HumanOutputOptions) -> String {
+    let notes = notes_for_report(report);
+    let counts = StatusCounts::from_report(report, notes.len());
+    let separator = dim(if options.ascii { " | " } else { " · " }, options);
+    let status = overall_status_label(report.overall_status);
+    let mut parts = vec![count_label(counts.ok, "ok", DisplayStatus::Ok, options)];
+    if counts.idle > 0 {
+        parts.push(count_label(
+            counts.idle,
+            "idle",
+            DisplayStatus::Idle,
+            options,
+        ));
+    }
+    if counts.notes > 0 {
+        parts.push(count_label(
+            counts.notes,
+            "notes",
+            DisplayStatus::Note,
+            options,
+        ));
+    }
+    parts.push(count_label(
+        counts.warning,
+        "warn",
+        DisplayStatus::Warning,
+        options,
+    ));
+    parts.push(count_label(
+        counts.fail,
+        "fail",
+        DisplayStatus::Fail,
+        options,
+    ));
+    format!(
+        "{} {}",
+        parts.join(&separator),
+        styled_overall_status(status, report.overall_status, options)
+    )
+}
+
+fn count_label(
+    count: usize,
+    label: &str,
+    status: DisplayStatus,
+    options: HumanOutputOptions,
+) -> String {
+    let count = dim(&count.to_string(), options);
+    let label = match status {
+        DisplayStatus::Ok => green(label, options),
+        DisplayStatus::Update => amber(label, options),
+        DisplayStatus::Note | DisplayStatus::Warning => orange(label, options),
+        DisplayStatus::Fail => red(label, options),
+        DisplayStatus::Idle => dim(label, options),
+    };
+    format!("{count} {label}")
+}
+
+fn overall_status_label(status: CheckStatus) -> &'static str {
+    match status {
+        CheckStatus::Ok => "ok",
+        CheckStatus::Warning => "degraded",
+        CheckStatus::Fail => "failed",
+    }
+}
+
+fn styled_overall_status(label: &str, status: CheckStatus, options: HumanOutputOptions) -> String {
+    if !options.color_enabled {
+        return label.to_string();
+    }
+
+    match status {
+        CheckStatus::Ok => label.green().bold().to_string(),
+        CheckStatus::Warning => label.yellow().bold().to_string(),
+        CheckStatus::Fail => label.red().bold().to_string(),
+    }
+}
+
+fn write_footer(out: &mut String, options: HumanOutputOptions) {
+    if options.show_details {
+        let _ = writeln!(
+            out,
+            "{} {:<24} {} {}",
+            cyan("--summary", options),
+            dim("compact output", options),
+            cyan("--all", options),
+            dim("expand truncated lists", options)
+        );
+    } else {
+        let _ = writeln!(
+            out,
+            "{}",
+            dim(
+                "Run codex doctor without --summary for detailed diagnostics.",
+                options
+            )
+        );
+        let _ = writeln!(
+            out,
+            "{} {:<28} {} {}",
+            cyan("--all", options),
+            dim("expand truncated lists", options),
+            cyan("--json", options),
+            dim("redacted report", options)
+        );
+        return;
+    }
+    let _ = writeln!(
+        out,
+        "{} {}",
+        cyan("--json", options),
+        dim("redacted report", options)
+    );
+}
+
+fn header_suffix(report: &DoctorReport) -> String {
+    let version = format!("v{}", report.codex_version);
+    report
+        .checks
+        .iter()
+        .find(|check| check.category == "runtime")
+        .and_then(|check| detail::detail_value(check, "platform"))
+        .map_or(version.clone(), |platform| {
+            format!("{version} · {platform}")
+        })
+}
+
+fn notes_for_report(report: &DoctorReport) -> Vec<DoctorNote> {
+    let mut notes = Vec::new();
+    if let Some(check) = find_check(report, "updates") {
+        update_note(check, report)
+            .into_iter()
+            .for_each(|note| notes.push(note));
+    }
+    if let Some(check) = find_check(report, "state") {
+        rollout_note(check)
+            .into_iter()
+            .for_each(|note| notes.push(note));
+    }
+    if let Some(check) = find_check(report, "sandbox") {
+        sandbox_note(check)
+            .into_iter()
+            .for_each(|note| notes.push(note));
+    }
+    non_ok_notes(report)
+        .into_iter()
+        .for_each(|note| notes.push(note));
+    auth_reachability_note(report)
+        .into_iter()
+        .for_each(|note| notes.push(note));
+    notes
+}
+
+fn find_check<'a>(report: &'a DoctorReport, category: &str) -> Option<&'a DoctorCheck> {
+    report
+        .checks
+        .iter()
+        .find(|check| check.category == category)
+}
+
+fn update_note(check: &DoctorCheck, report: &DoctorReport) -> Option<DoctorNote> {
+    let status = detail::detail_value(check, "latest version status")?;
+    if !status.contains("newer version is available") {
+        return None;
+    }
+    let latest = detail::detail_value(check, "latest version")
+        .or_else(|| detail::detail_value(check, "cached latest version"))
+        .unwrap_or_else(|| "newer version".to_string());
+    let dismissed = detail::detail_value(check, "dismissed version");
+    let mut parenthetical = format!("current {}", report.codex_version);
+    if let Some(dismissed) = dismissed
+        && !detail::is_falsy(&dismissed)
+    {
+        parenthetical.push_str(&format!(", dismissed {dismissed}"));
+    }
+    Some(DoctorNote {
+        status: DisplayStatus::Update,
+        name: "updates".to_string(),
+        summary: format!("{latest} available ({parenthetical})"),
+    })
+}
+
+fn rollout_note(check: &DoctorCheck) -> Option<DoctorNote> {
+    let active = detail::detail_value(check, "active rollout files")?;
+    let (files, bytes) = detail::rollout_files_and_bytes(&active)?;
+    if files < 1000 && bytes < 1024 * 1024 * 1024 {
+        return None;
+    }
+    Some(DoctorNote {
+        status: DisplayStatus::Warning,
+        name: "rollouts".to_string(),
+        summary: format!(
+            "{} active files · {} on disk",
+            detail::format_count(files),
+            detail::format_bytes(bytes)
+        ),
+    })
+}
+
+fn sandbox_note(check: &DoctorCheck) -> Option<DoctorNote> {
+    let filesystem = detail::detail_value(check, "filesystem sandbox")?;
+    let network = detail::detail_value(check, "network sandbox")?;
+    if filesystem == "restricted" && network == "restricted" {
+        return None;
+    }
+    Some(DoctorNote {
+        status: DisplayStatus::Warning,
+        name: "sandbox".to_string(),
+        summary: format!("filesystem {filesystem} · network {network}"),
+    })
+}
+
+fn non_ok_notes(report: &DoctorReport) -> Vec<DoctorNote> {
+    report
+        .checks
+        .iter()
+        .filter(|check| matches!(check.status, CheckStatus::Warning | CheckStatus::Fail))
+        .map(|check| DoctorNote {
+            status: display_status(check),
+            name: check.category.clone(),
+            summary: actionable_note_summary(check),
+        })
+        .collect()
+}
+
+fn actionable_note_summary(check: &DoctorCheck) -> String {
+    if !check.issues.is_empty() {
+        return issue_summary(check);
+    }
+    if let Some(remediation) = &check.remediation {
+        return format!("{} - {remediation}", check.summary);
+    }
+    check.summary.clone()
+}
+
+fn auth_reachability_note(report: &DoctorReport) -> Option<DoctorNote> {
+    let websocket = find_check(report, "websocket")?;
+    let reachability = find_check(report, "reachability")?;
+    let auth_mode = detail::detail_value(websocket, "auth mode")?;
+    let reachability_mode = detail::detail_value(reachability, "reachability mode")?;
+    let auth_mode_lower = auth_mode.to_ascii_lowercase();
+    let reachability_mode_lower = reachability_mode.to_ascii_lowercase();
+    if auth_mode_lower.contains("chatgpt") && reachability_mode_lower.contains("api key") {
+        return Some(DoctorNote {
+            status: DisplayStatus::Warning,
+            name: "auth".to_string(),
+            summary: "mixed auth signals: ChatGPT login plus API key env var; HTTP reachability uses API-key mode".to_string(),
+        });
+    }
+    None
+}
+
+fn display_summary(check: &DoctorCheck, _options: HumanOutputOptions) -> String {
+    match check.category.as_str() {
+        "runtime" => runtime_summary(check),
+        "install" if check.status == CheckStatus::Ok => "consistent".to_string(),
+        "search" => search_summary(check),
+        "terminal" => terminal_summary(check),
+        "state" => state_summary(check),
+        "config" if check.status == CheckStatus::Ok => "loaded".to_string(),
+        "mcp" => mcp_summary(check),
+        "sandbox" => sandbox_summary(check),
+        "network" => network_summary(check),
+        "websocket" => websocket_summary(check),
+        "app-server" => app_server_summary(check),
+        _ => check.summary.clone(),
+    }
+}
+
+fn runtime_summary(check: &DoctorCheck) -> String {
+    if detail::detail_value(check, "current executable")
+        .is_some_and(|path| path.contains("/target/debug/"))
+    {
+        return "local debug build".to_string();
+    }
+    detail::detail_value(check, "install method").unwrap_or_else(|| check.summary.clone())
+}
+
+fn search_summary(check: &DoctorCheck) -> String {
+    let provider = detail::detail_value(check, "search provider");
+    let command = detail::detail_value(check, "search command");
+    let readiness = detail::detail_value(check, "search command readiness");
+    match (readiness, provider, command) {
+        (Some(readiness), Some(provider), Some(command)) if check.status == CheckStatus::Ok => {
+            format!("{readiness} ({provider}, `{command}`)")
+        }
+        _ => check.summary.clone(),
+    }
+}
+
+fn terminal_summary(check: &DoctorCheck) -> String {
+    let mut parts = Vec::new();
+    if let Some(terminal) = detail::detail_value(check, "terminal") {
+        let version = detail::detail_value(check, "terminal version");
+        parts.push(version.map_or(terminal.clone(), |version| format!("{terminal} {version}")));
+    }
+    if let Some(multiplexer) = detail::detail_value(check, "multiplexer") {
+        parts.push(multiplexer);
+    }
+    if let Some(term) = detail::detail_value(check, "TERM") {
+        parts.push(format!("TERM={term}"));
+    }
+    if parts.is_empty() {
+        check.summary.clone()
+    } else {
+        parts.join(" · ")
+    }
+}
+
+fn state_summary(check: &DoctorCheck) -> String {
+    let databases_ok = [
+        "state DB integrity",
+        "log DB integrity",
+        "goals DB integrity",
+    ]
+    .into_iter()
+    .all(|label| detail::detail_value(check, label).is_some_and(|value| value == "ok"));
+    if check.status == CheckStatus::Ok && databases_ok {
+        "databases healthy".to_string()
+    } else {
+        check.summary.clone()
+    }
+}
+
+fn mcp_summary(check: &DoctorCheck) -> String {
+    let Some(count) = detail::detail_value(check, "configured servers") else {
+        return check.summary.clone();
+    };
+    let disabled =
+        detail::detail_value(check, "disabled servers").unwrap_or_else(|| "0".to_string());
+    let transports = check
+        .details
+        .iter()
+        .filter_map(|detail| detail.split_once(" servers: "))
+        .filter(|(transport, _)| *transport != "configured" && *transport != "disabled")
+        .map(|(transport, count)| format!("{count} {transport}"))
+        .collect::<Vec<_>>();
+    if transports.is_empty() {
+        format!("{count} servers · {disabled} disabled")
+    } else {
+        format!(
+            "{} server ({}) · {} disabled",
+            count,
+            transports.join(", "),
+            disabled
+        )
+    }
+}
+
+fn sandbox_summary(check: &DoctorCheck) -> String {
+    let approval = detail::detail_value(check, "approval policy");
+    let filesystem = detail::detail_value(check, "filesystem sandbox");
+    let network = detail::detail_value(check, "network sandbox");
+    match (approval, filesystem, network) {
+        (Some(approval), Some(filesystem), Some(network)) => {
+            format!("{filesystem} fs + {network} network · approval {approval}")
+        }
+        _ => check.summary.clone(),
+    }
+}
+
+fn network_summary(check: &DoctorCheck) -> String {
+    detail::detail_value(check, "proxy env vars")
+        .map(|value| {
+            if value == "none" {
+                "no proxy env vars".to_string()
+            } else {
+                "proxy env vars present".to_string()
+            }
+        })
+        .unwrap_or_else(|| check.summary.clone())
+}
+
+fn websocket_summary(check: &DoctorCheck) -> String {
+    let status = detail::detail_value(check, "handshake result")
+        .or_else(|| detail::detail_value(check, "handshake status"));
+    let timeout = detail::detail_value(check, "connect timeout")
+        .map(|value| value.replace("000 ms", "s").replace(" ms", "ms"));
+    match (status, timeout) {
+        (Some(status), Some(timeout)) => format!("connected ({status}) · {timeout} timeout"),
+        _ => check.summary.clone(),
+    }
+}
+
+fn app_server_summary(check: &DoctorCheck) -> String {
+    let status = detail::detail_value(check, "status");
+    let mode = detail::detail_value(check, "mode");
+    match (status, mode) {
+        (Some(status), Some(mode)) => format!("{status} ({mode} mode)"),
+        _ => check.summary.clone(),
+    }
+}
+
+fn separator(options: HumanOutputOptions) -> String {
+    if options.ascii {
+        "-".repeat(SEPARATOR_WIDTH)
+    } else {
+        "─".repeat(SEPARATOR_WIDTH)
+    }
+}
+
+fn highlight_actions(text: &str, options: HumanOutputOptions) -> String {
+    if !options.color_enabled {
+        return text.to_string();
+    }
+
+    let mut out = String::new();
+    let mut parts = text.split('`');
+    if let Some(first) = parts.next() {
+        out.push_str(&highlight_flags(first, options));
+    }
+    let mut in_code = true;
+    for part in parts {
+        if in_code {
+            out.push_str(&cyan(part, options));
+        } else {
+            out.push_str(&highlight_flags(part, options));
+        }
+        in_code = !in_code;
+    }
+    out
+}
+
+fn highlight_flags(text: &str, options: HumanOutputOptions) -> String {
+    text.split_inclusive(char::is_whitespace)
+        .map(|token| {
+            let trimmed = token.trim_end();
+            let suffix = &token[trimmed.len()..];
+            let bare = trimmed.trim_end_matches([',', '.', ':', ';', ')']);
+            let punctuation = &trimmed[bare.len()..];
+            if bare.starts_with("--") {
+                let highlighted = cyan(bare, options);
+                format!("{highlighted}{punctuation}{suffix}")
+            } else {
+                token.to_string()
+            }
+        })
+        .collect()
+}
+
+pub(super) fn redact_detail(detail: &str) -> String {
+    let lower = detail.to_ascii_lowercase();
+    let label = lower.split(':').next().unwrap_or_default();
+    if label.contains("env var") {
+        return redact_urls(detail);
+    }
+    if detail
+        .split_once(": ")
+        .is_some_and(|(_, value)| is_safe_presence_value(value))
+    {
+        return redact_urls(detail);
+    }
+
+    let secret_keys = [
+        "openai_api_key",
+        "codex_api_key",
+        "codex_access_token",
+        "authorization",
+        "bearer_token",
+        "token",
+        "secret",
+    ];
+    if secret_keys.iter().any(|key| lower.contains(key)) {
+        let name = detail.split(':').next().unwrap_or(detail);
+        format!("{name}: <redacted>")
+    } else {
+        redact_urls(detail)
+    }
+}
+
+fn is_safe_presence_value(value: &str) -> bool {
+    matches!(
+        value.trim().to_ascii_lowercase().as_str(),
+        "true" | "false" | "yes" | "no" | "present" | "absent" | "missing" | "not set"
+    )
+}
+
+fn redact_urls(detail: &str) -> String {
+    detail
+        .split_inclusive(char::is_whitespace)
+        .map(redact_url_token)
+        .collect()
+}
+
+fn redact_url_token(token: &str) -> String {
+    let Some(scheme_end) = token.find("://") else {
+        return token.to_string();
+    };
+    let mut suffix_start = token.len();
+    while suffix_start > scheme_end + 3
+        && matches!(
+            token.as_bytes()[suffix_start - 1],
+            b' ' | b'\t' | b'\n' | b'\r' | b'.' | b',' | b';' | b':' | b')' | b']'
+        )
+    {
+        suffix_start -= 1;
+    }
+
+    let (body, suffix) = token.split_at(suffix_start);
+    let scheme_prefix_end = scheme_end + 3;
+    let rest = &body[scheme_prefix_end..];
+    let authority_end = rest
+        .find(['/', '?', '#'])
+        .map(|index| scheme_prefix_end + index)
+        .unwrap_or(body.len());
+    let authority = &body[scheme_prefix_end..authority_end];
+    let authority = authority
+        .rsplit_once('@')
+        .map_or(authority, |(_, host)| host);
+    let path = &body[authority_end..];
+    let path = path
+        .find(['?', '#'])
+        .map(|index| &path[..index])
+        .unwrap_or(path);
+    let path = redact_url_path(path);
+    format!(
+        "{}{}{}{}",
+        &body[..scheme_prefix_end],
+        authority,
+        path,
+        suffix
+    )
+}
+
+fn redact_url_path(path: &str) -> String {
+    let mut segments = path.split('/').filter(|segment| !segment.is_empty());
+    let Some(first_segment) = segments.next() else {
+        return path.to_string();
+    };
+    if segments.next().is_some() {
+        format!("/{first_segment}/<redacted>")
+    } else {
+        path.to_string()
+    }
+}
+
+#[derive(Default)]
+struct StatusCounts {
+    ok: usize,
+    idle: usize,
+    notes: usize,
+    warning: usize,
+    fail: usize,
+}
+
+impl StatusCounts {
+    fn from_report(report: &DoctorReport, notes: usize) -> Self {
+        let mut counts = Self {
+            notes,
+            ..Self::default()
+        };
+        for check in &report.checks {
+            match display_status(check) {
+                DisplayStatus::Ok => counts.ok += 1,
+                DisplayStatus::Idle => counts.idle += 1,
+                DisplayStatus::Warning => counts.warning += 1,
+                DisplayStatus::Fail => counts.fail += 1,
+                DisplayStatus::Update | DisplayStatus::Note => {}
+            }
+        }
+        counts
+    }
+}
+
+fn bold(text: &str, options: HumanOutputOptions) -> String {
+    if options.color_enabled {
+        text.bold().to_string()
+    } else {
+        text.to_string()
+    }
+}
+
+fn dim(text: &str, options: HumanOutputOptions) -> String {
+    if options.color_enabled {
+        text.dimmed().to_string()
+    } else {
+        text.to_string()
+    }
+}
+
+fn very_dim(text: &str, options: HumanOutputOptions) -> String {
+    color256(text, /*code*/ 238, options)
+}
+
+fn detail_label(text: &str, options: HumanOutputOptions) -> String {
+    color256(text, /*code*/ 240, options)
+}
+
+fn detail_value(text: &str, options: HumanOutputOptions) -> String {
+    if !options.color_enabled {
+        return text.to_string();
+    }
+    style_detail_text(text, options)
+}
+
+fn style_detail_text(text: &str, options: HumanOutputOptions) -> String {
+    let mut out = String::new();
+    let mut parts = text.split('`');
+    if let Some(first) = parts.next() {
+        out.push_str(&style_detail_plain_text(first, options));
+    }
+    let mut in_code = true;
+    for part in parts {
+        if in_code {
+            out.push_str(&cyan(part, options));
+        } else {
+            out.push_str(&style_detail_plain_text(part, options));
+        }
+        in_code = !in_code;
+    }
+    out
+}
+
+fn style_detail_plain_text(text: &str, options: HumanOutputOptions) -> String {
+    text.split_inclusive(char::is_whitespace)
+        .map(|token| style_detail_token(token, options))
+        .collect()
+}
+
+fn style_detail_token(token: &str, options: HumanOutputOptions) -> String {
+    let trimmed = token.trim_end();
+    let suffix = &token[trimmed.len()..];
+    let bare = trimmed.trim_end_matches([',', '.', ':', ';', ')']);
+    let punctuation = &trimmed[bare.len()..];
+    let styled = style_detail_bare_token(bare, options);
+    format!("{styled}{punctuation}{suffix}")
+}
+
+fn style_detail_bare_token(bare: &str, options: HumanOutputOptions) -> String {
+    if bare.is_empty() {
+        return String::new();
+    }
+    if bare == "<redacted>" {
+        return color256(&bare.italic().to_string(), /*code*/ 244, options);
+    }
+    if bare.contains("(missing)") || detail::is_falsy(bare) {
+        return color256(bare, /*code*/ 240, options);
+    }
+    if let Some((label, value)) = bare.split_once(':')
+        && detail::is_falsy(value)
+    {
+        return format!("{label}:{}", color256(value, /*code*/ 240, options));
+    }
+    if bare == "ok" {
+        return green(bare, options);
+    }
+    if bare.starts_with("--") || looks_copyable(bare) {
+        return cyan(bare, options);
+    }
+    if matches!(bare, "B" | "KB" | "MB" | "GB" | "TB" | "files" | "file") {
+        return dim(bare, options);
+    }
+    bare.to_string()
+}
+
+fn green(text: &str, options: HumanOutputOptions) -> String {
+    color256(text, /*code*/ 10, options)
+}
+
+fn amber(text: &str, options: HumanOutputOptions) -> String {
+    color256(text, /*code*/ 220, options)
+}
+
+fn orange(text: &str, options: HumanOutputOptions) -> String {
+    color256(text, /*code*/ 214, options)
+}
+
+fn red(text: &str, options: HumanOutputOptions) -> String {
+    color256(text, /*code*/ 196, options)
+}
+
+fn cyan(text: &str, options: HumanOutputOptions) -> String {
+    color256(text, /*code*/ 117, options)
+}
+
+fn color256(text: &str, code: u8, options: HumanOutputOptions) -> String {
+    if options.color_enabled {
+        text.color(XtermColors::from(code)).to_string()
+    } else {
+        text.to_string()
+    }
+}
+
+fn looks_copyable(text: &str) -> bool {
+    text.starts_with("http://")
+        || text.starts_with("https://")
+        || text.starts_with("wss://")
+        || text.starts_with("~/")
+        || text.starts_with('/')
+        || text.starts_with("./")
+        || text.starts_with("../")
+}
+
+#[cfg(test)]
+mod tests {
+    use pretty_assertions::assert_eq;
+
+    use super::*;
+
+    fn detailed_no_color_unicode_options() -> HumanOutputOptions {
+        HumanOutputOptions {
+            show_details: true,
+            show_all: false,
+            ascii: false,
+            color_enabled: false,
+        }
+    }
+
+    fn summary_no_color_unicode_options() -> HumanOutputOptions {
+        HumanOutputOptions {
+            show_details: false,
+            show_all: false,
+            ascii: false,
+            color_enabled: false,
+        }
+    }
+
+    fn detailed_all_no_color_unicode_options() -> HumanOutputOptions {
+        HumanOutputOptions {
+            show_details: true,
+            show_all: true,
+            ascii: false,
+            color_enabled: false,
+        }
+    }
+
+    fn detailed_color_unicode_options() -> HumanOutputOptions {
+        HumanOutputOptions {
+            show_details: true,
+            show_all: false,
+            ascii: false,
+            color_enabled: true,
+        }
+    }
+
+    fn sample_report() -> DoctorReport {
+        let checks = vec![
+            DoctorCheck::new(
+                "runtime.provenance",
+                "runtime",
+                CheckStatus::Ok,
+                "running local build on darwin-arm64",
+            ),
+            DoctorCheck::new(
+                "installation",
+                "install",
+                CheckStatus::Ok,
+                "installation looks consistent",
+            ),
+            DoctorCheck::new(
+                "runtime.search",
+                "search",
+                CheckStatus::Ok,
+                "search is OK (bundled)",
+            ),
+            DoctorCheck::new(
+                "terminal.env",
+                "terminal",
+                CheckStatus::Warning,
+                "narrow terminal",
+            ),
+            DoctorCheck::new(
+                "state.paths",
+                "state",
+                CheckStatus::Ok,
+                "state paths inspectable",
+            ),
+            DoctorCheck::new(
+                "auth.credentials",
+                "auth",
+                CheckStatus::Fail,
+                "token expired",
+            )
+            .detail("OPENAI_API_KEY: present")
+            .remediation("Run `codex login`."),
+            DoctorCheck::new(
+                "updates.status",
+                "updates",
+                CheckStatus::Ok,
+                "update configuration is locally consistent",
+            ),
+            DoctorCheck::new(
+                "network.env",
+                "network",
+                CheckStatus::Ok,
+                "network environment readable",
+            ),
+            DoctorCheck::new(
+                "network.websocket_reachability",
+                "websocket",
+                CheckStatus::Ok,
+                "Responses WebSocket handshake succeeded",
+            ),
+            DoctorCheck::new(
+                "app_server.status",
+                "app-server",
+                CheckStatus::Ok,
+                "background server is not running",
+            ),
+            DoctorCheck::new(
+                "network.provider_reachability",
+                "reachability",
+                CheckStatus::Ok,
+                "active provider endpoints are reachable over HTTP",
+            ),
+        ];
+        DoctorReport {
+            schema_version: 1,
+            generated_at: "0s since unix epoch".to_string(),
+            overall_status: CheckStatus::Fail,
+            codex_version: "0.0.0".to_string(),
+            checks,
+        }
+    }
+
+    #[test]
+    fn render_human_report_includes_details_by_default_without_color() {
+        let rendered = render_human_report(&sample_report(), detailed_no_color_unicode_options());
+        let expected = format!(
+            "\
+Codex Doctor v0.0.0
+
+Notes
+   ⚠ terminal     narrow terminal
+   ✗ auth         token expired - Run `codex login`.
+─────────────────────────────────────────────────────────────
+
+Environment
+  ✓ runtime      running local build on darwin-arm64
+  ✓ install      consistent
+      managed by               npm: no · bun: no · package root —
+  ✓ search       search is OK (bundled)
+  ⚠ terminal     narrow terminal
+  ✓ state        state paths inspectable
+
+Configuration
+  ✗ auth         token expired — Run `codex login`.
+      OPENAI_API_KEY           present
+
+Updates
+  ✓ updates      update configuration is locally consistent
+
+Connectivity
+  ✓ network      network environment readable
+  ✓ websocket    Responses WebSocket handshake succeeded
+  ✓ reachability active provider endpoints are reachable over HTTP
+
+Background Server
+  ✓ app-server   background server is not running
+
+{}
+9 ok · 2 notes · 1 warn · 1 fail failed
+
+--summary compact output           --all expand truncated lists
+--json redacted report
+",
+            "─".repeat(SEPARATOR_WIDTH)
+        );
+        assert_eq!(rendered, expected);
+    }
+
+    #[test]
+    fn render_human_report_supports_summary_output_without_color() {
+        let rendered = render_human_report(&sample_report(), summary_no_color_unicode_options());
+        let expected = format!(
+            "\
+Codex Doctor v0.0.0
+
+Notes
+   ⚠ terminal     narrow terminal
+   ✗ auth         token expired - Run `codex login`.
+─────────────────────────────────────────────────────────────
+
+Environment
+  ✓ runtime      running local build on darwin-arm64
+  ✓ install      consistent
+  ✓ search       search is OK (bundled)
+  ⚠ terminal     narrow terminal
+  ✓ state        state paths inspectable
+
+Configuration
+  ✗ auth         token expired — Run `codex login`.
+
+Updates
+  ✓ updates      update configuration is locally consistent
+
+Connectivity
+  ✓ network      network environment readable
+  ✓ websocket    Responses WebSocket handshake succeeded
+  ✓ reachability active provider endpoints are reachable over HTTP
+
+Background Server
+  ✓ app-server   background server is not running
+
+{}
+9 ok · 2 notes · 1 warn · 1 fail failed
+
+Run codex doctor without --summary for detailed diagnostics.
+--all expand truncated lists       --json redacted report
+",
+            "─".repeat(SEPARATOR_WIDTH)
+        );
+        assert_eq!(rendered, expected);
+    }
+
+    #[test]
+    fn render_human_report_supports_ascii_output() {
+        let rendered = render_human_report(
+            &sample_report(),
+            HumanOutputOptions {
+                show_details: false,
+                show_all: false,
+                ascii: true,
+                color_enabled: false,
+            },
+        );
+        let expected = format!(
+            "\
+Codex Doctor v0.0.0
+
+Notes
+   [!!] terminal     narrow terminal
+   [XX] auth         token expired - Run `codex login`.
+-------------------------------------------------------------
+
+Environment
+  [ok] runtime      running local build on darwin-arm64
+  [ok] install      consistent
+  [ok] search       search is OK (bundled)
+  [!!] terminal     narrow terminal
+  [ok] state        state paths inspectable
+
+Configuration
+  [XX] auth         token expired - Run `codex login`.
+
+Updates
+  [ok] updates      update configuration is locally consistent
+
+Connectivity
+  [ok] network      network environment readable
+  [ok] websocket    Responses WebSocket handshake succeeded
+  [ok] reachability active provider endpoints are reachable over HTTP
+
+Background Server
+  [ok] app-server   background server is not running
+
+{}
+9 ok | 2 notes | 1 warn | 1 fail failed
+
+Run codex doctor without --summary for detailed diagnostics.
+--all expand truncated lists       --json redacted report
+",
+            "-".repeat(SEPARATOR_WIDTH)
+        );
+        assert_eq!(rendered, expected);
+    }
+
+    #[test]
+    fn render_human_report_includes_redacted_details() {
+        let rendered = render_human_report(
+            &sample_report(),
+            HumanOutputOptions {
+                show_details: true,
+                show_all: false,
+                ascii: false,
+                color_enabled: false,
+            },
+        );
+        assert!(rendered.contains("      OPENAI_API_KEY           present"));
+    }
+
+    #[test]
+    fn render_human_report_explains_terminal_warning_issue() {
+        let report = DoctorReport {
+            schema_version: 1,
+            generated_at: "0s since unix epoch".to_string(),
+            overall_status: CheckStatus::Warning,
+            codex_version: "0.0.0".to_string(),
+            checks: vec![
+                DoctorCheck::new(
+                    "terminal.env",
+                    "terminal",
+                    CheckStatus::Warning,
+                    "width 79 cols - output may wrap (recommended >=80)",
+                )
+                .detail("terminal: Ghostty")
+                .detail("terminal version: 1.3.1")
+                .detail("terminal size: 79x26")
+                .issue(
+                    super::super::DoctorIssue::new(
+                        CheckStatus::Warning,
+                        "width 79 cols - output may wrap (recommended >=80)",
+                    )
+                    .expected(">= 80 columns")
+                    .remedy("resize the window to at least 80 columns")
+                    .field("terminal size"),
+                ),
+            ],
+        };
+
+        let rendered = render_human_report(&report, detailed_no_color_unicode_options());
+
+        assert!(
+            rendered.contains("⚠ terminal     width 79 cols - output may wrap (recommended >=80)")
+        );
+        assert!(rendered.contains("▸ terminal size            79x26 (expected >= 80 columns)"));
+        assert!(rendered.contains("→ resize the window to at least 80 columns"));
+        assert!(!rendered.contains("⚠ terminal     Ghostty 1.3.1"));
+    }
+
+    #[test]
+    fn render_human_report_promotes_notes_without_changing_statuses() {
+        let report = DoctorReport {
+            schema_version: 1,
+            generated_at: "0s since unix epoch".to_string(),
+            overall_status: CheckStatus::Warning,
+            codex_version: "0.0.0".to_string(),
+            checks: vec![
+                DoctorCheck::new(
+                    "updates.status",
+                    "updates",
+                    CheckStatus::Ok,
+                    "update configuration is locally consistent",
+                )
+                .detail("latest version status: newer version is available")
+                .detail("latest version: 0.130.0")
+                .detail("dismissed version: 0.128.0"),
+                DoctorCheck::new(
+                    "state.paths",
+                    "state",
+                    CheckStatus::Ok,
+                    "state paths inspectable",
+                )
+                .detail("active rollout files: 1515 files, 2702146365 total bytes, 1783594 average bytes"),
+                DoctorCheck::new(
+                    "sandbox.helpers",
+                    "sandbox",
+                    CheckStatus::Ok,
+                    "sandbox configuration is readable",
+                )
+                .detail("filesystem sandbox: danger-full-access")
+                .detail("network sandbox: restricted")
+                .detail("approval policy: Never"),
+                DoctorCheck::new(
+                    "mcp.config",
+                    "mcp",
+                    CheckStatus::Warning,
+                    "MCP configuration has optional issues",
+                ),
+                DoctorCheck::new(
+                    "network.websocket_reachability",
+                    "websocket",
+                    CheckStatus::Ok,
+                    "Responses WebSocket handshake succeeded",
+                )
+                .detail("auth mode: chatgpt"),
+                DoctorCheck::new(
+                    "network.provider_reachability",
+                    "reachability",
+                    CheckStatus::Ok,
+                    "active provider endpoints are reachable over HTTP",
+                )
+                .detail("reachability mode: API key auth"),
+                DoctorCheck::new(
+                    "app_server.status",
+                    "app-server",
+                    CheckStatus::Ok,
+                    "background server is not running",
+                )
+                .detail("status: not running")
+                .detail("mode: ephemeral"),
+            ],
+        };
+
+        let rendered = render_human_report(&report, summary_no_color_unicode_options());
+
+        assert!(rendered.contains("Notes\n   ↑ updates"));
+        assert!(rendered.contains("0.130.0 available (current 0.0.0, dismissed 0.128.0)"));
+        assert!(rendered.contains("⚠ rollouts"));
+        assert!(rendered.contains("⚠ sandbox"));
+        assert!(rendered.contains("⚠ mcp"));
+        assert!(rendered.contains(
+            "⚠ auth         mixed auth signals: ChatGPT login plus API key env var; HTTP reachability uses API-key mode"
+        ));
+        assert!(rendered.contains("○ app-server   not running (ephemeral mode)"));
+        assert!(rendered.contains("5 ok · 1 idle · 5 notes · 1 warn · 0 fail degraded"));
+    }
+
+    #[test]
+    fn render_human_report_expands_feature_flags_with_all() {
+        let report = DoctorReport {
+            schema_version: 1,
+            generated_at: "0s since unix epoch".to_string(),
+            overall_status: CheckStatus::Ok,
+            codex_version: "0.0.0".to_string(),
+            checks: vec![
+                DoctorCheck::new("config.load", "config", CheckStatus::Ok, "config loaded")
+                    .detail("model: gpt-5.5")
+                    .detail("model provider: openai")
+                    .detail("feature flags enabled: 3")
+                    .detail("enabled feature flags: shell_tool, memories, goals")
+                    .detail("feature flag overrides: memories=true"),
+            ],
+        };
+
+        let compact = render_human_report(&report, detailed_no_color_unicode_options());
+        let expanded = render_human_report(&report, detailed_all_no_color_unicode_options());
+
+        assert!(!compact.contains("enabled flags"));
+        assert!(
+            compact.contains(
+                "feature flags            3 enabled · 1 overridden (full list with --all)"
+            )
+        );
+        assert!(expanded.contains("enabled flags            shell_tool, memories, goals"));
+    }
+
+    #[test]
+    fn detail_value_colors_inline_statuses_and_low_signal_values() {
+        let rendered = detail_value(
+            "npm: no · commit unknown · integrity ok · ~/code/codex/target/debug/codex · <redacted>",
+            detailed_color_unicode_options(),
+        );
+
+        assert!(rendered.contains("npm: \u{1b}[38;5;240mno"));
+        assert!(rendered.contains("\u{1b}[38;5;240munknown"));
+        assert!(rendered.contains("\u{1b}[38;5;10mok"));
+        assert!(rendered.contains("\u{1b}[38;5;117m~/code/codex/target/debug/codex"));
+        assert!(rendered.contains("\u{1b}[38;5;244m"));
+    }
+
+    #[test]
+    fn update_note_emphasizes_available_version_and_dims_context() {
+        let rendered = style_update_note_summary(
+            "0.130.0 available (current 0.0.0, dismissed 0.128.0)",
+            detailed_color_unicode_options(),
+        );
+
+        assert!(rendered.contains("\u{1b}[38;5;220m0.130.0 available"));
+        assert!(rendered.contains("\u{1b}[2m(current 0.0.0, dismissed 0.128.0)"));
+    }
+
+    #[test]
+    fn redact_detail_sanitizes_urls() {
+        let redacted = redact_detail(
+            "reachability failed: https://user:pass@example.com/mcp?x=abc#frag (connect failed)",
+        );
+
+        assert_eq!(
+            redacted,
+            "reachability failed: https://example.com/mcp (connect failed)"
+        );
+    }
+
+    #[test]
+    fn redact_detail_sanitizes_secret_url_path_segments() {
+        let redacted = redact_detail("reachability failed: https://example.com/mcp/abc123xyz");
+
+        assert_eq!(
+            redacted,
+            "reachability failed: https://example.com/mcp/<redacted>"
+        );
+    }
+
+    #[test]
+    fn redact_detail_preserves_env_var_names() {
+        assert_eq!(
+            redact_detail("auth env vars present: OPENAI_API_KEY, CODEX_API_KEY"),
+            "auth env vars present: OPENAI_API_KEY, CODEX_API_KEY"
+        );
+    }
+
+    #[test]
+    fn redact_detail_preserves_secret_presence_booleans() {
+        assert_eq!(
+            redact_detail("stored ChatGPT tokens: true"),
+            "stored ChatGPT tokens: true"
+        );
+        assert_eq!(
+            redact_detail("stored ChatGPT tokens: false"),
+            "stored ChatGPT tokens: false"
+        );
+    }
+
+    #[test]
+    fn render_human_report_can_emit_color() {
+        let rendered = render_human_report(
+            &sample_report(),
+            HumanOutputOptions {
+                show_details: false,
+                show_all: false,
+                ascii: false,
+                color_enabled: true,
+            },
+        );
+        assert!(rendered.contains("\u{1b}["));
+    }
+}
diff --git a/codex-rs/cli/src/doctor/output/detail.rs b/codex-rs/cli/src/doctor/output/detail.rs
new file mode 100644
index 0000000000..0105077620
--- /dev/null
+++ b/codex-rs/cli/src/doctor/output/detail.rs
@@ -0,0 +1,651 @@
+//! Converts raw doctor detail strings into human-oriented rows.
+//!
+//! Checks intentionally store details as simple redacted `label: value` strings
+//! so JSON serialization and human rendering share the same source data. This
+//! module owns the presentation-only transformations: collapsing noisy booleans,
+//! truncating long paths for terminal output, grouping repeated values, and
+//! keeping the `--all` expansion behavior out of check construction.
+
+use std::collections::BTreeSet;
+use std::env;
+
+use super::DoctorCheck;
+use super::HumanOutputOptions;
+use super::redact_detail;
+
+const LIST_LIMIT: usize = 7;
+const PATH_LIMIT: usize = 48;
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub(super) enum HumanDetail {
+    Row {
+        label: String,
+        value: String,
+        expected: Option<String>,
+    },
+    Continuation(String),
+    Bullet(String),
+    Remedy(String),
+}
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+struct ParsedDetail {
+    label: String,
+    value: String,
+}
+
+pub(super) fn detail_lines(check: &DoctorCheck, options: HumanOutputOptions) -> Vec<HumanDetail> {
+    let parsed = parsed_details(check);
+    let details = match check.category.as_str() {
+        "runtime" => runtime_details(&parsed),
+        "install" => install_details(&parsed, options),
+        "config" => config_details(&parsed, options),
+        "state" => state_details(&parsed),
+        _ => generic_details(&parsed),
+    };
+    let mut details = details
+        .into_iter()
+        .map(|detail| attach_issue_metadata(detail, check))
+        .map(|detail| humanize_detail(detail, options))
+        .collect::<Vec<_>>();
+    details.extend(issue_remedies(check));
+    details
+}
+
+pub(super) fn detail_value(check: &DoctorCheck, label: &str) -> Option<String> {
+    parsed_details(check)
+        .into_iter()
+        .find(|detail| detail.label == label)
+        .map(|detail| detail.value)
+}
+
+pub(super) fn rollout_summary(value: &str) -> Option<String> {
+    let (files, rest) = value.split_once(" files, ")?;
+    let (total_bytes, rest) = rest.split_once(" total bytes, ")?;
+    let (average_bytes, _) = rest.split_once(" average bytes")?;
+    let files = files.trim().parse::<u64>().ok()?;
+    let total_bytes = total_bytes.trim().parse::<u64>().ok()?;
+    let average_bytes = average_bytes.trim().parse::<u64>().ok()?;
+    Some(format!(
+        "{} files · {} (avg {})",
+        format_count(files),
+        format_bytes(total_bytes),
+        format_bytes(average_bytes)
+    ))
+}
+
+pub(super) fn rollout_files_and_bytes(value: &str) -> Option<(u64, u64)> {
+    let (files, rest) = value.split_once(" files, ")?;
+    let (total_bytes, _) = rest.split_once(" total bytes, ")?;
+    Some((
+        files.trim().parse::<u64>().ok()?,
+        total_bytes.trim().parse::<u64>().ok()?,
+    ))
+}
+
+pub(super) fn format_bytes(bytes: u64) -> String {
+    const KIB: f64 = 1024.0;
+    const MIB: f64 = KIB * 1024.0;
+    const GIB: f64 = MIB * 1024.0;
+
+    let bytes = bytes as f64;
+    if bytes >= GIB {
+        format!("{:.2} GB", bytes / GIB)
+    } else if bytes >= MIB {
+        format!("{:.2} MB", bytes / MIB)
+    } else if bytes >= KIB {
+        format!("{:.2} KB", bytes / KIB)
+    } else {
+        format!("{} B", bytes as u64)
+    }
+}
+
+pub(super) fn format_count(count: u64) -> String {
+    let mut digits = count.to_string();
+    let mut out = String::new();
+    while digits.len() > 3 {
+        let tail = digits.split_off(digits.len() - 3);
+        if out.is_empty() {
+            out = tail;
+        } else {
+            out = format!("{tail},{out}");
+        }
+    }
+    if out.is_empty() {
+        digits
+    } else {
+        format!("{digits},{out}")
+    }
+}
+
+fn parsed_details(check: &DoctorCheck) -> Vec<ParsedDetail> {
+    check
+        .details
+        .iter()
+        .map(|detail| redact_detail(detail))
+        .map(|detail| {
+            detail
+                .split_once(": ")
+                .map(|(label, value)| ParsedDetail {
+                    label: label.to_string(),
+                    value: value.to_string(),
+                })
+                .unwrap_or_else(|| ParsedDetail {
+                    label: String::new(),
+                    value: detail,
+                })
+        })
+        .collect()
+}
+
+fn runtime_details(parsed: &[ParsedDetail]) -> Vec<HumanDetail> {
+    let mut out = Vec::new();
+    push_row_if_present(&mut out, parsed, "version", "version");
+    push_row_if_present(&mut out, parsed, "install method", "install method");
+    push_row_if_present(&mut out, parsed, "commit", "commit");
+    push_row_if_present(&mut out, parsed, "current executable", "executable");
+    push_remaining(
+        &mut out,
+        parsed,
+        &[
+            "version",
+            "platform",
+            "install method",
+            "commit",
+            "current executable",
+        ],
+        &[],
+    );
+    out
+}
+
+fn install_details(parsed: &[ParsedDetail], options: HumanOutputOptions) -> Vec<HumanDetail> {
+    let mut out = Vec::new();
+    push_row_if_present(&mut out, parsed, "install context", "context");
+    if parsed.iter().any(|detail| {
+        detail.value == "ignored inherited package-manager launch env for cargo-built binary"
+    }) {
+        out.push(HumanDetail::Bullet(
+            "ignored inherited package-manager launch env for cargo-built binary".to_string(),
+        ));
+    }
+
+    let managed_by_npm = value(parsed, "managed by npm").unwrap_or("false");
+    let managed_by_bun = value(parsed, "managed by bun").unwrap_or("false");
+    let package_root = value(parsed, "managed package root").unwrap_or("not set");
+    out.push(HumanDetail::Row {
+        label: "managed by".to_string(),
+        value: format!(
+            "npm: {} · bun: {} · package root {}",
+            yes_no(managed_by_npm),
+            yes_no(managed_by_bun),
+            if is_falsy(package_root) {
+                "—".to_string()
+            } else {
+                package_root.to_string()
+            }
+        ),
+        expected: None,
+    });
+
+    let path_entries = numbered_values(parsed, "PATH codex #");
+    if !path_entries.is_empty() {
+        let total = path_entries.len();
+        let shown = if options.show_all {
+            total
+        } else {
+            total.min(3)
+        };
+        out.push(HumanDetail::Row {
+            label: format!("PATH entries ({total})"),
+            value: path_entries[0].clone(),
+            expected: None,
+        });
+        out.extend(
+            path_entries
+                .iter()
+                .skip(1)
+                .take(shown.saturating_sub(1))
+                .cloned()
+                .map(HumanDetail::Continuation),
+        );
+        if shown < total {
+            out.push(HumanDetail::Continuation(
+                "… (full list with --all)".to_string(),
+            ));
+        }
+    }
+
+    push_remaining(
+        &mut out,
+        parsed,
+        &[
+            "current executable",
+            "install context",
+            "managed by npm",
+            "managed by bun",
+            "managed package root",
+            "PATH codex entries",
+        ],
+        &["PATH codex #"],
+    );
+    out
+}
+
+fn config_details(parsed: &[ParsedDetail], options: HumanOutputOptions) -> Vec<HumanDetail> {
+    let mut out = Vec::new();
+    if let Some(model) = value(parsed, "model") {
+        let value = value(parsed, "model provider").map_or_else(
+            || model.to_string(),
+            |provider| format!("{model} · {provider}"),
+        );
+        out.push(HumanDetail::Row {
+            label: "model".to_string(),
+            value,
+            expected: None,
+        });
+    }
+    push_row_if_present(&mut out, parsed, "cwd", "cwd");
+    push_row_if_present(&mut out, parsed, "config.toml", "config.toml");
+    push_row_if_present(&mut out, parsed, "config.toml parse", "config.toml parse");
+    push_row_if_present(&mut out, parsed, "config.toml read", "config.toml read");
+    push_row_if_present(&mut out, parsed, "mcp servers", "MCP servers");
+    push_feature_flags(&mut out, parsed, options);
+
+    for detail in parsed
+        .iter()
+        .filter(|detail| detail.label == "legacy feature flag")
+    {
+        out.push(HumanDetail::Row {
+            label: "legacy alias".to_string(),
+            value: detail.value.clone(),
+            expected: None,
+        });
+    }
+
+    push_remaining(
+        &mut out,
+        parsed,
+        &[
+            "CODEX_HOME",
+            "cwd",
+            "model",
+            "model provider",
+            "log dir",
+            "sqlite home",
+            "mcp servers",
+            "feature flags enabled",
+            "enabled feature flags",
+            "feature flag overrides",
+            "legacy feature flag",
+            "config.toml",
+            "config.toml parse",
+            "config.toml read",
+        ],
+        &[],
+    );
+    out
+}
+
+fn state_details(parsed: &[ParsedDetail]) -> Vec<HumanDetail> {
+    let mut out = Vec::new();
+    push_row_if_present(&mut out, parsed, "CODEX_HOME", "CODEX_HOME");
+    push_row_if_present(&mut out, parsed, "log dir", "log dir");
+    push_row_if_present(&mut out, parsed, "sqlite home", "sqlite home");
+    push_database_row(&mut out, parsed, "state DB");
+    push_database_row(&mut out, parsed, "log DB");
+    push_database_row(&mut out, parsed, "goals DB");
+
+    for (source, label) in [
+        ("active rollout files", "active rollouts"),
+        ("archived rollout files", "archived rollouts"),
+    ] {
+        if let Some(value) = value(parsed, source) {
+            out.push(HumanDetail::Row {
+                label: label.to_string(),
+                value: rollout_summary(value).unwrap_or_else(|| value.to_string()),
+                expected: None,
+            });
+        }
+    }
+
+    push_remaining(
+        &mut out,
+        parsed,
+        &[
+            "CODEX_HOME",
+            "log dir",
+            "sqlite home",
+            "state DB",
+            "log DB",
+            "goals DB",
+            "state DB integrity",
+            "log DB integrity",
+            "goals DB integrity",
+            "active rollout files",
+            "archived rollout files",
+        ],
+        &[],
+    );
+    out
+}
+
+fn generic_details(parsed: &[ParsedDetail]) -> Vec<HumanDetail> {
+    parsed
+        .iter()
+        .map(|detail| {
+            if detail.label.is_empty() {
+                HumanDetail::Bullet(detail.value.clone())
+            } else {
+                HumanDetail::Row {
+                    label: display_label(&detail.label),
+                    value: detail.value.clone(),
+                    expected: None,
+                }
+            }
+        })
+        .collect()
+}
+
+fn push_feature_flags(
+    out: &mut Vec<HumanDetail>,
+    parsed: &[ParsedDetail],
+    options: HumanOutputOptions,
+) {
+    let enabled_count = value(parsed, "feature flags enabled")
+        .and_then(|value| value.parse::<usize>().ok())
+        .unwrap_or_default();
+    let overrides = list_items(value(parsed, "feature flag overrides").unwrap_or("none"));
+    let override_count = overrides.len();
+    let hint = if !options.show_all && enabled_count > 0 {
+        " (full list with --all)"
+    } else {
+        ""
+    };
+    out.push(HumanDetail::Row {
+        label: "feature flags".to_string(),
+        value: format!("{enabled_count} enabled · {override_count} overridden{hint}"),
+        expected: None,
+    });
+
+    if !overrides.is_empty() {
+        push_list_row(out, "overrides", &override_names(&overrides), options);
+    }
+    if options.show_all {
+        let enabled = list_items(value(parsed, "enabled feature flags").unwrap_or("none"));
+        if !enabled.is_empty() {
+            push_list_row(out, "enabled flags", &enabled, options);
+        }
+    }
+}
+
+fn push_list_row(
+    out: &mut Vec<HumanDetail>,
+    label: &str,
+    items: &[String],
+    options: HumanOutputOptions,
+) {
+    let limit = if options.show_all {
+        items.len()
+    } else {
+        items.len().min(LIST_LIMIT)
+    };
+    let mut value = items
+        .iter()
+        .take(limit)
+        .cloned()
+        .collect::<Vec<_>>()
+        .join(", ");
+    if limit < items.len() {
+        value.push_str(", … (full list with --all)");
+    }
+    out.push(HumanDetail::Row {
+        label: label.to_string(),
+        value,
+        expected: None,
+    });
+}
+
+fn push_database_row(out: &mut Vec<HumanDetail>, parsed: &[ParsedDetail], label: &str) {
+    let Some(path) = value(parsed, label) else {
+        return;
+    };
+    let integrity = value(parsed, &format!("{label} integrity"));
+    let value = integrity.map_or_else(
+        || path.to_string(),
+        |integrity| format!("{path} · integrity {integrity}"),
+    );
+    out.push(HumanDetail::Row {
+        label: label.to_string(),
+        value,
+        expected: None,
+    });
+}
+
+fn push_row_if_present(
+    out: &mut Vec<HumanDetail>,
+    parsed: &[ParsedDetail],
+    source_label: &str,
+    display_label: &str,
+) {
+    if let Some(value) = value(parsed, source_label) {
+        out.push(HumanDetail::Row {
+            label: display_label.to_string(),
+            value: value.to_string(),
+            expected: None,
+        });
+    }
+}
+
+fn push_remaining(
+    out: &mut Vec<HumanDetail>,
+    parsed: &[ParsedDetail],
+    consumed_labels: &[&str],
+    consumed_prefixes: &[&str],
+) {
+    for detail in parsed {
+        if detail.value == "ignored inherited package-manager launch env for cargo-built binary" {
+            continue;
+        }
+        if consumed_labels.contains(&detail.label.as_str())
+            || consumed_prefixes
+                .iter()
+                .any(|prefix| detail.label.starts_with(prefix))
+        {
+            continue;
+        }
+        if detail.label.is_empty() {
+            out.push(HumanDetail::Bullet(detail.value.clone()));
+        } else {
+            out.push(HumanDetail::Row {
+                label: display_label(&detail.label),
+                value: detail.value.clone(),
+                expected: None,
+            });
+        }
+    }
+}
+
+fn humanize_detail(detail: HumanDetail, options: HumanOutputOptions) -> HumanDetail {
+    match detail {
+        HumanDetail::Row {
+            label,
+            value,
+            expected,
+        } => HumanDetail::Row {
+            label,
+            value: humanize_value(&value, options),
+            expected,
+        },
+        HumanDetail::Continuation(value) => {
+            HumanDetail::Continuation(humanize_value(&value, options))
+        }
+        HumanDetail::Bullet(value) => HumanDetail::Bullet(humanize_value(&value, options)),
+        HumanDetail::Remedy(value) => HumanDetail::Remedy(value),
+    }
+}
+
+fn attach_issue_metadata(detail: HumanDetail, check: &DoctorCheck) -> HumanDetail {
+    let HumanDetail::Row {
+        label,
+        value,
+        expected,
+    } = detail
+    else {
+        return detail;
+    };
+    let expected = expected.or_else(|| issue_expected_for_label(check, &label));
+    HumanDetail::Row {
+        label,
+        value,
+        expected,
+    }
+}
+
+fn issue_expected_for_label(check: &DoctorCheck, label: &str) -> Option<String> {
+    check
+        .issues
+        .iter()
+        .find(|issue| {
+            issue
+                .fields
+                .iter()
+                .any(|field| display_label(field) == label || field == label)
+        })
+        .and_then(|issue| issue.expected.clone())
+}
+
+fn issue_remedies(check: &DoctorCheck) -> Vec<HumanDetail> {
+    let mut seen = BTreeSet::new();
+    check
+        .issues
+        .iter()
+        .filter_map(|issue| issue.remedy.as_ref())
+        .filter(|remedy| seen.insert((*remedy).clone()))
+        .cloned()
+        .map(HumanDetail::Remedy)
+        .collect()
+}
+
+fn humanize_value(value: &str, _options: HumanOutputOptions) -> String {
+    if looks_like_path(value) {
+        return shorten_path_prefix(value);
+    }
+    if let Some(timestamp) = humanize_timestamp(value) {
+        return timestamp;
+    }
+    value.to_string()
+}
+
+fn humanize_timestamp(value: &str) -> Option<String> {
+    if value.len() < 17 || !value.ends_with('Z') {
+        return None;
+    }
+    let (date, time) = value.split_once('T')?;
+    let hour_minute = time.get(..5)?;
+    Some(format!("{date} {hour_minute} UTC"))
+}
+
+fn shorten_path_prefix(value: &str) -> String {
+    let (path, suffix) = value.split_once(" (").map_or_else(
+        || (value, String::new()),
+        |(path, suffix)| (path, format!(" ({suffix}")),
+    );
+    let home_shortened = home_shortened_path(path);
+    let shortened = middle_truncate(&home_shortened, PATH_LIMIT);
+    format!("{shortened}{suffix}")
+}
+
+fn home_shortened_path(path: &str) -> String {
+    let Some(home) = env::var_os("HOME").and_then(|home| home.into_string().ok()) else {
+        return path.to_string();
+    };
+    if path == home {
+        "~".to_string()
+    } else {
+        path.strip_prefix(&format!("{home}/"))
+            .map_or_else(|| path.to_string(), |tail| format!("~/{tail}"))
+    }
+}
+
+fn middle_truncate(value: &str, max_chars: usize) -> String {
+    let char_count = value.chars().count();
+    if char_count <= max_chars {
+        return value.to_string();
+    }
+    let head_len = max_chars / 2;
+    let tail_len = max_chars.saturating_sub(head_len + 1);
+    let head = value.chars().take(head_len).collect::<String>();
+    let tail = value
+        .chars()
+        .rev()
+        .take(tail_len)
+        .collect::<String>()
+        .chars()
+        .rev()
+        .collect::<String>();
+    format!("{head}…{tail}")
+}
+
+fn looks_like_path(value: &str) -> bool {
+    value.starts_with('/')
+        || value.starts_with("~/")
+        || value.starts_with("./")
+        || value.starts_with("../")
+}
+
+fn numbered_values(parsed: &[ParsedDetail], prefix: &str) -> Vec<String> {
+    parsed
+        .iter()
+        .filter(|detail| detail.label.starts_with(prefix))
+        .map(|detail| detail.value.clone())
+        .collect()
+}
+
+fn value<'a>(parsed: &'a [ParsedDetail], label: &str) -> Option<&'a str> {
+    parsed
+        .iter()
+        .find(|detail| detail.label == label)
+        .map(|detail| detail.value.as_str())
+}
+
+fn display_label(label: &str) -> String {
+    match label {
+        "codex-linux-sandbox helper" => "linux helper",
+        "optional reachability failed" => "optional reachability",
+        "check for update on startup" => "startup update check",
+        other => other,
+    }
+    .to_string()
+}
+
+fn list_items(value: &str) -> Vec<String> {
+    if is_falsy(value) {
+        return Vec::new();
+    }
+    value
+        .split(',')
+        .map(str::trim)
+        .filter(|item| !item.is_empty())
+        .map(str::to_string)
+        .collect()
+}
+
+fn override_names(items: &[String]) -> Vec<String> {
+    items
+        .iter()
+        .map(|item| item.split_once('=').map_or(item.as_str(), |(name, _)| name))
+        .map(str::to_string)
+        .collect()
+}
+
+fn yes_no(value: &str) -> &'static str {
+    if value == "true" { "yes" } else { "no" }
+}
+
+pub(super) fn is_falsy(value: &str) -> bool {
+    matches!(
+        value.trim().to_ascii_lowercase().as_str(),
+        "" | "false" | "none" | "not set" | "unknown" | "missing" | "absent" | "no" | "—" | "-"
+    )
+}
diff --git a/codex-rs/cli/src/doctor/progress.rs b/codex-rs/cli/src/doctor/progress.rs
new file mode 100644
index 0000000000..ba8d65a357
--- /dev/null
+++ b/codex-rs/cli/src/doctor/progress.rs
@@ -0,0 +1,139 @@
+use std::io;
+use std::io::IsTerminal;
+use std::io::Write;
+use std::sync::Mutex;
+use std::time::Duration;
+
+use super::CheckStatus;
+
+/// Receives check lifecycle events while doctor builds the final report.
+///
+/// Progress implementations must not write to stdout. The final report owns
+/// stdout so JSON and redirected human reports stay clean.
+pub(super) trait DoctorProgress: Send + Sync {
+    fn begin(&self, label: &'static str);
+    fn heartbeat(&self, label: &'static str, elapsed: Duration);
+    fn finish(&self, label: &'static str, status: CheckStatus);
+    fn settle(&self);
+}
+
+/// Selects the progress implementation for the current output mode.
+///
+/// JSON output is always quiet so stdout remains valid JSON. Human output uses a
+/// transient stderr line only for interactive terminals, then clears it before
+/// the final report is printed.
+pub(super) fn doctor_progress(json: bool) -> std::sync::Arc<dyn DoctorProgress> {
+    if should_show_progress(
+        json,
+        std::env::var("TERM").ok().as_deref(),
+        io::stderr().is_terminal(),
+    ) {
+        std::sync::Arc::new(StderrProgress::default())
+    } else {
+        std::sync::Arc::new(QuietProgress)
+    }
+}
+
+fn should_show_progress(json: bool, term: Option<&str>, stderr_is_tty: bool) -> bool {
+    !json && stderr_is_tty && term != Some("dumb")
+}
+
+struct QuietProgress;
+
+impl DoctorProgress for QuietProgress {
+    fn begin(&self, _label: &'static str) {}
+
+    fn heartbeat(&self, _label: &'static str, _elapsed: Duration) {}
+
+    fn finish(&self, _label: &'static str, _status: CheckStatus) {}
+
+    fn settle(&self) {}
+}
+
+#[derive(Default)]
+struct StderrProgress {
+    state: Mutex<StderrProgressState>,
+}
+
+#[derive(Default)]
+struct StderrProgressState {
+    wrote_line: bool,
+}
+
+impl StderrProgress {
+    fn render(&self, message: String) {
+        let Ok(mut state) = self.state.lock() else {
+            return;
+        };
+        let mut stderr = io::stderr().lock();
+        let _ = write!(stderr, "\r\x1b[2K{message}");
+        let _ = stderr.flush();
+        state.wrote_line = true;
+    }
+}
+
+impl DoctorProgress for StderrProgress {
+    fn begin(&self, label: &'static str) {
+        self.render(format!("Checking {label}..."));
+    }
+
+    fn heartbeat(&self, label: &'static str, elapsed: Duration) {
+        self.render(format!("Still checking {label}... {}s", elapsed.as_secs()));
+    }
+
+    fn finish(&self, _label: &'static str, _status: CheckStatus) {}
+
+    fn settle(&self) {
+        let Ok(mut state) = self.state.lock() else {
+            return;
+        };
+        if !state.wrote_line {
+            return;
+        }
+        let mut stderr = io::stderr().lock();
+        let _ = write!(stderr, "\r\x1b[2K");
+        let _ = stderr.flush();
+        state.wrote_line = false;
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn progress_is_quiet_for_json() {
+        assert!(!should_show_progress(
+            /*json*/ true,
+            Some("xterm-256color"),
+            /*stderr_is_tty*/ true,
+        ));
+    }
+
+    #[test]
+    fn progress_is_quiet_for_non_tty() {
+        assert!(!should_show_progress(
+            /*json*/ false,
+            Some("xterm-256color"),
+            /*stderr_is_tty*/ false,
+        ));
+    }
+
+    #[test]
+    fn progress_is_quiet_for_dumb_terminal() {
+        assert!(!should_show_progress(
+            /*json*/ false,
+            Some("dumb"),
+            /*stderr_is_tty*/ true,
+        ));
+    }
+
+    #[test]
+    fn progress_is_shown_for_human_tty_output() {
+        assert!(should_show_progress(
+            /*json*/ false,
+            Some("xterm-256color"),
+            /*stderr_is_tty*/ true,
+        ));
+    }
+}
diff --git a/codex-rs/cli/src/doctor/runtime.rs b/codex-rs/cli/src/doctor/runtime.rs
new file mode 100644
index 0000000000..96e806762c
--- /dev/null
+++ b/codex-rs/cli/src/doctor/runtime.rs
@@ -0,0 +1,141 @@
+//! Captures how this Codex process was launched.
+//!
+//! Runtime diagnostics answer provenance questions that are hard to infer from
+//! user reports: which binary is running, which install channel it resembles,
+//! which platform it targets, and whether the search command comes from bundled
+//! standalone resources or from PATH.
+
+use std::env;
+use std::process::Command;
+
+use codex_install_context::InstallContext;
+
+use super::CheckStatus;
+use super::DoctorCheck;
+use super::describe_install_context;
+use super::doctor_install_context;
+use super::push_path_detail;
+
+/// Builds the process provenance row for the current Codex executable.
+///
+/// This check is informational and should not fail on its own; inconsistent
+/// install state is reported by the installation and update checks instead.
+pub(super) fn runtime_check() -> DoctorCheck {
+    let current_exe = env::current_exe().ok();
+    let install_context = doctor_install_context(current_exe.as_deref());
+    let os = env::consts::OS;
+    let arch = env::consts::ARCH;
+    let platform = format!("{os}-{arch}");
+    let install_method = install_method_name(&install_context);
+    let mut details = vec![
+        format!("version: {}", env!("CARGO_PKG_VERSION")),
+        format!("platform: {platform}"),
+        format!(
+            "install method: {}",
+            describe_install_context(&install_context)
+        ),
+        format!("commit: {}", build_commit()),
+    ];
+    push_path_detail(&mut details, "current executable", current_exe.as_deref());
+
+    DoctorCheck::new(
+        "runtime.provenance",
+        "runtime",
+        CheckStatus::Ok,
+        format!("running {install_method} on {platform}"),
+    )
+    .details(details)
+}
+
+/// Verifies that the search command selected by the install context is usable.
+///
+/// Standalone installs should point at a bundled ripgrep binary, while local or
+/// package-managed installs usually resolve rg from PATH. A warning here means
+/// features that depend on file search may degrade even when the CLI launches.
+pub(super) fn search_check() -> DoctorCheck {
+    let current_exe = env::current_exe().ok();
+    let install_context = doctor_install_context(current_exe.as_deref());
+    let rg_command = install_context.rg_command();
+    let provider = search_provider(&install_context);
+    let mut details = vec![
+        format!("search command: {}", rg_command.display()),
+        format!("search provider: {provider}"),
+    ];
+
+    let status = if rg_command.components().count() > 1 {
+        match std::fs::metadata(&rg_command) {
+            Ok(metadata) if metadata.is_file() => {
+                details.push("search command readiness: file exists".to_string());
+                CheckStatus::Ok
+            }
+            Ok(_) => {
+                details.push("search command readiness: path is not a file".to_string());
+                CheckStatus::Warning
+            }
+            Err(err) => {
+                details.push(format!("search command readiness: {err}"));
+                CheckStatus::Warning
+            }
+        }
+    } else {
+        match Command::new(&rg_command).arg("--version").output() {
+            Ok(output) if output.status.success() => {
+                let version = String::from_utf8_lossy(&output.stdout)
+                    .lines()
+                    .next()
+                    .unwrap_or("rg version unknown")
+                    .to_string();
+                details.push(format!("search command readiness: {version}"));
+                CheckStatus::Ok
+            }
+            Ok(output) => {
+                details.push(format!(
+                    "search command readiness: exited with status {}",
+                    output.status
+                ));
+                CheckStatus::Warning
+            }
+            Err(err) => {
+                details.push(format!("search command readiness: {err}"));
+                CheckStatus::Warning
+            }
+        }
+    };
+
+    let summary = match status {
+        CheckStatus::Ok => format!("search is OK ({provider})"),
+        CheckStatus::Warning => "search command could not be verified".to_string(),
+        CheckStatus::Fail => unreachable!(),
+    };
+    let mut check = DoctorCheck::new("runtime.search", "search", status, summary).details(details);
+    if status != CheckStatus::Ok {
+        check = check.remediation("Install ripgrep or repair the bundled standalone resources.");
+    }
+    check
+}
+
+fn install_method_name(context: &InstallContext) -> &'static str {
+    match context {
+        InstallContext::Standalone { .. } => "standalone",
+        InstallContext::Npm => "npm",
+        InstallContext::Bun => "bun",
+        InstallContext::Brew => "brew",
+        InstallContext::Other => "local build",
+    }
+}
+
+fn search_provider(context: &InstallContext) -> &'static str {
+    match context {
+        InstallContext::Standalone {
+            resources_dir: Some(resources_dir),
+            ..
+        } if context.rg_command().starts_with(resources_dir) => "bundled",
+        _ => "system",
+    }
+}
+
+fn build_commit() -> &'static str {
+    option_env!("CODEX_BUILD_COMMIT")
+        .or(option_env!("GIT_COMMIT"))
+        .unwrap_or("unknown")
+}
diff --git a/codex-rs/cli/src/doctor/updates.rs b/codex-rs/cli/src/doctor/updates.rs
new file mode 100644
index 0000000000..3d728fc07b
--- /dev/null
+++ b/codex-rs/cli/src/doctor/updates.rs
@@ -0,0 +1,227 @@
+//! Diagnoses whether Codex update paths target the running installation.
+//!
+//! Update diagnostics combine cached version metadata, install-channel hints,
+//! and bounded latest-version probes. For npm-managed launches, this module also
+//! verifies that npm install -g would update the package root that launched the
+//! current process, which catches PATH and prefix mismatches before the user runs
+//! an update command.
+
+use std::path::Path;
+
+use codex_core::config::Config;
+use codex_install_context::InstallContext;
+use serde::Deserialize;
+
+use super::CheckStatus;
+use super::DoctorCheck;
+use super::NpmRootCheck;
+use super::doctor_install_context;
+use super::doctor_managed_by_npm;
+use super::npm_global_root_check;
+use super::run_command;
+
+const VERSION_FILE_NAME: &str = "version.json";
+const GITHUB_LATEST_RELEASE_URL: &str = "https://api.github.com/repos/openai/codex/releases/latest";
+const HOMEBREW_CASK_API_URL: &str = "https://formulae.brew.sh/api/cask/codex.json";
+
+/// Builds the update-health row for the current installation.
+///
+/// Network failures while fetching latest-version metadata degrade the row to a
+/// warning instead of failing doctor outright; update freshness is useful
+/// support context but should not mask more direct install/config failures.
+pub(super) fn updates_check(config: &Config) -> DoctorCheck {
+    let current_exe = std::env::current_exe().ok();
+    let install_context = doctor_install_context(current_exe.as_deref());
+    let mut details = vec![
+        format!(
+            "check for update on startup: {}",
+            config.check_for_update_on_startup
+        ),
+        format!("update action: {}", update_action_label(&install_context)),
+    ];
+    let version_file = config.codex_home.join(VERSION_FILE_NAME);
+    push_cached_version_details(&mut details, &version_file);
+
+    let mut status = CheckStatus::Ok;
+    let mut summary = "update configuration is locally consistent".to_string();
+    let mut remediation = None;
+
+    if doctor_managed_by_npm(current_exe.as_deref()) {
+        match npm_global_root_check() {
+            NpmRootCheck::Match { package_root } => {
+                details.push(format!("npm update target: {}", package_root.display()));
+            }
+            NpmRootCheck::Mismatch {
+                running_package_root,
+                npm_package_root,
+            } => {
+                status = CheckStatus::Fail;
+                summary = "update would target a different npm install".to_string();
+                details.push(format!(
+                    "running package root: {}",
+                    running_package_root.display()
+                ));
+                details.push(format!("npm package root: {}", npm_package_root.display()));
+                remediation = Some(format!(
+                    "Fix PATH or npm prefix so the running package root ({}) matches the npm global package root ({}).",
+                    running_package_root.display(),
+                    npm_package_root.display()
+                ));
+            }
+            NpmRootCheck::MissingPackageRoot => {
+                status = status.max(CheckStatus::Warning);
+                summary = "npm update target could not be proven".to_string();
+                remediation = Some(
+                    "Reinstall or update Codex so the JS shim provides CODEX_MANAGED_PACKAGE_ROOT."
+                        .to_string(),
+                );
+            }
+            NpmRootCheck::NpmUnavailable(error) => {
+                status = status.max(CheckStatus::Warning);
+                summary = "npm update target could not be inspected".to_string();
+                details.push(format!("npm root -g failed: {error}"));
+            }
+        }
+    }
+
+    match fetch_latest_version(&install_context) {
+        Ok(latest_version) => {
+            details.push(format!("latest version: {latest_version}"));
+            if is_newer(&latest_version, env!("CARGO_PKG_VERSION")) == Some(true) {
+                details.push("latest version status: newer version is available".to_string());
+            } else {
+                details.push("latest version status: current version is not older".to_string());
+            }
+        }
+        Err(err) => {
+            status = status.max(CheckStatus::Warning);
+            details.push(format!("latest version probe: {err}"));
+        }
+    }
+
+    let mut check = DoctorCheck::new("updates.status", "updates", status, summary).details(details);
+    if let Some(remediation) = remediation {
+        check = check.remediation(remediation);
+    }
+    check
+}
+
+fn push_cached_version_details(details: &mut Vec<String>, version_file: &Path) {
+    details.push(format!("version cache: {}", version_file.display()));
+    match std::fs::read_to_string(version_file) {
+        Ok(contents) => match serde_json::from_str::<VersionInfo>(&contents) {
+            Ok(info) => {
+                details.push(format!("cached latest version: {}", info.latest_version));
+                if let Some(last_checked_at) = info.last_checked_at {
+                    details.push(format!("last checked at: {last_checked_at}"));
+                }
+                if let Some(dismissed_version) = info.dismissed_version {
+                    details.push(format!("dismissed version: {dismissed_version}"));
+                }
+            }
+            Err(err) => details.push(format!("version cache parse: {err}")),
+        },
+        Err(err) if err.kind() == std::io::ErrorKind::NotFound => {
+            details.push("version cache: missing".to_string());
+        }
+        Err(err) => details.push(format!("version cache read: {err}")),
+    }
+}
+
+fn update_action_label(context: &InstallContext) -> &'static str {
+    match context {
+        InstallContext::Npm => "npm install -g @openai/codex",
+        InstallContext::Bun => "bun install -g @openai/codex",
+        InstallContext::Brew => "brew upgrade --cask codex",
+        InstallContext::Standalone { .. } => "standalone installer",
+        InstallContext::Other => "manual or unknown",
+    }
+}
+
+fn fetch_latest_version(context: &InstallContext) -> Result<String, String> {
+    match context {
+        InstallContext::Brew => fetch_homebrew_cask_version(),
+        InstallContext::Npm
+        | InstallContext::Bun
+        | InstallContext::Standalone { .. }
+        | InstallContext::Other => fetch_latest_github_release_version(),
+    }
+}
+
+fn fetch_latest_github_release_version() -> Result<String, String> {
+    #[derive(Deserialize)]
+    struct ReleaseInfo {
+        tag_name: String,
+    }
+
+    let info = http_get_json::<ReleaseInfo>(GITHUB_LATEST_RELEASE_URL)?;
+    info.tag_name
+        .strip_prefix("rust-v")
+        .map(str::to_string)
+        .ok_or_else(|| format!("failed to parse latest tag {}", info.tag_name))
+}
+
+fn fetch_homebrew_cask_version() -> Result<String, String> {
+    #[derive(Deserialize)]
+    struct HomebrewCaskInfo {
+        version: String,
+    }
+
+    http_get_json::<HomebrewCaskInfo>(HOMEBREW_CASK_API_URL).map(|info| info.version)
+}
+
+fn http_get_json<T>(url: &str) -> Result<T, String>
+where
+    T: for<'de> Deserialize<'de>,
+{
+    let body = run_command("curl", ["-fsSL", "--max-time", "5", url])?;
+    serde_json::from_str::<T>(&body).map_err(|err| err.to_string())
+}
+
+fn is_newer(latest: &str, current: &str) -> Option<bool> {
+    match (parse_version(latest), parse_version(current)) {
+        (Some(latest), Some(current)) => Some(latest > current),
+        (Some(_), None) | (None, Some(_)) | (None, None) => None,
+    }
+}
+
+fn parse_version(value: &str) -> Option<(u64, u64, u64)> {
+    let mut parts = value.trim().split('.');
+    let major = parts.next()?.parse::<u64>().ok()?;
+    let minor = parts.next()?.parse::<u64>().ok()?;
+    let patch = parts.next()?.parse::<u64>().ok()?;
+    Some((major, minor, patch))
+}
+
+#[derive(Deserialize)]
+struct VersionInfo {
+    latest_version: String,
+    #[serde(default)]
+    last_checked_at: Option<String>,
+    #[serde(default)]
+    dismissed_version: Option<String>,
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn is_newer_compares_plain_semver() {
+        assert_eq!(is_newer("1.2.4", "1.2.3"), Some(true));
+        assert_eq!(is_newer("1.2.3", "1.2.4"), Some(false));
+        assert_eq!(is_newer("1.2.3-beta.1", "1.2.2"), None);
+    }
+
+    #[test]
+    fn update_action_labels_install_contexts() {
+        assert_eq!(
+            update_action_label(&InstallContext::Npm),
+            "npm install -g @openai/codex"
+        );
+        assert_eq!(
+            update_action_label(&InstallContext::Other),
+            "manual or unknown"
+        );
+    }
+}
diff --git a/codex-rs/cli/src/login.rs b/codex-rs/cli/src/login.rs
index 16add7ac90..6fdc62fdb1 100644
--- a/codex-rs/cli/src/login.rs
+++ b/codex-rs/cli/src/login.rs
@@ -115,7 +115,7 @@ fn print_login_server_start(actual_port: u16, auth_url: &str) {
 
 pub async fn login_with_chatgpt(
     codex_home: PathBuf,
-    forced_chatgpt_workspace_id: Option<String>,
+    forced_chatgpt_workspace_id: Option<Vec<String>>,
     cli_auth_credentials_store_mode: AuthCredentialsStoreMode,
 ) -> std::io::Result<()> {
     let opts = ServerOptions::new(
diff --git a/codex-rs/cli/src/main.rs b/codex-rs/cli/src/main.rs
index 36ce876b88..1b71ab15ae 100644
--- a/codex-rs/cli/src/main.rs
+++ b/codex-rs/cli/src/main.rs
@@ -37,6 +37,8 @@ use codex_tui::ExitReason;
 use codex_tui::UpdateAction;
 use codex_utils_absolute_path::AbsolutePathBuf;
 use codex_utils_cli::CliConfigOverrides;
+use codex_utils_cli::ProfileV2Name;
+use codex_utils_cli::resume_hint;
 use owo_colors::OwoColorize;
 use std::io::IsTerminal;
 use std::path::PathBuf;
@@ -46,23 +48,35 @@ use supports_color::Stream;
 mod app_cmd;
 #[cfg(any(target_os = "macos", target_os = "windows"))]
 mod desktop_app;
+mod doctor;
 mod marketplace_cmd;
 mod mcp_cmd;
+mod plugin_cmd;
+mod remote_control_cmd;
+mod state_db_recovery;
 #[cfg(not(windows))]
 mod wsl_paths;
 
-use crate::marketplace_cmd::MarketplaceCli;
 use crate::mcp_cmd::McpCli;
+use crate::plugin_cmd::PluginCli;
+use crate::plugin_cmd::PluginSubcommand;
+use crate::remote_control_cmd::RemoteControlCommand;
+use doctor::DoctorCommand;
+use state_db_recovery as local_state_db;
 
+use codex_config::LoaderOverrides;
 use codex_core::build_models_manager;
-use codex_core::config::Config;
+use codex_core::config::ConfigBuilder;
 use codex_core::config::ConfigOverrides;
 use codex_core::config::edit::ConfigEditsBuilder;
 use codex_core::config::find_codex_home;
+use codex_core::config::resolve_profile_v2_config_path;
 use codex_features::FEATURES;
 use codex_features::Stage;
 use codex_features::is_known_feature_key;
 use codex_login::AuthManager;
+use codex_login::CodexAuth;
+use codex_login::read_codex_access_token_from_env;
 use codex_memories_write::clear_memory_roots_contents;
 use codex_models_manager::bundled_models_response;
 use codex_models_manager::manager::RefreshStrategy;
@@ -109,7 +123,7 @@ enum Subcommand {
     Exec(ExecCli),
 
     /// Run a code review non-interactively.
-    Review(ReviewArgs),
+    Review(ReviewCommand),
 
     /// Manage login.
     Login(LoginCommand),
@@ -124,13 +138,13 @@ enum Subcommand {
     Plugin(PluginCli),
 
     /// Start Codex as an MCP server (stdio).
-    McpServer,
+    McpServer(McpServerCommand),
 
     /// [experimental] Run the app server or related tooling.
     AppServer(AppServerCommand),
 
-    /// [experimental] Ensure the app-server daemon is running with remote control enabled.
-    RemoteControl,
+    /// [experimental] Manage the app-server daemon with remote control enabled.
+    RemoteControl(RemoteControlCommand),
 
     /// Launch the Codex desktop app (opens the app installer if missing).
     #[cfg(any(target_os = "macos", target_os = "windows"))]
@@ -142,6 +156,9 @@ enum Subcommand {
     /// Update Codex to the latest version.
     Update,
 
+    /// Diagnose local Codex installation, config, auth, and runtime health.
+    Doctor(DoctorCommand),
+
     /// Run commands within a Codex-provided sandbox.
     Sandbox(SandboxArgs),
 
@@ -181,22 +198,6 @@ enum Subcommand {
     Features(FeaturesCli),
 }
 
-#[derive(Debug, Parser)]
-#[command(bin_name = "codex plugin")]
-struct PluginCli {
-    #[clap(flatten)]
-    pub config_overrides: CliConfigOverrides,
-
-    #[command(subcommand)]
-    subcommand: PluginSubcommand,
-}
-
-#[derive(Debug, clap::Subcommand)]
-enum PluginSubcommand {
-    /// Manage plugin marketplaces for Codex.
-    Marketplace(MarketplaceCli),
-}
-
 #[derive(Debug, Parser)]
 struct CompletionCommand {
     /// Shell to generate completions for
@@ -266,6 +267,23 @@ struct DebugModelsCommand {
     bundled: bool,
 }
 
+#[derive(Debug, Parser)]
+struct ReviewCommand {
+    /// Error out when config.toml contains fields that are not recognized by this version of Codex.
+    #[arg(long = "strict-config", default_value_t = false)]
+    strict_config: bool,
+
+    #[clap(flatten)]
+    args: ReviewArgs,
+}
+
+#[derive(Debug, Parser)]
+struct McpServerCommand {
+    /// Error out when config.toml contains fields that are not recognized by this version of Codex.
+    #[arg(long = "strict-config", default_value_t = false)]
+    strict_config: bool,
+}
+
 #[derive(Debug, Parser)]
 struct DebugTraceReduceCommand {
     /// Trace bundle directory containing manifest.json and trace.jsonl.
@@ -419,6 +437,10 @@ struct AppServerCommand {
     #[command(subcommand)]
     subcommand: Option<AppServerSubcommand>,
 
+    /// Error out when config.toml contains fields that are not recognized by this version of Codex.
+    #[arg(long = "strict-config", default_value_t = false)]
+    strict_config: bool,
+
     /// Transport endpoint URL. Supported values: `stdio://` (default),
     /// `unix://`, `unix://PATH`, `ws://IP:PORT`, `off`.
     #[arg(
@@ -471,6 +493,10 @@ struct ExecServerCommand {
     /// Human-readable executor name.
     #[arg(long = "name", value_name = "NAME")]
     name: Option<String>,
+
+    /// Use Agent Identity auth from CODEX_ACCESS_TOKEN for remote registration.
+    #[arg(long = "use-agent-identity-auth", requires = "remote")]
+    use_agent_identity_auth: bool,
 }
 
 #[derive(Debug, clap::Subcommand)]
@@ -590,6 +616,7 @@ fn format_exit_messages(exit_info: AppExitInfo, color_enabled: bool) -> Vec<Stri
     let AppExitInfo {
         token_usage,
         thread_id: conversation_id,
+        thread_name,
         ..
     } = exit_info;
 
@@ -598,9 +625,7 @@ fn format_exit_messages(exit_info: AppExitInfo, color_enabled: bool) -> Vec<Stri
         lines.push(token_usage.to_string());
     }
 
-    if let Some(resume_cmd) =
-        codex_core::util::resume_command(/*thread_name*/ None, conversation_id)
-    {
+    if let Some(resume_cmd) = resume_hint(thread_name.as_deref(), conversation_id) {
         let command = if color_enabled {
             resume_cmd.cyan().to_string()
         } else {
@@ -810,6 +835,11 @@ async fn cli_main(arg0_paths: Arg0DispatchPaths) -> anyhow::Result<()> {
     root_config_overrides.raw_overrides.extend(toggle_overrides);
     let root_remote = remote.remote;
     let root_remote_auth_token_env = remote.remote_auth_token_env;
+    let root_strict_config = interactive.strict_config;
+    reject_root_strict_config_for_subcommand(root_strict_config, &subcommand)?;
+    if let Some(subcommand) = subcommand.as_ref() {
+        profile_v2_for_subcommand(&interactive, subcommand)?;
+    }
 
     match subcommand {
         None => {
@@ -835,33 +865,46 @@ async fn cli_main(arg0_paths: Arg0DispatchPaths) -> anyhow::Result<()> {
             exec_cli
                 .shared
                 .inherit_exec_root_options(&interactive.shared);
+            exec_cli.strict_config |= root_strict_config;
             prepend_config_flags(
                 &mut exec_cli.config_overrides,
                 root_config_overrides.clone(),
             );
             codex_exec::run_main(exec_cli, arg0_paths.clone()).await?;
         }
-        Some(Subcommand::Review(review_args)) => {
+        Some(Subcommand::Review(ReviewCommand {
+            strict_config,
+            args: review_args,
+        })) => {
             reject_remote_mode_for_subcommand(
                 root_remote.as_deref(),
                 root_remote_auth_token_env.as_deref(),
                 "review",
             )?;
             let mut exec_cli = ExecCli::try_parse_from(["codex", "exec"])?;
+            exec_cli
+                .shared
+                .inherit_exec_root_options(&interactive.shared);
             exec_cli.command = Some(ExecCommand::Review(review_args));
+            exec_cli.strict_config = strict_config || root_strict_config;
             prepend_config_flags(
                 &mut exec_cli.config_overrides,
                 root_config_overrides.clone(),
             );
             codex_exec::run_main(exec_cli, arg0_paths.clone()).await?;
         }
-        Some(Subcommand::McpServer) => {
+        Some(Subcommand::McpServer(McpServerCommand { strict_config })) => {
             reject_remote_mode_for_subcommand(
                 root_remote.as_deref(),
                 root_remote_auth_token_env.as_deref(),
                 "mcp-server",
             )?;
-            codex_mcp_server::run_main(arg0_paths.clone(), root_config_overrides).await?;
+            codex_mcp_server::run_main(
+                arg0_paths.clone(),
+                root_config_overrides,
+                strict_config || root_strict_config,
+            )
+            .await?;
         }
         Some(Subcommand::Mcp(mut mcp_cli)) => {
             reject_remote_mode_for_subcommand(
@@ -885,20 +928,41 @@ async fn cli_main(arg0_paths: Arg0DispatchPaths) -> anyhow::Result<()> {
             } = plugin_cli;
             prepend_config_flags(&mut config_overrides, root_config_overrides.clone());
             match subcommand {
+                PluginSubcommand::Add(args) => {
+                    let overrides = config_overrides
+                        .parse_overrides()
+                        .map_err(anyhow::Error::msg)?;
+                    plugin_cmd::run_plugin_add(overrides, args).await?;
+                }
+                PluginSubcommand::List(args) => {
+                    let overrides = config_overrides
+                        .parse_overrides()
+                        .map_err(anyhow::Error::msg)?;
+                    plugin_cmd::run_plugin_list(overrides, args).await?;
+                }
                 PluginSubcommand::Marketplace(mut marketplace_cli) => {
                     prepend_config_flags(&mut marketplace_cli.config_overrides, config_overrides);
                     marketplace_cli.run().await?;
                 }
+                PluginSubcommand::Remove(args) => {
+                    let overrides = config_overrides
+                        .parse_overrides()
+                        .map_err(anyhow::Error::msg)?;
+                    plugin_cmd::run_plugin_remove(overrides, args).await?;
+                }
             }
         }
         Some(Subcommand::AppServer(app_server_cli)) => {
             let AppServerCommand {
                 subcommand,
+                strict_config: app_server_strict_config,
                 listen,
                 remote_control,
                 analytics_default_enabled,
                 auth,
             } = app_server_cli;
+            let strict_config = app_server_strict_config || root_strict_config;
+            reject_strict_config_for_app_server_subcommand(strict_config, subcommand.as_ref())?;
             reject_remote_mode_for_app_server_subcommand(
                 root_remote.as_deref(),
                 root_remote_auth_token_env.as_deref(),
@@ -915,7 +979,8 @@ async fn cli_main(arg0_paths: Arg0DispatchPaths) -> anyhow::Result<()> {
                     codex_app_server::run_main_with_transport_options(
                         arg0_paths.clone(),
                         root_config_overrides,
-                        codex_config::LoaderOverrides::default(),
+                        LoaderOverrides::default(),
+                        strict_config,
                         analytics_default_enabled,
                         transport,
                         codex_protocol::protocol::SessionSource::VSCode,
@@ -991,14 +1056,19 @@ async fn cli_main(arg0_paths: Arg0DispatchPaths) -> anyhow::Result<()> {
                 }
             }
         }
-        Some(Subcommand::RemoteControl) => {
+        Some(Subcommand::RemoteControl(remote_control_cli)) => {
+            let subcommand_name = remote_control_cli.subcommand_name();
             reject_remote_mode_for_subcommand(
                 root_remote.as_deref(),
                 root_remote_auth_token_env.as_deref(),
-                "remote-control",
+                subcommand_name,
             )?;
-            let output = codex_app_server_daemon::ensure_remote_control_started().await?;
-            println!("{}", serde_json::to_string(&output)?);
+            remote_control_cmd::run(
+                remote_control_cli,
+                arg0_paths.clone(),
+                root_config_overrides,
+            )
+            .await?;
         }
         #[cfg(any(target_os = "macos", target_os = "windows"))]
         Some(Subcommand::App(app_cli)) => {
@@ -1135,6 +1205,20 @@ async fn cli_main(arg0_paths: Arg0DispatchPaths) -> anyhow::Result<()> {
             )?;
             run_update_command()?;
         }
+        Some(Subcommand::Doctor(doctor_cli)) => {
+            reject_remote_mode_for_subcommand(
+                root_remote.as_deref(),
+                root_remote_auth_token_env.as_deref(),
+                "doctor",
+            )?;
+            doctor::run_doctor(
+                doctor_cli,
+                root_config_overrides.clone(),
+                &interactive,
+                &arg0_paths,
+            )
+            .await?;
+        }
         Some(Subcommand::Cloud(mut cloud_cli)) => {
             reject_remote_mode_for_subcommand(
                 root_remote.as_deref(),
@@ -1292,7 +1376,13 @@ async fn cli_main(arg0_paths: Arg0DispatchPaths) -> anyhow::Result<()> {
                 root_remote_auth_token_env.as_deref(),
                 "exec-server",
             )?;
-            run_exec_server_command(cmd, &arg0_paths).await?;
+            run_exec_server_command(
+                cmd,
+                &arg0_paths,
+                &root_config_overrides,
+                interactive.config_profile.clone(),
+            )
+            .await?;
         }
         Some(Subcommand::Features(FeaturesCli { sub })) => match sub {
             FeaturesSubcommand::List => {
@@ -1320,11 +1410,11 @@ async fn cli_main(arg0_paths: Arg0DispatchPaths) -> anyhow::Result<()> {
                     ..Default::default()
                 };
 
-                let config = Config::load_with_cli_overrides_and_harness_overrides(
-                    cli_kv_overrides,
-                    overrides,
-                )
-                .await?;
+                let config = ConfigBuilder::default()
+                    .cli_overrides(cli_kv_overrides)
+                    .harness_overrides(overrides)
+                    .build()
+                    .await?;
                 let mut rows = Vec::with_capacity(FEATURES.len());
                 let mut name_width = 0;
                 let mut stage_width = 0;
@@ -1364,9 +1454,33 @@ async fn cli_main(arg0_paths: Arg0DispatchPaths) -> anyhow::Result<()> {
     Ok(())
 }
 
+fn profile_v2_for_subcommand<'a>(
+    interactive: &'a TuiCli,
+    subcommand: &Subcommand,
+) -> anyhow::Result<Option<&'a ProfileV2Name>> {
+    let Some(profile_v2) = interactive.config_profile_v2.as_ref() else {
+        return Ok(None);
+    };
+
+    match subcommand {
+        Subcommand::Exec(_)
+        | Subcommand::Review(_)
+        | Subcommand::Resume(_)
+        | Subcommand::Fork(_)
+        | Subcommand::Debug(DebugCommand {
+            subcommand: DebugSubcommand::PromptInput(_),
+        }) => Ok(Some(profile_v2)),
+        _ => anyhow::bail!(
+            "--profile-v2 only applies to runtime commands: `codex`, `codex exec`, `codex review`, `codex resume`, `codex fork`, and `codex debug prompt-input`."
+        ),
+    }
+}
+
 async fn run_exec_server_command(
     cmd: ExecServerCommand,
     arg0_paths: &Arg0DispatchPaths,
+    root_config_overrides: &CliConfigOverrides,
+    config_profile: Option<String>,
 ) -> anyhow::Result<()> {
     let codex_self_exe = arg0_paths
         .codex_self_exe
@@ -1380,8 +1494,14 @@ async fn run_exec_server_command(
         let executor_id = cmd
             .executor_id
             .ok_or_else(|| anyhow::anyhow!("--executor-id is required when --remote is set"))?;
+        let auth_provider = load_exec_server_remote_auth_provider(
+            root_config_overrides,
+            config_profile,
+            cmd.use_agent_identity_auth,
+        )
+        .await?;
         let mut remote_config =
-            codex_exec_server::RemoteExecutorConfig::new(base_url, executor_id)?;
+            codex_exec_server::RemoteExecutorConfig::new(base_url, executor_id, auth_provider)?;
         if let Some(name) = cmd.name {
             remote_config.name = name;
         }
@@ -1397,6 +1517,75 @@ async fn run_exec_server_command(
         .map_err(anyhow::Error::from_boxed)
 }
 
+async fn load_exec_server_remote_auth_provider(
+    root_config_overrides: &CliConfigOverrides,
+    config_profile: Option<String>,
+    use_agent_identity_auth: bool,
+) -> anyhow::Result<codex_api::SharedAuthProvider> {
+    let config = load_exec_server_remote_config(root_config_overrides, config_profile).await?;
+    if use_agent_identity_auth {
+        let agent_identity_jwt = read_codex_access_token_from_env().ok_or_else(|| {
+            anyhow::anyhow!("CODEX_ACCESS_TOKEN is required when --use-agent-identity-auth is set")
+        })?;
+        let auth =
+            CodexAuth::from_agent_identity_jwt(&agent_identity_jwt, Some(&config.chatgpt_base_url))
+                .await?;
+        return Ok(codex_model_provider::auth_provider_from_auth(&auth));
+    }
+
+    let auth = load_exec_server_remote_auth(
+        &config,
+        "remote exec-server registration requires ChatGPT authentication; run `codex login` first",
+    )
+    .await?;
+
+    if !auth.is_chatgpt_auth() {
+        anyhow::bail!(
+            "remote exec-server registration requires ChatGPT authentication; API key and Agent Identity auth are not supported"
+        );
+    }
+
+    Ok(codex_model_provider::auth_provider_from_auth(&auth))
+}
+
+async fn load_exec_server_remote_config(
+    root_config_overrides: &CliConfigOverrides,
+    config_profile: Option<String>,
+) -> anyhow::Result<codex_core::config::Config> {
+    let cli_kv_overrides = root_config_overrides
+        .parse_overrides()
+        .map_err(anyhow::Error::msg)?;
+    Ok(ConfigBuilder::default()
+        .cli_overrides(cli_kv_overrides)
+        .harness_overrides(ConfigOverrides {
+            config_profile,
+            ..Default::default()
+        })
+        .build()
+        .await?)
+}
+
+async fn load_exec_server_remote_auth(
+    config: &codex_core::config::Config,
+    missing_auth_error: &'static str,
+) -> anyhow::Result<codex_login::CodexAuth> {
+    let auth_manager =
+        AuthManager::shared_from_config(config, /*enable_codex_api_key_env*/ true).await;
+
+    let auth = match auth_manager.auth().await {
+        Some(auth) => auth,
+        None => {
+            auth_manager.reload().await;
+            auth_manager
+                .auth()
+                .await
+                .ok_or_else(|| anyhow::anyhow!(missing_auth_error))?
+        }
+    };
+
+    Ok(auth)
+}
+
 async fn enable_feature_in_config(interactive: &TuiCli, feature: &str) -> anyhow::Result<()> {
     FeatureToggles::validate_feature(feature)?;
     let codex_home = find_codex_home()?;
@@ -1422,6 +1611,22 @@ async fn disable_feature_in_config(interactive: &TuiCli, feature: &str) -> anyho
     Ok(())
 }
 
+fn loader_overrides_for_profile(
+    profile_v2: Option<&ProfileV2Name>,
+) -> anyhow::Result<LoaderOverrides> {
+    match profile_v2 {
+        Some(profile_v2) => {
+            let codex_home = find_codex_home()?;
+            Ok(LoaderOverrides {
+                user_config_path: Some(resolve_profile_v2_config_path(&codex_home, profile_v2)),
+                user_config_profile: Some(profile_v2.clone()),
+                ..Default::default()
+            })
+        }
+        None => Ok(LoaderOverrides::default()),
+    }
+}
+
 fn maybe_print_under_development_feature_warning(
     codex_home: &std::path::Path,
     interactive: &TuiCli,
@@ -1464,6 +1669,7 @@ async fn run_debug_prompt_input_command(
     interactive: TuiCli,
     arg0_paths: Arg0DispatchPaths,
 ) -> anyhow::Result<()> {
+    let loader_overrides = loader_overrides_for_profile(interactive.config_profile_v2.as_ref())?;
     let shared = interactive.shared.into_inner();
     let mut cli_kv_overrides = root_config_overrides
         .parse_overrides()
@@ -1500,14 +1706,18 @@ async fn run_debug_prompt_input_command(
         additional_writable_roots: shared.add_dir,
         ..Default::default()
     };
-    let config =
-        Config::load_with_cli_overrides_and_harness_overrides(cli_kv_overrides, overrides).await?;
+    let config = ConfigBuilder::default()
+        .cli_overrides(cli_kv_overrides)
+        .harness_overrides(overrides)
+        .loader_overrides(loader_overrides)
+        .build()
+        .await?;
 
     let mut input = shared
         .images
         .into_iter()
         .chain(cmd.images)
-        .map(|path| UserInput::LocalImage { path })
+        .map(|path| UserInput::LocalImage { path, detail: None })
         .collect::<Vec<_>>();
     if let Some(prompt) = cmd.prompt.or(interactive.prompt) {
         input.push(UserInput::Text {
@@ -1532,7 +1742,10 @@ async fn run_debug_models_command(
         let cli_overrides = root_config_overrides
             .parse_overrides()
             .map_err(anyhow::Error::msg)?;
-        let config = Config::load_with_cli_overrides(cli_overrides).await?;
+        let config = ConfigBuilder::default()
+            .cli_overrides(cli_overrides)
+            .build()
+            .await?;
         let auth_manager =
             AuthManager::shared_from_config(&config, /*enable_codex_api_key_env*/ true).await;
         let models_manager = build_models_manager(&config, auth_manager);
@@ -1557,8 +1770,11 @@ async fn run_debug_clear_memories_command(
         config_profile: interactive.config_profile.clone(),
         ..Default::default()
     };
-    let config =
-        Config::load_with_cli_overrides_and_harness_overrides(cli_kv_overrides, overrides).await?;
+    let config = ConfigBuilder::default()
+        .cli_overrides(cli_kv_overrides)
+        .harness_overrides(overrides)
+        .build()
+        .await?;
 
     let state_path = state_db_path(config.sqlite_home.as_path());
     let mut cleared_state_db = false;
@@ -1593,9 +1809,7 @@ fn prepend_config_flags(
     subcommand_config_overrides: &mut CliConfigOverrides,
     cli_config_overrides: CliConfigOverrides,
 ) {
-    subcommand_config_overrides
-        .raw_overrides
-        .splice(0..0, cli_config_overrides.raw_overrides);
+    subcommand_config_overrides.prepend_root_overrides(cli_config_overrides);
 }
 
 fn reject_remote_mode_for_subcommand(
@@ -1616,12 +1830,104 @@ fn reject_remote_mode_for_subcommand(
     Ok(())
 }
 
+fn reject_root_strict_config_for_subcommand(
+    strict_config: bool,
+    subcommand: &Option<Subcommand>,
+) -> anyhow::Result<()> {
+    if !strict_config {
+        return Ok(());
+    }
+
+    match unsupported_subcommand_name_for_strict_config(subcommand) {
+        Some(subcommand_name) => {
+            reject_strict_config_for_unsupported_subcommand(strict_config, subcommand_name)
+        }
+        None => Ok(()),
+    }
+}
+
+/// Return the selected subcommand name when a root-level `--strict-config`
+/// flag should be rejected after parsing.
+///
+/// `--strict-config` is parsed on the root interactive CLI so commands like
+/// `codex --strict-config` continue to work for the TUI and for wrappers that
+/// forward root options into another command shape. Clap will still accept that
+/// root flag before the dispatcher knows which subcommand the user selected, so
+/// unsupported subcommands need an explicit post-parse reject path.
+///
+/// `Some(...)` returns the user-facing command name fragment to embed in the
+/// rejection error, such as `cloud` or `app-server proxy`. `None` means the
+/// selected command is allowed to inherit root `--strict-config`.
+fn unsupported_subcommand_name_for_strict_config(
+    subcommand: &Option<Subcommand>,
+) -> Option<&'static str> {
+    match subcommand {
+        None
+        | Some(Subcommand::Exec(_))
+        | Some(Subcommand::Review(_))
+        | Some(Subcommand::McpServer(_))
+        | Some(Subcommand::Resume(_))
+        | Some(Subcommand::Fork(_))
+        | Some(Subcommand::Doctor(_)) => None,
+        Some(Subcommand::AppServer(app_server)) if app_server.subcommand.is_none() => None,
+        Some(Subcommand::AppServer(app_server)) => {
+            Some(app_server_subcommand_name(app_server.subcommand.as_ref()))
+        }
+        Some(Subcommand::RemoteControl(remote_control)) => Some(remote_control.subcommand_name()),
+        Some(Subcommand::Mcp(_)) => Some("mcp"),
+        Some(Subcommand::Plugin(_)) => Some("plugin"),
+        #[cfg(any(target_os = "macos", target_os = "windows"))]
+        Some(Subcommand::App(_)) => Some("app"),
+        Some(Subcommand::Login(_)) => Some("login"),
+        Some(Subcommand::Logout(_)) => Some("logout"),
+        Some(Subcommand::Completion(_)) => Some("completion"),
+        Some(Subcommand::Update) => Some("update"),
+        Some(Subcommand::Cloud(_)) => Some("cloud"),
+        Some(Subcommand::Sandbox(_)) => Some("sandbox"),
+        Some(Subcommand::Debug(_)) => Some("debug"),
+        Some(Subcommand::Execpolicy(_)) => Some("execpolicy"),
+        Some(Subcommand::Apply(_)) => Some("apply"),
+        Some(Subcommand::ResponsesApiProxy(_)) => Some("responses-api-proxy"),
+        Some(Subcommand::StdioToUds(_)) => Some("stdio-to-uds"),
+        Some(Subcommand::ExecServer(_)) => Some("exec-server"),
+        Some(Subcommand::Features(_)) => Some("features"),
+    }
+}
+
+fn reject_strict_config_for_app_server_subcommand(
+    strict_config: bool,
+    subcommand: Option<&AppServerSubcommand>,
+) -> anyhow::Result<()> {
+    if subcommand.is_none() {
+        return Ok(());
+    }
+    reject_strict_config_for_unsupported_subcommand(
+        strict_config,
+        app_server_subcommand_name(subcommand),
+    )
+}
+
+fn reject_strict_config_for_unsupported_subcommand(
+    strict_config: bool,
+    subcommand: &str,
+) -> anyhow::Result<()> {
+    if strict_config {
+        anyhow::bail!("`--strict-config` is not supported for `codex {subcommand}`");
+    }
+    Ok(())
+}
+
 fn reject_remote_mode_for_app_server_subcommand(
     remote: Option<&str>,
     remote_auth_token_env: Option<&str>,
     subcommand: Option<&AppServerSubcommand>,
 ) -> anyhow::Result<()> {
-    let subcommand_name = match subcommand {
+    let subcommand_name = app_server_subcommand_name(subcommand);
+    reject_remote_mode_for_subcommand(remote, remote_auth_token_env, subcommand_name)
+}
+
+fn app_server_subcommand_name(subcommand: Option<&AppServerSubcommand>) -> &'static str {
+    match subcommand {
         None => "app-server",
         Some(AppServerSubcommand::Daemon(daemon)) => match daemon.subcommand {
             AppServerDaemonSubcommand::Bootstrap(_) => "app-server daemon bootstrap",
@@ -1643,8 +1949,7 @@ fn reject_remote_mode_for_app_server_subcommand(
         Some(AppServerSubcommand::GenerateInternalJsonSchema(_)) => {
             "app-server generate-internal-json-schema"
         }
-    };
-    reject_remote_mode_for_subcommand(remote, remote_auth_token_env, subcommand_name)
+    }
 }
 
 async fn print_app_server_daemon_output(command: AppServerLifecycleCommand) -> anyhow::Result<()> {
@@ -1738,13 +2043,47 @@ async fn run_interactive_tui(
         };
         *slot = Some(auth_token);
     }
-    codex_tui::run_main(
-        interactive,
-        arg0_paths,
-        codex_config::LoaderOverrides::default(),
-        remote_endpoint,
-    )
-    .await
+    let start_tui = || {
+        codex_tui::run_main(
+            interactive.clone(),
+            arg0_paths.clone(),
+            codex_config::LoaderOverrides::default(),
+            remote_endpoint.clone(),
+        )
+    };
+    let mut attempted_repair = false;
+    loop {
+        let err = match start_tui().await {
+            Ok(exit_info) => return Ok(exit_info),
+            Err(err) => err,
+        };
+        let Some(startup_error) = local_state_db::startup_error(&err) else {
+            return Err(err);
+        };
+        if local_state_db::is_locked(startup_error.detail()) {
+            local_state_db::print_locked_guidance(startup_error);
+            return Ok(AppExitInfo::fatal(startup_error.to_string()));
+        }
+        if attempted_repair {
+            local_state_db::print_diagnostic_guidance(startup_error);
+            return Ok(AppExitInfo::fatal(startup_error.to_string()));
+        }
+        if !local_state_db::confirm_repair(startup_error)? {
+            local_state_db::print_diagnostic_guidance(startup_error);
+            return Ok(AppExitInfo::fatal(startup_error.to_string()));
+        }
+
+        match local_state_db::repair_files(startup_error).await {
+            Ok(backups) => local_state_db::print_repair_backups(&backups),
+            Err(repair_err) => {
+                local_state_db::print_diagnostic_guidance(startup_error);
+                return Ok(AppExitInfo::fatal(format!(
+                    "failed to repair Codex local data automatically: {repair_err}"
+                )));
+            }
+        }
+        attempted_repair = true;
+    }
 }
 
 fn confirm(prompt: &str) -> std::io::Result<bool> {
@@ -1816,6 +2155,7 @@ fn finalize_fork_interactive(
 fn merge_interactive_cli_flags(interactive: &mut TuiCli, subcommand_cli: TuiCli) {
     let TuiCli {
         shared,
+        strict_config,
         approval_policy,
         web_search,
         prompt,
@@ -1831,6 +2171,9 @@ fn merge_interactive_cli_flags(interactive: &mut TuiCli, subcommand_cli: TuiCli)
     if web_search {
         interactive.web_search = true;
     }
+    if strict_config {
+        interactive.strict_config = true;
+    }
     if let Some(prompt) = prompt {
         // Normalize CRLF/CR to LF so CLI-provided text can't leak `\r` into TUI state.
         interactive.prompt = Some(prompt.replace("\r\n", "\n").replace('\r', "\n"));
@@ -1913,6 +2256,49 @@ mod tests {
         finalize_fork_interactive(interactive, root_overrides, session_id, last, all, fork_cli)
     }
 
+    fn profile_v2_for_args(args: &[&str]) -> anyhow::Result<Option<String>> {
+        let cli = MultitoolCli::try_parse_from(args).expect("parse");
+        let Some(subcommand) = cli.subcommand.as_ref() else {
+            return Ok(cli
+                .interactive
+                .config_profile_v2
+                .as_ref()
+                .map(std::string::ToString::to_string));
+        };
+        Ok(profile_v2_for_subcommand(&cli.interactive, subcommand)?.map(ToString::to_string))
+    }
+
+    #[test]
+    fn profile_v2_is_rejected_for_config_management_subcommands() {
+        assert!(
+            profile_v2_for_args(&["codex", "--profile-v2", "work", "features", "list"]).is_err()
+        );
+    }
+
+    #[test]
+    fn profile_v2_is_allowed_for_runtime_subcommands() {
+        assert_eq!(
+            profile_v2_for_args(&["codex", "--profile-v2", "work", "resume"])
+                .expect("resume supports profile-v2")
+                .as_deref(),
+            Some("work")
+        );
+        assert_eq!(
+            profile_v2_for_args(&["codex", "--profile-v2", "work", "debug", "prompt-input"])
+                .expect("debug prompt-input supports profile-v2")
+                .as_deref(),
+            Some("work")
+        );
+    }
+
+    #[test]
+    fn profile_v2_rejects_non_plain_names_at_parse_time() {
+        assert!(
+            MultitoolCli::try_parse_from(["codex", "--profile-v2", "nested/work", "resume"])
+                .is_err()
+        );
+    }
+
     #[test]
     fn exec_resume_last_accepts_prompt_positional() {
         let cli =
@@ -1932,7 +2318,7 @@ mod tests {
     }
 
     #[test]
-    fn exec_resume_accepts_output_last_message_flag_after_subcommand() {
+    fn exec_resume_accepts_output_flags_after_subcommand() {
         let cli = MultitoolCli::try_parse_from([
             "codex",
             "exec",
@@ -1940,6 +2326,8 @@ mod tests {
             "session-123",
             "-o",
             "/tmp/resume-output.md",
+            "--output-schema",
+            "/tmp/schema.json",
             "re-review",
         ])
         .expect("parse should succeed");
@@ -1955,6 +2343,10 @@ mod tests {
             exec.last_message_file,
             Some(std::path::PathBuf::from("/tmp/resume-output.md"))
         );
+        assert_eq!(
+            exec.output_schema,
+            Some(std::path::PathBuf::from("/tmp/schema.json"))
+        );
         assert_eq!(args.session_id.as_deref(), Some("session-123"));
         assert_eq!(args.prompt.as_deref(), Some("re-review"));
     }
@@ -2053,6 +2445,7 @@ mod tests {
 
         for (subcommand, usage) in [
             ("add", "Usage: codex plugin marketplace add"),
+            ("list", "Usage: codex plugin marketplace list"),
             ("upgrade", "Usage: codex plugin marketplace upgrade"),
             ("remove", "Usage: codex plugin marketplace remove"),
         ] {
@@ -2079,6 +2472,45 @@ mod tests {
         assert!(matches!(cli.subcommand, Some(Subcommand::Plugin(_))));
     }
 
+    #[test]
+    fn plugin_add_parses_under_plugin() {
+        let cli = MultitoolCli::try_parse_from([
+            "codex",
+            "plugin",
+            "add",
+            "sample",
+            "--marketplace",
+            "debug",
+        ])
+        .expect("parse");
+
+        assert!(matches!(cli.subcommand, Some(Subcommand::Plugin(_))));
+    }
+
+    #[test]
+    fn plugin_list_parses_under_plugin() {
+        let cli =
+            MultitoolCli::try_parse_from(["codex", "plugin", "list", "--marketplace", "debug"])
+                .expect("parse");
+
+        assert!(matches!(cli.subcommand, Some(Subcommand::Plugin(_))));
+    }
+
+    #[test]
+    fn plugin_remove_parses_under_plugin() {
+        let cli = MultitoolCli::try_parse_from([
+            "codex",
+            "plugin",
+            "remove",
+            "sample",
+            "--marketplace",
+            "debug",
+        ])
+        .expect("parse");
+
+        assert!(matches!(cli.subcommand, Some(Subcommand::Plugin(_))));
+    }
+
     #[test]
     fn update_parses_as_update_subcommand() {
         let cli = MultitoolCli::try_parse_from(["codex", "update"]).expect("parse");
@@ -2229,7 +2661,7 @@ mod tests {
     }
 
     #[test]
-    fn format_exit_messages_uses_id_even_when_thread_has_name() {
+    fn format_exit_messages_names_picker_item_when_thread_has_name() {
         let exit_info = sample_exit_info(
             Some("123e4567-e89b-12d3-a456-426614174000"),
             Some("my-thread"),
@@ -2239,8 +2671,7 @@ mod tests {
             lines,
             vec![
                 "Token usage: total=2 input=0 output=2".to_string(),
-                "To continue this session, run codex resume 123e4567-e89b-12d3-a456-426614174000"
-                    .to_string(),
+                "To continue this session, run codex resume, then select my-thread (123e4567-e89b-12d3-a456-426614174000)".to_string(),
             ]
         );
     }
@@ -2316,8 +2747,11 @@ mod tests {
                 "gpt-5.1-test",
                 "-p",
                 "my-profile",
+                "--profile-v2",
+                "my-config",
                 "-C",
                 "/tmp",
+                "--strict-config",
                 "-i",
                 "/tmp/a.png,/tmp/b.png",
             ]
@@ -2327,6 +2761,7 @@ mod tests {
         assert_eq!(interactive.model.as_deref(), Some("gpt-5.1-test"));
         assert!(interactive.oss);
         assert_eq!(interactive.config_profile.as_deref(), Some("my-profile"));
+        assert_eq!(interactive.config_profile_v2.as_deref(), Some("my-config"));
         assert_matches!(
             interactive.sandbox_mode,
             Some(codex_utils_cli::SandboxModeCliArg::WorkspaceWrite)
@@ -2340,6 +2775,7 @@ mod tests {
             Some(std::path::Path::new("/tmp"))
         );
         assert!(interactive.web_search);
+        assert!(interactive.strict_config);
         let has_a = interactive
             .images
             .iter()
@@ -2434,11 +2870,85 @@ mod tests {
         assert!(app_server.analytics_default_enabled);
     }
 
+    #[test]
+    fn strict_config_parses_for_supported_commands() {
+        let cli = MultitoolCli::try_parse_from(["codex", "--strict-config"]).expect("parse");
+        assert!(cli.interactive.strict_config);
+
+        let cli = MultitoolCli::try_parse_from(["codex", "mcp-server", "--strict-config"])
+            .expect("parse");
+        assert_matches!(
+            cli.subcommand,
+            Some(Subcommand::McpServer(McpServerCommand {
+                strict_config: true,
+            }))
+        );
+
+        let cli =
+            MultitoolCli::try_parse_from(["codex", "review", "--strict-config", "--uncommitted"])
+                .expect("parse");
+        assert_matches!(
+            cli.subcommand,
+            Some(Subcommand::Review(ReviewCommand {
+                strict_config: true,
+                ..
+            }))
+        );
+    }
+
+    #[test]
+    fn root_strict_config_is_rejected_for_unsupported_subcommands() {
+        let cli = MultitoolCli::try_parse_from(["codex", "--strict-config", "mcp", "list"])
+            .expect("parse");
+        let err = reject_root_strict_config_for_subcommand(
+            cli.interactive.strict_config,
+            &cli.subcommand,
+        )
+        .expect_err("mcp should not support root --strict-config");
+
+        assert_eq!(
+            err.to_string(),
+            "`--strict-config` is not supported for `codex mcp`"
+        );
+
+        let cli = MultitoolCli::try_parse_from(["codex", "--strict-config", "remote-control"])
+            .expect("parse");
+        let err = reject_root_strict_config_for_subcommand(
+            cli.interactive.strict_config,
+            &cli.subcommand,
+        )
+        .expect_err("remote-control should not support root --strict-config");
+
+        assert_eq!(
+            err.to_string(),
+            "`--strict-config` is not supported for `codex remote-control`"
+        );
+    }
+
+    #[test]
+    fn app_server_subcommands_reject_strict_config() {
+        let app_server =
+            app_server_from_args(["codex", "app-server", "--strict-config", "proxy"].as_ref());
+        let err = reject_strict_config_for_app_server_subcommand(
+            app_server.strict_config,
+            app_server.subcommand.as_ref(),
+        )
+        .expect_err("app-server proxy should not support --strict-config");
+
+        assert_eq!(
+            err.to_string(),
+            "`--strict-config` is not supported for `codex app-server proxy`"
+        );
+    }
+
     #[test]
     fn reject_remote_flag_for_remote_control() {
         let cli = MultitoolCli::try_parse_from(["codex", "--remote", "unix://", "remote-control"])
             .expect("parse");
-        assert_matches!(cli.subcommand, Some(Subcommand::RemoteControl));
+        let Some(Subcommand::RemoteControl(remote_control)) = &cli.subcommand else {
+            panic!("expected remote-control subcommand");
+        };
+        assert_eq!(remote_control.subcommand_name(), "remote-control");
 
         let err = reject_remote_mode_for_subcommand(
             cli.remote.remote.as_deref(),
@@ -2880,4 +3390,38 @@ mod tests {
             .expect_err("feature should be rejected");
         assert_eq!(err.to_string(), "Unknown feature flag: does_not_exist");
     }
+
+    #[test]
+    fn strict_config_with_unknown_enable_errors() {
+        let err = strict_config_feature_toggle_error(["--enable", "does_not_exist"].as_ref());
+        assert_eq!(err.to_string(), "Unknown feature flag: does_not_exist");
+    }
+
+    #[test]
+    fn strict_config_with_unknown_disable_errors() {
+        let err = strict_config_feature_toggle_error(["--disable", "does_not_exist"].as_ref());
+        assert_eq!(err.to_string(), "Unknown feature flag: does_not_exist");
+    }
+
+    #[test]
+    fn strict_config_with_compound_enable_errors() {
+        let err = strict_config_feature_toggle_error(
+            ["--enable", "multi_agent_v2.subagent_usage_hint_text"].as_ref(),
+        );
+        assert_eq!(
+            err.to_string(),
+            "Unknown feature flag: multi_agent_v2.subagent_usage_hint_text"
+        );
+    }
+
+    fn strict_config_feature_toggle_error(args: &[&str]) -> anyhow::Error {
+        let cli_args = std::iter::once("codex")
+            .chain(std::iter::once("--strict-config"))
+            .chain(args.iter().copied());
+        let cli = MultitoolCli::try_parse_from(cli_args).expect("parse should succeed");
+        assert!(cli.interactive.strict_config);
+        cli.feature_toggles
+            .to_overrides()
+            .expect_err("feature should be rejected")
+    }
 }
diff --git a/codex-rs/cli/src/marketplace_cmd.rs b/codex-rs/cli/src/marketplace_cmd.rs
index fcd9049d59..2ec948eacb 100644
--- a/codex-rs/cli/src/marketplace_cmd.rs
+++ b/codex-rs/cli/src/marketplace_cmd.rs
@@ -6,10 +6,13 @@ use codex_core::config::Config;
 use codex_core::config::find_codex_home;
 use codex_core_plugins::PluginMarketplaceUpgradeOutcome;
 use codex_core_plugins::PluginsManager;
+use codex_core_plugins::installed_marketplaces::marketplace_install_root;
+use codex_core_plugins::installed_marketplaces::resolve_configured_marketplace_root;
 use codex_core_plugins::marketplace_add::MarketplaceAddRequest;
 use codex_core_plugins::marketplace_add::add_marketplace;
 use codex_core_plugins::marketplace_remove::MarketplaceRemoveRequest;
 use codex_core_plugins::marketplace_remove::remove_marketplace;
+use codex_plugin::validate_plugin_segment;
 use codex_utils_cli::CliConfigOverrides;
 
 #[derive(Debug, Parser)]
@@ -24,21 +27,36 @@ pub struct MarketplaceCli {
 
 #[derive(Debug, clap::Subcommand)]
 enum MarketplaceSubcommand {
+    /// Add a local or Git marketplace to the configured marketplace sources.
     Add(AddMarketplaceArgs),
+
+    /// List configured marketplace names and their local snapshot roots.
+    List,
+
+    /// Refresh configured Git marketplace snapshots.
+    ///
+    /// Omit MARKETPLACE_NAME to upgrade all configured Git marketplaces.
     Upgrade(UpgradeMarketplaceArgs),
+
+    /// Remove a configured marketplace source by name.
     Remove(RemoveMarketplaceArgs),
 }
 
 #[derive(Debug, Parser)]
-#[command(bin_name = "codex plugin marketplace add")]
+#[command(
+    bin_name = "codex plugin marketplace add",
+    after_help = "Examples:\n  codex plugin marketplace add ./path/to/marketplace\n  codex plugin marketplace add owner/repo --ref main\n  codex plugin marketplace add https://github.com/owner/repo --sparse plugins/foo"
+)]
 struct AddMarketplaceArgs {
-    /// Marketplace source. Supports owner/repo[@ref], HTTP(S) Git URLs, SSH URLs,
-    /// or local marketplace root directories.
+    /// Marketplace source: a local path, owner/repo[@ref], HTTPS Git URL, or SSH Git URL.
+    #[arg(value_name = "SOURCE")]
     source: String,
 
+    /// Git ref to fetch for Git marketplace sources.
     #[arg(long = "ref", value_name = "REF")]
     ref_name: Option<String>,
 
+    /// Sparse checkout path for Git marketplace sources. Can be repeated.
     #[arg(
         long = "sparse",
         value_name = "PATH",
@@ -48,15 +66,24 @@ struct AddMarketplaceArgs {
 }
 
 #[derive(Debug, Parser)]
-#[command(bin_name = "codex plugin marketplace upgrade")]
+#[command(
+    bin_name = "codex plugin marketplace upgrade",
+    after_help = "Examples:\n  codex plugin marketplace upgrade\n  codex plugin marketplace upgrade debug"
+)]
 struct UpgradeMarketplaceArgs {
+    /// Optional configured marketplace name to upgrade. Omit to upgrade all Git marketplaces.
+    #[arg(value_name = "MARKETPLACE_NAME")]
     marketplace_name: Option<String>,
 }
 
 #[derive(Debug, Parser)]
-#[command(bin_name = "codex plugin marketplace remove")]
+#[command(
+    bin_name = "codex plugin marketplace remove",
+    after_help = "Example:\n  codex plugin marketplace remove debug"
+)]
 struct RemoveMarketplaceArgs {
     /// Configured marketplace name to remove.
+    #[arg(value_name = "MARKETPLACE_NAME")]
     marketplace_name: String,
 }
 
@@ -73,6 +100,7 @@ impl MarketplaceCli {
 
         match subcommand {
             MarketplaceSubcommand::Add(args) => run_add(args).await?,
+            MarketplaceSubcommand::List => run_list(overrides).await?,
             MarketplaceSubcommand::Upgrade(args) => run_upgrade(overrides, args).await?,
             MarketplaceSubcommand::Remove(args) => run_remove(args).await?,
         }
@@ -118,6 +146,48 @@ async fn run_add(args: AddMarketplaceArgs) -> Result<()> {
     Ok(())
 }
 
+async fn run_list(overrides: Vec<(String, toml::Value)>) -> Result<()> {
+    let config = Config::load_with_cli_overrides(overrides)
+        .await
+        .context("failed to load configuration")?;
+    let configured_marketplaces = config
+        .config_layer_stack
+        .get_active_user_layer()
+        .and_then(|layer| layer.config.get("marketplaces"))
+        .and_then(toml::Value::as_table);
+    let Some(configured_marketplaces) = configured_marketplaces else {
+        println!("No configured plugin marketplaces.");
+        return Ok(());
+    };
+
+    if configured_marketplaces.is_empty() {
+        println!("No configured plugin marketplaces.");
+        return Ok(());
+    }
+
+    let default_install_root = marketplace_install_root(config.codex_home.as_path());
+    for (marketplace_name, marketplace) in configured_marketplaces {
+        if !marketplace.is_table() {
+            eprintln!("Ignoring invalid marketplace `{marketplace_name}`: expected table.");
+            continue;
+        }
+        if let Err(err) = validate_plugin_segment(marketplace_name, "marketplace name") {
+            eprintln!("Ignoring invalid marketplace `{marketplace_name}`: {err}.");
+            continue;
+        }
+        let root = resolve_configured_marketplace_root(
+            marketplace_name,
+            marketplace,
+            default_install_root.as_path(),
+        )
+        .map(|root| root.display().to_string())
+        .unwrap_or_else(|| "<invalid source>".to_string());
+        println!("{marketplace_name}\t{root}");
+    }
+
+    Ok(())
+}
+
 async fn run_upgrade(
     overrides: Vec<(String, toml::Value)>,
     args: UpgradeMarketplaceArgs,
diff --git a/codex-rs/cli/src/mcp_cmd.rs b/codex-rs/cli/src/mcp_cmd.rs
index af75999163..5c66a27d84 100644
--- a/codex-rs/cli/src/mcp_cmd.rs
+++ b/codex-rs/cli/src/mcp_cmd.rs
@@ -199,6 +199,7 @@ async fn perform_oauth_login_retry_without_scopes(
     http_headers: Option<HashMap<String, String>>,
     env_http_headers: Option<HashMap<String, String>>,
     resolved_scopes: &ResolvedMcpOAuthScopes,
+    oauth_client_id: Option<&str>,
     oauth_resource: Option<&str>,
     callback_port: Option<u16>,
     callback_url: Option<&str>,
@@ -210,6 +211,7 @@ async fn perform_oauth_login_retry_without_scopes(
         http_headers.clone(),
         env_http_headers.clone(),
         &resolved_scopes.scopes,
+        oauth_client_id,
         oauth_resource,
         callback_port,
         callback_url,
@@ -226,6 +228,7 @@ async fn perform_oauth_login_retry_without_scopes(
                 http_headers,
                 env_http_headers,
                 &[],
+                oauth_client_id,
                 oauth_resource,
                 callback_port,
                 callback_url,
@@ -309,6 +312,7 @@ async fn run_add(config_overrides: &CliConfigOverrides, add_args: AddArgs) -> Re
         enabled_tools: None,
         disabled_tools: None,
         scopes: None,
+        oauth: None,
         oauth_resource: None,
         tools: HashMap::new(),
     };
@@ -338,6 +342,7 @@ async fn run_add(config_overrides: &CliConfigOverrides, add_args: AddArgs) -> Re
                 oauth_config.http_headers,
                 oauth_config.env_http_headers,
                 &resolved_scopes,
+                /*oauth_client_id*/ None,
                 /*oauth_resource*/ None,
                 config.mcp_oauth_callback_port,
                 config.mcp_oauth_callback_url.as_deref(),
@@ -431,6 +436,7 @@ async fn run_login(config_overrides: &CliConfigOverrides, login_args: LoginArgs)
         http_headers,
         env_http_headers,
         &resolved_scopes,
+        server.oauth_client_id(),
         server.oauth_resource.as_deref(),
         config.mcp_oauth_callback_port,
         config.mcp_oauth_callback_url.as_deref(),
diff --git a/codex-rs/cli/src/plugin_cmd.rs b/codex-rs/cli/src/plugin_cmd.rs
new file mode 100644
index 0000000000..593fe644b2
--- /dev/null
+++ b/codex-rs/cli/src/plugin_cmd.rs
@@ -0,0 +1,405 @@
+use anyhow::Context;
+use anyhow::Result;
+use anyhow::bail;
+use clap::Parser;
+use codex_core::config::Config;
+use codex_core::config::find_codex_home;
+use codex_core_plugins::ConfiguredMarketplace;
+use codex_core_plugins::PluginInstallRequest;
+use codex_core_plugins::PluginsConfigInput;
+use codex_core_plugins::PluginsManager;
+use codex_core_plugins::installed_marketplaces::marketplace_install_root;
+use codex_core_plugins::installed_marketplaces::resolve_configured_marketplace_root;
+use codex_core_plugins::marketplace::MarketplaceListError;
+use codex_core_plugins::marketplace::find_marketplace_manifest_path;
+use codex_plugin::PluginId;
+use codex_plugin::validate_plugin_segment;
+use codex_utils_cli::CliConfigOverrides;
+use std::path::PathBuf;
+
+use crate::marketplace_cmd::MarketplaceCli;
+
+#[derive(Debug, Parser)]
+#[command(bin_name = "codex plugin")]
+pub struct PluginCli {
+    #[clap(flatten)]
+    pub config_overrides: CliConfigOverrides,
+
+    #[command(subcommand)]
+    pub subcommand: PluginSubcommand,
+}
+
+#[derive(Debug, clap::Subcommand)]
+pub enum PluginSubcommand {
+    /// Install a plugin from a configured marketplace snapshot.
+    ///
+    /// Pass either `PLUGIN@MARKETPLACE` or pass `PLUGIN` with
+    /// `--marketplace MARKETPLACE`.
+    Add(AddPluginArgs),
+
+    /// List plugins available from configured marketplace snapshots.
+    List(ListPluginsArgs),
+
+    /// Add, list, upgrade, or remove configured plugin marketplaces.
+    Marketplace(MarketplaceCli),
+
+    /// Remove an installed plugin from local config and cache.
+    ///
+    /// Pass either `PLUGIN@MARKETPLACE` or pass `PLUGIN` with
+    /// `--marketplace MARKETPLACE`.
+    Remove(RemovePluginArgs),
+}
+
+#[derive(Debug, Parser)]
+#[command(
+    bin_name = "codex plugin add",
+    after_help = "Examples:\n  codex plugin add sample@debug\n  codex plugin add sample --marketplace debug"
+)]
+pub struct AddPluginArgs {
+    /// Plugin selector to install: either PLUGIN@MARKETPLACE or PLUGIN with --marketplace.
+    #[arg(value_name = "PLUGIN[@MARKETPLACE]")]
+    plugin: String,
+
+    /// Configured marketplace name to use when PLUGIN does not include @MARKETPLACE.
+    #[arg(long = "marketplace", short = 'm', value_name = "MARKETPLACE")]
+    marketplace_name: Option<String>,
+}
+
+#[derive(Debug, Parser)]
+#[command(
+    bin_name = "codex plugin list",
+    after_help = "Examples:\n  codex plugin list\n  codex plugin list --marketplace debug"
+)]
+pub struct ListPluginsArgs {
+    /// Only list plugins from this configured marketplace name.
+    #[arg(long = "marketplace", short = 'm', value_name = "MARKETPLACE")]
+    marketplace_name: Option<String>,
+}
+
+#[derive(Debug, Parser)]
+#[command(
+    bin_name = "codex plugin remove",
+    after_help = "Examples:\n  codex plugin remove sample@debug\n  codex plugin remove sample --marketplace debug"
+)]
+pub struct RemovePluginArgs {
+    /// Plugin selector to remove: either PLUGIN@MARKETPLACE or PLUGIN with --marketplace.
+    #[arg(value_name = "PLUGIN[@MARKETPLACE]")]
+    plugin: String,
+
+    /// Marketplace name to use when PLUGIN does not include @MARKETPLACE.
+    #[arg(long = "marketplace", short = 'm', value_name = "MARKETPLACE")]
+    marketplace_name: Option<String>,
+}
+
+pub async fn run_plugin_add(
+    overrides: Vec<(String, toml::Value)>,
+    args: AddPluginArgs,
+) -> Result<()> {
+    let PluginCommandContext {
+        codex_home,
+        plugins_input,
+        manager,
+    } = load_plugin_command_context(overrides).await?;
+    let PluginSelection {
+        plugin_name,
+        marketplace_name,
+        ..
+    } = parse_plugin_selection(args.plugin, args.marketplace_name)?;
+    let marketplace = find_marketplace_for_plugin(
+        &manager,
+        codex_home.as_path(),
+        &plugins_input,
+        &marketplace_name,
+        &plugin_name,
+    )?;
+    let outcome = manager
+        .install_plugin(PluginInstallRequest {
+            plugin_name,
+            marketplace_path: marketplace.path,
+        })
+        .await?;
+
+    println!(
+        "Added plugin `{}` from marketplace `{}`.",
+        outcome.plugin_id.plugin_name, outcome.plugin_id.marketplace_name
+    );
+    println!(
+        "Installed plugin root: {}",
+        outcome.installed_path.as_path().display()
+    );
+
+    Ok(())
+}
+
+pub async fn run_plugin_list(
+    overrides: Vec<(String, toml::Value)>,
+    args: ListPluginsArgs,
+) -> Result<()> {
+    let PluginCommandContext {
+        codex_home,
+        plugins_input,
+        manager,
+        ..
+    } = load_plugin_command_context(overrides).await?;
+    let outcome = manager
+        .list_marketplaces_for_config(&plugins_input, &[])
+        .context("failed to list marketplace plugins")?;
+    ensure_configured_marketplace_snapshots_loaded(
+        codex_home.as_path(),
+        &plugins_input,
+        &outcome.errors,
+        /*marketplace_name*/ None,
+    )?;
+
+    let marketplaces = outcome
+        .marketplaces
+        .into_iter()
+        .filter(|marketplace| {
+            args.marketplace_name
+                .as_ref()
+                .is_none_or(|name| marketplace.name == *name)
+        })
+        .collect::<Vec<_>>();
+
+    if marketplaces.is_empty() {
+        if let Some(marketplace_name) = args.marketplace_name {
+            println!("No plugins found in marketplace `{marketplace_name}`.");
+        } else {
+            println!("No marketplace plugins found.");
+        }
+    } else {
+        for marketplace in marketplaces {
+            println!("Marketplace `{}`", marketplace.name);
+            println!("Path: {}", marketplace.path.as_path().display());
+            for plugin in &marketplace.plugins {
+                let state = if plugin.installed && plugin.enabled {
+                    "installed, enabled"
+                } else if plugin.installed {
+                    "installed, disabled"
+                } else {
+                    "not installed"
+                };
+                println!("  {} ({state})", plugin.id);
+            }
+        }
+    }
+
+    Ok(())
+}
+
+pub async fn run_plugin_remove(
+    overrides: Vec<(String, toml::Value)>,
+    args: RemovePluginArgs,
+) -> Result<()> {
+    let PluginCommandContext { manager, .. } = load_plugin_command_context(overrides).await?;
+    let selection = parse_plugin_selection(args.plugin, args.marketplace_name)?;
+
+    manager.uninstall_plugin(selection.plugin_key).await?;
+    println!(
+        "Removed plugin `{}` from marketplace `{}`.",
+        selection.plugin_name, selection.marketplace_name
+    );
+
+    Ok(())
+}
+
+struct PluginCommandContext {
+    codex_home: PathBuf,
+    plugins_input: PluginsConfigInput,
+    manager: PluginsManager,
+}
+
+async fn load_plugin_command_context(
+    overrides: Vec<(String, toml::Value)>,
+) -> Result<PluginCommandContext> {
+    let codex_home = find_codex_home().context("failed to resolve CODEX_HOME")?;
+    let config = Config::load_with_cli_overrides(overrides)
+        .await
+        .context("failed to load configuration")?;
+    let plugins_input = config.plugins_config_input();
+    let manager = PluginsManager::new(codex_home.to_path_buf());
+    Ok(PluginCommandContext {
+        codex_home: codex_home.to_path_buf(),
+        plugins_input,
+        manager,
+    })
+}
+
+struct PluginSelection {
+    plugin_name: String,
+    marketplace_name: String,
+    plugin_key: String,
+}
+
+impl PluginSelection {
+    fn from_plugin_id(plugin_id: PluginId) -> Self {
+        let plugin_key = plugin_id.as_key();
+        Self {
+            plugin_name: plugin_id.plugin_name,
+            marketplace_name: plugin_id.marketplace_name,
+            plugin_key,
+        }
+    }
+}
+
+fn parse_plugin_selection(
+    plugin: String,
+    marketplace_name: Option<String>,
+) -> Result<PluginSelection> {
+    match (PluginId::parse(&plugin), marketplace_name) {
+        (Ok(plugin_id), None) => Ok(PluginSelection::from_plugin_id(plugin_id)),
+        (Ok(plugin_id), Some(marketplace_name)) => {
+            if plugin_id.marketplace_name != marketplace_name {
+                bail!(
+                    "plugin id `{}` belongs to marketplace `{}`, but --marketplace specified `{}`",
+                    plugin,
+                    plugin_id.marketplace_name,
+                    marketplace_name
+                );
+            }
+            Ok(PluginSelection::from_plugin_id(plugin_id))
+        }
+        (Err(_), Some(marketplace_name)) => Ok(PluginSelection::from_plugin_id(PluginId::new(
+            plugin,
+            marketplace_name,
+        )?)),
+        (Err(_), None) => {
+            bail!("plugin requires --marketplace unless passed as <plugin>@<marketplace>")
+        }
+    }
+}
+
+fn find_marketplace_for_plugin(
+    manager: &PluginsManager,
+    codex_home: &std::path::Path,
+    plugins_input: &PluginsConfigInput,
+    marketplace_name: &str,
+    plugin_name: &str,
+) -> Result<ConfiguredMarketplace> {
+    let outcome = manager
+        .list_marketplaces_for_config(plugins_input, &[])
+        .context("failed to list marketplace plugins")?;
+    ensure_configured_marketplace_snapshots_loaded(
+        codex_home,
+        plugins_input,
+        &outcome.errors,
+        Some(marketplace_name),
+    )?;
+    let matches = outcome
+        .marketplaces
+        .into_iter()
+        .filter(|marketplace| marketplace.name == marketplace_name)
+        .filter(|marketplace| {
+            marketplace
+                .plugins
+                .iter()
+                .any(|plugin| plugin.name == plugin_name)
+        })
+        .collect::<Vec<_>>();
+
+    match matches.as_slice() {
+        [] => bail!("plugin `{plugin_name}` was not found in marketplace `{marketplace_name}`"),
+        [marketplace] => Ok(marketplace.clone()),
+        _ => bail!(
+            "plugin `{plugin_name}` in marketplace `{marketplace_name}` matched multiple marketplace roots"
+        ),
+    }
+}
+
+struct ConfiguredMarketplaceSnapshotIssue {
+    marketplace_name: String,
+    path: PathBuf,
+    message: String,
+}
+
+fn ensure_configured_marketplace_snapshots_loaded(
+    codex_home: &std::path::Path,
+    plugins_input: &PluginsConfigInput,
+    load_errors: &[MarketplaceListError],
+    marketplace_name: Option<&str>,
+) -> Result<()> {
+    let issues = configured_marketplace_snapshot_issues(
+        codex_home,
+        plugins_input,
+        load_errors,
+        marketplace_name,
+    );
+    if issues.is_empty() {
+        return Ok(());
+    }
+
+    let issue_lines = issues
+        .iter()
+        .map(|issue| {
+            format!(
+                "- `{}` at {}: {}",
+                issue.marketplace_name,
+                issue.path.display(),
+                issue.message
+            )
+        })
+        .collect::<Vec<_>>()
+        .join("\n");
+    bail!("failed to load configured marketplace snapshot(s):\n{issue_lines}");
+}
+
+fn configured_marketplace_snapshot_issues(
+    codex_home: &std::path::Path,
+    plugins_input: &PluginsConfigInput,
+    load_errors: &[MarketplaceListError],
+    marketplace_name: Option<&str>,
+) -> Vec<ConfiguredMarketplaceSnapshotIssue> {
+    let Some(user_layer) = plugins_input.config_layer_stack.get_active_user_layer() else {
+        return Vec::new();
+    };
+    let Some(configured_marketplaces) = user_layer
+        .config
+        .get("marketplaces")
+        .and_then(toml::Value::as_table)
+    else {
+        return Vec::new();
+    };
+
+    let default_install_root = marketplace_install_root(codex_home);
+    let mut manifest_paths = Vec::new();
+    let mut issues = Vec::new();
+    for (configured_name, marketplace) in configured_marketplaces {
+        if marketplace_name.is_some_and(|name| configured_name != name) {
+            continue;
+        }
+        if !marketplace.is_table()
+            || validate_plugin_segment(configured_name, "marketplace name").is_err()
+        {
+            continue;
+        }
+        let Some(root) = resolve_configured_marketplace_root(
+            configured_name,
+            marketplace,
+            &default_install_root,
+        ) else {
+            continue;
+        };
+        match find_marketplace_manifest_path(&root) {
+            Some(path) => manifest_paths.push((configured_name.clone(), path)),
+            None => issues.push(ConfiguredMarketplaceSnapshotIssue {
+                marketplace_name: configured_name.clone(),
+                path: root,
+                message: "marketplace root does not contain a supported manifest".to_string(),
+            }),
+        }
+    }
+
+    for error in load_errors {
+        if let Some((configured_name, _)) = manifest_paths
+            .iter()
+            .find(|(_, path)| path.as_path() == error.path.as_path())
+        {
+            issues.push(ConfiguredMarketplaceSnapshotIssue {
+                marketplace_name: configured_name.clone(),
+                path: error.path.to_path_buf(),
+                message: error.message.clone(),
+            });
+        }
+    }
+    issues
+}
diff --git a/codex-rs/cli/src/remote_control_cmd.rs b/codex-rs/cli/src/remote_control_cmd.rs
new file mode 100644
index 0000000000..1ff8bd7595
--- /dev/null
+++ b/codex-rs/cli/src/remote_control_cmd.rs
@@ -0,0 +1,695 @@
+use std::io::Write;
+use std::time::Duration;
+
+use anyhow::Context;
+use clap::Args;
+use codex_app_server::AppServerRuntimeOptions;
+use codex_app_server::AppServerTransport;
+use codex_app_server::AppServerWebsocketAuthSettings;
+use codex_app_server_daemon::LifecycleCommand as AppServerLifecycleCommand;
+use codex_app_server_daemon::LifecycleOutput as AppServerLifecycleOutput;
+use codex_app_server_daemon::LifecycleStatus as AppServerLifecycleStatus;
+use codex_app_server_daemon::RemoteControlReadyOutput as AppServerRemoteControlReadyOutput;
+use codex_app_server_daemon::RemoteControlReadyStatus as AppServerRemoteControlReadyStatus;
+use codex_app_server_daemon::RemoteControlStartOutput as AppServerRemoteControlStartOutput;
+use codex_app_server_protocol::RemoteControlConnectionStatus;
+use codex_arg0::Arg0DispatchPaths;
+use codex_config::LoaderOverrides;
+use codex_protocol::protocol::SessionSource;
+use codex_utils_absolute_path::AbsolutePathBuf;
+use codex_utils_cli::CliConfigOverrides;
+use serde::Serialize;
+use tokio::sync::watch;
+use tokio::task::JoinHandle;
+use tokio::time::timeout;
+
+const FOREGROUND_SOCKET_CONNECT_TIMEOUT: Duration = Duration::from_secs(10);
+const FOREGROUND_SOCKET_CONNECT_RETRY_DELAY: Duration = Duration::from_millis(50);
+const FOREGROUND_APP_SERVER_ABORT_TIMEOUT: Duration = Duration::from_secs(1);
+
+#[derive(Debug, Args)]
+pub(crate) struct RemoteControlCommand {
+    /// Emit machine-readable JSON.
+    #[arg(long = "json", global = true)]
+    json: bool,
+
+    #[command(subcommand)]
+    subcommand: Option<RemoteControlSubcommand>,
+}
+
+impl RemoteControlCommand {
+    pub(crate) fn subcommand_name(&self) -> &'static str {
+        match self.subcommand {
+            None => "remote-control",
+            Some(RemoteControlSubcommand::Start) => "remote-control start",
+            Some(RemoteControlSubcommand::Stop) => "remote-control stop",
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, clap::Subcommand)]
+enum RemoteControlSubcommand {
+    /// Start the app-server daemon with remote control enabled.
+    Start,
+
+    /// Stop the app-server daemon.
+    Stop,
+}
+
+pub(crate) async fn run(
+    command: RemoteControlCommand,
+    arg0_paths: Arg0DispatchPaths,
+    root_config_overrides: CliConfigOverrides,
+) -> anyhow::Result<()> {
+    match command.subcommand {
+        None => {
+            print_remote_control_progress(
+                command.json,
+                "Starting app-server with remote control enabled...",
+            )?;
+            run_foreground_remote_control(command.json, arg0_paths, root_config_overrides).await?;
+        }
+        Some(RemoteControlSubcommand::Start) => {
+            print_remote_control_progress(
+                command.json,
+                "Starting app-server daemon with remote control enabled...",
+            )?;
+            let output = codex_app_server_daemon::ensure_remote_control_ready().await?;
+            print_remote_control_start_output(&output, command.json)?;
+        }
+        Some(RemoteControlSubcommand::Stop) => {
+            print_remote_control_progress(command.json, "Stopping remote control...")?;
+            let output = codex_app_server_daemon::run(AppServerLifecycleCommand::Stop).await?;
+            print_remote_control_stop_output(&output, command.json)?;
+        }
+    }
+    Ok(())
+}
+
+fn print_remote_control_progress(json: bool, message: &str) -> anyhow::Result<()> {
+    if json {
+        return Ok(());
+    }
+
+    println!("{message}");
+    std::io::stdout()
+        .flush()
+        .context("failed to flush remote-control progress message")?;
+    Ok(())
+}
+
+async fn run_foreground_remote_control(
+    json: bool,
+    arg0_paths: Arg0DispatchPaths,
+    root_config_overrides: CliConfigOverrides,
+) -> anyhow::Result<()> {
+    let socket_dir = tempfile::Builder::new()
+        .prefix("codex-rc-")
+        .tempdir_in("/tmp")
+        .or_else(|_| tempfile::tempdir())
+        .context("failed to create private app-server socket directory")?;
+    let socket_path = socket_dir.path().join("rc.sock");
+    let socket_path = AbsolutePathBuf::from_absolute_path(&socket_path)
+        .context("private app-server socket path was not absolute")?;
+    let transport = AppServerTransport::UnixSocket {
+        socket_path: socket_path.clone(),
+    };
+    let runtime_options = AppServerRuntimeOptions {
+        remote_control_enabled: true,
+        install_shutdown_signal_handler: false,
+        ..Default::default()
+    };
+    let (stop_rx, stop_signal_task) = foreground_stop_signal();
+    let mut app_server_task = tokio::spawn(codex_app_server::run_main_with_transport_options(
+        arg0_paths,
+        root_config_overrides,
+        LoaderOverrides::default(),
+        /*strict_config*/ false,
+        /*default_analytics_enabled*/ false,
+        transport,
+        SessionSource::VSCode,
+        AppServerWebsocketAuthSettings::default(),
+        runtime_options,
+    ));
+
+    let summary = match wait_for_foreground_remote_control_start(
+        &mut app_server_task,
+        wait_for_foreground_remote_control_ready(socket_path),
+        stop_rx.clone(),
+    )
+    .await
+    {
+        ForegroundStartupResult::Ready(summary) => summary,
+        ForegroundStartupResult::Stopped => {
+            abort_foreground_app_server(app_server_task).await;
+            stop_signal_task.abort();
+            return Ok(());
+        }
+        ForegroundStartupResult::ReadyFailed(error) => {
+            abort_foreground_app_server(app_server_task).await;
+            stop_signal_task.abort();
+            return Err(error);
+        }
+        ForegroundStartupResult::AppServerExited(error) => {
+            stop_signal_task.abort();
+            return Err(error);
+        }
+    };
+
+    if *stop_rx.borrow() {
+        abort_foreground_app_server(app_server_task).await;
+        stop_signal_task.abort();
+        return Ok(());
+    }
+
+    if let Err(error) = print_foreground_ready_output(&summary, json) {
+        abort_foreground_app_server(app_server_task).await;
+        stop_signal_task.abort();
+        return Err(error);
+    }
+
+    let result = wait_for_foreground_app_server(app_server_task, stop_rx).await;
+    stop_signal_task.abort();
+    result
+}
+
+fn foreground_stop_signal() -> (watch::Receiver<bool>, JoinHandle<()>) {
+    let (stop_tx, stop_rx) = watch::channel(false);
+    let task = tokio::spawn(async move {
+        if let Err(err) = tokio::signal::ctrl_c().await {
+            eprintln!("failed to listen for Ctrl-C: {err}");
+        }
+        let _ = stop_tx.send(true);
+    });
+    (stop_rx, task)
+}
+
+enum ForegroundStartupResult {
+    Ready(AppServerRemoteControlReadyStatus),
+    Stopped,
+    ReadyFailed(anyhow::Error),
+    AppServerExited(anyhow::Error),
+}
+
+async fn wait_for_foreground_remote_control_start(
+    app_server_task: &mut JoinHandle<std::io::Result<()>>,
+    ready: impl std::future::Future<Output = anyhow::Result<AppServerRemoteControlReadyStatus>>,
+    mut stop_rx: watch::Receiver<bool>,
+) -> ForegroundStartupResult {
+    tokio::pin!(ready);
+
+    tokio::select! {
+        ready_result = &mut ready => match ready_result {
+            Ok(summary) => ForegroundStartupResult::Ready(summary),
+            Err(error) => ForegroundStartupResult::ReadyFailed(error),
+        },
+        app_server_result = app_server_task => {
+            ForegroundStartupResult::AppServerExited(
+                foreground_app_server_exited_before_ready(app_server_result)
+            )
+        }
+        _ = wait_for_stop_signal(&mut stop_rx) => ForegroundStartupResult::Stopped,
+    }
+}
+
+async fn wait_for_foreground_app_server(
+    mut app_server_task: JoinHandle<std::io::Result<()>>,
+    mut stop_rx: watch::Receiver<bool>,
+) -> anyhow::Result<()> {
+    tokio::select! {
+        app_server_result = &mut app_server_task => {
+            app_server_result
+                .context("foreground app-server task failed to join")?
+                .context("foreground app-server exited with an error")?;
+        }
+        _ = wait_for_stop_signal(&mut stop_rx) => {
+            abort_foreground_app_server(app_server_task).await;
+        }
+    }
+
+    Ok(())
+}
+
+async fn wait_for_stop_signal(stop_rx: &mut watch::Receiver<bool>) {
+    if *stop_rx.borrow() {
+        return;
+    }
+    let _ = stop_rx.wait_for(|stopped| *stopped).await;
+}
+
+fn foreground_app_server_exited_before_ready(
+    result: Result<std::io::Result<()>, tokio::task::JoinError>,
+) -> anyhow::Error {
+    match result {
+        Ok(Ok(())) => {
+            anyhow::anyhow!("foreground app-server exited before remote control became ready")
+        }
+        Ok(Err(error)) => anyhow::Error::new(error)
+            .context("foreground app-server exited before remote control became ready"),
+        Err(error) => anyhow::Error::new(error)
+            .context("foreground app-server task failed before remote control became ready"),
+    }
+}
+
+async fn abort_foreground_app_server(app_server_task: JoinHandle<std::io::Result<()>>) {
+    app_server_task.abort();
+    let _ = timeout(FOREGROUND_APP_SERVER_ABORT_TIMEOUT, app_server_task).await;
+}
+
+async fn wait_for_foreground_remote_control_ready(
+    socket_path: AbsolutePathBuf,
+) -> anyhow::Result<AppServerRemoteControlReadyStatus> {
+    codex_app_server_daemon::enable_remote_control_on_socket(
+        socket_path.as_path(),
+        FOREGROUND_SOCKET_CONNECT_TIMEOUT,
+        FOREGROUND_SOCKET_CONNECT_RETRY_DELAY,
+    )
+    .await
+}
+
+fn print_remote_control_start_output(
+    output: &AppServerRemoteControlReadyOutput,
+    json: bool,
+) -> anyhow::Result<()> {
+    ensure_remote_control_startable(&output.remote_control)?;
+    if json {
+        println!(
+            "{}",
+            serde_json::to_string(&RemoteControlStartJsonOutput::daemon(output))?
+        );
+        return Ok(());
+    }
+
+    for line in remote_control_start_human_lines(
+        &output.remote_control,
+        RemoteControlHumanOutputMode::Daemon,
+    )? {
+        println!("{line}");
+    }
+    for line in daemon_app_server_human_lines(&output.daemon) {
+        println!("{line}");
+    }
+    Ok(())
+}
+
+fn print_foreground_ready_output(
+    summary: &AppServerRemoteControlReadyStatus,
+    json: bool,
+) -> anyhow::Result<()> {
+    if json {
+        ensure_remote_control_startable(summary)?;
+        println!(
+            "{}",
+            serde_json::to_string(&RemoteControlStartJsonOutput::foreground(summary))?
+        );
+        return Ok(());
+    }
+
+    for line in remote_control_start_human_lines(summary, RemoteControlHumanOutputMode::Foreground)?
+    {
+        println!("{line}");
+    }
+    Ok(())
+}
+
+#[derive(Serialize)]
+#[serde(rename_all = "camelCase")]
+struct RemoteControlStartJsonOutput<'a> {
+    mode: RemoteControlModeJson,
+    status: RemoteControlConnectionStatus,
+    server_name: &'a str,
+    environment_id: Option<&'a str>,
+    timed_out: bool,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    daemon: Option<&'a AppServerRemoteControlStartOutput>,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Serialize)]
+#[serde(rename_all = "camelCase")]
+enum RemoteControlModeJson {
+    Foreground,
+    Daemon,
+}
+
+impl<'a> RemoteControlStartJsonOutput<'a> {
+    fn foreground(summary: &'a AppServerRemoteControlReadyStatus) -> Self {
+        Self {
+            mode: RemoteControlModeJson::Foreground,
+            status: summary.status,
+            server_name: &summary.server_name,
+            environment_id: summary.environment_id.as_deref(),
+            timed_out: summary.timed_out,
+            daemon: None,
+        }
+    }
+
+    fn daemon(output: &'a AppServerRemoteControlReadyOutput) -> Self {
+        let remote_control = &output.remote_control;
+        Self {
+            mode: RemoteControlModeJson::Daemon,
+            status: remote_control.status,
+            server_name: &remote_control.server_name,
+            environment_id: remote_control.environment_id.as_deref(),
+            timed_out: remote_control.timed_out,
+            daemon: Some(&output.daemon),
+        }
+    }
+}
+
+fn remote_control_start_human_message(
+    output: &AppServerRemoteControlReadyStatus,
+) -> anyhow::Result<String> {
+    ensure_remote_control_startable(output)?;
+    match output.status {
+        RemoteControlConnectionStatus::Connected => Ok(format!(
+            "This machine is available for remote control as {}.",
+            output.server_name
+        )),
+        RemoteControlConnectionStatus::Connecting => Ok(format!(
+            "Remote control is enabled on {} and still connecting.",
+            output.server_name
+        )),
+        RemoteControlConnectionStatus::Errored | RemoteControlConnectionStatus::Disabled => {
+            unreachable!("errored and disabled statuses are rejected before formatting")
+        }
+    }
+}
+
+fn ensure_remote_control_startable(
+    output: &AppServerRemoteControlReadyStatus,
+) -> anyhow::Result<()> {
+    match output.status {
+        RemoteControlConnectionStatus::Connected | RemoteControlConnectionStatus::Connecting => {
+            Ok(())
+        }
+        RemoteControlConnectionStatus::Errored => {
+            anyhow::bail!(
+                "Remote control is enabled on {} but the connection is errored.",
+                output.server_name
+            );
+        }
+        RemoteControlConnectionStatus::Disabled => {
+            anyhow::bail!("Remote control is disabled on {}.", output.server_name);
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum RemoteControlHumanOutputMode {
+    Foreground,
+    Daemon,
+}
+
+fn remote_control_start_human_lines(
+    summary: &AppServerRemoteControlReadyStatus,
+    mode: RemoteControlHumanOutputMode,
+) -> anyhow::Result<Vec<String>> {
+    let mut lines = vec![remote_control_start_human_message(summary)?];
+    match mode {
+        RemoteControlHumanOutputMode::Foreground => {
+            lines.push("Press Ctrl-C to stop.".to_string());
+        }
+        RemoteControlHumanOutputMode::Daemon => {}
+    }
+    Ok(lines)
+}
+
+fn daemon_app_server_human_lines(output: &AppServerRemoteControlStartOutput) -> Vec<String> {
+    let (managed_codex_path, managed_codex_version) = daemon_app_server_identity(output);
+    vec![
+        "Daemon used app-server:".to_string(),
+        format!("  path: {}", managed_codex_path.display()),
+        format!("  version: {}", managed_codex_version.unwrap_or("unknown")),
+    ]
+}
+
+fn daemon_app_server_identity(
+    output: &AppServerRemoteControlStartOutput,
+) -> (&std::path::Path, Option<&str>) {
+    match output {
+        AppServerRemoteControlStartOutput::Bootstrap(output) => (
+            &output.managed_codex_path,
+            output.managed_codex_version.as_deref(),
+        ),
+        AppServerRemoteControlStartOutput::Start(output) => (
+            &output.managed_codex_path,
+            output.managed_codex_version.as_deref(),
+        ),
+    }
+}
+
+fn print_remote_control_stop_output(
+    output: &AppServerLifecycleOutput,
+    json: bool,
+) -> anyhow::Result<()> {
+    if json {
+        println!("{}", serde_json::to_string(output)?);
+        return Ok(());
+    }
+
+    println!("{}", remote_control_stop_human_message(output));
+    Ok(())
+}
+
+fn remote_control_stop_human_message(output: &AppServerLifecycleOutput) -> String {
+    match output.status {
+        AppServerLifecycleStatus::Stopped => "Remote control stopped.".to_string(),
+        AppServerLifecycleStatus::NotRunning => "Remote control is not running.".to_string(),
+        AppServerLifecycleStatus::Started
+        | AppServerLifecycleStatus::Restarted
+        | AppServerLifecycleStatus::AlreadyRunning
+        | AppServerLifecycleStatus::Running => {
+            format!(
+                "Remote control stop completed with status {:?}.",
+                output.status
+            )
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use pretty_assertions::assert_eq;
+    use serde_json::json;
+    use std::path::PathBuf;
+
+    use super::*;
+
+    fn remote_control_status(
+        status: RemoteControlConnectionStatus,
+    ) -> AppServerRemoteControlReadyStatus {
+        AppServerRemoteControlReadyStatus {
+            status,
+            server_name: "owen-mbp".to_string(),
+            environment_id: Some("env_test".to_string()),
+            timed_out: status == RemoteControlConnectionStatus::Connecting,
+        }
+    }
+
+    fn daemon_ready_output(
+        status: RemoteControlConnectionStatus,
+    ) -> AppServerRemoteControlReadyOutput {
+        AppServerRemoteControlReadyOutput {
+            daemon: AppServerRemoteControlStartOutput::Start(AppServerLifecycleOutput {
+                status: AppServerLifecycleStatus::Started,
+                backend: None,
+                pid: Some(42),
+                managed_codex_path: PathBuf::from("/opt/codex/bin/codex"),
+                managed_codex_version: Some("1.0.0".to_string()),
+                socket_path: PathBuf::from("/tmp/app-server-control.sock"),
+                cli_version: Some("1.0.0".to_string()),
+                app_server_version: Some("2.0.0".to_string()),
+            }),
+            remote_control: AppServerRemoteControlReadyStatus {
+                status,
+                server_name: "owen-mbp".to_string(),
+                environment_id: Some("env_test".to_string()),
+                timed_out: status == RemoteControlConnectionStatus::Connecting,
+            },
+        }
+    }
+
+    #[test]
+    fn remote_control_human_start_messages_use_server_name() {
+        assert_eq!(
+            remote_control_start_human_message(&remote_control_status(
+                RemoteControlConnectionStatus::Connected
+            ))
+            .expect("connected message"),
+            "This machine is available for remote control as owen-mbp."
+        );
+        assert_eq!(
+            remote_control_start_human_message(&remote_control_status(
+                RemoteControlConnectionStatus::Connecting
+            ))
+            .expect("connecting message"),
+            "Remote control is enabled on owen-mbp and still connecting."
+        );
+        assert_eq!(
+            remote_control_start_human_message(&remote_control_status(
+                RemoteControlConnectionStatus::Errored
+            ))
+            .expect_err("errored status should fail")
+            .to_string(),
+            "Remote control is enabled on owen-mbp but the connection is errored."
+        );
+        assert_eq!(
+            remote_control_start_human_message(&remote_control_status(
+                RemoteControlConnectionStatus::Disabled
+            ))
+            .expect_err("disabled status should fail")
+            .to_string(),
+            "Remote control is disabled on owen-mbp."
+        );
+    }
+
+    #[test]
+    fn remote_control_human_lines_include_foreground_stop_hint_only() {
+        let summary = remote_control_status(RemoteControlConnectionStatus::Connected);
+
+        assert_eq!(
+            remote_control_start_human_lines(&summary, RemoteControlHumanOutputMode::Foreground)
+                .expect("foreground lines"),
+            vec![
+                "This machine is available for remote control as owen-mbp.".to_string(),
+                "Press Ctrl-C to stop.".to_string(),
+            ]
+        );
+        assert_eq!(
+            remote_control_start_human_lines(&summary, RemoteControlHumanOutputMode::Daemon)
+                .expect("daemon lines"),
+            vec!["This machine is available for remote control as owen-mbp.".to_string()]
+        );
+    }
+
+    #[test]
+    fn daemon_app_server_human_lines_include_path_and_version() {
+        assert_eq!(
+            daemon_app_server_human_lines(
+                &daemon_ready_output(RemoteControlConnectionStatus::Connected).daemon
+            ),
+            vec![
+                "Daemon used app-server:".to_string(),
+                "  path: /opt/codex/bin/codex".to_string(),
+                "  version: 1.0.0".to_string(),
+            ]
+        );
+    }
+
+    #[test]
+    fn remote_control_json_output_marks_foreground_or_daemon() {
+        let foreground_summary = remote_control_status(RemoteControlConnectionStatus::Connected);
+        assert_eq!(
+            serde_json::to_value(RemoteControlStartJsonOutput::foreground(
+                &foreground_summary
+            ))
+            .expect("foreground JSON"),
+            json!({
+                "mode": "foreground",
+                "status": "connected",
+                "serverName": "owen-mbp",
+                "environmentId": "env_test",
+                "timedOut": false,
+            })
+        );
+
+        let daemon_output = daemon_ready_output(RemoteControlConnectionStatus::Connected);
+        assert_eq!(
+            serde_json::to_value(RemoteControlStartJsonOutput::daemon(&daemon_output))
+                .expect("daemon JSON"),
+            json!({
+                "mode": "daemon",
+                "status": "connected",
+                "serverName": "owen-mbp",
+                "environmentId": "env_test",
+                "timedOut": false,
+                "daemon": {
+                    "status": "started",
+                    "pid": 42,
+                    "managedCodexPath": "/opt/codex/bin/codex",
+                    "managedCodexVersion": "1.0.0",
+                    "socketPath": "/tmp/app-server-control.sock",
+                    "cliVersion": "1.0.0",
+                    "appServerVersion": "2.0.0",
+                },
+            })
+        );
+    }
+
+    #[test]
+    fn remote_control_daemon_json_rejects_unstartable_status() {
+        assert_eq!(
+            print_remote_control_start_output(
+                &daemon_ready_output(RemoteControlConnectionStatus::Errored),
+                /*json*/ true
+            )
+            .expect_err("errored daemon status should fail")
+            .to_string(),
+            "Remote control is enabled on owen-mbp but the connection is errored."
+        );
+    }
+
+    #[tokio::test]
+    async fn foreground_wait_aborts_app_server_on_stop_signal() {
+        let app_server_task = tokio::spawn(std::future::pending::<std::io::Result<()>>());
+        let (stop_tx, stop_rx) = tokio::sync::watch::channel(false);
+        stop_tx.send(true).expect("send stop signal");
+
+        tokio::time::timeout(
+            std::time::Duration::from_secs(1),
+            wait_for_foreground_app_server(app_server_task, stop_rx),
+        )
+        .await
+        .expect("foreground wait should return after stop signal")
+        .expect("stop signal should shut down cleanly");
+    }
+
+    #[tokio::test]
+    async fn foreground_start_wait_stops_before_ready() {
+        let mut app_server_task = tokio::spawn(std::future::pending::<std::io::Result<()>>());
+        let (stop_tx, stop_rx) = tokio::sync::watch::channel(false);
+        stop_tx.send(true).expect("send stop signal");
+
+        let startup = tokio::time::timeout(
+            std::time::Duration::from_secs(1),
+            wait_for_foreground_remote_control_start(
+                &mut app_server_task,
+                std::future::pending::<anyhow::Result<AppServerRemoteControlReadyStatus>>(),
+                stop_rx,
+            ),
+        )
+        .await
+        .expect("foreground startup wait should return after stop signal");
+
+        assert!(matches!(startup, ForegroundStartupResult::Stopped));
+        app_server_task.abort();
+        let _ = app_server_task.await;
+    }
+
+    #[tokio::test]
+    async fn foreground_start_wait_reports_app_server_exit_before_ready() {
+        let mut app_server_task =
+            tokio::spawn(async { Err(std::io::Error::other("startup failed before socket bind")) });
+        let (_stop_tx, stop_rx) = tokio::sync::watch::channel(false);
+
+        let startup = tokio::time::timeout(
+            std::time::Duration::from_secs(1),
+            wait_for_foreground_remote_control_start(
+                &mut app_server_task,
+                std::future::pending::<anyhow::Result<AppServerRemoteControlReadyStatus>>(),
+                stop_rx,
+            ),
+        )
+        .await
+        .expect("foreground startup wait should return after app-server exits");
+
+        let ForegroundStartupResult::AppServerExited(error) = startup else {
+            panic!("expected app-server exit before ready");
+        };
+
+        assert_eq!(
+            error.to_string(),
+            "foreground app-server exited before remote control became ready"
+        );
+    }
+}
diff --git a/codex-rs/cli/src/state_db_recovery.rs b/codex-rs/cli/src/state_db_recovery.rs
new file mode 100644
index 0000000000..7aeffaca3a
--- /dev/null
+++ b/codex-rs/cli/src/state_db_recovery.rs
@@ -0,0 +1,185 @@
+//! CLI recovery for local state database startup failures.
+//!
+//! This keeps user-facing repair and lock-contention handling out of the main
+//! CLI dispatch path while preserving the TUI startup error as the boundary type.
+
+use codex_tui::LocalStateDbStartupError;
+use std::path::PathBuf;
+
+pub(crate) fn startup_error(err: &std::io::Error) -> Option<&LocalStateDbStartupError> {
+    err.get_ref()
+        .and_then(|err| err.downcast_ref::<LocalStateDbStartupError>())
+}
+
+pub(crate) fn is_locked(detail: &str) -> bool {
+    let detail = detail.to_ascii_lowercase();
+    detail.contains("database is locked") || detail.contains("database is busy")
+}
+
+pub(crate) fn confirm_repair(startup_error: &LocalStateDbStartupError) -> std::io::Result<bool> {
+    eprintln!("Codex couldn't start because its local database appears to be damaged.");
+    eprintln!("Codex can try a safe repair by backing up those files and rebuilding them.");
+    print_technical_details(startup_error);
+    crate::confirm("Repair Codex local data now? [y/N]: ")
+}
+
+pub(crate) async fn repair_files(
+    startup_error: &LocalStateDbStartupError,
+) -> std::io::Result<Vec<PathBuf>> {
+    let state_db_path = startup_error.state_db_path();
+    let sqlite_home = state_db_path.parent().ok_or_else(|| {
+        std::io::Error::other("state database path does not have a parent directory")
+    })?;
+    let timestamp = std::time::SystemTime::now()
+        .duration_since(std::time::UNIX_EPOCH)
+        .map_or(0, |duration| duration.as_secs());
+    let repair_suffix = format!("codex-repair-{timestamp}");
+    let mut backups = Vec::new();
+
+    match tokio::fs::metadata(sqlite_home).await {
+        Ok(metadata) if metadata.is_dir() => {}
+        Ok(_) => {
+            backups.push(backup_path(sqlite_home, &repair_suffix).await?);
+            tokio::fs::create_dir_all(sqlite_home).await?;
+        }
+        Err(err) if err.kind() == std::io::ErrorKind::NotFound => {
+            tokio::fs::create_dir_all(sqlite_home).await?;
+        }
+        Err(err) => return Err(err),
+    }
+
+    for path in codex_state::runtime_db_paths(sqlite_home)
+        .into_iter()
+        .flat_map(|db| sqlite_paths(db.path.as_path()))
+    {
+        if tokio::fs::try_exists(path.as_path()).await? {
+            backups.push(backup_path(path.as_path(), &repair_suffix).await?);
+        }
+    }
+
+    if backups.is_empty() {
+        return Err(std::io::Error::other(
+            "no repairable Codex local data files were found",
+        ));
+    }
+
+    Ok(backups)
+}
+
+pub(crate) fn print_repair_backups(backups: &[PathBuf]) {
+    eprintln!("Backed up Codex local data before repair:");
+    for backup in backups {
+        eprintln!("  {}", backup.display());
+    }
+    eprintln!("Retrying startup with rebuilt local data...");
+}
+
+pub(crate) fn print_diagnostic_guidance(startup_error: &LocalStateDbStartupError) {
+    eprintln!("Codex couldn't start because its local database appears to be damaged.");
+    eprintln!("Run `codex doctor` to check your setup and get next-step guidance.");
+    eprintln!("If this keeps happening, share the technical details below when asking for help.");
+    print_technical_details(startup_error);
+}
+
+pub(crate) fn print_locked_guidance(startup_error: &LocalStateDbStartupError) {
+    eprintln!("Codex couldn't start because another Codex process is using its local data.");
+    eprintln!("Quit any other copies of Codex that may still be running, then try again.");
+    print_technical_details(startup_error);
+}
+
+fn sqlite_paths(db_path: &std::path::Path) -> Vec<PathBuf> {
+    let mut wal_path = db_path.as_os_str().to_os_string();
+    wal_path.push("-wal");
+    let mut shm_path = db_path.as_os_str().to_os_string();
+    shm_path.push("-shm");
+    vec![
+        db_path.to_path_buf(),
+        PathBuf::from(wal_path),
+        PathBuf::from(shm_path),
+    ]
+}
+
+async fn backup_path(path: &std::path::Path, repair_suffix: &str) -> std::io::Result<PathBuf> {
+    let file_name = path.file_name().ok_or_else(|| {
+        std::io::Error::other(format!(
+            "cannot create a repair backup name for {}",
+            path.display()
+        ))
+    })?;
+    let mut sequence = 0;
+    loop {
+        let mut backup_name = file_name.to_os_string();
+        backup_name.push(format!(".{repair_suffix}.{sequence}.bak"));
+        let backup_path = path.with_file_name(backup_name);
+        if !tokio::fs::try_exists(backup_path.as_path()).await? {
+            tokio::fs::rename(path, backup_path.as_path()).await?;
+            return Ok(backup_path);
+        }
+        sequence += 1;
+    }
+}
+
+fn print_technical_details(startup_error: &LocalStateDbStartupError) {
+    eprintln!("Technical details:");
+    eprintln!("  Location: {}", startup_error.state_db_path().display());
+    eprintln!("  Cause: {}", startup_error.detail());
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use pretty_assertions::assert_eq;
+    use tempfile::TempDir;
+
+    #[tokio::test]
+    async fn repair_backs_up_owned_database_files() -> std::io::Result<()> {
+        let temp_dir = TempDir::new()?;
+        let state_path = codex_state::state_db_path(temp_dir.path());
+        let logs_path = codex_state::logs_db_path(temp_dir.path());
+        let goals_path = codex_state::goals_db_path(temp_dir.path());
+        let state_sidecars = sqlite_paths(state_path.as_path());
+        tokio::fs::write(state_path.as_path(), b"state").await?;
+        tokio::fs::write(state_sidecars[1].as_path(), b"state-wal").await?;
+        tokio::fs::write(logs_path.as_path(), b"logs").await?;
+        tokio::fs::write(goals_path.as_path(), b"goals").await?;
+
+        let startup_error =
+            LocalStateDbStartupError::new(state_path.clone(), "corrupt".to_string());
+        let backups = repair_files(&startup_error).await?;
+
+        assert_eq!(backups.len(), 4);
+        assert!(!tokio::fs::try_exists(state_path.as_path()).await?);
+        assert!(!tokio::fs::try_exists(state_sidecars[1].as_path()).await?);
+        assert!(!tokio::fs::try_exists(logs_path.as_path()).await?);
+        assert!(!tokio::fs::try_exists(goals_path.as_path()).await?);
+        for backup in backups {
+            assert!(tokio::fs::try_exists(backup.as_path()).await?);
+        }
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn repair_replaces_blocking_sqlite_home_file() -> std::io::Result<()> {
+        let temp_dir = TempDir::new()?;
+        let sqlite_home = temp_dir.path().join("sqlite-home");
+        tokio::fs::write(sqlite_home.as_path(), b"not-a-directory").await?;
+        let startup_error = LocalStateDbStartupError::new(
+            codex_state::state_db_path(sqlite_home.as_path()),
+            "File exists".to_string(),
+        );
+
+        let backups = repair_files(&startup_error).await?;
+
+        assert_eq!(backups.len(), 1);
+        assert!(tokio::fs::metadata(sqlite_home.as_path()).await?.is_dir());
+        assert!(tokio::fs::try_exists(backups[0].as_path()).await?);
+        Ok(())
+    }
+
+    #[test]
+    fn lock_failures_skip_repair() {
+        assert!(is_locked("database is locked"));
+        assert!(is_locked("database is busy"));
+        assert!(!is_locked("database disk image is malformed"));
+    }
+}
diff --git a/codex-rs/cli/tests/app_server.rs b/codex-rs/cli/tests/app_server.rs
new file mode 100644
index 0000000000..4a2642379d
--- /dev/null
+++ b/codex-rs/cli/tests/app_server.rs
@@ -0,0 +1,30 @@
+use std::path::Path;
+
+use anyhow::Result;
+use predicates::str::contains;
+use tempfile::TempDir;
+
+fn codex_command(codex_home: &Path) -> Result<assert_cmd::Command> {
+    let mut cmd = assert_cmd::Command::new(codex_utils_cargo_bin::cargo_bin("codex")?);
+    cmd.env("CODEX_HOME", codex_home);
+    Ok(cmd)
+}
+
+#[test]
+fn strict_config_rejects_unknown_config_fields_for_app_server() -> Result<()> {
+    let codex_home = TempDir::new()?;
+    std::fs::write(
+        codex_home.path().join("config.toml"),
+        r#"
+foo = "bar"
+"#,
+    )?;
+
+    let mut cmd = codex_command(codex_home.path())?;
+    cmd.args(["app-server", "--strict-config", "--listen", "off"])
+        .assert()
+        .failure()
+        .stderr(contains("unknown configuration field"));
+
+    Ok(())
+}
diff --git a/codex-rs/cli/tests/features.rs b/codex-rs/cli/tests/features.rs
index 17a7eff679..596cfaa8f8 100644
--- a/codex-rs/cli/tests/features.rs
+++ b/codex-rs/cli/tests/features.rs
@@ -11,6 +11,34 @@ fn codex_command(codex_home: &Path) -> Result<assert_cmd::Command> {
     Ok(cmd)
 }
 
+#[test]
+fn strict_config_rejects_unknown_config_override() -> Result<()> {
+    let codex_home = TempDir::new()?;
+
+    let mut cmd = codex_command(codex_home.path())?;
+    cmd.args(["--strict-config", "-c", "foo=bar", "mcp-server"])
+        .assert()
+        .failure()
+        .stderr(contains("unknown configuration field"));
+
+    Ok(())
+}
+
+#[test]
+fn strict_config_is_not_supported_for_cloud_command() -> Result<()> {
+    let codex_home = TempDir::new()?;
+
+    let mut cmd = codex_command(codex_home.path())?;
+    cmd.args(["--strict-config", "-c", "foo=bar", "cloud", "list"])
+        .assert()
+        .failure()
+        .stderr(contains(
+            "`--strict-config` is not supported for `codex cloud`",
+        ));
+
+    Ok(())
+}
+
 #[tokio::test]
 async fn features_enable_writes_feature_flag_to_config() -> Result<()> {
     let codex_home = TempDir::new()?;
diff --git a/codex-rs/cli/tests/plugin_cli.rs b/codex-rs/cli/tests/plugin_cli.rs
new file mode 100644
index 0000000000..9829e4df07
--- /dev/null
+++ b/codex-rs/cli/tests/plugin_cli.rs
@@ -0,0 +1,327 @@
+use anyhow::Result;
+use codex_config::CONFIG_TOML_FILE;
+use codex_config::MarketplaceConfigUpdate;
+use codex_config::record_user_marketplace;
+use predicates::prelude::PredicateBooleanExt;
+use predicates::str::contains;
+use std::path::Path;
+use tempfile::TempDir;
+
+fn codex_command(codex_home: &Path) -> Result<assert_cmd::Command> {
+    let mut cmd = assert_cmd::Command::new(codex_utils_cargo_bin::cargo_bin("codex")?);
+    cmd.env("CODEX_HOME", codex_home);
+    Ok(cmd)
+}
+
+fn codex_command_in(codex_home: &Path, current_dir: &Path) -> Result<assert_cmd::Command> {
+    let mut cmd = codex_command(codex_home)?;
+    cmd.current_dir(current_dir);
+    Ok(cmd)
+}
+
+fn configured_local_marketplace(source: &str) -> MarketplaceConfigUpdate<'_> {
+    MarketplaceConfigUpdate {
+        last_updated: "2026-05-06T00:00:00Z",
+        last_revision: None,
+        source_type: "local",
+        source,
+        ref_name: None,
+        sparse_paths: &[],
+    }
+}
+
+fn write_plugins_enabled_config(codex_home: &Path) -> Result<()> {
+    std::fs::write(
+        codex_home.join(CONFIG_TOML_FILE),
+        r#"[features]
+plugins = true
+"#,
+    )?;
+    Ok(())
+}
+
+fn write_marketplace_source(source: &Path) -> Result<()> {
+    std::fs::create_dir_all(source.join(".agents/plugins"))?;
+    std::fs::create_dir_all(source.join("plugins/sample/.codex-plugin"))?;
+    std::fs::write(
+        source.join(".agents/plugins/marketplace.json"),
+        r#"{
+  "name": "debug",
+  "plugins": [
+    {
+      "name": "sample",
+      "source": {
+        "source": "local",
+        "path": "./plugins/sample"
+      }
+    }
+  ]
+}"#,
+    )?;
+    std::fs::write(
+        source.join("plugins/sample/.codex-plugin/plugin.json"),
+        r#"{"name":"sample","description":"Sample plugin"}"#,
+    )?;
+    Ok(())
+}
+
+fn setup_local_marketplace() -> Result<(TempDir, TempDir)> {
+    let codex_home = TempDir::new()?;
+    let source = TempDir::new()?;
+    write_plugins_enabled_config(codex_home.path())?;
+    write_marketplace_source(source.path())?;
+    let source_path = source.path().to_string_lossy().into_owned();
+    record_user_marketplace(
+        codex_home.path(),
+        "debug",
+        &configured_local_marketplace(&source_path),
+    )?;
+    Ok((codex_home, source))
+}
+
+fn setup_unconfigured_local_marketplace() -> Result<(TempDir, TempDir)> {
+    let codex_home = TempDir::new()?;
+    let source = TempDir::new()?;
+    write_plugins_enabled_config(codex_home.path())?;
+    write_marketplace_source(source.path())?;
+    Ok((codex_home, source))
+}
+
+fn setup_configured_marketplace_without_manifest() -> Result<(TempDir, TempDir)> {
+    let codex_home = TempDir::new()?;
+    let source = TempDir::new()?;
+    write_plugins_enabled_config(codex_home.path())?;
+    let source_path = source.path().to_string_lossy().into_owned();
+    record_user_marketplace(
+        codex_home.path(),
+        "debug",
+        &configured_local_marketplace(&source_path),
+    )?;
+    Ok((codex_home, source))
+}
+
+fn setup_configured_marketplace_with_malformed_manifest() -> Result<(TempDir, TempDir)> {
+    let codex_home = TempDir::new()?;
+    let source = TempDir::new()?;
+    write_plugins_enabled_config(codex_home.path())?;
+    std::fs::create_dir_all(source.path().join(".agents/plugins"))?;
+    std::fs::write(
+        source.path().join(".agents/plugins/marketplace.json"),
+        "{not valid json",
+    )?;
+    let source_path = source.path().to_string_lossy().into_owned();
+    record_user_marketplace(
+        codex_home.path(),
+        "debug",
+        &configured_local_marketplace(&source_path),
+    )?;
+    Ok((codex_home, source))
+}
+
+#[tokio::test]
+async fn marketplace_list_shows_configured_marketplace_names() -> Result<()> {
+    let (codex_home, source) = setup_local_marketplace()?;
+
+    codex_command(codex_home.path())?
+        .args(["plugin", "marketplace", "list"])
+        .assert()
+        .success()
+        .stdout(contains("debug"))
+        .stdout(contains(source.path().display().to_string()));
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn plugin_list_shows_plugins_grouped_by_marketplace() -> Result<()> {
+    let (codex_home, _source) = setup_local_marketplace()?;
+
+    codex_command(codex_home.path())?
+        .args(["plugin", "list"])
+        .assert()
+        .success()
+        .stdout(contains("Marketplace `debug`"))
+        .stdout(contains("sample@debug (not installed)"));
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn plugin_list_excludes_unconfigured_repo_local_marketplaces() -> Result<()> {
+    let (codex_home, source) = setup_unconfigured_local_marketplace()?;
+
+    codex_command_in(codex_home.path(), source.path())?
+        .args(["plugin", "list"])
+        .assert()
+        .success()
+        .stdout(contains("No marketplace plugins found."))
+        .stdout(predicates::str::is_match("sample@debug").unwrap().not());
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn plugin_list_fails_when_configured_marketplace_snapshot_is_missing() -> Result<()> {
+    let (codex_home, source) = setup_configured_marketplace_without_manifest()?;
+
+    codex_command(codex_home.path())?
+        .args(["plugin", "list"])
+        .assert()
+        .failure()
+        .stderr(contains(
+            "failed to load configured marketplace snapshot(s):",
+        ))
+        .stderr(contains("`debug`"))
+        .stderr(contains(source.path().display().to_string()))
+        .stderr(contains(
+            "marketplace root does not contain a supported manifest",
+        ));
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn plugin_add_and_remove_updates_installed_plugin_config() -> Result<()> {
+    let (codex_home, _source) = setup_local_marketplace()?;
+
+    codex_command(codex_home.path())?
+        .args(["plugin", "add", "sample@debug"])
+        .assert()
+        .success()
+        .stdout(contains("Added plugin `sample` from marketplace `debug`."));
+
+    let config = std::fs::read_to_string(codex_home.path().join(CONFIG_TOML_FILE))?;
+    assert!(config.contains("[plugins.\"sample@debug\"]"));
+
+    codex_command(codex_home.path())?
+        .args(["plugin", "remove", "sample", "--marketplace", "debug"])
+        .assert()
+        .success()
+        .stdout(contains(
+            "Removed plugin `sample` from marketplace `debug`.",
+        ));
+
+    let config = std::fs::read_to_string(codex_home.path().join(CONFIG_TOML_FILE))?;
+    assert!(!config.contains("[plugins.\"sample@debug\"]"));
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn plugin_add_rejects_unconfigured_repo_local_marketplaces() -> Result<()> {
+    let (codex_home, source) = setup_unconfigured_local_marketplace()?;
+
+    codex_command_in(codex_home.path(), source.path())?
+        .args(["plugin", "add", "sample@debug"])
+        .assert()
+        .failure()
+        .stderr(contains(
+            "plugin `sample` was not found in marketplace `debug`",
+        ));
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn plugin_add_fails_when_configured_marketplace_snapshot_is_malformed() -> Result<()> {
+    let (codex_home, _source) = setup_configured_marketplace_with_malformed_manifest()?;
+
+    codex_command(codex_home.path())?
+        .args(["plugin", "add", "sample@debug"])
+        .assert()
+        .failure()
+        .stderr(contains(
+            "failed to load configured marketplace snapshot(s):",
+        ))
+        .stderr(contains("`debug`"))
+        .stderr(contains("invalid marketplace file"))
+        .stderr(contains("key must be a string"));
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn plugin_add_reinstalls_from_configured_marketplace_snapshot() -> Result<()> {
+    let (codex_home, _source) = setup_local_marketplace()?;
+
+    codex_command(codex_home.path())?
+        .args(["plugin", "add", "sample@debug"])
+        .assert()
+        .success();
+
+    codex_command(codex_home.path())?
+        .args(["plugin", "add", "sample@debug"])
+        .assert()
+        .success()
+        .stdout(contains("Added plugin `sample` from marketplace `debug`."));
+
+    assert!(
+        codex_home
+            .path()
+            .join("plugins/cache/debug/sample/local/.codex-plugin/plugin.json")
+            .is_file()
+    );
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn plugin_remove_works_after_marketplace_is_removed() -> Result<()> {
+    let (codex_home, _source) = setup_local_marketplace()?;
+
+    codex_command(codex_home.path())?
+        .args(["plugin", "add", "sample", "--marketplace", "debug"])
+        .assert()
+        .success();
+
+    codex_command(codex_home.path())?
+        .args(["plugin", "marketplace", "remove", "debug"])
+        .assert()
+        .success();
+
+    codex_command(codex_home.path())?
+        .args(["plugin", "remove", "sample@debug"])
+        .assert()
+        .success()
+        .stdout(contains(
+            "Removed plugin `sample` from marketplace `debug`.",
+        ));
+
+    let config = std::fs::read_to_string(codex_home.path().join(CONFIG_TOML_FILE))?;
+    assert!(!config.contains("[plugins.\"sample@debug\"]"));
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn plugin_add_rejects_cached_plugins_without_authorizing_marketplace_snapshot() -> Result<()>
+{
+    let (codex_home, _source) = setup_local_marketplace()?;
+
+    codex_command(codex_home.path())?
+        .args(["plugin", "add", "sample@debug"])
+        .assert()
+        .success();
+
+    codex_command(codex_home.path())?
+        .args(["plugin", "marketplace", "remove", "debug"])
+        .assert()
+        .success();
+
+    assert!(
+        codex_home
+            .path()
+            .join("plugins/cache/debug/sample/local/.codex-plugin/plugin.json")
+            .is_file()
+    );
+
+    codex_command(codex_home.path())?
+        .args(["plugin", "add", "sample@debug"])
+        .assert()
+        .failure()
+        .stderr(contains(
+            "plugin `sample` was not found in marketplace `debug`",
+        ));
+
+    Ok(())
+}
diff --git a/codex-rs/code-mode/src/description.rs b/codex-rs/code-mode/src/description.rs
index 4c5eb6fbdc..18d3c4555c 100644
--- a/codex-rs/code-mode/src/description.rs
+++ b/codex-rs/code-mode/src/description.rs
@@ -7,10 +7,8 @@ use std::collections::BTreeMap;
 use crate::PUBLIC_TOOL_NAME;
 
 const MAX_JS_SAFE_INTEGER: u64 = (1_u64 << 53) - 1;
-const CODE_MODE_ONLY_PREFACE: &str =
-    "Use `exec/wait` tool to run all other tools, do not attempt to use any other tools directly";
 const DEFERRED_NESTED_TOOLS_GUIDANCE: &str = r#"Some nested MCP/app tools may be omitted from this description. They are still available on the global `tools` object and listed in `ALL_TOOLS`.
-To find one, filter `ALL_TOOLS` by `name` and `description`; do not print the full `ALL_TOOLS` array. Print only a small set of relevant matches if you need to inspect them."#;
+To find one, filter `ALL_TOOLS` by `name` and `description`."#;
 const EXEC_DESCRIPTION_TEMPLATE: &str = r#"Run JavaScript code to orchestrate/compose tool calls
 - Evaluates the provided JavaScript code in a fresh V8 isolate as an async module.
 - All nested tools are available on the global `tools` object, for example `await tools.exec_command(...)`. Tool names are exposed as normalized JavaScript identifiers, for example `await tools.mcp__ologs__get_profile(...)`.
@@ -26,7 +24,7 @@ const EXEC_DESCRIPTION_TEMPLATE: &str = r#"Run JavaScript code to orchestrate/co
 - Global helpers:
 - `exit()`: Immediately ends the current script successfully (like an early return from the top level).
 - `text(value: string | number | boolean | undefined | null)`: Appends a text item. Non-string values are stringified with `JSON.stringify(...)` when possible.
-- `image(imageUrlOrItem: string | { image_url: string; detail?: "auto" | "low" | "high" | "original" | null } | ImageContent, detail?: "auto" | "low" | "high" | "original" | null)`: Appends an image item. `image_url` can be an HTTPS URL or a base64-encoded `data:` URL. To forward an MCP tool image, pass an individual `ImageContent` block from `result.content`, for example `image(result.content[0])`. MCP image blocks may request detail with `_meta: { "codex/imageDetail": "original" }`. When provided, the second `detail` argument overrides any detail embedded in the first argument.
+- `image(imageUrlOrItem: string | { image_url: string; detail?: "high" | "original" | null } | ImageContent, detail?: "high" | "original" | null)`: Appends an image item. `image_url` can be an HTTPS URL or a base64-encoded `data:` URL. To forward an MCP tool image, pass an individual `ImageContent` block from `result.content`, for example `image(result.content[0])`. MCP image blocks may request detail with `_meta: { "codex/imageDetail": "original" }`. When provided, the second `detail` argument overrides any detail embedded in the first argument.
 - `store(key: string, value: any)`: stores a serializable value under a string key for later `exec` calls in the same session.
 - `load(key: string)`: returns the stored value for a string key, or `undefined` if it is missing.
 - `notify(value: string | number | boolean | undefined | null)`: immediately injects an extra `custom_tool_call_output` for the current `exec` call. Values are stringified like `text(...)`.
@@ -256,9 +254,6 @@ pub fn build_exec_tool_description(
     deferred_tools_available: bool,
 ) -> String {
     let mut sections = Vec::new();
-    if code_mode_only {
-        sections.push(CODE_MODE_ONLY_PREFACE.to_string());
-    }
     sections.push(EXEC_DESCRIPTION_TEMPLATE.to_string());
     if deferred_tools_available {
         sections.push(DEFERRED_NESTED_TOOLS_GUIDANCE.to_string());
@@ -875,6 +870,7 @@ mod tests {
             "### `foo`
 bar"
         ));
+        assert!(!description.contains("do not attempt to use any other tools directly"));
     }
 
     #[test]
@@ -1097,5 +1093,6 @@ bar"
 
         assert!(description.contains("Some nested MCP/app tools may be omitted"));
         assert!(description.contains("filter `ALL_TOOLS` by `name` and `description`"));
+        assert!(!description.contains("do not print the full `ALL_TOOLS` array"));
     }
 }
diff --git a/codex-rs/code-mode/src/response.rs b/codex-rs/code-mode/src/response.rs
index 0ac3a03770..ae92639cc0 100644
--- a/codex-rs/code-mode/src/response.rs
+++ b/codex-rs/code-mode/src/response.rs
@@ -4,8 +4,6 @@ use serde::Serialize;
 #[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq)]
 #[serde(rename_all = "lowercase")]
 pub enum ImageDetail {
-    Auto,
-    Low,
     High,
     Original,
 }
diff --git a/codex-rs/code-mode/src/runtime/value.rs b/codex-rs/code-mode/src/runtime/value.rs
index 8d76a832d3..865b5a569d 100644
--- a/codex-rs/code-mode/src/runtime/value.rs
+++ b/codex-rs/code-mode/src/runtime/value.rs
@@ -71,14 +71,10 @@ pub(super) fn normalize_output_image(
             Some(detail) => {
                 let normalized = detail.to_ascii_lowercase();
                 Some(match normalized.as_str() {
-                    "auto" => ImageDetail::Auto,
-                    "low" => ImageDetail::Low,
                     "high" => ImageDetail::High,
                     "original" => ImageDetail::Original,
                     _ => {
-                        return Err(
-                            "image detail must be one of: auto, low, high, original".to_string()
-                        );
+                        return Err("image detail must be one of: high, original".to_string());
                     }
                 })
             }
@@ -160,7 +156,7 @@ fn parse_mcp_output_image(
         .and_then(JsonValue::as_object)
         .and_then(|meta| meta.get(CODEX_IMAGE_DETAIL_META_KEY))
         .and_then(JsonValue::as_str)
-        .filter(|detail| matches!(*detail, "auto" | "low" | "high" | "original"))
+        .filter(|detail| matches!(*detail, "high" | "original"))
         .map(str::to_string);
     Ok((image_url, detail))
 }
diff --git a/codex-rs/code-mode/src/service.rs b/codex-rs/code-mode/src/service.rs
index 44e4be4939..1544f84f36 100644
--- a/codex-rs/code-mode/src/service.rs
+++ b/codex-rs/code-mode/src/service.rs
@@ -1308,7 +1308,7 @@ image({
 image(
   {
     image_url: "https://example.com/image.jpg",
-    detail: "low",
+    detail: "high",
   },
   "original",
 );
@@ -1348,7 +1348,7 @@ image(
     mimeType: "image/png",
     _meta: { "codex/imageDetail": "original" },
   },
-  "low",
+  "high",
 );
 "#
                 .to_string(),
@@ -1364,7 +1364,7 @@ image(
                 cell_id: "1".to_string(),
                 content_items: vec![FunctionCallOutputContentItem::InputImage {
                     image_url: "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR4nGP4z8DwHwAFAAH/iZk9HQAAAABJRU5ErkJggg==".to_string(),
-                    detail: Some(crate::ImageDetail::Low),
+                    detail: Some(crate::ImageDetail::High),
                 }],
                 stored_values: HashMap::new(),
                 error_text: None,
@@ -1372,6 +1372,36 @@ image(
         );
     }
 
+    #[tokio::test]
+    async fn image_helper_rejects_unsupported_detail() {
+        let service = CodeModeService::new();
+
+        let response = service
+            .execute(ExecuteRequest {
+                source: r#"
+image({
+  image_url: "https://example.com/image.jpg",
+  detail: "low",
+});
+"#
+                .to_string(),
+                yield_time_ms: None,
+                ..execute_request("")
+            })
+            .await
+            .unwrap();
+
+        assert_eq!(
+            response,
+            RuntimeResponse::Result {
+                cell_id: "1".to_string(),
+                content_items: Vec::new(),
+                stored_values: HashMap::new(),
+                error_text: Some("image detail must be one of: high, original".to_string()),
+            }
+        );
+    }
+
     #[tokio::test]
     async fn image_helper_rejects_raw_mcp_result_container() {
         let service = CodeModeService::new();
diff --git a/codex-rs/codex-api/src/endpoint/mod.rs b/codex-rs/codex-api/src/endpoint/mod.rs
index c16687ff28..70c52b9580 100644
--- a/codex-rs/codex-api/src/endpoint/mod.rs
+++ b/codex-rs/codex-api/src/endpoint/mod.rs
@@ -24,4 +24,6 @@ pub use realtime_websocket::session_update_session_json;
 pub use responses::ResponsesClient;
 pub use responses::ResponsesOptions;
 pub use responses_websocket::ResponsesWebsocketClient;
+pub use responses_websocket::ResponsesWebsocketClose;
 pub use responses_websocket::ResponsesWebsocketConnection;
+pub use responses_websocket::ResponsesWebsocketProbe;
diff --git a/codex-rs/codex-api/src/endpoint/responses_websocket.rs b/codex-rs/codex-api/src/endpoint/responses_websocket.rs
index c5a682b328..f0a0019817 100644
--- a/codex-rs/codex-api/src/endpoint/responses_websocket.rs
+++ b/codex-rs/codex-api/src/endpoint/responses_websocket.rs
@@ -35,6 +35,7 @@ use tokio_tungstenite::connect_async_tls_with_config;
 use tokio_tungstenite::tungstenite::Error as WsError;
 use tokio_tungstenite::tungstenite::Message;
 use tokio_tungstenite::tungstenite::client::IntoClientRequest;
+use tokio_tungstenite::tungstenite::protocol::CloseFrame;
 use tracing::Instrument;
 use tracing::Span;
 use tracing::debug;
@@ -321,12 +322,40 @@ impl ResponsesWebsocketConnection {
     }
 }
 
+/// Client for connecting to the Responses WebSocket endpoint for one provider.
 pub struct ResponsesWebsocketClient {
     provider: Provider,
     auth: SharedAuthProvider,
 }
 
+/// Close frame information captured by a handshake probe.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ResponsesWebsocketClose {
+    /// WebSocket close code returned by the server.
+    pub code: String,
+    /// Human-readable close reason returned by the server.
+    pub reason: String,
+}
+
+/// Result of a handshake-only Responses WebSocket probe.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ResponsesWebsocketProbe {
+    /// Redacted by callers before displaying or serializing support reports.
+    pub url: String,
+    /// HTTP status returned by the successful WebSocket upgrade.
+    pub status: StatusCode,
+    /// Whether the server reported reasoning support in the upgrade response.
+    pub reasoning_included: bool,
+    /// Whether the server returned a model catalog ETag in the upgrade response.
+    pub models_etag_present: bool,
+    /// Whether the server returned a server-selected model in the upgrade response.
+    pub server_model_present: bool,
+    /// Close frame received immediately after upgrade, when one arrives quickly.
+    pub immediate_close: Option<ResponsesWebsocketClose>,
+}
+
 impl ResponsesWebsocketClient {
+    /// Creates a Responses WebSocket client for an already-resolved provider and auth source.
     pub fn new(provider: Provider, auth: SharedAuthProvider) -> Self {
         Self { provider, auth }
     }
@@ -353,7 +382,7 @@ impl ResponsesWebsocketClient {
             merge_request_headers(&self.provider.headers, extra_headers, default_headers);
         self.auth.add_auth_headers(&mut headers);
 
-        let (stream, server_reasoning_included, models_etag, server_model) =
+        let (stream, _status, server_reasoning_included, models_etag, server_model) =
             connect_websocket(ws_url, headers, turn_state.clone()).await?;
         Ok(ResponsesWebsocketConnection::new(
             stream,
@@ -364,6 +393,64 @@ impl ResponsesWebsocketClient {
             telemetry,
         ))
     }
+
+    /// Opens a WebSocket connection long enough to validate the upgrade response.
+    ///
+    /// The probe uses the same URL construction, headers, authentication, TLS,
+    /// and custom-CA path as a real Responses WebSocket connection, but it does
+    /// not send a request frame. After the HTTP 101 upgrade succeeds, it waits
+    /// briefly for an immediate server close frame so diagnostics can distinguish
+    /// a usable connection from a policy rejection that closes right away.
+    pub async fn probe_handshake(
+        &self,
+        extra_headers: HeaderMap,
+        default_headers: HeaderMap,
+        immediate_close_timeout: Duration,
+    ) -> Result<ResponsesWebsocketProbe, ApiError> {
+        let ws_url = self
+            .provider
+            .websocket_url_for_path("responses")
+            .map_err(|err| ApiError::Stream(format!("failed to build websocket URL: {err}")))?;
+
+        let mut headers =
+            merge_request_headers(&self.provider.headers, extra_headers, default_headers);
+        self.auth.add_auth_headers(&mut headers);
+
+        let (mut stream, status, reasoning_included, models_etag, server_model) =
+            connect_websocket(ws_url.clone(), headers, /*turn_state*/ None).await?;
+        let immediate_close = tokio::time::timeout(immediate_close_timeout, stream.next())
+            .await
+            .ok()
+            .flatten()
+            .transpose()
+            .map_err(|err| {
+                ApiError::Stream(format!("failed to read websocket probe event: {err}"))
+            })?
+            .and_then(immediate_close_from_message);
+
+        Ok(ResponsesWebsocketProbe {
+            url: ws_url.to_string(),
+            status,
+            reasoning_included,
+            models_etag_present: models_etag.is_some(),
+            server_model_present: server_model.is_some(),
+            immediate_close,
+        })
+    }
+}
+
+fn immediate_close_from_message(message: Message) -> Option<ResponsesWebsocketClose> {
+    let Message::Close(frame) = message else {
+        return None;
+    };
+    frame.map(close_frame_to_probe)
+}
+
+fn close_frame_to_probe(frame: CloseFrame) -> ResponsesWebsocketClose {
+    ResponsesWebsocketClose {
+        code: frame.code.to_string(),
+        reason: frame.reason.to_string(),
+    }
 }
 
 fn merge_request_headers(
@@ -385,7 +472,7 @@ async fn connect_websocket(
     url: Url,
     headers: HeaderMap,
     turn_state: Option<Arc<OnceLock<String>>>,
-) -> Result<(WsStream, bool, Option<String>, Option<String>), ApiError> {
+) -> Result<(WsStream, StatusCode, bool, Option<String>, Option<String>), ApiError> {
     ensure_rustls_crypto_provider();
     info!("connecting to websocket: {url}");
 
@@ -445,6 +532,7 @@ async fn connect_websocket(
     }
     Ok((
         WsStream::new(stream),
+        response.status(),
         reasoning_included,
         models_etag,
         server_model,
diff --git a/codex-rs/codex-api/src/lib.rs b/codex-rs/codex-api/src/lib.rs
index d7017c8d3f..99470cac59 100644
--- a/codex-rs/codex-api/src/lib.rs
+++ b/codex-rs/codex-api/src/lib.rs
@@ -55,7 +55,9 @@ pub use crate::endpoint::RealtimeWebsocketWriter;
 pub use crate::endpoint::ResponsesClient;
 pub use crate::endpoint::ResponsesOptions;
 pub use crate::endpoint::ResponsesWebsocketClient;
+pub use crate::endpoint::ResponsesWebsocketClose;
 pub use crate::endpoint::ResponsesWebsocketConnection;
+pub use crate::endpoint::ResponsesWebsocketProbe;
 pub use crate::endpoint::session_update_session_json;
 pub use crate::error::ApiError;
 pub use crate::files::upload_local_file;
diff --git a/codex-rs/codex-api/src/requests/headers.rs b/codex-rs/codex-api/src/requests/headers.rs
index ed5a5ad647..c5cede8ac6 100644
--- a/codex-rs/codex-api/src/requests/headers.rs
+++ b/codex-rs/codex-api/src/requests/headers.rs
@@ -5,11 +5,9 @@ use http::HeaderValue;
 pub fn build_session_headers(session_id: Option<String>, thread_id: Option<String>) -> HeaderMap {
     let mut headers = HeaderMap::new();
     if let Some(id) = session_id {
-        insert_header(&mut headers, "session_id", &id);
         insert_header(&mut headers, "session-id", &id);
     }
     if let Some(id) = thread_id {
-        insert_header(&mut headers, "thread_id", &id);
         insert_header(&mut headers, "thread-id", &id);
     }
     headers
diff --git a/codex-rs/codex-api/tests/clients.rs b/codex-rs/codex-api/tests/clients.rs
index a78073b302..afaf82389f 100644
--- a/codex-rs/codex-api/tests/clients.rs
+++ b/codex-rs/codex-api/tests/clients.rs
@@ -458,18 +458,10 @@ async fn azure_default_store_attaches_ids_and_headers() -> Result<()> {
     assert_eq!(requests.len(), 1);
     let req = &requests[0];
 
-    assert_eq!(
-        req.headers.get("session_id").and_then(|v| v.to_str().ok()),
-        Some("sess_123")
-    );
     assert_eq!(
         req.headers.get("session-id").and_then(|v| v.to_str().ok()),
         Some("sess_123")
     );
-    assert_eq!(
-        req.headers.get("thread_id").and_then(|v| v.to_str().ok()),
-        Some("thread_123")
-    );
     assert_eq!(
         req.headers.get("thread-id").and_then(|v| v.to_str().ok()),
         Some("thread_123")
diff --git a/codex-rs/codex-mcp/src/connection_manager.rs b/codex-rs/codex-mcp/src/connection_manager.rs
index c5593a5598..8144f5b227 100644
--- a/codex-rs/codex-mcp/src/connection_manager.rs
+++ b/codex-rs/codex-mcp/src/connection_manager.rs
@@ -71,6 +71,7 @@ use tracing::warn;
 pub struct McpConnectionManager {
     clients: HashMap<String, AsyncManagedClient>,
     server_metadata: HashMap<String, McpServerMetadata>,
+    tool_plugin_provenance: Arc<ToolPluginProvenance>,
     host_owned_codex_apps_enabled: bool,
     elicitation_requests: ElicitationRequestManager,
     startup_cancellation_token: CancellationToken,
@@ -80,14 +81,22 @@ impl McpConnectionManager {
     pub fn new_uninitialized(
         approval_policy: &Constrained<AskForApproval>,
         permission_profile: &Constrained<PermissionProfile>,
+    ) -> Self {
+        Self::new_uninitialized_with_permission_profile(approval_policy, permission_profile.get())
+    }
+
+    pub fn new_uninitialized_with_permission_profile(
+        approval_policy: &Constrained<AskForApproval>,
+        permission_profile: &PermissionProfile,
     ) -> Self {
         Self {
             clients: HashMap::new(),
             server_metadata: HashMap::new(),
+            tool_plugin_provenance: Arc::new(ToolPluginProvenance::default()),
             host_owned_codex_apps_enabled: false,
             elicitation_requests: ElicitationRequestManager::new(
                 approval_policy.value(),
-                permission_profile.get().clone(),
+                permission_profile.clone(),
                 /*reviewer*/ None,
             ),
             startup_cancellation_token: CancellationToken::new(),
@@ -129,6 +138,11 @@ impl McpConnectionManager {
             .is_none_or(|metadata| metadata.pollutes_memory)
     }
 
+    pub fn plugin_id_for_mcp_server_name(&self, server_name: &str) -> Option<&str> {
+        self.tool_plugin_provenance
+            .plugin_id_for_mcp_server_name(server_name)
+    }
+
     pub fn is_host_owned_codex_apps_server(&self, server_name: &str) -> bool {
         self.host_owned_codex_apps_enabled && server_name == CODEX_APPS_MCP_SERVER_NAME
     }
@@ -276,6 +290,7 @@ impl McpConnectionManager {
         let manager = Self {
             clients,
             server_metadata,
+            tool_plugin_provenance,
             host_owned_codex_apps_enabled,
             elicitation_requests: elicitation_requests.clone(),
             startup_cancellation_token: cancel_token.clone(),
diff --git a/codex-rs/codex-mcp/src/connection_manager_tests.rs b/codex-rs/codex-mcp/src/connection_manager_tests.rs
index 5d04dc2a36..952bc8207b 100644
--- a/codex-rs/codex-mcp/src/connection_manager_tests.rs
+++ b/codex-rs/codex-mcp/src/connection_manager_tests.rs
@@ -596,8 +596,8 @@ fn codex_apps_tools_cache_filters_disallowed_connectors() {
         create_test_tool_with_connector(
             CODEX_APPS_MCP_SERVER_NAME,
             "blocked_tool",
-            "connector_openai_hidden",
-            Some("Hidden"),
+            "connector_2b0a9009c9c64bf9933a3dae3f2b1254",
+            Some("Blocked"),
         ),
         create_test_tool_with_connector(
             CODEX_APPS_MCP_SERVER_NAME,
@@ -847,6 +847,112 @@ async fn list_all_tools_adds_server_metadata_to_cached_tools() {
     assert_eq!(tool.server_origin.as_deref(), Some("https://docs.example"));
 }
 
+#[tokio::test]
+async fn no_local_runtime_fails_local_stdio_but_keeps_local_http_server() {
+    let approval_policy = Constrained::allow_any(AskForApproval::OnFailure);
+    let (tx_event, rx_event) = async_channel::unbounded();
+    drop(rx_event);
+    let codex_home = tempdir().expect("tempdir");
+    let mcp_servers = HashMap::from([
+        (
+            "stdio".to_string(),
+            EffectiveMcpServer::configured(McpServerConfig {
+                transport: McpServerTransportConfig::Stdio {
+                    command: "echo".to_string(),
+                    args: Vec::new(),
+                    env: None,
+                    env_vars: Vec::new(),
+                    cwd: None,
+                },
+                experimental_environment: None,
+                enabled: true,
+                required: false,
+                supports_parallel_tool_calls: false,
+                disabled_reason: None,
+                startup_timeout_sec: None,
+                tool_timeout_sec: None,
+                default_tools_approval_mode: None,
+                enabled_tools: None,
+                disabled_tools: None,
+                scopes: None,
+                oauth: None,
+                oauth_resource: None,
+                tools: HashMap::new(),
+            }),
+        ),
+        (
+            "http".to_string(),
+            EffectiveMcpServer::configured(McpServerConfig {
+                transport: McpServerTransportConfig::StreamableHttp {
+                    url: "http://127.0.0.1:1".to_string(),
+                    bearer_token_env_var: None,
+                    http_headers: None,
+                    env_http_headers: None,
+                },
+                experimental_environment: None,
+                enabled: true,
+                required: false,
+                supports_parallel_tool_calls: false,
+                disabled_reason: None,
+                startup_timeout_sec: None,
+                tool_timeout_sec: None,
+                default_tools_approval_mode: None,
+                enabled_tools: None,
+                disabled_tools: None,
+                scopes: None,
+                oauth: None,
+                oauth_resource: None,
+                tools: HashMap::new(),
+            }),
+        ),
+    ]);
+
+    let (manager, cancel_token) = McpConnectionManager::new(
+        &mcp_servers,
+        OAuthCredentialsStoreMode::default(),
+        HashMap::new(),
+        &approval_policy,
+        String::new(),
+        tx_event,
+        PermissionProfile::default(),
+        McpRuntimeEnvironment::new(
+            /*environment*/ None,
+            /*local_environment*/ None,
+            PathBuf::from("/tmp"),
+        ),
+        codex_home.path().to_path_buf(),
+        CodexAppsToolsCacheKey {
+            account_id: None,
+            chatgpt_user_id: None,
+            is_workspace_account: false,
+        },
+        /*host_owned_codex_apps_enabled*/ false,
+        ElicitationCapability::default(),
+        ToolPluginProvenance::default(),
+        /*auth*/ None,
+        /*elicitation_reviewer*/ None,
+    )
+    .await;
+
+    assert!(manager.clients.contains_key("stdio"));
+    assert!(manager.clients.contains_key("http"));
+    assert!(
+        !manager
+            .wait_for_server_ready("stdio", Duration::from_millis(10))
+            .await
+    );
+    let failures = manager
+        .required_startup_failures(&["stdio".to_string()])
+        .await;
+    assert_eq!(failures.len(), 1);
+    assert_eq!(failures[0].server, "stdio");
+    assert_eq!(
+        failures[0].error,
+        "local stdio MCP server `stdio` requires a local environment"
+    );
+    cancel_token.cancel();
+}
+
 #[test]
 fn elicitation_capability_uses_2025_06_18_shape_for_form_only_support() {
     let capability = Some(ElicitationCapability::default());
@@ -893,6 +999,7 @@ fn mcp_init_error_display_prompts_for_github_pat() {
             enabled_tools: None,
             disabled_tools: None,
             scopes: None,
+            oauth: None,
             oauth_resource: None,
             tools: HashMap::new(),
         }),
@@ -945,6 +1052,7 @@ fn mcp_init_error_display_reports_generic_errors() {
             enabled_tools: None,
             disabled_tools: None,
             scopes: None,
+            oauth: None,
             oauth_resource: None,
             tools: HashMap::new(),
         }),
diff --git a/codex-rs/codex-mcp/src/mcp/mod.rs b/codex-rs/codex-mcp/src/mcp/mod.rs
index b8fb9a080c..3d1969de0c 100644
--- a/codex-rs/codex-mcp/src/mcp/mod.rs
+++ b/codex-rs/codex-mcp/src/mcp/mod.rs
@@ -109,6 +109,8 @@ pub struct McpConfig {
     pub chatgpt_base_url: String,
     /// Optional path override for the host-owned apps MCP server.
     pub apps_mcp_path_override: Option<String>,
+    /// Optional product SKU forwarded to the host-owned apps MCP server.
+    pub apps_mcp_product_sku: Option<String>,
     /// Codex home directory used for MCP OAuth state and app-tool cache files.
     pub codex_home: PathBuf,
     /// Preferred credential store for MCP OAuth tokens.
@@ -136,6 +138,8 @@ pub struct McpConfig {
     ///
     /// Runtime-only additions are merged later by [`effective_mcp_servers`].
     pub configured_mcp_servers: HashMap<String, McpServerConfig>,
+    /// Winning plugin owner for plugin-provided MCP servers, keyed by server name.
+    pub plugin_ids_by_mcp_server_name: HashMap<String, String>,
     /// Plugin metadata used to attribute MCP tools/connectors to plugin display names.
     pub plugin_capability_summaries: Vec<PluginCapabilitySummary>,
 }
@@ -144,6 +148,7 @@ pub struct McpConfig {
 pub struct ToolPluginProvenance {
     plugin_display_names_by_connector_id: HashMap<String, Vec<String>>,
     plugin_display_names_by_mcp_server_name: HashMap<String, Vec<String>>,
+    plugin_ids_by_mcp_server_name: HashMap<String, String>,
 }
 
 impl ToolPluginProvenance {
@@ -161,9 +166,15 @@ impl ToolPluginProvenance {
             .unwrap_or(&[])
     }
 
-    fn from_capability_summaries(capability_summaries: &[PluginCapabilitySummary]) -> Self {
+    pub fn plugin_id_for_mcp_server_name(&self, server_name: &str) -> Option<&str> {
+        self.plugin_ids_by_mcp_server_name
+            .get(server_name)
+            .map(String::as_str)
+    }
+
+    fn from_config(config: &McpConfig) -> Self {
         let mut tool_plugin_provenance = Self::default();
-        for plugin in capability_summaries {
+        for plugin in &config.plugin_capability_summaries {
             for connector_id in &plugin.app_connector_ids {
                 tool_plugin_provenance
                     .plugin_display_names_by_connector_id
@@ -193,6 +204,8 @@ impl ToolPluginProvenance {
             plugin_names.sort_unstable();
             plugin_names.dedup();
         }
+        tool_plugin_provenance.plugin_ids_by_mcp_server_name =
+            config.plugin_ids_by_mcp_server_name.clone();
 
         tool_plugin_provenance
     }
@@ -242,7 +255,7 @@ pub fn effective_mcp_servers_from_configured(
 }
 
 pub fn tool_plugin_provenance(config: &McpConfig) -> ToolPluginProvenance {
-    ToolPluginProvenance::from_capability_summaries(&config.plugin_capability_summaries)
+    ToolPluginProvenance::from_config(config)
 }
 
 pub async fn read_mcp_resource(
@@ -427,12 +440,15 @@ fn codex_apps_mcp_url_for_base_url(base_url: &str, apps_mcp_path_override: Optio
 
 fn codex_apps_mcp_server_config(config: &McpConfig) -> McpServerConfig {
     let url = codex_apps_mcp_url(config);
+    let http_headers = config.apps_mcp_product_sku.as_ref().map(|product_sku| {
+        HashMap::from([("X-OpenAI-Product-Sku".to_string(), product_sku.clone())])
+    });
 
     McpServerConfig {
         transport: McpServerTransportConfig::StreamableHttp {
             url,
             bearer_token_env_var: codex_apps_mcp_bearer_token_env_var(),
-            http_headers: None,
+            http_headers,
             env_http_headers: None,
         },
         experimental_environment: None,
@@ -446,6 +462,7 @@ fn codex_apps_mcp_server_config(config: &McpConfig) -> McpServerConfig {
         enabled_tools: None,
         disabled_tools: None,
         scopes: None,
+        oauth: None,
         oauth_resource: None,
         tools: HashMap::new(),
     }
diff --git a/codex-rs/codex-mcp/src/mcp/mod_tests.rs b/codex-rs/codex-mcp/src/mcp/mod_tests.rs
index 0d0afc6c48..7566bf9bde 100644
--- a/codex-rs/codex-mcp/src/mcp/mod_tests.rs
+++ b/codex-rs/codex-mcp/src/mcp/mod_tests.rs
@@ -18,6 +18,7 @@ fn test_mcp_config(codex_home: PathBuf) -> McpConfig {
     McpConfig {
         chatgpt_base_url: "https://chatgpt.com".to_string(),
         apps_mcp_path_override: None,
+        apps_mcp_product_sku: None,
         codex_home,
         mcp_oauth_credentials_store_mode: OAuthCredentialsStoreMode::default(),
         mcp_oauth_callback_port: None,
@@ -29,6 +30,7 @@ fn test_mcp_config(codex_home: PathBuf) -> McpConfig {
         apps_enabled: false,
         client_elicitation_capability: ElicitationCapability::default(),
         configured_mcp_servers: HashMap::new(),
+        plugin_ids_by_mcp_server_name: HashMap::new(),
         plugin_capability_summaries: Vec::new(),
     }
 }
@@ -123,7 +125,10 @@ fn mcp_prompt_auto_approval_rejects_auto_mode_in_default_permission_mode() {
 
 #[test]
 fn tool_plugin_provenance_collects_app_and_mcp_sources() {
-    let provenance = ToolPluginProvenance::from_capability_summaries(&[
+    let mut config = test_mcp_config(PathBuf::new());
+    config.plugin_ids_by_mcp_server_name =
+        HashMap::from([("alpha".to_string(), "alpha@test".to_string())]);
+    config.plugin_capability_summaries = vec![
         PluginCapabilitySummary {
             display_name: "alpha-plugin".to_string(),
             app_connector_ids: vec![AppConnectorId("connector_example".to_string())],
@@ -139,7 +144,8 @@ fn tool_plugin_provenance_collects_app_and_mcp_sources() {
             mcp_server_names: vec!["beta".to_string()],
             ..PluginCapabilitySummary::default()
         },
-    ]);
+    ];
+    let provenance = tool_plugin_provenance(&config);
 
     assert_eq!(
         provenance,
@@ -158,8 +164,17 @@ fn tool_plugin_provenance_collects_app_and_mcp_sources() {
                 ("alpha".to_string(), vec!["alpha-plugin".to_string()]),
                 ("beta".to_string(), vec!["beta-plugin".to_string()]),
             ]),
+            plugin_ids_by_mcp_server_name: HashMap::from([(
+                "alpha".to_string(),
+                "alpha@test".to_string(),
+            )]),
         }
     );
+    assert_eq!(
+        provenance.plugin_id_for_mcp_server_name("alpha"),
+        Some("alpha@test")
+    );
+    assert_eq!(provenance.plugin_id_for_mcp_server_name("beta"), None);
 }
 
 #[test]
@@ -251,6 +266,40 @@ fn codex_apps_server_config_uses_configured_apps_mcp_path_override() {
     assert_eq!(url, "https://chatgpt.com/backend-api/custom/mcp");
 }
 
+#[test]
+fn codex_apps_server_config_forwards_configured_product_sku_header() {
+    let mut config = test_mcp_config(PathBuf::from("/tmp"));
+    config.apps_mcp_product_sku = Some("tpp".to_string());
+    config.apps_enabled = true;
+    let auth = CodexAuth::create_dummy_chatgpt_auth_for_testing();
+
+    let servers = with_codex_apps_mcp(HashMap::new(), Some(&auth), &config);
+    let server = servers
+        .get(CODEX_APPS_MCP_SERVER_NAME)
+        .expect("codex apps should be present when apps is enabled");
+    let config = server
+        .configured_config()
+        .expect("codex apps should use configured transport");
+
+    match &config.transport {
+        McpServerTransportConfig::StreamableHttp {
+            http_headers,
+            env_http_headers,
+            ..
+        } => {
+            assert_eq!(
+                http_headers,
+                &Some(HashMap::from([(
+                    "X-OpenAI-Product-Sku".to_string(),
+                    "tpp".to_string(),
+                )]))
+            );
+            assert!(env_http_headers.is_none());
+        }
+        other => panic!("expected streamable http transport, got {other:?}"),
+    }
+}
+
 #[tokio::test]
 async fn effective_mcp_servers_preserve_user_servers_and_add_codex_apps() {
     let codex_home = tempfile::tempdir().expect("tempdir");
@@ -278,6 +327,7 @@ async fn effective_mcp_servers_preserve_user_servers_and_add_codex_apps() {
             enabled_tools: None,
             disabled_tools: None,
             scopes: None,
+            oauth: None,
             oauth_resource: None,
             tools: HashMap::new(),
         },
@@ -302,6 +352,7 @@ async fn effective_mcp_servers_preserve_user_servers_and_add_codex_apps() {
             enabled_tools: None,
             disabled_tools: None,
             scopes: None,
+            oauth: None,
             oauth_resource: None,
             tools: HashMap::new(),
         },
diff --git a/codex-rs/codex-mcp/src/rmcp_client.rs b/codex-rs/codex-mcp/src/rmcp_client.rs
index fcc9d1c86e..687576dfac 100644
--- a/codex-rs/codex-mcp/src/rmcp_client.rs
+++ b/codex-rs/codex-mcp/src/rmcp_client.rs
@@ -566,6 +566,9 @@ async fn make_rmcp_client(
     let config = match server.launch() {
         McpServerLaunch::Configured(config) => config.as_ref().clone(),
     };
+    if let Some(reason) = runtime_environment.startup_unavailable_reason(server_name, &config) {
+        return Err(StartupOutcomeError::from(anyhow!(reason)));
+    }
     let McpServerConfig {
         transport,
         experimental_environment,
@@ -573,14 +576,7 @@ async fn make_rmcp_client(
     } = config;
     let remote_environment = match experimental_environment.as_deref() {
         None | Some("local") => false,
-        Some("remote") => {
-            if !runtime_environment.environment().is_remote() {
-                return Err(StartupOutcomeError::from(anyhow!(
-                    "remote MCP server `{server_name}` requires a remote environment"
-                )));
-            }
-            true
-        }
+        Some("remote") => true,
         Some(environment) => {
             return Err(StartupOutcomeError::from(anyhow!(
                 "unsupported experimental_environment `{environment}` for MCP server `{server_name}`"
@@ -604,8 +600,15 @@ async fn make_rmcp_client(
                     .collect::<HashMap<_, _>>()
             });
             let launcher = if remote_environment {
+                // Preflight should reject this first, but keep client startup
+                // defensive if optional runtime placement is mis-threaded.
+                let Some(environment) = runtime_environment.environment() else {
+                    return Err(StartupOutcomeError::from(anyhow!(
+                        "remote MCP server requires a runtime environment"
+                    )));
+                };
                 Arc::new(ExecutorStdioServerLauncher::new(
-                    runtime_environment.environment().get_exec_backend(),
+                    environment.get_exec_backend(),
                     runtime_environment.fallback_cwd(),
                 ))
             } else {
@@ -628,7 +631,12 @@ async fn make_rmcp_client(
             bearer_token_env_var,
         } => {
             let http_client: Arc<dyn HttpClient> = if remote_environment {
-                runtime_environment.environment().get_http_client()
+                let Some(environment) = runtime_environment.environment() else {
+                    return Err(StartupOutcomeError::from(anyhow!(
+                        "remote MCP server requires a runtime environment"
+                    )));
+                };
+                environment.get_http_client()
             } else {
                 Arc::new(ReqwestHttpClient)
             };
diff --git a/codex-rs/codex-mcp/src/runtime.rs b/codex-rs/codex-mcp/src/runtime.rs
index 4284c96ff6..dc1fcec219 100644
--- a/codex-rs/codex-mcp/src/runtime.rs
+++ b/codex-rs/codex-mcp/src/runtime.rs
@@ -30,33 +30,79 @@ pub struct SandboxState {
 
 /// Runtime placement information used when starting MCP server transports.
 ///
-/// `McpConfig` describes what servers exist. This value describes where those
-/// servers should run for the current caller. Keep it explicit at manager
-/// construction time so status/snapshot paths and real sessions make the same
-/// local-vs-remote decision. `fallback_cwd` is not a per-server override; it is
-/// used when a stdio server omits `cwd` and the launcher needs a concrete
-/// process working directory.
+/// `McpConfig` describes what servers exist. This value describes which
+/// selected/default environment MCP servers should use for the current caller.
+/// Keep it explicit at manager construction time so status/snapshot paths and
+/// real sessions make the same placement decision. `fallback_cwd` is not a
+/// per-server override; it is used when a stdio server omits `cwd` and the
+/// launcher needs a concrete process working directory. `local_environment`
+/// is separate because a remote selected/default environment can coexist with
+/// an explicitly configured local environment that may launch local stdio MCPs.
 #[derive(Clone)]
 pub struct McpRuntimeEnvironment {
-    environment: Arc<Environment>,
+    environment: Option<Arc<Environment>>,
+    local_environment: Option<Arc<Environment>>,
     fallback_cwd: PathBuf,
 }
 
 impl McpRuntimeEnvironment {
-    pub fn new(environment: Arc<Environment>, fallback_cwd: PathBuf) -> Self {
+    pub fn new(
+        environment: Option<Arc<Environment>>,
+        local_environment: Option<Arc<Environment>>,
+        fallback_cwd: PathBuf,
+    ) -> Self {
         Self {
             environment,
+            local_environment,
             fallback_cwd,
         }
     }
 
-    pub(crate) fn environment(&self) -> Arc<Environment> {
-        Arc::clone(&self.environment)
+    pub(crate) fn environment(&self) -> Option<Arc<Environment>> {
+        self.environment.as_ref().map(Arc::clone)
     }
 
     pub(crate) fn fallback_cwd(&self) -> PathBuf {
         self.fallback_cwd.clone()
     }
+
+    pub(crate) fn startup_unavailable_reason(
+        &self,
+        server_name: &str,
+        config: &codex_config::McpServerConfig,
+    ) -> Option<String> {
+        // This is intentionally narrower than "no env means no MCP": local
+        // stdio needs a local process launcher, while local HTTP can still use
+        // the ambient HTTP client with no local environment configured.
+        match config.experimental_environment.as_deref() {
+            None | Some("local") => {
+                // Local stdio only needs an explicitly configured local
+                // launcher. The selected/default MCP environment can be remote
+                // when both local and remote environments are configured.
+                if self.local_environment.is_none()
+                    && matches!(
+                        config.transport,
+                        codex_config::McpServerTransportConfig::Stdio { .. }
+                    )
+                {
+                    Some(format!(
+                        "local stdio MCP server `{server_name}` requires a local environment"
+                    ))
+                } else {
+                    None
+                }
+            }
+            Some("remote") => match self.environment.as_ref() {
+                Some(environment) if environment.is_remote() => None,
+                _ => Some(format!(
+                    "remote MCP server `{server_name}` requires a remote environment"
+                )),
+            },
+            Some(environment) => Some(format!(
+                "unsupported experimental_environment `{environment}` for MCP server `{server_name}`"
+            )),
+        }
+    }
 }
 
 pub(crate) fn emit_duration(metric: &str, duration: Duration, tags: &[(&str, &str)]) {
@@ -64,3 +110,156 @@ pub(crate) fn emit_duration(metric: &str, duration: Duration, tags: &[(&str, &st
         let _ = metrics.record_duration(metric, duration, tags);
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use std::collections::HashMap;
+
+    use codex_config::McpServerConfig;
+    use codex_config::McpServerTransportConfig;
+    use pretty_assertions::assert_eq;
+
+    use super::*;
+
+    fn stdio_server(experimental_environment: Option<&str>) -> McpServerConfig {
+        McpServerConfig {
+            transport: McpServerTransportConfig::Stdio {
+                command: "echo".to_string(),
+                args: Vec::new(),
+                env: None,
+                env_vars: Vec::new(),
+                cwd: None,
+            },
+            experimental_environment: experimental_environment.map(str::to_string),
+            enabled: true,
+            required: false,
+            supports_parallel_tool_calls: false,
+            disabled_reason: None,
+            startup_timeout_sec: None,
+            tool_timeout_sec: None,
+            default_tools_approval_mode: None,
+            enabled_tools: None,
+            disabled_tools: None,
+            scopes: None,
+            oauth: None,
+            oauth_resource: None,
+            tools: HashMap::new(),
+        }
+    }
+
+    fn http_server(experimental_environment: Option<&str>) -> McpServerConfig {
+        McpServerConfig {
+            transport: McpServerTransportConfig::StreamableHttp {
+                url: "http://127.0.0.1:1".to_string(),
+                bearer_token_env_var: None,
+                http_headers: None,
+                env_http_headers: None,
+            },
+            experimental_environment: experimental_environment.map(str::to_string),
+            ..stdio_server(/*experimental_environment*/ None)
+        }
+    }
+
+    #[test]
+    fn local_stdio_requires_local_stdio_availability() {
+        let runtime_environment = McpRuntimeEnvironment::new(
+            /*environment*/ None,
+            /*local_environment*/ None,
+            PathBuf::from("/tmp"),
+        );
+
+        assert_eq!(
+            runtime_environment.startup_unavailable_reason(
+                "stdio",
+                &stdio_server(/*experimental_environment*/ None)
+            ),
+            Some("local stdio MCP server `stdio` requires a local environment".to_string())
+        );
+    }
+
+    #[test]
+    fn local_http_does_not_require_local_stdio_availability() {
+        let runtime_environment = McpRuntimeEnvironment::new(
+            /*environment*/ None,
+            /*local_environment*/ None,
+            PathBuf::from("/tmp"),
+        );
+
+        assert_eq!(
+            runtime_environment.startup_unavailable_reason(
+                "http",
+                &http_server(/*experimental_environment*/ None)
+            ),
+            None
+        );
+    }
+
+    #[test]
+    fn remote_stdio_requires_remote_environment() {
+        let runtime_environment = McpRuntimeEnvironment::new(
+            /*environment*/ None,
+            /*local_environment*/ None,
+            PathBuf::from("/tmp"),
+        );
+
+        assert_eq!(
+            runtime_environment.startup_unavailable_reason(
+                "stdio",
+                &stdio_server(/*experimental_environment*/ Some("remote")),
+            ),
+            Some("remote MCP server `stdio` requires a remote environment".to_string())
+        );
+    }
+
+    #[test]
+    fn remote_stdio_and_http_accept_remote_environment() {
+        let environment = Arc::new(
+            Environment::create_for_tests(Some("ws://127.0.0.1:8765".to_string()))
+                .expect("remote environment"),
+        );
+        let runtime_environment = McpRuntimeEnvironment::new(
+            Some(environment),
+            /*local_environment*/ None,
+            PathBuf::from("/tmp"),
+        );
+
+        assert_eq!(
+            runtime_environment.startup_unavailable_reason(
+                "stdio",
+                &stdio_server(/*experimental_environment*/ Some("remote")),
+            ),
+            None
+        );
+        assert_eq!(
+            runtime_environment.startup_unavailable_reason(
+                "http",
+                &http_server(/*experimental_environment*/ Some("remote")),
+            ),
+            None
+        );
+    }
+
+    #[tokio::test]
+    async fn local_stdio_accepts_remote_runtime_when_local_environment_exists() {
+        let remote_environment = Arc::new(
+            Environment::create_for_tests(Some("ws://127.0.0.1:8765".to_string()))
+                .expect("remote environment"),
+        );
+        let local_environment = Arc::new(
+            Environment::create_for_tests(/*exec_server_url*/ None).expect("local environment"),
+        );
+        let runtime_environment = McpRuntimeEnvironment::new(
+            Some(remote_environment),
+            Some(local_environment),
+            PathBuf::from("/tmp"),
+        );
+
+        assert_eq!(
+            runtime_environment.startup_unavailable_reason(
+                "stdio",
+                &stdio_server(/*experimental_environment*/ None),
+            ),
+            None
+        );
+    }
+}
diff --git a/codex-rs/config/Cargo.toml b/codex-rs/config/Cargo.toml
index 9583a57c62..c345f31c6e 100644
--- a/codex-rs/config/Cargo.toml
+++ b/codex-rs/config/Cargo.toml
@@ -32,6 +32,7 @@ multimap = { workspace = true }
 prost = "0.14.3"
 schemars = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
+serde_ignored = { workspace = true }
 serde_json = { workspace = true }
 serde_path_to_error = { workspace = true }
 sha2 = { workspace = true }
diff --git a/codex-rs/config/src/config_requirements.rs b/codex-rs/config/src/config_requirements.rs
index 9faa846137..4e4336a2b5 100644
--- a/codex-rs/config/src/config_requirements.rs
+++ b/codex-rs/config/src/config_requirements.rs
@@ -1255,8 +1255,7 @@ mod tests {
     use codex_execpolicy::Decision;
     use codex_execpolicy::Evaluation;
     use codex_execpolicy::RuleMatch;
-    use codex_protocol::protocol::NetworkAccess;
-    use codex_protocol::protocol::SandboxPolicy;
+    use codex_protocol::permissions::NetworkSandboxPolicy;
     use codex_utils_absolute_path::AbsolutePathBuf;
     use codex_utils_absolute_path::AbsolutePathBufGuard;
     use pretty_assertions::assert_eq;
@@ -1272,10 +1271,6 @@ mod tests {
         )?)
     }
 
-    fn profile_from_sandbox_policy(sandbox_policy: &SandboxPolicy) -> PermissionProfile {
-        PermissionProfile::from_legacy_sandbox_policy(sandbox_policy)
-    }
-
     fn with_unknown_source(toml: ConfigRequirementsToml) -> ConfigRequirementsWithSources {
         let ConfigRequirementsToml {
             allowed_approval_policies,
@@ -1963,9 +1958,7 @@ allowed_approvals_reviewers = ["user"]
         assert_eq!(
             requirements
                 .permission_profile
-                .can_set(&profile_from_sandbox_policy(
-                    &SandboxPolicy::DangerFullAccess,
-                )),
+                .can_set(&PermissionProfile::Disabled),
             Err(ConstraintError::InvalidValue {
                 field_name: "sandbox_mode",
                 candidate: "DangerFullAccess".into(),
@@ -2110,9 +2103,7 @@ allowed_approvals_reviewers = ["user"]
         assert!(
             requirements
                 .permission_profile
-                .can_set(&profile_from_sandbox_policy(
-                    &SandboxPolicy::new_read_only_policy()
-                ))
+                .can_set(&PermissionProfile::read_only())
                 .is_ok()
         );
 
@@ -2195,29 +2186,25 @@ allowed_approvals_reviewers = ["user"]
         assert!(
             requirements
                 .permission_profile
-                .can_set(&profile_from_sandbox_policy(
-                    &SandboxPolicy::new_read_only_policy()
-                ))
+                .can_set(&PermissionProfile::read_only())
                 .is_ok()
         );
-        let workspace_write_policy = SandboxPolicy::WorkspaceWrite {
-            writable_roots: vec![AbsolutePathBuf::from_absolute_path(root)?],
-            network_access: false,
-            exclude_tmpdir_env_var: false,
-            exclude_slash_tmp: false,
-        };
+        let workspace_write_profile = PermissionProfile::workspace_write_with(
+            &[AbsolutePathBuf::from_absolute_path(root)?],
+            NetworkSandboxPolicy::Restricted,
+            /*exclude_tmpdir_env_var*/ false,
+            /*exclude_slash_tmp*/ false,
+        );
         assert!(
             requirements
                 .permission_profile
-                .can_set(&profile_from_sandbox_policy(&workspace_write_policy))
+                .can_set(&workspace_write_profile)
                 .is_ok()
         );
         assert_eq!(
             requirements
                 .permission_profile
-                .can_set(&profile_from_sandbox_policy(
-                    &SandboxPolicy::DangerFullAccess,
-                )),
+                .can_set(&PermissionProfile::Disabled),
             Err(ConstraintError::InvalidValue {
                 field_name: "sandbox_mode",
                 candidate: "DangerFullAccess".into(),
@@ -2228,11 +2215,9 @@ allowed_approvals_reviewers = ["user"]
         assert_eq!(
             requirements
                 .permission_profile
-                .can_set(&profile_from_sandbox_policy(
-                    &SandboxPolicy::ExternalSandbox {
-                        network_access: NetworkAccess::Restricted,
-                    }
-                )),
+                .can_set(&PermissionProfile::External {
+                    network: NetworkSandboxPolicy::Restricted,
+                }),
             Err(ConstraintError::InvalidValue {
                 field_name: "sandbox_mode",
                 candidate: "ExternalSandbox".into(),
@@ -2313,24 +2298,22 @@ allowed_approvals_reviewers = ["user"]
 
         let requirements = ConfigRequirements::try_from(requirements_with_sources)?;
         let root = if cfg!(windows) { "C:\\repo" } else { "/repo" };
-        let workspace_write_policy = SandboxPolicy::WorkspaceWrite {
-            writable_roots: vec![AbsolutePathBuf::from_absolute_path(root)?],
-            network_access: false,
-            exclude_tmpdir_env_var: false,
-            exclude_slash_tmp: false,
-        };
+        let workspace_write_profile = PermissionProfile::workspace_write_with(
+            &[AbsolutePathBuf::from_absolute_path(root)?],
+            NetworkSandboxPolicy::Restricted,
+            /*exclude_tmpdir_env_var*/ false,
+            /*exclude_slash_tmp*/ false,
+        );
         assert!(
             requirements
                 .permission_profile
-                .can_set(&profile_from_sandbox_policy(&workspace_write_policy))
+                .can_set(&workspace_write_profile)
                 .is_ok()
         );
         assert_eq!(
             requirements
                 .permission_profile
-                .can_set(&profile_from_sandbox_policy(
-                    &SandboxPolicy::DangerFullAccess,
-                )),
+                .can_set(&PermissionProfile::Disabled),
             Err(ConstraintError::InvalidValue {
                 field_name: "sandbox_mode",
                 candidate: "DangerFullAccess".into(),
@@ -2361,9 +2344,7 @@ allowed_approvals_reviewers = ["user"]
         assert_eq!(
             requirements
                 .permission_profile
-                .can_set(&profile_from_sandbox_policy(
-                    &SandboxPolicy::DangerFullAccess,
-                )),
+                .can_set(&PermissionProfile::Disabled),
             Err(ConstraintError::InvalidValue {
                 field_name: "sandbox_mode",
                 candidate: "DangerFullAccess".into(),
@@ -2402,9 +2383,7 @@ allowed_approvals_reviewers = ["user"]
         assert_eq!(
             requirements
                 .permission_profile
-                .can_set(&profile_from_sandbox_policy(
-                    &SandboxPolicy::new_workspace_write_policy(),
-                )),
+                .can_set(&PermissionProfile::workspace_write()),
             Err(ConstraintError::InvalidValue {
                 field_name: "sandbox_mode",
                 candidate: "WorkspaceWrite".into(),
diff --git a/codex-rs/config/src/config_toml.rs b/codex-rs/config/src/config_toml.rs
index 06993e046a..43f75ffc28 100644
--- a/codex-rs/config/src/config_toml.rs
+++ b/codex-rs/config/src/config_toml.rs
@@ -27,6 +27,7 @@ use crate::types::ToolSuggestConfig;
 use crate::types::Tui;
 use crate::types::UriBasedFileOpener;
 use crate::types::WindowsToml;
+use codex_app_server_protocol::ForcedChatgptWorkspaceIds as ApiForcedChatgptWorkspaceIds;
 use codex_app_server_protocol::Tools;
 use codex_app_server_protocol::UserSavedConfig;
 use codex_features::FeaturesToml;
@@ -37,6 +38,7 @@ use codex_model_provider_info::ModelProviderInfo;
 use codex_model_provider_info::OLLAMA_CHAT_PROVIDER_REMOVED_ERROR;
 use codex_model_provider_info::OLLAMA_OSS_PROVIDER_ID;
 use codex_model_provider_info::OPENAI_PROVIDER_ID;
+use codex_protocol::config_types::AutoCompactTokenLimitScope;
 use codex_protocol::config_types::ForcedLoginMethod;
 use codex_protocol::config_types::Personality;
 use codex_protocol::config_types::ReasoningSummary;
@@ -56,6 +58,8 @@ use schemars::JsonSchema;
 use serde::Deserialize;
 use serde::Deserializer;
 use serde::Serialize;
+use serde::de::Error as SerdeError;
+use serde_json::Value as JsonValue;
 
 const RESERVED_MODEL_PROVIDER_IDS: [&str; 4] = [
     AMAZON_BEDROCK_PROVIDER_ID,
@@ -86,6 +90,55 @@ const fn default_hide_agent_reasoning() -> Option<bool> {
     Some(false)
 }
 
+/// Backward-compatible shape for ChatGPT workspace login restrictions in config.toml.
+#[derive(Serialize, Debug, Clone, PartialEq, JsonSchema)]
+#[serde(untagged)]
+pub enum ForcedChatgptWorkspaceIds {
+    Single(String),
+    Multiple(Vec<String>),
+}
+
+impl ForcedChatgptWorkspaceIds {
+    pub fn into_vec(self) -> Vec<String> {
+        match self {
+            Self::Single(value) => vec![value],
+            Self::Multiple(values) => values,
+        }
+    }
+
+    pub fn into_api(self) -> ApiForcedChatgptWorkspaceIds {
+        match self {
+            Self::Single(value) => ApiForcedChatgptWorkspaceIds::Single(value),
+            Self::Multiple(values) => ApiForcedChatgptWorkspaceIds::Multiple(values),
+        }
+    }
+}
+
+impl<'de> Deserialize<'de> for ForcedChatgptWorkspaceIds {
+    fn deserialize<D>(deserializer: D) -> Result<Self, D::Error>
+    where
+        D: Deserializer<'de>,
+    {
+        #[derive(Deserialize)]
+        #[serde(untagged)]
+        enum Repr {
+            Single(String),
+            Multiple(Vec<String>),
+        }
+
+        match Repr::deserialize(deserializer)? {
+            Repr::Single(value) if value.contains(',') => Err(D::Error::custom(
+                "forced_chatgpt_workspace_id must be a single workspace ID string or a TOML list \
+of strings; comma-separated strings are not supported. Use \
+`forced_chatgpt_workspace_id = [\"123e4567-e89b-42d3-a456-426614174000\", \
+\"123e4567-e89b-42d3-a456-426614174001\"]` instead.",
+            )),
+            Repr::Single(value) => Ok(Self::Single(value)),
+            Repr::Multiple(values) => Ok(Self::Multiple(values)),
+        }
+    }
+}
+
 /// Base config deserialized from ~/.codex/config.toml.
 #[derive(Serialize, Deserialize, Debug, Clone, Default, PartialEq, JsonSchema)]
 #[schemars(deny_unknown_fields)]
@@ -104,6 +157,10 @@ pub struct ConfigToml {
     /// Token usage threshold triggering auto-compaction of conversation history.
     pub model_auto_compact_token_limit: Option<i64>,
 
+    /// Controls whether the auto-compaction limit applies to the full context or
+    /// only to tokens after the carried prefix in the current compaction window.
+    pub model_auto_compact_token_limit_scope: Option<AutoCompactTokenLimitScope>,
+
     /// Default approval policy for executing commands.
     pub approval_policy: Option<AskForApproval>,
 
@@ -177,17 +234,9 @@ pub struct ConfigToml {
     /// Compact prompt used for history compaction.
     pub compact_prompt: Option<String>,
 
-    /// Optional commit attribution text for commit message co-author trailers.
-    /// This top-level setting only takes effect when `[features].codex_git_commit`
-    /// is enabled.
-    ///
-    /// When enabled and unset, Codex uses `Codex <noreply@openai.com>`.
-    /// Set to an empty string to disable automatic commit attribution.
-    pub commit_attribution: Option<String>,
-
-    /// When set, restricts ChatGPT login to a specific workspace identifier.
+    /// When set, restricts ChatGPT login to one or more workspace identifiers.
     #[serde(default)]
-    pub forced_chatgpt_workspace_id: Option<String>,
+    pub forced_chatgpt_workspace_id: Option<ForcedChatgptWorkspaceIds>,
 
     /// When set, restricts the login mechanism users may use.
     #[serde(default)]
@@ -316,6 +365,9 @@ pub struct ConfigToml {
     /// Base URL for requests to ChatGPT (as opposed to the OpenAI API).
     pub chatgpt_base_url: Option<String>,
 
+    /// Optional product SKU forwarded on host-owned Codex Apps MCP requests.
+    pub apps_mcp_product_sku: Option<String>,
+
     /// Base URL override for the built-in `openai` model provider.
     pub openai_base_url: Option<String>,
 
@@ -431,6 +483,10 @@ pub struct ConfigToml {
     #[serde(default)]
     pub apps: Option<AppsConfigToml>,
 
+    /// Opaque desktop settings stored alongside the rest of config.toml.
+    #[serde(default)]
+    pub desktop: Option<HashMap<String, JsonValue>>,
+
     /// OTEL configuration.
     pub otel: Option<OtelConfigToml>,
 
@@ -438,20 +494,12 @@ pub struct ConfigToml {
     #[serde(default)]
     pub windows: Option<WindowsToml>,
 
-    /// Tracks whether the Windows onboarding screen has been acknowledged.
-    pub windows_wsl_setup_acknowledged: Option<bool>,
-
     /// Collection of in-product notices (different from notifications)
     /// See [`crate::types::Notice`] for more details
     pub notice: Option<Notice>,
 
-    /// Legacy, now use features
-    /// Deprecated: ignored. Use `model_instructions_file`.
-    #[schemars(skip)]
-    pub experimental_instructions_file: Option<AbsolutePathBuf>,
     pub experimental_compact_prompt_file: Option<AbsolutePathBuf>,
     pub experimental_use_unified_exec_tool: Option<bool>,
-    pub experimental_use_freeform_apply_patch: Option<bool>,
     /// Preferred OSS provider for local models, e.g. "lmstudio" or "ollama".
     pub oss_provider: Option<String>,
 }
@@ -516,7 +564,9 @@ impl From<ConfigToml> for UserSavedConfig {
             approval_policy: config_toml.approval_policy,
             sandbox_mode: config_toml.sandbox_mode,
             sandbox_settings: config_toml.sandbox_workspace_write.map(From::from),
-            forced_chatgpt_workspace_id: config_toml.forced_chatgpt_workspace_id,
+            forced_chatgpt_workspace_id: config_toml
+                .forced_chatgpt_workspace_id
+                .map(ForcedChatgptWorkspaceIds::into_api),
             forced_login_method: config_toml.forced_login_method,
             model: config_toml.model,
             model_reasoning_effort: config_toml.model_reasoning_effort,
@@ -606,10 +656,6 @@ pub struct ToolsToml {
         deserialize_with = "deserialize_optional_web_search_tool_config"
     )]
     pub web_search: Option<WebSearchToolConfig>,
-
-    /// Enable the `view_image` tool that lets the agent attach local images.
-    #[serde(default)]
-    pub view_image: Option<bool>,
 }
 
 #[derive(Deserialize)]
@@ -687,7 +733,6 @@ impl From<ToolsToml> for Tools {
     fn from(tools_toml: ToolsToml) -> Self {
         Self {
             web_search: tools_toml.web_search.is_some().then_some(true),
-            view_image: tools_toml.view_image,
         }
     }
 }
@@ -964,3 +1009,56 @@ pub fn validate_oss_provider(provider: &str) -> std::io::Result<()> {
         )),
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use pretty_assertions::assert_eq;
+
+    const WORKSPACE_ID_A: &str = "123e4567-e89b-42d3-a456-426614174000";
+    const WORKSPACE_ID_B: &str = "123e4567-e89b-42d3-a456-426614174001";
+
+    #[test]
+    fn forced_chatgpt_workspace_id_accepts_single_string() {
+        let config: ConfigToml = toml::from_str(&format!(
+            r#"forced_chatgpt_workspace_id = "{WORKSPACE_ID_A}""#
+        ))
+        .expect("single workspace id should deserialize");
+
+        assert_eq!(
+            config
+                .forced_chatgpt_workspace_id
+                .expect("workspace id should be set")
+                .into_vec(),
+            vec![WORKSPACE_ID_A.to_string()]
+        );
+    }
+
+    #[test]
+    fn forced_chatgpt_workspace_id_accepts_string_list() {
+        let config: ConfigToml = toml::from_str(&format!(
+            r#"forced_chatgpt_workspace_id = ["{WORKSPACE_ID_A}", "{WORKSPACE_ID_B}"]"#
+        ))
+        .expect("workspace id list should deserialize");
+
+        assert_eq!(
+            config
+                .forced_chatgpt_workspace_id
+                .expect("workspace ids should be set")
+                .into_vec(),
+            vec![WORKSPACE_ID_A.to_string(), WORKSPACE_ID_B.to_string()]
+        );
+    }
+
+    #[test]
+    fn forced_chatgpt_workspace_id_rejects_comma_separated_string() {
+        let err = toml::from_str::<ConfigToml>(&format!(
+            r#"forced_chatgpt_workspace_id = "{WORKSPACE_ID_A},{WORKSPACE_ID_B}""#
+        ))
+        .expect_err("comma-separated string should be rejected");
+
+        let message = err.to_string();
+        assert!(message.contains("TOML list of strings"));
+        assert!(message.contains("comma-separated strings are not supported"));
+    }
+}
diff --git a/codex-rs/config/src/diagnostics.rs b/codex-rs/config/src/diagnostics.rs
index 899114d6d7..3fc593dcdf 100644
--- a/codex-rs/config/src/diagnostics.rs
+++ b/codex-rs/config/src/diagnostics.rs
@@ -86,6 +86,23 @@ impl std::error::Error for ConfigLoadError {
     }
 }
 
+#[derive(Clone, Copy)]
+pub(crate) enum ConfigDiagnosticSource<'a> {
+    Path(&'a Path),
+    #[cfg(any(target_os = "macos", test))]
+    DisplayName(&'a str),
+}
+
+impl ConfigDiagnosticSource<'_> {
+    pub(crate) fn to_path_buf(self) -> PathBuf {
+        match self {
+            ConfigDiagnosticSource::Path(path) => path.to_path_buf(),
+            #[cfg(any(target_os = "macos", test))]
+            ConfigDiagnosticSource::DisplayName(name) => PathBuf::from(name),
+        }
+    }
+}
+
 pub fn io_error_from_config_error(
     kind: io::ErrorKind,
     error: ConfigError,
@@ -98,21 +115,39 @@ pub fn config_error_from_toml(
     path: impl AsRef<Path>,
     contents: &str,
     err: toml::de::Error,
+) -> ConfigError {
+    config_error_from_toml_for_source(ConfigDiagnosticSource::Path(path.as_ref()), contents, err)
+}
+
+pub(crate) fn config_error_from_toml_for_source(
+    source: ConfigDiagnosticSource<'_>,
+    contents: &str,
+    err: toml::de::Error,
 ) -> ConfigError {
     let range = err
         .span()
         .map(|span| text_range_from_span(contents, span))
         .unwrap_or_else(default_range);
-    ConfigError::new(path.as_ref().to_path_buf(), range, err.message())
+    ConfigError::new(source.to_path_buf(), range, err.message())
 }
 
 pub fn config_error_from_typed_toml<T: DeserializeOwned>(
     path: impl AsRef<Path>,
     contents: &str,
+) -> Option<ConfigError> {
+    config_error_from_typed_toml_for_source::<T>(
+        ConfigDiagnosticSource::Path(path.as_ref()),
+        contents,
+    )
+}
+
+fn config_error_from_typed_toml_for_source<T: DeserializeOwned>(
+    source: ConfigDiagnosticSource<'_>,
+    contents: &str,
 ) -> Option<ConfigError> {
     let deserializer = match toml::de::Deserializer::parse(contents) {
         Ok(deserializer) => deserializer,
-        Err(err) => return Some(config_error_from_toml(path, contents, err)),
+        Err(err) => return Some(config_error_from_toml_for_source(source, contents, err)),
     };
 
     let result: Result<T, _> = serde_path_to_error::deserialize(deserializer);
@@ -126,7 +161,7 @@ pub fn config_error_from_typed_toml<T: DeserializeOwned>(
                 .map(|span| text_range_from_span(contents, span))
                 .unwrap_or_else(default_range);
             Some(ConfigError::new(
-                path.as_ref().to_path_buf(),
+                source.to_path_buf(),
                 range,
                 toml_err.message(),
             ))
@@ -194,7 +229,7 @@ where
 fn config_path_for_layer(layer: &ConfigLayerEntry, config_toml_file: &str) -> Option<PathBuf> {
     match &layer.name {
         ConfigLayerSource::System { file } => Some(file.to_path_buf()),
-        ConfigLayerSource::User { file } => Some(file.to_path_buf()),
+        ConfigLayerSource::User { file, .. } => Some(file.to_path_buf()),
         ConfigLayerSource::Project { dot_codex_folder } => {
             Some(dot_codex_folder.as_path().join(config_toml_file))
         }
@@ -205,7 +240,7 @@ fn config_path_for_layer(layer: &ConfigLayerEntry, config_toml_file: &str) -> Op
     }
 }
 
-fn text_range_from_span(contents: &str, span: std::ops::Range<usize>) -> TextRange {
+pub(crate) fn text_range_from_span(contents: &str, span: std::ops::Range<usize>) -> TextRange {
     let start = position_for_offset(contents, span.start);
     let end_index = if span.end > span.start {
         span.end - 1
@@ -290,7 +325,7 @@ fn position_for_offset(contents: &str, index: usize) -> TextPosition {
     }
 }
 
-fn default_range() -> TextRange {
+pub(crate) fn default_range() -> TextRange {
     let position = TextPosition { line: 1, column: 1 };
     TextRange {
         start: position,
@@ -314,7 +349,10 @@ fn span_for_path(contents: &str, path: &SerdePath) -> Option<std::ops::Range<usi
     }
 }
 
-fn span_for_config_path(contents: &str, path: &SerdePath) -> Option<std::ops::Range<usize>> {
+pub(crate) fn span_for_config_path(
+    contents: &str,
+    path: &SerdePath,
+) -> Option<std::ops::Range<usize>> {
     if is_features_table_path(path)
         && let Some(span) = span_for_features_value(contents)
     {
@@ -323,6 +361,48 @@ fn span_for_config_path(contents: &str, path: &SerdePath) -> Option<std::ops::Ra
     span_for_path(contents, path)
 }
 
+pub(crate) fn span_for_toml_key_path(
+    contents: &str,
+    path: &[String],
+) -> Option<std::ops::Range<usize>> {
+    let doc = contents.parse::<Document<String>>().ok()?;
+    let mut node = TomlNode::Item(doc.as_item());
+    for (index, segment) in path.iter().enumerate() {
+        if index + 1 == path.len() {
+            let key_span = match &node {
+                TomlNode::Item(item) => item
+                    .as_table_like()
+                    .and_then(|table| table.get_key_value(segment))
+                    .and_then(|(key, _)| key.span()),
+                TomlNode::Table(table) => {
+                    table.get_key_value(segment).and_then(|(key, _)| key.span())
+                }
+                TomlNode::Value(Value::InlineTable(table)) => {
+                    table.get_key_value(segment).and_then(|(key, _)| key.span())
+                }
+                _ => None,
+            };
+            if key_span.is_some() {
+                return key_span;
+            }
+        }
+
+        if let Some(next) = map_child(&node, segment) {
+            node = next;
+            continue;
+        }
+
+        let index = segment.parse::<usize>().ok()?;
+        node = seq_child(&node, index)?;
+    }
+
+    match node {
+        TomlNode::Item(item) => item.span(),
+        TomlNode::Table(table) => table.span(),
+        TomlNode::Value(value) => value.span(),
+    }
+}
+
 fn is_features_table_path(path: &SerdePath) -> bool {
     let mut segments = path.iter();
     matches!(segments.next(), Some(SerdeSegment::Map { key }) if key == "features")
diff --git a/codex-rs/config/src/hook_config.rs b/codex-rs/config/src/hook_config.rs
index 636b6bfc17..a74543ca47 100644
--- a/codex-rs/config/src/hook_config.rs
+++ b/codex-rs/config/src/hook_config.rs
@@ -46,6 +46,8 @@ pub struct HookEventsToml {
     pub session_start: Vec<MatcherGroup>,
     #[serde(rename = "UserPromptSubmit", default)]
     pub user_prompt_submit: Vec<MatcherGroup>,
+    #[serde(rename = "SubagentStart", default)]
+    pub subagent_start: Vec<MatcherGroup>,
     #[serde(rename = "Stop", default)]
     pub stop: Vec<MatcherGroup>,
 }
@@ -60,6 +62,7 @@ impl HookEventsToml {
             post_compact,
             session_start,
             user_prompt_submit,
+            subagent_start,
             stop,
         } = self;
         pre_tool_use.is_empty()
@@ -69,6 +72,7 @@ impl HookEventsToml {
             && post_compact.is_empty()
             && session_start.is_empty()
             && user_prompt_submit.is_empty()
+            && subagent_start.is_empty()
             && stop.is_empty()
     }
 
@@ -81,6 +85,7 @@ impl HookEventsToml {
             post_compact,
             session_start,
             user_prompt_submit,
+            subagent_start,
             stop,
         } = self;
         [
@@ -91,6 +96,7 @@ impl HookEventsToml {
             post_compact,
             session_start,
             user_prompt_submit,
+            subagent_start,
             stop,
         ]
         .into_iter()
@@ -99,7 +105,7 @@ impl HookEventsToml {
         .sum()
     }
 
-    pub fn into_matcher_groups(self) -> [(HookEventName, Vec<MatcherGroup>); 8] {
+    pub fn into_matcher_groups(self) -> [(HookEventName, Vec<MatcherGroup>); 9] {
         [
             (HookEventName::PreToolUse, self.pre_tool_use),
             (HookEventName::PermissionRequest, self.permission_request),
@@ -108,6 +114,7 @@ impl HookEventsToml {
             (HookEventName::PostCompact, self.post_compact),
             (HookEventName::SessionStart, self.session_start),
             (HookEventName::UserPromptSubmit, self.user_prompt_submit),
+            (HookEventName::SubagentStart, self.subagent_start),
             (HookEventName::Stop, self.stop),
         ]
     }
diff --git a/codex-rs/config/src/lib.rs b/codex-rs/config/src/lib.rs
index 2d4c62013e..3b49db638f 100644
--- a/codex-rs/config/src/lib.rs
+++ b/codex-rs/config/src/lib.rs
@@ -21,6 +21,7 @@ mod requirements_exec_policy;
 pub mod schema;
 mod skills_config;
 mod state;
+mod strict_config;
 mod thread_config;
 mod tui_keymap;
 pub mod types;
@@ -31,6 +32,8 @@ pub use cloud_requirements::CloudRequirementsLoadError;
 pub use cloud_requirements::CloudRequirementsLoadErrorCode;
 pub use cloud_requirements::CloudRequirementsLoader;
 pub use codex_app_server_protocol::ConfigLayerSource;
+pub use codex_protocol::config_types::ProfileV2Name;
+pub use codex_protocol::config_types::ProfileV2NameParseError;
 pub use codex_utils_absolute_path::AbsolutePathBuf;
 pub use config_requirements::AppRequirementToml;
 pub use config_requirements::AppToolRequirementToml;
@@ -93,6 +96,7 @@ pub use mcp_types::AppToolApproval;
 pub use mcp_types::McpServerConfig;
 pub use mcp_types::McpServerDisabledReason;
 pub use mcp_types::McpServerEnvVar;
+pub use mcp_types::McpServerOAuthConfig;
 pub use mcp_types::McpServerToolConfig;
 pub use mcp_types::McpServerTransportConfig;
 pub use mcp_types::RawMcpServerConfig;
@@ -116,7 +120,9 @@ pub use skills_config::SkillsConfig;
 pub use state::ConfigLayerEntry;
 pub use state::ConfigLayerStack;
 pub use state::ConfigLayerStackOrdering;
+pub use state::ConfigLoadOptions;
 pub use state::LoaderOverrides;
+pub use strict_config::config_error_from_ignored_toml_fields;
 pub use thread_config::NoopThreadConfigLoader;
 pub use thread_config::RemoteThreadConfigLoader;
 pub use thread_config::SessionThreadConfig;
diff --git a/codex-rs/config/src/loader/README.md b/codex-rs/config/src/loader/README.md
index 28750c4929..e004cea87c 100644
--- a/codex-rs/config/src/loader/README.md
+++ b/codex-rs/config/src/loader/README.md
@@ -10,13 +10,14 @@ This module is the canonical place to **load and describe Codex configuration la
 
 Exported from `codex_config::loader`:
 
-- `load_config_layers_state(fs, codex_home, cwd_opt, cli_overrides, overrides, cloud_requirements, thread_config_loader) -> ConfigLayerStack`
+- `load_config_layers_state(fs, codex_home, cwd_opt, cli_overrides, options, cloud_requirements, thread_config_loader) -> ConfigLayerStack`
 - `ConfigLayerStack`
   - `effective_config() -> toml::Value`
   - `origins() -> HashMap<String, ConfigLayerMetadata>`
   - `layers_high_to_low() -> Vec<ConfigLayer>`
   - `with_user_config(user_config) -> ConfigLayerStack`
 - `ConfigLayerEntry` (one layer’s `{name, config, version, disabled_reason}`; `name` carries source metadata)
+- `ConfigLoadOptions` (user-facing load behavior such as strict config validation)
 - `LoaderOverrides` (test/override hooks for managed config sources)
 - `merge_toml_values(base, overlay)` (public helper used elsewhere)
 
diff --git a/codex-rs/config/src/loader/layer_io.rs b/codex-rs/config/src/loader/layer_io.rs
index 9c15df7271..415d82e405 100644
--- a/codex-rs/config/src/loader/layer_io.rs
+++ b/codex-rs/config/src/loader/layer_io.rs
@@ -2,11 +2,14 @@
 use super::macos::ManagedAdminConfigLayer;
 #[cfg(target_os = "macos")]
 use super::macos::load_managed_admin_config_layer;
+use crate::config_toml::ConfigToml;
 use crate::diagnostics::config_error_from_toml;
 use crate::diagnostics::io_error_from_config_error;
 use crate::state::LoaderOverrides;
+use crate::strict_config::config_error_from_ignored_toml_value_fields;
 use codex_file_system::ExecutorFileSystem;
 use codex_utils_absolute_path::AbsolutePathBuf;
+use codex_utils_absolute_path::AbsolutePathBufGuard;
 use std::io;
 use std::path::Path;
 use std::path::PathBuf;
@@ -39,6 +42,7 @@ pub(super) async fn load_config_layers_internal(
     fs: &dyn ExecutorFileSystem,
     codex_home: &Path,
     overrides: LoaderOverrides,
+    strict_config: bool,
 ) -> io::Result<LoadedConfigLayers> {
     #[cfg(target_os = "macos")]
     let LoaderOverrides {
@@ -57,19 +61,26 @@ pub(super) async fn load_config_layers_internal(
         managed_config_path.unwrap_or_else(|| managed_config_default_path(codex_home)),
     )?;
 
-    let managed_config =
-        read_config_from_path(fs, &managed_config_path, /*log_missing_as_info*/ false)
-            .await?
-            .map(|managed_config| MangedConfigFromFile {
-                managed_config,
-                file: managed_config_path.clone(),
-            });
+    let managed_config = read_config_from_path(
+        fs,
+        &managed_config_path,
+        /*log_missing_as_info*/ false,
+        strict_config,
+    )
+    .await?
+    .map(|loaded| MangedConfigFromFile {
+        managed_config: loaded,
+        file: managed_config_path.clone(),
+    });
 
     #[cfg(target_os = "macos")]
-    let managed_preferences =
-        load_managed_admin_config_layer(managed_preferences_base64.as_deref())
-            .await?
-            .map(map_managed_admin_layer);
+    let managed_preferences = load_managed_admin_config_layer(
+        managed_preferences_base64.as_deref(),
+        strict_config,
+        codex_home,
+    )
+    .await?
+    .map(map_managed_admin_layer);
 
     #[cfg(not(target_os = "macos"))]
     let managed_preferences = None;
@@ -93,10 +104,16 @@ pub(super) async fn read_config_from_path(
     fs: &dyn ExecutorFileSystem,
     path: &AbsolutePathBuf,
     log_missing_as_info: bool,
+    strict_config: bool,
 ) -> io::Result<Option<TomlValue>> {
     match fs.read_file_text(path, /*sandbox*/ None).await {
         Ok(contents) => match toml::from_str::<TomlValue>(&contents) {
-            Ok(value) => Ok(Some(value)),
+            Ok(value) => {
+                if strict_config {
+                    validate_config_toml_strictly(path, &contents, &value)?;
+                }
+                Ok(Some(value))
+            }
             Err(err) => {
                 tracing::error!("Failed to parse {}: {err}", path.as_path().display());
                 let config_error = config_error_from_toml(path.as_path(), &contents, err.clone());
@@ -122,6 +139,33 @@ pub(super) async fn read_config_from_path(
     }
 }
 
+fn validate_config_toml_strictly(
+    path: &AbsolutePathBuf,
+    contents: &str,
+    value: &TomlValue,
+) -> io::Result<()> {
+    let Some(base_dir) = path.as_path().parent() else {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidData,
+            format!("Config file {} has no parent directory", path.display()),
+        ));
+    };
+    let _guard = AbsolutePathBufGuard::new(base_dir);
+    if let Some(config_error) = config_error_from_ignored_toml_value_fields::<ConfigToml>(
+        path.as_path(),
+        contents,
+        value.clone(),
+    ) {
+        return Err(io_error_from_config_error(
+            io::ErrorKind::InvalidData,
+            config_error,
+            /*source*/ None,
+        ));
+    }
+
+    Ok(())
+}
+
 /// Return the default managed config path.
 pub(super) fn managed_config_default_path(codex_home: &Path) -> PathBuf {
     #[cfg(unix)]
diff --git a/codex-rs/config/src/loader/macos.rs b/codex-rs/config/src/loader/macos.rs
index 3a9fc3a0ea..199e7f6daa 100644
--- a/codex-rs/config/src/loader/macos.rs
+++ b/codex-rs/config/src/loader/macos.rs
@@ -2,13 +2,20 @@ use super::merge_requirements_with_remote_sandbox_config;
 use crate::config_requirements::ConfigRequirementsToml;
 use crate::config_requirements::ConfigRequirementsWithSources;
 use crate::config_requirements::RequirementSource;
+use crate::config_toml::ConfigToml;
+use crate::diagnostics::ConfigDiagnosticSource;
+use crate::diagnostics::config_error_from_toml_for_source;
+use crate::diagnostics::io_error_from_config_error;
+use crate::strict_config::config_error_from_ignored_toml_value_fields_for_source_name;
 use base64::Engine;
 use base64::prelude::BASE64_STANDARD;
+use codex_utils_absolute_path::AbsolutePathBufGuard;
 use core_foundation::base::TCFType;
 use core_foundation::string::CFString;
 use core_foundation::string::CFStringRef;
 use std::ffi::c_void;
 use std::io;
+use std::path::Path;
 use tokio::task;
 use toml::Value as TomlValue;
 
@@ -31,17 +38,20 @@ pub(super) fn managed_preferences_requirements_source() -> RequirementSource {
 
 pub(crate) async fn load_managed_admin_config_layer(
     override_base64: Option<&str>,
+    strict_config: bool,
+    base_dir: &Path,
 ) -> io::Result<Option<ManagedAdminConfigLayer>> {
     if let Some(encoded) = override_base64 {
         let trimmed = encoded.trim();
         return if trimmed.is_empty() {
             Ok(None)
         } else {
-            parse_managed_config_base64(trimmed).map(Some)
+            parse_managed_config_base64(trimmed, strict_config, base_dir).map(Some)
         };
     }
 
-    match task::spawn_blocking(load_managed_admin_config).await {
+    let base_dir = base_dir.to_path_buf();
+    match task::spawn_blocking(move || load_managed_admin_config(strict_config, &base_dir)).await {
         Ok(result) => result,
         Err(join_err) => {
             if join_err.is_cancelled() {
@@ -54,11 +64,14 @@ pub(crate) async fn load_managed_admin_config_layer(
     }
 }
 
-fn load_managed_admin_config() -> io::Result<Option<ManagedAdminConfigLayer>> {
+fn load_managed_admin_config(
+    strict_config: bool,
+    base_dir: &Path,
+) -> io::Result<Option<ManagedAdminConfigLayer>> {
     load_managed_preference(MANAGED_PREFERENCES_CONFIG_KEY)?
         .as_deref()
         .map(str::trim)
-        .map(parse_managed_config_base64)
+        .map(|encoded| parse_managed_config_base64(encoded, strict_config, base_dir))
         .transpose()
 }
 
@@ -134,24 +147,73 @@ fn load_managed_preference(key_name: &str) -> io::Result<Option<String>> {
     Ok(Some(value))
 }
 
-fn parse_managed_config_base64(encoded: &str) -> io::Result<ManagedAdminConfigLayer> {
+fn parse_managed_config_base64(
+    encoded: &str,
+    strict_config: bool,
+    base_dir: &Path,
+) -> io::Result<ManagedAdminConfigLayer> {
     let raw_toml = decode_managed_preferences_base64(encoded)?;
-    match toml::from_str::<TomlValue>(&raw_toml) {
-        Ok(TomlValue::Table(parsed)) => Ok(ManagedAdminConfigLayer {
+    let source_name =
+        format!("{MANAGED_PREFERENCES_APPLICATION_ID}:{MANAGED_PREFERENCES_CONFIG_KEY}");
+    let parsed = toml::from_str::<TomlValue>(&raw_toml).map_err(|err| {
+        tracing::error!("Failed to parse managed config TOML: {err}");
+        if strict_config {
+            let config_error = config_error_from_toml_for_source(
+                ConfigDiagnosticSource::DisplayName(&source_name),
+                &raw_toml,
+                err.clone(),
+            );
+            io_error_from_config_error(io::ErrorKind::InvalidData, config_error, Some(err))
+        } else {
+            io::Error::new(io::ErrorKind::InvalidData, err)
+        }
+    })?;
+
+    validate_managed_config_toml_strictly_if_requested(
+        strict_config,
+        &source_name,
+        &raw_toml,
+        &parsed,
+        base_dir,
+    )?;
+    match parsed {
+        TomlValue::Table(parsed) => Ok(ManagedAdminConfigLayer {
             config: TomlValue::Table(parsed),
             raw_toml,
         }),
-        Ok(other) => {
+        other => {
             tracing::error!("Managed config TOML must have a table at the root, found {other:?}",);
             Err(io::Error::new(
                 io::ErrorKind::InvalidData,
                 "managed config root must be a table",
             ))
         }
-        Err(err) => {
-            tracing::error!("Failed to parse managed config TOML: {err}");
-            Err(io::Error::new(io::ErrorKind::InvalidData, err))
-        }
+    }
+}
+
+fn validate_managed_config_toml_strictly_if_requested(
+    strict_config: bool,
+    source_name: &str,
+    raw_toml: &str,
+    parsed: &TomlValue,
+    base_dir: &Path,
+) -> io::Result<()> {
+    if !strict_config {
+        return Ok(());
+    }
+
+    let _guard = AbsolutePathBufGuard::new(base_dir);
+    if let Some(config_error) = config_error_from_ignored_toml_value_fields_for_source_name::<
+        ConfigToml,
+    >(source_name, raw_toml, parsed.clone())
+    {
+        Err(io_error_from_config_error(
+            io::ErrorKind::InvalidData,
+            config_error,
+            /*source*/ None,
+        ))
+    } else {
+        Ok(())
     }
 }
 
diff --git a/codex-rs/config/src/loader/mod.rs b/codex-rs/config/src/loader/mod.rs
index 6e98691465..49df306abb 100644
--- a/codex-rs/config/src/loader/mod.rs
+++ b/codex-rs/config/src/loader/mod.rs
@@ -1,9 +1,12 @@
 mod layer_io;
 #[cfg(target_os = "macos")]
 mod macos;
+#[cfg(test)]
+mod tests;
 
 use self::layer_io::LoadedConfigLayers;
 use crate::CONFIG_TOML_FILE;
+use crate::ProfileV2Name;
 use crate::cloud_requirements::CloudRequirementsLoader;
 use crate::config_requirements::ConfigRequirementsToml;
 use crate::config_requirements::ConfigRequirementsWithSources;
@@ -21,7 +24,11 @@ use crate::project_root_markers::default_project_root_markers;
 use crate::project_root_markers::project_root_markers_from_config;
 use crate::state::ConfigLayerEntry;
 use crate::state::ConfigLayerStack;
+use crate::state::ConfigLoadOptions;
 use crate::state::LoaderOverrides;
+use crate::strict_config::config_error_from_ignored_toml_value_fields;
+use crate::strict_config::ignored_toml_value_field;
+use crate::strict_config::unknown_feature_toml_value_field;
 use crate::thread_config::ThreadConfigContext;
 use crate::thread_config::ThreadConfigLoader;
 use codex_app_server_protocol::ConfigLayerSource;
@@ -54,6 +61,7 @@ const DEFAULT_PROGRAM_DATA_DIR_WINDOWS: &str = r"C:\ProgramData";
 const PROJECT_LOCAL_CONFIG_DENYLIST: &[&str] = &[
     "openai_base_url",
     "chatgpt_base_url",
+    "apps_mcp_product_sku",
     "model_provider",
     "model_providers",
     "notify",
@@ -85,6 +93,7 @@ async fn first_layer_config_error_from_entries(layers: &[ConfigLayerEntry]) -> O
 /// - system    `/etc/codex/config.toml` (Unix) or
 ///   `%ProgramData%\OpenAI\Codex\config.toml` (Windows)
 /// - user      `${CODEX_HOME}/config.toml`
+/// - profile   `${CODEX_HOME}/<name>.config.toml`, when selected
 /// - cwd       `${PWD}/config.toml` (loaded but disabled when the directory is untrusted)
 /// - tree      parent directories up to root looking for `./.codex/config.toml` (loaded but disabled when untrusted)
 /// - repo      `$(git rev-parse --show-toplevel)/.codex/config.toml` (loaded but disabled when untrusted)
@@ -104,10 +113,15 @@ pub async fn load_config_layers_state(
     codex_home: &Path,
     cwd: Option<AbsolutePathBuf>,
     cli_overrides: &[(String, TomlValue)],
-    overrides: LoaderOverrides,
+    options: impl Into<ConfigLoadOptions>,
     cloud_requirements: CloudRequirementsLoader,
     thread_config_loader: &dyn ThreadConfigLoader,
 ) -> io::Result<ConfigLayerStack> {
+    let ConfigLoadOptions {
+        loader_overrides: overrides,
+        strict_config,
+    } = options.into();
+    let active_user_profile = overrides.user_config_profile.clone();
     let ignore_managed_requirements = overrides.ignore_managed_requirements;
     let ignore_user_config = overrides.ignore_user_config;
     let ignore_user_and_project_exec_policy_rules =
@@ -140,7 +154,8 @@ pub async fn load_config_layers_state(
     // Make a best-effort to support the legacy `managed_config.toml` as a
     // requirements specification.
     let loaded_config_layers =
-        layer_io::load_config_layers_internal(fs, codex_home, overrides.clone()).await?;
+        layer_io::load_config_layers_internal(fs, codex_home, overrides.clone(), strict_config)
+            .await?;
     if !ignore_managed_requirements {
         load_requirements_from_legacy_scheme(
             &mut config_requirements_toml,
@@ -168,6 +183,9 @@ pub async fn load_config_layers_state(
             .as_ref()
             .map(AbsolutePathBuf::as_path)
             .unwrap_or(codex_home);
+        if strict_config {
+            validate_cli_overrides_strictly(&cli_overrides_layer, base_dir)?;
+        }
         Some(resolve_relative_paths_in_config_toml(
             cli_overrides_layer,
             base_dir,
@@ -177,41 +195,66 @@ pub async fn load_config_layers_state(
     // Include an entry for the "system" config folder, loading its config.toml,
     // if it exists.
     let system_config_toml_file = system_config_toml_file_with_overrides(&overrides)?;
-    let system_layer =
-        load_config_toml_for_required_layer(fs, &system_config_toml_file, |config_toml| {
+    let system_layer = load_config_toml_for_required_layer(
+        fs,
+        &system_config_toml_file,
+        strict_config,
+        |config_toml| {
             ConfigLayerEntry::new(
                 ConfigLayerSource::System {
                     file: system_config_toml_file.clone(),
                 },
                 config_toml,
             )
-        })
-        .await?;
+        },
+    )
+    .await?;
     layers.push(system_layer);
 
-    // Add a layer for $CODEX_HOME/config.toml so folder-derived resources such
-    // as rules/ can still be discovered. When user config is ignored, preserve
-    // the layer metadata without reading config.toml.
-    let user_file = AbsolutePathBuf::resolve_path_against_base(CONFIG_TOML_FILE, codex_home);
-    let user_layer = if ignore_user_config {
-        ConfigLayerEntry::new(
-            ConfigLayerSource::User {
-                file: user_file.clone(),
-            },
-            TomlValue::Table(toml::map::Map::new()),
-        )
-    } else {
-        load_config_toml_for_required_layer(fs, &user_file, |config_toml| {
-            ConfigLayerEntry::new(
-                ConfigLayerSource::User {
-                    file: user_file.clone(),
-                },
-                config_toml,
-            )
+    // Add the base user config layer. When profile-v2 is selected, add the
+    // profile config as a second user layer on top so the profile only needs to
+    // contain overrides.
+    let active_user_file = overrides.user_config_path(codex_home)?;
+    let base_user_file = AbsolutePathBuf::resolve_path_against_base(CONFIG_TOML_FILE, codex_home);
+    let base_user_layer = load_user_config_layer(
+        fs,
+        &base_user_file,
+        /*profile*/ None,
+        ignore_user_config,
+        strict_config,
+    )
+    .await?;
+    if let Some(active_user_profile) = active_user_profile.as_ref()
+        && base_user_layer.config.as_table().is_some_and(|config| {
+            config
+                .get("profiles")
+                .and_then(TomlValue::as_table)
+                .is_some_and(|profiles| profiles.contains_key(active_user_profile.as_str()))
         })
-        .await?
-    };
-    layers.push(user_layer);
+    {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidData,
+            format!(
+                "--profile-v2 `{active_user_profile}` cannot be used while {} contains legacy `[profiles.{active_user_profile}]` config; move those settings into {} or remove `[profiles.{active_user_profile}]`",
+                base_user_file.as_path().display(),
+                active_user_file.as_path().display()
+            ),
+        ));
+    }
+    layers.push(base_user_layer);
+
+    if active_user_file != base_user_file {
+        layers.push(
+            load_user_config_layer(
+                fs,
+                &active_user_file,
+                active_user_profile.as_ref(),
+                ignore_user_config,
+                strict_config,
+            )
+            .await?,
+        );
+    }
 
     let mut startup_warnings = None;
     if let Some(cwd) = cwd {
@@ -242,7 +285,7 @@ pub async fn load_config_layers_state(
             &cwd,
             &project_root_markers,
             codex_home,
-            &user_file,
+            &active_user_file,
         )
         .await
         {
@@ -268,6 +311,7 @@ pub async fn load_config_layers_state(
             &project_trust_context.project_root,
             &project_trust_context,
             codex_home,
+            strict_config,
         )
         .await?;
         layers.extend(project_layers.layers);
@@ -339,6 +383,36 @@ pub async fn load_config_layers_state(
     })
 }
 
+async fn load_user_config_layer(
+    fs: &dyn ExecutorFileSystem,
+    user_file: &AbsolutePathBuf,
+    profile: Option<&ProfileV2Name>,
+    ignore_user_config: bool,
+    strict_config: bool,
+) -> io::Result<ConfigLayerEntry> {
+    let profile = profile.map(ToString::to_string);
+    if ignore_user_config {
+        return Ok(ConfigLayerEntry::new(
+            ConfigLayerSource::User {
+                file: user_file.clone(),
+                profile,
+            },
+            TomlValue::Table(toml::map::Map::new()),
+        ));
+    }
+
+    load_config_toml_for_required_layer(fs, user_file, strict_config, |config_toml| {
+        ConfigLayerEntry::new(
+            ConfigLayerSource::User {
+                file: user_file.clone(),
+                profile: profile.clone(),
+            },
+            config_toml,
+        )
+    })
+    .await
+}
+
 fn insert_layer_by_precedence(layers: &mut Vec<ConfigLayerEntry>, layer: ConfigLayerEntry) {
     match layers
         .iter()
@@ -359,15 +433,11 @@ fn insert_layer_by_precedence(layers: &mut Vec<ConfigLayerEntry>, layer: ConfigL
 async fn load_config_toml_for_required_layer(
     fs: &dyn ExecutorFileSystem,
     toml_file: &AbsolutePathBuf,
+    strict_config: bool,
     create_entry: impl FnOnce(TomlValue) -> ConfigLayerEntry,
 ) -> io::Result<ConfigLayerEntry> {
     let toml_value = match fs.read_file_text(toml_file, /*sandbox*/ None).await {
         Ok(contents) => {
-            let config: TomlValue = toml::from_str(&contents).map_err(|err| {
-                let config_error =
-                    config_error_from_toml(toml_file.as_path(), &contents, err.clone());
-                io_error_from_config_error(io::ErrorKind::InvalidData, config_error, Some(err))
-            })?;
             let config_parent = toml_file.as_path().parent().ok_or_else(|| {
                 io::Error::new(
                     io::ErrorKind::InvalidData,
@@ -377,6 +447,19 @@ async fn load_config_toml_for_required_layer(
                     ),
                 )
             })?;
+            let config: TomlValue = toml::from_str(&contents).map_err(|err| {
+                let config_error =
+                    config_error_from_toml(toml_file.as_path(), &contents, err.clone());
+                io_error_from_config_error(io::ErrorKind::InvalidData, config_error, Some(err))
+            })?;
+            if strict_config {
+                validate_config_toml_strictly(
+                    toml_file.as_path(),
+                    &contents,
+                    &config,
+                    config_parent,
+                )?;
+            }
             resolve_relative_paths_in_config_toml(config, config_parent)
         }
         Err(e) => {
@@ -397,6 +480,51 @@ async fn load_config_toml_for_required_layer(
     Ok(create_entry(toml_value))
 }
 
+fn validate_config_toml_strictly(
+    toml_file: &Path,
+    contents: &str,
+    value: &TomlValue,
+    base_dir: &Path,
+) -> io::Result<()> {
+    let _guard = AbsolutePathBufGuard::new(base_dir);
+    if let Some(config_error) = config_error_from_ignored_toml_value_fields::<ConfigToml>(
+        toml_file,
+        contents,
+        value.clone(),
+    ) {
+        Err(io_error_from_config_error(
+            io::ErrorKind::InvalidData,
+            config_error,
+            /*source*/ None,
+        ))
+    } else {
+        Ok(())
+    }
+}
+
+fn validate_cli_overrides_strictly(
+    cli_overrides_layer: &TomlValue,
+    base_dir: &Path,
+) -> io::Result<()> {
+    let _guard = AbsolutePathBufGuard::new(base_dir);
+    if let Some(ignored_path) = ignored_toml_value_field::<ConfigToml>(cli_overrides_layer.clone())
+    {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidData,
+            format!("unknown configuration field `{ignored_path}` in -c/--config override"),
+        ));
+    }
+
+    if let Some(ignored_path) = unknown_feature_toml_value_field(cli_overrides_layer) {
+        return Err(io::Error::new(
+            io::ErrorKind::InvalidData,
+            format!("unknown configuration field `{ignored_path}` in -c/--config override"),
+        ));
+    }
+
+    Ok(())
+}
+
 /// If available, apply requirements from the platform system
 /// `requirements.toml` location to `config_requirements_toml` by filling in
 /// any unset fields.
@@ -998,6 +1126,7 @@ async fn load_project_layers(
     project_root: &AbsolutePathBuf,
     trust_context: &ProjectTrustContext,
     codex_home: &Path,
+    strict_config: bool,
 ) -> io::Result<LoadedProjectLayers> {
     let codex_home_abs = AbsolutePathBuf::from_absolute_path(codex_home)?;
     let codex_home_normalized =
@@ -1063,6 +1192,14 @@ async fn load_project_layers(
                     }
                 };
                 let mut config = config;
+                if disabled_reason.is_none() && strict_config {
+                    validate_config_toml_strictly(
+                        config_file.as_path(),
+                        &contents,
+                        &config,
+                        dot_codex_abs.as_path(),
+                    )?;
+                }
                 let ignored_project_config_keys = sanitize_project_config(&mut config);
                 let config =
                     resolve_relative_paths_in_config_toml(config, dot_codex_abs.as_path())?;
diff --git a/codex-rs/config/src/loader/tests.rs b/codex-rs/config/src/loader/tests.rs
new file mode 100644
index 0000000000..2d9462bfa7
--- /dev/null
+++ b/codex-rs/config/src/loader/tests.rs
@@ -0,0 +1,172 @@
+use super::*;
+use async_trait::async_trait;
+use codex_file_system::CopyOptions;
+use codex_file_system::CreateDirectoryOptions;
+use codex_file_system::FileMetadata;
+use codex_file_system::FileSystemResult;
+use codex_file_system::FileSystemSandboxContext;
+use codex_file_system::ReadDirectoryEntry;
+use codex_file_system::RemoveOptions;
+use pretty_assertions::assert_eq;
+use tempfile::tempdir;
+
+struct TestFileSystem;
+
+#[async_trait]
+impl ExecutorFileSystem for TestFileSystem {
+    async fn read_file(
+        &self,
+        path: &AbsolutePathBuf,
+        _sandbox: Option<&FileSystemSandboxContext>,
+    ) -> FileSystemResult<Vec<u8>> {
+        tokio::fs::read(path.as_path()).await
+    }
+
+    async fn write_file(
+        &self,
+        _path: &AbsolutePathBuf,
+        _contents: Vec<u8>,
+        _sandbox: Option<&FileSystemSandboxContext>,
+    ) -> FileSystemResult<()> {
+        unimplemented!("test filesystem only supports reads")
+    }
+
+    async fn create_directory(
+        &self,
+        _path: &AbsolutePathBuf,
+        _create_directory_options: CreateDirectoryOptions,
+        _sandbox: Option<&FileSystemSandboxContext>,
+    ) -> FileSystemResult<()> {
+        unimplemented!("test filesystem only supports reads")
+    }
+
+    async fn get_metadata(
+        &self,
+        _path: &AbsolutePathBuf,
+        _sandbox: Option<&FileSystemSandboxContext>,
+    ) -> FileSystemResult<FileMetadata> {
+        unimplemented!("test filesystem only supports reads")
+    }
+
+    async fn read_directory(
+        &self,
+        _path: &AbsolutePathBuf,
+        _sandbox: Option<&FileSystemSandboxContext>,
+    ) -> FileSystemResult<Vec<ReadDirectoryEntry>> {
+        unimplemented!("test filesystem only supports reads")
+    }
+
+    async fn remove(
+        &self,
+        _path: &AbsolutePathBuf,
+        _remove_options: RemoveOptions,
+        _sandbox: Option<&FileSystemSandboxContext>,
+    ) -> FileSystemResult<()> {
+        unimplemented!("test filesystem only supports reads")
+    }
+
+    async fn copy(
+        &self,
+        _source_path: &AbsolutePathBuf,
+        _destination_path: &AbsolutePathBuf,
+        _copy_options: CopyOptions,
+        _sandbox: Option<&FileSystemSandboxContext>,
+    ) -> FileSystemResult<()> {
+        unimplemented!("test filesystem only supports reads")
+    }
+}
+
+#[tokio::test]
+async fn profile_v2_rejects_matching_legacy_profile_in_base_user_config() {
+    let tmp = tempdir().expect("tempdir");
+    let selected_config = tmp.path().join("work.config.toml");
+
+    std::fs::write(
+        tmp.path().join(CONFIG_TOML_FILE),
+        r#"
+model = "gpt-main"
+
+[profiles.work]
+model = "gpt-work"
+"#,
+    )
+    .expect("write default user config");
+    std::fs::write(&selected_config, r#"model = "gpt-work-v2""#)
+        .expect("write selected user config");
+
+    let mut overrides = LoaderOverrides::without_managed_config_for_tests();
+    overrides.user_config_path = Some(AbsolutePathBuf::resolve_path_against_base(
+        "work.config.toml",
+        tmp.path(),
+    ));
+    overrides.user_config_profile = Some("work".parse().expect("profile-v2 name"));
+
+    let err = load_config_layers_state(
+        &TestFileSystem,
+        tmp.path(),
+        /*cwd*/ None,
+        &[],
+        overrides,
+        CloudRequirementsLoader::default(),
+        &crate::NoopThreadConfigLoader,
+    )
+    .await
+    .expect_err("profile-v2 should reject a matching legacy profile in base user config");
+
+    assert_eq!(
+        err.kind(),
+        io::ErrorKind::InvalidData,
+        "a matching legacy profile should be a hard config error"
+    );
+    let message = err.to_string();
+    assert!(
+        message.contains("--profile-v2 `work` cannot be used"),
+        "unexpected error message: {message}"
+    );
+    assert!(
+        message.contains("config.toml"),
+        "unexpected error message: {message}"
+    );
+    assert!(
+        message.contains("[profiles.work]"),
+        "unexpected error message: {message}"
+    );
+}
+
+#[tokio::test]
+async fn profile_v2_allows_unrelated_legacy_profiles_in_base_user_config() {
+    let tmp = tempdir().expect("tempdir");
+    let selected_config = tmp.path().join("work.config.toml");
+
+    std::fs::write(
+        tmp.path().join(CONFIG_TOML_FILE),
+        r#"
+model = "gpt-main"
+
+[profiles.dev]
+model = "gpt-dev"
+"#,
+    )
+    .expect("write default user config");
+    std::fs::write(&selected_config, r#"model = "gpt-work-v2""#)
+        .expect("write selected user config");
+
+    let mut overrides = LoaderOverrides::without_managed_config_for_tests();
+    overrides.user_config_path = Some(AbsolutePathBuf::resolve_path_against_base(
+        "work.config.toml",
+        tmp.path(),
+    ));
+    overrides.user_config_profile = Some("work".parse().expect("profile-v2 name"));
+
+    load_config_layers_state(
+        &TestFileSystem,
+        tmp.path(),
+        /*cwd*/ None,
+        &[],
+        overrides,
+        CloudRequirementsLoader::default(),
+        &crate::NoopThreadConfigLoader,
+    )
+    .await
+    .expect("profile-v2 should allow unrelated legacy profiles in base user config");
+}
diff --git a/codex-rs/config/src/mcp_edit.rs b/codex-rs/config/src/mcp_edit.rs
index f5881a1257..aaad3444fd 100644
--- a/codex-rs/config/src/mcp_edit.rs
+++ b/codex-rs/config/src/mcp_edit.rs
@@ -212,6 +212,15 @@ fn serialize_mcp_server(config: &McpServerConfig) -> TomlItem {
     {
         entry["scopes"] = array_from_strings(scopes);
     }
+    if let Some(oauth) = &config.oauth
+        && let Some(client_id) = &oauth.client_id
+        && !client_id.is_empty()
+    {
+        let mut oauth_table = TomlTable::new();
+        oauth_table.set_implicit(false);
+        oauth_table["client_id"] = value(client_id.clone());
+        entry["oauth"] = TomlItem::Table(oauth_table);
+    }
     if let Some(resource) = &config.oauth_resource
         && !resource.is_empty()
     {
diff --git a/codex-rs/config/src/mcp_edit_tests.rs b/codex-rs/config/src/mcp_edit_tests.rs
index cfcd73c3e5..0215e7b808 100644
--- a/codex-rs/config/src/mcp_edit_tests.rs
+++ b/codex-rs/config/src/mcp_edit_tests.rs
@@ -1,4 +1,5 @@
 use super::*;
+use crate::McpServerOAuthConfig;
 use crate::McpServerToolConfig;
 use pretty_assertions::assert_eq;
 use std::collections::HashMap;
@@ -33,6 +34,7 @@ async fn replace_mcp_servers_serializes_per_tool_approval_overrides() -> anyhow:
             enabled_tools: None,
             disabled_tools: None,
             scopes: None,
+            oauth: None,
             oauth_resource: None,
             tools: HashMap::from([
                 (
@@ -82,3 +84,63 @@ approval_mode = "approve"
 
     Ok(())
 }
+
+#[tokio::test]
+async fn replace_mcp_servers_serializes_oauth_client_id() -> anyhow::Result<()> {
+    let unique_suffix = SystemTime::now().duration_since(UNIX_EPOCH)?.as_nanos();
+    let codex_home = std::env::temp_dir().join(format!(
+        "codex-config-mcp-oauth-edit-test-{}-{unique_suffix}",
+        std::process::id()
+    ));
+    let servers = BTreeMap::from([(
+        "maas_outlook".to_string(),
+        McpServerConfig {
+            transport: McpServerTransportConfig::StreamableHttp {
+                url: "https://example.com/mcp".to_string(),
+                bearer_token_env_var: None,
+                http_headers: None,
+                env_http_headers: None,
+            },
+            experimental_environment: None,
+            enabled: true,
+            required: false,
+            supports_parallel_tool_calls: false,
+            disabled_reason: None,
+            startup_timeout_sec: None,
+            tool_timeout_sec: None,
+            default_tools_approval_mode: None,
+            enabled_tools: None,
+            disabled_tools: None,
+            scopes: None,
+            oauth: Some(McpServerOAuthConfig {
+                client_id: Some("eci-prd-pub-codex-123".to_string()),
+            }),
+            oauth_resource: None,
+            tools: HashMap::new(),
+        },
+    )]);
+
+    ConfigEditsBuilder::new(&codex_home)
+        .replace_mcp_servers(&servers)
+        .apply()
+        .await?;
+
+    let config_path = codex_home.join(CONFIG_TOML_FILE);
+    let serialized = std::fs::read_to_string(&config_path)?;
+    assert_eq!(
+        serialized,
+        r#"[mcp_servers.maas_outlook]
+url = "https://example.com/mcp"
+
+[mcp_servers.maas_outlook.oauth]
+client_id = "eci-prd-pub-codex-123"
+"#
+    );
+
+    let loaded = load_global_mcp_servers(&codex_home).await?;
+    assert_eq!(loaded, servers);
+
+    std::fs::remove_dir_all(&codex_home)?;
+
+    Ok(())
+}
diff --git a/codex-rs/config/src/mcp_types.rs b/codex-rs/config/src/mcp_types.rs
index d642d9fc57..8dfceec37e 100644
--- a/codex-rs/config/src/mcp_types.rs
+++ b/codex-rs/config/src/mcp_types.rs
@@ -114,6 +114,15 @@ impl AsRef<str> for McpServerEnvVar {
     }
 }
 
+/// OAuth client settings used when Codex launches an MCP OAuth flow.
+#[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Eq, JsonSchema)]
+#[schemars(deny_unknown_fields)]
+pub struct McpServerOAuthConfig {
+    /// Explicit OAuth client identifier to present during authorization and token exchange.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub client_id: Option<String>,
+}
+
 #[derive(Serialize, Debug, Clone, PartialEq)]
 pub struct McpServerConfig {
     #[serde(flatten)]
@@ -167,6 +176,10 @@ pub struct McpServerConfig {
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub scopes: Option<Vec<String>>,
 
+    /// Optional OAuth client settings for MCP login.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub oauth: Option<McpServerOAuthConfig>,
+
     /// Optional OAuth resource parameter to include during MCP login (RFC 8707).
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub oauth_resource: Option<String>,
@@ -176,6 +189,14 @@ pub struct McpServerConfig {
     pub tools: HashMap<String, McpServerToolConfig>,
 }
 
+impl McpServerConfig {
+    pub fn oauth_client_id(&self) -> Option<&str> {
+        self.oauth
+            .as_ref()
+            .and_then(|oauth| oauth.client_id.as_deref())
+    }
+}
+
 /// Raw MCP config shape used for deserialization and supported-field JSON
 /// Schema generation.
 ///
@@ -233,6 +254,8 @@ pub struct RawMcpServerConfig {
     #[serde(default)]
     pub scopes: Option<Vec<String>>,
     #[serde(default)]
+    pub oauth: Option<McpServerOAuthConfig>,
+    #[serde(default)]
     pub oauth_resource: Option<String>,
     /// Legacy display-name field accepted for backward compatibility.
     #[serde(default, rename = "name")]
@@ -267,6 +290,7 @@ impl TryFrom<RawMcpServerConfig> for McpServerConfig {
             enabled_tools,
             disabled_tools,
             scopes,
+            oauth,
             oauth_resource,
             _name: _,
             tools,
@@ -297,6 +321,7 @@ impl TryFrom<RawMcpServerConfig> for McpServerConfig {
             throw_if_set("stdio", "bearer_token", bearer_token.as_ref())?;
             throw_if_set("stdio", "http_headers", http_headers.as_ref())?;
             throw_if_set("stdio", "env_http_headers", env_http_headers.as_ref())?;
+            throw_if_set("stdio", "oauth", oauth.as_ref())?;
             throw_if_set("stdio", "oauth_resource", oauth_resource.as_ref())?;
             let env_vars = env_vars.unwrap_or_default();
             for env_var in &env_vars {
@@ -338,6 +363,7 @@ impl TryFrom<RawMcpServerConfig> for McpServerConfig {
             enabled_tools,
             disabled_tools,
             scopes,
+            oauth,
             oauth_resource,
             tools: tools.unwrap_or_default(),
         })
diff --git a/codex-rs/config/src/mcp_types_tests.rs b/codex-rs/config/src/mcp_types_tests.rs
index 50f705d0f8..f397115425 100644
--- a/codex-rs/config/src/mcp_types_tests.rs
+++ b/codex-rs/config/src/mcp_types_tests.rs
@@ -283,6 +283,26 @@ fn deserialize_streamable_http_server_config_with_oauth_resource() {
     );
 }
 
+#[test]
+fn deserialize_streamable_http_server_config_with_oauth_client_id() {
+    let cfg: McpServerConfig = toml::from_str(
+        r#"
+            url = "https://example.com/mcp"
+
+            [oauth]
+            client_id = "eci-prd-pub-codex-123"
+        "#,
+    )
+    .expect("should deserialize http config with oauth client id");
+
+    assert_eq!(
+        cfg.oauth,
+        Some(McpServerOAuthConfig {
+            client_id: Some("eci-prd-pub-codex-123".to_string()),
+        })
+    );
+}
+
 #[test]
 fn deserialize_server_config_with_tool_filters() {
     let cfg: McpServerConfig = toml::from_str(
@@ -393,6 +413,7 @@ fn deserialize_ignores_unknown_server_fields() {
             enabled_tools: None,
             disabled_tools: None,
             scopes: None,
+            oauth: None,
             oauth_resource: None,
             tools: HashMap::new(),
         }
@@ -439,6 +460,19 @@ fn deserialize_rejects_headers_for_stdio() {
     )
     .expect_err("should reject env_http_headers for stdio transport");
 
+    let err = toml::from_str::<McpServerConfig>(
+        r#"
+            command = "echo"
+            oauth = { client_id = "eci-prd-pub-codex-123" }
+        "#,
+    )
+    .expect_err("should reject oauth for stdio transport");
+
+    assert!(
+        err.to_string().contains("oauth is not supported for stdio"),
+        "unexpected error: {err}"
+    );
+
     let err = toml::from_str::<McpServerConfig>(
         r#"
             command = "echo"
diff --git a/codex-rs/config/src/permissions_toml.rs b/codex-rs/config/src/permissions_toml.rs
index cee68d7abb..fff8c67706 100644
--- a/codex-rs/config/src/permissions_toml.rs
+++ b/codex-rs/config/src/permissions_toml.rs
@@ -25,10 +25,25 @@ impl PermissionsToml {
 #[derive(Serialize, Deserialize, Debug, Clone, Default, PartialEq, Eq, JsonSchema)]
 #[schemars(deny_unknown_fields)]
 pub struct PermissionProfileToml {
+    pub workspace_roots: Option<WorkspaceRootsToml>,
     pub filesystem: Option<FilesystemPermissionsToml>,
     pub network: Option<NetworkToml>,
 }
 
+#[derive(Serialize, Deserialize, Debug, Clone, Default, PartialEq, Eq, JsonSchema)]
+pub struct WorkspaceRootsToml {
+    #[serde(flatten)]
+    pub entries: BTreeMap<String, bool>,
+}
+
+impl WorkspaceRootsToml {
+    pub fn enabled_roots(&self) -> impl Iterator<Item = &String> {
+        self.entries
+            .iter()
+            .filter_map(|(path, enabled)| (*enabled).then_some(path))
+    }
+}
+
 #[derive(Serialize, Deserialize, Debug, Clone, Default, PartialEq, Eq, JsonSchema)]
 pub struct FilesystemPermissionsToml {
     /// Optional maximum depth for expanding unreadable glob patterns on
diff --git a/codex-rs/config/src/profile_toml.rs b/codex-rs/config/src/profile_toml.rs
index 11d3a6a403..6cf35be68e 100644
--- a/codex-rs/config/src/profile_toml.rs
+++ b/codex-rs/config/src/profile_toml.rs
@@ -50,18 +50,12 @@ pub struct ConfigProfile {
     pub js_repl_node_module_dirs: Option<Vec<AbsolutePathBuf>>,
     /// Optional absolute path to patched zsh used by zsh-exec-bridge-backed shell execution.
     pub zsh_path: Option<AbsolutePathBuf>,
-    /// Deprecated: ignored. Use `model_instructions_file`.
-    #[schemars(skip)]
-    pub experimental_instructions_file: Option<AbsolutePathBuf>,
     pub experimental_compact_prompt_file: Option<AbsolutePathBuf>,
-    pub include_apply_patch_tool: Option<bool>,
     pub include_permissions_instructions: Option<bool>,
     pub include_apps_instructions: Option<bool>,
     pub include_collaboration_mode_instructions: Option<bool>,
     pub include_environment_context: Option<bool>,
     pub experimental_use_unified_exec_tool: Option<bool>,
-    pub experimental_use_freeform_apply_patch: Option<bool>,
-    pub tools_view_image: Option<bool>,
     pub tools: Option<ToolsToml>,
     pub web_search: Option<WebSearchMode>,
     pub analytics: Option<AnalyticsConfigToml>,
diff --git a/codex-rs/config/src/state.rs b/codex-rs/config/src/state.rs
index e718ecae67..3ec0bfb314 100644
--- a/codex-rs/config/src/state.rs
+++ b/codex-rs/config/src/state.rs
@@ -5,18 +5,38 @@ use super::fingerprint::record_origins;
 use super::fingerprint::version_for_toml;
 use super::key_aliases::normalized_with_key_aliases;
 use super::merge::merge_toml_values;
+use crate::ProfileV2Name;
 use codex_app_server_protocol::ConfigLayer;
 use codex_app_server_protocol::ConfigLayerMetadata;
 use codex_app_server_protocol::ConfigLayerSource;
 use codex_utils_absolute_path::AbsolutePathBuf;
 use serde_json::Value as JsonValue;
 use std::collections::HashMap;
+use std::path::Path;
 use std::path::PathBuf;
 use toml::Value as TomlValue;
 
+/// User-facing config loading behavior that is not part of the config document.
+#[derive(Debug, Default, Clone)]
+pub struct ConfigLoadOptions {
+    pub loader_overrides: LoaderOverrides,
+    pub strict_config: bool,
+}
+
+impl From<LoaderOverrides> for ConfigLoadOptions {
+    fn from(loader_overrides: LoaderOverrides) -> Self {
+        Self {
+            loader_overrides,
+            strict_config: false,
+        }
+    }
+}
+
 /// LoaderOverrides overrides managed configuration inputs (primarily for tests).
 #[derive(Debug, Default, Clone)]
 pub struct LoaderOverrides {
+    pub user_config_path: Option<AbsolutePathBuf>,
+    pub user_config_profile: Option<ProfileV2Name>,
     pub managed_config_path: Option<PathBuf>,
     pub system_config_path: Option<PathBuf>,
     pub system_requirements_path: Option<PathBuf>,
@@ -36,6 +56,8 @@ impl LoaderOverrides {
     pub fn without_managed_config_for_tests() -> Self {
         let base = std::env::temp_dir().join("codex-config-tests");
         Self {
+            user_config_path: None,
+            user_config_profile: None,
             managed_config_path: Some(base.join("managed_config.toml")),
             system_config_path: Some(base.join("config.toml")),
             system_requirements_path: Some(base.join("requirements.toml")),
@@ -53,10 +75,22 @@ impl LoaderOverrides {
     /// This is intended for tests that supply an explicit managed config fixture.
     pub fn with_managed_config_path_for_tests(managed_config_path: PathBuf) -> Self {
         Self {
+            user_config_path: None,
+            user_config_profile: None,
             managed_config_path: Some(managed_config_path),
             ..Self::without_managed_config_for_tests()
         }
     }
+
+    pub fn user_config_path(&self, codex_home: &Path) -> std::io::Result<AbsolutePathBuf> {
+        match self.user_config_path.as_ref() {
+            Some(path) => Ok(path.clone()),
+            None => Ok(AbsolutePathBuf::resolve_path_against_base(
+                crate::CONFIG_TOML_FILE,
+                codex_home,
+            )),
+        }
+    }
 }
 
 #[derive(Debug, Clone, PartialEq)]
@@ -147,7 +181,7 @@ impl ConfigLayerEntry {
         match &self.name {
             ConfigLayerSource::Mdm { .. } => None,
             ConfigLayerSource::System { file } => file.parent(),
-            ConfigLayerSource::User { file } => file.parent(),
+            ConfigLayerSource::User { file, .. } => file.parent(),
             ConfigLayerSource::Project { dot_codex_folder } => Some(dot_codex_folder.clone()),
             ConfigLayerSource::SessionFlags => None,
             ConfigLayerSource::LegacyManagedConfigTomlFromFile { .. } => None,
@@ -180,7 +214,12 @@ pub struct ConfigLayerStack {
     /// later entries in the Vec override earlier ones.
     layers: Vec<ConfigLayerEntry>,
 
-    /// Index into [layers] of the user config layer, if any.
+    /// Index into [layers] of the active user config layer, if any.
+    ///
+    /// When profile config is active, there can be more than one user layer:
+    /// the base `$CODEX_HOME/config.toml` layer followed by the profile override
+    /// layer. This index points at the highest-precedence user layer because that
+    /// is the writable layer for profile-aware edits.
     user_layer_index: Option<usize>,
 
     /// Constraints that must be enforced when deriving a [Config] from the
@@ -240,14 +279,61 @@ impl ConfigLayerStack {
         self.startup_warnings.as_deref()
     }
 
-    /// Returns the raw user config layer, if any.
+    /// Returns the active raw user config layer, if any.
     ///
-    /// This does not merge other config layers or apply any requirements.
-    pub fn get_user_layer(&self) -> Option<&ConfigLayerEntry> {
+    /// This does not merge other config layers or apply any requirements. When
+    /// a profile-v2 layer is active, this returns that profile layer rather than
+    /// the base `$CODEX_HOME/config.toml` layer because the active layer is the
+    /// writable target for profile-aware edits.
+    pub fn get_active_user_layer(&self) -> Option<&ConfigLayerEntry> {
         self.user_layer_index
             .and_then(|index| self.layers.get(index))
     }
 
+    pub fn get_user_config_file(&self) -> Option<&AbsolutePathBuf> {
+        let layer = self.get_active_user_layer()?;
+        let ConfigLayerSource::User { file, .. } = &layer.name else {
+            return None;
+        };
+        Some(file)
+    }
+
+    /// Returns all user config layers in the requested precedence order.
+    ///
+    /// With profile-v2 enabled, `LowestPrecedenceFirst` returns the base user
+    /// config before the profile overlay, while `HighestPrecedenceFirst` returns
+    /// the profile overlay before the base user config.
+    pub fn get_user_layers(
+        &self,
+        ordering: ConfigLayerStackOrdering,
+        include_disabled: bool,
+    ) -> Vec<&ConfigLayerEntry> {
+        self.get_layers(ordering, include_disabled)
+            .into_iter()
+            .filter(|layer| matches!(layer.name, ConfigLayerSource::User { .. }))
+            .collect()
+    }
+
+    /// Returns the merged config from enabled user layers only.
+    ///
+    /// When profile config is active, this includes the base user config followed
+    /// by the profile override config.
+    pub fn effective_user_config(&self) -> Option<TomlValue> {
+        let user_layers = self.get_user_layers(
+            ConfigLayerStackOrdering::LowestPrecedenceFirst,
+            /*include_disabled*/ false,
+        );
+        if user_layers.is_empty() {
+            return None;
+        }
+
+        let mut merged = TomlValue::Table(toml::map::Map::new());
+        for layer in user_layers {
+            merge_toml_values(&mut merged, &layer.config);
+        }
+        Some(merged)
+    }
+
     pub fn requirements(&self) -> &ConfigRequirements {
         &self.requirements
     }
@@ -256,54 +342,101 @@ impl ConfigLayerStack {
         &self.requirements_toml
     }
 
-    /// Creates a new [ConfigLayerStack] using the specified values to inject a
-    /// "user layer" into the stack. If such a layer already exists, it is
-    /// replaced; otherwise, it is inserted into the stack at the appropriate
-    /// position based on precedence rules.
+    /// Creates a new [ConfigLayerStack] using the specified values to inject one
+    /// user layer into the stack. If such a layer already exists, it is replaced;
+    /// otherwise, it is inserted into the stack at the appropriate position
+    /// based on precedence rules. When the stack has both base and profile-v2
+    /// user layers, this updates only the layer whose file matches
+    /// `config_toml`.
     pub fn with_user_config(&self, config_toml: &AbsolutePathBuf, user_config: TomlValue) -> Self {
-        self.with_user_layer(Some(ConfigLayerEntry::new(
+        let profile = self.layers.iter().find_map(|layer| match &layer.name {
+            ConfigLayerSource::User { file, profile } if file == config_toml => profile
+                .as_deref()
+                .and_then(|profile| profile.parse::<ProfileV2Name>().ok()),
+            _ => None,
+        });
+        self.with_user_config_profile(config_toml, profile.as_ref(), user_config)
+    }
+
+    pub fn with_user_config_profile(
+        &self,
+        config_toml: &AbsolutePathBuf,
+        profile: Option<&ProfileV2Name>,
+        user_config: TomlValue,
+    ) -> Self {
+        let user_layer = ConfigLayerEntry::new(
             ConfigLayerSource::User {
                 file: config_toml.clone(),
+                profile: profile.map(ToString::to_string),
             },
             user_config,
-        )))
+        );
+
+        let mut layers = self.layers.clone();
+        if let Some(index) = layers.iter().position(|layer| {
+            matches!(
+                &layer.name,
+                ConfigLayerSource::User { file, .. } if file == config_toml
+            )
+        }) {
+            layers.remove(index);
+        }
+        match layers
+            .iter()
+            .position(|layer| layer.name.precedence() > user_layer.name.precedence())
+        {
+            Some(index) => layers.insert(index, user_layer),
+            None => layers.push(user_layer),
+        }
+        let user_layer_index = layers.iter().enumerate().rev().find_map(|(index, layer)| {
+            if matches!(layer.name, ConfigLayerSource::User { .. }) {
+                Some(index)
+            } else {
+                None
+            }
+        });
+        Self {
+            layers,
+            user_layer_index,
+            requirements: self.requirements.clone(),
+            requirements_toml: self.requirements_toml.clone(),
+            ignore_user_and_project_exec_policy_rules: self
+                .ignore_user_and_project_exec_policy_rules,
+            startup_warnings: self.startup_warnings.clone(),
+        }
     }
 
     /// Returns a new stack with the user layer copied from `other`, preserving
     /// every non-user layer already present in this stack.
     pub fn with_user_layer_from(&self, other: &Self) -> Self {
-        self.with_user_layer(other.get_user_layer().cloned())
-    }
-
-    fn with_user_layer(&self, user_layer: Option<ConfigLayerEntry>) -> Self {
-        let mut layers = self.layers.clone();
-        let user_layer_index = match (self.user_layer_index, user_layer) {
-            (Some(index), Some(user_layer)) => {
-                layers[index] = user_layer;
-                Some(index)
+        let user_layers = other
+            .layers
+            .iter()
+            .filter(|layer| matches!(layer.name, ConfigLayerSource::User { .. }))
+            .cloned()
+            .collect::<Vec<_>>();
+        let mut layers = self
+            .layers
+            .iter()
+            .filter(|layer| !matches!(layer.name, ConfigLayerSource::User { .. }))
+            .cloned()
+            .collect::<Vec<_>>();
+        for user_layer in user_layers {
+            match layers
+                .iter()
+                .position(|layer| layer.name.precedence() > user_layer.name.precedence())
+            {
+                Some(index) => layers.insert(index, user_layer),
+                None => layers.push(user_layer),
             }
-            (Some(index), None) => {
-                layers.remove(index);
+        }
+        let user_layer_index = layers.iter().enumerate().rev().find_map(|(index, layer)| {
+            if matches!(layer.name, ConfigLayerSource::User { .. }) {
+                Some(index)
+            } else {
                 None
             }
-            (None, Some(user_layer)) => {
-                let user_layer_index = match layers
-                    .iter()
-                    .position(|layer| layer.name.precedence() > user_layer.name.precedence())
-                {
-                    Some(index) => {
-                        layers.insert(index, user_layer);
-                        index
-                    }
-                    None => {
-                        layers.push(user_layer);
-                        layers.len() - 1
-                    }
-                };
-                Some(user_layer_index)
-            }
-            (None, None) => None,
-        };
+        });
         Self {
             layers,
             user_layer_index,
@@ -379,7 +512,7 @@ impl ConfigLayerStack {
 }
 
 /// Ensures precedence ordering of config layers is correct. Returns the index
-/// of the user config layer, if any (at most one should exist).
+/// of the active user config layer, if any.
 fn verify_layer_ordering(layers: &[ConfigLayerEntry]) -> std::io::Result<Option<usize>> {
     if !layers.iter().map(|layer| &layer.name).is_sorted() {
         return Err(std::io::Error::new(
@@ -389,19 +522,13 @@ fn verify_layer_ordering(layers: &[ConfigLayerEntry]) -> std::io::Result<Option<
     }
 
     // The previous check ensured `layers` is sorted by precedence, so now we
-    // further verify that:
-    // 1. There is at most one user config layer.
-    // 2. Project layers are ordered from root to cwd.
+    // further verify that project layers are ordered from root to cwd. Multiple
+    // user layers are allowed so a profile override can layer on top of the base
+    // user config.
     let mut user_layer_index: Option<usize> = None;
     let mut previous_project_dot_codex_folder: Option<&AbsolutePathBuf> = None;
     for (index, layer) in layers.iter().enumerate() {
         if matches!(layer.name, ConfigLayerSource::User { .. }) {
-            if user_layer_index.is_some() {
-                return Err(std::io::Error::new(
-                    std::io::ErrorKind::InvalidData,
-                    "multiple user config layers found",
-                ));
-            }
             user_layer_index = Some(index);
         }
 
diff --git a/codex-rs/config/src/state_tests.rs b/codex-rs/config/src/state_tests.rs
index 81e1fa63fc..fb6e26968b 100644
--- a/codex-rs/config/src/state_tests.rs
+++ b/codex-rs/config/src/state_tests.rs
@@ -1,5 +1,11 @@
 use super::*;
 use pretty_assertions::assert_eq;
+use tempfile::TempDir;
+
+fn test_user_config_path(temp_dir: &TempDir, file_name: &str) -> AbsolutePathBuf {
+    AbsolutePathBuf::from_absolute_path(temp_dir.path().join(file_name))
+        .expect("test user config path should be absolute")
+}
 
 #[test]
 fn origins_use_canonical_key_aliases() {
@@ -32,3 +38,104 @@ no_memories_if_mcp_or_web_search = true
         "legacy key should be canonicalized before origin recording"
     );
 }
+
+#[test]
+fn active_user_layer_is_highest_precedence_user_layer() {
+    let temp_dir = TempDir::new().expect("tempdir");
+    let base_file = test_user_config_path(&temp_dir, "config.toml");
+    let profile_file = test_user_config_path(&temp_dir, "work.config.toml");
+    let base_layer = ConfigLayerEntry::new(
+        ConfigLayerSource::User {
+            file: base_file,
+            profile: None,
+        },
+        toml::from_str(
+            r#"
+model = "base"
+approval_policy = "on-failure"
+"#,
+        )
+        .expect("base config"),
+    );
+    let profile_layer = ConfigLayerEntry::new(
+        ConfigLayerSource::User {
+            file: profile_file.clone(),
+            profile: Some("work".to_string()),
+        },
+        toml::from_str(r#"model = "profile""#).expect("profile config"),
+    );
+    let stack = ConfigLayerStack::new(
+        vec![base_layer, profile_layer],
+        ConfigRequirements::default(),
+        ConfigRequirementsToml::default(),
+    )
+    .expect("multiple user layers should be valid");
+
+    assert_eq!(stack.get_user_config_file(), Some(&profile_file));
+    assert_eq!(
+        stack
+            .effective_user_config()
+            .expect("merged user config")
+            .get("model")
+            .and_then(toml::Value::as_str),
+        Some("profile")
+    );
+    assert_eq!(
+        stack
+            .effective_user_config()
+            .expect("merged user config")
+            .get("approval_policy")
+            .and_then(toml::Value::as_str),
+        Some("on-failure")
+    );
+}
+
+#[test]
+fn with_user_config_updates_matching_user_layer_without_replacing_active_profile() {
+    let temp_dir = TempDir::new().expect("tempdir");
+    let base_file = test_user_config_path(&temp_dir, "config.toml");
+    let profile_file = test_user_config_path(&temp_dir, "work.config.toml");
+    let base_layer = ConfigLayerEntry::new(
+        ConfigLayerSource::User {
+            file: base_file.clone(),
+            profile: None,
+        },
+        toml::from_str(r#"model = "base""#).expect("base config"),
+    );
+    let profile_layer = ConfigLayerEntry::new(
+        ConfigLayerSource::User {
+            file: profile_file.clone(),
+            profile: Some("work".to_string()),
+        },
+        toml::from_str(r#"approval_policy = "on-failure""#).expect("profile config"),
+    );
+    let stack = ConfigLayerStack::new(
+        vec![base_layer, profile_layer],
+        ConfigRequirements::default(),
+        ConfigRequirementsToml::default(),
+    )
+    .expect("multiple user layers should be valid");
+
+    let updated = stack.with_user_config(
+        &base_file,
+        toml::from_str(r#"model = "updated-base""#).expect("updated base config"),
+    );
+
+    assert_eq!(updated.get_user_config_file(), Some(&profile_file));
+    assert_eq!(
+        updated
+            .effective_user_config()
+            .expect("merged user config")
+            .get("model")
+            .and_then(toml::Value::as_str),
+        Some("updated-base")
+    );
+    assert_eq!(
+        updated
+            .effective_user_config()
+            .expect("merged user config")
+            .get("approval_policy")
+            .and_then(toml::Value::as_str),
+        Some("on-failure")
+    );
+}
diff --git a/codex-rs/config/src/strict_config.rs b/codex-rs/config/src/strict_config.rs
new file mode 100644
index 0000000000..fb64458e07
--- /dev/null
+++ b/codex-rs/config/src/strict_config.rs
@@ -0,0 +1,201 @@
+//! Strict config validation built on top of serde's ignored-field tracking.
+
+use crate::diagnostics::ConfigDiagnosticSource;
+use crate::diagnostics::ConfigError;
+use crate::diagnostics::config_error_from_toml_for_source;
+use crate::diagnostics::default_range;
+use crate::diagnostics::span_for_config_path;
+use crate::diagnostics::span_for_toml_key_path;
+use crate::diagnostics::text_range_from_span;
+use codex_features::is_known_feature_key;
+use serde::de::DeserializeOwned;
+use std::path::Path;
+use toml::Value as TomlValue;
+
+pub fn config_error_from_ignored_toml_fields<T: DeserializeOwned>(
+    path: impl AsRef<Path>,
+    contents: &str,
+) -> Option<ConfigError> {
+    let source = ConfigDiagnosticSource::Path(path.as_ref());
+    match toml::from_str::<TomlValue>(contents) {
+        Ok(value) => {
+            config_error_from_ignored_toml_value_fields_for_source::<T>(source, contents, value)
+        }
+        Err(err) => Some(config_error_from_toml_for_source(source, contents, err)),
+    }
+}
+
+pub(crate) fn config_error_from_ignored_toml_value_fields<T: DeserializeOwned>(
+    path: impl AsRef<Path>,
+    contents: &str,
+    value: TomlValue,
+) -> Option<ConfigError> {
+    config_error_from_ignored_toml_value_fields_for_source::<T>(
+        ConfigDiagnosticSource::Path(path.as_ref()),
+        contents,
+        value,
+    )
+}
+
+#[cfg(any(target_os = "macos", test))]
+pub(crate) fn config_error_from_ignored_toml_value_fields_for_source_name<T: DeserializeOwned>(
+    source_name: &str,
+    contents: &str,
+    value: TomlValue,
+) -> Option<ConfigError> {
+    config_error_from_ignored_toml_value_fields_for_source::<T>(
+        ConfigDiagnosticSource::DisplayName(source_name),
+        contents,
+        value,
+    )
+}
+
+fn config_error_from_ignored_toml_value_fields_for_source<T: DeserializeOwned>(
+    source: ConfigDiagnosticSource<'_>,
+    contents: &str,
+    value: TomlValue,
+) -> Option<ConfigError> {
+    let unknown_feature_paths = unknown_feature_toml_value_path(&value);
+    let mut ignored_paths = Vec::new();
+    let mut ignored_callback = |ignored_path: serde_ignored::Path<'_>| {
+        let path_segments = ignored_path_segments(&ignored_path);
+        if !path_segments.is_empty() {
+            ignored_paths.push(path_segments);
+        }
+    };
+    let deserializer = serde_ignored::Deserializer::new(value, &mut ignored_callback);
+    let result: Result<T, _> = serde_path_to_error::deserialize(deserializer);
+
+    match result {
+        Ok(_) => unknown_field_error_from_paths(source, contents, ignored_paths)
+            .or_else(|| unknown_field_error_from_paths(source, contents, unknown_feature_paths)),
+        Err(err) => {
+            let path_hint = err.path().clone();
+            let toml_err = err.into_inner();
+            let range = span_for_config_path(contents, &path_hint)
+                .or_else(|| toml_err.span())
+                .map(|span| text_range_from_span(contents, span))
+                .unwrap_or_else(default_range);
+            Some(ConfigError::new(
+                source.to_path_buf(),
+                range,
+                toml_err.message(),
+            ))
+        }
+    }
+}
+
+pub(crate) fn ignored_toml_value_field<T: DeserializeOwned>(value: TomlValue) -> Option<String> {
+    let mut ignored_paths = Vec::new();
+    let result: Result<T, _> = serde_ignored::deserialize(value, |ignored_path| {
+        let path_segments = ignored_path_segments(&ignored_path);
+        if !path_segments.is_empty() {
+            ignored_paths.push(path_segments);
+        }
+    });
+    if result.is_err() {
+        return None;
+    }
+
+    ignored_paths
+        .into_iter()
+        .next()
+        .map(|path_segments| path_segments.join("."))
+}
+
+pub(crate) fn unknown_feature_toml_value_field(value: &TomlValue) -> Option<String> {
+    unknown_feature_toml_value_path(value)
+        .into_iter()
+        .next()
+        .map(|path_segments| path_segments.join("."))
+}
+
+fn unknown_field_error_from_paths(
+    source: ConfigDiagnosticSource<'_>,
+    contents: &str,
+    ignored_paths: Vec<Vec<String>>,
+) -> Option<ConfigError> {
+    let path_segments = ignored_paths.into_iter().next()?;
+    let ignored_path = path_segments.join(".");
+    let range = span_for_toml_key_path(contents, &path_segments)
+        .map(|span| text_range_from_span(contents, span))
+        .unwrap_or_else(default_range);
+    Some(ConfigError::new(
+        source.to_path_buf(),
+        range,
+        format!("unknown configuration field `{ignored_path}`"),
+    ))
+}
+
+fn unknown_feature_toml_value_path(value: &TomlValue) -> Vec<Vec<String>> {
+    let Some(root) = value.as_table() else {
+        return Vec::new();
+    };
+
+    let mut paths = Vec::new();
+    push_unknown_feature_paths(&mut paths, &["features"], root.get("features"));
+
+    if let Some(profiles) = root.get("profiles").and_then(TomlValue::as_table) {
+        for (profile_name, profile) in profiles {
+            let prefix = ["profiles", profile_name.as_str(), "features"];
+            let features = profile
+                .as_table()
+                .and_then(|profile| profile.get("features"));
+            push_unknown_feature_paths(&mut paths, &prefix, features);
+        }
+    }
+
+    paths
+}
+
+fn push_unknown_feature_paths(
+    paths: &mut Vec<Vec<String>>,
+    prefix: &[&str],
+    features: Option<&TomlValue>,
+) {
+    let Some(features) = features.and_then(TomlValue::as_table) else {
+        return;
+    };
+
+    for feature_key in features
+        .keys()
+        .map(String::as_str)
+        .filter(|key| !is_known_feature_key(key))
+    {
+        let mut path = prefix
+            .iter()
+            .map(|segment| (*segment).to_string())
+            .collect::<Vec<_>>();
+        path.push(feature_key.to_string());
+        paths.push(path);
+    }
+}
+
+fn ignored_path_segments(path: &serde_ignored::Path<'_>) -> Vec<String> {
+    let mut segments = Vec::new();
+    push_ignored_path_segments(path, &mut segments);
+    segments
+}
+
+fn push_ignored_path_segments(path: &serde_ignored::Path<'_>, segments: &mut Vec<String>) {
+    match path {
+        serde_ignored::Path::Root => {}
+        serde_ignored::Path::Seq { parent, index } => {
+            push_ignored_path_segments(parent, segments);
+            segments.push(index.to_string());
+        }
+        serde_ignored::Path::Map { parent, key } => {
+            push_ignored_path_segments(parent, segments);
+            segments.push(key.clone());
+        }
+        serde_ignored::Path::Some { parent }
+        | serde_ignored::Path::NewtypeStruct { parent }
+        | serde_ignored::Path::NewtypeVariant { parent } => {
+            push_ignored_path_segments(parent, segments);
+        }
+    }
+}
+
+#[cfg(test)]
+#[path = "strict_config_tests.rs"]
+mod tests;
diff --git a/codex-rs/config/src/strict_config_tests.rs b/codex-rs/config/src/strict_config_tests.rs
new file mode 100644
index 0000000000..4d5a62df25
--- /dev/null
+++ b/codex-rs/config/src/strict_config_tests.rs
@@ -0,0 +1,127 @@
+use super::*;
+use crate::config_toml::ConfigToml;
+use crate::diagnostics::TextPosition;
+use crate::diagnostics::TextRange;
+use pretty_assertions::assert_eq;
+use std::path::PathBuf;
+
+#[test]
+fn ignored_toml_field_errors_accept_non_file_source_names() {
+    let source_name = "com.openai.codex:config_toml_base64";
+    let contents = r#"
+model = "gpt-5"
+unknown_key = true"#;
+
+    let value = toml::from_str::<TomlValue>(contents).expect("valid TOML");
+    let error = config_error_from_ignored_toml_value_fields_for_source_name::<ConfigToml>(
+        source_name,
+        contents,
+        value,
+    )
+    .expect("unknown field error");
+
+    assert_eq!(
+        error,
+        ConfigError::new(
+            PathBuf::from(source_name),
+            TextRange {
+                start: TextPosition { line: 3, column: 1 },
+                end: TextPosition {
+                    line: 3,
+                    column: 11,
+                },
+            },
+            "unknown configuration field `unknown_key`",
+        )
+    );
+}
+
+#[test]
+fn type_errors_take_precedence_over_ignored_fields() {
+    let path = Path::new("/tmp/config.toml");
+    let contents = r#"
+model_context_window = "wide"
+unknown_key = true"#;
+
+    let error =
+        config_error_from_ignored_toml_fields::<ConfigToml>(path, contents).expect("type error");
+
+    assert_eq!(
+        error,
+        ConfigError::new(
+            path.to_path_buf(),
+            TextRange {
+                start: TextPosition {
+                    line: 2,
+                    column: 24,
+                },
+                end: TextPosition {
+                    line: 2,
+                    column: 29,
+                },
+            },
+            "invalid type: string \"wide\", expected i64",
+        )
+    );
+}
+
+#[test]
+fn strict_config_rejects_unknown_feature_key() {
+    let path = Path::new("/tmp/config.toml");
+    let contents = r#"
+[features]
+foo = true"#;
+
+    let error = config_error_from_ignored_toml_fields::<ConfigToml>(path, contents)
+        .expect("unknown feature error");
+
+    assert_eq!(
+        error,
+        ConfigError::new(
+            path.to_path_buf(),
+            TextRange {
+                start: TextPosition { line: 3, column: 1 },
+                end: TextPosition { line: 3, column: 3 },
+            },
+            "unknown configuration field `features.foo`",
+        )
+    );
+}
+
+#[test]
+fn strict_config_rejects_unknown_profile_feature_key() {
+    let path = Path::new("/tmp/config.toml");
+    let contents = r#"
+[profiles.work.features]
+foo = true"#;
+
+    let error = config_error_from_ignored_toml_fields::<ConfigToml>(path, contents)
+        .expect("unknown feature error");
+
+    assert_eq!(
+        error,
+        ConfigError::new(
+            path.to_path_buf(),
+            TextRange {
+                start: TextPosition { line: 3, column: 1 },
+                end: TextPosition { line: 3, column: 3 },
+            },
+            "unknown configuration field `profiles.work.features.foo`",
+        )
+    );
+}
+
+#[test]
+fn strict_config_accepts_opaque_desktop_keys() {
+    let path = Path::new("/tmp/config.toml");
+    let contents = r#"
+[desktop]
+appearanceTheme = "dark"
+
+[desktop.workspace]
+collapsed = true"#;
+
+    let error = config_error_from_ignored_toml_fields::<ConfigToml>(path, contents);
+
+    assert_eq!(error, None);
+}
diff --git a/codex-rs/config/src/types.rs b/codex-rs/config/src/types.rs
index 21d9b44752..c7d0a5876b 100644
--- a/codex-rs/config/src/types.rs
+++ b/codex-rs/config/src/types.rs
@@ -7,6 +7,7 @@ pub use crate::mcp_types::AppToolApproval;
 pub use crate::mcp_types::McpServerConfig;
 pub use crate::mcp_types::McpServerDisabledReason;
 pub use crate::mcp_types::McpServerEnvVar;
+pub use crate::mcp_types::McpServerOAuthConfig;
 pub use crate::mcp_types::McpServerToolConfig;
 pub use crate::mcp_types::McpServerTransportConfig;
 pub use crate::mcp_types::RawMcpServerConfig;
@@ -892,8 +893,7 @@ impl From<SandboxWorkspaceWrite> for codex_app_server_protocol::SandboxSettings
     }
 }
 
-/// Policy for building the `env` when spawning a process via either the
-/// `shell` or `local_shell` tool.
+/// Policy for building the `env` when spawning a process via shell-like tools.
 #[derive(Serialize, Deserialize, Debug, Clone, PartialEq, Default, JsonSchema)]
 #[schemars(deny_unknown_fields)]
 pub struct ShellEnvironmentPolicyToml {
diff --git a/codex-rs/connectors/src/filter.rs b/codex-rs/connectors/src/filter.rs
index 82c334f82d..e26291794f 100644
--- a/codex-rs/connectors/src/filter.rs
+++ b/codex-rs/connectors/src/filter.rs
@@ -37,7 +37,6 @@ const DISALLOWED_CONNECTOR_IDS: &[&str] = &[
 ];
 const FIRST_PARTY_CHAT_DISALLOWED_CONNECTOR_IDS: &[&str] =
     &["connector_0f9c9d4592e54d0a9a12b3f44a1e2010"];
-const DISALLOWED_CONNECTOR_PREFIX: &str = "connector_openai_";
 
 pub fn filter_disallowed_connectors(
     connectors: Vec<AppInfo>,
@@ -63,6 +62,166 @@ fn is_connector_id_allowed(connector_id: &str, first_party_chat_originator: bool
         DISALLOWED_CONNECTOR_IDS
     };
 
-    !connector_id.starts_with(DISALLOWED_CONNECTOR_PREFIX)
-        && !disallowed_connector_ids.contains(&connector_id)
+    !disallowed_connector_ids.contains(&connector_id)
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::metadata::connector_install_url;
+    use pretty_assertions::assert_eq;
+
+    fn app(id: &str) -> AppInfo {
+        AppInfo {
+            id: id.to_string(),
+            name: id.to_string(),
+            description: None,
+            logo_url: None,
+            logo_url_dark: None,
+            distribution_channel: None,
+            install_url: None,
+            branding: None,
+            app_metadata: None,
+            labels: None,
+            is_accessible: false,
+            is_enabled: true,
+            plugin_display_names: Vec::new(),
+        }
+    }
+
+    fn named_app(id: &str, name: &str) -> AppInfo {
+        AppInfo {
+            id: id.to_string(),
+            name: name.to_string(),
+            install_url: Some(connector_install_url(name, id)),
+            ..app(id)
+        }
+    }
+
+    #[test]
+    fn filter_disallowed_connectors_allows_non_disallowed_connectors() {
+        let filtered =
+            filter_disallowed_connectors(vec![app("asdk_app_hidden"), app("alpha")], "codex_cli");
+        assert_eq!(filtered, vec![app("asdk_app_hidden"), app("alpha")]);
+    }
+
+    #[test]
+    fn filter_disallowed_connectors_allows_openai_prefix() {
+        let filtered = filter_disallowed_connectors(
+            vec![
+                app("connector_openai_foo"),
+                app("connector_openai_bar"),
+                app("gamma"),
+            ],
+            "codex_cli",
+        );
+        assert_eq!(
+            filtered,
+            vec![
+                app("connector_openai_foo"),
+                app("connector_openai_bar"),
+                app("gamma")
+            ]
+        );
+    }
+
+    #[test]
+    fn filter_disallowed_connectors_filters_disallowed_connector_ids() {
+        let filtered = filter_disallowed_connectors(
+            vec![
+                app("asdk_app_6938a94a61d881918ef32cb999ff937c"),
+                app("connector_3f8d1a79f27c4c7ba1a897ab13bf37dc"),
+                app("delta"),
+            ],
+            "codex_cli",
+        );
+        assert_eq!(filtered, vec![app("delta")]);
+    }
+
+    #[test]
+    fn first_party_chat_originator_filters_target_connector_ids() {
+        let filtered = filter_disallowed_connectors(
+            vec![
+                app("connector_openai_foo"),
+                app("asdk_app_6938a94a61d881918ef32cb999ff937c"),
+                app("connector_0f9c9d4592e54d0a9a12b3f44a1e2010"),
+            ],
+            "codex_atlas",
+        );
+        assert_eq!(
+            filtered,
+            vec![
+                app("connector_openai_foo"),
+                app("asdk_app_6938a94a61d881918ef32cb999ff937c")
+            ]
+        );
+    }
+
+    #[test]
+    fn filter_tool_suggest_discoverable_connectors_keeps_only_plugin_backed_uninstalled_apps() {
+        let filtered = filter_tool_suggest_discoverable_connectors(
+            vec![
+                named_app(
+                    "connector_2128aebfecb84f64a069897515042a44",
+                    "Google Calendar",
+                ),
+                named_app("connector_68df038e0ba48191908c8434991bbac2", "Gmail"),
+                named_app("connector_other", "Other"),
+            ],
+            &[AppInfo {
+                is_accessible: true,
+                ..named_app(
+                    "connector_2128aebfecb84f64a069897515042a44",
+                    "Google Calendar",
+                )
+            }],
+            &HashSet::from([
+                "connector_2128aebfecb84f64a069897515042a44".to_string(),
+                "connector_68df038e0ba48191908c8434991bbac2".to_string(),
+            ]),
+            "codex_cli",
+        );
+
+        assert_eq!(
+            filtered,
+            vec![named_app(
+                "connector_68df038e0ba48191908c8434991bbac2",
+                "Gmail",
+            )]
+        );
+    }
+
+    #[test]
+    fn filter_tool_suggest_discoverable_connectors_excludes_accessible_apps_even_when_disabled() {
+        let filtered = filter_tool_suggest_discoverable_connectors(
+            vec![
+                named_app(
+                    "connector_2128aebfecb84f64a069897515042a44",
+                    "Google Calendar",
+                ),
+                named_app("connector_68df038e0ba48191908c8434991bbac2", "Gmail"),
+            ],
+            &[
+                AppInfo {
+                    is_accessible: true,
+                    ..named_app(
+                        "connector_2128aebfecb84f64a069897515042a44",
+                        "Google Calendar",
+                    )
+                },
+                AppInfo {
+                    is_accessible: true,
+                    is_enabled: false,
+                    ..named_app("connector_68df038e0ba48191908c8434991bbac2", "Gmail")
+                },
+            ],
+            &HashSet::from([
+                "connector_2128aebfecb84f64a069897515042a44".to_string(),
+                "connector_68df038e0ba48191908c8434991bbac2".to_string(),
+            ]),
+            "codex_cli",
+        );
+
+        assert_eq!(filtered, Vec::<AppInfo>::new());
+    }
 }
diff --git a/codex-rs/connectors/src/merge.rs b/codex-rs/connectors/src/merge.rs
index b41ee63add..a8bee18737 100644
--- a/codex-rs/connectors/src/merge.rs
+++ b/codex-rs/connectors/src/merge.rs
@@ -117,3 +117,90 @@ pub fn plugin_connector_to_app_info(connector_id: String) -> AppInfo {
         plugin_display_names: Vec::new(),
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::metadata::connector_install_url;
+    use crate::metadata::connector_mention_slug;
+    use pretty_assertions::assert_eq;
+
+    fn plugin_names(names: &[&str]) -> Vec<String> {
+        names.iter().map(ToString::to_string).collect()
+    }
+
+    fn google_calendar_accessible_connector(plugin_display_names: &[&str]) -> AppInfo {
+        AppInfo {
+            id: "calendar".to_string(),
+            name: "Google Calendar".to_string(),
+            description: Some("Plan events".to_string()),
+            logo_url: Some("https://example.com/logo.png".to_string()),
+            logo_url_dark: Some("https://example.com/logo-dark.png".to_string()),
+            distribution_channel: Some("workspace".to_string()),
+            branding: None,
+            app_metadata: None,
+            labels: None,
+            install_url: None,
+            is_accessible: true,
+            is_enabled: true,
+            plugin_display_names: plugin_names(plugin_display_names),
+        }
+    }
+
+    #[test]
+    fn merge_connectors_replaces_plugin_placeholder_name_with_accessible_name() {
+        let plugin = plugin_connector_to_app_info("calendar".to_string());
+        let accessible = google_calendar_accessible_connector(&[]);
+
+        let merged = merge_connectors(vec![plugin], vec![accessible]);
+
+        assert_eq!(
+            merged,
+            vec![AppInfo {
+                id: "calendar".to_string(),
+                name: "Google Calendar".to_string(),
+                description: Some("Plan events".to_string()),
+                logo_url: Some("https://example.com/logo.png".to_string()),
+                logo_url_dark: Some("https://example.com/logo-dark.png".to_string()),
+                distribution_channel: Some("workspace".to_string()),
+                branding: None,
+                app_metadata: None,
+                labels: None,
+                install_url: Some(connector_install_url("calendar", "calendar")),
+                is_accessible: true,
+                is_enabled: true,
+                plugin_display_names: Vec::new(),
+            }]
+        );
+        assert_eq!(connector_mention_slug(&merged[0]), "google-calendar");
+    }
+
+    #[test]
+    fn merge_connectors_unions_and_dedupes_plugin_display_names() {
+        let mut plugin = plugin_connector_to_app_info("calendar".to_string());
+        plugin.plugin_display_names = plugin_names(&["sample", "alpha", "sample"]);
+
+        let accessible = google_calendar_accessible_connector(&["beta", "alpha"]);
+
+        let merged = merge_connectors(vec![plugin], vec![accessible]);
+
+        assert_eq!(
+            merged,
+            vec![AppInfo {
+                id: "calendar".to_string(),
+                name: "Google Calendar".to_string(),
+                description: Some("Plan events".to_string()),
+                logo_url: Some("https://example.com/logo.png".to_string()),
+                logo_url_dark: Some("https://example.com/logo-dark.png".to_string()),
+                distribution_channel: Some("workspace".to_string()),
+                branding: None,
+                app_metadata: None,
+                labels: None,
+                install_url: Some(connector_install_url("calendar", "calendar")),
+                is_accessible: true,
+                is_enabled: true,
+                plugin_display_names: plugin_names(&["alpha", "beta", "sample"]),
+            }]
+        );
+    }
+}
diff --git a/codex-rs/core-api/src/lib.rs b/codex-rs/core-api/src/lib.rs
index 04ebaf8e7e..e87ee82f30 100644
--- a/codex-rs/core-api/src/lib.rs
+++ b/codex-rs/core-api/src/lib.rs
@@ -58,6 +58,7 @@ pub use codex_models_manager::manager::SharedModelsManager;
 pub use codex_protocol::ThreadId;
 pub use codex_protocol::config_types::AltScreenMode;
 pub use codex_protocol::config_types::ApprovalsReviewer;
+pub use codex_protocol::config_types::AutoCompactTokenLimitScope;
 pub use codex_protocol::config_types::CollaborationModeMask;
 pub use codex_protocol::config_types::ShellEnvironmentPolicy;
 pub use codex_protocol::config_types::WebSearchMode;
diff --git a/codex-rs/core-plugins/Cargo.toml b/codex-rs/core-plugins/Cargo.toml
index 352d6e5714..83df070dd3 100644
--- a/codex-rs/core-plugins/Cargo.toml
+++ b/codex-rs/core-plugins/Cargo.toml
@@ -32,6 +32,7 @@ chrono = { workspace = true }
 dirs = { workspace = true }
 flate2 = { workspace = true }
 reqwest = { workspace = true }
+semver = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
 tar = { workspace = true }
diff --git a/codex-rs/core-plugins/src/installed_marketplaces.rs b/codex-rs/core-plugins/src/installed_marketplaces.rs
index f313a06276..0377fac9ed 100644
--- a/codex-rs/core-plugins/src/installed_marketplaces.rs
+++ b/codex-rs/core-plugins/src/installed_marketplaces.rs
@@ -18,10 +18,10 @@ pub fn installed_marketplace_roots_from_layer_stack(
     config_layer_stack: &ConfigLayerStack,
     codex_home: &Path,
 ) -> Vec<AbsolutePathBuf> {
-    let Some(user_layer) = config_layer_stack.get_user_layer() else {
+    let Some(user_config) = config_layer_stack.effective_user_config() else {
         return Vec::new();
     };
-    let Some(marketplaces_value) = user_layer.config.get("marketplaces") else {
+    let Some(marketplaces_value) = user_config.get("marketplaces") else {
         return Vec::new();
     };
     let Some(marketplaces) = marketplaces_value.as_table() else {
diff --git a/codex-rs/core-plugins/src/loader.rs b/codex-rs/core-plugins/src/loader.rs
index f348a3414d..fc4193aa67 100644
--- a/codex-rs/core-plugins/src/loader.rs
+++ b/codex-rs/core-plugins/src/loader.rs
@@ -378,10 +378,10 @@ fn refresh_non_curated_plugin_cache_with_mode(
 fn configured_plugins_from_stack(
     config_layer_stack: &ConfigLayerStack,
 ) -> HashMap<String, PluginConfig> {
-    let Some(user_layer) = config_layer_stack.get_user_layer() else {
+    let Some(user_config) = config_layer_stack.effective_user_config() else {
         return HashMap::new();
     };
-    configured_plugins_from_user_config_value(&user_layer.config)
+    configured_plugins_from_user_config_value(&user_config)
 }
 
 fn is_full_git_sha(value: &str) -> bool {
@@ -1053,13 +1053,21 @@ fn normalize_plugin_mcp_server_value(
         }
     }
 
-    if let Some(JsonValue::Object(oauth)) = object.remove("oauth")
-        && oauth.contains_key("callbackPort")
-    {
-        warn!(
-            plugin = %plugin_root.display(),
-            "plugin MCP server OAuth callbackPort is ignored; Codex uses global MCP OAuth callback settings"
-        );
+    if let Some(JsonValue::Object(mut oauth)) = object.remove("oauth") {
+        if oauth.remove("callbackPort").is_some() {
+            warn!(
+                plugin = %plugin_root.display(),
+                "plugin MCP server OAuth callbackPort is ignored; Codex uses global MCP OAuth callback settings"
+            );
+        }
+
+        if let Some(client_id) = oauth.remove("clientId") {
+            oauth.entry("client_id".to_string()).or_insert(client_id);
+        }
+
+        if !oauth.is_empty() {
+            object.insert("oauth".to_string(), JsonValue::Object(oauth));
+        }
     }
 
     if let Some(JsonValue::String(cwd)) = object.get("cwd")
diff --git a/codex-rs/core-plugins/src/loader_tests.rs b/codex-rs/core-plugins/src/loader_tests.rs
index d9029c584e..a360d54ccb 100644
--- a/codex-rs/core-plugins/src/loader_tests.rs
+++ b/codex-rs/core-plugins/src/loader_tests.rs
@@ -1,7 +1,69 @@
 use super::*;
 use crate::manifest::load_plugin_manifest;
+use codex_config::ConfigLayerEntry;
+use codex_config::ConfigLayerSource;
+use codex_config::ConfigRequirements;
+use codex_config::ConfigRequirementsToml;
 use codex_plugin::PluginId;
 use pretty_assertions::assert_eq;
+use tempfile::TempDir;
+
+fn user_config_path(temp_dir: &TempDir, file_name: &str) -> AbsolutePathBuf {
+    AbsolutePathBuf::from_absolute_path(temp_dir.path().join(file_name))
+        .expect("test user config path should be absolute")
+}
+
+fn user_layer(path: AbsolutePathBuf, config: &str) -> ConfigLayerEntry {
+    ConfigLayerEntry::new(
+        ConfigLayerSource::User {
+            file: path,
+            profile: None,
+        },
+        toml::from_str(config).expect("user config toml"),
+    )
+}
+
+#[test]
+fn configured_plugins_from_stack_merges_user_layers() {
+    let temp_dir = TempDir::new().expect("tempdir");
+    let stack = ConfigLayerStack::new(
+        vec![
+            user_layer(
+                user_config_path(&temp_dir, "config.toml"),
+                "[plugins.base]\nenabled = true\n",
+            ),
+            user_layer(
+                user_config_path(&temp_dir, "work.config.toml"),
+                "[plugins.profile]\nenabled = false\n",
+            ),
+        ],
+        ConfigRequirements::default(),
+        ConfigRequirementsToml::default(),
+    )
+    .expect("valid config layer stack");
+
+    let plugins = configured_plugins_from_stack(&stack);
+
+    assert_eq!(
+        plugins,
+        HashMap::from([
+            (
+                "base".to_string(),
+                PluginConfig {
+                    enabled: true,
+                    mcp_servers: HashMap::new(),
+                },
+            ),
+            (
+                "profile".to_string(),
+                PluginConfig {
+                    enabled: false,
+                    mcp_servers: HashMap::new(),
+                },
+            ),
+        ])
+    );
+}
 
 #[test]
 fn plugin_mcp_file_supports_mcp_servers_object_format() {
diff --git a/codex-rs/core-plugins/src/manager.rs b/codex-rs/core-plugins/src/manager.rs
index 2df35b401f..56b8c18bda 100644
--- a/codex-rs/core-plugins/src/manager.rs
+++ b/codex-rs/core-plugins/src/manager.rs
@@ -37,6 +37,7 @@ use crate::marketplace_upgrade::configured_git_marketplace_names;
 use crate::marketplace_upgrade::upgrade_configured_git_marketplaces;
 use crate::remote::RemoteInstalledPlugin;
 use crate::remote::RemotePluginCatalogError;
+use crate::remote::RemotePluginScope;
 use crate::remote::RemotePluginServiceConfig;
 use crate::remote_legacy::RemotePluginFetchError;
 use crate::remote_legacy::RemotePluginMutationError;
@@ -494,7 +495,7 @@ impl PluginsManager {
 
         let outcome = load_plugins_from_layer_stack(
             &config.config_layer_stack,
-            self.remote_installed_plugin_configs(config),
+            self.remote_installed_plugin_configs(),
             &self.store,
             self.restriction_product,
             plugin_hooks_enabled,
@@ -542,7 +543,7 @@ impl PluginsManager {
         }
         load_plugins_from_layer_stack(
             config_layer_stack,
-            self.remote_installed_plugin_configs(config),
+            self.remote_installed_plugin_configs(),
             &self.store,
             self.restriction_product,
             plugin_hooks_feature_enabled,
@@ -585,14 +586,7 @@ impl PluginsManager {
         }
     }
 
-    fn remote_installed_plugin_configs(
-        &self,
-        config: &PluginsConfigInput,
-    ) -> HashMap<String, PluginConfig> {
-        if !config.remote_plugin_enabled {
-            return HashMap::new();
-        }
-
+    fn remote_installed_plugin_configs(&self) -> HashMap<String, PluginConfig> {
         let cache = match self.remote_installed_plugins_cache.read() {
             Ok(cache) => cache,
             Err(err) => err.into_inner(),
@@ -604,6 +598,39 @@ impl PluginsManager {
         remote_installed_plugins_to_config(plugins, &self.store)
     }
 
+    pub fn build_remote_installed_plugin_marketplaces_from_cache(
+        &self,
+        visible_scopes: &[RemotePluginScope],
+    ) -> Option<Vec<crate::remote::RemoteMarketplace>> {
+        let cache = match self.remote_installed_plugins_cache.read() {
+            Ok(cache) => cache,
+            Err(err) => err.into_inner(),
+        };
+        let plugins = cache.as_ref()?;
+        Some(crate::remote::group_remote_installed_plugins_by_marketplaces(plugins, visible_scopes))
+    }
+
+    pub async fn build_and_cache_remote_installed_plugin_marketplaces(
+        &self,
+        config: &PluginsConfigInput,
+        auth: Option<&CodexAuth>,
+        visible_scopes: &[RemotePluginScope],
+        on_effective_plugins_changed: Option<Arc<dyn Fn() + Send + Sync + 'static>>,
+    ) -> Result<Vec<crate::remote::RemoteMarketplace>, RemotePluginCatalogError> {
+        let plugins = crate::remote::fetch_remote_installed_plugins(
+            &remote_plugin_service_config(config),
+            auth,
+        )
+        .await?;
+        let marketplaces =
+            crate::remote::group_remote_installed_plugins_by_marketplaces(&plugins, visible_scopes);
+        let changed = self.write_remote_installed_plugins_cache(plugins);
+        if changed && let Some(on_effective_plugins_changed) = on_effective_plugins_changed {
+            on_effective_plugins_changed();
+        }
+        Ok(marketplaces)
+    }
+
     fn write_remote_installed_plugins_cache(&self, plugins: Vec<RemoteInstalledPlugin>) -> bool {
         let mut cache = match self.remote_installed_plugins_cache.write() {
             Ok(cache) => cache,
@@ -667,7 +694,7 @@ impl PluginsManager {
         notify: RemoteInstalledPluginsCacheRefreshNotify,
         on_effective_plugins_changed: Option<Arc<dyn Fn() + Send + Sync + 'static>>,
     ) {
-        if !config.plugins_enabled || !config.remote_plugin_enabled {
+        if !config.plugins_enabled {
             return;
         }
 
@@ -681,13 +708,13 @@ impl PluginsManager {
         );
     }
 
-    fn maybe_start_remote_installed_plugin_bundle_sync(
+    pub fn maybe_start_remote_installed_plugin_bundle_sync(
         self: &Arc<Self>,
         config: &PluginsConfigInput,
         auth: Option<CodexAuth>,
         on_effective_plugins_changed: Option<Arc<dyn Fn() + Send + Sync + 'static>>,
     ) {
-        if !config.plugins_enabled || !config.remote_plugin_enabled {
+        if !config.plugins_enabled {
             return;
         }
 
@@ -1504,25 +1531,23 @@ impl PluginsManager {
                 auth_manager.clone(),
             );
 
-            if config.remote_plugin_enabled {
-                let config = config.clone();
-                let manager = Arc::clone(self);
-                let auth_manager = auth_manager.clone();
-                let on_effective_plugins_changed = on_effective_plugins_changed.clone();
-                tokio::spawn(async move {
-                    let auth = auth_manager.auth().await;
-                    manager.maybe_start_remote_installed_plugins_cache_refresh(
-                        &config,
-                        auth.clone(),
-                        on_effective_plugins_changed.clone(),
-                    );
-                    manager.maybe_start_remote_installed_plugin_bundle_sync(
-                        &config,
-                        auth,
-                        on_effective_plugins_changed,
-                    );
-                });
-            }
+            let config_for_remote_sync = config.clone();
+            let manager = Arc::clone(self);
+            let auth_manager_for_remote_sync = auth_manager.clone();
+            let on_effective_plugins_changed = on_effective_plugins_changed.clone();
+            tokio::spawn(async move {
+                let auth = auth_manager_for_remote_sync.auth().await;
+                manager.maybe_start_remote_installed_plugins_cache_refresh(
+                    &config_for_remote_sync,
+                    auth.clone(),
+                    on_effective_plugins_changed.clone(),
+                );
+                manager.maybe_start_remote_installed_plugin_bundle_sync(
+                    &config_for_remote_sync,
+                    auth,
+                    on_effective_plugins_changed,
+                );
+            });
 
             let config = config.clone();
             let manager = Arc::clone(self);
@@ -2006,10 +2031,10 @@ pub(crate) fn configured_plugins_from_stack(
     config_layer_stack: &ConfigLayerStack,
 ) -> HashMap<String, PluginConfig> {
     // Plugin entries remain persisted user config only.
-    let Some(user_layer) = config_layer_stack.get_user_layer() else {
+    let Some(user_config) = config_layer_stack.effective_user_config() else {
         return HashMap::new();
     };
-    configured_plugins_from_user_config_value(&user_layer.config)
+    configured_plugins_from_user_config_value(&user_config)
 }
 
 fn configured_plugins_from_user_config_value(
diff --git a/codex-rs/core-plugins/src/manager_tests.rs b/codex-rs/core-plugins/src/manager_tests.rs
index d04852ea13..791a143c4f 100644
--- a/codex-rs/core-plugins/src/manager_tests.rs
+++ b/codex-rs/core-plugins/src/manager_tests.rs
@@ -7,6 +7,7 @@ use crate::loader::refresh_non_curated_plugin_cache;
 use crate::loader::refresh_non_curated_plugin_cache_force_reinstall;
 use crate::marketplace::MarketplacePluginInstallPolicy;
 use crate::remote::RemoteInstalledPlugin;
+use crate::remote::RemotePluginScope;
 use crate::startup_sync::curated_plugins_repo_path;
 use crate::test_support::TEST_CURATED_PLUGIN_CACHE_VERSION;
 use crate::test_support::TEST_CURATED_PLUGIN_SHA;
@@ -22,6 +23,7 @@ use codex_config::ConfigLayerStack;
 use codex_config::ConfigRequirements;
 use codex_config::ConfigRequirementsToml;
 use codex_config::McpServerConfig;
+use codex_config::McpServerOAuthConfig;
 use codex_config::McpServerToolConfig;
 use codex_config::types::McpServerTransportConfig;
 use codex_login::CodexAuth;
@@ -146,6 +148,20 @@ async fn load_config(codex_home: &Path, cwd: &Path) -> PluginsConfigInput {
     load_plugins_config_input(codex_home, cwd).await
 }
 
+fn remote_installed_linear_plugin() -> RemoteInstalledPlugin {
+    RemoteInstalledPlugin {
+        marketplace_name: "chatgpt-global".to_string(),
+        id: "plugins~Plugin_linear".to_string(),
+        name: "linear".to_string(),
+        enabled: true,
+        install_policy: codex_app_server_protocol::PluginInstallPolicy::Available,
+        auth_policy: codex_app_server_protocol::PluginAuthPolicy::OnUse,
+        availability: codex_app_server_protocol::PluginAvailability::Available,
+        interface: None,
+        keywords: Vec::new(),
+    }
+}
+
 #[tokio::test]
 async fn load_plugins_loads_default_skills_and_mcp_servers() {
     let codex_home = TempDir::new().unwrap();
@@ -230,6 +246,9 @@ async fn load_plugins_loads_default_skills_and_mcp_servers() {
                     enabled_tools: None,
                     disabled_tools: None,
                     scopes: None,
+                    oauth: Some(McpServerOAuthConfig {
+                        client_id: Some("client-id".to_string()),
+                    }),
                     oauth_resource: None,
                     tools: HashMap::new(),
                 },
@@ -330,39 +349,6 @@ approval_mode = "approve"
     );
 }
 
-#[tokio::test]
-async fn remote_installed_cache_adds_plugin_skill_roots_without_marketplace_config() {
-    let codex_home = TempDir::new().unwrap();
-    let plugin_base = codex_home
-        .path()
-        .join("plugins/cache/chatgpt-global/linear");
-    write_plugin(&plugin_base, "local", "linear");
-    write_file(
-        &codex_home.path().join(CONFIG_TOML_FILE),
-        r#"[features]
-plugins = true
-remote_plugin = true
-"#,
-    );
-
-    let config = load_config(codex_home.path(), codex_home.path()).await;
-    let manager = PluginsManager::new(codex_home.path().to_path_buf());
-    manager.write_remote_installed_plugins_cache(vec![RemoteInstalledPlugin {
-        marketplace_name: "chatgpt-global".to_string(),
-        id: "plugins~Plugin_linear".to_string(),
-        name: "linear".to_string(),
-        enabled: true,
-    }]);
-
-    let outcome = manager.plugins_for_config(&config).await;
-    assert_eq!(
-        outcome.effective_skill_roots(),
-        vec![AbsolutePathBuf::try_from(plugin_base.join("local/skills")).unwrap()]
-    );
-    assert_eq!(outcome.plugins().len(), 1);
-    assert_eq!(outcome.plugins()[0].config_name, "linear@chatgpt-global");
-}
-
 #[tokio::test]
 async fn remote_installed_cache_ignores_plugins_missing_local_cache() {
     let codex_home = TempDir::new().unwrap();
@@ -376,17 +362,85 @@ remote_plugin = true
 
     let config = load_config(codex_home.path(), codex_home.path()).await;
     let manager = PluginsManager::new(codex_home.path().to_path_buf());
-    manager.write_remote_installed_plugins_cache(vec![RemoteInstalledPlugin {
-        marketplace_name: "chatgpt-global".to_string(),
-        id: "plugins~Plugin_linear".to_string(),
-        name: "linear".to_string(),
-        enabled: true,
-    }]);
+    manager.write_remote_installed_plugins_cache(vec![remote_installed_linear_plugin()]);
 
     let outcome = manager.plugins_for_config(&config).await;
     assert_eq!(outcome, PluginLoadOutcome::default());
 }
 
+#[tokio::test]
+async fn build_remote_installed_plugin_marketplaces_from_cache_uses_remote_metadata() {
+    let codex_home = TempDir::new().unwrap();
+    let manager = PluginsManager::new(codex_home.path().to_path_buf());
+    let mut plugin = remote_installed_linear_plugin();
+    plugin.install_policy = codex_app_server_protocol::PluginInstallPolicy::InstalledByDefault;
+    plugin.auth_policy = codex_app_server_protocol::PluginAuthPolicy::OnInstall;
+    plugin.interface = Some(codex_app_server_protocol::PluginInterface {
+        display_name: Some("Linear".to_string()),
+        short_description: Some("Track remote work".to_string()),
+        long_description: None,
+        developer_name: None,
+        category: None,
+        capabilities: Vec::new(),
+        website_url: None,
+        privacy_policy_url: None,
+        terms_of_service_url: None,
+        default_prompt: None,
+        brand_color: Some("#111111".to_string()),
+        composer_icon: None,
+        composer_icon_url: None,
+        logo: None,
+        logo_url: None,
+        screenshots: Vec::new(),
+        screenshot_urls: Vec::new(),
+    });
+    plugin.keywords = vec!["issues".to_string()];
+    manager.write_remote_installed_plugins_cache(vec![plugin]);
+
+    let marketplaces = manager
+        .build_remote_installed_plugin_marketplaces_from_cache(&[RemotePluginScope::Global])
+        .expect("remote installed cache should be present");
+    assert_eq!(marketplaces.len(), 1);
+    assert_eq!(marketplaces[0].name, "chatgpt-global");
+    assert_eq!(marketplaces[0].display_name, "ChatGPT Plugins");
+    assert_eq!(marketplaces[0].plugins.len(), 1);
+    let plugin = &marketplaces[0].plugins[0];
+    assert_eq!(plugin.id, "linear@chatgpt-global");
+    assert_eq!(plugin.remote_plugin_id, "plugins~Plugin_linear");
+    assert_eq!(plugin.name, "linear");
+    assert_eq!(plugin.installed, true);
+    assert_eq!(plugin.enabled, true);
+    assert_eq!(
+        plugin.install_policy,
+        codex_app_server_protocol::PluginInstallPolicy::InstalledByDefault
+    );
+    assert_eq!(
+        plugin.auth_policy,
+        codex_app_server_protocol::PluginAuthPolicy::OnInstall
+    );
+    assert_eq!(plugin.keywords, vec!["issues".to_string()]);
+    assert_eq!(
+        plugin
+            .interface
+            .as_ref()
+            .and_then(|interface| interface.display_name.as_deref()),
+        Some("Linear")
+    );
+    assert_eq!(
+        plugin
+            .interface
+            .as_ref()
+            .and_then(|interface| interface.short_description.as_deref()),
+        Some("Track remote work")
+    );
+    assert_eq!(
+        manager
+            .build_remote_installed_plugin_marketplaces_from_cache(&[RemotePluginScope::Workspace])
+            .expect("remote installed cache should be present"),
+        Vec::new()
+    );
+}
+
 #[tokio::test]
 async fn load_plugins_resolves_disabled_skill_names_against_loaded_plugin_skills() {
     let codex_home = TempDir::new().unwrap();
@@ -695,6 +749,7 @@ async fn load_plugins_uses_manifest_configured_component_paths() {
                 enabled_tools: None,
                 disabled_tools: None,
                 scopes: None,
+                oauth: None,
                 oauth_resource: None,
                 tools: HashMap::new(),
             },
@@ -806,6 +861,7 @@ async fn load_plugins_ignores_manifest_component_paths_without_dot_slash() {
                 enabled_tools: None,
                 disabled_tools: None,
                 scopes: None,
+                oauth: None,
                 oauth_resource: None,
                 tools: HashMap::new(),
             },
@@ -967,6 +1023,7 @@ fn capability_index_filters_inactive_and_zero_capability_plugins() {
         enabled_tools: None,
         disabled_tools: None,
         scopes: None,
+        oauth: None,
         oauth_resource: None,
         tools: HashMap::new(),
     };
diff --git a/codex-rs/core-plugins/src/marketplace_upgrade.rs b/codex-rs/core-plugins/src/marketplace_upgrade.rs
index 81474cf66f..9dda8a9a3e 100644
--- a/codex-rs/core-plugins/src/marketplace_upgrade.rs
+++ b/codex-rs/core-plugins/src/marketplace_upgrade.rs
@@ -108,10 +108,10 @@ fn marketplace_install_root(codex_home: &Path) -> PathBuf {
 fn configured_git_marketplaces(
     config_layer_stack: &ConfigLayerStack,
 ) -> Vec<ConfiguredGitMarketplace> {
-    let Some(user_layer) = config_layer_stack.get_user_layer() else {
+    let Some(user_config) = config_layer_stack.effective_user_config() else {
         return Vec::new();
     };
-    let Some(marketplaces_value) = user_layer.config.get("marketplaces") else {
+    let Some(marketplaces_value) = user_config.get("marketplaces") else {
         return Vec::new();
     };
     let marketplaces = match marketplaces_value
diff --git a/codex-rs/core-plugins/src/remote.rs b/codex-rs/core-plugins/src/remote.rs
index fc6fedbe23..56427473a1 100644
--- a/codex-rs/core-plugins/src/remote.rs
+++ b/codex-rs/core-plugins/src/remote.rs
@@ -27,7 +27,7 @@ pub use remote_installed_plugin_sync::RemoteInstalledPluginBundleSyncError;
 pub use remote_installed_plugin_sync::RemoteInstalledPluginBundleSyncOutcome;
 pub use remote_installed_plugin_sync::RemotePluginCacheMutationGuard;
 pub use remote_installed_plugin_sync::mark_remote_plugin_cache_mutation_in_flight;
-pub use remote_installed_plugin_sync::maybe_start_remote_installed_plugin_bundle_sync;
+pub(crate) use remote_installed_plugin_sync::maybe_start_remote_installed_plugin_bundle_sync;
 pub use remote_installed_plugin_sync::sync_remote_installed_plugin_bundles_once;
 pub use share::RemotePluginShareAccessPolicy;
 pub use share::RemotePluginShareDiscoverability;
@@ -48,6 +48,7 @@ pub use share::update_remote_plugin_share_targets;
 
 pub const REMOTE_GLOBAL_MARKETPLACE_NAME: &str = "chatgpt-global";
 pub const REMOTE_WORKSPACE_MARKETPLACE_NAME: &str = "workspace-directory";
+pub const REMOTE_WORKSPACE_SHARED_WITH_ME_MARKETPLACE_NAME: &str = "workspace-shared-with-me";
 pub const REMOTE_WORKSPACE_SHARED_WITH_ME_PRIVATE_MARKETPLACE_NAME: &str =
     "workspace-shared-with-me-private";
 pub const REMOTE_WORKSPACE_SHARED_WITH_ME_UNLISTED_MARKETPLACE_NAME: &str =
@@ -62,6 +63,28 @@ const REMOTE_PLUGIN_CATALOG_TIMEOUT: Duration = Duration::from_secs(30);
 const REMOTE_PLUGIN_LIST_PAGE_LIMIT: u32 = 200;
 const MAX_REMOTE_DEFAULT_PROMPT_LEN: usize = 128;
 const INVALID_REQUEST_ERROR_CODE: i64 = -32600;
+const REMOTE_INSTALLED_MARKETPLACE_DISPLAY_ORDER: [(&str, &str); 5] = [
+    (
+        REMOTE_GLOBAL_MARKETPLACE_NAME,
+        REMOTE_GLOBAL_MARKETPLACE_DISPLAY_NAME,
+    ),
+    (
+        REMOTE_WORKSPACE_MARKETPLACE_NAME,
+        REMOTE_WORKSPACE_MARKETPLACE_DISPLAY_NAME,
+    ),
+    (
+        REMOTE_WORKSPACE_SHARED_WITH_ME_MARKETPLACE_NAME,
+        REMOTE_WORKSPACE_SHARED_WITH_ME_PRIVATE_MARKETPLACE_DISPLAY_NAME,
+    ),
+    (
+        REMOTE_WORKSPACE_SHARED_WITH_ME_PRIVATE_MARKETPLACE_NAME,
+        REMOTE_WORKSPACE_SHARED_WITH_ME_PRIVATE_MARKETPLACE_DISPLAY_NAME,
+    ),
+    (
+        REMOTE_WORKSPACE_SHARED_WITH_ME_UNLISTED_MARKETPLACE_NAME,
+        REMOTE_WORKSPACE_SHARED_WITH_ME_UNLISTED_MARKETPLACE_DISPLAY_NAME,
+    ),
+];
 
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct RemotePluginServiceConfig {
@@ -88,6 +111,11 @@ pub struct RemoteInstalledPlugin {
     pub id: String,
     pub name: String,
     pub enabled: bool,
+    pub install_policy: PluginInstallPolicy,
+    pub auth_policy: PluginAuthPolicy,
+    pub availability: PluginAvailability,
+    pub interface: Option<PluginInterface>,
+    pub keywords: Vec<String>,
 }
 
 #[derive(Debug, Clone, PartialEq)]
@@ -263,7 +291,7 @@ pub enum RemotePluginCatalogError {
 }
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash, Deserialize)]
-enum RemotePluginScope {
+pub enum RemotePluginScope {
     #[serde(rename = "GLOBAL")]
     Global,
     #[serde(rename = "WORKSPACE")]
@@ -296,6 +324,7 @@ impl RemotePluginScope {
         match name {
             REMOTE_GLOBAL_MARKETPLACE_NAME => Some(Self::Global),
             REMOTE_WORKSPACE_MARKETPLACE_NAME
+            | REMOTE_WORKSPACE_SHARED_WITH_ME_MARKETPLACE_NAME
             | REMOTE_WORKSPACE_SHARED_WITH_ME_PRIVATE_MARKETPLACE_NAME
             | REMOTE_WORKSPACE_SHARED_WITH_ME_UNLISTED_MARKETPLACE_NAME => Some(Self::Workspace),
             _ => None,
@@ -397,11 +426,9 @@ fn remote_plugin_canonical_marketplace_name(
         RemotePluginScope::Global => Ok(REMOTE_GLOBAL_MARKETPLACE_NAME),
         RemotePluginScope::Workspace => match workspace_plugin_discoverability(plugin)? {
             RemotePluginShareDiscoverability::Listed => Ok(REMOTE_WORKSPACE_MARKETPLACE_NAME),
-            RemotePluginShareDiscoverability::Unlisted => {
-                Ok(REMOTE_WORKSPACE_SHARED_WITH_ME_UNLISTED_MARKETPLACE_NAME)
-            }
-            RemotePluginShareDiscoverability::Private => {
-                Ok(REMOTE_WORKSPACE_SHARED_WITH_ME_PRIVATE_MARKETPLACE_NAME)
+            RemotePluginShareDiscoverability::Private
+            | RemotePluginShareDiscoverability::Unlisted => {
+                Ok(REMOTE_WORKSPACE_SHARED_WITH_ME_MARKETPLACE_NAME)
             }
         },
     }
@@ -505,20 +532,29 @@ pub async fn fetch_remote_marketplaces(
                 }
             }
             RemoteMarketplaceSource::SharedWithMe => {
-                let private_plugins = fetch_shared_workspace_plugins(config, auth)
-                    .await?
+                // The shared endpoint is the source of truth for plugins explicitly shared
+                // with the user. Installed unlisted plugins that are not returned there are
+                // link-installed and stay in the separate unlisted bucket.
+                let shared_plugins = fetch_shared_workspace_plugins(config, auth).await?;
+                let shared_plugin_ids = shared_plugins
+                    .iter()
+                    .map(|plugin| plugin.id.clone())
+                    .collect::<BTreeSet<_>>();
+                let directly_shared_plugins = shared_plugins
                     .into_iter()
                     .filter_map(|plugin| match workspace_plugin_discoverability(&plugin) {
-                        Ok(RemotePluginShareDiscoverability::Private) => Some(Ok(plugin)),
-                        Ok(RemotePluginShareDiscoverability::Listed)
-                        | Ok(RemotePluginShareDiscoverability::Unlisted) => None,
+                        Ok(
+                            RemotePluginShareDiscoverability::Private
+                            | RemotePluginShareDiscoverability::Unlisted,
+                        ) => Some(Ok(plugin)),
+                        Ok(RemotePluginShareDiscoverability::Listed) => None,
                         Err(err) => Some(Err(err)),
                     })
                     .collect::<Result<Vec<_>, _>>()?;
                 if let Some(marketplace) = build_remote_marketplace(
                     REMOTE_WORKSPACE_SHARED_WITH_ME_PRIVATE_MARKETPLACE_NAME,
                     REMOTE_WORKSPACE_SHARED_WITH_ME_PRIVATE_MARKETPLACE_DISPLAY_NAME,
-                    private_plugins,
+                    directly_shared_plugins,
                     workspace_installed_plugins.clone().unwrap_or_default(),
                     /*include_installed_only*/ false,
                 )? {
@@ -531,7 +567,12 @@ pub async fn fetch_remote_marketplaces(
                     .into_iter()
                     .filter_map(
                         |plugin| match workspace_plugin_discoverability(&plugin.plugin) {
-                            Ok(RemotePluginShareDiscoverability::Unlisted) => Some(Ok(plugin)),
+                            Ok(RemotePluginShareDiscoverability::Unlisted)
+                                if !shared_plugin_ids.contains(&plugin.plugin.id) =>
+                            {
+                                Some(Ok(plugin))
+                            }
+                            Ok(RemotePluginShareDiscoverability::Unlisted) => None,
                             Ok(RemotePluginShareDiscoverability::Listed)
                             | Ok(RemotePluginShareDiscoverability::Private) => None,
                             Err(err) => Some(Err(err)),
@@ -594,13 +635,7 @@ fn build_remote_marketplace(
         })
         .map(|(plugin, installed_plugin)| build_remote_plugin_summary(plugin, installed_plugin))
         .collect::<Result<Vec<_>, _>>()?;
-    plugins.sort_by(|left, right| {
-        remote_plugin_display_name(left)
-            .to_ascii_lowercase()
-            .cmp(&remote_plugin_display_name(right).to_ascii_lowercase())
-            .then_with(|| remote_plugin_display_name(left).cmp(remote_plugin_display_name(right)))
-            .then_with(|| left.id.cmp(&right.id))
-    });
+    sort_remote_plugin_summaries_by_display_name(&mut plugins);
     Ok(Some(RemoteMarketplace {
         name: name.to_string(),
         display_name: display_name.to_string(),
@@ -608,7 +643,7 @@ fn build_remote_marketplace(
     }))
 }
 
-pub async fn fetch_remote_installed_plugins(
+pub(crate) async fn fetch_remote_installed_plugins(
     config: &RemotePluginServiceConfig,
     auth: Option<&CodexAuth>,
 ) -> Result<Vec<RemoteInstalledPlugin>, RemotePluginCatalogError> {
@@ -628,7 +663,7 @@ pub async fn fetch_remote_installed_plugins(
     let mut installed_plugins = [global, workspace]
         .into_iter()
         .flat_map(|(_scope, plugins)| plugins)
-        .map(|plugin| remote_installed_plugin_to_info(&plugin))
+        .map(|plugin| remote_installed_plugin_to_cache_entry(&plugin))
         .collect::<Result<Vec<_>, _>>()?;
     installed_plugins.sort_by(|left, right| {
         left.marketplace_name
@@ -638,6 +673,55 @@ pub async fn fetch_remote_installed_plugins(
     Ok(installed_plugins)
 }
 
+pub fn group_remote_installed_plugins_by_marketplaces(
+    plugins: &[RemoteInstalledPlugin],
+    visible_scopes: &[RemotePluginScope],
+) -> Vec<RemoteMarketplace> {
+    let mut plugins_by_marketplace = BTreeMap::<String, Vec<RemotePluginSummary>>::new();
+
+    for plugin in plugins {
+        if !RemotePluginScope::from_marketplace_name(&plugin.marketplace_name)
+            .is_some_and(|scope| visible_scopes.contains(&scope))
+        {
+            continue;
+        }
+        let Ok(plugin_id) = PluginId::new(plugin.name.clone(), plugin.marketplace_name.clone())
+        else {
+            continue;
+        };
+        let plugin_summary = RemotePluginSummary {
+            id: plugin_id.as_key(),
+            remote_plugin_id: plugin.id.clone(),
+            name: plugin.name.clone(),
+            share_context: None,
+            installed: true,
+            enabled: plugin.enabled,
+            install_policy: plugin.install_policy,
+            auth_policy: plugin.auth_policy,
+            availability: plugin.availability,
+            interface: plugin.interface.clone(),
+            keywords: plugin.keywords.clone(),
+        };
+        plugins_by_marketplace
+            .entry(plugin.marketplace_name.clone())
+            .or_default()
+            .push(plugin_summary);
+    }
+
+    REMOTE_INSTALLED_MARKETPLACE_DISPLAY_ORDER
+        .into_iter()
+        .filter_map(|(marketplace_name, display_name)| {
+            let mut marketplace_plugins = plugins_by_marketplace.remove(marketplace_name)?;
+            sort_remote_plugin_summaries_by_display_name(&mut marketplace_plugins);
+            Some(RemoteMarketplace {
+                name: marketplace_name.to_string(),
+                display_name: display_name.to_string(),
+                plugins: marketplace_plugins,
+            })
+        })
+        .collect()
+}
+
 pub async fn fetch_remote_plugin_detail(
     config: &RemotePluginServiceConfig,
     auth: Option<&CodexAuth>,
@@ -968,7 +1052,7 @@ fn remote_plugin_share_context(
     }
 }
 
-fn remote_installed_plugin_to_info(
+fn remote_installed_plugin_to_cache_entry(
     installed_plugin: &RemotePluginInstalledItem,
 ) -> Result<RemoteInstalledPlugin, RemotePluginCatalogError> {
     let plugin = &installed_plugin.plugin;
@@ -980,6 +1064,11 @@ fn remote_installed_plugin_to_info(
         id: plugin.id.clone(),
         name: plugin.name.clone(),
         enabled: installed_plugin.enabled,
+        install_policy: plugin.installation_policy,
+        auth_policy: plugin.authentication_policy,
+        availability: plugin.availability,
+        interface: remote_plugin_interface_to_info(plugin),
+        keywords: plugin.release.keywords.clone(),
     })
 }
 
@@ -1054,6 +1143,18 @@ fn remote_plugin_display_name(plugin: &RemotePluginSummary) -> &str {
         .unwrap_or(&plugin.name)
 }
 
+fn sort_remote_plugin_summaries_by_display_name(plugins: &mut [RemotePluginSummary]) {
+    plugins.sort_by(|left, right| {
+        let left_display_name = remote_plugin_display_name(left);
+        let right_display_name = remote_plugin_display_name(right);
+        left_display_name
+            .to_ascii_lowercase()
+            .cmp(&right_display_name.to_ascii_lowercase())
+            .then_with(|| left_display_name.cmp(right_display_name))
+            .then_with(|| left.id.cmp(&right.id))
+    });
+}
+
 fn non_empty_string(value: Option<&str>) -> Option<String> {
     value.and_then(|value| {
         let value = value.trim();
diff --git a/codex-rs/core-plugins/src/remote/remote_installed_plugin_sync.rs b/codex-rs/core-plugins/src/remote/remote_installed_plugin_sync.rs
index c94eba428e..69cbfe2569 100644
--- a/codex-rs/core-plugins/src/remote/remote_installed_plugin_sync.rs
+++ b/codex-rs/core-plugins/src/remote/remote_installed_plugin_sync.rs
@@ -1,5 +1,6 @@
 use super::REMOTE_GLOBAL_MARKETPLACE_NAME;
 use super::REMOTE_WORKSPACE_MARKETPLACE_NAME;
+use super::REMOTE_WORKSPACE_SHARED_WITH_ME_MARKETPLACE_NAME;
 use super::REMOTE_WORKSPACE_SHARED_WITH_ME_PRIVATE_MARKETPLACE_NAME;
 use super::REMOTE_WORKSPACE_SHARED_WITH_ME_UNLISTED_MARKETPLACE_NAME;
 use super::RemotePluginCatalogError;
@@ -77,7 +78,7 @@ pub struct RemotePluginCacheMutationGuard {
     key: RemotePluginCacheMutationKey,
 }
 
-pub fn maybe_start_remote_installed_plugin_bundle_sync(
+pub(crate) fn maybe_start_remote_installed_plugin_bundle_sync(
     codex_home: PathBuf,
     config: RemotePluginServiceConfig,
     auth: Option<CodexAuth>,
@@ -153,6 +154,10 @@ pub async fn sync_remote_installed_plugin_bundles_once(
                 REMOTE_WORKSPACE_MARKETPLACE_NAME.to_string(),
                 BTreeSet::new(),
             ),
+            (
+                REMOTE_WORKSPACE_SHARED_WITH_ME_MARKETPLACE_NAME.to_string(),
+                BTreeSet::new(),
+            ),
             (
                 REMOTE_WORKSPACE_SHARED_WITH_ME_PRIVATE_MARKETPLACE_NAME.to_string(),
                 BTreeSet::new(),
@@ -303,6 +308,7 @@ fn remove_stale_remote_plugin_caches(
     for marketplace_name in [
         REMOTE_GLOBAL_MARKETPLACE_NAME,
         REMOTE_WORKSPACE_MARKETPLACE_NAME,
+        REMOTE_WORKSPACE_SHARED_WITH_ME_MARKETPLACE_NAME,
         REMOTE_WORKSPACE_SHARED_WITH_ME_PRIVATE_MARKETPLACE_NAME,
         REMOTE_WORKSPACE_SHARED_WITH_ME_UNLISTED_MARKETPLACE_NAME,
     ] {
@@ -510,7 +516,7 @@ mod tests {
     }
 
     #[test]
-    fn stale_remote_plugin_cleanup_removes_private_shared_with_me_cache() {
+    fn stale_remote_plugin_cleanup_removes_old_shared_with_me_cache_and_keeps_canonical_cache() {
         let codex_home = tempfile::tempdir().expect("create codex home");
         let cached_manifest = codex_home
             .path()
@@ -524,6 +530,18 @@ mod tests {
             .expect("create cached plugin manifest parent");
         std::fs::write(&cached_manifest, r#"{"name":"private-plugin"}"#)
             .expect("write cached plugin manifest");
+        let canonical_cached_manifest = codex_home
+            .path()
+            .join(PLUGINS_CACHE_DIR)
+            .join(REMOTE_WORKSPACE_SHARED_WITH_ME_MARKETPLACE_NAME)
+            .join("shared-plugin")
+            .join("1.2.3")
+            .join(".codex-plugin")
+            .join("plugin.json");
+        std::fs::create_dir_all(canonical_cached_manifest.parent().expect("manifest parent"))
+            .expect("create canonical cached plugin manifest parent");
+        std::fs::write(&canonical_cached_manifest, r#"{"name":"shared-plugin"}"#)
+            .expect("write canonical cached plugin manifest");
         let installed_plugin_names_by_marketplace =
             BTreeMap::<String, BTreeSet<String>>::from_iter([
                 (REMOTE_GLOBAL_MARKETPLACE_NAME.to_string(), BTreeSet::new()),
@@ -531,6 +549,10 @@ mod tests {
                     REMOTE_WORKSPACE_MARKETPLACE_NAME.to_string(),
                     BTreeSet::new(),
                 ),
+                (
+                    REMOTE_WORKSPACE_SHARED_WITH_ME_MARKETPLACE_NAME.to_string(),
+                    BTreeSet::from(["shared-plugin".to_string()]),
+                ),
                 (
                     REMOTE_WORKSPACE_SHARED_WITH_ME_PRIVATE_MARKETPLACE_NAME.to_string(),
                     BTreeSet::new(),
@@ -552,5 +574,6 @@ mod tests {
             vec!["private-plugin@workspace-shared-with-me-private".to_string()]
         );
         assert!(!cached_manifest.exists());
+        assert!(canonical_cached_manifest.is_file());
     }
 }
diff --git a/codex-rs/core-plugins/src/remote/share/checkout.rs b/codex-rs/core-plugins/src/remote/share/checkout.rs
index 9ccdbee851..8aabccff8b 100644
--- a/codex-rs/core-plugins/src/remote/share/checkout.rs
+++ b/codex-rs/core-plugins/src/remote/share/checkout.rs
@@ -1,3 +1,4 @@
+use super::super::REMOTE_WORKSPACE_SHARED_WITH_ME_MARKETPLACE_NAME;
 use super::super::REMOTE_WORKSPACE_SHARED_WITH_ME_PRIVATE_MARKETPLACE_NAME;
 use super::super::REMOTE_WORKSPACE_SHARED_WITH_ME_UNLISTED_MARKETPLACE_NAME;
 use super::super::RemotePluginCatalogError;
@@ -162,7 +163,8 @@ pub async fn checkout_remote_plugin_share(
 fn is_checkout_supported_share_marketplace(marketplace_name: &str) -> bool {
     matches!(
         marketplace_name,
-        REMOTE_WORKSPACE_SHARED_WITH_ME_PRIVATE_MARKETPLACE_NAME
+        REMOTE_WORKSPACE_SHARED_WITH_ME_MARKETPLACE_NAME
+            | REMOTE_WORKSPACE_SHARED_WITH_ME_PRIVATE_MARKETPLACE_NAME
             | REMOTE_WORKSPACE_SHARED_WITH_ME_UNLISTED_MARKETPLACE_NAME
     )
 }
diff --git a/codex-rs/core-plugins/src/remote/share/tests.rs b/codex-rs/core-plugins/src/remote/share/tests.rs
index 0b8f8f2fb5..f62051374e 100644
--- a/codex-rs/core-plugins/src/remote/share/tests.rs
+++ b/codex-rs/core-plugins/src/remote/share/tests.rs
@@ -586,7 +586,7 @@ async fn list_remote_plugin_shares_fetches_created_workspace_plugins() {
         vec![
             RemotePluginShareSummary {
                 summary: RemotePluginSummary {
-                    id: "demo-plugin@workspace-shared-with-me-private".to_string(),
+                    id: "demo-plugin@workspace-shared-with-me".to_string(),
                     remote_plugin_id: "plugins_123".to_string(),
                     name: "demo-plugin".to_string(),
                     share_context: Some(RemotePluginShareContext {
@@ -625,7 +625,7 @@ async fn list_remote_plugin_shares_fetches_created_workspace_plugins() {
             },
             RemotePluginShareSummary {
                 summary: RemotePluginSummary {
-                    id: "demo-plugin@workspace-shared-with-me-private".to_string(),
+                    id: "demo-plugin@workspace-shared-with-me".to_string(),
                     remote_plugin_id: "plugins_456".to_string(),
                     name: "demo-plugin".to_string(),
                     share_context: Some(RemotePluginShareContext {
diff --git a/codex-rs/core-plugins/src/store.rs b/codex-rs/core-plugins/src/store.rs
index fe662a142e..19c3b0116f 100644
--- a/codex-rs/core-plugins/src/store.rs
+++ b/codex-rs/core-plugins/src/store.rs
@@ -4,8 +4,10 @@ use codex_plugin::PluginId;
 use codex_plugin::validate_plugin_segment;
 use codex_utils_absolute_path::AbsolutePathBuf;
 use codex_utils_plugins::find_plugin_manifest_path;
+use semver::Version;
 use serde::Deserialize;
 use serde_json::Value as JsonValue;
+use std::cmp::Ordering;
 use std::fs;
 use std::io;
 use std::path::Path;
@@ -75,7 +77,7 @@ impl PluginStore {
             })
             .filter(|version| validate_plugin_version_segment(version).is_ok())
             .collect::<Vec<_>>();
-        discovered_versions.sort_unstable();
+        discovered_versions.sort_unstable_by(|left, right| compare_plugin_versions(left, right));
         if discovered_versions.is_empty() {
             None
         } else if discovered_versions
@@ -286,6 +288,15 @@ fn replace_plugin_root_atomically(
     let staged_version_root = staged_root.join(plugin_version);
     copy_dir_recursive(source, &staged_version_root)?;
 
+    let target_version_root = target_root.join(plugin_version);
+    if target_root.exists() && !target_version_root.exists() {
+        fs::rename(&staged_version_root, &target_version_root).map_err(|err| {
+            PluginStoreError::io("failed to activate updated plugin cache version", err)
+        })?;
+        remove_old_plugin_versions(target_root, plugin_version)?;
+        return Ok(());
+    }
+
     if target_root.exists() {
         let backup_dir = tempfile::Builder::new()
             .prefix("plugin-backup-")
@@ -322,6 +333,52 @@ fn replace_plugin_root_atomically(
     Ok(())
 }
 
+fn remove_old_plugin_versions(
+    target_root: &Path,
+    plugin_version: &str,
+) -> Result<(), PluginStoreError> {
+    let Ok(entries) = fs::read_dir(target_root) else {
+        return Ok(());
+    };
+
+    for entry in entries.filter_map(Result::ok) {
+        let Ok(file_type) = entry.file_type() else {
+            continue;
+        };
+        if !file_type.is_dir() {
+            continue;
+        }
+        let Ok(version) = entry.file_name().into_string() else {
+            continue;
+        };
+        if version == plugin_version || validate_plugin_version_segment(&version).is_err() {
+            continue;
+        }
+
+        if fs::remove_dir_all(entry.path()).is_err()
+            && old_plugin_version_would_stay_active(&version, plugin_version)
+        {
+            return Err(PluginStoreError::Invalid(format!(
+                "failed to activate updated plugin cache version `{plugin_version}` while `{version}` remains active"
+            )));
+        }
+    }
+
+    Ok(())
+}
+
+fn old_plugin_version_would_stay_active(old_version: &str, new_version: &str) -> bool {
+    old_version == DEFAULT_PLUGIN_VERSION
+        || compare_plugin_versions(old_version, new_version).is_gt()
+}
+
+fn compare_plugin_versions(left: &str, right: &str) -> Ordering {
+    match (Version::parse(left), Version::parse(right)) {
+        (Ok(left), Ok(right)) => left.cmp(&right),
+        _ => left.cmp(right),
+    }
+}
+
 fn copy_dir_recursive(source: &Path, target: &Path) -> Result<(), PluginStoreError> {
     fs::create_dir_all(target)
         .map_err(|err| PluginStoreError::io("failed to create plugin target directory", err))?;
diff --git a/codex-rs/core-plugins/src/store_tests.rs b/codex-rs/core-plugins/src/store_tests.rs
index 0ba6b0d2c6..200055fe6c 100644
--- a/codex-rs/core-plugins/src/store_tests.rs
+++ b/codex-rs/core-plugins/src/store_tests.rs
@@ -247,7 +247,7 @@ fn active_plugin_version_prefers_default_local_version_when_multiple_versions_ex
 }
 
 #[test]
-fn active_plugin_version_returns_last_sorted_version_when_default_is_missing() {
+fn active_plugin_version_returns_latest_version_when_default_is_missing() {
     let tmp = tempdir().unwrap();
     write_plugin(
         &tmp.path().join("plugins/cache/debug"),
@@ -268,6 +268,76 @@ fn active_plugin_version_returns_last_sorted_version_when_default_is_missing() {
     );
 }
 
+#[test]
+fn active_plugin_version_compares_semver_versions_semantically() {
+    let tmp = tempdir().unwrap();
+    write_plugin(
+        &tmp.path().join("plugins/cache/debug"),
+        "sample-plugin/9.0.0",
+        "sample-plugin",
+    );
+    write_plugin(
+        &tmp.path().join("plugins/cache/debug"),
+        "sample-plugin/10.0.0",
+        "sample-plugin",
+    );
+    let store = PluginStore::new(tmp.path().to_path_buf());
+    let plugin_id = PluginId::new("sample-plugin".to_string(), "debug".to_string()).unwrap();
+
+    assert_eq!(
+        store.active_plugin_version(&plugin_id),
+        Some("10.0.0".to_string())
+    );
+}
+
+#[test]
+fn install_with_new_version_keeps_existing_plugin_root_and_prunes_old_versions() {
+    let tmp = tempdir().unwrap();
+    let store = PluginStore::new(tmp.path().to_path_buf());
+    let plugin_id = PluginId::new("sample-plugin".to_string(), "debug".to_string()).unwrap();
+
+    write_plugin_with_version(tmp.path(), "v1", "sample-plugin", Some("1.0.0"));
+    store
+        .install(
+            AbsolutePathBuf::try_from(tmp.path().join("v1")).unwrap(),
+            plugin_id.clone(),
+        )
+        .unwrap();
+
+    write_plugin_with_version(tmp.path(), "v2", "sample-plugin", Some("2.0.0"));
+    store
+        .install(
+            AbsolutePathBuf::try_from(tmp.path().join("v2")).unwrap(),
+            plugin_id.clone(),
+        )
+        .unwrap();
+
+    assert_eq!(
+        store.active_plugin_version(&plugin_id),
+        Some("2.0.0".to_string())
+    );
+    assert!(
+        tmp.path()
+            .join("plugins/cache/debug/sample-plugin/2.0.0")
+            .is_dir()
+    );
+    assert!(
+        !tmp.path()
+            .join("plugins/cache/debug/sample-plugin/1.0.0")
+            .exists()
+    );
+}
+
+#[test]
+fn old_plugin_version_would_stay_active_for_local_or_later_versions() {
+    assert!(old_plugin_version_would_stay_active(
+        DEFAULT_PLUGIN_VERSION,
+        "1.0.0"
+    ));
+    assert!(old_plugin_version_would_stay_active("10.0.0", "9.0.0"));
+    assert!(!old_plugin_version_would_stay_active("1.0.0", "2.0.0"));
+}
+
 #[test]
 fn plugin_root_rejects_path_separators_in_key_segments() {
     let err = PluginId::parse("../../etc@debug").unwrap_err();
diff --git a/codex-rs/core-skills/src/env_var_dependencies.rs b/codex-rs/core-skills/src/env_var_dependencies.rs
deleted file mode 100644
index 4d8e57164c..0000000000
--- a/codex-rs/core-skills/src/env_var_dependencies.rs
+++ /dev/null
@@ -1,30 +0,0 @@
-use crate::SkillMetadata;
-
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub struct SkillDependencyInfo {
-    pub skill_name: String,
-    pub name: String,
-    pub description: Option<String>,
-}
-
-pub fn collect_env_var_dependencies(
-    mentioned_skills: &[SkillMetadata],
-) -> Vec<SkillDependencyInfo> {
-    let mut dependencies = Vec::new();
-    for skill in mentioned_skills {
-        let Some(skill_dependencies) = &skill.dependencies else {
-            continue;
-        };
-        for tool in &skill_dependencies.tools {
-            if tool.r#type != "env_var" || tool.value.is_empty() {
-                continue;
-            }
-            dependencies.push(SkillDependencyInfo {
-                skill_name: skill.name.clone(),
-                name: tool.value.clone(),
-                description: tool.description.clone(),
-            });
-        }
-    }
-    dependencies
-}
diff --git a/codex-rs/core-skills/src/lib.rs b/codex-rs/core-skills/src/lib.rs
index eec3a5f054..1577662bc5 100644
--- a/codex-rs/core-skills/src/lib.rs
+++ b/codex-rs/core-skills/src/lib.rs
@@ -1,5 +1,4 @@
 pub mod config_rules;
-mod env_var_dependencies;
 pub mod injection;
 pub(crate) mod invocation_utils;
 pub mod loader;
@@ -10,8 +9,6 @@ pub mod remote;
 pub mod render;
 pub mod system;
 
-pub use env_var_dependencies::SkillDependencyInfo;
-pub use env_var_dependencies::collect_env_var_dependencies;
 pub(crate) use invocation_utils::build_implicit_skill_path_indexes;
 pub use invocation_utils::detect_implicit_skill_invocation_for_command;
 pub use manager::SkillsLoadInput;
diff --git a/codex-rs/core-skills/src/loader_tests.rs b/codex-rs/core-skills/src/loader_tests.rs
index c80585871e..a1d03dead2 100644
--- a/codex-rs/core-skills/src/loader_tests.rs
+++ b/codex-rs/core-skills/src/loader_tests.rs
@@ -99,6 +99,7 @@ async fn make_config_for_cwd(codex_home: &TempDir, cwd: PathBuf) -> TestConfig {
         ConfigLayerEntry::new(
             ConfigLayerSource::User {
                 file: config_file(user_config_path),
+                profile: None,
             },
             TomlValue::Table(toml::map::Map::new()),
         ),
@@ -164,7 +165,10 @@ async fn skill_roots_from_layer_stack_maps_user_to_user_and_system_cache_and_sys
             TomlValue::Table(toml::map::Map::new()),
         ),
         ConfigLayerEntry::new(
-            ConfigLayerSource::User { file: user_file },
+            ConfigLayerSource::User {
+                file: user_file,
+                profile: None,
+            },
             TomlValue::Table(toml::map::Map::new()),
         ),
     ];
@@ -222,7 +226,10 @@ async fn skill_roots_from_layer_stack_includes_disabled_project_layers() -> anyh
 
     let layers = vec![
         ConfigLayerEntry::new(
-            ConfigLayerSource::User { file: user_file },
+            ConfigLayerSource::User {
+                file: user_file,
+                profile: None,
+            },
             TomlValue::Table(toml::map::Map::new()),
         ),
         ConfigLayerEntry::new_disabled(
@@ -281,7 +288,10 @@ async fn loads_skills_from_home_agents_dir_for_user_scope() -> anyhow::Result<()
 
     let user_file = user_folder.join("config.toml").abs();
     let layers = vec![ConfigLayerEntry::new(
-        ConfigLayerSource::User { file: user_file },
+        ConfigLayerSource::User {
+            file: user_file,
+            profile: None,
+        },
         TomlValue::Table(toml::map::Map::new()),
     )];
     let stack = ConfigLayerStack::new(
@@ -389,11 +399,6 @@ async fn loads_skill_dependencies_metadata_from_yaml() {
 {
   "dependencies": {
     "tools": [
-      {
-        "type": "env_var",
-        "value": "GITHUB_TOKEN",
-        "description": "GitHub API token with repo scopes"
-      },
       {
         "type": "mcp",
         "value": "github",
@@ -436,14 +441,6 @@ async fn loads_skill_dependencies_metadata_from_yaml() {
             interface: None,
             dependencies: Some(SkillDependencies {
                 tools: vec![
-                    SkillToolDependency {
-                        r#type: "env_var".to_string(),
-                        value: "GITHUB_TOKEN".to_string(),
-                        description: Some("GitHub API token with repo scopes".to_string()),
-                        transport: None,
-                        command: None,
-                        url: None,
-                    },
                     SkillToolDependency {
                         r#type: "mcp".to_string(),
                         value: "github".to_string(),
diff --git a/codex-rs/core-skills/src/manager_tests.rs b/codex-rs/core-skills/src/manager_tests.rs
index 338da0c398..15b06b393a 100644
--- a/codex-rs/core-skills/src/manager_tests.rs
+++ b/codex-rs/core-skills/src/manager_tests.rs
@@ -87,7 +87,10 @@ fn user_config_layer(codex_home: &TempDir, config_toml: &str) -> ConfigLayerEntr
     let config_path = AbsolutePathBuf::try_from(codex_home.path().join(CONFIG_TOML_FILE))
         .expect("user config path should be absolute");
     ConfigLayerEntry::new(
-        ConfigLayerSource::User { file: config_path },
+        ConfigLayerSource::User {
+            file: config_path,
+            profile: None,
+        },
         toml::from_str(config_toml).expect("user layer toml"),
     )
 }
@@ -495,7 +498,10 @@ fn disabled_paths_for_skills_allows_session_flags_to_override_user_layer() {
     let user_file = AbsolutePathBuf::try_from(tempdir.path().join("config.toml"))
         .expect("user config path should be absolute");
     let user_layer = ConfigLayerEntry::new(
-        ConfigLayerSource::User { file: user_file },
+        ConfigLayerSource::User {
+            file: user_file,
+            profile: None,
+        },
         toml::from_str(&path_toggle_config(&skill_path, /*enabled*/ false))
             .expect("user layer toml"),
     );
@@ -527,7 +533,10 @@ fn disabled_paths_for_skills_allows_session_flags_to_disable_user_enabled_skill(
     let user_file = AbsolutePathBuf::try_from(tempdir.path().join("config.toml"))
         .expect("user config path should be absolute");
     let user_layer = ConfigLayerEntry::new(
-        ConfigLayerSource::User { file: user_file },
+        ConfigLayerSource::User {
+            file: user_file,
+            profile: None,
+        },
         toml::from_str(&path_toggle_config(&skill_path, /*enabled*/ true))
             .expect("user layer toml"),
     );
@@ -562,7 +571,10 @@ fn disabled_paths_for_skills_disables_matching_name_selectors() {
     let user_file = AbsolutePathBuf::try_from(tempdir.path().join("config.toml"))
         .expect("user config path should be absolute");
     let user_layer = ConfigLayerEntry::new(
-        ConfigLayerSource::User { file: user_file },
+        ConfigLayerSource::User {
+            file: user_file,
+            profile: None,
+        },
         toml::from_str(&name_toggle_config("github:yeet", /*enabled*/ false))
             .expect("user layer toml"),
     );
@@ -592,7 +604,10 @@ fn disabled_paths_for_skills_allows_name_selector_to_override_path_selector() {
     let user_file = AbsolutePathBuf::try_from(tempdir.path().join("config.toml"))
         .expect("user config path should be absolute");
     let user_layer = ConfigLayerEntry::new(
-        ConfigLayerSource::User { file: user_file },
+        ConfigLayerSource::User {
+            file: user_file,
+            profile: None,
+        },
         toml::from_str(&path_toggle_config(&skill_path, /*enabled*/ false))
             .expect("user layer toml"),
     );
diff --git a/codex-rs/core/config.schema.json b/codex-rs/core/config.schema.json
index 8a7cb01b5f..00fc4931a4 100644
--- a/codex-rs/core/config.schema.json
+++ b/codex-rs/core/config.schema.json
@@ -309,6 +309,25 @@
         }
       ]
     },
+    "AutoCompactTokenLimitScope": {
+      "description": "Selects which part of the active context is charged against `model_auto_compact_token_limit`.",
+      "oneOf": [
+        {
+          "description": "Count the full active context against the limit.",
+          "enum": [
+            "total"
+          ],
+          "type": "string"
+        },
+        {
+          "description": "Count sampled output and later growth after the carried window prefix.",
+          "enum": [
+            "body_after_prefix"
+          ],
+          "type": "string"
+        }
+      ]
+    },
     "AutoReviewToml": {
       "properties": {
         "policy": {
@@ -347,9 +366,6 @@
         "experimental_compact_prompt_file": {
           "$ref": "#/definitions/AbsolutePathBuf"
         },
-        "experimental_use_freeform_apply_patch": {
-          "type": "boolean"
-        },
         "experimental_use_unified_exec_tool": {
           "type": "boolean"
         },
@@ -430,9 +446,6 @@
             "exec_permission_approvals": {
               "type": "boolean"
             },
-            "experimental_use_freeform_apply_patch": {
-              "type": "boolean"
-            },
             "experimental_use_unified_exec_tool": {
               "type": "boolean"
             },
@@ -463,9 +476,6 @@
             "in_app_browser": {
               "type": "boolean"
             },
-            "include_apply_patch_tool": {
-              "type": "boolean"
-            },
             "js_repl": {
               "type": "boolean"
             },
@@ -619,9 +629,6 @@
           },
           "type": "object"
         },
-        "include_apply_patch_tool": {
-          "type": "boolean"
-        },
         "include_apps_instructions": {
           "type": "boolean"
         },
@@ -685,9 +692,6 @@
         "tools": {
           "$ref": "#/definitions/ToolsToml"
         },
-        "tools_view_image": {
-          "type": "boolean"
-        },
         "tui": {
           "allOf": [
             {
@@ -832,13 +836,23 @@
       "type": "object"
     },
     "FileSystemAccessMode": {
-      "description": "Access mode for a filesystem entry.\n\nWhen two equally specific entries target the same path, we compare these by conflict precedence rather than by capability breadth: `none` beats `write`, and `write` beats `read`.",
-      "enum": [
-        "read",
-        "write",
-        "none"
-      ],
-      "type": "string"
+      "description": "Access mode for a filesystem entry.\n\nWhen two equally specific entries target the same path, we compare these by conflict precedence rather than by capability breadth: `deny` beats `write`, and `write` beats `read`.",
+      "oneOf": [
+        {
+          "enum": [
+            "read",
+            "write"
+          ],
+          "type": "string"
+        },
+        {
+          "description": "`none` is a legacy input alias retained temporarily for compatibility.",
+          "enum": [
+            "deny"
+          ],
+          "type": "string"
+        }
+      ]
     },
     "FilesystemPermissionToml": {
       "anyOf": [
@@ -864,6 +878,20 @@
       },
       "type": "object"
     },
+    "ForcedChatgptWorkspaceIds": {
+      "anyOf": [
+        {
+          "type": "string"
+        },
+        {
+          "items": {
+            "type": "string"
+          },
+          "type": "array"
+        }
+      ],
+      "description": "Backward-compatible shape for ChatGPT workspace login restrictions in config.toml."
+    },
     "ForcedLoginMethod": {
       "enum": [
         "chatgpt",
@@ -1094,6 +1122,13 @@
           },
           "type": "array"
         },
+        "SubagentStart": {
+          "default": [],
+          "items": {
+            "$ref": "#/definitions/MatcherGroup"
+          },
+          "type": "array"
+        },
         "UserPromptSubmit": {
           "default": [],
           "items": {
@@ -1212,6 +1247,17 @@
         }
       ]
     },
+    "McpServerOAuthConfig": {
+      "additionalProperties": false,
+      "description": "OAuth client settings used when Codex launches an MCP OAuth flow.",
+      "properties": {
+        "client_id": {
+          "description": "Explicit OAuth client identifier to present during authorization and token exchange.",
+          "type": "string"
+        }
+      },
+      "type": "object"
+    },
     "McpServerToolConfig": {
       "additionalProperties": false,
       "description": "Per-tool approval settings for a single MCP server tool.",
@@ -1468,6 +1514,12 @@
     "MultiAgentV2ConfigToml": {
       "additionalProperties": false,
       "properties": {
+        "default_wait_timeout_ms": {
+          "format": "int64",
+          "maximum": 3600000.0,
+          "minimum": 0.0,
+          "type": "integer"
+        },
         "enabled": {
           "type": "boolean"
         },
@@ -1479,18 +1531,33 @@
           "minimum": 1.0,
           "type": "integer"
         },
+        "max_wait_timeout_ms": {
+          "format": "int64",
+          "maximum": 3600000.0,
+          "minimum": 0.0,
+          "type": "integer"
+        },
         "min_wait_timeout_ms": {
           "format": "int64",
           "maximum": 3600000.0,
-          "minimum": 1.0,
+          "minimum": 0.0,
           "type": "integer"
         },
+        "non_code_mode_only": {
+          "type": "boolean"
+        },
         "root_agent_usage_hint_text": {
           "type": "string"
         },
         "subagent_usage_hint_text": {
           "type": "string"
         },
+        "tool_namespace": {
+          "maxLength": 64,
+          "minLength": 1,
+          "pattern": "^[a-zA-Z0-9_-]+$",
+          "type": "string"
+        },
         "usage_hint_enabled": {
           "type": "boolean"
         },
@@ -1940,6 +2007,9 @@
         },
         "network": {
           "$ref": "#/definitions/NetworkToml"
+        },
+        "workspace_roots": {
+          "$ref": "#/definitions/WorkspaceRootsToml"
         }
       },
       "type": "object"
@@ -2121,6 +2191,14 @@
           "description": "Legacy display-name field accepted for backward compatibility.",
           "type": "string"
         },
+        "oauth": {
+          "allOf": [
+            {
+              "$ref": "#/definitions/McpServerOAuthConfig"
+            }
+          ],
+          "default": null
+        },
         "oauth_resource": {
           "default": null,
           "type": "string"
@@ -2344,7 +2422,7 @@
     },
     "ShellEnvironmentPolicyToml": {
       "additionalProperties": false,
-      "description": "Policy for building the `env` when spawning a process via either the `shell` or `local_shell` tool.",
+      "description": "Policy for building the `env` when spawning a process via shell-like tools.",
       "properties": {
         "exclude": {
           "description": "List of regular expressions.",
@@ -2501,11 +2579,6 @@
     "ToolsToml": {
       "additionalProperties": false,
       "properties": {
-        "view_image": {
-          "default": null,
-          "description": "Enable the `view_image` tool that lets the agent attach local images.",
-          "type": "boolean"
-        },
         "web_search": {
           "allOf": [
             {
@@ -3932,6 +4005,9 @@
           "type": "string"
         }
       ]
+    },
+    "WorkspaceRootsToml": {
+      "type": "object"
     }
   },
   "description": "Base config deserialized from ~/.codex/config.toml.",
@@ -3982,6 +4058,10 @@
       "default": null,
       "description": "Settings for app-specific controls."
     },
+    "apps_mcp_product_sku": {
+      "description": "Optional product SKU forwarded on host-owned Codex Apps MCP requests.",
+      "type": "string"
+    },
     "audio": {
       "allOf": [
         {
@@ -4023,10 +4103,6 @@
       "default": null,
       "description": "Preferred backend for storing CLI auth credentials. file (default): Use a file in the Codex home directory. keyring: Use an OS-specific keyring service. auto: Use the keyring if available, otherwise use a file."
     },
-    "commit_attribution": {
-      "description": "Optional commit attribution text for commit message co-author trailers. This top-level setting only takes effect when `[features].codex_git_commit` is enabled.\n\nWhen enabled and unset, Codex uses `Codex <noreply@openai.com>`. Set to an empty string to disable automatic commit attribution.",
-      "type": "string"
-    },
     "compact_prompt": {
       "description": "Compact prompt used for history compaction.",
       "type": "string"
@@ -4043,6 +4119,12 @@
       "description": "Default permissions profile to apply. Names starting with `:` refer to built-in profiles; other names are resolved from the `[permissions]` table.",
       "type": "string"
     },
+    "desktop": {
+      "additionalProperties": true,
+      "default": null,
+      "description": "Opaque desktop settings stored alongside the rest of config.toml.",
+      "type": "object"
+    },
     "developer_instructions": {
       "default": null,
       "description": "Developer instructions inserted as a `developer` role message.",
@@ -4087,9 +4169,6 @@
       ],
       "description": "Experimental / do not use. Selects the thread store implementation."
     },
-    "experimental_use_freeform_apply_patch": {
-      "type": "boolean"
-    },
     "experimental_use_unified_exec_tool": {
       "type": "boolean"
     },
@@ -4170,9 +4249,6 @@
         "exec_permission_approvals": {
           "type": "boolean"
         },
-        "experimental_use_freeform_apply_patch": {
-          "type": "boolean"
-        },
         "experimental_use_unified_exec_tool": {
           "type": "boolean"
         },
@@ -4203,9 +4279,6 @@
         "in_app_browser": {
           "type": "boolean"
         },
-        "include_apply_patch_tool": {
-          "type": "boolean"
-        },
         "js_repl": {
           "type": "boolean"
         },
@@ -4376,9 +4449,13 @@
       "description": "Optional URI-based file opener. If set, citations to files in the model output will be hyperlinked using the specified URI scheme."
     },
     "forced_chatgpt_workspace_id": {
+      "allOf": [
+        {
+          "$ref": "#/definitions/ForcedChatgptWorkspaceIds"
+        }
+      ],
       "default": null,
-      "description": "When set, restricts ChatGPT login to a specific workspace identifier.",
-      "type": "string"
+      "description": "When set, restricts ChatGPT login to one or more workspace identifiers."
     },
     "forced_login_method": {
       "allOf": [
@@ -4503,6 +4580,14 @@
       "format": "int64",
       "type": "integer"
     },
+    "model_auto_compact_token_limit_scope": {
+      "allOf": [
+        {
+          "$ref": "#/definitions/AutoCompactTokenLimitScope"
+        }
+      ],
+      "description": "Controls whether the auto-compaction limit applies to the full context or only to tokens after the carried prefix in the current compaction window."
+    },
     "model_catalog_json": {
       "allOf": [
         {
@@ -4774,10 +4859,6 @@
       "default": null,
       "description": "Windows-specific configuration."
     },
-    "windows_wsl_setup_acknowledged": {
-      "description": "Tracks whether the Windows onboarding screen has been acknowledged.",
-      "type": "boolean"
-    },
     "zsh_path": {
       "allOf": [
         {
diff --git a/codex-rs/core/src/agent/control.rs b/codex-rs/core/src/agent/control.rs
index d973f40e45..42981a5d0a 100644
--- a/codex-rs/core/src/agent/control.rs
+++ b/codex-rs/core/src/agent/control.rs
@@ -96,7 +96,7 @@ fn agent_nickname_candidates(
         .collect()
 }
 
-fn keep_forked_rollout_item(item: &RolloutItem) -> bool {
+fn keep_forked_rollout_item(item: &RolloutItem, preserve_reference_context_item: bool) -> bool {
     match item {
         RolloutItem::ResponseItem(ResponseItem::Message { role, phase, .. }) => match role.as_str()
         {
@@ -116,16 +116,34 @@ fn keep_forked_rollout_item(item: &RolloutItem) -> bool {
             | ResponseItem::WebSearchCall { .. }
             | ResponseItem::ImageGenerationCall { .. }
             | ResponseItem::Compaction { .. }
+            | ResponseItem::CompactionTrigger
             | ResponseItem::ContextCompaction { .. }
             | ResponseItem::Other,
         ) => false,
-        // A forked child gets its own runtime config, including spawned-agent
-        // instructions, so it must establish a fresh context diff baseline.
-        RolloutItem::TurnContext(_) => false,
+        // Full-history forks preserve the cached prompt prefix and can keep diffing
+        // from the parent's durable baseline. Truncated forks drop part of that prompt,
+        // so they must rebuild context on their first child turn.
+        RolloutItem::TurnContext(_) => preserve_reference_context_item,
         RolloutItem::Compacted(_) | RolloutItem::EventMsg(_) | RolloutItem::SessionMeta(_) => true,
     }
 }
 
+fn is_multi_agent_v2_usage_hint_message(item: &ResponseItem, usage_hint_texts: &[String]) -> bool {
+    let ResponseItem::Message { role, content, .. } = item else {
+        return false;
+    };
+    if role != "developer" {
+        return false;
+    }
+    let [ContentItem::InputText { text }] = content.as_slice() else {
+        return false;
+    };
+
+    usage_hint_texts
+        .iter()
+        .any(|usage_hint_text| usage_hint_text == text)
+}
+
 /// Control-plane handle for multi-agent operations.
 /// `AgentControl` is held by each session (via `SessionServices`). It provides capability to
 /// spawn new agents and the inter-agent communication layer.
@@ -395,16 +413,26 @@ impl AgentControl {
             forked_rollout_items =
                 truncate_rollout_to_last_n_fork_turns(&forked_rollout_items, *last_n_turns);
         }
-        // MultiAgentV2 root/subagent usage hints are injected as standalone developer
-        // messages at thread start. When forking history, drop hints from the parent
-        // so the child gets a fresh hint that matches its own session source/config.
         let multi_agent_v2_usage_hint_texts_to_filter: Vec<String> =
             if let Some(parent_thread) = parent_thread.as_ref() {
-                parent_thread
-                    .codex
-                    .session
-                    .configured_multi_agent_v2_usage_hint_texts()
-                    .await
+                if parent_thread.enabled(Feature::MultiAgentV2) {
+                    let parent_config = parent_thread.codex.session.get_config().await;
+                    [
+                        parent_config
+                            .multi_agent_v2
+                            .root_agent_usage_hint_text
+                            .clone(),
+                        parent_config
+                            .multi_agent_v2
+                            .subagent_usage_hint_text
+                            .clone(),
+                    ]
+                    .into_iter()
+                    .flatten()
+                    .collect()
+                } else {
+                    Vec::new()
+                }
             } else if config.features.enabled(Feature::MultiAgentV2) {
                 [
                     config.multi_agent_v2.root_agent_usage_hint_text.clone(),
@@ -416,19 +444,41 @@ impl AgentControl {
             } else {
                 Vec::new()
             };
+        let preserve_reference_context_item = matches!(fork_mode, SpawnAgentForkMode::FullHistory);
         forked_rollout_items.retain(|item| {
-            if let RolloutItem::ResponseItem(ResponseItem::Message { role, content, .. }) = item
-                && role == "developer"
-                && let [ContentItem::InputText { text }] = content.as_slice()
-                && multi_agent_v2_usage_hint_texts_to_filter
-                    .iter()
-                    .any(|usage_hint_text| usage_hint_text == text)
-            {
-                return false;
-            }
-
-            keep_forked_rollout_item(item)
+            keep_forked_rollout_item(item, preserve_reference_context_item)
+                && !matches!(
+                    item,
+                    RolloutItem::ResponseItem(response_item)
+                        if is_multi_agent_v2_usage_hint_message(
+                            response_item,
+                            &multi_agent_v2_usage_hint_texts_to_filter,
+                        )
+                )
         });
+        for item in &mut forked_rollout_items {
+            if let RolloutItem::Compacted(compacted) = item
+                && let Some(replacement_history) = compacted.replacement_history.as_mut()
+            {
+                replacement_history.retain(|response_item| {
+                    !is_multi_agent_v2_usage_hint_message(
+                        response_item,
+                        &multi_agent_v2_usage_hint_texts_to_filter,
+                    )
+                });
+            }
+        }
+        if preserve_reference_context_item
+            && config.features.enabled(Feature::MultiAgentV2)
+            && let Some(subagent_usage_hint_text) =
+                config.multi_agent_v2.subagent_usage_hint_text.clone()
+            && let Some(subagent_usage_hint_message) =
+                crate::context_manager::updates::build_developer_update_item(vec![
+                    subagent_usage_hint_text,
+                ])
+        {
+            forked_rollout_items.push(RolloutItem::ResponseItem(subagent_usage_hint_message));
+        }
 
         state
             .fork_thread_with_source(
@@ -498,13 +548,12 @@ impl AgentControl {
                             agent_nickname: None,
                             agent_role: None,
                         });
-                    match self
-                        .resume_single_agent_from_rollout(
-                            config.clone(),
-                            child_thread_id,
-                            child_session_source,
-                        )
-                        .await
+                    match Box::pin(self.resume_single_agent_from_rollout(
+                        config.clone(),
+                        child_thread_id,
+                        child_session_source,
+                    ))
+                    .await
                     {
                         Ok(_) => true,
                         Err(err) => {
@@ -1234,7 +1283,9 @@ pub(crate) fn render_input_preview(initial_operation: &Op) -> String {
             .map(|item| match item {
                 UserInput::Text { text, .. } => text.clone(),
                 UserInput::Image { .. } => "[image]".to_string(),
-                UserInput::LocalImage { path } => format!("[local_image:{}]", path.display()),
+                UserInput::LocalImage { path, .. } => {
+                    format!("[local_image:{}]", path.display())
+                }
                 UserInput::Skill { name, path } => format!("[skill:${name}]({})", path.display()),
                 UserInput::Mention { name, path } => format!("[mention:${name}]({path})"),
                 _ => "[input]".to_string(),
diff --git a/codex-rs/core/src/agent/control_tests.rs b/codex-rs/core/src/agent/control_tests.rs
index b95aad4489..7ff50ffef8 100644
--- a/codex-rs/core/src/agent/control_tests.rs
+++ b/codex-rs/core/src/agent/control_tests.rs
@@ -17,6 +17,7 @@ use codex_protocol::config_types::ModeKind;
 use codex_protocol::models::ContentItem;
 use codex_protocol::models::MessagePhase;
 use codex_protocol::models::ResponseItem;
+use codex_protocol::protocol::CompactedItem;
 use codex_protocol::protocol::ErrorEvent;
 use codex_protocol::protocol::EventMsg;
 use codex_protocol::protocol::InterAgentCommunication;
@@ -442,6 +443,7 @@ async fn send_input_submits_user_message() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         },
     );
     let captured = harness
@@ -486,7 +488,13 @@ async fn send_inter_agent_communication_without_turn_queues_message_without_trig
 
     timeout(Duration::from_secs(5), async {
         loop {
-            if thread.codex.session.has_pending_input().await {
+            if thread
+                .codex
+                .session
+                .input_queue
+                .has_pending_input(&thread.codex.session.active_turn)
+                .await
+            {
                 break;
             }
             sleep(Duration::from_millis(10)).await;
@@ -589,6 +597,7 @@ async fn spawn_agent_creates_thread_and_sends_prompt() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         },
     );
     let captured = harness
@@ -669,6 +678,14 @@ async fn spawn_agent_can_fork_parent_thread_history_with_sanitized_items() {
             ],
         )
         .await;
+    let parent_reference_context_item = turn_context.to_turn_context_item();
+    parent_thread
+        .codex
+        .session
+        .persist_rollout_items(&[RolloutItem::TurnContext(
+            parent_reference_context_item.clone(),
+        )])
+        .await;
     parent_thread
         .codex
         .session
@@ -720,11 +737,26 @@ async fn spawn_agent_can_fork_parent_thread_history_with_sanitized_items() {
             phase: None,
         },
         assistant_message("parent final answer", Some(MessagePhase::FinalAnswer)),
+        ResponseItem::Message {
+            id: None,
+            role: "developer".to_string(),
+            content: vec![ContentItem::InputText {
+                text: "Child subagent guidance.".to_string(),
+            }],
+            phase: None,
+        },
     ];
     assert_eq!(
         history.raw_items(),
         &expected_history,
-        "forked child history should keep only parent user messages and assistant final answers"
+        "full-history forked child history should replace parent usage hints with the child subagent hint while filtering non-final assistant/tool chatter"
+    );
+    assert_eq!(
+        serde_json::to_value(child_thread.codex.session.reference_context_item().await)
+            .expect("serialize child reference context item"),
+        serde_json::to_value(Some(parent_reference_context_item))
+            .expect("serialize expected reference context item"),
+        "full-history forked child should preserve the parent diff baseline"
     );
 
     let expected = (
@@ -737,6 +769,7 @@ async fn spawn_agent_can_fork_parent_thread_history_with_sanitized_items() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         },
     );
     let captured = harness
@@ -757,6 +790,124 @@ async fn spawn_agent_can_fork_parent_thread_history_with_sanitized_items() {
         .expect("parent shutdown should submit");
 }
 
+#[tokio::test]
+async fn spawn_agent_fork_strips_parent_usage_hints_from_compacted_history() {
+    let harness = AgentControlHarness::new().await;
+    let mut parent_config = harness.config.clone();
+    let _ = parent_config.features.enable(Feature::MultiAgentV2);
+    parent_config.multi_agent_v2.root_agent_usage_hint_text =
+        Some("Parent root guidance.".to_string());
+    parent_config.multi_agent_v2.subagent_usage_hint_text =
+        Some("Parent subagent guidance.".to_string());
+    let mut child_config = harness.config.clone();
+    let _ = child_config.features.enable(Feature::MultiAgentV2);
+    child_config.multi_agent_v2.root_agent_usage_hint_text =
+        Some("Child root guidance.".to_string());
+    child_config.multi_agent_v2.subagent_usage_hint_text =
+        Some("Child subagent guidance.".to_string());
+    let new_thread = harness
+        .manager
+        .start_thread(parent_config)
+        .await
+        .expect("start parent thread");
+    let parent_thread_id = new_thread.thread_id;
+    let parent_thread = new_thread.thread;
+    let turn_context = parent_thread.codex.session.new_default_turn().await;
+    let parent_spawn_call_id = "spawn-call-compacted-usage-hints".to_string();
+    let replacement_history = vec![
+        ResponseItem::Message {
+            id: None,
+            role: "user".to_string(),
+            content: vec![ContentItem::InputText {
+                text: "compacted parent summary".to_string(),
+            }],
+            phase: None,
+        },
+        ResponseItem::Message {
+            id: None,
+            role: "developer".to_string(),
+            content: vec![ContentItem::InputText {
+                text: "Parent root guidance.".to_string(),
+            }],
+            phase: None,
+        },
+    ];
+    parent_thread
+        .codex
+        .session
+        .persist_rollout_items(&[
+            RolloutItem::Compacted(CompactedItem {
+                message: String::new(),
+                replacement_history: Some(replacement_history),
+            }),
+            RolloutItem::TurnContext(turn_context.to_turn_context_item()),
+            RolloutItem::ResponseItem(spawn_agent_call(&parent_spawn_call_id)),
+        ])
+        .await;
+    parent_thread
+        .codex
+        .session
+        .ensure_rollout_materialized()
+        .await;
+    parent_thread
+        .codex
+        .session
+        .flush_rollout()
+        .await
+        .expect("parent rollout should flush");
+
+    let child_thread_id = harness
+        .control
+        .spawn_agent_with_metadata(
+            child_config,
+            text_input("child task"),
+            Some(SessionSource::SubAgent(SubAgentSource::ThreadSpawn {
+                parent_thread_id,
+                depth: 1,
+                agent_path: None,
+                agent_nickname: None,
+                agent_role: None,
+            })),
+            SpawnAgentOptions {
+                fork_parent_spawn_call_id: Some(parent_spawn_call_id),
+                fork_mode: Some(SpawnAgentForkMode::FullHistory),
+                ..Default::default()
+            },
+        )
+        .await
+        .expect("forked spawn should sanitize compacted usage hints")
+        .thread_id;
+
+    let child_thread = harness
+        .manager
+        .get_thread(child_thread_id)
+        .await
+        .expect("child thread should be registered");
+    let history = child_thread.codex.session.clone_history().await;
+    assert!(
+        history_contains_text(history.raw_items(), "compacted parent summary"),
+        "forked child history should retain compacted non-hint content"
+    );
+    assert!(
+        !history_contains_text(history.raw_items(), "Parent root guidance."),
+        "forked child history should strip stale parent hints from compacted replacement history"
+    );
+    assert!(
+        history_contains_text(history.raw_items(), "Child subagent guidance."),
+        "full-history forked child should add the child subagent hint after compacted-history sanitization"
+    );
+
+    let _ = harness
+        .control
+        .shutdown_live_agent(child_thread_id)
+        .await
+        .expect("child shutdown should submit");
+    let _ = parent_thread
+        .submit(Op::Shutdown {})
+        .await
+        .expect("parent shutdown should submit");
+}
+
 #[tokio::test]
 async fn spawn_agent_fork_flushes_parent_rollout_before_loading_history() {
     let harness = AgentControlHarness::new().await;
@@ -873,6 +1024,13 @@ async fn spawn_agent_fork_last_n_turns_keeps_only_recent_turns() {
             &[spawn_agent_call(&parent_spawn_call_id)],
         )
         .await;
+    parent_thread
+        .codex
+        .session
+        .persist_rollout_items(&[RolloutItem::TurnContext(
+            spawn_turn_context.to_turn_context_item(),
+        )])
+        .await;
     parent_thread
         .codex
         .session
@@ -930,6 +1088,116 @@ async fn spawn_agent_fork_last_n_turns_keeps_only_recent_turns() {
         history_contains_text(history.raw_items(), "current parent task"),
         "forked child history should keep the parent user message from the requested last-N turn window"
     );
+    assert!(
+        child_thread
+            .codex
+            .session
+            .reference_context_item()
+            .await
+            .is_none(),
+        "last-N forked child should rebuild context after truncating the cached prefix"
+    );
+
+    let _ = harness
+        .control
+        .shutdown_live_agent(child_thread_id)
+        .await
+        .expect("child shutdown should submit");
+    let _ = parent_thread
+        .submit(Op::Shutdown {})
+        .await
+        .expect("parent shutdown should submit");
+}
+
+#[tokio::test]
+async fn spawn_agent_fork_last_n_turns_strips_parent_usage_hints() {
+    let harness = AgentControlHarness::new().await;
+    let mut parent_config = harness.config.clone();
+    let _ = parent_config.features.enable(Feature::MultiAgentV2);
+    parent_config.multi_agent_v2.root_agent_usage_hint_text =
+        Some("Parent root guidance.".to_string());
+    let mut child_config = harness.config.clone();
+    let _ = child_config.features.enable(Feature::MultiAgentV2);
+    child_config.multi_agent_v2.subagent_usage_hint_text =
+        Some("Child subagent guidance.".to_string());
+    let new_thread = harness
+        .manager
+        .start_thread(parent_config)
+        .await
+        .expect("start parent thread");
+    let parent_thread_id = new_thread.thread_id;
+    let parent_thread = new_thread.thread;
+    parent_thread
+        .inject_user_message_without_turn("parent task".to_string())
+        .await;
+    let turn_context = parent_thread.codex.session.new_default_turn().await;
+    let parent_spawn_call_id = "spawn-call-last-n-usage-hints".to_string();
+    parent_thread
+        .codex
+        .session
+        .record_conversation_items(
+            turn_context.as_ref(),
+            &[
+                ResponseItem::Message {
+                    id: None,
+                    role: "developer".to_string(),
+                    content: vec![ContentItem::InputText {
+                        text: "Parent root guidance.".to_string(),
+                    }],
+                    phase: None,
+                },
+                spawn_agent_call(&parent_spawn_call_id),
+            ],
+        )
+        .await;
+    parent_thread
+        .codex
+        .session
+        .ensure_rollout_materialized()
+        .await;
+    parent_thread
+        .codex
+        .session
+        .flush_rollout()
+        .await
+        .expect("parent rollout should flush");
+
+    let child_thread_id = harness
+        .control
+        .spawn_agent_with_metadata(
+            child_config,
+            text_input("child task"),
+            Some(SessionSource::SubAgent(SubAgentSource::ThreadSpawn {
+                parent_thread_id,
+                depth: 1,
+                agent_path: None,
+                agent_nickname: None,
+                agent_role: None,
+            })),
+            SpawnAgentOptions {
+                fork_parent_spawn_call_id: Some(parent_spawn_call_id),
+                fork_mode: Some(SpawnAgentForkMode::LastNTurns(2)),
+                ..Default::default()
+            },
+        )
+        .await
+        .expect("bounded forked spawn should sanitize parent usage hints")
+        .thread_id;
+
+    let child_thread = harness
+        .manager
+        .get_thread(child_thread_id)
+        .await
+        .expect("child thread should be registered");
+    let history = child_thread.codex.session.clone_history().await;
+    assert!(
+        history_contains_text(history.raw_items(), "parent task"),
+        "bounded fork should retain the requested recent parent turn"
+    );
+    assert!(
+        !history_contains_text(history.raw_items(), "Parent root guidance."),
+        "bounded fork should strip stale parent root hints before the child rebuilds startup context"
+    );
 
     let _ = harness
         .control
diff --git a/codex-rs/core/src/agent/mailbox.rs b/codex-rs/core/src/agent/mailbox.rs
deleted file mode 100644
index c328236475..0000000000
--- a/codex-rs/core/src/agent/mailbox.rs
+++ /dev/null
@@ -1,161 +0,0 @@
-use codex_protocol::protocol::InterAgentCommunication;
-use std::collections::VecDeque;
-use std::sync::atomic::AtomicU64;
-use std::sync::atomic::Ordering;
-use tokio::sync::mpsc;
-use tokio::sync::watch;
-
-#[cfg(test)]
-use codex_protocol::AgentPath;
-
-pub(crate) struct Mailbox {
-    tx: mpsc::UnboundedSender<InterAgentCommunication>,
-    next_seq: AtomicU64,
-    seq_tx: watch::Sender<u64>,
-}
-
-pub(crate) struct MailboxReceiver {
-    rx: mpsc::UnboundedReceiver<InterAgentCommunication>,
-    pending_mails: VecDeque<InterAgentCommunication>,
-}
-
-impl Mailbox {
-    pub(crate) fn new() -> (Self, MailboxReceiver) {
-        let (tx, rx) = mpsc::unbounded_channel();
-        let (seq_tx, _) = watch::channel(0);
-        (
-            Self {
-                tx,
-                next_seq: AtomicU64::new(0),
-                seq_tx,
-            },
-            MailboxReceiver {
-                rx,
-                pending_mails: VecDeque::new(),
-            },
-        )
-    }
-
-    pub(crate) fn subscribe(&self) -> watch::Receiver<u64> {
-        self.seq_tx.subscribe()
-    }
-
-    pub(crate) fn send(&self, communication: InterAgentCommunication) -> u64 {
-        let seq = self.next_seq.fetch_add(1, Ordering::Relaxed) + 1;
-        let _ = self.tx.send(communication);
-        self.seq_tx.send_replace(seq);
-        seq
-    }
-}
-
-impl MailboxReceiver {
-    fn sync_pending_mails(&mut self) {
-        while let Ok(mail) = self.rx.try_recv() {
-            self.pending_mails.push_back(mail);
-        }
-    }
-
-    pub(crate) fn has_pending(&mut self) -> bool {
-        self.sync_pending_mails();
-        !self.pending_mails.is_empty()
-    }
-
-    pub(crate) fn has_pending_trigger_turn(&mut self) -> bool {
-        self.sync_pending_mails();
-        self.pending_mails.iter().any(|mail| mail.trigger_turn)
-    }
-
-    pub(crate) fn drain(&mut self) -> Vec<InterAgentCommunication> {
-        self.sync_pending_mails();
-        self.pending_mails.drain(..).collect()
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use pretty_assertions::assert_eq;
-
-    fn make_mail(
-        author: AgentPath,
-        recipient: AgentPath,
-        content: &str,
-        trigger_turn: bool,
-    ) -> InterAgentCommunication {
-        InterAgentCommunication::new(
-            author,
-            recipient,
-            Vec::new(),
-            content.to_string(),
-            trigger_turn,
-        )
-    }
-
-    #[tokio::test]
-    async fn mailbox_assigns_monotonic_sequence_numbers() {
-        let (mailbox, _receiver) = Mailbox::new();
-        let mut seq_rx = mailbox.subscribe();
-
-        let seq_a = mailbox.send(make_mail(
-            AgentPath::root(),
-            AgentPath::try_from("/root/worker").expect("agent path"),
-            "one",
-            /*trigger_turn*/ false,
-        ));
-        let seq_b = mailbox.send(make_mail(
-            AgentPath::root(),
-            AgentPath::try_from("/root/worker").expect("agent path"),
-            "two",
-            /*trigger_turn*/ false,
-        ));
-
-        seq_rx.changed().await.expect("first seq update");
-        assert_eq!(*seq_rx.borrow(), seq_b);
-        assert_eq!(seq_a, 1);
-        assert_eq!(seq_b, 2);
-    }
-
-    #[tokio::test]
-    async fn mailbox_drains_in_delivery_order() {
-        let (mailbox, mut receiver) = Mailbox::new();
-        let mail_one = make_mail(
-            AgentPath::root(),
-            AgentPath::try_from("/root/worker").expect("agent path"),
-            "one",
-            /*trigger_turn*/ false,
-        );
-        let mail_two = make_mail(
-            AgentPath::try_from("/root/worker").expect("agent path"),
-            AgentPath::root(),
-            "two",
-            /*trigger_turn*/ false,
-        );
-
-        mailbox.send(mail_one.clone());
-        mailbox.send(mail_two.clone());
-
-        assert_eq!(receiver.drain(), vec![mail_one, mail_two]);
-        assert!(!receiver.has_pending());
-    }
-
-    #[tokio::test]
-    async fn mailbox_tracks_pending_trigger_turn_mail() {
-        let (mailbox, mut receiver) = Mailbox::new();
-
-        mailbox.send(make_mail(
-            AgentPath::root(),
-            AgentPath::try_from("/root/worker").expect("agent path"),
-            "queued",
-            /*trigger_turn*/ false,
-        ));
-        assert!(!receiver.has_pending_trigger_turn());
-
-        mailbox.send(make_mail(
-            AgentPath::root(),
-            AgentPath::try_from("/root/worker").expect("agent path"),
-            "wake",
-            /*trigger_turn*/ true,
-        ));
-        assert!(receiver.has_pending_trigger_turn());
-    }
-}
diff --git a/codex-rs/core/src/agent/mod.rs b/codex-rs/core/src/agent/mod.rs
index a60fc3004a..350962dc08 100644
--- a/codex-rs/core/src/agent/mod.rs
+++ b/codex-rs/core/src/agent/mod.rs
@@ -1,14 +1,11 @@
 pub(crate) mod agent_resolver;
 pub(crate) mod control;
-pub(crate) mod mailbox;
 mod registry;
 pub(crate) mod role;
 pub(crate) mod status;
 
 pub(crate) use codex_protocol::protocol::AgentStatus;
 pub(crate) use control::AgentControl;
-pub(crate) use mailbox::Mailbox;
-pub(crate) use mailbox::MailboxReceiver;
 pub(crate) use registry::exceeds_thread_spawn_depth_limit;
 pub(crate) use registry::next_thread_spawn_depth;
 pub(crate) use status::agent_status_from_event;
diff --git a/codex-rs/core/src/agents_md.rs b/codex-rs/core/src/agents_md.rs
index 7a9fd74932..2c635e7002 100644
--- a/codex-rs/core/src/agents_md.rs
+++ b/codex-rs/core/src/agents_md.rs
@@ -23,6 +23,7 @@ use codex_config::merge_toml_values;
 use codex_config::project_root_markers_from_config;
 use codex_exec_server::Environment;
 use codex_exec_server::ExecutorFileSystem;
+use codex_exec_server::LOCAL_FS;
 use codex_features::Feature;
 use codex_utils_absolute_path::AbsolutePathBuf;
 use dunce::canonicalize as normalize_path;
@@ -58,13 +59,14 @@ impl<'a> AgentsMdManager<'a> {
         Self { config }
     }
 
-    pub(crate) fn load_global_instructions(
+    pub(crate) async fn load_global_instructions(
+        fs: &dyn ExecutorFileSystem,
         codex_dir: Option<&AbsolutePathBuf>,
     ) -> Option<LoadedAgentsMd> {
         let base = codex_dir?;
         for candidate in [LOCAL_AGENTS_MD_FILENAME, DEFAULT_AGENTS_MD_FILENAME] {
             let path = base.join(candidate);
-            if let Ok(contents) = std::fs::read_to_string(&path) {
+            if let Ok(contents) = fs.read_file_text(&path, /*sandbox*/ None).await {
                 let trimmed = contents.trim();
                 if !trimmed.is_empty() {
                     return Some(LoadedAgentsMd {
@@ -128,9 +130,11 @@ impl<'a> AgentsMdManager<'a> {
 
     /// Returns all instruction source files included in the current config.
     pub async fn instruction_sources(&self, fs: &dyn ExecutorFileSystem) -> Vec<AbsolutePathBuf> {
-        let mut paths = Self::load_global_instructions(Some(&self.config.codex_home))
-            .map(|loaded| vec![loaded.path])
-            .unwrap_or_default();
+        let mut paths =
+            Self::load_global_instructions(LOCAL_FS.as_ref(), Some(&self.config.codex_home))
+                .await
+                .map(|loaded| vec![loaded.path])
+                .unwrap_or_default();
         match self.agents_md_paths(fs).await {
             Ok(agents_md_paths) => paths.extend(agents_md_paths),
             Err(err) => {
diff --git a/codex-rs/core/src/arc_monitor.rs b/codex-rs/core/src/arc_monitor.rs
index d1e679a631..a4f7e038e0 100644
--- a/codex-rs/core/src/arc_monitor.rs
+++ b/codex-rs/core/src/arc_monitor.rs
@@ -384,6 +384,7 @@ fn build_arc_monitor_message_item(
         | ResponseItem::ToolSearchOutput { .. }
         | ResponseItem::ImageGenerationCall { .. }
         | ResponseItem::Compaction { .. }
+        | ResponseItem::CompactionTrigger
         | ResponseItem::ContextCompaction { .. }
         | ResponseItem::Other => None,
     }
diff --git a/codex-rs/core/src/client_common.rs b/codex-rs/core/src/client_common.rs
index efe2670652..d9edadbed4 100644
--- a/codex-rs/core/src/client_common.rs
+++ b/codex-rs/core/src/client_common.rs
@@ -2,13 +2,10 @@ pub use codex_api::ResponseEvent;
 use codex_config::types::Personality;
 use codex_protocol::error::Result;
 use codex_protocol::models::BaseInstructions;
-use codex_protocol::models::FunctionCallOutputBody;
 use codex_protocol::models::ResponseItem;
 use codex_tools::ToolSpec;
 use futures::Stream;
-use serde::Deserialize;
 use serde_json::Value;
-use std::collections::HashSet;
 use std::pin::Pin;
 use std::task::Context;
 use std::task::Poll;
@@ -64,116 +61,10 @@ impl Default for Prompt {
 
 impl Prompt {
     pub(crate) fn get_formatted_input(&self) -> Vec<ResponseItem> {
-        let mut input = self.input.clone();
-
-        // when using the *Freeform* apply_patch tool specifically, tool outputs
-        // should be structured text, not json. Do NOT reserialize when using
-        // the Function tool - note that this differs from the check above for
-        // instructions. We declare the result as a named variable for clarity.
-        let is_freeform_apply_patch_tool_present = self.tools.iter().any(|tool| match tool {
-            ToolSpec::Freeform(f) => f.name == "apply_patch",
-            _ => false,
-        });
-        if is_freeform_apply_patch_tool_present {
-            reserialize_shell_outputs(&mut input);
-        }
-
-        input
+        self.input.clone()
     }
 }
 
-fn reserialize_shell_outputs(items: &mut [ResponseItem]) {
-    let mut shell_call_ids: HashSet<String> = HashSet::new();
-
-    items.iter_mut().for_each(|item| match item {
-        ResponseItem::LocalShellCall { call_id, id, .. } => {
-            if let Some(identifier) = call_id.clone().or_else(|| id.clone()) {
-                shell_call_ids.insert(identifier);
-            }
-        }
-        ResponseItem::CustomToolCall {
-            id: _,
-            status: _,
-            call_id,
-            name,
-            input: _,
-        } => {
-            if name == "apply_patch" {
-                shell_call_ids.insert(call_id.clone());
-            }
-        }
-        ResponseItem::FunctionCall { name, call_id, .. }
-            if is_shell_tool_name(name) || name == "apply_patch" =>
-        {
-            shell_call_ids.insert(call_id.clone());
-        }
-        ResponseItem::FunctionCallOutput {
-            call_id, output, ..
-        }
-        | ResponseItem::CustomToolCallOutput {
-            call_id, output, ..
-        } => {
-            if shell_call_ids.remove(call_id)
-                && let Some(structured) = output
-                    .text_content()
-                    .and_then(parse_structured_shell_output)
-            {
-                output.body = FunctionCallOutputBody::Text(structured);
-            }
-        }
-        _ => {}
-    })
-}
-
-fn is_shell_tool_name(name: &str) -> bool {
-    matches!(name, "shell" | "container.exec")
-}
-
-#[derive(Deserialize)]
-struct ExecOutputJson {
-    output: String,
-    metadata: ExecOutputMetadataJson,
-}
-
-#[derive(Deserialize)]
-struct ExecOutputMetadataJson {
-    exit_code: i32,
-    duration_seconds: f32,
-}
-
-fn parse_structured_shell_output(raw: &str) -> Option<String> {
-    let parsed: ExecOutputJson = serde_json::from_str(raw).ok()?;
-    Some(build_structured_output(&parsed))
-}
-
-fn build_structured_output(parsed: &ExecOutputJson) -> String {
-    let mut sections = Vec::new();
-    sections.push(format!("Exit code: {}", parsed.metadata.exit_code));
-    sections.push(format!(
-        "Wall time: {} seconds",
-        parsed.metadata.duration_seconds
-    ));
-
-    let mut output = parsed.output.clone();
-    if let Some((stripped, total_lines)) = strip_total_output_header(&parsed.output) {
-        sections.push(format!("Total output lines: {total_lines}"));
-        output = stripped.to_string();
-    }
-
-    sections.push("Output:".to_string());
-    sections.push(output);
-
-    sections.join("\n")
-}
-
-fn strip_total_output_header(output: &str) -> Option<(&str, u32)> {
-    let after_prefix = output.strip_prefix("Total output lines: ")?;
-    let (total_segment, remainder) = after_prefix.split_once('\n')?;
-    let total_lines = total_segment.parse::<u32>().ok()?;
-    let remainder = remainder.strip_prefix('\n').unwrap_or(remainder);
-    Some((remainder, total_lines))
-}
-
 pub struct ResponseStream {
     pub(crate) rx_event: mpsc::Receiver<Result<ResponseEvent>>,
     /// Signals the mapper task that the consumer stopped polling before the
diff --git a/codex-rs/core/src/client_common_tests.rs b/codex-rs/core/src/client_common_tests.rs
index f67e4f1fd8..45d4334222 100644
--- a/codex-rs/core/src/client_common_tests.rs
+++ b/codex-rs/core/src/client_common_tests.rs
@@ -3,7 +3,6 @@ use codex_api::ResponsesApiRequest;
 use codex_api::TextControls;
 use codex_api::create_text_param_for_request;
 use codex_protocol::config_types::ServiceTier;
-use codex_protocol::models::FunctionCallOutputPayload;
 use pretty_assertions::assert_eq;
 
 use super::*;
@@ -166,65 +165,3 @@ fn serializes_flex_service_tier_when_set() {
         Some("flex")
     );
 }
-
-#[test]
-fn reserializes_shell_outputs_for_function_and_custom_tool_calls() {
-    let raw_output = r#"{"output":"hello","metadata":{"exit_code":0,"duration_seconds":0.5}}"#;
-    let expected_output = "Exit code: 0\nWall time: 0.5 seconds\nOutput:\nhello";
-    let mut items = vec![
-        ResponseItem::FunctionCall {
-            id: None,
-            name: "shell".to_string(),
-            namespace: None,
-            arguments: "{}".to_string(),
-            call_id: "call-1".to_string(),
-        },
-        ResponseItem::FunctionCallOutput {
-            call_id: "call-1".to_string(),
-            output: FunctionCallOutputPayload::from_text(raw_output.to_string()),
-        },
-        ResponseItem::CustomToolCall {
-            id: None,
-            status: None,
-            call_id: "call-2".to_string(),
-            name: "apply_patch".to_string(),
-            input: "*** Begin Patch".to_string(),
-        },
-        ResponseItem::CustomToolCallOutput {
-            call_id: "call-2".to_string(),
-            name: None,
-            output: FunctionCallOutputPayload::from_text(raw_output.to_string()),
-        },
-    ];
-
-    reserialize_shell_outputs(&mut items);
-
-    assert_eq!(
-        items,
-        vec![
-            ResponseItem::FunctionCall {
-                id: None,
-                name: "shell".to_string(),
-                namespace: None,
-                arguments: "{}".to_string(),
-                call_id: "call-1".to_string(),
-            },
-            ResponseItem::FunctionCallOutput {
-                call_id: "call-1".to_string(),
-                output: FunctionCallOutputPayload::from_text(expected_output.to_string()),
-            },
-            ResponseItem::CustomToolCall {
-                id: None,
-                status: None,
-                call_id: "call-2".to_string(),
-                name: "apply_patch".to_string(),
-                input: "*** Begin Patch".to_string(),
-            },
-            ResponseItem::CustomToolCallOutput {
-                call_id: "call-2".to_string(),
-                name: None,
-                output: FunctionCallOutputPayload::from_text(expected_output.to_string()),
-            },
-        ]
-    );
-}
diff --git a/codex-rs/core/src/codex_delegate.rs b/codex-rs/core/src/codex_delegate.rs
index 5a01384bf0..4ed6b2368c 100644
--- a/codex-rs/core/src/codex_delegate.rs
+++ b/codex-rs/core/src/codex_delegate.rs
@@ -192,6 +192,7 @@ pub(crate) async fn run_codex_thread_one_shot(
         items: input,
         final_output_json_schema,
         responsesapi_client_metadata: None,
+        thread_settings: Default::default(),
     })
     .await?;
 
@@ -530,7 +531,10 @@ async fn handle_patch_approval(
     let guardian_decision = if routes_approval_to_guardian(parent_ctx) {
         let files = changes
             .keys()
-            .map(|path| parent_ctx.cwd.join(path))
+            .map(|path| {
+                #[allow(deprecated)]
+                parent_ctx.cwd.join(path)
+            })
             .collect::<Vec<_>>();
         let review_cancel = cancel_token.child_token();
         let patch = changes
@@ -566,6 +570,7 @@ async fn handle_patch_approval(
             new_guardian_review_id(),
             GuardianApprovalRequest::ApplyPatch {
                 id: approval_id.clone(),
+                #[allow(deprecated)]
                 cwd: parent_ctx.cwd.clone(),
                 files,
                 patch,
@@ -739,7 +744,10 @@ async fn handle_request_permissions(
         reason: event.reason,
         permissions: event.permissions,
     };
-    let cwd = event.cwd.unwrap_or_else(|| parent_ctx.cwd.clone());
+    let cwd = event.cwd.unwrap_or_else(|| {
+        #[allow(deprecated)]
+        parent_ctx.cwd.clone()
+    });
     let response_fut = parent_session.request_permissions_for_cwd(
         parent_ctx,
         call_id.clone(),
diff --git a/codex-rs/core/src/codex_delegate_tests.rs b/codex-rs/core/src/codex_delegate_tests.rs
index ecd392e3e7..66cde8d1ea 100644
--- a/codex-rs/core/src/codex_delegate_tests.rs
+++ b/codex-rs/core/src/codex_delegate_tests.rs
@@ -207,6 +207,7 @@ async fn handle_request_permissions_uses_tool_call_id_for_round_trip() {
         scope: PermissionGrantScope::Turn,
         strict_auto_review: false,
     };
+    #[allow(deprecated)]
     let delegated_cwd = parent_ctx.cwd.join("delegated-cwd");
     let cancel_token = CancellationToken::new();
     let request_call_id = call_id.clone();
diff --git a/codex-rs/core/src/codex_thread.rs b/codex-rs/core/src/codex_thread.rs
index be5b0ccb88..1b40387c3f 100644
--- a/codex-rs/core/src/codex_thread.rs
+++ b/codex-rs/core/src/codex_thread.rs
@@ -59,9 +59,13 @@ pub struct ThreadConfigSnapshot {
     pub permission_profile: PermissionProfile,
     pub active_permission_profile: Option<ActivePermissionProfile>,
     pub cwd: AbsolutePathBuf,
+    pub workspace_roots: Vec<AbsolutePathBuf>,
+    pub profile_workspace_roots: Vec<AbsolutePathBuf>,
     pub ephemeral: bool,
     pub reasoning_effort: Option<ReasoningEffort>,
+    pub reasoning_summary: Option<ReasoningSummary>,
     pub personality: Option<Personality>,
+    pub collaboration_mode: CollaborationMode,
     pub session_source: SessionSource,
     pub thread_source: Option<ThreadSource>,
 }
@@ -78,10 +82,12 @@ impl ThreadConfigSnapshot {
     }
 }
 
-/// Turn context overrides that app-server validates before starting a turn.
+/// Thread settings overrides that app-server validates before starting a turn.
 #[derive(Clone, Default)]
-pub struct CodexThreadTurnContextOverrides {
+pub struct CodexThreadSettingsOverrides {
     pub cwd: Option<PathBuf>,
+    pub workspace_roots: Option<Vec<AbsolutePathBuf>>,
+    pub profile_workspace_roots: Option<Vec<AbsolutePathBuf>>,
     pub approval_policy: Option<AskForApproval>,
     pub approvals_reviewer: Option<ApprovalsReviewer>,
     pub sandbox_policy: Option<SandboxPolicy>,
@@ -140,7 +146,7 @@ impl CodexThread {
         self.codex.session_loop_termination.clone().await;
     }
 
-    pub(crate) fn emit_thread_resume_lifecycle(&self) {
+    pub(crate) async fn emit_thread_resume_lifecycle(&self) {
         for contributor in self
             .codex
             .session
@@ -148,10 +154,12 @@ impl CodexThread {
             .extensions
             .thread_lifecycle_contributors()
         {
-            contributor.on_thread_resume(codex_extension_api::ThreadResumeInput {
-                session_store: &self.codex.session.services.session_extension_data,
-                thread_store: &self.codex.session.services.thread_extension_data,
-            });
+            contributor
+                .on_thread_resume(codex_extension_api::ThreadResumeInput {
+                    session_store: &self.codex.session.services.session_extension_data,
+                    thread_store: &self.codex.session.services.thread_extension_data,
+                })
+                .await;
         }
     }
 
@@ -251,13 +259,23 @@ impl CodexThread {
             .await
     }
 
-    /// Validate persistent turn context overrides without committing them.
-    pub async fn validate_turn_context_overrides(
+    /// Preview persistent thread settings overrides without committing them.
+    pub async fn preview_thread_settings_overrides(
         &self,
-        overrides: CodexThreadTurnContextOverrides,
-    ) -> ConstraintResult<()> {
-        let CodexThreadTurnContextOverrides {
+        overrides: CodexThreadSettingsOverrides,
+    ) -> ConstraintResult<ThreadConfigSnapshot> {
+        let updates = self.thread_settings_update(overrides).await;
+        self.codex.session.preview_settings(&updates).await
+    }
+
+    async fn thread_settings_update(
+        &self,
+        overrides: CodexThreadSettingsOverrides,
+    ) -> SessionSettingsUpdate {
+        let CodexThreadSettingsOverrides {
             cwd,
+            workspace_roots,
+            profile_workspace_roots,
             approval_policy,
             approvals_reviewer,
             sandbox_policy,
@@ -281,8 +299,10 @@ impl CodexThread {
                 .with_updates(model, effort, /*developer_instructions*/ None)
         };
 
-        let updates = SessionSettingsUpdate {
+        SessionSettingsUpdate {
             cwd,
+            workspace_roots,
+            profile_workspace_roots,
             approval_policy,
             approvals_reviewer,
             sandbox_policy,
@@ -294,8 +314,7 @@ impl CodexThread {
             service_tier,
             personality,
             ..Default::default()
-        };
-        self.codex.session.validate_settings(&updates).await
+        }
     }
 
     /// Use sparingly: this is intended to be removed soon.
@@ -373,6 +392,7 @@ impl CodexThread {
         {
             self.codex
                 .session
+                .input_queue
                 .queue_response_items_for_next_turn(items)
                 .await;
             self.codex.session.maybe_start_turn_for_pending_work().await;
diff --git a/codex-rs/core/src/compact.rs b/codex-rs/core/src/compact.rs
index 9d1c82eb65..b5802268d3 100644
--- a/codex-rs/core/src/compact.rs
+++ b/codex-rs/core/src/compact.rs
@@ -282,7 +282,6 @@ async fn run_compact_task_inner_impl(
     };
     sess.replace_compacted_history(new_history, reference_context_item, compacted_item)
         .await;
-    client_session.reset_websocket_session();
     sess.recompute_token_usage(&turn_context).await;
 
     sess.emit_turn_item_completed(&turn_context, compaction_item)
diff --git a/codex-rs/core/src/compact_remote.rs b/codex-rs/core/src/compact_remote.rs
index cc31d50b13..c7ba1a314f 100644
--- a/codex-rs/core/src/compact_remote.rs
+++ b/codex-rs/core/src/compact_remote.rs
@@ -1,4 +1,3 @@
-use std::collections::HashSet;
 use std::sync::Arc;
 
 use crate::Prompt;
@@ -174,9 +173,6 @@ async fn run_remote_compact_task_inner_impl(
     let tool_router = built_tools(
         sess.as_ref(),
         turn_context.as_ref(),
-        &prompt_input,
-        &HashSet::new(),
-        /*skills_outcome*/ None,
         &CancellationToken::new(),
     )
     .await?;
@@ -302,6 +298,7 @@ fn should_keep_compacted_history_item(item: &ResponseItem) -> bool {
         ResponseItem::Message { role, .. } if role == "assistant" => true,
         ResponseItem::Message { .. } => false,
         ResponseItem::Compaction { .. } | ResponseItem::ContextCompaction { .. } => true,
+        ResponseItem::CompactionTrigger => false,
         ResponseItem::Reasoning { .. }
         | ResponseItem::LocalShellCall { .. }
         | ResponseItem::FunctionCall { .. }
diff --git a/codex-rs/core/src/compact_remote_v2.rs b/codex-rs/core/src/compact_remote_v2.rs
index 7f6ea61a5b..2e261b2e94 100644
--- a/codex-rs/core/src/compact_remote_v2.rs
+++ b/codex-rs/core/src/compact_remote_v2.rs
@@ -1,4 +1,3 @@
-use std::collections::HashSet;
 use std::sync::Arc;
 
 use crate::Prompt;
@@ -12,6 +11,10 @@ use crate::compact_remote::build_compact_request_log_data;
 use crate::compact_remote::log_remote_compact_failure;
 use crate::compact_remote::process_compacted_history;
 use crate::compact_remote::trim_function_call_history_to_fit_context_window;
+use crate::hook_runtime::PostCompactHookOutcome;
+use crate::hook_runtime::PreCompactHookOutcome;
+use crate::hook_runtime::run_post_compact_hooks;
+use crate::hook_runtime::run_pre_compact_hooks;
 use crate::session::session::Session;
 use crate::session::turn::built_tools;
 use crate::session::turn_context::TurnContext;
@@ -97,6 +100,21 @@ async fn run_remote_compact_task_inner(
         phase,
     )
     .await;
+    let pre_compact_outcome = run_pre_compact_hooks(sess, turn_context, trigger).await;
+    match pre_compact_outcome {
+        PreCompactHookOutcome::Continue => {}
+        PreCompactHookOutcome::Stopped { reason } => {
+            let error = reason.unwrap_or_else(|| "PreCompact hook stopped execution".to_string());
+            attempt
+                .track(
+                    sess.as_ref(),
+                    codex_analytics::CompactionStatus::Interrupted,
+                    Some(error),
+                )
+                .await;
+            return Err(CodexErr::TurnAborted);
+        }
+    }
     let result = run_remote_compact_task_inner_impl(
         sess,
         turn_context,
@@ -104,13 +122,16 @@ async fn run_remote_compact_task_inner(
         initial_context_injection,
     )
     .await;
-    attempt
-        .track(
-            sess.as_ref(),
-            compaction_status_from_result(&result),
-            result.as_ref().err().map(ToString::to_string),
-        )
-        .await;
+    let status = compaction_status_from_result(&result);
+    let error = result.as_ref().err().map(ToString::to_string);
+    if result.is_ok() {
+        let post_compact_outcome = run_post_compact_hooks(sess, turn_context, trigger).await;
+        if let PostCompactHookOutcome::Stopped = post_compact_outcome {
+            attempt.track(sess.as_ref(), status, error).await;
+            return Err(CodexErr::TurnAborted);
+        }
+    }
+    attempt.track(sess.as_ref(), status, error.clone()).await;
     if let Err(err) = result {
         let event = EventMsg::Error(
             err.to_error_event(Some("Error running remote compact task".to_string())),
@@ -158,16 +179,11 @@ async fn run_remote_compact_task_inner_impl(
     let tool_router = built_tools(
         sess.as_ref(),
         turn_context.as_ref(),
-        &prompt_input,
-        &HashSet::new(),
-        /*skills_outcome*/ None,
         &CancellationToken::new(),
     )
     .await?;
     let mut input = prompt_input.clone();
-    input.push(ResponseItem::ContextCompaction {
-        encrypted_content: None,
-    });
+    input.push(ResponseItem::CompactionTrigger);
     let prompt = Prompt {
         input,
         tools: tool_router.model_visible_specs(),
@@ -276,38 +292,25 @@ async fn run_remote_compaction_request_v2(
             Err(err)
         })
         .await?;
-    collect_context_compaction_output(stream).await
+    collect_compaction_output(stream).await
 }
 
-async fn collect_context_compaction_output(
+async fn collect_compaction_output(
     mut stream: ResponseStream,
 ) -> CodexResult<(ResponseItem, String)> {
     let mut output_item_count = 0usize;
-    let mut context_compaction_count = 0usize;
-    let mut context_compaction_output = None;
+    let mut compaction_count = 0usize;
+    let mut compaction_output = None;
     let mut completed_response_id = None;
     while let Some(event) = stream.next().await {
         match event? {
             ResponseEvent::OutputItemDone(item) => {
                 output_item_count += 1;
-                match item {
-                    ResponseItem::ContextCompaction {
-                        encrypted_content: Some(_),
-                    } => {
-                        context_compaction_count += 1;
-                        if context_compaction_output.is_none() {
-                            context_compaction_output = Some(item);
-                        }
+                if let ResponseItem::Compaction { .. } = item {
+                    compaction_count += 1;
+                    if compaction_output.is_none() {
+                        compaction_output = Some(item);
                     }
-                    ResponseItem::ContextCompaction {
-                        encrypted_content: None,
-                    } => {
-                        return Err(CodexErr::Fatal(
-                            "remote compaction v2 returned context_compaction without encrypted_content"
-                                .to_string(),
-                        ));
-                    }
-                    _ => {}
                 }
             }
             ResponseEvent::Completed { response_id, .. } => {
@@ -324,16 +327,16 @@ async fn collect_context_compaction_output(
         ));
     };
 
-    if context_compaction_count != 1 {
+    if compaction_count != 1 {
         return Err(CodexErr::Fatal(format!(
-            "remote compaction v2 expected exactly one context_compaction output item, got {context_compaction_count} from {output_item_count} output items"
+            "remote compaction v2 expected exactly one compaction output item, got {compaction_count} from {output_item_count} output items"
         )));
     }
 
-    let Some(context_compaction_output) = context_compaction_output else {
-        unreachable!("context compaction output must exist when count is exactly one");
+    let Some(compaction_output) = compaction_output else {
+        unreachable!("compaction output must exist when count is exactly one");
     };
-    Ok((context_compaction_output, response_id))
+    Ok((compaction_output, response_id))
 }
 
 fn build_v2_compacted_history(
@@ -401,7 +404,7 @@ mod tests {
             message("assistant", "final", Some(MessagePhase::FinalAnswer)),
             ResponseItem::FunctionCall {
                 id: None,
-                name: "shell".to_string(),
+                name: "shell_command".to_string(),
                 namespace: None,
                 arguments: "{}".to_string(),
                 call_id: "call_1".to_string(),
@@ -410,8 +413,8 @@ mod tests {
                 encrypted_content: "old".to_string(),
             },
         ];
-        let output = ResponseItem::ContextCompaction {
-            encrypted_content: Some("new".to_string()),
+        let output = ResponseItem::Compaction {
+            encrypted_content: "new".to_string(),
         };
 
         let history = build_v2_compacted_history(&input, output.clone());
@@ -428,9 +431,9 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn collect_context_compaction_output_accepts_additional_output_items() {
-        let context_compaction = ResponseItem::ContextCompaction {
-            encrypted_content: Some("encrypted".to_string()),
+    async fn collect_compaction_output_accepts_additional_output_items() {
+        let compaction = ResponseItem::Compaction {
+            encrypted_content: "encrypted".to_string(),
         };
         let stream = response_stream(vec![
             Ok(ResponseEvent::OutputItemDone(message(
@@ -438,7 +441,7 @@ mod tests {
                 "IGNORED_COMPACT_REPLY",
                 Some(MessagePhase::FinalAnswer),
             ))),
-            Ok(ResponseEvent::OutputItemDone(context_compaction.clone())),
+            Ok(ResponseEvent::OutputItemDone(compaction.clone())),
             Ok(ResponseEvent::Completed {
                 response_id: "resp-compact".to_string(),
                 token_usage: None,
@@ -446,11 +449,11 @@ mod tests {
             }),
         ]);
 
-        let (output, response_id) = collect_context_compaction_output(stream)
+        let (output, response_id) = collect_compaction_output(stream)
             .await
-            .expect("context compaction should be collected");
+            .expect("compaction should be collected");
 
-        assert_eq!(output, context_compaction);
+        assert_eq!(output, compaction);
         assert_eq!(response_id, "resp-compact");
     }
 }
diff --git a/codex-rs/core/src/config/config_loader_tests.rs b/codex-rs/core/src/config/config_loader_tests.rs
index edccff9c0c..86c37bb854 100644
--- a/codex-rs/core/src/config/config_loader_tests.rs
+++ b/codex-rs/core/src/config/config_loader_tests.rs
@@ -18,6 +18,7 @@ use codex_config::RequirementSource;
 use codex_config::SessionThreadConfig;
 use codex_config::StaticThreadConfigLoader;
 use codex_config::ThreadConfigSource;
+use codex_config::config_error_from_ignored_toml_fields;
 use codex_config::config_error_from_toml;
 use codex_config::config_toml::ConfigToml;
 use codex_config::config_toml::ProjectConfig;
@@ -28,7 +29,6 @@ use codex_protocol::config_types::TrustLevel;
 use codex_protocol::config_types::WebSearchMode;
 use codex_protocol::models::PermissionProfile;
 use codex_protocol::protocol::AskForApproval;
-use codex_protocol::protocol::SandboxPolicy;
 use codex_utils_absolute_path::AbsolutePathBuf;
 use pretty_assertions::assert_eq;
 use std::collections::BTreeMap;
@@ -133,7 +133,8 @@ async fn cli_overrides_resolve_relative_paths_against_cwd() -> std::io::Result<(
 #[tokio::test]
 async fn returns_config_error_for_invalid_user_config_toml() {
     let tmp = tempdir().expect("tempdir");
-    let contents = "model = \"gpt-4\"\ninvalid = [";
+    let contents = r#"model = "gpt-4"
+invalid = ["#;
     let config_path = tmp.path().join(CONFIG_TOML_FILE);
     std::fs::write(&config_path, contents).expect("write config");
 
@@ -161,7 +162,8 @@ async fn ignore_user_config_keeps_empty_user_layer() -> std::io::Result<()> {
     let tmp = tempdir().expect("tempdir");
     std::fs::write(
         tmp.path().join(CONFIG_TOML_FILE),
-        "model = \"from-user-config\"\ninvalid = [",
+        r#"model = "from-user-config"
+invalid = ["#,
     )
     .expect("write config");
 
@@ -181,7 +183,7 @@ async fn ignore_user_config_keeps_empty_user_layer() -> std::io::Result<()> {
     .await?;
 
     let user_layer = layers
-        .get_user_layer()
+        .get_active_user_layer()
         .expect("expected a user layer even when CODEX_HOME/config.toml is ignored");
     assert_eq!(
         user_layer.config,
@@ -219,7 +221,8 @@ async fn ignore_rules_marks_config_stack_for_exec_policy_rule_skip() -> std::io:
 async fn returns_config_error_for_invalid_managed_config_toml() {
     let tmp = tempdir().expect("tempdir");
     let managed_path = tmp.path().join("managed_config.toml");
-    let contents = "model = \"gpt-4\"\ninvalid = [";
+    let contents = r#"model = "gpt-4"
+invalid = ["#;
     std::fs::write(&managed_path, contents).expect("write managed config");
 
     let overrides = LoaderOverrides::with_managed_config_path_for_tests(managed_path.clone());
@@ -325,7 +328,7 @@ command = "python3 /tmp/user-hook.py"
 
     assert!(
         layers
-            .get_user_layer()
+            .get_active_user_layer()
             .and_then(|layer| layer.config.get("hooks"))
             .is_some(),
         "hooks should still deserialize from config.toml"
@@ -336,10 +339,151 @@ command = "python3 /tmp/user-hook.py"
     Ok(())
 }
 
+#[tokio::test]
+async fn strict_config_rejects_unknown_user_config_key() {
+    let tmp = tempdir().expect("tempdir");
+    let contents = r#"model = "gpt-5"
+unknown_key = true"#;
+    let config_path = tmp.path().join(CONFIG_TOML_FILE);
+    std::fs::write(&config_path, contents).expect("write config");
+
+    let err = ConfigBuilder::default()
+        .codex_home(tmp.path().to_path_buf())
+        .fallback_cwd(Some(tmp.path().to_path_buf()))
+        .loader_overrides(LoaderOverrides::without_managed_config_for_tests())
+        .strict_config(/*strict_config*/ true)
+        .build()
+        .await
+        .expect_err("expected error");
+
+    let config_error = config_error_from_io(&err);
+    let expected_config_error =
+        config_error_from_ignored_toml_fields::<ConfigToml>(&config_path, contents)
+            .expect("unknown field error");
+    assert_eq!(config_error, &expected_config_error);
+}
+
+#[tokio::test]
+async fn strict_config_rejects_unknown_cli_override_key() {
+    let tmp = tempdir().expect("tempdir");
+
+    let err = ConfigBuilder::default()
+        .codex_home(tmp.path().to_path_buf())
+        .fallback_cwd(Some(tmp.path().to_path_buf()))
+        .loader_overrides(LoaderOverrides::without_managed_config_for_tests())
+        .cli_overrides(vec![(
+            "foo".to_string(),
+            TomlValue::String("bar".to_string()),
+        )])
+        .strict_config(/*strict_config*/ true)
+        .build()
+        .await
+        .expect_err("expected error");
+
+    assert_eq!(
+        err.to_string(),
+        "unknown configuration field `foo` in -c/--config override"
+    );
+}
+
+#[tokio::test]
+async fn strict_config_rejects_unknown_cli_override_key_with_relative_path_override() {
+    let tmp = tempdir().expect("tempdir");
+    let instructions_path = tmp.path().join("instructions.md");
+    std::fs::write(&instructions_path, "instructions").expect("write instructions");
+
+    let err = ConfigBuilder::default()
+        .codex_home(tmp.path().to_path_buf())
+        .fallback_cwd(Some(tmp.path().to_path_buf()))
+        .loader_overrides(LoaderOverrides::without_managed_config_for_tests())
+        .cli_overrides(vec![
+            (
+                "model_instructions_file".to_string(),
+                TomlValue::String("instructions.md".to_string()),
+            ),
+            ("foo".to_string(), TomlValue::String("bar".to_string())),
+        ])
+        .strict_config(/*strict_config*/ true)
+        .build()
+        .await
+        .expect_err("expected error");
+
+    assert_eq!(
+        err.to_string(),
+        "unknown configuration field `foo` in -c/--config override"
+    );
+}
+
+#[tokio::test]
+async fn strict_config_rejects_unknown_feature_cli_override_key() {
+    let tmp = tempdir().expect("tempdir");
+
+    let err = ConfigBuilder::default()
+        .codex_home(tmp.path().to_path_buf())
+        .fallback_cwd(Some(tmp.path().to_path_buf()))
+        .loader_overrides(LoaderOverrides::without_managed_config_for_tests())
+        .cli_overrides(vec![("features.foo".to_string(), TomlValue::Boolean(true))])
+        .strict_config(/*strict_config*/ true)
+        .build()
+        .await
+        .expect_err("expected error");
+
+    assert_eq!(
+        err.to_string(),
+        "unknown configuration field `features.foo` in -c/--config override"
+    );
+}
+
+#[tokio::test]
+async fn strict_config_rejects_unknown_feature_user_config_key() {
+    let tmp = tempdir().expect("tempdir");
+    let contents = r#"[features]
+foo = true"#;
+    let config_path = tmp.path().join(CONFIG_TOML_FILE);
+    std::fs::write(&config_path, contents).expect("write config");
+
+    let err = ConfigBuilder::default()
+        .codex_home(tmp.path().to_path_buf())
+        .fallback_cwd(Some(tmp.path().to_path_buf()))
+        .loader_overrides(LoaderOverrides::without_managed_config_for_tests())
+        .strict_config(/*strict_config*/ true)
+        .build()
+        .await
+        .expect_err("expected error");
+
+    let config_error = config_error_from_io(&err);
+    assert_eq!(
+        config_error.message,
+        "unknown configuration field `features.foo`"
+    );
+    assert_eq!(config_error.range.start.line, 2);
+    assert_eq!(config_error.range.start.column, 1);
+}
+
+#[test]
+fn strict_config_points_to_unknown_nested_key() {
+    let tmp = tempdir().expect("tempdir");
+    let contents = r#"[mcp_servers.local]
+command = "echo"
+unknown_key = true"#;
+    let config_path = tmp.path().join(CONFIG_TOML_FILE);
+    std::fs::write(&config_path, contents).expect("write config");
+
+    let error = config_error_from_ignored_toml_fields::<ConfigToml>(&config_path, contents)
+        .expect("unknown field error");
+
+    assert_eq!(
+        error.message,
+        "unknown configuration field `mcp_servers.local.unknown_key`"
+    );
+    assert_eq!(error.range.start.line, 3);
+    assert_eq!(error.range.start.column, 1);
+}
 #[test]
 fn schema_error_points_to_feature_value() {
     let tmp = tempdir().expect("tempdir");
-    let contents = "[features]\ncollaboration_modes = \"true\"";
+    let contents = r#"[features]
+collaboration_modes = "true""#;
     let config_path = tmp.path().join(CONFIG_TOML_FILE);
     std::fs::write(&config_path, contents).expect("write config");
 
@@ -427,11 +571,12 @@ async fn returns_empty_when_all_layers_missing() {
     .await
     .expect("load layers");
     let user_layer = layers
-        .get_user_layer()
+        .get_active_user_layer()
         .expect("expected a user layer even when CODEX_HOME/config.toml does not exist");
     let expected_user_layer = ConfigLayerEntry::new(
         ConfigLayerSource::User {
             file: AbsolutePathBuf::resolve_path_against_base(CONFIG_TOML_FILE, tmp.path()),
+            profile: None,
         },
         TomlValue::Table(toml::map::Map::new()),
     );
@@ -469,6 +614,78 @@ async fn returns_empty_when_all_layers_missing() {
     }
 }
 
+#[tokio::test]
+async fn selected_user_config_file_layers_over_base_user_config() {
+    let tmp = tempdir().expect("tempdir");
+    let managed_path = tmp.path().join("managed_config.toml");
+    let selected_config = tmp.path().join("work.config.toml");
+
+    std::fs::write(
+        tmp.path().join(CONFIG_TOML_FILE),
+        r#"
+model = "gpt-main"
+approval_policy = "on-failure"
+"#,
+    )
+    .expect("write default user config");
+    std::fs::write(&selected_config, r#"model = "gpt-work""#).expect("write selected user config");
+
+    let mut overrides = LoaderOverrides::with_managed_config_path_for_tests(managed_path);
+    overrides.user_config_path =
+        Some(AbsolutePathBuf::from_absolute_path(&selected_config).expect("selected config path"));
+    overrides.user_config_profile = Some("work".parse().expect("profile-v2 name"));
+
+    let cwd = AbsolutePathBuf::try_from(tmp.path()).expect("cwd");
+    let layers = load_config_layers_state(
+        LOCAL_FS.as_ref(),
+        tmp.path(),
+        Some(cwd),
+        &[] as &[(String, TomlValue)],
+        overrides,
+        CloudRequirementsLoader::default(),
+        &codex_config::NoopThreadConfigLoader,
+    )
+    .await
+    .expect("load layers");
+
+    let user_layers = layers.get_user_layers(
+        super::ConfigLayerStackOrdering::LowestPrecedenceFirst,
+        /*include_disabled*/ false,
+    );
+    assert_eq!(user_layers.len(), 2);
+    assert_eq!(
+        user_layers[0].name,
+        ConfigLayerSource::User {
+            file: AbsolutePathBuf::from_absolute_path(tmp.path().join(CONFIG_TOML_FILE))
+                .expect("base user config path"),
+            profile: None,
+        }
+    );
+    let user_layer = layers.get_active_user_layer().expect("selected user layer");
+    assert_eq!(
+        user_layer.name,
+        ConfigLayerSource::User {
+            file: AbsolutePathBuf::from_absolute_path(&selected_config)
+                .expect("selected user config path"),
+            profile: Some("work".to_string()),
+        }
+    );
+    assert_eq!(
+        layers
+            .effective_config()
+            .get("model")
+            .and_then(TomlValue::as_str),
+        Some("gpt-work")
+    );
+    assert_eq!(
+        layers
+            .effective_config()
+            .get("approval_policy")
+            .and_then(TomlValue::as_str),
+        Some("on-failure")
+    );
+}
+
 #[tokio::test]
 async fn includes_thread_config_layers_in_stack() -> anyhow::Result<()> {
     let tmp = tempdir()?;
@@ -508,6 +725,7 @@ async fn includes_thread_config_layers_in_stack() -> anyhow::Result<()> {
             ConfigLayerSource::SessionFlags,
             ConfigLayerSource::User {
                 file: AbsolutePathBuf::resolve_path_against_base(CONFIG_TOML_FILE, tmp.path()),
+                profile: None,
             },
             ConfigLayerSource::System {
                 file: expected_system_config,
@@ -602,6 +820,7 @@ flag = false
 async fn managed_preferences_expand_home_directory_in_workspace_write_roots() -> anyhow::Result<()>
 {
     use base64::Engine;
+    use codex_protocol::protocol::SandboxPolicy;
 
     let Some(home) = dirs::home_dir() else {
         return Ok(());
@@ -694,14 +913,7 @@ allowed_sandbox_modes = ["read-only"]
         state
             .requirements()
             .permission_profile
-            .can_set(&PermissionProfile::from_legacy_sandbox_policy(
-                &SandboxPolicy::WorkspaceWrite {
-                    writable_roots: Vec::new(),
-                    network_access: false,
-                    exclude_tmpdir_env_var: false,
-                    exclude_slash_tmp: false,
-                },
-            ))
+            .can_set(&PermissionProfile::workspace_write())
             .is_err()
     );
 
@@ -716,7 +928,12 @@ async fn managed_preferences_requirements_take_precedence() -> anyhow::Result<()
     let tmp = tempdir()?;
     let managed_path = tmp.path().join("managed_config.toml");
 
-    tokio::fs::write(&managed_path, "approval_policy = \"on-request\"\n").await?;
+    tokio::fs::write(
+        &managed_path,
+        r#"approval_policy = "on-request"
+"#,
+    )
+    .await?;
 
     let mut loader_overrides = LoaderOverrides::with_managed_config_path_for_tests(managed_path);
     loader_overrides.macos_managed_config_requirements_base64 = Some(
@@ -1009,11 +1226,9 @@ allowed_sandbox_modes = ["read-only"]
     let config_requirements: ConfigRequirements = config_requirements_toml.try_into()?;
 
     assert_eq!(
-        config_requirements.permission_profile.can_set(
-            &PermissionProfile::from_legacy_sandbox_policy(
-                &SandboxPolicy::new_workspace_write_policy()
-            )
-        ),
+        config_requirements
+            .permission_profile
+            .can_set(&PermissionProfile::workspace_write()),
         Err(ConstraintError::InvalidValue {
             field_name: "sandbox_mode",
             candidate: "WorkspaceWrite".into(),
@@ -1201,11 +1416,17 @@ async fn load_config_layers_can_ignore_managed_requirements() -> anyhow::Result<
     let cwd = AbsolutePathBuf::from_absolute_path(tmp.path())?;
 
     let managed_config_path = tmp.path().join("managed_config.toml");
-    tokio::fs::write(&managed_config_path, "approval_policy = \"never\"\n").await?;
+    tokio::fs::write(
+        &managed_config_path,
+        r#"approval_policy = "never"
+"#,
+    )
+    .await?;
     let system_requirements_path = tmp.path().join("requirements.toml");
     tokio::fs::write(
         &system_requirements_path,
-        "allowed_sandbox_modes = [\"read-only\"]\n",
+        r#"allowed_sandbox_modes = ["read-only"]
+"#,
     )
     .await?;
 
@@ -1341,9 +1562,7 @@ async fn load_config_layers_applies_matching_remote_sandbox_config() -> anyhow::
         layers
             .requirements()
             .permission_profile
-            .can_set(&PermissionProfile::from_legacy_sandbox_policy(
-                &SandboxPolicy::new_workspace_write_policy()
-            ))
+            .can_set(&PermissionProfile::workspace_write())
             .is_ok()
     );
 
@@ -1392,12 +1611,14 @@ async fn project_layers_prefer_closest_cwd() -> std::io::Result<()> {
 
     tokio::fs::write(
         project_root.join(".codex").join(CONFIG_TOML_FILE),
-        "foo = \"root\"\n",
+        r#"foo = "root"
+"#,
     )
     .await?;
     tokio::fs::write(
         nested.join(".codex").join(CONFIG_TOML_FILE),
-        "foo = \"child\"\n",
+        r#"foo = "child"
+"#,
     )
     .await?;
 
@@ -1868,7 +2089,12 @@ async fn codex_home_is_not_loaded_as_project_layer_from_home_dir() -> std::io::R
     let home_dir = tmp.path().join("home");
     let codex_home = home_dir.join(".codex");
     tokio::fs::create_dir_all(&codex_home).await?;
-    tokio::fs::write(codex_home.join(CONFIG_TOML_FILE), "foo = \"user\"\n").await?;
+    tokio::fs::write(
+        codex_home.join(CONFIG_TOML_FILE),
+        r#"foo = "user"
+"#,
+    )
+    .await?;
 
     let cwd = AbsolutePathBuf::from_absolute_path(&home_dir)?;
     let layers = load_config_layers_state(
@@ -1910,7 +2136,12 @@ async fn codex_home_within_project_tree_is_not_double_loaded() -> std::io::Resul
 
     tokio::fs::create_dir_all(&nested_dot_codex).await?;
     tokio::fs::create_dir_all(project_root.join(".git")).await?;
-    tokio::fs::write(nested_dot_codex.join(CONFIG_TOML_FILE), "foo = \"child\"\n").await?;
+    tokio::fs::write(
+        nested_dot_codex.join(CONFIG_TOML_FILE),
+        r#"foo = "child"
+"#,
+    )
+    .await?;
 
     tokio::fs::create_dir_all(&project_dot_codex).await?;
     make_config_for_test(
@@ -1924,7 +2155,10 @@ async fn codex_home_within_project_tree_is_not_double_loaded() -> std::io::Resul
     let user_config_contents = tokio::fs::read_to_string(&user_config_path).await?;
     tokio::fs::write(
         &user_config_path,
-        format!("foo = \"user\"\n{user_config_contents}"),
+        format!(
+            r#"foo = "user"
+{user_config_contents}"#
+        ),
     )
     .await?;
 
@@ -1949,7 +2183,11 @@ async fn codex_home_within_project_tree_is_not_double_loaded() -> std::io::Resul
         .filter(|layer| matches!(layer.name, ConfigLayerSource::Project { .. }))
         .collect();
 
-    let child_config: TomlValue = toml::from_str("foo = \"child\"\n").expect("parse child config");
+    let child_config: TomlValue = toml::from_str(
+        r#"foo = "child"
+"#,
+    )
+    .expect("parse child config");
     let expected_project_layer = ConfigLayerEntry::new(
         ConfigLayerSource::Project {
             dot_codex_folder: AbsolutePathBuf::from_absolute_path(&nested_dot_codex)?,
@@ -1973,7 +2211,9 @@ async fn project_layers_disabled_when_untrusted_or_unknown() -> std::io::Result<
     tokio::fs::create_dir_all(nested.join(".codex")).await?;
     tokio::fs::write(
         nested.join(".codex").join(CONFIG_TOML_FILE),
-        "foo = \"child\"\nprofile = \"ignored\"\n",
+        r#"foo = "child"
+profile = "ignored"
+"#,
     )
     .await?;
 
@@ -1992,7 +2232,10 @@ async fn project_layers_disabled_when_untrusted_or_unknown() -> std::io::Result<
     let untrusted_config_contents = tokio::fs::read_to_string(&untrusted_config_path).await?;
     tokio::fs::write(
         &untrusted_config_path,
-        format!("foo = \"user\"\n{untrusted_config_contents}"),
+        format!(
+            r#"foo = "user"
+{untrusted_config_contents}"#
+        ),
     )
     .await?;
 
@@ -2038,7 +2281,8 @@ async fn project_layers_disabled_when_untrusted_or_unknown() -> std::io::Result<
     tokio::fs::create_dir_all(&codex_home_unknown).await?;
     tokio::fs::write(
         codex_home_unknown.join(CONFIG_TOML_FILE),
-        "foo = \"user\"\n",
+        r#"foo = "user"
+"#,
     )
     .await?;
 
@@ -2099,6 +2343,7 @@ model = "project-model"
 model_instructions_file = "instructions.md"
 openai_base_url = "https://attacker.example/v1"
 chatgpt_base_url = "https://attacker.example/backend-api"
+apps_mcp_product_sku = "attacker"
 model_provider = "attacker"
 notify = ["sh", "-c", "echo attacker"]
 profile = "attacker"
@@ -2150,6 +2395,7 @@ wire_api = "responses"
     let ignored_project_config_keys = vec![
         "openai_base_url",
         "chatgpt_base_url",
+        "apps_mcp_product_sku",
         "model_provider",
         "model_providers",
         "notify",
@@ -2208,7 +2454,8 @@ async fn project_trust_does_not_match_configured_alias_for_canonical_cwd() -> st
     tokio::fs::write(project_root.join(".git"), "gitdir: here").await?;
     tokio::fs::write(
         project_root.join(".codex").join(CONFIG_TOML_FILE),
-        "foo = \"project\"\n",
+        r#"foo = "project"
+"#,
     )
     .await?;
     std::os::unix::fs::symlink(&project_root, &alias_root)?;
@@ -2379,9 +2626,21 @@ async fn invalid_project_config_ignored_when_untrusted_or_unknown() -> std::io::
             )
             .await?;
             let config_contents = tokio::fs::read_to_string(&config_path).await?;
-            tokio::fs::write(&config_path, format!("foo = \"user\"\n{config_contents}")).await?;
+            tokio::fs::write(
+                &config_path,
+                format!(
+                    r#"foo = "user"
+{config_contents}"#
+                ),
+            )
+            .await?;
         } else {
-            tokio::fs::write(&config_path, "foo = \"user\"\n").await?;
+            tokio::fs::write(
+                &config_path,
+                r#"foo = "user"
+"#,
+            )
+            .await?;
         }
 
         let layers = load_config_layers_state(
@@ -2538,12 +2797,14 @@ async fn project_root_markers_supports_alternate_markers() -> std::io::Result<()
     tokio::fs::write(project_root.join(".hg"), "hg").await?;
     tokio::fs::write(
         project_root.join(".codex").join(CONFIG_TOML_FILE),
-        "foo = \"root\"\n",
+        r#"foo = "root"
+"#,
     )
     .await?;
     tokio::fs::write(
         nested.join(".codex").join(CONFIG_TOML_FILE),
-        "foo = \"child\"\n",
+        r#"foo = "child"
+"#,
     )
     .await?;
 
diff --git a/codex-rs/core/src/config/config_tests.rs b/codex-rs/core/src/config/config_tests.rs
index b56ad5afc2..2297314e06 100644
--- a/codex-rs/core/src/config/config_tests.rs
+++ b/codex-rs/core/src/config/config_tests.rs
@@ -7,6 +7,7 @@ use crate::config::edit::apply_blocking;
 use assert_matches::assert_matches;
 use codex_config::CONFIG_TOML_FILE;
 use codex_config::ConfigLayerEntry;
+use codex_config::ProfileV2Name;
 use codex_config::RequirementSource;
 use codex_config::config_toml::AgentRoleToml;
 use codex_config::config_toml::AgentsToml;
@@ -28,6 +29,7 @@ use codex_config::permissions_toml::NetworkDomainPermissionsToml;
 use codex_config::permissions_toml::NetworkToml;
 use codex_config::permissions_toml::PermissionProfileToml;
 use codex_config::permissions_toml::PermissionsToml;
+use codex_config::permissions_toml::WorkspaceRootsToml;
 use codex_config::profile_toml::ConfigProfile;
 use codex_config::types::AppToolApproval;
 use codex_config::types::ApprovalsReviewer;
@@ -35,6 +37,7 @@ use codex_config::types::BundledSkillsConfig;
 use codex_config::types::FeedbackConfigToml;
 use codex_config::types::HistoryPersistence;
 use codex_config::types::McpServerEnvVar;
+use codex_config::types::McpServerOAuthConfig;
 use codex_config::types::McpServerToolConfig;
 use codex_config::types::McpServerTransportConfig;
 use codex_config::types::MemoriesConfig;
@@ -68,7 +71,9 @@ use codex_model_provider_info::WireApi;
 use codex_models_manager::bundled_models_response;
 use codex_protocol::config_types::ServiceTier;
 use codex_protocol::models::ActivePermissionProfile;
-use codex_protocol::models::ActivePermissionProfileModification;
+use codex_protocol::models::BUILT_IN_PERMISSION_PROFILE_DANGER_FULL_ACCESS;
+use codex_protocol::models::BUILT_IN_PERMISSION_PROFILE_READ_ONLY;
+use codex_protocol::models::BUILT_IN_PERMISSION_PROFILE_WORKSPACE;
 use codex_protocol::models::ManagedFileSystemPermissions;
 use codex_protocol::models::PermissionProfile;
 use codex_protocol::models::SandboxEnforcement;
@@ -100,6 +105,18 @@ use std::path::Path;
 use std::time::Duration;
 use tempfile::TempDir;
 
+fn active_permission_profile_state(
+    permission_profile: PermissionProfile,
+    profile_id: impl Into<String>,
+) -> PermissionProfileState {
+    PermissionProfileState::from_constrained_active_profile(
+        Constrained::allow_any(permission_profile),
+        Some(ActivePermissionProfile::new(profile_id)),
+        Vec::new(),
+    )
+    .expect("active permission profile state should be valid")
+}
+
 fn stdio_mcp(command: &str) -> McpServerConfig {
     McpServerConfig {
         transport: McpServerTransportConfig::Stdio {
@@ -120,6 +137,7 @@ fn stdio_mcp(command: &str) -> McpServerConfig {
         enabled_tools: None,
         disabled_tools: None,
         scopes: None,
+        oauth: None,
         oauth_resource: None,
         tools: HashMap::new(),
     }
@@ -144,6 +162,7 @@ fn http_mcp(url: &str) -> McpServerConfig {
         enabled_tools: None,
         disabled_tools: None,
         scopes: None,
+        oauth: None,
         oauth_resource: None,
         tools: HashMap::new(),
     }
@@ -376,13 +395,7 @@ web_search = true
     )
     .expect("TOML deserialization should succeed");
 
-    assert_eq!(
-        cfg.tools,
-        Some(ToolsToml {
-            web_search: None,
-            view_image: None,
-        })
-    );
+    assert_eq!(cfg.tools, Some(ToolsToml { web_search: None }));
 }
 
 #[test]
@@ -395,13 +408,7 @@ web_search = false
     )
     .expect("TOML deserialization should succeed");
 
-    assert_eq!(
-        cfg.tools,
-        Some(ToolsToml {
-            web_search: None,
-            view_image: None,
-        })
-    );
+    assert_eq!(cfg.tools, Some(ToolsToml { web_search: None }));
 }
 
 #[test]
@@ -727,10 +734,15 @@ fn config_toml_deserializes_permission_profiles() {
     let toml = r#"
 default_permissions = "workspace"
 
+[permissions.workspace.workspace_roots]
+"~/code/openai" = true
+"~/code/ignored" = false
+
 [permissions.workspace.filesystem]
 ":minimal" = "read"
+"/tmp/secret.env" = "deny"
 
-[permissions.workspace.filesystem.":project_roots"]
+[permissions.workspace.filesystem.":workspace_roots"]
 "." = "write"
 "docs" = "read"
 
@@ -753,6 +765,12 @@ allow_upstream_proxy = false
             entries: BTreeMap::from([(
                 "workspace".to_string(),
                 PermissionProfileToml {
+                    workspace_roots: Some(WorkspaceRootsToml {
+                        entries: BTreeMap::from([
+                            ("~/code/ignored".to_string(), false),
+                            ("~/code/openai".to_string(), true),
+                        ]),
+                    }),
                     filesystem: Some(FilesystemPermissionsToml {
                         glob_scan_max_depth: None,
                         entries: BTreeMap::from([
@@ -761,7 +779,11 @@ allow_upstream_proxy = false
                                 FilesystemPermissionToml::Access(FileSystemAccessMode::Read),
                             ),
                             (
-                                ":project_roots".to_string(),
+                                "/tmp/secret.env".to_string(),
+                                FilesystemPermissionToml::Access(FileSystemAccessMode::Deny),
+                            ),
+                            (
+                                ":workspace_roots".to_string(),
                                 FilesystemPermissionToml::Scoped(BTreeMap::from([
                                     (".".to_string(), FileSystemAccessMode::Write),
                                     ("docs".to_string(), FileSystemAccessMode::Read),
@@ -808,6 +830,7 @@ async fn permissions_profiles_proxy_policy_does_not_start_managed_network_proxy_
                 entries: BTreeMap::from([(
                     "workspace".to_string(),
                     PermissionProfileToml {
+                        workspace_roots: None,
                         filesystem: Some(FilesystemPermissionsToml {
                             glob_scan_max_depth: None,
                             entries: BTreeMap::from([(
@@ -961,6 +984,7 @@ async fn network_proxy_feature_matrix_preserves_sandbox_network_semantics() -> s
                     entries: BTreeMap::from([(
                         "workspace".to_string(),
                         PermissionProfileToml {
+                            workspace_roots: None,
                             filesystem: Some(FilesystemPermissionsToml {
                                 glob_scan_max_depth: None,
                                 entries: BTreeMap::from([(
@@ -1111,6 +1135,7 @@ async fn network_proxy_feature_uses_profile_network_proxy_settings() -> std::io:
                 entries: BTreeMap::from([(
                     "workspace".to_string(),
                     PermissionProfileToml {
+                        workspace_roots: None,
                         filesystem: Some(FilesystemPermissionsToml {
                             glob_scan_max_depth: None,
                             entries: BTreeMap::from([(
@@ -1213,6 +1238,7 @@ enabled = false
                 entries: BTreeMap::from([(
                     "workspace".to_string(),
                     PermissionProfileToml {
+                        workspace_roots: None,
                         filesystem: Some(FilesystemPermissionsToml {
                             glob_scan_max_depth: None,
                             entries: BTreeMap::from([(
@@ -1261,6 +1287,7 @@ async fn permissions_profiles_network_disabled_by_default_does_not_start_proxy()
                 entries: BTreeMap::from([(
                     "workspace".to_string(),
                     PermissionProfileToml {
+                        workspace_roots: None,
                         filesystem: Some(FilesystemPermissionsToml {
                             glob_scan_max_depth: None,
                             entries: BTreeMap::from([(
@@ -1307,6 +1334,7 @@ async fn default_permissions_profile_populates_runtime_sandbox_policy() -> std::
             entries: BTreeMap::from([(
                 "workspace".to_string(),
                 PermissionProfileToml {
+                    workspace_roots: None,
                     filesystem: Some(FilesystemPermissionsToml {
                         glob_scan_max_depth: None,
                         entries: BTreeMap::from([
@@ -1315,7 +1343,7 @@ async fn default_permissions_profile_populates_runtime_sandbox_policy() -> std::
                                 FilesystemPermissionToml::Access(FileSystemAccessMode::Read),
                             ),
                             (
-                                ":project_roots".to_string(),
+                                ":workspace_roots".to_string(),
                                 FilesystemPermissionToml::Scoped(BTreeMap::from([
                                     (".".to_string(), FileSystemAccessMode::Write),
                                     ("docs".to_string(), FileSystemAccessMode::Read),
@@ -1340,6 +1368,7 @@ async fn default_permissions_profile_populates_runtime_sandbox_policy() -> std::
     )
     .await?;
 
+    let cwd_root = cwd.path().abs();
     let memories_root = codex_home.path().join("memories").abs();
     assert_eq!(
         config.permissions.file_system_sandbox_policy(),
@@ -1351,14 +1380,14 @@ async fn default_permissions_profile_populates_runtime_sandbox_policy() -> std::
                 access: FileSystemAccessMode::Read,
             },
             FileSystemSandboxEntry {
-                path: FileSystemPath::Special {
-                    value: FileSystemSpecialPath::project_roots(/*subpath*/ None),
+                path: FileSystemPath::Path {
+                    path: cwd_root.clone(),
                 },
                 access: FileSystemAccessMode::Write,
             },
             FileSystemSandboxEntry {
-                path: FileSystemPath::Special {
-                    value: FileSystemSpecialPath::project_roots(Some("docs".into())),
+                path: FileSystemPath::Path {
+                    path: cwd_root.join("docs"),
                 },
                 access: FileSystemAccessMode::Read,
             },
@@ -1379,6 +1408,12 @@ async fn default_permissions_profile_populates_runtime_sandbox_policy() -> std::
             exclude_slash_tmp: true,
         }
     );
+    assert!(
+        !config
+            .permissions
+            .file_system_sandbox_policy()
+            .can_write_path_with_cwd(&cwd.path().join(".git"), cwd.path())
+    );
     assert_eq!(
         config.permissions.network_sandbox_policy(),
         NetworkSandboxPolicy::Restricted
@@ -1411,7 +1446,10 @@ async fn permission_profile_override_populates_runtime_permissions() -> std::io:
     )
     .await?;
 
-    assert_eq!(config.permissions.permission_profile(), permission_profile);
+    assert_eq!(
+        config.permissions.effective_permission_profile(),
+        permission_profile
+    );
     assert_eq!(config.permissions.active_permission_profile(), None);
     assert_eq!(
         &config.legacy_sandbox_policy(),
@@ -1420,6 +1458,30 @@ async fn permission_profile_override_populates_runtime_permissions() -> std::io:
     Ok(())
 }
 
+#[test]
+fn permission_snapshot_setter_preserves_permission_constraints() {
+    let initial_profile = PermissionProfile::read_only();
+    let mut permissions = Permissions::from_approval_and_profile(
+        Constrained::allow_any(AskForApproval::Never),
+        Constrained::allow_only(initial_profile.clone()),
+    )
+    .expect("initial permissions should satisfy constraints");
+
+    let err = permissions
+        .set_permission_profile_from_session_snapshot(PermissionProfileSnapshot::active(
+            PermissionProfile::workspace_write(),
+            ActivePermissionProfile::new(BUILT_IN_PERMISSION_PROFILE_WORKSPACE),
+        ))
+        .expect_err("workspace profile should violate read-only constraint");
+
+    assert_eq!(permissions.permission_profile(), &initial_profile);
+    assert_eq!(permissions.active_permission_profile(), None);
+    assert!(
+        matches!(err, ConstraintError::InvalidValue { .. }),
+        "expected invalid value constraint error, got {err:?}"
+    );
+}
+
 #[tokio::test]
 async fn permission_profile_override_preserves_managed_unrestricted_filesystem()
 -> std::io::Result<()> {
@@ -1441,7 +1503,10 @@ async fn permission_profile_override_preserves_managed_unrestricted_filesystem()
     )
     .await?;
 
-    assert_eq!(config.permissions.permission_profile(), permission_profile);
+    assert_eq!(
+        config.permissions.effective_permission_profile(),
+        permission_profile
+    );
     assert_eq!(
         &config.legacy_sandbox_policy(),
         &SandboxPolicy::ExternalSandbox {
@@ -1573,6 +1638,7 @@ async fn permission_profile_override_preserves_configured_network_policy_without
                 entries: BTreeMap::from([(
                     "workspace".to_string(),
                     PermissionProfileToml {
+                        workspace_roots: None,
                         filesystem: Some(FilesystemPermissionsToml {
                             glob_scan_max_depth: None,
                             entries: BTreeMap::from([(
@@ -1610,15 +1676,20 @@ async fn permission_profile_override_preserves_configured_network_policy_without
         config.permissions.network.is_none(),
         "profile network.enabled should not start the managed network proxy"
     );
-    assert_eq!(config.permissions.permission_profile(), permission_profile);
+    assert_eq!(
+        config.permissions.effective_permission_profile(),
+        permission_profile
+    );
     Ok(())
 }
 
 #[tokio::test]
-async fn project_root_glob_none_compiles_to_filesystem_pattern_entry() -> std::io::Result<()> {
+async fn workspace_root_glob_none_compiles_to_filesystem_pattern_entry() -> std::io::Result<()> {
     let codex_home = TempDir::new()?;
     let cwd = TempDir::new()?;
+    let extra_root = TempDir::new()?;
     tokio::fs::write(cwd.path().join(".git"), "gitdir: nowhere").await?;
+    tokio::fs::write(extra_root.path().join(".git"), "gitdir: nowhere").await?;
 
     let config = Config::load_from_base_config_with_overrides(
         ConfigToml {
@@ -1627,13 +1698,14 @@ async fn project_root_glob_none_compiles_to_filesystem_pattern_entry() -> std::i
                 entries: BTreeMap::from([(
                     "workspace".to_string(),
                     PermissionProfileToml {
+                        workspace_roots: None,
                         filesystem: Some(FilesystemPermissionsToml {
                             glob_scan_max_depth: Some(2),
                             entries: BTreeMap::from([(
-                                ":project_roots".to_string(),
+                                ":workspace_roots".to_string(),
                                 FilesystemPermissionToml::Scoped(BTreeMap::from([
                                     (".".to_string(), FileSystemAccessMode::Write),
-                                    ("**/*.env".to_string(), FileSystemAccessMode::None),
+                                    ("**/*.env".to_string(), FileSystemAccessMode::Deny),
                                 ])),
                             )]),
                         }),
@@ -1645,6 +1717,7 @@ async fn project_root_glob_none_compiles_to_filesystem_pattern_entry() -> std::i
         },
         ConfigOverrides {
             cwd: Some(cwd.path().to_path_buf()),
+            additional_writable_roots: vec![extra_root.path().to_path_buf()],
             ..Default::default()
         },
         codex_home.abs(),
@@ -1658,21 +1731,23 @@ async fn project_root_glob_none_compiles_to_filesystem_pattern_entry() -> std::i
             .glob_scan_max_depth,
         Some(2)
     );
-    let expected_pattern = AbsolutePathBuf::resolve_path_against_base("**/*.env", cwd.path())
-        .to_string_lossy()
-        .into_owned();
-    assert!(
-        config
-            .permissions
-            .file_system_sandbox_policy()
-            .entries
-            .contains(&FileSystemSandboxEntry {
-                path: FileSystemPath::GlobPattern {
-                    pattern: expected_pattern,
-                },
-                access: FileSystemAccessMode::None,
-            })
-    );
+    for root in [cwd.path(), extra_root.path()] {
+        let expected_pattern = AbsolutePathBuf::resolve_path_against_base("**/*.env", root)
+            .to_string_lossy()
+            .into_owned();
+        assert!(
+            config
+                .permissions
+                .file_system_sandbox_policy()
+                .entries
+                .contains(&FileSystemSandboxEntry {
+                    path: FileSystemPath::GlobPattern {
+                        pattern: expected_pattern,
+                    },
+                    access: FileSystemAccessMode::Deny,
+                })
+        );
+    }
     assert!(
         !config
             .permissions
@@ -1702,6 +1777,7 @@ async fn permissions_profiles_require_default_permissions() -> std::io::Result<(
                 entries: BTreeMap::from([(
                     "workspace".to_string(),
                     PermissionProfileToml {
+                        workspace_roots: None,
                         filesystem: Some(FilesystemPermissionsToml {
                             glob_scan_max_depth: None,
                             entries: BTreeMap::from([(
@@ -1740,7 +1816,7 @@ async fn default_permissions_can_select_builtin_profile_without_permissions_tabl
 
     let config = Config::load_from_base_config_with_overrides(
         ConfigToml {
-            default_permissions: Some(":workspace".to_string()),
+            default_permissions: Some(BUILT_IN_PERMISSION_PROFILE_WORKSPACE.to_string()),
             ..Default::default()
         },
         ConfigOverrides {
@@ -1751,6 +1827,8 @@ async fn default_permissions_can_select_builtin_profile_without_permissions_tabl
     )
     .await?;
 
+    assert!(config.explicit_permission_profile_mode);
+    assert!(config.custom_permission_profile_ids.is_empty());
     let policy = config.permissions.file_system_sandbox_policy();
     assert_eq!(
         config
@@ -1758,7 +1836,7 @@ async fn default_permissions_can_select_builtin_profile_without_permissions_tabl
             .active_permission_profile()
             .as_ref()
             .map(|active| active.id.as_str()),
-        Some(":workspace")
+        Some(BUILT_IN_PERMISSION_PROFILE_WORKSPACE)
     );
     assert!(
         policy.can_write_path_with_cwd(cwd.path(), cwd.path()),
@@ -1772,8 +1850,7 @@ async fn default_permissions_can_select_builtin_profile_without_permissions_tabl
 }
 
 #[tokio::test]
-async fn default_permissions_read_only_applies_additional_writable_roots_as_modifications()
--> std::io::Result<()> {
+async fn default_permissions_read_only_keeps_add_dir_read_only() -> std::io::Result<()> {
     let codex_home = TempDir::new()?;
     let cwd = TempDir::new()?;
     let extra_root = TempDir::new()?;
@@ -1781,7 +1858,7 @@ async fn default_permissions_read_only_applies_additional_writable_roots_as_modi
 
     let config = Config::load_from_base_config_with_overrides(
         ConfigToml {
-            default_permissions: Some(":read-only".to_string()),
+            default_permissions: Some(BUILT_IN_PERMISSION_PROFILE_READ_ONLY.to_string()),
             ..Default::default()
         },
         ConfigOverrides {
@@ -1795,16 +1872,112 @@ async fn default_permissions_read_only_applies_additional_writable_roots_as_modi
 
     let policy = config.permissions.file_system_sandbox_policy();
     assert!(
-        policy.can_write_path_with_cwd(extra_root.as_path(), cwd.path()),
-        "expected additional writable root to modify :read-only, policy: {policy:?}"
+        !policy.can_write_path_with_cwd(extra_root.as_path(), cwd.path()),
+        "expected :read-only to stay read-only for runtime workspace roots, policy: {policy:?}"
     );
     assert_eq!(
         config.permissions.active_permission_profile(),
-        Some(
-            ActivePermissionProfile::new(":read-only").with_modifications(vec![
-                ActivePermissionProfileModification::AdditionalWritableRoot { path: extra_root },
-            ])
-        )
+        Some(ActivePermissionProfile::new(
+            BUILT_IN_PERMISSION_PROFILE_READ_ONLY,
+        ))
+    );
+    Ok(())
+}
+
+#[tokio::test]
+async fn workspace_profile_applies_rules_to_runtime_and_profile_workspace_roots()
+-> std::io::Result<()> {
+    let temp_dir = TempDir::new()?;
+    let codex_home = temp_dir.path().join("codex-home");
+    let cwd = temp_dir.path().join("frontend");
+    let runtime_root = temp_dir.path().join("backend");
+    let profile_root = temp_dir.path().join("shared");
+    for root in [&cwd, &runtime_root, &profile_root] {
+        std::fs::create_dir_all(root.join(".git"))?;
+        std::fs::create_dir_all(root.join(".codex"))?;
+    }
+
+    let config = Config::load_from_base_config_with_overrides(
+        ConfigToml {
+            default_permissions: Some("dev".to_string()),
+            permissions: Some(PermissionsToml {
+                entries: BTreeMap::from([(
+                    "dev".to_string(),
+                    PermissionProfileToml {
+                        workspace_roots: Some(WorkspaceRootsToml {
+                            entries: BTreeMap::from([(
+                                profile_root.to_string_lossy().into_owned(),
+                                true,
+                            )]),
+                        }),
+                        filesystem: Some(FilesystemPermissionsToml {
+                            glob_scan_max_depth: None,
+                            entries: BTreeMap::from([(
+                                ":workspace_roots".to_string(),
+                                FilesystemPermissionToml::Scoped(BTreeMap::from([
+                                    (".".to_string(), FileSystemAccessMode::Write),
+                                    (".git".to_string(), FileSystemAccessMode::Read),
+                                    (".codex".to_string(), FileSystemAccessMode::Read),
+                                ])),
+                            )]),
+                        }),
+                        network: None,
+                    },
+                )]),
+            }),
+            ..Default::default()
+        },
+        ConfigOverrides {
+            cwd: Some(cwd.clone()),
+            additional_writable_roots: vec![runtime_root.clone()],
+            ..Default::default()
+        },
+        codex_home.abs(),
+    )
+    .await?;
+
+    let cwd_abs = cwd.abs();
+    let runtime_root_abs = runtime_root.abs();
+    let profile_root_abs = profile_root.abs();
+    assert_eq!(
+        config.workspace_roots,
+        vec![cwd_abs.clone(), runtime_root_abs.clone()]
+    );
+    assert_eq!(
+        config.permissions.workspace_roots(),
+        &[cwd_abs.clone(), runtime_root_abs.clone()]
+    );
+    assert_eq!(
+        config.effective_workspace_roots(),
+        vec![
+            cwd_abs.clone(),
+            runtime_root_abs.clone(),
+            profile_root_abs.clone()
+        ]
+    );
+
+    let policy = config.permissions.file_system_sandbox_policy();
+    for root in [cwd_abs, runtime_root_abs, profile_root_abs.clone()] {
+        assert!(
+            policy.can_write_path_with_cwd(root.as_path(), cwd.as_path()),
+            "expected workspace root to be writable, policy: {policy:?}"
+        );
+        assert!(
+            !policy.can_write_path_with_cwd(&root.join(".git"), cwd.as_path()),
+            "expected .git carveout under {root:?}, policy: {policy:?}"
+        );
+        assert!(
+            !policy.can_write_path_with_cwd(&root.join(".codex"), cwd.as_path()),
+            "expected .codex carveout under {root:?}, policy: {policy:?}"
+        );
+    }
+    assert_eq!(
+        config.permissions.profile_workspace_roots(),
+        std::slice::from_ref(&profile_root_abs)
+    );
+    assert_eq!(
+        config.permissions.active_permission_profile(),
+        Some(ActivePermissionProfile::new("dev"))
     );
     Ok(())
 }
@@ -1818,7 +1991,7 @@ async fn explicit_builtin_workspace_profile_ignores_legacy_workspace_write_setti
 
     let config = Config::load_from_base_config_with_overrides(
         ConfigToml {
-            default_permissions: Some(":workspace".to_string()),
+            default_permissions: Some(BUILT_IN_PERMISSION_PROFILE_WORKSPACE.to_string()),
             sandbox_workspace_write: Some(SandboxWorkspaceWrite {
                 writable_roots: vec![extra_root.path().abs()],
                 network_access: true,
@@ -1883,9 +2056,9 @@ async fn empty_config_defaults_to_builtin_profile_for_trusted_project() -> std::
             .as_ref()
             .map(|active| active.id.as_str()),
         Some(if cfg!(target_os = "windows") {
-            ":read-only"
+            BUILT_IN_PERMISSION_PROFILE_READ_ONLY
         } else {
-            ":workspace"
+            BUILT_IN_PERMISSION_PROFILE_WORKSPACE
         })
     );
     if cfg!(target_os = "windows") {
@@ -2054,13 +2227,13 @@ async fn empty_config_defaults_to_builtin_read_only_without_trust_decision() ->
 }
 
 #[tokio::test]
-async fn default_permissions_can_select_builtin_no_sandbox_profile() -> std::io::Result<()> {
+async fn default_permissions_can_select_builtin_full_access_profile() -> std::io::Result<()> {
     let codex_home = TempDir::new()?;
     let cwd = TempDir::new()?;
 
     let config = Config::load_from_base_config_with_overrides(
         ConfigToml {
-            default_permissions: Some(":danger-no-sandbox".to_string()),
+            default_permissions: Some(BUILT_IN_PERMISSION_PROFILE_DANGER_FULL_ACCESS.to_string()),
             ..Default::default()
         },
         ConfigOverrides {
@@ -2072,7 +2245,7 @@ async fn default_permissions_can_select_builtin_no_sandbox_profile() -> std::io:
     .await?;
 
     assert_eq!(
-        config.permissions.permission_profile(),
+        config.permissions.effective_permission_profile(),
         PermissionProfile::Disabled
     );
     assert_eq!(
@@ -2081,7 +2254,33 @@ async fn default_permissions_can_select_builtin_no_sandbox_profile() -> std::io:
             .active_permission_profile()
             .as_ref()
             .map(|active| active.id.as_str()),
-        Some(":danger-no-sandbox")
+        Some(BUILT_IN_PERMISSION_PROFILE_DANGER_FULL_ACCESS)
+    );
+    Ok(())
+}
+
+#[tokio::test]
+async fn legacy_danger_no_sandbox_is_rejected() -> std::io::Result<()> {
+    let codex_home = TempDir::new()?;
+    let cwd = TempDir::new()?;
+
+    let err = Config::load_from_base_config_with_overrides(
+        ConfigToml {
+            default_permissions: Some(":danger-no-sandbox".to_string()),
+            ..Default::default()
+        },
+        ConfigOverrides {
+            cwd: Some(cwd.path().to_path_buf()),
+            ..Default::default()
+        },
+        codex_home.abs(),
+    )
+    .await
+    .expect_err("legacy full-access alias should be rejected");
+
+    assert_eq!(
+        err.to_string(),
+        "default_permissions refers to unknown built-in profile `:danger-no-sandbox`"
     );
     Ok(())
 }
@@ -2163,6 +2362,7 @@ async fn permissions_profiles_allow_direct_write_roots_outside_workspace_root()
                 entries: BTreeMap::from([(
                     "workspace".to_string(),
                     PermissionProfileToml {
+                        workspace_roots: None,
                         filesystem: Some(FilesystemPermissionsToml {
                             glob_scan_max_depth: None,
                             entries: BTreeMap::from([(
@@ -2184,6 +2384,10 @@ async fn permissions_profiles_allow_direct_write_roots_outside_workspace_root()
     )
     .await?;
 
+    assert_eq!(
+        config.custom_permission_profile_ids,
+        vec!["workspace".to_string()]
+    );
     let memories_root = AbsolutePathBuf::from_absolute_path(std::fs::canonicalize(
         codex_home.path().join("memories"),
     )?)?;
@@ -2206,7 +2410,8 @@ async fn permissions_profiles_allow_direct_write_roots_outside_workspace_root()
 }
 
 #[tokio::test]
-async fn permissions_profiles_reject_nested_entries_for_non_project_roots() -> std::io::Result<()> {
+async fn permissions_profiles_reject_nested_entries_for_non_workspace_roots() -> std::io::Result<()>
+{
     let codex_home = TempDir::new()?;
     let cwd = TempDir::new()?;
     std::fs::write(cwd.path().join(".git"), "gitdir: nowhere")?;
@@ -2218,6 +2423,7 @@ async fn permissions_profiles_reject_nested_entries_for_non_project_roots() -> s
                 entries: BTreeMap::from([(
                     "workspace".to_string(),
                     PermissionProfileToml {
+                        workspace_roots: None,
                         filesystem: Some(FilesystemPermissionsToml {
                             glob_scan_max_depth: None,
                             entries: BTreeMap::from([(
@@ -2241,7 +2447,7 @@ async fn permissions_profiles_reject_nested_entries_for_non_project_roots() -> s
         codex_home.abs(),
     )
     .await
-    .expect_err("nested entries outside :project_roots should be rejected");
+    .expect_err("nested entries outside :workspace_roots should be rejected");
 
     assert_eq!(err.kind(), std::io::ErrorKind::InvalidInput);
     assert_eq!(
@@ -2278,6 +2484,7 @@ async fn load_workspace_permission_profile(
 #[tokio::test]
 async fn permissions_profiles_allow_unknown_special_paths() -> std::io::Result<()> {
     let config = load_workspace_permission_profile(PermissionProfileToml {
+        workspace_roots: None,
         filesystem: Some(FilesystemPermissionsToml {
             glob_scan_max_depth: None,
             entries: BTreeMap::from([(
@@ -2321,6 +2528,7 @@ async fn permissions_profiles_allow_unknown_special_paths() -> std::io::Result<(
 async fn permissions_profiles_allow_unknown_special_paths_with_nested_entries()
 -> std::io::Result<()> {
     let config = load_workspace_permission_profile(PermissionProfileToml {
+        workspace_roots: None,
         filesystem: Some(FilesystemPermissionsToml {
             glob_scan_max_depth: None,
             entries: BTreeMap::from([(
@@ -2357,6 +2565,7 @@ async fn permissions_profiles_allow_unknown_special_paths_with_nested_entries()
 #[tokio::test]
 async fn permissions_profiles_allow_missing_filesystem_with_warning() -> std::io::Result<()> {
     let config = load_workspace_permission_profile(PermissionProfileToml {
+        workspace_roots: None,
         filesystem: None,
         network: None,
     })
@@ -2385,6 +2594,7 @@ async fn permissions_profiles_allow_missing_filesystem_with_warning() -> std::io
 #[tokio::test]
 async fn permissions_profiles_allow_empty_filesystem_with_warning() -> std::io::Result<()> {
     let config = load_workspace_permission_profile(PermissionProfileToml {
+        workspace_roots: None,
         filesystem: Some(FilesystemPermissionsToml {
             glob_scan_max_depth: None,
             entries: BTreeMap::new(),
@@ -2408,7 +2618,7 @@ async fn permissions_profiles_allow_empty_filesystem_with_warning() -> std::io::
 }
 
 #[tokio::test]
-async fn permissions_profiles_reject_project_root_parent_traversal() -> std::io::Result<()> {
+async fn permissions_profiles_reject_workspace_root_parent_traversal() -> std::io::Result<()> {
     let codex_home = TempDir::new()?;
     let cwd = TempDir::new()?;
     std::fs::write(cwd.path().join(".git"), "gitdir: nowhere")?;
@@ -2420,10 +2630,11 @@ async fn permissions_profiles_reject_project_root_parent_traversal() -> std::io:
                 entries: BTreeMap::from([(
                     "workspace".to_string(),
                     PermissionProfileToml {
+                        workspace_roots: None,
                         filesystem: Some(FilesystemPermissionsToml {
                             glob_scan_max_depth: None,
                             entries: BTreeMap::from([(
-                                ":project_roots".to_string(),
+                                ":workspace_roots".to_string(),
                                 FilesystemPermissionToml::Scoped(BTreeMap::from([(
                                     "../sibling".to_string(),
                                     FileSystemAccessMode::Read,
@@ -2466,6 +2677,7 @@ async fn permissions_profiles_allow_network_enablement() -> std::io::Result<()>
                 entries: BTreeMap::from([(
                     "workspace".to_string(),
                     PermissionProfileToml {
+                        workspace_roots: None,
                         filesystem: Some(FilesystemPermissionsToml {
                             glob_scan_max_depth: None,
                             entries: BTreeMap::from([(
@@ -2699,6 +2911,55 @@ async fn runtime_config_resolves_terminal_resize_reflow_defaults_and_overrides()
     );
 }
 
+#[tokio::test]
+async fn forced_chatgpt_workspace_id_empty_values_disable_runtime_restriction()
+-> std::io::Result<()> {
+    let cases: Vec<(&str, &str, Option<Vec<&str>>)> = vec![
+        ("unset", "", None),
+        ("empty string", r#"forced_chatgpt_workspace_id = """#, None),
+        (
+            "whitespace string",
+            r#"forced_chatgpt_workspace_id = "   ""#,
+            None,
+        ),
+        ("empty list", r#"forced_chatgpt_workspace_id = []"#, None),
+        (
+            "blank list entries",
+            r#"forced_chatgpt_workspace_id = ["", "  "]"#,
+            None,
+        ),
+        (
+            "mixed list entries",
+            r#"forced_chatgpt_workspace_id = ["", " 123e4567-e89b-42d3-a456-426614174000 ", "123e4567-e89b-42d3-a456-426614174001"]"#,
+            Some(vec![
+                "123e4567-e89b-42d3-a456-426614174000",
+                "123e4567-e89b-42d3-a456-426614174001",
+            ]),
+        ),
+    ];
+
+    for (name, toml, expected) in cases {
+        let cfg_toml: ConfigToml = toml::from_str(toml)
+            .unwrap_or_else(|err| panic!("{name} should parse forced_chatgpt_workspace_id: {err}"));
+        let config = Config::load_from_base_config_with_overrides(
+            cfg_toml,
+            ConfigOverrides::default(),
+            tempdir().expect("tempdir").abs(),
+        )
+        .await?;
+
+        let expected = expected.map(|values| {
+            values
+                .into_iter()
+                .map(ToString::to_string)
+                .collect::<Vec<_>>()
+        });
+        assert_eq!(config.forced_chatgpt_workspace_id, expected, "{name}");
+    }
+
+    Ok(())
+}
+
 #[tokio::test]
 async fn legacy_remote_thread_store_endpoint_is_rejected() {
     let cfg: ConfigToml =
@@ -3012,13 +3273,15 @@ exclude_slash_tmp = true
                     );
                     continue;
                 }
+                assert_eq!(
+                    config.permissions.workspace_roots(),
+                    &[cwd.abs(), extra_root.clone()]
+                );
                 assert!(
                     file_system_policy
                         .entries
                         .contains(&FileSystemSandboxEntry {
-                            path: FileSystemPath::Special {
-                                value: FileSystemSpecialPath::project_roots(/*subpath*/ None),
-                            },
+                            path: FileSystemPath::Path { path: cwd.abs() },
                             access: FileSystemAccessMode::Write,
                         })
                 );
@@ -3037,15 +3300,16 @@ exclude_slash_tmp = true
                         file_system_policy
                             .entries
                             .contains(&FileSystemSandboxEntry {
-                                path: FileSystemPath::Special {
-                                    value: FileSystemSpecialPath::project_roots(Some(
-                                        subpath.into()
-                                    )),
+                                path: FileSystemPath::Path {
+                                    path: AbsolutePathBuf::resolve_path_against_base(
+                                        subpath,
+                                        cwd.path()
+                                    ),
                                 },
                                 access: FileSystemAccessMode::Read,
                             }),
-                        "case `{name}` should preserve `{subpath}` as a symbolic project-root \
-                         metadata carveout"
+                        "case `{name}` should materialize `{subpath}` for the runtime workspace \
+                         root"
                     );
                 }
             }
@@ -3346,6 +3610,7 @@ async fn rebuild_preserving_session_layers_refreshes_requirements() -> std::io::
             ConfigLayerEntry::new(
                 codex_app_server_protocol::ConfigLayerSource::User {
                     file: user_file.clone(),
+                    profile: None,
                 },
                 toml::toml! {
                     [mcp_servers.session_overrides_user]
@@ -3400,6 +3665,7 @@ async fn rebuild_preserving_session_layers_refreshes_requirements() -> std::io::
             ConfigLayerEntry::new(
                 codex_app_server_protocol::ConfigLayerSource::User {
                     file: user_file.clone(),
+                    profile: None,
                 },
                 toml::toml! {
                     [mcp_servers.session_overrides_user]
@@ -3530,6 +3796,7 @@ async fn rebuild_preserving_session_layers_refreshes_plugin_derived_mcp_config()
         vec![ConfigLayerEntry::new(
             codex_app_server_protocol::ConfigLayerSource::User {
                 file: user_file.clone(),
+                profile: None,
             },
             toml::toml! {
                 [features]
@@ -3556,7 +3823,10 @@ async fn rebuild_preserving_session_layers_refreshes_plugin_derived_mcp_config()
     .await?;
     let thread_layer_stack = ConfigLayerStack::new(
         vec![ConfigLayerEntry::new(
-            codex_app_server_protocol::ConfigLayerSource::User { file: user_file },
+            codex_app_server_protocol::ConfigLayerSource::User {
+                file: user_file,
+                profile: None,
+            },
             toml::toml! {
                 [features]
                 plugins = false
@@ -3590,6 +3860,63 @@ async fn rebuild_preserving_session_layers_refreshes_plugin_derived_mcp_config()
         mcp_config.configured_mcp_servers.get("sample"),
         Some(&http_mcp("https://sample.example/mcp"))
     );
+    assert_eq!(
+        mcp_config.plugin_ids_by_mcp_server_name,
+        HashMap::from([("sample".to_string(), "sample@test".to_string())])
+    );
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn to_mcp_config_omits_plugin_id_when_user_server_shadows_plugin_mcp() -> anyhow::Result<()> {
+    let codex_home = TempDir::new()?;
+    let plugin_root = codex_home
+        .path()
+        .join("plugins/cache")
+        .join("test/sample/local");
+    std::fs::create_dir_all(plugin_root.join(".codex-plugin"))?;
+    std::fs::write(
+        plugin_root.join(".codex-plugin/plugin.json"),
+        r#"{"name":"sample"}"#,
+    )?;
+    std::fs::write(
+        plugin_root.join(".mcp.json"),
+        r#"{
+  "mcpServers": {
+    "sample": {
+      "type": "http",
+      "url": "https://plugin.example/mcp"
+    }
+  }
+}"#,
+    )?;
+    std::fs::write(
+        codex_home.path().join(CONFIG_TOML_FILE),
+        r#"
+[features]
+plugins = true
+
+[mcp_servers.sample]
+url = "https://user.example/mcp"
+
+[plugins."sample@test"]
+enabled = true
+"#,
+    )?;
+
+    let config = ConfigBuilder::default()
+        .codex_home(codex_home.path().to_path_buf())
+        .build()
+        .await?;
+    let plugins_manager = PluginsManager::new(codex_home.path().to_path_buf());
+    let mcp_config = config.to_mcp_config(&plugins_manager).await;
+
+    assert_eq!(
+        mcp_config.configured_mcp_servers.get("sample"),
+        Some(&http_mcp("https://user.example/mcp"))
+    );
+    assert!(mcp_config.plugin_ids_by_mcp_server_name.is_empty());
 
     Ok(())
 }
@@ -4044,8 +4371,7 @@ fn web_search_mode_disabled_overrides_legacy_request() {
 #[test]
 fn web_search_mode_for_turn_uses_preference_for_read_only() {
     let web_search_mode = Constrained::allow_any(WebSearchMode::Cached);
-    let permission_profile =
-        PermissionProfile::from_legacy_sandbox_policy(&SandboxPolicy::new_read_only_policy());
+    let permission_profile = PermissionProfile::read_only();
     let mode = resolve_web_search_mode_for_turn(&web_search_mode, &permission_profile);
 
     assert_eq!(mode, WebSearchMode::Cached);
@@ -4239,7 +4565,6 @@ async fn feature_table_overrides_legacy_flags() -> std::io::Result<()> {
     .await?;
 
     assert!(!config.features.enabled(Feature::ApplyPatchFreeform));
-    assert!(!config.include_apply_patch_tool);
 
     Ok(())
 }
@@ -4249,7 +4574,6 @@ async fn legacy_toggles_map_to_features() -> std::io::Result<()> {
     let codex_home = TempDir::new()?;
     let cfg = ConfigToml {
         experimental_use_unified_exec_tool: Some(true),
-        experimental_use_freeform_apply_patch: Some(true),
         ..Default::default()
     };
 
@@ -4260,11 +4584,8 @@ async fn legacy_toggles_map_to_features() -> std::io::Result<()> {
     )
     .await?;
 
-    assert!(config.features.enabled(Feature::ApplyPatchFreeform));
     assert!(config.features.enabled(Feature::UnifiedExec));
 
-    assert!(config.include_apply_patch_tool);
-
     assert!(config.use_experimental_unified_exec_tool);
 
     Ok(())
@@ -4403,6 +4724,7 @@ async fn replace_mcp_servers_round_trips_entries() -> anyhow::Result<()> {
             enabled_tools: None,
             disabled_tools: None,
             scopes: None,
+            oauth: None,
             oauth_resource: None,
             tools: HashMap::new(),
         },
@@ -4583,6 +4905,57 @@ approval_mode = "approve"
     );
 }
 
+#[test]
+fn desktop_toml_round_trips_opaque_nested_values() -> anyhow::Result<()> {
+    let parsed = toml::from_str::<ConfigToml>(
+        r#"
+[desktop]
+appearanceTheme = "dark"
+selected-avatar-id = "codex"
+recentViews = ["threads", "settings"]
+
+[desktop.workspace]
+collapsed = true
+width = 320
+pane = { selected = "console", expanded = false }
+"#,
+    )?;
+
+    let desktop = parsed
+        .desktop
+        .as_ref()
+        .expect("desktop settings should deserialize");
+    assert_eq!(
+        desktop.get("appearanceTheme"),
+        Some(&serde_json::json!("dark"))
+    );
+    assert_eq!(
+        desktop.get("selected-avatar-id"),
+        Some(&serde_json::json!("codex"))
+    );
+    assert_eq!(
+        desktop.get("recentViews"),
+        Some(&serde_json::json!(["threads", "settings"]))
+    );
+    assert_eq!(
+        desktop.get("workspace"),
+        Some(&serde_json::json!({
+            "collapsed": true,
+            "width": 320,
+            "pane": {
+                "selected": "console",
+                "expanded": false,
+            },
+        }))
+    );
+
+    let serialized = toml::to_string(&parsed)?;
+    let reparsed = toml::from_str::<ConfigToml>(&serialized)?;
+    assert_eq!(reparsed.desktop, parsed.desktop);
+
+    Ok(())
+}
+
 #[tokio::test]
 async fn to_mcp_config_preserves_apps_feature_from_config() -> std::io::Result<()> {
     let codex_home = TempDir::new()?;
@@ -4595,12 +4968,14 @@ async fn to_mcp_config_preserves_apps_feature_from_config() -> std::io::Result<(
     let plugins_manager = PluginsManager::new(codex_home.path().to_path_buf());
 
     config.apps_mcp_path_override = Some("/custom/mcp".to_string());
+    config.apps_mcp_product_sku = Some("tpp".to_string());
     let mcp_config = config.to_mcp_config(&plugins_manager).await;
     assert!(mcp_config.apps_enabled);
     assert_eq!(
         mcp_config.apps_mcp_path_override.as_deref(),
         Some("/custom/mcp")
     );
+    assert_eq!(mcp_config.apps_mcp_product_sku.as_deref(), Some("tpp"));
 
     let _ = config.features.disable(Feature::Apps);
     let mcp_config = config.to_mcp_config(&plugins_manager).await;
@@ -4696,6 +5071,7 @@ async fn replace_mcp_servers_serializes_env_sorted() -> anyhow::Result<()> {
             enabled_tools: None,
             disabled_tools: None,
             scopes: None,
+            oauth: None,
             oauth_resource: None,
             tools: HashMap::new(),
         },
@@ -4772,6 +5148,7 @@ async fn replace_mcp_servers_serializes_env_vars() -> anyhow::Result<()> {
             enabled_tools: None,
             disabled_tools: None,
             scopes: None,
+            oauth: None,
             oauth_resource: None,
             tools: HashMap::new(),
         },
@@ -4833,6 +5210,7 @@ async fn replace_mcp_servers_serializes_sourced_env_vars() -> anyhow::Result<()>
             enabled_tools: None,
             disabled_tools: None,
             scopes: None,
+            oauth: None,
             oauth_resource: None,
             tools: HashMap::new(),
         },
@@ -4884,6 +5262,7 @@ async fn replace_mcp_servers_serializes_cwd() -> anyhow::Result<()> {
             enabled_tools: None,
             disabled_tools: None,
             scopes: None,
+            oauth: None,
             oauth_resource: None,
             tools: HashMap::new(),
         },
@@ -4938,6 +5317,7 @@ async fn replace_mcp_servers_streamable_http_serializes_bearer_token() -> anyhow
             enabled_tools: None,
             disabled_tools: None,
             scopes: None,
+            oauth: None,
             oauth_resource: None,
             tools: HashMap::new(),
         },
@@ -5008,6 +5388,7 @@ async fn replace_mcp_servers_streamable_http_serializes_custom_headers() -> anyh
             enabled_tools: None,
             disabled_tools: None,
             scopes: None,
+            oauth: None,
             oauth_resource: None,
             tools: HashMap::new(),
         },
@@ -5090,6 +5471,7 @@ async fn replace_mcp_servers_streamable_http_removes_optional_sections() -> anyh
             enabled_tools: None,
             disabled_tools: None,
             scopes: None,
+            oauth: None,
             oauth_resource: None,
             tools: HashMap::new(),
         },
@@ -5125,6 +5507,7 @@ async fn replace_mcp_servers_streamable_http_removes_optional_sections() -> anyh
             enabled_tools: None,
             disabled_tools: None,
             scopes: None,
+            oauth: None,
             oauth_resource: None,
             tools: HashMap::new(),
         },
@@ -5195,6 +5578,7 @@ async fn replace_mcp_servers_streamable_http_isolates_headers_between_servers()
                 enabled_tools: None,
                 disabled_tools: None,
                 scopes: None,
+                oauth: None,
                 oauth_resource: None,
                 tools: HashMap::new(),
             },
@@ -5220,6 +5604,7 @@ async fn replace_mcp_servers_streamable_http_isolates_headers_between_servers()
                 enabled_tools: None,
                 disabled_tools: None,
                 scopes: None,
+                oauth: None,
                 oauth_resource: None,
                 tools: HashMap::new(),
             },
@@ -5308,6 +5693,7 @@ async fn replace_mcp_servers_serializes_disabled_flag() -> anyhow::Result<()> {
             enabled_tools: None,
             disabled_tools: None,
             scopes: None,
+            oauth: None,
             oauth_resource: None,
             tools: HashMap::new(),
         },
@@ -5358,6 +5744,7 @@ async fn replace_mcp_servers_serializes_required_flag() -> anyhow::Result<()> {
             enabled_tools: None,
             disabled_tools: None,
             scopes: None,
+            oauth: None,
             oauth_resource: None,
             tools: HashMap::new(),
         },
@@ -5408,6 +5795,7 @@ async fn replace_mcp_servers_serializes_tool_filters() -> anyhow::Result<()> {
             enabled_tools: Some(vec!["allowed".to_string()]),
             disabled_tools: Some(vec!["blocked".to_string()]),
             scopes: None,
+            oauth: None,
             oauth_resource: None,
             tools: HashMap::new(),
         },
@@ -5462,6 +5850,9 @@ async fn replace_mcp_servers_streamable_http_serializes_oauth_resource() -> anyh
             enabled_tools: None,
             disabled_tools: None,
             scopes: None,
+            oauth: Some(McpServerOAuthConfig {
+                client_id: Some("eci-prd-pub-codex-123".to_string()),
+            }),
             oauth_resource: Some("https://resource.example.com".to_string()),
             tools: HashMap::new(),
         },
@@ -5475,6 +5866,8 @@ async fn replace_mcp_servers_streamable_http_serializes_oauth_resource() -> anyh
 
     let config_path = codex_home.path().join(CONFIG_TOML_FILE);
     let serialized = std::fs::read_to_string(&config_path)?;
+    assert!(serialized.contains("[mcp_servers.docs.oauth]"));
+    assert!(serialized.contains(r#"client_id = "eci-prd-pub-codex-123""#));
     assert!(serialized.contains(r#"oauth_resource = "https://resource.example.com""#));
 
     let loaded = load_global_mcp_servers(codex_home.path()).await?;
@@ -5483,6 +5876,7 @@ async fn replace_mcp_servers_streamable_http_serializes_oauth_resource() -> anyh
         docs.oauth_resource.as_deref(),
         Some("https://resource.example.com")
     );
+    assert_eq!(docs.oauth_client_id(), Some("eci-prd-pub-codex-123"));
 
     Ok(())
 }
@@ -5505,6 +5899,52 @@ async fn set_model_updates_defaults() -> anyhow::Result<()> {
     Ok(())
 }
 
+#[tokio::test]
+async fn for_config_writes_selected_user_config_file() -> anyhow::Result<()> {
+    let codex_home = TempDir::new()?;
+    let base_config = codex_home.path().join(CONFIG_TOML_FILE);
+    let selected_config = codex_home.path().join("work.config.toml");
+    tokio::fs::write(&base_config, r#"model_provider = "openai""#).await?;
+    tokio::fs::write(&selected_config, r#"model = "gpt-old""#).await?;
+
+    let config = ConfigBuilder::without_managed_config_for_tests()
+        .codex_home(codex_home.path().to_path_buf())
+        .loader_overrides(LoaderOverrides {
+            user_config_path: Some(selected_config.abs()),
+            user_config_profile: Some("work".parse().expect("profile-v2 name")),
+            ..LoaderOverrides::without_managed_config_for_tests()
+        })
+        .build()
+        .await?;
+
+    ConfigEditsBuilder::for_config(&config)
+        .set_model(Some("gpt-new"), Some(ReasoningEffort::High))
+        .apply()
+        .await?;
+
+    let selected_serialized = tokio::fs::read_to_string(&selected_config).await?;
+    let selected: ConfigToml = toml::from_str(&selected_serialized)?;
+    assert_eq!(selected.model.as_deref(), Some("gpt-new"));
+    assert_eq!(selected.model_reasoning_effort, Some(ReasoningEffort::High));
+    assert_eq!(
+        tokio::fs::read_to_string(&base_config).await?,
+        r#"model_provider = "openai""#
+    );
+
+    Ok(())
+}
+
+#[test]
+fn profile_v2_config_path_resolves_validated_names() -> anyhow::Result<()> {
+    let codex_home = TempDir::new()?;
+    let profile_name: ProfileV2Name = "work".parse()?;
+    assert_eq!(
+        resolve_profile_v2_config_path(codex_home.path(), &profile_name),
+        codex_home.path().join("work.config.toml").abs()
+    );
+    Ok(())
+}
+
 #[tokio::test]
 async fn set_model_overwrites_existing_model() -> anyhow::Result<()> {
     let codex_home = TempDir::new()?;
@@ -6096,6 +6536,7 @@ config_file = "./agents/researcher.toml"
         vec![codex_config::ConfigLayerEntry::new(
             codex_app_server_protocol::ConfigLayerSource::User {
                 file: codex_home.path().join(CONFIG_TOML_FILE).abs(),
+                profile: None,
             },
             layer_config,
         )],
@@ -7275,24 +7716,32 @@ async fn test_precedence_fixture_with_o3_profile() -> std::io::Result<()> {
             review_model: None,
             model_context_window: None,
             model_auto_compact_token_limit: None,
+            model_auto_compact_token_limit_scope: AutoCompactTokenLimitScope::Total,
             service_tier: None,
             model_provider_id: "openai".to_string(),
             model_provider: fixture.openai_provider.clone(),
             permissions: Permissions {
                 approval_policy: Constrained::allow_any(AskForApproval::Never),
-                permission_profile: Constrained::allow_any(PermissionProfile::read_only()),
-                active_permission_profile: Some(ActivePermissionProfile::new(":read-only")),
+                permission_profile_state: active_permission_profile_state(
+                    PermissionProfile::read_only(),
+                    BUILT_IN_PERMISSION_PROFILE_READ_ONLY,
+                ),
+                workspace_roots: vec![fixture.cwd()],
                 network: None,
                 allow_login_shell: true,
                 shell_environment_policy: ShellEnvironmentPolicy::default(),
                 windows_sandbox_mode: None,
                 windows_sandbox_private_desktop: true,
             },
+            explicit_permission_profile_mode: false,
+            custom_permission_profile_ids: Vec::new(),
             approvals_reviewer: ApprovalsReviewer::User,
             enforce_residency: Constrained::allow_any(/*initial_value*/ None),
             user_instructions: None,
             notify: None,
             cwd: fixture.cwd(),
+            workspace_roots: vec![fixture.cwd()],
+            workspace_roots_explicit: false,
             cli_auth_credentials_store_mode: Default::default(),
             mcp_servers: Constrained::allow_any(HashMap::new()),
             mcp_oauth_credentials_store_mode: resolve_mcp_oauth_credentials_store_mode(
@@ -7339,6 +7788,7 @@ async fn test_precedence_fixture_with_o3_profile() -> std::io::Result<()> {
             personality: Some(Personality::Pragmatic),
             chatgpt_base_url: "https://chatgpt.com/backend-api/".to_string(),
             apps_mcp_path_override: None,
+            apps_mcp_product_sku: None,
             realtime_audio: RealtimeAudioConfig::default(),
             experimental_realtime_start_instructions: None,
             experimental_realtime_ws_base_url: None,
@@ -7357,10 +7807,8 @@ async fn test_precedence_fixture_with_o3_profile() -> std::io::Result<()> {
             include_skill_instructions: true,
             include_environment_context: true,
             compact_prompt: None,
-            commit_attribution: None,
             forced_chatgpt_workspace_id: None,
             forced_login_method: None,
-            include_apply_patch_tool: true,
             web_search_mode: Constrained::allow_any(WebSearchMode::Cached),
             web_search_config: None,
             use_experimental_unified_exec_tool: !cfg!(windows),
@@ -7371,7 +7819,6 @@ async fn test_precedence_fixture_with_o3_profile() -> std::io::Result<()> {
             suppress_unstable_features_warning: false,
             active_profile: Some("o3".to_string()),
             active_project: ProjectConfig { trust_level: None },
-            windows_wsl_setup_acknowledged: false,
             notices: Default::default(),
             check_for_update_on_startup: true,
             disable_paste_burst: false,
@@ -7723,24 +8170,32 @@ async fn test_precedence_fixture_with_gpt3_profile() -> std::io::Result<()> {
         review_model: None,
         model_context_window: None,
         model_auto_compact_token_limit: None,
+        model_auto_compact_token_limit_scope: AutoCompactTokenLimitScope::Total,
         service_tier: None,
         model_provider_id: "openai-custom".to_string(),
         model_provider: fixture.openai_custom_provider.clone(),
         permissions: Permissions {
             approval_policy: Constrained::allow_any(AskForApproval::UnlessTrusted),
-            permission_profile: Constrained::allow_any(PermissionProfile::read_only()),
-            active_permission_profile: Some(ActivePermissionProfile::new(":read-only")),
+            permission_profile_state: active_permission_profile_state(
+                PermissionProfile::read_only(),
+                BUILT_IN_PERMISSION_PROFILE_READ_ONLY,
+            ),
+            workspace_roots: vec![fixture.cwd()],
             network: None,
             allow_login_shell: true,
             shell_environment_policy: ShellEnvironmentPolicy::default(),
             windows_sandbox_mode: None,
             windows_sandbox_private_desktop: true,
         },
+        explicit_permission_profile_mode: false,
+        custom_permission_profile_ids: Vec::new(),
         approvals_reviewer: ApprovalsReviewer::User,
         enforce_residency: Constrained::allow_any(/*initial_value*/ None),
         user_instructions: None,
         notify: None,
         cwd: fixture.cwd(),
+        workspace_roots: vec![fixture.cwd()],
+        workspace_roots_explicit: false,
         cli_auth_credentials_store_mode: Default::default(),
         mcp_servers: Constrained::allow_any(HashMap::new()),
         mcp_oauth_credentials_store_mode: resolve_mcp_oauth_credentials_store_mode(
@@ -7787,6 +8242,7 @@ async fn test_precedence_fixture_with_gpt3_profile() -> std::io::Result<()> {
         personality: Some(Personality::Pragmatic),
         chatgpt_base_url: "https://chatgpt.com/backend-api/".to_string(),
         apps_mcp_path_override: None,
+        apps_mcp_product_sku: None,
         realtime_audio: RealtimeAudioConfig::default(),
         experimental_realtime_start_instructions: None,
         experimental_realtime_ws_base_url: None,
@@ -7805,10 +8261,8 @@ async fn test_precedence_fixture_with_gpt3_profile() -> std::io::Result<()> {
         include_skill_instructions: true,
         include_environment_context: true,
         compact_prompt: None,
-        commit_attribution: None,
         forced_chatgpt_workspace_id: None,
         forced_login_method: None,
-        include_apply_patch_tool: true,
         web_search_mode: Constrained::allow_any(WebSearchMode::Cached),
         web_search_config: None,
         use_experimental_unified_exec_tool: !cfg!(windows),
@@ -7819,7 +8273,6 @@ async fn test_precedence_fixture_with_gpt3_profile() -> std::io::Result<()> {
         suppress_unstable_features_warning: false,
         active_profile: Some("gpt3".to_string()),
         active_project: ProjectConfig { trust_level: None },
-        windows_wsl_setup_acknowledged: false,
         notices: Default::default(),
         check_for_update_on_startup: true,
         disable_paste_burst: false,
@@ -7885,24 +8338,32 @@ async fn test_precedence_fixture_with_zdr_profile() -> std::io::Result<()> {
         review_model: None,
         model_context_window: None,
         model_auto_compact_token_limit: None,
+        model_auto_compact_token_limit_scope: AutoCompactTokenLimitScope::Total,
         service_tier: None,
         model_provider_id: "openai".to_string(),
         model_provider: fixture.openai_provider.clone(),
         permissions: Permissions {
             approval_policy: Constrained::allow_any(AskForApproval::OnFailure),
-            permission_profile: Constrained::allow_any(PermissionProfile::read_only()),
-            active_permission_profile: Some(ActivePermissionProfile::new(":read-only")),
+            permission_profile_state: active_permission_profile_state(
+                PermissionProfile::read_only(),
+                BUILT_IN_PERMISSION_PROFILE_READ_ONLY,
+            ),
+            workspace_roots: vec![fixture.cwd()],
             network: None,
             allow_login_shell: true,
             shell_environment_policy: ShellEnvironmentPolicy::default(),
             windows_sandbox_mode: None,
             windows_sandbox_private_desktop: true,
         },
+        explicit_permission_profile_mode: false,
+        custom_permission_profile_ids: Vec::new(),
         approvals_reviewer: ApprovalsReviewer::User,
         enforce_residency: Constrained::allow_any(/*initial_value*/ None),
         user_instructions: None,
         notify: None,
         cwd: fixture.cwd(),
+        workspace_roots: vec![fixture.cwd()],
+        workspace_roots_explicit: false,
         cli_auth_credentials_store_mode: Default::default(),
         mcp_servers: Constrained::allow_any(HashMap::new()),
         mcp_oauth_credentials_store_mode: resolve_mcp_oauth_credentials_store_mode(
@@ -7949,6 +8410,7 @@ async fn test_precedence_fixture_with_zdr_profile() -> std::io::Result<()> {
         personality: Some(Personality::Pragmatic),
         chatgpt_base_url: "https://chatgpt.com/backend-api/".to_string(),
         apps_mcp_path_override: None,
+        apps_mcp_product_sku: None,
         realtime_audio: RealtimeAudioConfig::default(),
         experimental_realtime_start_instructions: None,
         experimental_realtime_ws_base_url: None,
@@ -7967,10 +8429,8 @@ async fn test_precedence_fixture_with_zdr_profile() -> std::io::Result<()> {
         include_skill_instructions: true,
         include_environment_context: true,
         compact_prompt: None,
-        commit_attribution: None,
         forced_chatgpt_workspace_id: None,
         forced_login_method: None,
-        include_apply_patch_tool: true,
         web_search_mode: Constrained::allow_any(WebSearchMode::Cached),
         web_search_config: None,
         use_experimental_unified_exec_tool: !cfg!(windows),
@@ -7981,7 +8441,6 @@ async fn test_precedence_fixture_with_zdr_profile() -> std::io::Result<()> {
         suppress_unstable_features_warning: false,
         active_profile: Some("zdr".to_string()),
         active_project: ProjectConfig { trust_level: None },
-        windows_wsl_setup_acknowledged: false,
         notices: Default::default(),
         check_for_update_on_startup: true,
         disable_paste_burst: false,
@@ -8032,24 +8491,32 @@ async fn test_precedence_fixture_with_gpt5_profile() -> std::io::Result<()> {
         review_model: None,
         model_context_window: None,
         model_auto_compact_token_limit: None,
+        model_auto_compact_token_limit_scope: AutoCompactTokenLimitScope::Total,
         service_tier: None,
         model_provider_id: "openai".to_string(),
         model_provider: fixture.openai_provider.clone(),
         permissions: Permissions {
             approval_policy: Constrained::allow_any(AskForApproval::OnFailure),
-            permission_profile: Constrained::allow_any(PermissionProfile::read_only()),
-            active_permission_profile: Some(ActivePermissionProfile::new(":read-only")),
+            permission_profile_state: active_permission_profile_state(
+                PermissionProfile::read_only(),
+                BUILT_IN_PERMISSION_PROFILE_READ_ONLY,
+            ),
+            workspace_roots: vec![fixture.cwd()],
             network: None,
             allow_login_shell: true,
             shell_environment_policy: ShellEnvironmentPolicy::default(),
             windows_sandbox_mode: None,
             windows_sandbox_private_desktop: true,
         },
+        explicit_permission_profile_mode: false,
+        custom_permission_profile_ids: Vec::new(),
         approvals_reviewer: ApprovalsReviewer::User,
         enforce_residency: Constrained::allow_any(/*initial_value*/ None),
         user_instructions: None,
         notify: None,
         cwd: fixture.cwd(),
+        workspace_roots: vec![fixture.cwd()],
+        workspace_roots_explicit: false,
         cli_auth_credentials_store_mode: Default::default(),
         mcp_servers: Constrained::allow_any(HashMap::new()),
         mcp_oauth_credentials_store_mode: resolve_mcp_oauth_credentials_store_mode(
@@ -8096,6 +8563,7 @@ async fn test_precedence_fixture_with_gpt5_profile() -> std::io::Result<()> {
         personality: Some(Personality::Pragmatic),
         chatgpt_base_url: "https://chatgpt.com/backend-api/".to_string(),
         apps_mcp_path_override: None,
+        apps_mcp_product_sku: None,
         realtime_audio: RealtimeAudioConfig::default(),
         experimental_realtime_start_instructions: None,
         experimental_realtime_ws_base_url: None,
@@ -8114,10 +8582,8 @@ async fn test_precedence_fixture_with_gpt5_profile() -> std::io::Result<()> {
         include_skill_instructions: true,
         include_environment_context: true,
         compact_prompt: None,
-        commit_attribution: None,
         forced_chatgpt_workspace_id: None,
         forced_login_method: None,
-        include_apply_patch_tool: true,
         web_search_mode: Constrained::allow_any(WebSearchMode::Cached),
         web_search_config: None,
         use_experimental_unified_exec_tool: !cfg!(windows),
@@ -8128,7 +8594,6 @@ async fn test_precedence_fixture_with_gpt5_profile() -> std::io::Result<()> {
         suppress_unstable_features_warning: false,
         active_profile: Some("gpt5".to_string()),
         active_project: ProjectConfig { trust_level: None },
-        windows_wsl_setup_acknowledged: false,
         notices: Default::default(),
         check_for_update_on_startup: true,
         disable_paste_burst: false,
@@ -8540,29 +9005,26 @@ async fn derive_sandbox_policy_preserves_windows_downgrade_for_unsupported_fallb
     let active_project = ProjectConfig {
         trust_level: Some(TrustLevel::Trusted),
     };
-    let constrained = Constrained::new(
-        PermissionProfile::from_legacy_sandbox_policy(&SandboxPolicy::new_workspace_write_policy()),
-        |candidate| {
-            if matches!(
-                candidate,
-                PermissionProfile::Managed {
-                    file_system: ManagedFileSystemPermissions::Restricted { entries, .. },
-                    ..
-                } if entries
-                        .iter()
-                        .any(|entry| entry.access.can_write())
-            ) {
-                Ok(())
-            } else {
-                Err(ConstraintError::InvalidValue {
-                    field_name: "sandbox_mode",
-                    candidate: format!("{candidate:?}"),
-                    allowed: "[WorkspaceWrite]".to_string(),
-                    requirement_source: RequirementSource::Unknown,
-                })
-            }
-        },
-    )?;
+    let constrained = Constrained::new(PermissionProfile::workspace_write(), |candidate| {
+        if matches!(
+            candidate,
+            PermissionProfile::Managed {
+                file_system: ManagedFileSystemPermissions::Restricted { entries, .. },
+                ..
+            } if entries
+                    .iter()
+                    .any(|entry| entry.access.can_write())
+        ) {
+            Ok(())
+        } else {
+            Err(ConstraintError::InvalidValue {
+                field_name: "sandbox_mode",
+                candidate: format!("{candidate:?}"),
+                allowed: "[WorkspaceWrite]".to_string(),
+                requirement_source: RequirementSource::Unknown,
+            })
+        }
+    })?;
 
     let resolution = derive_legacy_sandbox_policy_for_test(
         &cfg,
@@ -8769,6 +9231,79 @@ path = "/custom/mcp"
     Ok(())
 }
 
+#[tokio::test]
+async fn config_defaults_enabled_apps_mcp_path_override_to_plugin_service() -> std::io::Result<()> {
+    let codex_home = TempDir::new()?;
+    let toml = r#"
+model = "gpt-5.4"
+
+[features]
+apps_mcp_path_override = true
+"#;
+    let cfg: ConfigToml =
+        toml::from_str(toml).expect("TOML deserialization should succeed for apps MCP feature");
+
+    let config = Config::load_from_base_config_with_overrides(
+        cfg,
+        ConfigOverrides::default(),
+        codex_home.abs(),
+    )
+    .await?;
+
+    assert!(config.features.enabled(Feature::AppsMcpPathOverride));
+    assert_eq!(config.apps_mcp_path_override.as_deref(), Some("/ps/mcp"));
+    Ok(())
+}
+
+#[tokio::test]
+async fn config_preserves_explicit_apps_mcp_path_override_path() -> std::io::Result<()> {
+    let codex_home = TempDir::new()?;
+    let toml = r#"
+model = "gpt-5.4"
+
+[features.apps_mcp_path_override]
+enabled = true
+path = "/custom/mcp"
+"#;
+    let cfg: ConfigToml =
+        toml::from_str(toml).expect("TOML deserialization should succeed for apps MCP feature");
+
+    let config = Config::load_from_base_config_with_overrides(
+        cfg,
+        ConfigOverrides::default(),
+        codex_home.abs(),
+    )
+    .await?;
+
+    assert_eq!(
+        config.apps_mcp_path_override.as_deref(),
+        Some("/custom/mcp")
+    );
+    assert!(config.features.enabled(Feature::AppsMcpPathOverride));
+    Ok(())
+}
+
+#[tokio::test]
+async fn config_loads_apps_mcp_product_sku_from_toml() -> std::io::Result<()> {
+    let codex_home = TempDir::new()?;
+    let toml = r#"
+model = "gpt-5.4"
+apps_mcp_product_sku = "tpp"
+"#;
+    let cfg: ConfigToml =
+        toml::from_str(toml).expect("TOML deserialization should succeed for apps MCP SKU");
+
+    let config = Config::load_from_base_config_with_overrides(
+        cfg,
+        ConfigOverrides::default(),
+        codex_home.abs(),
+    )
+    .await?;
+
+    assert_eq!(config.apps_mcp_product_sku.as_deref(), Some("tpp"));
+    Ok(())
+}
+
 #[tokio::test]
 async fn config_loads_mcp_oauth_callback_url_from_toml() -> std::io::Result<()> {
     let codex_home = TempDir::new()?;
@@ -8936,7 +9471,7 @@ async fn permission_profile_override_falls_back_when_disallowed_by_requirements(
     let expected_sandbox_policy = SandboxPolicy::new_read_only_policy();
     assert_eq!(config.legacy_sandbox_policy(), expected_sandbox_policy);
     assert_eq!(
-        config.permissions.permission_profile(),
+        config.permissions.effective_permission_profile(),
         PermissionProfile::read_only()
     );
     Ok(())
@@ -8954,7 +9489,7 @@ async fn active_profile_is_cleared_when_requirements_force_fallback() -> std::io
         .codex_home(codex_home.path().to_path_buf())
         .fallback_cwd(Some(codex_home.path().to_path_buf()))
         .harness_overrides(ConfigOverrides {
-            default_permissions: Some(":danger-no-sandbox".to_string()),
+            default_permissions: Some(BUILT_IN_PERMISSION_PROFILE_DANGER_FULL_ACCESS.to_string()),
             ..Default::default()
         })
         .cloud_requirements(CloudRequirementsLoader::new(async move {
@@ -8964,7 +9499,7 @@ async fn active_profile_is_cleared_when_requirements_force_fallback() -> std::io
         .await?;
 
     assert_eq!(
-        config.permissions.permission_profile(),
+        config.permissions.effective_permission_profile(),
         PermissionProfile::read_only()
     );
     assert_eq!(config.permissions.active_permission_profile(), None);
@@ -9084,7 +9619,7 @@ async fn requirements_web_search_mode_overrides_danger_full_access_default() ->
     assert_eq!(
         resolve_web_search_mode_for_turn(
             &config.web_search_mode,
-            &config.permissions.permission_profile(),
+            &config.permissions.effective_permission_profile(),
         ),
         WebSearchMode::Cached,
     );
@@ -9651,11 +10186,15 @@ async fn multi_agent_v2_config_from_feature_table() -> std::io::Result<()> {
 enabled = true
 max_concurrent_threads_per_session = 5
 min_wait_timeout_ms = 2500
+max_wait_timeout_ms = 120000
+default_wait_timeout_ms = 30000
 usage_hint_enabled = false
 usage_hint_text = "Custom delegation guidance."
 root_agent_usage_hint_text = "Root guidance."
 subagent_usage_hint_text = "Subagent guidance."
+tool_namespace = "agents"
 hide_spawn_agent_metadata = true
+non_code_mode_only = true
 "#,
     )?;
 
@@ -9668,6 +10207,8 @@ hide_spawn_agent_metadata = true
     assert!(config.features.enabled(Feature::MultiAgentV2));
     assert_eq!(config.multi_agent_v2.max_concurrent_threads_per_session, 5);
     assert_eq!(config.multi_agent_v2.min_wait_timeout_ms, 2500);
+    assert_eq!(config.multi_agent_v2.max_wait_timeout_ms, 120000);
+    assert_eq!(config.multi_agent_v2.default_wait_timeout_ms, 30000);
     assert_eq!(config.agent_max_threads, Some(4));
     assert!(!config.multi_agent_v2.usage_hint_enabled);
     assert_eq!(
@@ -9682,7 +10223,12 @@ hide_spawn_agent_metadata = true
         config.multi_agent_v2.subagent_usage_hint_text.as_deref(),
         Some("Subagent guidance.")
     );
+    assert_eq!(
+        config.multi_agent_v2.tool_namespace.as_deref(),
+        Some("agents")
+    );
     assert!(config.multi_agent_v2.hide_spawn_agent_metadata);
+    assert!(config.multi_agent_v2.non_code_mode_only);
 
     Ok(())
 }
@@ -9697,20 +10243,28 @@ async fn profile_multi_agent_v2_config_overrides_base() -> std::io::Result<()> {
 [features.multi_agent_v2]
 max_concurrent_threads_per_session = 4
 min_wait_timeout_ms = 3000
+max_wait_timeout_ms = 120000
+default_wait_timeout_ms = 30000
 usage_hint_enabled = true
 usage_hint_text = "base hint"
 root_agent_usage_hint_text = "base root hint"
 subagent_usage_hint_text = "base subagent hint"
+tool_namespace = "base_agents"
 hide_spawn_agent_metadata = true
+non_code_mode_only = false
 
 [profiles.no_hint.features.multi_agent_v2]
 max_concurrent_threads_per_session = 6
 min_wait_timeout_ms = 1500
+max_wait_timeout_ms = 90000
+default_wait_timeout_ms = 15000
 usage_hint_enabled = false
 usage_hint_text = "profile hint"
 root_agent_usage_hint_text = "profile root hint"
 subagent_usage_hint_text = "profile subagent hint"
+tool_namespace = "profile_agents"
 hide_spawn_agent_metadata = false
+non_code_mode_only = true
 "#,
     )?;
 
@@ -9722,6 +10276,8 @@ hide_spawn_agent_metadata = false
 
     assert_eq!(config.multi_agent_v2.max_concurrent_threads_per_session, 6);
     assert_eq!(config.multi_agent_v2.min_wait_timeout_ms, 1500);
+    assert_eq!(config.multi_agent_v2.max_wait_timeout_ms, 90000);
+    assert_eq!(config.multi_agent_v2.default_wait_timeout_ms, 15000);
     assert!(!config.multi_agent_v2.usage_hint_enabled);
     assert_eq!(
         config.multi_agent_v2.usage_hint_text.as_deref(),
@@ -9735,7 +10291,12 @@ hide_spawn_agent_metadata = false
         config.multi_agent_v2.subagent_usage_hint_text.as_deref(),
         Some("profile subagent hint")
     );
+    assert_eq!(
+        config.multi_agent_v2.tool_namespace.as_deref(),
+        Some("profile_agents")
+    );
     assert!(!config.multi_agent_v2.hide_spawn_agent_metadata);
+    assert!(config.multi_agent_v2.non_code_mode_only);
 
     Ok(())
 }
@@ -9758,7 +10319,10 @@ enabled = true
 
     assert_eq!(config.multi_agent_v2.max_concurrent_threads_per_session, 4);
     assert_eq!(config.multi_agent_v2.min_wait_timeout_ms, 10_000);
+    assert_eq!(config.multi_agent_v2.max_wait_timeout_ms, 3_600_000);
+    assert_eq!(config.multi_agent_v2.default_wait_timeout_ms, 30_000);
     assert_eq!(config.agent_max_threads, Some(3));
+    assert!(!config.multi_agent_v2.non_code_mode_only);
 
     Ok(())
 }
@@ -9793,13 +10357,33 @@ max_threads = 3
 }
 
 #[tokio::test]
-async fn multi_agent_v2_rejects_invalid_min_wait_timeout() -> std::io::Result<()> {
+async fn multi_agent_v2_rejects_invalid_wait_timeouts() -> std::io::Result<()> {
     let codex_home = TempDir::new()?;
     std::fs::write(
         codex_home.path().join(CONFIG_TOML_FILE),
         r#"[features.multi_agent_v2]
 enabled = true
 min_wait_timeout_ms = 0
+max_wait_timeout_ms = 0
+default_wait_timeout_ms = 0
+"#,
+    )?;
+
+    let config = ConfigBuilder::without_managed_config_for_tests()
+        .codex_home(codex_home.path().to_path_buf())
+        .fallback_cwd(Some(codex_home.path().to_path_buf()))
+        .build()
+        .await?;
+
+    assert_eq!(config.multi_agent_v2.min_wait_timeout_ms, 0);
+    assert_eq!(config.multi_agent_v2.max_wait_timeout_ms, 0);
+    assert_eq!(config.multi_agent_v2.default_wait_timeout_ms, 0);
+
+    std::fs::write(
+        codex_home.path().join(CONFIG_TOML_FILE),
+        r#"[features.multi_agent_v2]
+enabled = true
+min_wait_timeout_ms = -1
 "#,
     )?;
 
@@ -9808,12 +10392,12 @@ min_wait_timeout_ms = 0
         .fallback_cwd(Some(codex_home.path().to_path_buf()))
         .build()
         .await
-        .expect_err("zero min_wait_timeout_ms should be rejected");
+        .expect_err("negative min_wait_timeout_ms should be rejected");
 
     assert_eq!(err.kind(), std::io::ErrorKind::InvalidInput);
     assert_eq!(
         err.to_string(),
-        "features.multi_agent_v2.min_wait_timeout_ms must be at least 1"
+        "features.multi_agent_v2.min_wait_timeout_ms must be at least 0"
     );
 
     std::fs::write(
@@ -9837,6 +10421,173 @@ min_wait_timeout_ms = 3600001
         "features.multi_agent_v2.min_wait_timeout_ms must be at most 3600000"
     );
 
+    std::fs::write(
+        codex_home.path().join(CONFIG_TOML_FILE),
+        r#"[features.multi_agent_v2]
+enabled = true
+max_wait_timeout_ms = -1
+"#,
+    )?;
+
+    let err = ConfigBuilder::without_managed_config_for_tests()
+        .codex_home(codex_home.path().to_path_buf())
+        .fallback_cwd(Some(codex_home.path().to_path_buf()))
+        .build()
+        .await
+        .expect_err("negative max_wait_timeout_ms should be rejected");
+
+    assert_eq!(err.kind(), std::io::ErrorKind::InvalidInput);
+    assert_eq!(
+        err.to_string(),
+        "features.multi_agent_v2.max_wait_timeout_ms must be at least 0"
+    );
+
+    std::fs::write(
+        codex_home.path().join(CONFIG_TOML_FILE),
+        r#"[features.multi_agent_v2]
+enabled = true
+max_wait_timeout_ms = 3600001
+"#,
+    )?;
+
+    let err = ConfigBuilder::without_managed_config_for_tests()
+        .codex_home(codex_home.path().to_path_buf())
+        .fallback_cwd(Some(codex_home.path().to_path_buf()))
+        .build()
+        .await
+        .expect_err("too large max_wait_timeout_ms should be rejected");
+
+    assert_eq!(err.kind(), std::io::ErrorKind::InvalidInput);
+    assert_eq!(
+        err.to_string(),
+        "features.multi_agent_v2.max_wait_timeout_ms must be at most 3600000"
+    );
+
+    std::fs::write(
+        codex_home.path().join(CONFIG_TOML_FILE),
+        r#"[features.multi_agent_v2]
+enabled = true
+default_wait_timeout_ms = -1
+"#,
+    )?;
+
+    let err = ConfigBuilder::without_managed_config_for_tests()
+        .codex_home(codex_home.path().to_path_buf())
+        .fallback_cwd(Some(codex_home.path().to_path_buf()))
+        .build()
+        .await
+        .expect_err("negative default_wait_timeout_ms should be rejected");
+
+    assert_eq!(err.kind(), std::io::ErrorKind::InvalidInput);
+    assert_eq!(
+        err.to_string(),
+        "features.multi_agent_v2.default_wait_timeout_ms must be at least 0"
+    );
+
+    std::fs::write(
+        codex_home.path().join(CONFIG_TOML_FILE),
+        r#"[features.multi_agent_v2]
+enabled = true
+min_wait_timeout_ms = 1000
+max_wait_timeout_ms = 500
+"#,
+    )?;
+
+    let err = ConfigBuilder::without_managed_config_for_tests()
+        .codex_home(codex_home.path().to_path_buf())
+        .fallback_cwd(Some(codex_home.path().to_path_buf()))
+        .build()
+        .await
+        .expect_err("min greater than max should be rejected");
+
+    assert_eq!(err.kind(), std::io::ErrorKind::InvalidInput);
+    assert_eq!(
+        err.to_string(),
+        "features.multi_agent_v2.min_wait_timeout_ms must be at most features.multi_agent_v2.max_wait_timeout_ms"
+    );
+
+    std::fs::write(
+        codex_home.path().join(CONFIG_TOML_FILE),
+        r#"[features.multi_agent_v2]
+enabled = true
+min_wait_timeout_ms = 1000
+max_wait_timeout_ms = 2000
+default_wait_timeout_ms = 500
+"#,
+    )?;
+
+    let err = ConfigBuilder::without_managed_config_for_tests()
+        .codex_home(codex_home.path().to_path_buf())
+        .fallback_cwd(Some(codex_home.path().to_path_buf()))
+        .build()
+        .await
+        .expect_err("default less than min should be rejected");
+
+    assert_eq!(err.kind(), std::io::ErrorKind::InvalidInput);
+    assert_eq!(
+        err.to_string(),
+        "features.multi_agent_v2.default_wait_timeout_ms must be at least features.multi_agent_v2.min_wait_timeout_ms"
+    );
+
+    std::fs::write(
+        codex_home.path().join(CONFIG_TOML_FILE),
+        r#"[features.multi_agent_v2]
+enabled = true
+min_wait_timeout_ms = 1000
+max_wait_timeout_ms = 2000
+default_wait_timeout_ms = 2500
+"#,
+    )?;
+
+    let err = ConfigBuilder::without_managed_config_for_tests()
+        .codex_home(codex_home.path().to_path_buf())
+        .fallback_cwd(Some(codex_home.path().to_path_buf()))
+        .build()
+        .await
+        .expect_err("default greater than max should be rejected");
+
+    assert_eq!(err.kind(), std::io::ErrorKind::InvalidInput);
+    assert_eq!(
+        err.to_string(),
+        "features.multi_agent_v2.default_wait_timeout_ms must be at most features.multi_agent_v2.max_wait_timeout_ms"
+    );
+
+    Ok(())
+}
+
+#[tokio::test]
+async fn multi_agent_v2_rejects_invalid_tool_namespace() -> std::io::Result<()> {
+    for (namespace, expected_message) in [
+        (
+            "bad namespace",
+            "features.multi_agent_v2.tool_namespace must match ^[a-zA-Z0-9_-]+$",
+        ),
+        (
+            "functions",
+            "features.multi_agent_v2.tool_namespace uses a reserved namespace: functions",
+        ),
+    ] {
+        let codex_home = TempDir::new()?;
+        std::fs::write(
+            codex_home.path().join(CONFIG_TOML_FILE),
+            format!(
+                r#"[features.multi_agent_v2]
+enabled = true
+tool_namespace = "{namespace}"
+"#
+            ),
+        )?;
+
+        let err = ConfigBuilder::without_managed_config_for_tests()
+            .codex_home(codex_home.path().to_path_buf())
+            .fallback_cwd(Some(codex_home.path().to_path_buf()))
+            .build()
+            .await
+            .expect_err("invalid multi_agent_v2 tool namespace should fail");
+        assert_eq!(err.kind(), std::io::ErrorKind::InvalidInput);
+        assert_eq!(err.to_string(), expected_message);
+    }
+
     Ok(())
 }
 
diff --git a/codex-rs/core/src/config/edit.rs b/codex-rs/core/src/config/edit.rs
index 4dde2c0cb0..5418d3b268 100644
--- a/codex-rs/core/src/config/edit.rs
+++ b/codex-rs/core/src/config/edit.rs
@@ -44,8 +44,6 @@ pub enum ConfigEdit {
     SetNoticeFastDefaultOptOut(bool),
     /// Toggle the rate limit model nudge acknowledgement flag.
     SetNoticeHideRateLimitModelNudge(bool),
-    /// Toggle the Windows onboarding acknowledgement flag.
-    SetWindowsWslSetupAcknowledged(bool),
     /// Toggle the model migration prompt acknowledgement flag.
     SetNoticeHideModelMigrationPrompt(String, bool),
     /// Toggle the home external config migration prompt acknowledgement flag.
@@ -341,6 +339,15 @@ mod document_helpers {
         {
             entry["scopes"] = array_from_iter(scopes.iter().cloned());
         }
+        if let Some(oauth) = &config.oauth
+            && let Some(client_id) = &oauth.client_id
+            && !client_id.is_empty()
+        {
+            let mut oauth_table = TomlTable::new();
+            oauth_table.set_implicit(false);
+            oauth_table["client_id"] = value(client_id.clone());
+            entry["oauth"] = TomlItem::Table(oauth_table);
+        }
         if let Some(resource) = &config.oauth_resource
             && !resource.is_empty()
         {
@@ -636,11 +643,6 @@ impl ConfigDocument {
                 &[NOTICE_TABLE_KEY, "model_migrations", from.as_str()],
                 value(to.clone()),
             )),
-            ConfigEdit::SetWindowsWslSetupAcknowledged(acknowledged) => Ok(self.write_value(
-                Scope::Global,
-                &["windows_wsl_setup_acknowledged"],
-                value(*acknowledged),
-            )),
             ConfigEdit::ReplaceMcpServers(servers) => Ok(self.replace_mcp_servers(servers)),
             ConfigEdit::AddToolSuggestDisabledTool(disabled_tool) => {
                 Ok(self.add_tool_suggest_disabled_tool(disabled_tool))
@@ -1037,13 +1039,21 @@ pub fn apply_blocking(
     codex_home: &Path,
     profile: Option<&str>,
     edits: &[ConfigEdit],
+) -> anyhow::Result<()> {
+    let config_path = codex_home.join(CONFIG_TOML_FILE);
+    apply_blocking_to_resolved_file(&config_path, profile, edits)
+}
+
+fn apply_blocking_to_resolved_file(
+    resolved_config_file: &Path,
+    legacy_profile: Option<&str>,
+    edits: &[ConfigEdit],
 ) -> anyhow::Result<()> {
     if edits.is_empty() {
         return Ok(());
     }
 
-    let config_path = codex_home.join(CONFIG_TOML_FILE);
-    let write_paths = resolve_symlink_write_paths(&config_path)?;
+    let write_paths = resolve_symlink_write_paths(resolved_config_file)?;
     let serialized = match write_paths.read_path {
         Some(path) => match std::fs::read_to_string(&path) {
             Ok(contents) => contents,
@@ -1059,7 +1069,7 @@ pub fn apply_blocking(
         serialized.parse::<DocumentMut>()?
     };
 
-    let profile = profile.map(ToOwned::to_owned).or_else(|| {
+    let profile = legacy_profile.map(ToOwned::to_owned).or_else(|| {
         doc.get("profile")
             .and_then(|item| item.as_str())
             .map(ToOwned::to_owned)
@@ -1078,7 +1088,7 @@ pub fn apply_blocking(
 
     write_atomically(&write_paths.write_path, &document.doc.to_string()).with_context(|| {
         format!(
-            "failed to persist config.toml at {}",
+            "failed to persist config at {}",
             write_paths.write_path.display()
         )
     })?;
@@ -1087,30 +1097,50 @@ pub fn apply_blocking(
 }
 
 /// Persist edits asynchronously by offloading the blocking writer.
+///
+/// `profile` selects a legacy `[profiles.<name>]` section inside
+/// `$CODEX_HOME/config.toml`; profile-v2 callers should resolve their target
+/// file before constructing a [ConfigEditsBuilder].
 pub async fn apply(
     codex_home: &Path,
     profile: Option<&str>,
     edits: Vec<ConfigEdit>,
 ) -> anyhow::Result<()> {
     let codex_home = codex_home.to_path_buf();
+    let config_path = codex_home.join(CONFIG_TOML_FILE);
     let profile = profile.map(ToOwned::to_owned);
-    task::spawn_blocking(move || apply_blocking(&codex_home, profile.as_deref(), &edits))
-        .await
-        .context("config persistence task panicked")?
+    task::spawn_blocking(move || {
+        apply_blocking_to_resolved_file(&config_path, profile.as_deref(), &edits)
+    })
+    .await
+    .context("config persistence task panicked")?
 }
 
 /// Fluent builder to batch config edits and apply them atomically.
 #[derive(Default)]
 pub struct ConfigEditsBuilder {
-    codex_home: PathBuf,
+    config_path: PathBuf,
     profile: Option<String>,
     edits: Vec<ConfigEdit>,
 }
 
 impl ConfigEditsBuilder {
     pub fn new(codex_home: &Path) -> Self {
+        Self::for_config_path(&codex_home.join(CONFIG_TOML_FILE))
+    }
+
+    pub fn for_config(config: &crate::config::Config) -> Self {
+        let config_path = config
+            .config_layer_stack
+            .get_user_config_file()
+            .map(codex_utils_absolute_path::AbsolutePathBuf::to_path_buf)
+            .unwrap_or_else(|| config.codex_home.join(CONFIG_TOML_FILE).to_path_buf());
+        Self::for_config_path(&config_path)
+    }
+
+    pub fn for_config_path(config_path: &Path) -> Self {
         Self {
-            codex_home: codex_home.to_path_buf(),
+            config_path: config_path.to_path_buf(),
             profile: None,
             edits: Vec::new(),
         }
@@ -1203,12 +1233,6 @@ impl ConfigEditsBuilder {
         self
     }
 
-    pub fn set_windows_wsl_setup_acknowledged(mut self, acknowledged: bool) -> Self {
-        self.edits
-            .push(ConfigEdit::SetWindowsWslSetupAcknowledged(acknowledged));
-        self
-    }
-
     pub fn set_model_availability_nux_count(mut self, shown_count: &HashMap<String, u32>) -> Self {
         self.edits
             .extend(model_availability_nux_count_edits(shown_count));
@@ -1369,13 +1393,13 @@ impl ConfigEditsBuilder {
 
     /// Apply edits on a blocking thread.
     pub fn apply_blocking(self) -> anyhow::Result<()> {
-        apply_blocking(&self.codex_home, self.profile.as_deref(), &self.edits)
+        apply_blocking_to_resolved_file(&self.config_path, self.profile.as_deref(), &self.edits)
     }
 
     /// Apply edits asynchronously via a blocking offload.
     pub async fn apply(self) -> anyhow::Result<()> {
         task::spawn_blocking(move || {
-            apply_blocking(&self.codex_home, self.profile.as_deref(), &self.edits)
+            apply_blocking_to_resolved_file(&self.config_path, self.profile.as_deref(), &self.edits)
         })
         .await
         .context("config persistence task panicked")?
diff --git a/codex-rs/core/src/config/edit_tests.rs b/codex-rs/core/src/config/edit_tests.rs
index ec7342c779..751411afdf 100644
--- a/codex-rs/core/src/config/edit_tests.rs
+++ b/codex-rs/core/src/config/edit_tests.rs
@@ -1,5 +1,6 @@
 use super::*;
 use codex_config::types::AppToolApproval;
+use codex_config::types::McpServerOAuthConfig;
 use codex_config::types::McpServerToolConfig;
 use codex_config::types::McpServerTransportConfig;
 use codex_config::types::SessionPickerViewMode;
@@ -940,6 +941,7 @@ fn blocking_replace_mcp_servers_round_trips() {
             enabled_tools: Some(vec!["one".to_string(), "two".to_string()]),
             disabled_tools: None,
             scopes: None,
+            oauth: None,
             oauth_resource: None,
             tools: HashMap::new(),
         },
@@ -969,6 +971,9 @@ fn blocking_replace_mcp_servers_round_trips() {
             enabled_tools: None,
             disabled_tools: Some(vec!["forbidden".to_string()]),
             scopes: None,
+            oauth: Some(McpServerOAuthConfig {
+                client_id: Some("eci-prd-pub-codex-123".to_string()),
+            }),
             oauth_resource: Some("https://resource.example.com".to_string()),
             tools: HashMap::new(),
         },
@@ -994,6 +999,9 @@ oauth_resource = \"https://resource.example.com\"
 [mcp_servers.http.http_headers]
 Z-Header = \"z\"
 
+[mcp_servers.http.oauth]
+client_id = \"eci-prd-pub-codex-123\"
+
 [mcp_servers.stdio]
 command = \"cmd\"
 args = [\"--flag\"]
@@ -1035,6 +1043,7 @@ fn blocking_replace_mcp_servers_serializes_tool_approval_overrides() {
             enabled_tools: None,
             disabled_tools: None,
             scopes: None,
+            oauth: None,
             oauth_resource: None,
             tools: HashMap::from([(
                 "search".to_string(),
@@ -1099,6 +1108,7 @@ foo = { command = "cmd" }
             enabled_tools: None,
             disabled_tools: None,
             scopes: None,
+            oauth: None,
             oauth_resource: None,
             tools: HashMap::new(),
         },
@@ -1153,6 +1163,7 @@ foo = { command = "cmd" } # keep me
             enabled_tools: None,
             disabled_tools: None,
             scopes: None,
+            oauth: None,
             oauth_resource: None,
             tools: HashMap::new(),
         },
@@ -1206,6 +1217,7 @@ foo = { command = "cmd", args = ["--flag"] } # keep me
             enabled_tools: None,
             disabled_tools: None,
             scopes: None,
+            oauth: None,
             oauth_resource: None,
             tools: HashMap::new(),
         },
@@ -1260,6 +1272,7 @@ foo = { command = "cmd" }
             enabled_tools: None,
             disabled_tools: None,
             scopes: None,
+            oauth: None,
             oauth_resource: None,
             tools: HashMap::new(),
         },
diff --git a/codex-rs/core/src/config/managed_features.rs b/codex-rs/core/src/config/managed_features.rs
index a575b0a45b..480225fb99 100644
--- a/codex-rs/core/src/config/managed_features.rs
+++ b/codex-rs/core/src/config/managed_features.rs
@@ -269,13 +269,6 @@ fn explicit_feature_settings_in_config(cfg: &ConfigToml) -> Vec<(String, Feature
             enabled,
         ));
     }
-    if let Some(enabled) = cfg.experimental_use_freeform_apply_patch {
-        explicit_settings.push((
-            "experimental_use_freeform_apply_patch".to_string(),
-            Feature::ApplyPatchFreeform,
-            enabled,
-        ));
-    }
     for (profile_name, profile) in &cfg.profiles {
         if let Some(features) = profile.features.as_ref() {
             for (key, enabled) in features.entries() {
@@ -288,13 +281,6 @@ fn explicit_feature_settings_in_config(cfg: &ConfigToml) -> Vec<(String, Feature
                 }
             }
         }
-        if let Some(enabled) = profile.include_apply_patch_tool {
-            explicit_settings.push((
-                format!("profiles.{profile_name}.include_apply_patch_tool"),
-                Feature::ApplyPatchFreeform,
-                enabled,
-            ));
-        }
         if let Some(enabled) = profile.experimental_use_unified_exec_tool {
             explicit_settings.push((
                 format!("profiles.{profile_name}.experimental_use_unified_exec_tool"),
@@ -302,13 +288,6 @@ fn explicit_feature_settings_in_config(cfg: &ConfigToml) -> Vec<(String, Feature
                 enabled,
             ));
         }
-        if let Some(enabled) = profile.experimental_use_freeform_apply_patch {
-            explicit_settings.push((
-                format!("profiles.{profile_name}.experimental_use_freeform_apply_patch"),
-                Feature::ApplyPatchFreeform,
-                enabled,
-            ));
-        }
     }
 
     explicit_settings
@@ -369,15 +348,10 @@ pub(crate) fn validate_feature_requirements_in_config_toml(
         let configured_features = Features::from_sources(
             FeatureConfigSource {
                 features: cfg.features.as_ref(),
-                include_apply_patch_tool: None,
-                experimental_use_freeform_apply_patch: cfg.experimental_use_freeform_apply_patch,
                 experimental_use_unified_exec_tool: cfg.experimental_use_unified_exec_tool,
             },
             FeatureConfigSource {
                 features: profile.features.as_ref(),
-                include_apply_patch_tool: profile.include_apply_patch_tool,
-                experimental_use_freeform_apply_patch: profile
-                    .experimental_use_freeform_apply_patch,
                 experimental_use_unified_exec_tool: profile.experimental_use_unified_exec_tool,
             },
             FeatureOverrides::default(),
diff --git a/codex-rs/core/src/config/mod.rs b/codex-rs/core/src/config/mod.rs
index d74f83102c..336d54b382 100644
--- a/codex-rs/core/src/config/mod.rs
+++ b/codex-rs/core/src/config/mod.rs
@@ -15,10 +15,10 @@ use codex_config::ConfigRequirements;
 use codex_config::ConfigRequirementsToml;
 use codex_config::ConstrainedWithSource;
 use codex_config::FeatureRequirementsToml;
-use codex_config::LoaderOverrides;
 use codex_config::McpServerIdentity;
 use codex_config::McpServerRequirement;
 use codex_config::PluginRequirementsToml;
+use codex_config::ProfileV2Name;
 use codex_config::ResidencyRequirement;
 use codex_config::SandboxModeRequirement;
 use codex_config::Sourced;
@@ -77,6 +77,7 @@ use codex_model_provider_info::built_in_model_providers;
 use codex_model_provider_info::merge_configured_model_providers;
 use codex_models_manager::ModelsManagerConfig;
 use codex_protocol::config_types::AltScreenMode;
+use codex_protocol::config_types::AutoCompactTokenLimitScope;
 use codex_protocol::config_types::ForcedLoginMethod;
 use codex_protocol::config_types::Personality;
 use codex_protocol::config_types::ReasoningSummary;
@@ -89,7 +90,6 @@ use codex_protocol::config_types::WebSearchConfig;
 use codex_protocol::config_types::WebSearchMode;
 use codex_protocol::config_types::WindowsSandboxLevel;
 use codex_protocol::models::ActivePermissionProfile;
-use codex_protocol::models::ActivePermissionProfileModification;
 use codex_protocol::models::PermissionProfile;
 use codex_protocol::models::SandboxEnforcement;
 use codex_protocol::openai_models::ModelsResponse;
@@ -108,6 +108,7 @@ use serde::Serialize;
 use std::collections::BTreeMap;
 use std::collections::HashMap;
 use std::collections::HashSet;
+use std::collections::hash_map::Entry;
 use std::io::ErrorKind;
 use std::path::Path;
 use std::path::PathBuf;
@@ -117,6 +118,7 @@ use crate::config::permissions::BUILT_IN_WORKSPACE_PROFILE;
 use crate::config::permissions::apply_network_proxy_feature_config;
 use crate::config::permissions::builtin_permission_profile;
 use crate::config::permissions::compile_permission_profile_selection;
+use crate::config::permissions::compile_permission_profile_workspace_roots;
 use crate::config::permissions::default_builtin_permission_profile_name;
 use crate::config::permissions::get_readable_roots_required_for_codex_runtime;
 use crate::config::permissions::network_proxy_config_for_profile_selection;
@@ -134,11 +136,14 @@ mod managed_features;
 mod network_proxy_spec;
 mod otel;
 mod permissions;
+mod resolved_permission_profile;
 #[cfg(test)]
 mod schema;
+pub use codex_config::ConfigLoadOptions;
 pub use codex_config::Constrained;
 pub use codex_config::ConstraintError;
 pub use codex_config::ConstraintResult;
+pub use codex_config::LoaderOverrides;
 pub use codex_network_proxy::NetworkProxyAuditMetadata;
 use codex_sandboxing::compatibility_sandbox_policy_for_permission_profile;
 pub use codex_sandboxing::system_bwrap_warning;
@@ -146,6 +151,8 @@ pub use managed_features::ManagedFeatures;
 pub use network_proxy_spec::NetworkProxySpec;
 pub use network_proxy_spec::StartedNetworkProxy;
 pub(crate) use permissions::resolve_permission_profile;
+pub use resolved_permission_profile::PermissionProfileSnapshot;
+pub(crate) use resolved_permission_profile::PermissionProfileState;
 
 const DEFAULT_IGNORE_LARGE_UNTRACKED_DIRS: i64 = 200;
 const DEFAULT_IGNORE_LARGE_UNTRACKED_FILES: i64 = 10 * 1024 * 1024;
@@ -176,12 +183,17 @@ pub(crate) const AGENTS_MD_MAX_BYTES: usize = DEFAULT_PROJECT_DOC_MAX_BYTES; //
 pub(crate) const DEFAULT_AGENT_MAX_THREADS: Option<usize> = Some(6);
 pub(crate) const DEFAULT_MULTI_AGENT_V2_MAX_CONCURRENT_THREADS_PER_SESSION: usize = 4;
 pub(crate) const DEFAULT_MULTI_AGENT_V2_MIN_WAIT_TIMEOUT_MS: i64 = 10_000;
-pub(crate) const MAX_MULTI_AGENT_V2_WAIT_TIMEOUT_MS: i64 = 3600 * 1000;
+pub(crate) const DEFAULT_MULTI_AGENT_V2_MAX_WAIT_TIMEOUT_MS: i64 = 3600 * 1000;
+pub(crate) const DEFAULT_MULTI_AGENT_V2_DEFAULT_WAIT_TIMEOUT_MS: i64 = 30_000;
+pub(crate) const HARD_MIN_MULTI_AGENT_V2_TIMEOUT_MS: i64 = 0;
+pub(crate) const HARD_MAX_MULTI_AGENT_V2_TIMEOUT_MS: i64 =
+    DEFAULT_MULTI_AGENT_V2_MAX_WAIT_TIMEOUT_MS;
 pub(crate) const DEFAULT_AGENT_MAX_DEPTH: i32 = 1;
 pub(crate) const DEFAULT_AGENT_JOB_MAX_RUNTIME_SECONDS: Option<u64> = None;
 const LOCAL_DEV_BUILD_VERSION: &str = "0.0.0";
 
 pub const CONFIG_TOML_FILE: &str = "config.toml";
+const CONFIG_PROFILE_V2_SUFFIX: &str = ".config.toml";
 
 fn resolve_sqlite_home_env(resolved_cwd: &Path) -> Option<PathBuf> {
     let raw = std::env::var(codex_state::SQLITE_HOME_ENV).ok()?;
@@ -240,12 +252,12 @@ pub(crate) async fn test_config() -> Config {
 pub struct Permissions {
     /// Approval policy for executing commands.
     pub approval_policy: Constrained<AskForApproval>,
-    /// Canonical effective runtime permissions after config requirements and
-    /// runtime readable-root additions have been applied.
-    pub permission_profile: Constrained<PermissionProfile>,
-    /// Named or implicit built-in profile selected by config, rather than an
-    /// ad-hoc override.
-    pub active_permission_profile: Option<ActivePermissionProfile>,
+    /// Constrained permission profile plus its selected profile identity, if
+    /// the profile came from a built-in or named config profile.
+    permission_profile_state: PermissionProfileState,
+    /// Thread-scoped runtime workspace roots. Symbolic `:workspace_roots`
+    /// entries in the permission profile are materialized against these roots.
+    workspace_roots: Vec<AbsolutePathBuf>,
     /// Effective network configuration applied to all spawned processes.
     pub network: Option<NetworkProxySpec>,
     /// Whether the model may request a login shell for shell-based tools.
@@ -267,33 +279,131 @@ pub struct Permissions {
 }
 
 impl Permissions {
+    /// Build permissions from the constrained values required for a minimal
+    /// in-process configuration.
+    pub fn from_approval_and_profile(
+        approval_policy: Constrained<AskForApproval>,
+        permission_profile: Constrained<PermissionProfile>,
+    ) -> ConstraintResult<Self> {
+        Ok(Self {
+            approval_policy,
+            permission_profile_state: PermissionProfileState::from_constrained_legacy(
+                permission_profile,
+            )?,
+            workspace_roots: Vec::new(),
+            network: None,
+            allow_login_shell: true,
+            shell_environment_policy: ShellEnvironmentPolicy::default(),
+            windows_sandbox_mode: None,
+            windows_sandbox_private_desktop: true,
+        })
+    }
+
+    pub(crate) fn permission_profile_state(&self) -> &PermissionProfileState {
+        &self.permission_profile_state
+    }
+
+    pub(crate) fn set_permission_profile_state(
+        &mut self,
+        permission_profile_state: PermissionProfileState,
+    ) {
+        self.permission_profile_state = permission_profile_state;
+    }
+
+    /// Apply a permission profile snapshot emitted by core session state.
+    ///
+    /// This is a trusted-state bridge for consumers of `SessionConfigured`.
+    /// Config loading and app-server selection should resolve named profiles
+    /// through config instead of constructing a snapshot directly.
+    pub fn set_permission_profile_from_session_snapshot(
+        &mut self,
+        snapshot: PermissionProfileSnapshot,
+    ) -> ConstraintResult<()> {
+        self.permission_profile_state
+            .set_permission_profile_snapshot(snapshot)
+    }
+
+    /// Replace the current permission constraints with a trusted session
+    /// snapshot. This is only for clients that must mirror core session state
+    /// after their local config constraints reject the snapshot.
+    pub fn replace_permission_profile_from_session_snapshot(
+        &mut self,
+        snapshot: PermissionProfileSnapshot,
+    ) -> ConstraintResult<()> {
+        let permission_profile = Constrained::allow_only(snapshot.permission_profile().clone());
+        self.permission_profile_state = PermissionProfileState::from_constrained_resolved(
+            permission_profile,
+            snapshot.into_resolved_permission_profile(),
+        )?;
+        Ok(())
+    }
+
+    /// Borrow the canonical profile before runtime workspace-root
+    /// materialization has been applied.
+    pub fn permission_profile(&self) -> &PermissionProfile {
+        self.permission_profile_state.permission_profile()
+    }
+
+    pub fn can_set_permission_profile(
+        &self,
+        permission_profile: &PermissionProfile,
+    ) -> ConstraintResult<()> {
+        self.permission_profile_state
+            .can_set_legacy_permission_profile(permission_profile)
+    }
+
+    pub fn set_workspace_roots(&mut self, workspace_roots: Vec<AbsolutePathBuf>) {
+        self.workspace_roots = workspace_roots;
+    }
+
+    pub fn workspace_roots(&self) -> &[AbsolutePathBuf] {
+        &self.workspace_roots
+    }
+
+    /// Workspace roots that came from user-visible configuration or runtime
+    /// selection. Internal Codex-only writable roots are intentionally excluded.
+    pub fn user_visible_workspace_roots(&self) -> &[AbsolutePathBuf] {
+        &self.workspace_roots
+    }
+
+    pub fn profile_workspace_roots(&self) -> &[AbsolutePathBuf] {
+        self.permission_profile_state.profile_workspace_roots()
+    }
+
+    fn materialized_permission_profile(&self) -> PermissionProfile {
+        self.permission_profile()
+            .clone()
+            .materialize_project_roots_with_workspace_roots(&self.workspace_roots)
+    }
+
     /// Effective runtime permissions after config requirements and runtime
-    /// readable-root additions have been applied.
-    pub fn permission_profile(&self) -> PermissionProfile {
-        self.permission_profile.get().clone()
+    /// workspace-root materialization have been applied.
+    pub fn effective_permission_profile(&self) -> PermissionProfile {
+        self.materialized_permission_profile()
     }
 
     /// Named profile selected by config, if the current profile has one.
     pub fn active_permission_profile(&self) -> Option<ActivePermissionProfile> {
-        self.active_permission_profile.clone()
+        self.permission_profile_state.active_permission_profile()
     }
 
     /// Effective filesystem sandbox policy derived from the canonical profile.
     pub fn file_system_sandbox_policy(&self) -> FileSystemSandboxPolicy {
-        self.permission_profile.get().file_system_sandbox_policy()
+        self.materialized_permission_profile()
+            .file_system_sandbox_policy()
     }
 
     /// Effective network sandbox policy derived from the canonical profile.
     pub fn network_sandbox_policy(&self) -> NetworkSandboxPolicy {
-        self.permission_profile.get().network_sandbox_policy()
+        self.permission_profile().network_sandbox_policy()
     }
 
     /// Legacy compatibility projection derived from the canonical profile.
     pub fn legacy_sandbox_policy(&self, cwd: &Path) -> SandboxPolicy {
-        let permission_profile = self.permission_profile.get();
+        let permission_profile = self.materialized_permission_profile();
         let file_system_sandbox_policy = permission_profile.file_system_sandbox_policy();
         compatibility_sandbox_policy_for_permission_profile(
-            permission_profile,
+            &permission_profile,
             &file_system_sandbox_policy,
             permission_profile.network_sandbox_policy(),
             cwd,
@@ -315,11 +425,12 @@ impl Permissions {
             &file_system_sandbox_policy,
             network_sandbox_policy,
         );
-        self.permission_profile.can_set(&permission_profile)
+        self.permission_profile_state
+            .can_set_legacy_permission_profile(&permission_profile)
     }
 
-    /// Replace permissions from a legacy sandbox policy and keep every
-    /// permission projection in sync.
+    /// Set permissions from a legacy sandbox policy and keep every permission
+    /// projection in sync.
     pub fn set_legacy_sandbox_policy(
         &mut self,
         sandbox_policy: SandboxPolicy,
@@ -334,35 +445,39 @@ impl Permissions {
             &file_system_sandbox_policy,
             network_sandbox_policy,
         );
+        self.workspace_roots = match &sandbox_policy {
+            SandboxPolicy::WorkspaceWrite { writable_roots, .. } => {
+                let mut workspace_roots = vec![
+                    AbsolutePathBuf::from_absolute_path(cwd)
+                        .unwrap_or_else(|_| AbsolutePathBuf::resolve_path_against_base(cwd, "/")),
+                ];
+                for root in writable_roots {
+                    if !workspace_roots.iter().any(|existing| existing == root) {
+                        workspace_roots.push(root.clone());
+                    }
+                }
+                workspace_roots
+            }
+            SandboxPolicy::DangerFullAccess
+            | SandboxPolicy::ExternalSandbox { .. }
+            | SandboxPolicy::ReadOnly { .. } => vec![
+                AbsolutePathBuf::from_absolute_path(cwd)
+                    .unwrap_or_else(|_| AbsolutePathBuf::resolve_path_against_base(cwd, "/")),
+            ],
+        };
 
-        self.permission_profile.set(permission_profile)?;
-        self.active_permission_profile = None;
+        self.permission_profile_state
+            .set_legacy_permission_profile(permission_profile)?;
         Ok(())
     }
 
-    /// Replace permissions from the canonical profile.
+    /// Set permissions from the canonical profile.
     pub fn set_permission_profile(
         &mut self,
         permission_profile: PermissionProfile,
     ) -> ConstraintResult<()> {
-        self.set_permission_profile_with_active_profile(
-            permission_profile,
-            /*active_permission_profile*/ None,
-        )
-    }
-
-    /// Replace permissions from the canonical profile and record the named
-    /// source profile, if one is known.
-    pub fn set_permission_profile_with_active_profile(
-        &mut self,
-        permission_profile: PermissionProfile,
-        active_permission_profile: Option<ActivePermissionProfile>,
-    ) -> ConstraintResult<()> {
-        self.permission_profile.can_set(&permission_profile)?;
-
-        self.permission_profile.set(permission_profile)?;
-        self.active_permission_profile = active_permission_profile;
-        Ok(())
+        self.permission_profile_state
+            .set_legacy_permission_profile(permission_profile)
     }
 }
 
@@ -413,6 +528,10 @@ pub struct Config {
     /// Token usage threshold triggering auto-compaction of conversation history.
     pub model_auto_compact_token_limit: Option<i64>,
 
+    /// Controls whether `model_auto_compact_token_limit` applies to the full
+    /// active context or only tokens after the carried compaction-window prefix.
+    pub model_auto_compact_token_limit_scope: AutoCompactTokenLimitScope,
+
     /// Key into the model_providers map that specifies which provider to use.
     pub model_provider_id: String,
 
@@ -425,6 +544,13 @@ pub struct Config {
     /// Effective permission configuration for shell tool execution.
     pub permissions: Permissions,
 
+    /// Whether config explicitly selected named permissions profiles instead
+    /// of the legacy `sandbox_mode` syntax.
+    pub explicit_permission_profile_mode: bool,
+
+    /// User-defined permission profile IDs available from effective config.
+    pub custom_permission_profile_ids: Vec<String>,
+
     /// Configures who approval requests are routed to for review once they have
     /// been escalated. This does not disable separate safety checks such as
     /// ARC.
@@ -477,15 +603,6 @@ pub struct Config {
     /// Compact prompt override.
     pub compact_prompt: Option<String>,
 
-    /// Optional commit attribution text for commit message co-author trailers.
-    /// This top-level setting only takes effect when `[features].codex_git_commit`
-    /// is enabled.
-    ///
-    /// - `None`: use default attribution (`Codex <noreply@openai.com>`)
-    /// - `Some("")` or whitespace-only: disable commit attribution
-    /// - `Some("...")`: use the provided attribution text verbatim
-    pub commit_attribution: Option<String>,
-
     /// Optional external notifier command. When set, Codex will spawn this
     /// program after each completed *turn* (i.e. when the agent finishes
     /// processing a user submission). The value must be the full command
@@ -579,6 +696,15 @@ pub struct Config {
     /// layer are resolved against this path.
     pub cwd: AbsolutePathBuf,
 
+    /// Absolute runtime workspace roots for the session. Symbolic
+    /// `:workspace_roots` permission entries are materialized against these
+    /// roots while profile-defined workspace roots remain encoded directly in
+    /// the permission profile.
+    pub workspace_roots: Vec<AbsolutePathBuf>,
+    /// Whether runtime workspace roots were supplied explicitly by the caller
+    /// or legacy config, rather than defaulting to `cwd`.
+    pub workspace_roots_explicit: bool,
+
     /// Preferred store for CLI auth credentials.
     /// file (default): Use a file in the Codex home directory.
     /// keyring: Use an OS-specific keyring service.
@@ -728,6 +854,9 @@ pub struct Config {
     /// Optional path override for the host-owned apps MCP server.
     pub apps_mcp_path_override: Option<String>,
 
+    /// Optional product SKU forwarded to the host-owned apps MCP server.
+    pub apps_mcp_product_sku: Option<String>,
+
     /// Machine-local realtime audio device preferences used by realtime voice.
     pub realtime_audio: RealtimeAudioConfig,
 
@@ -754,24 +883,18 @@ pub struct Config {
     /// instructions inserted into developer messages when realtime becomes
     /// active.
     pub experimental_realtime_start_instructions: Option<String>,
-
     /// Experimental / do not use. When set, app-server fetches thread-scoped
     /// config from a remote service at this endpoint.
     pub experimental_thread_config_endpoint: Option<String>,
 
     /// Experimental / do not use. Selects the thread persistence backend.
     pub experimental_thread_store: ThreadStoreConfig,
-    /// When set, restricts ChatGPT login to a specific workspace identifier.
-    pub forced_chatgpt_workspace_id: Option<String>,
+    /// When set, restricts ChatGPT login to one or more workspace identifiers.
+    pub forced_chatgpt_workspace_id: Option<Vec<String>>,
 
     /// When set, restricts the login mechanism users may use.
     pub forced_login_method: Option<ForcedLoginMethod>,
 
-    /// Include the `apply_patch` tool for models that benefit from invoking
-    /// file edits as a structured tool call. When unset, this falls back to the
-    /// model info's default preference.
-    pub include_apply_patch_tool: bool,
-
     /// Explicit or feature-derived web search mode.
     pub web_search_mode: Constrained<WebSearchMode>,
 
@@ -805,9 +928,6 @@ pub struct Config {
     /// is (1) part of a git repo, (2) a git worktree, or (3) just using the cwd
     pub active_project: ProjectConfig,
 
-    /// Tracks whether the Windows onboarding screen has been acknowledged.
-    pub windows_wsl_setup_acknowledged: bool,
-
     /// Collection of various notices we show the user
     pub notices: Notice,
 
@@ -840,11 +960,15 @@ pub struct Config {
 pub struct MultiAgentV2Config {
     pub max_concurrent_threads_per_session: usize,
     pub min_wait_timeout_ms: i64,
+    pub max_wait_timeout_ms: i64,
+    pub default_wait_timeout_ms: i64,
     pub usage_hint_enabled: bool,
     pub usage_hint_text: Option<String>,
     pub root_agent_usage_hint_text: Option<String>,
     pub subagent_usage_hint_text: Option<String>,
+    pub tool_namespace: Option<String>,
     pub hide_spawn_agent_metadata: bool,
+    pub non_code_mode_only: bool,
 }
 
 impl Default for MultiAgentV2Config {
@@ -853,11 +977,15 @@ impl Default for MultiAgentV2Config {
             max_concurrent_threads_per_session:
                 DEFAULT_MULTI_AGENT_V2_MAX_CONCURRENT_THREADS_PER_SESSION,
             min_wait_timeout_ms: DEFAULT_MULTI_AGENT_V2_MIN_WAIT_TIMEOUT_MS,
+            max_wait_timeout_ms: DEFAULT_MULTI_AGENT_V2_MAX_WAIT_TIMEOUT_MS,
+            default_wait_timeout_ms: DEFAULT_MULTI_AGENT_V2_DEFAULT_WAIT_TIMEOUT_MS,
             usage_hint_enabled: true,
             usage_hint_text: None,
             root_agent_usage_hint_text: None,
             subagent_usage_hint_text: None,
+            tool_namespace: None,
             hide_spawn_agent_metadata: false,
+            non_code_mode_only: false,
         }
     }
 }
@@ -887,7 +1015,7 @@ impl AuthManagerConfig for Config {
         self.cli_auth_credentials_store_mode
     }
 
-    fn forced_chatgpt_workspace_id(&self) -> Option<String> {
+    fn forced_chatgpt_workspace_id(&self) -> Option<Vec<String>> {
         self.forced_chatgpt_workspace_id.clone()
     }
 
@@ -902,6 +1030,7 @@ pub struct ConfigBuilder {
     cli_overrides: Option<Vec<(String, TomlValue)>>,
     harness_overrides: Option<ConfigOverrides>,
     loader_overrides: Option<LoaderOverrides>,
+    strict_config: bool,
     cloud_requirements: CloudRequirementsLoader,
     thread_config_loader: Option<Arc<dyn ThreadConfigLoader>>,
     fallback_cwd: Option<PathBuf>,
@@ -928,6 +1057,11 @@ impl ConfigBuilder {
         self
     }
 
+    pub fn strict_config(mut self, strict_config: bool) -> Self {
+        self.strict_config = strict_config;
+        self
+    }
+
     pub fn cloud_requirements(mut self, cloud_requirements: CloudRequirementsLoader) -> Self {
         self.cloud_requirements = cloud_requirements;
         self
@@ -957,6 +1091,7 @@ impl ConfigBuilder {
             cli_overrides,
             harness_overrides,
             loader_overrides,
+            strict_config,
             cloud_requirements,
             thread_config_loader,
             fallback_cwd,
@@ -979,7 +1114,10 @@ impl ConfigBuilder {
             &codex_home,
             Some(cwd),
             &cli_overrides,
-            loader_overrides,
+            ConfigLoadOptions {
+                loader_overrides,
+                strict_config,
+            },
             cloud_requirements,
             thread_config_loader
                 .as_deref()
@@ -1071,8 +1209,21 @@ impl Config {
         &mut self,
         sandbox_policy: SandboxPolicy,
     ) -> ConstraintResult<()> {
+        self.workspace_roots_explicit = matches!(
+            &sandbox_policy,
+            SandboxPolicy::WorkspaceWrite { writable_roots, .. } if !writable_roots.is_empty()
+        );
         self.permissions
-            .set_legacy_sandbox_policy(sandbox_policy, self.cwd.as_path())
+            .set_legacy_sandbox_policy(sandbox_policy, self.cwd.as_path())?;
+        self.workspace_roots = self.permissions.workspace_roots().to_vec();
+        Ok(())
+    }
+
+    pub fn effective_workspace_roots(&self) -> Vec<AbsolutePathBuf> {
+        let mut workspace_roots = self.workspace_roots.clone();
+        workspace_roots.extend(self.permissions.profile_workspace_roots().iter().cloned());
+        dedupe_absolute_paths(&mut workspace_roots);
+        workspace_roots
     }
 
     pub fn to_models_manager_config(&self) -> ModelsManagerConfig {
@@ -1105,6 +1256,7 @@ impl Config {
         let plugins_input = self.plugins_config_input();
         let loaded_plugins = plugins_manager.plugins_for_config(&plugins_input).await;
         let mut configured_mcp_servers = self.mcp_servers.get().clone();
+        let mut plugin_ids_by_mcp_server_name = HashMap::new();
         for plugin in loaded_plugins
             .plugins()
             .iter()
@@ -1117,7 +1269,10 @@ impl Config {
                 self.config_layer_stack.requirements().plugins.as_ref(),
             );
             for (name, plugin_server) in plugin_mcp_servers {
-                configured_mcp_servers.entry(name).or_insert(plugin_server);
+                if let Entry::Vacant(entry) = configured_mcp_servers.entry(name.clone()) {
+                    entry.insert(plugin_server);
+                    plugin_ids_by_mcp_server_name.insert(name, plugin.config_name.clone());
+                }
             }
         }
         if let Some(mcp_requirements) = self.config_layer_stack.requirements().mcp_servers.as_ref()
@@ -1127,10 +1282,13 @@ impl Config {
             // above.
             filter_mcp_servers_by_requirements(&mut configured_mcp_servers, Some(mcp_requirements));
         }
+        plugin_ids_by_mcp_server_name
+            .retain(|server_name, _| configured_mcp_servers.contains_key(server_name));
 
         McpConfig {
             chatgpt_base_url: self.chatgpt_base_url.clone(),
             apps_mcp_path_override: self.apps_mcp_path_override.clone(),
+            apps_mcp_product_sku: self.apps_mcp_product_sku.clone(),
             codex_home: self.codex_home.to_path_buf(),
             mcp_oauth_credentials_store_mode: self.mcp_oauth_credentials_store_mode,
             mcp_oauth_callback_port: self.mcp_oauth_callback_port,
@@ -1153,6 +1311,7 @@ impl Config {
                 ElicitationCapability::default()
             },
             configured_mcp_servers,
+            plugin_ids_by_mcp_server_name,
             plugin_capability_summaries: loaded_plugins.capability_summaries().to_vec(),
         }
     }
@@ -1260,7 +1419,6 @@ impl Config {
         )
         .await
     }
-
     /// This is a secondary way of creating [Config], which is appropriate when
     /// the harness is meant to be used with a specific configuration that
     /// ignores user settings. For example, the `codex exec` subcommand is
@@ -1281,6 +1439,16 @@ impl Config {
     }
 }
 
+pub fn resolve_profile_v2_config_path(
+    codex_home: &Path,
+    profile_name: &ProfileV2Name,
+) -> AbsolutePathBuf {
+    AbsolutePathBuf::resolve_path_against_base(
+        format!("{profile_name}{CONFIG_PROFILE_V2_SUFFIX}"),
+        codex_home,
+    )
+}
+
 /// DEPRECATED: Use [Config::load_with_cli_overrides()] instead because working
 /// with [ConfigToml] directly means that [ConfigRequirements] have not been
 /// applied yet, which risks failing to enforce required constraints.
@@ -1288,28 +1456,47 @@ pub async fn load_config_as_toml_with_cli_overrides(
     codex_home: &Path,
     cwd: Option<&AbsolutePathBuf>,
     cli_overrides: Vec<(String, TomlValue)>,
+    loader_overrides: LoaderOverrides,
 ) -> std::io::Result<ConfigToml> {
     load_config_as_toml_with_cli_and_loader_overrides(
         codex_home,
         cwd,
         cli_overrides,
-        LoaderOverrides::default(),
+        loader_overrides,
     )
     .await
 }
 
+/// DEPRECATED for most callers: prefer [Config::load_with_cli_overrides()] or
+/// [ConfigBuilder] because working with [ConfigToml] directly means
+/// [ConfigRequirements] have not been applied yet, which risks skipping
+/// required constraints.
 pub async fn load_config_as_toml_with_cli_and_loader_overrides(
     codex_home: &Path,
     cwd: Option<&AbsolutePathBuf>,
     cli_overrides: Vec<(String, TomlValue)>,
     loader_overrides: LoaderOverrides,
+) -> std::io::Result<ConfigToml> {
+    load_config_as_toml_with_cli_and_load_options(codex_home, cwd, cli_overrides, loader_overrides)
+        .await
+}
+
+/// DEPRECATED for most callers: prefer [Config::load_with_cli_overrides()] or
+/// [ConfigBuilder] because working with [ConfigToml] directly means
+/// [ConfigRequirements] have not been applied yet, which risks skipping
+/// required constraints.
+pub async fn load_config_as_toml_with_cli_and_load_options(
+    codex_home: &Path,
+    cwd: Option<&AbsolutePathBuf>,
+    cli_overrides: Vec<(String, TomlValue)>,
+    options: impl Into<ConfigLoadOptions>,
 ) -> std::io::Result<ConfigToml> {
     let config_layer_stack = load_config_layers_state(
         LOCAL_FS.as_ref(),
         codex_home,
         cwd.cloned(),
         &cli_overrides,
-        loader_overrides,
+        options,
         CloudRequirementsLoader::default(),
         &codex_config::NoopThreadConfigLoader,
     )
@@ -1844,7 +2031,7 @@ fn apply_managed_filesystem_constraints(
                 path: codex_protocol::permissions::FileSystemPath::GlobPattern {
                     pattern: deny_read.as_str().to_string(),
                 },
-                access: codex_protocol::permissions::FileSystemAccessMode::None,
+                access: codex_protocol::permissions::FileSystemAccessMode::Deny,
             }
         } else {
             let Ok(path) = AbsolutePathBuf::try_from(deny_read.as_str()) else {
@@ -1852,7 +2039,7 @@ fn apply_managed_filesystem_constraints(
             };
             codex_protocol::permissions::FileSystemSandboxEntry {
                 path: codex_protocol::permissions::FileSystemPath::Path { path },
-                access: codex_protocol::permissions::FileSystemAccessMode::None,
+                access: codex_protocol::permissions::FileSystemAccessMode::Deny,
             }
         };
         if !file_system_sandbox_policy
@@ -1887,13 +2074,20 @@ pub struct ConfigOverrides {
     pub developer_instructions: Option<String>,
     pub personality: Option<Personality>,
     pub compact_prompt: Option<String>,
-    pub include_apply_patch_tool: Option<bool>,
     pub show_raw_agent_reasoning: Option<bool>,
     pub tools_web_search_request: Option<bool>,
     pub ephemeral: Option<bool>,
     pub bypass_hook_trust: Option<bool>,
     /// Additional directories that should be treated as writable roots for this session.
     pub additional_writable_roots: Vec<PathBuf>,
+    /// Explicit runtime workspace roots for this session. When set, this is
+    /// the full runtime root list rather than an additive override.
+    pub workspace_roots: Option<Vec<PathBuf>>,
+}
+
+fn dedupe_absolute_paths(paths: &mut Vec<AbsolutePathBuf>) {
+    let mut seen = HashSet::new();
+    paths.retain(|path| seen.insert(path.clone()));
 }
 
 /// Resolves the OSS provider from CLI override, profile config, or global config.
@@ -1979,6 +2173,14 @@ fn resolve_multi_agent_v2_config(
         .and_then(|config| config.min_wait_timeout_ms)
         .or_else(|| base.and_then(|config| config.min_wait_timeout_ms))
         .unwrap_or(default.min_wait_timeout_ms);
+    let max_wait_timeout_ms = profile
+        .and_then(|config| config.max_wait_timeout_ms)
+        .or_else(|| base.and_then(|config| config.max_wait_timeout_ms))
+        .unwrap_or(default.max_wait_timeout_ms);
+    let default_wait_timeout_ms = profile
+        .and_then(|config| config.default_wait_timeout_ms)
+        .or_else(|| base.and_then(|config| config.default_wait_timeout_ms))
+        .unwrap_or(default.default_wait_timeout_ms);
     let usage_hint_enabled = profile
         .and_then(|config| config.usage_hint_enabled)
         .or_else(|| base.and_then(|config| config.usage_hint_enabled))
@@ -1998,19 +2200,32 @@ fn resolve_multi_agent_v2_config(
         .or_else(|| base.and_then(|config| config.subagent_usage_hint_text.as_ref()))
         .cloned()
         .or(default.subagent_usage_hint_text);
+    let tool_namespace = profile
+        .and_then(|config| config.tool_namespace.as_ref())
+        .or_else(|| base.and_then(|config| config.tool_namespace.as_ref()))
+        .cloned()
+        .or(default.tool_namespace);
     let hide_spawn_agent_metadata = profile
         .and_then(|config| config.hide_spawn_agent_metadata)
         .or_else(|| base.and_then(|config| config.hide_spawn_agent_metadata))
         .unwrap_or(default.hide_spawn_agent_metadata);
+    let non_code_mode_only = profile
+        .and_then(|config| config.non_code_mode_only)
+        .or_else(|| base.and_then(|config| config.non_code_mode_only))
+        .unwrap_or(default.non_code_mode_only);
 
     MultiAgentV2Config {
         max_concurrent_threads_per_session,
         min_wait_timeout_ms,
+        max_wait_timeout_ms,
+        default_wait_timeout_ms,
         usage_hint_enabled,
         usage_hint_text,
         root_agent_usage_hint_text,
         subagent_usage_hint_text,
+        tool_namespace,
         hide_spawn_agent_metadata,
+        non_code_mode_only,
     }
 }
 
@@ -2087,6 +2302,85 @@ pub(crate) fn resolve_web_search_mode_for_turn(
     WebSearchMode::Disabled
 }
 
+fn validate_multi_agent_v2_wait_timeout(label: &str, value: i64) -> std::io::Result<()> {
+    if value < HARD_MIN_MULTI_AGENT_V2_TIMEOUT_MS {
+        return Err(std::io::Error::new(
+            std::io::ErrorKind::InvalidInput,
+            format!("{label} must be at least {HARD_MIN_MULTI_AGENT_V2_TIMEOUT_MS}"),
+        ));
+    }
+    if value > HARD_MAX_MULTI_AGENT_V2_TIMEOUT_MS {
+        return Err(std::io::Error::new(
+            std::io::ErrorKind::InvalidInput,
+            format!("{label} must be at most {HARD_MAX_MULTI_AGENT_V2_TIMEOUT_MS}"),
+        ));
+    }
+    Ok(())
+}
+
+fn validate_multi_agent_v2_tool_namespace(namespace: Option<&str>) -> std::io::Result<()> {
+    const LABEL: &str = "features.multi_agent_v2.tool_namespace";
+    const MAX_LEN: usize = 64;
+    const RESERVED_RESPONSES_NAMESPACES: &[&str] = &[
+        "api_tool",
+        "browser",
+        "computer",
+        "container",
+        "file_search",
+        "functions",
+        "image_gen",
+        "multi_tool_use",
+        "python",
+        "python_user_visible",
+        "submodel_delegator",
+        "terminal",
+        "tool_search",
+        "web",
+    ];
+
+    let Some(namespace) = namespace else {
+        return Ok(());
+    };
+    if namespace.is_empty() {
+        return Err(std::io::Error::new(
+            std::io::ErrorKind::InvalidInput,
+            format!("{LABEL} must not be empty"),
+        ));
+    }
+    if namespace.trim() != namespace {
+        return Err(std::io::Error::new(
+            std::io::ErrorKind::InvalidInput,
+            format!("{LABEL} must not have leading or trailing whitespace"),
+        ));
+    }
+    if !namespace
+        .bytes()
+        .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'_' | b'-'))
+    {
+        return Err(std::io::Error::new(
+            std::io::ErrorKind::InvalidInput,
+            format!("{LABEL} must match ^[a-zA-Z0-9_-]+$"),
+        ));
+    }
+    if namespace.chars().count() > MAX_LEN {
+        return Err(std::io::Error::new(
+            std::io::ErrorKind::InvalidInput,
+            format!("{LABEL} must be at most {MAX_LEN} characters"),
+        ));
+    }
+    if namespace == "mcp"
+        || namespace.starts_with("mcp__")
+        || RESERVED_RESPONSES_NAMESPACES.contains(&namespace)
+    {
+        return Err(std::io::Error::new(
+            std::io::ErrorKind::InvalidInput,
+            format!("{LABEL} uses a reserved namespace: {namespace}"),
+        ));
+    }
+
+    Ok(())
+}
+
 impl Config {
     #[cfg(test)]
     async fn load_from_base_config_with_overrides(
@@ -2143,8 +2437,10 @@ impl Config {
             guardian_policy_config_source: _,
         } = config_layer_stack.requirements().clone();
 
-        let user_instructions = AgentsMdManager::load_global_instructions(Some(&codex_home))
-            .map(|loaded| loaded.contents);
+        let user_instructions =
+            AgentsMdManager::load_global_instructions(LOCAL_FS.as_ref(), Some(&codex_home))
+                .await
+                .map(|loaded| loaded.contents);
         let mut startup_warnings = config_layer_stack
             .startup_warnings()
             .unwrap_or_default()
@@ -2171,12 +2467,12 @@ impl Config {
             developer_instructions,
             personality,
             compact_prompt,
-            include_apply_patch_tool: include_apply_patch_tool_override,
             show_raw_agent_reasoning,
             tools_web_search_request: override_tools_web_search_request,
             ephemeral,
             bypass_hook_trust,
             additional_writable_roots,
+            workspace_roots: workspace_roots_override,
         } = overrides;
         let bypass_hook_trust = bypass_hook_trust.unwrap_or_default();
 
@@ -2225,22 +2521,16 @@ impl Config {
         };
         let tool_suggest = resolve_tool_suggest_config(&cfg, &config_layer_stack);
         let feature_overrides = FeatureOverrides {
-            include_apply_patch_tool: include_apply_patch_tool_override,
             web_search_request: override_tools_web_search_request,
         };
 
         let configured_features = Features::from_sources(
             FeatureConfigSource {
                 features: cfg.features.as_ref(),
-                include_apply_patch_tool: None,
-                experimental_use_freeform_apply_patch: cfg.experimental_use_freeform_apply_patch,
                 experimental_use_unified_exec_tool: cfg.experimental_use_unified_exec_tool,
             },
             FeatureConfigSource {
                 features: config_profile.features.as_ref(),
-                include_apply_patch_tool: config_profile.include_apply_patch_tool,
-                experimental_use_freeform_apply_patch: config_profile
-                    .experimental_use_freeform_apply_patch,
                 experimental_use_unified_exec_tool: config_profile
                     .experimental_use_unified_exec_tool,
             },
@@ -2273,11 +2563,10 @@ impl Config {
                 }
             }
         }))?;
-        let mut additional_writable_roots: Vec<AbsolutePathBuf> = additional_writable_roots
+        let requested_additional_writable_roots: Vec<AbsolutePathBuf> = additional_writable_roots
             .into_iter()
             .map(|path| AbsolutePathBuf::resolve_path_against_base(path, resolved_cwd.as_path()))
             .collect();
-        let requested_additional_writable_roots = additional_writable_roots.clone();
         let repo_root = resolve_root_git_project_for_trust(fs, &resolved_cwd).await;
         let active_project = cfg
             .get_active_project(
@@ -2319,12 +2608,7 @@ impl Config {
         };
         let memories_root = memory_root(&codex_home);
         std::fs::create_dir_all(&memories_root)?;
-        if !additional_writable_roots
-            .iter()
-            .any(|existing| existing == &memories_root)
-        {
-            additional_writable_roots.push(memories_root);
-        }
+        let internal_writable_roots = vec![memories_root];
 
         let profiles_are_active = default_permissions_override.is_some()
             || matches!(
@@ -2332,13 +2616,59 @@ impl Config {
                 Some(PermissionConfigSyntax::Profiles)
             )
             || permission_config_syntax.is_none();
+        let explicit_permission_profile_mode = default_permissions_override.is_some()
+            || matches!(
+                permission_config_syntax,
+                Some(PermissionConfigSyntax::Profiles)
+            );
+        let custom_permission_profile_ids = cfg
+            .permissions
+            .as_ref()
+            .map_or_else(Vec::new, |permissions| {
+                permissions.entries.keys().cloned().collect()
+            });
         let using_implicit_builtin_profile =
             permission_config_syntax.is_none() && default_permissions.is_none();
+        let should_seed_legacy_workspace_roots = default_permissions.is_none()
+            && matches!(
+                permission_config_syntax,
+                None | Some(PermissionConfigSyntax::Legacy)
+            );
+        let legacy_workspace_roots_explicit = should_seed_legacy_workspace_roots
+            && cfg
+                .sandbox_workspace_write
+                .as_ref()
+                .is_some_and(|sandbox_workspace_write| {
+                    !sandbox_workspace_write.writable_roots.is_empty()
+                });
+        let workspace_roots_explicit = workspace_roots_override.is_some()
+            || !requested_additional_writable_roots.is_empty()
+            || legacy_workspace_roots_explicit;
+        let mut workspace_roots = match workspace_roots_override {
+            Some(workspace_roots) => workspace_roots
+                .into_iter()
+                .map(|path| {
+                    AbsolutePathBuf::resolve_path_against_base(path, resolved_cwd.as_path())
+                })
+                .collect(),
+            None => {
+                let mut workspace_roots = vec![resolved_cwd.clone()];
+                workspace_roots.extend(requested_additional_writable_roots.clone());
+                if should_seed_legacy_workspace_roots
+                    && let Some(sandbox_workspace_write) = cfg.sandbox_workspace_write.as_ref()
+                {
+                    workspace_roots.extend(sandbox_workspace_write.writable_roots.clone());
+                }
+                workspace_roots
+            }
+        };
+        dedupe_absolute_paths(&mut workspace_roots);
         let (
             mut configured_network_proxy_config,
             permission_profile,
             file_system_sandbox_policy,
             mut active_permission_profile,
+            mut profile_workspace_roots,
         ) = if let Some(mut permission_profile) = permission_profile {
             let (mut file_system_sandbox_policy, network_sandbox_policy) =
                 permission_profile.to_runtime_permissions();
@@ -2362,18 +2692,24 @@ impl Config {
                 } else {
                     NetworkProxyConfig::default()
                 };
+            let materialized_file_system_sandbox_policy = file_system_sandbox_policy
+                .clone()
+                .materialize_project_roots_with_workspace_roots(&workspace_roots);
+            let materialized_permission_profile =
+                PermissionProfile::from_runtime_permissions_with_enforcement(
+                    permission_profile.enforcement(),
+                    &materialized_file_system_sandbox_policy,
+                    network_sandbox_policy,
+                );
             let sandbox_policy = compatibility_sandbox_policy_for_permission_profile(
-                &permission_profile,
-                &file_system_sandbox_policy,
+                &materialized_permission_profile,
+                &materialized_file_system_sandbox_policy,
                 network_sandbox_policy,
                 resolved_cwd.as_path(),
             );
             if matches!(sandbox_policy, SandboxPolicy::WorkspaceWrite { .. }) {
                 file_system_sandbox_policy = file_system_sandbox_policy
-                    .with_additional_writable_roots(
-                        resolved_cwd.as_path(),
-                        &additional_writable_roots,
-                    );
+                    .with_additional_legacy_workspace_writable_roots(&internal_writable_roots);
                 permission_profile = PermissionProfile::from_runtime_permissions_with_enforcement(
                     permission_profile.enforcement(),
                     &file_system_sandbox_policy,
@@ -2385,6 +2721,7 @@ impl Config {
                 permission_profile,
                 file_system_sandbox_policy,
                 None,
+                Vec::new(),
             )
         } else if profiles_are_active {
             let default_permissions = default_permissions.unwrap_or_else(|| {
@@ -2407,6 +2744,20 @@ impl Config {
                     resolved_cwd.as_path(),
                     &mut startup_warnings,
                 )?;
+            let mut configured_workspace_roots = compile_permission_profile_workspace_roots(
+                cfg.permissions.as_ref(),
+                default_permissions,
+                resolved_cwd.as_path(),
+            )?;
+            if using_implicit_builtin_profile
+                && default_permissions == BUILT_IN_WORKSPACE_PROFILE
+                && let Some(sandbox_workspace_write) = cfg.sandbox_workspace_write.as_ref()
+            {
+                configured_workspace_roots.extend(sandbox_workspace_write.writable_roots.clone());
+            }
+            dedupe_absolute_paths(&mut configured_workspace_roots);
+            file_system_sandbox_policy = file_system_sandbox_policy
+                .with_materialized_project_roots_for_workspace_roots(&configured_workspace_roots);
             let mut permission_profile = if let Some(permission_profile) =
                 builtin_permission_profile(default_permissions, builtin_workspace_write_settings)
             {
@@ -2417,36 +2768,26 @@ impl Config {
                     network_sandbox_policy,
                 )
             };
+            let materialized_file_system_sandbox_policy = file_system_sandbox_policy
+                .clone()
+                .materialize_project_roots_with_workspace_roots(&workspace_roots);
+            let materialized_permission_profile =
+                PermissionProfile::from_runtime_permissions_with_enforcement(
+                    permission_profile.enforcement(),
+                    &materialized_file_system_sandbox_policy,
+                    network_sandbox_policy,
+                );
             let sandbox_policy = compatibility_sandbox_policy_for_permission_profile(
-                &permission_profile,
-                &file_system_sandbox_policy,
+                &materialized_permission_profile,
+                &materialized_file_system_sandbox_policy,
                 network_sandbox_policy,
                 resolved_cwd.as_path(),
             );
             if matches!(sandbox_policy, SandboxPolicy::WorkspaceWrite { .. }) {
-                file_system_sandbox_policy = if using_implicit_builtin_profile {
-                    file_system_sandbox_policy
-                        .with_additional_legacy_workspace_writable_roots(
-                            &additional_writable_roots,
-                        )
-                } else {
-                    file_system_sandbox_policy.with_additional_writable_roots(
-                        resolved_cwd.as_path(),
-                        &additional_writable_roots,
-                    )
-                };
-                permission_profile = PermissionProfile::from_runtime_permissions(
-                    &file_system_sandbox_policy,
-                    network_sandbox_policy,
-                );
-            } else if matches!(permission_profile, PermissionProfile::Managed { .. })
-                && !requested_additional_writable_roots.is_empty()
-            {
-                file_system_sandbox_policy = file_system_sandbox_policy.with_additional_writable_roots(
-                    resolved_cwd.as_path(),
-                    &requested_additional_writable_roots,
-                );
-                permission_profile = PermissionProfile::from_runtime_permissions(
+                file_system_sandbox_policy = file_system_sandbox_policy
+                    .with_additional_legacy_workspace_writable_roots(&internal_writable_roots);
+                permission_profile = PermissionProfile::from_runtime_permissions_with_enforcement(
+                    permission_profile.enforcement(),
                     &file_system_sandbox_policy,
                     network_sandbox_policy,
                 );
@@ -2462,28 +2803,14 @@ impl Config {
                 // when doing so would lose roots, network, or tmp settings.
                 None
             } else {
-                let active_permission_profile = if !requested_additional_writable_roots.is_empty()
-                    && matches!(permission_profile, PermissionProfile::Managed { .. })
-                {
-                    ActivePermissionProfile::new(default_permissions).with_modifications(
-                        requested_additional_writable_roots
-                            .iter()
-                            .cloned()
-                            .map(|path| {
-                                ActivePermissionProfileModification::AdditionalWritableRoot { path }
-                            })
-                            .collect(),
-                    )
-                } else {
-                    ActivePermissionProfile::new(default_permissions)
-                };
-                Some(active_permission_profile)
+                Some(ActivePermissionProfile::new(default_permissions))
             };
             (
                 configured_network_proxy_config,
                 permission_profile,
                 file_system_sandbox_policy,
                 active_permission_profile,
+                configured_workspace_roots,
             )
         } else {
             let configured_network_proxy_config = NetworkProxyConfig::default();
@@ -2516,25 +2843,21 @@ impl Config {
             }
             let (mut file_system_sandbox_policy, network_sandbox_policy) =
                 permission_profile.to_runtime_permissions();
-            // `additional_writable_roots` is a legacy workspace-write knob. It
-            // only applies when the derived managed profile has workspace-style
-            // write access to the project roots; read-only, disabled, external,
-            // and future non-workspace profiles must not silently grow extra
-            // write access.
+            let materialized_file_system_sandbox_policy = permission_profile
+                .clone()
+                .materialize_project_roots_with_workspace_roots(&workspace_roots)
+                .file_system_sandbox_policy();
             if matches!(permission_profile.enforcement(), SandboxEnforcement::Managed)
-                && file_system_sandbox_policy.can_write_path_with_cwd(
+                && materialized_file_system_sandbox_policy.can_write_path_with_cwd(
                     resolved_cwd.as_path(),
                     resolved_cwd.as_path(),
                 )
-                && !file_system_sandbox_policy.has_full_disk_write_access()
+                && !materialized_file_system_sandbox_policy.has_full_disk_write_access()
             {
-                // Keep legacy behavior for extra writable roots while storing
-                // the result as the canonical permission profile. Explicit
-                // extra roots are concrete paths, so their metadata carveouts
-                // are also concrete rather than symbolic `:project_roots`
-                // entries.
+                // Keep Codex runtime write access while storing the runtime
+                // workspace roots separately on the thread.
                 file_system_sandbox_policy = file_system_sandbox_policy
-                    .with_additional_legacy_workspace_writable_roots(&additional_writable_roots);
+                    .with_additional_legacy_workspace_writable_roots(&internal_writable_roots);
                 permission_profile = PermissionProfile::from_runtime_permissions_with_enforcement(
                     permission_profile.enforcement(),
                     &file_system_sandbox_policy,
@@ -2546,6 +2869,7 @@ impl Config {
                 permission_profile,
                 file_system_sandbox_policy,
                 None,
+                Vec::new(),
             )
         };
         if enable_network_proxy && permission_profile.network_sandbox_policy().is_enabled() {
@@ -2615,6 +2939,7 @@ impl Config {
                 .and_then(|config| config.path.as_ref())
                 .or_else(|| base.and_then(|config| config.path.as_ref()))
                 .cloned()
+                .or_else(|| Some("/ps/mcp".to_string()))
         } else {
             None
         };
@@ -2660,20 +2985,37 @@ impl Config {
                 "features.multi_agent_v2.max_concurrent_threads_per_session must be at least 1",
             ));
         }
-        if multi_agent_v2.min_wait_timeout_ms <= 0 {
+        validate_multi_agent_v2_wait_timeout(
+            "features.multi_agent_v2.min_wait_timeout_ms",
+            multi_agent_v2.min_wait_timeout_ms,
+        )?;
+        validate_multi_agent_v2_wait_timeout(
+            "features.multi_agent_v2.max_wait_timeout_ms",
+            multi_agent_v2.max_wait_timeout_ms,
+        )?;
+        validate_multi_agent_v2_wait_timeout(
+            "features.multi_agent_v2.default_wait_timeout_ms",
+            multi_agent_v2.default_wait_timeout_ms,
+        )?;
+        if multi_agent_v2.min_wait_timeout_ms > multi_agent_v2.max_wait_timeout_ms {
             return Err(std::io::Error::new(
                 std::io::ErrorKind::InvalidInput,
-                "features.multi_agent_v2.min_wait_timeout_ms must be at least 1",
+                "features.multi_agent_v2.min_wait_timeout_ms must be at most features.multi_agent_v2.max_wait_timeout_ms",
             ));
         }
-        if multi_agent_v2.min_wait_timeout_ms > MAX_MULTI_AGENT_V2_WAIT_TIMEOUT_MS {
+        if multi_agent_v2.default_wait_timeout_ms < multi_agent_v2.min_wait_timeout_ms {
             return Err(std::io::Error::new(
                 std::io::ErrorKind::InvalidInput,
-                format!(
-                    "features.multi_agent_v2.min_wait_timeout_ms must be at most {MAX_MULTI_AGENT_V2_WAIT_TIMEOUT_MS}"
-                ),
+                "features.multi_agent_v2.default_wait_timeout_ms must be at least features.multi_agent_v2.min_wait_timeout_ms",
             ));
         }
+        if multi_agent_v2.default_wait_timeout_ms > multi_agent_v2.max_wait_timeout_ms {
+            return Err(std::io::Error::new(
+                std::io::ErrorKind::InvalidInput,
+                "features.multi_agent_v2.default_wait_timeout_ms must be at most features.multi_agent_v2.max_wait_timeout_ms",
+            ));
+        }
+        validate_multi_agent_v2_tool_namespace(multi_agent_v2.tool_namespace.as_deref())?;
         let agent_max_threads_from_config = cfg.agents.as_ref().and_then(|agents| agents.max_threads);
         let agent_max_threads = if features.enabled(Feature::MultiAgentV2) {
             if agent_max_threads_from_config.is_some() {
@@ -2762,18 +3104,20 @@ impl Config {
             config
         };
 
-        let include_apply_patch_tool_flag = features.enabled(Feature::ApplyPatchFreeform);
         let use_experimental_unified_exec_tool = features.enabled(Feature::UnifiedExec);
 
-        let forced_chatgpt_workspace_id =
-            cfg.forced_chatgpt_workspace_id.as_ref().and_then(|value| {
-                let trimmed = value.trim();
-                if trimmed.is_empty() {
-                    None
-                } else {
-                    Some(trimmed.to_string())
-                }
-            });
+        let forced_chatgpt_workspace_id = cfg
+            .forced_chatgpt_workspace_id
+            .clone()
+            .map(codex_config::config_toml::ForcedChatgptWorkspaceIds::into_vec)
+            .map(|values| {
+                values
+                    .into_iter()
+                    .map(|value| value.trim().to_string())
+                    .filter(|value| !value.is_empty())
+                    .collect::<Vec<_>>()
+            })
+            .filter(|values| !values.is_empty());
 
         let forced_login_method = cfg.forced_login_method;
 
@@ -2808,8 +3152,6 @@ impl Config {
             }
         });
 
-        let commit_attribution = cfg.commit_attribution;
-
         // Load base instructions override from a file if specified. If the
         // path is relative, resolve it against the effective cwd so the
         // behaviour matches other path-like config values.
@@ -2952,6 +3294,7 @@ impl Config {
             // The selected profile no longer describes the effective
             // permissions after requirements forced a fallback.
             active_permission_profile = None;
+            profile_workspace_roots.clear();
         }
         apply_requirement_constrained_value(
             "web_search_mode",
@@ -3022,6 +3365,12 @@ impl Config {
             .value
             .set(effective_permission_profile)
             .map_err(std::io::Error::from)?;
+        let permission_profile_state = PermissionProfileState::from_constrained_active_profile(
+            constrained_permission_profile.value,
+            active_permission_profile,
+            profile_workspace_roots,
+        )
+        .map_err(std::io::Error::from)?;
         let otel = otel::resolve_config(cfg.otel.unwrap_or_default(), &mut startup_warnings);
         let config = Self {
             model,
@@ -3029,20 +3378,27 @@ impl Config {
             review_model,
             model_context_window: cfg.model_context_window,
             model_auto_compact_token_limit: cfg.model_auto_compact_token_limit,
+            model_auto_compact_token_limit_scope: cfg
+                .model_auto_compact_token_limit_scope
+                .unwrap_or_default(),
             model_provider_id,
             model_provider,
             cwd: resolved_cwd,
+            workspace_roots: workspace_roots.clone(),
+            workspace_roots_explicit,
             startup_warnings,
             permissions: Permissions {
                 approval_policy: constrained_approval_policy.value,
-                permission_profile: constrained_permission_profile.value,
-                active_permission_profile,
+                permission_profile_state,
+                workspace_roots,
                 network,
                 allow_login_shell,
                 shell_environment_policy,
                 windows_sandbox_mode,
                 windows_sandbox_private_desktop,
             },
+            explicit_permission_profile_mode,
+            custom_permission_profile_ids,
             approvals_reviewer: constrained_approvals_reviewer.value(),
             enforce_residency: enforce_residency.value,
             notify: cfg.notify,
@@ -3051,7 +3407,6 @@ impl Config {
             personality,
             developer_instructions,
             compact_prompt,
-            commit_attribution,
             include_permissions_instructions,
             include_apps_instructions,
             include_collaboration_mode_instructions,
@@ -3148,6 +3503,7 @@ impl Config {
                 .or(cfg.chatgpt_base_url)
                 .unwrap_or("https://chatgpt.com/backend-api/".to_string()),
             apps_mcp_path_override,
+            apps_mcp_product_sku: cfg.apps_mcp_product_sku.clone(),
             realtime_audio: cfg
                 .audio
                 .map_or_else(RealtimeAudioConfig::default, |audio| RealtimeAudioConfig {
@@ -3174,7 +3530,6 @@ impl Config {
             experimental_thread_store: thread_store_config(cfg.experimental_thread_store),
             forced_chatgpt_workspace_id,
             forced_login_method,
-            include_apply_patch_tool: include_apply_patch_tool_flag,
             web_search_mode: constrained_web_search_mode.value,
             web_search_config,
             use_experimental_unified_exec_tool,
@@ -3187,7 +3542,6 @@ impl Config {
                 .unwrap_or(false),
             active_profile: active_profile_name,
             active_project,
-            windows_wsl_setup_acknowledged: cfg.windows_wsl_setup_acknowledged.unwrap_or(false),
             notices,
             check_for_update_on_startup,
             disable_paste_burst: cfg.disable_paste_burst.unwrap_or(false),
@@ -3323,7 +3677,7 @@ impl Config {
 
     pub fn managed_network_requirements_enabled(&self) -> bool {
         !matches!(
-            self.permissions.permission_profile.get(),
+            self.permissions.permission_profile(),
             PermissionProfile::Disabled
         ) && self
             .config_layer_stack
@@ -3337,13 +3691,6 @@ impl Config {
     }
 }
 
-pub(crate) fn uses_deprecated_instructions_file(config_layer_stack: &ConfigLayerStack) -> bool {
-    config_layer_stack
-        .layers_high_to_low()
-        .into_iter()
-        .any(|layer| toml_uses_deprecated_instructions_file(&layer.config))
-}
-
 fn guardian_policy_config_from_requirements(
     requirements_toml: &ConfigRequirementsToml,
 ) -> Option<String> {
@@ -3357,23 +3704,6 @@ fn normalize_guardian_policy_config(value: Option<&str>) -> Option<String> {
     })
 }
 
-fn toml_uses_deprecated_instructions_file(value: &TomlValue) -> bool {
-    let Some(table) = value.as_table() else {
-        return false;
-    };
-    if table.contains_key("experimental_instructions_file") {
-        return true;
-    }
-    let Some(profiles) = table.get("profiles").and_then(TomlValue::as_table) else {
-        return false;
-    };
-    profiles.values().any(|profile| {
-        profile.as_table().is_some_and(|profile_table| {
-            profile_table.contains_key("experimental_instructions_file")
-        })
-    })
-}
-
 /// Returns the path to the Codex configuration directory, which can be
 /// specified by the `CODEX_HOME` environment variable. If not set, defaults to
 /// `~/.codex`.
diff --git a/codex-rs/core/src/config/network_proxy_spec_tests.rs b/codex-rs/core/src/config/network_proxy_spec_tests.rs
index 14b7c1c330..6dfb1e3a25 100644
--- a/codex-rs/core/src/config/network_proxy_spec_tests.rs
+++ b/codex-rs/core/src/config/network_proxy_spec_tests.rs
@@ -5,13 +5,8 @@ use codex_network_proxy::NetworkDomainPermission;
 use codex_protocol::models::ManagedFileSystemPermissions;
 use codex_protocol::models::PermissionProfile;
 use codex_protocol::permissions::NetworkSandboxPolicy;
-use codex_protocol::protocol::SandboxPolicy;
 use pretty_assertions::assert_eq;
 
-fn permission_profile_for_sandbox_policy(sandbox_policy: &SandboxPolicy) -> PermissionProfile {
-    PermissionProfile::from_legacy_sandbox_policy(sandbox_policy)
-}
-
 fn domain_permissions(
     entries: impl IntoIterator<Item = (&'static str, NetworkDomainPermissionToml)>,
 ) -> NetworkDomainPermissionsToml {
@@ -62,7 +57,7 @@ fn requirements_allowed_domains_are_a_baseline_for_user_allowlist() {
     let spec = NetworkProxySpec::from_config_and_constraints(
         config,
         Some(requirements),
-        &permission_profile_for_sandbox_policy(&SandboxPolicy::new_read_only_policy()),
+        &PermissionProfile::read_only(),
     )
     .expect("config should stay within the managed allowlist");
 
@@ -97,7 +92,7 @@ fn requirements_allowed_domains_do_not_override_user_denies_for_same_pattern() {
     let spec = NetworkProxySpec::from_config_and_constraints(
         config,
         Some(requirements),
-        &permission_profile_for_sandbox_policy(&SandboxPolicy::new_workspace_write_policy()),
+        &PermissionProfile::workspace_write(),
     )
     .expect("managed allowlist should not erase a user deny");
 
@@ -129,7 +124,7 @@ fn requirements_allowlist_expansion_keeps_user_entries_mutable() {
     let spec = NetworkProxySpec::from_config_and_constraints(
         config,
         Some(requirements),
-        &permission_profile_for_sandbox_policy(&SandboxPolicy::new_workspace_write_policy()),
+        &PermissionProfile::workspace_write(),
     )
     .expect("managed baseline should still allow user edits");
 
@@ -207,7 +202,7 @@ fn danger_full_access_keeps_managed_allowlist_and_denylist_fixed() {
     let spec = NetworkProxySpec::from_config_and_constraints(
         config,
         Some(requirements),
-        &permission_profile_for_sandbox_policy(&SandboxPolicy::DangerFullAccess),
+        &PermissionProfile::Disabled,
     )
     .expect("yolo mode should pin the effective policy to the managed baseline");
 
@@ -241,7 +236,7 @@ fn managed_allowed_domains_only_disables_default_mode_allowlist_expansion() {
     let spec = NetworkProxySpec::from_config_and_constraints(
         config,
         Some(requirements),
-        &permission_profile_for_sandbox_policy(&SandboxPolicy::new_workspace_write_policy()),
+        &PermissionProfile::workspace_write(),
     )
     .expect("managed baseline should still load");
 
@@ -270,7 +265,7 @@ fn managed_allowed_domains_only_ignores_user_allowlist_and_hard_denies_misses()
     let spec = NetworkProxySpec::from_config_and_constraints(
         config,
         Some(requirements),
-        &permission_profile_for_sandbox_policy(&SandboxPolicy::new_workspace_write_policy()),
+        &PermissionProfile::workspace_write(),
     )
     .expect("managed-only allowlist should still load");
 
@@ -300,7 +295,7 @@ fn managed_allowed_domains_only_without_managed_allowlist_blocks_all_user_domain
     let spec = NetworkProxySpec::from_config_and_constraints(
         config,
         Some(requirements),
-        &permission_profile_for_sandbox_policy(&SandboxPolicy::new_workspace_write_policy()),
+        &PermissionProfile::workspace_write(),
     )
     .expect("managed-only mode should treat missing managed allowlist as empty");
 
@@ -324,7 +319,7 @@ fn managed_allowed_domains_only_blocks_all_user_domains_in_full_access_without_m
     let spec = NetworkProxySpec::from_config_and_constraints(
         config,
         Some(requirements),
-        &permission_profile_for_sandbox_policy(&SandboxPolicy::DangerFullAccess),
+        &PermissionProfile::Disabled,
     )
     .expect("managed-only mode should treat missing managed allowlist as empty");
 
@@ -351,7 +346,7 @@ fn deny_only_requirements_do_not_create_allow_constraints_in_full_access() {
     let spec = NetworkProxySpec::from_config_and_constraints(
         config,
         Some(requirements),
-        &permission_profile_for_sandbox_policy(&SandboxPolicy::DangerFullAccess),
+        &PermissionProfile::Disabled,
     )
     .expect("deny-only requirements should not constrain the allowlist");
 
@@ -384,7 +379,7 @@ fn allow_only_requirements_do_not_create_deny_constraints_in_full_access() {
     let spec = NetworkProxySpec::from_config_and_constraints(
         config,
         Some(requirements),
-        &permission_profile_for_sandbox_policy(&SandboxPolicy::DangerFullAccess),
+        &PermissionProfile::Disabled,
     )
     .expect("allow-only requirements should not constrain the denylist");
 
@@ -417,7 +412,7 @@ fn requirements_denied_domains_are_a_baseline_for_default_mode() {
     let spec = NetworkProxySpec::from_config_and_constraints(
         config,
         Some(requirements),
-        &permission_profile_for_sandbox_policy(&SandboxPolicy::new_workspace_write_policy()),
+        &PermissionProfile::workspace_write(),
     )
     .expect("default mode should merge managed and user deny entries");
 
@@ -452,7 +447,7 @@ fn requirements_denylist_expansion_keeps_user_entries_mutable() {
     let spec = NetworkProxySpec::from_config_and_constraints(
         config,
         Some(requirements),
-        &permission_profile_for_sandbox_policy(&SandboxPolicy::new_workspace_write_policy()),
+        &PermissionProfile::workspace_write(),
     )
     .expect("managed baseline should still allow user edits");
 
diff --git a/codex-rs/core/src/config/permissions.rs b/codex-rs/core/src/config/permissions.rs
index 6b6021ad34..4235cd0f65 100644
--- a/codex-rs/core/src/config/permissions.rs
+++ b/codex-rs/core/src/config/permissions.rs
@@ -13,6 +13,7 @@ use codex_config::permissions_toml::NetworkUnixSocketPermissionToml;
 use codex_config::permissions_toml::NetworkUnixSocketPermissionsToml;
 use codex_config::permissions_toml::PermissionProfileToml;
 use codex_config::permissions_toml::PermissionsToml;
+use codex_config::permissions_toml::WorkspaceRootsToml;
 use codex_config::types::SandboxWorkspaceWrite;
 use codex_features::NetworkProxyConfigToml;
 use codex_features::NetworkProxyDomainPermissionToml;
@@ -23,6 +24,9 @@ use codex_network_proxy::NetworkProxyConfig;
 #[cfg(test)]
 use codex_network_proxy::NetworkUnixSocketPermission as ProxyNetworkUnixSocketPermission;
 use codex_protocol::config_types::WindowsSandboxLevel;
+use codex_protocol::models::BUILT_IN_PERMISSION_PROFILE_DANGER_FULL_ACCESS;
+use codex_protocol::models::BUILT_IN_PERMISSION_PROFILE_READ_ONLY;
+use codex_protocol::models::BUILT_IN_PERMISSION_PROFILE_WORKSPACE;
 use codex_protocol::models::PermissionProfile;
 use codex_protocol::permissions::FileSystemAccessMode;
 use codex_protocol::permissions::FileSystemPath;
@@ -30,13 +34,15 @@ use codex_protocol::permissions::FileSystemSandboxEntry;
 use codex_protocol::permissions::FileSystemSandboxPolicy;
 use codex_protocol::permissions::FileSystemSpecialPath;
 use codex_protocol::permissions::NetworkSandboxPolicy;
+use codex_protocol::permissions::project_roots_glob_pattern;
 use codex_utils_absolute_path::AbsolutePathBuf;
 
 use super::ProjectConfig;
 
-pub(crate) const BUILT_IN_READ_ONLY_PROFILE: &str = ":read-only";
-pub(crate) const BUILT_IN_WORKSPACE_PROFILE: &str = ":workspace";
-pub(crate) const BUILT_IN_DANGER_NO_SANDBOX_PROFILE: &str = ":danger-no-sandbox";
+pub(crate) const BUILT_IN_READ_ONLY_PROFILE: &str = BUILT_IN_PERMISSION_PROFILE_READ_ONLY;
+pub(crate) const BUILT_IN_WORKSPACE_PROFILE: &str = BUILT_IN_PERMISSION_PROFILE_WORKSPACE;
+pub(crate) const BUILT_IN_DANGER_FULL_ACCESS_PROFILE: &str =
+    BUILT_IN_PERMISSION_PROFILE_DANGER_FULL_ACCESS;
 
 pub(crate) fn default_builtin_permission_profile_name(
     active_project: &ProjectConfig,
@@ -56,7 +62,7 @@ pub(crate) fn is_builtin_permission_profile_name(profile_name: &str) -> bool {
         profile_name,
         BUILT_IN_READ_ONLY_PROFILE
             | BUILT_IN_WORKSPACE_PROFILE
-            | BUILT_IN_DANGER_NO_SANDBOX_PROFILE
+            | BUILT_IN_DANGER_FULL_ACCESS_PROFILE
     )
 }
 
@@ -68,12 +74,12 @@ pub(crate) fn builtin_permission_profile(
         BUILT_IN_READ_ONLY_PROFILE => Some(PermissionProfile::read_only()),
         BUILT_IN_WORKSPACE_PROFILE => Some(match workspace_write {
             Some(SandboxWorkspaceWrite {
-                writable_roots,
+                writable_roots: _,
                 network_access,
                 exclude_tmpdir_env_var,
                 exclude_slash_tmp,
             }) => PermissionProfile::workspace_write_with(
-                writable_roots,
+                &[],
                 if *network_access {
                     NetworkSandboxPolicy::Enabled
                 } else {
@@ -84,7 +90,7 @@ pub(crate) fn builtin_permission_profile(
             ),
             None => PermissionProfile::workspace_write(),
         }),
-        BUILT_IN_DANGER_NO_SANDBOX_PROFILE => Some(PermissionProfile::Disabled),
+        BUILT_IN_DANGER_FULL_ACCESS_PROFILE => Some(PermissionProfile::Disabled),
         _ => None,
     }
 }
@@ -237,7 +243,7 @@ pub(crate) fn compile_permission_profile(
                     push_warning(
                         startup_warnings,
                         format!(
-                            "Filesystem glob `{pattern}` uses `read` or `write` access, which is not fully supported by this platform's sandboxing. Use an exact path or trailing `/**` subtree rule instead. `none` deny-read globs are supported."
+                            "Filesystem glob `{pattern}` uses `read` or `write` access, which is not fully supported by this platform's sandboxing. Use an exact path or trailing `/**` subtree rule instead. `deny` globs are supported."
                         ),
                     );
                 }
@@ -299,6 +305,41 @@ pub(crate) fn compile_permission_profile_selection(
     compile_permission_profile(permissions, profile_name, policy_cwd, startup_warnings)
 }
 
+pub(crate) fn compile_permission_profile_workspace_roots(
+    permissions: Option<&PermissionsToml>,
+    profile_name: &str,
+    policy_cwd: &Path,
+) -> io::Result<Vec<AbsolutePathBuf>> {
+    if is_builtin_permission_profile_name(profile_name) {
+        return Ok(Vec::new());
+    }
+    reject_unknown_builtin_permission_profile(profile_name)?;
+
+    let permissions = permissions.ok_or_else(|| {
+        io::Error::new(
+            io::ErrorKind::InvalidInput,
+            "default_permissions requires a `[permissions]` table",
+        )
+    })?;
+    let profile = resolve_permission_profile(permissions, profile_name)?;
+    Ok(compile_workspace_roots(
+        profile.workspace_roots.as_ref(),
+        policy_cwd,
+    ))
+}
+
+fn compile_workspace_roots(
+    workspace_roots: Option<&WorkspaceRootsToml>,
+    policy_cwd: &Path,
+) -> Vec<AbsolutePathBuf> {
+    workspace_roots.map_or_else(Vec::new, |workspace_roots| {
+        workspace_roots
+            .enabled_roots()
+            .map(|path| AbsolutePathBuf::resolve_path_against_base(path, policy_cwd))
+            .collect()
+    })
+}
+
 fn reject_unknown_builtin_permission_profile(profile_name: &str) -> io::Result<()> {
     if profile_name.starts_with(':') {
         return Err(io::Error::new(
@@ -373,7 +414,7 @@ fn compile_filesystem_permission(
                     Some(FileSystemSpecialPath::ProjectRoots { .. }) | None => true,
                     Some(_) => false,
                 };
-                if has_glob && *access == FileSystemAccessMode::None && can_compile_as_pattern {
+                if has_glob && *access == FileSystemAccessMode::Deny && can_compile_as_pattern {
                     // Scoped glob syntax is a first-class filesystem policy
                     // pattern entry. Literal scoped paths continue through the
                     // exact-path parser so existing path semantics stay intact.
@@ -408,7 +449,7 @@ fn compile_filesystem_access_path(
         return compile_filesystem_path(path, startup_warnings);
     }
 
-    if access == FileSystemAccessMode::None {
+    if access == FileSystemAccessMode::Deny {
         // At this point `path` is an unscoped filesystem table key. Top-level
         // glob deny entries still go through the absolute-path parser before
         // becoming policy patterns; relative project-root glob syntax is
@@ -474,30 +515,25 @@ fn compile_scoped_filesystem_pattern(
     path: &str,
     subpath: &str,
     access: FileSystemAccessMode,
-    policy_cwd: &Path,
+    _policy_cwd: &Path,
 ) -> io::Result<String> {
     // Pattern entries currently mean deny-read only. Supporting broader access
     // modes here would imply glob-based read/write allow semantics that the
     // sandbox policy does not express yet.
-    if access != FileSystemAccessMode::None {
+    if access != FileSystemAccessMode::Deny {
         return Err(io::Error::new(
             io::ErrorKind::InvalidInput,
-            format!("filesystem glob subpath `{subpath}` only supports `none` access"),
+            format!("filesystem glob subpath `{subpath}` only supports `deny` access"),
         ));
     }
     let subpath = parse_relative_subpath(subpath)?;
 
     match parse_special_path(path) {
         Some(FileSystemSpecialPath::ProjectRoots { .. }) => {
-            // `:project_roots` is represented as a special path, but current
-            // filesystem-policy resolution defines it relative to the session
-            // cwd. Use the same policy cwd here so glob entries and exact
-            // scoped entries resolve consistently.
-            Ok(
-                AbsolutePathBuf::resolve_path_against_base(&subpath, policy_cwd)
-                    .to_string_lossy()
-                    .to_string(),
-            )
+            // Keep `:workspace_roots` glob patterns symbolic until the active
+            // workspace roots are known, then materialize them for cwd and any
+            // runtime/profile-added workspace roots together.
+            Ok(project_roots_glob_pattern(&subpath))
         }
         Some(_) => Err(io::Error::new(
             io::ErrorKind::InvalidInput,
@@ -523,7 +559,7 @@ fn compile_read_write_glob_path(path: &str, access: FileSystemAccessMode) -> io:
     Err(io::Error::new(
         io::ErrorKind::InvalidInput,
         format!(
-            "filesystem glob path `{path}` only supports `none` access; use an exact path or trailing `/**` for `{access}` subtree access"
+            "filesystem glob path `{path}` only supports `deny` access; use an exact path or trailing `/**` for `{access}` subtree access"
         ),
     ))
 }
@@ -533,7 +569,7 @@ fn unsupported_read_write_glob_paths(filesystem: &FilesystemPermissionsToml) ->
     for (path, permission) in &filesystem.entries {
         match permission {
             FilesystemPermissionToml::Access(access) => {
-                if *access != FileSystemAccessMode::None
+                if *access != FileSystemAccessMode::Deny
                     && contains_glob_chars(remove_trailing_glob_suffix(path))
                 {
                     patterns.push(path.clone());
@@ -541,7 +577,7 @@ fn unsupported_read_write_glob_paths(filesystem: &FilesystemPermissionsToml) ->
             }
             FilesystemPermissionToml::Scoped(scoped_entries) => {
                 for (subpath, access) in scoped_entries {
-                    if *access != FileSystemAccessMode::None
+                    if *access != FileSystemAccessMode::Deny
                         && contains_glob_chars(remove_trailing_glob_suffix(subpath))
                     {
                         patterns.push(format!("{path}/{subpath}"));
@@ -561,7 +597,7 @@ fn unbounded_unreadable_globstar_paths(filesystem: &FilesystemPermissionsToml) -
     let mut patterns = Vec::new();
     for (path, permission) in &filesystem.entries {
         match permission {
-            FilesystemPermissionToml::Access(FileSystemAccessMode::None) => {
+            FilesystemPermissionToml::Access(FileSystemAccessMode::Deny) => {
                 if path.contains("**") {
                     patterns.push(path.clone());
                 }
@@ -569,7 +605,7 @@ fn unbounded_unreadable_globstar_paths(filesystem: &FilesystemPermissionsToml) -
             FilesystemPermissionToml::Access(_) => {}
             FilesystemPermissionToml::Scoped(scoped_entries) => {
                 for (subpath, access) in scoped_entries {
-                    if *access == FileSystemAccessMode::None && subpath.contains("**") {
+                    if *access == FileSystemAccessMode::Deny && subpath.contains("**") {
                         patterns.push(format!("{path}/{subpath}"));
                     }
                 }
@@ -616,7 +652,7 @@ fn parse_special_path(path: &str) -> Option<FileSystemSpecialPath> {
     match path {
         ":root" => Some(FileSystemSpecialPath::Root),
         ":minimal" => Some(FileSystemSpecialPath::Minimal),
-        ":project_roots" => Some(FileSystemSpecialPath::project_roots(/*subpath*/ None)),
+        ":workspace_roots" => Some(FileSystemSpecialPath::project_roots(/*subpath*/ None)),
         ":tmpdir" => Some(FileSystemSpecialPath::Tmpdir),
         _ if path.starts_with(':') => {
             Some(FileSystemSpecialPath::unknown(path, /*subpath*/ None))
diff --git a/codex-rs/core/src/config/permissions_tests.rs b/codex-rs/core/src/config/permissions_tests.rs
index 6ae9307f02..d6f358017e 100644
--- a/codex-rs/core/src/config/permissions_tests.rs
+++ b/codex-rs/core/src/config/permissions_tests.rs
@@ -11,6 +11,7 @@ use codex_config::permissions_toml::NetworkUnixSocketPermissionToml;
 use codex_config::permissions_toml::NetworkUnixSocketPermissionsToml;
 use codex_config::permissions_toml::PermissionProfileToml;
 use codex_config::permissions_toml::PermissionsToml;
+use codex_config::permissions_toml::WorkspaceRootsToml;
 use codex_protocol::permissions::FileSystemAccessMode;
 use codex_protocol::permissions::FileSystemPath;
 use codex_protocol::permissions::FileSystemSandboxEntry;
@@ -66,6 +67,7 @@ async fn restricted_read_implicitly_allows_helper_executables() -> std::io::Resu
                 entries: BTreeMap::from([(
                     "workspace".to_string(),
                     PermissionProfileToml {
+                        workspace_roots: None,
                         filesystem: Some(FilesystemPermissionsToml {
                             glob_scan_max_depth: None,
                             entries: BTreeMap::new(),
@@ -275,6 +277,39 @@ fn profile_network_proxy_config_keeps_proxy_disabled_for_proxy_policy() {
     );
 }
 
+#[test]
+fn compile_permission_profile_workspace_roots_resolves_enabled_entries() -> std::io::Result<()> {
+    let cwd = TempDir::new()?;
+    let workspace_roots = compile_permission_profile_workspace_roots(
+        Some(&PermissionsToml {
+            entries: BTreeMap::from([(
+                "workspace".to_string(),
+                PermissionProfileToml {
+                    workspace_roots: Some(WorkspaceRootsToml {
+                        entries: BTreeMap::from([
+                            ("backend".to_string(), true),
+                            ("disabled".to_string(), false),
+                        ]),
+                    }),
+                    filesystem: None,
+                    network: None,
+                },
+            )]),
+        }),
+        "workspace",
+        cwd.path(),
+    )?;
+
+    assert_eq!(
+        workspace_roots,
+        vec![AbsolutePathBuf::resolve_path_against_base(
+            "backend",
+            cwd.path()
+        )]
+    );
+    Ok(())
+}
+
 #[test]
 fn read_write_glob_warnings_skip_supported_deny_read_globs_and_trailing_subpaths() {
     let filesystem = FilesystemPermissionsToml {
@@ -289,9 +324,9 @@ fn read_write_glob_warnings_skip_supported_deny_read_globs_and_trailing_subpaths
                 FilesystemPermissionToml::Access(FileSystemAccessMode::Write),
             ),
             (
-                ":project_roots".to_string(),
+                ":workspace_roots".to_string(),
                 FilesystemPermissionToml::Scoped(BTreeMap::from([
-                    ("**/*.env".to_string(), FileSystemAccessMode::None),
+                    ("**/*.env".to_string(), FileSystemAccessMode::Deny),
                     ("docs/**".to_string(), FileSystemAccessMode::Read),
                     ("src/**/*.rs".to_string(), FileSystemAccessMode::Write),
                 ])),
@@ -303,9 +338,9 @@ fn read_write_glob_warnings_skip_supported_deny_read_globs_and_trailing_subpaths
         unsupported_read_write_glob_paths(&filesystem),
         vec![
             "/tmp/**/*.log".to_string(),
-            ":project_roots/src/**/*.rs".to_string()
+            ":workspace_roots/src/**/*.rs".to_string()
         ],
-        "`none` glob patterns are supported as deny-read rules; only `read`/`write` globs should warn"
+        "`deny` glob patterns are supported as deny-read rules; only `read`/`write` globs should warn"
     );
 }
 
@@ -314,17 +349,17 @@ fn unreadable_globstar_warning_is_suppressed_when_scan_depth_is_configured() {
     let filesystem = FilesystemPermissionsToml {
         glob_scan_max_depth: None,
         entries: BTreeMap::from([(
-            ":project_roots".to_string(),
+            ":workspace_roots".to_string(),
             FilesystemPermissionToml::Scoped(BTreeMap::from([
-                ("**/*.env".to_string(), FileSystemAccessMode::None),
-                ("*.pem".to_string(), FileSystemAccessMode::None),
+                ("**/*.env".to_string(), FileSystemAccessMode::Deny),
+                ("*.pem".to_string(), FileSystemAccessMode::Deny),
             ])),
         )]),
     };
 
     assert_eq!(
         unbounded_unreadable_globstar_paths(&filesystem),
-        vec![":project_roots/**/*.env".to_string()]
+        vec![":workspace_roots/**/*.env".to_string()]
     );
 
     let configured_filesystem = FilesystemPermissionsToml {
@@ -359,10 +394,11 @@ fn read_write_trailing_glob_suffix_compiles_as_subpath() -> std::io::Result<()>
             entries: BTreeMap::from([(
                 "workspace".to_string(),
                 PermissionProfileToml {
+                    workspace_roots: None,
                     filesystem: Some(FilesystemPermissionsToml {
                         glob_scan_max_depth: None,
                         entries: BTreeMap::from([(
-                            ":project_roots".to_string(),
+                            ":workspace_roots".to_string(),
                             FilesystemPermissionToml::Scoped(BTreeMap::from([(
                                 "docs/**".to_string(),
                                 FileSystemAccessMode::Read,
@@ -399,7 +435,7 @@ fn read_write_glob_patterns_still_reject_non_subpath_globs() {
     assert_eq!(err.kind(), std::io::ErrorKind::InvalidInput);
     assert!(
         err.to_string()
-            .contains("filesystem glob path `src/**/*.rs` only supports `none` access"),
+            .contains("filesystem glob path `src/**/*.rs` only supports `deny` access"),
         "{err}"
     );
 }
diff --git a/codex-rs/core/src/config/resolved_permission_profile.rs b/codex-rs/core/src/config/resolved_permission_profile.rs
new file mode 100644
index 0000000000..f0fff66bcc
--- /dev/null
+++ b/codex-rs/core/src/config/resolved_permission_profile.rs
@@ -0,0 +1,309 @@
+use codex_config::Constrained;
+use codex_config::ConstraintResult;
+use codex_protocol::models::ActivePermissionProfile;
+use codex_protocol::models::BUILT_IN_PERMISSION_PROFILE_DANGER_FULL_ACCESS;
+use codex_protocol::models::BUILT_IN_PERMISSION_PROFILE_READ_ONLY;
+use codex_protocol::models::BUILT_IN_PERMISSION_PROFILE_WORKSPACE;
+use codex_protocol::models::PermissionProfile;
+use codex_utils_absolute_path::AbsolutePathBuf;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) enum BuiltInPermissionProfileId {
+    ReadOnly,
+    Workspace,
+    DangerFullAccess,
+}
+
+impl BuiltInPermissionProfileId {
+    fn from_str(id: &str) -> Option<Self> {
+        match id {
+            BUILT_IN_PERMISSION_PROFILE_READ_ONLY => Some(Self::ReadOnly),
+            BUILT_IN_PERMISSION_PROFILE_WORKSPACE => Some(Self::Workspace),
+            BUILT_IN_PERMISSION_PROFILE_DANGER_FULL_ACCESS => Some(Self::DangerFullAccess),
+            _ => None,
+        }
+    }
+
+    fn as_str(self) -> &'static str {
+        match self {
+            Self::ReadOnly => BUILT_IN_PERMISSION_PROFILE_READ_ONLY,
+            Self::Workspace => BUILT_IN_PERMISSION_PROFILE_WORKSPACE,
+            Self::DangerFullAccess => BUILT_IN_PERMISSION_PROFILE_DANGER_FULL_ACCESS,
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) enum ResolvedPermissionProfile {
+    Legacy(LegacyPermissionProfile),
+    BuiltIn(BuiltInPermissionProfile),
+    Named(NamedPermissionProfile),
+}
+
+/// Trusted snapshot of a resolved permission profile.
+///
+/// This is a bridge for already-resolved session/config state. It keeps the
+/// concrete `PermissionProfile`, optional active profile id, and
+/// profile-defined workspace roots together so `Permissions` can validate and
+/// install them atomically. It is not a resolver: callers that are handling
+/// user-selected profile ids should resolve those ids through config instead
+/// of constructing this type directly.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct PermissionProfileSnapshot {
+    resolved_permission_profile: ResolvedPermissionProfile,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct LegacyPermissionProfile {
+    permission_profile: PermissionProfile,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct BuiltInPermissionProfile {
+    id: BuiltInPermissionProfileId,
+    extends: Option<String>,
+    permission_profile: PermissionProfile,
+    profile_workspace_roots: Vec<AbsolutePathBuf>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) struct NamedPermissionProfile {
+    id: String,
+    extends: Option<String>,
+    permission_profile: PermissionProfile,
+    profile_workspace_roots: Vec<AbsolutePathBuf>,
+}
+
+impl ResolvedPermissionProfile {
+    pub(crate) fn from_active_profile(
+        permission_profile: PermissionProfile,
+        active_permission_profile: Option<ActivePermissionProfile>,
+        profile_workspace_roots: Vec<AbsolutePathBuf>,
+    ) -> Self {
+        let Some(active_permission_profile) = active_permission_profile else {
+            return Self::legacy(permission_profile);
+        };
+
+        let ActivePermissionProfile { id, extends } = active_permission_profile;
+        if let Some(built_in_id) = BuiltInPermissionProfileId::from_str(&id) {
+            Self::BuiltIn(BuiltInPermissionProfile {
+                id: built_in_id,
+                extends,
+                permission_profile,
+                profile_workspace_roots,
+            })
+        } else {
+            Self::Named(NamedPermissionProfile {
+                id,
+                extends,
+                permission_profile,
+                profile_workspace_roots,
+            })
+        }
+    }
+
+    pub(crate) fn legacy(permission_profile: PermissionProfile) -> Self {
+        Self::Legacy(LegacyPermissionProfile { permission_profile })
+    }
+
+    pub(crate) fn permission_profile(&self) -> &PermissionProfile {
+        match self {
+            Self::Legacy(profile) => &profile.permission_profile,
+            Self::BuiltIn(profile) => &profile.permission_profile,
+            Self::Named(profile) => &profile.permission_profile,
+        }
+    }
+
+    pub(crate) fn active_permission_profile(&self) -> Option<ActivePermissionProfile> {
+        match self {
+            Self::Legacy(_) => None,
+            Self::BuiltIn(profile) => Some(ActivePermissionProfile {
+                id: profile.id.as_str().to_string(),
+                extends: profile.extends.clone(),
+            }),
+            Self::Named(profile) => Some(ActivePermissionProfile {
+                id: profile.id.clone(),
+                extends: profile.extends.clone(),
+            }),
+        }
+    }
+
+    pub(crate) fn profile_workspace_roots(&self) -> &[AbsolutePathBuf] {
+        match self {
+            Self::Legacy(_) => &[],
+            Self::BuiltIn(profile) => &profile.profile_workspace_roots,
+            Self::Named(profile) => &profile.profile_workspace_roots,
+        }
+    }
+}
+
+impl PermissionProfileSnapshot {
+    /// Create a snapshot with no active profile id.
+    ///
+    /// Prefer this only for legacy data or local overrides that genuinely do
+    /// not have a named/built-in profile identity. Using this for a built-in or
+    /// named profile will intentionally clear the active profile metadata.
+    pub fn legacy(permission_profile: PermissionProfile) -> Self {
+        Self {
+            resolved_permission_profile: ResolvedPermissionProfile::legacy(permission_profile),
+        }
+    }
+
+    /// Create a snapshot for a known active profile id.
+    ///
+    /// Use this only after a trusted caller has already resolved the active id
+    /// to the supplied concrete `PermissionProfile`. This constructor does not
+    /// verify that the id and profile match; `Permissions` will still enforce
+    /// configured permission constraints when the snapshot is installed.
+    pub fn active(
+        permission_profile: PermissionProfile,
+        active_permission_profile: ActivePermissionProfile,
+    ) -> Self {
+        Self::active_with_profile_workspace_roots(
+            permission_profile,
+            active_permission_profile,
+            Vec::new(),
+        )
+    }
+
+    /// Create a snapshot for a known active profile id with profile roots.
+    ///
+    /// As with `active`, the caller is responsible for passing the concrete
+    /// profile and active id that were resolved together. Use this variant when
+    /// the selected profile declared workspace roots that should remain
+    /// distinct from turn-scoped runtime workspace roots.
+    pub fn active_with_profile_workspace_roots(
+        permission_profile: PermissionProfile,
+        active_permission_profile: ActivePermissionProfile,
+        profile_workspace_roots: Vec<AbsolutePathBuf>,
+    ) -> Self {
+        Self {
+            resolved_permission_profile: ResolvedPermissionProfile::from_active_profile(
+                permission_profile,
+                Some(active_permission_profile),
+                profile_workspace_roots,
+            ),
+        }
+    }
+
+    /// Reconstruct a trusted snapshot from session state.
+    ///
+    /// This is intended for session responses emitted by core, where the
+    /// concrete profile and active profile id were captured together. Avoid
+    /// using this as a shortcut for arbitrary user input because mismatched
+    /// arguments can still misrepresent the active profile identity.
+    pub fn from_session_snapshot(
+        permission_profile: PermissionProfile,
+        active_permission_profile: Option<ActivePermissionProfile>,
+    ) -> Self {
+        match active_permission_profile {
+            Some(active_permission_profile) => {
+                Self::active(permission_profile, active_permission_profile)
+            }
+            None => Self::legacy(permission_profile),
+        }
+    }
+
+    /// Borrow the concrete permission profile captured in this snapshot.
+    pub fn permission_profile(&self) -> &PermissionProfile {
+        self.resolved_permission_profile.permission_profile()
+    }
+
+    /// Return the active profile id captured in this snapshot, if any.
+    pub fn active_permission_profile(&self) -> Option<ActivePermissionProfile> {
+        self.resolved_permission_profile.active_permission_profile()
+    }
+
+    /// Borrow profile-declared workspace roots captured in this snapshot.
+    pub fn profile_workspace_roots(&self) -> &[AbsolutePathBuf] {
+        self.resolved_permission_profile.profile_workspace_roots()
+    }
+
+    pub(crate) fn into_resolved_permission_profile(self) -> ResolvedPermissionProfile {
+        self.resolved_permission_profile
+    }
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub(crate) struct PermissionProfileState {
+    resolved_permission_profile: Constrained<ResolvedPermissionProfile>,
+}
+
+impl PermissionProfileState {
+    pub(crate) fn from_constrained_legacy(
+        constrained_permission_profile: Constrained<PermissionProfile>,
+    ) -> ConstraintResult<Self> {
+        let resolved =
+            ResolvedPermissionProfile::legacy(constrained_permission_profile.get().clone());
+        Self::from_constrained_resolved(constrained_permission_profile, resolved)
+    }
+
+    pub(crate) fn from_constrained_active_profile(
+        constrained_permission_profile: Constrained<PermissionProfile>,
+        active_permission_profile: Option<ActivePermissionProfile>,
+        profile_workspace_roots: Vec<AbsolutePathBuf>,
+    ) -> ConstraintResult<Self> {
+        let resolved = ResolvedPermissionProfile::from_active_profile(
+            constrained_permission_profile.get().clone(),
+            active_permission_profile,
+            profile_workspace_roots,
+        );
+        Self::from_constrained_resolved(constrained_permission_profile, resolved)
+    }
+
+    pub(crate) fn from_constrained_resolved(
+        constrained_permission_profile: Constrained<PermissionProfile>,
+        resolved_permission_profile: ResolvedPermissionProfile,
+    ) -> ConstraintResult<Self> {
+        let permission_profile_constraint = constrained_permission_profile;
+        let resolved_permission_profile = Constrained::new(
+            resolved_permission_profile,
+            move |candidate: &ResolvedPermissionProfile| {
+                permission_profile_constraint.can_set(candidate.permission_profile())
+            },
+        )?;
+        Ok(Self {
+            resolved_permission_profile,
+        })
+    }
+
+    pub(crate) fn permission_profile(&self) -> &PermissionProfile {
+        self.resolved_permission_profile.get().permission_profile()
+    }
+
+    pub(crate) fn active_permission_profile(&self) -> Option<ActivePermissionProfile> {
+        self.resolved_permission_profile
+            .get()
+            .active_permission_profile()
+    }
+
+    pub(crate) fn profile_workspace_roots(&self) -> &[AbsolutePathBuf] {
+        self.resolved_permission_profile
+            .get()
+            .profile_workspace_roots()
+    }
+
+    pub(crate) fn can_set_legacy_permission_profile(
+        &self,
+        permission_profile: &PermissionProfile,
+    ) -> ConstraintResult<()> {
+        let candidate = ResolvedPermissionProfile::legacy(permission_profile.clone());
+        self.resolved_permission_profile.can_set(&candidate)
+    }
+
+    pub(crate) fn set_legacy_permission_profile(
+        &mut self,
+        permission_profile: PermissionProfile,
+    ) -> ConstraintResult<()> {
+        self.resolved_permission_profile
+            .set(ResolvedPermissionProfile::legacy(permission_profile))
+    }
+
+    pub(crate) fn set_permission_profile_snapshot(
+        &mut self,
+        snapshot: PermissionProfileSnapshot,
+    ) -> ConstraintResult<()> {
+        self.resolved_permission_profile
+            .set(snapshot.into_resolved_permission_profile())
+    }
+}
diff --git a/codex-rs/core/src/config_lock.rs b/codex-rs/core/src/config_lock.rs
index ff8f1e761d..14ee7e1105 100644
--- a/codex-rs/core/src/config_lock.rs
+++ b/codex-rs/core/src/config_lock.rs
@@ -84,6 +84,7 @@ pub(crate) fn lock_layer_from_config(
     Ok(ConfigLayerEntry::new(
         ConfigLayerSource::User {
             file: lock_path.clone(),
+            profile: None,
         },
         value,
     ))
diff --git a/codex-rs/core/src/connectors.rs b/codex-rs/core/src/connectors.rs
index f4ee42c821..de41919a89 100644
--- a/codex-rs/core/src/connectors.rs
+++ b/codex-rs/core/src/connectors.rs
@@ -198,7 +198,8 @@ pub async fn list_accessible_connectors_from_mcp_tools_with_options_and_status(
         config.codex_linux_sandbox_exe.clone(),
     )?;
     let environment_manager =
-        EnvironmentManager::from_codex_home(config.codex_home.clone(), local_runtime_paths).await?;
+        EnvironmentManager::from_codex_home(config.codex_home.clone(), Some(local_runtime_paths))
+            .await?;
     list_accessible_connectors_from_mcp_tools_with_environment_manager(
         config,
         force_refetch,
@@ -261,10 +262,6 @@ pub async fn list_accessible_connectors_from_mcp_tools_with_environment_manager(
     let (tx_event, rx_event) = unbounded();
     drop(rx_event);
 
-    let environment = environment_manager
-        .default_environment()
-        .unwrap_or_else(|| environment_manager.local_environment());
-
     let (mut mcp_connection_manager, cancel_token) = McpConnectionManager::new(
         &mcp_servers,
         config.mcp_oauth_credentials_store_mode,
@@ -273,7 +270,13 @@ pub async fn list_accessible_connectors_from_mcp_tools_with_environment_manager(
         INITIAL_SUBMIT_ID.to_owned(),
         tx_event,
         PermissionProfile::default(),
-        McpRuntimeEnvironment::new(environment, config.cwd.to_path_buf()),
+        // Connector discovery is threadless. Use an actually configured env if
+        // one exists, but do not reintroduce the old hidden-local fallback.
+        McpRuntimeEnvironment::new(
+            environment_manager.default_or_local_environment(),
+            environment_manager.try_local_environment(),
+            config.cwd.to_path_buf(),
+        ),
         config.codex_home.to_path_buf(),
         codex_apps_tools_cache_key(auth.as_ref()),
         host_owned_codex_apps_enabled,
diff --git a/codex-rs/core/src/connectors_tests.rs b/codex-rs/core/src/connectors_tests.rs
index c5798d7c14..cce2491679 100644
--- a/codex-rs/core/src/connectors_tests.rs
+++ b/codex-rs/core/src/connectors_tests.rs
@@ -13,12 +13,8 @@ use codex_config::types::AppConfig;
 use codex_config::types::AppToolConfig;
 use codex_config::types::AppToolsConfig;
 use codex_config::types::AppsDefaultConfig;
-use codex_connectors::filter::filter_disallowed_connectors;
-use codex_connectors::filter::filter_tool_suggest_discoverable_connectors;
-use codex_connectors::merge::merge_connectors;
 use codex_connectors::merge::plugin_connector_to_app_info;
 use codex_connectors::metadata::connector_install_url;
-use codex_connectors::metadata::connector_mention_slug;
 use codex_connectors::metadata::sanitize_name;
 use codex_features::Feature;
 use codex_login::CodexAuth;
@@ -62,15 +58,6 @@ fn app(id: &str) -> AppInfo {
     }
 }
 
-fn named_app(id: &str, name: &str) -> AppInfo {
-    AppInfo {
-        id: id.to_string(),
-        name: name.to_string(),
-        install_url: Some(connector_install_url(name, id)),
-        ..app(id)
-    }
-}
-
 fn plugin_names(names: &[&str]) -> Vec<String> {
     names.iter().map(ToString::to_string).collect()
 }
@@ -89,24 +76,6 @@ fn test_tool_definition(tool_name: &str) -> Tool {
     }
 }
 
-fn google_calendar_accessible_connector(plugin_display_names: &[&str]) -> AppInfo {
-    AppInfo {
-        id: "calendar".to_string(),
-        name: "Google Calendar".to_string(),
-        description: Some("Plan events".to_string()),
-        logo_url: Some("https://example.com/logo.png".to_string()),
-        logo_url_dark: Some("https://example.com/logo-dark.png".to_string()),
-        distribution_channel: Some("workspace".to_string()),
-        branding: None,
-        app_metadata: None,
-        labels: None,
-        install_url: None,
-        is_accessible: true,
-        is_enabled: true,
-        plugin_display_names: plugin_names(plugin_display_names),
-    }
-}
-
 fn codex_app_tool(
     tool_name: &str,
     connector_id: &str,
@@ -147,34 +116,6 @@ fn with_accessible_connectors_cache_cleared<R>(f: impl FnOnce() -> R) -> R {
     result
 }
 
-#[test]
-fn merge_connectors_replaces_plugin_placeholder_name_with_accessible_name() {
-    let plugin = plugin_connector_to_app_info("calendar".to_string());
-    let accessible = google_calendar_accessible_connector(&[]);
-
-    let merged = merge_connectors(vec![plugin], vec![accessible]);
-
-    assert_eq!(
-        merged,
-        vec![AppInfo {
-            id: "calendar".to_string(),
-            name: "Google Calendar".to_string(),
-            description: Some("Plan events".to_string()),
-            logo_url: Some("https://example.com/logo.png".to_string()),
-            logo_url_dark: Some("https://example.com/logo-dark.png".to_string()),
-            distribution_channel: Some("workspace".to_string()),
-            branding: None,
-            app_metadata: None,
-            labels: None,
-            install_url: Some(connector_install_url("calendar", "calendar")),
-            is_accessible: true,
-            is_enabled: true,
-            plugin_display_names: Vec::new(),
-        }]
-    );
-    assert_eq!(connector_mention_slug(&merged[0]), "google-calendar");
-}
-
 #[test]
 fn accessible_connectors_from_mcp_tools_carries_plugin_display_names() {
     let tools = vec![
@@ -258,50 +199,38 @@ async fn refresh_accessible_connectors_cache_from_mcp_tools_writes_latest_instal
 
     assert_eq!(
         cached,
-        vec![AppInfo {
-            id: "calendar".to_string(),
-            name: "Google Calendar".to_string(),
-            description: None,
-            logo_url: None,
-            logo_url_dark: None,
-            distribution_channel: None,
-            install_url: Some(connector_install_url("Google Calendar", "calendar")),
-            branding: None,
-            app_metadata: None,
-            labels: None,
-            is_accessible: true,
-            is_enabled: true,
-            plugin_display_names: plugin_names(&["calendar-plugin"]),
-        }]
-    );
-}
-
-#[test]
-fn merge_connectors_unions_and_dedupes_plugin_display_names() {
-    let mut plugin = plugin_connector_to_app_info("calendar".to_string());
-    plugin.plugin_display_names = plugin_names(&["sample", "alpha", "sample"]);
-
-    let accessible = google_calendar_accessible_connector(&["beta", "alpha"]);
-
-    let merged = merge_connectors(vec![plugin], vec![accessible]);
-
-    assert_eq!(
-        merged,
-        vec![AppInfo {
-            id: "calendar".to_string(),
-            name: "Google Calendar".to_string(),
-            description: Some("Plan events".to_string()),
-            logo_url: Some("https://example.com/logo.png".to_string()),
-            logo_url_dark: Some("https://example.com/logo-dark.png".to_string()),
-            distribution_channel: Some("workspace".to_string()),
-            branding: None,
-            app_metadata: None,
-            labels: None,
-            install_url: Some(connector_install_url("calendar", "calendar")),
-            is_accessible: true,
-            is_enabled: true,
-            plugin_display_names: plugin_names(&["alpha", "beta", "sample"]),
-        }]
+        vec![
+            AppInfo {
+                id: "calendar".to_string(),
+                name: "Google Calendar".to_string(),
+                description: None,
+                logo_url: None,
+                logo_url_dark: None,
+                distribution_channel: None,
+                install_url: Some(connector_install_url("Google Calendar", "calendar")),
+                branding: None,
+                app_metadata: None,
+                labels: None,
+                is_accessible: true,
+                is_enabled: true,
+                plugin_display_names: plugin_names(&["calendar-plugin"]),
+            },
+            AppInfo {
+                id: "connector_openai_hidden".to_string(),
+                name: "Hidden".to_string(),
+                description: None,
+                logo_url: None,
+                logo_url_dark: None,
+                distribution_channel: None,
+                install_url: Some(connector_install_url("Hidden", "connector_openai_hidden")),
+                branding: None,
+                app_metadata: None,
+                labels: None,
+                is_accessible: true,
+                is_enabled: true,
+                plugin_display_names: Vec::new(),
+            }
+        ]
     );
 }
 
@@ -1245,55 +1174,6 @@ fn app_tool_policy_matches_prefix_stripped_tool_name_for_tool_config() {
     );
 }
 
-#[test]
-fn filter_disallowed_connectors_allows_non_disallowed_connectors() {
-    let filtered =
-        filter_disallowed_connectors(vec![app("asdk_app_hidden"), app("alpha")], "codex_cli");
-    assert_eq!(filtered, vec![app("asdk_app_hidden"), app("alpha")]);
-}
-
-#[test]
-fn filter_disallowed_connectors_filters_openai_prefix() {
-    let filtered = filter_disallowed_connectors(
-        vec![
-            app("connector_openai_foo"),
-            app("connector_openai_bar"),
-            app("gamma"),
-        ],
-        "codex_cli",
-    );
-    assert_eq!(filtered, vec![app("gamma")]);
-}
-
-#[test]
-fn filter_disallowed_connectors_filters_disallowed_connector_ids() {
-    let filtered = filter_disallowed_connectors(
-        vec![
-            app("asdk_app_6938a94a61d881918ef32cb999ff937c"),
-            app("connector_3f8d1a79f27c4c7ba1a897ab13bf37dc"),
-            app("delta"),
-        ],
-        "codex_cli",
-    );
-    assert_eq!(filtered, vec![app("delta")]);
-}
-
-#[test]
-fn first_party_chat_originator_filters_target_and_openai_prefixed_connectors() {
-    let filtered = filter_disallowed_connectors(
-        vec![
-            app("connector_openai_foo"),
-            app("asdk_app_6938a94a61d881918ef32cb999ff937c"),
-            app("connector_0f9c9d4592e54d0a9a12b3f44a1e2010"),
-        ],
-        "codex_atlas",
-    );
-    assert_eq!(
-        filtered,
-        vec![app("asdk_app_6938a94a61d881918ef32cb999ff937c")]
-    );
-}
-
 #[tokio::test]
 async fn tool_suggest_connector_ids_include_configured_tool_suggest_discoverables() {
     let codex_home = tempdir().expect("tempdir should succeed");
@@ -1385,71 +1265,3 @@ discoverables = [
         ))]
     );
 }
-
-#[test]
-fn filter_tool_suggest_discoverable_connectors_keeps_only_plugin_backed_uninstalled_apps() {
-    let filtered = filter_tool_suggest_discoverable_connectors(
-        vec![
-            named_app(
-                "connector_2128aebfecb84f64a069897515042a44",
-                "Google Calendar",
-            ),
-            named_app("connector_68df038e0ba48191908c8434991bbac2", "Gmail"),
-            named_app("connector_other", "Other"),
-        ],
-        &[AppInfo {
-            is_accessible: true,
-            ..named_app(
-                "connector_2128aebfecb84f64a069897515042a44",
-                "Google Calendar",
-            )
-        }],
-        &HashSet::from([
-            "connector_2128aebfecb84f64a069897515042a44".to_string(),
-            "connector_68df038e0ba48191908c8434991bbac2".to_string(),
-        ]),
-        "codex_cli",
-    );
-
-    assert_eq!(
-        filtered,
-        vec![named_app(
-            "connector_68df038e0ba48191908c8434991bbac2",
-            "Gmail",
-        )]
-    );
-}
-
-#[test]
-fn filter_tool_suggest_discoverable_connectors_excludes_accessible_apps_even_when_disabled() {
-    let filtered = filter_tool_suggest_discoverable_connectors(
-        vec![
-            named_app(
-                "connector_2128aebfecb84f64a069897515042a44",
-                "Google Calendar",
-            ),
-            named_app("connector_68df038e0ba48191908c8434991bbac2", "Gmail"),
-        ],
-        &[
-            AppInfo {
-                is_accessible: true,
-                ..named_app(
-                    "connector_2128aebfecb84f64a069897515042a44",
-                    "Google Calendar",
-                )
-            },
-            AppInfo {
-                is_accessible: true,
-                is_enabled: false,
-                ..named_app("connector_68df038e0ba48191908c8434991bbac2", "Gmail")
-            },
-        ],
-        &HashSet::from([
-            "connector_2128aebfecb84f64a069897515042a44".to_string(),
-            "connector_68df038e0ba48191908c8434991bbac2".to_string(),
-        ]),
-        "codex_cli",
-    );
-
-    assert_eq!(filtered, Vec::<AppInfo>::new());
-}
diff --git a/codex-rs/core/src/context/approved_command_prefix_saved.rs b/codex-rs/core/src/context/approved_command_prefix_saved.rs
index 3aac17712a..532a2494c3 100644
--- a/codex-rs/core/src/context/approved_command_prefix_saved.rs
+++ b/codex-rs/core/src/context/approved_command_prefix_saved.rs
@@ -14,9 +14,17 @@ impl ApprovedCommandPrefixSaved {
 }
 
 impl ContextualUserFragment for ApprovedCommandPrefixSaved {
-    const ROLE: &'static str = "developer";
-    const START_MARKER: &'static str = "";
-    const END_MARKER: &'static str = "";
+    fn role() -> &'static str {
+        "developer"
+    }
+
+    fn markers(&self) -> (&'static str, &'static str) {
+        Self::type_markers()
+    }
+
+    fn type_markers() -> (&'static str, &'static str) {
+        ("", "")
+    }
 
     fn body(&self) -> String {
         format!("Approved command prefix saved:\n{}", self.prefixes)
diff --git a/codex-rs/core/src/context/apps_instructions.rs b/codex-rs/core/src/context/apps_instructions.rs
index 55865b429a..9a475dc311 100644
--- a/codex-rs/core/src/context/apps_instructions.rs
+++ b/codex-rs/core/src/context/apps_instructions.rs
@@ -18,9 +18,17 @@ impl AppsInstructions {
 }
 
 impl ContextualUserFragment for AppsInstructions {
-    const ROLE: &'static str = "developer";
-    const START_MARKER: &'static str = APPS_INSTRUCTIONS_OPEN_TAG;
-    const END_MARKER: &'static str = APPS_INSTRUCTIONS_CLOSE_TAG;
+    fn role() -> &'static str {
+        "developer"
+    }
+
+    fn markers(&self) -> (&'static str, &'static str) {
+        Self::type_markers()
+    }
+
+    fn type_markers() -> (&'static str, &'static str) {
+        (APPS_INSTRUCTIONS_OPEN_TAG, APPS_INSTRUCTIONS_CLOSE_TAG)
+    }
 
     fn body(&self) -> String {
         format!(
diff --git a/codex-rs/core/src/context/available_plugins_instructions.rs b/codex-rs/core/src/context/available_plugins_instructions.rs
index 52f9c8df48..e7f560f6a1 100644
--- a/codex-rs/core/src/context/available_plugins_instructions.rs
+++ b/codex-rs/core/src/context/available_plugins_instructions.rs
@@ -22,9 +22,20 @@ impl AvailablePluginsInstructions {
 }
 
 impl ContextualUserFragment for AvailablePluginsInstructions {
-    const ROLE: &'static str = "developer";
-    const START_MARKER: &'static str = PLUGINS_INSTRUCTIONS_OPEN_TAG;
-    const END_MARKER: &'static str = PLUGINS_INSTRUCTIONS_CLOSE_TAG;
+    fn role() -> &'static str {
+        "developer"
+    }
+
+    fn markers(&self) -> (&'static str, &'static str) {
+        Self::type_markers()
+    }
+
+    fn type_markers() -> (&'static str, &'static str) {
+        (
+            PLUGINS_INSTRUCTIONS_OPEN_TAG,
+            PLUGINS_INSTRUCTIONS_CLOSE_TAG,
+        )
+    }
 
     fn body(&self) -> String {
         let mut lines = vec![
diff --git a/codex-rs/core/src/context/available_skills_instructions.rs b/codex-rs/core/src/context/available_skills_instructions.rs
index 0a99bf62e6..e63d637677 100644
--- a/codex-rs/core/src/context/available_skills_instructions.rs
+++ b/codex-rs/core/src/context/available_skills_instructions.rs
@@ -21,9 +21,17 @@ impl From<AvailableSkills> for AvailableSkillsInstructions {
 }
 
 impl ContextualUserFragment for AvailableSkillsInstructions {
-    const ROLE: &'static str = "developer";
-    const START_MARKER: &'static str = SKILLS_INSTRUCTIONS_OPEN_TAG;
-    const END_MARKER: &'static str = SKILLS_INSTRUCTIONS_CLOSE_TAG;
+    fn role() -> &'static str {
+        "developer"
+    }
+
+    fn markers(&self) -> (&'static str, &'static str) {
+        Self::type_markers()
+    }
+
+    fn type_markers() -> (&'static str, &'static str) {
+        (SKILLS_INSTRUCTIONS_OPEN_TAG, SKILLS_INSTRUCTIONS_CLOSE_TAG)
+    }
 
     fn body(&self) -> String {
         render_available_skills_body(&self.skill_root_lines, &self.skill_lines)
diff --git a/codex-rs/core/src/context/collaboration_mode_instructions.rs b/codex-rs/core/src/context/collaboration_mode_instructions.rs
index dcf3bac1de..16e3d38198 100644
--- a/codex-rs/core/src/context/collaboration_mode_instructions.rs
+++ b/codex-rs/core/src/context/collaboration_mode_instructions.rs
@@ -22,9 +22,17 @@ impl CollaborationModeInstructions {
 }
 
 impl ContextualUserFragment for CollaborationModeInstructions {
-    const ROLE: &'static str = "developer";
-    const START_MARKER: &'static str = COLLABORATION_MODE_OPEN_TAG;
-    const END_MARKER: &'static str = COLLABORATION_MODE_CLOSE_TAG;
+    fn role() -> &'static str {
+        "developer"
+    }
+
+    fn markers(&self) -> (&'static str, &'static str) {
+        Self::type_markers()
+    }
+
+    fn type_markers() -> (&'static str, &'static str) {
+        (COLLABORATION_MODE_OPEN_TAG, COLLABORATION_MODE_CLOSE_TAG)
+    }
 
     fn body(&self) -> String {
         self.instructions.clone()
diff --git a/codex-rs/core/src/context/contextual_user_message_tests.rs b/codex-rs/core/src/context/contextual_user_message_tests.rs
index ee134cc685..7e04854d42 100644
--- a/codex-rs/core/src/context/contextual_user_message_tests.rs
+++ b/codex-rs/core/src/context/contextual_user_message_tests.rs
@@ -1,8 +1,11 @@
 use super::*;
 use crate::context::ContextualUserFragment;
+use crate::context::GoalContext;
+use crate::context::SubagentNotification;
 use codex_protocol::items::HookPromptFragment;
 use codex_protocol::items::build_hook_prompt_message;
 use codex_protocol::models::ResponseItem;
+use pretty_assertions::assert_eq;
 
 #[test]
 fn detects_environment_context_fragment() {
@@ -38,6 +41,18 @@ fn detects_goal_context_fragment() {
     }));
 }
 
+#[test]
+fn contextual_user_fragment_is_dyn_compatible() {
+    let fragment: Box<dyn ContextualUserFragment> = Box::new(GoalContext {
+        prompt: "Continue working toward the active thread goal.".to_string(),
+    });
+
+    assert_eq!(
+        fragment.render(),
+        "<goal_context>\nContinue working toward the active thread goal.\n</goal_context>"
+    );
+}
+
 #[test]
 fn ignores_regular_user_text() {
     assert!(!is_contextual_user_fragment(&ContentItem::InputText {
diff --git a/codex-rs/core/src/context/environment_context.rs b/codex-rs/core/src/context/environment_context.rs
index 272e3c617d..a3052b6642 100644
--- a/codex-rs/core/src/context/environment_context.rs
+++ b/codex-rs/core/src/context/environment_context.rs
@@ -269,9 +269,20 @@ impl EnvironmentContext {
 }
 
 impl ContextualUserFragment for EnvironmentContext {
-    const ROLE: &'static str = "user";
-    const START_MARKER: &'static str = codex_protocol::protocol::ENVIRONMENT_CONTEXT_OPEN_TAG;
-    const END_MARKER: &'static str = codex_protocol::protocol::ENVIRONMENT_CONTEXT_CLOSE_TAG;
+    fn role() -> &'static str {
+        "user"
+    }
+
+    fn markers(&self) -> (&'static str, &'static str) {
+        Self::type_markers()
+    }
+
+    fn type_markers() -> (&'static str, &'static str) {
+        (
+            codex_protocol::protocol::ENVIRONMENT_CONTEXT_OPEN_TAG,
+            codex_protocol::protocol::ENVIRONMENT_CONTEXT_CLOSE_TAG,
+        )
+    }
 
     fn body(&self) -> String {
         let mut lines = Vec::new();
diff --git a/codex-rs/core/src/context/fragment.rs b/codex-rs/core/src/context/fragment.rs
index 1cc8f6d9b8..4a9e284d12 100644
--- a/codex-rs/core/src/context/fragment.rs
+++ b/codex-rs/core/src/context/fragment.rs
@@ -38,37 +38,34 @@ impl<T: ContextualUserFragment> FragmentRegistration for FragmentRegistrationPro
 /// in which case the default helpers render only the body and never match
 /// arbitrary text.
 pub trait ContextualUserFragment {
-    const ROLE: &'static str;
-    const START_MARKER: &'static str;
-    const END_MARKER: &'static str;
+    fn role() -> &'static str
+    where
+        Self: Sized;
+
+    fn markers(&self) -> (&'static str, &'static str);
 
     fn body(&self) -> String;
 
+    fn type_markers() -> (&'static str, &'static str)
+    where
+        Self: Sized;
+
     fn matches_text(text: &str) -> bool
     where
         Self: Sized,
     {
-        if Self::START_MARKER.is_empty() || Self::END_MARKER.is_empty() {
-            return false;
-        }
-
-        let trimmed = text.trim_start();
-        let starts_with_marker = trimmed
-            .get(..Self::START_MARKER.len())
-            .is_some_and(|candidate| candidate.eq_ignore_ascii_case(Self::START_MARKER));
-        let trimmed = trimmed.trim_end();
-        let ends_with_marker = trimmed
-            .get(trimmed.len().saturating_sub(Self::END_MARKER.len())..)
-            .is_some_and(|candidate| candidate.eq_ignore_ascii_case(Self::END_MARKER));
-        starts_with_marker && ends_with_marker
+        let (start_marker, end_marker) = Self::type_markers();
+        matches_marked_text(start_marker, end_marker, text)
     }
 
     fn render(&self) -> String {
-        if Self::START_MARKER.is_empty() && Self::END_MARKER.is_empty() {
-            return self.body();
+        let (start_marker, end_marker) = self.markers();
+        let body = self.body();
+        if start_marker.is_empty() && end_marker.is_empty() {
+            return body;
         }
 
-        format!("{}{}{}", Self::START_MARKER, self.body(), Self::END_MARKER)
+        format!("{start_marker}{body}{end_marker}")
     }
 
     fn into(self) -> ResponseItem
@@ -77,7 +74,7 @@ pub trait ContextualUserFragment {
     {
         ResponseItem::Message {
             id: None,
-            role: Self::ROLE.to_string(),
+            role: Self::role().to_string(),
             content: vec![ContentItem::InputText {
                 text: self.render(),
             }],
@@ -85,3 +82,19 @@ pub trait ContextualUserFragment {
         }
     }
 }
+
+fn matches_marked_text(start_marker: &str, end_marker: &str, text: &str) -> bool {
+    if start_marker.is_empty() || end_marker.is_empty() {
+        return false;
+    }
+
+    let trimmed = text.trim_start();
+    let starts_with_marker = trimmed
+        .get(..start_marker.len())
+        .is_some_and(|candidate| candidate.eq_ignore_ascii_case(start_marker));
+    let trimmed = trimmed.trim_end();
+    let ends_with_marker = trimmed
+        .get(trimmed.len().saturating_sub(end_marker.len())..)
+        .is_some_and(|candidate| candidate.eq_ignore_ascii_case(end_marker));
+    starts_with_marker && ends_with_marker
+}
diff --git a/codex-rs/core/src/context/goal_context.rs b/codex-rs/core/src/context/goal_context.rs
index d259273324..240d4d0e8a 100644
--- a/codex-rs/core/src/context/goal_context.rs
+++ b/codex-rs/core/src/context/goal_context.rs
@@ -8,9 +8,17 @@ pub(crate) struct GoalContext {
 }
 
 impl ContextualUserFragment for GoalContext {
-    const ROLE: &'static str = "user";
-    const START_MARKER: &'static str = "<goal_context>";
-    const END_MARKER: &'static str = "</goal_context>";
+    fn role() -> &'static str {
+        "user"
+    }
+
+    fn markers(&self) -> (&'static str, &'static str) {
+        Self::type_markers()
+    }
+
+    fn type_markers() -> (&'static str, &'static str) {
+        ("<goal_context>", "</goal_context>")
+    }
 
     fn body(&self) -> String {
         format!("\n{}\n", self.prompt)
diff --git a/codex-rs/core/src/context/guardian_followup_review_reminder.rs b/codex-rs/core/src/context/guardian_followup_review_reminder.rs
index 972355ba95..4de750629c 100644
--- a/codex-rs/core/src/context/guardian_followup_review_reminder.rs
+++ b/codex-rs/core/src/context/guardian_followup_review_reminder.rs
@@ -4,9 +4,17 @@ use super::ContextualUserFragment;
 pub(crate) struct GuardianFollowupReviewReminder;
 
 impl ContextualUserFragment for GuardianFollowupReviewReminder {
-    const ROLE: &'static str = "developer";
-    const START_MARKER: &'static str = "";
-    const END_MARKER: &'static str = "";
+    fn role() -> &'static str {
+        "developer"
+    }
+
+    fn markers(&self) -> (&'static str, &'static str) {
+        Self::type_markers()
+    }
+
+    fn type_markers() -> (&'static str, &'static str) {
+        ("", "")
+    }
 
     fn body(&self) -> String {
         concat!(
diff --git a/codex-rs/core/src/context/hook_additional_context.rs b/codex-rs/core/src/context/hook_additional_context.rs
index 01c95a6524..1094261665 100644
--- a/codex-rs/core/src/context/hook_additional_context.rs
+++ b/codex-rs/core/src/context/hook_additional_context.rs
@@ -12,9 +12,17 @@ impl HookAdditionalContext {
 }
 
 impl ContextualUserFragment for HookAdditionalContext {
-    const ROLE: &'static str = "developer";
-    const START_MARKER: &'static str = "";
-    const END_MARKER: &'static str = "";
+    fn role() -> &'static str {
+        "developer"
+    }
+
+    fn markers(&self) -> (&'static str, &'static str) {
+        Self::type_markers()
+    }
+
+    fn type_markers() -> (&'static str, &'static str) {
+        ("", "")
+    }
 
     fn body(&self) -> String {
         self.text.clone()
diff --git a/codex-rs/core/src/context/image_generation_instructions.rs b/codex-rs/core/src/context/image_generation_instructions.rs
index 01abee9096..7ddb231b8f 100644
--- a/codex-rs/core/src/context/image_generation_instructions.rs
+++ b/codex-rs/core/src/context/image_generation_instructions.rs
@@ -17,9 +17,17 @@ impl ImageGenerationInstructions {
 }
 
 impl ContextualUserFragment for ImageGenerationInstructions {
-    const ROLE: &'static str = "developer";
-    const START_MARKER: &'static str = "";
-    const END_MARKER: &'static str = "";
+    fn role() -> &'static str {
+        "developer"
+    }
+
+    fn markers(&self) -> (&'static str, &'static str) {
+        Self::type_markers()
+    }
+
+    fn type_markers() -> (&'static str, &'static str) {
+        ("", "")
+    }
 
     fn body(&self) -> String {
         format!(
diff --git a/codex-rs/core/src/context/legacy_apply_patch_exec_command_warning.rs b/codex-rs/core/src/context/legacy_apply_patch_exec_command_warning.rs
index d8fd7da8e9..b9ecbf6170 100644
--- a/codex-rs/core/src/context/legacy_apply_patch_exec_command_warning.rs
+++ b/codex-rs/core/src/context/legacy_apply_patch_exec_command_warning.rs
@@ -5,9 +5,17 @@ use super::ContextualUserFragment;
 pub(crate) struct LegacyApplyPatchExecCommandWarning;
 
 impl ContextualUserFragment for LegacyApplyPatchExecCommandWarning {
-    const ROLE: &'static str = "user";
-    const START_MARKER: &'static str = "";
-    const END_MARKER: &'static str = "";
+    fn role() -> &'static str {
+        "user"
+    }
+
+    fn markers(&self) -> (&'static str, &'static str) {
+        Self::type_markers()
+    }
+
+    fn type_markers() -> (&'static str, &'static str) {
+        ("", "")
+    }
 
     fn matches_text(text: &str) -> bool {
         let trimmed = text.trim();
diff --git a/codex-rs/core/src/context/legacy_model_mismatch_warning.rs b/codex-rs/core/src/context/legacy_model_mismatch_warning.rs
index a6afa9d7d1..9b769e11e9 100644
--- a/codex-rs/core/src/context/legacy_model_mismatch_warning.rs
+++ b/codex-rs/core/src/context/legacy_model_mismatch_warning.rs
@@ -5,9 +5,17 @@ use super::ContextualUserFragment;
 pub(crate) struct LegacyModelMismatchWarning;
 
 impl ContextualUserFragment for LegacyModelMismatchWarning {
-    const ROLE: &'static str = "user";
-    const START_MARKER: &'static str = "";
-    const END_MARKER: &'static str = "";
+    fn role() -> &'static str {
+        "user"
+    }
+
+    fn markers(&self) -> (&'static str, &'static str) {
+        Self::type_markers()
+    }
+
+    fn type_markers() -> (&'static str, &'static str) {
+        ("", "")
+    }
 
     fn matches_text(text: &str) -> bool {
         text.trim().starts_with(
diff --git a/codex-rs/core/src/context/legacy_unified_exec_process_limit_warning.rs b/codex-rs/core/src/context/legacy_unified_exec_process_limit_warning.rs
index 463aeaa8aa..54f1a40e3e 100644
--- a/codex-rs/core/src/context/legacy_unified_exec_process_limit_warning.rs
+++ b/codex-rs/core/src/context/legacy_unified_exec_process_limit_warning.rs
@@ -5,9 +5,17 @@ use super::ContextualUserFragment;
 pub(crate) struct LegacyUnifiedExecProcessLimitWarning;
 
 impl ContextualUserFragment for LegacyUnifiedExecProcessLimitWarning {
-    const ROLE: &'static str = "user";
-    const START_MARKER: &'static str = "";
-    const END_MARKER: &'static str = "";
+    fn role() -> &'static str {
+        "user"
+    }
+
+    fn markers(&self) -> (&'static str, &'static str) {
+        Self::type_markers()
+    }
+
+    fn type_markers() -> (&'static str, &'static str) {
+        ("", "")
+    }
 
     fn matches_text(text: &str) -> bool {
         text.trim().starts_with(
diff --git a/codex-rs/core/src/context/model_switch_instructions.rs b/codex-rs/core/src/context/model_switch_instructions.rs
index 0b75afb61a..f15dcd22e0 100644
--- a/codex-rs/core/src/context/model_switch_instructions.rs
+++ b/codex-rs/core/src/context/model_switch_instructions.rs
@@ -14,9 +14,17 @@ impl ModelSwitchInstructions {
 }
 
 impl ContextualUserFragment for ModelSwitchInstructions {
-    const ROLE: &'static str = "developer";
-    const START_MARKER: &'static str = "<model_switch>";
-    const END_MARKER: &'static str = "</model_switch>";
+    fn role() -> &'static str {
+        "developer"
+    }
+
+    fn markers(&self) -> (&'static str, &'static str) {
+        Self::type_markers()
+    }
+
+    fn type_markers() -> (&'static str, &'static str) {
+        ("<model_switch>", "</model_switch>")
+    }
 
     fn body(&self) -> String {
         format!(
diff --git a/codex-rs/core/src/context/network_rule_saved.rs b/codex-rs/core/src/context/network_rule_saved.rs
index 8162e6bda2..5b45dbb560 100644
--- a/codex-rs/core/src/context/network_rule_saved.rs
+++ b/codex-rs/core/src/context/network_rule_saved.rs
@@ -18,9 +18,17 @@ impl NetworkRuleSaved {
 }
 
 impl ContextualUserFragment for NetworkRuleSaved {
-    const ROLE: &'static str = "developer";
-    const START_MARKER: &'static str = "";
-    const END_MARKER: &'static str = "";
+    fn role() -> &'static str {
+        "developer"
+    }
+
+    fn markers(&self) -> (&'static str, &'static str) {
+        Self::type_markers()
+    }
+
+    fn type_markers() -> (&'static str, &'static str) {
+        ("", "")
+    }
 
     fn body(&self) -> String {
         let (action, list_name) = match self.action {
diff --git a/codex-rs/core/src/context/permissions_instructions.rs b/codex-rs/core/src/context/permissions_instructions.rs
index 0ccd6c33a7..db8f983c16 100644
--- a/codex-rs/core/src/context/permissions_instructions.rs
+++ b/codex-rs/core/src/context/permissions_instructions.rs
@@ -8,7 +8,6 @@ use codex_protocol::permissions::NetworkSandboxPolicy;
 use codex_protocol::protocol::AskForApproval;
 use codex_protocol::protocol::GranularApprovalConfig;
 use codex_protocol::protocol::NetworkAccess;
-use codex_protocol::protocol::SandboxPolicy;
 use codex_protocol::protocol::WritableRoot;
 use codex_utils_template::Template;
 use std::path::Path;
@@ -85,27 +84,6 @@ impl PermissionsInstructions {
         )
     }
 
-    /// Builds permissions instructions from a legacy sandbox policy.
-    pub fn from_policy(
-        sandbox_policy: &SandboxPolicy,
-        approval_policy: AskForApproval,
-        approvals_reviewer: ApprovalsReviewer,
-        exec_policy: &Policy,
-        cwd: &Path,
-        exec_permission_approvals_enabled: bool,
-        request_permissions_tool_enabled: bool,
-    ) -> Self {
-        Self::from_permission_profile(
-            &PermissionProfile::from_legacy_sandbox_policy(sandbox_policy),
-            approval_policy,
-            approvals_reviewer,
-            exec_policy,
-            cwd,
-            exec_permission_approvals_enabled,
-            request_permissions_tool_enabled,
-        )
-    }
-
     fn from_permissions_with_network(
         sandbox_mode: SandboxMode,
         network_access: NetworkAccess,
@@ -167,9 +145,17 @@ fn network_access_from_policy(network_policy: NetworkSandboxPolicy) -> NetworkAc
 }
 
 impl ContextualUserFragment for PermissionsInstructions {
-    const ROLE: &'static str = "developer";
-    const START_MARKER: &'static str = "<permissions instructions>";
-    const END_MARKER: &'static str = "</permissions instructions>";
+    fn role() -> &'static str {
+        "developer"
+    }
+
+    fn markers(&self) -> (&'static str, &'static str) {
+        Self::type_markers()
+    }
+
+    fn type_markers() -> (&'static str, &'static str) {
+        ("<permissions instructions>", "</permissions instructions>")
+    }
 
     fn body(&self) -> String {
         self.text.clone()
@@ -251,10 +237,11 @@ fn sandbox_text(mode: SandboxMode, network_access: NetworkAccess) -> String {
 }
 
 fn writable_roots_text(writable_roots: Option<Vec<WritableRoot>>) -> Option<String> {
-    let roots = writable_roots?;
+    let mut roots = writable_roots?;
     if roots.is_empty() {
         return None;
     }
+    roots.sort_by(|left, right| left.root.as_path().cmp(right.root.as_path()));
 
     let roots_list: Vec<String> = roots
         .iter()
diff --git a/codex-rs/core/src/context/permissions_instructions_tests.rs b/codex-rs/core/src/context/permissions_instructions_tests.rs
index 16d5dc631a..6d1aa5d886 100644
--- a/codex-rs/core/src/context/permissions_instructions_tests.rs
+++ b/codex-rs/core/src/context/permissions_instructions_tests.rs
@@ -53,29 +53,6 @@ fn builds_permissions_with_network_access_override() {
     );
 }
 
-#[test]
-fn builds_permissions_from_policy() {
-    let policy = SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![],
-        network_access: true,
-        exclude_tmpdir_env_var: false,
-        exclude_slash_tmp: false,
-    };
-
-    let instructions = PermissionsInstructions::from_policy(
-        &policy,
-        AskForApproval::UnlessTrusted,
-        ApprovalsReviewer::User,
-        &Policy::empty(),
-        &PathBuf::from("/tmp"),
-        /*exec_permission_approvals_enabled*/ false,
-        /*request_permissions_tool_enabled*/ false,
-    );
-    let text = instructions.body();
-    assert!(text.contains("Network access is enabled."));
-    assert!(text.contains("`approval_policy` is `unless-trusted`"));
-}
-
 #[test]
 fn builds_permissions_from_profile() {
     let cwd = PathBuf::from("/tmp");
diff --git a/codex-rs/core/src/context/personality_spec_instructions.rs b/codex-rs/core/src/context/personality_spec_instructions.rs
index 17c9cf595b..590ebde80d 100644
--- a/codex-rs/core/src/context/personality_spec_instructions.rs
+++ b/codex-rs/core/src/context/personality_spec_instructions.rs
@@ -12,9 +12,17 @@ impl PersonalitySpecInstructions {
 }
 
 impl ContextualUserFragment for PersonalitySpecInstructions {
-    const ROLE: &'static str = "developer";
-    const START_MARKER: &'static str = "<personality_spec>";
-    const END_MARKER: &'static str = "</personality_spec>";
+    fn role() -> &'static str {
+        "developer"
+    }
+
+    fn markers(&self) -> (&'static str, &'static str) {
+        Self::type_markers()
+    }
+
+    fn type_markers() -> (&'static str, &'static str) {
+        ("<personality_spec>", "</personality_spec>")
+    }
 
     fn body(&self) -> String {
         format!(
diff --git a/codex-rs/core/src/context/plugin_instructions.rs b/codex-rs/core/src/context/plugin_instructions.rs
index 0678033bbe..8fbccbfa10 100644
--- a/codex-rs/core/src/context/plugin_instructions.rs
+++ b/codex-rs/core/src/context/plugin_instructions.rs
@@ -12,9 +12,17 @@ impl PluginInstructions {
 }
 
 impl ContextualUserFragment for PluginInstructions {
-    const ROLE: &'static str = "developer";
-    const START_MARKER: &'static str = "";
-    const END_MARKER: &'static str = "";
+    fn role() -> &'static str {
+        "developer"
+    }
+
+    fn markers(&self) -> (&'static str, &'static str) {
+        Self::type_markers()
+    }
+
+    fn type_markers() -> (&'static str, &'static str) {
+        ("", "")
+    }
 
     fn body(&self) -> String {
         self.text.clone()
diff --git a/codex-rs/core/src/context/realtime_end_instructions.rs b/codex-rs/core/src/context/realtime_end_instructions.rs
index 0edd852895..a8c6226f2a 100644
--- a/codex-rs/core/src/context/realtime_end_instructions.rs
+++ b/codex-rs/core/src/context/realtime_end_instructions.rs
@@ -18,9 +18,20 @@ impl RealtimeEndInstructions {
 }
 
 impl ContextualUserFragment for RealtimeEndInstructions {
-    const ROLE: &'static str = "developer";
-    const START_MARKER: &'static str = REALTIME_CONVERSATION_OPEN_TAG;
-    const END_MARKER: &'static str = REALTIME_CONVERSATION_CLOSE_TAG;
+    fn role() -> &'static str {
+        "developer"
+    }
+
+    fn markers(&self) -> (&'static str, &'static str) {
+        Self::type_markers()
+    }
+
+    fn type_markers() -> (&'static str, &'static str) {
+        (
+            REALTIME_CONVERSATION_OPEN_TAG,
+            REALTIME_CONVERSATION_CLOSE_TAG,
+        )
+    }
 
     fn body(&self) -> String {
         format!(
diff --git a/codex-rs/core/src/context/realtime_start_instructions.rs b/codex-rs/core/src/context/realtime_start_instructions.rs
index 6745a74fd3..cc767c202a 100644
--- a/codex-rs/core/src/context/realtime_start_instructions.rs
+++ b/codex-rs/core/src/context/realtime_start_instructions.rs
@@ -8,9 +8,20 @@ const REALTIME_START_INSTRUCTIONS: &str = include_str!("prompts/realtime/realtim
 pub(crate) struct RealtimeStartInstructions;
 
 impl ContextualUserFragment for RealtimeStartInstructions {
-    const ROLE: &'static str = "developer";
-    const START_MARKER: &'static str = REALTIME_CONVERSATION_OPEN_TAG;
-    const END_MARKER: &'static str = REALTIME_CONVERSATION_CLOSE_TAG;
+    fn role() -> &'static str {
+        "developer"
+    }
+
+    fn markers(&self) -> (&'static str, &'static str) {
+        Self::type_markers()
+    }
+
+    fn type_markers() -> (&'static str, &'static str) {
+        (
+            REALTIME_CONVERSATION_OPEN_TAG,
+            REALTIME_CONVERSATION_CLOSE_TAG,
+        )
+    }
 
     fn body(&self) -> String {
         format!("\n{}\n", REALTIME_START_INSTRUCTIONS.trim())
diff --git a/codex-rs/core/src/context/realtime_start_with_instructions.rs b/codex-rs/core/src/context/realtime_start_with_instructions.rs
index ddaf4528df..ee242f9068 100644
--- a/codex-rs/core/src/context/realtime_start_with_instructions.rs
+++ b/codex-rs/core/src/context/realtime_start_with_instructions.rs
@@ -16,9 +16,20 @@ impl RealtimeStartWithInstructions {
 }
 
 impl ContextualUserFragment for RealtimeStartWithInstructions {
-    const ROLE: &'static str = "developer";
-    const START_MARKER: &'static str = REALTIME_CONVERSATION_OPEN_TAG;
-    const END_MARKER: &'static str = REALTIME_CONVERSATION_CLOSE_TAG;
+    fn role() -> &'static str {
+        "developer"
+    }
+
+    fn markers(&self) -> (&'static str, &'static str) {
+        Self::type_markers()
+    }
+
+    fn type_markers() -> (&'static str, &'static str) {
+        (
+            REALTIME_CONVERSATION_OPEN_TAG,
+            REALTIME_CONVERSATION_CLOSE_TAG,
+        )
+    }
 
     fn body(&self) -> String {
         format!("\n{}\n", self.instructions)
diff --git a/codex-rs/core/src/context/skill_instructions.rs b/codex-rs/core/src/context/skill_instructions.rs
index 22f6ba2255..5c4b4b78a6 100644
--- a/codex-rs/core/src/context/skill_instructions.rs
+++ b/codex-rs/core/src/context/skill_instructions.rs
@@ -20,9 +20,17 @@ impl From<&SkillInjection> for SkillInstructions {
 }
 
 impl ContextualUserFragment for SkillInstructions {
-    const ROLE: &'static str = "user";
-    const START_MARKER: &'static str = "<skill>";
-    const END_MARKER: &'static str = "</skill>";
+    fn role() -> &'static str {
+        "user"
+    }
+
+    fn markers(&self) -> (&'static str, &'static str) {
+        Self::type_markers()
+    }
+
+    fn type_markers() -> (&'static str, &'static str) {
+        ("<skill>", "</skill>")
+    }
 
     fn body(&self) -> String {
         format!(
diff --git a/codex-rs/core/src/context/subagent_notification.rs b/codex-rs/core/src/context/subagent_notification.rs
index bdb389f366..0c1358f33c 100644
--- a/codex-rs/core/src/context/subagent_notification.rs
+++ b/codex-rs/core/src/context/subagent_notification.rs
@@ -18,9 +18,17 @@ impl SubagentNotification {
 }
 
 impl ContextualUserFragment for SubagentNotification {
-    const ROLE: &'static str = "user";
-    const START_MARKER: &'static str = "<subagent_notification>";
-    const END_MARKER: &'static str = "</subagent_notification>";
+    fn role() -> &'static str {
+        "user"
+    }
+
+    fn markers(&self) -> (&'static str, &'static str) {
+        Self::type_markers()
+    }
+
+    fn type_markers() -> (&'static str, &'static str) {
+        ("<subagent_notification>", "</subagent_notification>")
+    }
 
     fn body(&self) -> String {
         format!(
diff --git a/codex-rs/core/src/context/turn_aborted.rs b/codex-rs/core/src/context/turn_aborted.rs
index 34c02b9cf6..6dc6697288 100644
--- a/codex-rs/core/src/context/turn_aborted.rs
+++ b/codex-rs/core/src/context/turn_aborted.rs
@@ -17,9 +17,17 @@ impl TurnAborted {
 }
 
 impl ContextualUserFragment for TurnAborted {
-    const ROLE: &'static str = "user";
-    const START_MARKER: &'static str = "<turn_aborted>";
-    const END_MARKER: &'static str = "</turn_aborted>";
+    fn role() -> &'static str {
+        "user"
+    }
+
+    fn markers(&self) -> (&'static str, &'static str) {
+        Self::type_markers()
+    }
+
+    fn type_markers() -> (&'static str, &'static str) {
+        ("<turn_aborted>", "</turn_aborted>")
+    }
 
     fn body(&self) -> String {
         format!("\n{}\n", self.guidance)
diff --git a/codex-rs/core/src/context/user_instructions.rs b/codex-rs/core/src/context/user_instructions.rs
index dead5971da..1b3fa40298 100644
--- a/codex-rs/core/src/context/user_instructions.rs
+++ b/codex-rs/core/src/context/user_instructions.rs
@@ -7,9 +7,17 @@ pub(crate) struct UserInstructions {
 }
 
 impl ContextualUserFragment for UserInstructions {
-    const ROLE: &'static str = "user";
-    const START_MARKER: &'static str = "# AGENTS.md instructions for ";
-    const END_MARKER: &'static str = "</INSTRUCTIONS>";
+    fn role() -> &'static str {
+        "user"
+    }
+
+    fn markers(&self) -> (&'static str, &'static str) {
+        Self::type_markers()
+    }
+
+    fn type_markers() -> (&'static str, &'static str) {
+        ("# AGENTS.md instructions for ", "</INSTRUCTIONS>")
+    }
 
     fn body(&self) -> String {
         format!("{}\n\n<INSTRUCTIONS>\n{}\n", self.directory, self.text)
diff --git a/codex-rs/core/src/context/user_shell_command.rs b/codex-rs/core/src/context/user_shell_command.rs
index 2350687abc..cf5a3337d0 100644
--- a/codex-rs/core/src/context/user_shell_command.rs
+++ b/codex-rs/core/src/context/user_shell_command.rs
@@ -27,9 +27,17 @@ impl UserShellCommand {
 }
 
 impl ContextualUserFragment for UserShellCommand {
-    const ROLE: &'static str = "user";
-    const START_MARKER: &'static str = "<user_shell_command>";
-    const END_MARKER: &'static str = "</user_shell_command>";
+    fn role() -> &'static str {
+        "user"
+    }
+
+    fn markers(&self) -> (&'static str, &'static str) {
+        Self::type_markers()
+    }
+
+    fn type_markers() -> (&'static str, &'static str) {
+        ("<user_shell_command>", "</user_shell_command>")
+    }
 
     fn body(&self) -> String {
         format!(
diff --git a/codex-rs/core/src/context_manager/history.rs b/codex-rs/core/src/context_manager/history.rs
index 80c057e0eb..cfd9297382 100644
--- a/codex-rs/core/src/context_manager/history.rs
+++ b/codex-rs/core/src/context_manager/history.rs
@@ -400,6 +400,7 @@ impl ContextManager {
             | ResponseItem::ImageGenerationCall { .. }
             | ResponseItem::CustomToolCall { .. }
             | ResponseItem::Compaction { .. }
+            | ResponseItem::CompactionTrigger
             | ResponseItem::ContextCompaction { .. }
             | ResponseItem::Other => item.clone(),
         }
@@ -490,6 +491,7 @@ fn is_api_message(message: &ResponseItem) -> bool {
         | ResponseItem::ImageGenerationCall { .. }
         | ResponseItem::Compaction { .. }
         | ResponseItem::ContextCompaction { .. } => true,
+        ResponseItem::CompactionTrigger => false,
         ResponseItem::Other => false,
     }
 }
@@ -688,6 +690,7 @@ fn is_model_generated_item(item: &ResponseItem) -> bool {
         | ResponseItem::LocalShellCall { .. }
         | ResponseItem::Compaction { .. }
         | ResponseItem::ContextCompaction { .. } => true,
+        ResponseItem::CompactionTrigger => false,
         ResponseItem::FunctionCallOutput { .. }
         | ResponseItem::ToolSearchOutput { .. }
         | ResponseItem::CustomToolCallOutput { .. }
diff --git a/codex-rs/core/src/context_manager/history_tests.rs b/codex-rs/core/src/context_manager/history_tests.rs
index 74f4d29bfb..8ba5d56e32 100644
--- a/codex-rs/core/src/context_manager/history_tests.rs
+++ b/codex-rs/core/src/context_manager/history_tests.rs
@@ -2,7 +2,6 @@ use super::*;
 use base64::Engine;
 use base64::engine::general_purpose::STANDARD as BASE64_STANDARD;
 use codex_protocol::AgentPath;
-use codex_protocol::config_types::ReasoningSummary;
 use codex_protocol::models::BaseInstructions;
 use codex_protocol::models::ContentItem;
 use codex_protocol::models::DEFAULT_IMAGE_DETAIL;
@@ -121,7 +120,6 @@ fn developer_msg_with_fragments(texts: &[&str]) -> ResponseItem {
 fn reference_context_item() -> TurnContextItem {
     TurnContextItem {
         turn_id: Some("reference-turn".to_string()),
-        trace_id: None,
         cwd: PathBuf::from("/tmp/reference-cwd"),
         current_date: Some("2026-03-23".to_string()),
         timezone: Some("America/Los_Angeles".to_string()),
@@ -135,11 +133,7 @@ fn reference_context_item() -> TurnContextItem {
         collaboration_mode: None,
         realtime_active: Some(false),
         effort: None,
-        summary: ReasoningSummary::Auto,
-        user_instructions: None,
-        developer_instructions: None,
-        final_output_json_schema: None,
-        truncation_policy: Some(codex_protocol::protocol::TruncationPolicy::Tokens(10_000)),
+        summary: codex_protocol::config_types::ReasoningSummary::Auto,
     }
 }
 
diff --git a/codex-rs/core/src/context_manager/updates.rs b/codex-rs/core/src/context_manager/updates.rs
index 0cdbc0b010..d7302bbbf8 100644
--- a/codex-rs/core/src/context_manager/updates.rs
+++ b/codex-rs/core/src/context_manager/updates.rs
@@ -61,6 +61,7 @@ fn build_permissions_update_item(
             next.approval_policy.value(),
             next.config.approvals_reviewer,
             exec_policy,
+            #[allow(deprecated)]
             &next.cwd,
             next.features.enabled(Feature::ExecPermissionApprovals),
             next.features.enabled(Feature::RequestPermissionsTool),
diff --git a/codex-rs/core/src/environment_selection.rs b/codex-rs/core/src/environment_selection.rs
index 89808c27ee..749212f70a 100644
--- a/codex-rs/core/src/environment_selection.rs
+++ b/codex-rs/core/src/environment_selection.rs
@@ -106,7 +106,7 @@ mod tests {
         let cwd = AbsolutePathBuf::current_dir().expect("cwd");
         let manager = EnvironmentManager::create_for_tests(
             Some("ws://127.0.0.1:8765".to_string()),
-            test_runtime_paths(),
+            Some(test_runtime_paths()),
         )
         .await;
 
@@ -132,9 +132,10 @@ url = "ws://127.0.0.1:8765"
         )
         .expect("write environments.toml");
         let cwd = AbsolutePathBuf::current_dir().expect("cwd");
-        let manager = EnvironmentManager::from_codex_home(temp_dir.path(), test_runtime_paths())
-            .await
-            .expect("environment manager");
+        let manager =
+            EnvironmentManager::from_codex_home(temp_dir.path(), Some(test_runtime_paths()))
+                .await
+                .expect("environment manager");
 
         assert_eq!(
             default_thread_environment_selections(&manager, &cwd),
@@ -154,7 +155,7 @@ url = "ws://127.0.0.1:8765"
     #[tokio::test]
     async fn default_thread_environment_selections_empty_when_default_disabled() {
         let cwd = AbsolutePathBuf::current_dir().expect("cwd");
-        let manager = EnvironmentManager::disabled_for_tests(test_runtime_paths());
+        let manager = EnvironmentManager::without_environments();
 
         assert_eq!(
             default_thread_environment_selections(&manager, &cwd),
diff --git a/codex-rs/core/src/event_mapping.rs b/codex-rs/core/src/event_mapping.rs
index e7c79e6dd2..d3cae7feed 100644
--- a/codex-rs/core/src/event_mapping.rs
+++ b/codex-rs/core/src/event_mapping.rs
@@ -90,9 +90,10 @@ fn parse_user_message(message: &[ContentItem]) -> Option<UserMessageItem> {
                     text_elements: Vec::new(),
                 });
             }
-            ContentItem::InputImage { image_url, .. } => {
+            ContentItem::InputImage { image_url, detail } => {
                 content.push(UserInput::Image {
                     image_url: image_url.clone(),
+                    detail: *detail,
                 });
             }
             ContentItem::OutputText { text } => {
diff --git a/codex-rs/core/src/event_mapping_tests.rs b/codex-rs/core/src/event_mapping_tests.rs
index a70b2a69b0..c8311440eb 100644
--- a/codex-rs/core/src/event_mapping_tests.rs
+++ b/codex-rs/core/src/event_mapping_tests.rs
@@ -48,8 +48,14 @@ fn parses_user_message_with_text_and_two_images() {
                     text: "Hello world".to_string(),
                     text_elements: Vec::new(),
                 },
-                UserInput::Image { image_url: img1 },
-                UserInput::Image { image_url: img2 },
+                UserInput::Image {
+                    image_url: img1,
+                    detail: Some(DEFAULT_IMAGE_DETAIL),
+                },
+                UserInput::Image {
+                    image_url: img2,
+                    detail: Some(DEFAULT_IMAGE_DETAIL),
+                },
             ];
             assert_eq!(user.content, expected_content);
         }
@@ -87,7 +93,10 @@ fn skips_local_image_label_text() {
     match turn_item {
         TurnItem::UserMessage(user) => {
             let expected_content = vec![
-                UserInput::Image { image_url },
+                UserInput::Image {
+                    image_url,
+                    detail: Some(DEFAULT_IMAGE_DETAIL),
+                },
                 UserInput::Text {
                     text: user_text,
                     text_elements: Vec::new(),
@@ -165,7 +174,10 @@ fn skips_unnamed_image_label_text() {
     match turn_item {
         TurnItem::UserMessage(user) => {
             let expected_content = vec![
-                UserInput::Image { image_url },
+                UserInput::Image {
+                    image_url,
+                    detail: Some(DEFAULT_IMAGE_DETAIL),
+                },
                 UserInput::Text {
                     text: user_text,
                     text_elements: Vec::new(),
diff --git a/codex-rs/core/src/exec_policy_tests.rs b/codex-rs/core/src/exec_policy_tests.rs
index 776aa8e54f..7b0883db2a 100644
--- a/codex-rs/core/src/exec_policy_tests.rs
+++ b/codex-rs/core/src/exec_policy_tests.rs
@@ -23,7 +23,6 @@ use codex_protocol::permissions::FileSystemSpecialPath;
 use codex_protocol::permissions::NetworkSandboxPolicy;
 use codex_protocol::protocol::AskForApproval;
 use codex_protocol::protocol::GranularApprovalConfig;
-use codex_protocol::protocol::SandboxPolicy;
 use codex_utils_absolute_path::AbsolutePathBuf;
 use pretty_assertions::assert_eq;
 use std::fs;
@@ -130,10 +129,6 @@ fn external_file_system_sandbox_policy() -> FileSystemSandboxPolicy {
     FileSystemSandboxPolicy::external_sandbox()
 }
 
-fn permission_profile_from_sandbox_policy(sandbox_policy: &SandboxPolicy) -> PermissionProfile {
-    PermissionProfile::from_legacy_sandbox_policy(sandbox_policy)
-}
-
 async fn test_config() -> (TempDir, Config) {
     let home = TempDir::new().expect("create temp dir");
     let config = ConfigBuilder::without_managed_config_for_tests()
@@ -260,6 +255,26 @@ async fn returns_empty_policy_when_no_policy_files_exist() {
     assert!(!temp_dir.path().join(RULES_DIR_NAME).exists());
 }
 
+#[tokio::test]
+async fn rules_path_file_returns_read_dir_error() {
+    let temp_dir = tempdir().expect("create temp dir");
+    let rules_path = temp_dir.path().join(RULES_DIR_NAME);
+    fs::write(&rules_path, "rules should be a directory").expect("write malformed rules path");
+    let config_stack = config_stack_for_dot_codex_folder(temp_dir.path());
+
+    let err = load_exec_policy(&config_stack)
+        .await
+        .expect_err("rules file should fail policy loading");
+
+    assert!(
+        matches!(
+            err,
+            ExecPolicyError::ReadDir { ref dir, .. } if dir == &rules_path
+        ),
+        "expected malformed rules path to surface as ReadDir, got {err:?}"
+    );
+}
+
 #[tokio::test]
 async fn collect_policy_files_returns_empty_when_dir_missing() {
     let temp_dir = tempdir().expect("create temp dir");
@@ -592,6 +607,7 @@ async fn loads_policies_from_multiple_config_layers() -> anyhow::Result<()> {
         ConfigLayerEntry::new(
             ConfigLayerSource::User {
                 file: user_config_toml,
+                profile: None,
             },
             TomlValue::Table(Default::default()),
         ),
@@ -648,7 +664,7 @@ async fn evaluates_bash_lc_inner_commands() {
                 "rm -rf /some/important/folder".to_string(),
             ],
             approval_policy: AskForApproval::OnRequest,
-            sandbox_policy: SandboxPolicy::DangerFullAccess,
+            permission_profile: PermissionProfile::Disabled,
             file_system_sandbox_policy: unrestricted_file_system_sandbox_policy(),
             sandbox_permissions: SandboxPermissions::UseDefault,
             prefix_rule: None,
@@ -744,7 +760,7 @@ async fn evaluates_heredoc_script_against_prefix_rules() {
             policy_src: Some(r#"prefix_rule(pattern=["python3"], decision="allow")"#.to_string()),
             command,
             approval_policy: AskForApproval::OnRequest,
-            sandbox_policy: SandboxPolicy::new_read_only_policy(),
+            permission_profile: PermissionProfile::read_only(),
             file_system_sandbox_policy: read_only_file_system_sandbox_policy(),
             sandbox_permissions: SandboxPermissions::UseDefault,
             prefix_rule: None,
@@ -768,7 +784,7 @@ async fn omits_auto_amendment_for_heredoc_fallback_prompts() {
                 "python3 <<'PY'\nprint('hello')\nPY".to_string(),
             ],
             approval_policy: AskForApproval::UnlessTrusted,
-            sandbox_policy: SandboxPolicy::new_read_only_policy(),
+            permission_profile: PermissionProfile::read_only(),
             file_system_sandbox_policy: read_only_file_system_sandbox_policy(),
             sandbox_permissions: SandboxPermissions::UseDefault,
             prefix_rule: None,
@@ -792,7 +808,7 @@ async fn drops_requested_amendment_for_heredoc_fallback_prompts_when_it_wont_mat
                 "python3 <<'PY'\nprint('hello')\nPY".to_string(),
             ],
             approval_policy: AskForApproval::UnlessTrusted,
-            sandbox_policy: SandboxPolicy::new_read_only_policy(),
+            permission_profile: PermissionProfile::read_only(),
             file_system_sandbox_policy: read_only_file_system_sandbox_policy(),
             sandbox_permissions: SandboxPermissions::UseDefault,
             prefix_rule: Some(vec![
@@ -820,7 +836,7 @@ async fn drops_requested_amendment_for_heredoc_fallback_prompts_when_it_matches(
                 "python3 <<'PY'\nprint('hello')\nPY".to_string(),
             ],
             approval_policy: AskForApproval::UnlessTrusted,
-            sandbox_policy: SandboxPolicy::new_read_only_policy(),
+            permission_profile: PermissionProfile::read_only(),
             file_system_sandbox_policy: read_only_file_system_sandbox_policy(),
             sandbox_permissions: SandboxPermissions::UseDefault,
             prefix_rule: Some(vec!["python3".to_string()]),
@@ -845,7 +861,7 @@ async fn heredoc_with_variable_assignment_is_not_reduced_to_allowed_prefix() {
                 "PATH=/tmp/evil:$PATH cat <<'EOF'\nhello\nEOF".to_string(),
             ],
             approval_policy: AskForApproval::OnRequest,
-            sandbox_policy: SandboxPolicy::new_read_only_policy(),
+            permission_profile: PermissionProfile::read_only(),
             file_system_sandbox_policy: read_only_file_system_sandbox_policy(),
             sandbox_permissions: SandboxPermissions::UseDefault,
             prefix_rule: None,
@@ -876,7 +892,7 @@ EOF"#
                     .to_string(),
             ],
             approval_policy: AskForApproval::OnRequest,
-            sandbox_policy: SandboxPolicy::new_workspace_write_policy(),
+            permission_profile: PermissionProfile::workspace_write(),
             file_system_sandbox_policy: workspace_write_file_system_sandbox_policy(),
             sandbox_permissions: SandboxPermissions::UseDefault,
             prefix_rule: None,
@@ -910,7 +926,7 @@ EOF"#
                     .to_string(),
             ],
             approval_policy: AskForApproval::OnRequest,
-            sandbox_policy: SandboxPolicy::new_workspace_write_policy(),
+            permission_profile: PermissionProfile::workspace_write(),
             file_system_sandbox_policy: workspace_write_file_system_sandbox_policy(),
             sandbox_permissions: SandboxPermissions::RequireEscalated,
             prefix_rule: None,
@@ -950,7 +966,7 @@ prefix_rule(
                 "/some/important/folder".to_string(),
             ],
             approval_policy: AskForApproval::OnRequest,
-            sandbox_policy: SandboxPolicy::DangerFullAccess,
+            permission_profile: PermissionProfile::Disabled,
             file_system_sandbox_policy: unrestricted_file_system_sandbox_policy(),
             sandbox_permissions: SandboxPermissions::UseDefault,
             prefix_rule: None,
@@ -969,7 +985,7 @@ async fn exec_approval_requirement_prefers_execpolicy_match() {
             policy_src: Some(r#"prefix_rule(pattern=["rm"], decision="prompt")"#.to_string()),
             command: vec!["rm".to_string()],
             approval_policy: AskForApproval::OnRequest,
-            sandbox_policy: SandboxPolicy::DangerFullAccess,
+            permission_profile: PermissionProfile::Disabled,
             file_system_sandbox_policy: unrestricted_file_system_sandbox_policy(),
             sandbox_permissions: SandboxPermissions::UseDefault,
             prefix_rule: None,
@@ -997,7 +1013,7 @@ prefix_rule(pattern=["git"], decision="allow")
             policy_src: Some(policy_src),
             command: vec![git_path, "status".to_string()],
             approval_policy: AskForApproval::UnlessTrusted,
-            sandbox_policy: SandboxPolicy::new_read_only_policy(),
+            permission_profile: PermissionProfile::read_only(),
             file_system_sandbox_policy: read_only_file_system_sandbox_policy(),
             sandbox_permissions: SandboxPermissions::UseDefault,
             prefix_rule: None,
@@ -1031,7 +1047,7 @@ prefix_rule(pattern=["git"], decision="prompt")
             policy_src: Some(policy_src),
             command: vec![disallowed_git_path.clone(), "status".to_string()],
             approval_policy: AskForApproval::UnlessTrusted,
-            sandbox_policy: SandboxPolicy::new_read_only_policy(),
+            permission_profile: PermissionProfile::read_only(),
             file_system_sandbox_policy: read_only_file_system_sandbox_policy(),
             sandbox_permissions: SandboxPermissions::UseDefault,
             prefix_rule: None,
@@ -1058,7 +1074,7 @@ async fn requested_prefix_rule_can_approve_absolute_path_commands() {
                 "cargo-insta".to_string(),
             ],
             approval_policy: AskForApproval::UnlessTrusted,
-            sandbox_policy: SandboxPolicy::new_read_only_policy(),
+            permission_profile: PermissionProfile::read_only(),
             file_system_sandbox_policy: read_only_file_system_sandbox_policy(),
             sandbox_permissions: SandboxPermissions::UseDefault,
             prefix_rule: Some(vec!["cargo".to_string(), "install".to_string()]),
@@ -1081,7 +1097,7 @@ async fn exec_approval_requirement_respects_approval_policy() {
             policy_src: Some(r#"prefix_rule(pattern=["rm"], decision="prompt")"#.to_string()),
             command: vec!["rm".to_string()],
             approval_policy: AskForApproval::Never,
-            sandbox_policy: SandboxPolicy::DangerFullAccess,
+            permission_profile: PermissionProfile::Disabled,
             file_system_sandbox_policy: unrestricted_file_system_sandbox_policy(),
             sandbox_permissions: SandboxPermissions::UseDefault,
             prefix_rule: None,
@@ -1109,9 +1125,7 @@ fn unmatched_granular_policy_still_prompts_for_restricted_sandbox_escalation() {
                     request_permissions: true,
                     mcp_elicitations: true,
                 }),
-                permission_profile: &permission_profile_from_sandbox_policy(
-                    &SandboxPolicy::new_read_only_policy(),
-                ),
+                permission_profile: &PermissionProfile::read_only(),
                 file_system_sandbox_policy: &read_only_file_system_sandbox_policy(),
                 sandbox_cwd: Path::new("/tmp"),
                 sandbox_permissions: SandboxPermissions::RequireEscalated,
@@ -1154,9 +1168,7 @@ fn known_safe_on_request_still_prompts_for_restricted_sandbox_escalation() {
             &command,
             UnmatchedCommandContext {
                 approval_policy: AskForApproval::OnRequest,
-                permission_profile: &permission_profile_from_sandbox_policy(
-                    &SandboxPolicy::new_workspace_write_policy(),
-                ),
+                permission_profile: &PermissionProfile::workspace_write(),
                 file_system_sandbox_policy: &workspace_write_file_system_sandbox_policy(),
                 sandbox_cwd: Path::new("/tmp"),
                 sandbox_permissions: SandboxPermissions::RequireEscalated,
@@ -1237,7 +1249,7 @@ async fn exec_approval_requirement_prompts_for_inline_additional_permissions_und
                 "touch requested-dir/requested-but-unused.txt".to_string(),
             ],
             approval_policy: AskForApproval::OnRequest,
-            sandbox_policy: SandboxPolicy::new_read_only_policy(),
+            permission_profile: PermissionProfile::read_only(),
             file_system_sandbox_policy: read_only_file_system_sandbox_policy(),
             sandbox_permissions: SandboxPermissions::WithAdditionalPermissions,
             prefix_rule: None,
@@ -1260,7 +1272,7 @@ async fn exec_approval_requirement_prompts_for_known_safe_escalation_under_on_re
             policy_src: None,
             command: vec!["echo".to_string(), "hello".to_string()],
             approval_policy: AskForApproval::OnRequest,
-            sandbox_policy: SandboxPolicy::new_workspace_write_policy(),
+            permission_profile: PermissionProfile::workspace_write(),
             file_system_sandbox_policy: workspace_write_file_system_sandbox_policy(),
             sandbox_permissions: SandboxPermissions::RequireEscalated,
             prefix_rule: None,
@@ -1290,7 +1302,7 @@ async fn exec_approval_requirement_rejects_known_safe_escalation_when_granular_s
                 request_permissions: true,
                 mcp_elicitations: true,
             }),
-            sandbox_policy: SandboxPolicy::new_workspace_write_policy(),
+            permission_profile: PermissionProfile::workspace_write(),
             file_system_sandbox_policy: workspace_write_file_system_sandbox_policy(),
             sandbox_permissions: SandboxPermissions::RequireEscalated,
             prefix_rule: None,
@@ -1316,7 +1328,7 @@ async fn exec_approval_requirement_rejects_unmatched_sandbox_escalation_when_gra
                 request_permissions: true,
                 mcp_elicitations: true,
             }),
-            sandbox_policy: SandboxPolicy::new_read_only_policy(),
+            permission_profile: PermissionProfile::read_only(),
             file_system_sandbox_policy: read_only_file_system_sandbox_policy(),
             sandbox_permissions: SandboxPermissions::RequireEscalated,
             prefix_rule: None,
@@ -1352,9 +1364,7 @@ async fn mixed_rule_and_sandbox_prompt_prioritizes_rule_for_rejection_decision()
                 request_permissions: true,
                 mcp_elicitations: true,
             }),
-            permission_profile: permission_profile_from_sandbox_policy(
-                &SandboxPolicy::new_read_only_policy(),
-            ),
+            permission_profile: PermissionProfile::read_only(),
             file_system_sandbox_policy: &read_only_file_system_sandbox_policy(),
             sandbox_cwd: Path::new("/tmp"),
             sandbox_permissions: SandboxPermissions::RequireEscalated,
@@ -1392,9 +1402,7 @@ async fn mixed_rule_and_sandbox_prompt_rejects_when_granular_rules_are_disabled(
                 request_permissions: true,
                 mcp_elicitations: true,
             }),
-            permission_profile: permission_profile_from_sandbox_policy(
-                &SandboxPolicy::new_read_only_policy(),
-            ),
+            permission_profile: PermissionProfile::read_only(),
             file_system_sandbox_policy: &read_only_file_system_sandbox_policy(),
             sandbox_cwd: Path::new("/tmp"),
             sandbox_permissions: SandboxPermissions::RequireEscalated,
@@ -1419,9 +1427,7 @@ async fn exec_approval_requirement_falls_back_to_heuristics() {
         .create_exec_approval_requirement_for_command(ExecApprovalRequest {
             command: &command,
             approval_policy: AskForApproval::UnlessTrusted,
-            permission_profile: permission_profile_from_sandbox_policy(
-                &SandboxPolicy::new_read_only_policy(),
-            ),
+            permission_profile: PermissionProfile::read_only(),
             file_system_sandbox_policy: &read_only_file_system_sandbox_policy(),
             sandbox_cwd: Path::new("/tmp"),
             sandbox_permissions: SandboxPermissions::UseDefault,
@@ -1447,9 +1453,7 @@ async fn empty_bash_lc_script_falls_back_to_original_command() {
         .create_exec_approval_requirement_for_command(ExecApprovalRequest {
             command: &command,
             approval_policy: AskForApproval::UnlessTrusted,
-            permission_profile: permission_profile_from_sandbox_policy(
-                &SandboxPolicy::new_read_only_policy(),
-            ),
+            permission_profile: PermissionProfile::read_only(),
             file_system_sandbox_policy: &read_only_file_system_sandbox_policy(),
             sandbox_cwd: Path::new("/tmp"),
             sandbox_permissions: SandboxPermissions::UseDefault,
@@ -1479,9 +1483,7 @@ async fn whitespace_bash_lc_script_falls_back_to_original_command() {
         .create_exec_approval_requirement_for_command(ExecApprovalRequest {
             command: &command,
             approval_policy: AskForApproval::UnlessTrusted,
-            permission_profile: permission_profile_from_sandbox_policy(
-                &SandboxPolicy::new_read_only_policy(),
-            ),
+            permission_profile: PermissionProfile::read_only(),
             file_system_sandbox_policy: &read_only_file_system_sandbox_policy(),
             sandbox_cwd: Path::new("/tmp"),
             sandbox_permissions: SandboxPermissions::UseDefault,
@@ -1511,9 +1513,7 @@ async fn request_rule_uses_prefix_rule() {
         .create_exec_approval_requirement_for_command(ExecApprovalRequest {
             command: &command,
             approval_policy: AskForApproval::OnRequest,
-            permission_profile: permission_profile_from_sandbox_policy(
-                &SandboxPolicy::new_read_only_policy(),
-            ),
+            permission_profile: PermissionProfile::read_only(),
             file_system_sandbox_policy: &read_only_file_system_sandbox_policy(),
             sandbox_cwd: Path::new("/tmp"),
             sandbox_permissions: SandboxPermissions::RequireEscalated,
@@ -1662,7 +1662,7 @@ async fn proposed_execpolicy_amendment_is_present_for_single_command_without_pol
             policy_src: None,
             command: command.clone(),
             approval_policy: AskForApproval::UnlessTrusted,
-            sandbox_policy: SandboxPolicy::new_read_only_policy(),
+            permission_profile: PermissionProfile::read_only(),
             file_system_sandbox_policy: read_only_file_system_sandbox_policy(),
             sandbox_permissions: SandboxPermissions::UseDefault,
             prefix_rule: None,
@@ -1682,7 +1682,7 @@ async fn proposed_execpolicy_amendment_is_omitted_when_policy_prompts() {
             policy_src: Some(r#"prefix_rule(pattern=["rm"], decision="prompt")"#.to_string()),
             command: vec!["rm".to_string()],
             approval_policy: AskForApproval::OnRequest,
-            sandbox_policy: SandboxPolicy::DangerFullAccess,
+            permission_profile: PermissionProfile::Disabled,
             file_system_sandbox_policy: unrestricted_file_system_sandbox_policy(),
             sandbox_permissions: SandboxPermissions::UseDefault,
             prefix_rule: None,
@@ -1706,7 +1706,7 @@ async fn proposed_execpolicy_amendment_is_present_for_multi_command_scripts() {
                 "cargo build && echo ok".to_string(),
             ],
             approval_policy: AskForApproval::UnlessTrusted,
-            sandbox_policy: SandboxPolicy::new_read_only_policy(),
+            permission_profile: PermissionProfile::read_only(),
             file_system_sandbox_policy: read_only_file_system_sandbox_policy(),
             sandbox_permissions: SandboxPermissions::UseDefault,
             prefix_rule: None,
@@ -1736,7 +1736,7 @@ async fn proposed_execpolicy_amendment_uses_first_no_match_in_multi_command_scri
             policy_src: Some(policy_src.to_string()),
             command,
             approval_policy: AskForApproval::UnlessTrusted,
-            sandbox_policy: SandboxPolicy::new_read_only_policy(),
+            permission_profile: PermissionProfile::read_only(),
             file_system_sandbox_policy: read_only_file_system_sandbox_policy(),
             sandbox_permissions: SandboxPermissions::UseDefault,
             prefix_rule: None,
@@ -1760,7 +1760,7 @@ async fn proposed_execpolicy_amendment_is_present_when_heuristics_allow() {
             policy_src: None,
             command: command.clone(),
             approval_policy: AskForApproval::OnRequest,
-            sandbox_policy: SandboxPolicy::new_read_only_policy(),
+            permission_profile: PermissionProfile::read_only(),
             file_system_sandbox_policy: read_only_file_system_sandbox_policy(),
             sandbox_permissions: SandboxPermissions::UseDefault,
             prefix_rule: None,
@@ -1784,7 +1784,7 @@ async fn proposed_execpolicy_amendment_is_suppressed_when_policy_matches_allow()
                 "print(1)".to_string(),
             ],
             approval_policy: AskForApproval::OnRequest,
-            sandbox_policy: SandboxPolicy::new_read_only_policy(),
+            permission_profile: PermissionProfile::read_only(),
             file_system_sandbox_policy: read_only_file_system_sandbox_policy(),
             sandbox_permissions: SandboxPermissions::UseDefault,
             prefix_rule: None,
@@ -1815,7 +1815,7 @@ prefix_rule(pattern=["cat"], decision="allow")
                 policy_src: Some(policy_src.to_string()),
                 command: command.clone(),
                 approval_policy,
-                sandbox_policy: SandboxPolicy::new_workspace_write_policy(),
+                permission_profile: PermissionProfile::workspace_write(),
                 file_system_sandbox_policy: workspace_write_file_system_sandbox_policy(),
                 sandbox_permissions: SandboxPermissions::UseDefault,
                 prefix_rule: None,
@@ -1847,7 +1847,7 @@ prefix_rule(pattern=["bash"], decision="allow")
                     .to_string(),
             ],
             approval_policy: AskForApproval::OnRequest,
-            sandbox_policy: SandboxPolicy::new_read_only_policy(),
+            permission_profile: PermissionProfile::read_only(),
             file_system_sandbox_policy: read_only_file_system_sandbox_policy(),
             sandbox_permissions: SandboxPermissions::UseDefault,
             prefix_rule: None,
@@ -2013,7 +2013,7 @@ async fn dangerous_rm_rf_requires_approval_in_danger_full_access() {
             policy_src: None,
             command: command.clone(),
             approval_policy: AskForApproval::OnRequest,
-            sandbox_policy: SandboxPolicy::DangerFullAccess,
+            permission_profile: PermissionProfile::Disabled,
             file_system_sandbox_policy: unrestricted_file_system_sandbox_policy(),
             sandbox_permissions: SandboxPermissions::UseDefault,
             prefix_rule: None,
@@ -2077,9 +2077,7 @@ async fn verify_approval_requirement_for_unsafe_powershell_command() {
             .create_exec_approval_requirement_for_command(ExecApprovalRequest {
                 command: &sneaky_command,
                 approval_policy: AskForApproval::OnRequest,
-                permission_profile: permission_profile_from_sandbox_policy(
-                    &SandboxPolicy::new_read_only_policy(),
-                ),
+                permission_profile: PermissionProfile::read_only(),
                 file_system_sandbox_policy: &read_only_file_system_sandbox_policy(),
                 sandbox_cwd: Path::new("/tmp"),
                 sandbox_permissions: permissions,
@@ -2104,9 +2102,7 @@ async fn verify_approval_requirement_for_unsafe_powershell_command() {
             .create_exec_approval_requirement_for_command(ExecApprovalRequest {
                 command: &dangerous_command,
                 approval_policy: AskForApproval::OnRequest,
-                permission_profile: permission_profile_from_sandbox_policy(
-                    &SandboxPolicy::new_read_only_policy(),
-                ),
+                permission_profile: PermissionProfile::read_only(),
                 file_system_sandbox_policy: &read_only_file_system_sandbox_policy(),
                 sandbox_cwd: Path::new("/tmp"),
                 sandbox_permissions: permissions,
@@ -2127,9 +2123,7 @@ async fn verify_approval_requirement_for_unsafe_powershell_command() {
             .create_exec_approval_requirement_for_command(ExecApprovalRequest {
                 command: &dangerous_command,
                 approval_policy: AskForApproval::Never,
-                permission_profile: permission_profile_from_sandbox_policy(
-                    &SandboxPolicy::new_read_only_policy(),
-                ),
+                permission_profile: PermissionProfile::read_only(),
                 file_system_sandbox_policy: &read_only_file_system_sandbox_policy(),
                 sandbox_cwd: Path::new("/tmp"),
                 sandbox_permissions: permissions,
@@ -2149,8 +2143,8 @@ async fn dangerous_command_allowed_when_sandbox_is_explicitly_disabled() {
             policy_src: None,
             command,
             approval_policy: AskForApproval::Never,
-            sandbox_policy: SandboxPolicy::ExternalSandbox {
-                network_access: Default::default(),
+            permission_profile: PermissionProfile::External {
+                network: NetworkSandboxPolicy::Restricted,
             },
             file_system_sandbox_policy: external_file_system_sandbox_policy(),
             sandbox_permissions: SandboxPermissions::UseDefault,
@@ -2174,8 +2168,8 @@ async fn dangerous_command_forbidden_in_external_sandbox_when_policy_matches() {
             policy_src: Some("prefix_rule(pattern=['rm'], decision='prompt')".to_string()),
             command,
             approval_policy: AskForApproval::Never,
-            sandbox_policy: SandboxPolicy::ExternalSandbox {
-                network_access: Default::default(),
+            permission_profile: PermissionProfile::External {
+                network: NetworkSandboxPolicy::Restricted,
             },
             file_system_sandbox_policy: external_file_system_sandbox_policy(),
             sandbox_permissions: SandboxPermissions::UseDefault,
@@ -2193,7 +2187,7 @@ struct ExecApprovalRequirementScenario {
     policy_src: Option<String>,
     command: Vec<String>,
     approval_policy: AskForApproval,
-    sandbox_policy: SandboxPolicy,
+    permission_profile: PermissionProfile,
     file_system_sandbox_policy: FileSystemSandboxPolicy,
     sandbox_permissions: SandboxPermissions,
     prefix_rule: Option<Vec<String>>,
@@ -2217,7 +2211,7 @@ async fn exec_approval_requirement_for_command(
         policy_src,
         command,
         approval_policy,
-        sandbox_policy,
+        permission_profile,
         file_system_sandbox_policy,
         sandbox_permissions,
         prefix_rule,
@@ -2225,7 +2219,6 @@ async fn exec_approval_requirement_for_command(
 
     let policy = policy_from_src(policy_src.as_deref());
 
-    let permission_profile = permission_profile_from_sandbox_policy(&sandbox_policy);
     ExecPolicyManager::new(policy)
         .create_exec_approval_requirement_for_command(ExecApprovalRequest {
             command: &command,
diff --git a/codex-rs/core/src/exec_policy_windows_tests.rs b/codex-rs/core/src/exec_policy_windows_tests.rs
index c1552f7e12..1d14d93813 100644
--- a/codex-rs/core/src/exec_policy_windows_tests.rs
+++ b/codex-rs/core/src/exec_policy_windows_tests.rs
@@ -14,7 +14,7 @@ async fn evaluates_powershell_inner_commands_against_prompt_rules() {
                 "echo blocked".to_string(),
             ],
             approval_policy: AskForApproval::Never,
-            sandbox_policy: SandboxPolicy::DangerFullAccess,
+            permission_profile: PermissionProfile::Disabled,
             file_system_sandbox_policy: unrestricted_file_system_sandbox_policy(),
             sandbox_permissions: SandboxPermissions::UseDefault,
             prefix_rule: None,
@@ -38,7 +38,7 @@ async fn evaluates_powershell_inner_commands_against_allow_rules() {
                 "echo blocked".to_string(),
             ],
             approval_policy: AskForApproval::UnlessTrusted,
-            sandbox_policy: SandboxPolicy::new_read_only_policy(),
+            permission_profile: PermissionProfile::read_only(),
             file_system_sandbox_policy: read_only_file_system_sandbox_policy(),
             sandbox_permissions: SandboxPermissions::UseDefault,
             prefix_rule: None,
@@ -80,9 +80,7 @@ fn unmatched_safe_powershell_words_are_allowed() {
             &command,
             UnmatchedCommandContext {
                 approval_policy: AskForApproval::UnlessTrusted,
-                permission_profile: &permission_profile_from_sandbox_policy(
-                    &SandboxPolicy::new_read_only_policy(),
-                ),
+                permission_profile: &PermissionProfile::read_only(),
                 file_system_sandbox_policy: &read_only_file_system_sandbox_policy(),
                 sandbox_cwd: Path::new("/tmp"),
                 sandbox_permissions: SandboxPermissions::UseDefault,
@@ -111,7 +109,7 @@ async fn unmatched_dangerous_powershell_inner_commands_require_approval() {
                 "Remove-Item test -Force".to_string(),
             ],
             approval_policy: AskForApproval::OnRequest,
-            sandbox_policy: SandboxPolicy::DangerFullAccess,
+            permission_profile: PermissionProfile::Disabled,
             file_system_sandbox_policy: unrestricted_file_system_sandbox_policy(),
             sandbox_permissions: SandboxPermissions::UseDefault,
             prefix_rule: None,
diff --git a/codex-rs/core/src/exec_tests.rs b/codex-rs/core/src/exec_tests.rs
index 1e802121a1..23db019bb9 100644
--- a/codex-rs/core/src/exec_tests.rs
+++ b/codex-rs/core/src/exec_tests.rs
@@ -347,8 +347,7 @@ async fn process_exec_tool_call_preserves_full_buffer_capture_policy() -> Result
     ];
 
     let cwd = codex_utils_absolute_path::AbsolutePathBuf::current_dir()?;
-    let sandbox_policy = SandboxPolicy::DangerFullAccess;
-    let permission_profile = PermissionProfile::from_legacy_sandbox_policy(&sandbox_policy);
+    let permission_profile = PermissionProfile::Disabled;
     let output = process_exec_tool_call(
         ExecParams {
             command,
@@ -699,7 +698,7 @@ fn windows_restricted_token_rejects_unreadable_split_carveouts() {
         },
         codex_protocol::permissions::FileSystemSandboxEntry {
             path: codex_protocol::permissions::FileSystemPath::Path { path: blocked },
-            access: codex_protocol::permissions::FileSystemAccessMode::None,
+            access: codex_protocol::permissions::FileSystemAccessMode::Deny,
         },
     ]);
 
@@ -847,7 +846,7 @@ fn windows_elevated_supports_unreadable_split_carveouts() {
                 path: codex_utils_absolute_path::AbsolutePathBuf::from_absolute_path(&blocked)
                     .expect("absolute blocked"),
             },
-            access: codex_protocol::permissions::FileSystemAccessMode::None,
+            access: codex_protocol::permissions::FileSystemAccessMode::Deny,
         },
     ]);
 
@@ -909,7 +908,7 @@ fn windows_elevated_supports_unreadable_globs() {
             path: codex_protocol::permissions::FileSystemPath::GlobPattern {
                 pattern: "**/*.env".to_string(),
             },
-            access: codex_protocol::permissions::FileSystemAccessMode::None,
+            access: codex_protocol::permissions::FileSystemAccessMode::Deny,
         },
     ]);
 
diff --git a/codex-rs/core/src/git_info_tests.rs b/codex-rs/core/src/git_info_tests.rs
index 0ffdd1c4df..946779d06b 100644
--- a/codex-rs/core/src/git_info_tests.rs
+++ b/codex-rs/core/src/git_info_tests.rs
@@ -2,6 +2,7 @@ use codex_exec_server::LOCAL_FS;
 use codex_git_utils::GitInfo;
 use codex_git_utils::GitSha;
 use codex_git_utils::collect_git_info;
+use codex_git_utils::get_git_repo_root_with_fs;
 use codex_git_utils::get_has_changes;
 use codex_git_utils::git_diff_to_remote;
 use codex_git_utils::recent_commits;
@@ -11,6 +12,8 @@ use core_test_support::PathBufExt;
 use core_test_support::PathExt;
 use core_test_support::skip_if_sandbox;
 use std::fs;
+#[cfg(unix)]
+use std::os::unix::fs::PermissionsExt;
 use std::path::PathBuf;
 use tempfile::TempDir;
 use tokio::process::Command;
@@ -337,6 +340,90 @@ async fn test_get_has_changes_with_untracked_change_returns_true() {
     assert_eq!(get_has_changes(&repo_path).await, Some(true));
 }
 
+#[cfg(unix)]
+#[tokio::test]
+async fn test_get_has_changes_ignores_repo_fsmonitor_config() {
+    let temp_dir = TempDir::new().expect("Failed to create temp dir");
+    let repo_path = create_test_git_repo(&temp_dir).await;
+    let helper_path = repo_path.join("fsmonitor-helper.sh");
+    let marker_path = repo_path.join("fsmonitor-ran");
+
+    fs::write(
+        &helper_path,
+        format!(
+            "#!/bin/sh\nprintf ran > \"{}\"\n",
+            marker_path.to_string_lossy()
+        ),
+    )
+    .expect("write fsmonitor helper");
+    let mut permissions = fs::metadata(&helper_path)
+        .expect("read fsmonitor helper metadata")
+        .permissions();
+    permissions.set_mode(0o755);
+    fs::set_permissions(&helper_path, permissions).expect("mark fsmonitor helper executable");
+
+    Command::new("git")
+        .args([
+            "config",
+            "core.fsmonitor",
+            helper_path.to_string_lossy().as_ref(),
+        ])
+        .current_dir(&repo_path)
+        .output()
+        .await
+        .expect("configure fsmonitor helper");
+
+    assert_eq!(get_has_changes(&repo_path).await, Some(true));
+    assert!(
+        !marker_path.exists(),
+        "metadata collection should not invoke repository fsmonitor helpers"
+    );
+}
+
+#[cfg(unix)]
+#[tokio::test]
+async fn test_get_has_changes_ignores_configured_hooks_path() {
+    let temp_dir = TempDir::new().expect("Failed to create temp dir");
+    let repo_path = create_test_git_repo(&temp_dir).await;
+    let hooks_dir = repo_path.join(".git/hooks-path-test");
+    let hook_path = hooks_dir.join("post-index-change");
+    let marker_path = repo_path.join("hook-ran");
+
+    fs::create_dir_all(&hooks_dir).expect("create hook dir");
+    fs::write(
+        &hook_path,
+        format!(
+            "#!/bin/sh\nprintf ran > \"{}\"\n",
+            marker_path.to_string_lossy()
+        ),
+    )
+    .expect("write post-index-change hook");
+    let mut permissions = fs::metadata(&hook_path)
+        .expect("read hook metadata")
+        .permissions();
+    permissions.set_mode(0o755);
+    fs::set_permissions(&hook_path, permissions).expect("mark hook executable");
+
+    Command::new("git")
+        .args([
+            "config",
+            "core.hooksPath",
+            hooks_dir.to_string_lossy().as_ref(),
+        ])
+        .current_dir(&repo_path)
+        .output()
+        .await
+        .expect("configure hooks path");
+
+    fs::write(repo_path.join("test.txt"), "test content").expect("refresh tracked file");
+
+    assert_eq!(get_has_changes(&repo_path).await, Some(false));
+    assert!(
+        !marker_path.exists(),
+        "metadata collection should not invoke configured hook directories"
+    );
+}
+
 #[tokio::test]
 async fn test_get_git_working_tree_state_clean_repo() {
     let temp_dir = TempDir::new().expect("Failed to create temp dir");
@@ -440,6 +527,20 @@ async fn resolve_root_git_project_for_trust_returns_none_outside_repo() {
     );
 }
 
+#[tokio::test]
+async fn get_git_repo_root_with_fs_detects_gitdir_pointer() {
+    let tmp = TempDir::new().expect("tempdir");
+    let proj = tmp.path().join("proj");
+    let nested = proj.join("nested");
+    std::fs::create_dir_all(&nested).unwrap();
+    std::fs::write(proj.join(".git"), "gitdir: /tmp/fake-worktree\n").unwrap();
+
+    assert_eq!(
+        get_git_repo_root_with_fs(LOCAL_FS.as_ref(), &nested.abs()).await,
+        Some(proj.abs())
+    );
+}
+
 #[tokio::test]
 async fn resolve_root_git_project_for_trust_regular_repo_returns_repo_root() {
     let temp_dir = TempDir::new().expect("Failed to create temp dir");
diff --git a/codex-rs/core/src/goals.rs b/codex-rs/core/src/goals.rs
index 4a7a9a3d0b..6843264e44 100644
--- a/codex-rs/core/src/goals.rs
+++ b/codex-rs/core/src/goals.rs
@@ -7,6 +7,7 @@
 use crate::StateDbHandle;
 use crate::context::ContextualUserFragment;
 use crate::context::GoalContext;
+use crate::session::TurnInput;
 use crate::session::session::Session;
 use crate::session::turn_context::TurnContext;
 use crate::state::ActiveTurn;
@@ -15,21 +16,23 @@ use crate::tasks::RegularTask;
 use crate::tools::handlers::goal_spec::UPDATE_GOAL_TOOL_NAME;
 use anyhow::Context;
 use codex_features::Feature;
+use codex_otel::GOAL_BLOCKED_METRIC;
 use codex_otel::GOAL_BUDGET_LIMITED_METRIC;
 use codex_otel::GOAL_COMPLETED_METRIC;
 use codex_otel::GOAL_CREATED_METRIC;
 use codex_otel::GOAL_DURATION_SECONDS_METRIC;
+use codex_otel::GOAL_RESUMED_METRIC;
 use codex_otel::GOAL_TOKEN_COUNT_METRIC;
+use codex_otel::GOAL_USAGE_LIMITED_METRIC;
+use codex_protocol::ThreadId;
 use codex_protocol::config_types::ModeKind;
 use codex_protocol::models::ContentItem;
 use codex_protocol::models::ResponseInputItem;
-use codex_protocol::protocol::Event;
 use codex_protocol::protocol::EventMsg;
 use codex_protocol::protocol::ThreadGoal;
 use codex_protocol::protocol::ThreadGoalStatus;
 use codex_protocol::protocol::ThreadGoalUpdatedEvent;
 use codex_protocol::protocol::TokenUsage;
-use codex_protocol::protocol::TurnAbortReason;
 use codex_protocol::protocol::validate_thread_goal_objective;
 use codex_rollout::state_db::reconcile_rollout;
 use codex_thread_store::LocalThreadStore;
@@ -153,7 +156,9 @@ pub(crate) enum GoalRuntimeEvent<'a> {
     MaybeContinueIfIdle,
     TaskAborted {
         turn_context: Option<&'a TurnContext>,
-        reason: TurnAbortReason,
+    },
+    UsageLimitReached {
+        turn_context: &'a TurnContext,
     },
     ExternalMutationStarting,
     ExternalSet {
@@ -331,8 +336,8 @@ impl Session {
     /// starts capture the active goal and token baseline, tool completions
     /// account usage and may inject budget steering, completion accounting
     /// suppresses that steering, external mutations account best-effort before
-    /// changing state, interrupts pause active goals, thread resumes restore
-    /// runtime state for already-active goals, explicit maybe-continue events
+    /// changing state, thread resumes restore runtime state for already-active
+    /// goals, explicit maybe-continue events
     /// start idle goal continuation turns, and continuation turns with no counted
     /// autonomous activity suppress the next automatic continuation until
     /// user/tool/external activity resets it.
@@ -384,12 +389,13 @@ impl Session {
                 self.maybe_continue_goal_if_idle_runtime().await;
                 Ok(())
             }),
-            GoalRuntimeEvent::TaskAborted {
-                turn_context,
-                reason,
-            } => Box::pin(async move {
-                self.handle_thread_goal_task_abort(turn_context, reason)
-                    .await;
+            GoalRuntimeEvent::TaskAborted { turn_context } => Box::pin(async move {
+                self.handle_thread_goal_task_abort(turn_context).await;
+                Ok(())
+            }),
+            GoalRuntimeEvent::UsageLimitReached { turn_context } => Box::pin(async move {
+                self.usage_limit_active_thread_goal_for_turn(turn_context)
+                    .await?;
                 Ok(())
             }),
             GoalRuntimeEvent::ExternalMutationStarting => Box::pin(async move {
@@ -422,6 +428,7 @@ impl Session {
 
         let state_db = self.require_state_db_for_thread_goals().await?;
         state_db
+            .thread_goals()
             .get_thread_goal(self.conversation_id)
             .await
             .map(|goal| goal.map(protocol_goal_from_state))
@@ -459,10 +466,14 @@ impl Session {
         let mut replacing_goal = false;
         let previous_status;
         let goal = if let Some(objective) = objective.as_deref() {
-            let existing_goal = state_db.get_thread_goal(self.conversation_id).await?;
+            let existing_goal = state_db
+                .thread_goals()
+                .get_thread_goal(self.conversation_id)
+                .await?;
             previous_status = existing_goal.as_ref().map(|goal| goal.status);
             if let Some(existing_goal) = existing_goal.as_ref() {
                 state_db
+                    .thread_goals()
                     .update_thread_goal(
                         self.conversation_id,
                         codex_state::ThreadGoalUpdate {
@@ -482,6 +493,7 @@ impl Session {
             } else {
                 replacing_goal = true;
                 state_db
+                    .thread_goals()
                     .replace_thread_goal(
                         self.conversation_id,
                         objective,
@@ -493,11 +505,15 @@ impl Session {
                     .await?
             }
         } else {
-            let existing_goal = state_db.get_thread_goal(self.conversation_id).await?;
+            let existing_goal = state_db
+                .thread_goals()
+                .get_thread_goal(self.conversation_id)
+                .await?;
             previous_status = existing_goal.as_ref().map(|goal| goal.status);
             let expected_goal_id = existing_goal.map(|goal| goal.goal_id);
             let status = status.map(state_goal_status_from_protocol);
             state_db
+                .thread_goals()
                 .update_thread_goal(
                     self.conversation_id,
                     codex_state::ThreadGoalUpdate {
@@ -516,6 +532,14 @@ impl Session {
                 })?
         };
 
+        if objective.is_some() {
+            set_thread_preview_from_goal_objective(
+                &state_db,
+                self.conversation_id,
+                goal.objective.as_str(),
+            )
+            .await;
+        }
         let goal_status = goal.status;
         let goal_id = goal.goal_id.clone();
         let previous_status_for_goal = if replacing_goal {
@@ -526,6 +550,7 @@ impl Session {
         if replacing_goal {
             self.emit_goal_created_metric();
         }
+        self.emit_goal_resumed_metric_if_status_changed(previous_status_for_goal, goal_status);
         self.emit_goal_terminal_metrics_if_status_changed(previous_status_for_goal, &goal);
         let goal = protocol_goal_from_state(goal);
         *self.goal_runtime.budget_limit_reported_goal_id.lock().await = None;
@@ -581,6 +606,7 @@ impl Session {
         )
         .await?;
         let goal = state_db
+            .thread_goals()
             .insert_thread_goal(
                 self.conversation_id,
                 objective,
@@ -595,6 +621,12 @@ impl Session {
                 )
             })?;
 
+        set_thread_preview_from_goal_objective(
+            &state_db,
+            self.conversation_id,
+            goal.objective.as_str(),
+        )
+        .await;
         let goal_id = goal.goal_id.clone();
         self.emit_goal_created_metric();
         let goal = protocol_goal_from_state(goal);
@@ -641,6 +673,7 @@ impl Session {
         let previous_status = previous_goal
             .as_ref()
             .and_then(|previous_goal| (!replaced_existing_goal).then_some(previous_goal.status));
+        self.emit_goal_resumed_metric_if_status_changed(previous_status, goal.status);
         self.emit_goal_terminal_metrics_if_status_changed(previous_status, &goal);
         let goal_for_steering = objective_changed.then(|| protocol_goal_from_state(goal.clone()));
         let goal_id = goal.goal_id;
@@ -669,7 +702,10 @@ impl Session {
                     self.clear_stopped_thread_goal_runtime_state().await;
                 }
             }
-            codex_state::ThreadGoalStatus::Paused | codex_state::ThreadGoalStatus::Complete => {
+            codex_state::ThreadGoalStatus::Paused
+            | codex_state::ThreadGoalStatus::Blocked
+            | codex_state::ThreadGoalStatus::UsageLimited
+            | codex_state::ThreadGoalStatus::Complete => {
                 self.clear_stopped_thread_goal_runtime_state().await;
             }
         }
@@ -723,6 +759,31 @@ impl Session {
             .counter(GOAL_CREATED_METRIC, /*inc*/ 1, &[]);
     }
 
+    fn emit_goal_resumed_metric(&self) {
+        self.services
+            .session_telemetry
+            .counter(GOAL_RESUMED_METRIC, /*inc*/ 1, &[]);
+    }
+
+    fn emit_goal_resumed_metric_if_status_changed(
+        &self,
+        previous_status: Option<codex_state::ThreadGoalStatus>,
+        goal_status: codex_state::ThreadGoalStatus,
+    ) {
+        if goal_status == codex_state::ThreadGoalStatus::Active
+            && matches!(
+                previous_status,
+                Some(
+                    codex_state::ThreadGoalStatus::Paused
+                        | codex_state::ThreadGoalStatus::Blocked
+                        | codex_state::ThreadGoalStatus::UsageLimited
+                )
+            )
+        {
+            self.emit_goal_resumed_metric();
+        }
+    }
+
     fn emit_goal_terminal_metrics_if_status_changed(
         &self,
         previous_status: Option<codex_state::ThreadGoalStatus>,
@@ -733,6 +794,8 @@ impl Session {
         }
 
         let counter = match goal.status {
+            codex_state::ThreadGoalStatus::Blocked => GOAL_BLOCKED_METRIC,
+            codex_state::ThreadGoalStatus::UsageLimited => GOAL_USAGE_LIMITED_METRIC,
             codex_state::ThreadGoalStatus::BudgetLimited => GOAL_BUDGET_LIMITED_METRIC,
             codex_state::ThreadGoalStatus::Complete => GOAL_COMPLETED_METRIC,
             codex_state::ThreadGoalStatus::Active | codex_state::ThreadGoalStatus::Paused => {
@@ -760,7 +823,10 @@ impl Session {
         state_db: &StateDbHandle,
         expected_goal_id: Option<&str>,
     ) -> anyhow::Result<Option<codex_state::ThreadGoalStatus>> {
-        let goal = state_db.get_thread_goal(self.conversation_id).await?;
+        let goal = state_db
+            .thread_goals()
+            .get_thread_goal(self.conversation_id)
+            .await?;
         Ok(goal.and_then(|goal| {
             expected_goal_id
                 .is_none_or(|expected_goal_id| goal.goal_id == expected_goal_id)
@@ -801,7 +867,11 @@ impl Session {
                 return;
             }
         };
-        match state_db.get_thread_goal(self.conversation_id).await {
+        match state_db
+            .thread_goals()
+            .get_thread_goal(self.conversation_id)
+            .await
+        {
             Ok(Some(goal))
                 if matches!(
                     goal.status,
@@ -886,11 +956,7 @@ impl Session {
         }
     }
 
-    async fn handle_thread_goal_task_abort(
-        &self,
-        turn_context: Option<&TurnContext>,
-        reason: TurnAbortReason,
-    ) {
+    async fn handle_thread_goal_task_abort(&self, turn_context: Option<&TurnContext>) {
         if let Some(turn_context) = turn_context {
             self.take_thread_goal_continuation_turn(&turn_context.sub_id)
                 .await;
@@ -913,12 +979,6 @@ impl Session {
                 accounting.turn = None;
             }
         }
-
-        if reason == TurnAbortReason::Interrupted
-            && let Err(err) = self.pause_active_thread_goal_for_interrupt().await
-        {
-            tracing::warn!("failed to pause active thread goal after interrupt: {err}");
-        }
     }
 
     async fn account_thread_goal_progress(
@@ -963,6 +1023,7 @@ impl Session {
             .current_goal_status_for_metrics(&state_db, expected_goal_id.as_deref())
             .await?;
         let outcome = state_db
+            .thread_goals()
             .account_thread_goal_usage(
                 self.conversation_id,
                 time_delta_seconds,
@@ -985,6 +1046,8 @@ impl Session {
                         matches!(budget_limit_steering, BudgetLimitSteering::Suppressed)
                     }
                     codex_state::ThreadGoalStatus::Paused
+                    | codex_state::ThreadGoalStatus::Blocked
+                    | codex_state::ThreadGoalStatus::UsageLimited
                     | codex_state::ThreadGoalStatus::Complete => true,
                 };
                 {
@@ -1085,6 +1148,7 @@ impl Session {
             .await?;
 
         match state_db
+            .thread_goals()
             .account_thread_goal_usage(
                 self.conversation_id,
                 time_delta_seconds,
@@ -1122,8 +1186,11 @@ impl Session {
         }
     }
 
-    async fn pause_active_thread_goal_for_interrupt(&self) -> anyhow::Result<()> {
-        if should_ignore_goal_for_mode(self.collaboration_mode().await.mode) {
+    async fn usage_limit_active_thread_goal_for_turn(
+        &self,
+        turn_context: &TurnContext,
+    ) -> anyhow::Result<()> {
+        if should_ignore_goal_for_mode(turn_context.collaboration_mode.mode) {
             return Ok(());
         }
 
@@ -1140,34 +1207,34 @@ impl Session {
         let Some(state_db) = self.state_db_for_thread_goals().await? else {
             return Ok(());
         };
-        self.account_thread_goal_wall_clock_usage(
-            &state_db,
-            codex_state::ThreadGoalAccountingMode::ActiveStatusOnly,
+        self.account_thread_goal_progress(
+            turn_context,
+            BudgetLimitSteering::Suppressed,
             TerminalMetricEmission::Emit,
         )
         .await?;
+        let previous_status = self
+            .current_goal_status_for_metrics(&state_db, /*expected_goal_id*/ None)
+            .await?;
         let Some(goal) = state_db
-            .pause_active_thread_goal(self.conversation_id)
+            .thread_goals()
+            .usage_limit_active_thread_goal(self.conversation_id)
             .await?
         else {
             return Ok(());
         };
+        self.emit_goal_terminal_metrics_if_status_changed(previous_status, &goal);
         let goal = protocol_goal_from_state(goal);
         *self.goal_runtime.budget_limit_reported_goal_id.lock().await = None;
-        self.goal_runtime
-            .accounting
-            .lock()
-            .await
-            .wall_clock
-            .clear_active_goal();
-        self.send_event_raw(Event {
-            id: uuid::Uuid::new_v4().to_string(),
-            msg: EventMsg::ThreadGoalUpdated(ThreadGoalUpdatedEvent {
+        self.clear_active_goal_accounting(turn_context).await;
+        self.send_event(
+            turn_context,
+            EventMsg::ThreadGoalUpdated(ThreadGoalUpdatedEvent {
                 thread_id: self.conversation_id,
-                turn_id: None,
+                turn_id: Some(turn_context.sub_id.clone()),
                 goal,
             }),
-        })
+        )
         .await;
         Ok(())
     }
@@ -1192,7 +1259,11 @@ impl Session {
         let Some(state_db) = self.state_db_for_thread_goals().await? else {
             return Ok(());
         };
-        let Some(goal) = state_db.get_thread_goal(self.conversation_id).await? else {
+        let Some(goal) = state_db
+            .thread_goals()
+            .get_thread_goal(self.conversation_id)
+            .await?
+        else {
             self.clear_stopped_thread_goal_runtime_state().await;
             return Ok(());
         };
@@ -1204,8 +1275,11 @@ impl Session {
                     .await
                     .wall_clock
                     .mark_active_goal(goal.goal_id);
+                self.emit_goal_resumed_metric();
             }
             codex_state::ThreadGoalStatus::Paused
+            | codex_state::ThreadGoalStatus::Blocked
+            | codex_state::ThreadGoalStatus::UsageLimited
             | codex_state::ThreadGoalStatus::BudgetLimited
             | codex_state::ThreadGoalStatus::Complete => {
                 self.clear_stopped_thread_goal_runtime_state().await;
@@ -1237,7 +1311,11 @@ impl Session {
             Arc::clone(&active_turn.turn_state)
         };
         let goal_is_current = match self.state_db_for_thread_goals().await {
-            Ok(Some(state_db)) => match state_db.get_thread_goal(self.conversation_id).await {
+            Ok(Some(state_db)) => match state_db
+                .thread_goals()
+                .get_thread_goal(self.conversation_id)
+                .await
+            {
                 Ok(Some(goal))
                     if goal.goal_id == candidate.goal_id
                         && goal.status == codex_state::ThreadGoalStatus::Active =>
@@ -1269,12 +1347,16 @@ impl Session {
                 .await;
             return;
         }
-        {
-            let mut turn_state = turn_state.lock().await;
-            for item in candidate.items {
-                turn_state.push_pending_input(item);
-            }
-        }
+        self.input_queue
+            .extend_pending_input_for_turn_state(
+                turn_state.as_ref(),
+                candidate
+                    .items
+                    .into_iter()
+                    .map(TurnInput::ResponseInputItem)
+                    .collect(),
+            )
+            .await;
 
         let turn_context = self
             .new_default_turn_with_sub_id(uuid::Uuid::new_v4().to_string())
@@ -1312,11 +1394,15 @@ impl Session {
             tracing::debug!("skipping active goal continuation because a turn is already active");
             return None;
         }
-        if self.has_queued_response_items_for_next_turn().await {
+        if self
+            .input_queue
+            .has_queued_response_items_for_next_turn()
+            .await
+        {
             tracing::debug!("skipping active goal continuation because queued input exists");
             return None;
         }
-        if self.has_trigger_turn_mailbox_items().await {
+        if self.input_queue.has_trigger_turn_mailbox_items().await {
             tracing::debug!(
                 "skipping active goal continuation because trigger-turn mailbox input is pending"
             );
@@ -1333,7 +1419,11 @@ impl Session {
                 return None;
             }
         };
-        let goal = match state_db.get_thread_goal(self.conversation_id).await {
+        let goal = match state_db
+            .thread_goals()
+            .get_thread_goal(self.conversation_id)
+            .await
+        {
             Ok(Some(goal)) => goal,
             Ok(None) => {
                 tracing::debug!("skipping active goal continuation because no goal is set");
@@ -1349,8 +1439,11 @@ impl Session {
             return None;
         }
         if self.active_turn.lock().await.is_some()
-            || self.has_queued_response_items_for_next_turn().await
-            || self.has_trigger_turn_mailbox_items().await
+            || self
+                .input_queue
+                .has_queued_response_items_for_next_turn()
+                .await
+            || self.input_queue.has_trigger_turn_mailbox_items().await
         {
             tracing::debug!("skipping active goal continuation because pending work appeared");
             return None;
@@ -1438,6 +1531,21 @@ impl Session {
     }
 }
 
+async fn set_thread_preview_from_goal_objective(
+    state_db: &StateDbHandle,
+    thread_id: ThreadId,
+    objective: &str,
+) {
+    if let Err(err) = state_db
+        .set_thread_preview_if_empty(thread_id, objective)
+        .await
+    {
+        tracing::warn!(
+            "failed to set empty thread preview from goal objective for {thread_id}: {err}"
+        );
+    }
+}
+
 fn should_ignore_goal_for_mode(mode: ModeKind) -> bool {
     mode == ModeKind::Plan
 }
@@ -1526,7 +1634,7 @@ fn budget_limit_steering_item(goal: &ThreadGoal) -> ResponseInputItem {
 fn goal_context_input_item(prompt: String) -> ResponseInputItem {
     let context = GoalContext { prompt };
     ResponseInputItem::Message {
-        role: <GoalContext as ContextualUserFragment>::ROLE.to_string(),
+        role: GoalContext::role().to_string(),
         content: vec![ContentItem::InputText {
             text: context.render(),
         }],
@@ -1553,6 +1661,8 @@ pub(crate) fn protocol_goal_status_from_state(
     match status {
         codex_state::ThreadGoalStatus::Active => ThreadGoalStatus::Active,
         codex_state::ThreadGoalStatus::Paused => ThreadGoalStatus::Paused,
+        codex_state::ThreadGoalStatus::Blocked => ThreadGoalStatus::Blocked,
+        codex_state::ThreadGoalStatus::UsageLimited => ThreadGoalStatus::UsageLimited,
         codex_state::ThreadGoalStatus::BudgetLimited => ThreadGoalStatus::BudgetLimited,
         codex_state::ThreadGoalStatus::Complete => ThreadGoalStatus::Complete,
     }
@@ -1564,6 +1674,8 @@ pub(crate) fn state_goal_status_from_protocol(
     match status {
         ThreadGoalStatus::Active => codex_state::ThreadGoalStatus::Active,
         ThreadGoalStatus::Paused => codex_state::ThreadGoalStatus::Paused,
+        ThreadGoalStatus::Blocked => codex_state::ThreadGoalStatus::Blocked,
+        ThreadGoalStatus::UsageLimited => codex_state::ThreadGoalStatus::UsageLimited,
         ThreadGoalStatus::BudgetLimited => codex_state::ThreadGoalStatus::BudgetLimited,
         ThreadGoalStatus::Complete => codex_state::ThreadGoalStatus::Complete,
     }
@@ -1642,7 +1754,7 @@ mod tests {
     }
 
     #[test]
-    fn continuation_prompt_only_tells_model_to_update_goal_when_complete() {
+    fn continuation_prompt_allows_complete_and_strict_blocked_updates() {
         let prompt = continuation_prompt(&ThreadGoal {
             thread_id: ThreadId::new(),
             objective: "finish the stack".to_string(),
@@ -1659,9 +1771,11 @@ mod tests {
         assert!(prompt.contains("<objective>\nfinish the stack\n</objective>"));
         assert!(prompt.contains("Token budget: 10000"));
         assert!(prompt.contains("call update_goal with status \"complete\""));
-        assert!(!prompt.contains(
-            "explain the blocker or next required input to the user and wait for new input"
-        ));
+        assert!(prompt.contains("status \"blocked\""));
+        assert!(prompt.contains("at least three consecutive goal turns"));
+        assert!(prompt.contains("same blocking condition"));
+        assert!(prompt.contains("original/user-triggered turn"));
+        assert!(prompt.contains("truly at an impasse"));
         assert!(!prompt.contains("budgetLimited"));
         assert!(!prompt.contains("status \"paused\""));
     }
diff --git a/codex-rs/core/src/guardian/review_session.rs b/codex-rs/core/src/guardian/review_session.rs
index a419d7cbfa..15d6c142ca 100644
--- a/codex-rs/core/src/guardian/review_session.rs
+++ b/codex-rs/core/src/guardian/review_session.rs
@@ -7,6 +7,7 @@ use std::time::Duration;
 use anyhow::anyhow;
 use codex_analytics::GuardianReviewAnalyticsResult;
 use codex_analytics::GuardianReviewSessionKind;
+use codex_protocol::config_types::AutoCompactTokenLimitScope;
 use codex_protocol::config_types::Personality;
 use codex_protocol::config_types::ReasoningSummary as ReasoningSummaryConfig;
 use codex_protocol::models::PermissionProfile;
@@ -138,6 +139,7 @@ struct GuardianReviewSessionReuseKey {
     model_provider: ModelProviderInfo,
     model_context_window: Option<i64>,
     model_auto_compact_token_limit: Option<i64>,
+    model_auto_compact_token_limit_scope: AutoCompactTokenLimitScope,
     model_reasoning_effort: Option<ReasoningEffortConfig>,
     model_reasoning_summary: Option<ReasoningSummaryConfig>,
     permissions: Permissions,
@@ -151,7 +153,6 @@ struct GuardianReviewSessionReuseKey {
     main_execve_wrapper_exe: Option<PathBuf>,
     zsh_path: Option<PathBuf>,
     features: ManagedFeatures,
-    include_apply_patch_tool: bool,
     use_experimental_unified_exec_tool: bool,
 }
 
@@ -163,6 +164,7 @@ impl GuardianReviewSessionReuseKey {
             model_provider: spawn_config.model_provider.clone(),
             model_context_window: spawn_config.model_context_window,
             model_auto_compact_token_limit: spawn_config.model_auto_compact_token_limit,
+            model_auto_compact_token_limit_scope: spawn_config.model_auto_compact_token_limit_scope,
             model_reasoning_effort: spawn_config.model_reasoning_effort,
             model_reasoning_summary: spawn_config.model_reasoning_summary,
             permissions: spawn_config.permissions.clone(),
@@ -176,7 +178,6 @@ impl GuardianReviewSessionReuseKey {
             main_execve_wrapper_exe: spawn_config.main_execve_wrapper_exe.clone(),
             zsh_path: spawn_config.zsh_path.clone(),
             features: spawn_config.features.clone(),
-            include_apply_patch_tool: spawn_config.include_apply_patch_tool,
             use_experimental_unified_exec_tool: spawn_config.use_experimental_unified_exec_tool,
         }
     }
@@ -701,25 +702,36 @@ async fn run_review_on_session(
         .total_token_usage()
         .await
         .unwrap_or_default();
+    // The legacy SandboxPolicy should match the PermissionProfile.
+    let guardian_permission_profile = PermissionProfile::read_only();
+    let legacy_sandbox_policy = SandboxPolicy::new_read_only_policy();
 
     let submit_result = run_before_review_deadline(
         deadline,
         params.external_cancel.as_ref(),
-        Box::pin(review_session.codex.submit(Op::UserTurn {
-            environments: None,
+        Box::pin(review_session.codex.submit(Op::UserInput {
             items: prompt_items.items,
-            cwd: params.parent_turn.cwd.to_path_buf(),
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy: SandboxPolicy::new_read_only_policy(),
-            permission_profile: None,
-            model: params.model.clone(),
-            effort: params.reasoning_effort,
-            summary: Some(params.reasoning_summary),
-            service_tier: None,
+            environments: None,
             final_output_json_schema: Some(params.schema.clone()),
-            collaboration_mode: None,
-            personality: params.personality,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                #[allow(deprecated)]
+                cwd: Some(params.parent_turn.cwd.to_path_buf()),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(legacy_sandbox_policy),
+                permission_profile: Some(guardian_permission_profile),
+                summary: Some(params.reasoning_summary),
+                personality: params.personality,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: params.model.clone(),
+                        reasoning_effort: params.reasoning_effort,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })),
     )
     .await;
@@ -894,15 +906,11 @@ pub(crate) fn build_guardian_review_session_config(
     );
     guardian_config.developer_instructions = None;
     guardian_config.permissions.approval_policy = Constrained::allow_only(AskForApproval::Never);
-    let sandbox_policy = SandboxPolicy::new_read_only_policy();
-    guardian_config.permissions.permission_profile = Constrained::allow_only(
-        PermissionProfile::from_legacy_sandbox_policy(&sandbox_policy),
-    );
     guardian_config
         .permissions
-        .set_legacy_sandbox_policy(sandbox_policy, guardian_config.cwd.as_path())
+        .set_permission_profile(PermissionProfile::read_only())
         .map_err(|err| {
-            anyhow::anyhow!("guardian review session could not set sandbox policy: {err}")
+            anyhow::anyhow!("guardian review session could not set permission profile: {err}")
         })?;
     guardian_config.include_apps_instructions = false;
     guardian_config
@@ -923,7 +931,7 @@ pub(crate) fn build_guardian_review_session_config(
         guardian_config.permissions.network = Some(NetworkProxySpec::from_config_and_constraints(
             live_network_config,
             network_constraints,
-            guardian_config.permissions.permission_profile.get(),
+            guardian_config.permissions.permission_profile(),
         )?);
     }
     for feature in [
@@ -1086,6 +1094,7 @@ mod tests {
         let reasoning_effort = turn.reasoning_effort;
         let reasoning_summary = turn.reasoning_summary;
         let personality = turn.personality;
+        #[allow(deprecated)]
         let cwd = turn.cwd.clone();
         let spawn_config = build_guardian_review_session_config(
             turn.config.as_ref(),
@@ -1149,6 +1158,34 @@ mod tests {
         );
     }
 
+    #[tokio::test]
+    async fn guardian_review_session_compact_scope_change_invalidates_cached_session() {
+        let parent_config = crate::config::test_config().await;
+        let cached_spawn_config = build_guardian_review_session_config(
+            &parent_config,
+            /*live_network_config*/ None,
+            "active-model",
+            /*reasoning_effort*/ None,
+        )
+        .expect("cached guardian config");
+        let cached_reuse_key =
+            GuardianReviewSessionReuseKey::from_spawn_config(&cached_spawn_config);
+
+        let mut changed_parent_config = parent_config;
+        changed_parent_config.model_auto_compact_token_limit_scope =
+            AutoCompactTokenLimitScope::BodyAfterPrefix;
+        let next_spawn_config = build_guardian_review_session_config(
+            &changed_parent_config,
+            /*live_network_config*/ None,
+            "active-model",
+            /*reasoning_effort*/ None,
+        )
+        .expect("next guardian config");
+        let next_reuse_key = GuardianReviewSessionReuseKey::from_spawn_config(&next_spawn_config);
+
+        assert_ne!(cached_reuse_key, next_reuse_key);
+    }
+
     #[tokio::test]
     async fn guardian_review_session_config_disables_hooks() {
         let mut parent_config = crate::config::test_config().await;
diff --git a/codex-rs/core/src/guardian/tests.rs b/codex-rs/core/src/guardian/tests.rs
index 7601ef44c3..0544b27770 100644
--- a/codex-rs/core/src/guardian/tests.rs
+++ b/codex-rs/core/src/guardian/tests.rs
@@ -42,7 +42,6 @@ use codex_protocol::protocol::GuardianRiskLevel;
 use codex_protocol::protocol::GuardianUserAuthorization;
 use codex_protocol::protocol::ReviewDecision;
 use codex_protocol::protocol::RolloutItem;
-use codex_protocol::protocol::SandboxPolicy;
 use codex_protocol::protocol::TurnCompleteEvent;
 use core_test_support::PathBufExt;
 use core_test_support::TempDirExt;
@@ -2163,7 +2162,7 @@ async fn guardian_review_session_config_preserves_parent_network_proxy() {
             }),
             ..Default::default()
         }),
-        parent_config.permissions.permission_profile.get(),
+        parent_config.permissions.permission_profile(),
     )
     .expect("network proxy spec");
     parent_config.permissions.network = Some(network.clone());
@@ -2190,10 +2189,8 @@ async fn guardian_review_session_config_preserves_parent_network_proxy() {
         Constrained::allow_only(AskForApproval::Never)
     );
     assert_eq!(
-        guardian_config.permissions.permission_profile,
-        Constrained::allow_only(PermissionProfile::from_legacy_sandbox_policy(
-            &SandboxPolicy::new_read_only_policy(),
-        ))
+        guardian_config.permissions.permission_profile(),
+        &PermissionProfile::read_only()
     );
 }
 
@@ -2230,7 +2227,7 @@ async fn guardian_review_session_config_uses_live_network_proxy_state() {
         NetworkProxySpec::from_config_and_constraints(
             parent_network,
             /*requirements*/ None,
-            parent_config.permissions.permission_profile.get(),
+            parent_config.permissions.permission_profile(),
         )
         .expect("parent network proxy spec"),
     );
@@ -2255,9 +2252,7 @@ async fn guardian_review_session_config_uses_live_network_proxy_state() {
             NetworkProxySpec::from_config_and_constraints(
                 live_network,
                 /*requirements*/ None,
-                &PermissionProfile::from_legacy_sandbox_policy(
-                    &SandboxPolicy::new_read_only_policy(),
-                ),
+                &PermissionProfile::read_only(),
             )
             .expect("live network proxy spec")
         )
diff --git a/codex-rs/core/src/hook_runtime.rs b/codex-rs/core/src/hook_runtime.rs
index 4744724a5c..dcb32a520f 100644
--- a/codex-rs/core/src/hook_runtime.rs
+++ b/codex-rs/core/src/hook_runtime.rs
@@ -13,12 +13,15 @@ use codex_hooks::PostToolUseRequest;
 use codex_hooks::PreToolUseOutcome;
 use codex_hooks::PreToolUseRequest;
 use codex_hooks::SessionStartOutcome;
+use codex_hooks::StartHookTarget;
+use codex_hooks::StopOutcome;
+use codex_hooks::StopRequest;
 use codex_hooks::UserPromptSubmitOutcome;
 use codex_hooks::UserPromptSubmitRequest;
 use codex_otel::HOOK_RUN_DURATION_METRIC;
 use codex_otel::HOOK_RUN_METRIC;
 use codex_protocol::items::TurnItem;
-use codex_protocol::models::ResponseInputItem;
+use codex_protocol::items::UserMessageItem;
 use codex_protocol::models::ResponseItem;
 use codex_protocol::protocol::AskForApproval;
 use codex_protocol::protocol::EventMsg;
@@ -28,12 +31,14 @@ use codex_protocol::protocol::HookRunStatus;
 use codex_protocol::protocol::HookRunSummary;
 use codex_protocol::protocol::HookSource;
 use codex_protocol::protocol::HookStartedEvent;
-use codex_protocol::user_input::UserInput;
+use codex_protocol::protocol::SessionSource;
+use codex_protocol::protocol::SubAgentSource;
 use serde_json::Value;
 
 use crate::context::ContextualUserFragment;
 use crate::context::HookAdditionalContext;
 use crate::event_mapping::parse_turn_item;
+use crate::session::TurnInput;
 use crate::session::session::Session;
 use crate::session::turn_context::TurnContext;
 use crate::tools::hook_names::HookToolName;
@@ -49,22 +54,6 @@ pub(crate) enum PreToolUseHookResult {
     Blocked(String),
 }
 
-pub(crate) enum PendingInputHookDisposition {
-    Accepted(Box<PendingInputRecord>),
-    Blocked { additional_contexts: Vec<String> },
-}
-
-pub(crate) enum PendingInputRecord {
-    UserMessage {
-        content: Vec<UserInput>,
-        response_item: ResponseItem,
-        additional_contexts: Vec<String>,
-    },
-    ConversationItem {
-        response_item: ResponseItem,
-    },
-}
-
 struct ContextInjectingHookOutcome {
     hook_events: Vec<HookCompletedEvent>,
     outcome: HookRuntimeOutcome,
@@ -114,13 +103,38 @@ pub(crate) async fn run_pending_session_start_hooks(
         return false;
     };
 
+    // Pending session-start hooks are reused to dispatch thread-spawn subagent
+    // starts. Other subagent sessions are internal/system work and do not run
+    // start hooks.
+    let target = match &turn_context.session_source {
+        SessionSource::SubAgent(SubAgentSource::ThreadSpawn { agent_role, .. })
+            if matches!(
+                session_start_source,
+                codex_hooks::SessionStartSource::Startup
+            ) =>
+        {
+            let agent_type = agent_role
+                .clone()
+                .unwrap_or_else(|| crate::agent::role::DEFAULT_ROLE_NAME.to_string());
+            StartHookTarget::SubagentStart {
+                turn_id: turn_context.sub_id.clone(),
+                agent_id: sess.thread_id().to_string(),
+                agent_type,
+            }
+        }
+        SessionSource::SubAgent(_) => return false,
+        _ => StartHookTarget::SessionStart {
+            source: session_start_source,
+        },
+    };
     let request = codex_hooks::SessionStartRequest {
         session_id: sess.session_id().into(),
+        #[allow(deprecated)]
         cwd: turn_context.cwd.clone(),
         transcript_path: sess.hook_transcript_path().await,
         model: turn_context.model_info.slug.clone(),
         permission_mode: hook_permission_mode(turn_context),
-        source: session_start_source,
+        target,
     };
     let hooks = sess.hooks();
     let preview_runs = hooks.preview_session_start(&request);
@@ -150,6 +164,7 @@ pub(crate) async fn run_pre_tool_use_hooks(
     let request = PreToolUseRequest {
         session_id: sess.session_id().into(),
         turn_id: turn_context.sub_id.clone(),
+        #[allow(deprecated)]
         cwd: turn_context.cwd.clone(),
         transcript_path: sess.hook_transcript_path().await,
         model: turn_context.model_info.slug.clone(),
@@ -209,6 +224,7 @@ pub(crate) async fn run_permission_request_hooks(
     let request = PermissionRequestRequest {
         session_id: sess.session_id().into(),
         turn_id: turn_context.sub_id.clone(),
+        #[allow(deprecated)]
         cwd: turn_context.cwd.to_path_buf(),
         transcript_path: sess.hook_transcript_path().await,
         model: turn_context.model_info.slug.clone(),
@@ -249,6 +265,7 @@ pub(crate) async fn run_post_tool_use_hooks(
     let request = PostToolUseRequest {
         session_id: sess.session_id().into(),
         turn_id: turn_context.sub_id.clone(),
+        #[allow(deprecated)]
         cwd: turn_context.cwd.clone(),
         transcript_path: sess.hook_transcript_path().await,
         model: turn_context.model_info.slug.clone(),
@@ -276,6 +293,7 @@ pub(crate) async fn run_pre_compact_hooks(
     let request = codex_hooks::PreCompactRequest {
         session_id: sess.session_id().into(),
         turn_id: turn_context.sub_id.clone(),
+        #[allow(deprecated)]
         cwd: turn_context.cwd.clone(),
         transcript_path: sess.hook_transcript_path().await,
         model: turn_context.model_info.slug.clone(),
@@ -313,6 +331,7 @@ pub(crate) async fn run_post_compact_hooks(
     let request = codex_hooks::PostCompactRequest {
         session_id: sess.session_id().into(),
         turn_id: turn_context.sub_id.clone(),
+        #[allow(deprecated)]
         cwd: turn_context.cwd.clone(),
         transcript_path: sess.hook_transcript_path().await,
         model: turn_context.model_info.slug.clone(),
@@ -330,82 +349,149 @@ pub(crate) async fn run_post_compact_hooks(
     }
 }
 
-pub(crate) async fn run_user_prompt_submit_hooks(
+pub(crate) async fn run_stop_hooks(
     sess: &Arc<Session>,
     turn_context: &Arc<TurnContext>,
-    prompt: String,
-) -> HookRuntimeOutcome {
-    let request = UserPromptSubmitRequest {
+    stop_hook_active: bool,
+    last_assistant_message: Option<String>,
+) -> StopOutcome {
+    let request = StopRequest {
         session_id: sess.session_id().into(),
         turn_id: turn_context.sub_id.clone(),
+        #[allow(deprecated)]
         cwd: turn_context.cwd.clone(),
         transcript_path: sess.hook_transcript_path().await,
         model: turn_context.model_info.slug.clone(),
         permission_mode: hook_permission_mode(turn_context),
-        prompt,
+        stop_hook_active,
+        last_assistant_message,
     };
     let hooks = sess.hooks();
-    let preview_runs = hooks.preview_user_prompt_submit(&request);
-    run_context_injecting_hook(
-        sess,
-        turn_context,
-        preview_runs,
-        hooks.run_user_prompt_submit(request),
-    )
-    .await
+    emit_hook_started_events(sess, turn_context, hooks.preview_stop(&request)).await;
+    let mut outcome = hooks.run_stop(request).await;
+    emit_hook_completed_events(sess, turn_context, std::mem::take(&mut outcome.hook_events)).await;
+    outcome
+}
+
+pub(crate) async fn run_legacy_after_agent_hook(
+    sess: &Arc<Session>,
+    turn_context: &Arc<TurnContext>,
+    input: &[ResponseItem],
+    last_assistant_message: Option<String>,
+) -> bool {
+    let mut abort_message = None;
+    let input_messages = input
+        .iter()
+        .filter_map(|item| match parse_turn_item(item) {
+            Some(TurnItem::UserMessage(user_message)) => Some(user_message.message()),
+            _ => None,
+        })
+        .collect();
+    let hooks = sess.hooks();
+    for hook_outcome in hooks
+        .dispatch(codex_hooks::HookPayload {
+            session_id: sess.session_id().into(),
+            #[allow(deprecated)]
+            cwd: turn_context.cwd.clone(),
+            client: turn_context.app_server_client_name.clone(),
+            triggered_at: chrono::Utc::now(),
+            hook_event: codex_hooks::HookEvent::AfterAgent {
+                event: codex_hooks::HookEventAfterAgent {
+                    thread_id: sess.conversation_id,
+                    turn_id: turn_context.sub_id.clone(),
+                    input_messages,
+                    last_assistant_message,
+                },
+            },
+        })
+        .await
+    {
+        let hook_name = hook_outcome.hook_name;
+        let (error, should_abort) = match hook_outcome.result {
+            codex_hooks::HookResult::Success => continue,
+            codex_hooks::HookResult::FailedContinue(error) => (error, false),
+            codex_hooks::HookResult::FailedAbort(error) => (error, true),
+        };
+        let action = if should_abort {
+            "aborting operation"
+        } else {
+            "continuing"
+        };
+        tracing::warn!(
+            turn_id = %turn_context.sub_id,
+            hook_name = %hook_name,
+            error = %error,
+            "after_agent hook failed; {action}"
+        );
+        if should_abort && abort_message.is_none() {
+            abort_message = Some(format!(
+                "after_agent hook '{hook_name}' failed and aborted turn completion: {error}"
+            ));
+        }
+    }
+    let Some(message) = abort_message else {
+        return false;
+    };
+    let event = EventMsg::Error(codex_protocol::protocol::ErrorEvent {
+        message,
+        codex_error_info: None,
+    });
+    sess.send_event(turn_context, event).await;
+    true
 }
 
 pub(crate) async fn inspect_pending_input(
     sess: &Arc<Session>,
     turn_context: &Arc<TurnContext>,
-    pending_input_item: ResponseInputItem,
-) -> PendingInputHookDisposition {
-    let response_item = ResponseItem::from(pending_input_item);
-    if let Some(TurnItem::UserMessage(user_message)) = parse_turn_item(&response_item) {
-        let user_prompt_submit_outcome =
-            run_user_prompt_submit_hooks(sess, turn_context, user_message.message()).await;
-        if user_prompt_submit_outcome.should_stop {
-            PendingInputHookDisposition::Blocked {
-                additional_contexts: user_prompt_submit_outcome.additional_contexts,
-            }
-        } else {
-            PendingInputHookDisposition::Accepted(Box::new(PendingInputRecord::UserMessage {
-                content: user_message.content,
-                response_item,
-                additional_contexts: user_prompt_submit_outcome.additional_contexts,
-            }))
+    pending_input_item: &TurnInput,
+) -> HookRuntimeOutcome {
+    match pending_input_item {
+        TurnInput::UserInput(content) => {
+            let request = UserPromptSubmitRequest {
+                session_id: sess.session_id().into(),
+                turn_id: turn_context.sub_id.clone(),
+                #[allow(deprecated)]
+                cwd: turn_context.cwd.clone(),
+                transcript_path: sess.hook_transcript_path().await,
+                model: turn_context.model_info.slug.clone(),
+                permission_mode: hook_permission_mode(turn_context),
+                prompt: UserMessageItem::new(content).message(),
+            };
+            let hooks = sess.hooks();
+            let preview_runs = hooks.preview_user_prompt_submit(&request);
+            run_context_injecting_hook(
+                sess,
+                turn_context,
+                preview_runs,
+                hooks.run_user_prompt_submit(request),
+            )
+            .await
         }
-    } else {
-        PendingInputHookDisposition::Accepted(Box::new(PendingInputRecord::ConversationItem {
-            response_item,
-        }))
+        TurnInput::ResponseInputItem(_) => HookRuntimeOutcome {
+            should_stop: false,
+            additional_contexts: Vec::new(),
+        },
     }
 }
 
 pub(crate) async fn record_pending_input(
     sess: &Arc<Session>,
     turn_context: &Arc<TurnContext>,
-    pending_input: PendingInputRecord,
+    pending_input: TurnInput,
+    additional_contexts: Vec<String>,
 ) {
     match pending_input {
-        PendingInputRecord::UserMessage {
-            content,
-            response_item,
-            additional_contexts,
-        } => {
-            sess.record_user_prompt_and_emit_turn_item(
-                turn_context.as_ref(),
-                content.as_slice(),
-                response_item,
-            )
-            .await;
-            record_additional_contexts(sess, turn_context, additional_contexts).await;
+        TurnInput::UserInput(content) => {
+            sess.record_user_prompt_and_emit_turn_item(turn_context.as_ref(), content.as_slice())
+                .await;
         }
-        PendingInputRecord::ConversationItem { response_item } => {
+        TurnInput::ResponseInputItem(input) => {
+            let response_item = ResponseItem::from(input);
             sess.record_conversation_items(turn_context, std::slice::from_ref(&response_item))
                 .await;
         }
     }
+    record_additional_contexts(sess, turn_context, additional_contexts).await;
 }
 
 async fn run_context_injecting_hook<Fut, Outcome>(
@@ -548,6 +634,7 @@ fn hook_run_metric_tags(run: &HookRunSummary) -> [(&'static str, &'static str);
         HookEventName::PostCompact => "PostCompact",
         HookEventName::SessionStart => "SessionStart",
         HookEventName::UserPromptSubmit => "UserPromptSubmit",
+        HookEventName::SubagentStart => "SubagentStart",
         HookEventName::Stop => "Stop",
     };
     let hook_source = match run.source {
diff --git a/codex-rs/core/src/lib.rs b/codex-rs/core/src/lib.rs
index 325d65745f..aca6049698 100644
--- a/codex-rs/core/src/lib.rs
+++ b/codex-rs/core/src/lib.rs
@@ -20,7 +20,7 @@ mod compact_remote;
 mod compact_remote_v2;
 mod config_lock;
 pub use codex_thread::CodexThread;
-pub use codex_thread::CodexThreadTurnContextOverrides;
+pub use codex_thread::CodexThreadSettingsOverrides;
 pub use codex_thread::ThreadConfigSnapshot;
 pub use session::turn_context::TurnContext;
 mod agent;
@@ -90,13 +90,11 @@ pub(crate) use skills::SkillsManager;
 pub(crate) use skills::build_available_skills;
 pub(crate) use skills::build_skill_injections;
 pub(crate) use skills::build_skill_name_counts;
-pub(crate) use skills::collect_env_var_dependencies;
 pub(crate) use skills::collect_explicit_skill_mentions;
 pub(crate) use skills::default_skill_metadata_budget;
 pub(crate) use skills::injection;
 pub(crate) use skills::manager;
 pub(crate) use skills::maybe_emit_implicit_skill_invocation;
-pub(crate) use skills::resolve_skill_dependencies_for_turn;
 pub(crate) use skills::skills_load_input_from_config;
 mod stream_events_utils;
 pub mod test_support;
diff --git a/codex-rs/core/src/mcp_openai_file.rs b/codex-rs/core/src/mcp_openai_file.rs
index 0e0d4a6008..ae44515c62 100644
--- a/codex-rs/core/src/mcp_openai_file.rs
+++ b/codex-rs/core/src/mcp_openai_file.rs
@@ -102,6 +102,7 @@ async fn build_uploaded_local_argument_value(
     index: Option<usize>,
     file_path: &str,
 ) -> Result<JsonValue, String> {
+    #[allow(deprecated)]
     let resolved_path = turn_context.resolve_path(Some(file_path.to_string()));
     let Some(auth) = auth else {
         return Err(
@@ -216,7 +217,10 @@ mod tests {
         tokio::fs::write(&local_path, b"hello")
             .await
             .expect("write local file");
-        turn_context.cwd = AbsolutePathBuf::try_from(dir.path()).expect("absolute path");
+        #[allow(deprecated)]
+        {
+            turn_context.cwd = AbsolutePathBuf::try_from(dir.path()).expect("absolute path");
+        }
 
         let mut config = (*turn_context.config).clone();
         config.chatgpt_base_url = format!("{}/backend-api", server.uri());
@@ -297,7 +301,10 @@ mod tests {
         tokio::fs::write(&local_path, b"hello")
             .await
             .expect("write local file");
-        turn_context.cwd = AbsolutePathBuf::try_from(dir.path()).expect("absolute path");
+        #[allow(deprecated)]
+        {
+            turn_context.cwd = AbsolutePathBuf::try_from(dir.path()).expect("absolute path");
+        }
 
         let mut config = (*turn_context.config).clone();
         config.chatgpt_base_url = format!("{}/backend-api", server.uri());
@@ -411,7 +418,10 @@ mod tests {
         tokio::fs::write(dir.path().join("two.csv"), b"two")
             .await
             .expect("write second local file");
-        turn_context.cwd = AbsolutePathBuf::try_from(dir.path()).expect("absolute path");
+        #[allow(deprecated)]
+        {
+            turn_context.cwd = AbsolutePathBuf::try_from(dir.path()).expect("absolute path");
+        }
 
         let mut config = (*turn_context.config).clone();
         config.chatgpt_base_url = format!("{}/backend-api", server.uri());
diff --git a/codex-rs/core/src/mcp_skill_dependencies.rs b/codex-rs/core/src/mcp_skill_dependencies.rs
index 44764e0064..b8552596b3 100644
--- a/codex-rs/core/src/mcp_skill_dependencies.rs
+++ b/codex-rs/core/src/mcp_skill_dependencies.rs
@@ -151,6 +151,7 @@ pub(crate) async fn maybe_install_mcp_dependencies(
             server_config.scopes.clone(),
             oauth_config.discovered_scopes.clone(),
         );
+        let oauth_client_id = server_config.oauth_client_id();
         let first_attempt = perform_oauth_login(
             &name,
             &oauth_config.url,
@@ -158,6 +159,7 @@ pub(crate) async fn maybe_install_mcp_dependencies(
             oauth_config.http_headers.clone(),
             oauth_config.env_http_headers.clone(),
             &resolved_scopes.scopes,
+            oauth_client_id,
             server_config.oauth_resource.as_deref(),
             config.mcp_oauth_callback_port,
             config.mcp_oauth_callback_url.as_deref(),
@@ -173,6 +175,7 @@ pub(crate) async fn maybe_install_mcp_dependencies(
                     oauth_config.http_headers,
                     oauth_config.env_http_headers,
                     &[],
+                    oauth_client_id,
                     server_config.oauth_resource.as_deref(),
                     config.mcp_oauth_callback_port,
                     config.mcp_oauth_callback_url.as_deref(),
@@ -369,6 +372,7 @@ fn mcp_dependency_to_server_config(
             enabled_tools: None,
             disabled_tools: None,
             scopes: None,
+            oauth: None,
             oauth_resource: None,
             tools: HashMap::new(),
         });
@@ -398,6 +402,7 @@ fn mcp_dependency_to_server_config(
             enabled_tools: None,
             disabled_tools: None,
             scopes: None,
+            oauth: None,
             oauth_resource: None,
             tools: HashMap::new(),
         });
diff --git a/codex-rs/core/src/mcp_tool_call.rs b/codex-rs/core/src/mcp_tool_call.rs
index 5dd16acb9a..902ede574e 100644
--- a/codex-rs/core/src/mcp_tool_call.rs
+++ b/codex-rs/core/src/mcp_tool_call.rs
@@ -15,7 +15,6 @@ use crate::arc_monitor::monitor_action;
 use crate::config::Config;
 use crate::config::edit::ConfigEdit;
 use crate::config::edit::ConfigEditsBuilder;
-use crate::config::load_global_mcp_servers;
 use crate::connectors;
 use crate::guardian::GuardianApprovalRequest;
 use crate::guardian::GuardianMcpAnnotations;
@@ -193,12 +192,6 @@ pub(crate) async fn handle_mcp_tool_call(
                 .unwrap_or_else(|| JsonValue::Object(serde_json::Map::new())),
         };
     }
-    let request_meta = build_mcp_tool_call_request_meta(
-        turn_context.as_ref(),
-        &server,
-        &call_id,
-        metadata.as_ref(),
-    );
     let connector_id = metadata
         .as_ref()
         .and_then(|metadata| metadata.connector_id.clone());
@@ -236,7 +229,6 @@ pub(crate) async fn handle_mcp_tool_call(
                     &call_id,
                     invocation,
                     metadata.as_ref(),
-                    request_meta,
                     mcp_app_resource_uri,
                 )
                 .await;
@@ -304,7 +296,6 @@ pub(crate) async fn handle_mcp_tool_call(
         &call_id,
         invocation,
         metadata.as_ref(),
-        request_meta,
         mcp_app_resource_uri,
     )
     .await
@@ -321,7 +312,6 @@ async fn handle_approved_mcp_tool_call(
     call_id: &str,
     invocation: McpInvocation,
     metadata: Option<&McpToolApprovalMetadata>,
-    request_meta: Option<JsonValue>,
     mcp_app_resource_uri: Option<String>,
 ) -> HandledMcpToolCall {
     let server = invocation.server.clone();
@@ -354,6 +344,8 @@ async fn handle_approved_mcp_tool_call(
     };
     let result = async {
         let rewritten_arguments = rewrite?;
+        let request_meta =
+            build_mcp_tool_call_request_meta(turn_context, &server, call_id, metadata);
         let result = execute_mcp_tool_call(
             sess,
             turn_context,
@@ -576,6 +568,11 @@ async fn execute_mcp_tool_call(
     )
     .await
     .map_err(|e| format!("failed to build MCP tool request metadata: {e:#}"))?;
+    let mcp_call_trace = sess
+        .services
+        .rollout_thread_trace
+        .start_mcp_call_trace(call_id);
+    let request_meta = mcp_call_trace.add_request_meta(request_meta);
     let result = sess
         .call_tool(
             &invocation.server,
@@ -727,6 +724,7 @@ async fn augment_mcp_tool_request_meta_with_sandbox_state(
         permission_profile: Some(turn_context.permission_profile()),
         sandbox_policy: turn_context.sandbox_policy(),
         codex_linux_sandbox_exe: turn_context.codex_linux_sandbox_exe.clone(),
+        #[allow(deprecated)]
         sandbox_cwd: turn_context.cwd.to_path_buf(),
         use_legacy_landlock: turn_context.features.use_legacy_landlock(),
     })?;
@@ -976,6 +974,7 @@ pub(crate) struct McpToolApprovalMetadata {
     connector_id: Option<String>,
     connector_name: Option<String>,
     connector_description: Option<String>,
+    plugin_id: Option<String>,
     tool_title: Option<String>,
     tool_description: Option<String>,
     mcp_app_resource_uri: Option<String>,
@@ -985,6 +984,7 @@ pub(crate) struct McpToolApprovalMetadata {
 
 const MCP_TOOL_OPENAI_OUTPUT_TEMPLATE_META_KEY: &str = "openai/outputTemplate";
 const MCP_TOOL_UI_RESOURCE_URI_META_KEY: &str = "ui/resourceUri";
+const MCP_TOOL_PLUGIN_ID_META_KEY: &str = "plugin_id";
 const MCP_TOOL_THREAD_ID_META_KEY: &str = "threadId";
 
 async fn custom_mcp_tool_approval_mode(
@@ -1070,6 +1070,12 @@ fn build_mcp_tool_call_request_meta(
             serde_json::Value::Object(codex_apps_meta),
         );
     }
+    if let Some(plugin_id) = metadata.and_then(|metadata| metadata.plugin_id.as_ref()) {
+        request_meta.insert(
+            MCP_TOOL_PLUGIN_ID_META_KEY.to_string(),
+            serde_json::Value::String(plugin_id.clone()),
+        );
+    }
 
     (!request_meta.is_empty()).then_some(serde_json::Value::Object(request_meta))
 }
@@ -1482,13 +1488,11 @@ pub(crate) async fn lookup_mcp_tool_metadata(
     server: &str,
     tool_name: &str,
 ) -> Option<McpToolApprovalMetadata> {
-    let tools = sess
-        .services
-        .mcp_connection_manager
-        .read()
-        .await
-        .list_all_tools()
-        .await;
+    let manager = sess.services.mcp_connection_manager.read().await;
+    let plugin_id = manager
+        .plugin_id_for_mcp_server_name(server)
+        .map(str::to_string);
+    let tools = manager.list_all_tools().await;
     let tool_info = tools
         .into_iter()
         .find(|tool_info| tool_info.server_name == server && tool_info.tool.name == tool_name)?;
@@ -1521,6 +1525,7 @@ pub(crate) async fn lookup_mcp_tool_metadata(
         connector_id: tool_info.connector_id,
         connector_name: tool_info.connector_name,
         connector_description,
+        plugin_id,
         tool_title: tool_info.tool.title,
         tool_description: tool_info.tool.description.map(std::borrow::Cow::into_owned),
         mcp_app_resource_uri: get_mcp_app_resource_uri(tool_info.tool.meta.as_deref()),
@@ -1998,8 +2003,7 @@ async fn maybe_persist_mcp_tool_approval(
             remember_mcp_tool_approval(sess, key).await;
             return;
         };
-        persist_codex_app_tool_approval(&turn_context.config.codex_home, &connector_id, &tool_name)
-            .await
+        persist_codex_app_tool_approval(&turn_context.config, &connector_id, &tool_name).await
     } else {
         persist_non_app_mcp_tool_approval(sess, &turn_context.config, &key.server, &tool_name).await
     };
@@ -2020,11 +2024,11 @@ async fn maybe_persist_mcp_tool_approval(
 }
 
 async fn persist_codex_app_tool_approval(
-    codex_home: &AbsolutePathBuf,
+    config: &Config,
     connector_id: &str,
     tool_name: &str,
 ) -> anyhow::Result<()> {
-    ConfigEditsBuilder::new(codex_home)
+    ConfigEditsBuilder::for_config(config)
         .with_edits([ConfigEdit::SetPath {
             segments: vec![
                 "apps".to_string(),
@@ -2045,11 +2049,12 @@ async fn persist_custom_mcp_tool_approval(
     server: &str,
     tool_name: &str,
 ) -> anyhow::Result<()> {
-    let Some(config_folder) = custom_mcp_tool_approval_config_folder(config, server).await? else {
+    let Some(config_edits_builder) = custom_mcp_tool_approval_config_builder(config, server)?
+    else {
         anyhow::bail!("MCP server `{server}` is not configured in config.toml");
     };
 
-    persist_custom_mcp_tool_approval_at(&config_folder, server, tool_name).await
+    persist_custom_mcp_tool_approval_with(config_edits_builder, server, tool_name).await
 }
 
 async fn persist_non_app_mcp_tool_approval(
@@ -2058,8 +2063,9 @@ async fn persist_non_app_mcp_tool_approval(
     server: &str,
     tool_name: &str,
 ) -> anyhow::Result<()> {
-    if let Some(config_folder) = custom_mcp_tool_approval_config_folder(config, server).await? {
-        return persist_custom_mcp_tool_approval_at(&config_folder, server, tool_name).await;
+    if let Some(config_edits_builder) = custom_mcp_tool_approval_config_builder(config, server)? {
+        return persist_custom_mcp_tool_approval_with(config_edits_builder, server, tool_name)
+            .await;
     }
 
     let plugin_config_name = sess
@@ -2074,7 +2080,7 @@ async fn persist_non_app_mcp_tool_approval(
         .map(|plugin| plugin.config_name.clone());
 
     if let Some(plugin_config_name) = plugin_config_name {
-        return ConfigEditsBuilder::new(&config.codex_home)
+        return ConfigEditsBuilder::for_config(config)
             .with_edits([ConfigEdit::SetPath {
                 segments: vec![
                     "plugins".to_string(),
@@ -2094,26 +2100,24 @@ async fn persist_non_app_mcp_tool_approval(
     anyhow::bail!("MCP server `{server}` is not configured in config.toml or an enabled plugin")
 }
 
-async fn custom_mcp_tool_approval_config_folder(
+fn custom_mcp_tool_approval_config_builder(
     config: &Config,
     server: &str,
-) -> anyhow::Result<Option<AbsolutePathBuf>> {
+) -> anyhow::Result<Option<ConfigEditsBuilder>> {
     if let Some(project_config_folder) = project_mcp_tool_approval_config_folder(config, server) {
-        return Ok(Some(project_config_folder));
+        return Ok(Some(ConfigEditsBuilder::new(&project_config_folder)));
     }
 
-    let servers = load_global_mcp_servers(&config.codex_home).await?;
-    Ok(servers
-        .contains_key(server)
-        .then(|| config.codex_home.clone()))
+    Ok(user_mcp_server_is_configured(config, server)?
+        .then(|| ConfigEditsBuilder::for_config(config)))
 }
 
-async fn persist_custom_mcp_tool_approval_at(
-    config_folder: &AbsolutePathBuf,
+async fn persist_custom_mcp_tool_approval_with(
+    config_edits_builder: ConfigEditsBuilder,
     server: &str,
     tool_name: &str,
 ) -> anyhow::Result<()> {
-    ConfigEditsBuilder::new(config_folder)
+    config_edits_builder
         .with_edits([ConfigEdit::SetPath {
             segments: vec![
                 "mcp_servers".to_string(),
@@ -2128,6 +2132,21 @@ async fn persist_custom_mcp_tool_approval_at(
         .await
 }
 
+fn user_mcp_server_is_configured(config: &Config, server: &str) -> anyhow::Result<bool> {
+    let Some(mcp_servers_toml) = config
+        .config_layer_stack
+        .effective_user_config()
+        .as_ref()
+        .and_then(|user_config| user_config.get("mcp_servers"))
+        .cloned()
+    else {
+        return Ok(false);
+    };
+    let servers =
+        HashMap::<String, codex_config::types::McpServerConfig>::deserialize(mcp_servers_toml)?;
+    Ok(servers.contains_key(server))
+}
+
 fn project_mcp_tool_approval_config_folder(
     config: &Config,
     server: &str,
diff --git a/codex-rs/core/src/mcp_tool_call_tests.rs b/codex-rs/core/src/mcp_tool_call_tests.rs
index ecad2091c5..50a6bb4d45 100644
--- a/codex-rs/core/src/mcp_tool_call_tests.rs
+++ b/codex-rs/core/src/mcp_tool_call_tests.rs
@@ -23,7 +23,13 @@ use codex_protocol::models::PermissionProfile;
 use codex_protocol::protocol::AskForApproval;
 use codex_protocol::protocol::EventMsg;
 use codex_protocol::protocol::GranularApprovalConfig;
-use core_test_support::PathExt;
+use codex_protocol::protocol::McpInvocation;
+use codex_protocol::protocol::SessionSource;
+use codex_rollout_trace::ThreadStartedTraceMetadata;
+use codex_rollout_trace::ToolDispatchInvocation;
+use codex_rollout_trace::ToolDispatchPayload;
+use codex_rollout_trace::ToolDispatchRequester;
+use codex_rollout_trace::replay_bundle;
 use core_test_support::hooks::trusted_config_layer_stack;
 use core_test_support::responses::ev_assistant_message;
 use core_test_support::responses::ev_completed;
@@ -34,6 +40,9 @@ use core_test_support::responses::start_mock_server;
 use pretty_assertions::assert_eq;
 use serde::Deserialize;
 use std::collections::HashMap;
+use std::fs;
+use std::path::Path;
+use std::path::PathBuf;
 use std::sync::Arc;
 use tempfile::tempdir;
 use tracing::Instrument;
@@ -67,6 +76,7 @@ fn approval_metadata(
         connector_id: connector_id.map(str::to_string),
         connector_name: connector_name.map(str::to_string),
         connector_description: connector_description.map(str::to_string),
+        plugin_id: None,
         tool_title: tool_title.map(str::to_string),
         tool_description: tool_description.map(str::to_string),
         mcp_app_resource_uri: None,
@@ -116,6 +126,60 @@ fn prompt_options(
     }
 }
 
+#[tokio::test]
+async fn execute_mcp_tool_call_records_replayable_correlation() -> anyhow::Result<()> {
+    let temp = tempdir()?;
+    let (mut session, turn_context) = make_session_and_context().await;
+    attach_trace_bundle(&mut session, &turn_context, temp.path())?;
+
+    let dispatch_trace = session
+        .services
+        .rollout_thread_trace
+        .start_tool_dispatch_trace(|| {
+            Some(ToolDispatchInvocation {
+                thread_id: session.conversation_id.to_string(),
+                codex_turn_id: turn_context.sub_id.clone(),
+                tool_call_id: "mcp-call".to_string(),
+                tool_name: "search".to_string(),
+                tool_namespace: Some("mcp__docs__".to_string()),
+                requester: ToolDispatchRequester::Model {
+                    model_visible_call_id: "mcp-call".to_string(),
+                },
+                payload: ToolDispatchPayload::Function {
+                    arguments: r#"{"query":"trace"}"#.to_string(),
+                },
+            })
+        });
+    assert!(dispatch_trace.is_enabled());
+
+    let result = execute_mcp_tool_call(
+        &session,
+        &turn_context,
+        "mcp-call",
+        &McpInvocation {
+            server: "docs".to_string(),
+            tool: "search".to_string(),
+            arguments: Some(serde_json::json!({ "query": "trace" })),
+        },
+        /*rewritten_arguments*/ None,
+        /*metadata*/ None,
+        /*request_meta*/ None,
+    )
+    .await;
+    assert!(
+        result.is_err(),
+        "the synthetic backend is absent; only trace emission matters",
+    );
+
+    let replayed = replay_bundle(single_bundle_dir(temp.path())?)?;
+    assert!(
+        replayed.tool_calls["mcp-call"].mcp_call_id.is_some(),
+        "the real MCP execution path should emit a reducer-visible correlation ID",
+    );
+
+    Ok(())
+}
+
 fn install_mcp_permission_request_hook(
     session: &mut Session,
     turn_context: &TurnContext,
@@ -205,6 +269,45 @@ print({hook_output:?})
     log_path.to_path_buf()
 }
 
+/// Attaches a replayable rollout bundle to one synthetic session under test.
+fn attach_trace_bundle(
+    session: &mut Session,
+    turn_context: &TurnContext,
+    root: &Path,
+) -> anyhow::Result<()> {
+    let rollout_thread_trace =
+        codex_rollout_trace::ThreadTraceContext::start_root_in_root_for_test(
+            root,
+            ThreadStartedTraceMetadata {
+                thread_id: session.conversation_id.to_string(),
+                agent_path: "/root".to_string(),
+                task_name: None,
+                nickname: None,
+                agent_role: None,
+                session_source: SessionSource::Exec,
+                cwd: PathBuf::from("/workspace"),
+                rollout_path: None,
+                model: "gpt-test".to_string(),
+                provider_name: "test-provider".to_string(),
+                approval_policy: "never".to_string(),
+                sandbox_policy: "danger-full-access".to_string(),
+            },
+        )?;
+    rollout_thread_trace.record_codex_turn_started(turn_context.sub_id.as_str());
+    session.services.rollout_thread_trace = rollout_thread_trace;
+    Ok(())
+}
+
+/// Returns the sole bundle emitted under a temporary rollout trace root.
+fn single_bundle_dir(root: &Path) -> anyhow::Result<PathBuf> {
+    let mut entries = fs::read_dir(root)?
+        .map(|entry| entry.map(|entry| entry.path()))
+        .collect::<Result<Vec<_>, _>>()?;
+    entries.sort();
+    assert_eq!(entries.len(), 1);
+    Ok(entries.remove(0))
+}
+
 #[test]
 fn mcp_app_resource_uri_reads_known_tool_meta_keys() {
     let nested = serde_json::json!({
@@ -997,6 +1100,29 @@ async fn mcp_tool_call_request_meta_includes_turn_started_at_unix_ms() {
     );
 }
 
+#[tokio::test]
+async fn plugin_mcp_tool_call_request_meta_includes_plugin_id() {
+    let (_, turn_context) = make_session_and_context().await;
+    let expected_turn_metadata = turn_context
+        .turn_metadata_state
+        .current_meta_value_for_mcp_request(mcp_turn_metadata_context(&turn_context))
+        .expect("turn metadata");
+    let mut metadata = approval_metadata(
+        /*connector_id*/ None, /*connector_name*/ None,
+        /*connector_description*/ None, /*tool_title*/ None,
+        /*tool_description*/ None,
+    );
+    metadata.plugin_id = Some("sample@test".to_string());
+
+    assert_eq!(
+        build_mcp_tool_call_request_meta(&turn_context, "sample", "call-plugin", Some(&metadata),),
+        Some(serde_json::json!({
+            crate::X_CODEX_TURN_METADATA_HEADER: expected_turn_metadata,
+            MCP_TOOL_PLUGIN_ID_META_KEY: "sample@test",
+        }))
+    );
+}
+
 #[tokio::test]
 async fn codex_apps_tool_call_request_meta_includes_turn_metadata_and_codex_apps_meta() {
     let (_, turn_context) = make_session_and_context().await;
@@ -1009,6 +1135,7 @@ async fn codex_apps_tool_call_request_meta_includes_turn_metadata_and_codex_apps
         connector_id: Some("calendar".to_string()),
         connector_name: Some("Calendar".to_string()),
         connector_description: Some("Manage events".to_string()),
+        plugin_id: None,
         tool_title: Some("Create Event".to_string()),
         tool_description: Some("Create a calendar event.".to_string()),
         mcp_app_resource_uri: None,
@@ -1108,8 +1235,8 @@ async fn install_host_owned_codex_apps_manager(session: &Session, turn_context:
     let environment = session
         .services
         .environment_manager
-        .default_environment()
-        .unwrap_or_else(|| session.services.environment_manager.local_environment());
+        .default_or_local_environment()
+        .expect("test session should have an MCP runtime environment");
     let (manager, _cancel_token) = codex_mcp::McpConnectionManager::new(
         &HashMap::new(),
         turn_context.config.mcp_oauth_credentials_store_mode,
@@ -1118,7 +1245,14 @@ async fn install_host_owned_codex_apps_manager(session: &Session, turn_context:
         turn_context.sub_id.clone(),
         session.get_tx_event(),
         turn_context.permission_profile(),
-        codex_mcp::McpRuntimeEnvironment::new(environment, turn_context.cwd.to_path_buf()),
+        codex_mcp::McpRuntimeEnvironment::new(
+            Some(environment),
+            session.services.environment_manager.try_local_environment(),
+            {
+                #[allow(deprecated)]
+                turn_context.cwd.to_path_buf()
+            },
+        ),
         turn_context.config.codex_home.to_path_buf(),
         codex_mcp::codex_apps_tools_cache_key(auth.as_ref()),
         /*host_owned_codex_apps_enabled*/ true,
@@ -1468,6 +1602,7 @@ fn guardian_mcp_review_request_includes_annotations_when_present() {
         connector_id: None,
         connector_name: None,
         connector_description: None,
+        plugin_id: None,
         tool_title: None,
         tool_description: None,
         mcp_app_resource_uri: None,
@@ -1768,8 +1903,13 @@ fn accepted_elicitation_without_content_defaults_to_accept() {
 #[tokio::test]
 async fn persist_codex_app_tool_approval_writes_tool_override() {
     let tmp = tempdir().expect("tempdir");
+    let config = ConfigBuilder::default()
+        .codex_home(tmp.path().to_path_buf())
+        .build()
+        .await
+        .expect("load config");
 
-    persist_codex_app_tool_approval(&tmp.path().abs(), "calendar", "calendar/list_events")
+    persist_codex_app_tool_approval(&config, "calendar", "calendar/list_events")
         .await
         .expect("persist approval");
 
@@ -2010,7 +2150,7 @@ async fn maybe_persist_mcp_tool_approval_reloads_session_config() {
 
 #[tokio::test]
 async fn maybe_persist_mcp_tool_approval_reloads_session_config_for_custom_server() {
-    let (session, turn_context) = make_session_and_context().await;
+    let (session, mut turn_context) = make_session_and_context().await;
     let codex_home = session.codex_home().await;
     std::fs::create_dir_all(&codex_home).expect("create codex home");
     std::fs::write(
@@ -2018,6 +2158,12 @@ async fn maybe_persist_mcp_tool_approval_reloads_session_config_for_custom_serve
         "[mcp_servers.docs]\ncommand = \"docs-server\"\n",
     )
     .expect("seed config");
+    let config = ConfigBuilder::without_managed_config_for_tests()
+        .codex_home(codex_home.clone().to_path_buf())
+        .build()
+        .await
+        .expect("load config");
+    turn_context.config = Arc::new(config);
     let key = McpToolApprovalKey {
         server: "docs".to_string(),
         connector_id: None,
@@ -2127,7 +2273,6 @@ async fn maybe_persist_mcp_tool_approval_writes_project_config_for_project_serve
         .build()
         .await
         .expect("load project config");
-    turn_context.cwd = config.cwd.clone();
     turn_context.config = Arc::new(config);
     let key = McpToolApprovalKey {
         server: "docs".to_string(),
@@ -2175,6 +2320,7 @@ async fn approve_mode_skips_when_annotations_do_not_require_approval() {
         connector_id: None,
         connector_name: None,
         connector_description: None,
+        plugin_id: None,
         tool_title: Some("Read Only Tool".to_string()),
         tool_description: None,
         mcp_app_resource_uri: None,
@@ -2248,6 +2394,7 @@ async fn guardian_mode_skips_auto_when_annotations_do_not_require_approval() {
         connector_id: None,
         connector_name: None,
         connector_description: None,
+        plugin_id: None,
         tool_title: Some("Read Only Tool".to_string()),
         tool_description: None,
         mcp_app_resource_uri: None,
@@ -2304,6 +2451,7 @@ async fn permission_request_hook_allows_mcp_tool_call() {
         connector_id: None,
         connector_name: None,
         connector_description: None,
+        plugin_id: None,
         tool_title: Some("Create entities".to_string()),
         tool_description: None,
         mcp_app_resource_uri: None,
@@ -2328,12 +2476,14 @@ async fn permission_request_hook_allows_mcp_tool_call() {
         .lines()
         .map(|line| serde_json::from_str::<serde_json::Value>(line).expect("parse hook input"))
         .collect::<Vec<_>>();
+    #[allow(deprecated)]
+    let turn_cwd = turn_context.cwd.clone();
     assert_eq!(
         inputs,
         vec![serde_json::json!({
             "session_id": session.session_id(),
             "turn_id": "turn_id",
-            "cwd": turn_context.cwd,
+            "cwd": turn_cwd,
             "transcript_path": null,
             "model": turn_context.model_info.slug,
             "permission_mode": "default",
@@ -2388,12 +2538,14 @@ async fn permission_request_hook_uses_hook_tool_name_without_metadata() {
         .lines()
         .map(|line| serde_json::from_str::<serde_json::Value>(line).expect("parse hook input"))
         .collect::<Vec<_>>();
+    #[allow(deprecated)]
+    let turn_cwd = turn_context.cwd.clone();
     assert_eq!(
         inputs,
         vec![serde_json::json!({
             "session_id": session.session_id(),
             "turn_id": "turn_id",
-            "cwd": turn_context.cwd,
+            "cwd": turn_cwd,
             "transcript_path": null,
             "model": turn_context.model_info.slug,
             "permission_mode": "default",
@@ -2435,6 +2587,7 @@ async fn permission_request_hook_runs_after_remembered_mcp_approval() {
         connector_id: None,
         connector_name: None,
         connector_description: None,
+        plugin_id: None,
         tool_title: Some("Create entities".to_string()),
         tool_description: None,
         mcp_app_resource_uri: None,
@@ -2521,6 +2674,7 @@ async fn guardian_mode_mcp_denial_returns_rationale_message() {
         connector_id: None,
         connector_name: None,
         connector_description: None,
+        plugin_id: None,
         tool_title: Some("Dangerous Tool".to_string()),
         tool_description: Some("Reads calendar data.".to_string()),
         mcp_app_resource_uri: None,
@@ -2574,6 +2728,7 @@ async fn prompt_mode_waits_for_approval_when_annotations_do_not_require_approval
         connector_id: None,
         connector_name: None,
         connector_description: None,
+        plugin_id: None,
         tool_title: Some("Read Only Tool".to_string()),
         tool_description: None,
         mcp_app_resource_uri: None,
@@ -2653,6 +2808,7 @@ async fn approve_mode_skips_arc_interrupt_for_model() {
         connector_id: Some("calendar".to_string()),
         connector_name: Some("Calendar".to_string()),
         connector_description: Some("Manage events".to_string()),
+        plugin_id: None,
         tool_title: Some("Dangerous Tool".to_string()),
         tool_description: Some("Performs a risky action.".to_string()),
         mcp_app_resource_uri: None,
@@ -2720,6 +2876,7 @@ async fn custom_approve_mode_skips_arc_interrupt_for_model() {
         connector_id: None,
         connector_name: None,
         connector_description: None,
+        plugin_id: None,
         tool_title: Some("Dangerous Tool".to_string()),
         tool_description: Some("Performs a risky action.".to_string()),
         mcp_app_resource_uri: None,
@@ -2787,6 +2944,7 @@ async fn approve_mode_skips_arc_interrupt_without_annotations() {
         connector_id: Some("calendar".to_string()),
         connector_name: Some("Calendar".to_string()),
         connector_description: Some("Manage events".to_string()),
+        plugin_id: None,
         tool_title: Some("Dangerous Tool".to_string()),
         tool_description: Some("Performs a risky action.".to_string()),
         mcp_app_resource_uri: None,
@@ -2859,6 +3017,7 @@ async fn full_access_mode_skips_arc_monitor_for_all_approval_modes() {
         connector_id: Some("calendar".to_string()),
         connector_name: Some("Calendar".to_string()),
         connector_description: Some("Manage events".to_string()),
+        plugin_id: None,
         tool_title: Some("Dangerous Tool".to_string()),
         tool_description: Some("Performs a risky action.".to_string()),
         mcp_app_resource_uri: None,
@@ -2927,6 +3086,7 @@ async fn approve_mode_skips_arc_and_guardian_in_every_permission_mode() {
         connector_id: Some("calendar".to_string()),
         connector_name: Some("Calendar".to_string()),
         connector_description: Some("Manage events".to_string()),
+        plugin_id: None,
         tool_title: Some("Dangerous Tool".to_string()),
         tool_description: Some("Performs a risky action.".to_string()),
         mcp_app_resource_uri: None,
diff --git a/codex-rs/core/src/mcp_tool_exposure.rs b/codex-rs/core/src/mcp_tool_exposure.rs
index 0bf696acdf..e58be65f9c 100644
--- a/codex-rs/core/src/mcp_tool_exposure.rs
+++ b/codex-rs/core/src/mcp_tool_exposure.rs
@@ -3,7 +3,6 @@ use std::collections::HashSet;
 use codex_features::Feature;
 use codex_mcp::CODEX_APPS_MCP_SERVER_NAME;
 use codex_mcp::ToolInfo as McpToolInfo;
-use codex_tools::ToolsConfig;
 
 use crate::config::Config;
 use crate::connectors;
@@ -18,9 +17,8 @@ pub(crate) struct McpToolExposure {
 pub(crate) fn build_mcp_tool_exposure(
     all_mcp_tools: &[McpToolInfo],
     connectors: Option<&[connectors::AppInfo]>,
-    explicitly_enabled_connectors: &[connectors::AppInfo],
     config: &Config,
-    tools_config: &ToolsConfig,
+    search_tool_enabled: bool,
 ) -> McpToolExposure {
     let mut deferred_tools = filter_non_codex_apps_mcp_tools_only(all_mcp_tools);
     if let Some(connectors) = connectors {
@@ -31,7 +29,7 @@ pub(crate) fn build_mcp_tool_exposure(
         ));
     }
 
-    let should_defer = tools_config.search_tool
+    let should_defer = search_tool_enabled
         && (config
             .features
             .enabled(Feature::ToolSearchAlwaysDeferMcpTools)
@@ -44,16 +42,8 @@ pub(crate) fn build_mcp_tool_exposure(
         };
     }
 
-    let direct_tools =
-        filter_codex_apps_mcp_tools(all_mcp_tools, explicitly_enabled_connectors, config);
-    let direct_tool_names = direct_tools
-        .iter()
-        .map(McpToolInfo::canonical_tool_name)
-        .collect::<HashSet<_>>();
-    deferred_tools.retain(|tool| !direct_tool_names.contains(&tool.canonical_tool_name()));
-
     McpToolExposure {
-        direct_tools,
+        direct_tools: Vec::new(),
         deferred_tools: (!deferred_tools.is_empty()).then_some(deferred_tools),
     }
 }
diff --git a/codex-rs/core/src/mcp_tool_exposure_test.rs b/codex-rs/core/src/mcp_tool_exposure_test.rs
index f9468d898f..fba7fe1f84 100644
--- a/codex-rs/core/src/mcp_tool_exposure_test.rs
+++ b/codex-rs/core/src/mcp_tool_exposure_test.rs
@@ -2,17 +2,9 @@ use std::collections::HashSet;
 use std::sync::Arc;
 
 use codex_features::Feature;
-use codex_features::Features;
 use codex_mcp::CODEX_APPS_MCP_SERVER_NAME;
 use codex_mcp::ToolInfo;
-use codex_models_manager::test_support::construct_model_info_offline_for_tests;
-use codex_protocol::config_types::WebSearchMode;
-use codex_protocol::config_types::WindowsSandboxLevel;
-use codex_protocol::models::PermissionProfile;
-use codex_protocol::protocol::SessionSource;
 use codex_tools::ToolName;
-use codex_tools::ToolsConfig;
-use codex_tools::ToolsConfigParams;
 use pretty_assertions::assert_eq;
 use rmcp::model::JsonObject;
 use rmcp::model::Tool;
@@ -94,38 +86,13 @@ fn tool_names(tools: &[ToolInfo]) -> HashSet<ToolName> {
         .collect()
 }
 
-async fn tools_config_for_mcp_tool_exposure(search_tool: bool) -> ToolsConfig {
-    let config = test_config().await;
-    let model_info =
-        construct_model_info_offline_for_tests("gpt-5.4", &config.to_models_manager_config());
-    let features = Features::with_defaults();
-    let available_models = Vec::new();
-    let mut tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    tools_config.search_tool = search_tool;
-    tools_config
-}
-
 #[tokio::test]
 async fn directly_exposes_small_effective_tool_sets() {
     let config = test_config().await;
-    let tools_config = tools_config_for_mcp_tool_exposure(/*search_tool*/ true).await;
     let mcp_tools = numbered_mcp_tools(DIRECT_MCP_TOOL_EXPOSURE_THRESHOLD - 1);
 
     let exposure = build_mcp_tool_exposure(
-        &mcp_tools,
-        /*connectors*/ None,
-        &[],
-        &config,
-        &tools_config,
+        &mcp_tools, /*connectors*/ None, &config, /*search_tool_enabled*/ true,
     );
 
     assert_eq!(tool_names(&exposure.direct_tools), tool_names(&mcp_tools));
@@ -135,15 +102,10 @@ async fn directly_exposes_small_effective_tool_sets() {
 #[tokio::test]
 async fn searches_large_effective_tool_sets() {
     let config = test_config().await;
-    let tools_config = tools_config_for_mcp_tool_exposure(/*search_tool*/ true).await;
     let mcp_tools = numbered_mcp_tools(DIRECT_MCP_TOOL_EXPOSURE_THRESHOLD);
 
     let exposure = build_mcp_tool_exposure(
-        &mcp_tools,
-        /*connectors*/ None,
-        &[],
-        &config,
-        &tools_config,
+        &mcp_tools, /*connectors*/ None, &config, /*search_tool_enabled*/ true,
     );
 
     assert!(exposure.direct_tools.is_empty());
@@ -155,64 +117,12 @@ async fn searches_large_effective_tool_sets() {
 }
 
 #[tokio::test]
-async fn directly_exposes_explicit_apps_without_deferred_overlap() {
-    let config = test_config().await;
-    let tools_config = tools_config_for_mcp_tool_exposure(/*search_tool*/ true).await;
-    let mut mcp_tools = numbered_mcp_tools(DIRECT_MCP_TOOL_EXPOSURE_THRESHOLD - 1);
-    mcp_tools.push(make_mcp_tool(
-        CODEX_APPS_MCP_SERVER_NAME,
-        "calendar_create_event",
-        "mcp__codex_apps__calendar",
-        "_create_event",
-        Some("calendar"),
-        Some("Calendar"),
-    ));
-    let connectors = vec![make_connector("calendar", "Calendar")];
-
-    let exposure = build_mcp_tool_exposure(
-        &mcp_tools,
-        Some(connectors.as_slice()),
-        connectors.as_slice(),
-        &config,
-        &tools_config,
-    );
-
-    let direct_tool_names = tool_names(&exposure.direct_tools);
-    assert_eq!(
-        direct_tool_names,
-        HashSet::from([ToolName::namespaced(
-            "mcp__codex_apps__calendar",
-            "_create_event"
-        )])
-    );
-    assert_eq!(
-        exposure.deferred_tools.as_ref().map(Vec::len),
-        Some(DIRECT_MCP_TOOL_EXPOSURE_THRESHOLD - 1)
-    );
-    let deferred_tools = exposure
-        .deferred_tools
-        .as_ref()
-        .expect("large tool sets should be discoverable through tool_search");
-    let deferred_tool_names = tool_names(deferred_tools);
-    assert!(
-        direct_tool_names.is_disjoint(&deferred_tool_names),
-        "direct tools should not also be deferred: {direct_tool_names:?}"
-    );
-    assert!(!deferred_tool_names.contains(&ToolName::namespaced(
-        "mcp__codex_apps__calendar",
-        "_create_event"
-    )));
-    assert!(deferred_tool_names.contains(&ToolName::namespaced("mcp__rmcp__", "tool_0")));
-}
-
-#[tokio::test]
-async fn always_defer_feature_preserves_explicit_apps() {
+async fn always_defer_feature_defers_apps_too() {
     let mut config = test_config().await;
     config
         .features
         .enable(Feature::ToolSearchAlwaysDeferMcpTools)
         .expect("test config should allow feature update");
-    let tools_config = tools_config_for_mcp_tool_exposure(/*search_tool*/ true).await;
     let mcp_tools = vec![
         make_mcp_tool(
             "rmcp",
@@ -236,26 +146,18 @@ async fn always_defer_feature_preserves_explicit_apps() {
     let exposure = build_mcp_tool_exposure(
         &mcp_tools,
         Some(connectors.as_slice()),
-        connectors.as_slice(),
         &config,
-        &tools_config,
+        /*search_tool_enabled*/ true,
     );
 
-    let direct_tool_names = tool_names(&exposure.direct_tools);
-    assert_eq!(
-        direct_tool_names,
-        HashSet::from([ToolName::namespaced(
-            "mcp__codex_apps__calendar",
-            "_create_event"
-        )])
-    );
+    assert!(exposure.direct_tools.is_empty());
     let deferred_tools = exposure
         .deferred_tools
         .as_ref()
         .expect("MCP tools should be discoverable through tool_search");
     let deferred_tool_names = tool_names(deferred_tools);
     assert!(deferred_tool_names.contains(&ToolName::namespaced("mcp__rmcp__", "tool")));
-    assert!(!deferred_tool_names.contains(&ToolName::namespaced(
+    assert!(deferred_tool_names.contains(&ToolName::namespaced(
         "mcp__codex_apps__calendar",
         "_create_event"
     )));
diff --git a/codex-rs/core/src/memory_usage.rs b/codex-rs/core/src/memory_usage.rs
index fd54044f21..9e9601c730 100644
--- a/codex-rs/core/src/memory_usage.rs
+++ b/codex-rs/core/src/memory_usage.rs
@@ -5,7 +5,6 @@ use crate::tools::handlers::unified_exec::ExecCommandArgs;
 use codex_memories_read::usage::MEMORIES_USAGE_METRIC;
 use codex_memories_read::usage::memories_usage_kinds_from_command;
 use codex_protocol::models::ShellCommandToolCallParams;
-use codex_protocol::models::ShellToolCallParams;
 use std::path::PathBuf;
 
 pub(crate) async fn emit_metric_for_tool_read(invocation: &ToolInvocation, success: bool) {
@@ -41,34 +40,26 @@ fn shell_command_for_invocation(invocation: &ToolInvocation) -> Option<(Vec<Stri
         invocation.tool_name.namespace.as_deref(),
         invocation.tool_name.name.as_str(),
     ) {
-        (None, "shell") => serde_json::from_str::<ShellToolCallParams>(arguments)
-            .ok()
-            .map(|params| {
-                (
-                    params.command,
-                    invocation.turn.resolve_path(params.workdir).to_path_buf(),
-                )
-            }),
         (None, "shell_command") => serde_json::from_str::<ShellCommandToolCallParams>(arguments)
             .ok()
             .map(|params| {
-                if !invocation.turn.tools_config.allow_login_shell && params.login == Some(true) {
-                    return (
-                        Vec::new(),
-                        invocation.turn.resolve_path(params.workdir).to_path_buf(),
-                    );
+                if !invocation.turn.config.permissions.allow_login_shell
+                    && params.login == Some(true)
+                {
+                    #[allow(deprecated)]
+                    let cwd = invocation.turn.resolve_path(params.workdir).to_path_buf();
+                    return (Vec::new(), cwd);
                 }
                 let use_login_shell = params
                     .login
-                    .unwrap_or(invocation.turn.tools_config.allow_login_shell);
+                    .unwrap_or(invocation.turn.config.permissions.allow_login_shell);
                 let command = invocation
                     .session
                     .user_shell()
                     .derive_exec_args(&params.command, use_login_shell);
-                (
-                    command,
-                    invocation.turn.resolve_path(params.workdir).to_path_buf(),
-                )
+                #[allow(deprecated)]
+                let cwd = invocation.turn.resolve_path(params.workdir).to_path_buf();
+                (command, cwd)
             }),
         (None, "exec_command") => serde_json::from_str::<ExecCommandArgs>(arguments)
             .ok()
@@ -76,14 +67,13 @@ fn shell_command_for_invocation(invocation: &ToolInvocation) -> Option<(Vec<Stri
                 let command = crate::tools::handlers::unified_exec::get_command(
                     &params,
                     invocation.session.user_shell(),
-                    &invocation.turn.tools_config.unified_exec_shell_mode,
-                    invocation.turn.tools_config.allow_login_shell,
+                    &invocation.turn.unified_exec_shell_mode,
+                    invocation.turn.config.permissions.allow_login_shell,
                 )
                 .ok()?;
-                Some((
-                    command,
-                    invocation.turn.resolve_path(params.workdir).to_path_buf(),
-                ))
+                #[allow(deprecated)]
+                let cwd = invocation.turn.resolve_path(params.workdir).to_path_buf();
+                Some((command.command, cwd))
             }),
         (Some(_), _) | (None, _) => None,
     }
diff --git a/codex-rs/core/src/network_proxy_loader.rs b/codex-rs/core/src/network_proxy_loader.rs
index 41ef46e3fd..1c49be2daf 100644
--- a/codex-rs/core/src/network_proxy_loader.rs
+++ b/codex-rs/core/src/network_proxy_loader.rs
@@ -90,7 +90,7 @@ fn collect_layer_mtimes(stack: &ConfigLayerStack) -> Vec<LayerMtime> {
         .filter_map(|layer| {
             let path = match &layer.name {
                 ConfigLayerSource::System { file } => Some(file.clone()),
-                ConfigLayerSource::User { file } => Some(file.clone()),
+                ConfigLayerSource::User { file, .. } => Some(file.clone()),
                 ConfigLayerSource::Project { dot_codex_folder } => {
                     Some(dot_codex_folder.join(CONFIG_TOML_FILE))
                 }
diff --git a/codex-rs/core/src/personality_migration_tests.rs b/codex-rs/core/src/personality_migration_tests.rs
index 699e06fe67..b84d6dd3eb 100644
--- a/codex-rs/core/src/personality_migration_tests.rs
+++ b/codex-rs/core/src/personality_migration_tests.rs
@@ -72,6 +72,7 @@ async fn write_rollout_with_user_event(dir: &Path, thread_id: ThreadId) -> io::R
             images: None,
             local_images: Vec::new(),
             text_elements: Vec::new(),
+            ..Default::default()
         })),
     };
 
diff --git a/codex-rs/core/src/prompt_debug.rs b/codex-rs/core/src/prompt_debug.rs
index 72fa5b4e44..f6bf7d0022 100644
--- a/codex-rs/core/src/prompt_debug.rs
+++ b/codex-rs/core/src/prompt_debug.rs
@@ -1,4 +1,3 @@
-use std::collections::HashSet;
 use std::sync::Arc;
 
 use codex_exec_server::EnvironmentManager;
@@ -46,9 +45,12 @@ pub async fn build_prompt_input(
         Arc::clone(&auth_manager),
         SessionSource::Exec,
         Arc::new(
-            EnvironmentManager::from_codex_home(config.codex_home.clone(), local_runtime_paths)
-                .await
-                .map_err(|err| CodexErr::Fatal(err.to_string()))?,
+            EnvironmentManager::from_codex_home(
+                config.codex_home.clone(),
+                Some(local_runtime_paths),
+            )
+            .await
+            .map_err(|err| CodexErr::Fatal(err.to_string()))?,
         ),
         empty_extension_registry(),
         /*analytics_events_client*/ None,
@@ -86,15 +88,7 @@ pub(crate) async fn build_prompt_input_from_session(
         .clone_history()
         .await
         .for_prompt(&turn_context.model_info.input_modalities);
-    let router = built_tools(
-        sess,
-        turn_context.as_ref(),
-        &prompt_input,
-        &HashSet::new(),
-        Some(turn_context.turn_skills.outcome.as_ref()),
-        &CancellationToken::new(),
-    )
-    .await?;
+    let router = built_tools(sess, turn_context.as_ref(), &CancellationToken::new()).await?;
     let base_instructions = sess.get_base_instructions().await;
     let prompt = build_prompt(
         prompt_input,
diff --git a/codex-rs/core/src/safety_tests.rs b/codex-rs/core/src/safety_tests.rs
index d699172498..ca15d0fe42 100644
--- a/codex-rs/core/src/safety_tests.rs
+++ b/codex-rs/core/src/safety_tests.rs
@@ -1,20 +1,16 @@
 use super::*;
 use codex_protocol::models::PermissionProfile;
+use codex_protocol::permissions::NetworkSandboxPolicy;
 use codex_protocol::protocol::FileSystemAccessMode;
 use codex_protocol::protocol::FileSystemPath;
 use codex_protocol::protocol::FileSystemSandboxEntry;
 use codex_protocol::protocol::FileSystemSpecialPath;
 use codex_protocol::protocol::GranularApprovalConfig;
-use codex_protocol::protocol::SandboxPolicy;
 use codex_utils_absolute_path::AbsolutePathBuf;
 use core_test_support::PathExt;
 use pretty_assertions::assert_eq;
 use tempfile::TempDir;
 
-fn permission_profile_for_policy(sandbox_policy: &SandboxPolicy) -> PermissionProfile {
-    PermissionProfile::from_legacy_sandbox_policy(sandbox_policy)
-}
-
 #[test]
 fn test_writable_roots_constraint() {
     // Use a temporary directory as our workspace to avoid touching
@@ -32,36 +28,34 @@ fn test_writable_roots_constraint() {
 
     // Policy limited to the workspace only; exclude system temp roots so
     // only `cwd` is writable by default.
-    let policy_workspace_only = SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![],
-        network_access: false,
-        exclude_tmpdir_env_var: true,
-        exclude_slash_tmp: true,
-    };
+    let workspace_only_file_system_policy = FileSystemSandboxPolicy::workspace_write(
+        &[],
+        /*exclude_tmpdir_env_var*/ true,
+        /*exclude_slash_tmp*/ true,
+    );
 
     assert!(is_write_patch_constrained_to_writable_paths(
         &add_inside,
-        &FileSystemSandboxPolicy::from(&policy_workspace_only),
+        &workspace_only_file_system_policy,
         &cwd,
     ));
 
     assert!(!is_write_patch_constrained_to_writable_paths(
         &add_outside,
-        &FileSystemSandboxPolicy::from(&policy_workspace_only),
+        &workspace_only_file_system_policy,
         &cwd,
     ));
 
     // With the parent dir explicitly added as a writable root, the
     // outside write should be permitted.
-    let policy_with_parent = SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![parent],
-        network_access: false,
-        exclude_tmpdir_env_var: true,
-        exclude_slash_tmp: true,
-    };
+    let file_system_policy_with_parent = FileSystemSandboxPolicy::workspace_write(
+        std::slice::from_ref(&parent),
+        /*exclude_tmpdir_env_var*/ true,
+        /*exclude_slash_tmp*/ true,
+    );
     assert!(is_write_patch_constrained_to_writable_paths(
         &add_outside,
-        &FileSystemSandboxPolicy::from(&policy_with_parent),
+        &file_system_policy_with_parent,
         &cwd,
     ));
 }
@@ -73,16 +67,17 @@ fn external_sandbox_auto_approves_in_on_request() {
     let add_inside_path = cwd.join("inner.txt");
     let add_inside = ApplyPatchAction::new_add_for_test(&add_inside_path, "".to_string());
 
-    let policy = SandboxPolicy::ExternalSandbox {
-        network_access: codex_protocol::protocol::NetworkAccess::Enabled,
+    let permission_profile = PermissionProfile::External {
+        network: NetworkSandboxPolicy::Enabled,
     };
+    let file_system_sandbox_policy = FileSystemSandboxPolicy::external_sandbox();
 
     assert_eq!(
         assess_patch_safety(
             &add_inside,
             AskForApproval::OnRequest,
-            &permission_profile_for_policy(&policy),
-            &FileSystemSandboxPolicy::from(&policy),
+            &permission_profile,
+            &file_system_sandbox_policy,
             &cwd,
             WindowsSandboxLevel::Disabled
         ),
@@ -100,19 +95,20 @@ fn granular_with_all_flags_true_matches_on_request_for_out_of_root_patch() {
     let parent = cwd.parent().unwrap();
     let outside_path = parent.join("outside.txt");
     let add_outside = ApplyPatchAction::new_add_for_test(&outside_path, "".to_string());
-    let policy_workspace_only = SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![],
-        network_access: false,
-        exclude_tmpdir_env_var: true,
-        exclude_slash_tmp: true,
-    };
+    let permission_profile = PermissionProfile::workspace_write_with(
+        &[],
+        NetworkSandboxPolicy::Restricted,
+        /*exclude_tmpdir_env_var*/ true,
+        /*exclude_slash_tmp*/ true,
+    );
+    let file_system_sandbox_policy = permission_profile.file_system_sandbox_policy();
 
     assert_eq!(
         assess_patch_safety(
             &add_outside,
             AskForApproval::OnRequest,
-            &permission_profile_for_policy(&policy_workspace_only),
-            &FileSystemSandboxPolicy::from(&policy_workspace_only),
+            &permission_profile,
+            &file_system_sandbox_policy,
             &cwd,
             WindowsSandboxLevel::Disabled,
         ),
@@ -128,8 +124,8 @@ fn granular_with_all_flags_true_matches_on_request_for_out_of_root_patch() {
                 request_permissions: true,
                 mcp_elicitations: true,
             }),
-            &permission_profile_for_policy(&policy_workspace_only),
-            &FileSystemSandboxPolicy::from(&policy_workspace_only),
+            &permission_profile,
+            &file_system_sandbox_policy,
             &cwd,
             WindowsSandboxLevel::Disabled,
         ),
@@ -144,12 +140,13 @@ fn granular_sandbox_approval_false_rejects_out_of_root_patch() {
     let parent = cwd.parent().unwrap();
     let outside_path = parent.join("outside.txt");
     let add_outside = ApplyPatchAction::new_add_for_test(&outside_path, "".to_string());
-    let policy_workspace_only = SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![],
-        network_access: false,
-        exclude_tmpdir_env_var: true,
-        exclude_slash_tmp: true,
-    };
+    let permission_profile = PermissionProfile::workspace_write_with(
+        &[],
+        NetworkSandboxPolicy::Restricted,
+        /*exclude_tmpdir_env_var*/ true,
+        /*exclude_slash_tmp*/ true,
+    );
+    let file_system_sandbox_policy = permission_profile.file_system_sandbox_policy();
 
     assert_eq!(
         assess_patch_safety(
@@ -161,8 +158,8 @@ fn granular_sandbox_approval_false_rejects_out_of_root_patch() {
                 request_permissions: true,
                 mcp_elicitations: true,
             }),
-            &permission_profile_for_policy(&policy_workspace_only),
-            &FileSystemSandboxPolicy::from(&policy_workspace_only),
+            &permission_profile,
+            &file_system_sandbox_policy,
             &cwd,
             WindowsSandboxLevel::Disabled,
         ),
@@ -178,9 +175,8 @@ fn read_only_policy_rejects_patch_with_read_only_reason() {
     let cwd = tmp.path().abs();
     let inside_path = cwd.join("inside.txt");
     let action = ApplyPatchAction::new_add_for_test(&inside_path, "".to_string());
-    let sandbox_policy = SandboxPolicy::new_read_only_policy();
-    let file_system_sandbox_policy =
-        FileSystemSandboxPolicy::from_legacy_sandbox_policy_for_cwd(&sandbox_policy, &cwd);
+    let permission_profile = PermissionProfile::read_only();
+    let file_system_sandbox_policy = permission_profile.file_system_sandbox_policy();
 
     assert!(!is_write_patch_constrained_to_writable_paths(
         &action,
@@ -191,7 +187,7 @@ fn read_only_policy_rejects_patch_with_read_only_reason() {
         assess_patch_safety(
             &action,
             AskForApproval::Never,
-            &permission_profile_for_policy(&sandbox_policy),
+            &permission_profile,
             &file_system_sandbox_policy,
             &cwd,
             WindowsSandboxLevel::Disabled,
@@ -208,8 +204,8 @@ fn explicit_unreadable_paths_prevent_auto_approval_for_external_sandbox() {
     let blocked_path = cwd.join("blocked.txt");
     let blocked_absolute = blocked_path;
     let action = ApplyPatchAction::new_add_for_test(&blocked_absolute, "".to_string());
-    let sandbox_policy = SandboxPolicy::ExternalSandbox {
-        network_access: codex_protocol::protocol::NetworkAccess::Restricted,
+    let permission_profile = PermissionProfile::External {
+        network: NetworkSandboxPolicy::Restricted,
     };
     let file_system_sandbox_policy = FileSystemSandboxPolicy::restricted(vec![
         FileSystemSandboxEntry {
@@ -222,7 +218,7 @@ fn explicit_unreadable_paths_prevent_auto_approval_for_external_sandbox() {
             path: FileSystemPath::Path {
                 path: blocked_absolute,
             },
-            access: FileSystemAccessMode::None,
+            access: FileSystemAccessMode::Deny,
         },
     ]);
 
@@ -235,7 +231,7 @@ fn explicit_unreadable_paths_prevent_auto_approval_for_external_sandbox() {
         assess_patch_safety(
             &action,
             AskForApproval::OnRequest,
-            &permission_profile_for_policy(&sandbox_policy),
+            &permission_profile,
             &file_system_sandbox_policy,
             &cwd,
             WindowsSandboxLevel::Disabled,
@@ -252,8 +248,8 @@ fn explicit_read_only_subpaths_prevent_auto_approval_for_external_sandbox() {
     let blocked_absolute = blocked_path;
     let docs_absolute = AbsolutePathBuf::resolve_path_against_base("docs", &cwd);
     let action = ApplyPatchAction::new_add_for_test(&blocked_absolute, "".to_string());
-    let sandbox_policy = SandboxPolicy::ExternalSandbox {
-        network_access: codex_protocol::protocol::NetworkAccess::Restricted,
+    let permission_profile = PermissionProfile::External {
+        network: NetworkSandboxPolicy::Restricted,
     };
     let file_system_sandbox_policy = FileSystemSandboxPolicy::restricted(vec![
         FileSystemSandboxEntry {
@@ -279,7 +275,7 @@ fn explicit_read_only_subpaths_prevent_auto_approval_for_external_sandbox() {
         assess_patch_safety(
             &action,
             AskForApproval::OnRequest,
-            &permission_profile_for_policy(&sandbox_policy),
+            &permission_profile,
             &file_system_sandbox_policy,
             &cwd,
             WindowsSandboxLevel::Disabled,
@@ -294,14 +290,21 @@ fn missing_project_dot_codex_config_requires_approval() {
     let cwd = tmp.path().abs();
     let config_path = cwd.join(".codex").join("config.toml");
     let action = ApplyPatchAction::new_add_for_test(&config_path, "".to_string());
-    let sandbox_policy = SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![],
-        network_access: false,
-        exclude_tmpdir_env_var: true,
-        exclude_slash_tmp: true,
-    };
-    let file_system_sandbox_policy =
-        FileSystemSandboxPolicy::from_legacy_sandbox_policy_for_cwd(&sandbox_policy, &cwd);
+    let permission_profile = PermissionProfile::workspace_write_with(
+        &[],
+        NetworkSandboxPolicy::Restricted,
+        /*exclude_tmpdir_env_var*/ true,
+        /*exclude_slash_tmp*/ true,
+    );
+    let mut file_system_sandbox_policy = permission_profile.file_system_sandbox_policy();
+    file_system_sandbox_policy
+        .entries
+        .push(FileSystemSandboxEntry {
+            path: FileSystemPath::Path {
+                path: cwd.join(".codex"),
+            },
+            access: FileSystemAccessMode::Read,
+        });
 
     assert!(!is_write_patch_constrained_to_writable_paths(
         &action,
@@ -312,7 +315,7 @@ fn missing_project_dot_codex_config_requires_approval() {
         assess_patch_safety(
             &action,
             AskForApproval::OnRequest,
-            &permission_profile_for_policy(&sandbox_policy),
+            &permission_profile,
             &file_system_sandbox_policy,
             &cwd,
             WindowsSandboxLevel::Disabled,
diff --git a/codex-rs/core/src/sandbox_tags.rs b/codex-rs/core/src/sandbox_tags.rs
index f6db4da918..2973a5bf94 100644
--- a/codex-rs/core/src/sandbox_tags.rs
+++ b/codex-rs/core/src/sandbox_tags.rs
@@ -1,24 +1,10 @@
 use codex_protocol::config_types::WindowsSandboxLevel;
 use codex_protocol::models::PermissionProfile;
-#[cfg(test)]
-use codex_protocol::protocol::SandboxPolicy;
 use codex_sandboxing::SandboxType;
 use codex_sandboxing::get_platform_sandbox;
 use codex_sandboxing::policy_transforms::should_require_platform_sandbox;
 use std::path::Path;
 
-#[cfg(test)]
-pub(crate) fn sandbox_tag(
-    policy: &SandboxPolicy,
-    windows_sandbox_level: WindowsSandboxLevel,
-) -> &'static str {
-    permission_profile_sandbox_tag(
-        &PermissionProfile::from_legacy_sandbox_policy(policy),
-        windows_sandbox_level,
-        /*enforce_managed_network*/ false,
-    )
-}
-
 pub(crate) fn permission_profile_sandbox_tag(
     profile: &PermissionProfile,
     windows_sandbox_level: WindowsSandboxLevel,
diff --git a/codex-rs/core/src/sandbox_tags_tests.rs b/codex-rs/core/src/sandbox_tags_tests.rs
index 8b00de9ccd..64dc50574f 100644
--- a/codex-rs/core/src/sandbox_tags_tests.rs
+++ b/codex-rs/core/src/sandbox_tags_tests.rs
@@ -1,6 +1,5 @@
 use super::permission_profile_policy_tag;
 use super::permission_profile_sandbox_tag;
-use super::sandbox_tag;
 use codex_protocol::config_types::WindowsSandboxLevel;
 use codex_protocol::models::ManagedFileSystemPermissions;
 use codex_protocol::models::PermissionProfile;
@@ -10,8 +9,6 @@ use codex_protocol::permissions::FileSystemSandboxEntry;
 use codex_protocol::permissions::FileSystemSandboxKind;
 use codex_protocol::permissions::FileSystemSandboxPolicy;
 use codex_protocol::permissions::NetworkSandboxPolicy;
-use codex_protocol::protocol::NetworkAccess;
-use codex_protocol::protocol::SandboxPolicy;
 use codex_sandboxing::SandboxType;
 use codex_sandboxing::get_platform_sandbox;
 use codex_utils_absolute_path::AbsolutePathBuf;
@@ -20,29 +17,32 @@ use std::path::Path;
 
 #[test]
 fn danger_full_access_is_untagged_even_when_linux_sandbox_defaults_apply() {
-    let actual = sandbox_tag(
-        &SandboxPolicy::DangerFullAccess,
+    let actual = permission_profile_sandbox_tag(
+        &PermissionProfile::Disabled,
         WindowsSandboxLevel::Disabled,
+        /*enforce_managed_network*/ false,
     );
     assert_eq!(actual, "none");
 }
 
 #[test]
 fn external_sandbox_keeps_external_tag_when_linux_sandbox_defaults_apply() {
-    let actual = sandbox_tag(
-        &SandboxPolicy::ExternalSandbox {
-            network_access: NetworkAccess::Enabled,
+    let actual = permission_profile_sandbox_tag(
+        &PermissionProfile::External {
+            network: NetworkSandboxPolicy::Enabled,
         },
         WindowsSandboxLevel::Disabled,
+        /*enforce_managed_network*/ false,
     );
     assert_eq!(actual, "external");
 }
 
 #[test]
 fn default_linux_sandbox_uses_platform_sandbox_tag() {
-    let actual = sandbox_tag(
-        &SandboxPolicy::new_read_only_policy(),
+    let actual = permission_profile_sandbox_tag(
+        &PermissionProfile::read_only(),
         WindowsSandboxLevel::Disabled,
+        /*enforce_managed_network*/ false,
     );
     let expected = get_platform_sandbox(/*windows_sandbox_enabled*/ false)
         .map(SandboxType::as_metric_tag)
diff --git a/codex-rs/core/src/session/config_lock.rs b/codex-rs/core/src/session/config_lock.rs
index 18748b33f1..85815f8533 100644
--- a/codex-rs/core/src/session/config_lock.rs
+++ b/codex-rs/core/src/session/config_lock.rs
@@ -186,7 +186,6 @@ fn drop_lockfile_inputs(lock_config: &mut ConfigToml) {
     lock_config.profiles.clear();
     clear_config_lock_debug_controls(lock_config);
     lock_config.model_instructions_file = None;
-    lock_config.experimental_instructions_file = None;
     lock_config.experimental_compact_prompt_file = None;
     lock_config.model_catalog_json = None;
     lock_config.sandbox_mode = None;
@@ -194,7 +193,6 @@ fn drop_lockfile_inputs(lock_config: &mut ConfigToml) {
     lock_config.default_permissions = None;
     lock_config.permissions = None;
     lock_config.experimental_use_unified_exec_tool = None;
-    lock_config.experimental_use_freeform_apply_patch = None;
 }
 
 fn resolved_config_to_toml<Toml>(
@@ -264,6 +262,8 @@ mod tests {
                 enabled: Some(false),
                 max_concurrent_threads_per_session: Some(_),
                 min_wait_timeout_ms: Some(_),
+                max_wait_timeout_ms: Some(_),
+                default_wait_timeout_ms: Some(_),
                 usage_hint_enabled: Some(_),
                 hide_spawn_agent_metadata: Some(_),
                 ..
diff --git a/codex-rs/core/src/session/handlers.rs b/codex-rs/core/src/session/handlers.rs
index ab40cb8eed..3d57bd7074 100644
--- a/codex-rs/core/src/session/handlers.rs
+++ b/codex-rs/core/src/session/handlers.rs
@@ -42,15 +42,15 @@ use codex_protocol::protocol::ReviewRequest;
 use codex_protocol::protocol::RolloutItem;
 use codex_protocol::protocol::ThreadMemoryMode;
 use codex_protocol::protocol::ThreadRolledBackEvent;
+use codex_protocol::protocol::ThreadSettingsAppliedEvent;
+use codex_protocol::protocol::ThreadSettingsOverrides;
+use codex_protocol::protocol::ThreadSettingsSnapshot;
 use codex_protocol::protocol::TurnAbortReason;
 use codex_protocol::protocol::WarningEvent;
 use codex_protocol::request_permissions::RequestPermissionsResponse;
 use codex_protocol::request_user_input::RequestUserInputResponse;
 
 use crate::context_manager::is_user_turn_boundary;
-use codex_protocol::config_types::CollaborationMode;
-use codex_protocol::config_types::ModeKind;
-use codex_protocol::config_types::Settings;
 use codex_protocol::dynamic_tools::DynamicToolResponse;
 use codex_protocol::items::UserMessageItem;
 use codex_protocol::mcp::RequestId as ProtocolRequestId;
@@ -83,19 +83,6 @@ pub async fn realtime_conversation_list_voices(sess: &Session, sub_id: String) {
     .await;
 }
 
-pub async fn override_turn_context(sess: &Session, sub_id: String, updates: SessionSettingsUpdate) {
-    if let Err(err) = sess.update_settings(updates).await {
-        sess.send_event_raw(Event {
-            id: sub_id,
-            msg: EventMsg::Error(ErrorEvent {
-                message: err.to_string(),
-                codex_error_info: Some(CodexErrorInfo::BadRequest),
-            }),
-        })
-        .await;
-    }
-}
-
 pub async fn user_input_or_turn(sess: &Arc<Session>, sub_id: String, op: Op) {
     user_input_or_turn_inner(
         sess,
@@ -106,134 +93,132 @@ pub async fn user_input_or_turn(sess: &Arc<Session>, sub_id: String, op: Op) {
     .await;
 }
 
+pub async fn update_thread_settings(
+    sess: &Arc<Session>,
+    sub_id: String,
+    thread_settings: ThreadSettingsOverrides,
+) {
+    let updates = thread_settings_update(sess, thread_settings).await;
+    let msg = match sess.update_settings(updates).await {
+        Ok(()) => thread_settings_applied_event(sess).await,
+        Err(err) => EventMsg::Error(ErrorEvent {
+            message: format!("invalid thread settings override: {err}"),
+            codex_error_info: Some(CodexErrorInfo::BadRequest),
+        }),
+    };
+    sess.send_event_raw(Event { id: sub_id, msg }).await;
+}
+
+async fn thread_settings_update(
+    sess: &Session,
+    thread_settings: ThreadSettingsOverrides,
+) -> SessionSettingsUpdate {
+    let ThreadSettingsOverrides {
+        cwd,
+        workspace_roots,
+        profile_workspace_roots,
+        approval_policy,
+        approvals_reviewer,
+        sandbox_policy,
+        permission_profile,
+        active_permission_profile,
+        windows_sandbox_level,
+        model,
+        effort,
+        summary,
+        service_tier,
+        collaboration_mode,
+        personality,
+    } = thread_settings;
+    let collaboration_mode = match collaboration_mode {
+        Some(collaboration_mode) => collaboration_mode,
+        None => {
+            let state = sess.state.lock().await;
+            // Model and reasoning effort live in CollaborationMode settings today, so
+            // partial thread-settings updates refresh those fields on the active mode.
+            state
+                .session_configuration
+                .collaboration_mode
+                .with_updates(model, effort, /*developer_instructions*/ None)
+        }
+    };
+    SessionSettingsUpdate {
+        cwd,
+        workspace_roots,
+        profile_workspace_roots,
+        approval_policy,
+        approvals_reviewer,
+        sandbox_policy,
+        permission_profile,
+        active_permission_profile,
+        windows_sandbox_level,
+        collaboration_mode: Some(collaboration_mode),
+        reasoning_summary: summary,
+        service_tier,
+        personality,
+        ..Default::default()
+    }
+}
+
+async fn thread_settings_applied_event(sess: &Session) -> EventMsg {
+    let snapshot = {
+        let state = sess.state.lock().await;
+        state.session_configuration.thread_config_snapshot()
+    };
+    EventMsg::ThreadSettingsApplied(ThreadSettingsAppliedEvent {
+        thread_settings: ThreadSettingsSnapshot {
+            model: snapshot.model,
+            model_provider_id: snapshot.model_provider_id,
+            service_tier: snapshot.service_tier,
+            approval_policy: snapshot.approval_policy,
+            approvals_reviewer: snapshot.approvals_reviewer,
+            permission_profile: snapshot.permission_profile,
+            active_permission_profile: snapshot.active_permission_profile,
+            cwd: snapshot.cwd,
+            reasoning_effort: snapshot.reasoning_effort,
+            reasoning_summary: snapshot.reasoning_summary,
+            personality: snapshot.personality,
+            collaboration_mode: snapshot.collaboration_mode,
+        },
+    })
+}
+
 pub(super) async fn user_input_or_turn_inner(
     sess: &Arc<Session>,
     sub_id: String,
     op: Op,
     mirror_user_text_to_realtime: Option<()>,
 ) {
-    let (items, updates, responsesapi_client_metadata) = match op {
-        Op::UserTurn {
-            cwd,
-            approval_policy,
-            approvals_reviewer,
-            sandbox_policy,
-            permission_profile,
-            model,
-            effort,
-            summary,
-            service_tier,
-            final_output_json_schema,
-            items,
-            collaboration_mode,
-            personality,
-            environments,
-        } => {
-            let collaboration_mode = collaboration_mode.or_else(|| {
-                Some(CollaborationMode {
-                    mode: ModeKind::Default,
-                    settings: Settings {
-                        model: model.clone(),
-                        reasoning_effort: effort,
-                        developer_instructions: None,
-                    },
-                })
-            });
-            (
-                items,
-                SessionSettingsUpdate {
-                    cwd: Some(cwd),
-                    approval_policy: Some(approval_policy),
-                    approvals_reviewer,
-                    sandbox_policy: Some(sandbox_policy),
-                    permission_profile,
-                    active_permission_profile: None,
-                    windows_sandbox_level: None,
-                    collaboration_mode,
-                    reasoning_summary: summary,
-                    service_tier,
-                    final_output_json_schema: Some(final_output_json_schema),
-                    environments,
-                    personality,
-                    app_server_client_name: None,
-                    app_server_client_version: None,
-                },
-                None,
-            )
-        }
-        Op::UserInputWithTurnContext {
-            cwd,
-            approval_policy,
-            approvals_reviewer,
-            sandbox_policy,
-            permission_profile,
-            active_permission_profile,
-            windows_sandbox_level,
-            model,
-            effort,
-            summary,
-            service_tier,
-            final_output_json_schema,
-            items,
-            responsesapi_client_metadata,
-            collaboration_mode,
-            personality,
-            environments,
-        } => {
-            let collaboration_mode = if let Some(collab_mode) = collaboration_mode {
-                Some(collab_mode)
-            } else {
-                let state = sess.state.lock().await;
-                Some(
-                    state
-                        .session_configuration
-                        .collaboration_mode
-                        .with_updates(model, effort, /*developer_instructions*/ None),
-                )
-            };
-            (
-                items,
-                SessionSettingsUpdate {
-                    cwd,
-                    approval_policy,
-                    approvals_reviewer,
-                    sandbox_policy,
-                    permission_profile,
-                    active_permission_profile,
-                    windows_sandbox_level,
-                    collaboration_mode,
-                    reasoning_summary: summary,
-                    service_tier,
-                    final_output_json_schema: Some(final_output_json_schema),
-                    environments,
-                    personality,
-                    app_server_client_name: None,
-                    app_server_client_version: None,
-                },
-                responsesapi_client_metadata,
-            )
-        }
-        Op::UserInput {
-            items,
-            environments,
-            final_output_json_schema,
-            responsesapi_client_metadata,
-        } => (
-            items,
-            SessionSettingsUpdate {
-                final_output_json_schema: Some(final_output_json_schema),
-                environments,
-                ..Default::default()
-            },
-            responsesapi_client_metadata,
-        ),
-        _ => unreachable!(),
+    let Op::UserInput {
+        items,
+        environments,
+        final_output_json_schema,
+        responsesapi_client_metadata,
+        thread_settings,
+    } = op
+    else {
+        unreachable!();
     };
+    let emit_thread_settings_applied = thread_settings != ThreadSettingsOverrides::default();
+    let mut updates = if emit_thread_settings_applied {
+        thread_settings_update(sess, thread_settings).await
+    } else {
+        SessionSettingsUpdate::default()
+    };
+    updates.final_output_json_schema = Some(final_output_json_schema);
+    updates.environments = environments;
 
     let Ok(current_context) = sess.new_turn_with_sub_id(sub_id.clone(), updates).await else {
         // new_turn_with_sub_id already emits the error event.
         return;
     };
+    if emit_thread_settings_applied {
+        sess.send_event_raw(Event {
+            id: sub_id.clone(),
+            msg: thread_settings_applied_event(sess).await,
+        })
+        .await;
+    }
     sess.maybe_emit_unknown_model_warning_for_turn(current_context.as_ref())
         .await;
     let accepted_items = match sess
@@ -313,7 +298,9 @@ pub async fn inter_agent_communication(
     communication: InterAgentCommunication,
 ) {
     let trigger_turn = communication.trigger_turn;
-    sess.enqueue_mailbox_communication(communication);
+    sess.input_queue
+        .enqueue_mailbox_communication(communication)
+        .await;
     if trigger_turn {
         sess.maybe_start_turn_for_pending_work_with_sub_id(sub_id)
             .await;
@@ -632,12 +619,14 @@ async fn shutdown_session_runtime(sess: &Arc<Session>) {
     sess.guardian_review_session.shutdown().await;
 }
 
-fn emit_thread_stop_lifecycle(sess: &Session) {
+async fn emit_thread_stop_lifecycle(sess: &Session) {
     for contributor in sess.services.extensions.thread_lifecycle_contributors() {
-        contributor.on_thread_stop(codex_extension_api::ThreadStopInput {
-            session_store: &sess.services.session_extension_data,
-            thread_store: &sess.services.thread_extension_data,
-        });
+        contributor
+            .on_thread_stop(codex_extension_api::ThreadStopInput {
+                session_store: &sess.services.session_extension_data,
+                thread_store: &sess.services.thread_extension_data,
+            })
+            .await;
     }
 }
 
@@ -656,7 +645,7 @@ pub async fn shutdown(sess: &Arc<Session>, sub_id: String) -> bool {
         &[],
     );
 
-    emit_thread_stop_lifecycle(sess.as_ref());
+    emit_thread_stop_lifecycle(sess.as_ref()).await;
 
     // Gracefully flush and shutdown thread persistence on session end so tests
     // that inspect durable state do not race with the background writer.
@@ -699,6 +688,7 @@ pub async fn review(
         .await;
     sess.refresh_mcp_servers_if_requested(&turn_context, Some(sess.mcp_elicitation_reviewer()))
         .await;
+    #[allow(deprecated)]
     match resolve_review_request(review_request, &turn_context.cwd) {
         Ok(resolved) => {
             spawn_review_thread(
@@ -774,54 +764,12 @@ pub(super) async fn submission_loop(
                     realtime_conversation_list_voices(&sess, sub.id.clone()).await;
                     false
                 }
-                Op::OverrideTurnContext {
-                    cwd,
-                    approval_policy,
-                    approvals_reviewer,
-                    sandbox_policy,
-                    permission_profile,
-                    windows_sandbox_level,
-                    model,
-                    effort,
-                    summary,
-                    service_tier,
-                    collaboration_mode,
-                    personality,
-                } => {
-                    let collaboration_mode = if let Some(collab_mode) = collaboration_mode {
-                        collab_mode
-                    } else {
-                        let state = sess.state.lock().await;
-                        state.session_configuration.collaboration_mode.with_updates(
-                            model.clone(),
-                            effort,
-                            /*developer_instructions*/ None,
-                        )
-                    };
-                    override_turn_context(
-                        &sess,
-                        sub.id.clone(),
-                        SessionSettingsUpdate {
-                            cwd,
-                            approval_policy,
-                            approvals_reviewer,
-                            sandbox_policy,
-                            permission_profile,
-                            windows_sandbox_level,
-                            collaboration_mode: Some(collaboration_mode),
-                            reasoning_summary: summary,
-                            service_tier,
-                            personality,
-                            ..Default::default()
-                        },
-                    )
-                    .await;
+                Op::UserInput { .. } => {
+                    user_input_or_turn(&sess, sub.id.clone(), sub.op).await;
                     false
                 }
-                Op::UserInput { .. }
-                | Op::UserInputWithTurnContext { .. }
-                | Op::UserTurn { .. } => {
-                    user_input_or_turn(&sess, sub.id.clone(), sub.op).await;
+                Op::ThreadSettings { thread_settings } => {
+                    update_thread_settings(&sess, sub.id.clone(), thread_settings).await;
                     false
                 }
                 Op::InterAgentCommunication { communication } => {
@@ -910,7 +858,7 @@ pub(super) async fn submission_loop(
     // explicit shutdown op, still run session teardown.
     if !shutdown_received {
         shutdown_session_runtime(&sess).await;
-        emit_thread_stop_lifecycle(sess.as_ref());
+        emit_thread_stop_lifecycle(sess.as_ref()).await;
     }
     debug!("Agent loop exited");
 }
@@ -952,7 +900,9 @@ Approved action:
     }];
 
     if let Err(items) = sess.inject_response_items(items).await {
-        sess.queue_response_items_for_next_turn(items).await;
+        sess.input_queue
+            .queue_response_items_for_next_turn(items)
+            .await;
     }
 }
 
diff --git a/codex-rs/core/src/session/input_queue.rs b/codex-rs/core/src/session/input_queue.rs
new file mode 100644
index 0000000000..5f92322c8d
--- /dev/null
+++ b/codex-rs/core/src/session/input_queue.rs
@@ -0,0 +1,378 @@
+use crate::state::ActiveTurn;
+use crate::state::MailboxDeliveryPhase;
+use crate::state::TurnState;
+use codex_protocol::models::ResponseInputItem;
+use codex_protocol::protocol::InterAgentCommunication;
+use codex_protocol::user_input::UserInput;
+use std::collections::VecDeque;
+use std::sync::Arc;
+use tokio::sync::Mutex;
+use tokio::sync::watch;
+
+#[derive(Clone, Debug, PartialEq)]
+pub(crate) enum TurnInput {
+    UserInput(Vec<UserInput>),
+    ResponseInputItem(ResponseInputItem),
+}
+
+/// Turn-local pending input storage owned by the input queue flow.
+#[derive(Default)]
+pub(crate) struct TurnInputQueue {
+    items: Vec<TurnInput>,
+}
+
+/// Session-scoped pending input storage and active-turn mailbox delivery coordination.
+pub(crate) struct InputQueue {
+    mailbox_tx: watch::Sender<()>,
+    mailbox_pending_mails: Mutex<VecDeque<InterAgentCommunication>>,
+
+    idle_pending_input: Mutex<Vec<ResponseInputItem>>,
+}
+
+impl InputQueue {
+    pub(crate) fn new() -> Self {
+        let (mailbox_tx, _) = watch::channel(());
+        Self {
+            mailbox_tx,
+            mailbox_pending_mails: Mutex::new(VecDeque::new()),
+            idle_pending_input: Mutex::new(Vec::new()),
+        }
+    }
+
+    pub(crate) async fn subscribe_mailbox(&self) -> watch::Receiver<()> {
+        let mut mailbox_rx = self.mailbox_tx.subscribe();
+        if self.has_pending_mailbox_items().await {
+            mailbox_rx.mark_changed();
+        }
+        mailbox_rx
+    }
+
+    pub(crate) async fn enqueue_mailbox_communication(
+        &self,
+        communication: InterAgentCommunication,
+    ) {
+        self.mailbox_pending_mails
+            .lock()
+            .await
+            .push_back(communication);
+        self.mailbox_tx.send_replace(());
+    }
+
+    pub(crate) async fn has_pending_mailbox_items(&self) -> bool {
+        !self.mailbox_pending_mails.lock().await.is_empty()
+    }
+
+    pub(crate) async fn has_trigger_turn_mailbox_items(&self) -> bool {
+        self.mailbox_pending_mails
+            .lock()
+            .await
+            .iter()
+            .any(|mail| mail.trigger_turn)
+    }
+
+    pub(crate) async fn drain_mailbox_input_items(&self) -> Vec<ResponseInputItem> {
+        self.mailbox_pending_mails
+            .lock()
+            .await
+            .drain(..)
+            .map(|mail| mail.to_response_input_item())
+            .collect()
+    }
+
+    pub(crate) async fn queue_response_items_for_next_turn(&self, items: Vec<ResponseInputItem>) {
+        if items.is_empty() {
+            return;
+        }
+
+        self.idle_pending_input.lock().await.extend(items);
+    }
+
+    pub(crate) async fn take_queued_response_items_for_next_turn(&self) -> Vec<ResponseInputItem> {
+        std::mem::take(&mut *self.idle_pending_input.lock().await)
+    }
+
+    pub(crate) async fn has_queued_response_items_for_next_turn(&self) -> bool {
+        !self.idle_pending_input.lock().await.is_empty()
+    }
+
+    pub(crate) async fn turn_state_for_sub_id(
+        &self,
+        active_turn: &Mutex<Option<ActiveTurn>>,
+        sub_id: &str,
+    ) -> Option<Arc<Mutex<TurnState>>> {
+        let active = active_turn.lock().await;
+        active.as_ref().and_then(|active_turn| {
+            active_turn
+                .tasks
+                .contains_key(sub_id)
+                .then(|| Arc::clone(&active_turn.turn_state))
+        })
+    }
+
+    /// Clear any pending waiters and input buffered for the current turn.
+    pub(crate) async fn clear_pending(&self, active_turn: &ActiveTurn) {
+        let mut turn_state = active_turn.turn_state.lock().await;
+        turn_state.clear_pending_waiters();
+        turn_state.pending_input.items.clear();
+    }
+
+    pub(crate) async fn defer_mailbox_delivery_to_next_turn(
+        &self,
+        active_turn: &Mutex<Option<ActiveTurn>>,
+        sub_id: &str,
+    ) {
+        let turn_state = self.turn_state_for_sub_id(active_turn, sub_id).await;
+        let Some(turn_state) = turn_state else {
+            return;
+        };
+        let mut turn_state = turn_state.lock().await;
+        if !turn_state.pending_input.items.is_empty() {
+            return;
+        }
+        turn_state.set_mailbox_delivery_phase(MailboxDeliveryPhase::NextTurn);
+    }
+
+    pub(crate) async fn accept_mailbox_delivery_for_current_turn(
+        &self,
+        active_turn: &Mutex<Option<ActiveTurn>>,
+        sub_id: &str,
+    ) {
+        let turn_state = self.turn_state_for_sub_id(active_turn, sub_id).await;
+        let Some(turn_state) = turn_state else {
+            return;
+        };
+        self.accept_mailbox_delivery_for_turn_state(turn_state.as_ref())
+            .await;
+    }
+
+    pub(super) async fn accept_mailbox_delivery_for_turn_state(
+        &self,
+        turn_state: &Mutex<TurnState>,
+    ) {
+        turn_state
+            .lock()
+            .await
+            .accept_mailbox_delivery_for_current_turn();
+    }
+
+    pub(super) async fn push_pending_input_and_accept_mailbox_delivery_for_turn_state(
+        &self,
+        turn_state: &Mutex<TurnState>,
+        input: TurnInput,
+    ) {
+        let mut turn_state = turn_state.lock().await;
+        turn_state.pending_input.items.push(input);
+        turn_state.accept_mailbox_delivery_for_current_turn();
+    }
+
+    pub(crate) async fn extend_pending_input_for_turn_state(
+        &self,
+        turn_state: &Mutex<TurnState>,
+        input: Vec<TurnInput>,
+    ) {
+        turn_state.lock().await.pending_input.items.extend(input);
+    }
+
+    pub(crate) async fn take_pending_input_for_turn_state(
+        &self,
+        turn_state: &Mutex<TurnState>,
+    ) -> Vec<TurnInput> {
+        turn_state.lock().await.pending_input.items.split_off(0)
+    }
+
+    #[expect(
+        clippy::await_holding_invalid_type,
+        reason = "active turn checks and turn state updates must remain atomic"
+    )]
+    pub(crate) async fn inject_response_items(
+        &self,
+        active_turn: &Mutex<Option<ActiveTurn>>,
+        input: Vec<ResponseInputItem>,
+    ) -> Result<(), Vec<ResponseInputItem>> {
+        let mut active = active_turn.lock().await;
+        match active.as_mut() {
+            Some(active_turn) => {
+                self.extend_pending_input_for_turn_state(
+                    active_turn.turn_state.as_ref(),
+                    input
+                        .into_iter()
+                        .map(TurnInput::ResponseInputItem)
+                        .collect(),
+                )
+                .await;
+                Ok(())
+            }
+            None => Err(input),
+        }
+    }
+
+    #[expect(
+        clippy::await_holding_invalid_type,
+        reason = "active turn checks and turn state updates must remain atomic"
+    )]
+    pub(crate) async fn get_pending_input(
+        &self,
+        active_turn: &Mutex<Option<ActiveTurn>>,
+    ) -> Vec<TurnInput> {
+        let (pending_input, accepts_mailbox_delivery) = {
+            let mut active = active_turn.lock().await;
+            match active.as_mut() {
+                Some(active_turn) => {
+                    let mut turn_state = active_turn.turn_state.lock().await;
+                    (
+                        turn_state.pending_input.items.split_off(0),
+                        turn_state.accepts_mailbox_delivery_for_current_turn(),
+                    )
+                }
+                None => (Vec::new(), true),
+            }
+        };
+        if !accepts_mailbox_delivery {
+            return pending_input;
+        }
+        let mailbox_items = self
+            .drain_mailbox_input_items()
+            .await
+            .into_iter()
+            .map(TurnInput::ResponseInputItem);
+        if pending_input.is_empty() {
+            mailbox_items.collect()
+        } else {
+            let mut pending_input = pending_input;
+            pending_input.extend(mailbox_items);
+            pending_input
+        }
+    }
+
+    #[expect(
+        clippy::await_holding_invalid_type,
+        reason = "active turn checks and turn state reads must remain atomic"
+    )]
+    pub(crate) async fn has_pending_input(&self, active_turn: &Mutex<Option<ActiveTurn>>) -> bool {
+        let (has_turn_pending_input, accepts_mailbox_delivery) = {
+            let active = active_turn.lock().await;
+            match active.as_ref() {
+                Some(active_turn) => {
+                    let turn_state = active_turn.turn_state.lock().await;
+                    (
+                        !turn_state.pending_input.items.is_empty(),
+                        turn_state.accepts_mailbox_delivery_for_current_turn(),
+                    )
+                }
+                None => (false, true),
+            }
+        };
+        if has_turn_pending_input {
+            return true;
+        }
+        if !accepts_mailbox_delivery {
+            return false;
+        }
+        self.has_pending_mailbox_items().await
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use codex_protocol::AgentPath;
+    use pretty_assertions::assert_eq;
+
+    fn make_mail(
+        author: AgentPath,
+        recipient: AgentPath,
+        content: &str,
+        trigger_turn: bool,
+    ) -> InterAgentCommunication {
+        InterAgentCommunication::new(
+            author,
+            recipient,
+            Vec::new(),
+            content.to_string(),
+            trigger_turn,
+        )
+    }
+
+    #[tokio::test]
+    async fn input_queue_notifies_mailbox_subscribers() {
+        let input_queue = InputQueue::new();
+        let mut mailbox_rx = input_queue.subscribe_mailbox().await;
+
+        input_queue
+            .enqueue_mailbox_communication(make_mail(
+                AgentPath::root(),
+                AgentPath::try_from("/root/worker").expect("agent path"),
+                "one",
+                /*trigger_turn*/ false,
+            ))
+            .await;
+        input_queue
+            .enqueue_mailbox_communication(make_mail(
+                AgentPath::root(),
+                AgentPath::try_from("/root/worker").expect("agent path"),
+                "two",
+                /*trigger_turn*/ false,
+            ))
+            .await;
+
+        mailbox_rx.changed().await.expect("mailbox update");
+    }
+
+    #[tokio::test]
+    async fn input_queue_drains_mailbox_in_delivery_order() {
+        let input_queue = InputQueue::new();
+        let mail_one = make_mail(
+            AgentPath::root(),
+            AgentPath::try_from("/root/worker").expect("agent path"),
+            "one",
+            /*trigger_turn*/ false,
+        );
+        let mail_two = make_mail(
+            AgentPath::try_from("/root/worker").expect("agent path"),
+            AgentPath::root(),
+            "two",
+            /*trigger_turn*/ false,
+        );
+
+        input_queue
+            .enqueue_mailbox_communication(mail_one.clone())
+            .await;
+        input_queue
+            .enqueue_mailbox_communication(mail_two.clone())
+            .await;
+
+        assert_eq!(
+            input_queue.drain_mailbox_input_items().await,
+            vec![
+                mail_one.to_response_input_item(),
+                mail_two.to_response_input_item()
+            ]
+        );
+        assert!(!input_queue.has_pending_mailbox_items().await);
+    }
+
+    #[tokio::test]
+    async fn input_queue_tracks_pending_trigger_turn_mail() {
+        let input_queue = InputQueue::new();
+
+        input_queue
+            .enqueue_mailbox_communication(make_mail(
+                AgentPath::root(),
+                AgentPath::try_from("/root/worker").expect("agent path"),
+                "queued",
+                /*trigger_turn*/ false,
+            ))
+            .await;
+        assert!(!input_queue.has_trigger_turn_mailbox_items().await);
+
+        input_queue
+            .enqueue_mailbox_communication(make_mail(
+                AgentPath::root(),
+                AgentPath::try_from("/root/worker").expect("agent path"),
+                "wake",
+                /*trigger_turn*/ true,
+            ))
+            .await;
+        assert!(input_queue.has_trigger_turn_mailbox_items().await);
+    }
+}
diff --git a/codex-rs/core/src/session/mcp.rs b/codex-rs/core/src/session/mcp.rs
index d32ecf2b19..47201414de 100644
--- a/codex-rs/core/src/session/mcp.rs
+++ b/codex-rs/core/src/session/mcp.rs
@@ -154,6 +154,9 @@ impl Session {
             id,
             request,
         });
+        turn_context
+            .turn_metadata_state
+            .mark_user_input_requested_during_turn();
         self.send_event(turn_context, event).await;
         rx_response.await.ok()
     }
@@ -288,14 +291,16 @@ impl Session {
             compute_auth_statuses(mcp_servers.iter(), store_mode, auth.as_ref()).await;
         let mcp_runtime_environment = match turn_context.environments.primary() {
             Some(turn_environment) => McpRuntimeEnvironment::new(
-                Arc::clone(&turn_environment.environment),
+                Some(Arc::clone(&turn_environment.environment)),
+                self.services.environment_manager.try_local_environment(),
                 turn_environment.cwd.to_path_buf(),
             ),
             None => McpRuntimeEnvironment::new(
                 self.services
                     .environment_manager
-                    .default_environment()
-                    .unwrap_or_else(|| self.services.environment_manager.local_environment()),
+                    .default_or_local_environment(),
+                self.services.environment_manager.try_local_environment(),
+                #[allow(deprecated)]
                 turn_context.cwd.to_path_buf(),
             ),
         };
diff --git a/codex-rs/core/src/session/mod.rs b/codex-rs/core/src/session/mod.rs
index 3ef9466812..8f0d2f1c01 100644
--- a/codex-rs/core/src/session/mod.rs
+++ b/codex-rs/core/src/session/mod.rs
@@ -10,8 +10,6 @@ use std::time::UNIX_EPOCH;
 
 use crate::agent::AgentControl;
 use crate::agent::AgentStatus;
-use crate::agent::Mailbox;
-use crate::agent::MailboxReceiver;
 use crate::agent::agent_status_from_event;
 use crate::agent::status::is_final;
 use crate::attestation::AttestationProvider;
@@ -80,6 +78,7 @@ use codex_protocol::approvals::ExecPolicyAmendment;
 use codex_protocol::approvals::NetworkPolicyAmendment;
 use codex_protocol::approvals::NetworkPolicyRuleAction;
 use codex_protocol::config_types::ApprovalsReviewer;
+use codex_protocol::config_types::AutoCompactTokenLimitScope;
 use codex_protocol::config_types::ModeKind;
 use codex_protocol::config_types::Settings;
 use codex_protocol::config_types::WebSearchMode;
@@ -95,6 +94,7 @@ use codex_protocol::models::PermissionProfile;
 use codex_protocol::models::SandboxEnforcement;
 use codex_protocol::models::format_allow_prefixes;
 use codex_protocol::openai_models::ModelInfo;
+use codex_protocol::openai_models::ModelPreset;
 use codex_protocol::permissions::FileSystemSandboxPolicy;
 use codex_protocol::permissions::NetworkSandboxPolicy;
 use codex_protocol::protocol::FileChange;
@@ -173,12 +173,16 @@ use crate::compact::collect_user_messages;
 use crate::config::Config;
 use crate::config::Constrained;
 use crate::config::ConstraintResult;
+use crate::config::PermissionProfileSnapshot;
+use crate::config::PermissionProfileState;
 use crate::config::StartedNetworkProxy;
 use crate::config::resolve_web_search_mode_for_turn;
 use crate::context_manager::ContextManager;
 use crate::context_manager::TotalTokenUsageBreakdown;
 use crate::thread_rollout_truncation::initial_history_has_prior_user_turns;
 use codex_config::CONFIG_TOML_FILE;
+use codex_config::ConfigLayerSource;
+use codex_config::ConfigLayerStackOrdering;
 use codex_config::types::McpServerConfig;
 use codex_model_provider_info::ModelProviderInfo;
 use codex_protocol::config_types::ShellEnvironmentPolicy;
@@ -189,6 +193,7 @@ use codex_protocol::exec_output::StreamOutput;
 
 mod config_lock;
 mod handlers;
+mod input_queue;
 mod mcp;
 mod multi_agents;
 mod review;
@@ -202,6 +207,8 @@ use self::config_lock::validate_config_lock_if_configured;
 #[cfg(test)]
 use self::handlers::submission_dispatch_span;
 use self::handlers::submission_loop;
+pub(crate) use self::input_queue::TurnInput;
+pub(crate) use self::input_queue::TurnInputQueue;
 use self::review::spawn_review_thread;
 use self::session::AppServerClientMetadata;
 use self::session::Session;
@@ -211,8 +218,6 @@ pub(crate) use self::session::SessionSettingsUpdate;
 use self::turn::AssistantMessageStreamParsers;
 #[cfg(test)]
 use self::turn::collect_explicit_app_ids_from_skill_items;
-#[cfg(test)]
-use self::turn::filter_connectors_for_input;
 use self::turn::realtime_text_for_event;
 use self::turn_context::TurnContext;
 use self::turn_context::TurnSkillsContext;
@@ -285,8 +290,7 @@ use crate::rollout::map_session_init_error;
 use crate::session_startup_prewarm::SessionStartupPrewarmHandle;
 use crate::shell;
 use crate::shell_snapshot::ShellSnapshot;
-use crate::state::ActiveTurn;
-use crate::state::MailboxDeliveryPhase;
+use crate::state::AutoCompactWindowSnapshot;
 use crate::state::PendingRequestPermissions;
 use crate::state::SessionServices;
 use crate::state::SessionState;
@@ -355,8 +359,8 @@ use codex_protocol::protocol::TokenUsageInfo;
 use codex_protocol::protocol::WarningEvent;
 use codex_protocol::user_input::UserInput;
 use codex_tools::ToolEnvironmentMode;
-use codex_tools::ToolsConfig;
-use codex_tools::ToolsConfigParams;
+use codex_tools::UnifiedExecShellMode;
+use codex_tools::shell_command_backend_for_features;
 use codex_utils_absolute_path::AbsolutePathBuf;
 #[cfg(test)]
 use codex_utils_stream_parser::ProposedPlanSegment;
@@ -615,10 +619,10 @@ impl Codex {
             compact_prompt: config.compact_prompt.clone(),
             approval_policy: config.permissions.approval_policy.clone(),
             approvals_reviewer: config.approvals_reviewer,
-            permission_profile: config.permissions.permission_profile.clone(),
-            active_permission_profile: config.permissions.active_permission_profile(),
+            permission_profile_state: session_permission_profile_state_from_config(&config)?,
             windows_sandbox_level: WindowsSandboxLevel::from_config(&config),
             cwd: config.cwd.clone(),
+            workspace_roots: config.workspace_roots.clone(),
             codex_home: config.codex_home.clone(),
             thread_name: None,
             environments: environment_selections.to_selections(),
@@ -816,6 +820,12 @@ fn get_service_tier(
         .then_some(ServiceTier::Fast.request_value().to_string())
 }
 
+fn session_permission_profile_state_from_config(
+    config: &Config,
+) -> CodexResult<PermissionProfileState> {
+    Ok(config.permissions.permission_profile_state().clone())
+}
+
 fn is_enterprise_default_service_tier_plan(plan_type: AccountPlanType) -> bool {
     plan_type == AccountPlanType::Enterprise
         || plan_type.is_business_like()
@@ -878,22 +888,6 @@ impl Session {
         }
     }
 
-    pub(crate) async fn configured_multi_agent_v2_usage_hint_texts(&self) -> Vec<String> {
-        if !self.features.enabled(Feature::MultiAgentV2) {
-            return Vec::new();
-        }
-
-        let state = self.state.lock().await;
-        let config = &state.session_configuration.original_config_do_not_use;
-        [
-            config.multi_agent_v2.root_agent_usage_hint_text.clone(),
-            config.multi_agent_v2.subagent_usage_hint_text.clone(),
-        ]
-        .into_iter()
-        .flatten()
-        .collect()
-    }
-
     fn managed_network_proxy_active_for_permission_profile(
         permission_profile: &PermissionProfile,
     ) -> bool {
@@ -1086,6 +1080,7 @@ impl Session {
                 }],
                 final_output_json_schema: None,
                 responsesapi_client_metadata: None,
+                thread_settings: Default::default(),
             },
             /*mirror_user_text_to_realtime*/ None,
         )
@@ -1097,6 +1092,11 @@ impl Session {
         state.get_total_token_usage(state.server_reasoning_included())
     }
 
+    pub(crate) async fn auto_compact_window_snapshot(&self) -> AutoCompactWindowSnapshot {
+        let state = self.state.lock().await;
+        state.auto_compact_window_snapshot()
+    }
+
     pub(crate) async fn get_total_token_usage_breakdown(&self) -> TotalTokenUsageBreakdown {
         let state = self.state.lock().await;
         state.history.get_total_token_usage_breakdown()
@@ -1255,11 +1255,41 @@ impl Session {
             reconstructed_rollout.reference_context_item,
         )
         .await;
+        let prefix_tokens = if matches!(
+            turn_context.config.model_auto_compact_token_limit_scope,
+            AutoCompactTokenLimitScope::BodyAfterPrefix
+        ) {
+            let history = self.clone_history().await;
+            let base_instructions = self.get_base_instructions().await;
+            history.estimate_token_count_with_base_instructions(&base_instructions)
+        } else {
+            None
+        };
+        if let Some(prefix_tokens) = prefix_tokens {
+            self.set_auto_compact_window_estimated_prefill_for_scope(turn_context, prefix_tokens)
+                .await;
+        }
         self.set_previous_turn_settings(previous_turn_settings.clone())
             .await;
         previous_turn_settings
     }
 
+    async fn set_auto_compact_window_estimated_prefill_for_scope(
+        &self,
+        turn_context: &TurnContext,
+        tokens: i64,
+    ) {
+        if !matches!(
+            turn_context.config.model_auto_compact_token_limit_scope,
+            AutoCompactTokenLimitScope::BodyAfterPrefix
+        ) {
+            return;
+        }
+
+        let mut state = self.state.lock().await;
+        state.set_auto_compact_window_estimated_prefill(tokens);
+    }
+
     fn last_token_info_from_rollout(rollout_items: &[RolloutItem]) -> Option<TokenUsageInfo> {
         rollout_items.iter().rev().find_map(|item| match item {
             RolloutItem::EventMsg(EventMsg::TokenCount(ev)) => ev.info.clone(),
@@ -1375,12 +1405,15 @@ impl Session {
         Ok(())
     }
 
-    pub(crate) async fn validate_settings(
+    pub(crate) async fn preview_settings(
         &self,
         updates: &SessionSettingsUpdate,
-    ) -> ConstraintResult<()> {
+    ) -> ConstraintResult<ThreadConfigSnapshot> {
         let state = self.state.lock().await;
-        state.session_configuration.apply(updates).map(|_| ())
+        state
+            .session_configuration
+            .apply(updates)
+            .map(|configuration| configuration.thread_config_snapshot())
     }
 
     pub(crate) async fn set_session_startup_prewarm(
@@ -1479,37 +1512,62 @@ impl Session {
         //
         // Prefer `refresh_runtime_config()` when the host can already provide a materialized
         // config snapshot. This file-based path exists for legacy local reload flows.
-        let config_toml_path = {
+        let config_toml_paths = {
             let state = self.state.lock().await;
-            state
-                .session_configuration
-                .codex_home
-                .join(CONFIG_TOML_FILE)
+            let config = &state.session_configuration.original_config_do_not_use;
+            let user_config_paths = config
+                .config_layer_stack
+                .get_user_layers(
+                    ConfigLayerStackOrdering::LowestPrecedenceFirst,
+                    /*include_disabled*/ true,
+                )
+                .into_iter()
+                .filter_map(|layer| match &layer.name {
+                    ConfigLayerSource::User { file, .. } => Some(file.clone()),
+                    _ => None,
+                })
+                .collect::<Vec<_>>();
+            if user_config_paths.is_empty() {
+                vec![
+                    state
+                        .session_configuration
+                        .codex_home
+                        .join(CONFIG_TOML_FILE),
+                ]
+            } else {
+                user_config_paths
+            }
         };
 
-        let user_config = match std::fs::read_to_string(&config_toml_path) {
-            Ok(contents) => match toml::from_str::<toml::Value>(&contents) {
-                Ok(config) => config,
+        let mut reloaded_user_configs = Vec::with_capacity(config_toml_paths.len());
+        for config_toml_path in config_toml_paths {
+            let user_config = match std::fs::read_to_string(&config_toml_path) {
+                Ok(contents) => match toml::from_str::<toml::Value>(&contents) {
+                    Ok(config) => config,
+                    Err(err) => {
+                        warn!("failed to parse user config while reloading layer: {err}");
+                        return;
+                    }
+                },
+                Err(err) if err.kind() == std::io::ErrorKind::NotFound => {
+                    toml::Value::Table(Default::default())
+                }
                 Err(err) => {
-                    warn!("failed to parse user config while reloading layer: {err}");
+                    warn!("failed to read user config while reloading layer: {err}");
                     return;
                 }
-            },
-            Err(err) if err.kind() == std::io::ErrorKind::NotFound => {
-                toml::Value::Table(Default::default())
-            }
-            Err(err) => {
-                warn!("failed to read user config while reloading layer: {err}");
-                return;
-            }
-        };
+            };
+            reloaded_user_configs.push((config_toml_path, user_config));
+        }
 
         let next_config = {
             let state = self.state.lock().await;
             let mut config = (*state.session_configuration.original_config_do_not_use).clone();
-            config.config_layer_stack = config
-                .config_layer_stack
-                .with_user_config(&config_toml_path, user_config);
+            for (config_toml_path, user_config) in reloaded_user_configs {
+                config.config_layer_stack = config
+                    .config_layer_stack
+                    .with_user_config(&config_toml_path, user_config);
+            }
             config.tool_suggest =
                 resolve_tool_suggest_config_from_layer_stack(&config.config_layer_stack);
             config
@@ -2051,6 +2109,7 @@ impl Session {
             turn_context,
             call_id,
             args,
+            #[allow(deprecated)]
             turn_context.cwd.clone(),
             cancellation_token,
         )
@@ -2247,6 +2306,9 @@ impl Session {
             turn_id: turn_context.sub_id.clone(),
             questions: args.questions,
         });
+        turn_context
+            .turn_metadata_state
+            .mark_user_input_requested_during_turn();
         self.send_event(turn_context, event).await;
         rx_response.await.ok()
     }
@@ -2544,8 +2606,11 @@ impl Session {
         reference_context_item: Option<TurnContextItem>,
         compacted_item: CompactedItem,
     ) {
-        self.replace_history(items, reference_context_item.clone())
-            .await;
+        {
+            let mut state = self.state.lock().await;
+            state.replace_history(items, reference_context_item.clone());
+            state.start_next_auto_compact_window();
+        }
 
         self.persist_rollout_items(&[RolloutItem::Compacted(compacted_item)])
             .await;
@@ -2630,6 +2695,7 @@ impl Session {
                     turn_context.approval_policy.value(),
                     turn_context.config.approvals_reviewer,
                     self.services.exec_policy.current().as_ref(),
+                    #[allow(deprecated)]
                     &turn_context.cwd,
                     turn_context
                         .features
@@ -2651,14 +2717,6 @@ impl Session {
         {
             developer_sections.push(developer_instructions.to_string());
         }
-        // Add developer instructions for memories.
-        if turn_context.features.enabled(Feature::MemoryTool)
-            && turn_context.config.memories.use_memories
-            && let Some(memory_prompt) =
-                build_memory_tool_developer_instructions(&turn_context.config.codex_home).await
-        {
-            developer_sections.push(memory_prompt);
-        }
         // Add developer instructions from collaboration_mode if they exist and are non-empty
         if turn_context.config.include_collaboration_mode_instructions
             && let Some(collab_instructions) =
@@ -2763,6 +2821,7 @@ impl Session {
             contextual_user_sections.push(
                 UserInstructions {
                     text: user_instructions.to_string(),
+                    #[allow(deprecated)]
                     directory: turn_context.cwd.to_string_lossy().into_owned(),
                 }
                 .render(),
@@ -2909,16 +2968,24 @@ impl Session {
                 let mut state = self.state.lock().await;
                 state
                     .update_token_info_from_usage(token_usage, turn_context.model_context_window());
+                if matches!(
+                    turn_context.config.model_auto_compact_token_limit_scope,
+                    AutoCompactTokenLimitScope::BodyAfterPrefix
+                ) {
+                    state.ensure_auto_compact_window_server_prefill_from_usage(token_usage);
+                }
                 state.token_info()
             };
             if let Some(token_info) = token_info.as_ref() {
                 for contributor in self.services.extensions.token_usage_contributors() {
-                    contributor.on_token_usage(
-                        &self.services.session_extension_data,
-                        &self.services.thread_extension_data,
-                        turn_context.extension_data.as_ref(),
-                        token_info,
-                    );
+                    contributor
+                        .on_token_usage(
+                            &self.services.session_extension_data,
+                            &self.services.thread_extension_data,
+                            turn_context.extension_data.as_ref(),
+                            token_info,
+                        )
+                        .await;
                 }
             }
         }
@@ -2954,6 +3021,11 @@ impl Session {
 
             state.set_token_info(Some(info));
         }
+        self.set_auto_compact_window_estimated_prefill_for_scope(
+            turn_context,
+            estimated_total_tokens,
+        )
+        .await;
         self.send_token_count_event(turn_context).await;
     }
 
@@ -2986,16 +3058,6 @@ impl Session {
         state.record_mcp_dependency_prompted(names);
     }
 
-    pub async fn dependency_env(&self) -> HashMap<String, String> {
-        let state = self.state.lock().await;
-        state.dependency_env()
-    }
-
-    pub async fn set_dependency_env(&self, values: HashMap<String, String>) {
-        let mut state = self.state.lock().await;
-        state.set_dependency_env(values);
-    }
-
     pub(crate) async fn set_server_reasoning_included(&self, included: bool) {
         let mut state = self.state.lock().await;
         state.set_server_reasoning_included(included);
@@ -3038,11 +3100,11 @@ impl Session {
         &self,
         turn_context: &TurnContext,
         input: &[UserInput],
-        response_item: ResponseItem,
     ) {
         // Persist the user message to history, but emit the turn item from `UserInput` so
         // UI-only `text_elements` are preserved. `ResponseItem::Message` does not carry
         // those spans, and `record_response_item_and_emit_turn_item` would drop them.
+        let response_item = ResponseItem::from(ResponseInputItem::from(input.to_vec()));
         self.record_conversation_items(turn_context, std::slice::from_ref(&response_item))
             .await;
         let turn_item = TurnItem::UserMessage(UserMessageItem::new(input));
@@ -3082,10 +3144,6 @@ impl Session {
         expected_turn_id: Option<&str>,
         responsesapi_client_metadata: Option<HashMap<String, String>>,
     ) -> Result<String, SteerInputError> {
-        if input.is_empty() {
-            return Err(SteerInputError::EmptyInput);
-        }
-
         let mut active = self.active_turn.lock().await;
         let Some(active_turn) = active.as_mut() else {
             return Err(SteerInputError::NoActiveTurn(input));
@@ -3119,6 +3177,10 @@ impl Session {
             None => return Err(SteerInputError::NoActiveTurn(input)),
         }
 
+        if input.is_empty() {
+            return Err(SteerInputError::EmptyInput);
+        }
+
         if let Some(responsesapi_client_metadata) = responsesapi_client_metadata
             && let Some((_, active_task)) = active_turn.tasks.first()
         {
@@ -3128,199 +3190,39 @@ impl Session {
                 .set_responsesapi_client_metadata(responsesapi_client_metadata);
         }
 
-        let mut turn_state = active_turn.turn_state.lock().await;
-        turn_state.push_pending_input(input.into());
-        turn_state.accept_mailbox_delivery_for_current_turn();
+        self.input_queue
+            .push_pending_input_and_accept_mailbox_delivery_for_turn_state(
+                active_turn.turn_state.as_ref(),
+                TurnInput::UserInput(input),
+            )
+            .await;
         Ok(active_turn_id.clone())
     }
 
     /// Returns the input if there was no task running to inject into.
-    #[expect(
-        clippy::await_holding_invalid_type,
-        reason = "active turn checks and turn state updates must remain atomic"
-    )]
     pub async fn inject_response_items(
         &self,
         input: Vec<ResponseInputItem>,
     ) -> Result<(), Vec<ResponseInputItem>> {
-        let mut active = self.active_turn.lock().await;
-        match active.as_mut() {
-            Some(at) => {
-                let mut ts = at.turn_state.lock().await;
-                for item in input {
-                    ts.push_pending_input(item);
-                }
-                Ok(())
-            }
-            None => Err(input),
-        }
-    }
-
-    pub(crate) async fn defer_mailbox_delivery_to_next_turn(&self, sub_id: &str) {
-        let turn_state = self.turn_state_for_sub_id(sub_id).await;
-        let Some(turn_state) = turn_state else {
-            return;
-        };
-        let mut turn_state = turn_state.lock().await;
-        if turn_state.has_pending_input() {
-            return;
-        }
-        turn_state.set_mailbox_delivery_phase(MailboxDeliveryPhase::NextTurn);
-    }
-
-    pub(crate) async fn accept_mailbox_delivery_for_current_turn(&self, sub_id: &str) {
-        let turn_state = self.turn_state_for_sub_id(sub_id).await;
-        let Some(turn_state) = turn_state else {
-            return;
-        };
-        turn_state
-            .lock()
+        self.input_queue
+            .inject_response_items(&self.active_turn, input)
             .await
-            .set_mailbox_delivery_phase(MailboxDeliveryPhase::CurrentTurn);
     }
 
     pub(crate) async fn record_memory_citation_for_turn(&self, sub_id: &str) {
-        let turn_state = self.turn_state_for_sub_id(sub_id).await;
+        let turn_state = self
+            .input_queue
+            .turn_state_for_sub_id(&self.active_turn, sub_id)
+            .await;
         let Some(turn_state) = turn_state else {
             return;
         };
         turn_state.lock().await.has_memory_citation = true;
     }
 
-    async fn turn_state_for_sub_id(
-        &self,
-        sub_id: &str,
-    ) -> Option<Arc<tokio::sync::Mutex<crate::state::TurnState>>> {
-        let active = self.active_turn.lock().await;
-        active.as_ref().and_then(|active_turn| {
-            active_turn
-                .tasks
-                .contains_key(sub_id)
-                .then(|| Arc::clone(&active_turn.turn_state))
-        })
-    }
-
-    pub(crate) fn subscribe_mailbox_seq(&self) -> watch::Receiver<u64> {
-        self.mailbox.subscribe()
-    }
-
-    pub(crate) fn enqueue_mailbox_communication(&self, communication: InterAgentCommunication) {
-        self.mailbox.send(communication);
-    }
-
-    pub(crate) async fn has_trigger_turn_mailbox_items(&self) -> bool {
-        self.mailbox_rx.lock().await.has_pending_trigger_turn()
-    }
-
-    pub(crate) async fn has_pending_mailbox_items(&self) -> bool {
-        self.mailbox_rx.lock().await.has_pending()
-    }
-
-    #[expect(
-        clippy::await_holding_invalid_type,
-        reason = "active turn checks and turn state updates must remain atomic"
-    )]
-    pub async fn prepend_pending_input(&self, input: Vec<ResponseInputItem>) -> Result<(), ()> {
-        let mut active = self.active_turn.lock().await;
-        match active.as_mut() {
-            Some(at) => {
-                let mut ts = at.turn_state.lock().await;
-                ts.prepend_pending_input(input);
-                Ok(())
-            }
-            None => Err(()),
-        }
-    }
-
-    #[expect(
-        clippy::await_holding_invalid_type,
-        reason = "active turn checks and turn state updates must remain atomic"
-    )]
-    pub async fn get_pending_input(&self) -> Vec<ResponseInputItem> {
-        let (pending_input, accepts_mailbox_delivery) = {
-            let mut active = self.active_turn.lock().await;
-            match active.as_mut() {
-                Some(at) => {
-                    let mut ts = at.turn_state.lock().await;
-                    (
-                        ts.take_pending_input(),
-                        ts.accepts_mailbox_delivery_for_current_turn(),
-                    )
-                }
-                None => (Vec::new(), true),
-            }
-        };
-        if !accepts_mailbox_delivery {
-            return pending_input;
-        }
-        let mailbox_items = {
-            let mut mailbox_rx = self.mailbox_rx.lock().await;
-            mailbox_rx
-                .drain()
-                .into_iter()
-                .map(|mail| mail.to_response_input_item())
-                .collect::<Vec<_>>()
-        };
-        if pending_input.is_empty() {
-            mailbox_items
-        } else if mailbox_items.is_empty() {
-            pending_input
-        } else {
-            let mut pending_input = pending_input;
-            pending_input.extend(mailbox_items);
-            pending_input
-        }
-    }
-
-    /// Queue response items to be injected into the next active turn created for this session.
-    pub(crate) async fn queue_response_items_for_next_turn(&self, items: Vec<ResponseInputItem>) {
-        if items.is_empty() {
-            return;
-        }
-
-        let mut idle_pending_input = self.idle_pending_input.lock().await;
-        idle_pending_input.extend(items);
-    }
-
-    pub(crate) async fn take_queued_response_items_for_next_turn(&self) -> Vec<ResponseInputItem> {
-        std::mem::take(&mut *self.idle_pending_input.lock().await)
-    }
-
-    pub(crate) async fn has_queued_response_items_for_next_turn(&self) -> bool {
-        !self.idle_pending_input.lock().await.is_empty()
-    }
-
-    #[expect(
-        clippy::await_holding_invalid_type,
-        reason = "active turn checks and turn state reads must remain atomic"
-    )]
-    pub async fn has_pending_input(&self) -> bool {
-        let (has_turn_pending_input, accepts_mailbox_delivery) = {
-            let active = self.active_turn.lock().await;
-            match active.as_ref() {
-                Some(at) => {
-                    let ts = at.turn_state.lock().await;
-                    (
-                        ts.has_pending_input(),
-                        ts.accepts_mailbox_delivery_for_current_turn(),
-                    )
-                }
-                None => (false, true),
-            }
-        };
-        if has_turn_pending_input {
-            return true;
-        }
-        if !accepts_mailbox_delivery {
-            return false;
-        }
-        self.has_pending_mailbox_items().await
-    }
-
     pub async fn interrupt_task(self: &Arc<Self>) {
         info!("interrupt received: abort current task, if any");
         let had_active_turn = self.active_turn.lock().await.is_some();
-        // Even without an active task, interrupt handling pauses any active goal.
         self.abort_all_tasks(TurnAbortReason::Interrupted).await;
         if !had_active_turn {
             self.cancel_mcp_startup().await;
@@ -3398,8 +3300,6 @@ pub(crate) fn emit_subagent_session_started(
     });
 }
 
-use codex_memories_read::build_memory_tool_developer_instructions;
-
 /// Builds the hook engine for one config snapshot, including any enabled plugin hooks.
 async fn build_hooks_for_config(
     config: &Config,
diff --git a/codex-rs/core/src/session/review.rs b/codex-rs/core/src/session/review.rs
index f884a95a27..059dc8abbd 100644
--- a/codex-rs/core/src/session/review.rs
+++ b/codex-rs/core/src/session/review.rs
@@ -1,4 +1,3 @@
-use super::turn_context::image_generation_tool_auth_allowed;
 use super::*;
 use std::sync::atomic::AtomicBool;
 
@@ -23,49 +22,21 @@ pub(super) async fn spawn_review_thread(
     let mut review_features = sess.features.clone();
     let _ = review_features.disable(Feature::WebSearchRequest);
     let _ = review_features.disable(Feature::WebSearchCached);
+    let _ = review_features.disable(Feature::Goals);
     let review_web_search_mode = WebSearchMode::Disabled;
-    let goal_tools_supported = !config.ephemeral && parent_turn_context.tools_config.goal_tools;
-    let provider_capabilities = parent_turn_context.provider.capabilities();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &review_model_info,
-        available_models: &sess
-            .services
-            .models_manager
-            .list_models(RefreshStrategy::OnlineIfUncached)
-            .await,
-        features: &review_features,
-        image_generation_tool_auth_allowed: image_generation_tool_auth_allowed(Some(
-            sess.services.auth_manager.as_ref(),
-        )),
-        web_search_mode: Some(review_web_search_mode),
-        session_source: parent_turn_context.session_source.clone(),
-        permission_profile: &parent_turn_context.permission_profile,
-        windows_sandbox_level: parent_turn_context.windows_sandbox_level,
-    })
-    .with_namespace_tools_capability(provider_capabilities.namespace_tools)
-    .with_image_generation_capability(provider_capabilities.image_generation)
-    .with_web_search_capability(provider_capabilities.web_search)
-    .with_unified_exec_shell_mode_for_session(
-        crate::tools::spec::tool_user_shell_type(sess.services.user_shell.as_ref()),
+    let goal_tools_supported = !config.ephemeral && parent_turn_context.goal_tools_enabled();
+    let available_models = sess
+        .services
+        .models_manager
+        .list_models(RefreshStrategy::OnlineIfUncached)
+        .await;
+    let shell_command_backend = shell_command_backend_for_features(review_features.get());
+    let unified_exec_shell_mode = UnifiedExecShellMode::for_session(
+        shell_command_backend,
+        crate::tools::tool_user_shell_type(sess.services.user_shell.as_ref()),
         sess.services.shell_zsh_path.as_ref(),
         sess.services.main_execve_wrapper_exe.as_ref(),
-    )
-    .with_web_search_config(/*web_search_config*/ None)
-    .with_allow_login_shell(config.permissions.allow_login_shell)
-    .with_environment_mode(parent_turn_context.tools_config.environment_mode)
-    .with_spawn_agent_usage_hint(config.multi_agent_v2.usage_hint_enabled)
-    .with_spawn_agent_usage_hint_text(config.multi_agent_v2.usage_hint_text.clone())
-    .with_hide_spawn_agent_metadata(config.multi_agent_v2.hide_spawn_agent_metadata)
-    .with_goal_tools_allowed(goal_tools_supported)
-    .with_max_concurrent_threads_per_session(config.agent_max_threads)
-    .with_wait_agent_min_timeout_ms(
-        review_features
-            .enabled(Feature::MultiAgentV2)
-            .then_some(config.multi_agent_v2.min_wait_timeout_ms),
-    )
-    .with_agent_type_description(crate::agent::role::spawn_tool_spec::build(
-        &config.agent_roles,
-    ));
+    );
 
     let review_prompt = resolved.prompt.clone();
     let provider = parent_turn_context.provider.clone();
@@ -106,6 +77,7 @@ pub(super) async fn spawn_review_thread(
         sess.thread_id().to_string(),
         parent_turn_context.thread_source,
         review_turn_id.clone(),
+        #[allow(deprecated)]
         parent_turn_context.cwd.clone(),
         &parent_turn_context.permission_profile,
         parent_turn_context.windows_sandbox_level,
@@ -126,8 +98,10 @@ pub(super) async fn spawn_review_thread(
         session_source,
         thread_source: parent_turn_context.thread_source,
         environments: parent_turn_context.environments.clone(),
-        tools_config,
-        features: parent_turn_context.features.clone(),
+        available_models,
+        unified_exec_shell_mode,
+        goal_tools_supported,
+        features: review_features,
         ghost_snapshot: parent_turn_context.ghost_snapshot.clone(),
         current_date: parent_turn_context.current_date.clone(),
         timezone: parent_turn_context.timezone.clone(),
@@ -142,6 +116,7 @@ pub(super) async fn spawn_review_thread(
         network: parent_turn_context.network.clone(),
         windows_sandbox_level: parent_turn_context.windows_sandbox_level,
         shell_environment_policy: parent_turn_context.shell_environment_policy.clone(),
+        #[allow(deprecated)]
         cwd: parent_turn_context.cwd.clone(),
         final_output_json_schema: None,
         codex_self_exe: parent_turn_context.codex_self_exe.clone(),
diff --git a/codex-rs/core/src/session/rollout_reconstruction_tests.rs b/codex-rs/core/src/session/rollout_reconstruction_tests.rs
index 5cfcc38053..fc2811710a 100644
--- a/codex-rs/core/src/session/rollout_reconstruction_tests.rs
+++ b/codex-rs/core/src/session/rollout_reconstruction_tests.rs
@@ -59,7 +59,7 @@ async fn record_initial_history_resumed_bare_turn_context_does_not_hydrate_previ
     let previous_model = "previous-rollout-model";
     let previous_context_item = TurnContextItem {
         turn_id: Some(turn_context.sub_id.clone()),
-        trace_id: turn_context.trace_id.clone(),
+        #[allow(deprecated)]
         cwd: turn_context.cwd.to_path_buf(),
         current_date: turn_context.current_date.clone(),
         timezone: turn_context.timezone.clone(),
@@ -73,11 +73,7 @@ async fn record_initial_history_resumed_bare_turn_context_does_not_hydrate_previ
         collaboration_mode: Some(turn_context.collaboration_mode.clone()),
         realtime_active: Some(turn_context.realtime_active),
         effort: turn_context.reasoning_effort,
-        summary: turn_context.reasoning_summary,
-        user_instructions: None,
-        developer_instructions: None,
-        final_output_json_schema: None,
-        truncation_policy: Some(turn_context.truncation_policy),
+        summary: codex_protocol::config_types::ReasoningSummary::Auto,
     };
     let rollout_items = vec![RolloutItem::TurnContext(previous_context_item)];
 
@@ -100,7 +96,7 @@ async fn record_initial_history_resumed_hydrates_previous_turn_settings_from_lif
     let previous_model = "previous-rollout-model";
     let mut previous_context_item = TurnContextItem {
         turn_id: Some(turn_context.sub_id.clone()),
-        trace_id: turn_context.trace_id.clone(),
+        #[allow(deprecated)]
         cwd: turn_context.cwd.to_path_buf(),
         current_date: turn_context.current_date.clone(),
         timezone: turn_context.timezone.clone(),
@@ -114,11 +110,7 @@ async fn record_initial_history_resumed_hydrates_previous_turn_settings_from_lif
         collaboration_mode: Some(turn_context.collaboration_mode.clone()),
         realtime_active: Some(turn_context.realtime_active),
         effort: turn_context.reasoning_effort,
-        summary: turn_context.reasoning_summary,
-        user_instructions: None,
-        developer_instructions: None,
-        final_output_json_schema: None,
-        truncation_policy: Some(turn_context.truncation_policy),
+        summary: codex_protocol::config_types::ReasoningSummary::Auto,
     };
     let turn_id = previous_context_item
         .turn_id
@@ -141,6 +133,7 @@ async fn record_initial_history_resumed_hydrates_previous_turn_settings_from_lif
                 images: None,
                 local_images: Vec::new(),
                 text_elements: Vec::new(),
+                ..Default::default()
             },
         )),
         RolloutItem::TurnContext(previous_context_item),
@@ -207,6 +200,7 @@ async fn reconstruct_history_rollback_keeps_history_and_metadata_in_sync_for_com
                 images: None,
                 local_images: Vec::new(),
                 text_elements: Vec::new(),
+                ..Default::default()
             },
         )),
         RolloutItem::TurnContext(first_context_item.clone()),
@@ -235,6 +229,7 @@ async fn reconstruct_history_rollback_keeps_history_and_metadata_in_sync_for_com
                 images: None,
                 local_images: Vec::new(),
                 text_elements: Vec::new(),
+                ..Default::default()
             },
         )),
         RolloutItem::TurnContext(rolled_back_context_item),
@@ -305,6 +300,7 @@ async fn reconstruct_history_rollback_keeps_history_and_metadata_in_sync_for_inc
                 images: None,
                 local_images: Vec::new(),
                 text_elements: Vec::new(),
+                ..Default::default()
             },
         )),
         RolloutItem::TurnContext(first_context_item.clone()),
@@ -333,6 +329,7 @@ async fn reconstruct_history_rollback_keeps_history_and_metadata_in_sync_for_inc
                 images: None,
                 local_images: Vec::new(),
                 text_elements: Vec::new(),
+                ..Default::default()
             },
         )),
         RolloutItem::ResponseItem(turn_two_user),
@@ -395,6 +392,7 @@ async fn reconstruct_history_rollback_skips_non_user_turns_for_history_and_metad
                 images: None,
                 local_images: Vec::new(),
                 text_elements: Vec::new(),
+                ..Default::default()
             },
         )),
         RolloutItem::TurnContext(first_context_item.clone()),
@@ -423,6 +421,7 @@ async fn reconstruct_history_rollback_skips_non_user_turns_for_history_and_metad
                 images: None,
                 local_images: Vec::new(),
                 text_elements: Vec::new(),
+                ..Default::default()
             },
         )),
         RolloutItem::ResponseItem(turn_two_user),
@@ -513,6 +512,7 @@ async fn reconstruct_history_rollback_counts_inter_agent_assistant_turns() {
                 images: None,
                 local_images: Vec::new(),
                 text_elements: Vec::new(),
+                ..Default::default()
             },
         )),
         RolloutItem::TurnContext(first_context_item.clone()),
@@ -601,6 +601,7 @@ async fn reconstruct_history_rollback_clears_history_and_metadata_when_exceeding
                 images: None,
                 local_images: Vec::new(),
                 text_elements: Vec::new(),
+                ..Default::default()
             },
         )),
         RolloutItem::TurnContext(only_context_item),
@@ -653,6 +654,7 @@ async fn record_initial_history_resumed_rollback_skips_only_user_turns() {
                 images: None,
                 local_images: Vec::new(),
                 text_elements: Vec::new(),
+                ..Default::default()
             },
         )),
         RolloutItem::TurnContext(previous_context_item),
@@ -725,6 +727,7 @@ async fn record_initial_history_resumed_rollback_drops_incomplete_user_turn_comp
                 images: None,
                 local_images: Vec::new(),
                 text_elements: Vec::new(),
+                ..Default::default()
             },
         )),
         RolloutItem::TurnContext(previous_context_item.clone()),
@@ -751,6 +754,7 @@ async fn record_initial_history_resumed_rollback_drops_incomplete_user_turn_comp
                 images: None,
                 local_images: Vec::new(),
                 text_elements: Vec::new(),
+                ..Default::default()
             },
         )),
         RolloutItem::Compacted(CompactedItem {
@@ -882,6 +886,7 @@ async fn reconstruct_history_legacy_compaction_without_replacement_history_clear
                 images: None,
                 local_images: Vec::new(),
                 text_elements: Vec::new(),
+                ..Default::default()
             },
         )),
         RolloutItem::TurnContext(current_context_item),
@@ -910,7 +915,7 @@ async fn record_initial_history_resumed_turn_context_after_compaction_reestablis
     let previous_model = "previous-rollout-model";
     let previous_context_item = TurnContextItem {
         turn_id: Some(turn_context.sub_id.clone()),
-        trace_id: turn_context.trace_id.clone(),
+        #[allow(deprecated)]
         cwd: turn_context.cwd.to_path_buf(),
         current_date: turn_context.current_date.clone(),
         timezone: turn_context.timezone.clone(),
@@ -924,11 +929,7 @@ async fn record_initial_history_resumed_turn_context_after_compaction_reestablis
         collaboration_mode: Some(turn_context.collaboration_mode.clone()),
         realtime_active: Some(turn_context.realtime_active),
         effort: turn_context.reasoning_effort,
-        summary: turn_context.reasoning_summary,
-        user_instructions: None,
-        developer_instructions: None,
-        final_output_json_schema: None,
-        truncation_policy: Some(turn_context.truncation_policy),
+        summary: codex_protocol::config_types::ReasoningSummary::Auto,
     };
     let previous_turn_id = previous_context_item
         .turn_id
@@ -949,6 +950,7 @@ async fn record_initial_history_resumed_turn_context_after_compaction_reestablis
                 images: None,
                 local_images: Vec::new(),
                 text_elements: Vec::new(),
+                ..Default::default()
             },
         )),
         // Compaction clears baseline until a later TurnContextItem re-establishes it.
@@ -988,7 +990,7 @@ async fn record_initial_history_resumed_turn_context_after_compaction_reestablis
             .expect("serialize seeded reference context item"),
         serde_json::to_value(Some(TurnContextItem {
             turn_id: Some(turn_context.sub_id.clone()),
-            trace_id: turn_context.trace_id.clone(),
+            #[allow(deprecated)]
             cwd: turn_context.cwd.to_path_buf(),
             current_date: turn_context.current_date.clone(),
             timezone: turn_context.timezone.clone(),
@@ -1002,11 +1004,7 @@ async fn record_initial_history_resumed_turn_context_after_compaction_reestablis
             collaboration_mode: Some(turn_context.collaboration_mode.clone()),
             realtime_active: Some(turn_context.realtime_active),
             effort: turn_context.reasoning_effort,
-            summary: turn_context.reasoning_summary,
-            user_instructions: None,
-            developer_instructions: None,
-            final_output_json_schema: None,
-            truncation_policy: Some(turn_context.truncation_policy),
+            summary: codex_protocol::config_types::ReasoningSummary::Auto,
         }))
         .expect("serialize expected reference context item")
     );
@@ -1019,7 +1017,7 @@ async fn record_initial_history_resumed_aborted_turn_without_id_clears_active_tu
     let previous_model = "previous-rollout-model";
     let previous_context_item = TurnContextItem {
         turn_id: Some(turn_context.sub_id.clone()),
-        trace_id: turn_context.trace_id.clone(),
+        #[allow(deprecated)]
         cwd: turn_context.cwd.to_path_buf(),
         current_date: turn_context.current_date.clone(),
         timezone: turn_context.timezone.clone(),
@@ -1033,11 +1031,7 @@ async fn record_initial_history_resumed_aborted_turn_without_id_clears_active_tu
         collaboration_mode: Some(turn_context.collaboration_mode.clone()),
         realtime_active: Some(turn_context.realtime_active),
         effort: turn_context.reasoning_effort,
-        summary: turn_context.reasoning_summary,
-        user_instructions: None,
-        developer_instructions: None,
-        final_output_json_schema: None,
-        truncation_policy: Some(turn_context.truncation_policy),
+        summary: codex_protocol::config_types::ReasoningSummary::Auto,
     };
     let previous_turn_id = previous_context_item
         .turn_id
@@ -1060,6 +1054,7 @@ async fn record_initial_history_resumed_aborted_turn_without_id_clears_active_tu
                 images: None,
                 local_images: Vec::new(),
                 text_elements: Vec::new(),
+                ..Default::default()
             },
         )),
         RolloutItem::TurnContext(previous_context_item),
@@ -1086,6 +1081,7 @@ async fn record_initial_history_resumed_aborted_turn_without_id_clears_active_tu
                 images: None,
                 local_images: Vec::new(),
                 text_elements: Vec::new(),
+                ..Default::default()
             },
         )),
         RolloutItem::EventMsg(EventMsg::TurnAborted(
@@ -1134,7 +1130,7 @@ async fn record_initial_history_resumed_unmatched_abort_preserves_active_turn_fo
     let unmatched_abort_turn_id = "other-turn".to_string();
     let current_context_item = TurnContextItem {
         turn_id: Some(current_turn_id.clone()),
-        trace_id: turn_context.trace_id.clone(),
+        #[allow(deprecated)]
         cwd: turn_context.cwd.to_path_buf(),
         current_date: turn_context.current_date.clone(),
         timezone: turn_context.timezone.clone(),
@@ -1148,11 +1144,7 @@ async fn record_initial_history_resumed_unmatched_abort_preserves_active_turn_fo
         collaboration_mode: Some(turn_context.collaboration_mode.clone()),
         realtime_active: Some(turn_context.realtime_active),
         effort: turn_context.reasoning_effort,
-        summary: turn_context.reasoning_summary,
-        user_instructions: None,
-        developer_instructions: None,
-        final_output_json_schema: None,
-        truncation_policy: Some(turn_context.truncation_policy),
+        summary: codex_protocol::config_types::ReasoningSummary::Auto,
     };
 
     let rollout_items = vec![
@@ -1170,6 +1162,7 @@ async fn record_initial_history_resumed_unmatched_abort_preserves_active_turn_fo
                 images: None,
                 local_images: Vec::new(),
                 text_elements: Vec::new(),
+                ..Default::default()
             },
         )),
         RolloutItem::TurnContext(previous_context_item),
@@ -1196,6 +1189,7 @@ async fn record_initial_history_resumed_unmatched_abort_preserves_active_turn_fo
                 images: None,
                 local_images: Vec::new(),
                 text_elements: Vec::new(),
+                ..Default::default()
             },
         )),
         RolloutItem::EventMsg(EventMsg::TurnAborted(
@@ -1248,7 +1242,7 @@ async fn record_initial_history_resumed_trailing_incomplete_turn_compaction_clea
     let previous_model = "previous-rollout-model";
     let previous_context_item = TurnContextItem {
         turn_id: Some(turn_context.sub_id.clone()),
-        trace_id: turn_context.trace_id.clone(),
+        #[allow(deprecated)]
         cwd: turn_context.cwd.to_path_buf(),
         current_date: turn_context.current_date.clone(),
         timezone: turn_context.timezone.clone(),
@@ -1262,11 +1256,7 @@ async fn record_initial_history_resumed_trailing_incomplete_turn_compaction_clea
         collaboration_mode: Some(turn_context.collaboration_mode.clone()),
         realtime_active: Some(turn_context.realtime_active),
         effort: turn_context.reasoning_effort,
-        summary: turn_context.reasoning_summary,
-        user_instructions: None,
-        developer_instructions: None,
-        final_output_json_schema: None,
-        truncation_policy: Some(turn_context.truncation_policy),
+        summary: codex_protocol::config_types::ReasoningSummary::Auto,
     };
     let previous_turn_id = previous_context_item
         .turn_id
@@ -1289,6 +1279,7 @@ async fn record_initial_history_resumed_trailing_incomplete_turn_compaction_clea
                 images: None,
                 local_images: Vec::new(),
                 text_elements: Vec::new(),
+                ..Default::default()
             },
         )),
         RolloutItem::TurnContext(previous_context_item),
@@ -1315,6 +1306,7 @@ async fn record_initial_history_resumed_trailing_incomplete_turn_compaction_clea
                 images: None,
                 local_images: Vec::new(),
                 text_elements: Vec::new(),
+                ..Default::default()
             },
         )),
         RolloutItem::Compacted(CompactedItem {
@@ -1365,6 +1357,7 @@ async fn record_initial_history_resumed_trailing_incomplete_turn_preserves_turn_
                 images: None,
                 local_images: Vec::new(),
                 text_elements: Vec::new(),
+                ..Default::default()
             },
         )),
         RolloutItem::TurnContext(current_context_item.clone()),
@@ -1400,7 +1393,7 @@ async fn record_initial_history_resumed_replaced_incomplete_compacted_turn_clear
     let previous_model = "previous-rollout-model";
     let previous_context_item = TurnContextItem {
         turn_id: Some(turn_context.sub_id.clone()),
-        trace_id: turn_context.trace_id.clone(),
+        #[allow(deprecated)]
         cwd: turn_context.cwd.to_path_buf(),
         current_date: turn_context.current_date.clone(),
         timezone: turn_context.timezone.clone(),
@@ -1414,11 +1407,7 @@ async fn record_initial_history_resumed_replaced_incomplete_compacted_turn_clear
         collaboration_mode: Some(turn_context.collaboration_mode.clone()),
         realtime_active: Some(turn_context.realtime_active),
         effort: turn_context.reasoning_effort,
-        summary: turn_context.reasoning_summary,
-        user_instructions: None,
-        developer_instructions: None,
-        final_output_json_schema: None,
-        truncation_policy: Some(turn_context.truncation_policy),
+        summary: codex_protocol::config_types::ReasoningSummary::Auto,
     };
     let previous_turn_id = previous_context_item
         .turn_id
@@ -1442,6 +1431,7 @@ async fn record_initial_history_resumed_replaced_incomplete_compacted_turn_clear
                 images: None,
                 local_images: Vec::new(),
                 text_elements: Vec::new(),
+                ..Default::default()
             },
         )),
         RolloutItem::TurnContext(previous_context_item),
@@ -1468,6 +1458,7 @@ async fn record_initial_history_resumed_replaced_incomplete_compacted_turn_clear
                 images: None,
                 local_images: Vec::new(),
                 text_elements: Vec::new(),
+                ..Default::default()
             },
         )),
         RolloutItem::Compacted(CompactedItem {
diff --git a/codex-rs/core/src/session/session.rs b/codex-rs/core/src/session/session.rs
index 5b1b8c83e4..884c440f28 100644
--- a/codex-rs/core/src/session/session.rs
+++ b/codex-rs/core/src/session/session.rs
@@ -1,5 +1,7 @@
+use super::input_queue::InputQueue;
 use super::*;
 use crate::goals::GoalRuntimeState;
+use crate::state::ActiveTurn;
 use codex_protocol::SessionId;
 use codex_protocol::config_types::ServiceTier;
 use codex_protocol::permissions::FileSystemPath;
@@ -27,9 +29,7 @@ pub(crate) struct Session {
     pub(super) pending_mcp_server_refresh_config: Mutex<Option<McpServerRefreshConfig>>,
     pub(crate) conversation: Arc<RealtimeConversationManager>,
     pub(crate) active_turn: Mutex<Option<ActiveTurn>>,
-    pub(super) mailbox: Mailbox,
-    pub(super) mailbox_rx: Mutex<MailboxReceiver>,
-    pub(super) idle_pending_input: Mutex<Vec<ResponseInputItem>>, // TODO (jif) merge with mailbox!
+    pub(crate) input_queue: InputQueue,
     pub(crate) goal_runtime: GoalRuntimeState,
     pub(crate) guardian_review_session: GuardianReviewSessionManager,
     pub(crate) services: SessionServices,
@@ -63,11 +63,10 @@ pub(crate) struct SessionConfiguration {
     /// When to escalate for approval for execution
     pub(super) approval_policy: Constrained<AskForApproval>,
     pub(super) approvals_reviewer: ApprovalsReviewer,
-    /// Canonical permission profile for the session.
-    pub(super) permission_profile: Constrained<PermissionProfile>,
-    /// Named or implicit built-in permissions profile selected from config, if
-    /// any.
-    pub(super) active_permission_profile: Option<ActivePermissionProfile>,
+    /// Permission profile state for the session. Keep the constrained profile,
+    /// active profile id, and profile-defined workspace roots in sync by using
+    /// the methods below instead of mutating the fields independently.
+    pub(super) permission_profile_state: PermissionProfileState,
     pub(super) windows_sandbox_level: WindowsSandboxLevel,
 
     /// Absolute working directory that should be treated as the *root* of the
@@ -75,6 +74,9 @@ pub(crate) struct SessionConfiguration {
     /// execution sandbox are resolved against this directory **instead** of
     /// the process-wide current working directory.
     pub(super) cwd: AbsolutePathBuf,
+    /// Thread-scoped runtime workspace roots for materializing symbolic
+    /// workspace permissions at session runtime.
+    pub(super) workspace_roots: Vec<AbsolutePathBuf>,
     /// Directory containing all Codex state for this session.
     pub(super) codex_home: AbsolutePathBuf,
     /// Optional user-facing name for the thread, updated during the session.
@@ -103,12 +105,39 @@ impl SessionConfiguration {
         &self.codex_home
     }
 
+    pub(super) fn permission_profile_state(&self) -> &PermissionProfileState {
+        &self.permission_profile_state
+    }
+
     pub(super) fn permission_profile(&self) -> PermissionProfile {
-        self.permission_profile.get().clone()
+        self.permission_profile_state
+            .permission_profile()
+            .clone()
+            .materialize_project_roots_with_workspace_roots(&self.workspace_roots)
     }
 
     pub(super) fn active_permission_profile(&self) -> Option<ActivePermissionProfile> {
-        self.active_permission_profile.clone()
+        self.permission_profile_state.active_permission_profile()
+    }
+
+    pub(super) fn profile_workspace_roots(&self) -> &[AbsolutePathBuf] {
+        self.permission_profile_state.profile_workspace_roots()
+    }
+
+    pub(super) fn apply_permission_profile_to_permissions(
+        &self,
+        permissions: &mut crate::config::Permissions,
+    ) {
+        permissions.set_permission_profile_state(self.permission_profile_state.clone());
+    }
+
+    #[cfg(test)]
+    pub(super) fn set_permission_profile_for_tests(
+        &mut self,
+        permission_profile: PermissionProfile,
+    ) -> ConstraintResult<()> {
+        self.permission_profile_state
+            .set_legacy_permission_profile(permission_profile)
     }
 
     pub(super) fn sandbox_policy(&self) -> SandboxPolicy {
@@ -117,7 +146,7 @@ impl SessionConfiguration {
             .unwrap_or_else(|_| {
                 let file_system_sandbox_policy = self.file_system_sandbox_policy();
                 codex_sandboxing::compatibility_sandbox_policy_for_permission_profile(
-                    self.permission_profile.get(),
+                    self.permission_profile_state.permission_profile(),
                     &file_system_sandbox_policy,
                     self.network_sandbox_policy(),
                     &self.cwd,
@@ -126,11 +155,13 @@ impl SessionConfiguration {
     }
 
     pub(super) fn file_system_sandbox_policy(&self) -> FileSystemSandboxPolicy {
-        self.permission_profile.get().file_system_sandbox_policy()
+        self.permission_profile().file_system_sandbox_policy()
     }
 
     pub(super) fn network_sandbox_policy(&self) -> NetworkSandboxPolicy {
-        self.permission_profile.get().network_sandbox_policy()
+        self.permission_profile_state
+            .permission_profile()
+            .network_sandbox_policy()
     }
 
     pub(super) fn thread_config_snapshot(&self) -> ThreadConfigSnapshot {
@@ -143,9 +174,13 @@ impl SessionConfiguration {
             permission_profile: self.permission_profile(),
             active_permission_profile: self.active_permission_profile(),
             cwd: self.cwd.clone(),
+            workspace_roots: self.workspace_roots.clone(),
+            profile_workspace_roots: self.profile_workspace_roots().to_vec(),
             ephemeral: self.original_config_do_not_use.ephemeral,
             reasoning_effort: self.collaboration_mode.reasoning_effort(),
+            reasoning_summary: self.model_reasoning_summary,
             personality: self.personality,
+            collaboration_mode: self.collaboration_mode.clone(),
             session_source: self.session_source.clone(),
             thread_source: self.thread_source,
         }
@@ -222,21 +257,39 @@ impl SessionConfiguration {
 
         let cwd_changed = absolute_cwd.as_path() != self.cwd.as_path();
         next_configuration.cwd = absolute_cwd;
+        if let Some(workspace_roots) = updates.workspace_roots.clone() {
+            next_configuration.workspace_roots = workspace_roots;
+        } else if cwd_changed && self.workspace_roots.contains(&self.cwd) {
+            let mut retargeted_workspace_roots =
+                Vec::with_capacity(next_configuration.workspace_roots.len());
+            for root in &self.workspace_roots {
+                let root = if root == &self.cwd {
+                    next_configuration.cwd.clone()
+                } else {
+                    root.clone()
+                };
+                if !retargeted_workspace_roots.contains(&root) {
+                    retargeted_workspace_roots.push(root);
+                }
+            }
+            next_configuration.workspace_roots = retargeted_workspace_roots;
+        }
 
         if let Some(permission_profile) = updates.permission_profile.clone() {
             let active_permission_profile =
                 updates.active_permission_profile.clone().or_else(|| {
                     if permission_profile == self.permission_profile() {
-                        self.active_permission_profile.clone()
+                        self.active_permission_profile()
                     } else {
                         None
                     }
                 });
             next_configuration.set_permission_profile_projection(
                 permission_profile,
+                active_permission_profile,
+                updates.profile_workspace_roots.clone().unwrap_or_default(),
                 Some(&current_file_system_sandbox_policy),
             )?;
-            next_configuration.active_permission_profile = active_permission_profile;
         } else if let Some(sandbox_policy) = updates.sandbox_policy.clone() {
             let file_system_sandbox_policy =
                 FileSystemSandboxPolicy::from_legacy_sandbox_policy_preserving_deny_entries(
@@ -245,14 +298,15 @@ impl SessionConfiguration {
                     &current_file_system_sandbox_policy,
                 );
             let network_sandbox_policy = NetworkSandboxPolicy::from(&sandbox_policy);
-            next_configuration.permission_profile.set(
-                PermissionProfile::from_runtime_permissions_with_enforcement(
-                    SandboxEnforcement::from_legacy_sandbox_policy(&sandbox_policy),
-                    &file_system_sandbox_policy,
-                    network_sandbox_policy,
-                ),
-            )?;
-            next_configuration.active_permission_profile = None;
+            next_configuration
+                .permission_profile_state
+                .set_legacy_permission_profile(
+                    PermissionProfile::from_runtime_permissions_with_enforcement(
+                        SandboxEnforcement::from_legacy_sandbox_policy(&sandbox_policy),
+                        &file_system_sandbox_policy,
+                        network_sandbox_policy,
+                    ),
+                )?;
         } else if cwd_changed
             && file_system_policy_matches_legacy
             && file_system_policy_has_rebindable_project_root_write
@@ -266,13 +320,15 @@ impl SessionConfiguration {
                     &next_configuration.cwd,
                     &current_file_system_sandbox_policy,
                 );
-            next_configuration.permission_profile.set(
-                PermissionProfile::from_runtime_permissions_with_enforcement(
-                    SandboxEnforcement::from_legacy_sandbox_policy(&current_sandbox_policy),
-                    &file_system_sandbox_policy,
-                    current_network_sandbox_policy,
-                ),
-            )?;
+            next_configuration
+                .permission_profile_state
+                .set_legacy_permission_profile(
+                    PermissionProfile::from_runtime_permissions_with_enforcement(
+                        SandboxEnforcement::from_legacy_sandbox_policy(&current_sandbox_policy),
+                        &file_system_sandbox_policy,
+                        current_network_sandbox_policy,
+                    ),
+                )?;
         }
         if let Some(app_server_client_name) = updates.app_server_client_name.clone() {
             next_configuration.app_server_client_name = Some(app_server_client_name);
@@ -286,6 +342,8 @@ impl SessionConfiguration {
     fn set_permission_profile_projection(
         &mut self,
         permission_profile: PermissionProfile,
+        active_permission_profile: Option<ActivePermissionProfile>,
+        profile_workspace_roots: Vec<AbsolutePathBuf>,
         preserve_deny_reads_from: Option<&FileSystemSandboxPolicy>,
     ) -> ConstraintResult<()> {
         let enforcement = permission_profile.enforcement();
@@ -301,14 +359,28 @@ impl SessionConfiguration {
                 &file_system_sandbox_policy,
                 network_sandbox_policy,
             );
-        self.permission_profile.set(effective_permission_profile)?;
-        Ok(())
+
+        let permission_snapshot = match active_permission_profile {
+            Some(active_permission_profile) => {
+                PermissionProfileSnapshot::active_with_profile_workspace_roots(
+                    effective_permission_profile,
+                    active_permission_profile,
+                    profile_workspace_roots,
+                )
+            }
+            None => PermissionProfileSnapshot::legacy(effective_permission_profile),
+        };
+
+        self.permission_profile_state
+            .set_permission_profile_snapshot(permission_snapshot)
     }
 }
 
 #[derive(Default, Clone)]
 pub(crate) struct SessionSettingsUpdate {
     pub(crate) cwd: Option<PathBuf>,
+    pub(crate) workspace_roots: Option<Vec<AbsolutePathBuf>>,
+    pub(crate) profile_workspace_roots: Option<Vec<AbsolutePathBuf>>,
     pub(crate) approval_policy: Option<AskForApproval>,
     pub(crate) approvals_reviewer: Option<ApprovalsReviewer>,
     pub(crate) sandbox_policy: Option<SandboxPolicy>,
@@ -564,19 +636,6 @@ impl Session {
                     }),
                 });
             }
-            if crate::config::uses_deprecated_instructions_file(&config.config_layer_stack) {
-                post_session_configured_events.push(Event {
-                    id: INITIAL_SUBMIT_ID.to_owned(),
-                    msg: EventMsg::DeprecationNotice(DeprecationNoticeEvent {
-                        summary: "`experimental_instructions_file` is deprecated and ignored. Use `model_instructions_file` instead."
-                            .to_string(),
-                        details: Some(
-                            "Move the setting to `model_instructions_file` in config.toml (or under a profile) to load instructions from a file."
-                                .to_string(),
-                        ),
-                    }),
-                });
-            }
             for message in &config.startup_warnings {
                 post_session_configured_events.push(Event {
                     id: "".to_owned(),
@@ -769,7 +828,7 @@ impl Session {
                     let (network_proxy, session_network_proxy) = Self::start_managed_network_proxy(
                         spec,
                         current_exec_policy.as_ref(),
-                        config.permissions.permission_profile.get(),
+                        config.permissions.permission_profile(),
                         network_policy_decider.as_ref().map(Arc::clone),
                         blocked_request_observer.as_ref().map(Arc::clone),
                         managed_network_requirements_configured,
@@ -820,7 +879,7 @@ impl Session {
                     config: config.as_ref(),
                     session_store: &session_extension_data,
                     thread_store: &thread_extension_data,
-                });
+                }).await;
             }
 
             let services = SessionServices {
@@ -831,10 +890,12 @@ impl Session {
                 // before any MCP-related events. It is reasonable to consider
                 // changing this to use Option or OnceCell, though the current
                 // setup is straightforward enough and performs well.
-                mcp_connection_manager: Arc::new(RwLock::new(McpConnectionManager::new_uninitialized(
-                    &config.permissions.approval_policy,
-                    &config.permissions.permission_profile,
-                ))),
+                mcp_connection_manager: Arc::new(RwLock::new(
+                    McpConnectionManager::new_uninitialized_with_permission_profile(
+                        &config.permissions.approval_policy,
+                        config.permissions.permission_profile(),
+                    ),
+                )),
                 mcp_startup_cancellation_token: Mutex::new(CancellationToken::new()),
                 unified_exec_manager: UnifiedExecProcessManager::new(
                     config.background_terminal_max_timeout,
@@ -891,7 +952,6 @@ impl Session {
             let (out_of_band_elicitation_paused, _out_of_band_elicitation_paused_rx) =
                 watch::channel(false);
 
-            let (mailbox, mailbox_rx) = Mailbox::new();
             let sess = Arc::new(Session {
                 conversation_id: thread_id,
                 installation_id,
@@ -904,9 +964,7 @@ impl Session {
                 pending_mcp_server_refresh_config: Mutex::new(None),
                 conversation: Arc::new(RealtimeConversationManager::new()),
                 active_turn: Mutex::new(None),
-                mailbox,
-                mailbox_rx: Mutex::new(mailbox_rx),
-                idle_pending_input: Mutex::new(Vec::new()),
+                input_queue: InputQueue::new(),
                 goal_runtime: GoalRuntimeState::new(),
                 guardian_review_session: GuardianReviewSessionManager::default(),
                 services,
@@ -939,7 +997,9 @@ impl Session {
                     initial_messages,
                     network_proxy: session_network_proxy.filter(|_| {
                         Self::managed_network_proxy_active_for_permission_profile(
-                            session_configuration.permission_profile.get(),
+                            session_configuration
+                                .permission_profile_state()
+                                .permission_profile(),
                         )
                     }),
                     rollout_path,
@@ -990,14 +1050,13 @@ impl Session {
             .cloned();
             let mcp_runtime_environment = match turn_environment {
                 Some(turn_environment) => McpRuntimeEnvironment::new(
-                    Arc::clone(&turn_environment.environment),
+                    Some(Arc::clone(&turn_environment.environment)),
+                    sess.services.environment_manager.try_local_environment(),
                     turn_environment.cwd.to_path_buf(),
                 ),
                 None => McpRuntimeEnvironment::new(
-                    sess.services
-                        .environment_manager
-                        .default_environment()
-                        .unwrap_or_else(|| sess.services.environment_manager.local_environment()),
+                    sess.services.environment_manager.default_or_local_environment(),
+                    sess.services.environment_manager.try_local_environment(),
                     session_configuration.cwd.to_path_buf(),
                 ),
             };
@@ -1069,7 +1128,7 @@ impl Session {
             };
 
             // record_initial_history can emit events. We record only after the SessionConfiguredEvent is emitted.
-            sess.record_initial_history(initial_history).await;
+            Box::pin(sess.record_initial_history(initial_history)).await;
             {
                 let mut state = sess.state.lock().await;
                 state.set_pending_session_start_source(Some(session_start_source));
diff --git a/codex-rs/core/src/session/snapshots/codex_core__codex_tests__fork_startup_context_then_first_turn_diff.snap b/codex-rs/core/src/session/snapshots/codex_core__codex_tests__fork_startup_context_then_first_turn_diff.snap
index f9a808f65e..c51cb93ac6 100644
--- a/codex-rs/core/src/session/snapshots/codex_core__codex_tests__fork_startup_context_then_first_turn_diff.snap
+++ b/codex-rs/core/src/session/snapshots/codex_core__codex_tests__fork_startup_context_then_first_turn_diff.snap
@@ -1,6 +1,5 @@
 ---
 source: core/src/session/tests.rs
-assertion_line: 1619
 expression: snapshot
 ---
 Scenario: First request after fork when startup preserves the parent baseline, the fork changes approval policy, and the first forked turn enters plan mode.
diff --git a/codex-rs/core/src/session/tests.rs b/codex-rs/core/src/session/tests.rs
index b95d67fae5..f80246070b 100644
--- a/codex-rs/core/src/session/tests.rs
+++ b/codex-rs/core/src/session/tests.rs
@@ -4,7 +4,6 @@ use crate::config::ConfigBuilder;
 use crate::config::test_config;
 use crate::context::ContextualUserFragment;
 use crate::context::TurnAborted;
-use crate::exec::ExecCapturePolicy;
 use crate::function_tool::FunctionCallError;
 use crate::shell::default_user_shell;
 use crate::skills::SkillRenderSideEffects;
@@ -13,6 +12,7 @@ use crate::test_support::models_manager_with_provider;
 use crate::tools::format_exec_output_str;
 use codex_config::ConfigLayerStack;
 use codex_config::ConfigLayerStackOrdering;
+use codex_config::LoaderOverrides;
 use codex_config::NetworkConstraints;
 use codex_config::NetworkDomainPermissionToml;
 use codex_config::NetworkDomainPermissionsToml;
@@ -22,7 +22,6 @@ use codex_config::loader::project_trust_key;
 use codex_config::types::ToolSuggestDisabledTool;
 
 use codex_features::Feature;
-use codex_features::Features;
 use codex_login::CodexAuth;
 use codex_model_provider_info::ModelProviderInfo;
 use codex_models_manager::bundled_models_response;
@@ -36,6 +35,8 @@ use codex_protocol::account::PlanType as AccountPlanType;
 use codex_protocol::config_types::ServiceTier;
 use codex_protocol::config_types::TrustLevel;
 use codex_protocol::exec_output::ExecToolCallOutput;
+use codex_protocol::models::ActivePermissionProfile;
+use codex_protocol::models::BUILT_IN_PERMISSION_PROFILE_WORKSPACE;
 use codex_protocol::models::FileSystemPermissions;
 use codex_protocol::models::FunctionCallOutputBody;
 use codex_protocol::models::FunctionCallOutputPayload;
@@ -53,6 +54,7 @@ use codex_protocol::request_permissions::PermissionGrantScope;
 use codex_protocol::request_permissions::RequestPermissionProfile;
 use tracing::Span;
 
+use crate::goals::CreateGoalRequest;
 use crate::goals::ExternalGoalPreviousStatus;
 use crate::goals::ExternalGoalSet;
 use crate::goals::GoalRuntimeEvent;
@@ -69,7 +71,7 @@ use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolPayload;
 use crate::tools::handlers::CreateGoalHandler;
 use crate::tools::handlers::ExecCommandHandler;
-use crate::tools::handlers::ShellHandler;
+use crate::tools::handlers::ShellCommandHandler;
 use crate::tools::handlers::UpdateGoalHandler;
 use crate::tools::registry::ToolExecutor;
 use crate::tools::router::ToolCallSource;
@@ -116,6 +118,7 @@ use codex_protocol::protocol::SkillScope;
 use codex_protocol::protocol::Submission;
 use codex_protocol::protocol::ThreadGoalStatus;
 use codex_protocol::protocol::ThreadRolledBackEvent;
+use codex_protocol::protocol::ThreadSettingsOverrides;
 use codex_protocol::protocol::TokenCountEvent;
 use codex_protocol::protocol::TokenUsage;
 use codex_protocol::protocol::TokenUsageInfo;
@@ -170,10 +173,6 @@ use std::time::Duration as StdDuration;
 
 mod guardian_tests;
 
-fn permission_profile_for_sandbox_policy(sandbox_policy: &SandboxPolicy) -> PermissionProfile {
-    PermissionProfile::from_legacy_sandbox_policy(sandbox_policy)
-}
-
 struct InstructionsTestCase {
     slug: &'static str,
     expects_apply_patch_description: bool,
@@ -531,14 +530,16 @@ async fn preview_session_start_hooks(
             transcript_path: None,
             model: "gpt-5.2".to_string(),
             permission_mode: "default".to_string(),
-            source: codex_hooks::SessionStartSource::Startup,
+            target: codex_hooks::StartHookTarget::SessionStart {
+                source: codex_hooks::SessionStartSource::Startup,
+            },
         }),
     )
 }
 
 fn test_tool_runtime(session: Arc<Session>, turn_context: Arc<TurnContext>) -> ToolCallRuntime {
-    let router = Arc::new(ToolRouter::from_config(
-        &turn_context.tools_config,
+    let router = Arc::new(ToolRouter::from_turn_context(
+        &turn_context,
         crate::tools::router::ToolRouterParams {
             mcp_tools: None,
             deferred_mcp_tools: None,
@@ -668,10 +669,11 @@ fn validated_network_policy_amendment_host_rejects_mismatch() {
 
 #[tokio::test]
 async fn start_managed_network_proxy_applies_execpolicy_network_rules() -> anyhow::Result<()> {
+    let permission_profile = PermissionProfile::workspace_write();
     let spec = crate::config::NetworkProxySpec::from_config_and_constraints(
         NetworkProxyConfig::default(),
         /*requirements*/ None,
-        &permission_profile_for_sandbox_policy(&SandboxPolicy::new_workspace_write_policy()),
+        &permission_profile,
     )?;
     let mut exec_policy = Policy::empty();
     exec_policy.add_network_rule(
@@ -684,7 +686,7 @@ async fn start_managed_network_proxy_applies_execpolicy_network_rules() -> anyho
     let (started_proxy, _) = Session::start_managed_network_proxy(
         &spec,
         &exec_policy,
-        &permission_profile_for_sandbox_policy(&SandboxPolicy::new_workspace_write_policy()),
+        &permission_profile,
         /*network_policy_decider*/ None,
         /*blocked_request_observer*/ None,
         /*managed_network_requirements_enabled*/ false,
@@ -703,6 +705,7 @@ async fn start_managed_network_proxy_applies_execpolicy_network_rules() -> anyho
 #[tokio::test]
 async fn start_managed_network_proxy_ignores_invalid_execpolicy_network_rules() -> anyhow::Result<()>
 {
+    let permission_profile = PermissionProfile::workspace_write();
     let spec = crate::config::NetworkProxySpec::from_config_and_constraints(
         NetworkProxyConfig::default(),
         Some(NetworkConstraints {
@@ -715,7 +718,7 @@ async fn start_managed_network_proxy_ignores_invalid_execpolicy_network_rules()
             managed_allowed_domains_only: Some(true),
             ..Default::default()
         }),
-        &permission_profile_for_sandbox_policy(&SandboxPolicy::new_workspace_write_policy()),
+        &permission_profile,
     )?;
     let mut exec_policy = Policy::empty();
     exec_policy.add_network_rule(
@@ -728,7 +731,7 @@ async fn start_managed_network_proxy_ignores_invalid_execpolicy_network_rules()
     let (started_proxy, _) = Session::start_managed_network_proxy(
         &spec,
         &exec_policy,
-        &permission_profile_for_sandbox_policy(&SandboxPolicy::new_workspace_write_policy()),
+        &permission_profile,
         /*network_policy_decider*/ None,
         /*blocked_request_observer*/ None,
         /*managed_network_requirements_enabled*/ false,
@@ -746,13 +749,14 @@ async fn start_managed_network_proxy_ignores_invalid_execpolicy_network_rules()
 
 #[tokio::test]
 async fn managed_network_proxy_decider_survives_full_access_start() -> anyhow::Result<()> {
+    let full_access_permission_profile = PermissionProfile::Disabled;
     let spec = crate::config::NetworkProxySpec::from_config_and_constraints(
         NetworkProxyConfig::default(),
         Some(NetworkConstraints {
             enabled: Some(true),
             ..Default::default()
         }),
-        &permission_profile_for_sandbox_policy(&SandboxPolicy::DangerFullAccess),
+        &full_access_permission_profile,
     )?;
     let exec_policy = Policy::empty();
     let decider_calls = Arc::new(std::sync::atomic::AtomicUsize::new(0));
@@ -767,7 +771,7 @@ async fn managed_network_proxy_decider_survives_full_access_start() -> anyhow::R
     let (started_proxy, _) = Session::start_managed_network_proxy(
         &spec,
         &exec_policy,
-        &permission_profile_for_sandbox_policy(&SandboxPolicy::DangerFullAccess),
+        &full_access_permission_profile,
         Some(network_policy_decider),
         /*blocked_request_observer*/ None,
         /*managed_network_requirements_enabled*/ true,
@@ -775,9 +779,7 @@ async fn managed_network_proxy_decider_survives_full_access_start() -> anyhow::R
     )
     .await?;
 
-    let spec = spec.recompute_for_permission_profile(&permission_profile_for_sandbox_policy(
-        &SandboxPolicy::new_workspace_write_policy(),
-    ))?;
+    let spec = spec.recompute_for_permission_profile(&PermissionProfile::workspace_write())?;
     spec.apply_to_started_proxy(&started_proxy).await?;
     let current_cfg = started_proxy.proxy().current_cfg().await?;
     assert_eq!(current_cfg.network.allowed_domains(), None);
@@ -816,7 +818,7 @@ async fn managed_network_proxy_decider_survives_full_access_start() -> anyhow::R
 #[tokio::test]
 async fn new_turn_refreshes_managed_network_proxy_for_sandbox_change() -> anyhow::Result<()> {
     let (mut session, _turn_context) = make_session_and_context().await;
-    let initial_policy = SandboxPolicy::new_workspace_write_policy();
+    let initial_permission_profile = PermissionProfile::workspace_write();
 
     let mut network_config = NetworkProxyConfig::default();
     network_config
@@ -834,12 +836,12 @@ async fn new_turn_refreshes_managed_network_proxy_for_sandbox_change() -> anyhow
     let spec = crate::config::NetworkProxySpec::from_config_and_constraints(
         network_config,
         Some(requirements),
-        &permission_profile_for_sandbox_policy(&initial_policy),
+        &initial_permission_profile,
     )?;
     let (started_proxy, _) = Session::start_managed_network_proxy(
         &spec,
         &Policy::empty(),
-        &permission_profile_for_sandbox_policy(&initial_policy),
+        &initial_permission_profile,
         /*network_policy_decider*/ None,
         /*blocked_request_observer*/ None,
         /*managed_network_requirements_enabled*/ false,
@@ -860,18 +862,14 @@ async fn new_turn_refreshes_managed_network_proxy_for_sandbox_change() -> anyhow
         let mut state = session.state.lock().await;
         let mut config = (*state.session_configuration.original_config_do_not_use).clone();
         config.permissions.network = Some(spec);
-        let cwd = config.cwd.clone();
         config
             .permissions
-            .set_legacy_sandbox_policy(initial_policy.clone(), cwd.as_path())
-            .expect("test setup should allow sandbox policy");
+            .set_permission_profile(initial_permission_profile.clone())
+            .expect("test setup should allow permission profile");
         state.session_configuration.original_config_do_not_use = Arc::new(config);
         state
             .session_configuration
-            .permission_profile
-            .set(PermissionProfile::from_legacy_sandbox_policy(
-                &initial_policy,
-            ))
+            .set_permission_profile_for_tests(initial_permission_profile)
             .expect("test setup should allow permission profile");
     }
     session.services.network_proxy = Some(started_proxy);
@@ -912,15 +910,14 @@ async fn danger_full_access_turns_do_not_expose_managed_network_proxy() -> anyho
             enabled: Some(true),
             ..Default::default()
         }),
-        &permission_profile_for_sandbox_policy(&SandboxPolicy::DangerFullAccess),
+        &PermissionProfile::Disabled,
     )?;
 
     let session = make_session_with_config(move |config| {
-        let cwd = config.cwd.clone();
         config
             .permissions
-            .set_legacy_sandbox_policy(SandboxPolicy::DangerFullAccess, cwd.as_path())
-            .expect("test setup should allow sandbox policy");
+            .set_permission_profile(PermissionProfile::Disabled)
+            .expect("test setup should allow permission profile");
         config.permissions.network = Some(network_spec);
     })
     .await?;
@@ -978,15 +975,14 @@ async fn danger_full_access_tool_attempts_do_not_enforce_managed_network() -> an
             enabled: Some(true),
             ..Default::default()
         }),
-        &permission_profile_for_sandbox_policy(&SandboxPolicy::DangerFullAccess),
+        &PermissionProfile::Disabled,
     )?;
 
     let session = make_session_with_config(move |config| {
-        let cwd = config.cwd.clone();
         config
             .permissions
-            .set_legacy_sandbox_policy(SandboxPolicy::DangerFullAccess, cwd.as_path())
-            .expect("test setup should allow sandbox policy");
+            .set_permission_profile(PermissionProfile::Disabled)
+            .expect("test setup should allow permission profile");
         config.permissions.network = Some(network_spec);
 
         let layers = config
@@ -1046,22 +1042,21 @@ async fn danger_full_access_tool_attempts_do_not_enforce_managed_network() -> an
 
 #[tokio::test]
 async fn workspace_write_turns_continue_to_expose_managed_network_proxy() -> anyhow::Result<()> {
-    let sandbox_policy = SandboxPolicy::new_workspace_write_policy();
+    let permission_profile = PermissionProfile::workspace_write();
     let network_spec = crate::config::NetworkProxySpec::from_config_and_constraints(
         NetworkProxyConfig::default(),
         Some(NetworkConstraints {
             enabled: Some(true),
             ..Default::default()
         }),
-        &permission_profile_for_sandbox_policy(&sandbox_policy),
+        &permission_profile,
     )?;
 
     let session = make_session_with_config(move |config| {
-        let cwd = config.cwd.clone();
         config
             .permissions
-            .set_legacy_sandbox_policy(sandbox_policy, cwd.as_path())
-            .expect("test setup should allow sandbox policy");
+            .set_permission_profile(permission_profile)
+            .expect("test setup should allow permission profile");
         config.permissions.network = Some(network_spec);
     })
     .await?;
@@ -1073,22 +1068,21 @@ async fn workspace_write_turns_continue_to_expose_managed_network_proxy() -> any
 
 #[tokio::test]
 async fn user_shell_commands_do_not_inherit_managed_network_proxy() -> anyhow::Result<()> {
-    let sandbox_policy = SandboxPolicy::new_workspace_write_policy();
+    let permission_profile = PermissionProfile::workspace_write();
     let network_spec = crate::config::NetworkProxySpec::from_config_and_constraints(
         NetworkProxyConfig::default(),
         Some(NetworkConstraints {
             enabled: Some(true),
             ..Default::default()
         }),
-        &permission_profile_for_sandbox_policy(&sandbox_policy),
+        &permission_profile,
     )?;
 
     let (session, rx) = make_session_with_config_and_rx(move |config| {
-        let cwd = config.cwd.clone();
         config
             .permissions
-            .set_legacy_sandbox_policy(sandbox_policy, cwd.as_path())
-            .expect("test setup should allow sandbox policy");
+            .set_permission_profile(permission_profile)
+            .expect("test setup should allow permission profile");
         config.permissions.network = Some(network_spec);
     })
     .await?;
@@ -1211,6 +1205,70 @@ async fn reload_user_config_layer_updates_effective_apps_config() {
     assert_eq!(app.destructive_enabled, Some(false));
 }
 
+#[tokio::test]
+async fn reload_user_config_layer_updates_base_and_selected_profile_layers() {
+    let (session, _turn_context) = make_session_and_context().await;
+    let codex_home = session.codex_home().await;
+    std::fs::create_dir_all(&codex_home).expect("create codex home");
+    let base_config_path = codex_home.join(CONFIG_TOML_FILE);
+    let profile_config_path = codex_home.join("work.config.toml");
+    std::fs::write(
+        &base_config_path,
+        "model = \"base\"\napproval_policy = \"on-failure\"\n",
+    )
+    .expect("write base user config");
+    std::fs::write(&profile_config_path, "model = \"profile-old\"\n")
+        .expect("write profile user config");
+    let config = ConfigBuilder::without_managed_config_for_tests()
+        .codex_home(codex_home.to_path_buf())
+        .loader_overrides(LoaderOverrides {
+            user_config_path: Some(profile_config_path.abs()),
+            user_config_profile: Some("work".parse().expect("profile-v2 name")),
+            ..LoaderOverrides::without_managed_config_for_tests()
+        })
+        .build()
+        .await
+        .expect("load profile config");
+    {
+        let mut state = session.state.lock().await;
+        state.session_configuration.original_config_do_not_use = Arc::new(config);
+    }
+    std::fs::write(
+        &base_config_path,
+        "model = \"base\"\napproval_policy = \"never\"\n",
+    )
+    .expect("update base user config");
+    std::fs::write(&profile_config_path, "model = \"profile-new\"\n")
+        .expect("update profile user config");
+
+    session.reload_user_config_layer().await;
+
+    let config = session.get_config().await;
+    assert_eq!(
+        config
+            .config_layer_stack
+            .get_user_config_file()
+            .map(codex_utils_absolute_path::AbsolutePathBuf::as_path),
+        Some(profile_config_path.as_path())
+    );
+    let effective_user_config = config
+        .config_layer_stack
+        .effective_user_config()
+        .expect("merged user config");
+    assert_eq!(
+        effective_user_config
+            .get("model")
+            .and_then(toml::Value::as_str),
+        Some("profile-new")
+    );
+    assert_eq!(
+        effective_user_config
+            .get("approval_policy")
+            .and_then(toml::Value::as_str),
+        Some("never")
+    );
+}
+
 #[tokio::test]
 async fn reload_user_config_layer_refreshes_hooks() -> anyhow::Result<()> {
     let session = make_session_with_config(|config| {
@@ -1240,7 +1298,9 @@ async fn reload_user_config_layer_refreshes_hooks() -> anyhow::Result<()> {
         transcript_path: None,
         model: "gpt-5.2".to_string(),
         permission_mode: "default".to_string(),
-        source: codex_hooks::SessionStartSource::Startup,
+        target: codex_hooks::StartHookTarget::SessionStart {
+            source: codex_hooks::SessionStartSource::Startup,
+        },
     };
     assert!(session.hooks().preview_session_start(&request).is_empty());
 
@@ -1346,7 +1406,9 @@ async fn refresh_runtime_config_refreshes_hooks() -> anyhow::Result<()> {
         transcript_path: None,
         model: "gpt-5.2".to_string(),
         permission_mode: "default".to_string(),
-        source: codex_hooks::SessionStartSource::Startup,
+        target: codex_hooks::StartHookTarget::SessionStart {
+            source: codex_hooks::SessionStartSource::Startup,
+        },
     };
     assert!(session.hooks().preview_session_start(&request).is_empty());
 
@@ -1442,74 +1504,6 @@ disabled_tools = [
     );
 }
 
-#[test]
-fn filter_connectors_for_input_skips_duplicate_slug_mentions() {
-    let connectors = vec![
-        make_connector("one", "Foo Bar"),
-        make_connector("two", "Foo-Bar"),
-    ];
-    let input = vec![user_message("use $foo-bar")];
-    let explicitly_enabled_connectors = HashSet::new();
-    let skill_name_counts_lower = HashMap::new();
-
-    let selected = filter_connectors_for_input(
-        &connectors,
-        &input,
-        &explicitly_enabled_connectors,
-        &skill_name_counts_lower,
-    );
-
-    assert_eq!(selected, Vec::new());
-}
-
-#[test]
-fn filter_connectors_for_input_skips_when_skill_name_conflicts() {
-    let connectors = vec![make_connector("one", "Todoist")];
-    let input = vec![user_message("use $todoist")];
-    let explicitly_enabled_connectors = HashSet::new();
-    let skill_name_counts_lower = HashMap::from([("todoist".to_string(), 1)]);
-
-    let selected = filter_connectors_for_input(
-        &connectors,
-        &input,
-        &explicitly_enabled_connectors,
-        &skill_name_counts_lower,
-    );
-
-    assert_eq!(selected, Vec::new());
-}
-
-#[test]
-fn filter_connectors_for_input_skips_disabled_connectors() {
-    let mut connector = make_connector("calendar", "Calendar");
-    connector.is_enabled = false;
-    let input = vec![user_message("use $calendar")];
-    let explicitly_enabled_connectors = HashSet::new();
-    let selected = filter_connectors_for_input(
-        &[connector],
-        &input,
-        &explicitly_enabled_connectors,
-        &HashMap::new(),
-    );
-
-    assert_eq!(selected, Vec::new());
-}
-
-#[test]
-fn filter_connectors_for_input_skips_plugin_mentions() {
-    let connectors = vec![make_connector("figma", "Figma")];
-    let input = vec![user_message("use [@figma](plugin://figma@openai-curated)")];
-    let explicitly_enabled_connectors = HashSet::new();
-    let selected = filter_connectors_for_input(
-        &connectors,
-        &input,
-        &explicitly_enabled_connectors,
-        &HashMap::new(),
-    );
-
-    assert_eq!(selected, Vec::new());
-}
-
 #[test]
 fn collect_explicit_app_ids_from_skill_items_includes_linked_mentions() {
     let connectors = vec![make_connector("calendar", "Calendar")];
@@ -1820,8 +1814,9 @@ async fn record_token_usage_info_notifies_extension_contributors() {
         records: Arc<std::sync::Mutex<Vec<RecordedTokenUsage>>>,
     }
 
+    #[async_trait::async_trait]
     impl codex_extension_api::TokenUsageContributor for TokenUsageRecorder {
-        fn on_token_usage(
+        async fn on_token_usage(
             &self,
             session_store: &codex_extension_api::ExtensionData,
             thread_store: &codex_extension_api::ExtensionData,
@@ -2063,11 +2058,15 @@ async fn session_configured_reports_permission_profile_for_external_sandbox() ->
     let sandbox_policy = SandboxPolicy::ExternalSandbox {
         network_access: codex_protocol::protocol::NetworkAccess::Restricted,
     };
-    let expected_sandbox_policy = sandbox_policy.clone();
+    let permission_profile = PermissionProfile::External {
+        network: NetworkSandboxPolicy::Restricted,
+    };
+    let expected_permission_profile = permission_profile.clone();
     let mut builder = test_codex().with_config(move |config| {
-        config.permissions.permission_profile = codex_config::Constrained::allow_any(
-            PermissionProfile::from_legacy_sandbox_policy(&sandbox_policy),
-        );
+        config
+            .permissions
+            .set_permission_profile(permission_profile.clone())
+            .expect("set permission profile");
         config
             .set_legacy_sandbox_policy(sandbox_policy)
             .expect("set sandbox policy");
@@ -2075,10 +2074,6 @@ async fn session_configured_reports_permission_profile_for_external_sandbox() ->
 
     let test = builder.build(&server).await?;
 
-    let expected_permission_profile =
-        codex_protocol::models::PermissionProfile::from_legacy_sandbox_policy(
-            &expected_sandbox_policy,
-        );
     assert_eq!(
         test.session_configured.permission_profile, expected_permission_profile,
         "ExternalSandbox is represented explicitly instead of as a lossy root-write profile"
@@ -2086,6 +2081,51 @@ async fn session_configured_reports_permission_profile_for_external_sandbox() ->
     Ok(())
 }
 
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn session_permission_profile_rebinds_runtime_workspace_roots() -> anyhow::Result<()> {
+    let codex_home = tempfile::TempDir::new()?;
+    let cwd = tempfile::TempDir::new()?;
+    let old_root = test_path_buf("/workspace/old").abs();
+    let new_root = test_path_buf("/workspace/new").abs();
+    let config = ConfigBuilder::default()
+        .codex_home(codex_home.path().to_path_buf())
+        .harness_overrides(crate::config::ConfigOverrides {
+            cwd: Some(cwd.path().to_path_buf()),
+            default_permissions: Some(BUILT_IN_PERMISSION_PROFILE_WORKSPACE.to_string()),
+            additional_writable_roots: vec![old_root.to_path_buf()],
+            ..Default::default()
+        })
+        .build()
+        .await?;
+
+    let session_permission_profile_state = session_permission_profile_state_from_config(&config)?;
+    let stored_file_system_policy = session_permission_profile_state
+        .permission_profile()
+        .file_system_sandbox_policy();
+    assert!(
+        !stored_file_system_policy
+            .can_write_path_with_cwd(old_root.as_path(), config.cwd.as_path()),
+        "session permission profile state should keep runtime workspace roots symbolic"
+    );
+
+    let mut session_configuration = make_session_configuration_for_tests().await;
+    session_configuration.cwd = config.cwd.clone();
+    session_configuration.workspace_roots = config.workspace_roots.clone();
+    session_configuration.permission_profile_state = session_permission_profile_state;
+
+    let initial_policy = session_configuration.file_system_sandbox_policy();
+    assert!(initial_policy.can_write_path_with_cwd(old_root.as_path(), config.cwd.as_path()));
+
+    let updated = session_configuration.apply(&SessionSettingsUpdate {
+        workspace_roots: Some(vec![new_root.clone()]),
+        ..Default::default()
+    })?;
+    let updated_policy = updated.file_system_sandbox_policy();
+    assert!(updated_policy.can_write_path_with_cwd(new_root.as_path(), updated.cwd.as_path()));
+    assert!(!updated_policy.can_write_path_with_cwd(old_root.as_path(), updated.cwd.as_path()));
+    Ok(())
+}
+
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn fork_startup_context_then_first_turn_diff_snapshot() -> anyhow::Result<()> {
     let server = start_mock_server().await;
@@ -2121,6 +2161,7 @@ async fn fork_startup_context_then_first_turn_diff_snapshot() -> anyhow::Result<
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&initial.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -2156,24 +2197,6 @@ async fn fork_startup_context_then_first_turn_diff_snapshot() -> anyhow::Result<
             developer_instructions: Some("Fork turn collaboration instructions.".to_string()),
         },
     };
-    forked
-        .thread
-        .submit(Op::OverrideTurnContext {
-            cwd: None,
-            approval_policy: Some(AskForApproval::Never),
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
-            model: None,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: Some(collaboration_mode),
-            personality: None,
-        })
-        .await?;
-
     forked
         .thread
         .submit(Op::UserInput {
@@ -2184,6 +2207,11 @@ async fn fork_startup_context_then_first_turn_diff_snapshot() -> anyhow::Result<
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: ThreadSettingsOverrides {
+                approval_policy: Some(AskForApproval::Never),
+                collaboration_mode: Some(collaboration_mode),
+                ..Default::default()
+            },
         })
         .await?;
     wait_for_event(&forked.thread, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -2217,7 +2245,7 @@ async fn record_initial_history_forked_hydrates_previous_turn_settings() {
     let previous_model = "forked-rollout-model";
     let previous_context_item = TurnContextItem {
         turn_id: Some(turn_context.sub_id.clone()),
-        trace_id: turn_context.trace_id.clone(),
+        #[allow(deprecated)]
         cwd: turn_context.cwd.to_path_buf(),
         current_date: turn_context.current_date.clone(),
         timezone: turn_context.timezone.clone(),
@@ -2231,16 +2259,12 @@ async fn record_initial_history_forked_hydrates_previous_turn_settings() {
         collaboration_mode: Some(turn_context.collaboration_mode.clone()),
         realtime_active: Some(turn_context.realtime_active),
         effort: turn_context.reasoning_effort,
-        summary: turn_context.reasoning_summary,
-        user_instructions: None,
-        developer_instructions: None,
-        final_output_json_schema: None,
-        truncation_policy: Some(turn_context.truncation_policy),
+        summary: codex_protocol::config_types::ReasoningSummary::Auto,
     };
     let turn_id = previous_context_item
         .turn_id
         .clone()
-        .expect("turn context should have turn_id");
+        .expect("thread settings should have turn_id");
     let rollout_items = vec![
         RolloutItem::EventMsg(EventMsg::TurnStarted(
             codex_protocol::protocol::TurnStartedEvent {
@@ -2256,6 +2280,7 @@ async fn record_initial_history_forked_hydrates_previous_turn_settings() {
                 images: None,
                 local_images: Vec::new(),
                 text_elements: Vec::new(),
+                ..Default::default()
             },
         )),
         RolloutItem::TurnContext(previous_context_item.clone()),
@@ -2422,14 +2447,14 @@ async fn thread_rollback_recomputes_previous_turn_settings_and_reference_context
     let first_turn_id = first_context_item
         .turn_id
         .clone()
-        .expect("turn context should have turn_id");
+        .expect("thread settings should have turn_id");
     let mut rolled_back_context_item = first_context_item.clone();
     rolled_back_context_item.turn_id = Some("rolled-back-turn".to_string());
     rolled_back_context_item.model = "rolled-back-model".to_string();
     let rolled_back_turn_id = rolled_back_context_item
         .turn_id
         .clone()
-        .expect("turn context should have turn_id");
+        .expect("thread settings should have turn_id");
     let turn_one_user = user_message("turn 1 user");
     let turn_one_assistant = assistant_message("turn 1 assistant");
     let turn_two_user = user_message("turn 2 user");
@@ -2450,6 +2475,7 @@ async fn thread_rollback_recomputes_previous_turn_settings_and_reference_context
                 images: None,
                 local_images: Vec::new(),
                 text_elements: Vec::new(),
+                ..Default::default()
             },
         )),
         RolloutItem::TurnContext(first_context_item.clone()),
@@ -2476,6 +2502,7 @@ async fn thread_rollback_recomputes_previous_turn_settings_and_reference_context
                 images: None,
                 local_images: Vec::new(),
                 text_elements: Vec::new(),
+                ..Default::default()
             },
         )),
         RolloutItem::TurnContext(rolled_back_context_item),
@@ -2536,7 +2563,7 @@ async fn thread_rollback_restores_cleared_reference_context_item_after_compactio
     let first_turn_id = first_context_item
         .turn_id
         .clone()
-        .expect("turn context should have turn_id");
+        .expect("thread settings should have turn_id");
     let compact_turn_id = "compact-turn".to_string();
     let rolled_back_turn_id = "rolled-back-turn".to_string();
     let compacted_history = vec![
@@ -2558,6 +2585,7 @@ async fn thread_rollback_restores_cleared_reference_context_item_after_compactio
             images: None,
             local_images: Vec::new(),
             text_elements: Vec::new(),
+            ..Default::default()
         })),
         RolloutItem::TurnContext(first_context_item.clone()),
         RolloutItem::ResponseItem(user_message("turn 1 user")),
@@ -2601,6 +2629,7 @@ async fn thread_rollback_restores_cleared_reference_context_item_after_compactio
             images: None,
             local_images: Vec::new(),
             text_elements: Vec::new(),
+            ..Default::default()
         })),
         RolloutItem::TurnContext(TurnContextItem {
             turn_id: Some(rolled_back_turn_id.clone()),
@@ -2655,6 +2684,7 @@ async fn thread_rollback_persists_marker_and_replays_cumulatively() {
             images: None,
             local_images: Vec::new(),
             text_elements: Vec::new(),
+            ..Default::default()
         })),
         RolloutItem::TurnContext(turn_context_item.clone()),
         RolloutItem::ResponseItem(user_message("turn 1 user")),
@@ -2679,6 +2709,7 @@ async fn thread_rollback_persists_marker_and_replays_cumulatively() {
             images: None,
             local_images: Vec::new(),
             text_elements: Vec::new(),
+            ..Default::default()
         })),
         RolloutItem::TurnContext(turn_context_item.clone()),
         RolloutItem::ResponseItem(user_message("turn 2 user")),
@@ -2703,6 +2734,7 @@ async fn thread_rollback_persists_marker_and_replays_cumulatively() {
             images: None,
             local_images: Vec::new(),
             text_elements: Vec::new(),
+            ..Default::default()
         })),
         RolloutItem::TurnContext(turn_context_item),
         RolloutItem::ResponseItem(user_message("turn 3 user")),
@@ -2820,10 +2852,10 @@ async fn set_rate_limits_retains_previous_credits() {
         compact_prompt: config.compact_prompt.clone(),
         approval_policy: config.permissions.approval_policy.clone(),
         approvals_reviewer: config.approvals_reviewer,
-        permission_profile: config.permissions.permission_profile.clone(),
-        active_permission_profile: config.permissions.active_permission_profile(),
+        permission_profile_state: config.permissions.permission_profile_state().clone(),
         windows_sandbox_level: WindowsSandboxLevel::from_config(&config),
         cwd: config.cwd.clone(),
+        workspace_roots: config.workspace_roots.clone(),
         codex_home: config.codex_home.clone(),
         thread_name: None,
         environments: Vec::new(),
@@ -2924,10 +2956,10 @@ async fn set_rate_limits_updates_plan_type_when_present() {
         compact_prompt: config.compact_prompt.clone(),
         approval_policy: config.permissions.approval_policy.clone(),
         approvals_reviewer: config.approvals_reviewer,
-        permission_profile: config.permissions.permission_profile.clone(),
-        active_permission_profile: config.permissions.active_permission_profile(),
+        permission_profile_state: config.permissions.permission_profile_state().clone(),
         windows_sandbox_level: WindowsSandboxLevel::from_config(&config),
         cwd: config.cwd.clone(),
+        workspace_roots: config.workspace_roots.clone(),
         codex_home: config.codex_home.clone(),
         thread_name: None,
         environments: Vec::new(),
@@ -3397,10 +3429,10 @@ pub(crate) async fn make_session_configuration_for_tests() -> SessionConfigurati
         compact_prompt: config.compact_prompt.clone(),
         approval_policy: config.permissions.approval_policy.clone(),
         approvals_reviewer: config.approvals_reviewer,
-        permission_profile: config.permissions.permission_profile.clone(),
-        active_permission_profile: config.permissions.active_permission_profile(),
+        permission_profile_state: config.permissions.permission_profile_state().clone(),
         windows_sandbox_level: WindowsSandboxLevel::from_config(&config),
         cwd: config.cwd.clone(),
+        workspace_roots: config.workspace_roots.clone(),
         codex_home: config.codex_home.clone(),
         thread_name: None,
         environments: Vec::new(),
@@ -3461,13 +3493,17 @@ async fn session_configuration_apply_preserves_profile_file_system_policy_on_cwd
         },
     ]);
     let network_sandbox_policy = NetworkSandboxPolicy::from(&sandbox_policy);
-    session_configuration.permission_profile = codex_config::Constrained::allow_any(
-        PermissionProfile::from_runtime_permissions_with_enforcement(
-            SandboxEnforcement::from_legacy_sandbox_policy(&sandbox_policy),
-            &file_system_sandbox_policy,
-            network_sandbox_policy,
-        ),
-    );
+    session_configuration
+        .set_permission_profile_for_tests(
+            PermissionProfile::from_runtime_permissions_with_enforcement(
+                SandboxEnforcement::from_legacy_sandbox_policy(&sandbox_policy),
+                &file_system_sandbox_policy,
+                network_sandbox_policy,
+            ),
+        )
+        .expect("set permission profile");
+    let expected_file_system_sandbox_policy = file_system_sandbox_policy
+        .materialize_project_roots_with_workspace_roots(&session_configuration.workspace_roots);
 
     let updated = session_configuration
         .apply(&SessionSettingsUpdate {
@@ -3478,7 +3514,7 @@ async fn session_configuration_apply_preserves_profile_file_system_policy_on_cwd
 
     assert_eq!(
         updated.file_system_sandbox_policy(),
-        file_system_sandbox_policy
+        expected_file_system_sandbox_policy
     );
 }
 
@@ -3493,7 +3529,7 @@ async fn session_configuration_apply_permission_profile_preserves_existing_deny_
         path: FileSystemPath::GlobPattern {
             pattern: "**/*.env".to_string(),
         },
-        access: FileSystemAccessMode::None,
+        access: FileSystemAccessMode::Deny,
     };
     let mut existing_file_system_policy =
         FileSystemSandboxPolicy::from_legacy_sandbox_policy_for_cwd(
@@ -3502,13 +3538,15 @@ async fn session_configuration_apply_permission_profile_preserves_existing_deny_
         );
     existing_file_system_policy.glob_scan_max_depth = Some(2);
     existing_file_system_policy.entries.push(deny_entry.clone());
-    session_configuration.permission_profile = codex_config::Constrained::allow_any(
-        PermissionProfile::from_runtime_permissions_with_enforcement(
-            SandboxEnforcement::from_legacy_sandbox_policy(&workspace_policy),
-            &existing_file_system_policy,
-            NetworkSandboxPolicy::Restricted,
-        ),
-    );
+    session_configuration
+        .set_permission_profile_for_tests(
+            PermissionProfile::from_runtime_permissions_with_enforcement(
+                SandboxEnforcement::from_legacy_sandbox_policy(&workspace_policy),
+                &existing_file_system_policy,
+                NetworkSandboxPolicy::Restricted,
+            ),
+        )
+        .expect("set permission profile");
 
     let requested_file_system_policy = FileSystemSandboxPolicy::from_legacy_sandbox_policy_for_cwd(
         &workspace_policy,
@@ -3525,7 +3563,8 @@ async fn session_configuration_apply_permission_profile_preserves_existing_deny_
         })
         .expect("permission profile update should succeed");
 
-    let mut expected_file_system_policy = requested_file_system_policy;
+    let mut expected_file_system_policy = requested_file_system_policy
+        .materialize_project_roots_with_workspace_roots(&session_configuration.workspace_roots);
     expected_file_system_policy.glob_scan_max_depth = Some(2);
     expected_file_system_policy.entries.push(deny_entry);
     assert_eq!(
@@ -3580,6 +3619,93 @@ async fn session_configuration_apply_permission_profile_accepts_direct_write_roo
     );
 }
 
+#[tokio::test]
+async fn session_configuration_apply_rebinds_symbolic_profile_to_updated_workspace_roots() {
+    let mut session_configuration = make_session_configuration_for_tests().await;
+    let old_root = tempfile::tempdir().expect("create old root");
+    let new_root = tempfile::tempdir().expect("create new root");
+    let profile_root = tempfile::tempdir().expect("create profile root");
+    let old_root = old_root.path().abs();
+    let new_root = new_root.path().abs();
+    let profile_root = profile_root.path().abs();
+    session_configuration.workspace_roots = vec![old_root.clone()];
+
+    let file_system_sandbox_policy =
+        FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
+            path: FileSystemPath::Special {
+                value: FileSystemSpecialPath::project_roots(/*subpath*/ None),
+            },
+            access: FileSystemAccessMode::Write,
+        }]);
+    let permission_profile = PermissionProfile::from_runtime_permissions(
+        &file_system_sandbox_policy,
+        NetworkSandboxPolicy::Restricted,
+    );
+
+    let updated = session_configuration
+        .apply(&SessionSettingsUpdate {
+            workspace_roots: Some(vec![new_root.clone()]),
+            permission_profile: Some(permission_profile),
+            active_permission_profile: Some(ActivePermissionProfile::new("dev")),
+            profile_workspace_roots: Some(vec![profile_root.clone()]),
+            ..Default::default()
+        })
+        .expect("permission profile update should succeed");
+
+    let updated_policy = updated.file_system_sandbox_policy();
+    assert!(updated_policy.can_write_path_with_cwd(new_root.as_path(), updated.cwd.as_path()));
+    assert!(!updated_policy.can_write_path_with_cwd(old_root.as_path(), updated.cwd.as_path()));
+    assert_eq!(
+        updated.active_permission_profile(),
+        Some(ActivePermissionProfile::new("dev"))
+    );
+    assert_eq!(updated.profile_workspace_roots(), &[profile_root]);
+}
+
+#[tokio::test]
+async fn session_configuration_apply_retargets_implicit_workspace_root_on_cwd_update() {
+    let mut session_configuration = make_session_configuration_for_tests().await;
+    let old_root = tempfile::tempdir().expect("create old root");
+    let new_root = tempfile::tempdir().expect("create new root");
+    let extra_root = tempfile::tempdir().expect("create extra root");
+    let old_root = old_root.path().abs();
+    let new_root = new_root.path().abs();
+    let extra_root = extra_root.path().abs();
+    session_configuration.cwd = old_root.clone();
+    session_configuration.workspace_roots = vec![old_root.clone(), extra_root.clone()];
+
+    let file_system_sandbox_policy =
+        FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
+            path: FileSystemPath::Special {
+                value: FileSystemSpecialPath::project_roots(/*subpath*/ None),
+            },
+            access: FileSystemAccessMode::Write,
+        }]);
+    let permission_profile = PermissionProfile::from_runtime_permissions(
+        &file_system_sandbox_policy,
+        NetworkSandboxPolicy::Restricted,
+    );
+    session_configuration
+        .set_permission_profile_for_tests(permission_profile)
+        .expect("set permission profile");
+
+    let updated = session_configuration
+        .apply(&SessionSettingsUpdate {
+            cwd: Some(new_root.to_path_buf()),
+            ..Default::default()
+        })
+        .expect("cwd-only update should succeed");
+
+    assert_eq!(
+        updated.workspace_roots,
+        vec![new_root.clone(), extra_root.clone()]
+    );
+    let updated_policy = updated.file_system_sandbox_policy();
+    assert!(updated_policy.can_write_path_with_cwd(new_root.as_path(), updated.cwd.as_path()));
+    assert!(updated_policy.can_write_path_with_cwd(extra_root.as_path(), updated.cwd.as_path()));
+    assert!(!updated_policy.can_write_path_with_cwd(old_root.as_path(), updated.cwd.as_path()));
+}
+
 #[cfg_attr(windows, ignore)]
 #[tokio::test]
 async fn new_default_turn_uses_config_aware_skills_for_role_overrides() {
@@ -3667,12 +3793,13 @@ enabled = false
 }
 
 #[tokio::test]
-async fn session_configuration_apply_rederives_legacy_file_system_policy_on_cwd_update() {
+async fn session_configuration_apply_retargets_legacy_workspace_root_on_cwd_update() {
     let mut session_configuration = make_session_configuration_for_tests().await;
     let workspace = tempfile::tempdir().expect("create temp dir");
-    let project_root = workspace.path().join("project");
-    let original_cwd = project_root.join("subdir");
-    session_configuration.cwd = original_cwd.abs();
+    let original_cwd = workspace.path().join("repo-a").abs();
+    let project_root = workspace.path().join("repo-b").abs();
+    session_configuration.cwd = original_cwd.clone();
+    session_configuration.workspace_roots = vec![session_configuration.cwd.clone()];
     let sandbox_policy = SandboxPolicy::WorkspaceWrite {
         writable_roots: Vec::new(),
         network_access: false,
@@ -3683,30 +3810,35 @@ async fn session_configuration_apply_rederives_legacy_file_system_policy_on_cwd_
         &sandbox_policy,
         &session_configuration.cwd,
     );
-    session_configuration.permission_profile = codex_config::Constrained::allow_any(
-        PermissionProfile::from_runtime_permissions_with_enforcement(
-            SandboxEnforcement::from_legacy_sandbox_policy(&sandbox_policy),
-            &file_system_sandbox_policy,
-            NetworkSandboxPolicy::from(&sandbox_policy),
-        ),
-    );
+    session_configuration
+        .set_permission_profile_for_tests(
+            PermissionProfile::from_runtime_permissions_with_enforcement(
+                SandboxEnforcement::from_legacy_sandbox_policy(&sandbox_policy),
+                &file_system_sandbox_policy,
+                NetworkSandboxPolicy::from(&sandbox_policy),
+            ),
+        )
+        .expect("set permission profile");
 
     let updated = session_configuration
         .apply(&SessionSettingsUpdate {
-            cwd: Some(project_root.clone()),
+            cwd: Some(project_root.to_path_buf()),
             ..Default::default()
         })
         .expect("cwd-only update should succeed");
 
-    let expected_file_system_policy = FileSystemSandboxPolicy::from_legacy_sandbox_policy_for_cwd(
-        &updated.sandbox_policy(),
-        &project_root,
-    );
+    assert_eq!(updated.workspace_roots, vec![project_root.clone()]);
     assert!(
         updated
             .file_system_sandbox_policy()
-            .is_semantically_equivalent_to(&expected_file_system_policy, &project_root),
-        "cwd-only update should rederive the legacy filesystem policy for the new cwd"
+            .can_write_path_with_cwd(project_root.as_path(), updated.cwd.as_path()),
+        "cwd-only update should keep the new cwd writable"
+    );
+    assert!(
+        !updated
+            .file_system_sandbox_policy()
+            .can_write_path_with_cwd(original_cwd.as_path(), updated.cwd.as_path()),
+        "cwd-only update should not keep the old implicit cwd writable"
     );
 }
 
@@ -3735,13 +3867,15 @@ async fn session_configuration_apply_preserves_absolute_cwd_write_root_on_cwd_up
             access: FileSystemAccessMode::Write,
         },
     ]);
-    session_configuration.permission_profile = codex_config::Constrained::allow_any(
-        PermissionProfile::from_runtime_permissions_with_enforcement(
-            SandboxEnforcement::Managed,
-            &file_system_sandbox_policy,
-            NetworkSandboxPolicy::Restricted,
-        ),
-    );
+    session_configuration
+        .set_permission_profile_for_tests(
+            PermissionProfile::from_runtime_permissions_with_enforcement(
+                SandboxEnforcement::Managed,
+                &file_system_sandbox_policy,
+                NetworkSandboxPolicy::Restricted,
+            ),
+        )
+        .expect("set permission profile");
 
     let updated = session_configuration
         .apply(&SessionSettingsUpdate {
@@ -3764,13 +3898,14 @@ async fn session_configuration_apply_preserves_absolute_cwd_write_root_on_cwd_up
         !updated
             .file_system_sandbox_policy()
             .can_write_path_with_cwd(next_cwd.as_path(), updated.cwd.as_path()),
-        "cwd-only update must not reinterpret an absolute old-cwd grant as :project_roots"
+        "cwd-only update must not reinterpret an absolute old-cwd grant as :workspace_roots"
     );
 }
 
 #[tokio::test]
 async fn session_update_settings_does_not_rewrite_sticky_environment_cwds() {
     let (session, turn_context) = make_session_and_context().await;
+    #[allow(deprecated)]
     let updated_cwd = turn_context.cwd.join("project");
     std::fs::create_dir_all(updated_cwd.as_path()).expect("create project dir");
 
@@ -3790,8 +3925,12 @@ async fn session_update_settings_does_not_rewrite_sticky_environment_cwds() {
     let next_turn = session.new_default_turn().await;
 
     assert_eq!(session_cwd, updated_cwd);
-    assert_eq!(config.cwd, turn_context.cwd);
-    assert_eq!(next_turn.cwd, updated_cwd);
+    #[allow(deprecated)]
+    let turn_cwd = turn_context.cwd.clone();
+    #[allow(deprecated)]
+    let next_turn_cwd = next_turn.cwd.clone();
+    assert_eq!(config.cwd, turn_cwd);
+    assert_eq!(next_turn_cwd, updated_cwd);
     assert_eq!(next_turn.config.cwd, updated_cwd);
 }
 
@@ -3875,7 +4014,9 @@ async fn absolute_cwd_update_with_turn_environment_is_allowed() {
         .await
         .expect("absolute cwd with explicit environments should succeed");
 
-    assert_eq!(turn_context.cwd, absolute_cwd);
+    #[allow(deprecated)]
+    let turn_cwd = turn_context.cwd.clone();
+    assert_eq!(turn_cwd, absolute_cwd);
     assert_eq!(turn_context.config.cwd, absolute_cwd);
     assert_eq!(turn_context.environments.turn_environments.len(), 1);
 }
@@ -3923,10 +4064,10 @@ async fn session_new_fails_when_zsh_fork_enabled_without_zsh_path() {
         compact_prompt: config.compact_prompt.clone(),
         approval_policy: config.permissions.approval_policy.clone(),
         approvals_reviewer: config.approvals_reviewer,
-        permission_profile: config.permissions.permission_profile.clone(),
-        active_permission_profile: config.permissions.active_permission_profile(),
+        permission_profile_state: config.permissions.permission_profile_state().clone(),
         windows_sandbox_level: WindowsSandboxLevel::from_config(&config),
         cwd: config.cwd.clone(),
+        workspace_roots: config.workspace_roots.clone(),
         codex_home: config.codex_home.clone(),
         thread_name: None,
         environments: Vec::new(),
@@ -4032,10 +4173,10 @@ pub(crate) async fn make_session_and_context() -> (Session, TurnContext) {
         compact_prompt: config.compact_prompt.clone(),
         approval_policy: config.permissions.approval_policy.clone(),
         approvals_reviewer: config.approvals_reviewer,
-        permission_profile: config.permissions.permission_profile.clone(),
-        active_permission_profile: config.permissions.active_permission_profile(),
+        permission_profile_state: config.permissions.permission_profile_state().clone(),
         windows_sandbox_level: WindowsSandboxLevel::from_config(&config),
         cwd: config.cwd.clone(),
+        workspace_roots: config.workspace_roots.clone(),
         codex_home: config.codex_home.clone(),
         thread_name: None,
         environments: default_environments,
@@ -4077,10 +4218,12 @@ pub(crate) async fn make_session_and_context() -> (Session, TurnContext) {
     );
 
     let services = SessionServices {
-        mcp_connection_manager: Arc::new(RwLock::new(McpConnectionManager::new_uninitialized(
-            &config.permissions.approval_policy,
-            &config.permissions.permission_profile,
-        ))),
+        mcp_connection_manager: Arc::new(RwLock::new(
+            McpConnectionManager::new_uninitialized_with_permission_profile(
+                &config.permissions.approval_policy,
+                config.permissions.permission_profile(),
+            ),
+        )),
         mcp_startup_cancellation_token: Mutex::new(CancellationToken::new()),
         unified_exec_manager: UnifiedExecProcessManager::new(
             config.background_terminal_max_timeout,
@@ -4179,7 +4322,6 @@ pub(crate) async fn make_session_and_context() -> (Session, TurnContext) {
         /*goal_tools_supported*/ true,
     );
 
-    let (mailbox, mailbox_rx) = crate::agent::Mailbox::new();
     let session = Session {
         conversation_id: thread_id,
         installation_id: "11111111-1111-4111-8111-111111111111".to_string(),
@@ -4192,9 +4334,7 @@ pub(crate) async fn make_session_and_context() -> (Session, TurnContext) {
         pending_mcp_server_refresh_config: Mutex::new(None),
         conversation: Arc::new(RealtimeConversationManager::new()),
         active_turn: Mutex::new(None),
-        mailbox,
-        mailbox_rx: Mutex::new(mailbox_rx),
-        idle_pending_input: Mutex::new(Vec::new()),
+        input_queue: super::input_queue::InputQueue::new(),
         goal_runtime: crate::goals::GoalRuntimeState::new(),
         guardian_review_session: crate::guardian::GuardianReviewSessionManager::default(),
         services,
@@ -4264,10 +4404,10 @@ async fn make_session_with_config_and_rx(
         compact_prompt: config.compact_prompt.clone(),
         approval_policy: config.permissions.approval_policy.clone(),
         approvals_reviewer: config.approvals_reviewer,
-        permission_profile: config.permissions.permission_profile.clone(),
-        active_permission_profile: config.permissions.active_permission_profile(),
+        permission_profile_state: config.permissions.permission_profile_state().clone(),
         windows_sandbox_level: WindowsSandboxLevel::from_config(&config),
         cwd: config.cwd.clone(),
+        workspace_roots: config.workspace_roots.clone(),
         codex_home: config.codex_home.clone(),
         thread_name: None,
         environments: default_environments,
@@ -4367,10 +4507,10 @@ async fn make_session_with_history_source_and_agent_control_and_rx(
         compact_prompt: config.compact_prompt.clone(),
         approval_policy: config.permissions.approval_policy.clone(),
         approvals_reviewer: config.approvals_reviewer,
-        permission_profile: config.permissions.permission_profile.clone(),
-        active_permission_profile: config.permissions.active_permission_profile(),
+        permission_profile_state: config.permissions.permission_profile_state().clone(),
         windows_sandbox_level: WindowsSandboxLevel::from_config(&config),
         cwd: config.cwd.clone(),
+        workspace_roots: config.workspace_roots.clone(),
         codex_home: config.codex_home.clone(),
         thread_name: None,
         environments: default_environments,
@@ -4619,7 +4759,7 @@ async fn request_permissions_emits_event_when_granular_policy_allows_requests()
     let (session, mut turn_context, rx) = make_session_and_context_with_rx().await;
     *session.active_turn.lock().await = Some(ActiveTurn::default());
     Arc::get_mut(&mut turn_context)
-        .expect("single turn context ref")
+        .expect("single thread settings ref")
         .approval_policy
         .set(AskForApproval::Granular(GranularApprovalConfig {
             sandbox_approval: true,
@@ -4676,7 +4816,9 @@ async fn request_permissions_emits_event_when_granular_policy_allows_requests()
         panic!("expected request_permissions event");
     };
     assert_eq!(request.call_id, call_id);
-    assert_eq!(request.cwd, Some(turn_context.cwd.clone()));
+    #[allow(deprecated)]
+    let turn_cwd = turn_context.cwd.clone();
+    assert_eq!(request.cwd, Some(turn_cwd));
 
     session
         .notify_request_permissions_response(&request.call_id, expected_response.clone())
@@ -4695,7 +4837,7 @@ async fn request_permissions_response_materializes_session_cwd_grants_before_rec
     let (session, mut turn_context, rx) = make_session_and_context_with_rx().await;
     *session.active_turn.lock().await = Some(ActiveTurn::default());
     Arc::get_mut(&mut turn_context)
-        .expect("single turn context ref")
+        .expect("single thread settings ref")
         .approval_policy
         .set(AskForApproval::Granular(GranularApprovalConfig {
             sandbox_approval: true,
@@ -4792,7 +4934,7 @@ async fn request_permissions_is_auto_denied_when_granular_policy_blocks_tool_req
     let (session, mut turn_context, rx) = make_session_and_context_with_rx().await;
     *session.active_turn.lock().await = Some(ActiveTurn::default());
     Arc::get_mut(&mut turn_context)
-        .expect("single turn context ref")
+        .expect("single thread settings ref")
         .approval_policy
         .set(AskForApproval::Granular(GranularApprovalConfig {
             sandbox_approval: true,
@@ -4903,7 +5045,7 @@ async fn new_default_turn_captures_current_span_trace_id() {
         &request_parent
     ));
 
-    let turn_context_item = async {
+    let turn_trace_id = async {
         let expected_trace_id = Span::current()
             .context()
             .span()
@@ -4911,15 +5053,14 @@ async fn new_default_turn_captures_current_span_trace_id() {
             .trace_id()
             .to_string();
         let turn_context = session.new_default_turn().await;
-        let turn_context_item = turn_context.to_turn_context_item();
-        assert_eq!(turn_context_item.trace_id, Some(expected_trace_id));
-        turn_context_item
+        assert_eq!(turn_context.trace_id, Some(expected_trace_id));
+        turn_context.trace_id.clone()
     }
     .instrument(request_span)
     .await;
 
     assert_eq!(
-        turn_context_item.trace_id.as_deref(),
+        turn_trace_id.as_deref(),
         Some("00000000000000000000000000000011")
     );
 }
@@ -4982,57 +5123,24 @@ fn submission_dispatch_span_uses_debug_for_realtime_audio() {
 }
 
 #[test]
-fn op_kind_distinguishes_turn_ops() {
-    assert_eq!(
-        Op::OverrideTurnContext {
-            cwd: None,
-            approval_policy: None,
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
-            model: None,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
-        }
-        .kind(),
-        "override_turn_context"
-    );
+fn op_kind_for_input_and_context_ops() {
     assert_eq!(
         Op::UserInput {
             environments: None,
             items: vec![],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         }
         .kind(),
         "user_input"
     );
     assert_eq!(
-        Op::UserInputWithTurnContext {
-            environments: None,
-            items: vec![],
-            final_output_json_schema: None,
-            responsesapi_client_metadata: None,
-            cwd: None,
-            approval_policy: None,
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            active_permission_profile: None,
-            windows_sandbox_level: None,
-            model: None,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+        Op::ThreadSettings {
+            thread_settings: ThreadSettingsOverrides::default(),
         }
         .kind(),
-        "user_input_with_turn_context"
+        "thread_settings"
     );
 }
 
@@ -5044,24 +5152,31 @@ async fn user_turn_updates_approvals_reviewer() {
     handlers::user_input_or_turn(
         &session,
         "sub-1".to_string(),
-        Op::UserTurn {
-            environments: None,
+        Op::UserInput {
             items: vec![UserInput::Text {
                 text: "hello".to_string(),
                 text_elements: Vec::new(),
             }],
-            cwd: config.cwd.to_path_buf(),
-            approval_policy: config.permissions.approval_policy.value(),
-            approvals_reviewer: Some(codex_config::types::ApprovalsReviewer::AutoReview),
-            sandbox_policy: config.legacy_sandbox_policy(),
-            permission_profile: None,
-            model: turn_context.model_info.slug.clone(),
-            effort: config.model_reasoning_effort,
-            summary: config.model_reasoning_summary,
-            service_tier: None,
+            environments: None,
             final_output_json_schema: None,
-            collaboration_mode: None,
-            personality: config.personality,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(config.cwd.to_path_buf()),
+                approval_policy: Some(config.permissions.approval_policy.value()),
+                approvals_reviewer: Some(codex_config::types::ApprovalsReviewer::AutoReview),
+                sandbox_policy: Some(config.legacy_sandbox_policy()),
+                summary: config.model_reasoning_summary,
+                personality: config.personality,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: turn_context.model_info.slug.clone(),
+                        reasoning_effort: config.model_reasoning_effort,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         },
     )
     .await;
@@ -5105,7 +5220,9 @@ async fn turn_environments_set_primary_environment() {
         &turn_environments.turn_environments[0].environment
     ));
     assert!(!turn_context.environments.turn_environments.is_empty());
-    assert_eq!(turn_context.cwd.as_path(), selected_cwd.as_path());
+    #[allow(deprecated)]
+    let turn_cwd = turn_context.cwd.clone();
+    assert_eq!(turn_cwd.as_path(), selected_cwd.as_path());
     assert_eq!(turn_context.config.cwd.as_path(), selected_cwd.as_path());
 }
 
@@ -5136,7 +5253,9 @@ async fn default_turn_overlays_session_cwd_onto_stored_thread_environments() {
         &turn_environment.environment,
         &turn_environments.turn_environments[0].environment
     ));
-    assert_eq!(turn_context.cwd, session_cwd);
+    #[allow(deprecated)]
+    let turn_cwd = turn_context.cwd.clone();
+    assert_eq!(turn_cwd, session_cwd);
     assert_eq!(turn_context.config.cwd, session_cwd);
 }
 
@@ -5154,7 +5273,9 @@ async fn default_turn_honors_empty_stored_thread_environments() {
 
     assert!(turn_context.environments.primary().is_none());
     assert!(turn_context.environments.turn_environments.is_empty());
-    assert_eq!(turn_context.cwd, session_cwd);
+    #[allow(deprecated)]
+    let turn_cwd = turn_context.cwd.clone();
+    assert_eq!(turn_cwd, session_cwd);
     assert_eq!(turn_context.config.cwd, session_cwd);
     assert_eq!(turn_context.environments.turn_environments.len(), 0);
 }
@@ -5163,6 +5284,7 @@ async fn default_turn_honors_empty_stored_thread_environments() {
 async fn primary_environment_uses_first_turn_environment() {
     let (_session, mut turn_context) = make_session_and_context().await;
     let first_environment = turn_context.environments.turn_environments[0].clone();
+    #[allow(deprecated)]
     let second_cwd = turn_context.cwd.join("second");
     turn_context
         .environments
@@ -5216,7 +5338,9 @@ async fn empty_turn_environments_clear_primary_environment() {
 
     assert!(turn_context.environments.primary().is_none());
     assert!(turn_context.environments.turn_environments.is_empty());
-    assert_eq!(turn_context.cwd, session.get_config().await.cwd);
+    #[allow(deprecated)]
+    let turn_cwd = turn_context.cwd.clone();
+    assert_eq!(turn_cwd, session.get_config().await.cwd);
     assert_eq!(turn_context.config.cwd, session.get_config().await.cwd);
 }
 
@@ -5451,8 +5575,9 @@ async fn submission_loop_channel_close_emits_thread_stop_lifecycle() {
         expected_thread_id: ThreadId,
     }
 
+    #[async_trait::async_trait]
     impl codex_extension_api::ThreadLifecycleContributor<crate::config::Config> for ThreadStopRecorder {
-        fn on_thread_stop(&self, input: codex_extension_api::ThreadStopInput<'_>) {
+        async fn on_thread_stop(&self, input: codex_extension_api::ThreadStopInput<'_>) {
             assert_eq!(
                 self.expected_thread_id.to_string(),
                 input.thread_store.level_id()
@@ -5496,8 +5621,9 @@ async fn submission_loop_channel_close_aborts_active_turn_before_thread_stop_lif
         expected_turn_id: String,
     }
 
+    #[async_trait::async_trait]
     impl codex_extension_api::ThreadLifecycleContributor<crate::config::Config> for LifecycleRecorder {
-        fn on_thread_stop(&self, input: codex_extension_api::ThreadStopInput<'_>) {
+        async fn on_thread_stop(&self, input: codex_extension_api::ThreadStopInput<'_>) {
             assert_eq!(
                 self.expected_thread_id.to_string(),
                 input.thread_store.level_id()
@@ -5509,8 +5635,9 @@ async fn submission_loop_channel_close_aborts_active_turn_before_thread_stop_lif
         }
     }
 
+    #[async_trait::async_trait]
     impl codex_extension_api::TurnLifecycleContributor for LifecycleRecorder {
-        fn on_turn_abort(&self, input: codex_extension_api::TurnAbortInput<'_>) {
+        async fn on_turn_abort(&self, input: codex_extension_api::TurnAbortInput<'_>) {
             assert_eq!(
                 self.expected_thread_id.to_string(),
                 input.thread_store.level_id()
@@ -5873,10 +6000,10 @@ where
         compact_prompt: config.compact_prompt.clone(),
         approval_policy: config.permissions.approval_policy.clone(),
         approvals_reviewer: config.approvals_reviewer,
-        permission_profile: config.permissions.permission_profile.clone(),
-        active_permission_profile: config.permissions.active_permission_profile(),
+        permission_profile_state: config.permissions.permission_profile_state().clone(),
         windows_sandbox_level: WindowsSandboxLevel::from_config(&config),
         cwd: config.cwd.clone(),
+        workspace_roots: config.workspace_roots.clone(),
         codex_home: config.codex_home.clone(),
         thread_name: None,
         environments: default_environments,
@@ -5918,10 +6045,12 @@ where
     );
 
     let services = SessionServices {
-        mcp_connection_manager: Arc::new(RwLock::new(McpConnectionManager::new_uninitialized(
-            &config.permissions.approval_policy,
-            &config.permissions.permission_profile,
-        ))),
+        mcp_connection_manager: Arc::new(RwLock::new(
+            McpConnectionManager::new_uninitialized_with_permission_profile(
+                &config.permissions.approval_policy,
+                config.permissions.permission_profile(),
+            ),
+        )),
         mcp_startup_cancellation_token: Mutex::new(CancellationToken::new()),
         unified_exec_manager: UnifiedExecProcessManager::new(
             config.background_terminal_max_timeout,
@@ -6020,7 +6149,6 @@ where
         /*goal_tools_supported*/ true,
     ));
 
-    let (mailbox, mailbox_rx) = crate::agent::Mailbox::new();
     let session = Arc::new(Session {
         conversation_id: thread_id,
         installation_id: "11111111-1111-4111-8111-111111111111".to_string(),
@@ -6033,9 +6161,7 @@ where
         pending_mcp_server_refresh_config: Mutex::new(None),
         conversation: Arc::new(RealtimeConversationManager::new()),
         active_turn: Mutex::new(None),
-        mailbox,
-        mailbox_rx: Mutex::new(mailbox_rx),
-        idle_pending_input: Mutex::new(Vec::new()),
+        input_queue: super::input_queue::InputQueue::new(),
         goal_runtime: crate::goals::GoalRuntimeState::new(),
         guardian_review_session: crate::guardian::GuardianReviewSessionManager::default(),
         services,
@@ -6476,10 +6602,10 @@ async fn make_multi_agent_v2_usage_hint_test_session(
     (session, turn_context)
 }
 
-struct GitAttributionTestContributor;
-struct GitAttributionTestState;
+struct PromptExtensionTestContributor;
+struct PromptExtensionTestState;
 
-impl codex_extension_api::ContextContributor for GitAttributionTestContributor {
+impl codex_extension_api::ContextContributor for PromptExtensionTestContributor {
     fn contribute<'a>(
         &'a self,
         _session_store: &'a codex_extension_api::ExtensionData,
@@ -6489,11 +6615,11 @@ impl codex_extension_api::ContextContributor for GitAttributionTestContributor {
     > {
         Box::pin(async move {
             thread_store
-                .get::<GitAttributionTestState>()
+                .get::<PromptExtensionTestState>()
                 .is_some()
                 .then(|| {
                     codex_extension_api::PromptFragment::developer_policy(
-                        "git attribution extension enabled",
+                        "prompt extension enabled",
                     )
                 })
                 .into_iter()
@@ -6502,21 +6628,21 @@ impl codex_extension_api::ContextContributor for GitAttributionTestContributor {
     }
 }
 
-fn git_attribution_test_registry()
+fn prompt_extension_test_registry()
 -> Arc<codex_extension_api::ExtensionRegistry<crate::config::Config>> {
     let mut builder = codex_extension_api::ExtensionRegistryBuilder::new();
-    builder.prompt_contributor(Arc::new(GitAttributionTestContributor));
+    builder.prompt_contributor(Arc::new(PromptExtensionTestContributor));
     Arc::new(builder.build())
 }
 
 #[tokio::test]
-async fn build_initial_context_includes_git_attribution_from_extensions() {
+async fn build_initial_context_includes_prompt_fragments_from_extensions() {
     let (mut session, turn_context) = make_session_and_context().await;
-    session.services.extensions = git_attribution_test_registry();
+    session.services.extensions = prompt_extension_test_registry();
     session
         .services
         .thread_extension_data
-        .insert(GitAttributionTestState);
+        .insert(PromptExtensionTestState);
 
     let initial_context = session.build_initial_context(&turn_context).await;
     let developer_messages = developer_message_texts(&initial_context);
@@ -6525,15 +6651,15 @@ async fn build_initial_context_includes_git_attribution_from_extensions() {
         developer_messages
             .iter()
             .flatten()
-            .any(|text| *text == "git attribution extension enabled"),
-        "expected git attribution developer text, got {developer_messages:?}"
+            .any(|text| *text == "prompt extension enabled"),
+        "expected prompt extension developer text, got {developer_messages:?}"
     );
 }
 
 #[tokio::test]
-async fn build_initial_context_omits_git_attribution_when_feature_is_disabled() {
+async fn build_initial_context_omits_prompt_fragments_without_extension_state() {
     let (mut session, turn_context) = make_session_and_context().await;
-    session.services.extensions = git_attribution_test_registry();
+    session.services.extensions = prompt_extension_test_registry();
 
     let initial_context = session.build_initial_context(&turn_context).await;
     let developer_messages = developer_message_texts(&initial_context);
@@ -6542,8 +6668,8 @@ async fn build_initial_context_omits_git_attribution_when_feature_is_disabled()
         !developer_messages
             .iter()
             .flatten()
-            .any(|text| *text == "git attribution extension enabled"),
-        "did not expect git attribution developer text, got {developer_messages:?}"
+            .any(|text| *text == "prompt extension enabled"),
+        "did not expect prompt extension developer text, got {developer_messages:?}"
     );
 }
 
@@ -6587,7 +6713,7 @@ async fn build_initial_context_adds_multi_agent_v2_subagent_usage_hint_as_develo
         .session_configuration
         .session_source = session_source.clone();
     Arc::get_mut(&mut turn_context)
-        .expect("turn context should not be shared")
+        .expect("thread settings should not be shared")
         .session_source = session_source;
 
     let initial_context = session.build_initial_context(turn_context.as_ref()).await;
@@ -6626,40 +6752,6 @@ async fn build_initial_context_omits_multi_agent_v2_usage_hints_when_feature_dis
     );
 }
 
-#[tokio::test]
-async fn configured_multi_agent_v2_usage_hint_texts_use_effective_enabled_feature_state() {
-    let (mut session, _turn_context) =
-        make_multi_agent_v2_usage_hint_test_session(/*enable_multi_agent_v2*/ false).await;
-    let mut effective_features = Features::with_defaults();
-    effective_features.enable(Feature::MultiAgentV2);
-    Arc::get_mut(&mut session)
-        .expect("session should not be shared")
-        .features = effective_features.into();
-
-    let hint_texts = session.configured_multi_agent_v2_usage_hint_texts().await;
-
-    assert_eq!(
-        hint_texts,
-        vec![
-            "Root guidance.".to_string(),
-            "Subagent guidance.".to_string()
-        ]
-    );
-}
-
-#[tokio::test]
-async fn configured_multi_agent_v2_usage_hint_texts_omit_effectively_disabled_feature() {
-    let (mut session, _turn_context) =
-        make_multi_agent_v2_usage_hint_test_session(/*enable_multi_agent_v2*/ true).await;
-    Arc::get_mut(&mut session)
-        .expect("session should not be shared")
-        .features = Features::with_defaults().into();
-
-    let hint_texts = session.configured_multi_agent_v2_usage_hint_texts().await;
-
-    assert_eq!(hint_texts, Vec::<String>::new());
-}
-
 #[tokio::test]
 async fn build_initial_context_omits_default_image_save_location_with_image_history() {
     let (session, turn_context) = make_session_and_context().await;
@@ -6853,7 +6945,7 @@ fn emit_thread_start_skill_metrics_records_description_truncated_chars_without_o
 #[tokio::test]
 async fn build_initial_context_emits_thread_start_skill_warning_on_repeated_builds() {
     let (session, turn_context, rx) = make_session_and_context_with_rx().await;
-    let mut turn_context = Arc::into_inner(turn_context).expect("sole turn context owner");
+    let mut turn_context = Arc::into_inner(turn_context).expect("sole thread settings owner");
     let mut outcome = SkillLoadOutcome::default();
     outcome.skills = vec![
         SkillMetadata {
@@ -6927,6 +7019,9 @@ async fn handle_output_item_done_records_image_save_history_message() {
     let mut ctx = HandleOutputCtx {
         sess: Arc::clone(&session),
         turn_context: Arc::clone(&turn_context),
+        turn_store: Arc::new(codex_extension_api::ExtensionData::new(
+            turn_context.sub_id.clone(),
+        )),
         tool_runtime: test_tool_runtime(Arc::clone(&session), Arc::clone(&turn_context)),
         cancellation_token: CancellationToken::new(),
     };
@@ -6979,6 +7074,9 @@ async fn handle_output_item_done_skips_image_save_message_when_save_fails() {
     let mut ctx = HandleOutputCtx {
         sess: Arc::clone(&session),
         turn_context: Arc::clone(&turn_context),
+        turn_store: Arc::new(codex_extension_api::ExtensionData::new(
+            turn_context.sub_id.clone(),
+        )),
         tool_runtime: test_tool_runtime(Arc::clone(&session), Arc::clone(&turn_context)),
         cancellation_token: CancellationToken::new(),
     };
@@ -7035,15 +7133,18 @@ async fn build_initial_context_restates_realtime_start_when_reference_context_is
 }
 
 fn file_system_policy_with_unreadable_glob(turn_context: &TurnContext) -> FileSystemSandboxPolicy {
+    #[allow(deprecated)]
     let mut policy = FileSystemSandboxPolicy::from_legacy_sandbox_policy_for_cwd(
         &turn_context.sandbox_policy(),
         &turn_context.cwd,
     );
+    #[allow(deprecated)]
+    let cwd_display = turn_context.cwd.as_path().display().to_string();
     policy.entries.push(FileSystemSandboxEntry {
         path: FileSystemPath::GlobPattern {
-            pattern: format!("{}/**/*.env", turn_context.cwd.as_path().display()),
+            pattern: format!("{cwd_display}/**/*.env"),
         },
-        access: FileSystemAccessMode::None,
+        access: FileSystemAccessMode::Deny,
     });
     policy
 }
@@ -7278,6 +7379,7 @@ async fn record_context_updates_and_set_reference_context_item_persists_full_rei
                 images: None,
                 local_images: Vec::new(),
                 text_elements: Vec::new(),
+                ..Default::default()
             },
         ))])
         .await;
@@ -7629,15 +7731,21 @@ async fn task_finish_emits_turn_item_lifecycle_for_leftover_pending_user_input()
 
     while rx.try_recv().is_ok() {}
 
-    sess.inject_response_items(vec![ResponseInputItem::Message {
-        role: "user".to_string(),
-        content: vec![ContentItem::InputText {
-            text: "late pending input".to_string(),
-        }],
-        phase: None,
-    }])
+    let text_element = codex_protocol::user_input::TextElement::new(
+        codex_protocol::user_input::ByteRange { start: 5, end: 12 },
+        Some("pending marker".to_string()),
+    );
+    let pending_user_input = vec![UserInput::Text {
+        text: "late pending input".to_string(),
+        text_elements: vec![text_element.clone()],
+    }];
+    sess.steer_input(
+        pending_user_input.clone(),
+        Some(&tc.sub_id),
+        /*responsesapi_client_metadata*/ None,
+    )
     .await
-    .expect("inject pending input into active turn");
+    .expect("steer pending input into active turn");
 
     sess.on_task_finished(Arc::clone(&tc), /*last_agent_message*/ None)
         .await;
@@ -7671,10 +7779,7 @@ async fn task_finish_emits_turn_item_lifecycle_for_leftover_pending_user_input()
         EventMsg::ItemStarted(ItemStartedEvent {
             item: TurnItem::UserMessage(UserMessageItem { content, .. }),
             ..
-        }) if content == vec![UserInput::Text {
-            text: "late pending input".to_string(),
-            text_elements: Vec::new(),
-        }]
+        }) if content == pending_user_input
     ));
 
     let third = tokio::time::timeout(std::time::Duration::from_secs(2), rx.recv())
@@ -7686,10 +7791,7 @@ async fn task_finish_emits_turn_item_lifecycle_for_leftover_pending_user_input()
         EventMsg::ItemCompleted(ItemCompletedEvent {
             item: TurnItem::UserMessage(UserMessageItem { content, .. }),
             ..
-        }) if content == vec![UserInput::Text {
-            text: "late pending input".to_string(),
-            text_elements: Vec::new(),
-        }]
+        }) if content == pending_user_input
     ));
 
     let fourth = tokio::time::timeout(std::time::Duration::from_secs(2), rx.recv())
@@ -7703,9 +7805,10 @@ async fn task_finish_emits_turn_item_lifecycle_for_leftover_pending_user_input()
             images,
             text_elements,
             local_images,
+            ..
         }) if message == "late pending input"
             && images == Some(Vec::new())
-            && text_elements.is_empty()
+            && text_elements == vec![text_element]
             && local_images.is_empty()
     ));
 
@@ -7855,66 +7958,7 @@ async fn steer_input_returns_active_turn_id() {
         .expect("steering with matching expected turn id should succeed");
 
     assert_eq!(turn_id, tc.sub_id);
-    assert!(sess.has_pending_input().await);
-}
-
-#[tokio::test]
-async fn prepend_pending_input_keeps_older_tail_ahead_of_newer_input() {
-    let (sess, tc, _rx) = make_session_and_context_with_rx().await;
-    let input = vec![UserInput::Text {
-        text: "hello".to_string(),
-        text_elements: Vec::new(),
-    }];
-    sess.spawn_task(
-        Arc::clone(&tc),
-        input,
-        NeverEndingTask {
-            kind: TaskKind::Regular,
-            listen_to_cancellation_token: false,
-        },
-    )
-    .await;
-
-    let blocked = ResponseInputItem::Message {
-        role: "user".to_string(),
-        content: vec![ContentItem::InputText {
-            text: "blocked queued prompt".to_string(),
-        }],
-        phase: None,
-    };
-    let later = ResponseInputItem::Message {
-        role: "user".to_string(),
-        content: vec![ContentItem::InputText {
-            text: "later queued prompt".to_string(),
-        }],
-        phase: None,
-    };
-    let newer = ResponseInputItem::Message {
-        role: "user".to_string(),
-        content: vec![ContentItem::InputText {
-            text: "newer queued prompt".to_string(),
-        }],
-        phase: None,
-    };
-
-    sess.inject_response_items(vec![blocked.clone(), later.clone()])
-        .await
-        .expect("inject initial pending input into active turn");
-
-    let drained = sess.get_pending_input().await;
-    assert_eq!(drained, vec![blocked, later.clone()]);
-
-    sess.inject_response_items(vec![newer.clone()])
-        .await
-        .expect("inject newer pending input into active turn");
-
-    let mut drained_iter = drained.into_iter();
-    let _blocked = drained_iter.next().expect("blocked prompt should exist");
-    sess.prepend_pending_input(drained_iter.collect())
-        .await
-        .expect("requeue later pending input at the front of the queue");
-
-    assert_eq!(sess.get_pending_input().await, vec![later, newer]);
+    assert!(sess.input_queue.has_pending_input(&sess.active_turn).await);
 }
 
 #[tokio::test]
@@ -7928,7 +7972,8 @@ async fn queued_response_items_for_next_turn_move_into_next_active_turn() {
         phase: None,
     };
 
-    sess.queue_response_items_for_next_turn(vec![queued_item.clone()])
+    sess.input_queue
+        .queue_response_items_for_next_turn(vec![queued_item.clone()])
         .await;
 
     sess.spawn_task(
@@ -7941,7 +7986,10 @@ async fn queued_response_items_for_next_turn_move_into_next_active_turn() {
     )
     .await;
 
-    assert_eq!(sess.get_pending_input().await, vec![queued_item]);
+    assert_eq!(
+        sess.input_queue.get_pending_input(&sess.active_turn).await,
+        vec![TurnInput::ResponseInputItem(queued_item)]
+    );
 }
 
 #[tokio::test]
@@ -7955,13 +8003,18 @@ async fn idle_interrupt_does_not_wake_queued_next_turn_items() {
         phase: None,
     };
 
-    sess.queue_response_items_for_next_turn(vec![queued_item])
+    sess.input_queue
+        .queue_response_items_for_next_turn(vec![queued_item])
         .await;
 
     sess.abort_all_tasks(TurnAbortReason::Interrupted).await;
 
     assert!(sess.active_turn.lock().await.is_none());
-    assert!(sess.has_queued_response_items_for_next_turn().await);
+    assert!(
+        sess.input_queue
+            .has_queued_response_items_for_next_turn()
+            .await
+    );
 }
 
 #[tokio::test]
@@ -7979,22 +8032,26 @@ async fn abort_empty_active_turn_preserves_pending_input() {
         let active_turn = active.get_or_insert_with(ActiveTurn::default);
         Arc::clone(&active_turn.turn_state)
     };
-    turn_state
-        .lock()
-        .await
-        .push_pending_input(pending_item.clone());
+    sess.input_queue
+        .extend_pending_input_for_turn_state(
+            turn_state.as_ref(),
+            vec![TurnInput::ResponseInputItem(pending_item.clone())],
+        )
+        .await;
 
     sess.abort_all_tasks(TurnAbortReason::Replaced).await;
 
     assert!(sess.active_turn.lock().await.is_none());
     assert_eq!(
-        turn_state.lock().await.take_pending_input(),
-        vec![pending_item]
+        sess.input_queue
+            .take_pending_input_for_turn_state(turn_state.as_ref())
+            .await,
+        vec![TurnInput::ResponseInputItem(pending_item)]
     );
 }
 
 #[tokio::test]
-async fn interrupt_accounts_active_goal_before_pausing() -> anyhow::Result<()> {
+async fn interrupt_accounts_active_goal_without_pausing() -> anyhow::Result<()> {
     let (sess, tc, _rx, _codex_home) = make_goal_session_and_context_with_rx().await;
     sess.set_thread_goal(
         tc.as_ref(),
@@ -8024,7 +8081,7 @@ async fn interrupt_accounts_active_goal_before_pausing() -> anyhow::Result<()> {
         .await?
         .expect("goal should remain persisted after interrupt");
     assert_eq!(
-        codex_protocol::protocol::ThreadGoalStatus::Paused,
+        codex_protocol::protocol::ThreadGoalStatus::Active,
         goal.status
     );
     assert_eq!(70, goal.tokens_used);
@@ -8034,6 +8091,34 @@ async fn interrupt_accounts_active_goal_before_pausing() -> anyhow::Result<()> {
     Ok(())
 }
 
+#[tokio::test]
+async fn shutdown_without_active_turn_keeps_active_goal_active() -> anyhow::Result<()> {
+    let (sess, tc, _rx, _codex_home) = make_goal_session_and_context_with_rx().await;
+    sess.set_thread_goal(
+        tc.as_ref(),
+        SetGoalRequest {
+            objective: Some("Keep improving the benchmark".to_string()),
+            status: None,
+            token_budget: None,
+        },
+    )
+    .await?;
+
+    assert!(sess.active_turn.lock().await.is_none());
+    assert!(handlers::shutdown(&sess, "shutdown".to_string()).await);
+
+    let goal = sess
+        .get_thread_goal()
+        .await?
+        .expect("goal should remain persisted after shutdown");
+    assert_eq!(
+        codex_protocol::protocol::ThreadGoalStatus::Active,
+        goal.status
+    );
+
+    Ok(())
+}
+
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn active_goal_continuation_runs_again_after_no_tool_turn() -> anyhow::Result<()> {
     let server = start_mock_server().await;
@@ -8090,6 +8175,7 @@ async fn active_goal_continuation_runs_again_after_no_tool_turn() -> anyhow::Res
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
 
@@ -8194,6 +8280,7 @@ async fn pending_request_user_input_does_not_spawn_extra_goal_continuation() ->
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
 
@@ -8276,6 +8363,66 @@ async fn goal_test_state_db(sess: &Session) -> anyhow::Result<crate::StateDbHand
         .await
 }
 
+#[tokio::test]
+async fn create_thread_goal_fills_empty_thread_preview() -> anyhow::Result<()> {
+    let (sess, tc, _rx, _codex_home) = make_goal_session_and_context_with_rx().await;
+    let state_db = goal_test_state_db(sess.as_ref()).await?;
+
+    let page = state_db
+        .list_threads(
+            /*page_size*/ 10,
+            codex_state::ThreadFilterOptions {
+                archived_only: false,
+                allowed_sources: &[],
+                model_providers: None,
+                cwd_filters: None,
+                anchor: None,
+                sort_key: codex_state::SortKey::UpdatedAt,
+                sort_direction: codex_state::SortDirection::Desc,
+                search_term: None,
+            },
+        )
+        .await?;
+    assert!(page.items.is_empty());
+
+    sess.create_thread_goal(
+        tc.as_ref(),
+        CreateGoalRequest {
+            objective: "Keep improving the benchmark".to_string(),
+            token_budget: None,
+        },
+    )
+    .await?;
+
+    let page = state_db
+        .list_threads(
+            /*page_size*/ 10,
+            codex_state::ThreadFilterOptions {
+                archived_only: false,
+                allowed_sources: &[],
+                model_providers: None,
+                cwd_filters: None,
+                anchor: None,
+                sort_key: codex_state::SortKey::UpdatedAt,
+                sort_direction: codex_state::SortDirection::Desc,
+                search_term: None,
+            },
+        )
+        .await?;
+    let ids = page
+        .items
+        .iter()
+        .map(|thread| thread.id)
+        .collect::<Vec<_>>();
+    assert_eq!(vec![sess.conversation_id], ids);
+    assert_eq!(
+        Some("Keep improving the benchmark"),
+        page.items[0].preview.as_deref()
+    );
+
+    Ok(())
+}
+
 #[tokio::test]
 async fn budget_limited_accounting_steers_active_turn_without_aborting() -> anyhow::Result<()> {
     let (sess, tc, rx, _codex_home) = make_goal_session_and_context_with_rx().await;
@@ -8318,12 +8465,14 @@ async fn budget_limited_accounting_steers_active_turn_without_aborting() -> anyh
 
     sess.goal_runtime_apply(GoalRuntimeEvent::ToolCompleted {
         turn_context: tc.as_ref(),
-        tool_name: "shell",
+        tool_name: "shell_command",
     })
     .await?;
 
-    let pending_input = sess.get_pending_input().await;
-    let [ResponseInputItem::Message { role, content, .. }] = pending_input.as_slice() else {
+    let pending_input = sess.input_queue.get_pending_input(&sess.active_turn).await;
+    let [TurnInput::ResponseInputItem(ResponseInputItem::Message { role, content, .. })] =
+        pending_input.as_slice()
+    else {
         panic!("expected one budget-limit steering message, got {pending_input:#?}");
     };
     assert_eq!("user", role);
@@ -8344,6 +8493,7 @@ async fn budget_limited_accounting_steers_active_turn_without_aborting() -> anyh
 
     let state_db = goal_test_state_db(sess.as_ref()).await?;
     let goal = state_db
+        .thread_goals()
         .get_thread_goal(sess.conversation_id)
         .await?
         .expect("goal should remain persisted after accounting");
@@ -8367,6 +8517,7 @@ async fn budget_limited_accounting_steers_active_turn_without_aborting() -> anyh
     .await?;
 
     let goal = state_db
+        .thread_goals()
         .get_thread_goal(sess.conversation_id)
         .await?
         .expect("goal should remain persisted after follow-up accounting");
@@ -8378,6 +8529,57 @@ async fn budget_limited_accounting_steers_active_turn_without_aborting() -> anyh
     Ok(())
 }
 
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn usage_limit_runtime_stops_active_goal_and_prevents_idle_continuation() -> anyhow::Result<()>
+{
+    let (sess, tc, _rx, _codex_home) = make_goal_session_and_context_with_rx().await;
+    sess.set_thread_goal(
+        tc.as_ref(),
+        SetGoalRequest {
+            objective: Some("Keep improving the benchmark".to_string()),
+            status: None,
+            token_budget: Some(Some(50)),
+        },
+    )
+    .await?;
+    sess.goal_runtime_apply(GoalRuntimeEvent::TurnStarted {
+        turn_context: tc.as_ref(),
+        token_usage: TokenUsage::default(),
+    })
+    .await?;
+    sess.spawn_task(
+        Arc::clone(&tc),
+        Vec::new(),
+        NeverEndingTask {
+            kind: TaskKind::Regular,
+            listen_to_cancellation_token: false,
+        },
+    )
+    .await;
+    set_total_token_usage(&sess, post_goal_token_usage()).await;
+
+    sess.goal_runtime_apply(GoalRuntimeEvent::UsageLimitReached {
+        turn_context: tc.as_ref(),
+    })
+    .await?;
+
+    let state_db = goal_test_state_db(sess.as_ref()).await?;
+    let goal = state_db
+        .thread_goals()
+        .get_thread_goal(sess.conversation_id)
+        .await?
+        .expect("goal should remain persisted after usage limiting");
+    assert_eq!(codex_state::ThreadGoalStatus::UsageLimited, goal.status);
+    assert_eq!(70, goal.tokens_used);
+
+    sess.abort_all_tasks(TurnAbortReason::Replaced).await;
+    sess.goal_runtime_apply(GoalRuntimeEvent::MaybeContinueIfIdle)
+        .await?;
+    assert!(sess.active_turn.lock().await.is_none());
+
+    Ok(())
+}
+
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn external_goal_mutation_accounts_active_turn_before_status_change() -> anyhow::Result<()> {
     let (sess, tc, _rx, _codex_home) = make_goal_session_and_context_with_rx().await;
@@ -8406,6 +8608,7 @@ async fn external_goal_mutation_accounts_active_turn_before_status_change() -> a
 
     let state_db = goal_test_state_db(sess.as_ref()).await?;
     let goal = state_db
+        .thread_goals()
         .get_thread_goal(sess.conversation_id)
         .await?
         .expect("goal should remain persisted");
@@ -8414,6 +8617,7 @@ async fn external_goal_mutation_accounts_active_turn_before_status_change() -> a
     let previous_goal = goal.clone();
     let goal_id = goal.goal_id.clone();
     let updated_goal = state_db
+        .thread_goals()
         .update_thread_goal(
             sess.conversation_id,
             codex_state::ThreadGoalUpdate {
@@ -8435,6 +8639,7 @@ async fn external_goal_mutation_accounts_active_turn_before_status_change() -> a
 
     assert!(sess.active_turn.lock().await.is_some());
     let goal = state_db
+        .thread_goals()
         .get_thread_goal(sess.conversation_id)
         .await?
         .expect("goal should remain persisted");
@@ -8461,6 +8666,7 @@ async fn external_objective_change_steers_active_turn() -> anyhow::Result<()> {
 
     let state_db = goal_test_state_db(sess.as_ref()).await?;
     let old_goal = state_db
+        .thread_goals()
         .replace_thread_goal(
             sess.conversation_id,
             "Keep improving the benchmark",
@@ -8469,6 +8675,7 @@ async fn external_objective_change_steers_active_turn() -> anyhow::Result<()> {
         )
         .await?;
     let new_goal = state_db
+        .thread_goals()
         .replace_thread_goal(
             sess.conversation_id,
             "Write a concise benchmark summary",
@@ -8485,12 +8692,12 @@ async fn external_objective_change_steers_active_turn() -> anyhow::Result<()> {
     })
     .await?;
 
-    let pending_input = sess.get_pending_input().await;
+    let pending_input = sess.input_queue.get_pending_input(&sess.active_turn).await;
     assert!(
         pending_input.iter().any(|item| {
             matches!(
                 item,
-                ResponseInputItem::Message { role, content, .. }
+                TurnInput::ResponseInputItem(ResponseInputItem::Message { role, content, .. })
                     if role == "user"
                         && content.iter().any(|content| matches!(
                             content,
@@ -8526,6 +8733,7 @@ async fn external_active_goal_set_marks_current_turn_for_accounting() -> anyhow:
 
     let state_db = goal_test_state_db(sess.as_ref()).await?;
     let goal = state_db
+        .thread_goals()
         .replace_thread_goal(
             sess.conversation_id,
             "Keep improving the benchmark",
@@ -8554,11 +8762,12 @@ async fn external_active_goal_set_marks_current_turn_for_accounting() -> anyhow:
     .await;
     sess.goal_runtime_apply(GoalRuntimeEvent::ToolCompleted {
         turn_context: tc.as_ref(),
-        tool_name: "shell",
+        tool_name: "shell_command",
     })
     .await?;
 
     let goal = state_db
+        .thread_goals()
         .get_thread_goal(sess.conversation_id)
         .await?
         .expect("goal should remain persisted");
@@ -8618,6 +8827,7 @@ async fn completed_goal_accounts_current_turn_tokens_before_tool_response() -> a
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
 
@@ -8640,7 +8850,7 @@ async fn completed_goal_accounts_current_turn_tokens_before_tool_response() -> a
     assert_eq!(complete_output["remainingTokens"], 0);
     assert_eq!(
         complete_output["completionBudgetReport"],
-        "Goal achieved. Report final budget usage to the user: tokens used: 580 of 500."
+        "Goal achieved. Report final usage from this tool result's structured goal fields. If `goal.tokenBudget` is present, include token usage from `goal.tokensUsed` and `goal.tokenBudget`. If `goal.timeUsedSeconds` is greater than 0, summarize elapsed time in a concise, human-friendly form appropriate to the response language."
     );
     let requests = responses.requests();
     let completion_followup_request = requests
@@ -8657,6 +8867,7 @@ async fn completed_goal_accounts_current_turn_tokens_before_tool_response() -> a
     )
     .await?;
     let persisted_goal = state_db
+        .thread_goals()
         .get_thread_goal(test.session_configured.thread_id)
         .await?
         .expect("goal should be persisted");
@@ -8689,20 +8900,29 @@ async fn queue_only_mailbox_mail_waits_for_next_turn_after_answer_boundary() {
     )
     .await;
 
-    sess.defer_mailbox_delivery_to_next_turn(&tc.sub_id).await;
-    sess.enqueue_mailbox_communication(communication.clone());
+    sess.input_queue
+        .defer_mailbox_delivery_to_next_turn(&sess.active_turn, &tc.sub_id)
+        .await;
+    sess.input_queue
+        .enqueue_mailbox_communication(communication.clone())
+        .await;
 
     assert!(
-        !sess.has_pending_input().await,
+        !sess.input_queue.has_pending_input(&sess.active_turn).await,
         "queue-only mailbox mail should stay buffered once the current turn emitted its answer"
     );
-    assert_eq!(sess.get_pending_input().await, Vec::new());
+    assert_eq!(
+        sess.input_queue.get_pending_input(&sess.active_turn).await,
+        Vec::new()
+    );
 
     sess.abort_all_tasks(TurnAbortReason::Replaced).await;
 
     assert_eq!(
-        sess.get_pending_input().await,
-        vec![communication.to_response_input_item()],
+        sess.input_queue.get_pending_input(&sess.active_turn).await,
+        vec![TurnInput::ResponseInputItem(
+            communication.to_response_input_item()
+        )],
     );
 }
 
@@ -8719,23 +8939,27 @@ async fn trigger_turn_mailbox_mail_waits_for_next_turn_after_answer_boundary() {
     )
     .await;
 
-    sess.defer_mailbox_delivery_to_next_turn(&tc.sub_id).await;
-    sess.enqueue_mailbox_communication(InterAgentCommunication::new(
-        AgentPath::try_from("/root/worker").expect("worker path should parse"),
-        AgentPath::root(),
-        Vec::new(),
-        "late trigger update".to_string(),
-        /*trigger_turn*/ true,
-    ));
+    sess.input_queue
+        .defer_mailbox_delivery_to_next_turn(&sess.active_turn, &tc.sub_id)
+        .await;
+    sess.input_queue
+        .enqueue_mailbox_communication(InterAgentCommunication::new(
+            AgentPath::try_from("/root/worker").expect("worker path should parse"),
+            AgentPath::root(),
+            Vec::new(),
+            "late trigger update".to_string(),
+            /*trigger_turn*/ true,
+        ))
+        .await;
 
     assert!(
-        !sess.has_pending_input().await,
+        !sess.input_queue.has_pending_input(&sess.active_turn).await,
         "trigger-turn mailbox mail should not extend the current turn after its answer boundary"
     );
 
     sess.abort_all_tasks(TurnAbortReason::Replaced).await;
 
-    assert!(sess.has_trigger_turn_mailbox_items().await);
+    assert!(sess.input_queue.has_trigger_turn_mailbox_items().await);
 }
 
 #[tokio::test]
@@ -8758,8 +8982,12 @@ async fn steered_input_reopens_mailbox_delivery_for_current_turn() {
     )
     .await;
 
-    sess.defer_mailbox_delivery_to_next_turn(&tc.sub_id).await;
-    sess.enqueue_mailbox_communication(communication.clone());
+    sess.input_queue
+        .defer_mailbox_delivery_to_next_turn(&sess.active_turn, &tc.sub_id)
+        .await;
+    sess.input_queue
+        .enqueue_mailbox_communication(communication.clone())
+        .await;
     sess.steer_input(
         vec![UserInput::Text {
             text: "follow up".to_string(),
@@ -8772,13 +9000,13 @@ async fn steered_input_reopens_mailbox_delivery_for_current_turn() {
     .expect("steered input should be accepted");
 
     assert_eq!(
-        sess.get_pending_input().await,
+        sess.input_queue.get_pending_input(&sess.active_turn).await,
         vec![
-            ResponseInputItem::from(vec![UserInput::Text {
+            TurnInput::UserInput(vec![UserInput::Text {
                 text: "follow up".to_string(),
                 text_elements: Vec::new(),
             }]),
-            communication.to_response_input_item(),
+            TurnInput::ResponseInputItem(communication.to_response_input_item()),
         ],
     );
 }
@@ -8803,8 +9031,12 @@ async fn stale_defer_mailbox_delivery_does_not_override_steered_input() {
     )
     .await;
 
-    sess.defer_mailbox_delivery_to_next_turn(&tc.sub_id).await;
-    sess.enqueue_mailbox_communication(communication.clone());
+    sess.input_queue
+        .defer_mailbox_delivery_to_next_turn(&sess.active_turn, &tc.sub_id)
+        .await;
+    sess.input_queue
+        .enqueue_mailbox_communication(communication.clone())
+        .await;
     sess.steer_input(
         vec![UserInput::Text {
             text: "follow up".to_string(),
@@ -8816,16 +9048,18 @@ async fn stale_defer_mailbox_delivery_does_not_override_steered_input() {
     .await
     .expect("steered input should be accepted");
 
-    sess.defer_mailbox_delivery_to_next_turn(&tc.sub_id).await;
+    sess.input_queue
+        .defer_mailbox_delivery_to_next_turn(&sess.active_turn, &tc.sub_id)
+        .await;
 
     assert_eq!(
-        sess.get_pending_input().await,
+        sess.input_queue.get_pending_input(&sess.active_turn).await,
         vec![
-            ResponseInputItem::from(vec![UserInput::Text {
+            TurnInput::UserInput(vec![UserInput::Text {
                 text: "follow up".to_string(),
                 text_elements: Vec::new(),
             }]),
-            communication.to_response_input_item(),
+            TurnInput::ResponseInputItem(communication.to_response_input_item()),
         ],
     );
 }
@@ -8850,8 +9084,12 @@ async fn tool_calls_reopen_mailbox_delivery_for_current_turn() {
     )
     .await;
 
-    sess.defer_mailbox_delivery_to_next_turn(&tc.sub_id).await;
-    sess.enqueue_mailbox_communication(communication.clone());
+    sess.input_queue
+        .defer_mailbox_delivery_to_next_turn(&sess.active_turn, &tc.sub_id)
+        .await;
+    sess.input_queue
+        .enqueue_mailbox_communication(communication.clone())
+        .await;
 
     let item = ResponseItem::FunctionCall {
         id: None,
@@ -8863,6 +9101,7 @@ async fn tool_calls_reopen_mailbox_delivery_for_current_turn() {
     let mut ctx = HandleOutputCtx {
         sess: Arc::clone(&sess),
         turn_context: Arc::clone(&tc),
+        turn_store: Arc::new(codex_extension_api::ExtensionData::new(tc.sub_id.clone())),
         tool_runtime: test_tool_runtime(Arc::clone(&sess), Arc::clone(&tc)),
         cancellation_token: CancellationToken::new(),
     };
@@ -8874,8 +9113,10 @@ async fn tool_calls_reopen_mailbox_delivery_for_current_turn() {
     assert!(output.needs_follow_up);
     assert!(output.tool_future.is_some());
     assert_eq!(
-        sess.get_pending_input().await,
-        vec![communication.to_response_input_item()],
+        sess.input_queue.get_pending_input(&sess.active_turn).await,
+        vec![TurnInput::ResponseInputItem(
+            communication.to_response_input_item()
+        )],
     );
 }
 
@@ -8971,8 +9212,8 @@ async fn fatal_tool_error_stops_turn_and_reports_error() {
             .await
     };
     let deferred_mcp_tools = Some(tools.clone());
-    let router = ToolRouter::from_config(
-        &turn_context.tools_config,
+    let router = ToolRouter::from_turn_context(
+        &turn_context,
         crate::tools::router::ToolRouterParams {
             deferred_mcp_tools,
             mcp_tools: Some(tools),
@@ -8985,7 +9226,7 @@ async fn fatal_tool_error_stops_turn_and_reports_error() {
         id: None,
         status: None,
         call_id: "call-1".to_string(),
-        name: "shell".to_string(),
+        name: "shell_command".to_string(),
         input: "{}".to_string(),
     };
 
@@ -9008,7 +9249,10 @@ async fn fatal_tool_error_stops_turn_and_reports_error() {
 
     match err {
         FunctionCallError::Fatal(message) => {
-            assert_eq!(message, "tool shell invoked with incompatible payload");
+            assert_eq!(
+                message,
+                "tool shell_command invoked with incompatible payload"
+            );
         }
         other => panic!("expected FunctionCallError::Fatal, got {other:?}"),
     }
@@ -9287,7 +9531,121 @@ async fn update_goal_tool_rejects_pausing_goal() {
     };
     assert_eq!(
         output,
-        "update_goal can only mark the existing goal complete; pause, resume, and budget-limited status changes are controlled by the user or system"
+        "update_goal can only mark the existing goal complete or blocked; pause, resume, budget-limited, and usage-limited status changes are controlled by the user or system"
+    );
+
+    let goal = session
+        .get_thread_goal()
+        .await
+        .expect("read thread goal")
+        .expect("goal should still exist");
+    assert_eq!(goal.status, ThreadGoalStatus::Active);
+}
+
+#[tokio::test]
+async fn update_goal_tool_marks_goal_blocked() {
+    let (session, turn_context, _rx, _codex_home) = make_goal_session_and_context_with_rx().await;
+    let tracker = Arc::new(tokio::sync::Mutex::new(TurnDiffTracker::new()));
+    let create_handler = CreateGoalHandler;
+    let update_handler = UpdateGoalHandler;
+
+    create_handler
+        .handle(ToolInvocation {
+            session: Arc::clone(&session),
+            turn: Arc::clone(&turn_context),
+            cancellation_token: CancellationToken::new(),
+            tracker: Arc::clone(&tracker),
+            call_id: "create-goal".to_string(),
+            tool_name: codex_tools::ToolName::plain("create_goal"),
+            source: ToolCallSource::Direct,
+            payload: ToolPayload::Function {
+                arguments: serde_json::json!({
+                    "objective": "Keep the watcher alive",
+                    "token_budget": 123,
+                })
+                .to_string(),
+            },
+        })
+        .await
+        .expect("initial create_goal should succeed");
+
+    update_handler
+        .handle(ToolInvocation {
+            session: Arc::clone(&session),
+            turn: Arc::clone(&turn_context),
+            cancellation_token: CancellationToken::new(),
+            tracker,
+            call_id: "block-goal".to_string(),
+            tool_name: codex_tools::ToolName::plain("update_goal"),
+            source: ToolCallSource::Direct,
+            payload: ToolPayload::Function {
+                arguments: serde_json::json!({
+                    "status": "blocked",
+                })
+                .to_string(),
+            },
+        })
+        .await
+        .expect("update_goal should mark the goal blocked");
+
+    let goal = session
+        .get_thread_goal()
+        .await
+        .expect("read thread goal")
+        .expect("goal should still exist");
+    assert_eq!(goal.status, ThreadGoalStatus::Blocked);
+}
+
+#[tokio::test]
+async fn update_goal_tool_rejects_usage_limited_goal() {
+    let (session, turn_context, _rx, _codex_home) = make_goal_session_and_context_with_rx().await;
+    let tracker = Arc::new(tokio::sync::Mutex::new(TurnDiffTracker::new()));
+    let create_handler = CreateGoalHandler;
+    let update_handler = UpdateGoalHandler;
+
+    create_handler
+        .handle(ToolInvocation {
+            session: Arc::clone(&session),
+            turn: Arc::clone(&turn_context),
+            cancellation_token: CancellationToken::new(),
+            tracker: Arc::clone(&tracker),
+            call_id: "create-goal".to_string(),
+            tool_name: codex_tools::ToolName::plain("create_goal"),
+            source: ToolCallSource::Direct,
+            payload: ToolPayload::Function {
+                arguments: serde_json::json!({
+                    "objective": "Keep the watcher alive",
+                })
+                .to_string(),
+            },
+        })
+        .await
+        .expect("initial create_goal should succeed");
+
+    let response = update_handler
+        .handle(ToolInvocation {
+            session: Arc::clone(&session),
+            turn: Arc::clone(&turn_context),
+            cancellation_token: CancellationToken::new(),
+            tracker,
+            call_id: "usage-limit-goal".to_string(),
+            tool_name: codex_tools::ToolName::plain("update_goal"),
+            source: ToolCallSource::Direct,
+            payload: ToolPayload::Function {
+                arguments: serde_json::json!({
+                    "status": "usageLimited",
+                })
+                .to_string(),
+            },
+        })
+        .await;
+
+    let Err(FunctionCallError::RespondToModel(output)) = response else {
+        panic!("expected update_goal to reject usage-limiting a goal");
+    };
+    assert_eq!(
+        output,
+        "update_goal can only mark the existing goal complete or blocked; pause, resume, budget-limited, and usage-limited status changes are controlled by the user or system"
     );
 
     let goal = session
@@ -9354,13 +9712,12 @@ async fn update_goal_tool_marks_goal_complete() {
 
 #[tokio::test]
 async fn rejects_escalated_permissions_when_policy_not_on_request() {
-    use crate::exec::ExecParams;
     use crate::exec_policy::ExecApprovalRequest;
     use crate::sandboxing::SandboxPermissions;
     use crate::tools::sandboxing::ExecApprovalRequirement;
     use crate::turn_diff_tracker::TurnDiffTracker;
     use codex_protocol::protocol::AskForApproval;
-    use std::collections::HashMap;
+    use codex_tools::ShellCommandBackendConfig;
 
     let (session, mut turn_context_raw) = make_session_and_context().await;
     // Ensure policy is NOT OnRequest so the early rejection path triggers
@@ -9371,43 +9728,18 @@ async fn rejects_escalated_permissions_when_policy_not_on_request() {
     let session = Arc::new(session);
     let mut turn_context = Arc::new(turn_context_raw);
 
+    let command_script = "echo hi";
     let timeout_ms = 1000;
     let sandbox_permissions = SandboxPermissions::RequireEscalated;
-    let params = ExecParams {
-        command: if cfg!(windows) {
-            vec![
-                "cmd.exe".to_string(),
-                "/C".to_string(),
-                "echo hi".to_string(),
-            ]
-        } else {
-            vec![
-                "/bin/sh".to_string(),
-                "-c".to_string(),
-                "echo hi".to_string(),
-            ]
-        },
-        cwd: turn_context.cwd.clone(),
-        expiration: timeout_ms.into(),
-        capture_policy: ExecCapturePolicy::ShellTool,
-        env: HashMap::new(),
-        network: None,
-        sandbox_permissions,
-        windows_sandbox_level: turn_context.windows_sandbox_level,
-        windows_sandbox_private_desktop: turn_context
-            .config
-            .permissions
-            .windows_sandbox_private_desktop,
-        justification: Some("test".to_string()),
-        arg0: None,
-    };
 
     let turn_diff_tracker = Arc::new(tokio::sync::Mutex::new(TurnDiffTracker::new()));
 
-    let tool_name = "shell";
+    let tool_name = "shell_command";
     let call_id = "test-call".to_string();
 
-    let handler = ShellHandler::default();
+    let handler = ShellCommandHandler::from(ShellCommandBackendConfig::Classic);
+    #[allow(deprecated)]
+    let workdir = Some(turn_context.cwd.to_string_lossy().to_string());
     let resp = handler
         .handle(ToolInvocation {
             session: Arc::clone(&session),
@@ -9419,11 +9751,11 @@ async fn rejects_escalated_permissions_when_policy_not_on_request() {
             source: crate::tools::context::ToolCallSource::Direct,
             payload: ToolPayload::Function {
                 arguments: serde_json::json!({
-                    "command": params.command.clone(),
-                    "workdir": Some(turn_context.cwd.to_string_lossy().to_string()),
-                    "timeout_ms": params.expiration.timeout_ms(),
-                    "sandbox_permissions": params.sandbox_permissions,
-                    "justification": params.justification.clone(),
+                    "command": command_script,
+                    "workdir": workdir,
+                    "timeout_ms": timeout_ms,
+                    "sandbox_permissions": sandbox_permissions,
+                    "justification": Some("test"),
                 })
                 .to_string(),
             },
@@ -9445,18 +9777,23 @@ async fn rejects_escalated_permissions_when_policy_not_on_request() {
     // The rejection should not poison the non-escalated path for the same
     // command. Force DangerFullAccess so this check stays focused on approval
     // policy rather than platform-specific sandbox behavior.
-    let turn_context_mut = Arc::get_mut(&mut turn_context).expect("unique turn context Arc");
+    let turn_context_mut = Arc::get_mut(&mut turn_context).expect("unique thread settings Arc");
     turn_context_mut.permission_profile = PermissionProfile::Disabled;
 
     let file_system_sandbox_policy = turn_context.file_system_sandbox_policy();
+    let command = session.user_shell().derive_exec_args(
+        command_script,
+        turn_context.config.permissions.allow_login_shell,
+    );
     let exec_approval_requirement = session
         .services
         .exec_policy
         .create_exec_approval_requirement_for_command(ExecApprovalRequest {
-            command: &params.command,
+            command: &command,
             approval_policy: turn_context.approval_policy.value(),
             permission_profile: turn_context.permission_profile(),
             file_system_sandbox_policy: &file_system_sandbox_policy,
+            #[allow(deprecated)]
             sandbox_cwd: turn_context.cwd.as_path(),
             sandbox_permissions: SandboxPermissions::UseDefault,
             prefix_rule: None,
diff --git a/codex-rs/core/src/session/tests/guardian_tests.rs b/codex-rs/core/src/session/tests/guardian_tests.rs
index 730b9f5e87..5db4aab985 100644
--- a/codex-rs/core/src/session/tests/guardian_tests.rs
+++ b/codex-rs/core/src/session/tests/guardian_tests.rs
@@ -1,14 +1,13 @@
 use super::*;
 use crate::compact::InitialContextInjection;
 use crate::environment_selection::ResolvedTurnEnvironments;
-use crate::exec::ExecCapturePolicy;
-use crate::exec::ExecParams;
 use crate::exec_policy::ExecPolicyManager;
 use crate::guardian::GUARDIAN_REVIEWER_NAME;
 use crate::sandboxing::SandboxPermissions;
 use crate::test_support::models_manager_with_provider;
-use crate::tools::context::FunctionToolOutput;
 use crate::tools::context::ToolCallSource;
+use crate::tools::context::ToolOutput;
+use crate::tools::context::ToolPayload;
 use crate::turn_diff_tracker::TurnDiffTracker;
 use codex_app_server_protocol::ConfigLayerSource;
 use codex_config::ConfigLayerEntry;
@@ -24,8 +23,8 @@ use codex_protocol::config_types::ApprovalsReviewer;
 use codex_protocol::models::AdditionalPermissionProfile as PermissionProfile;
 use codex_protocol::models::ContentItem;
 use codex_protocol::models::NetworkPermissions;
+use codex_protocol::models::ResponseInputItem;
 use codex_protocol::models::ResponseItem;
-use codex_protocol::models::function_call_output_content_items_to_text;
 use codex_protocol::protocol::AskForApproval;
 use codex_protocol::request_permissions::PermissionGrantScope;
 use codex_protocol::request_permissions::RequestPermissionProfile;
@@ -43,8 +42,6 @@ use core_test_support::responses::sse;
 use core_test_support::responses::sse_response;
 use core_test_support::responses::start_mock_server;
 use pretty_assertions::assert_eq;
-use serde::Deserialize;
-use std::collections::HashMap;
 use std::fs;
 use std::sync::Arc;
 use std::time::Duration;
@@ -52,8 +49,23 @@ use tempfile::tempdir;
 use tokio::time::timeout;
 use tokio_util::sync::CancellationToken;
 
-fn expect_text_output(output: &FunctionToolOutput) -> String {
-    function_call_output_content_items_to_text(&output.body).unwrap_or_default()
+fn expect_text_output<T>(output: &T) -> String
+where
+    T: ToolOutput + ?Sized,
+{
+    let response = output.to_response_item(
+        "call-guardian",
+        &ToolPayload::Function {
+            arguments: "{}".to_string(),
+        },
+    );
+    match response {
+        ResponseInputItem::FunctionCallOutput { output, .. }
+        | ResponseInputItem::CustomToolCallOutput { output, .. } => {
+            output.body.to_text().unwrap_or_default()
+        }
+        other => panic!("expected function output, got {other:?}"),
+    }
 }
 
 #[tokio::test]
@@ -238,7 +250,7 @@ async fn request_permissions_guardian_review_stops_when_cancelled() {
 }
 
 #[tokio::test]
-async fn guardian_allows_shell_additional_permissions_requests_past_policy_validation() {
+async fn guardian_allows_shell_command_additional_permissions_requests_past_policy_validation() {
     let server = start_mock_server().await;
     let _request_log = mount_sse_once(
         &server,
@@ -292,38 +304,11 @@ async fn guardian_allows_shell_additional_permissions_requests_past_policy_valid
     let turn_context = Arc::new(turn_context_raw);
     let expiration_ms: u64 = if cfg!(windows) { 2_500 } else { 1_000 };
 
-    let params = ExecParams {
-        command: if cfg!(windows) {
-            vec![
-                "cmd.exe".to_string(),
-                "/Q".to_string(),
-                "/D".to_string(),
-                "/C".to_string(),
-                "echo hi".to_string(),
-            ]
-        } else {
-            vec![
-                "/bin/sh".to_string(),
-                "-c".to_string(),
-                "echo hi".to_string(),
-            ]
-        },
-        cwd: turn_context.cwd.clone(),
-        expiration: expiration_ms.into(),
-        capture_policy: ExecCapturePolicy::ShellTool,
-        env: HashMap::new(),
-        network: None,
-        sandbox_permissions: SandboxPermissions::WithAdditionalPermissions,
-        windows_sandbox_level: turn_context.windows_sandbox_level,
-        windows_sandbox_private_desktop: turn_context
-            .config
-            .permissions
-            .windows_sandbox_private_desktop,
-        justification: Some("test".to_string()),
-        arg0: None,
-    };
-
-    let handler = ShellHandler::default();
+    let handler = crate::tools::handlers::ShellCommandHandler::from(
+        codex_tools::ShellCommandBackendConfig::Classic,
+    );
+    #[allow(deprecated)]
+    let workdir = Some(turn_context.cwd.to_string_lossy().to_string());
     let resp = handler
         .handle(ToolInvocation {
             session: Arc::clone(&session),
@@ -331,21 +316,22 @@ async fn guardian_allows_shell_additional_permissions_requests_past_policy_valid
             cancellation_token: CancellationToken::new(),
             tracker: Arc::new(tokio::sync::Mutex::new(TurnDiffTracker::new())),
             call_id: "test-call".to_string(),
-            tool_name: codex_tools::ToolName::plain("shell"),
+            tool_name: codex_tools::ToolName::plain("shell_command"),
             source: crate::tools::context::ToolCallSource::Direct,
             payload: ToolPayload::Function {
                 arguments: serde_json::json!({
-                    "command": params.command.clone(),
-                    "workdir": Some(turn_context.cwd.to_string_lossy().to_string()),
-                    "timeout_ms": params.expiration.timeout_ms(),
-                    "sandbox_permissions": params.sandbox_permissions,
+                    "command": "echo hi",
+                    "login": false,
+                    "workdir": workdir,
+                    "timeout_ms": expiration_ms,
+                    "sandbox_permissions": SandboxPermissions::WithAdditionalPermissions,
                     "additional_permissions": PermissionProfile {
                         network: Some(NetworkPermissions {
                             enabled: Some(true),
                         }),
                         file_system: None,
                     },
-                    "justification": params.justification.clone(),
+                    "justification": Some("test"),
                 })
                 .to_string(),
             },
@@ -353,27 +339,11 @@ async fn guardian_allows_shell_additional_permissions_requests_past_policy_valid
         .await;
 
     let output = expect_text_output(&resp.expect("expected Ok result"));
-
-    #[derive(Deserialize, PartialEq, Eq, Debug)]
-    struct ResponseExecMetadata {
-        exit_code: i32,
-    }
-
-    #[derive(Deserialize)]
-    struct ResponseExecOutput {
-        output: String,
-        metadata: ResponseExecMetadata,
-    }
-
-    let exec_output: ResponseExecOutput =
-        serde_json::from_str(&output).expect("valid exec output json");
-
-    assert_eq!(exec_output.metadata, ResponseExecMetadata { exit_code: 0 });
-    assert!(exec_output.output.contains("hi"));
+    assert!(output.contains("hi"));
 }
 
 #[tokio::test]
-async fn strict_auto_review_turn_grant_forces_guardian_for_shell_policy_skip() {
+async fn strict_auto_review_turn_grant_forces_guardian_for_shell_command_policy_skip() {
     let server = start_mock_server().await;
     let guardian_request_log = mount_sse_once(
         &server,
@@ -437,35 +407,25 @@ async fn strict_auto_review_turn_grant_forces_guardian_for_shell_policy_skip() {
     let session = Arc::new(session);
     let turn_context = Arc::new(turn_context_raw);
 
-    let handler = ShellHandler::default();
-    let command = if cfg!(windows) {
-        vec![
-            "cmd.exe".to_string(),
-            "/Q".to_string(),
-            "/D".to_string(),
-            "/C".to_string(),
-            "echo hi".to_string(),
-        ]
-    } else {
-        vec![
-            "/bin/sh".to_string(),
-            "-c".to_string(),
-            "echo hi".to_string(),
-        ]
-    };
+    let handler = crate::tools::handlers::ShellCommandHandler::from(
+        codex_tools::ShellCommandBackendConfig::Classic,
+    );
+    #[allow(deprecated)]
+    let workdir = Some(turn_context.cwd.to_string_lossy().to_string());
     let resp = handler
         .handle(ToolInvocation {
             session: Arc::clone(&session),
             turn: Arc::clone(&turn_context),
             cancellation_token: CancellationToken::new(),
             tracker: Arc::new(tokio::sync::Mutex::new(TurnDiffTracker::new())),
-            call_id: "strict-shell-call".to_string(),
-            tool_name: codex_tools::ToolName::plain("shell"),
+            call_id: "strict-shell-command-call".to_string(),
+            tool_name: codex_tools::ToolName::plain("shell_command"),
             source: ToolCallSource::Direct,
             payload: ToolPayload::Function {
                 arguments: serde_json::json!({
-                    "command": command,
-                    "workdir": Some(turn_context.cwd.to_string_lossy().to_string()),
+                    "command": "echo hi",
+                    "login": false,
+                    "workdir": workdir,
                     "timeout_ms": 1_000_u64,
                 })
                 .to_string(),
@@ -593,7 +553,7 @@ async fn process_compacted_history_preserves_separate_guardian_developer_message
     clippy::await_holding_invalid_type,
     reason = "test mutates active turn state directly to seed granted permissions"
 )]
-async fn shell_handler_allows_sticky_turn_permissions_without_inline_request_permissions_feature() {
+async fn shell_command_allows_sticky_turn_permissions_without_inline_request_permissions_feature() {
     let (mut session, turn_context_raw) = make_session_and_context().await;
     session
         .features
@@ -615,7 +575,11 @@ async fn shell_handler_allows_sticky_turn_permissions_without_inline_request_per
     let session = Arc::new(session);
     let turn_context = Arc::new(turn_context_raw);
 
-    let handler = ShellHandler::default();
+    let handler = crate::tools::handlers::ShellCommandHandler::from(
+        codex_tools::ShellCommandBackendConfig::Classic,
+    );
+    #[allow(deprecated)]
+    let workdir = Some(turn_context.cwd.to_string_lossy().to_string());
     let resp = handler
         .handle(ToolInvocation {
             session: Arc::clone(&session),
@@ -623,17 +587,14 @@ async fn shell_handler_allows_sticky_turn_permissions_without_inline_request_per
             cancellation_token: CancellationToken::new(),
             tracker: Arc::new(tokio::sync::Mutex::new(TurnDiffTracker::new())),
             call_id: "sticky-turn-grant".to_string(),
-            tool_name: codex_tools::ToolName::plain("shell"),
+            tool_name: codex_tools::ToolName::plain("shell_command"),
             source: crate::tools::context::ToolCallSource::Direct,
             payload: ToolPayload::Function {
                 arguments: serde_json::json!({
-                    "command": [
-                        "/bin/sh",
-                        "-c",
-                        "echo hi",
-                    ],
+                    "command": "echo hi",
+                    "login": false,
                     "timeout_ms": 1_000_u64,
-                    "workdir": Some(turn_context.cwd.to_string_lossy().to_string()),
+                    "workdir": workdir,
                 })
                 .to_string(),
             },
@@ -643,23 +604,7 @@ async fn shell_handler_allows_sticky_turn_permissions_without_inline_request_per
     match resp {
         Ok(output) => {
             let output = expect_text_output(&output);
-
-            #[derive(Deserialize, PartialEq, Eq, Debug)]
-            struct ResponseExecMetadata {
-                exit_code: i32,
-            }
-
-            #[derive(Deserialize)]
-            struct ResponseExecOutput {
-                output: String,
-                metadata: ResponseExecMetadata,
-            }
-
-            let exec_output: ResponseExecOutput =
-                serde_json::from_str(&output).expect("valid exec output json");
-
-            assert_eq!(exec_output.metadata, ResponseExecMetadata { exit_code: 0 });
-            assert!(exec_output.output.contains("hi"));
+            assert!(output.contains("hi"));
         }
         Err(FunctionCallError::RespondToModel(output)) => {
             assert!(
diff --git a/codex-rs/core/src/session/turn.rs b/codex-rs/core/src/session/turn.rs
index 2dd84213ed..4ac511f4fa 100644
--- a/codex-rs/core/src/session/turn.rs
+++ b/codex-rs/core/src/session/turn.rs
@@ -4,15 +4,12 @@ use std::sync::Arc;
 use std::sync::atomic::Ordering;
 
 use crate::SkillInjections;
-use crate::SkillLoadOutcome;
 use crate::build_skill_injections;
 use crate::client::ModelClientSession;
 use crate::client_common::Prompt;
 use crate::client_common::ResponseEvent;
-use crate::collect_env_var_dependencies;
 use crate::collect_explicit_skill_mentions;
 use crate::compact::InitialContextInjection;
-use crate::compact::collect_user_messages;
 use crate::compact::run_inline_auto_compact_task;
 use crate::compact::should_use_remote_compact_task;
 use crate::compact_remote::run_inline_remote_auto_compact_task;
@@ -20,13 +17,13 @@ use crate::compact_remote_v2::run_inline_remote_auto_compact_task as run_inline_
 use crate::connectors;
 use crate::context::ContextualUserFragment;
 use crate::feedback_tags;
-use crate::hook_runtime::PendingInputHookDisposition;
-use crate::hook_runtime::emit_hook_completed_events;
+use crate::goals::GoalRuntimeEvent;
 use crate::hook_runtime::inspect_pending_input;
 use crate::hook_runtime::record_additional_contexts;
 use crate::hook_runtime::record_pending_input;
+use crate::hook_runtime::run_legacy_after_agent_hook;
 use crate::hook_runtime::run_pending_session_start_hooks;
-use crate::hook_runtime::run_user_prompt_submit_hooks;
+use crate::hook_runtime::run_stop_hooks;
 use crate::injection::ToolMentionKind;
 use crate::injection::app_id_from_path;
 use crate::injection::tool_kind_for_path;
@@ -37,25 +34,28 @@ use crate::mentions::build_skill_name_counts;
 use crate::mentions::collect_explicit_app_ids;
 use crate::mentions::collect_explicit_plugin_mentions;
 use crate::mentions::collect_tool_mentions_from_messages;
-use crate::parse_turn_item;
 use crate::plugins::build_plugin_injections;
-use crate::resolve_skill_dependencies_for_turn;
 use crate::session::PreviousTurnSettings;
+use crate::session::TurnInput;
 use crate::session::session::Session;
 use crate::session::turn_context::TurnContext;
 use crate::stream_events_utils::HandleOutputCtx;
+use crate::stream_events_utils::TurnItemContributorPolicy;
+use crate::stream_events_utils::finalize_non_tool_response_item;
 use crate::stream_events_utils::handle_non_tool_response_item;
 use crate::stream_events_utils::handle_output_item_done;
 use crate::stream_events_utils::last_assistant_message_from_item;
 use crate::stream_events_utils::mark_thread_memory_mode_polluted_if_external_context;
 use crate::stream_events_utils::raw_assistant_output_text_from_item;
-use crate::stream_events_utils::record_completed_response_item;
+use crate::stream_events_utils::record_completed_response_item_with_finalized_facts;
 use crate::tools::ToolRouter;
 use crate::tools::context::SharedTurnDiffTracker;
 use crate::tools::parallel::ToolCallRuntime;
 use crate::tools::registry::ToolArgumentDiffConsumer;
 use crate::tools::router::ToolRouterParams;
 use crate::tools::router::extension_tool_executors;
+use crate::tools::spec_plan::search_tool_enabled;
+use crate::tools::spec_plan::tool_suggest_enabled;
 use crate::turn_diff_tracker::TurnDiffTracker;
 use crate::turn_timing::record_turn_ttft_metric;
 use crate::util::backoff;
@@ -69,17 +69,14 @@ use codex_analytics::build_track_events_context;
 use codex_async_utils::OrCancelExt;
 use codex_features::Feature;
 use codex_git_utils::get_git_repo_root;
-use codex_hooks::HookEvent;
-use codex_hooks::HookEventAfterAgent;
-use codex_hooks::HookPayload;
-use codex_hooks::HookResult;
+use codex_git_utils::get_git_repo_root_with_fs;
+use codex_protocol::config_types::AutoCompactTokenLimitScope;
 use codex_protocol::config_types::ModeKind;
 use codex_protocol::config_types::ServiceTier;
 use codex_protocol::error::CodexErr;
 use codex_protocol::error::Result as CodexResult;
 use codex_protocol::items::PlanItem;
 use codex_protocol::items::TurnItem;
-use codex_protocol::items::UserMessageItem;
 use codex_protocol::items::build_hook_prompt_message;
 use codex_protocol::models::BaseInstructions;
 use codex_protocol::models::ContentItem;
@@ -88,7 +85,6 @@ use codex_protocol::models::ResponseInputItem;
 use codex_protocol::models::ResponseItem;
 use codex_protocol::protocol::AgentMessageContentDeltaEvent;
 use codex_protocol::protocol::AgentReasoningSectionBreakEvent;
-use codex_protocol::protocol::AskForApproval;
 use codex_protocol::protocol::CodexErrorInfo;
 use codex_protocol::protocol::ErrorEvent;
 use codex_protocol::protocol::EventMsg;
@@ -132,23 +128,14 @@ use tracing::warn;
 /// - If the model sends only an assistant message, we record it in the
 ///   conversation history and consider the turn complete.
 ///
-#[expect(
-    clippy::await_holding_invalid_type,
-    reason = "turn execution must keep active-turn state transitions atomic"
-)]
 pub(crate) async fn run_turn(
     sess: Arc<Session>,
     turn_context: Arc<TurnContext>,
+    turn_extension_data: Arc<codex_extension_api::ExtensionData>,
     input: Vec<UserInput>,
     prewarmed_client_session: Option<ModelClientSession>,
     cancellation_token: CancellationToken,
 ) -> Option<String> {
-    if input.is_empty() && !sess.has_pending_input().await {
-        return None;
-    }
-
-    let model_info = turn_context.model_info.clone();
-    let auto_compact_limit = model_info.auto_compact_token_limit().unwrap_or(i64::MAX);
     let mut client_session =
         prewarmed_client_session.unwrap_or_else(|| sess.services.model_client.new_session());
     // TODO(ccunningham): Pre-turn compaction runs before context updates and the
@@ -158,7 +145,16 @@ pub(crate) async fn run_turn(
     let pre_sampling_compact =
         match run_pre_sampling_compact(&sess, &turn_context, &mut client_session).await {
             Ok(pre_sampling_compact) => pre_sampling_compact,
-            Err(_) => {
+            Err(err) => {
+                if err.to_codex_protocol_error() == CodexErrorInfo::UsageLimitExceeded
+                    && let Err(err) = sess
+                        .goal_runtime_apply(GoalRuntimeEvent::UsageLimitReached {
+                            turn_context: turn_context.as_ref(),
+                        })
+                        .await
+                {
+                    warn!("failed to usage-limit active goal after usage-limit error: {err}");
+                }
                 error!("Failed to run pre-sampling compact");
                 return None;
             }
@@ -167,155 +163,19 @@ pub(crate) async fn run_turn(
         client_session.reset_websocket_session();
     }
 
-    let skills_outcome = Some(turn_context.turn_skills.outcome.as_ref());
-
     sess.record_context_updates_and_set_reference_context_item(turn_context.as_ref())
         .await;
 
-    let loaded_plugins = sess
-        .services
-        .plugins_manager
-        .plugins_for_config(&turn_context.config.plugins_config_input())
-        .await;
-    // Structured plugin:// mentions are resolved from the current session's
-    // enabled plugins, then converted into turn-scoped guidance below.
-    let mentioned_plugins =
-        collect_explicit_plugin_mentions(&input, loaded_plugins.capability_summaries());
-    let mcp_tools = if turn_context.apps_enabled() || !mentioned_plugins.is_empty() {
-        // Plugin mentions need raw MCP/app inventory even when app tools
-        // are normally hidden so we can describe the plugin's currently
-        // usable capabilities for this turn.
-        match sess
-            .services
-            .mcp_connection_manager
-            .read()
-            .await
-            .list_all_tools()
-            .or_cancel(&cancellation_token)
-            .await
-        {
-            Ok(mcp_tools) => mcp_tools,
-            Err(_) if turn_context.apps_enabled() => return None,
-            Err(_) => Vec::new(),
-        }
-    } else {
-        Vec::new()
-    };
-    let available_connectors = if turn_context.apps_enabled() {
-        let connectors = codex_connectors::merge::merge_plugin_connectors_with_accessible(
-            loaded_plugins
-                .effective_apps()
-                .into_iter()
-                .map(|connector_id| connector_id.0),
-            connectors::accessible_connectors_from_mcp_tools(&mcp_tools),
-        );
-        connectors::with_app_enabled_state(connectors, &turn_context.config)
-    } else {
-        Vec::new()
-    };
-    let connector_slug_counts = build_connector_slug_counts(&available_connectors);
-    let skill_name_counts_lower = skills_outcome
-        .as_ref()
-        .map_or_else(HashMap::new, |outcome| {
-            build_skill_name_counts(&outcome.skills, &outcome.disabled_paths).1
-        });
-    let mentioned_skills = skills_outcome.as_ref().map_or_else(Vec::new, |outcome| {
-        collect_explicit_skill_mentions(
-            &input,
-            &outcome.skills,
-            &outcome.disabled_paths,
-            &connector_slug_counts,
-        )
-    });
-    let config = turn_context.config.clone();
-    if config
-        .features
-        .enabled(Feature::SkillEnvVarDependencyPrompt)
-    {
-        let env_var_dependencies = collect_env_var_dependencies(&mentioned_skills);
-        resolve_skill_dependencies_for_turn(&sess, &turn_context, &env_var_dependencies).await;
-    }
-
-    maybe_prompt_and_install_mcp_dependencies(
-        sess.as_ref(),
-        turn_context.as_ref(),
-        &cancellation_token,
-        &mentioned_skills,
-        Some(sess.mcp_elicitation_reviewer()),
-    )
-    .await;
-
-    let session_telemetry = turn_context.session_telemetry.clone();
-    let thread_id = sess.conversation_id.to_string();
-    let tracking = build_track_events_context(
-        turn_context.model_info.slug.clone(),
-        thread_id,
-        turn_context.sub_id.clone(),
-    );
-    let SkillInjections {
-        items: skill_injections,
-        warnings: skill_warnings,
-    } = build_skill_injections(
-        &mentioned_skills,
-        skills_outcome,
-        Some(&session_telemetry),
-        &sess.services.analytics_events_client,
-        tracking.clone(),
-    )
-    .await;
-
-    for message in skill_warnings {
-        sess.send_event(&turn_context, EventMsg::Warning(WarningEvent { message }))
-            .await;
-    }
-
-    let skill_items: Vec<ResponseItem> = skill_injections
-        .iter()
-        .map(|skill| ContextualUserFragment::into(crate::context::SkillInstructions::from(skill)))
-        .collect();
-
-    let plugin_items =
-        build_plugin_injections(&mentioned_plugins, &mcp_tools, &available_connectors);
-    let mentioned_plugin_metadata = mentioned_plugins
-        .iter()
-        .filter_map(crate::plugins::PluginCapabilitySummary::telemetry_metadata)
-        .collect::<Vec<_>>();
-
-    let mut explicitly_enabled_connectors = collect_explicit_app_ids(&input);
-    explicitly_enabled_connectors.extend(collect_explicit_app_ids_from_skill_items(
-        &skill_items,
-        &available_connectors,
-        &skill_name_counts_lower,
-    ));
-    let connector_names_by_id = available_connectors
-        .iter()
-        .map(|connector| (connector.id.as_str(), connector.name.as_str()))
-        .collect::<HashMap<&str, &str>>();
-    let mentioned_app_invocations = explicitly_enabled_connectors
-        .iter()
-        .map(|connector_id| AppInvocation {
-            connector_id: Some(connector_id.clone()),
-            app_name: connector_names_by_id
-                .get(connector_id.as_str())
-                .map(|name| (*name).to_string()),
-            invocation_type: Some(InvocationType::Explicit),
-        })
-        .collect::<Vec<_>>();
+    let (injection_items, explicitly_enabled_connectors) =
+        build_skills_and_plugins(&sess, turn_context.as_ref(), &input, &cancellation_token).await?;
 
     if run_pending_session_start_hooks(&sess, &turn_context).await {
         return None;
     }
-    let additional_contexts = if input.is_empty() {
-        Vec::new()
-    } else {
-        let initial_input_for_turn: ResponseInputItem = ResponseInputItem::from(input.clone());
-        let response_item: ResponseItem = initial_input_for_turn.clone().into();
-        let user_prompt_submit_outcome = run_user_prompt_submit_hooks(
-            &sess,
-            &turn_context,
-            UserMessageItem::new(&input).message(),
-        )
-        .await;
+    if !input.is_empty() {
+        let initial_turn_input = TurnInput::UserInput(input.clone());
+        let user_prompt_submit_outcome =
+            inspect_pending_input(&sess, &turn_context, &initial_turn_input).await;
         if user_prompt_submit_outcome.should_stop {
             record_additional_contexts(
                 &sess,
@@ -325,49 +185,45 @@ pub(crate) async fn run_turn(
             .await;
             return None;
         }
-        sess.record_user_prompt_and_emit_turn_item(turn_context.as_ref(), &input, response_item)
-            .await;
-        user_prompt_submit_outcome.additional_contexts
-    };
-    sess.services
-        .analytics_events_client
-        .track_app_mentioned(tracking.clone(), mentioned_app_invocations);
-    for plugin in mentioned_plugin_metadata {
-        sess.services
-            .analytics_events_client
-            .track_plugin_used(tracking.clone(), plugin);
+        record_pending_input(
+            &sess,
+            &turn_context,
+            initial_turn_input,
+            user_prompt_submit_outcome.additional_contexts,
+        )
+        .await;
     }
+
     sess.merge_connector_selection(explicitly_enabled_connectors.clone())
         .await;
-    record_additional_contexts(&sess, &turn_context, additional_contexts).await;
-    if !input.is_empty() {
-        // Track the previous-turn baseline from the regular user-turn path only so
-        // standalone tasks (compact/shell/review) cannot suppress future
-        // model/realtime injections.
-        sess.set_previous_turn_settings(Some(PreviousTurnSettings {
-            model: turn_context.model_info.slug.clone(),
-            realtime_active: Some(turn_context.realtime_active),
-        }))
-        .await;
-    }
-    if !skill_items.is_empty() {
-        sess.record_conversation_items(&turn_context, &skill_items)
-            .await;
-    }
-    if !plugin_items.is_empty() {
-        sess.record_conversation_items(&turn_context, &plugin_items)
+    sess.set_previous_turn_settings(Some(PreviousTurnSettings {
+        model: turn_context.model_info.slug.clone(),
+        realtime_active: Some(turn_context.realtime_active),
+    }))
+    .await;
+    for response_item in injection_items {
+        sess.record_conversation_items(&turn_context, std::slice::from_ref(&response_item))
             .await;
     }
 
     track_turn_resolved_config_analytics(&sess, &turn_context, &input).await;
 
-    let skills_outcome = Some(turn_context.turn_skills.outcome.as_ref());
     let mut last_agent_message: Option<String> = None;
     let mut stop_hook_active = false;
     // Although from the perspective of codex.rs, TurnDiffTracker has the lifecycle of a Task which contains
     // many turns, from the perspective of the user, it is a single turn.
-    let display_root = get_git_repo_root(turn_context.cwd.as_path())
-        .unwrap_or_else(|| turn_context.cwd.clone().into_path_buf());
+    #[allow(deprecated)]
+    let display_root = match turn_context.environments.primary() {
+        Some(turn_environment) => get_git_repo_root_with_fs(
+            turn_environment.environment.get_filesystem().as_ref(),
+            &turn_environment.cwd,
+        )
+        .await
+        .unwrap_or_else(|| turn_environment.cwd.clone())
+        .into_path_buf(),
+        None => get_git_repo_root(turn_context.cwd.as_path())
+            .unwrap_or_else(|| turn_context.cwd.clone().into_path_buf()),
+    };
     let turn_diff_tracker = Arc::new(tokio::sync::Mutex::new(TurnDiffTracker::with_display_root(
         display_root,
     )));
@@ -381,56 +237,36 @@ pub(crate) async fn run_turn(
     let mut can_drain_pending_input = input.is_empty();
 
     loop {
-        if run_pending_session_start_hooks(&sess, &turn_context).await {
-            break;
-        }
-
         // Note that pending_input would be something like a message the user
         // submitted through the UI while the model was running. Though the UI
         // may support this, the model might not.
         let pending_input = if can_drain_pending_input {
-            sess.get_pending_input().await
+            sess.input_queue.get_pending_input(&sess.active_turn).await
         } else {
             Vec::new()
         };
 
         let mut blocked_pending_input = false;
-        let mut blocked_pending_input_contexts = Vec::new();
-        let mut requeued_pending_input = false;
-        let mut accepted_pending_input = Vec::new();
-        if !pending_input.is_empty() {
-            let mut pending_input_iter = pending_input.into_iter();
-            while let Some(pending_input_item) = pending_input_iter.next() {
-                match inspect_pending_input(&sess, &turn_context, pending_input_item).await {
-                    PendingInputHookDisposition::Accepted(pending_input) => {
-                        accepted_pending_input.push(*pending_input);
-                    }
-                    PendingInputHookDisposition::Blocked {
-                        additional_contexts,
-                    } => {
-                        let remaining_pending_input = pending_input_iter.collect::<Vec<_>>();
-                        if !remaining_pending_input.is_empty() {
-                            let _ = sess.prepend_pending_input(remaining_pending_input).await;
-                            requeued_pending_input = true;
-                        }
-                        blocked_pending_input_contexts = additional_contexts;
-                        blocked_pending_input = true;
-                        break;
-                    }
-                }
+        let mut accepted_pending_input = false;
+        for pending_input_item in pending_input {
+            let hook_outcome =
+                inspect_pending_input(&sess, &turn_context, &pending_input_item).await;
+            if hook_outcome.should_stop {
+                blocked_pending_input = true;
+                record_additional_contexts(&sess, &turn_context, hook_outcome.additional_contexts)
+                    .await;
+            } else {
+                accepted_pending_input = true;
+                record_pending_input(
+                    &sess,
+                    &turn_context,
+                    pending_input_item,
+                    hook_outcome.additional_contexts,
+                )
+                .await;
             }
         }
-
-        let has_accepted_pending_input = !accepted_pending_input.is_empty();
-        for pending_input in accepted_pending_input {
-            record_pending_input(&sess, &turn_context, pending_input).await;
-        }
-        record_additional_contexts(&sess, &turn_context, blocked_pending_input_contexts).await;
-
-        if blocked_pending_input && !has_accepted_pending_input {
-            if requeued_pending_input {
-                continue;
-            }
+        if blocked_pending_input && !accepted_pending_input {
             break;
         }
 
@@ -441,24 +277,15 @@ pub(crate) async fn run_turn(
                 .for_prompt(&turn_context.model_info.input_modalities)
         };
 
-        let sampling_request_input_messages = sampling_request_input
-            .iter()
-            .filter_map(|item| match parse_turn_item(item) {
-                Some(TurnItem::UserMessage(user_message)) => Some(user_message),
-                _ => None,
-            })
-            .map(|user_message| user_message.message())
-            .collect::<Vec<String>>();
         let turn_metadata_header = turn_context.turn_metadata_state.current_header_value();
         match run_sampling_request(
             Arc::clone(&sess),
             Arc::clone(&turn_context),
+            Arc::clone(&turn_extension_data),
             Arc::clone(&turn_diff_tracker),
             &mut client_session,
             turn_metadata_header.as_deref(),
-            sampling_request_input,
-            &explicitly_enabled_connectors,
-            skills_outcome,
+            sampling_request_input.clone(),
             cancellation_token.child_token(),
         )
         .await
@@ -469,19 +296,26 @@ pub(crate) async fn run_turn(
                     last_agent_message: sampling_request_last_agent_message,
                 } = sampling_request_output;
                 can_drain_pending_input = true;
-                let has_pending_input = sess.has_pending_input().await;
+                let has_pending_input = sess.input_queue.has_pending_input(&sess.active_turn).await;
                 let needs_follow_up = model_needs_follow_up || has_pending_input;
-                let total_usage_tokens = sess.get_total_token_usage().await;
-                let token_limit_reached = total_usage_tokens >= auto_compact_limit;
+                let token_status =
+                    auto_compact_token_status(sess.as_ref(), turn_context.as_ref()).await;
+                let token_limit_reached = token_status.token_limit_reached;
 
                 let estimated_token_count =
                     sess.get_estimated_token_count(turn_context.as_ref()).await;
 
                 trace!(
                     turn_id = %turn_context.sub_id,
-                    total_usage_tokens,
+                    total_usage_tokens = token_status.active_context_tokens,
+                    auto_compact_scope_tokens = token_status.auto_compact_scope_tokens,
                     estimated_token_count = ?estimated_token_count,
-                    auto_compact_limit,
+                    auto_compact_scope_limit = token_status.auto_compact_scope_limit,
+                    auto_compact_limit_scope = ?turn_context.config.model_auto_compact_token_limit_scope,
+                    auto_compact_window_ordinal = ?token_status.auto_compact_window_ordinal,
+                    auto_compact_window_prefill_tokens = ?token_status.auto_compact_window_prefill_tokens,
+                    full_context_window_limit = ?token_status.full_context_window_limit,
+                    full_context_window_limit_reached = token_status.full_context_window_limit_reached,
                     token_limit_reached,
                     model_needs_follow_up,
                     has_pending_input,
@@ -502,7 +336,20 @@ pub(crate) async fn run_turn(
                     .await
                     {
                         Ok(reset_client_session) => reset_client_session,
-                        Err(_) => return None,
+                        Err(err) => {
+                            if err.to_codex_protocol_error() == CodexErrorInfo::UsageLimitExceeded
+                                && let Err(err) = sess
+                                    .goal_runtime_apply(GoalRuntimeEvent::UsageLimitReached {
+                                        turn_context: turn_context.as_ref(),
+                                    })
+                                    .await
+                            {
+                                warn!(
+                                    "failed to usage-limit active goal after usage-limit error: {err}"
+                                );
+                            }
+                            return None;
+                        }
                     };
                     if reset_client_session {
                         client_session.reset_websocket_session();
@@ -513,38 +360,13 @@ pub(crate) async fn run_turn(
 
                 if !needs_follow_up {
                     last_agent_message = sampling_request_last_agent_message;
-                    let stop_hook_permission_mode = match turn_context.approval_policy.value() {
-                        AskForApproval::Never => "bypassPermissions",
-                        AskForApproval::UnlessTrusted
-                        | AskForApproval::OnFailure
-                        | AskForApproval::OnRequest
-                        | AskForApproval::Granular(_) => "default",
-                    }
-                    .to_string();
-                    let stop_request = codex_hooks::StopRequest {
-                        session_id: sess.session_id().into(),
-                        turn_id: turn_context.sub_id.clone(),
-                        cwd: turn_context.cwd.clone(),
-                        transcript_path: sess.hook_transcript_path().await,
-                        model: turn_context.model_info.slug.clone(),
-                        permission_mode: stop_hook_permission_mode,
+                    let stop_outcome = run_stop_hooks(
+                        &sess,
+                        &turn_context,
                         stop_hook_active,
-                        last_assistant_message: last_agent_message.clone(),
-                    };
-                    let hooks = sess.hooks();
-                    for run in hooks.preview_stop(&stop_request) {
-                        sess.send_event(
-                            &turn_context,
-                            EventMsg::HookStarted(codex_protocol::protocol::HookStartedEvent {
-                                turn_id: Some(turn_context.sub_id.clone()),
-                                run,
-                            }),
-                        )
-                        .await;
-                    }
-                    let stop_outcome = hooks.run_stop(stop_request).await;
-                    emit_hook_completed_events(&sess, &turn_context, stop_outcome.hook_events)
-                        .await;
+                        last_agent_message.clone(),
+                    )
+                    .await;
                     if stop_outcome.should_block {
                         if let Some(hook_prompt_message) =
                             build_hook_prompt_message(&stop_outcome.continuation_fragments)
@@ -569,62 +391,14 @@ pub(crate) async fn run_turn(
                     if stop_outcome.should_stop {
                         break;
                     }
-                    let hook_outcomes = sess
-                        .hooks()
-                        .dispatch(HookPayload {
-                            session_id: sess.session_id().into(),
-                            cwd: turn_context.cwd.clone(),
-                            client: turn_context.app_server_client_name.clone(),
-                            triggered_at: chrono::Utc::now(),
-                            hook_event: HookEvent::AfterAgent {
-                                event: HookEventAfterAgent {
-                                    thread_id: sess.conversation_id,
-                                    turn_id: turn_context.sub_id.clone(),
-                                    input_messages: sampling_request_input_messages,
-                                    last_assistant_message: last_agent_message.clone(),
-                                },
-                            },
-                        })
-                        .await;
-
-                    let mut abort_message = None;
-                    for hook_outcome in hook_outcomes {
-                        let hook_name = hook_outcome.hook_name;
-                        match hook_outcome.result {
-                            HookResult::Success => {}
-                            HookResult::FailedContinue(error) => {
-                                warn!(
-                                    turn_id = %turn_context.sub_id,
-                                    hook_name = %hook_name,
-                                    error = %error,
-                                    "after_agent hook failed; continuing"
-                                );
-                            }
-                            HookResult::FailedAbort(error) => {
-                                let message = format!(
-                                    "after_agent hook '{hook_name}' failed and aborted turn completion: {error}"
-                                );
-                                warn!(
-                                    turn_id = %turn_context.sub_id,
-                                    hook_name = %hook_name,
-                                    error = %error,
-                                    "after_agent hook failed; aborting operation"
-                                );
-                                if abort_message.is_none() {
-                                    abort_message = Some(message);
-                                }
-                            }
-                        }
-                    }
-                    if let Some(message) = abort_message {
-                        sess.send_event(
-                            &turn_context,
-                            EventMsg::Error(ErrorEvent {
-                                message,
-                                codex_error_info: None,
-                            }),
-                        )
-                        .await;
+                    if run_legacy_after_agent_hook(
+                        &sess,
+                        &turn_context,
+                        &sampling_request_input,
+                        last_agent_message.clone(),
+                    )
+                    .await
+                    {
                         return None;
                     }
                     break;
@@ -656,6 +430,15 @@ pub(crate) async fn run_turn(
             }
             Err(e) => {
                 info!("Turn error: {e:#}");
+                if e.to_codex_protocol_error() == CodexErrorInfo::UsageLimitExceeded
+                    && let Err(err) = sess
+                        .goal_runtime_apply(GoalRuntimeEvent::UsageLimitReached {
+                            turn_context: turn_context.as_ref(),
+                        })
+                        .await
+                {
+                    warn!("failed to usage-limit active goal after usage-limit error: {err}");
+                }
                 let event = EventMsg::Error(e.to_error_event(/*message_prefix*/ None));
                 sess.send_event(&turn_context, event).await;
                 // let the user continue the conversation
@@ -667,6 +450,142 @@ pub(crate) async fn run_turn(
     last_agent_message
 }
 
+#[expect(
+    clippy::await_holding_invalid_type,
+    reason = "MCP tool listing borrows the read guard across cancellation-aware await"
+)]
+async fn build_skills_and_plugins(
+    sess: &Arc<Session>,
+    turn_context: &TurnContext,
+    input: &[UserInput],
+    cancellation_token: &CancellationToken,
+) -> Option<(Vec<ResponseItem>, HashSet<String>)> {
+    let tracking = build_track_events_context(
+        turn_context.model_info.slug.clone(),
+        sess.conversation_id.to_string(),
+        turn_context.sub_id.clone(),
+    );
+    let loaded_plugins = sess
+        .services
+        .plugins_manager
+        .plugins_for_config(&turn_context.config.plugins_config_input())
+        .await;
+    // Structured plugin:// mentions are resolved from the current session's
+    // enabled plugins, then converted into turn-scoped guidance below.
+    let mentioned_plugins =
+        collect_explicit_plugin_mentions(input, loaded_plugins.capability_summaries());
+    let mcp_tools = if turn_context.apps_enabled() || !mentioned_plugins.is_empty() {
+        // Plugin mentions need raw MCP/app inventory even when app tools
+        // are normally hidden so we can describe the plugin's currently
+        // usable capabilities for this turn.
+        match sess
+            .services
+            .mcp_connection_manager
+            .read()
+            .await
+            .list_all_tools()
+            .or_cancel(cancellation_token)
+            .await
+        {
+            Ok(mcp_tools) => mcp_tools,
+            Err(_) if turn_context.apps_enabled() => return None,
+            Err(_) => Vec::new(),
+        }
+    } else {
+        Vec::new()
+    };
+    let available_connectors = if turn_context.apps_enabled() {
+        let connectors = codex_connectors::merge::merge_plugin_connectors_with_accessible(
+            loaded_plugins
+                .effective_apps()
+                .into_iter()
+                .map(|connector_id| connector_id.0),
+            connectors::accessible_connectors_from_mcp_tools(&mcp_tools),
+        );
+        connectors::with_app_enabled_state(connectors, &turn_context.config)
+    } else {
+        Vec::new()
+    };
+    let skills_outcome = turn_context.turn_skills.outcome.as_ref();
+    let connector_slug_counts = build_connector_slug_counts(&available_connectors);
+    let skill_name_counts_lower =
+        build_skill_name_counts(&skills_outcome.skills, &skills_outcome.disabled_paths).1;
+    let mentioned_skills = collect_explicit_skill_mentions(
+        input,
+        &skills_outcome.skills,
+        &skills_outcome.disabled_paths,
+        &connector_slug_counts,
+    );
+    maybe_prompt_and_install_mcp_dependencies(
+        sess,
+        turn_context,
+        cancellation_token,
+        &mentioned_skills,
+        Some(sess.mcp_elicitation_reviewer()),
+    )
+    .await;
+
+    let SkillInjections {
+        items: skill_injections,
+        warnings: skill_warnings,
+    } = build_skill_injections(
+        &mentioned_skills,
+        Some(skills_outcome),
+        Some(&turn_context.session_telemetry),
+        &sess.services.analytics_events_client,
+        tracking.clone(),
+    )
+    .await;
+
+    for message in skill_warnings {
+        sess.send_event(turn_context, EventMsg::Warning(WarningEvent { message }))
+            .await;
+    }
+
+    let skill_items: Vec<ResponseItem> = skill_injections
+        .iter()
+        .map(|skill| ContextualUserFragment::into(crate::context::SkillInstructions::from(skill)))
+        .collect();
+    let skill_connector_ids = collect_explicit_app_ids_from_skill_items(
+        &skill_items,
+        &available_connectors,
+        &skill_name_counts_lower,
+    );
+    let plugin_items =
+        build_plugin_injections(&mentioned_plugins, &mcp_tools, &available_connectors);
+    let mut explicitly_enabled_connectors = collect_explicit_app_ids(input);
+    explicitly_enabled_connectors.extend(skill_connector_ids);
+    let connector_names_by_id = available_connectors
+        .iter()
+        .map(|connector| (connector.id.as_str(), connector.name.as_str()))
+        .collect::<HashMap<&str, &str>>();
+    let mentioned_app_invocations = explicitly_enabled_connectors
+        .iter()
+        .map(|connector_id| AppInvocation {
+            connector_id: Some(connector_id.clone()),
+            app_name: connector_names_by_id
+                .get(connector_id.as_str())
+                .map(|name| (*name).to_string()),
+            invocation_type: Some(InvocationType::Explicit),
+        })
+        .collect::<Vec<_>>();
+    sess.services
+        .analytics_events_client
+        .track_app_mentioned(tracking.clone(), mentioned_app_invocations);
+    for plugin in mentioned_plugins
+        .iter()
+        .filter_map(crate::plugins::PluginCapabilitySummary::telemetry_metadata)
+    {
+        sess.services
+            .analytics_events_client
+            .track_plugin_used(tracking.clone(), plugin);
+    }
+
+    let mut injection_items = skill_items;
+    injection_items.extend(plugin_items);
+    Some((injection_items, explicitly_enabled_connectors))
+}
+
 async fn track_turn_resolved_config_analytics(
     sess: &Session,
     turn_context: &TurnContext,
@@ -697,6 +616,7 @@ async fn track_turn_resolved_config_analytics(
             model: turn_context.model_info.slug.clone(),
             model_provider: turn_context.config.model_provider_id.clone(),
             permission_profile: turn_context.permission_profile(),
+            #[allow(deprecated)]
             permission_profile_cwd: turn_context.cwd.to_path_buf(),
             reasoning_effort: turn_context.reasoning_effort,
             reasoning_summary: Some(turn_context.reasoning_summary),
@@ -718,27 +638,83 @@ struct PreSamplingCompactResult {
     reset_client_session: bool,
 }
 
+#[derive(Debug)]
+struct AutoCompactTokenStatus {
+    // Full active context usage, independent of the configured auto-compact scope.
+    active_context_tokens: i64,
+    // Usage counted against `model_auto_compact_token_limit` for the current scope.
+    auto_compact_scope_tokens: i64,
+    auto_compact_scope_limit: i64,
+    full_context_window_limit: Option<i64>,
+    auto_compact_window_ordinal: Option<u64>,
+    auto_compact_window_prefill_tokens: Option<i64>,
+    full_context_window_limit_reached: bool,
+    token_limit_reached: bool,
+}
+
+async fn auto_compact_token_status(
+    sess: &Session,
+    turn_context: &TurnContext,
+) -> AutoCompactTokenStatus {
+    let active_context_tokens = sess.get_total_token_usage().await;
+    let mut auto_compact_window_ordinal = None;
+    let mut auto_compact_window_prefill_tokens = None;
+    let (auto_compact_scope_tokens, auto_compact_scope_limit, full_context_window_limit) =
+        match turn_context.config.model_auto_compact_token_limit_scope {
+            AutoCompactTokenLimitScope::Total => (
+                active_context_tokens,
+                turn_context
+                    .model_info
+                    .auto_compact_token_limit()
+                    .unwrap_or(i64::MAX),
+                None,
+            ),
+            AutoCompactTokenLimitScope::BodyAfterPrefix => {
+                let window = sess.auto_compact_window_snapshot().await;
+                auto_compact_window_ordinal = Some(window.ordinal);
+                auto_compact_window_prefill_tokens = window.prefill_input_tokens;
+                let baseline = window.prefill_input_tokens.unwrap_or(active_context_tokens);
+                (
+                    active_context_tokens.saturating_sub(baseline),
+                    turn_context
+                        .config
+                        .model_auto_compact_token_limit
+                        .or_else(|| turn_context.model_info.auto_compact_token_limit())
+                        .unwrap_or(i64::MAX),
+                    turn_context.model_context_window(),
+                )
+            }
+        };
+    let full_context_window_limit_reached =
+        full_context_window_limit.is_some_and(|full_context_window_limit| {
+            active_context_tokens >= full_context_window_limit
+        });
+    let token_limit_reached =
+        auto_compact_scope_tokens >= auto_compact_scope_limit || full_context_window_limit_reached;
+
+    AutoCompactTokenStatus {
+        active_context_tokens,
+        auto_compact_scope_tokens,
+        auto_compact_scope_limit,
+        full_context_window_limit,
+        auto_compact_window_ordinal,
+        auto_compact_window_prefill_tokens,
+        full_context_window_limit_reached,
+        token_limit_reached,
+    }
+}
+
 async fn run_pre_sampling_compact(
     sess: &Arc<Session>,
     turn_context: &Arc<TurnContext>,
     client_session: &mut ModelClientSession,
 ) -> CodexResult<PreSamplingCompactResult> {
-    let total_usage_tokens_before_compaction = sess.get_total_token_usage().await;
-    let mut pre_sampling_compacted = maybe_run_previous_model_inline_compact(
-        sess,
-        turn_context,
-        client_session,
-        total_usage_tokens_before_compaction,
-    )
-    .await?;
+    let mut pre_sampling_compacted =
+        maybe_run_previous_model_inline_compact(sess, turn_context, client_session).await?;
     let mut reset_client_session = pre_sampling_compacted;
-    let total_usage_tokens = sess.get_total_token_usage().await;
-    let auto_compact_limit = turn_context
-        .model_info
-        .auto_compact_token_limit()
-        .unwrap_or(i64::MAX);
-    // Compact if the total usage tokens are greater than the auto compact limit
-    if total_usage_tokens >= auto_compact_limit {
+    let token_status = auto_compact_token_status(sess.as_ref(), turn_context.as_ref()).await;
+    // Compact if the configured auto-compaction budget or usable context window is exhausted.
+    if token_status.token_limit_reached {
         reset_client_session |= run_auto_compact(
             sess,
             turn_context,
@@ -765,7 +741,6 @@ async fn maybe_run_previous_model_inline_compact(
     sess: &Arc<Session>,
     turn_context: &Arc<TurnContext>,
     client_session: &mut ModelClientSession,
-    total_usage_tokens: i64,
 ) -> CodexResult<bool> {
     let Some(previous_turn_settings) = sess.previous_turn_settings().await else {
         return Ok(false);
@@ -782,11 +757,22 @@ async fn maybe_run_previous_model_inline_compact(
     let Some(new_context_window) = turn_context.model_context_window() else {
         return Ok(false);
     };
-    let new_auto_compact_limit = turn_context
-        .model_info
-        .auto_compact_token_limit()
-        .unwrap_or(i64::MAX);
-    let should_run = total_usage_tokens > new_auto_compact_limit
+    let active_context_tokens = sess.get_total_token_usage().await;
+    let previous_model_limit_reached = match turn_context
+        .config
+        .model_auto_compact_token_limit_scope
+    {
+        AutoCompactTokenLimitScope::Total => {
+            let new_auto_compact_limit = turn_context
+                .model_info
+                .auto_compact_token_limit()
+                .unwrap_or(i64::MAX);
+            active_context_tokens > new_auto_compact_limit
+                || active_context_tokens >= new_context_window
+        }
+        AutoCompactTokenLimitScope::BodyAfterPrefix => active_context_tokens >= new_context_window,
+    };
+    let should_run = previous_model_limit_reached
         && previous_model_turn_context.model_info.slug != turn_context.model_info.slug
         && old_context_window > new_context_window;
     if should_run {
@@ -897,82 +883,6 @@ pub(super) fn collect_explicit_app_ids_from_skill_items(
     connector_ids
 }
 
-pub(super) fn filter_connectors_for_input(
-    connectors: &[connectors::AppInfo],
-    input: &[ResponseItem],
-    explicitly_enabled_connectors: &HashSet<String>,
-    skill_name_counts_lower: &HashMap<String, usize>,
-) -> Vec<connectors::AppInfo> {
-    let connectors: Vec<connectors::AppInfo> = connectors
-        .iter()
-        .filter(|connector| connector.is_enabled)
-        .cloned()
-        .collect::<Vec<_>>();
-    if connectors.is_empty() {
-        return Vec::new();
-    }
-
-    let user_messages = collect_user_messages(input);
-    if user_messages.is_empty() && explicitly_enabled_connectors.is_empty() {
-        return Vec::new();
-    }
-
-    let mentions = collect_tool_mentions_from_messages(&user_messages);
-    let mention_names_lower = mentions
-        .plain_names
-        .iter()
-        .map(|name| name.to_ascii_lowercase())
-        .collect::<HashSet<String>>();
-
-    let connector_slug_counts = build_connector_slug_counts(&connectors);
-    let mut allowed_connector_ids = explicitly_enabled_connectors.clone();
-    for path in mentions
-        .paths
-        .iter()
-        .filter(|path| tool_kind_for_path(path) == ToolMentionKind::App)
-    {
-        if let Some(connector_id) = app_id_from_path(path) {
-            allowed_connector_ids.insert(connector_id.to_string());
-        }
-    }
-
-    connectors
-        .into_iter()
-        .filter(|connector| {
-            connector_inserted_in_messages(
-                connector,
-                &mention_names_lower,
-                &allowed_connector_ids,
-                &connector_slug_counts,
-                skill_name_counts_lower,
-            )
-        })
-        .collect()
-}
-
-fn connector_inserted_in_messages(
-    connector: &connectors::AppInfo,
-    mention_names_lower: &HashSet<String>,
-    allowed_connector_ids: &HashSet<String>,
-    connector_slug_counts: &HashMap<String, usize>,
-    skill_name_counts_lower: &HashMap<String, usize>,
-) -> bool {
-    if allowed_connector_ids.contains(&connector.id) {
-        return true;
-    }
-
-    let mention_slug = codex_connectors::metadata::connector_mention_slug(connector);
-    let connector_count = connector_slug_counts
-        .get(&mention_slug)
-        .copied()
-        .unwrap_or(0);
-    let skill_count = skill_name_counts_lower
-        .get(&mention_slug)
-        .copied()
-        .unwrap_or(0);
-    connector_count == 1 && skill_count == 0 && mention_names_lower.contains(&mention_slug)
-}
-
 pub(crate) fn build_prompt(
     input: Vec<ResponseItem>,
     router: &ToolRouter,
@@ -993,6 +903,7 @@ pub(crate) fn build_prompt(
 }
 
 #[allow(clippy::too_many_arguments)]
+#[allow(deprecated)]
 #[instrument(level = "trace",
     skip_all,
     fields(
@@ -1004,23 +915,14 @@ pub(crate) fn build_prompt(
 async fn run_sampling_request(
     sess: Arc<Session>,
     turn_context: Arc<TurnContext>,
+    turn_store: Arc<codex_extension_api::ExtensionData>,
     turn_diff_tracker: SharedTurnDiffTracker,
     client_session: &mut ModelClientSession,
     turn_metadata_header: Option<&str>,
     input: Vec<ResponseItem>,
-    explicitly_enabled_connectors: &HashSet<String>,
-    skills_outcome: Option<&SkillLoadOutcome>,
     cancellation_token: CancellationToken,
 ) -> CodexResult<SamplingRequestResult> {
-    let router = built_tools(
-        sess.as_ref(),
-        turn_context.as_ref(),
-        &input,
-        explicitly_enabled_connectors,
-        skills_outcome,
-        &cancellation_token,
-    )
-    .await?;
+    let router = built_tools(sess.as_ref(), turn_context.as_ref(), &cancellation_token).await?;
 
     let base_instructions = sess.get_base_instructions().await;
 
@@ -1060,6 +962,7 @@ async fn run_sampling_request(
             tool_runtime.clone(),
             Arc::clone(&sess),
             Arc::clone(&turn_context),
+            Arc::clone(&turn_store),
             client_session,
             turn_metadata_header,
             Arc::clone(&turn_diff_tracker),
@@ -1149,9 +1052,6 @@ async fn run_sampling_request(
 pub(crate) async fn built_tools(
     sess: &Session,
     turn_context: &TurnContext,
-    input: &[ResponseItem],
-    explicitly_enabled_connectors: &HashSet<String>,
-    skills_outcome: Option<&SkillLoadOutcome>,
     cancellation_token: &CancellationToken,
 ) -> CodexResult<Arc<ToolRouter>> {
     let mcp_connection_manager = sess.services.mcp_connection_manager.read().await;
@@ -1167,9 +1067,6 @@ pub(crate) async fn built_tools(
         .plugins_for_config(&turn_context.config.plugins_config_input())
         .await;
 
-    let mut effective_explicitly_enabled_connectors = explicitly_enabled_connectors.clone();
-    effective_explicitly_enabled_connectors.extend(sess.get_connector_selection().await);
-
     let apps_enabled = turn_context.apps_enabled();
     let accessible_connectors =
         apps_enabled.then(|| connectors::accessible_connectors_from_mcp_tools(&all_mcp_tools));
@@ -1193,7 +1090,7 @@ pub(crate) async fn built_tools(
         None
     };
     let auth = sess.services.auth_manager.auth().await;
-    let discoverable_tools = if apps_enabled && turn_context.tools_config.tool_suggest {
+    let discoverable_tools = if apps_enabled && tool_suggest_enabled(turn_context) {
         if let Some(accessible_connectors) = accessible_connectors_with_enabled_state.as_ref() {
             match connectors::list_tool_suggest_discoverable_tools_with_auth(
                 &turn_context.config,
@@ -1221,31 +1118,16 @@ pub(crate) async fn built_tools(
         None
     };
 
-    let explicitly_enabled = if let Some(connectors) = connectors.as_ref() {
-        let skill_name_counts_lower = skills_outcome.map_or_else(HashMap::new, |outcome| {
-            build_skill_name_counts(&outcome.skills, &outcome.disabled_paths).1
-        });
-
-        filter_connectors_for_input(
-            connectors,
-            input,
-            &effective_explicitly_enabled_connectors,
-            &skill_name_counts_lower,
-        )
-    } else {
-        Vec::new()
-    };
     let mcp_tool_exposure = build_mcp_tool_exposure(
         &all_mcp_tools,
         connectors.as_deref(),
-        explicitly_enabled.as_slice(),
         &turn_context.config,
-        &turn_context.tools_config,
+        search_tool_enabled(turn_context),
     );
     let mcp_tools = has_mcp_servers.then_some(mcp_tool_exposure.direct_tools);
     let deferred_mcp_tools = mcp_tool_exposure.deferred_tools;
-    Ok(Arc::new(ToolRouter::from_config(
-        &turn_context.tools_config,
+    Ok(Arc::new(ToolRouter::from_turn_context(
+        turn_context,
         ToolRouterParams {
             mcp_tools,
             deferred_mcp_tools,
@@ -1452,6 +1334,7 @@ pub(super) fn realtime_text_for_event(msg: &EventMsg) -> Option<String> {
         | EventMsg::ContextCompacted(_)
         | EventMsg::ThreadRolledBack(_)
         | EventMsg::TurnStarted(_)
+        | EventMsg::ThreadSettingsApplied(_)
         | EventMsg::TurnComplete(_)
         | EventMsg::TokenCount(_)
         | EventMsg::UserMessage(_)
@@ -1742,6 +1625,7 @@ async fn emit_turn_item_in_plan_mode(
 async fn handle_assistant_item_done_in_plan_mode(
     sess: &Session,
     turn_context: &TurnContext,
+    turn_store: &codex_extension_api::ExtensionData,
     item: &ResponseItem,
     state: &mut PlanModeStreamState,
     previously_active_item: Option<&TurnItem>,
@@ -1752,21 +1636,38 @@ async fn handle_assistant_item_done_in_plan_mode(
     {
         maybe_complete_plan_item_from_message(sess, turn_context, state, item).await;
 
-        if let Some(turn_item) =
-            handle_non_tool_response_item(sess, turn_context, item, /*plan_mode*/ true).await
+        let mut finalized_facts = None;
+        if let Some(finalized_turn_item) = finalize_non_tool_response_item(
+            sess,
+            turn_context,
+            TurnItemContributorPolicy::Run(turn_store),
+            item,
+            /*plan_mode*/ true,
+        )
+        .await
         {
+            finalized_facts = Some(finalized_turn_item.facts.clone());
             emit_turn_item_in_plan_mode(
                 sess,
                 turn_context,
-                turn_item,
+                finalized_turn_item.turn_item,
                 previously_active_item,
                 state,
             )
             .await;
         }
+        let final_last_agent_message = finalized_facts
+            .as_ref()
+            .and_then(|facts| facts.last_agent_message.clone());
 
-        record_completed_response_item(sess, turn_context, item).await;
-        if let Some(agent_message) = last_assistant_message_from_item(item, /*plan_mode*/ true) {
+        record_completed_response_item_with_finalized_facts(
+            sess,
+            turn_context,
+            item,
+            finalized_facts.as_ref(),
+        )
+        .await;
+        if let Some(agent_message) = final_last_agent_message {
             *last_agent_message = Some(agent_message);
         }
         return true;
@@ -1812,6 +1713,7 @@ async fn try_run_sampling_request(
     tool_runtime: ToolCallRuntime,
     sess: Arc<Session>,
     turn_context: Arc<TurnContext>,
+    turn_store: Arc<codex_extension_api::ExtensionData>,
     client_session: &mut ModelClientSession,
     turn_metadata_header: Option<&str>,
     turn_diff_tracker: SharedTurnDiffTracker,
@@ -1860,6 +1762,9 @@ async fn try_run_sampling_request(
     let plan_mode = turn_context.collaboration_mode.mode == ModeKind::Plan;
     let mut assistant_message_stream_parsers = AssistantMessageStreamParsers::new(plan_mode);
     let mut plan_mode_state = plan_mode.then(|| PlanModeStreamState::new(&turn_context.sub_id));
+    let defer_streamed_turn_items_for_contributors =
+        !sess.services.extensions.turn_item_contributors().is_empty();
+    let mut active_item_is_streaming_to_client = false;
     let receiving_span = trace_span!("receiving_stream");
     let mut completed_response_id: Option<String> = None;
     let outcome: CodexResult<SamplingRequestResult> = loop {
@@ -1912,7 +1817,13 @@ async fn try_run_sampling_request(
                     sess.send_event(&turn_context, event).await;
                 }
                 let previously_active_item = active_item.take();
-                if let Some(previous) = previously_active_item.as_ref()
+                let previously_streamed_item = if active_item_is_streaming_to_client {
+                    previously_active_item
+                } else {
+                    None
+                };
+                active_item_is_streaming_to_client = false;
+                if let Some(previous) = previously_streamed_item.as_ref()
                     && matches!(previous, TurnItem::AgentMessage(_))
                 {
                     let item_id = previous.id();
@@ -1929,9 +1840,10 @@ async fn try_run_sampling_request(
                     && handle_assistant_item_done_in_plan_mode(
                         &sess,
                         &turn_context,
+                        turn_store.as_ref(),
                         &item,
                         state,
-                        previously_active_item.as_ref(),
+                        previously_streamed_item.as_ref(),
                         &mut last_agent_message,
                     )
                     .await
@@ -1942,6 +1854,7 @@ async fn try_run_sampling_request(
                 let mut ctx = HandleOutputCtx {
                     sess: sess.clone(),
                     turn_context: turn_context.clone(),
+                    turn_store: Arc::clone(&turn_store),
                     tool_runtime: tool_runtime.clone(),
                     cancellation_token: cancellation_token.child_token(),
                 };
@@ -1961,12 +1874,13 @@ async fn try_run_sampling_request(
                     | ResponseItem::WebSearchCall { .. }
                     | ResponseItem::ImageGenerationCall { .. }
                     | ResponseItem::Compaction { .. }
+                    | ResponseItem::CompactionTrigger
                     | ResponseItem::ContextCompaction { .. }
                     | ResponseItem::Other => false,
                 };
 
                 let output_result =
-                    match handle_output_item_done(&mut ctx, item, previously_active_item)
+                    match handle_output_item_done(&mut ctx, item, previously_streamed_item)
                         .instrument(handle_responses)
                         .await
                     {
@@ -1981,7 +1895,7 @@ async fn try_run_sampling_request(
                 }
                 needs_follow_up |= output_result.needs_follow_up;
                 // todo: remove before stabilizing multi-agent v2
-                if preempt_for_mailbox_mail && sess.mailbox_rx.lock().await.has_pending() {
+                if preempt_for_mailbox_mail && sess.input_queue.has_pending_mailbox_items().await {
                     break Ok(SamplingRequestResult {
                         needs_follow_up: true,
                         last_agent_message,
@@ -2000,15 +1914,18 @@ async fn try_run_sampling_request(
                 if let Some(turn_item) = handle_non_tool_response_item(
                     sess.as_ref(),
                     turn_context.as_ref(),
+                    TurnItemContributorPolicy::Skip,
                     &item,
                     plan_mode,
                 )
                 .await
                 {
                     let mut turn_item = turn_item;
+                    let stream_item_to_client = !defer_streamed_turn_items_for_contributors;
                     let mut seeded_parsed: Option<ParsedAssistantTextDelta> = None;
                     let mut seeded_item_id: Option<String> = None;
-                    if matches!(turn_item, TurnItem::AgentMessage(_))
+                    if stream_item_to_client
+                        && matches!(turn_item, TurnItem::AgentMessage(_))
                         && let Some(raw_text) = raw_assistant_output_text_from_item(&item)
                     {
                         let item_id = turn_item.id();
@@ -2027,31 +1944,34 @@ async fn try_run_sampling_request(
                         seeded_parsed = plan_mode.then_some(seeded);
                         seeded_item_id = Some(item_id);
                     }
-                    if let Some(state) = plan_mode_state.as_mut()
-                        && matches!(turn_item, TurnItem::AgentMessage(_))
-                    {
-                        let item_id = turn_item.id();
-                        state
-                            .pending_agent_message_items
-                            .insert(item_id, turn_item.clone());
-                    } else {
-                        sess.emit_turn_item_started(&turn_context, &turn_item).await;
-                    }
-                    if let (Some(state), Some(item_id), Some(parsed)) = (
-                        plan_mode_state.as_mut(),
-                        seeded_item_id.as_deref(),
-                        seeded_parsed,
-                    ) {
-                        emit_streamed_assistant_text_delta(
-                            &sess,
-                            &turn_context,
-                            Some(state),
-                            item_id,
-                            parsed,
-                        )
-                        .await;
+                    if stream_item_to_client {
+                        if let Some(state) = plan_mode_state.as_mut()
+                            && matches!(turn_item, TurnItem::AgentMessage(_))
+                        {
+                            let item_id = turn_item.id();
+                            state
+                                .pending_agent_message_items
+                                .insert(item_id, turn_item.clone());
+                        } else {
+                            sess.emit_turn_item_started(&turn_context, &turn_item).await;
+                        }
+                        if let (Some(state), Some(item_id), Some(parsed)) = (
+                            plan_mode_state.as_mut(),
+                            seeded_item_id.as_deref(),
+                            seeded_parsed,
+                        ) {
+                            emit_streamed_assistant_text_delta(
+                                &sess,
+                                &turn_context,
+                                Some(state),
+                                item_id,
+                                parsed,
+                            )
+                            .await;
+                        }
                     }
                     active_item = Some(turn_item);
+                    active_item_is_streaming_to_client = stream_item_to_client;
                 }
             }
             ResponseEvent::ServerModel(server_model) => {
@@ -2118,6 +2038,9 @@ async fn try_run_sampling_request(
                 // In review child threads, suppress assistant text deltas; the
                 // UI will show a selection popup from the final ReviewOutput.
                 if let Some(active) = active_item.as_ref() {
+                    if !active_item_is_streaming_to_client {
+                        continue;
+                    }
                     let item_id = active.id();
                     if matches!(active, TurnItem::AgentMessage(_)) {
                         let parsed = assistant_message_stream_parsers.parse_delta(&item_id, &delta);
@@ -2166,6 +2089,9 @@ async fn try_run_sampling_request(
                 summary_index,
             } => {
                 if let Some(active) = active_item.as_ref() {
+                    if !active_item_is_streaming_to_client {
+                        continue;
+                    }
                     let event = ReasoningContentDeltaEvent {
                         thread_id: sess.conversation_id.to_string(),
                         turn_id: turn_context.sub_id.clone(),
@@ -2181,6 +2107,9 @@ async fn try_run_sampling_request(
             }
             ResponseEvent::ReasoningSummaryPartAdded { summary_index } => {
                 if let Some(active) = active_item.as_ref() {
+                    if !active_item_is_streaming_to_client {
+                        continue;
+                    }
                     let event =
                         EventMsg::AgentReasoningSectionBreak(AgentReasoningSectionBreakEvent {
                             item_id: active.id(),
@@ -2196,6 +2125,9 @@ async fn try_run_sampling_request(
                 content_index,
             } => {
                 if let Some(active) = active_item.as_ref() {
+                    if !active_item_is_streaming_to_client {
+                        continue;
+                    }
                     let event = ReasoningRawContentDeltaEvent {
                         thread_id: sess.conversation_id.to_string(),
                         turn_id: turn_context.sub_id.clone(),
@@ -2265,3 +2197,7 @@ pub(crate) fn get_last_assistant_message_from_turn(responses: &[ResponseItem]) -
     }
     None
 }
+
+#[cfg(test)]
+#[path = "turn_tests.rs"]
+mod tests;
diff --git a/codex-rs/core/src/session/turn_context.rs b/codex-rs/core/src/session/turn_context.rs
index 12a1ccb79d..3338d0a558 100644
--- a/codex-rs/core/src/session/turn_context.rs
+++ b/codex-rs/core/src/session/turn_context.rs
@@ -14,10 +14,6 @@ use codex_sandboxing::policy_transforms::effective_network_sandbox_policy;
 use std::sync::atomic::AtomicBool;
 use std::sync::atomic::Ordering;
 
-pub(super) fn image_generation_tool_auth_allowed(auth_manager: Option<&AuthManager>) -> bool {
-    auth_manager.is_some_and(AuthManager::current_auth_uses_codex_backend)
-}
-
 #[derive(Clone, Debug)]
 pub(crate) struct TurnSkillsContext {
     pub(crate) outcome: Arc<SkillLoadOutcome>,
@@ -69,6 +65,7 @@ pub struct TurnContext {
     /// The session's absolute working directory. All relative paths provided
     /// by the model as well as sandbox policies are resolved against this path
     /// instead of `std::env::current_dir()`.
+    #[deprecated(note = "use the selected turn environment cwd instead")]
     pub(crate) cwd: AbsolutePathBuf,
     pub(crate) current_date: Option<String>,
     pub(crate) timezone: Option<String>,
@@ -83,7 +80,9 @@ pub struct TurnContext {
     pub(crate) network: Option<NetworkProxy>,
     pub(crate) windows_sandbox_level: WindowsSandboxLevel,
     pub(crate) shell_environment_policy: ShellEnvironmentPolicy,
-    pub(crate) tools_config: ToolsConfig,
+    pub(crate) available_models: Vec<ModelPreset>,
+    pub(crate) unified_exec_shell_mode: UnifiedExecShellMode,
+    pub(crate) goal_tools_supported: bool,
     pub features: ManagedFeatures,
     pub(crate) ghost_snapshot: GhostSnapshotConfig,
     pub(crate) final_output_json_schema: Option<Value>,
@@ -118,6 +117,7 @@ impl TurnContext {
             &self.permission_profile,
             &file_system_sandbox_policy,
             network_sandbox_policy,
+            #[allow(deprecated)]
             &self.cwd,
         )
     }
@@ -154,6 +154,14 @@ impl TurnContext {
         self.features.apps_enabled_for_auth(uses_codex_backend)
     }
 
+    pub(crate) fn tool_environment_mode(&self) -> ToolEnvironmentMode {
+        ToolEnvironmentMode::from_count(self.environments.turn_environments.len())
+    }
+
+    pub(crate) fn goal_tools_enabled(&self) -> bool {
+        self.goal_tools_supported && self.features.get().enabled(Feature::Goals)
+    }
+
     pub(crate) async fn with_model(
         &self,
         model: String,
@@ -193,47 +201,9 @@ impl TurnContext {
             /*developer_instructions*/ None,
         );
         let features = self.features.clone();
-        let provider_capabilities = self.provider.capabilities();
-        let tools_config = ToolsConfig::new(&ToolsConfigParams {
-            model_info: &model_info,
-            available_models: &models_manager
-                .list_models(RefreshStrategy::OnlineIfUncached)
-                .await,
-            features: &features,
-            image_generation_tool_auth_allowed: image_generation_tool_auth_allowed(
-                self.auth_manager.as_deref(),
-            ),
-            web_search_mode: self.tools_config.web_search_mode,
-            session_source: self.session_source.clone(),
-            permission_profile: &self.permission_profile,
-            windows_sandbox_level: self.windows_sandbox_level,
-        })
-        .with_namespace_tools_capability(provider_capabilities.namespace_tools)
-        .with_image_generation_capability(provider_capabilities.image_generation)
-        .with_web_search_capability(provider_capabilities.web_search)
-        .with_unified_exec_shell_mode(self.tools_config.unified_exec_shell_mode.clone())
-        .with_web_search_config(self.tools_config.web_search_config.clone())
-        .with_allow_login_shell(self.tools_config.allow_login_shell)
-        .with_environment_mode(self.tools_config.environment_mode)
-        .with_spawn_agent_usage_hint(config.multi_agent_v2.usage_hint_enabled)
-        .with_spawn_agent_usage_hint_text(config.multi_agent_v2.usage_hint_text.clone())
-        .with_hide_spawn_agent_metadata(config.multi_agent_v2.hide_spawn_agent_metadata)
-        .with_goal_tools_allowed(self.tools_config.goal_tools)
-        .with_max_concurrent_threads_per_session(
-            config
-                .features
-                .enabled(Feature::MultiAgentV2)
-                .then_some(config.multi_agent_v2.max_concurrent_threads_per_session),
-        )
-        .with_wait_agent_min_timeout_ms(
-            config
-                .features
-                .enabled(Feature::MultiAgentV2)
-                .then_some(config.multi_agent_v2.min_wait_timeout_ms),
-        )
-        .with_agent_type_description(crate::agent::role::spawn_tool_spec::build(
-            &config.agent_roles,
-        ));
+        let available_models = models_manager
+            .list_models(RefreshStrategy::OnlineIfUncached)
+            .await;
 
         Self {
             sub_id: self.sub_id.clone(),
@@ -252,6 +222,7 @@ impl TurnContext {
             session_source: self.session_source.clone(),
             thread_source: self.thread_source,
             environments: self.environments.clone(),
+            #[allow(deprecated)]
             cwd: self.cwd.clone(),
             current_date: self.current_date.clone(),
             timezone: self.timezone.clone(),
@@ -266,7 +237,9 @@ impl TurnContext {
             network: self.network.clone(),
             windows_sandbox_level: self.windows_sandbox_level,
             shell_environment_policy: self.shell_environment_policy.clone(),
-            tools_config,
+            available_models,
+            unified_exec_shell_mode: self.unified_exec_shell_mode.clone(),
+            goal_tools_supported: self.goal_tools_supported,
             features,
             ghost_snapshot: self.ghost_snapshot.clone(),
             final_output_json_schema: self.final_output_json_schema.clone(),
@@ -287,7 +260,9 @@ impl TurnContext {
         }
     }
 
+    #[deprecated(note = "resolve paths from the selected turn environment cwd instead")]
     pub(crate) fn resolve_path(&self, path: Option<String>) -> AbsolutePathBuf {
+        #[allow(deprecated)]
         path.as_ref()
             .map_or_else(|| self.cwd.clone(), |path| self.cwd.join(path))
     }
@@ -295,6 +270,7 @@ impl TurnContext {
     pub(crate) fn file_system_sandbox_context(
         &self,
         additional_permissions: Option<AdditionalPermissionProfile>,
+        cwd: &AbsolutePathBuf,
     ) -> FileSystemSandboxContext {
         let (base_file_system_sandbox_policy, base_network_sandbox_policy) =
             self.permission_profile.to_runtime_permissions();
@@ -313,7 +289,7 @@ impl TurnContext {
         );
         FileSystemSandboxContext {
             permissions,
-            cwd: Some(self.cwd.clone()),
+            cwd: Some(cwd.clone()),
             windows_sandbox_level: self.windows_sandbox_level,
             windows_sandbox_private_desktop: self
                 .config
@@ -331,6 +307,7 @@ impl TurnContext {
         let legacy_file_system_sandbox_policy =
             FileSystemSandboxPolicy::from_legacy_sandbox_policy_for_cwd(
                 &self.sandbox_policy(),
+                #[allow(deprecated)]
                 &self.cwd,
             );
         let file_system_sandbox_policy = self.file_system_sandbox_policy();
@@ -347,7 +324,7 @@ impl TurnContext {
     pub(crate) fn to_turn_context_item(&self) -> TurnContextItem {
         TurnContextItem {
             turn_id: Some(self.sub_id.clone()),
-            trace_id: self.trace_id.clone(),
+            #[allow(deprecated)]
             cwd: self.cwd.to_path_buf(),
             current_date: self.current_date.clone(),
             timezone: self.timezone.clone(),
@@ -361,11 +338,7 @@ impl TurnContext {
             collaboration_mode: Some(self.collaboration_mode.clone()),
             realtime_active: Some(self.realtime_active),
             effort: self.reasoning_effort,
-            summary: self.reasoning_summary,
-            user_instructions: self.user_instructions.clone(),
-            developer_instructions: self.developer_instructions.clone(),
-            final_output_json_schema: self.final_output_json_schema.clone(),
-            truncation_policy: Some(self.truncation_policy),
+            summary: ReasoningSummaryConfig::Auto,
         }
     }
 
@@ -411,14 +384,18 @@ impl Session {
         let config = session_configuration.original_config_do_not_use.clone();
         let mut per_turn_config = (*config).clone();
         per_turn_config.cwd = cwd;
+        per_turn_config.workspace_roots = session_configuration.workspace_roots.clone();
+        per_turn_config
+            .permissions
+            .set_workspace_roots(session_configuration.workspace_roots.clone());
         per_turn_config.model_reasoning_effort =
             session_configuration.collaboration_mode.reasoning_effort();
         per_turn_config.model_reasoning_summary = session_configuration.model_reasoning_summary;
         per_turn_config.service_tier = session_configuration.service_tier.clone();
         per_turn_config.personality = session_configuration.personality;
         per_turn_config.approvals_reviewer = session_configuration.approvals_reviewer;
-        per_turn_config.permissions.permission_profile =
-            session_configuration.permission_profile.clone();
+        session_configuration
+            .apply_permission_profile_to_permissions(&mut per_turn_config.permissions);
         let permission_profile = session_configuration.permission_profile();
         let resolved_web_search_mode =
             resolve_web_search_mode_for_turn(&per_turn_config.web_search_mode, &permission_profile);
@@ -445,8 +422,10 @@ impl Session {
             Self::build_per_turn_config(session_configuration, session_configuration.cwd.clone());
         config.model = Some(session_configuration.collaboration_mode.model().to_string());
         config.permissions.approval_policy = session_configuration.approval_policy.clone();
-        config.permissions.active_permission_profile =
-            session_configuration.active_permission_profile.clone();
+        config.workspace_roots = session_configuration.workspace_roots.clone();
+        config
+            .permissions
+            .set_workspace_roots(session_configuration.workspace_roots.clone());
         config
     }
 
@@ -480,58 +459,18 @@ impl Session {
             model_info.slug.as_str(),
         );
         let session_source = session_configuration.session_source.clone();
-        let image_generation_tool_auth_allowed =
-            image_generation_tool_auth_allowed(auth_manager.as_deref());
         let auth_manager_for_context = auth_manager.clone();
         let provider_for_context = create_model_provider(provider, auth_manager);
-        let provider_capabilities = provider_for_context.capabilities();
         let session_telemetry_for_context = session_telemetry;
-        let tools_config = ToolsConfig::new(&ToolsConfigParams {
-            model_info: &model_info,
-            available_models: &models_manager.try_list_models().unwrap_or_default(),
-            features: &per_turn_config.features,
-            image_generation_tool_auth_allowed,
-            web_search_mode: Some(per_turn_config.web_search_mode.value()),
-            session_source: session_source.clone(),
-            permission_profile: &session_configuration.permission_profile(),
-            windows_sandbox_level: session_configuration.windows_sandbox_level,
-        })
-        .with_namespace_tools_capability(provider_capabilities.namespace_tools)
-        .with_image_generation_capability(provider_capabilities.image_generation)
-        .with_web_search_capability(provider_capabilities.web_search)
-        .with_unified_exec_shell_mode_for_session(
-            crate::tools::spec::tool_user_shell_type(user_shell),
+        let available_models = models_manager.try_list_models().unwrap_or_default();
+        let shell_command_backend =
+            shell_command_backend_for_features(per_turn_config.features.get());
+        let unified_exec_shell_mode = UnifiedExecShellMode::for_session(
+            shell_command_backend,
+            crate::tools::tool_user_shell_type(user_shell),
             shell_zsh_path,
             main_execve_wrapper_exe,
-        )
-        .with_web_search_config(per_turn_config.web_search_config.clone())
-        .with_allow_login_shell(per_turn_config.permissions.allow_login_shell)
-        .with_environment_mode(ToolEnvironmentMode::from_count(
-            environments.turn_environments.len(),
-        ))
-        .with_spawn_agent_usage_hint(per_turn_config.multi_agent_v2.usage_hint_enabled)
-        .with_spawn_agent_usage_hint_text(per_turn_config.multi_agent_v2.usage_hint_text.clone())
-        .with_hide_spawn_agent_metadata(per_turn_config.multi_agent_v2.hide_spawn_agent_metadata)
-        .with_goal_tools_allowed(goal_tools_supported)
-        .with_max_concurrent_threads_per_session(
-            per_turn_config
-                .features
-                .enabled(Feature::MultiAgentV2)
-                .then_some(
-                    per_turn_config
-                        .multi_agent_v2
-                        .max_concurrent_threads_per_session,
-                ),
-        )
-        .with_wait_agent_min_timeout_ms(
-            per_turn_config
-                .features
-                .enabled(Feature::MultiAgentV2)
-                .then_some(per_turn_config.multi_agent_v2.min_wait_timeout_ms),
-        )
-        .with_agent_type_description(crate::agent::role::spawn_tool_spec::build(
-            &per_turn_config.agent_roles,
-        ));
+        );
 
         let mut per_turn_config = per_turn_config;
         per_turn_config.service_tier = per_turn_config
@@ -564,6 +503,7 @@ impl Session {
             session_source,
             thread_source: session_configuration.thread_source,
             environments,
+            #[allow(deprecated)]
             cwd,
             current_date: Some(current_date),
             timezone: Some(timezone),
@@ -578,7 +518,9 @@ impl Session {
             network,
             windows_sandbox_level: session_configuration.windows_sandbox_level,
             shell_environment_policy: per_turn_config.permissions.shell_environment_policy.clone(),
-            tools_config,
+            available_models,
+            unified_exec_shell_mode,
+            goal_tools_supported,
             features: per_turn_config.features.clone(),
             ghost_snapshot: per_turn_config.ghost_snapshot.clone(),
             final_output_json_schema: None,
diff --git a/codex-rs/core/src/session/turn_tests.rs b/codex-rs/core/src/session/turn_tests.rs
new file mode 100644
index 0000000000..f1cf86b46c
--- /dev/null
+++ b/codex-rs/core/src/session/turn_tests.rs
@@ -0,0 +1,67 @@
+use super::*;
+use codex_extension_api::ExtensionData;
+use codex_extension_api::TurnItemContributionFuture;
+use codex_extension_api::TurnItemContributor;
+use codex_protocol::items::AgentMessageContent;
+use pretty_assertions::assert_eq;
+use std::sync::Arc;
+
+struct RewriteAgentMessageContributor;
+
+impl TurnItemContributor for RewriteAgentMessageContributor {
+    fn contribute<'a>(
+        &'a self,
+        _thread_store: &'a ExtensionData,
+        _turn_store: &'a ExtensionData,
+        item: &'a mut TurnItem,
+    ) -> TurnItemContributionFuture<'a> {
+        Box::pin(async move {
+            if let TurnItem::AgentMessage(agent_message) = item {
+                agent_message.content = vec![AgentMessageContent::Text {
+                    text: "plan contributed assistant text".to_string(),
+                }];
+            }
+            Ok(())
+        })
+    }
+}
+
+fn assistant_output_text(text: &str) -> ResponseItem {
+    ResponseItem::Message {
+        id: Some("msg-1".to_string()),
+        role: "assistant".to_string(),
+        content: vec![ContentItem::OutputText {
+            text: text.to_string(),
+        }],
+        phase: None,
+    }
+}
+
+#[tokio::test]
+async fn plan_mode_uses_contributed_turn_item_for_last_agent_message() {
+    let (mut session, turn_context) = crate::session::tests::make_session_and_context().await;
+    let mut builder = codex_extension_api::ExtensionRegistryBuilder::new();
+    builder.turn_item_contributor(Arc::new(RewriteAgentMessageContributor));
+    session.services.extensions = Arc::new(builder.build());
+    let turn_store = ExtensionData::new(turn_context.sub_id.clone());
+    let mut state = PlanModeStreamState::new(&turn_context.sub_id);
+    let mut last_agent_message = None;
+    let item = assistant_output_text("original assistant text");
+
+    let handled = handle_assistant_item_done_in_plan_mode(
+        &session,
+        &turn_context,
+        &turn_store,
+        &item,
+        &mut state,
+        /*previously_active_item*/ None,
+        &mut last_agent_message,
+    )
+    .await;
+
+    assert!(handled);
+    assert_eq!(
+        last_agent_message.as_deref(),
+        Some("plan contributed assistant text")
+    );
+}
diff --git a/codex-rs/core/src/session_startup_prewarm.rs b/codex-rs/core/src/session_startup_prewarm.rs
index 0fac4b1c9a..ca21e3ea72 100644
--- a/codex-rs/core/src/session_startup_prewarm.rs
+++ b/codex-rs/core/src/session_startup_prewarm.rs
@@ -1,4 +1,3 @@
-use std::collections::HashSet;
 use std::sync::Arc;
 use std::time::Duration;
 use std::time::Instant;
@@ -235,9 +234,6 @@ async fn schedule_startup_prewarm_inner(
     let startup_router = built_tools(
         session.as_ref(),
         startup_turn_context.as_ref(),
-        &[],
-        &HashSet::new(),
-        /*skills_outcome*/ None,
         &startup_cancellation_token,
     )
     .await?;
diff --git a/codex-rs/core/src/skills.rs b/codex-rs/core/src/skills.rs
index 2cceb2be36..d540cd6d43 100644
--- a/codex-rs/core/src/skills.rs
+++ b/codex-rs/core/src/skills.rs
@@ -1,8 +1,3 @@
-use std::collections::HashMap;
-use std::collections::HashSet;
-use std::env;
-use std::sync::Arc;
-
 use crate::config::Config;
 use crate::session::session::Session;
 use crate::session::turn_context::TurnContext;
@@ -10,14 +5,9 @@ use codex_analytics::InvocationType;
 use codex_analytics::SkillInvocation;
 use codex_analytics::build_track_events_context;
 use codex_protocol::protocol::SkillScope;
-use codex_protocol::request_user_input::RequestUserInputArgs;
-use codex_protocol::request_user_input::RequestUserInputQuestion;
-use codex_protocol::request_user_input::RequestUserInputResponse;
 use codex_utils_absolute_path::AbsolutePathBuf;
 use codex_utils_plugins::PluginSkillRoot;
-use tracing::warn;
 
-pub use codex_core_skills::SkillDependencyInfo;
 pub use codex_core_skills::SkillError;
 pub use codex_core_skills::SkillLoadOutcome;
 pub use codex_core_skills::SkillMetadata;
@@ -27,7 +17,6 @@ pub use codex_core_skills::SkillsLoadInput;
 pub use codex_core_skills::SkillsManager;
 pub use codex_core_skills::build_available_skills;
 pub use codex_core_skills::build_skill_name_counts;
-pub use codex_core_skills::collect_env_var_dependencies;
 pub use codex_core_skills::config_rules;
 pub use codex_core_skills::default_skill_metadata_budget;
 pub use codex_core_skills::detect_implicit_skill_invocation_for_command;
@@ -56,121 +45,6 @@ pub(crate) fn skills_load_input_from_config(
     )
 }
 
-pub(crate) async fn resolve_skill_dependencies_for_turn(
-    sess: &Arc<Session>,
-    turn_context: &Arc<TurnContext>,
-    dependencies: &[SkillDependencyInfo],
-) {
-    if dependencies.is_empty() {
-        return;
-    }
-
-    let existing_env = sess.dependency_env().await;
-    let mut loaded_values = HashMap::new();
-    let mut missing = Vec::new();
-    let mut seen_names = HashSet::new();
-
-    for dependency in dependencies {
-        let name = dependency.name.clone();
-        if !seen_names.insert(name.clone()) || existing_env.contains_key(&name) {
-            continue;
-        }
-        match env::var(&name) {
-            Ok(value) => {
-                loaded_values.insert(name.clone(), value);
-            }
-            Err(env::VarError::NotPresent) => {
-                missing.push(dependency.clone());
-            }
-            Err(err) => {
-                warn!("failed to read env var {name}: {err}");
-                missing.push(dependency.clone());
-            }
-        }
-    }
-
-    if !loaded_values.is_empty() {
-        sess.set_dependency_env(loaded_values).await;
-    }
-
-    if !missing.is_empty() {
-        request_skill_dependencies(sess, turn_context, &missing).await;
-    }
-}
-
-async fn request_skill_dependencies(
-    sess: &Arc<Session>,
-    turn_context: &Arc<TurnContext>,
-    dependencies: &[SkillDependencyInfo],
-) {
-    let questions = dependencies
-        .iter()
-        .map(|dependency| {
-            let requirement = dependency.description.as_ref().map_or_else(
-                || {
-                    format!(
-                        "The skill \"{}\" requires \"{}\" to be set.",
-                        dependency.skill_name, dependency.name
-                    )
-                },
-                |description| {
-                    format!(
-                        "The skill \"{}\" requires \"{}\" to be set ({}).",
-                        dependency.skill_name, dependency.name, description
-                    )
-                },
-            );
-            RequestUserInputQuestion {
-                id: dependency.name.clone(),
-                header: "Skill requires environment variable".to_string(),
-                question: format!(
-                    "{requirement} This is an experimental internal feature. The value is stored in memory for this session only."
-                ),
-                is_other: false,
-                is_secret: true,
-                options: None,
-            }
-        })
-        .collect::<Vec<_>>();
-    if questions.is_empty() {
-        return;
-    }
-
-    let response = sess
-        .request_user_input(
-            turn_context,
-            format!("skill-deps-{}", turn_context.sub_id),
-            RequestUserInputArgs { questions },
-        )
-        .await
-        .unwrap_or_else(|| RequestUserInputResponse {
-            answers: HashMap::new(),
-        });
-    if response.answers.is_empty() {
-        return;
-    }
-
-    let mut values = HashMap::new();
-    for (name, answer) in response.answers {
-        let mut user_note = None;
-        for entry in &answer.answers {
-            if let Some(note) = entry.strip_prefix("user_note: ")
-                && !note.trim().is_empty()
-            {
-                user_note = Some(note.trim().to_string());
-            }
-        }
-        if let Some(value) = user_note {
-            values.insert(name, value);
-        }
-    }
-    if values.is_empty() {
-        return;
-    }
-
-    sess.set_dependency_env(values).await;
-}
-
 pub(crate) async fn maybe_emit_implicit_skill_invocation(
     sess: &Session,
     turn_context: &TurnContext,
diff --git a/codex-rs/core/src/state/auto_compact_window.rs b/codex-rs/core/src/state/auto_compact_window.rs
new file mode 100644
index 0000000000..d1deb3c288
--- /dev/null
+++ b/codex-rs/core/src/state/auto_compact_window.rs
@@ -0,0 +1,145 @@
+use codex_protocol::protocol::TokenUsage;
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) struct AutoCompactWindowSnapshot {
+    pub(crate) ordinal: u64,
+    pub(crate) prefill_input_tokens: Option<i64>,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+enum AutoCompactWindowPrefill {
+    ServerObserved(i64),
+    Estimated(i64),
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(super) struct AutoCompactWindow {
+    ordinal: u64,
+    /// Absolute input-token baseline for the current compaction window.
+    ///
+    /// `body_after_prefix` subtracts this from later active-context usage. It is
+    /// not the growth itself; server-observed usage replaces estimated
+    /// resume/recompute baselines when available.
+    prefill_input_tokens: Option<AutoCompactWindowPrefill>,
+}
+
+impl AutoCompactWindow {
+    pub(super) fn new() -> Self {
+        Self {
+            ordinal: 1,
+            prefill_input_tokens: None,
+        }
+    }
+
+    pub(super) fn clear_prefill(&mut self) {
+        self.prefill_input_tokens = None;
+    }
+
+    pub(super) fn start_next(&mut self) {
+        self.ordinal = self.ordinal.saturating_add(1);
+        self.clear_prefill();
+    }
+
+    /// Records the request-input side of the first server usage sample. The
+    /// sampled output from that response is body growth and should remain
+    /// counted against the scoped auto-compact budget.
+    pub(super) fn ensure_server_observed_prefill_from_usage(&mut self, usage: &TokenUsage) {
+        if matches!(
+            self.prefill_input_tokens,
+            Some(AutoCompactWindowPrefill::ServerObserved(_))
+        ) {
+            return;
+        }
+
+        self.prefill_input_tokens = Some(AutoCompactWindowPrefill::ServerObserved(
+            usage.input_tokens.max(0),
+        ));
+    }
+
+    pub(super) fn set_estimated_prefill(&mut self, tokens: i64) {
+        if matches!(
+            self.prefill_input_tokens,
+            Some(AutoCompactWindowPrefill::ServerObserved(_))
+        ) {
+            return;
+        }
+
+        self.prefill_input_tokens = Some(AutoCompactWindowPrefill::Estimated(tokens.max(0)));
+    }
+
+    pub(super) fn snapshot(&self) -> AutoCompactWindowSnapshot {
+        let prefill_input_tokens = match self.prefill_input_tokens {
+            Some(AutoCompactWindowPrefill::ServerObserved(tokens))
+            | Some(AutoCompactWindowPrefill::Estimated(tokens)) => Some(tokens),
+            None => None,
+        };
+        AutoCompactWindowSnapshot {
+            ordinal: self.ordinal,
+            prefill_input_tokens,
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use pretty_assertions::assert_eq;
+
+    #[test]
+    fn tracks_prefill_and_window_boundaries() {
+        let mut window = AutoCompactWindow::new();
+
+        assert_eq!(
+            window.snapshot(),
+            AutoCompactWindowSnapshot {
+                ordinal: 1,
+                prefill_input_tokens: None,
+            }
+        );
+
+        window.set_estimated_prefill(/*tokens*/ 150);
+        assert_eq!(
+            window.snapshot(),
+            AutoCompactWindowSnapshot {
+                ordinal: 1,
+                prefill_input_tokens: Some(150),
+            }
+        );
+
+        window.ensure_server_observed_prefill_from_usage(&TokenUsage {
+            input_tokens: 120,
+            total_tokens: 170,
+            ..Default::default()
+        });
+        assert_eq!(
+            window.snapshot(),
+            AutoCompactWindowSnapshot {
+                ordinal: 1,
+                prefill_input_tokens: Some(120),
+            }
+        );
+
+        window.ensure_server_observed_prefill_from_usage(&TokenUsage {
+            input_tokens: 130,
+            total_tokens: 180,
+            ..Default::default()
+        });
+        window.set_estimated_prefill(/*tokens*/ 90);
+        assert_eq!(
+            window.snapshot(),
+            AutoCompactWindowSnapshot {
+                ordinal: 1,
+                prefill_input_tokens: Some(120),
+            }
+        );
+
+        window.start_next();
+        assert_eq!(
+            window.snapshot(),
+            AutoCompactWindowSnapshot {
+                ordinal: 2,
+                prefill_input_tokens: None,
+            }
+        );
+    }
+}
diff --git a/codex-rs/core/src/state/mod.rs b/codex-rs/core/src/state/mod.rs
index 13f3bf6c86..3122ec5f25 100644
--- a/codex-rs/core/src/state/mod.rs
+++ b/codex-rs/core/src/state/mod.rs
@@ -1,7 +1,9 @@
+mod auto_compact_window;
 mod service;
 mod session;
 mod turn;
 
+pub(crate) use auto_compact_window::AutoCompactWindowSnapshot;
 pub(crate) use service::SessionServices;
 pub(crate) use session::SessionState;
 pub(crate) use turn::ActiveTurn;
diff --git a/codex-rs/core/src/state/session.rs b/codex-rs/core/src/state/session.rs
index 3bd4b8a26e..0903d0d073 100644
--- a/codex-rs/core/src/state/session.rs
+++ b/codex-rs/core/src/state/session.rs
@@ -3,9 +3,10 @@
 use codex_protocol::models::AdditionalPermissionProfile;
 use codex_protocol::models::ResponseItem;
 use codex_sandboxing::policy_transforms::merge_permission_profiles;
-use std::collections::HashMap;
 use std::collections::HashSet;
 
+use super::auto_compact_window::AutoCompactWindow;
+use super::auto_compact_window::AutoCompactWindowSnapshot;
 use crate::context_manager::ContextManager;
 use crate::session::PreviousTurnSettings;
 use crate::session::session::SessionConfiguration;
@@ -22,12 +23,13 @@ pub(crate) struct SessionState {
     pub(crate) history: ContextManager,
     pub(crate) latest_rate_limits: Option<RateLimitSnapshot>,
     pub(crate) server_reasoning_included: bool,
-    pub(crate) dependency_env: HashMap<String, String>,
     pub(crate) mcp_dependency_prompted: HashSet<String>,
     /// Settings used by the latest regular user turn, used for turn-to-turn
     /// model/realtime handling on subsequent regular turns (including full-context
     /// reinjection after resume or `/compact`).
     previous_turn_settings: Option<PreviousTurnSettings>,
+    /// Runtime accounting state for the active auto-compaction window.
+    auto_compact_window: AutoCompactWindow,
     /// Startup prewarmed session prepared during session initialization.
     pub(crate) startup_prewarm: Option<SessionStartupPrewarmHandle>,
     pub(crate) active_connector_selection: HashSet<String>,
@@ -45,9 +47,9 @@ impl SessionState {
             history,
             latest_rate_limits: None,
             server_reasoning_included: false,
-            dependency_env: HashMap::new(),
             mcp_dependency_prompted: HashSet::new(),
             previous_turn_settings: None,
+            auto_compact_window: AutoCompactWindow::new(),
             startup_prewarm: None,
             active_connector_selection: HashSet::new(),
             pending_session_start_source: None,
@@ -97,6 +99,7 @@ impl SessionState {
         self.history.replace(items);
         self.history
             .set_reference_context_item(reference_context_item);
+        self.auto_compact_window.clear_prefill();
     }
 
     pub(crate) fn set_token_info(&mut self, info: Option<TokenUsageInfo>) {
@@ -120,6 +123,26 @@ impl SessionState {
         self.history.update_token_info(usage, model_context_window);
     }
 
+    pub(crate) fn ensure_auto_compact_window_server_prefill_from_usage(
+        &mut self,
+        usage: &TokenUsage,
+    ) {
+        self.auto_compact_window
+            .ensure_server_observed_prefill_from_usage(usage);
+    }
+
+    pub(crate) fn set_auto_compact_window_estimated_prefill(&mut self, tokens: i64) {
+        self.auto_compact_window.set_estimated_prefill(tokens);
+    }
+
+    pub(crate) fn start_next_auto_compact_window(&mut self) {
+        self.auto_compact_window.start_next();
+    }
+
+    pub(crate) fn auto_compact_window_snapshot(&self) -> AutoCompactWindowSnapshot {
+        self.auto_compact_window.snapshot()
+    }
+
     pub(crate) fn token_info(&self) -> Option<TokenUsageInfo> {
         self.history.token_info()
     }
@@ -165,16 +188,6 @@ impl SessionState {
         self.mcp_dependency_prompted.clone()
     }
 
-    pub(crate) fn set_dependency_env(&mut self, values: HashMap<String, String>) {
-        for (key, value) in values {
-            self.dependency_env.insert(key, value);
-        }
-    }
-
-    pub(crate) fn dependency_env(&self) -> HashMap<String, String> {
-        self.dependency_env.clone()
-    }
-
     pub(crate) fn set_session_startup_prewarm(
         &mut self,
         startup_prewarm: SessionStartupPrewarmHandle,
diff --git a/codex-rs/core/src/state/session_tests.rs b/codex-rs/core/src/state/session_tests.rs
index 5e90cc881d..b6b5a057a0 100644
--- a/codex-rs/core/src/state/session_tests.rs
+++ b/codex-rs/core/src/state/session_tests.rs
@@ -1,5 +1,6 @@
 use super::*;
 use crate::session::tests::make_session_configuration_for_tests;
+use crate::state::AutoCompactWindowSnapshot;
 use codex_protocol::protocol::CreditsSnapshot;
 use codex_protocol::protocol::RateLimitWindow;
 use pretty_assertions::assert_eq;
@@ -61,6 +62,24 @@ async fn set_rate_limits_defaults_limit_id_to_codex_when_missing() {
     );
 }
 
+#[tokio::test]
+async fn replace_history_clears_auto_compact_window_prefill_without_advancing() {
+    let session_configuration = make_session_configuration_for_tests().await;
+    let mut state = SessionState::new(session_configuration);
+
+    state.start_next_auto_compact_window();
+    state.set_auto_compact_window_estimated_prefill(/*tokens*/ 100);
+    state.replace_history(Vec::new(), /*reference_context_item*/ None);
+
+    assert_eq!(
+        state.auto_compact_window_snapshot(),
+        AutoCompactWindowSnapshot {
+            ordinal: 2,
+            prefill_input_tokens: None,
+        }
+    );
+}
+
 #[tokio::test]
 async fn set_rate_limits_defaults_to_codex_when_limit_id_missing_after_other_bucket() {
     let session_configuration = make_session_configuration_for_tests().await;
diff --git a/codex-rs/core/src/state/turn.rs b/codex-rs/core/src/state/turn.rs
index 0dd0c09379..86438ad56a 100644
--- a/codex-rs/core/src/state/turn.rs
+++ b/codex-rs/core/src/state/turn.rs
@@ -9,8 +9,8 @@ use tokio::sync::Notify;
 use tokio_util::sync::CancellationToken;
 use tokio_util::task::AbortOnDropHandle;
 
+use codex_extension_api::ExtensionData;
 use codex_protocol::dynamic_tools::DynamicToolResponse;
-use codex_protocol::models::ResponseInputItem;
 use codex_protocol::request_permissions::RequestPermissionProfile;
 use codex_protocol::request_permissions::RequestPermissionsResponse;
 use codex_protocol::request_user_input::RequestUserInputResponse;
@@ -19,6 +19,7 @@ use codex_utils_absolute_path::AbsolutePathBuf;
 use rmcp::model::RequestId;
 use tokio::sync::oneshot;
 
+use crate::session::TurnInputQueue;
 use crate::session::turn_context::TurnContext;
 use crate::tasks::AnySessionTask;
 use codex_protocol::models::AdditionalPermissionProfile;
@@ -75,6 +76,7 @@ pub(crate) struct RunningTask {
     pub(crate) cancellation_token: CancellationToken,
     pub(crate) handle: AbortOnDropHandle<()>,
     pub(crate) turn_context: Arc<TurnContext>,
+    pub(crate) turn_extension_data: Arc<ExtensionData>,
     // Timer recorded when the task drops to capture the full turn duration.
     pub(crate) _timer: Option<codex_otel::Timer>,
 }
@@ -113,7 +115,7 @@ pub(crate) struct TurnState {
     pending_user_input: HashMap<String, oneshot::Sender<RequestUserInputResponse>>,
     pending_elicitations: HashMap<(String, RequestId), oneshot::Sender<ElicitationResponse>>,
     pending_dynamic_tools: HashMap<String, oneshot::Sender<DynamicToolResponse>>,
-    pending_input: Vec<ResponseInputItem>,
+    pub(crate) pending_input: TurnInputQueue,
     mailbox_delivery_phase: MailboxDeliveryPhase,
     granted_permissions: Option<AdditionalPermissionProfile>,
     strict_auto_review_enabled: bool,
@@ -144,13 +146,12 @@ impl TurnState {
         self.pending_approvals.remove(key)
     }
 
-    pub(crate) fn clear_pending(&mut self) {
+    pub(crate) fn clear_pending_waiters(&mut self) {
         self.pending_approvals.clear();
         self.pending_request_permissions.clear();
         self.pending_user_input.clear();
         self.pending_elicitations.clear();
         self.pending_dynamic_tools.clear();
-        self.pending_input.clear();
     }
 
     pub(crate) fn insert_pending_request_permissions(
@@ -218,33 +219,6 @@ impl TurnState {
         self.pending_dynamic_tools.remove(key)
     }
 
-    pub(crate) fn push_pending_input(&mut self, input: ResponseInputItem) {
-        self.pending_input.push(input);
-    }
-
-    pub(crate) fn prepend_pending_input(&mut self, mut input: Vec<ResponseInputItem>) {
-        if input.is_empty() {
-            return;
-        }
-
-        input.append(&mut self.pending_input);
-        self.pending_input = input;
-    }
-
-    pub(crate) fn take_pending_input(&mut self) -> Vec<ResponseInputItem> {
-        if self.pending_input.is_empty() {
-            Vec::with_capacity(0)
-        } else {
-            let mut ret = Vec::new();
-            std::mem::swap(&mut ret, &mut self.pending_input);
-            ret
-        }
-    }
-
-    pub(crate) fn has_pending_input(&self) -> bool {
-        !self.pending_input.is_empty()
-    }
-
     pub(crate) fn accept_mailbox_delivery_for_current_turn(&mut self) {
         self.set_mailbox_delivery_phase(MailboxDeliveryPhase::CurrentTurn);
     }
@@ -274,11 +248,3 @@ impl TurnState {
         self.strict_auto_review_enabled
     }
 }
-
-impl ActiveTurn {
-    /// Clear any pending approvals and input buffered for the current turn.
-    pub(crate) async fn clear_pending(&self) {
-        let mut ts = self.turn_state.lock().await;
-        ts.clear_pending();
-    }
-}
diff --git a/codex-rs/core/src/stream_events_utils.rs b/codex-rs/core/src/stream_events_utils.rs
index b4f00ee864..0e32ccb9fb 100644
--- a/codex-rs/core/src/stream_events_utils.rs
+++ b/codex-rs/core/src/stream_events_utils.rs
@@ -3,6 +3,7 @@ use std::sync::Arc;
 
 use base64::Engine;
 use base64::engine::general_purpose::STANDARD as BASE64_STANDARD;
+use codex_extension_api::ExtensionData;
 use codex_protocol::config_types::ModeKind;
 use codex_protocol::items::TurnItem;
 use codex_utils_stream_parser::strip_citations;
@@ -20,6 +21,7 @@ use codex_memories_read::citations::parse_memory_citation;
 use codex_memories_read::citations::thread_ids_from_memory_citation;
 use codex_protocol::error::CodexErr;
 use codex_protocol::error::Result;
+use codex_protocol::memory_citation::MemoryCitation;
 use codex_protocol::models::FunctionCallOutputBody;
 use codex_protocol::models::FunctionCallOutputPayload;
 use codex_protocol::models::MessagePhase;
@@ -31,6 +33,7 @@ use codex_utils_stream_parser::strip_proposed_plan_blocks;
 use futures::Future;
 use tracing::debug;
 use tracing::instrument;
+use tracing::warn;
 
 const GENERATED_IMAGE_ARTIFACTS_DIR: &str = "generated_images";
 
@@ -127,22 +130,51 @@ pub(crate) async fn record_completed_response_item(
     sess: &Session,
     turn_context: &TurnContext,
     item: &ResponseItem,
+) {
+    record_completed_response_item_with_finalized_facts(
+        sess,
+        turn_context,
+        item,
+        /*finalized_facts*/ None,
+    )
+    .await;
+}
+
+pub(crate) async fn record_completed_response_item_with_finalized_facts(
+    sess: &Session,
+    turn_context: &TurnContext,
+    item: &ResponseItem,
+    finalized_facts: Option<&FinalizedTurnItemFacts>,
 ) {
     sess.record_conversation_items(turn_context, std::slice::from_ref(item))
         .await;
-    if completed_item_defers_mailbox_delivery_to_next_turn(
-        item,
-        turn_context.collaboration_mode.mode == ModeKind::Plan,
-    ) {
-        sess.defer_mailbox_delivery_to_next_turn(&turn_context.sub_id)
+    let defers_mailbox_delivery = finalized_facts.map_or_else(
+        || {
+            completed_item_defers_mailbox_delivery_to_next_turn(
+                item,
+                turn_context.collaboration_mode.mode == ModeKind::Plan,
+            )
+        },
+        |facts| facts.defers_mailbox_delivery_to_next_turn,
+    );
+    if defers_mailbox_delivery {
+        sess.input_queue
+            .defer_mailbox_delivery_to_next_turn(&sess.active_turn, &turn_context.sub_id)
             .await;
     }
     mark_thread_memory_mode_polluted_if_external_context(sess, turn_context, item).await;
-    let has_memory_citation = record_stage1_output_usage_and_detect_memory_citation(
-        sess.services.state_db.as_ref(),
-        item,
-    )
-    .await;
+    let has_memory_citation = if let Some(memory_citation) =
+        finalized_facts.and_then(|facts| facts.memory_citation.as_ref())
+    {
+        record_stage1_output_usage_for_memory_citation(
+            sess.services.state_db.as_ref(),
+            memory_citation,
+        )
+        .await
+    } else {
+        record_stage1_output_usage_and_detect_memory_citation(sess.services.state_db.as_ref(), item)
+            .await
+    };
     if has_memory_citation {
         sess.record_memory_citation_for_turn(&turn_context.sub_id)
             .await;
@@ -188,7 +220,14 @@ async fn record_stage1_output_usage_and_detect_memory_citation(
     let Some(memory_citation) = parse_memory_citation(citations) else {
         return false;
     };
-    let thread_ids = thread_ids_from_memory_citation(&memory_citation);
+    record_stage1_output_usage_for_memory_citation(state_db_ctx, &memory_citation).await
+}
+
+async fn record_stage1_output_usage_for_memory_citation(
+    state_db_ctx: Option<&state_db::StateDbHandle>,
+    memory_citation: &MemoryCitation,
+) -> bool {
+    let thread_ids = thread_ids_from_memory_citation(memory_citation);
     if thread_ids.is_empty() {
         return true;
     }
@@ -215,10 +254,91 @@ pub(crate) struct OutputItemResult {
 pub(crate) struct HandleOutputCtx {
     pub sess: Arc<Session>,
     pub turn_context: Arc<TurnContext>,
+    pub turn_store: Arc<ExtensionData>,
     pub tool_runtime: ToolCallRuntime,
     pub cancellation_token: CancellationToken,
 }
 
+async fn apply_turn_item_contributors(
+    sess: &Session,
+    turn_store: &ExtensionData,
+    item: &mut TurnItem,
+) {
+    let contributors = sess.services.extensions.turn_item_contributors().to_vec();
+    for contributor in contributors {
+        if let Err(err) = contributor
+            .contribute(&sess.services.thread_extension_data, turn_store, item)
+            .await
+        {
+            warn!("turn item contributor failed: {err}");
+        }
+    }
+}
+
+pub(crate) enum TurnItemContributorPolicy<'a> {
+    Skip,
+    Run(&'a ExtensionData),
+}
+
+pub(crate) struct FinalizedTurnItem {
+    pub(crate) turn_item: TurnItem,
+    pub(crate) facts: FinalizedTurnItemFacts,
+}
+
+#[derive(Clone, Default)]
+pub(crate) struct FinalizedTurnItemFacts {
+    pub(crate) memory_citation: Option<MemoryCitation>,
+    pub(crate) last_agent_message: Option<String>,
+    pub(crate) defers_mailbox_delivery_to_next_turn: bool,
+}
+
+pub(crate) async fn finalize_non_tool_response_item(
+    sess: &Session,
+    turn_context: &TurnContext,
+    contributor_policy: TurnItemContributorPolicy<'_>,
+    item: &ResponseItem,
+    plan_mode: bool,
+) -> Option<FinalizedTurnItem> {
+    let turn_item =
+        handle_non_tool_response_item(sess, turn_context, contributor_policy, item, plan_mode)
+            .await?;
+    let (memory_citation, last_agent_message, defers_mailbox_delivery_to_next_turn) =
+        match &turn_item {
+            TurnItem::AgentMessage(agent_message) => {
+                let combined = agent_message
+                    .content
+                    .iter()
+                    .map(|entry| match entry {
+                        codex_protocol::items::AgentMessageContent::Text { text } => text.as_str(),
+                    })
+                    .collect::<String>();
+                let last_agent_message = if combined.trim().is_empty() {
+                    None
+                } else {
+                    Some(combined)
+                };
+                let defers_mailbox_delivery_to_next_turn =
+                    !matches!(agent_message.phase, Some(MessagePhase::Commentary))
+                        && last_agent_message.is_some();
+                (
+                    agent_message.memory_citation.clone(),
+                    last_agent_message,
+                    defers_mailbox_delivery_to_next_turn,
+                )
+            }
+            TurnItem::ImageGeneration(_) => (None, None, true),
+            _ => (None, None, false),
+        };
+    Some(FinalizedTurnItem {
+        turn_item,
+        facts: FinalizedTurnItemFacts {
+            memory_citation,
+            last_agent_message,
+            defers_mailbox_delivery_to_next_turn,
+        },
+    })
+}
+
 #[instrument(level = "trace", skip_all)]
 pub(crate) async fn handle_output_item_done(
     ctx: &mut HandleOutputCtx,
@@ -232,7 +352,11 @@ pub(crate) async fn handle_output_item_done(
         // The model emitted a tool call; log it, persist the item immediately, and queue the tool execution.
         Ok(Some(call)) => {
             ctx.sess
-                .accept_mailbox_delivery_for_current_turn(&ctx.turn_context.sub_id)
+                .input_queue
+                .accept_mailbox_delivery_for_current_turn(
+                    &ctx.sess.active_turn,
+                    &ctx.turn_context.sub_id,
+                )
                 .await;
 
             let payload_preview = call.payload.log_payload().into_owned();
@@ -258,16 +382,20 @@ pub(crate) async fn handle_output_item_done(
         }
         // No tool call: convert messages/reasoning into turn items and mark them as complete.
         Ok(None) => {
-            let turn_item = handle_non_tool_response_item(
+            let finalized_turn_item = finalize_non_tool_response_item(
                 ctx.sess.as_ref(),
                 ctx.turn_context.as_ref(),
+                TurnItemContributorPolicy::Run(ctx.turn_store.as_ref()),
                 &item,
                 plan_mode,
             )
             .await;
-            if let Some(turn_item) = turn_item {
+            let finalized_facts = finalized_turn_item
+                .as_ref()
+                .map(|finalized| finalized.facts.clone());
+            if let Some(finalized_turn_item) = finalized_turn_item {
                 if previously_active_item.is_none() {
-                    let mut started_item = turn_item.clone();
+                    let mut started_item = finalized_turn_item.turn_item.clone();
                     if let TurnItem::ImageGeneration(item) = &mut started_item {
                         item.status = "in_progress".to_string();
                         item.revised_prompt = None;
@@ -280,42 +408,18 @@ pub(crate) async fn handle_output_item_done(
                 }
 
                 ctx.sess
-                    .emit_turn_item_completed(&ctx.turn_context, turn_item)
+                    .emit_turn_item_completed(&ctx.turn_context, finalized_turn_item.turn_item)
                     .await;
             }
-            record_completed_response_item(ctx.sess.as_ref(), ctx.turn_context.as_ref(), &item)
-                .await;
-            let last_agent_message = last_assistant_message_from_item(&item, plan_mode);
+            record_completed_response_item_with_finalized_facts(
+                ctx.sess.as_ref(),
+                ctx.turn_context.as_ref(),
+                &item,
+                finalized_facts.as_ref(),
+            )
+            .await;
 
-            output.last_agent_message = last_agent_message;
-        }
-        // Guardrail: the model issued a LocalShellCall without an id; surface the error back into history.
-        Err(FunctionCallError::MissingLocalShellCallId) => {
-            let msg = "LocalShellCall without call_id or id";
-            ctx.turn_context
-                .session_telemetry
-                .log_tool_failed("local_shell", msg);
-            tracing::error!(msg);
-
-            let response = ResponseInputItem::FunctionCallOutput {
-                call_id: String::new(),
-                output: FunctionCallOutputPayload {
-                    body: FunctionCallOutputBody::Text(msg.to_string()),
-                    ..Default::default()
-                },
-            };
-            record_completed_response_item(ctx.sess.as_ref(), ctx.turn_context.as_ref(), &item)
-                .await;
-            if let Some(response_item) = response_input_to_response_item(&response) {
-                ctx.sess
-                    .record_conversation_items(
-                        &ctx.turn_context,
-                        std::slice::from_ref(&response_item),
-                    )
-                    .await;
-            }
-
-            output.needs_follow_up = true;
+            output.last_agent_message = finalized_facts.and_then(|facts| facts.last_agent_message);
         }
         // The tool request should be answered directly (or was denied); push that response into the transcript.
         Err(FunctionCallError::RespondToModel(message)) => {
@@ -351,6 +455,7 @@ pub(crate) async fn handle_output_item_done(
 pub(crate) async fn handle_non_tool_response_item(
     sess: &Session,
     turn_context: &TurnContext,
+    contributor_policy: TurnItemContributorPolicy<'_>,
     item: &ResponseItem,
     plan_mode: bool,
 ) -> Option<TurnItem> {
@@ -362,6 +467,9 @@ pub(crate) async fn handle_non_tool_response_item(
         | ResponseItem::WebSearchCall { .. }
         | ResponseItem::ImageGenerationCall { .. } => {
             let mut turn_item = parse_turn_item(item)?;
+            if let TurnItemContributorPolicy::Run(turn_store) = contributor_policy {
+                apply_turn_item_contributors(sess, turn_store, &mut turn_item).await;
+            }
             if let TurnItem::AgentMessage(agent_message) = &mut turn_item {
                 let combined = agent_message
                     .content
@@ -374,7 +482,9 @@ pub(crate) async fn handle_non_tool_response_item(
                     strip_hidden_assistant_markup_and_parse_memory_citation(&combined, plan_mode);
                 agent_message.content =
                     vec![codex_protocol::items::AgentMessageContent::Text { text: stripped }];
-                agent_message.memory_citation = memory_citation;
+                if agent_message.memory_citation.is_none() {
+                    agent_message.memory_citation = memory_citation;
+                }
             }
             if let TurnItem::ImageGeneration(image_item) = &mut turn_item {
                 let session_id = sess.conversation_id.to_string();
diff --git a/codex-rs/core/src/stream_events_utils_tests.rs b/codex-rs/core/src/stream_events_utils_tests.rs
index 2012e05aa3..28ffbb7a6b 100644
--- a/codex-rs/core/src/stream_events_utils_tests.rs
+++ b/codex-rs/core/src/stream_events_utils_tests.rs
@@ -1,12 +1,24 @@
+use super::HandleOutputCtx;
+use super::TurnItemContributorPolicy;
 use super::completed_item_defers_mailbox_delivery_to_next_turn;
+use super::finalize_non_tool_response_item;
 use super::handle_non_tool_response_item;
+use super::handle_output_item_done;
 use super::image_generation_artifact_path;
 use super::last_assistant_message_from_item;
 use super::response_item_may_include_external_context;
 use super::save_image_generation_result;
 use crate::session::tests::make_session_and_context;
+use crate::tools::ToolRouter;
+use crate::tools::parallel::ToolCallRuntime;
+use crate::turn_diff_tracker::TurnDiffTracker;
+use codex_extension_api::ExtensionData;
+use codex_extension_api::TurnItemContributionFuture;
+use codex_extension_api::TurnItemContributor;
 use codex_protocol::error::CodexErr;
+use codex_protocol::items::AgentMessageContent;
 use codex_protocol::items::TurnItem;
+use codex_protocol::memory_citation::MemoryCitation;
 use codex_protocol::models::ContentItem;
 use codex_protocol::models::FunctionCallOutputPayload;
 use codex_protocol::models::LocalShellAction;
@@ -16,6 +28,8 @@ use codex_protocol::models::MessagePhase;
 use codex_protocol::models::ResponseItem;
 use codex_utils_absolute_path::test_support::PathExt;
 use pretty_assertions::assert_eq;
+use std::sync::Arc;
+use tokio_util::sync::CancellationToken;
 
 fn assistant_output_text(text: &str) -> ResponseItem {
     assistant_output_text_with_phase(text, /*phase*/ None)
@@ -117,10 +131,15 @@ async fn handle_non_tool_response_item_strips_citations_from_assistant_message()
         "hello<oai-mem-citation><citation_entries>\nMEMORY.md:1-2|note=[x]\n</citation_entries>\n<rollout_ids>\n019cc2ea-1dff-7902-8d40-c8f6e5d83cc4\n</rollout_ids></oai-mem-citation> world",
     );
 
-    let turn_item =
-        handle_non_tool_response_item(&session, &turn_context, &item, /*plan_mode*/ false)
-            .await
-            .expect("assistant message should parse");
+    let turn_item = handle_non_tool_response_item(
+        &session,
+        &turn_context,
+        TurnItemContributorPolicy::Skip,
+        &item,
+        /*plan_mode*/ false,
+    )
+    .await
+    .expect("assistant message should parse");
 
     let TurnItem::AgentMessage(agent_message) = turn_item else {
         panic!("expected agent message");
@@ -144,6 +163,199 @@ async fn handle_non_tool_response_item_strips_citations_from_assistant_message()
     );
 }
 
+struct TestTurnItemContributor;
+
+#[derive(Debug)]
+struct TurnItemContributorRan;
+
+impl TurnItemContributor for TestTurnItemContributor {
+    fn contribute<'a>(
+        &'a self,
+        _thread_store: &'a ExtensionData,
+        turn_store: &'a ExtensionData,
+        item: &'a mut TurnItem,
+    ) -> TurnItemContributionFuture<'a> {
+        Box::pin(async move {
+            turn_store.insert(TurnItemContributorRan);
+            if let TurnItem::AgentMessage(agent_message) = item {
+                agent_message.memory_citation = Some(MemoryCitation {
+                    entries: Vec::new(),
+                    rollout_ids: Vec::new(),
+                });
+            }
+            Ok(())
+        })
+    }
+}
+
+struct RewriteAgentMessageContributor;
+
+impl TurnItemContributor for RewriteAgentMessageContributor {
+    fn contribute<'a>(
+        &'a self,
+        _thread_store: &'a ExtensionData,
+        _turn_store: &'a ExtensionData,
+        item: &'a mut TurnItem,
+    ) -> TurnItemContributionFuture<'a> {
+        Box::pin(async move {
+            if let TurnItem::AgentMessage(agent_message) = item {
+                agent_message.content = vec![AgentMessageContent::Text {
+                    text: "contributed assistant text".to_string(),
+                }];
+            }
+            Ok(())
+        })
+    }
+}
+
+#[tokio::test]
+async fn handle_non_tool_response_item_runs_turn_item_contributors_only_when_requested() {
+    let (mut session, turn_context) = make_session_and_context().await;
+    let mut builder = codex_extension_api::ExtensionRegistryBuilder::new();
+    builder.turn_item_contributor(Arc::new(TestTurnItemContributor));
+    session.services.extensions = Arc::new(builder.build());
+    let turn_store = ExtensionData::new(turn_context.sub_id.clone());
+    let item = assistant_output_text(
+        "hello<oai-mem-citation>ignored by memory parser</oai-mem-citation> world",
+    );
+
+    let provisional_turn_item = handle_non_tool_response_item(
+        &session,
+        &turn_context,
+        TurnItemContributorPolicy::Skip,
+        &item,
+        /*plan_mode*/ false,
+    )
+    .await
+    .expect("assistant message should parse");
+
+    assert!(turn_store.get::<TurnItemContributorRan>().is_none());
+    let TurnItem::AgentMessage(provisional_agent_message) = provisional_turn_item else {
+        panic!("expected agent message");
+    };
+    assert_eq!(provisional_agent_message.memory_citation, None);
+
+    let turn_item = handle_non_tool_response_item(
+        &session,
+        &turn_context,
+        TurnItemContributorPolicy::Run(&turn_store),
+        &item,
+        /*plan_mode*/ false,
+    )
+    .await
+    .expect("assistant message should parse");
+
+    assert!(turn_store.get::<TurnItemContributorRan>().is_some());
+    let TurnItem::AgentMessage(agent_message) = turn_item else {
+        panic!("expected agent message");
+    };
+    assert!(agent_message.memory_citation.is_some());
+    let text = agent_message
+        .content
+        .iter()
+        .map(|entry| match entry {
+            codex_protocol::items::AgentMessageContent::Text { text } => text.as_str(),
+        })
+        .collect::<String>();
+    assert_eq!(text, "hello world");
+}
+
+#[tokio::test]
+async fn handle_output_item_done_returns_contributed_last_agent_message() {
+    let (mut session, turn_context) = make_session_and_context().await;
+    let mut builder = codex_extension_api::ExtensionRegistryBuilder::new();
+    builder.turn_item_contributor(Arc::new(RewriteAgentMessageContributor));
+    session.services.extensions = Arc::new(builder.build());
+    let session = Arc::new(session);
+    let turn_context = Arc::new(turn_context);
+    let router = Arc::new(ToolRouter::from_turn_context(
+        &turn_context,
+        crate::tools::router::ToolRouterParams {
+            mcp_tools: None,
+            deferred_mcp_tools: None,
+            discoverable_tools: None,
+            extension_tool_executors: Vec::new(),
+            dynamic_tools: turn_context.dynamic_tools.as_slice(),
+        },
+    ));
+    let tracker = Arc::new(tokio::sync::Mutex::new(TurnDiffTracker::new()));
+    let tool_runtime = ToolCallRuntime::new(
+        router,
+        Arc::clone(&session),
+        Arc::clone(&turn_context),
+        tracker,
+    );
+    let item = assistant_output_text("original assistant text");
+    let mut ctx = HandleOutputCtx {
+        sess: session,
+        turn_context: Arc::clone(&turn_context),
+        turn_store: Arc::new(ExtensionData::new(turn_context.sub_id.clone())),
+        tool_runtime,
+        cancellation_token: CancellationToken::new(),
+    };
+
+    let output = handle_output_item_done(&mut ctx, item, /*previously_active_item*/ None)
+        .await
+        .expect("assistant message should complete");
+
+    assert_eq!(
+        output.last_agent_message.as_deref(),
+        Some("contributed assistant text")
+    );
+}
+
+#[tokio::test]
+async fn finalized_turn_item_defers_mailbox_for_contributed_visible_text() {
+    let (mut session, turn_context) = make_session_and_context().await;
+    let mut builder = codex_extension_api::ExtensionRegistryBuilder::new();
+    builder.turn_item_contributor(Arc::new(RewriteAgentMessageContributor));
+    session.services.extensions = Arc::new(builder.build());
+    let turn_store = ExtensionData::new(turn_context.sub_id.clone());
+    let item = assistant_output_text("<oai-mem-citation>hidden only</oai-mem-citation>");
+
+    let finalized = finalize_non_tool_response_item(
+        &session,
+        &turn_context,
+        TurnItemContributorPolicy::Run(&turn_store),
+        &item,
+        /*plan_mode*/ false,
+    )
+    .await
+    .expect("assistant message should parse");
+
+    assert_eq!(
+        finalized.facts.last_agent_message.as_deref(),
+        Some("contributed assistant text")
+    );
+    assert!(finalized.facts.defers_mailbox_delivery_to_next_turn);
+}
+
+#[tokio::test]
+async fn finalized_turn_item_keeps_mailbox_open_for_commentary_text() {
+    let (mut session, turn_context) = make_session_and_context().await;
+    let mut builder = codex_extension_api::ExtensionRegistryBuilder::new();
+    builder.turn_item_contributor(Arc::new(RewriteAgentMessageContributor));
+    session.services.extensions = Arc::new(builder.build());
+    let turn_store = ExtensionData::new(turn_context.sub_id.clone());
+    let item = assistant_output_text_with_phase("still working", Some(MessagePhase::Commentary));
+
+    let finalized = finalize_non_tool_response_item(
+        &session,
+        &turn_context,
+        TurnItemContributorPolicy::Run(&turn_store),
+        &item,
+        /*plan_mode*/ false,
+    )
+    .await
+    .expect("assistant message should parse");
+
+    assert_eq!(
+        finalized.facts.last_agent_message.as_deref(),
+        Some("contributed assistant text")
+    );
+    assert!(!finalized.facts.defers_mailbox_delivery_to_next_turn);
+}
+
 #[test]
 fn last_assistant_message_from_item_strips_citations_and_plan_blocks() {
     let item = assistant_output_text(
diff --git a/codex-rs/core/src/tasks/lifecycle.rs b/codex-rs/core/src/tasks/lifecycle.rs
index 2fb9017df2..94b51647c9 100644
--- a/codex-rs/core/src/tasks/lifecycle.rs
+++ b/codex-rs/core/src/tasks/lifecycle.rs
@@ -4,38 +4,44 @@ use codex_protocol::protocol::TurnAbortReason;
 use crate::session::session::Session;
 
 impl Session {
-    pub(super) fn emit_turn_start_lifecycle(&self, turn_store: &ExtensionData) {
+    pub(super) async fn emit_turn_start_lifecycle(&self, turn_store: &ExtensionData) {
         for contributor in self.services.extensions.turn_lifecycle_contributors() {
-            contributor.on_turn_start(codex_extension_api::TurnStartInput {
-                session_store: &self.services.session_extension_data,
-                thread_store: &self.services.thread_extension_data,
-                turn_store,
-            });
+            contributor
+                .on_turn_start(codex_extension_api::TurnStartInput {
+                    session_store: &self.services.session_extension_data,
+                    thread_store: &self.services.thread_extension_data,
+                    turn_store,
+                })
+                .await;
         }
     }
 
-    pub(super) fn emit_turn_stop_lifecycle(&self, turn_store: &ExtensionData) {
+    pub(super) async fn emit_turn_stop_lifecycle(&self, turn_store: &ExtensionData) {
         for contributor in self.services.extensions.turn_lifecycle_contributors() {
-            contributor.on_turn_stop(codex_extension_api::TurnStopInput {
-                session_store: &self.services.session_extension_data,
-                thread_store: &self.services.thread_extension_data,
-                turn_store,
-            });
+            contributor
+                .on_turn_stop(codex_extension_api::TurnStopInput {
+                    session_store: &self.services.session_extension_data,
+                    thread_store: &self.services.thread_extension_data,
+                    turn_store,
+                })
+                .await;
         }
     }
 
-    pub(super) fn emit_turn_abort_lifecycle(
+    pub(super) async fn emit_turn_abort_lifecycle(
         &self,
         reason: TurnAbortReason,
         turn_store: &ExtensionData,
     ) {
         for contributor in self.services.extensions.turn_lifecycle_contributors() {
-            contributor.on_turn_abort(codex_extension_api::TurnAbortInput {
-                reason: reason.clone(),
-                session_store: &self.services.session_extension_data,
-                thread_store: &self.services.thread_extension_data,
-                turn_store,
-            });
+            contributor
+                .on_turn_abort(codex_extension_api::TurnAbortInput {
+                    reason: reason.clone(),
+                    session_store: &self.services.session_extension_data,
+                    thread_store: &self.services.thread_extension_data,
+                    turn_store,
+                })
+                .await;
         }
     }
 }
diff --git a/codex-rs/core/src/tasks/mod.rs b/codex-rs/core/src/tasks/mod.rs
index 6da6d9ad9b..164e65f07c 100644
--- a/codex-rs/core/src/tasks/mod.rs
+++ b/codex-rs/core/src/tasks/mod.rs
@@ -8,6 +8,7 @@ use std::sync::Arc;
 use std::time::Duration;
 use std::time::Instant;
 
+use codex_extension_api::ExtensionData;
 use futures::future::BoxFuture;
 use tokio::select;
 use tokio::sync::Notify;
@@ -23,10 +24,10 @@ use tracing::warn;
 use crate::config::Config;
 use crate::context::ContextualUserFragment;
 use crate::goals::GoalRuntimeEvent;
-use crate::hook_runtime::PendingInputHookDisposition;
 use crate::hook_runtime::inspect_pending_input;
 use crate::hook_runtime::record_additional_contexts;
 use crate::hook_runtime::record_pending_input;
+use crate::session::TurnInput;
 use crate::session::session::Session;
 use crate::session::turn_context::TurnContext;
 use crate::state::ActiveTurn;
@@ -41,7 +42,6 @@ use codex_otel::TURN_MEMORY_METRIC;
 use codex_otel::TURN_NETWORK_PROXY_METRIC;
 use codex_otel::TURN_TOKEN_USAGE_METRIC;
 use codex_otel::TURN_TOOL_CALL_METRIC;
-use codex_protocol::models::ResponseInputItem;
 use codex_protocol::models::ResponseItem;
 use codex_protocol::protocol::EventMsg;
 use codex_protocol::protocol::RolloutItem;
@@ -153,17 +153,25 @@ fn bool_tag(value: bool) -> &'static str {
 #[derive(Clone)]
 pub(crate) struct SessionTaskContext {
     session: Arc<Session>,
+    turn_extension_data: Arc<ExtensionData>,
 }
 
 impl SessionTaskContext {
-    pub(crate) fn new(session: Arc<Session>) -> Self {
-        Self { session }
+    pub(crate) fn new(session: Arc<Session>, turn_extension_data: Arc<ExtensionData>) -> Self {
+        Self {
+            session,
+            turn_extension_data,
+        }
     }
 
     pub(crate) fn clone_session(&self) -> Arc<Session> {
         Arc::clone(&self.session)
     }
 
+    pub(crate) fn turn_extension_data(&self) -> Arc<ExtensionData> {
+        Arc::clone(&self.turn_extension_data)
+    }
+
     pub(crate) fn auth_manager(&self) -> Arc<AuthManager> {
         Arc::clone(&self.session.services.auth_manager)
     }
@@ -338,31 +346,38 @@ impl Session {
         {
             warn!("failed to apply goal runtime turn-start event: {err}");
         }
-        let queued_response_items = self.take_queued_response_items_for_next_turn().await;
-        let mailbox_items = self.get_pending_input().await;
+        let queued_response_items = self
+            .input_queue
+            .take_queued_response_items_for_next_turn()
+            .await;
+        let mailbox_items = self.input_queue.get_pending_input(&self.active_turn).await;
         let turn_state = {
             let mut active = self.active_turn.lock().await;
             let turn = active.get_or_insert_with(ActiveTurn::default);
             debug_assert!(turn.tasks.is_empty());
             Arc::clone(&turn.turn_state)
         };
-        {
-            let mut turn_state = turn_state.lock().await;
-            turn_state.token_usage_at_turn_start = token_usage_at_turn_start;
-            for item in queued_response_items {
-                turn_state.push_pending_input(item);
-            }
-            for item in mailbox_items {
-                turn_state.push_pending_input(item);
-            }
-        }
-        self.emit_turn_start_lifecycle(turn_context.extension_data.as_ref());
+        turn_state.lock().await.token_usage_at_turn_start = token_usage_at_turn_start;
+        let mut pending_items = queued_response_items
+            .into_iter()
+            .map(TurnInput::ResponseInputItem)
+            .collect::<Vec<_>>();
+        pending_items.extend(mailbox_items);
+        self.input_queue
+            .extend_pending_input_for_turn_state(turn_state.as_ref(), pending_items)
+            .await;
+        self.emit_turn_start_lifecycle(turn_context.extension_data.as_ref())
+            .await;
 
+        let turn_extension_data = Arc::clone(&turn_context.extension_data);
         let mut active = self.active_turn.lock().await;
         let turn = active.get_or_insert_with(ActiveTurn::default);
         debug_assert!(turn.tasks.is_empty());
         let done_clone = Arc::clone(&done);
-        let session_ctx = Arc::new(SessionTaskContext::new(Arc::clone(self)));
+        let session_ctx = Arc::new(SessionTaskContext::new(
+            Arc::clone(self),
+            Arc::clone(&turn_extension_data),
+        ));
         let ctx = Arc::clone(&turn_context);
         let task_for_run = Arc::clone(&task);
         let task_cancellation_token = cancellation_token.child_token();
@@ -427,6 +442,7 @@ impl Session {
             task,
             cancellation_token,
             turn_context: Arc::clone(&turn_context),
+            turn_extension_data,
             _timer: timer,
         };
         turn.add_task(running_task);
@@ -453,8 +469,11 @@ impl Session {
         self: &Arc<Self>,
         sub_id: String,
     ) {
-        if !self.has_queued_response_items_for_next_turn().await
-            && !self.has_trigger_turn_mailbox_items().await
+        if !self
+            .input_queue
+            .has_queued_response_items_for_next_turn()
+            .await
+            && !self.input_queue.has_trigger_turn_mailbox_items().await
         {
             return;
         }
@@ -491,13 +510,13 @@ impl Session {
         }
 
         if let Some(turn_context) = turn_context.as_deref() {
-            self.emit_turn_abort_lifecycle(reason.clone(), turn_context.extension_data.as_ref());
+            self.emit_turn_abort_lifecycle(reason.clone(), turn_context.extension_data.as_ref())
+                .await;
         }
         if (aborted_turn || reason == TurnAbortReason::Interrupted)
             && let Err(err) = self
                 .goal_runtime_apply(GoalRuntimeEvent::TaskAborted {
                     turn_context: turn_context.as_deref(),
-                    reason: reason.clone(),
                 })
                 .await
         {
@@ -506,7 +525,7 @@ impl Session {
         if let Some(active_turn) = active_turn_to_clear {
             // Let interrupted tasks observe cancellation before dropping pending approvals, or an
             // in-flight approval wait can surface as a model-visible rejection before TurnAborted.
-            active_turn.clear_pending().await;
+            self.input_queue.clear_pending(&active_turn).await;
         }
         if reason == TurnAbortReason::Interrupted && aborted_turn {
             self.maybe_start_turn_for_pending_work().await;
@@ -539,12 +558,12 @@ impl Session {
             self.handle_task_abort(task, reason.clone()).await;
         }
         if let Some(turn_context) = turn_context.as_deref() {
-            self.emit_turn_abort_lifecycle(reason.clone(), turn_context.extension_data.as_ref());
+            self.emit_turn_abort_lifecycle(reason.clone(), turn_context.extension_data.as_ref())
+                .await;
         }
         if let Err(err) = self
             .goal_runtime_apply(GoalRuntimeEvent::TaskAborted {
                 turn_context: turn_context.as_deref(),
-                reason: reason.clone(),
             })
             .await
         {
@@ -552,7 +571,7 @@ impl Session {
         }
         // Let interrupted tasks observe cancellation before dropping pending approvals, or an
         // in-flight approval wait can surface as a model-visible rejection before TurnAborted.
-        active_turn.clear_pending().await;
+        self.input_queue.clear_pending(&active_turn).await;
 
         if reason == TurnAbortReason::Interrupted {
             self.maybe_start_turn_for_pending_work().await;
@@ -570,7 +589,7 @@ impl Session {
             .turn_metadata_state
             .cancel_git_enrichment_task();
 
-        let mut pending_input = Vec::<ResponseInputItem>::new();
+        let mut pending_input = Vec::<TurnInput>::new();
         let mut should_clear_active_turn = false;
         let mut token_usage_at_turn_start = None;
         let mut turn_had_memory_citation = false;
@@ -594,23 +613,34 @@ impl Session {
             }
         };
         if let Some(turn_state) = turn_state.as_ref() {
-            let mut ts = turn_state.lock().await;
-            pending_input = ts.take_pending_input();
+            pending_input = self
+                .input_queue
+                .take_pending_input_for_turn_state(turn_state.as_ref())
+                .await;
+            let ts = turn_state.lock().await;
             turn_had_memory_citation = ts.has_memory_citation;
             turn_tool_calls = ts.tool_calls;
             token_usage_at_turn_start = Some(ts.token_usage_at_turn_start.clone());
         }
         if !pending_input.is_empty() {
             for pending_input_item in pending_input {
-                match inspect_pending_input(self, &turn_context, pending_input_item).await {
-                    PendingInputHookDisposition::Accepted(pending_input) => {
-                        record_pending_input(self, &turn_context, *pending_input).await;
-                    }
-                    PendingInputHookDisposition::Blocked {
-                        additional_contexts,
-                    } => {
-                        record_additional_contexts(self, &turn_context, additional_contexts).await;
-                    }
+                let hook_outcome =
+                    inspect_pending_input(self, &turn_context, &pending_input_item).await;
+                if hook_outcome.should_stop {
+                    record_additional_contexts(
+                        self,
+                        &turn_context,
+                        hook_outcome.additional_contexts,
+                    )
+                    .await;
+                } else {
+                    record_pending_input(
+                        self,
+                        &turn_context,
+                        pending_input_item,
+                        hook_outcome.additional_contexts,
+                    )
+                    .await;
                 }
             }
         }
@@ -742,7 +772,8 @@ impl Session {
             .time_to_first_token_ms()
             .await;
         if should_clear_active_turn {
-            self.emit_turn_stop_lifecycle(turn_context.extension_data.as_ref());
+            self.emit_turn_stop_lifecycle(turn_context.extension_data.as_ref())
+                .await;
         }
         if let Err(err) = self
             .goal_runtime_apply(GoalRuntimeEvent::TurnFinished {
@@ -829,7 +860,10 @@ impl Session {
 
         task.handle.abort();
 
-        let session_ctx = Arc::new(SessionTaskContext::new(Arc::clone(self)));
+        let session_ctx = Arc::new(SessionTaskContext::new(
+            Arc::clone(self),
+            Arc::clone(&task.turn_extension_data),
+        ));
         session_task
             .abort(session_ctx, Arc::clone(&task.turn_context))
             .await;
diff --git a/codex-rs/core/src/tasks/regular.rs b/codex-rs/core/src/tasks/regular.rs
index 08c4933488..50414df278 100644
--- a/codex-rs/core/src/tasks/regular.rs
+++ b/codex-rs/core/src/tasks/regular.rs
@@ -45,6 +45,7 @@ impl SessionTask for RegularTask {
         cancellation_token: CancellationToken,
     ) -> Option<String> {
         let sess = session.clone_session();
+        let turn_extension_data = session.turn_extension_data();
         let run_turn_span = trace_span!("run_turn");
         // Regular turns emit `TurnStarted` inline so first-turn lifecycle does
         // not wait on startup prewarm resolution.
@@ -72,13 +73,14 @@ impl SessionTask for RegularTask {
             let last_agent_message = run_turn(
                 Arc::clone(&sess),
                 Arc::clone(&ctx),
+                Arc::clone(&turn_extension_data),
                 next_input,
                 prewarmed_client_session.take(),
                 cancellation_token.child_token(),
             )
             .instrument(run_turn_span.clone())
             .await;
-            if !sess.has_pending_input().await {
+            if !sess.input_queue.has_pending_input(&sess.active_turn).await {
                 return last_agent_message;
             }
             next_input = Vec::new();
diff --git a/codex-rs/core/src/tasks/user_shell.rs b/codex-rs/core/src/tasks/user_shell.rs
index 683856b90e..23f3882eda 100644
--- a/codex-rs/core/src/tasks/user_shell.rs
+++ b/codex-rs/core/src/tasks/user_shell.rs
@@ -148,6 +148,7 @@ pub(crate) async fn execute_user_shell_command(
     let exec_command = maybe_wrap_shell_lc_with_snapshot(
         &display_command,
         session_shell.as_ref(),
+        #[allow(deprecated)]
         &turn_context.cwd,
         &turn_context.shell_environment_policy.r#set,
         &exec_env_map,
@@ -155,6 +156,7 @@ pub(crate) async fn execute_user_shell_command(
 
     let call_id = Uuid::new_v4().to_string();
     let raw_command = command;
+    #[allow(deprecated)]
     let cwd = turn_context.cwd.clone();
 
     let parsed_cmd = parse_command(&display_command);
diff --git a/codex-rs/core/src/thread_manager.rs b/codex-rs/core/src/thread_manager.rs
index 7b3d0a9921..e5b4fcf6a2 100644
--- a/codex-rs/core/src/thread_manager.rs
+++ b/codex-rs/core/src/thread_manager.rs
@@ -1228,7 +1228,7 @@ impl ThreadManagerState {
             .finalize_thread_spawn(codex, thread_id, tracked_session_source)
             .await?;
         if is_resumed_thread {
-            new_thread.thread.emit_thread_resume_lifecycle();
+            new_thread.thread.emit_thread_resume_lifecycle().await;
             if let Err(err) = new_thread.thread.apply_goal_resume_runtime_effects().await {
                 warn!("failed to apply goal resume runtime effects: {err}");
             }
diff --git a/codex-rs/core/src/thread_manager_tests.rs b/codex-rs/core/src/thread_manager_tests.rs
index 9fedff9470..255a8336b9 100644
--- a/codex-rs/core/src/thread_manager_tests.rs
+++ b/codex-rs/core/src/thread_manager_tests.rs
@@ -309,7 +309,7 @@ async fn start_thread_rejects_explicit_local_environment_when_default_provider_i
     let environment_manager = Arc::new(
         codex_exec_server::EnvironmentManager::create_for_tests(
             Some("none".to_string()),
-            runtime_paths,
+            Some(runtime_paths),
         )
         .await,
     );
@@ -373,7 +373,7 @@ args = ["dev", "cd /tmp && true"]
     let environment_manager = Arc::new(
         codex_exec_server::EnvironmentManager::from_codex_home(
             config.codex_home.clone(),
-            runtime_paths,
+            Some(runtime_paths),
         )
         .await
         .expect("environment manager"),
@@ -1127,6 +1127,7 @@ fn completed_legacy_event_history_is_not_mid_turn() {
             images: None,
             text_elements: Vec::new(),
             local_images: Vec::new(),
+            ..Default::default()
         })),
         RolloutItem::EventMsg(EventMsg::AgentMessage(AgentMessageEvent {
             message: "done".to_string(),
@@ -1154,6 +1155,7 @@ fn mixed_response_and_legacy_user_event_history_is_mid_turn() {
             images: None,
             text_elements: Vec::new(),
             local_images: Vec::new(),
+            ..Default::default()
         })),
     ]);
 
@@ -1559,6 +1561,7 @@ async fn resumed_thread_keeps_paused_goal_paused() -> anyhow::Result<()> {
         .state_db()
         .expect("source thread should have a state db");
     state_db
+        .thread_goals()
         .replace_thread_goal(
             source.thread_id,
             "Keep working until the task is done",
@@ -1579,6 +1582,7 @@ async fn resumed_thread_keeps_paused_goal_paused() -> anyhow::Result<()> {
         .await
         .expect("resume source thread");
     let goal = state_db
+        .thread_goals()
         .get_thread_goal(resumed.thread_id)
         .await?
         .expect("goal should still exist after resume");
diff --git a/codex-rs/core/src/tools/code_mode/execute_handler.rs b/codex-rs/core/src/tools/code_mode/execute_handler.rs
index eaa4150201..e101e1a800 100644
--- a/codex-rs/core/src/tools/code_mode/execute_handler.rs
+++ b/codex-rs/core/src/tools/code_mode/execute_handler.rs
@@ -2,8 +2,9 @@ use crate::function_tool::FunctionCallError;
 use crate::tools::context::FunctionToolOutput;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolPayload;
+use crate::tools::context::boxed_tool_output;
+use crate::tools::registry::CoreToolRuntime;
 use crate::tools::registry::ToolExecutor;
-use crate::tools::registry::ToolHandler;
 use codex_tools::ToolName;
 use codex_tools::ToolSpec;
 
@@ -87,9 +88,8 @@ impl CodeModeExecuteHandler {
     }
 }
 
+#[async_trait::async_trait]
 impl ToolExecutor<ToolInvocation> for CodeModeExecuteHandler {
-    type Output = FunctionToolOutput;
-
     fn tool_name(&self) -> ToolName {
         ToolName::plain(PUBLIC_TOOL_NAME)
     }
@@ -98,7 +98,10 @@ impl ToolExecutor<ToolInvocation> for CodeModeExecuteHandler {
         Some(self.spec.clone())
     }
 
-    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+    async fn handle(
+        &self,
+        invocation: ToolInvocation,
+    ) -> Result<Box<dyn crate::tools::context::ToolOutput>, FunctionCallError> {
         let ToolInvocation {
             session,
             turn,
@@ -109,9 +112,10 @@ impl ToolExecutor<ToolInvocation> for CodeModeExecuteHandler {
         } = invocation;
 
         match payload {
-            ToolPayload::Custom { input } if is_exec_tool_name(&tool_name) => {
-                self.execute(session, turn, call_id, input).await
-            }
+            ToolPayload::Custom { input } if is_exec_tool_name(&tool_name) => self
+                .execute(session, turn, call_id, input)
+                .await
+                .map(boxed_tool_output),
             _ => Err(FunctionCallError::RespondToModel(format!(
                 "{PUBLIC_TOOL_NAME} expects raw JavaScript source text"
             ))),
@@ -119,7 +123,7 @@ impl ToolExecutor<ToolInvocation> for CodeModeExecuteHandler {
     }
 }
 
-impl ToolHandler for CodeModeExecuteHandler {
+impl CoreToolRuntime for CodeModeExecuteHandler {
     fn matches_kind(&self, payload: &ToolPayload) -> bool {
         matches!(payload, ToolPayload::Custom { .. })
     }
diff --git a/codex-rs/core/src/tools/code_mode/response_adapter.rs b/codex-rs/core/src/tools/code_mode/response_adapter.rs
index e20cf6a071..133d6e2fc1 100644
--- a/codex-rs/core/src/tools/code_mode/response_adapter.rs
+++ b/codex-rs/core/src/tools/code_mode/response_adapter.rs
@@ -17,8 +17,6 @@ impl IntoProtocol<ImageDetail> for CodeModeImageDetail {
     fn into_protocol(self) -> ImageDetail {
         let value = self;
         match value {
-            CodeModeImageDetail::Auto => ImageDetail::Auto,
-            CodeModeImageDetail::Low => ImageDetail::Low,
             CodeModeImageDetail::High => ImageDetail::High,
             CodeModeImageDetail::Original => ImageDetail::Original,
         }
diff --git a/codex-rs/core/src/tools/code_mode/wait_handler.rs b/codex-rs/core/src/tools/code_mode/wait_handler.rs
index 070b9270d5..725535339f 100644
--- a/codex-rs/core/src/tools/code_mode/wait_handler.rs
+++ b/codex-rs/core/src/tools/code_mode/wait_handler.rs
@@ -1,11 +1,11 @@
 use serde::Deserialize;
 
 use crate::function_tool::FunctionCallError;
-use crate::tools::context::FunctionToolOutput;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolPayload;
+use crate::tools::context::boxed_tool_output;
+use crate::tools::registry::CoreToolRuntime;
 use crate::tools::registry::ToolExecutor;
-use crate::tools::registry::ToolHandler;
 use codex_tools::ToolName;
 use codex_tools::ToolSpec;
 
@@ -41,9 +41,8 @@ where
     })
 }
 
+#[async_trait::async_trait]
 impl ToolExecutor<ToolInvocation> for CodeModeWaitHandler {
-    type Output = FunctionToolOutput;
-
     fn tool_name(&self) -> ToolName {
         ToolName::plain(WAIT_TOOL_NAME)
     }
@@ -52,7 +51,10 @@ impl ToolExecutor<ToolInvocation> for CodeModeWaitHandler {
         Some(create_wait_tool())
     }
 
-    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+    async fn handle(
+        &self,
+        invocation: ToolInvocation,
+    ) -> Result<Box<dyn crate::tools::context::ToolOutput>, FunctionCallError> {
         let ToolInvocation {
             session,
             turn,
@@ -98,6 +100,7 @@ impl ToolExecutor<ToolInvocation> for CodeModeWaitHandler {
                 }
                 handle_runtime_response(&exec, wait_response.into(), args.max_tokens, started_at)
                     .await
+                    .map(boxed_tool_output)
                     .map_err(FunctionCallError::RespondToModel)
             }
             _ => Err(FunctionCallError::RespondToModel(format!(
@@ -107,4 +110,4 @@ impl ToolExecutor<ToolInvocation> for CodeModeWaitHandler {
     }
 }
 
-impl ToolHandler for CodeModeWaitHandler {}
+impl CoreToolRuntime for CodeModeWaitHandler {}
diff --git a/codex-rs/core/src/tools/context.rs b/codex-rs/core/src/tools/context.rs
index 0f3ae631a0..5fc19a2a2e 100644
--- a/codex-rs/core/src/tools/context.rs
+++ b/codex-rs/core/src/tools/context.rs
@@ -28,6 +28,13 @@ use tokio_util::sync::CancellationToken;
 pub use codex_tools::ToolOutput;
 pub use codex_tools::ToolPayload;
 
+pub(crate) fn boxed_tool_output<T>(output: T) -> Box<dyn ToolOutput>
+where
+    T: ToolOutput + 'static,
+{
+    Box::new(output)
+}
+
 pub type SharedTurnDiffTracker = Arc<Mutex<TurnDiffTracker>>;
 
 #[derive(Clone, Debug, Eq, PartialEq)]
@@ -91,6 +98,10 @@ impl ToolOutput for McpToolOutput {
         })
     }
 
+    fn post_tool_use_input(&self, _payload: &ToolPayload) -> Option<JsonValue> {
+        Some(self.tool_input.clone())
+    }
+
     fn post_tool_use_response(&self, _call_id: &str, _payload: &ToolPayload) -> Option<JsonValue> {
         serde_json::to_value(&self.result).ok()
     }
@@ -327,6 +338,20 @@ impl ToolOutput for ExecCommandToolOutput {
         )
     }
 
+    fn post_tool_use_id(&self, call_id: &str) -> String {
+        if self.event_call_id.is_empty() {
+            call_id.to_string()
+        } else {
+            self.event_call_id.clone()
+        }
+    }
+
+    fn post_tool_use_input(&self, _payload: &ToolPayload) -> Option<JsonValue> {
+        self.hook_command
+            .as_ref()
+            .map(|command| serde_json::json!({ "command": command }))
+    }
+
     fn post_tool_use_response(&self, _call_id: &str, _payload: &ToolPayload) -> Option<JsonValue> {
         if self.process_id.is_some() || self.hook_command.is_none() {
             return None;
diff --git a/codex-rs/core/src/tools/events.rs b/codex-rs/core/src/tools/events.rs
index 51f1833f07..747143ff69 100644
--- a/codex-rs/core/src/tools/events.rs
+++ b/codex-rs/core/src/tools/events.rs
@@ -116,7 +116,6 @@ pub(crate) enum ToolEmitter {
         cwd: AbsolutePathBuf,
         source: ExecCommandSource,
         parsed_cmd: Vec<ParsedCommand>,
-        freeform: bool,
     },
     ApplyPatch {
         changes: HashMap<PathBuf, FileChange>,
@@ -132,19 +131,13 @@ pub(crate) enum ToolEmitter {
 }
 
 impl ToolEmitter {
-    pub fn shell(
-        command: Vec<String>,
-        cwd: AbsolutePathBuf,
-        source: ExecCommandSource,
-        freeform: bool,
-    ) -> Self {
+    pub fn shell(command: Vec<String>, cwd: AbsolutePathBuf, source: ExecCommandSource) -> Self {
         let parsed_cmd = parse_command(&command);
         Self::Shell {
             command,
             cwd,
             source,
             parsed_cmd,
-            freeform,
         }
     }
 
@@ -328,12 +321,7 @@ impl ToolEmitter {
         output: &ExecToolCallOutput,
         ctx: ToolEventCtx<'_>,
     ) -> String {
-        match self {
-            Self::Shell { freeform: true, .. } => {
-                super::format_exec_output_for_model_freeform(output, ctx.turn.truncation_policy)
-            }
-            _ => super::format_exec_output_for_model_structured(output, ctx.turn.truncation_policy),
-        }
+        super::format_exec_output_for_model(output, ctx.turn.truncation_policy)
     }
 
     pub async fn finish(
diff --git a/codex-rs/core/src/tools/handlers/agent_jobs/report_agent_job_result.rs b/codex-rs/core/src/tools/handlers/agent_jobs/report_agent_job_result.rs
index 7797c8c61b..4641e793c8 100644
--- a/codex-rs/core/src/tools/handlers/agent_jobs/report_agent_job_result.rs
+++ b/codex-rs/core/src/tools/handlers/agent_jobs/report_agent_job_result.rs
@@ -2,9 +2,10 @@ use crate::function_tool::FunctionCallError;
 use crate::tools::context::FunctionToolOutput;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolPayload;
+use crate::tools::context::boxed_tool_output;
 use crate::tools::handlers::agent_jobs_spec::create_report_agent_job_result_tool;
+use crate::tools::registry::CoreToolRuntime;
 use crate::tools::registry::ToolExecutor;
-use crate::tools::registry::ToolHandler;
 use codex_tools::ToolName;
 use codex_tools::ToolSpec;
 
@@ -12,9 +13,8 @@ use super::*;
 
 pub struct ReportAgentJobResultHandler;
 
+#[async_trait::async_trait]
 impl ToolExecutor<ToolInvocation> for ReportAgentJobResultHandler {
-    type Output = FunctionToolOutput;
-
     fn tool_name(&self) -> ToolName {
         ToolName::plain("report_agent_job_result")
     }
@@ -23,7 +23,10 @@ impl ToolExecutor<ToolInvocation> for ReportAgentJobResultHandler {
         Some(create_report_agent_job_result_tool())
     }
 
-    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+    async fn handle(
+        &self,
+        invocation: ToolInvocation,
+    ) -> Result<Box<dyn crate::tools::context::ToolOutput>, FunctionCallError> {
         let ToolInvocation {
             session, payload, ..
         } = invocation;
@@ -37,11 +40,11 @@ impl ToolExecutor<ToolInvocation> for ReportAgentJobResultHandler {
             }
         };
 
-        handle(session, arguments).await
+        handle(session, arguments).await.map(boxed_tool_output)
     }
 }
 
-impl ToolHandler for ReportAgentJobResultHandler {
+impl CoreToolRuntime for ReportAgentJobResultHandler {
     fn matches_kind(&self, payload: &ToolPayload) -> bool {
         matches!(payload, ToolPayload::Function { .. })
     }
diff --git a/codex-rs/core/src/tools/handlers/agent_jobs/spawn_agents_on_csv.rs b/codex-rs/core/src/tools/handlers/agent_jobs/spawn_agents_on_csv.rs
index 6dd7ea2b31..0e51390e79 100644
--- a/codex-rs/core/src/tools/handlers/agent_jobs/spawn_agents_on_csv.rs
+++ b/codex-rs/core/src/tools/handlers/agent_jobs/spawn_agents_on_csv.rs
@@ -2,19 +2,20 @@ use crate::function_tool::FunctionCallError;
 use crate::tools::context::FunctionToolOutput;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolPayload;
+use crate::tools::context::boxed_tool_output;
 use crate::tools::handlers::agent_jobs_spec::create_spawn_agents_on_csv_tool;
+use crate::tools::registry::CoreToolRuntime;
 use crate::tools::registry::ToolExecutor;
-use crate::tools::registry::ToolHandler;
 use codex_tools::ToolName;
 use codex_tools::ToolSpec;
+use codex_utils_absolute_path::AbsolutePathBuf;
 
 use super::*;
 
 pub struct SpawnAgentsOnCsvHandler;
 
+#[async_trait::async_trait]
 impl ToolExecutor<ToolInvocation> for SpawnAgentsOnCsvHandler {
-    type Output = FunctionToolOutput;
-
     fn tool_name(&self) -> ToolName {
         ToolName::plain("spawn_agents_on_csv")
     }
@@ -23,7 +24,10 @@ impl ToolExecutor<ToolInvocation> for SpawnAgentsOnCsvHandler {
         Some(create_spawn_agents_on_csv_tool())
     }
 
-    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+    async fn handle(
+        &self,
+        invocation: ToolInvocation,
+    ) -> Result<Box<dyn crate::tools::context::ToolOutput>, FunctionCallError> {
         let ToolInvocation {
             session,
             turn,
@@ -40,11 +44,13 @@ impl ToolExecutor<ToolInvocation> for SpawnAgentsOnCsvHandler {
             }
         };
 
-        handle(session, turn, arguments).await
+        handle(session, turn, arguments)
+            .await
+            .map(boxed_tool_output)
     }
 }
 
-impl ToolHandler for SpawnAgentsOnCsvHandler {
+impl CoreToolRuntime for SpawnAgentsOnCsvHandler {
     fn matches_kind(&self, payload: &ToolPayload) -> bool {
         matches!(payload, ToolPayload::Function { .. })
     }
@@ -67,8 +73,9 @@ pub async fn handle(
         ));
     }
 
+    let cwd = single_local_environment_cwd(&turn)?;
     let db = required_state_db(&session)?;
-    let input_path = turn.resolve_path(Some(args.csv_path));
+    let input_path = cwd.join(args.csv_path);
     let input_path_display = input_path.display().to_string();
     let csv_content = tokio::fs::read_to_string(&input_path)
         .await
@@ -141,7 +148,7 @@ pub async fn handle(
     let job_id = Uuid::new_v4().to_string();
     let output_csv_path = args.output_csv_path.map_or_else(
         || default_output_csv_path(&input_path, job_id.as_str()),
-        |path| turn.resolve_path(Some(path)),
+        |path| cwd.join(path),
     );
     let job_suffix = &job_id[..8];
     let job_name = format!("agent-job-{job_suffix}");
@@ -286,3 +293,19 @@ pub async fn handle(
     })?;
     Ok(FunctionToolOutput::from_text(content, Some(true)))
 }
+
+fn single_local_environment_cwd(turn: &TurnContext) -> Result<&AbsolutePathBuf, FunctionCallError> {
+    let [turn_environment] = turn.environments.turn_environments.as_slice() else {
+        return Err(FunctionCallError::RespondToModel(
+            "spawn_agents_on_csv requires exactly one local environment".to_string(),
+        ));
+    };
+
+    if turn_environment.environment.is_remote() {
+        return Err(FunctionCallError::RespondToModel(
+            "spawn_agents_on_csv is not supported for remote environments".to_string(),
+        ));
+    }
+
+    Ok(&turn_environment.cwd)
+}
diff --git a/codex-rs/core/src/tools/handlers/apply_patch.rs b/codex-rs/core/src/tools/handlers/apply_patch.rs
index 32edd21da1..500751137b 100644
--- a/codex-rs/core/src/tools/handlers/apply_patch.rs
+++ b/codex-rs/core/src/tools/handlers/apply_patch.rs
@@ -17,8 +17,8 @@ use crate::tools::context::ApplyPatchToolOutput;
 use crate::tools::context::FunctionToolOutput;
 use crate::tools::context::SharedTurnDiffTracker;
 use crate::tools::context::ToolInvocation;
-use crate::tools::context::ToolOutput;
 use crate::tools::context::ToolPayload;
+use crate::tools::context::boxed_tool_output;
 use crate::tools::events::ToolEmitter;
 use crate::tools::events::ToolEventCtx;
 use crate::tools::handlers::apply_granted_turn_permissions;
@@ -27,11 +27,11 @@ use crate::tools::handlers::resolve_tool_environment;
 use crate::tools::handlers::updated_hook_command;
 use crate::tools::hook_names::HookToolName;
 use crate::tools::orchestrator::ToolOrchestrator;
+use crate::tools::registry::CoreToolRuntime;
 use crate::tools::registry::PostToolUsePayload;
 use crate::tools::registry::PreToolUsePayload;
 use crate::tools::registry::ToolArgumentDiffConsumer;
 use crate::tools::registry::ToolExecutor;
-use crate::tools::registry::ToolHandler;
 use crate::tools::runtimes::apply_patch::ApplyPatchRequest;
 use crate::tools::runtimes::apply_patch::ApplyPatchRuntime;
 use crate::tools::sandboxing::ToolCtx;
@@ -297,9 +297,8 @@ async fn effective_patch_permissions(
     )
 }
 
+#[async_trait::async_trait]
 impl ToolExecutor<ToolInvocation> for ApplyPatchHandler {
-    type Output = ApplyPatchToolOutput;
-
     fn tool_name(&self) -> ToolName {
         ToolName::plain("apply_patch")
     }
@@ -308,7 +307,10 @@ impl ToolExecutor<ToolInvocation> for ApplyPatchHandler {
         Some(create_apply_patch_freeform_tool(self.multi_environment))
     }
 
-    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+    async fn handle(
+        &self,
+        invocation: ToolInvocation,
+    ) -> Result<Box<dyn crate::tools::context::ToolOutput>, FunctionCallError> {
         let ToolInvocation {
             session,
             turn,
@@ -345,8 +347,7 @@ impl ToolExecutor<ToolInvocation> for ApplyPatchHandler {
         };
         let cwd = turn_environment.cwd.clone();
         let fs = turn_environment.environment.get_filesystem();
-        let mut sandbox = turn.file_system_sandbox_context(/*additional_permissions*/ None);
-        sandbox.cwd = Some(cwd.clone());
+        let sandbox = turn.file_system_sandbox_context(/*additional_permissions*/ None, &cwd);
         match codex_apply_patch::verify_apply_patch_args(args, &cwd, fs.as_ref(), Some(&sandbox))
             .await
         {
@@ -359,7 +360,7 @@ impl ToolExecutor<ToolInvocation> for ApplyPatchHandler {
                 {
                     InternalApplyPatchInvocation::Output(item) => {
                         let content = item?;
-                        Ok(ApplyPatchToolOutput::from_text(content))
+                        Ok(boxed_tool_output(ApplyPatchToolOutput::from_text(content)))
                     }
                     InternalApplyPatchInvocation::DelegateToRuntime(apply) => {
                         let changes = convert_apply_patch_to_protocol(&apply.action);
@@ -414,7 +415,7 @@ impl ToolExecutor<ToolInvocation> for ApplyPatchHandler {
                             Some(&tracker),
                         );
                         let content = emitter.finish(event_ctx, out, delta.as_ref()).await?;
-                        Ok(ApplyPatchToolOutput::from_text(content))
+                        Ok(boxed_tool_output(ApplyPatchToolOutput::from_text(content)))
                     }
                 }
             }
@@ -438,7 +439,7 @@ impl ToolExecutor<ToolInvocation> for ApplyPatchHandler {
     }
 }
 
-impl ToolHandler for ApplyPatchHandler {
+impl CoreToolRuntime for ApplyPatchHandler {
     fn matches_kind(&self, payload: &ToolPayload) -> bool {
         matches!(payload, ToolPayload::Custom { .. })
     }
@@ -472,7 +473,7 @@ impl ToolHandler for ApplyPatchHandler {
     fn post_tool_use_payload(
         &self,
         invocation: &ToolInvocation,
-        result: &Self::Output,
+        result: &dyn crate::tools::context::ToolOutput,
     ) -> Option<PostToolUsePayload> {
         let tool_response =
             result.post_tool_use_response(&invocation.call_id, &invocation.payload)?;
@@ -499,8 +500,7 @@ pub(crate) async fn intercept_apply_patch(
     call_id: &str,
     tool_name: &str,
 ) -> Result<Option<FunctionToolOutput>, FunctionCallError> {
-    let mut sandbox = turn.file_system_sandbox_context(/*additional_permissions*/ None);
-    sandbox.cwd = Some(cwd.clone());
+    let sandbox = turn.file_system_sandbox_context(/*additional_permissions*/ None, cwd);
     match codex_apply_patch::maybe_parse_apply_patch_verified(command, cwd, fs, Some(&sandbox))
         .await
     {
diff --git a/codex-rs/core/src/tools/handlers/apply_patch_tests.rs b/codex-rs/core/src/tools/handlers/apply_patch_tests.rs
index 99854d23ea..e9a118641a 100644
--- a/codex-rs/core/src/tools/handlers/apply_patch_tests.rs
+++ b/codex-rs/core/src/tools/handlers/apply_patch_tests.rs
@@ -3,7 +3,6 @@ use codex_apply_patch::MaybeApplyPatchVerified;
 use codex_exec_server::LOCAL_FS;
 use codex_protocol::permissions::FileSystemSandboxPolicy;
 use codex_protocol::protocol::FileChange;
-use codex_protocol::protocol::SandboxPolicy;
 use core_test_support::PathBufExt;
 use core_test_support::PathExt;
 use pretty_assertions::assert_eq;
@@ -251,12 +250,11 @@ fn write_permissions_for_paths_skip_dirs_already_writable_under_workspace_root()
     std::fs::create_dir_all(&nested).expect("create nested dir");
     let file_path = AbsolutePathBuf::try_from(nested.join("file.txt"))
         .expect("nested file path should be absolute");
-    let sandbox_policy = FileSystemSandboxPolicy::from(&SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![],
-        network_access: false,
-        exclude_tmpdir_env_var: true,
-        exclude_slash_tmp: false,
-    });
+    let sandbox_policy = FileSystemSandboxPolicy::workspace_write(
+        &[],
+        /*exclude_tmpdir_env_var*/ true,
+        /*exclude_slash_tmp*/ false,
+    );
 
     let permissions = write_permissions_for_paths(&[file_path], &sandbox_policy, &cwd);
 
@@ -273,12 +271,11 @@ fn write_permissions_for_paths_keep_dirs_outside_workspace_root() {
     let file_path = AbsolutePathBuf::try_from(outside.join("file.txt"))
         .expect("outside file path should be absolute");
     let cwd_abs = cwd.abs();
-    let sandbox_policy = FileSystemSandboxPolicy::from(&SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![],
-        network_access: false,
-        exclude_tmpdir_env_var: true,
-        exclude_slash_tmp: true,
-    });
+    let sandbox_policy = FileSystemSandboxPolicy::workspace_write(
+        &[],
+        /*exclude_tmpdir_env_var*/ true,
+        /*exclude_slash_tmp*/ true,
+    );
 
     let permissions = write_permissions_for_paths(&[file_path], &sandbox_policy, &cwd_abs);
     let expected_outside =
diff --git a/codex-rs/core/src/tools/handlers/dynamic.rs b/codex-rs/core/src/tools/handlers/dynamic.rs
index 3f3e72e2f3..5d20128ff3 100644
--- a/codex-rs/core/src/tools/handlers/dynamic.rs
+++ b/codex-rs/core/src/tools/handlers/dynamic.rs
@@ -4,9 +4,11 @@ use crate::session::turn_context::TurnContext;
 use crate::tools::context::FunctionToolOutput;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolPayload;
+use crate::tools::context::boxed_tool_output;
 use crate::tools::handlers::parse_arguments;
+use crate::tools::registry::CoreToolRuntime;
 use crate::tools::registry::ToolExecutor;
-use crate::tools::registry::ToolHandler;
+use crate::tools::registry::ToolExposure;
 use crate::tools::tool_search_entry::ToolSearchInfo;
 use crate::turn_timing::now_unix_timestamp_ms;
 use codex_protocol::dynamic_tools::DynamicToolCallRequest;
@@ -30,6 +32,7 @@ use tracing::warn;
 pub struct DynamicToolHandler {
     tool_name: ToolName,
     spec: Option<ToolSpec>,
+    exposure: ToolExposure,
     search_text: String,
 }
 
@@ -48,14 +51,18 @@ impl DynamicToolHandler {
         Some(Self {
             tool_name,
             spec: Some(spec),
+            exposure: if tool.defer_loading {
+                ToolExposure::Deferred
+            } else {
+                ToolExposure::Direct
+            },
             search_text: build_dynamic_search_text(tool),
         })
     }
 }
 
+#[async_trait::async_trait]
 impl ToolExecutor<ToolInvocation> for DynamicToolHandler {
-    type Output = FunctionToolOutput;
-
     fn tool_name(&self) -> ToolName {
         self.tool_name.clone()
     }
@@ -64,7 +71,14 @@ impl ToolExecutor<ToolInvocation> for DynamicToolHandler {
         self.spec.clone()
     }
 
-    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+    fn exposure(&self) -> ToolExposure {
+        self.exposure
+    }
+
+    async fn handle(
+        &self,
+        invocation: ToolInvocation,
+    ) -> Result<Box<dyn crate::tools::context::ToolOutput>, FunctionCallError> {
         let ToolInvocation {
             session,
             turn,
@@ -105,11 +119,14 @@ impl ToolExecutor<ToolInvocation> for DynamicToolHandler {
             .into_iter()
             .map(FunctionCallOutputContentItem::from)
             .collect::<Vec<_>>();
-        Ok(FunctionToolOutput::from_content(body, Some(success)))
+        Ok(boxed_tool_output(FunctionToolOutput::from_content(
+            body,
+            Some(success),
+        )))
     }
 }
 
-impl ToolHandler for DynamicToolHandler {
+impl CoreToolRuntime for DynamicToolHandler {
     fn search_info(&self) -> Option<ToolSearchInfo> {
         ToolSearchInfo::from_spec(
             self.search_text.clone(),
diff --git a/codex-rs/core/src/tools/handlers/extension_tools.rs b/codex-rs/core/src/tools/handlers/extension_tools.rs
index cd94d88698..37ad2d65fd 100644
--- a/codex-rs/core/src/tools/handlers/extension_tools.rs
+++ b/codex-rs/core/src/tools/handlers/extension_tools.rs
@@ -1,7 +1,5 @@
 use std::sync::Arc;
 
-use codex_extension_api::ExtensionToolExecutor;
-use codex_extension_api::ExtensionToolOutput;
 use codex_tools::ToolCall as ExtensionToolCall;
 use codex_tools::ToolName;
 use codex_tools::ToolSpec;
@@ -13,18 +11,16 @@ use crate::tools::context::ToolOutput;
 use crate::tools::context::ToolPayload;
 use crate::tools::flat_tool_name;
 use crate::tools::hook_names::HookToolName;
+use crate::tools::registry::CoreToolRuntime;
 use crate::tools::registry::PostToolUsePayload;
 use crate::tools::registry::PreToolUsePayload;
 use crate::tools::registry::ToolExecutor;
-use crate::tools::registry::ToolHandler;
 
-pub(crate) struct ExtensionToolHandler {
-    executor: Arc<dyn ExtensionToolExecutor>,
-}
+pub(crate) struct ExtensionToolAdapter(Arc<dyn codex_tools::ToolExecutor<ExtensionToolCall>>);
 
-impl ExtensionToolHandler {
-    pub(crate) fn new(executor: Arc<dyn ExtensionToolExecutor>) -> Self {
-        Self { executor }
+impl ExtensionToolAdapter {
+    pub(crate) fn new(executor: Arc<dyn codex_tools::ToolExecutor<ExtensionToolCall>>) -> Self {
+        Self(executor)
     }
 
     fn arguments_from_payload<'a>(&self, payload: &'a ToolPayload) -> Option<&'a str> {
@@ -35,23 +31,33 @@ impl ExtensionToolHandler {
     }
 }
 
-impl ToolExecutor<ToolInvocation> for ExtensionToolHandler {
-    type Output = ExtensionToolOutput;
-
+#[async_trait::async_trait]
+impl ToolExecutor<ToolInvocation> for ExtensionToolAdapter {
     fn tool_name(&self) -> ToolName {
-        self.executor.tool_name()
+        self.0.tool_name()
     }
 
     fn spec(&self) -> Option<ToolSpec> {
-        self.executor.spec()
+        self.0.spec()
     }
 
-    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
-        self.executor.handle(to_extension_call(&invocation)).await
+    fn exposure(&self) -> crate::tools::registry::ToolExposure {
+        self.0.exposure()
+    }
+
+    fn supports_parallel_tool_calls(&self) -> bool {
+        self.0.supports_parallel_tool_calls()
+    }
+
+    async fn handle(
+        &self,
+        invocation: ToolInvocation,
+    ) -> Result<Box<dyn ToolOutput>, FunctionCallError> {
+        self.0.handle(to_extension_call(&invocation)).await
     }
 }
 
-impl ToolHandler for ExtensionToolHandler {
+impl CoreToolRuntime for ExtensionToolAdapter {
     fn matches_kind(&self, payload: &ToolPayload) -> bool {
         self.arguments_from_payload(payload).is_some()
     }
@@ -67,7 +73,7 @@ impl ToolHandler for ExtensionToolHandler {
     fn post_tool_use_payload(
         &self,
         invocation: &ToolInvocation,
-        result: &Self::Output,
+        result: &dyn ToolOutput,
     ) -> Option<PostToolUsePayload> {
         let arguments = self.arguments_from_payload(&invocation.payload)?;
         Some(PostToolUsePayload {
@@ -103,19 +109,20 @@ mod tests {
     use pretty_assertions::assert_eq;
     use serde_json::json;
 
-    use super::ExtensionToolHandler;
+    use super::ExtensionToolAdapter;
     use crate::tools::context::ToolCallSource;
     use crate::tools::context::ToolInvocation;
     use crate::tools::context::ToolPayload;
     use crate::tools::hook_names::HookToolName;
+    use crate::tools::registry::CoreToolRuntime;
     use crate::tools::registry::PostToolUsePayload;
     use crate::tools::registry::PreToolUsePayload;
-    use crate::tools::registry::ToolHandler;
     use crate::turn_diff_tracker::TurnDiffTracker;
 
     struct StubExtensionExecutor;
 
-    impl codex_extension_api::ExtensionToolExecutor for StubExtensionExecutor {
+    #[async_trait::async_trait]
+    impl codex_extension_api::ToolExecutor<codex_tools::ToolCall> for StubExtensionExecutor {
         fn tool_name(&self) -> codex_tools::ToolName {
             codex_tools::ToolName::plain("extension_echo")
         }
@@ -141,17 +148,19 @@ mod tests {
             ))
         }
 
-        fn handle(
+        async fn handle(
             &self,
             _call: codex_tools::ToolCall,
-        ) -> codex_extension_api::ExtensionToolFuture<'_> {
-            Box::pin(async { Ok(codex_tools::JsonToolOutput::new(json!({ "ok": true }))) })
+        ) -> Result<Box<dyn codex_tools::ToolOutput>, codex_tools::FunctionCallError> {
+            Ok(Box::new(codex_tools::JsonToolOutput::new(
+                json!({ "ok": true }),
+            )))
         }
     }
 
     #[tokio::test]
     async fn exposes_generic_hook_payloads() {
-        let handler = ExtensionToolHandler::new(Arc::new(StubExtensionExecutor));
+        let handler = ExtensionToolAdapter::new(Arc::new(StubExtensionExecutor));
         let (session, turn) = crate::session::tests::make_session_and_context().await;
         let invocation = ToolInvocation {
             session: session.into(),
@@ -168,14 +177,14 @@ mod tests {
         let output = codex_tools::JsonToolOutput::new(json!({ "ok": true }));
 
         assert_eq!(
-            ToolHandler::pre_tool_use_payload(&handler, &invocation),
+            CoreToolRuntime::pre_tool_use_payload(&handler, &invocation),
             Some(PreToolUsePayload {
                 tool_name: HookToolName::new("extension_echo"),
                 tool_input: json!({ "message": "hello" }),
             })
         );
         assert_eq!(
-            ToolHandler::post_tool_use_payload(&handler, &invocation, &output),
+            CoreToolRuntime::post_tool_use_payload(&handler, &invocation, &output),
             Some(PostToolUsePayload {
                 tool_name: HookToolName::new("extension_echo"),
                 tool_use_id: "call-extension".to_string(),
diff --git a/codex-rs/core/src/tools/handlers/goal.rs b/codex-rs/core/src/tools/handlers/goal.rs
index 28e33f2be4..694eafca65 100644
--- a/codex-rs/core/src/tools/handlers/goal.rs
+++ b/codex-rs/core/src/tools/handlers/goal.rs
@@ -1,8 +1,8 @@
 //! Built-in model tool handlers for persisted thread goals.
 //!
-//! The public tool contract intentionally splits goal creation from completion:
-//! `create_goal` starts an active objective, while `update_goal` can only mark
-//! the existing goal complete.
+//! The public tool contract intentionally splits goal creation from stopped
+//! status updates: `create_goal` starts an active objective, while
+//! `update_goal` can only mark the existing goal complete or blocked.
 
 use crate::function_tool::FunctionCallError;
 use crate::tools::context::FunctionToolOutput;
@@ -87,20 +87,13 @@ fn goal_response(
 }
 
 fn completion_budget_report(goal: &ThreadGoal) -> Option<String> {
-    let mut parts = Vec::new();
-    if let Some(budget) = goal.token_budget {
-        parts.push(format!("tokens used: {} of {budget}", goal.tokens_used));
-    }
-    if goal.time_used_seconds > 0 {
-        parts.push(format!("time used: {} seconds", goal.time_used_seconds));
-    }
-    if parts.is_empty() {
+    if goal.token_budget.is_none() && goal.time_used_seconds <= 0 {
         None
     } else {
-        Some(format!(
-            "Goal achieved. Report final budget usage to the user: {}.",
-            parts.join("; ")
-        ))
+        Some(
+            "Goal achieved. Report final usage from this tool result's structured goal fields. If `goal.tokenBudget` is present, include token usage from `goal.tokensUsed` and `goal.tokenBudget`. If `goal.timeUsedSeconds` is greater than 0, summarize elapsed time in a concise, human-friendly form appropriate to the response language."
+                .to_string(),
+        )
     }
 }
 
@@ -131,7 +124,7 @@ mod tests {
                 goal: Some(goal),
                 remaining_tokens: Some(6_750),
                 completion_budget_report: Some(
-                    "Goal achieved. Report final budget usage to the user: tokens used: 3250 of 10000; time used: 75 seconds."
+                    "Goal achieved. Report final usage from this tool result's structured goal fields. If `goal.tokenBudget` is present, include token usage from `goal.tokensUsed` and `goal.tokenBudget`. If `goal.timeUsedSeconds` is greater than 0, summarize elapsed time in a concise, human-friendly form appropriate to the response language."
                         .to_string()
                 ),
             }
diff --git a/codex-rs/core/src/tools/handlers/goal/create_goal.rs b/codex-rs/core/src/tools/handlers/goal/create_goal.rs
index 34a4c9307c..9ae0107f34 100644
--- a/codex-rs/core/src/tools/handlers/goal/create_goal.rs
+++ b/codex-rs/core/src/tools/handlers/goal/create_goal.rs
@@ -1,13 +1,13 @@
 use crate::function_tool::FunctionCallError;
 use crate::goals::CreateGoalRequest;
-use crate::tools::context::FunctionToolOutput;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolPayload;
+use crate::tools::context::boxed_tool_output;
 use crate::tools::handlers::goal_spec::CREATE_GOAL_TOOL_NAME;
 use crate::tools::handlers::goal_spec::create_create_goal_tool;
 use crate::tools::handlers::parse_arguments;
+use crate::tools::registry::CoreToolRuntime;
 use crate::tools::registry::ToolExecutor;
-use crate::tools::registry::ToolHandler;
 use codex_tools::ToolName;
 use codex_tools::ToolSpec;
 
@@ -18,9 +18,8 @@ use super::goal_response;
 
 pub struct CreateGoalHandler;
 
+#[async_trait::async_trait]
 impl ToolExecutor<ToolInvocation> for CreateGoalHandler {
-    type Output = FunctionToolOutput;
-
     fn tool_name(&self) -> ToolName {
         ToolName::plain(CREATE_GOAL_TOOL_NAME)
     }
@@ -29,7 +28,10 @@ impl ToolExecutor<ToolInvocation> for CreateGoalHandler {
         Some(create_create_goal_tool())
     }
 
-    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+    async fn handle(
+        &self,
+        invocation: ToolInvocation,
+    ) -> Result<Box<dyn crate::tools::context::ToolOutput>, FunctionCallError> {
         let ToolInvocation {
             session,
             turn,
@@ -69,8 +71,8 @@ impl ToolExecutor<ToolInvocation> for CreateGoalHandler {
                     FunctionCallError::RespondToModel(format_goal_error(err))
                 }
             })?;
-        goal_response(Some(goal), CompletionBudgetReport::Omit)
+        goal_response(Some(goal), CompletionBudgetReport::Omit).map(boxed_tool_output)
     }
 }
 
-impl ToolHandler for CreateGoalHandler {}
+impl CoreToolRuntime for CreateGoalHandler {}
diff --git a/codex-rs/core/src/tools/handlers/goal/get_goal.rs b/codex-rs/core/src/tools/handlers/goal/get_goal.rs
index 3c0813329e..ff40227fab 100644
--- a/codex-rs/core/src/tools/handlers/goal/get_goal.rs
+++ b/codex-rs/core/src/tools/handlers/goal/get_goal.rs
@@ -1,11 +1,11 @@
 use crate::function_tool::FunctionCallError;
-use crate::tools::context::FunctionToolOutput;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolPayload;
+use crate::tools::context::boxed_tool_output;
 use crate::tools::handlers::goal_spec::GET_GOAL_TOOL_NAME;
 use crate::tools::handlers::goal_spec::create_get_goal_tool;
+use crate::tools::registry::CoreToolRuntime;
 use crate::tools::registry::ToolExecutor;
-use crate::tools::registry::ToolHandler;
 use codex_tools::ToolName;
 use codex_tools::ToolSpec;
 
@@ -15,9 +15,8 @@ use super::goal_response;
 
 pub struct GetGoalHandler;
 
+#[async_trait::async_trait]
 impl ToolExecutor<ToolInvocation> for GetGoalHandler {
-    type Output = FunctionToolOutput;
-
     fn tool_name(&self) -> ToolName {
         ToolName::plain(GET_GOAL_TOOL_NAME)
     }
@@ -26,7 +25,10 @@ impl ToolExecutor<ToolInvocation> for GetGoalHandler {
         Some(create_get_goal_tool())
     }
 
-    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+    async fn handle(
+        &self,
+        invocation: ToolInvocation,
+    ) -> Result<Box<dyn crate::tools::context::ToolOutput>, FunctionCallError> {
         let ToolInvocation {
             session, payload, ..
         } = invocation;
@@ -37,7 +39,7 @@ impl ToolExecutor<ToolInvocation> for GetGoalHandler {
                     .get_thread_goal()
                     .await
                     .map_err(|err| FunctionCallError::RespondToModel(format_goal_error(err)))?;
-                goal_response(goal, CompletionBudgetReport::Omit)
+                goal_response(goal, CompletionBudgetReport::Omit).map(boxed_tool_output)
             }
             _ => Err(FunctionCallError::RespondToModel(
                 "get_goal handler received unsupported payload".to_string(),
@@ -46,4 +48,4 @@ impl ToolExecutor<ToolInvocation> for GetGoalHandler {
     }
 }
 
-impl ToolHandler for GetGoalHandler {}
+impl CoreToolRuntime for GetGoalHandler {}
diff --git a/codex-rs/core/src/tools/handlers/goal/update_goal.rs b/codex-rs/core/src/tools/handlers/goal/update_goal.rs
index 18b59c1b36..16883e0755 100644
--- a/codex-rs/core/src/tools/handlers/goal/update_goal.rs
+++ b/codex-rs/core/src/tools/handlers/goal/update_goal.rs
@@ -1,14 +1,14 @@
 use crate::function_tool::FunctionCallError;
 use crate::goals::GoalRuntimeEvent;
 use crate::goals::SetGoalRequest;
-use crate::tools::context::FunctionToolOutput;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolPayload;
+use crate::tools::context::boxed_tool_output;
 use crate::tools::handlers::goal_spec::UPDATE_GOAL_TOOL_NAME;
 use crate::tools::handlers::goal_spec::create_update_goal_tool;
 use crate::tools::handlers::parse_arguments;
+use crate::tools::registry::CoreToolRuntime;
 use crate::tools::registry::ToolExecutor;
-use crate::tools::registry::ToolHandler;
 use codex_protocol::protocol::ThreadGoalStatus;
 use codex_tools::ToolName;
 use codex_tools::ToolSpec;
@@ -20,9 +20,8 @@ use super::goal_response;
 
 pub struct UpdateGoalHandler;
 
+#[async_trait::async_trait]
 impl ToolExecutor<ToolInvocation> for UpdateGoalHandler {
-    type Output = FunctionToolOutput;
-
     fn tool_name(&self) -> ToolName {
         ToolName::plain(UPDATE_GOAL_TOOL_NAME)
     }
@@ -31,7 +30,10 @@ impl ToolExecutor<ToolInvocation> for UpdateGoalHandler {
         Some(create_update_goal_tool())
     }
 
-    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+    async fn handle(
+        &self,
+        invocation: ToolInvocation,
+    ) -> Result<Box<dyn crate::tools::context::ToolOutput>, FunctionCallError> {
         let ToolInvocation {
             session,
             turn,
@@ -49,9 +51,12 @@ impl ToolExecutor<ToolInvocation> for UpdateGoalHandler {
         };
 
         let args: UpdateGoalArgs = parse_arguments(&arguments)?;
-        if args.status != ThreadGoalStatus::Complete {
+        if !matches!(
+            args.status,
+            ThreadGoalStatus::Complete | ThreadGoalStatus::Blocked
+        ) {
             return Err(FunctionCallError::RespondToModel(
-                "update_goal can only mark the existing goal complete; pause, resume, and budget-limited status changes are controlled by the user or system"
+                "update_goal can only mark the existing goal complete or blocked; pause, resume, budget-limited, and usage-limited status changes are controlled by the user or system"
                     .to_string(),
             ));
         }
@@ -66,14 +71,19 @@ impl ToolExecutor<ToolInvocation> for UpdateGoalHandler {
                 turn.as_ref(),
                 SetGoalRequest {
                     objective: None,
-                    status: Some(ThreadGoalStatus::Complete),
+                    status: Some(args.status),
                     token_budget: None,
                 },
             )
             .await
             .map_err(|err| FunctionCallError::RespondToModel(format_goal_error(err)))?;
-        goal_response(Some(goal), CompletionBudgetReport::Include)
+        let completion_budget_report = if args.status == ThreadGoalStatus::Complete {
+            CompletionBudgetReport::Include
+        } else {
+            CompletionBudgetReport::Omit
+        };
+        goal_response(Some(goal), completion_budget_report).map(boxed_tool_output)
     }
 }
 
-impl ToolHandler for UpdateGoalHandler {}
+impl CoreToolRuntime for UpdateGoalHandler {}
diff --git a/codex-rs/core/src/tools/handlers/goal_spec.rs b/codex-rs/core/src/tools/handlers/goal_spec.rs
index a5ea0ad2f4..a3ae8703ce 100644
--- a/codex-rs/core/src/tools/handlers/goal_spec.rs
+++ b/codex-rs/core/src/tools/handlers/goal_spec.rs
@@ -63,9 +63,9 @@ pub fn create_update_goal_tool() -> ToolSpec {
     let properties = BTreeMap::from([(
         "status".to_string(),
         JsonSchema::string_enum(
-            vec![json!("complete")],
+            vec![json!("complete"), json!("blocked")],
             Some(
-                "Required. Set to complete only when the objective is achieved and no required work remains."
+                "Required. Set to `complete` only when the objective is achieved and no required work remains. Set to `blocked` only after the same blocking condition has recurred for at least three consecutive goal turns and the agent is at an impasse. After a previously blocked goal is resumed, the resumed run starts a fresh blocked audit."
                     .to_string(),
             ),
         ),
@@ -74,10 +74,14 @@ pub fn create_update_goal_tool() -> ToolSpec {
     ToolSpec::Function(ResponsesApiTool {
         name: UPDATE_GOAL_TOOL_NAME.to_string(),
         description: r#"Update the existing goal.
-Use this tool only to mark the goal achieved.
+Use this tool only to mark the goal achieved or genuinely blocked.
 Set status to `complete` only when the objective has actually been achieved and no required work remains.
+Set status to `blocked` only when the same blocking condition has repeated for at least three consecutive goal turns, counting the original/user-triggered turn and any automatic continuations, and the agent cannot make meaningful progress without user input or an external-state change.
+If the user resumes a goal that was previously marked `blocked`, treat the resumed run as a fresh blocked audit. If the same blocking condition then repeats for at least three consecutive resumed goal turns, set status to `blocked` again.
+Once the blocked threshold is satisfied, do not keep reporting that you are still blocked while leaving the goal active; set status to `blocked`.
+Do not use `blocked` merely because the work is hard, slow, uncertain, incomplete, or would benefit from clarification.
 Do not mark a goal complete merely because its budget is nearly exhausted or because you are stopping work.
-You cannot use this tool to pause, resume, or budget-limit a goal; those status changes are controlled by the user or system.
+You cannot use this tool to pause, resume, budget-limit, or usage-limit a goal; those status changes are controlled by the user or system.
 When marking a budgeted goal achieved with status `complete`, report the final token usage from the tool result to the user."#
             .to_string(),
         strict: false,
@@ -96,7 +100,7 @@ mod tests {
     use super::*;
 
     #[test]
-    fn update_goal_tool_only_exposes_complete_status() {
+    fn update_goal_tool_exposes_complete_and_blocked_statuses() {
         let ToolSpec::Function(tool) = create_update_goal_tool() else {
             panic!("update_goal should be a function tool");
         };
@@ -107,6 +111,9 @@ mod tests {
             .and_then(|properties| properties.get("status"))
             .expect("status property should exist");
 
-        assert_eq!(status.enum_values, Some(vec![json!("complete")]));
+        assert_eq!(
+            status.enum_values,
+            Some(vec![json!("complete"), json!("blocked")])
+        );
     }
 }
diff --git a/codex-rs/core/src/tools/handlers/mcp.rs b/codex-rs/core/src/tools/handlers/mcp.rs
index 2cd02e8a0a..6f4f79505b 100644
--- a/codex-rs/core/src/tools/handlers/mcp.rs
+++ b/codex-rs/core/src/tools/handlers/mcp.rs
@@ -6,14 +6,15 @@ use crate::mcp_tool_call::handle_mcp_tool_call;
 use crate::original_image_detail::can_request_original_image_detail;
 use crate::tools::context::McpToolOutput;
 use crate::tools::context::ToolInvocation;
-use crate::tools::context::ToolOutput;
 use crate::tools::context::ToolPayload;
+use crate::tools::context::boxed_tool_output;
 use crate::tools::flat_tool_name;
 use crate::tools::hook_names::HookToolName;
+use crate::tools::registry::CoreToolRuntime;
 use crate::tools::registry::PostToolUsePayload;
 use crate::tools::registry::PreToolUsePayload;
 use crate::tools::registry::ToolExecutor;
-use crate::tools::registry::ToolHandler;
+use crate::tools::registry::ToolExposure;
 use crate::tools::registry::ToolTelemetryTags;
 use crate::tools::tool_search_entry::ToolSearchInfo;
 use codex_mcp::ToolInfo;
@@ -28,17 +29,24 @@ use serde_json::Value;
 
 pub struct McpHandler {
     tool_info: ToolInfo,
+    exposure: ToolExposure,
 }
 
 impl McpHandler {
     pub fn new(tool_info: ToolInfo) -> Self {
-        Self { tool_info }
+        Self::with_exposure(tool_info, ToolExposure::Direct)
+    }
+
+    pub fn with_exposure(tool_info: ToolInfo, exposure: ToolExposure) -> Self {
+        Self {
+            tool_info,
+            exposure,
+        }
     }
 }
 
+#[async_trait::async_trait]
 impl ToolExecutor<ToolInvocation> for McpHandler {
-    type Output = McpToolOutput;
-
     fn tool_name(&self) -> ToolName {
         self.tool_info.canonical_tool_name()
     }
@@ -71,11 +79,18 @@ impl ToolExecutor<ToolInvocation> for McpHandler {
         }))
     }
 
+    fn exposure(&self) -> ToolExposure {
+        self.exposure
+    }
+
     fn supports_parallel_tool_calls(&self) -> bool {
         self.tool_info.supports_parallel_tool_calls
     }
 
-    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+    async fn handle(
+        &self,
+        invocation: ToolInvocation,
+    ) -> Result<Box<dyn crate::tools::context::ToolOutput>, FunctionCallError> {
         let ToolInvocation {
             session,
             turn,
@@ -105,17 +120,17 @@ impl ToolExecutor<ToolInvocation> for McpHandler {
         )
         .await;
 
-        Ok(McpToolOutput {
+        Ok(boxed_tool_output(McpToolOutput {
             result: result.result,
             tool_input: result.tool_input,
             wall_time: started.elapsed(),
             original_image_detail_supported: can_request_original_image_detail(&turn.model_info),
             truncation_policy: turn.truncation_policy,
-        })
+        }))
     }
 }
 
-impl ToolHandler for McpHandler {
+impl CoreToolRuntime for McpHandler {
     fn search_info(&self) -> Option<ToolSearchInfo> {
         let source_name = self
             .tool_info
@@ -142,12 +157,17 @@ impl ToolHandler for McpHandler {
         )
     }
 
-    async fn telemetry_tags(&self, _invocation: &ToolInvocation) -> ToolTelemetryTags {
-        let mut tags = vec![("mcp_server", self.tool_info.server_name.clone())];
-        if let Some(origin) = &self.tool_info.server_origin {
-            tags.push(("mcp_server_origin", origin.clone()));
-        }
-        tags
+    fn telemetry_tags<'a>(
+        &'a self,
+        _invocation: &'a ToolInvocation,
+    ) -> futures::future::BoxFuture<'a, ToolTelemetryTags> {
+        Box::pin(async {
+            let mut tags = vec![("mcp_server", self.tool_info.server_name.clone())];
+            if let Some(origin) = &self.tool_info.server_origin {
+                tags.push(("mcp_server_origin", origin.clone()));
+            }
+            tags
+        })
     }
 
     fn pre_tool_use_payload(&self, invocation: &ToolInvocation) -> Option<PreToolUsePayload> {
@@ -186,7 +206,7 @@ impl ToolHandler for McpHandler {
     fn post_tool_use_payload(
         &self,
         invocation: &ToolInvocation,
-        result: &Self::Output,
+        result: &dyn crate::tools::context::ToolOutput,
     ) -> Option<PostToolUsePayload> {
         let ToolPayload::Function { .. } = &invocation.payload else {
             return None;
@@ -197,7 +217,7 @@ impl ToolHandler for McpHandler {
         Some(PostToolUsePayload {
             tool_name: HookToolName::new(self.tool_name().to_string()),
             tool_use_id: invocation.call_id.clone(),
-            tool_input: result.tool_input.clone(),
+            tool_input: result.post_tool_use_input(&invocation.payload)?,
             tool_response,
         })
     }
diff --git a/codex-rs/core/src/tools/handlers/mcp_resource/list_mcp_resource_templates.rs b/codex-rs/core/src/tools/handlers/mcp_resource/list_mcp_resource_templates.rs
index 0aea2b335e..866c7a9e12 100644
--- a/codex-rs/core/src/tools/handlers/mcp_resource/list_mcp_resource_templates.rs
+++ b/codex-rs/core/src/tools/handlers/mcp_resource/list_mcp_resource_templates.rs
@@ -1,12 +1,12 @@
 use std::time::Instant;
 
 use crate::function_tool::FunctionCallError;
-use crate::tools::context::FunctionToolOutput;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolPayload;
+use crate::tools::context::boxed_tool_output;
 use crate::tools::handlers::mcp_resource_spec::create_list_mcp_resource_templates_tool;
+use crate::tools::registry::CoreToolRuntime;
 use crate::tools::registry::ToolExecutor;
-use crate::tools::registry::ToolHandler;
 use codex_protocol::models::function_call_output_content_items_to_text;
 use codex_protocol::protocol::McpInvocation;
 use codex_tools::ToolName;
@@ -26,9 +26,8 @@ use super::serialize_function_output;
 
 pub struct ListMcpResourceTemplatesHandler;
 
+#[async_trait::async_trait]
 impl ToolExecutor<ToolInvocation> for ListMcpResourceTemplatesHandler {
-    type Output = FunctionToolOutput;
-
     fn tool_name(&self) -> ToolName {
         ToolName::plain("list_mcp_resource_templates")
     }
@@ -45,7 +44,10 @@ impl ToolExecutor<ToolInvocation> for ListMcpResourceTemplatesHandler {
         clippy::await_holding_invalid_type,
         reason = "MCP resource template listing reads through the session-owned manager guard"
     )]
-    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+    async fn handle(
+        &self,
+        invocation: ToolInvocation,
+    ) -> Result<Box<dyn crate::tools::context::ToolOutput>, FunctionCallError> {
         let ToolInvocation {
             session,
             turn,
@@ -130,7 +132,7 @@ impl ToolExecutor<ToolInvocation> for ListMcpResourceTemplatesHandler {
                         Ok(call_tool_result_from_content(&content, output.success)),
                     )
                     .await;
-                    Ok(output)
+                    Ok(boxed_tool_output(output))
                 }
                 Err(err) => {
                     let duration = start.elapsed();
@@ -165,4 +167,4 @@ impl ToolExecutor<ToolInvocation> for ListMcpResourceTemplatesHandler {
     }
 }
 
-impl ToolHandler for ListMcpResourceTemplatesHandler {}
+impl CoreToolRuntime for ListMcpResourceTemplatesHandler {}
diff --git a/codex-rs/core/src/tools/handlers/mcp_resource/list_mcp_resources.rs b/codex-rs/core/src/tools/handlers/mcp_resource/list_mcp_resources.rs
index b412f811bb..c87747eea4 100644
--- a/codex-rs/core/src/tools/handlers/mcp_resource/list_mcp_resources.rs
+++ b/codex-rs/core/src/tools/handlers/mcp_resource/list_mcp_resources.rs
@@ -1,12 +1,12 @@
 use std::time::Instant;
 
 use crate::function_tool::FunctionCallError;
-use crate::tools::context::FunctionToolOutput;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolPayload;
+use crate::tools::context::boxed_tool_output;
 use crate::tools::handlers::mcp_resource_spec::create_list_mcp_resources_tool;
+use crate::tools::registry::CoreToolRuntime;
 use crate::tools::registry::ToolExecutor;
-use crate::tools::registry::ToolHandler;
 use codex_protocol::models::function_call_output_content_items_to_text;
 use codex_protocol::protocol::McpInvocation;
 use codex_tools::ToolName;
@@ -26,9 +26,8 @@ use super::serialize_function_output;
 
 pub struct ListMcpResourcesHandler;
 
+#[async_trait::async_trait]
 impl ToolExecutor<ToolInvocation> for ListMcpResourcesHandler {
-    type Output = FunctionToolOutput;
-
     fn tool_name(&self) -> ToolName {
         ToolName::plain("list_mcp_resources")
     }
@@ -45,7 +44,10 @@ impl ToolExecutor<ToolInvocation> for ListMcpResourcesHandler {
         clippy::await_holding_invalid_type,
         reason = "MCP resource listing reads through the session-owned manager guard"
     )]
-    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+    async fn handle(
+        &self,
+        invocation: ToolInvocation,
+    ) -> Result<Box<dyn crate::tools::context::ToolOutput>, FunctionCallError> {
         let ToolInvocation {
             session,
             turn,
@@ -128,7 +130,7 @@ impl ToolExecutor<ToolInvocation> for ListMcpResourcesHandler {
                         Ok(call_tool_result_from_content(&content, output.success)),
                     )
                     .await;
-                    Ok(output)
+                    Ok(boxed_tool_output(output))
                 }
                 Err(err) => {
                     let duration = start.elapsed();
@@ -163,4 +165,4 @@ impl ToolExecutor<ToolInvocation> for ListMcpResourcesHandler {
     }
 }
 
-impl ToolHandler for ListMcpResourcesHandler {}
+impl CoreToolRuntime for ListMcpResourcesHandler {}
diff --git a/codex-rs/core/src/tools/handlers/mcp_resource/read_mcp_resource.rs b/codex-rs/core/src/tools/handlers/mcp_resource/read_mcp_resource.rs
index 89d061d692..3bb4d7f0ec 100644
--- a/codex-rs/core/src/tools/handlers/mcp_resource/read_mcp_resource.rs
+++ b/codex-rs/core/src/tools/handlers/mcp_resource/read_mcp_resource.rs
@@ -1,12 +1,12 @@
 use std::time::Instant;
 
 use crate::function_tool::FunctionCallError;
-use crate::tools::context::FunctionToolOutput;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolPayload;
+use crate::tools::context::boxed_tool_output;
 use crate::tools::handlers::mcp_resource_spec::create_read_mcp_resource_tool;
+use crate::tools::registry::CoreToolRuntime;
 use crate::tools::registry::ToolExecutor;
-use crate::tools::registry::ToolHandler;
 use codex_protocol::models::function_call_output_content_items_to_text;
 use codex_protocol::protocol::McpInvocation;
 use codex_tools::ToolName;
@@ -26,9 +26,8 @@ use super::serialize_function_output;
 
 pub struct ReadMcpResourceHandler;
 
+#[async_trait::async_trait]
 impl ToolExecutor<ToolInvocation> for ReadMcpResourceHandler {
-    type Output = FunctionToolOutput;
-
     fn tool_name(&self) -> ToolName {
         ToolName::plain("read_mcp_resource")
     }
@@ -41,7 +40,10 @@ impl ToolExecutor<ToolInvocation> for ReadMcpResourceHandler {
         true
     }
 
-    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+    async fn handle(
+        &self,
+        invocation: ToolInvocation,
+    ) -> Result<Box<dyn crate::tools::context::ToolOutput>, FunctionCallError> {
         let ToolInvocation {
             session,
             turn,
@@ -111,7 +113,7 @@ impl ToolExecutor<ToolInvocation> for ReadMcpResourceHandler {
                         Ok(call_tool_result_from_content(&content, output.success)),
                     )
                     .await;
-                    Ok(output)
+                    Ok(boxed_tool_output(output))
                 }
                 Err(err) => {
                     let duration = start.elapsed();
@@ -146,4 +148,4 @@ impl ToolExecutor<ToolInvocation> for ReadMcpResourceHandler {
     }
 }
 
-impl ToolHandler for ReadMcpResourceHandler {}
+impl CoreToolRuntime for ReadMcpResourceHandler {}
diff --git a/codex-rs/core/src/tools/handlers/mod.rs b/codex-rs/core/src/tools/handlers/mod.rs
index 712ed0f1a6..fe956faa37 100644
--- a/codex-rs/core/src/tools/handlers/mod.rs
+++ b/codex-rs/core/src/tools/handlers/mod.rs
@@ -62,11 +62,8 @@ pub use plan::PlanHandler;
 pub use request_permissions::RequestPermissionsHandler;
 pub use request_plugin_install::RequestPluginInstallHandler;
 pub use request_user_input::RequestUserInputHandler;
-pub use shell::ContainerExecHandler;
-pub use shell::LocalShellHandler;
 pub use shell::ShellCommandHandler;
 pub(crate) use shell::ShellCommandHandlerOptions;
-pub use shell::ShellHandler;
 pub use test_sync::TestSyncHandler;
 pub use tool_search::ToolSearchHandler;
 pub use unified_exec::ExecCommandHandler;
@@ -444,7 +441,7 @@ mod tests {
                         path: FileSystemPath::GlobPattern {
                             pattern: "**/*.env".to_string(),
                         },
-                        access: FileSystemAccessMode::None,
+                        access: FileSystemAccessMode::Deny,
                     },
                 ],
                 glob_scan_max_depth: None,
diff --git a/codex-rs/core/src/tools/handlers/multi_agents.rs b/codex-rs/core/src/tools/handlers/multi_agents.rs
index d0c5edfb77..00176572e0 100644
--- a/codex-rs/core/src/tools/handlers/multi_agents.rs
+++ b/codex-rs/core/src/tools/handlers/multi_agents.rs
@@ -13,10 +13,13 @@ use crate::session::turn_context::TurnContext;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolOutput;
 use crate::tools::context::ToolPayload;
+use crate::tools::context::boxed_tool_output;
 pub(crate) use crate::tools::handlers::multi_agents_common::*;
+use crate::tools::handlers::multi_agents_spec::MULTI_AGENT_V1_NAMESPACE;
 use crate::tools::handlers::parse_arguments;
+use crate::tools::registry::CoreToolRuntime;
 use crate::tools::registry::ToolExecutor;
-use crate::tools::registry::ToolHandler;
+use crate::tools::tool_search_entry::ToolSearchInfo;
 use codex_protocol::ThreadId;
 use codex_protocol::models::ResponseInputItem;
 use codex_protocol::openai_models::ReasoningEffort;
@@ -33,10 +36,14 @@ use codex_protocol::protocol::CollabWaitingBeginEvent;
 use codex_protocol::protocol::CollabWaitingEndEvent;
 use codex_protocol::user_input::UserInput;
 use codex_tools::ToolName;
+use codex_tools::ToolSearchSourceInfo;
 use serde::Deserialize;
 use serde::Serialize;
 use serde_json::Value as JsonValue;
 
+const MULTI_AGENT_TOOL_SEARCH_SOURCE_NAME: &str = "Multi-agent tools";
+const MULTI_AGENT_TOOL_SEARCH_SOURCE_DESCRIPTION: &str = "Spawn and manage sub-agents.";
+
 pub(crate) fn parse_agent_id_target(target: &str) -> Result<ThreadId, FunctionCallError> {
     ThreadId::from_string(target).map_err(|err| {
         FunctionCallError::RespondToModel(format!("invalid agent id {target}: {err:?}"))
@@ -58,6 +65,20 @@ pub(crate) fn parse_agent_id_targets(
         .collect()
 }
 
+fn multi_agent_tool_search_info(
+    search_text: &str,
+    spec: codex_tools::ToolSpec,
+) -> Option<ToolSearchInfo> {
+    ToolSearchInfo::from_spec(
+        search_text.to_string(),
+        spec,
+        Some(ToolSearchSourceInfo {
+            name: MULTI_AGENT_TOOL_SEARCH_SOURCE_NAME.to_string(),
+            description: Some(MULTI_AGENT_TOOL_SEARCH_SOURCE_DESCRIPTION.to_string()),
+        }),
+    )
+}
+
 pub(crate) use close_agent::Handler as CloseAgentHandler;
 pub(crate) use resume_agent::Handler as ResumeAgentHandler;
 pub(crate) use send_input::Handler as SendInputHandler;
diff --git a/codex-rs/core/src/tools/handlers/multi_agents/close_agent.rs b/codex-rs/core/src/tools/handlers/multi_agents/close_agent.rs
index beac3a96f4..bcbde4a6d3 100644
--- a/codex-rs/core/src/tools/handlers/multi_agents/close_agent.rs
+++ b/codex-rs/core/src/tools/handlers/multi_agents/close_agent.rs
@@ -5,22 +5,21 @@ use codex_tools::ToolSpec;
 
 pub(crate) struct Handler;
 
+#[async_trait::async_trait]
 impl ToolExecutor<ToolInvocation> for Handler {
-    type Output = CloseAgentResult;
-
     fn tool_name(&self) -> ToolName {
-        ToolName::plain("close_agent")
+        ToolName::namespaced(MULTI_AGENT_V1_NAMESPACE, "close_agent")
     }
 
     fn spec(&self) -> Option<ToolSpec> {
         Some(create_close_agent_tool_v1())
     }
 
-    fn handle(
+    async fn handle(
         &self,
         invocation: ToolInvocation,
-    ) -> impl std::future::Future<Output = Result<Self::Output, FunctionCallError>> + Send {
-        Box::pin(handle_close_agent(invocation))
+    ) -> Result<Box<dyn crate::tools::context::ToolOutput>, FunctionCallError> {
+        handle_close_agent(invocation).await.map(boxed_tool_output)
     }
 }
 
@@ -107,7 +106,14 @@ async fn handle_close_agent(
     })
 }
 
-impl ToolHandler for Handler {
+impl CoreToolRuntime for Handler {
+    fn search_info(&self) -> Option<ToolSearchInfo> {
+        multi_agent_tool_search_info(
+            "close_agent close shutdown stop agent subagent thread status target",
+            self.spec()?,
+        )
+    }
+
     fn matches_kind(&self, payload: &ToolPayload) -> bool {
         matches!(payload, ToolPayload::Function { .. })
     }
diff --git a/codex-rs/core/src/tools/handlers/multi_agents/resume_agent.rs b/codex-rs/core/src/tools/handlers/multi_agents/resume_agent.rs
index 1e9f5d9b07..ddfe6ee6a7 100644
--- a/codex-rs/core/src/tools/handlers/multi_agents/resume_agent.rs
+++ b/codex-rs/core/src/tools/handlers/multi_agents/resume_agent.rs
@@ -7,22 +7,21 @@ use std::sync::Arc;
 
 pub(crate) struct Handler;
 
+#[async_trait::async_trait]
 impl ToolExecutor<ToolInvocation> for Handler {
-    type Output = ResumeAgentResult;
-
     fn tool_name(&self) -> ToolName {
-        ToolName::plain("resume_agent")
+        ToolName::namespaced(MULTI_AGENT_V1_NAMESPACE, "resume_agent")
     }
 
     fn spec(&self) -> Option<ToolSpec> {
         Some(create_resume_agent_tool())
     }
 
-    fn handle(
+    async fn handle(
         &self,
         invocation: ToolInvocation,
-    ) -> impl std::future::Future<Output = Result<Self::Output, FunctionCallError>> + Send {
-        Box::pin(handle_resume_agent(invocation))
+    ) -> Result<Box<dyn crate::tools::context::ToolOutput>, FunctionCallError> {
+        handle_resume_agent(invocation).await.map(boxed_tool_output)
     }
 }
 
@@ -135,7 +134,14 @@ async fn handle_resume_agent(
     Ok(ResumeAgentResult { status })
 }
 
-impl ToolHandler for Handler {
+impl CoreToolRuntime for Handler {
+    fn search_info(&self) -> Option<ToolSearchInfo> {
+        multi_agent_tool_search_info(
+            "resume_agent resume reopen closed agent subagent thread id target",
+            self.spec()?,
+        )
+    }
+
     fn matches_kind(&self, payload: &ToolPayload) -> bool {
         matches!(payload, ToolPayload::Function { .. })
     }
diff --git a/codex-rs/core/src/tools/handlers/multi_agents/send_input.rs b/codex-rs/core/src/tools/handlers/multi_agents/send_input.rs
index ac212f7556..3322e1b3d4 100644
--- a/codex-rs/core/src/tools/handlers/multi_agents/send_input.rs
+++ b/codex-rs/core/src/tools/handlers/multi_agents/send_input.rs
@@ -6,18 +6,20 @@ use codex_tools::ToolSpec;
 
 pub(crate) struct Handler;
 
+#[async_trait::async_trait]
 impl ToolExecutor<ToolInvocation> for Handler {
-    type Output = SendInputResult;
-
     fn tool_name(&self) -> ToolName {
-        ToolName::plain("send_input")
+        ToolName::namespaced(MULTI_AGENT_V1_NAMESPACE, "send_input")
     }
 
     fn spec(&self) -> Option<ToolSpec> {
         Some(create_send_input_tool_v1())
     }
 
-    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+    async fn handle(
+        &self,
+        invocation: ToolInvocation,
+    ) -> Result<Box<dyn crate::tools::context::ToolOutput>, FunctionCallError> {
         let ToolInvocation {
             session,
             turn,
@@ -84,11 +86,18 @@ impl ToolExecutor<ToolInvocation> for Handler {
             .await;
         let submission_id = result?;
 
-        Ok(SendInputResult { submission_id })
+        Ok(boxed_tool_output(SendInputResult { submission_id }))
     }
 }
 
-impl ToolHandler for Handler {
+impl CoreToolRuntime for Handler {
+    fn search_info(&self) -> Option<ToolSearchInfo> {
+        multi_agent_tool_search_info(
+            "send_input send message existing agent subagent follow up interrupt redirect queue target",
+            self.spec()?,
+        )
+    }
+
     fn matches_kind(&self, payload: &ToolPayload) -> bool {
         matches!(payload, ToolPayload::Function { .. })
     }
diff --git a/codex-rs/core/src/tools/handlers/multi_agents/spawn.rs b/codex-rs/core/src/tools/handlers/multi_agents/spawn.rs
index 395e74f137..ceb46083c5 100644
--- a/codex-rs/core/src/tools/handlers/multi_agents/spawn.rs
+++ b/codex-rs/core/src/tools/handlers/multi_agents/spawn.rs
@@ -22,22 +22,21 @@ impl Handler {
     }
 }
 
+#[async_trait::async_trait]
 impl ToolExecutor<ToolInvocation> for Handler {
-    type Output = SpawnAgentResult;
-
     fn tool_name(&self) -> ToolName {
-        ToolName::plain("spawn_agent")
+        ToolName::namespaced(MULTI_AGENT_V1_NAMESPACE, "spawn_agent")
     }
 
     fn spec(&self) -> Option<ToolSpec> {
         Some(create_spawn_agent_tool_v1(self.options.clone()))
     }
 
-    fn handle(
+    async fn handle(
         &self,
         invocation: ToolInvocation,
-    ) -> impl std::future::Future<Output = Result<Self::Output, FunctionCallError>> + Send {
-        Box::pin(handle_spawn_agent(invocation))
+    ) -> Result<Box<dyn crate::tools::context::ToolOutput>, FunctionCallError> {
+        handle_spawn_agent(invocation).await.map(boxed_tool_output)
     }
 }
 
@@ -200,7 +199,14 @@ async fn handle_spawn_agent(
     })
 }
 
-impl ToolHandler for Handler {
+impl CoreToolRuntime for Handler {
+    fn search_info(&self) -> Option<ToolSearchInfo> {
+        multi_agent_tool_search_info(
+            "spawn_agent spawn agent subagent sub-agent delegate delegation parallel work worker explorer no-apps fork model reasoning",
+            self.spec()?,
+        )
+    }
+
     fn matches_kind(&self, payload: &ToolPayload) -> bool {
         matches!(payload, ToolPayload::Function { .. })
     }
diff --git a/codex-rs/core/src/tools/handlers/multi_agents/wait.rs b/codex-rs/core/src/tools/handlers/multi_agents/wait.rs
index aa9d6f6581..68f3dd7ee4 100644
--- a/codex-rs/core/src/tools/handlers/multi_agents/wait.rs
+++ b/codex-rs/core/src/tools/handlers/multi_agents/wait.rs
@@ -27,18 +27,20 @@ impl Handler {
     }
 }
 
+#[async_trait::async_trait]
 impl ToolExecutor<ToolInvocation> for Handler {
-    type Output = WaitAgentResult;
-
     fn tool_name(&self) -> ToolName {
-        ToolName::plain("wait_agent")
+        ToolName::namespaced(MULTI_AGENT_V1_NAMESPACE, "wait_agent")
     }
 
     fn spec(&self) -> Option<ToolSpec> {
         Some(create_wait_agent_tool_v1(self.options))
     }
 
-    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+    async fn handle(
+        &self,
+        invocation: ToolInvocation,
+    ) -> Result<Box<dyn crate::tools::context::ToolOutput>, FunctionCallError> {
         let ToolInvocation {
             session,
             turn,
@@ -196,11 +198,18 @@ impl ToolExecutor<ToolInvocation> for Handler {
             )
             .await;
 
-        Ok(result)
+        Ok(boxed_tool_output(result))
     }
 }
 
-impl ToolHandler for Handler {
+impl CoreToolRuntime for Handler {
+    fn search_info(&self) -> Option<ToolSearchInfo> {
+        multi_agent_tool_search_info(
+            "wait_agent wait agent subagent status final result complete timeout targets",
+            self.spec()?,
+        )
+    }
+
     fn matches_kind(&self, payload: &ToolPayload) -> bool {
         matches!(payload, ToolPayload::Function { .. })
     }
diff --git a/codex-rs/core/src/tools/handlers/multi_agents_common.rs b/codex-rs/core/src/tools/handlers/multi_agents_common.rs
index cc4e9ebfca..968810494d 100644
--- a/codex-rs/core/src/tools/handlers/multi_agents_common.rs
+++ b/codex-rs/core/src/tools/handlers/multi_agents_common.rs
@@ -1,7 +1,7 @@
 use crate::agent::AgentStatus;
 use crate::config::Config;
 use crate::config::DEFAULT_MULTI_AGENT_V2_MIN_WAIT_TIMEOUT_MS;
-use crate::config::MAX_MULTI_AGENT_V2_WAIT_TIMEOUT_MS;
+use crate::config::HARD_MAX_MULTI_AGENT_V2_TIMEOUT_MS;
 use crate::function_tool::FunctionCallError;
 use crate::session::session::Session;
 use crate::session::turn_context::TurnContext;
@@ -30,7 +30,7 @@ use std::collections::HashMap;
 /// Minimum wait timeout to prevent tight polling loops from burning CPU.
 pub(crate) const MIN_WAIT_TIMEOUT_MS: i64 = DEFAULT_MULTI_AGENT_V2_MIN_WAIT_TIMEOUT_MS;
 pub(crate) const DEFAULT_WAIT_TIMEOUT_MS: i64 = 30_000;
-pub(crate) const MAX_WAIT_TIMEOUT_MS: i64 = MAX_MULTI_AGENT_V2_WAIT_TIMEOUT_MS;
+pub(crate) const MAX_WAIT_TIMEOUT_MS: i64 = HARD_MAX_MULTI_AGENT_V2_TIMEOUT_MS;
 
 pub(crate) fn function_arguments(payload: ToolPayload) -> Result<String, FunctionCallError> {
     match payload {
@@ -268,7 +268,9 @@ pub(crate) fn apply_spawn_agent_runtime_overrides(
         })?;
     config.permissions.shell_environment_policy = turn.shell_environment_policy.clone();
     config.codex_linux_sandbox_exe = turn.codex_linux_sandbox_exe.clone();
-    config.cwd = turn.cwd.clone();
+    #[allow(deprecated)]
+    let turn_cwd = turn.cwd.clone();
+    config.cwd = turn_cwd;
     config
         .permissions
         .set_permission_profile(turn.permission_profile())
diff --git a/codex-rs/core/src/tools/handlers/multi_agents_spec.rs b/codex-rs/core/src/tools/handlers/multi_agents_spec.rs
index 111ab67798..8aad428411 100644
--- a/codex-rs/core/src/tools/handlers/multi_agents_spec.rs
+++ b/codex-rs/core/src/tools/handlers/multi_agents_spec.rs
@@ -1,14 +1,20 @@
 use codex_protocol::openai_models::ModelPreset;
 use codex_tools::JsonSchema;
+use codex_tools::ResponsesApiNamespace;
+use codex_tools::ResponsesApiNamespaceTool;
 use codex_tools::ResponsesApiTool;
 use codex_tools::ToolSpec;
 use serde_json::Value;
 use serde_json::json;
 use std::collections::BTreeMap;
 
+pub const MULTI_AGENT_V1_NAMESPACE: &str = "multi_agent_v1";
+const MULTI_AGENT_V1_NAMESPACE_DESCRIPTION: &str = "Tools for spawning and managing sub-agents.";
+
 const SPAWN_AGENT_INHERITED_MODEL_GUIDANCE: &str = "Spawned agents inherit your current model by default. Omit `model` to use that preferred default; set `model` only when an explicit override is needed.";
 const SPAWN_AGENT_MODEL_OVERRIDE_DESCRIPTION: &str = "Optional model override for the new agent. Leave unset to inherit the same model as the parent, which is the preferred default. Only set this when the user explicitly asks for a different model or the task clearly requires one.";
 const SPAWN_AGENT_SERVICE_TIER_OVERRIDE_DESCRIPTION: &str = "Optional service tier override for the new agent. Leave unset unless the user explicitly asks for one.";
+const MAX_MODEL_OVERRIDES_IN_SPAWN_AGENT_DESCRIPTION: usize = 5;
 
 #[derive(Debug, Clone, Default)]
 pub struct SpawnAgentToolOptions {
@@ -47,18 +53,22 @@ pub fn create_spawn_agent_tool_v1(options: SpawnAgentToolOptions) -> ToolSpec {
         hide_spawn_agent_metadata_options(&mut properties);
     }
 
-    ToolSpec::Function(ResponsesApiTool {
-        name: "spawn_agent".to_string(),
-        description: spawn_agent_tool_description(
-            available_models_description.as_deref(),
-            return_value_description,
-            options.include_usage_hint,
-            options.usage_hint_text,
-        ),
-        strict: false,
-        defer_loading: None,
-        parameters: JsonSchema::object(properties, /*required*/ None, Some(false.into())),
-        output_schema: Some(spawn_agent_output_schema_v1()),
+    ToolSpec::Namespace(ResponsesApiNamespace {
+        name: MULTI_AGENT_V1_NAMESPACE.to_string(),
+        description: MULTI_AGENT_V1_NAMESPACE_DESCRIPTION.to_string(),
+        tools: vec![ResponsesApiNamespaceTool::Function(ResponsesApiTool {
+            name: "spawn_agent".to_string(),
+            description: spawn_agent_tool_description(
+                available_models_description.as_deref(),
+                return_value_description,
+                options.include_usage_hint,
+                options.usage_hint_text,
+            ),
+            strict: false,
+            defer_loading: None,
+            parameters: JsonSchema::object(properties, /*required*/ None, Some(false.into())),
+            output_schema: Some(spawn_agent_output_schema_v1()),
+        })],
     })
 }
 
@@ -121,14 +131,18 @@ pub fn create_send_input_tool_v1() -> ToolSpec {
         ),
     ]);
 
-    ToolSpec::Function(ResponsesApiTool {
-        name: "send_input".to_string(),
-        description: "Send a message to an existing agent. Use interrupt=true to redirect work immediately. You should reuse the agent by send_input if you believe your assigned task is highly dependent on the context of a previous task."
-            .to_string(),
-        strict: false,
-        defer_loading: None,
-        parameters: JsonSchema::object(properties, Some(vec!["target".to_string()]), Some(false.into())),
-        output_schema: Some(send_input_output_schema()),
+    ToolSpec::Namespace(ResponsesApiNamespace {
+        name: MULTI_AGENT_V1_NAMESPACE.to_string(),
+        description: MULTI_AGENT_V1_NAMESPACE_DESCRIPTION.to_string(),
+        tools: vec![ResponsesApiNamespaceTool::Function(ResponsesApiTool {
+            name: "send_input".to_string(),
+            description: "Send a message to an existing agent. Use interrupt=true to redirect work immediately. You should reuse the agent by send_input if you believe your assigned task is highly dependent on the context of a previous task."
+                .to_string(),
+            strict: false,
+            defer_loading: None,
+            parameters: JsonSchema::object(properties, Some(vec!["target".to_string()]), Some(false.into())),
+            output_schema: Some(send_input_output_schema()),
+        })],
     })
 }
 
@@ -196,27 +210,35 @@ pub fn create_resume_agent_tool() -> ToolSpec {
         JsonSchema::string(Some("Agent id to resume.".to_string())),
     )]);
 
-    ToolSpec::Function(ResponsesApiTool {
-        name: "resume_agent".to_string(),
-        description:
-            "Resume a previously closed agent by id so it can receive send_input and wait_agent calls."
-                .to_string(),
-        strict: false,
-        defer_loading: None,
-        parameters: JsonSchema::object(properties, Some(vec!["id".to_string()]), Some(false.into())),
-        output_schema: Some(resume_agent_output_schema()),
+    ToolSpec::Namespace(ResponsesApiNamespace {
+        name: MULTI_AGENT_V1_NAMESPACE.to_string(),
+        description: MULTI_AGENT_V1_NAMESPACE_DESCRIPTION.to_string(),
+        tools: vec![ResponsesApiNamespaceTool::Function(ResponsesApiTool {
+            name: "resume_agent".to_string(),
+            description:
+                "Resume a previously closed agent by id so it can receive send_input and wait_agent calls."
+                    .to_string(),
+            strict: false,
+            defer_loading: None,
+            parameters: JsonSchema::object(properties, Some(vec!["id".to_string()]), Some(false.into())),
+            output_schema: Some(resume_agent_output_schema()),
+        })],
     })
 }
 
 pub fn create_wait_agent_tool_v1(options: WaitAgentTimeoutOptions) -> ToolSpec {
-    ToolSpec::Function(ResponsesApiTool {
-        name: "wait_agent".to_string(),
-        description: "Wait for agents to reach a final status. Completed statuses may include the agent's final message. Returns empty status when timed out. Once the agent reaches a final status, a notification message will be received containing the same completed status."
-            .to_string(),
-        strict: false,
-        defer_loading: None,
-        parameters: wait_agent_tool_parameters_v1(options),
-        output_schema: Some(wait_output_schema_v1()),
+    ToolSpec::Namespace(ResponsesApiNamespace {
+        name: MULTI_AGENT_V1_NAMESPACE.to_string(),
+        description: MULTI_AGENT_V1_NAMESPACE_DESCRIPTION.to_string(),
+        tools: vec![ResponsesApiNamespaceTool::Function(ResponsesApiTool {
+            name: "wait_agent".to_string(),
+            description: "Wait for agents to reach a final status. Completed statuses may include the agent's final message. Returns empty status when timed out. Once the agent reaches a final status, a notification message will be received containing the same completed status."
+                .to_string(),
+            strict: false,
+            defer_loading: None,
+            parameters: wait_agent_tool_parameters_v1(options),
+            output_schema: Some(wait_output_schema_v1()),
+        })],
     })
 }
 
@@ -259,13 +281,17 @@ pub fn create_close_agent_tool_v1() -> ToolSpec {
         JsonSchema::string(Some("Agent id to close (from spawn_agent).".to_string())),
     )]);
 
-    ToolSpec::Function(ResponsesApiTool {
-        name: "close_agent".to_string(),
-        description: "Close an agent and any open descendants when they are no longer needed, and return the target agent's previous status before shutdown was requested. Don't keep agents open for too long if they are not needed anymore.".to_string(),
-        strict: false,
-        defer_loading: None,
-        parameters: JsonSchema::object(properties, Some(vec!["target".to_string()]), Some(false.into())),
-        output_schema: Some(close_agent_output_schema()),
+    ToolSpec::Namespace(ResponsesApiNamespace {
+        name: MULTI_AGENT_V1_NAMESPACE.to_string(),
+        description: MULTI_AGENT_V1_NAMESPACE_DESCRIPTION.to_string(),
+        tools: vec![ResponsesApiNamespaceTool::Function(ResponsesApiTool {
+            name: "close_agent".to_string(),
+            description: "Close an agent and any open descendants when they are no longer needed, and return the target agent's previous status before shutdown was requested. Don't keep agents open for too long if they are not needed anymore.".to_string(),
+            strict: false,
+            defer_loading: None,
+            parameters: JsonSchema::object(properties, Some(vec!["target".to_string()]), Some(false.into())),
+            output_schema: Some(close_agent_output_schema()),
+        })],
     })
 }
 
@@ -711,8 +737,11 @@ The new agent's canonical task name will be provided to it along with the messag
 }
 
 fn spawn_agent_models_description(models: &[ModelPreset]) -> String {
-    let visible_models: Vec<&ModelPreset> =
-        models.iter().filter(|model| model.show_in_picker).collect();
+    let visible_models: Vec<&ModelPreset> = models
+        .iter()
+        .filter(|model| model.show_in_picker)
+        .take(MAX_MODEL_OVERRIDES_IN_SPAWN_AGENT_DESCRIPTION)
+        .collect();
     if visible_models.is_empty() {
         return "No picker-visible model overrides are currently loaded.".to_string();
     }
@@ -720,30 +749,40 @@ fn spawn_agent_models_description(models: &[ModelPreset]) -> String {
     let model_descriptions = visible_models
         .into_iter()
         .map(|model| {
+            let default_reasoning_effort = model.default_reasoning_effort;
             let efforts = model
                 .supported_reasoning_efforts
                 .iter()
-                .map(|preset| format!("{} ({})", preset.effort, preset.description))
+                .map(|preset| {
+                    let effort = preset.effort;
+                    if effort == default_reasoning_effort {
+                        format!("{effort} (default)")
+                    } else {
+                        effort.to_string()
+                    }
+                })
                 .collect::<Vec<_>>()
                 .join(", ");
-            let service_tiers = if model.service_tiers.is_empty() {
-                "none".to_string()
+            let reasoning_efforts_suffix = if efforts.is_empty() {
+                String::new()
             } else {
-                model
-                    .service_tiers
-                    .iter()
-                    .map(|tier| format!("{} ({}: {})", tier.id, tier.name, tier.description))
-                    .collect::<Vec<_>>()
-                    .join(", ")
+                format!(" Reasoning efforts: {efforts}.")
             };
+            let service_tiers = model
+                .service_tiers
+                .iter()
+                .map(|tier| tier.id.as_str())
+                .collect::<Vec<_>>()
+                .join(", ");
+            let service_tiers_suffix = if service_tiers.is_empty() {
+                String::new()
+            } else {
+                format!(" Service tiers: {service_tiers}.")
+            };
+            let model_slug = &model.model;
+            let description = &model.description;
             format!(
-                "- {} (`{}`): {} Default reasoning effort: {}. Supported reasoning efforts: {}. Supported service tiers: {}.",
-                model.display_name,
-                model.model,
-                model.description,
-                model.default_reasoning_effort,
-                efforts,
-                service_tiers
+                "- `{model_slug}`: {description}{reasoning_efforts_suffix}{service_tiers_suffix}"
             )
         })
         .collect::<Vec<_>>()
diff --git a/codex-rs/core/src/tools/handlers/multi_agents_spec_tests.rs b/codex-rs/core/src/tools/handlers/multi_agents_spec_tests.rs
index aaa29d6d4c..6f9eac1fff 100644
--- a/codex-rs/core/src/tools/handlers/multi_agents_spec_tests.rs
+++ b/codex-rs/core/src/tools/handlers/multi_agents_spec_tests.rs
@@ -74,12 +74,10 @@ fn spawn_agent_tool_v2_requires_task_name_and_lists_visible_models() {
         description
             .contains("Available model overrides (optional; inherited parent model is preferred):")
     );
-    assert!(description.contains("visible display (`visible-model`)"));
-    assert!(
-        description
-            .contains("Supported service tiers: priority (Fast: 1.5x speed, increased usage).")
-    );
-    assert!(!description.contains("hidden display (`hidden-model`)"));
+    assert!(description.contains(
+        "- `visible-model`: visible description Reasoning efforts: medium (default). Service tiers: priority."
+    ));
+    assert!(!description.contains("hidden-model"));
     assert!(properties.contains_key("task_name"));
     assert!(properties.contains_key("message"));
     assert!(properties.contains_key("fork_turns"));
@@ -122,11 +120,17 @@ fn spawn_agent_tool_v1_keeps_legacy_fork_context_field() {
         max_concurrent_threads_per_session: None,
     });
 
-    let ToolSpec::Function(ResponsesApiTool { parameters, .. }) = tool else {
-        panic!("spawn_agent should be a function tool");
+    let ToolSpec::Namespace(namespace) = tool else {
+        panic!("spawn_agent v1 should be a namespace tool");
+    };
+    assert_eq!(namespace.name, MULTI_AGENT_V1_NAMESPACE);
+    let Some(ResponsesApiNamespaceTool::Function(ResponsesApiTool { parameters, .. })) =
+        namespace.tools.first()
+    else {
+        panic!("spawn_agent should be a namespace function tool");
     };
     assert_eq!(
-        parameters.schema_type,
+        parameters.schema_type.clone(),
         Some(JsonSchemaType::Single(JsonSchemaPrimitiveType::Object))
     );
     let properties = parameters
@@ -150,6 +154,37 @@ fn spawn_agent_tool_v1_keeps_legacy_fork_context_field() {
     );
 }
 
+#[test]
+fn spawn_agent_tool_caps_visible_model_summaries() {
+    let tool = create_spawn_agent_tool_v2(SpawnAgentToolOptions {
+        available_models: vec![
+            model_preset("first", /*show_in_picker*/ true),
+            model_preset("second", /*show_in_picker*/ true),
+            model_preset("third", /*show_in_picker*/ true),
+            model_preset("fourth", /*show_in_picker*/ true),
+            model_preset("fifth", /*show_in_picker*/ true),
+            model_preset("sixth", /*show_in_picker*/ true),
+        ],
+        agent_type_description: "role help".to_string(),
+        hide_agent_type_model_reasoning: false,
+        include_usage_hint: true,
+        usage_hint_text: None,
+        max_concurrent_threads_per_session: Some(4),
+    });
+
+    let ToolSpec::Function(ResponsesApiTool { description, .. }) = tool else {
+        panic!("spawn_agent should be a function tool");
+    };
+
+    for model in ["first", "second", "third", "fourth", "fifth"] {
+        assert!(
+            description.contains(&format!("`{model}-model`")),
+            "expected {model} model summary in spawn_agent description: {description:?}"
+        );
+    }
+    assert!(!description.contains("`sixth-model`"));
+}
+
 #[test]
 fn spawn_agent_tool_hides_service_tier_with_spawn_metadata() {
     let tool = create_spawn_agent_tool_v2(SpawnAgentToolOptions {
diff --git a/codex-rs/core/src/tools/handlers/multi_agents_tests.rs b/codex-rs/core/src/tools/handlers/multi_agents_tests.rs
index f051fb0f70..ad1702b207 100644
--- a/codex-rs/core/src/tools/handlers/multi_agents_tests.rs
+++ b/codex-rs/core/src/tools/handlers/multi_agents_tests.rs
@@ -317,7 +317,8 @@ async fn spawn_agent_fork_context_rejects_agent_type_override() {
             })),
         ))
         .await
-        .expect_err("fork_context should reject agent_type overrides");
+        .err()
+        .expect("fork_context should reject agent_type overrides");
 
     assert_eq!(
         err,
@@ -351,7 +352,8 @@ async fn spawn_agent_fork_context_rejects_child_model_overrides() {
             })),
         ))
         .await
-        .expect_err("forked spawn should reject child model overrides");
+        .err()
+        .expect("forked spawn should reject child model overrides");
 
     assert_eq!(
         err,
@@ -395,7 +397,8 @@ async fn multi_agent_v2_spawn_fork_turns_all_rejects_agent_type_override() {
             })),
         ))
         .await
-        .expect_err("fork_turns=all should reject agent_type overrides");
+        .err()
+        .expect("fork_turns=all should reject agent_type overrides");
 
     assert_eq!(
         err,
@@ -435,7 +438,8 @@ async fn multi_agent_v2_spawn_defaults_to_full_fork_and_rejects_child_model_over
             })),
         ))
         .await
-        .expect_err("default full fork should reject child model overrides");
+        .err()
+        .expect("default full fork should reject child model overrides");
 
     assert_eq!(
         err,
@@ -505,7 +509,8 @@ async fn spawn_agent_service_tier_override_validates_the_effective_child_model()
                 })),
             ))
             .await
-            .expect_err("unknown service tier should be rejected");
+            .err()
+            .expect("unknown service tier should be rejected");
 
         assert_eq!(
             err,
@@ -530,7 +535,8 @@ async fn spawn_agent_service_tier_override_validates_the_effective_child_model()
                 })),
             ))
             .await
-            .expect_err("tier unsupported by the final child model should be rejected");
+            .err()
+            .expect("tier unsupported by the final child model should be rejected");
 
         assert_eq!(
             err,
@@ -1116,7 +1122,8 @@ async fn multi_agent_v2_spawn_rejects_legacy_fork_context() {
             })),
         ))
         .await
-        .expect_err("legacy fork_context should be rejected");
+        .err()
+        .expect("legacy fork_context should be rejected");
 
     assert_eq!(
         err,
@@ -1155,7 +1162,8 @@ async fn multi_agent_v2_spawn_rejects_invalid_fork_turns_string() {
             })),
         ))
         .await
-        .expect_err("invalid fork_turns should be rejected");
+        .err()
+        .expect("invalid fork_turns should be rejected");
 
     assert_eq!(
         err,
@@ -1194,7 +1202,8 @@ async fn multi_agent_v2_spawn_rejects_zero_fork_turns() {
             })),
         ))
         .await
-        .expect_err("zero turn count should be rejected");
+        .err()
+        .expect("zero turn count should be rejected");
 
     assert_eq!(
         err,
@@ -2088,6 +2097,7 @@ async fn spawn_agent_reapplies_runtime_sandbox_after_role_config() {
     let manager = thread_manager();
     session.services.agent_control = manager.agent_control();
     let expected_sandbox = turn.config.legacy_sandbox_policy();
+    #[allow(deprecated)]
     let mut expected_file_system_sandbox_policy =
         FileSystemSandboxPolicy::from_legacy_sandbox_policy_for_cwd(&expected_sandbox, &turn.cwd);
     expected_file_system_sandbox_policy
@@ -2096,7 +2106,7 @@ async fn spawn_agent_reapplies_runtime_sandbox_after_role_config() {
             path: FileSystemPath::GlobPattern {
                 pattern: "**/.env".to_string(),
             },
-            access: FileSystemAccessMode::None,
+            access: FileSystemAccessMode::Deny,
         });
     let expected_network_sandbox_policy = NetworkSandboxPolicy::from(&expected_sandbox);
     let expected_permission_profile = PermissionProfile::from_runtime_permissions_with_enforcement(
@@ -2110,7 +2120,7 @@ async fn spawn_agent_reapplies_runtime_sandbox_after_role_config() {
     turn.permission_profile = expected_permission_profile.clone();
     assert_ne!(
         expected_permission_profile,
-        turn.config.permissions.permission_profile(),
+        turn.config.permissions.effective_permission_profile(),
         "test requires a runtime profile override that differs from base config"
     );
 
@@ -2460,6 +2470,7 @@ async fn send_input_accepts_structured_items() {
         ],
         final_output_json_schema: None,
         responsesapi_client_metadata: None,
+        thread_settings: Default::default(),
     };
     let captured = manager
         .captured_ops()
@@ -2774,20 +2785,23 @@ async fn multi_agent_v2_wait_agent_accepts_timeout_only_argument() {
                     session,
                     turn,
                     "wait_agent",
-                    function_payload(json!({"timeout_ms": 1000})),
+                    function_payload(json!({"timeout_ms": 10_000})),
                 ))
                 .await
         }
     });
     tokio::task::yield_now().await;
 
-    session.enqueue_mailbox_communication(InterAgentCommunication::new(
-        worker_path,
-        AgentPath::root(),
-        Vec::new(),
-        "hello from worker".to_string(),
-        /*trigger_turn*/ false,
-    ));
+    session
+        .input_queue
+        .enqueue_mailbox_communication(InterAgentCommunication::new(
+            worker_path,
+            AgentPath::root(),
+            Vec::new(),
+            "hello from worker".to_string(),
+            /*trigger_turn*/ false,
+        ))
+        .await;
 
     let output = wait_task
         .await
@@ -2807,7 +2821,7 @@ async fn multi_agent_v2_wait_agent_accepts_timeout_only_argument() {
 }
 
 #[tokio::test]
-async fn multi_agent_v2_wait_agent_uses_configured_min_timeout() {
+async fn multi_agent_v2_wait_agent_rejects_timeout_below_configured_min() {
     let (session, mut turn) = make_session_and_context().await;
     let mut config = (*turn.config).clone();
     config
@@ -2815,6 +2829,73 @@ async fn multi_agent_v2_wait_agent_uses_configured_min_timeout() {
         .enable(Feature::MultiAgentV2)
         .expect("test config should allow feature update");
     config.multi_agent_v2.min_wait_timeout_ms = 50;
+    config.multi_agent_v2.max_wait_timeout_ms = 1_000;
+    config.multi_agent_v2.default_wait_timeout_ms = 50;
+    turn.config = Arc::new(config);
+
+    let Err(err) = WaitAgentHandlerV2::default()
+        .handle(invocation(
+            Arc::new(session),
+            Arc::new(turn),
+            "wait_agent",
+            function_payload(json!({"timeout_ms": 1})),
+        ))
+        .await
+    else {
+        panic!("timeout below configured minimum should be rejected");
+    };
+    assert_eq!(
+        err,
+        FunctionCallError::RespondToModel("timeout_ms must be at least 50".to_string())
+    );
+}
+
+#[tokio::test]
+async fn multi_agent_v2_wait_agent_accepts_explicit_timeout_at_configured_min() {
+    let (session, mut turn) = make_session_and_context().await;
+    let mut config = (*turn.config).clone();
+    config
+        .features
+        .enable(Feature::MultiAgentV2)
+        .expect("test config should allow feature update");
+    config.multi_agent_v2.min_wait_timeout_ms = 1;
+    config.multi_agent_v2.max_wait_timeout_ms = 1_000;
+    config.multi_agent_v2.default_wait_timeout_ms = 50;
+    turn.config = Arc::new(config);
+
+    let output = WaitAgentHandlerV2::default()
+        .handle(invocation(
+            Arc::new(session),
+            Arc::new(turn),
+            "wait_agent",
+            function_payload(json!({"timeout_ms": 1})),
+        ))
+        .await
+        .expect("wait_agent should succeed");
+    let (content, success) = expect_text_output(output);
+    let result: crate::tools::handlers::multi_agents_v2::wait::WaitAgentResult =
+        serde_json::from_str(&content).expect("wait_agent result should be json");
+    assert_eq!(
+        result,
+        crate::tools::handlers::multi_agents_v2::wait::WaitAgentResult {
+            message: "Wait timed out.".to_string(),
+            timed_out: true,
+        }
+    );
+    assert_eq!(success, None);
+}
+
+#[tokio::test]
+async fn multi_agent_v2_wait_agent_uses_configured_default_timeout() {
+    let (session, mut turn) = make_session_and_context().await;
+    let mut config = (*turn.config).clone();
+    config
+        .features
+        .enable(Feature::MultiAgentV2)
+        .expect("test config should allow feature update");
+    config.multi_agent_v2.min_wait_timeout_ms = 1;
+    config.multi_agent_v2.max_wait_timeout_ms = 1_000;
+    config.multi_agent_v2.default_wait_timeout_ms = 50;
     turn.config = Arc::new(config);
     let session = Arc::new(session);
     let turn = Arc::new(turn);
@@ -2825,13 +2906,13 @@ async fn multi_agent_v2_wait_agent_uses_configured_min_timeout() {
             session.clone(),
             turn.clone(),
             "wait_agent",
-            function_payload(json!({"timeout_ms": 1})),
+            function_payload(json!({})),
         )),
     )
     .await;
     assert!(
         early.is_err(),
-        "wait_agent should not return before the configured minimum timeout"
+        "wait_agent should not return before the configured default timeout"
     );
 
     let output = timeout(
@@ -2840,11 +2921,11 @@ async fn multi_agent_v2_wait_agent_uses_configured_min_timeout() {
             session,
             turn,
             "wait_agent",
-            function_payload(json!({"timeout_ms": 1})),
+            function_payload(json!({})),
         )),
     )
     .await
-    .expect("configured minimum should be shorter than the test timeout")
+    .expect("configured default should be shorter than the test timeout")
     .expect("wait_agent should succeed");
     let (content, success) = expect_text_output(output);
     let result: crate::tools::handlers::multi_agents_v2::wait::WaitAgentResult =
@@ -2859,6 +2940,111 @@ async fn multi_agent_v2_wait_agent_uses_configured_min_timeout() {
     assert_eq!(success, None);
 }
 
+#[tokio::test]
+async fn multi_agent_v2_wait_agent_allows_zero_configured_timeout() {
+    let (session, mut turn) = make_session_and_context().await;
+    let mut config = (*turn.config).clone();
+    config
+        .features
+        .enable(Feature::MultiAgentV2)
+        .expect("test config should allow feature update");
+    config.multi_agent_v2.min_wait_timeout_ms = 0;
+    config.multi_agent_v2.max_wait_timeout_ms = 0;
+    config.multi_agent_v2.default_wait_timeout_ms = 0;
+    turn.config = Arc::new(config);
+    let session = Arc::new(session);
+    let turn = Arc::new(turn);
+
+    let output = timeout(
+        Duration::from_secs(/*secs*/ 1),
+        WaitAgentHandlerV2::default().handle(invocation(
+            session,
+            turn,
+            "wait_agent",
+            function_payload(json!({})),
+        )),
+    )
+    .await
+    .expect("zero timeout should complete immediately")
+    .expect("wait_agent should succeed");
+    let (content, success) = expect_text_output(output);
+    let result: crate::tools::handlers::multi_agents_v2::wait::WaitAgentResult =
+        serde_json::from_str(&content).expect("wait_agent result should be json");
+    assert_eq!(
+        result,
+        crate::tools::handlers::multi_agents_v2::wait::WaitAgentResult {
+            message: "Wait timed out.".to_string(),
+            timed_out: true,
+        }
+    );
+    assert_eq!(success, None);
+}
+
+#[tokio::test]
+async fn multi_agent_v2_wait_agent_rejects_timeout_above_configured_max() {
+    let (session, mut turn) = make_session_and_context().await;
+    let mut config = (*turn.config).clone();
+    config
+        .features
+        .enable(Feature::MultiAgentV2)
+        .expect("test config should allow feature update");
+    config.multi_agent_v2.min_wait_timeout_ms = 1;
+    config.multi_agent_v2.max_wait_timeout_ms = 50;
+    config.multi_agent_v2.default_wait_timeout_ms = 1;
+    turn.config = Arc::new(config);
+
+    let Err(err) = WaitAgentHandlerV2::default()
+        .handle(invocation(
+            Arc::new(session),
+            Arc::new(turn),
+            "wait_agent",
+            function_payload(json!({"timeout_ms": 500})),
+        ))
+        .await
+    else {
+        panic!("timeout above configured maximum should be rejected");
+    };
+    assert_eq!(
+        err,
+        FunctionCallError::RespondToModel("timeout_ms must be at most 50".to_string())
+    );
+}
+
+#[tokio::test]
+async fn multi_agent_v2_wait_agent_accepts_explicit_timeout_at_configured_max() {
+    let (session, mut turn) = make_session_and_context().await;
+    let mut config = (*turn.config).clone();
+    config
+        .features
+        .enable(Feature::MultiAgentV2)
+        .expect("test config should allow feature update");
+    config.multi_agent_v2.min_wait_timeout_ms = 1;
+    config.multi_agent_v2.max_wait_timeout_ms = 1;
+    config.multi_agent_v2.default_wait_timeout_ms = 1;
+    turn.config = Arc::new(config);
+
+    let output = WaitAgentHandlerV2::default()
+        .handle(invocation(
+            Arc::new(session),
+            Arc::new(turn),
+            "wait_agent",
+            function_payload(json!({"timeout_ms": 1})),
+        ))
+        .await
+        .expect("wait_agent should succeed");
+    let (content, success) = expect_text_output(output);
+    let result: crate::tools::handlers::multi_agents_v2::wait::WaitAgentResult =
+        serde_json::from_str(&content).expect("wait_agent result should be json");
+    assert_eq!(
+        result,
+        crate::tools::handlers::multi_agents_v2::wait::WaitAgentResult {
+            message: "Wait timed out.".to_string(),
+            timed_out: true,
+        }
+    );
+    assert_eq!(success, None);
+}
+
 #[tokio::test]
 async fn wait_agent_returns_not_found_for_missing_agents() {
     let (mut session, turn) = make_session_and_context().await;
@@ -2872,7 +3058,7 @@ async fn wait_agent_returns_not_found_for_missing_agents() {
         "wait_agent",
         function_payload(json!({
             "targets": [id_a.to_string(), id_b.to_string()],
-            "timeout_ms": 1000
+            "timeout_ms": 10_000
         })),
     );
     let output = WaitAgentHandler::default()
@@ -3008,7 +3194,7 @@ async fn wait_agent_returns_final_status_without_timeout() {
         "wait_agent",
         function_payload(json!({
             "targets": [agent_id.to_string()],
-            "timeout_ms": 1000
+            "timeout_ms": 10_000
         })),
     );
     let output = WaitAgentHandler::default()
@@ -3087,20 +3273,23 @@ async fn multi_agent_v2_wait_agent_returns_summary_for_mailbox_activity() {
                     session,
                     turn,
                     "wait_agent",
-                    function_payload(json!({"timeout_ms": 1000})),
+                    function_payload(json!({"timeout_ms": 10_000})),
                 ))
                 .await
         }
     });
     tokio::task::yield_now().await;
 
-    session.enqueue_mailbox_communication(InterAgentCommunication::new(
-        worker_path,
-        AgentPath::root(),
-        Vec::new(),
-        "completed".to_string(),
-        /*trigger_turn*/ false,
-    ));
+    session
+        .input_queue
+        .enqueue_mailbox_communication(InterAgentCommunication::new(
+            worker_path,
+            AgentPath::root(),
+            Vec::new(),
+            "completed".to_string(),
+            /*trigger_turn*/ false,
+        ))
+        .await;
 
     let wait_output = wait_task
         .await
@@ -3164,13 +3353,16 @@ async fn multi_agent_v2_wait_agent_returns_for_already_queued_mail() {
         .agent_path
         .expect("worker path");
 
-    session.enqueue_mailbox_communication(InterAgentCommunication::new(
-        worker_path,
-        AgentPath::root(),
-        Vec::new(),
-        "already queued".to_string(),
-        /*trigger_turn*/ false,
-    ));
+    session
+        .input_queue
+        .enqueue_mailbox_communication(InterAgentCommunication::new(
+            worker_path,
+            AgentPath::root(),
+            Vec::new(),
+            "already queued".to_string(),
+            /*trigger_turn*/ false,
+        ))
+        .await;
 
     let output = timeout(
         Duration::from_millis(500),
@@ -3178,7 +3370,7 @@ async fn multi_agent_v2_wait_agent_returns_for_already_queued_mail() {
             session,
             turn,
             "wait_agent",
-            function_payload(json!({"timeout_ms": 1000})),
+            function_payload(json!({"timeout_ms": 10_000})),
         )),
     )
     .await
@@ -3253,20 +3445,23 @@ async fn multi_agent_v2_wait_agent_wakes_on_any_mailbox_notification() {
                     session,
                     turn,
                     "wait_agent",
-                    function_payload(json!({"timeout_ms": 1000})),
+                    function_payload(json!({"timeout_ms": 10_000})),
                 ))
                 .await
         }
     });
     tokio::task::yield_now().await;
 
-    session.enqueue_mailbox_communication(InterAgentCommunication::new(
-        worker_b_path,
-        AgentPath::root(),
-        Vec::new(),
-        "from worker b".to_string(),
-        /*trigger_turn*/ false,
-    ));
+    session
+        .input_queue
+        .enqueue_mailbox_communication(InterAgentCommunication::new(
+            worker_b_path,
+            AgentPath::root(),
+            Vec::new(),
+            "from worker b".to_string(),
+            /*trigger_turn*/ false,
+        ))
+        .await;
 
     let output = wait_task
         .await
@@ -3338,20 +3533,23 @@ async fn multi_agent_v2_wait_agent_does_not_return_completed_content() {
                     session,
                     turn,
                     "wait_agent",
-                    function_payload(json!({"timeout_ms": 1000})),
+                    function_payload(json!({"timeout_ms": 10_000})),
                 ))
                 .await
         }
     });
     tokio::task::yield_now().await;
 
-    session.enqueue_mailbox_communication(InterAgentCommunication::new(
-        worker_path,
-        AgentPath::root(),
-        Vec::new(),
-        "sensitive child output".to_string(),
-        /*trigger_turn*/ false,
-    ));
+    session
+        .input_queue
+        .enqueue_mailbox_communication(InterAgentCommunication::new(
+            worker_path,
+            AgentPath::root(),
+            Vec::new(),
+            "sensitive child output".to_string(),
+            /*trigger_turn*/ false,
+        ))
+        .await;
 
     let output = wait_task
         .await
@@ -3457,7 +3655,8 @@ async fn multi_agent_v2_close_agent_rejects_root_target_and_id() {
             function_payload(json!({"target": "/root"})),
         ))
         .await
-        .expect_err("close_agent should reject the root path");
+        .err()
+        .expect("close_agent should reject the root path");
     assert_eq!(
         root_path_error,
         FunctionCallError::RespondToModel("root is not a spawned agent".to_string())
@@ -3471,7 +3670,8 @@ async fn multi_agent_v2_close_agent_rejects_root_target_and_id() {
             function_payload(json!({"target": root.thread_id.to_string()})),
         ))
         .await
-        .expect_err("close_agent should reject the root thread id");
+        .err()
+        .expect("close_agent should reject the root thread id");
     assert_eq!(
         root_id_error,
         FunctionCallError::RespondToModel("root is not a spawned agent".to_string())
@@ -3727,7 +3927,7 @@ async fn tool_handlers_cascade_close_and_resume_and_keep_explicitly_closed_subtr
 #[tokio::test]
 async fn build_agent_spawn_config_uses_turn_context_values() {
     fn pick_allowed_sandbox_policy(
-        constraint: &crate::config::Constrained<PermissionProfile>,
+        permissions: &crate::config::Permissions,
         base: SandboxPolicy,
         cwd: &std::path::Path,
     ) -> SandboxPolicy {
@@ -3742,16 +3942,9 @@ async fn build_agent_spawn_config_uses_turn_context_values() {
                 if *candidate == base {
                     return false;
                 }
-                let file_system_sandbox_policy =
-                    FileSystemSandboxPolicy::from_legacy_sandbox_policy_for_cwd(candidate, cwd);
-                let network_sandbox_policy = NetworkSandboxPolicy::from(candidate);
-                let permission_profile =
-                    PermissionProfile::from_runtime_permissions_with_enforcement(
-                        SandboxEnforcement::from_legacy_sandbox_policy(candidate),
-                        &file_system_sandbox_policy,
-                        network_sandbox_policy,
-                    );
-                constraint.can_set(&permission_profile).is_ok()
+                permissions
+                    .can_set_legacy_sandbox_policy(candidate, cwd)
+                    .is_ok()
             })
             .unwrap_or(base)
     }
@@ -3767,15 +3960,20 @@ async fn build_agent_spawn_config_uses_turn_context_values() {
         ..ShellEnvironmentPolicy::default()
     };
     let temp_dir = tempfile::tempdir().expect("temp dir");
-    turn.cwd = temp_dir.abs();
+    #[allow(deprecated)]
+    {
+        turn.cwd = temp_dir.abs();
+    }
     turn.codex_linux_sandbox_exe = Some(PathBuf::from("/bin/echo"));
+    #[allow(deprecated)]
+    let turn_cwd = turn.cwd.clone();
     let sandbox_policy = pick_allowed_sandbox_policy(
-        &turn.config.permissions.permission_profile,
+        &turn.config.permissions,
         turn.config.legacy_sandbox_policy(),
-        turn.cwd.as_path(),
+        turn_cwd.as_path(),
     );
     let file_system_sandbox_policy =
-        FileSystemSandboxPolicy::from_legacy_sandbox_policy_for_cwd(&sandbox_policy, &turn.cwd);
+        FileSystemSandboxPolicy::from_legacy_sandbox_policy_for_cwd(&sandbox_policy, &turn_cwd);
     let network_sandbox_policy = NetworkSandboxPolicy::from(&sandbox_policy);
     let permission_profile = PermissionProfile::from_runtime_permissions_with_enforcement(
         SandboxEnforcement::from_legacy_sandbox_policy(&sandbox_policy),
@@ -3798,7 +3996,10 @@ async fn build_agent_spawn_config_uses_turn_context_values() {
     expected.compact_prompt = turn.compact_prompt.clone();
     expected.permissions.shell_environment_policy = turn.shell_environment_policy.clone();
     expected.codex_linux_sandbox_exe = turn.codex_linux_sandbox_exe.clone();
-    expected.cwd = turn.cwd.clone();
+    #[allow(deprecated)]
+    {
+        expected.cwd = turn.cwd.clone();
+    }
     expected
         .permissions
         .approval_policy
@@ -3849,7 +4050,10 @@ async fn build_agent_resume_config_clears_base_instructions() {
     expected.compact_prompt = turn.compact_prompt.clone();
     expected.permissions.shell_environment_policy = turn.shell_environment_policy.clone();
     expected.codex_linux_sandbox_exe = turn.codex_linux_sandbox_exe.clone();
-    expected.cwd = turn.cwd.clone();
+    #[allow(deprecated)]
+    {
+        expected.cwd = turn.cwd.clone();
+    }
     expected
         .permissions
         .approval_policy
diff --git a/codex-rs/core/src/tools/handlers/multi_agents_v2.rs b/codex-rs/core/src/tools/handlers/multi_agents_v2.rs
index 0190fe04ac..068f393379 100644
--- a/codex-rs/core/src/tools/handlers/multi_agents_v2.rs
+++ b/codex-rs/core/src/tools/handlers/multi_agents_v2.rs
@@ -6,10 +6,11 @@ use crate::function_tool::FunctionCallError;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolOutput;
 use crate::tools::context::ToolPayload;
+use crate::tools::context::boxed_tool_output;
 use crate::tools::handlers::multi_agents_common::*;
 use crate::tools::handlers::parse_arguments;
+use crate::tools::registry::CoreToolRuntime;
 use crate::tools::registry::ToolExecutor;
-use crate::tools::registry::ToolHandler;
 use codex_protocol::AgentPath;
 use codex_protocol::models::ResponseInputItem;
 use codex_protocol::openai_models::ReasoningEffort;
diff --git a/codex-rs/core/src/tools/handlers/multi_agents_v2/close_agent.rs b/codex-rs/core/src/tools/handlers/multi_agents_v2/close_agent.rs
index c901df9ae0..180cf1a9d8 100644
--- a/codex-rs/core/src/tools/handlers/multi_agents_v2/close_agent.rs
+++ b/codex-rs/core/src/tools/handlers/multi_agents_v2/close_agent.rs
@@ -5,9 +5,8 @@ use codex_tools::ToolSpec;
 
 pub(crate) struct Handler;
 
+#[async_trait::async_trait]
 impl ToolExecutor<ToolInvocation> for Handler {
-    type Output = CloseAgentResult;
-
     fn tool_name(&self) -> ToolName {
         ToolName::plain("close_agent")
     }
@@ -16,11 +15,11 @@ impl ToolExecutor<ToolInvocation> for Handler {
         Some(create_close_agent_tool_v2())
     }
 
-    fn handle(
+    async fn handle(
         &self,
         invocation: ToolInvocation,
-    ) -> impl std::future::Future<Output = Result<Self::Output, FunctionCallError>> + Send {
-        Box::pin(handle_close_agent(invocation))
+    ) -> Result<Box<dyn crate::tools::context::ToolOutput>, FunctionCallError> {
+        handle_close_agent(invocation).await.map(boxed_tool_output)
     }
 }
 
@@ -119,7 +118,7 @@ async fn handle_close_agent(
     })
 }
 
-impl ToolHandler for Handler {
+impl CoreToolRuntime for Handler {
     fn matches_kind(&self, payload: &ToolPayload) -> bool {
         matches!(payload, ToolPayload::Function { .. })
     }
diff --git a/codex-rs/core/src/tools/handlers/multi_agents_v2/followup_task.rs b/codex-rs/core/src/tools/handlers/multi_agents_v2/followup_task.rs
index 608d7f2f62..4b3edcd487 100644
--- a/codex-rs/core/src/tools/handlers/multi_agents_v2/followup_task.rs
+++ b/codex-rs/core/src/tools/handlers/multi_agents_v2/followup_task.rs
@@ -2,15 +2,13 @@ use super::message_tool::FollowupTaskArgs;
 use super::message_tool::MessageDeliveryMode;
 use super::message_tool::handle_message_string_tool;
 use super::*;
-use crate::tools::context::FunctionToolOutput;
 use crate::tools::handlers::multi_agents_spec::create_followup_task_tool;
 use codex_tools::ToolSpec;
 
 pub(crate) struct Handler;
 
+#[async_trait::async_trait]
 impl ToolExecutor<ToolInvocation> for Handler {
-    type Output = FunctionToolOutput;
-
     fn tool_name(&self) -> ToolName {
         ToolName::plain("followup_task")
     }
@@ -19,7 +17,10 @@ impl ToolExecutor<ToolInvocation> for Handler {
         Some(create_followup_task_tool())
     }
 
-    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+    async fn handle(
+        &self,
+        invocation: ToolInvocation,
+    ) -> Result<Box<dyn crate::tools::context::ToolOutput>, FunctionCallError> {
         let arguments = function_arguments(invocation.payload.clone())?;
         let args: FollowupTaskArgs = parse_arguments(&arguments)?;
         handle_message_string_tool(
@@ -29,10 +30,11 @@ impl ToolExecutor<ToolInvocation> for Handler {
             args.message,
         )
         .await
+        .map(boxed_tool_output)
     }
 }
 
-impl ToolHandler for Handler {
+impl CoreToolRuntime for Handler {
     fn matches_kind(&self, payload: &ToolPayload) -> bool {
         matches!(payload, ToolPayload::Function { .. })
     }
diff --git a/codex-rs/core/src/tools/handlers/multi_agents_v2/list_agents.rs b/codex-rs/core/src/tools/handlers/multi_agents_v2/list_agents.rs
index 527d5a29e7..b8b9072da9 100644
--- a/codex-rs/core/src/tools/handlers/multi_agents_v2/list_agents.rs
+++ b/codex-rs/core/src/tools/handlers/multi_agents_v2/list_agents.rs
@@ -5,9 +5,8 @@ use codex_tools::ToolSpec;
 
 pub(crate) struct Handler;
 
+#[async_trait::async_trait]
 impl ToolExecutor<ToolInvocation> for Handler {
-    type Output = ListAgentsResult;
-
     fn tool_name(&self) -> ToolName {
         ToolName::plain("list_agents")
     }
@@ -16,7 +15,10 @@ impl ToolExecutor<ToolInvocation> for Handler {
         Some(create_list_agents_tool())
     }
 
-    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+    async fn handle(
+        &self,
+        invocation: ToolInvocation,
+    ) -> Result<Box<dyn crate::tools::context::ToolOutput>, FunctionCallError> {
         let ToolInvocation {
             session,
             turn,
@@ -36,11 +38,11 @@ impl ToolExecutor<ToolInvocation> for Handler {
             .await
             .map_err(collab_spawn_error)?;
 
-        Ok(ListAgentsResult { agents })
+        Ok(boxed_tool_output(ListAgentsResult { agents }))
     }
 }
 
-impl ToolHandler for Handler {
+impl CoreToolRuntime for Handler {
     fn matches_kind(&self, payload: &ToolPayload) -> bool {
         matches!(payload, ToolPayload::Function { .. })
     }
diff --git a/codex-rs/core/src/tools/handlers/multi_agents_v2/send_message.rs b/codex-rs/core/src/tools/handlers/multi_agents_v2/send_message.rs
index 71909afb7e..202e28e0c9 100644
--- a/codex-rs/core/src/tools/handlers/multi_agents_v2/send_message.rs
+++ b/codex-rs/core/src/tools/handlers/multi_agents_v2/send_message.rs
@@ -2,15 +2,13 @@ use super::message_tool::MessageDeliveryMode;
 use super::message_tool::SendMessageArgs;
 use super::message_tool::handle_message_string_tool;
 use super::*;
-use crate::tools::context::FunctionToolOutput;
 use crate::tools::handlers::multi_agents_spec::create_send_message_tool;
 use codex_tools::ToolSpec;
 
 pub(crate) struct Handler;
 
+#[async_trait::async_trait]
 impl ToolExecutor<ToolInvocation> for Handler {
-    type Output = FunctionToolOutput;
-
     fn tool_name(&self) -> ToolName {
         ToolName::plain("send_message")
     }
@@ -19,7 +17,10 @@ impl ToolExecutor<ToolInvocation> for Handler {
         Some(create_send_message_tool())
     }
 
-    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+    async fn handle(
+        &self,
+        invocation: ToolInvocation,
+    ) -> Result<Box<dyn crate::tools::context::ToolOutput>, FunctionCallError> {
         let arguments = function_arguments(invocation.payload.clone())?;
         let args: SendMessageArgs = parse_arguments(&arguments)?;
         handle_message_string_tool(
@@ -29,10 +30,11 @@ impl ToolExecutor<ToolInvocation> for Handler {
             args.message,
         )
         .await
+        .map(boxed_tool_output)
     }
 }
 
-impl ToolHandler for Handler {
+impl CoreToolRuntime for Handler {
     fn matches_kind(&self, payload: &ToolPayload) -> bool {
         matches!(payload, ToolPayload::Function { .. })
     }
diff --git a/codex-rs/core/src/tools/handlers/multi_agents_v2/spawn.rs b/codex-rs/core/src/tools/handlers/multi_agents_v2/spawn.rs
index 1ab59cc3fe..2daa1f07db 100644
--- a/codex-rs/core/src/tools/handlers/multi_agents_v2/spawn.rs
+++ b/codex-rs/core/src/tools/handlers/multi_agents_v2/spawn.rs
@@ -24,9 +24,8 @@ impl Handler {
     }
 }
 
+#[async_trait::async_trait]
 impl ToolExecutor<ToolInvocation> for Handler {
-    type Output = SpawnAgentResult;
-
     fn tool_name(&self) -> ToolName {
         ToolName::plain("spawn_agent")
     }
@@ -35,11 +34,11 @@ impl ToolExecutor<ToolInvocation> for Handler {
         Some(create_spawn_agent_tool_v2(self.options.clone()))
     }
 
-    fn handle(
+    async fn handle(
         &self,
         invocation: ToolInvocation,
-    ) -> impl std::future::Future<Output = Result<Self::Output, FunctionCallError>> + Send {
-        Box::pin(handle_spawn_agent(invocation))
+    ) -> Result<Box<dyn crate::tools::context::ToolOutput>, FunctionCallError> {
+        handle_spawn_agent(invocation).await.map(boxed_tool_output)
     }
 }
 
@@ -231,7 +230,7 @@ async fn handle_spawn_agent(
     }
 }
 
-impl ToolHandler for Handler {
+impl CoreToolRuntime for Handler {
     fn matches_kind(&self, payload: &ToolPayload) -> bool {
         matches!(payload, ToolPayload::Function { .. })
     }
diff --git a/codex-rs/core/src/tools/handlers/multi_agents_v2/wait.rs b/codex-rs/core/src/tools/handlers/multi_agents_v2/wait.rs
index 48cbebdea4..285abd9330 100644
--- a/codex-rs/core/src/tools/handlers/multi_agents_v2/wait.rs
+++ b/codex-rs/core/src/tools/handlers/multi_agents_v2/wait.rs
@@ -19,9 +19,8 @@ impl Handler {
     }
 }
 
+#[async_trait::async_trait]
 impl ToolExecutor<ToolInvocation> for Handler {
-    type Output = WaitAgentResult;
-
     fn tool_name(&self) -> ToolName {
         ToolName::plain("wait_agent")
     }
@@ -30,7 +29,10 @@ impl ToolExecutor<ToolInvocation> for Handler {
         Some(create_wait_agent_tool_v2(self.options))
     }
 
-    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+    async fn handle(
+        &self,
+        invocation: ToolInvocation,
+    ) -> Result<Box<dyn crate::tools::context::ToolOutput>, FunctionCallError> {
         let ToolInvocation {
             session,
             turn,
@@ -40,22 +42,25 @@ impl ToolExecutor<ToolInvocation> for Handler {
         } = invocation;
         let arguments = function_arguments(payload)?;
         let args: WaitArgs = parse_arguments(&arguments)?;
-        let timeout_ms = args.timeout_ms.unwrap_or(DEFAULT_WAIT_TIMEOUT_MS);
-        let min_timeout_ms = turn
-            .config
-            .multi_agent_v2
-            .min_wait_timeout_ms
-            .clamp(1, MAX_WAIT_TIMEOUT_MS);
-        let timeout_ms = match timeout_ms {
-            ms if ms <= 0 => {
-                return Err(FunctionCallError::RespondToModel(
-                    "timeout_ms must be greater than zero".to_owned(),
-                ));
+        let min_timeout_ms = turn.config.multi_agent_v2.min_wait_timeout_ms;
+        let max_timeout_ms = turn.config.multi_agent_v2.max_wait_timeout_ms;
+        let default_timeout_ms = turn.config.multi_agent_v2.default_wait_timeout_ms;
+        let timeout_ms = match args.timeout_ms {
+            Some(ms) if ms < min_timeout_ms => {
+                return Err(FunctionCallError::RespondToModel(format!(
+                    "timeout_ms must be at least {min_timeout_ms}"
+                )));
             }
-            ms => ms.clamp(min_timeout_ms, MAX_WAIT_TIMEOUT_MS),
+            Some(ms) if ms > max_timeout_ms => {
+                return Err(FunctionCallError::RespondToModel(format!(
+                    "timeout_ms must be at most {max_timeout_ms}"
+                )));
+            }
+            Some(ms) => ms,
+            None => default_timeout_ms,
         };
 
-        let mut mailbox_seq_rx = session.subscribe_mailbox_seq();
+        let mut mailbox_rx = session.input_queue.subscribe_mailbox().await;
 
         session
             .send_event(
@@ -71,12 +76,8 @@ impl ToolExecutor<ToolInvocation> for Handler {
             )
             .await;
 
-        let timed_out = if session.has_pending_mailbox_items().await {
-            false
-        } else {
-            let deadline = Instant::now() + Duration::from_millis(timeout_ms as u64);
-            !wait_for_mailbox_change(&mut mailbox_seq_rx, deadline).await
-        };
+        let deadline = Instant::now() + Duration::from_millis(timeout_ms as u64);
+        let timed_out = !wait_for_mailbox_change(&mut mailbox_rx, deadline).await;
         let result = WaitAgentResult::from_timed_out(timed_out);
 
         session
@@ -93,11 +94,11 @@ impl ToolExecutor<ToolInvocation> for Handler {
             )
             .await;
 
-        Ok(result)
+        Ok(boxed_tool_output(result))
     }
 }
 
-impl ToolHandler for Handler {
+impl CoreToolRuntime for Handler {
     fn matches_kind(&self, payload: &ToolPayload) -> bool {
         matches!(payload, ToolPayload::Function { .. })
     }
@@ -148,10 +149,10 @@ impl ToolOutput for WaitAgentResult {
 }
 
 async fn wait_for_mailbox_change(
-    mailbox_seq_rx: &mut tokio::sync::watch::Receiver<u64>,
+    mailbox_rx: &mut tokio::sync::watch::Receiver<()>,
     deadline: Instant,
 ) -> bool {
-    match timeout_at(deadline, mailbox_seq_rx.changed()).await {
+    match timeout_at(deadline, mailbox_rx.changed()).await {
         Ok(Ok(())) => true,
         Ok(Err(_)) | Err(_) => false,
     }
diff --git a/codex-rs/core/src/tools/handlers/plan.rs b/codex-rs/core/src/tools/handlers/plan.rs
index 42f03e4e30..f5c94826f7 100644
--- a/codex-rs/core/src/tools/handlers/plan.rs
+++ b/codex-rs/core/src/tools/handlers/plan.rs
@@ -2,9 +2,10 @@ use crate::function_tool::FunctionCallError;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolOutput;
 use crate::tools::context::ToolPayload;
+use crate::tools::context::boxed_tool_output;
 use crate::tools::handlers::plan_spec::create_update_plan_tool;
+use crate::tools::registry::CoreToolRuntime;
 use crate::tools::registry::ToolExecutor;
-use crate::tools::registry::ToolHandler;
 use codex_protocol::config_types::ModeKind;
 use codex_protocol::models::FunctionCallOutputPayload;
 use codex_protocol::models::ResponseInputItem;
@@ -44,9 +45,8 @@ impl ToolOutput for PlanToolOutput {
     }
 }
 
+#[async_trait::async_trait]
 impl ToolExecutor<ToolInvocation> for PlanHandler {
-    type Output = PlanToolOutput;
-
     fn tool_name(&self) -> ToolName {
         ToolName::plain("update_plan")
     }
@@ -55,7 +55,10 @@ impl ToolExecutor<ToolInvocation> for PlanHandler {
         Some(create_update_plan_tool())
     }
 
-    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+    async fn handle(
+        &self,
+        invocation: ToolInvocation,
+    ) -> Result<Box<dyn crate::tools::context::ToolOutput>, FunctionCallError> {
         let ToolInvocation {
             session,
             turn,
@@ -84,11 +87,11 @@ impl ToolExecutor<ToolInvocation> for PlanHandler {
             .send_event(turn.as_ref(), EventMsg::PlanUpdate(args))
             .await;
 
-        Ok(PlanToolOutput)
+        Ok(boxed_tool_output(PlanToolOutput))
     }
 }
 
-impl ToolHandler for PlanHandler {}
+impl CoreToolRuntime for PlanHandler {}
 
 fn parse_update_plan_arguments(arguments: &str) -> Result<UpdatePlanArgs, FunctionCallError> {
     serde_json::from_str::<UpdatePlanArgs>(arguments).map_err(|e| {
diff --git a/codex-rs/core/src/tools/handlers/request_permissions.rs b/codex-rs/core/src/tools/handlers/request_permissions.rs
index 243ed52d15..007c8d2208 100644
--- a/codex-rs/core/src/tools/handlers/request_permissions.rs
+++ b/codex-rs/core/src/tools/handlers/request_permissions.rs
@@ -5,19 +5,19 @@ use crate::function_tool::FunctionCallError;
 use crate::tools::context::FunctionToolOutput;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolPayload;
+use crate::tools::context::boxed_tool_output;
 use crate::tools::handlers::parse_arguments_with_base_path;
 use crate::tools::handlers::shell_spec::create_request_permissions_tool;
 use crate::tools::handlers::shell_spec::request_permissions_tool_description;
+use crate::tools::registry::CoreToolRuntime;
 use crate::tools::registry::ToolExecutor;
-use crate::tools::registry::ToolHandler;
 use codex_tools::ToolName;
 use codex_tools::ToolSpec;
 
 pub struct RequestPermissionsHandler;
 
+#[async_trait::async_trait]
 impl ToolExecutor<ToolInvocation> for RequestPermissionsHandler {
-    type Output = FunctionToolOutput;
-
     fn tool_name(&self) -> ToolName {
         ToolName::plain("request_permissions")
     }
@@ -28,7 +28,10 @@ impl ToolExecutor<ToolInvocation> for RequestPermissionsHandler {
         ))
     }
 
-    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+    async fn handle(
+        &self,
+        invocation: ToolInvocation,
+    ) -> Result<Box<dyn crate::tools::context::ToolOutput>, FunctionCallError> {
         let ToolInvocation {
             session,
             turn,
@@ -47,6 +50,7 @@ impl ToolExecutor<ToolInvocation> for RequestPermissionsHandler {
             }
         };
 
+        #[allow(deprecated)]
         let mut args: RequestPermissionsArgs =
             parse_arguments_with_base_path(&arguments, &turn.cwd)?;
         args.permissions = normalize_additional_permissions(args.permissions.into())
@@ -73,8 +77,11 @@ impl ToolExecutor<ToolInvocation> for RequestPermissionsHandler {
             ))
         })?;
 
-        Ok(FunctionToolOutput::from_text(content, Some(true)))
+        Ok(boxed_tool_output(FunctionToolOutput::from_text(
+            content,
+            Some(true),
+        )))
     }
 }
 
-impl ToolHandler for RequestPermissionsHandler {}
+impl CoreToolRuntime for RequestPermissionsHandler {}
diff --git a/codex-rs/core/src/tools/handlers/request_plugin_install.rs b/codex-rs/core/src/tools/handlers/request_plugin_install.rs
index 9e76352aa7..3b53fd007a 100644
--- a/codex-rs/core/src/tools/handlers/request_plugin_install.rs
+++ b/codex-rs/core/src/tools/handlers/request_plugin_install.rs
@@ -32,10 +32,11 @@ use crate::function_tool::FunctionCallError;
 use crate::tools::context::FunctionToolOutput;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolPayload;
+use crate::tools::context::boxed_tool_output;
 use crate::tools::handlers::parse_arguments;
 use crate::tools::handlers::request_plugin_install_spec::create_request_plugin_install_tool;
+use crate::tools::registry::CoreToolRuntime;
 use crate::tools::registry::ToolExecutor;
-use crate::tools::registry::ToolHandler;
 
 #[derive(Default)]
 pub struct RequestPluginInstallHandler {
@@ -50,9 +51,8 @@ impl RequestPluginInstallHandler {
     }
 }
 
+#[async_trait::async_trait]
 impl ToolExecutor<ToolInvocation> for RequestPluginInstallHandler {
-    type Output = FunctionToolOutput;
-
     fn tool_name(&self) -> ToolName {
         ToolName::plain(REQUEST_PLUGIN_INSTALL_TOOL_NAME)
     }
@@ -69,7 +69,10 @@ impl ToolExecutor<ToolInvocation> for RequestPluginInstallHandler {
         clippy::await_holding_invalid_type,
         reason = "plugin install discovery reads through the session-owned manager guard"
     )]
-    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+    async fn handle(
+        &self,
+        invocation: ToolInvocation,
+    ) -> Result<Box<dyn crate::tools::context::ToolOutput>, FunctionCallError> {
         let ToolInvocation {
             payload,
             session,
@@ -189,11 +192,14 @@ impl ToolExecutor<ToolInvocation> for RequestPluginInstallHandler {
             ))
         })?;
 
-        Ok(FunctionToolOutput::from_text(content, Some(true)))
+        Ok(boxed_tool_output(FunctionToolOutput::from_text(
+            content,
+            Some(true),
+        )))
     }
 }
 
-impl ToolHandler for RequestPluginInstallHandler {}
+impl CoreToolRuntime for RequestPluginInstallHandler {}
 
 async fn maybe_persist_disabled_install_request(
     session: &crate::session::session::Session,
diff --git a/codex-rs/core/src/tools/handlers/request_user_input.rs b/codex-rs/core/src/tools/handlers/request_user_input.rs
index ae0a2c7694..8384e02637 100644
--- a/codex-rs/core/src/tools/handlers/request_user_input.rs
+++ b/codex-rs/core/src/tools/handlers/request_user_input.rs
@@ -2,14 +2,15 @@ use crate::function_tool::FunctionCallError;
 use crate::tools::context::FunctionToolOutput;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolPayload;
+use crate::tools::context::boxed_tool_output;
 use crate::tools::handlers::parse_arguments;
 use crate::tools::handlers::request_user_input_spec::REQUEST_USER_INPUT_TOOL_NAME;
 use crate::tools::handlers::request_user_input_spec::create_request_user_input_tool;
 use crate::tools::handlers::request_user_input_spec::normalize_request_user_input_args;
 use crate::tools::handlers::request_user_input_spec::request_user_input_tool_description;
 use crate::tools::handlers::request_user_input_spec::request_user_input_unavailable_message;
+use crate::tools::registry::CoreToolRuntime;
 use crate::tools::registry::ToolExecutor;
-use crate::tools::registry::ToolHandler;
 use codex_protocol::config_types::ModeKind;
 use codex_protocol::request_user_input::RequestUserInputArgs;
 use codex_tools::ToolName;
@@ -19,9 +20,8 @@ pub struct RequestUserInputHandler {
     pub available_modes: Vec<ModeKind>,
 }
 
+#[async_trait::async_trait]
 impl ToolExecutor<ToolInvocation> for RequestUserInputHandler {
-    type Output = FunctionToolOutput;
-
     fn tool_name(&self) -> ToolName {
         ToolName::plain(REQUEST_USER_INPUT_TOOL_NAME)
     }
@@ -32,7 +32,10 @@ impl ToolExecutor<ToolInvocation> for RequestUserInputHandler {
         ))
     }
 
-    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+    async fn handle(
+        &self,
+        invocation: ToolInvocation,
+    ) -> Result<Box<dyn crate::tools::context::ToolOutput>, FunctionCallError> {
         let ToolInvocation {
             session,
             turn,
@@ -79,11 +82,14 @@ impl ToolExecutor<ToolInvocation> for RequestUserInputHandler {
             ))
         })?;
 
-        Ok(FunctionToolOutput::from_text(content, Some(true)))
+        Ok(boxed_tool_output(FunctionToolOutput::from_text(
+            content,
+            Some(true),
+        )))
     }
 }
 
-impl ToolHandler for RequestUserInputHandler {}
+impl CoreToolRuntime for RequestUserInputHandler {}
 
 #[cfg(test)]
 #[path = "request_user_input_tests.rs"]
diff --git a/codex-rs/core/src/tools/handlers/shell.rs b/codex-rs/core/src/tools/handlers/shell.rs
index 6f8ba4d632..09eb29b1e4 100644
--- a/codex-rs/core/src/tools/handlers/shell.rs
+++ b/codex-rs/core/src/tools/handlers/shell.rs
@@ -1,6 +1,5 @@
 use codex_features::Feature;
 use codex_protocol::models::ShellCommandToolCallParams;
-use codex_protocol::models::ShellToolCallParams;
 use serde_json::Value as JsonValue;
 use std::sync::Arc;
 
@@ -8,9 +7,8 @@ use crate::exec::ExecParams;
 use crate::exec_policy::ExecApprovalRequest;
 use crate::function_tool::FunctionCallError;
 use crate::session::turn_context::TurnContext;
+use crate::shell::ShellType;
 use crate::tools::context::FunctionToolOutput;
-use crate::tools::context::ToolInvocation;
-use crate::tools::context::ToolOutput;
 use crate::tools::context::ToolPayload;
 use crate::tools::events::ToolEmitter;
 use crate::tools::events::ToolEventCtx;
@@ -19,12 +17,7 @@ use crate::tools::handlers::apply_patch::intercept_apply_patch;
 use crate::tools::handlers::implicit_granted_permissions;
 use crate::tools::handlers::normalize_and_validate_additional_permissions;
 use crate::tools::handlers::parse_arguments;
-use crate::tools::handlers::rewrite_function_arguments;
-use crate::tools::handlers::updated_hook_command;
-use crate::tools::hook_names::HookToolName;
 use crate::tools::orchestrator::ToolOrchestrator;
-use crate::tools::registry::PostToolUsePayload;
-use crate::tools::registry::PreToolUsePayload;
 use crate::tools::runtimes::shell::ShellRequest;
 use crate::tools::runtimes::shell::ShellRuntime;
 use crate::tools::runtimes::shell::ShellRuntimeBackend;
@@ -33,36 +26,10 @@ use codex_protocol::models::AdditionalPermissionProfile;
 use codex_protocol::protocol::ExecCommandSource;
 use codex_tools::ToolName;
 
-mod container_exec;
-mod local_shell;
 mod shell_command;
-mod shell_handler;
 
-pub use container_exec::ContainerExecHandler;
-pub use local_shell::LocalShellHandler;
 pub use shell_command::ShellCommandHandler;
 pub(crate) use shell_command::ShellCommandHandlerOptions;
-pub use shell_handler::ShellHandler;
-
-fn shell_function_payload_command(payload: &ToolPayload) -> Option<String> {
-    let ToolPayload::Function { arguments } = payload else {
-        return None;
-    };
-
-    parse_arguments::<ShellToolCallParams>(arguments)
-        .ok()
-        .map(|params| codex_shell_command::parse_command::shlex_join(&params.command))
-}
-
-fn local_shell_payload_command(payload: &ToolPayload) -> Option<String> {
-    let ToolPayload::LocalShell { params } = payload else {
-        return None;
-    };
-
-    Some(codex_shell_command::parse_command::shlex_join(
-        &params.command,
-    ))
-}
 
 fn shell_command_payload_command(payload: &ToolPayload) -> Option<String> {
     let ToolPayload::Function { arguments } = payload else {
@@ -78,79 +45,31 @@ struct RunExecLikeArgs {
     tool_name: ToolName,
     exec_params: ExecParams,
     hook_command: String,
+    shell_type: Option<ShellType>,
     additional_permissions: Option<AdditionalPermissionProfile>,
     prefix_rule: Option<Vec<String>>,
     session: Arc<crate::session::session::Session>,
     turn: Arc<TurnContext>,
     tracker: crate::tools::context::SharedTurnDiffTracker,
     call_id: String,
-    freeform: bool,
     shell_runtime_backend: ShellRuntimeBackend,
 }
 
-fn shell_function_pre_tool_use_payload(invocation: &ToolInvocation) -> Option<PreToolUsePayload> {
-    shell_function_payload_command(&invocation.payload).map(|command| PreToolUsePayload {
-        tool_name: HookToolName::bash(),
-        tool_input: serde_json::json!({ "command": command }),
-    })
-}
-
-fn rewrite_shell_function_updated_hook_input(
-    mut invocation: ToolInvocation,
-    updated_input: JsonValue,
-    tool_name: &str,
-) -> Result<ToolInvocation, FunctionCallError> {
-    let ToolPayload::Function { arguments } = invocation.payload else {
-        return Err(FunctionCallError::RespondToModel(format!(
-            "hook input rewrite received unsupported {tool_name} payload"
-        )));
-    };
-    let command = shlex::split(updated_hook_command(&updated_input)?).ok_or_else(|| {
-        FunctionCallError::RespondToModel(
-            "hook returned shell input with an invalid command string".to_string(),
-        )
-    })?;
-    invocation.payload = ToolPayload::Function {
-        arguments: rewrite_function_arguments(&arguments, tool_name, |arguments| {
-            arguments.insert(
-                "command".to_string(),
-                JsonValue::Array(command.into_iter().map(JsonValue::String).collect()),
-            );
-        })?,
-    };
-    Ok(invocation)
-}
-
-fn shell_function_post_tool_use_payload(
-    invocation: &ToolInvocation,
-    result: &FunctionToolOutput,
-) -> Option<PostToolUsePayload> {
-    let tool_response = result.post_tool_use_response(&invocation.call_id, &invocation.payload)?;
-    let command = shell_function_payload_command(&invocation.payload)?;
-    Some(PostToolUsePayload {
-        tool_name: HookToolName::bash(),
-        tool_use_id: invocation.call_id.clone(),
-        tool_input: serde_json::json!({ "command": command }),
-        tool_response,
-    })
-}
-
 async fn run_exec_like(args: RunExecLikeArgs) -> Result<FunctionToolOutput, FunctionCallError> {
     let RunExecLikeArgs {
         tool_name,
         exec_params,
         hook_command,
+        shell_type,
         additional_permissions,
         prefix_rule,
         session,
         turn,
         tracker,
         call_id,
-        freeform,
         shell_runtime_backend,
     } = args;
 
-    let mut exec_params = exec_params;
     let Some(turn_environment) = turn.environments.primary() else {
         return Err(FunctionCallError::RespondToModel(
             "shell is unavailable in this session".to_string(),
@@ -158,21 +77,11 @@ async fn run_exec_like(args: RunExecLikeArgs) -> Result<FunctionToolOutput, Func
     };
     let fs = turn_environment.environment.get_filesystem();
 
-    let dependency_env = session.dependency_env().await;
-    if !dependency_env.is_empty() {
-        exec_params.env.extend(dependency_env.clone());
-    }
-
-    let mut explicit_env_overrides = turn.shell_environment_policy.r#set.clone();
-    for key in dependency_env.keys() {
-        if let Some(value) = exec_params.env.get(key) {
-            explicit_env_overrides.insert(key.clone(), value.clone());
-        }
-    }
-
+    let explicit_env_overrides = turn.shell_environment_policy.r#set.clone();
     let exec_permission_approvals_enabled =
         session.features().enabled(Feature::ExecPermissionApprovals);
     let requested_additional_permissions = additional_permissions.clone();
+    #[allow(deprecated)]
     let effective_additional_permissions = apply_granted_turn_permissions(
         session.as_ref(),
         turn.cwd.as_path(),
@@ -239,12 +148,7 @@ async fn run_exec_like(args: RunExecLikeArgs) -> Result<FunctionToolOutput, Func
     }
 
     let source = ExecCommandSource::Agent;
-    let emitter = ToolEmitter::shell(
-        exec_params.command.clone(),
-        exec_params.cwd.clone(),
-        source,
-        freeform,
-    );
+    let emitter = ToolEmitter::shell(exec_params.command.clone(), exec_params.cwd.clone(), source);
     let event_ctx = ToolEventCtx::new(
         session.as_ref(),
         turn.as_ref(),
@@ -262,6 +166,7 @@ async fn run_exec_like(args: RunExecLikeArgs) -> Result<FunctionToolOutput, Func
             approval_policy: turn.approval_policy.value(),
             permission_profile: turn.permission_profile(),
             file_system_sandbox_policy: &file_system_sandbox_policy,
+            #[allow(deprecated)]
             sandbox_cwd: turn.cwd.as_path(),
             sandbox_permissions: if effective_additional_permissions.permissions_preapproved {
                 codex_protocol::models::SandboxPermissions::UseDefault
@@ -274,6 +179,7 @@ async fn run_exec_like(args: RunExecLikeArgs) -> Result<FunctionToolOutput, Func
 
     let req = ShellRequest {
         command: exec_params.command.clone(),
+        shell_type,
         hook_command,
         cwd: exec_params.cwd.clone(),
         timeout_ms: exec_params.expiration.timeout_ms(),
@@ -289,15 +195,7 @@ async fn run_exec_like(args: RunExecLikeArgs) -> Result<FunctionToolOutput, Func
         exec_approval_requirement,
     };
     let mut orchestrator = ToolOrchestrator::new();
-    let mut runtime = {
-        use ShellRuntimeBackend::*;
-        match shell_runtime_backend {
-            Generic => ShellRuntime::new(),
-            backend @ (ShellCommandClassic | ShellCommandZshFork) => {
-                ShellRuntime::for_shell_command(backend)
-            }
-        }
-    };
+    let mut runtime = ShellRuntime::for_shell_command(shell_runtime_backend);
     let tool_ctx = ToolCtx {
         session: session.clone(),
         turn: turn.clone(),
diff --git a/codex-rs/core/src/tools/handlers/shell/container_exec.rs b/codex-rs/core/src/tools/handlers/shell/container_exec.rs
deleted file mode 100644
index ee3dd8221d..0000000000
--- a/codex-rs/core/src/tools/handlers/shell/container_exec.rs
+++ /dev/null
@@ -1,97 +0,0 @@
-use codex_protocol::models::ShellToolCallParams;
-use codex_tools::ToolName;
-
-use crate::function_tool::FunctionCallError;
-use crate::tools::context::FunctionToolOutput;
-use crate::tools::context::ToolInvocation;
-use crate::tools::context::ToolPayload;
-use crate::tools::handlers::parse_arguments_with_base_path;
-use crate::tools::handlers::resolve_workdir_base_path;
-use crate::tools::registry::PostToolUsePayload;
-use crate::tools::registry::PreToolUsePayload;
-use crate::tools::registry::ToolExecutor;
-use crate::tools::registry::ToolHandler;
-use crate::tools::runtimes::shell::ShellRuntimeBackend;
-
-use super::RunExecLikeArgs;
-use super::rewrite_shell_function_updated_hook_input;
-use super::run_exec_like;
-use super::shell_function_post_tool_use_payload;
-use super::shell_function_pre_tool_use_payload;
-use super::shell_handler::ShellHandler;
-
-pub struct ContainerExecHandler;
-
-impl ToolExecutor<ToolInvocation> for ContainerExecHandler {
-    type Output = FunctionToolOutput;
-
-    fn tool_name(&self) -> ToolName {
-        ToolName::plain("container.exec")
-    }
-
-    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
-        let ToolInvocation {
-            session,
-            turn,
-            tracker,
-            call_id,
-            payload,
-            ..
-        } = invocation;
-
-        let arguments = match payload {
-            ToolPayload::Function { arguments } => arguments,
-            _ => {
-                return Err(FunctionCallError::RespondToModel(
-                    "unsupported payload for container.exec handler".to_string(),
-                ));
-            }
-        };
-
-        let cwd = resolve_workdir_base_path(&arguments, &turn.cwd)?;
-        let params: ShellToolCallParams = parse_arguments_with_base_path(&arguments, &cwd)?;
-        let prefix_rule = params.prefix_rule.clone();
-        let exec_params =
-            ShellHandler::to_exec_params(&params, turn.as_ref(), session.conversation_id);
-        run_exec_like(RunExecLikeArgs {
-            tool_name: ToolName::plain("container.exec"),
-            exec_params,
-            hook_command: codex_shell_command::parse_command::shlex_join(&params.command),
-            additional_permissions: params.additional_permissions.clone(),
-            prefix_rule,
-            session,
-            turn,
-            tracker,
-            call_id,
-            freeform: false,
-            shell_runtime_backend: ShellRuntimeBackend::Generic,
-        })
-        .await
-    }
-}
-
-impl ToolHandler for ContainerExecHandler {
-    fn matches_kind(&self, payload: &ToolPayload) -> bool {
-        matches!(payload, ToolPayload::Function { .. })
-    }
-
-    fn pre_tool_use_payload(&self, invocation: &ToolInvocation) -> Option<PreToolUsePayload> {
-        shell_function_pre_tool_use_payload(invocation)
-    }
-
-    fn with_updated_hook_input(
-        &self,
-        invocation: ToolInvocation,
-        updated_input: serde_json::Value,
-    ) -> Result<ToolInvocation, FunctionCallError> {
-        rewrite_shell_function_updated_hook_input(invocation, updated_input, "container.exec")
-    }
-
-    fn post_tool_use_payload(
-        &self,
-        invocation: &ToolInvocation,
-        result: &Self::Output,
-    ) -> Option<PostToolUsePayload> {
-        shell_function_post_tool_use_payload(invocation, result)
-    }
-}
diff --git a/codex-rs/core/src/tools/handlers/shell/local_shell.rs b/codex-rs/core/src/tools/handlers/shell/local_shell.rs
deleted file mode 100644
index 608d748d85..0000000000
--- a/codex-rs/core/src/tools/handlers/shell/local_shell.rs
+++ /dev/null
@@ -1,131 +0,0 @@
-use codex_tools::ToolName;
-
-use crate::function_tool::FunctionCallError;
-use crate::tools::context::FunctionToolOutput;
-use crate::tools::context::ToolInvocation;
-use crate::tools::context::ToolOutput;
-use crate::tools::context::ToolPayload;
-use crate::tools::handlers::updated_hook_command;
-use crate::tools::hook_names::HookToolName;
-use crate::tools::registry::PostToolUsePayload;
-use crate::tools::registry::PreToolUsePayload;
-use crate::tools::registry::ToolExecutor;
-use crate::tools::registry::ToolHandler;
-use crate::tools::runtimes::shell::ShellRuntimeBackend;
-use codex_tools::ToolSpec;
-
-use super::super::shell_spec::create_local_shell_tool;
-use super::RunExecLikeArgs;
-use super::local_shell_payload_command;
-use super::run_exec_like;
-use super::shell_handler::ShellHandler;
-
-#[derive(Default)]
-pub struct LocalShellHandler {
-    include_spec: bool,
-}
-
-impl LocalShellHandler {
-    pub(crate) fn new() -> Self {
-        Self { include_spec: true }
-    }
-}
-
-impl ToolExecutor<ToolInvocation> for LocalShellHandler {
-    type Output = FunctionToolOutput;
-
-    fn tool_name(&self) -> ToolName {
-        ToolName::plain("local_shell")
-    }
-
-    fn spec(&self) -> Option<ToolSpec> {
-        self.include_spec.then(create_local_shell_tool)
-    }
-
-    fn supports_parallel_tool_calls(&self) -> bool {
-        self.include_spec
-    }
-
-    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
-        let ToolInvocation {
-            session,
-            turn,
-            tracker,
-            call_id,
-            payload,
-            ..
-        } = invocation;
-
-        let ToolPayload::LocalShell { params } = payload else {
-            return Err(FunctionCallError::RespondToModel(
-                "unsupported payload for local_shell handler".to_string(),
-            ));
-        };
-
-        let exec_params =
-            ShellHandler::to_exec_params(&params, turn.as_ref(), session.conversation_id);
-        run_exec_like(RunExecLikeArgs {
-            tool_name: ToolName::plain("local_shell"),
-            exec_params,
-            hook_command: codex_shell_command::parse_command::shlex_join(&params.command),
-            additional_permissions: None,
-            prefix_rule: None,
-            session,
-            turn,
-            tracker,
-            call_id,
-            freeform: false,
-            shell_runtime_backend: ShellRuntimeBackend::Generic,
-        })
-        .await
-    }
-}
-
-impl ToolHandler for LocalShellHandler {
-    fn matches_kind(&self, payload: &ToolPayload) -> bool {
-        matches!(payload, ToolPayload::LocalShell { .. })
-    }
-
-    fn pre_tool_use_payload(&self, invocation: &ToolInvocation) -> Option<PreToolUsePayload> {
-        local_shell_payload_command(&invocation.payload).map(|command| PreToolUsePayload {
-            tool_name: HookToolName::bash(),
-            tool_input: serde_json::json!({ "command": command }),
-        })
-    }
-
-    fn with_updated_hook_input(
-        &self,
-        mut invocation: ToolInvocation,
-        updated_input: serde_json::Value,
-    ) -> Result<ToolInvocation, FunctionCallError> {
-        let command = updated_hook_command(&updated_input)?;
-        invocation.payload = match invocation.payload {
-            ToolPayload::LocalShell { mut params } => {
-                params.command = shlex::split(command).ok_or_else(|| {
-                    FunctionCallError::RespondToModel(
-                        "hook returned shell input with an invalid command string".to_string(),
-                    )
-                })?;
-                ToolPayload::LocalShell { params }
-            }
-            payload => payload,
-        };
-        Ok(invocation)
-    }
-
-    fn post_tool_use_payload(
-        &self,
-        invocation: &ToolInvocation,
-        result: &Self::Output,
-    ) -> Option<PostToolUsePayload> {
-        let tool_response =
-            result.post_tool_use_response(&invocation.call_id, &invocation.payload)?;
-        let command = local_shell_payload_command(&invocation.payload)?;
-        Some(PostToolUsePayload {
-            tool_name: HookToolName::bash(),
-            tool_use_id: invocation.call_id.clone(),
-            tool_input: serde_json::json!({ "command": command }),
-            tool_response,
-        })
-    }
-}
diff --git a/codex-rs/core/src/tools/handlers/shell/shell_command.rs b/codex-rs/core/src/tools/handlers/shell/shell_command.rs
index 8d9170bbdf..4dffdd688c 100644
--- a/codex-rs/core/src/tools/handlers/shell/shell_command.rs
+++ b/codex-rs/core/src/tools/handlers/shell/shell_command.rs
@@ -10,19 +10,18 @@ use crate::function_tool::FunctionCallError;
 use crate::maybe_emit_implicit_skill_invocation;
 use crate::session::turn_context::TurnContext;
 use crate::shell::Shell;
-use crate::tools::context::FunctionToolOutput;
 use crate::tools::context::ToolInvocation;
-use crate::tools::context::ToolOutput;
 use crate::tools::context::ToolPayload;
+use crate::tools::context::boxed_tool_output;
 use crate::tools::handlers::parse_arguments_with_base_path;
 use crate::tools::handlers::resolve_workdir_base_path;
 use crate::tools::handlers::rewrite_function_string_argument;
 use crate::tools::handlers::updated_hook_command;
 use crate::tools::hook_names::HookToolName;
+use crate::tools::registry::CoreToolRuntime;
 use crate::tools::registry::PostToolUsePayload;
 use crate::tools::registry::PreToolUsePayload;
 use crate::tools::registry::ToolExecutor;
-use crate::tools::registry::ToolHandler;
 use crate::tools::runtimes::shell::ShellRuntimeBackend;
 use codex_tools::ToolSpec;
 
@@ -92,10 +91,12 @@ impl ShellCommandHandler {
         let shell = session.user_shell();
         let use_login_shell = Self::resolve_use_login_shell(params.login, allow_login_shell)?;
         let command = Self::base_command(shell.as_ref(), &params.command, use_login_shell);
+        #[allow(deprecated)]
+        let cwd = turn_context.resolve_path(params.workdir.clone());
 
         Ok(ExecParams {
             command,
-            cwd: turn_context.resolve_path(params.workdir.clone()),
+            cwd,
             expiration: params.timeout_ms.into(),
             capture_policy: ExecCapturePolicy::ShellTool,
             env: create_env(&turn_context.shell_environment_policy, Some(thread_id)),
@@ -125,9 +126,8 @@ impl From<ShellCommandBackendConfig> for ShellCommandHandler {
     }
 }
 
+#[async_trait::async_trait]
 impl ToolExecutor<ToolInvocation> for ShellCommandHandler {
-    type Output = FunctionToolOutput;
-
     fn tool_name(&self) -> ToolName {
         ToolName::plain("shell_command")
     }
@@ -145,7 +145,10 @@ impl ToolExecutor<ToolInvocation> for ShellCommandHandler {
         self.options.is_some()
     }
 
-    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+    async fn handle(
+        &self,
+        invocation: ToolInvocation,
+    ) -> Result<Box<dyn crate::tools::context::ToolOutput>, FunctionCallError> {
         let ToolInvocation {
             session,
             turn,
@@ -162,8 +165,10 @@ impl ToolExecutor<ToolInvocation> for ShellCommandHandler {
             )));
         };
 
+        #[allow(deprecated)]
         let cwd = resolve_workdir_base_path(&arguments, &turn.cwd)?;
         let params: ShellCommandToolCallParams = parse_arguments_with_base_path(&arguments, &cwd)?;
+        #[allow(deprecated)]
         let workdir = turn.resolve_path(params.workdir.clone());
         maybe_emit_implicit_skill_invocation(
             session.as_ref(),
@@ -178,26 +183,28 @@ impl ToolExecutor<ToolInvocation> for ShellCommandHandler {
             session.as_ref(),
             turn.as_ref(),
             session.conversation_id,
-            turn.tools_config.allow_login_shell,
+            turn.config.permissions.allow_login_shell,
         )?;
+        let shell_type = Some(session.user_shell().shell_type.clone());
         run_exec_like(RunExecLikeArgs {
             tool_name,
             exec_params,
             hook_command: params.command,
+            shell_type,
             additional_permissions: params.additional_permissions.clone(),
             prefix_rule,
             session,
             turn,
             tracker,
             call_id,
-            freeform: true,
             shell_runtime_backend: self.shell_runtime_backend(),
         })
         .await
+        .map(boxed_tool_output)
     }
 }
 
-impl ToolHandler for ShellCommandHandler {
+impl CoreToolRuntime for ShellCommandHandler {
     fn matches_kind(&self, payload: &ToolPayload) -> bool {
         matches!(payload, ToolPayload::Function { .. })
     }
@@ -233,7 +240,7 @@ impl ToolHandler for ShellCommandHandler {
     fn post_tool_use_payload(
         &self,
         invocation: &ToolInvocation,
-        result: &Self::Output,
+        result: &dyn crate::tools::context::ToolOutput,
     ) -> Option<PostToolUsePayload> {
         let tool_response =
             result.post_tool_use_response(&invocation.call_id, &invocation.payload)?;
diff --git a/codex-rs/core/src/tools/handlers/shell/shell_handler.rs b/codex-rs/core/src/tools/handlers/shell/shell_handler.rs
deleted file mode 100644
index 8875e96024..0000000000
--- a/codex-rs/core/src/tools/handlers/shell/shell_handler.rs
+++ /dev/null
@@ -1,146 +0,0 @@
-use codex_protocol::ThreadId;
-use codex_protocol::models::ShellToolCallParams;
-use codex_tools::ToolName;
-
-use crate::exec::ExecCapturePolicy;
-use crate::exec::ExecParams;
-use crate::exec_env::create_env;
-use crate::function_tool::FunctionCallError;
-use crate::session::turn_context::TurnContext;
-use crate::tools::context::FunctionToolOutput;
-use crate::tools::context::ToolInvocation;
-use crate::tools::context::ToolPayload;
-use crate::tools::handlers::parse_arguments_with_base_path;
-use crate::tools::handlers::resolve_workdir_base_path;
-use crate::tools::registry::PostToolUsePayload;
-use crate::tools::registry::PreToolUsePayload;
-use crate::tools::registry::ToolExecutor;
-use crate::tools::registry::ToolHandler;
-use crate::tools::runtimes::shell::ShellRuntimeBackend;
-use codex_tools::ToolSpec;
-
-use super::super::shell_spec::ShellToolOptions;
-use super::super::shell_spec::create_shell_tool;
-use super::RunExecLikeArgs;
-use super::rewrite_shell_function_updated_hook_input;
-use super::run_exec_like;
-use super::shell_function_post_tool_use_payload;
-use super::shell_function_pre_tool_use_payload;
-
-#[derive(Default)]
-pub struct ShellHandler {
-    options: Option<ShellToolOptions>,
-}
-
-impl ShellHandler {
-    pub(crate) fn new(options: ShellToolOptions) -> Self {
-        Self {
-            options: Some(options),
-        }
-    }
-
-    pub(super) fn to_exec_params(
-        params: &ShellToolCallParams,
-        turn_context: &TurnContext,
-        thread_id: ThreadId,
-    ) -> ExecParams {
-        ExecParams {
-            command: params.command.clone(),
-            cwd: turn_context.resolve_path(params.workdir.clone()),
-            expiration: params.timeout_ms.into(),
-            capture_policy: ExecCapturePolicy::ShellTool,
-            env: create_env(&turn_context.shell_environment_policy, Some(thread_id)),
-            network: turn_context.network.clone(),
-            sandbox_permissions: params.sandbox_permissions.unwrap_or_default(),
-            windows_sandbox_level: turn_context.windows_sandbox_level,
-            windows_sandbox_private_desktop: turn_context
-                .config
-                .permissions
-                .windows_sandbox_private_desktop,
-            justification: params.justification.clone(),
-            arg0: None,
-        }
-    }
-}
-
-impl ToolExecutor<ToolInvocation> for ShellHandler {
-    type Output = FunctionToolOutput;
-
-    fn tool_name(&self) -> ToolName {
-        ToolName::plain("shell")
-    }
-
-    fn spec(&self) -> Option<ToolSpec> {
-        self.options.map(create_shell_tool)
-    }
-
-    fn supports_parallel_tool_calls(&self) -> bool {
-        self.options.is_some()
-    }
-
-    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
-        let ToolInvocation {
-            session,
-            turn,
-            tracker,
-            call_id,
-            payload,
-            ..
-        } = invocation;
-
-        let arguments = match payload {
-            ToolPayload::Function { arguments } => arguments,
-            _ => {
-                return Err(FunctionCallError::RespondToModel(
-                    "unsupported payload for shell handler".to_string(),
-                ));
-            }
-        };
-
-        let cwd = resolve_workdir_base_path(&arguments, &turn.cwd)?;
-        let params: ShellToolCallParams = parse_arguments_with_base_path(&arguments, &cwd)?;
-        let prefix_rule = params.prefix_rule.clone();
-        let exec_params =
-            ShellHandler::to_exec_params(&params, turn.as_ref(), session.conversation_id);
-        run_exec_like(RunExecLikeArgs {
-            tool_name: ToolName::plain("shell"),
-            exec_params,
-            hook_command: codex_shell_command::parse_command::shlex_join(&params.command),
-            additional_permissions: params.additional_permissions.clone(),
-            prefix_rule,
-            session,
-            turn,
-            tracker,
-            call_id,
-            freeform: false,
-            shell_runtime_backend: ShellRuntimeBackend::Generic,
-        })
-        .await
-    }
-}
-
-impl ToolHandler for ShellHandler {
-    fn matches_kind(&self, payload: &ToolPayload) -> bool {
-        matches!(payload, ToolPayload::Function { .. })
-    }
-
-    fn pre_tool_use_payload(&self, invocation: &ToolInvocation) -> Option<PreToolUsePayload> {
-        shell_function_pre_tool_use_payload(invocation)
-    }
-
-    fn with_updated_hook_input(
-        &self,
-        invocation: ToolInvocation,
-        updated_input: serde_json::Value,
-    ) -> Result<ToolInvocation, FunctionCallError> {
-        rewrite_shell_function_updated_hook_input(invocation, updated_input, "shell")
-    }
-
-    fn post_tool_use_payload(
-        &self,
-        invocation: &ToolInvocation,
-        result: &Self::Output,
-    ) -> Option<PostToolUsePayload> {
-        shell_function_post_tool_use_payload(invocation, result)
-    }
-}
diff --git a/codex-rs/core/src/tools/handlers/shell_spec.rs b/codex-rs/core/src/tools/handlers/shell_spec.rs
index dc46290bfa..43b78e3afe 100644
--- a/codex-rs/core/src/tools/handlers/shell_spec.rs
+++ b/codex-rs/core/src/tools/handlers/shell_spec.rs
@@ -11,20 +11,11 @@ pub struct CommandToolOptions {
     pub exec_permission_approvals_enabled: bool,
 }
 
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub struct ShellToolOptions {
-    pub exec_permission_approvals_enabled: bool,
-}
-
 #[cfg(test)]
 pub fn create_exec_command_tool(options: CommandToolOptions) -> ToolSpec {
     create_exec_command_tool_with_environment_id(options, /*include_environment_id*/ false)
 }
 
-pub fn create_local_shell_tool() -> ToolSpec {
-    ToolSpec::LocalShell {}
-}
-
 pub(crate) fn create_exec_command_tool_with_environment_id(
     options: CommandToolOptions,
     include_environment_id: bool,
@@ -153,69 +144,6 @@ pub fn create_write_stdin_tool() -> ToolSpec {
     })
 }
 
-pub fn create_shell_tool(options: ShellToolOptions) -> ToolSpec {
-    let mut properties = BTreeMap::from([
-        (
-            "command".to_string(),
-            JsonSchema::array(
-                JsonSchema::string(/*description*/ None),
-                Some("The command to execute".to_string()),
-            ),
-        ),
-        (
-            "workdir".to_string(),
-            JsonSchema::string(Some(
-                "The working directory to execute the command in".to_string(),
-            )),
-        ),
-        (
-            "timeout_ms".to_string(),
-            JsonSchema::number(Some(
-                "The timeout for the command in milliseconds".to_string(),
-            )),
-        ),
-    ]);
-    properties.extend(create_approval_parameters(
-        options.exec_permission_approvals_enabled,
-    ));
-
-    let description = if cfg!(windows) {
-        format!(
-            r#"Runs a Powershell command (Windows) and returns its output. Arguments to `shell` will be passed to CreateProcessW(). Most commands should be prefixed with ["powershell.exe", "-Command"].
-
-Examples of valid command strings:
-
-- ls -a (show hidden): ["powershell.exe", "-Command", "Get-ChildItem -Force"]
-- recursive find by name: ["powershell.exe", "-Command", "Get-ChildItem -Recurse -Filter *.py"]
-- recursive grep: ["powershell.exe", "-Command", "Get-ChildItem -Path C:\\myrepo -Recurse | Select-String -Pattern 'TODO' -CaseSensitive"]
-- ps aux | grep python: ["powershell.exe", "-Command", "Get-Process | Where-Object {{ $_.ProcessName -like '*python*' }}"]
-- setting an env var: ["powershell.exe", "-Command", "$env:FOO='bar'; echo $env:FOO"]
-- running an inline Python script: ["powershell.exe", "-Command", "@'\\nprint('Hello, world!')\\n'@ | python -"]
-
-{}"#,
-            windows_shell_guidance()
-        )
-    } else {
-        r#"Runs a shell command and returns its output.
-- The arguments to `shell` will be passed to execvp(). Most terminal commands should be prefixed with ["bash", "-lc"].
-- Always set the `workdir` param when using the shell function. Do not use `cd` unless absolutely necessary."#
-            .to_string()
-    };
-
-    ToolSpec::Function(ResponsesApiTool {
-        name: "shell".to_string(),
-        description,
-        strict: false,
-        defer_loading: None,
-        parameters: JsonSchema::object(
-            properties,
-            Some(vec!["command".to_string()]),
-            Some(false.into()),
-        ),
-        output_schema: None,
-    })
-}
-
 pub fn create_shell_command_tool(options: CommandToolOptions) -> ToolSpec {
     let mut properties = BTreeMap::from([
         (
diff --git a/codex-rs/core/src/tools/handlers/shell_spec_tests.rs b/codex-rs/core/src/tools/handlers/shell_spec_tests.rs
index a219263e1a..4774815fb2 100644
--- a/codex-rs/core/src/tools/handlers/shell_spec_tests.rs
+++ b/codex-rs/core/src/tools/handlers/shell_spec_tests.rs
@@ -6,91 +6,6 @@ fn windows_shell_guidance_description() -> String {
     format!("\n\n{}", windows_shell_guidance())
 }
 
-#[test]
-fn shell_tool_matches_expected_spec() {
-    let tool = create_shell_tool(ShellToolOptions {
-        exec_permission_approvals_enabled: false,
-    });
-
-    let description = if cfg!(windows) {
-        r#"Runs a Powershell command (Windows) and returns its output. Arguments to `shell` will be passed to CreateProcessW(). Most commands should be prefixed with ["powershell.exe", "-Command"].
-
-Examples of valid command strings:
-
-- ls -a (show hidden): ["powershell.exe", "-Command", "Get-ChildItem -Force"]
-- recursive find by name: ["powershell.exe", "-Command", "Get-ChildItem -Recurse -Filter *.py"]
-- recursive grep: ["powershell.exe", "-Command", "Get-ChildItem -Path C:\\myrepo -Recurse | Select-String -Pattern 'TODO' -CaseSensitive"]
-- ps aux | grep python: ["powershell.exe", "-Command", "Get-Process | Where-Object { $_.ProcessName -like '*python*' }"]
-- setting an env var: ["powershell.exe", "-Command", "$env:FOO='bar'; echo $env:FOO"]
-- running an inline Python script: ["powershell.exe", "-Command", "@'\\nprint('Hello, world!')\\n'@ | python -"]"#
-            .to_string()
-            + &windows_shell_guidance_description()
-    } else {
-        r#"Runs a shell command and returns its output.
-- The arguments to `shell` will be passed to execvp(). Most terminal commands should be prefixed with ["bash", "-lc"].
-- Always set the `workdir` param when using the shell function. Do not use `cd` unless absolutely necessary."#
-            .to_string()
-    };
-
-    let properties = BTreeMap::from([
-        (
-            "command".to_string(),
-            JsonSchema::array(JsonSchema::string(/*description*/ None), Some("The command to execute".to_string())),
-        ),
-        (
-            "workdir".to_string(),
-            JsonSchema::string(Some("The working directory to execute the command in".to_string())),
-        ),
-        (
-            "timeout_ms".to_string(),
-            JsonSchema::number(Some("The timeout for the command in milliseconds".to_string())),
-        ),
-        (
-            "sandbox_permissions".to_string(),
-            JsonSchema::string(Some(
-                    "Sandbox permissions for the command. Set to \"require_escalated\" to request running without sandbox restrictions; defaults to \"use_default\"."
-                        .to_string(),
-                )),
-        ),
-        (
-            "justification".to_string(),
-            JsonSchema::string(Some(
-                    r#"Only set if sandbox_permissions is \"require_escalated\".
-                    Request approval from the user to run this command outside the sandbox.
-                    Phrased as a simple question that summarizes the purpose of the
-                    command as it relates to the task at hand - e.g. 'Do you want to
-                    fetch and pull the latest version of this git branch?'"#
-                        .to_string(),
-                )),
-        ),
-        (
-            "prefix_rule".to_string(),
-            JsonSchema::array(JsonSchema::string(/*description*/ None), Some(
-                    r#"Only specify when sandbox_permissions is `require_escalated`.
-                        Suggest a prefix command pattern that will allow you to fulfill similar requests from the user in the future.
-                        Should be a short but reasonable prefix, e.g. [\"git\", \"pull\"] or [\"uv\", \"run\"] or [\"pytest\"]."#
-                        .to_string(),
-                )),
-        ),
-    ]);
-
-    assert_eq!(
-        tool,
-        ToolSpec::Function(ResponsesApiTool {
-            name: "shell".to_string(),
-            description,
-            strict: false,
-            defer_loading: None,
-            parameters: JsonSchema::object(
-                properties,
-                Some(vec!["command".to_string()]),
-                Some(false.into())
-            ),
-            output_schema: None,
-        })
-    );
-}
-
 #[test]
 fn exec_command_tool_matches_expected_spec() {
     let tool = create_exec_command_tool(CommandToolOptions {
@@ -224,77 +139,6 @@ fn write_stdin_tool_matches_expected_spec() {
     );
 }
 
-#[test]
-fn shell_tool_with_request_permission_includes_additional_permissions() {
-    let tool = create_shell_tool(ShellToolOptions {
-        exec_permission_approvals_enabled: true,
-    });
-
-    let mut properties = BTreeMap::from([
-        (
-            "command".to_string(),
-            JsonSchema::array(
-                JsonSchema::string(/*description*/ None),
-                Some("The command to execute".to_string()),
-            ),
-        ),
-        (
-            "workdir".to_string(),
-            JsonSchema::string(Some(
-                "The working directory to execute the command in".to_string(),
-            )),
-        ),
-        (
-            "timeout_ms".to_string(),
-            JsonSchema::number(Some(
-                "The timeout for the command in milliseconds".to_string(),
-            )),
-        ),
-    ]);
-    properties.extend(create_approval_parameters(
-        /*exec_permission_approvals_enabled*/ true,
-    ));
-
-    let description = if cfg!(windows) {
-        format!(
-            r#"Runs a Powershell command (Windows) and returns its output. Arguments to `shell` will be passed to CreateProcessW(). Most commands should be prefixed with ["powershell.exe", "-Command"].
-
-Examples of valid command strings:
-
-- ls -a (show hidden): ["powershell.exe", "-Command", "Get-ChildItem -Force"]
-- recursive find by name: ["powershell.exe", "-Command", "Get-ChildItem -Recurse -Filter *.py"]
-- recursive grep: ["powershell.exe", "-Command", "Get-ChildItem -Path C:\\myrepo -Recurse | Select-String -Pattern 'TODO' -CaseSensitive"]
-- ps aux | grep python: ["powershell.exe", "-Command", "Get-Process | Where-Object {{ $_.ProcessName -like '*python*' }}"]
-- setting an env var: ["powershell.exe", "-Command", "$env:FOO='bar'; echo $env:FOO"]
-- running an inline Python script: ["powershell.exe", "-Command", "@'\\nprint('Hello, world!')\\n'@ | python -"]
-
-{}"#,
-            windows_shell_guidance()
-        )
-    } else {
-        r#"Runs a shell command and returns its output.
-- The arguments to `shell` will be passed to execvp(). Most terminal commands should be prefixed with ["bash", "-lc"].
-- Always set the `workdir` param when using the shell function. Do not use `cd` unless absolutely necessary."#
-            .to_string()
-    };
-
-    assert_eq!(
-        tool,
-        ToolSpec::Function(ResponsesApiTool {
-            name: "shell".to_string(),
-            description,
-            strict: false,
-            defer_loading: None,
-            parameters: JsonSchema::object(
-                properties,
-                Some(vec!["command".to_string()]),
-                Some(false.into())
-            ),
-            output_schema: None,
-        })
-    );
-}
-
 #[test]
 fn request_permissions_tool_includes_full_permission_schema() {
     let tool =
diff --git a/codex-rs/core/src/tools/handlers/shell_tests.rs b/codex-rs/core/src/tools/handlers/shell_tests.rs
index ce97b8317e..eda23533a3 100644
--- a/codex-rs/core/src/tools/handlers/shell_tests.rs
+++ b/codex-rs/core/src/tools/handlers/shell_tests.rs
@@ -16,10 +16,9 @@ use crate::tools::context::FunctionToolOutput;
 use crate::tools::context::ToolCallSource;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolPayload;
-use crate::tools::handlers::LocalShellHandler;
 use crate::tools::handlers::ShellCommandHandler;
 use crate::tools::hook_names::HookToolName;
-use crate::tools::registry::ToolHandler;
+use crate::tools::registry::CoreToolRuntime;
 use crate::turn_diff_tracker::TurnDiffTracker;
 use codex_shell_command::is_safe_command::is_known_safe_command;
 use codex_shell_command::powershell::try_find_powershell_executable_blocking;
@@ -89,6 +88,7 @@ async fn shell_command_handler_to_exec_params_uses_session_shell_and_turn_contex
     let expected_command = session
         .user_shell()
         .derive_exec_args(&command, /*use_login_shell*/ true);
+    #[allow(deprecated)]
     let expected_cwd = turn_context.resolve_path(workdir.clone());
     let expected_env = create_env(
         &turn_context.shell_environment_policy,
@@ -203,44 +203,6 @@ fn shell_command_handler_rejects_login_when_disallowed() {
     );
 }
 
-#[tokio::test]
-async fn local_shell_pre_tool_use_payload_uses_joined_command() {
-    let payload = ToolPayload::LocalShell {
-        params: codex_protocol::models::ShellToolCallParams {
-            command: vec![
-                "bash".to_string(),
-                "-lc".to_string(),
-                "printf hi".to_string(),
-            ],
-            workdir: None,
-            timeout_ms: None,
-            sandbox_permissions: None,
-            additional_permissions: None,
-            prefix_rule: None,
-            justification: None,
-        },
-    };
-    let (session, turn) = make_session_and_context().await;
-    let handler = LocalShellHandler::default();
-
-    assert_eq!(
-        handler.pre_tool_use_payload(&ToolInvocation {
-            session: session.into(),
-            turn: turn.into(),
-            cancellation_token: tokio_util::sync::CancellationToken::new(),
-            tracker: Arc::new(Mutex::new(TurnDiffTracker::new())),
-            call_id: "call-41".to_string(),
-            tool_name: codex_tools::ToolName::plain("local_shell"),
-            source: crate::tools::context::ToolCallSource::Direct,
-            payload,
-        }),
-        Some(crate::tools::registry::PreToolUsePayload {
-            tool_name: HookToolName::bash(),
-            tool_input: json!({ "command": "bash -lc 'printf hi'" }),
-        })
-    );
-}
-
 #[tokio::test]
 async fn shell_command_pre_tool_use_payload_uses_raw_command() {
     let payload = ToolPayload::Function {
diff --git a/codex-rs/core/src/tools/handlers/test_sync.rs b/codex-rs/core/src/tools/handlers/test_sync.rs
index 091f0ffce7..d3c95dea7e 100644
--- a/codex-rs/core/src/tools/handlers/test_sync.rs
+++ b/codex-rs/core/src/tools/handlers/test_sync.rs
@@ -12,10 +12,11 @@ use crate::function_tool::FunctionCallError;
 use crate::tools::context::FunctionToolOutput;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolPayload;
+use crate::tools::context::boxed_tool_output;
 use crate::tools::handlers::parse_arguments;
 use crate::tools::handlers::test_sync_spec::create_test_sync_tool;
+use crate::tools::registry::CoreToolRuntime;
 use crate::tools::registry::ToolExecutor;
-use crate::tools::registry::ToolHandler;
 use codex_tools::ToolName;
 use codex_tools::ToolSpec;
 
@@ -56,9 +57,8 @@ fn barrier_map() -> &'static tokio::sync::Mutex<HashMap<String, BarrierState>> {
     BARRIERS.get_or_init(|| tokio::sync::Mutex::new(HashMap::new()))
 }
 
+#[async_trait::async_trait]
 impl ToolExecutor<ToolInvocation> for TestSyncHandler {
-    type Output = FunctionToolOutput;
-
     fn tool_name(&self) -> ToolName {
         ToolName::plain("test_sync_tool")
     }
@@ -71,7 +71,10 @@ impl ToolExecutor<ToolInvocation> for TestSyncHandler {
         true
     }
 
-    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+    async fn handle(
+        &self,
+        invocation: ToolInvocation,
+    ) -> Result<Box<dyn crate::tools::context::ToolOutput>, FunctionCallError> {
         let ToolInvocation { payload, .. } = invocation;
 
         let arguments = match payload {
@@ -101,11 +104,14 @@ impl ToolExecutor<ToolInvocation> for TestSyncHandler {
             sleep(Duration::from_millis(delay)).await;
         }
 
-        Ok(FunctionToolOutput::from_text("ok".to_string(), Some(true)))
+        Ok(boxed_tool_output(FunctionToolOutput::from_text(
+            "ok".to_string(),
+            Some(true),
+        )))
     }
 }
 
-impl ToolHandler for TestSyncHandler {}
+impl CoreToolRuntime for TestSyncHandler {}
 
 async fn wait_on_barrier(args: BarrierArgs) -> Result<(), FunctionCallError> {
     if args.participants == 0 {
diff --git a/codex-rs/core/src/tools/handlers/tool_search.rs b/codex-rs/core/src/tools/handlers/tool_search.rs
index aaa3138588..ffb25cb880 100644
--- a/codex-rs/core/src/tools/handlers/tool_search.rs
+++ b/codex-rs/core/src/tools/handlers/tool_search.rs
@@ -2,9 +2,10 @@ use crate::function_tool::FunctionCallError;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolPayload;
 use crate::tools::context::ToolSearchOutput;
+use crate::tools::context::boxed_tool_output;
 use crate::tools::handlers::tool_search_spec::create_tool_search_tool;
+use crate::tools::registry::CoreToolRuntime;
 use crate::tools::registry::ToolExecutor;
-use crate::tools::registry::ToolHandler;
 use crate::tools::tool_search_entry::ToolSearchEntry;
 use crate::tools::tool_search_entry::ToolSearchInfo;
 use bm25::Document;
@@ -52,9 +53,8 @@ impl ToolSearchHandler {
     }
 }
 
+#[async_trait::async_trait]
 impl ToolExecutor<ToolInvocation> for ToolSearchHandler {
-    type Output = ToolSearchOutput;
-
     fn tool_name(&self) -> ToolName {
         ToolName::plain(TOOL_SEARCH_TOOL_NAME)
     }
@@ -73,7 +73,7 @@ impl ToolExecutor<ToolInvocation> for ToolSearchHandler {
     async fn handle(
         &self,
         invocation: ToolInvocation,
-    ) -> Result<ToolSearchOutput, FunctionCallError> {
+    ) -> Result<Box<dyn crate::tools::context::ToolOutput>, FunctionCallError> {
         let ToolInvocation { payload, .. } = invocation;
 
         let args = match payload {
@@ -100,16 +100,16 @@ impl ToolExecutor<ToolInvocation> for ToolSearchHandler {
         }
 
         if self.entries.is_empty() {
-            return Ok(ToolSearchOutput { tools: Vec::new() });
+            return Ok(boxed_tool_output(ToolSearchOutput { tools: Vec::new() }));
         }
 
         let tools = self.search(query, limit)?;
 
-        Ok(ToolSearchOutput { tools })
+        Ok(boxed_tool_output(ToolSearchOutput { tools }))
     }
 }
 
-impl ToolHandler for ToolSearchHandler {}
+impl CoreToolRuntime for ToolSearchHandler {}
 
 impl ToolSearchHandler {
     fn search(
diff --git a/codex-rs/core/src/tools/handlers/unified_exec.rs b/codex-rs/core/src/tools/handlers/unified_exec.rs
index c97f5bb6f2..b4e7bd6acf 100644
--- a/codex-rs/core/src/tools/handlers/unified_exec.rs
+++ b/codex-rs/core/src/tools/handlers/unified_exec.rs
@@ -1,7 +1,7 @@
 use crate::sandboxing::SandboxPermissions;
 use crate::shell::Shell;
+use crate::shell::ShellType;
 use crate::shell::get_shell_by_model_provided_path;
-use crate::tools::context::ExecCommandToolOutput;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolOutput;
 use crate::tools::context::ToolPayload;
@@ -79,25 +79,27 @@ fn effective_max_output_tokens(
     resolve_max_tokens(max_output_tokens).min(truncation_policy.token_budget())
 }
 
+#[derive(Debug)]
+pub(crate) struct ResolvedCommand {
+    pub(crate) command: Vec<String>,
+    pub(crate) shell_type: ShellType,
+}
+
 fn post_unified_exec_tool_use_payload(
     invocation: &ToolInvocation,
-    result: &ExecCommandToolOutput,
+    result: &dyn ToolOutput,
 ) -> Option<PostToolUsePayload> {
     let ToolPayload::Function { .. } = &invocation.payload else {
         return None;
     };
 
-    let command = result.hook_command.clone()?;
-    let tool_use_id = if result.event_call_id.is_empty() {
-        invocation.call_id.clone()
-    } else {
-        result.event_call_id.clone()
-    };
+    let tool_input = result.post_tool_use_input(&invocation.payload)?;
+    let tool_use_id = result.post_tool_use_id(&invocation.call_id);
     let tool_response = result.post_tool_use_response(&tool_use_id, &invocation.payload)?;
     Some(PostToolUsePayload {
         tool_name: HookToolName::bash(),
         tool_use_id,
-        tool_input: serde_json::json!({ "command": command }),
+        tool_input,
         tool_response,
     })
 }
@@ -107,7 +109,7 @@ pub(crate) fn get_command(
     session_shell: Arc<Shell>,
     shell_mode: &UnifiedExecShellMode,
     allow_login_shell: bool,
-) -> Result<Vec<String>, String> {
+) -> Result<ResolvedCommand, String> {
     let use_login_shell = match args.login {
         Some(true) if !allow_login_shell => {
             return Err(
@@ -126,13 +128,19 @@ pub(crate) fn get_command(
                 shell
             });
             let shell = model_shell.as_ref().unwrap_or(session_shell.as_ref());
-            Ok(shell.derive_exec_args(&args.cmd, use_login_shell))
+            Ok(ResolvedCommand {
+                command: shell.derive_exec_args(&args.cmd, use_login_shell),
+                shell_type: shell.shell_type.clone(),
+            })
         }
-        UnifiedExecShellMode::ZshFork(zsh_fork_config) => Ok(vec![
-            zsh_fork_config.shell_zsh_path.to_string_lossy().to_string(),
-            if use_login_shell { "-lc" } else { "-c" }.to_string(),
-            args.cmd.clone(),
-        ]),
+        UnifiedExecShellMode::ZshFork(zsh_fork_config) => Ok(ResolvedCommand {
+            command: vec![
+                zsh_fork_config.shell_zsh_path.to_string_lossy().to_string(),
+                if use_login_shell { "-lc" } else { "-c" }.to_string(),
+                args.cmd.clone(),
+            ],
+            shell_type: ShellType::Zsh,
+        }),
     }
 }
 
diff --git a/codex-rs/core/src/tools/handlers/unified_exec/exec_command.rs b/codex-rs/core/src/tools/handlers/unified_exec/exec_command.rs
index cef066ad57..af1c752528 100644
--- a/codex-rs/core/src/tools/handlers/unified_exec/exec_command.rs
+++ b/codex-rs/core/src/tools/handlers/unified_exec/exec_command.rs
@@ -5,6 +5,7 @@ use crate::maybe_emit_implicit_skill_invocation;
 use crate::tools::context::ExecCommandToolOutput;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolPayload;
+use crate::tools::context::boxed_tool_output;
 use crate::tools::handlers::apply_granted_turn_permissions;
 use crate::tools::handlers::apply_patch::intercept_apply_patch;
 use crate::tools::handlers::implicit_granted_permissions;
@@ -15,10 +16,10 @@ use crate::tools::handlers::resolve_tool_environment;
 use crate::tools::handlers::rewrite_function_string_argument;
 use crate::tools::handlers::updated_hook_command;
 use crate::tools::hook_names::HookToolName;
+use crate::tools::registry::CoreToolRuntime;
 use crate::tools::registry::PostToolUsePayload;
 use crate::tools::registry::PreToolUsePayload;
 use crate::tools::registry::ToolExecutor;
-use crate::tools::registry::ToolHandler;
 use crate::unified_exec::ExecCommandRequest;
 use crate::unified_exec::UnifiedExecContext;
 use crate::unified_exec::UnifiedExecError;
@@ -68,9 +69,8 @@ impl ExecCommandHandler {
     }
 }
 
+#[async_trait::async_trait]
 impl ToolExecutor<ToolInvocation> for ExecCommandHandler {
-    type Output = ExecCommandToolOutput;
-
     fn tool_name(&self) -> ToolName {
         ToolName::plain("exec_command")
     }
@@ -89,7 +89,10 @@ impl ToolExecutor<ToolInvocation> for ExecCommandHandler {
         true
     }
 
-    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+    async fn handle(
+        &self,
+        invocation: ToolInvocation,
+    ) -> Result<Box<dyn crate::tools::context::ToolOutput>, FunctionCallError> {
         let ToolInvocation {
             session,
             turn,
@@ -138,13 +141,15 @@ impl ToolExecutor<ToolInvocation> for ExecCommandHandler {
         )
         .await;
         let process_id = manager.allocate_process_id().await;
-        let command = get_command(
+        let resolved_command = get_command(
             &args,
             session.user_shell(),
-            &turn.tools_config.unified_exec_shell_mode,
-            turn.tools_config.allow_login_shell,
+            &turn.unified_exec_shell_mode,
+            turn.config.permissions.allow_login_shell,
         )
         .map_err(FunctionCallError::RespondToModel)?;
+        let command = resolved_command.command;
+        let shell_type = resolved_command.shell_type;
         let command_for_display = codex_shell_command::parse_command::shlex_join(&command);
 
         let ExecCommandArgs {
@@ -231,7 +236,7 @@ impl ToolExecutor<ToolInvocation> for ExecCommandHandler {
         .await?
         {
             manager.release_process_id(process_id).await;
-            return Ok(ExecCommandToolOutput {
+            return Ok(boxed_tool_output(ExecCommandToolOutput {
                 event_call_id: String::new(),
                 chunk_id: String::new(),
                 wall_time: std::time::Duration::ZERO,
@@ -241,7 +246,7 @@ impl ToolExecutor<ToolInvocation> for ExecCommandHandler {
                 exit_code: None,
                 original_token_count: None,
                 hook_command: None,
-            });
+            }));
         }
 
         emit_unified_exec_tty_metric(&turn.session_telemetry, tty);
@@ -249,6 +254,7 @@ impl ToolExecutor<ToolInvocation> for ExecCommandHandler {
             .exec_command(
                 ExecCommandRequest {
                     command,
+                    shell_type,
                     hook_command: hook_command.clone(),
                     process_id,
                     yield_time_ms,
@@ -269,11 +275,11 @@ impl ToolExecutor<ToolInvocation> for ExecCommandHandler {
             )
             .await
         {
-            Ok(response) => Ok(response),
+            Ok(response) => Ok(boxed_tool_output(response)),
             Err(UnifiedExecError::SandboxDenied { output, .. }) => {
                 let output_text = output.aggregated_output.text;
                 let original_token_count = approx_token_count(&output_text);
-                Ok(ExecCommandToolOutput {
+                Ok(boxed_tool_output(ExecCommandToolOutput {
                     event_call_id: context.call_id.clone(),
                     chunk_id: generate_chunk_id(),
                     wall_time: output.duration,
@@ -285,7 +291,7 @@ impl ToolExecutor<ToolInvocation> for ExecCommandHandler {
                     exit_code: Some(output.exit_code),
                     original_token_count: Some(original_token_count),
                     hook_command: Some(hook_command),
-                })
+                }))
             }
             Err(err) => Err(FunctionCallError::RespondToModel(format!(
                 "exec_command failed for `{command_for_display}`: {err:?}"
@@ -294,7 +300,7 @@ impl ToolExecutor<ToolInvocation> for ExecCommandHandler {
     }
 }
 
-impl ToolHandler for ExecCommandHandler {
+impl CoreToolRuntime for ExecCommandHandler {
     fn matches_kind(&self, payload: &ToolPayload) -> bool {
         matches!(payload, ToolPayload::Function { .. })
     }
@@ -336,7 +342,7 @@ impl ToolHandler for ExecCommandHandler {
     fn post_tool_use_payload(
         &self,
         invocation: &ToolInvocation,
-        result: &Self::Output,
+        result: &dyn crate::tools::context::ToolOutput,
     ) -> Option<PostToolUsePayload> {
         post_unified_exec_tool_use_payload(invocation, result)
     }
diff --git a/codex-rs/core/src/tools/handlers/unified_exec/write_stdin.rs b/codex-rs/core/src/tools/handlers/unified_exec/write_stdin.rs
index cc79615c14..3dea7092f5 100644
--- a/codex-rs/core/src/tools/handlers/unified_exec/write_stdin.rs
+++ b/codex-rs/core/src/tools/handlers/unified_exec/write_stdin.rs
@@ -1,11 +1,11 @@
 use crate::function_tool::FunctionCallError;
-use crate::tools::context::ExecCommandToolOutput;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolPayload;
+use crate::tools::context::boxed_tool_output;
 use crate::tools::handlers::parse_arguments;
+use crate::tools::registry::CoreToolRuntime;
 use crate::tools::registry::PostToolUsePayload;
 use crate::tools::registry::ToolExecutor;
-use crate::tools::registry::ToolHandler;
 use crate::unified_exec::WriteStdinRequest;
 use codex_protocol::protocol::EventMsg;
 use codex_protocol::protocol::TerminalInteractionEvent;
@@ -31,9 +31,8 @@ struct WriteStdinArgs {
 
 pub struct WriteStdinHandler;
 
+#[async_trait::async_trait]
 impl ToolExecutor<ToolInvocation> for WriteStdinHandler {
-    type Output = ExecCommandToolOutput;
-
     fn tool_name(&self) -> ToolName {
         ToolName::plain("write_stdin")
     }
@@ -42,7 +41,10 @@ impl ToolExecutor<ToolInvocation> for WriteStdinHandler {
         Some(create_write_stdin_tool())
     }
 
-    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+    async fn handle(
+        &self,
+        invocation: ToolInvocation,
+    ) -> Result<Box<dyn crate::tools::context::ToolOutput>, FunctionCallError> {
         let ToolInvocation {
             session,
             turn,
@@ -85,11 +87,11 @@ impl ToolExecutor<ToolInvocation> for WriteStdinHandler {
             .send_event(turn.as_ref(), EventMsg::TerminalInteraction(interaction))
             .await;
 
-        Ok(response)
+        Ok(boxed_tool_output(response))
     }
 }
 
-impl ToolHandler for WriteStdinHandler {
+impl CoreToolRuntime for WriteStdinHandler {
     fn matches_kind(&self, payload: &ToolPayload) -> bool {
         matches!(payload, ToolPayload::Function { .. })
     }
@@ -97,7 +99,7 @@ impl ToolHandler for WriteStdinHandler {
     fn post_tool_use_payload(
         &self,
         invocation: &ToolInvocation,
-        result: &Self::Output,
+        result: &dyn crate::tools::context::ToolOutput,
     ) -> Option<PostToolUsePayload> {
         post_unified_exec_tool_use_payload(invocation, result)
     }
diff --git a/codex-rs/core/src/tools/handlers/unified_exec_tests.rs b/codex-rs/core/src/tools/handlers/unified_exec_tests.rs
index 02123c4b64..50a8e44214 100644
--- a/codex-rs/core/src/tools/handlers/unified_exec_tests.rs
+++ b/codex-rs/core/src/tools/handlers/unified_exec_tests.rs
@@ -1,4 +1,5 @@
 use super::*;
+use crate::shell::ShellType;
 use crate::shell::default_user_shell;
 use codex_tools::UnifiedExecShellMode;
 use codex_tools::ZshForkConfig;
@@ -12,7 +13,7 @@ use crate::tools::context::ToolCallSource;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolPayload;
 use crate::tools::hook_names::HookToolName;
-use crate::tools::registry::ToolHandler;
+use crate::tools::registry::CoreToolRuntime;
 use crate::turn_diff_tracker::TurnDiffTracker;
 use tokio::sync::Mutex;
 
@@ -42,13 +43,14 @@ fn test_get_command_uses_default_shell_when_unspecified() -> anyhow::Result<()>
 
     assert!(args.shell.is_none());
 
-    let command = get_command(
+    let resolved = get_command(
         &args,
         Arc::new(default_user_shell()),
         &UnifiedExecShellMode::Direct,
         /*allow_login_shell*/ true,
     )
     .map_err(anyhow::Error::msg)?;
+    let command = resolved.command;
 
     assert_eq!(command.len(), 3);
     assert_eq!(command[2], "echo hello");
@@ -63,13 +65,14 @@ fn test_get_command_respects_explicit_bash_shell() -> anyhow::Result<()> {
 
     assert_eq!(args.shell.as_deref(), Some("/bin/bash"));
 
-    let command = get_command(
+    let resolved = get_command(
         &args,
         Arc::new(default_user_shell()),
         &UnifiedExecShellMode::Direct,
         /*allow_login_shell*/ true,
     )
     .map_err(anyhow::Error::msg)?;
+    let command = resolved.command;
 
     assert_eq!(command.last(), Some(&"echo hello".to_string()));
     if command
@@ -83,21 +86,37 @@ fn test_get_command_respects_explicit_bash_shell() -> anyhow::Result<()> {
 
 #[test]
 fn test_get_command_respects_explicit_powershell_shell() -> anyhow::Result<()> {
-    let json = r#"{"cmd": "echo hello", "shell": "powershell"}"#;
+    let temp_dir = tempfile::tempdir()?;
+    let powershell_path = temp_dir.path().join(if cfg!(windows) {
+        "powershell.exe"
+    } else {
+        "powershell"
+    });
+    std::fs::write(&powershell_path, "")?;
+    let json = serde_json::json!({
+        "cmd": "echo hello",
+        "shell": powershell_path,
+    })
+    .to_string();
 
-    let args: ExecCommandArgs = parse_arguments(json)?;
+    let args: ExecCommandArgs = parse_arguments(&json)?;
 
-    assert_eq!(args.shell.as_deref(), Some("powershell"));
+    assert_eq!(
+        args.shell.as_deref(),
+        Some(powershell_path.to_string_lossy().as_ref())
+    );
 
-    let command = get_command(
+    let resolved = get_command(
         &args,
         Arc::new(default_user_shell()),
         &UnifiedExecShellMode::Direct,
         /*allow_login_shell*/ true,
     )
     .map_err(anyhow::Error::msg)?;
+    let command = resolved.command;
 
     assert_eq!(command[2], "echo hello");
+    assert_eq!(resolved.shell_type, ShellType::PowerShell);
     Ok(())
 }
 
@@ -109,13 +128,14 @@ fn test_get_command_respects_explicit_cmd_shell() -> anyhow::Result<()> {
 
     assert_eq!(args.shell.as_deref(), Some("cmd"));
 
-    let command = get_command(
+    let resolved = get_command(
         &args,
         Arc::new(default_user_shell()),
         &UnifiedExecShellMode::Direct,
         /*allow_login_shell*/ true,
     )
     .map_err(anyhow::Error::msg)?;
+    let command = resolved.command;
 
     assert_eq!(command[2], "echo hello");
     Ok(())
@@ -159,7 +179,7 @@ fn test_get_command_ignores_explicit_shell_in_zsh_fork_mode() -> anyhow::Result<
         })?,
     });
 
-    let command = get_command(
+    let resolved = get_command(
         &args,
         Arc::new(default_user_shell()),
         &shell_mode,
@@ -168,13 +188,14 @@ fn test_get_command_ignores_explicit_shell_in_zsh_fork_mode() -> anyhow::Result<
     .map_err(anyhow::Error::msg)?;
 
     assert_eq!(
-        command,
+        resolved.command,
         vec![
             shell_zsh_path.to_string_lossy().to_string(),
             "-lc".to_string(),
             "echo hello".to_string()
         ]
     );
+    assert_eq!(resolved.shell_type, ShellType::Zsh);
     Ok(())
 }
 
diff --git a/codex-rs/core/src/tools/handlers/view_image.rs b/codex-rs/core/src/tools/handlers/view_image.rs
index 3efbedc0ee..c3e6792c06 100644
--- a/codex-rs/core/src/tools/handlers/view_image.rs
+++ b/codex-rs/core/src/tools/handlers/view_image.rs
@@ -16,12 +16,13 @@ use crate::original_image_detail::can_request_original_image_detail;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolOutput;
 use crate::tools::context::ToolPayload;
+use crate::tools::context::boxed_tool_output;
 use crate::tools::handlers::parse_arguments;
 use crate::tools::handlers::resolve_tool_environment;
 use crate::tools::handlers::view_image_spec::ViewImageToolOptions;
 use crate::tools::handlers::view_image_spec::create_view_image_tool;
+use crate::tools::registry::CoreToolRuntime;
 use crate::tools::registry::ToolExecutor;
-use crate::tools::registry::ToolHandler;
 use codex_tools::ToolName;
 use codex_tools::ToolSpec;
 
@@ -59,12 +60,12 @@ struct ViewImageArgs {
 
 #[derive(Clone, Copy, Eq, PartialEq)]
 enum ViewImageDetail {
+    High,
     Original,
 }
 
+#[async_trait::async_trait]
 impl ToolExecutor<ToolInvocation> for ViewImageHandler {
-    type Output = ViewImageOutput;
-
     fn tool_name(&self) -> ToolName {
         ToolName::plain("view_image")
     }
@@ -77,7 +78,10 @@ impl ToolExecutor<ToolInvocation> for ViewImageHandler {
         true
     }
 
-    async fn handle(&self, invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
+    async fn handle(
+        &self,
+        invocation: ToolInvocation,
+    ) -> Result<Box<dyn crate::tools::context::ToolOutput>, FunctionCallError> {
         if !invocation
             .turn
             .model_info
@@ -111,16 +115,15 @@ impl ToolExecutor<ToolInvocation> for ViewImageHandler {
             environment_id,
             detail,
         } = parse_arguments(&arguments)?;
-        // `view_image` accepts only its documented detail values: omit
-        // `detail` for the default path or set it to `original`.
-        // Other string values remain invalid rather than being silently
-        // reinterpreted.
+        // `high` is the explicit spelling of the default resized path.
+        // Other string values remain invalid rather than being silently reinterpreted.
         let detail = match detail.as_deref() {
             None => None,
+            Some("high") => Some(ViewImageDetail::High),
             Some("original") => Some(ViewImageDetail::Original),
             Some(detail) => {
                 return Err(FunctionCallError::RespondToModel(format!(
-                    "view_image.detail only supports `original`; omit `detail` for default resized behavior, got `{detail}`"
+                    "view_image.detail only supports `high` or `original`; omit `detail` for default high resized behavior, got `{detail}`"
                 )));
             }
         };
@@ -134,8 +137,7 @@ impl ToolExecutor<ToolInvocation> for ViewImageHandler {
         };
         let cwd = turn_environment.cwd.clone();
         let abs_path = cwd.join(path);
-        let mut sandbox = turn.file_system_sandbox_context(/*additional_permissions*/ None);
-        sandbox.cwd = Some(cwd.clone());
+        let sandbox = turn.file_system_sandbox_context(/*additional_permissions*/ None, &cwd);
         let fs = turn_environment.environment.get_filesystem();
 
         let metadata = fs
@@ -173,11 +175,11 @@ impl ToolExecutor<ToolInvocation> for ViewImageHandler {
         } else {
             PromptImageMode::ResizeToFit
         };
-        let image_detail = Some(if use_original_detail {
+        let image_detail = if use_original_detail {
             ImageDetail::Original
         } else {
             DEFAULT_IMAGE_DETAIL
-        });
+        };
 
         let image =
             load_for_prompt_bytes(abs_path.as_path(), file_bytes, image_mode).map_err(|error| {
@@ -195,18 +197,18 @@ impl ToolExecutor<ToolInvocation> for ViewImageHandler {
         session.emit_turn_item_started(turn.as_ref(), &item).await;
         session.emit_turn_item_completed(turn.as_ref(), item).await;
 
-        Ok(ViewImageOutput {
+        Ok(boxed_tool_output(ViewImageOutput {
             image_url,
             image_detail,
-        })
+        }))
     }
 }
 
-impl ToolHandler for ViewImageHandler {}
+impl CoreToolRuntime for ViewImageHandler {}
 
 pub struct ViewImageOutput {
     image_url: String,
-    image_detail: Option<ImageDetail>,
+    image_detail: ImageDetail,
 }
 
 impl ToolOutput for ViewImageOutput {
@@ -222,7 +224,7 @@ impl ToolOutput for ViewImageOutput {
         let body =
             FunctionCallOutputBody::ContentItems(vec![FunctionCallOutputContentItem::InputImage {
                 image_url: self.image_url.clone(),
-                detail: self.image_detail,
+                detail: Some(self.image_detail),
             }]);
         let output = FunctionCallOutputPayload {
             body,
@@ -261,7 +263,7 @@ mod tests {
     fn code_mode_result_returns_image_url_object() {
         let output = ViewImageOutput {
             image_url: "data:image/png;base64,AAA".to_string(),
-            image_detail: Some(DEFAULT_IMAGE_DETAIL),
+            image_detail: DEFAULT_IMAGE_DETAIL,
         };
 
         let result = output.code_mode_result(&ToolPayload::Function {
@@ -282,7 +284,7 @@ mod tests {
         let (session, mut turn) = make_session_and_context().await;
         let image_dir = tempfile::tempdir().expect("create image temp dir");
         let image_cwd = image_dir.abs();
-        turn.cwd = image_cwd.clone();
+
         turn.environments
             .turn_environments
             .first_mut()
@@ -315,4 +317,68 @@ mod tests {
             "{message}"
         );
     }
+
+    #[tokio::test]
+    async fn handle_rejects_unsupported_detail() {
+        let (session, turn) = make_session_and_context().await;
+
+        let result = ViewImageHandler::default()
+            .handle(ToolInvocation {
+                session: Arc::new(session),
+                turn: Arc::new(turn),
+                cancellation_token: tokio_util::sync::CancellationToken::new(),
+                tracker: Arc::new(Mutex::new(TurnDiffTracker::new())),
+                call_id: "call-view-image".to_string(),
+                tool_name: codex_tools::ToolName::plain("view_image"),
+                source: ToolCallSource::Direct,
+                payload: ToolPayload::Function {
+                    arguments: json!({ "path": "image.png", "detail": "low" }).to_string(),
+                },
+            })
+            .await;
+
+        let Err(FunctionCallError::RespondToModel(message)) = result else {
+            panic!("expected unsupported detail error");
+        };
+        assert_eq!(
+            message,
+            "view_image.detail only supports `high` or `original`; omit `detail` for default high resized behavior, got `low`"
+        );
+    }
+
+    #[tokio::test(flavor = "multi_thread")]
+    async fn handle_accepts_explicit_high_detail() {
+        let (session, mut turn) = make_session_and_context().await;
+        let image_dir = tempfile::tempdir().expect("create image temp dir");
+        let image_cwd = image_dir.abs();
+
+        turn.environments
+            .turn_environments
+            .first_mut()
+            .expect("default local turn environment")
+            .cwd = image_cwd.clone();
+        let image_path = image_cwd.join("image.png");
+        std::fs::write(image_path.as_path(), b"not a real image").expect("write test image");
+        turn.permission_profile = PermissionProfile::Disabled;
+
+        let result = ViewImageHandler::default()
+            .handle(ToolInvocation {
+                session: Arc::new(session),
+                turn: Arc::new(turn),
+                cancellation_token: tokio_util::sync::CancellationToken::new(),
+                tracker: Arc::new(Mutex::new(TurnDiffTracker::new())),
+                call_id: "call-view-image".to_string(),
+                tool_name: codex_tools::ToolName::plain("view_image"),
+                source: ToolCallSource::Direct,
+                payload: ToolPayload::Function {
+                    arguments: json!({ "path": "image.png", "detail": "high" }).to_string(),
+                },
+            })
+            .await;
+
+        let Err(FunctionCallError::RespondToModel(message)) = result else {
+            panic!("expected image processing error");
+        };
+        assert!(message.contains("unable to process image"), "{message}");
+    }
 }
diff --git a/codex-rs/core/src/tools/handlers/view_image_spec.rs b/codex-rs/core/src/tools/handlers/view_image_spec.rs
index 7d1422a037..662cd639a6 100644
--- a/codex-rs/core/src/tools/handlers/view_image_spec.rs
+++ b/codex-rs/core/src/tools/handlers/view_image_spec.rs
@@ -20,9 +20,12 @@ pub fn create_view_image_tool(options: ViewImageToolOptions) -> ToolSpec {
     if options.can_request_original_image_detail {
         properties.insert(
             "detail".to_string(),
-            JsonSchema::string(Some(
-                "Optional detail override. The only supported value is `original`; omit this field for default resized behavior. Use `original` to preserve the file's original resolution instead of resizing to fit. This is important when high-fidelity image perception or precise localization is needed, especially for CUA agents.".to_string(),
-            )),
+            JsonSchema::string_enum(
+                vec![json!("high"), json!("original")],
+                Some(
+                    "Optional detail override. Supported values are `high` and `original`; omit this field for default high resized behavior. Use `original` to preserve the file's original resolution instead of resizing to fit. This is important when high-fidelity image perception or precise localization is needed, especially for CUA agents.".to_string(),
+                ),
+            ),
         );
     }
     if options.include_environment_id {
@@ -55,8 +58,9 @@ fn view_image_output_schema() -> Value {
                 "description": "Data URL for the loaded image."
             },
             "detail": {
-                "type": ["string", "null"],
-                "description": "Image detail hint returned by view_image. Returns `original` when original resolution is preserved, otherwise `null`."
+                "type": "string",
+                "enum": ["high", "original"],
+                "description": "Image detail hint returned by view_image. Returns `high` for default resized behavior or `original` when original resolution is preserved."
             }
         },
         "required": ["image_url", "detail"],
diff --git a/codex-rs/core/src/tools/lifecycle.rs b/codex-rs/core/src/tools/lifecycle.rs
new file mode 100644
index 0000000000..ad8b492cce
--- /dev/null
+++ b/codex-rs/core/src/tools/lifecycle.rs
@@ -0,0 +1,98 @@
+use codex_extension_api::ToolCallOutcome;
+use codex_extension_api::ToolCallSource as ExtensionToolCallSource;
+use codex_extension_api::ToolFinishInput;
+use codex_extension_api::ToolStartInput;
+use codex_tools::ToolName;
+
+use crate::session::session::Session;
+use crate::session::turn_context::TurnContext;
+use crate::tools::context::ToolCallSource;
+use crate::tools::context::ToolInvocation;
+
+pub(crate) async fn notify_tool_start(invocation: &ToolInvocation) {
+    for contributor in invocation
+        .session
+        .services
+        .extensions
+        .tool_lifecycle_contributors()
+    {
+        contributor
+            .on_tool_start(ToolStartInput {
+                session_store: &invocation.session.services.session_extension_data,
+                thread_store: &invocation.session.services.thread_extension_data,
+                turn_store: invocation.turn.extension_data.as_ref(),
+                turn_id: invocation.turn.sub_id.as_str(),
+                call_id: invocation.call_id.as_str(),
+                tool_name: &invocation.tool_name,
+                source: extension_tool_call_source(invocation.source.clone()),
+            })
+            .await;
+    }
+}
+
+pub(crate) async fn notify_tool_finish(invocation: &ToolInvocation, outcome: ToolCallOutcome) {
+    notify_tool_finish_parts(
+        invocation.session.as_ref(),
+        invocation.turn.as_ref(),
+        invocation.call_id.as_str(),
+        &invocation.tool_name,
+        invocation.source.clone(),
+        outcome,
+    )
+    .await;
+}
+
+pub(crate) async fn notify_tool_aborted(
+    session: &Session,
+    turn: &TurnContext,
+    call_id: &str,
+    tool_name: &ToolName,
+    source: ToolCallSource,
+) {
+    notify_tool_finish_parts(
+        session,
+        turn,
+        call_id,
+        tool_name,
+        source,
+        ToolCallOutcome::Aborted,
+    )
+    .await;
+}
+
+async fn notify_tool_finish_parts(
+    session: &Session,
+    turn: &TurnContext,
+    call_id: &str,
+    tool_name: &ToolName,
+    source: ToolCallSource,
+    outcome: ToolCallOutcome,
+) {
+    for contributor in session.services.extensions.tool_lifecycle_contributors() {
+        contributor
+            .on_tool_finish(ToolFinishInput {
+                session_store: &session.services.session_extension_data,
+                thread_store: &session.services.thread_extension_data,
+                turn_store: turn.extension_data.as_ref(),
+                turn_id: turn.sub_id.as_str(),
+                call_id,
+                tool_name,
+                source: extension_tool_call_source(source.clone()),
+                outcome,
+            })
+            .await;
+    }
+}
+
+fn extension_tool_call_source(source: ToolCallSource) -> ExtensionToolCallSource {
+    match source {
+        ToolCallSource::Direct => ExtensionToolCallSource::Direct,
+        ToolCallSource::CodeMode {
+            cell_id,
+            runtime_tool_call_id,
+        } => ExtensionToolCallSource::CodeMode {
+            cell_id,
+            runtime_tool_call_id,
+        },
+    }
+}
diff --git a/codex-rs/core/src/tools/mod.rs b/codex-rs/core/src/tools/mod.rs
index 3073d9f9da..1171596f82 100644
--- a/codex-rs/core/src/tools/mod.rs
+++ b/codex-rs/core/src/tools/mod.rs
@@ -4,6 +4,7 @@ pub(crate) mod events;
 pub(crate) mod handlers;
 pub(crate) mod hook_names;
 pub(crate) mod hosted_spec;
+pub(crate) mod lifecycle;
 pub(crate) mod network_approval;
 pub(crate) mod orchestrator;
 pub(crate) mod parallel;
@@ -11,10 +12,9 @@ pub(crate) mod registry;
 pub(crate) mod router;
 pub(crate) mod runtimes;
 pub(crate) mod sandboxing;
-pub(crate) mod spec;
 pub(crate) mod spec_plan;
-pub(crate) mod spec_plan_types;
 pub(crate) mod tool_dispatch_trace;
+pub(crate) mod tool_family;
 pub(crate) mod tool_search_entry;
 
 use std::borrow::Cow;
@@ -25,7 +25,6 @@ use codex_utils_output_truncation::TruncationPolicy;
 use codex_utils_output_truncation::formatted_truncate_text;
 use codex_utils_output_truncation::truncate_text;
 pub use router::ToolRouter;
-use serde::Serialize;
 
 // Telemetry preview limits: keep log events smaller than model budgets.
 pub(crate) const TELEMETRY_PREVIEW_MAX_BYTES: usize = 2 * 1024; // 2 KiB
@@ -48,48 +47,21 @@ pub(crate) fn flat_tool_name(tool_name: &ToolName) -> Cow<'_, str> {
     }
 }
 
-/// Format the combined exec output for sending back to the model.
-/// Includes exit code and duration metadata; truncates large bodies safely.
-pub fn format_exec_output_for_model_structured(
-    exec_output: &ExecToolCallOutput,
-    truncation_policy: TruncationPolicy,
-) -> String {
-    let ExecToolCallOutput {
-        exit_code,
-        duration,
-        ..
-    } = exec_output;
-
-    #[derive(Serialize)]
-    struct ExecMetadata {
-        exit_code: i32,
-        duration_seconds: f32,
+pub(crate) fn tool_user_shell_type(
+    user_shell: &crate::shell::Shell,
+) -> codex_tools::ToolUserShellType {
+    match user_shell.shell_type {
+        crate::shell::ShellType::Zsh => codex_tools::ToolUserShellType::Zsh,
+        crate::shell::ShellType::Bash => codex_tools::ToolUserShellType::Bash,
+        crate::shell::ShellType::PowerShell => codex_tools::ToolUserShellType::PowerShell,
+        crate::shell::ShellType::Sh => codex_tools::ToolUserShellType::Sh,
+        crate::shell::ShellType::Cmd => codex_tools::ToolUserShellType::Cmd,
     }
-
-    #[derive(Serialize)]
-    struct ExecOutput<'a> {
-        output: &'a str,
-        metadata: ExecMetadata,
-    }
-
-    // round to 1 decimal place
-    let duration_seconds = ((duration.as_secs_f32()) * 10.0).round() / 10.0;
-
-    let formatted_output = format_exec_output_str(exec_output, truncation_policy);
-
-    let payload = ExecOutput {
-        output: &formatted_output,
-        metadata: ExecMetadata {
-            exit_code: *exit_code,
-            duration_seconds,
-        },
-    };
-
-    #[expect(clippy::expect_used)]
-    serde_json::to_string(&payload).expect("serialize ExecOutput")
 }
 
-pub fn format_exec_output_for_model_freeform(
+/// Format the combined exec output for sending back to the model.
+/// Includes exit code and duration metadata; truncates large bodies safely.
+pub fn format_exec_output_for_model(
     exec_output: &ExecToolCallOutput,
     truncation_policy: TruncationPolicy,
 ) -> String {
diff --git a/codex-rs/core/src/tools/network_approval.rs b/codex-rs/core/src/tools/network_approval.rs
index 14af2c9c5f..39441d96f5 100644
--- a/codex-rs/core/src/tools/network_approval.rs
+++ b/codex-rs/core/src/tools/network_approval.rs
@@ -525,6 +525,7 @@ impl NetworkApprovalService {
                     guardian_approval_id,
                     /*approval_id*/ None,
                     prompt_command,
+                    #[allow(deprecated)]
                     turn_context.cwd.clone(),
                     Some(prompt_reason),
                     Some(network_approval_context.clone()),
diff --git a/codex-rs/core/src/tools/network_approval_tests.rs b/codex-rs/core/src/tools/network_approval_tests.rs
index 37a28b1255..25bcfe255d 100644
--- a/codex-rs/core/src/tools/network_approval_tests.rs
+++ b/codex-rs/core/src/tools/network_approval_tests.rs
@@ -4,7 +4,6 @@ use codex_network_proxy::BlockedRequestArgs;
 use codex_protocol::models::PermissionProfile;
 use codex_protocol::permissions::NetworkSandboxPolicy;
 use codex_protocol::protocol::AskForApproval;
-use codex_protocol::protocol::SandboxPolicy;
 use core_test_support::PathBufExt;
 use core_test_support::test_path_buf;
 use pretty_assertions::assert_eq;
@@ -189,10 +188,10 @@ fn only_never_policy_disables_network_approval_flow() {
 #[test]
 fn network_approval_flow_is_limited_to_restricted_sandbox_modes() {
     assert!(permission_profile_allows_network_approval_flow(
-        &PermissionProfile::from_legacy_sandbox_policy(&SandboxPolicy::new_read_only_policy())
+        &PermissionProfile::read_only()
     ));
     assert!(permission_profile_allows_network_approval_flow(
-        &PermissionProfile::from_legacy_sandbox_policy(&SandboxPolicy::new_workspace_write_policy())
+        &PermissionProfile::workspace_write()
     ));
     assert!(!permission_profile_allows_network_approval_flow(
         &PermissionProfile::Disabled
@@ -229,7 +228,7 @@ async fn register_call_with_default_shell_trigger(
             "turn-1".to_string(),
             GuardianNetworkAccessTrigger {
                 call_id: "call-1".to_string(),
-                tool_name: "shell".to_string(),
+                tool_name: "shell_command".to_string(),
                 command: vec!["curl".to_string(), "https://example.com".to_string()],
                 cwd: test_path_buf("/tmp").abs(),
                 sandbox_permissions: SandboxPermissions::UseDefault,
@@ -249,7 +248,7 @@ async fn active_call_preserves_triggering_command_context() {
     let service = NetworkApprovalService::default();
     let expected = GuardianNetworkAccessTrigger {
         call_id: "call-1".to_string(),
-        tool_name: "shell".to_string(),
+        tool_name: "shell_command".to_string(),
         command: vec!["curl".to_string(), "https://example.com".to_string()],
         cwd: test_path_buf("/repo").abs(),
         sandbox_permissions: SandboxPermissions::UseDefault,
diff --git a/codex-rs/core/src/tools/orchestrator.rs b/codex-rs/core/src/tools/orchestrator.rs
index 648d3f79e8..deb9ae596e 100644
--- a/codex-rs/core/src/tools/orchestrator.rs
+++ b/codex-rs/core/src/tools/orchestrator.rs
@@ -234,6 +234,7 @@ impl ToolOrchestrator {
 
         // Platform-specific flag gating is handled by SandboxManager::select_initial.
         let use_legacy_landlock = turn_ctx.features.use_legacy_landlock();
+        #[allow(deprecated)]
         let sandbox_cwd = tool.sandbox_cwd(req).unwrap_or(&turn_ctx.cwd);
         let initial_attempt = SandboxAttempt {
             sandbox: initial_sandbox,
diff --git a/codex-rs/core/src/tools/parallel.rs b/codex-rs/core/src/tools/parallel.rs
index 2c62e6c15d..15954869e2 100644
--- a/codex-rs/core/src/tools/parallel.rs
+++ b/codex-rs/core/src/tools/parallel.rs
@@ -1,7 +1,10 @@
 use std::sync::Arc;
+use std::sync::atomic::AtomicBool;
+use std::sync::atomic::Ordering;
 use std::time::Instant;
 
 use tokio::sync::RwLock;
+use tokio::task::JoinError;
 use tokio_util::either::Either;
 use tokio_util::sync::CancellationToken;
 use tokio_util::task::AbortOnDropHandle;
@@ -15,6 +18,7 @@ use crate::session::turn_context::TurnContext;
 use crate::tools::context::AbortedToolOutput;
 use crate::tools::context::SharedTurnDiffTracker;
 use crate::tools::context::ToolPayload;
+use crate::tools::lifecycle::notify_tool_aborted;
 use crate::tools::registry::AnyToolResult;
 use crate::tools::registry::ToolArgumentDiffConsumer;
 use crate::tools::router::ToolCall;
@@ -89,6 +93,12 @@ impl ToolCallRuntime {
         let lock = Arc::clone(&self.parallel_execution);
         let invocation_cancellation_token = cancellation_token.clone();
         let started = Instant::now();
+        let abort_session = Arc::clone(&session);
+        let abort_source = source.clone();
+        let abort_turn = Arc::clone(&turn);
+        let terminal_outcome_reached = Arc::new(AtomicBool::new(false));
+        let dispatch_terminal_outcome_reached = Arc::clone(&terminal_outcome_reached);
+        let dispatch_call = call.clone();
 
         let dispatch_span = trace_span!(
             "dispatch_tool_call_with_code_mode_result",
@@ -97,47 +107,69 @@ impl ToolCallRuntime {
             call_id = call.call_id.as_str(),
             aborted = false,
         );
+        let abort_dispatch_span = dispatch_span.clone();
 
-        let handle: AbortOnDropHandle<Result<AnyToolResult, FunctionCallError>> =
+        let mut handle: AbortOnDropHandle<Result<AnyToolResult, FunctionCallError>> =
             AbortOnDropHandle::new(tokio::spawn(async move {
-                tokio::select! {
-                    _ = cancellation_token.cancelled() => {
-                        let secs = started.elapsed().as_secs_f32().max(0.1);
-                        dispatch_span.record("aborted", true);
-                        Ok(Self::aborted_response(&call, secs))
-                    },
-                    res = async {
-                        let _guard = if supports_parallel {
-                            Either::Left(lock.read().await)
-                        } else {
-                            Either::Right(lock.write().await)
-                        };
+                let _guard = if supports_parallel {
+                    Either::Left(lock.read().await)
+                } else {
+                    Either::Right(lock.write().await)
+                };
 
-                        router
-                            .dispatch_tool_call_with_code_mode_result(
-                                session,
-                                turn,
-                                invocation_cancellation_token,
-                                tracker,
-                                call.clone(),
-                                source,
-                            )
-                            .instrument(dispatch_span.clone())
-                            .await
-                    } => res,
-                }
+                router
+                    .dispatch_tool_call_with_terminal_outcome(
+                        session,
+                        turn,
+                        invocation_cancellation_token,
+                        tracker,
+                        dispatch_call,
+                        source,
+                        dispatch_terminal_outcome_reached,
+                    )
+                    .instrument(dispatch_span.clone())
+                    .await
             }));
 
         async move {
-            handle.await.map_err(|err| {
-                FunctionCallError::Fatal(format!("tool task failed to receive: {err:?}"))
-            })?
+            tokio::select! {
+                res = &mut handle => res.map_err(Self::tool_task_join_error)?,
+                _ = cancellation_token.cancelled() => {
+                    if terminal_outcome_reached.load(Ordering::Acquire) || handle.is_finished() {
+                        handle.await.map_err(Self::tool_task_join_error)?
+                    } else {
+                        let secs = started.elapsed().as_secs_f32().max(0.1);
+                        abort_dispatch_span.record("aborted", true);
+                        handle.abort();
+                        match handle.await {
+                            Ok(result) => result,
+                            Err(err) if err.is_cancelled() => {
+                                let response = Self::aborted_response(&call, secs);
+                                notify_tool_aborted(
+                                    abort_session.as_ref(),
+                                    abort_turn.as_ref(),
+                                    call.call_id.as_str(),
+                                    &call.tool_name,
+                                    abort_source,
+                                )
+                                .await;
+                                Ok(response)
+                            }
+                            Err(err) => Err(Self::tool_task_join_error(err)),
+                        }
+                    }
+                },
+            }
         }
         .in_current_span()
     }
 }
 
 impl ToolCallRuntime {
+    fn tool_task_join_error(err: JoinError) -> FunctionCallError {
+        FunctionCallError::Fatal(format!("tool task failed to receive: {err:?}"))
+    }
+
     fn failure_response(call: ToolCall, err: FunctionCallError) -> ResponseInputItem {
         let message = err.to_string();
         match call.payload {
@@ -180,7 +212,7 @@ impl ToolCallRuntime {
         if call.tool_name.namespace.is_none()
             && matches!(
                 call.tool_name.name.as_str(),
-                "shell" | "container.exec" | "local_shell" | "shell_command" | "unified_exec"
+                "shell_command" | "unified_exec"
             )
         {
             format!("Wall time: {secs:.1} seconds\naborted by user")
@@ -189,3 +221,147 @@ impl ToolCallRuntime {
         }
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use std::time::Duration;
+
+    use crate::tools::context::FunctionToolOutput;
+    use crate::tools::context::ToolInvocation;
+    use crate::tools::registry::CoreToolRuntime;
+    use crate::tools::registry::ToolExecutor;
+    use crate::tools::registry::ToolRegistry;
+    use crate::turn_diff_tracker::TurnDiffTracker;
+    use codex_extension_api::ToolCallOutcome;
+    use codex_protocol::models::FunctionCallOutputBody;
+    use codex_protocol::models::FunctionCallOutputPayload;
+    use pretty_assertions::assert_eq;
+    use tokio::sync::Notify;
+    use tokio::sync::oneshot;
+
+    struct ImmediateHandler {
+        tool_name: codex_tools::ToolName,
+    }
+
+    #[async_trait::async_trait]
+    impl ToolExecutor<ToolInvocation> for ImmediateHandler {
+        fn tool_name(&self) -> codex_tools::ToolName {
+            self.tool_name.clone()
+        }
+
+        async fn handle(
+            &self,
+            _invocation: ToolInvocation,
+        ) -> Result<Box<dyn crate::tools::context::ToolOutput>, FunctionCallError> {
+            Ok(Box::new(FunctionToolOutput::from_text(
+                "ok".to_string(),
+                Some(true),
+            )))
+        }
+    }
+
+    impl CoreToolRuntime for ImmediateHandler {}
+
+    struct BlockingFinishContributor {
+        records: Arc<std::sync::Mutex<Vec<ToolCallOutcome>>>,
+        finish_started: std::sync::Mutex<Option<oneshot::Sender<()>>>,
+        allow_finish: Arc<Notify>,
+    }
+
+    impl codex_extension_api::ToolLifecycleContributor for BlockingFinishContributor {
+        fn on_tool_finish<'a>(
+            &'a self,
+            input: codex_extension_api::ToolFinishInput<'a>,
+        ) -> codex_extension_api::ToolLifecycleFuture<'a> {
+            let records = Arc::clone(&self.records);
+            let allow_finish = Arc::clone(&self.allow_finish);
+            let finish_started = self
+                .finish_started
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner)
+                .take();
+            let outcome = input.outcome;
+            Box::pin(async move {
+                if let Some(finish_started) = finish_started {
+                    let _ = finish_started.send(());
+                }
+                allow_finish.notified().await;
+                records
+                    .lock()
+                    .unwrap_or_else(std::sync::PoisonError::into_inner)
+                    .push(outcome);
+            })
+        }
+    }
+
+    #[tokio::test]
+    async fn cancellation_after_handler_finishes_preserves_completed_lifecycle()
+    -> anyhow::Result<()> {
+        let (mut session, turn_context) = crate::session::tests::make_session_and_context().await;
+        let records = Arc::new(std::sync::Mutex::new(Vec::new()));
+        let (finish_started_tx, finish_started_rx) = oneshot::channel();
+        let allow_finish = Arc::new(Notify::new());
+        let mut builder =
+            codex_extension_api::ExtensionRegistryBuilder::<crate::config::Config>::new();
+        builder.tool_lifecycle_contributor(Arc::new(BlockingFinishContributor {
+            records: Arc::clone(&records),
+            finish_started: std::sync::Mutex::new(Some(finish_started_tx)),
+            allow_finish: Arc::clone(&allow_finish),
+        }));
+        session.services.extensions = Arc::new(builder.build());
+
+        let session = Arc::new(session);
+        let turn_context = Arc::new(turn_context);
+        let tool_name = codex_tools::ToolName::plain("test_tool");
+        let handler = Arc::new(ImmediateHandler {
+            tool_name: tool_name.clone(),
+        }) as Arc<dyn CoreToolRuntime>;
+        let router = Arc::new(ToolRouter::from_parts(
+            ToolRegistry::from_tools([handler]),
+            Vec::new(),
+        ));
+        let tracker = Arc::new(tokio::sync::Mutex::new(TurnDiffTracker::new()));
+        let runtime = ToolCallRuntime::new(router, session, turn_context, tracker);
+        let cancellation_token = CancellationToken::new();
+        let call = ToolCall {
+            tool_name,
+            call_id: "call-1".to_string(),
+            payload: ToolPayload::Function {
+                arguments: "{}".to_string(),
+            },
+        };
+
+        let response_task =
+            tokio::spawn(runtime.handle_tool_call(call, cancellation_token.clone()));
+        tokio::time::timeout(Duration::from_secs(1), finish_started_rx)
+            .await
+            .expect("timed out waiting for lifecycle notification to start")
+            .expect("lifecycle notification should start");
+        cancellation_token.cancel();
+        tokio::time::sleep(Duration::from_millis(10)).await;
+        allow_finish.notify_waiters();
+
+        let response = tokio::time::timeout(Duration::from_secs(1), response_task)
+            .await
+            .expect("timed out waiting for tool response")
+            .expect("tool response task should join")?;
+        let expected_response = ResponseInputItem::FunctionCallOutput {
+            call_id: "call-1".to_string(),
+            output: FunctionCallOutputPayload {
+                body: FunctionCallOutputBody::Text("ok".to_string()),
+                success: Some(true),
+            },
+        };
+        assert_eq!(expected_response, response);
+
+        let actual = records
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner)
+            .drain(..)
+            .collect::<Vec<_>>();
+        assert_eq!(vec![ToolCallOutcome::Completed { success: true }], actual);
+
+        Ok(())
+    }
+}
diff --git a/codex-rs/core/src/tools/registry.rs b/codex-rs/core/src/tools/registry.rs
index b8480600f7..96837497f8 100644
--- a/codex-rs/core/src/tools/registry.rs
+++ b/codex-rs/core/src/tools/registry.rs
@@ -1,6 +1,7 @@
 use std::collections::HashMap;
-use std::future::Future;
 use std::sync::Arc;
+use std::sync::atomic::AtomicBool;
+use std::sync::atomic::Ordering;
 use std::time::Duration;
 
 use crate::function_tool::FunctionCallError;
@@ -18,12 +19,13 @@ use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolOutput;
 use crate::tools::context::ToolPayload;
 use crate::tools::flat_tool_name;
-use crate::tools::handlers::extension_tools::ExtensionToolHandler;
 use crate::tools::hook_names::HookToolName;
+use crate::tools::lifecycle::notify_tool_finish;
+use crate::tools::lifecycle::notify_tool_start;
 use crate::tools::tool_dispatch_trace::ToolDispatchTrace;
 use crate::tools::tool_search_entry::ToolSearchInfo;
 use crate::util::error_or_panic;
-use codex_extension_api::ExtensionToolExecutor;
+use codex_extension_api::ToolCallOutcome;
 use codex_protocol::models::ResponseInputItem;
 use codex_protocol::protocol::EventMsg;
 use codex_tools::ToolName;
@@ -35,8 +37,13 @@ use tracing::warn;
 pub(crate) type ToolTelemetryTags = Vec<(&'static str, String)>;
 
 pub use codex_tools::ToolExecutor;
+pub use codex_tools::ToolExposure;
 
-pub trait ToolHandler: ToolExecutor<ToolInvocation> {
+/// Typed runtime contract for locally executed tools.
+///
+/// Implementers provide the shared `ToolExecutor` behavior plus optional
+/// core-owned metadata for hooks, telemetry, tool search, and argument diffs.
+pub(crate) trait CoreToolRuntime: ToolExecutor<ToolInvocation> {
     fn search_info(&self) -> Option<ToolSearchInfo> {
         None
     }
@@ -48,17 +55,17 @@ pub trait ToolHandler: ToolExecutor<ToolInvocation> {
         )
     }
 
-    fn telemetry_tags(
-        &self,
-        _invocation: &ToolInvocation,
-    ) -> impl Future<Output = ToolTelemetryTags> + Send {
-        async { Vec::new() }
+    fn telemetry_tags<'a>(
+        &'a self,
+        _invocation: &'a ToolInvocation,
+    ) -> BoxFuture<'a, ToolTelemetryTags> {
+        Box::pin(async { Vec::new() })
     }
 
     fn post_tool_use_payload(
         &self,
         _invocation: &ToolInvocation,
-        _result: &Self::Output,
+        _result: &dyn ToolOutput,
     ) -> Option<PostToolUsePayload> {
         None
     }
@@ -155,63 +162,67 @@ pub(crate) struct PostToolUsePayload {
     pub(crate) tool_response: Value,
 }
 
-pub(crate) trait AnyToolHandler: Send + Sync {
-    fn tool_name(&self) -> ToolName;
+pub(crate) fn override_tool_exposure(
+    handler: Arc<dyn CoreToolRuntime>,
+    exposure: ToolExposure,
+) -> Arc<dyn CoreToolRuntime> {
+    if handler.exposure() == exposure {
+        return handler;
+    }
 
-    fn spec(&self) -> Option<ToolSpec>;
-
-    fn search_info(&self) -> Option<ToolSearchInfo>;
-
-    fn supports_parallel_tool_calls(&self) -> bool;
-
-    fn matches_kind(&self, payload: &ToolPayload) -> bool;
-
-    fn pre_tool_use_payload(&self, invocation: &ToolInvocation) -> Option<PreToolUsePayload>;
-
-    fn with_updated_hook_input(
-        &self,
-        invocation: ToolInvocation,
-        updated_input: Value,
-    ) -> Result<ToolInvocation, FunctionCallError>;
-
-    fn telemetry_tags<'a>(
-        &'a self,
-        invocation: &'a ToolInvocation,
-    ) -> BoxFuture<'a, ToolTelemetryTags>;
-
-    fn create_diff_consumer(&self) -> Option<Box<dyn ToolArgumentDiffConsumer>>;
-    fn handle_any<'a>(
-        &'a self,
-        invocation: ToolInvocation,
-    ) -> BoxFuture<'a, Result<AnyToolResult, FunctionCallError>>;
+    Arc::new(ExposureOverride { handler, exposure })
 }
 
-impl<T> AnyToolHandler for T
-where
-    T: ToolHandler,
-{
+struct ExposureOverride {
+    handler: Arc<dyn CoreToolRuntime>,
+    exposure: ToolExposure,
+}
+
+#[async_trait::async_trait]
+impl ToolExecutor<ToolInvocation> for ExposureOverride {
     fn tool_name(&self) -> ToolName {
-        ToolExecutor::tool_name(self)
+        self.handler.tool_name()
     }
 
     fn spec(&self) -> Option<ToolSpec> {
-        ToolExecutor::spec(self)
+        self.handler.spec()
     }
 
-    fn search_info(&self) -> Option<ToolSearchInfo> {
-        ToolHandler::search_info(self)
+    fn exposure(&self) -> ToolExposure {
+        self.exposure
     }
 
     fn supports_parallel_tool_calls(&self) -> bool {
-        ToolExecutor::supports_parallel_tool_calls(self)
+        self.handler.supports_parallel_tool_calls()
+    }
+
+    async fn handle(
+        &self,
+        invocation: ToolInvocation,
+    ) -> Result<Box<dyn ToolOutput>, FunctionCallError> {
+        self.handler.handle(invocation).await
+    }
+}
+
+impl CoreToolRuntime for ExposureOverride {
+    fn search_info(&self) -> Option<ToolSearchInfo> {
+        self.handler.search_info()
     }
 
     fn matches_kind(&self, payload: &ToolPayload) -> bool {
-        ToolHandler::matches_kind(self, payload)
+        self.handler.matches_kind(payload)
     }
 
     fn pre_tool_use_payload(&self, invocation: &ToolInvocation) -> Option<PreToolUsePayload> {
-        ToolHandler::pre_tool_use_payload(self, invocation)
+        self.handler.pre_tool_use_payload(invocation)
+    }
+
+    fn post_tool_use_payload(
+        &self,
+        invocation: &ToolInvocation,
+        result: &dyn ToolOutput,
+    ) -> Option<PostToolUsePayload> {
+        self.handler.post_tool_use_payload(invocation, result)
     }
 
     fn with_updated_hook_input(
@@ -219,46 +230,42 @@ where
         invocation: ToolInvocation,
         updated_input: Value,
     ) -> Result<ToolInvocation, FunctionCallError> {
-        ToolHandler::with_updated_hook_input(self, invocation, updated_input)
+        self.handler
+            .with_updated_hook_input(invocation, updated_input)
     }
 
     fn telemetry_tags<'a>(
         &'a self,
         invocation: &'a ToolInvocation,
     ) -> BoxFuture<'a, ToolTelemetryTags> {
-        Box::pin(ToolHandler::telemetry_tags(self, invocation))
+        self.handler.telemetry_tags(invocation)
     }
 
     fn create_diff_consumer(&self) -> Option<Box<dyn ToolArgumentDiffConsumer>> {
-        ToolHandler::create_diff_consumer(self)
-    }
-    fn handle_any<'a>(
-        &'a self,
-        invocation: ToolInvocation,
-    ) -> BoxFuture<'a, Result<AnyToolResult, FunctionCallError>> {
-        Box::pin(async move {
-            let call_id = invocation.call_id.clone();
-            let payload = invocation.payload.clone();
-            let output = ToolExecutor::handle(self, invocation.clone()).await?;
-            let post_tool_use_payload =
-                ToolHandler::post_tool_use_payload(self, &invocation, &output);
-            Ok(AnyToolResult {
-                call_id,
-                payload,
-                result: Box::new(output),
-                post_tool_use_payload,
-            })
-        })
+        self.handler.create_diff_consumer()
     }
 }
 
 pub struct ToolRegistry {
-    handlers: HashMap<ToolName, Arc<dyn AnyToolHandler>>,
+    tools: HashMap<ToolName, Arc<dyn CoreToolRuntime>>,
 }
 
 impl ToolRegistry {
-    fn new(handlers: HashMap<ToolName, Arc<dyn AnyToolHandler>>) -> Self {
-        Self { handlers }
+    fn new(tools: HashMap<ToolName, Arc<dyn CoreToolRuntime>>) -> Self {
+        Self { tools }
+    }
+
+    pub(crate) fn from_tools(tools: impl IntoIterator<Item = Arc<dyn CoreToolRuntime>>) -> Self {
+        let mut tools_by_name = HashMap::new();
+        for tool in tools {
+            let name = tool.tool_name();
+            if tools_by_name.contains_key(&name) {
+                error_or_panic(format!("tool {name} already registered"));
+                continue;
+            }
+            tools_by_name.insert(name, tool);
+        }
+        Self::new(tools_by_name)
     }
 
     #[cfg(test)]
@@ -269,40 +276,57 @@ impl ToolRegistry {
     #[cfg(test)]
     pub(crate) fn with_handler_for_test<T>(handler: Arc<T>) -> Self
     where
-        T: ToolHandler + 'static,
+        T: CoreToolRuntime + 'static,
     {
         let name = handler.tool_name();
-        Self::new(HashMap::from([(name, handler as Arc<dyn AnyToolHandler>)]))
+        Self::new(HashMap::from([(name, handler as Arc<dyn CoreToolRuntime>)]))
     }
 
-    fn handler(&self, name: &ToolName) -> Option<Arc<dyn AnyToolHandler>> {
-        self.handlers.get(name).map(Arc::clone)
+    fn tool(&self, name: &ToolName) -> Option<Arc<dyn CoreToolRuntime>> {
+        self.tools.get(name).map(Arc::clone)
     }
 
     #[cfg(test)]
-    pub(crate) fn has_handler(&self, name: &ToolName) -> bool {
-        self.handler(name).is_some()
+    pub(crate) fn tool_names_for_test(&self) -> Vec<ToolName> {
+        let mut names = self.tools.keys().cloned().collect::<Vec<_>>();
+        names.sort();
+        names
+    }
+
+    #[cfg(test)]
+    pub(crate) fn tool_exposure(&self, name: &ToolName) -> Option<ToolExposure> {
+        self.tools.get(name).map(|tool| tool.exposure())
     }
 
     pub(crate) fn create_diff_consumer(
         &self,
         name: &ToolName,
     ) -> Option<Box<dyn ToolArgumentDiffConsumer>> {
-        self.handler(name)?.create_diff_consumer()
+        self.tool(name)?.create_diff_consumer()
     }
 
     pub(crate) fn supports_parallel_tool_calls(&self, name: &ToolName) -> Option<bool> {
-        let handler = self.handler(name)?;
-        Some(handler.supports_parallel_tool_calls())
+        let tool = self.tool(name)?;
+        Some(tool.supports_parallel_tool_calls())
+    }
+
+    #[allow(dead_code)]
+    pub(crate) async fn dispatch_any(
+        &self,
+        invocation: ToolInvocation,
+    ) -> Result<AnyToolResult, FunctionCallError> {
+        self.dispatch_any_with_terminal_outcome(invocation, /*terminal_outcome_reached*/ None)
+            .await
     }
 
     #[expect(
         clippy::await_holding_invalid_type,
         reason = "tool dispatch must keep active-turn accounting atomic"
     )]
-    pub(crate) async fn dispatch_any(
+    pub(crate) async fn dispatch_any_with_terminal_outcome(
         &self,
         mut invocation: ToolInvocation,
+        terminal_outcome_reached: Option<Arc<AtomicBool>>,
     ) -> Result<AnyToolResult, FunctionCallError> {
         let tool_name = invocation.tool_name.clone();
         let tool_name_flat = flat_tool_name(&tool_name);
@@ -321,6 +345,7 @@ impl ToolRegistry {
                 "sandbox_policy",
                 permission_profile_policy_tag(
                     &invocation.turn.permission_profile,
+                    #[allow(deprecated)]
                     invocation.turn.cwd.as_path(),
                 ),
             ),
@@ -335,8 +360,8 @@ impl ToolRegistry {
         }
 
         let dispatch_trace = ToolDispatchTrace::start(&invocation);
-        let handler = match self.handler(&tool_name) {
-            Some(handler) => handler,
+        let tool = match self.tool(&tool_name) {
+            Some(tool) => tool,
             None => {
                 let message = unsupported_tool_call_message(&invocation.payload, &tool_name);
                 let log_payload = invocation.payload.log_payload();
@@ -356,7 +381,7 @@ impl ToolRegistry {
             }
         };
 
-        let telemetry_tags = handler.telemetry_tags(&invocation).await;
+        let telemetry_tags = tool.telemetry_tags(&invocation).await;
         let mut tool_result_tags =
             Vec::with_capacity(base_tool_result_tags.len() + telemetry_tags.len());
         let mut extra_trace_fields = Vec::new();
@@ -368,7 +393,7 @@ impl ToolRegistry {
                 tool_result_tags.push((*key, value.as_str()));
             }
         }
-        if !handler.matches_kind(&invocation.payload) {
+        if !tool.matches_kind(&invocation.payload) {
             let message = format!("tool {tool_name} invoked with incompatible payload");
             let log_payload = invocation.payload.log_payload();
             otel.tool_result_with_tags(
@@ -386,7 +411,9 @@ impl ToolRegistry {
             return Err(err);
         }
 
-        if let Some(pre_tool_use_payload) = handler.pre_tool_use_payload(&invocation) {
+        notify_tool_start(&invocation).await;
+
+        if let Some(pre_tool_use_payload) = tool.pre_tool_use_payload(&invocation) {
             match run_pre_tool_use_hooks(
                 &invocation.session,
                 &invocation.turn,
@@ -399,13 +426,33 @@ impl ToolRegistry {
                 PreToolUseHookResult::Blocked(message) => {
                     let err = FunctionCallError::RespondToModel(message);
                     dispatch_trace.record_failed(&err);
+                    if let Some(terminal_outcome_reached) = &terminal_outcome_reached {
+                        terminal_outcome_reached.store(true, Ordering::Release);
+                    }
+                    notify_tool_finish(&invocation, ToolCallOutcome::Blocked).await;
                     return Err(err);
                 }
                 PreToolUseHookResult::Continue {
                     updated_input: Some(updated_input),
-                } => {
-                    invocation = handler.with_updated_hook_input(invocation, updated_input)?;
-                }
+                } => match tool.with_updated_hook_input(invocation.clone(), updated_input) {
+                    Ok(updated_invocation) => {
+                        invocation = updated_invocation;
+                    }
+                    Err(err) => {
+                        dispatch_trace.record_failed(&err);
+                        if let Some(terminal_outcome_reached) = &terminal_outcome_reached {
+                            terminal_outcome_reached.store(true, Ordering::Release);
+                        }
+                        notify_tool_finish(
+                            &invocation,
+                            ToolCallOutcome::Failed {
+                                handler_executed: false,
+                            },
+                        )
+                        .await;
+                        return Err(err);
+                    }
+                },
                 PreToolUseHookResult::Continue {
                     updated_input: None,
                 } => {}
@@ -424,10 +471,10 @@ impl ToolRegistry {
                 &tool_result_tags,
                 &extra_trace_fields,
                 || {
-                    let handler = handler.clone();
+                    let tool = tool.clone();
                     let response_cell = &response_cell;
                     async move {
-                        match handler.handle_any(invocation_for_tool).await {
+                        match handle_any_tool(tool.as_ref(), invocation_for_tool).await {
                             Ok(result) => {
                                 let preview = result.result.log_preview();
                                 let success = result.result.success_for_logging();
@@ -500,6 +547,27 @@ impl ToolRegistry {
             }
         }
 
+        let lifecycle_outcome = match &result {
+            Ok(_) => {
+                let guard = response_cell.lock().await;
+                match guard.as_ref() {
+                    Some(result) => ToolCallOutcome::Completed {
+                        success: result.result.success_for_logging(),
+                    },
+                    None => ToolCallOutcome::Failed {
+                        handler_executed: true,
+                    },
+                }
+            }
+            Err(_) => ToolCallOutcome::Failed {
+                handler_executed: true,
+            },
+        };
+        if let Some(terminal_outcome_reached) = &terminal_outcome_reached {
+            terminal_outcome_reached.store(true, Ordering::Release);
+        }
+        notify_tool_finish(&invocation, lifecycle_outcome).await;
+
         if let Err(err) = invocation
             .session
             .goal_runtime_apply(GoalRuntimeEvent::ToolCompleted {
@@ -533,75 +601,21 @@ impl ToolRegistry {
     }
 }
 
-pub struct ToolRegistryBuilder {
-    handlers: HashMap<ToolName, Arc<dyn AnyToolHandler>>,
-    specs: Vec<ToolSpec>,
-}
-
-impl ToolRegistryBuilder {
-    pub fn new() -> Self {
-        Self {
-            handlers: HashMap::new(),
-            specs: Vec::new(),
-        }
-    }
-
-    pub(crate) fn push_spec(&mut self, spec: ToolSpec) {
-        self.specs.push(spec);
-    }
-
-    pub fn register_handler<H>(&mut self, handler: Arc<H>)
-    where
-        H: ToolHandler + 'static,
-    {
-        self.register_any_handler(handler);
-    }
-
-    pub(crate) fn register_any_handler(&mut self, handler: Arc<dyn AnyToolHandler>) {
-        self.register_any_handler_internal(handler, /*include_spec*/ true);
-    }
-
-    pub(crate) fn register_any_handler_without_spec(&mut self, handler: Arc<dyn AnyToolHandler>) {
-        self.register_any_handler_internal(handler, /*include_spec*/ false);
-    }
-
-    fn register_any_handler_internal(
-        &mut self,
-        handler: Arc<dyn AnyToolHandler>,
-        include_spec: bool,
-    ) {
-        let name = handler.tool_name();
-        if self.handlers.contains_key(&name) {
-            error_or_panic(format!("handler for tool {name} already registered"));
-            return;
-        }
-
-        if include_spec && let Some(spec) = handler.spec() {
-            self.push_spec(spec);
-        }
-
-        self.handlers.insert(name, handler);
-    }
-
-    pub fn register_extension_tool_executor(&mut self, executor: Arc<dyn ExtensionToolExecutor>) {
-        let tool_name = executor.tool_name();
-        if self.handlers.contains_key(&tool_name) {
-            warn!("Skipping extension tool `{tool_name}`: handler already registered");
-            return;
-        }
-
-        if let Some(spec) = executor.spec() {
-            self.push_spec(spec);
-        }
-
-        let handler: Arc<dyn AnyToolHandler> = Arc::new(ExtensionToolHandler::new(executor));
-        self.handlers.insert(tool_name, handler);
-    }
-
-    pub fn build(self) -> (Vec<ToolSpec>, ToolRegistry) {
-        let registry = ToolRegistry::new(self.handlers);
-        (self.specs, registry)
-    }
+async fn handle_any_tool(
+    tool: &dyn CoreToolRuntime,
+    invocation: ToolInvocation,
+) -> Result<AnyToolResult, FunctionCallError> {
+    let call_id = invocation.call_id.clone();
+    let payload = invocation.payload.clone();
+    let output = tool.handle(invocation.clone()).await?;
+    let post_tool_use_payload =
+        CoreToolRuntime::post_tool_use_payload(tool, &invocation, output.as_ref());
+    Ok(AnyToolResult {
+        call_id,
+        payload,
+        result: output,
+        post_tool_use_payload,
+    })
 }
 
 fn unsupported_tool_call_message(payload: &ToolPayload, tool_name: &ToolName) -> String {
diff --git a/codex-rs/core/src/tools/registry_tests.rs b/codex-rs/core/src/tools/registry_tests.rs
index 1cc68be44d..e3ecfc8f98 100644
--- a/codex-rs/core/src/tools/registry_tests.rs
+++ b/codex-rs/core/src/tools/registry_tests.rs
@@ -1,29 +1,118 @@
 use super::*;
-use crate::tools::handlers::GetGoalHandler;
-use crate::tools::handlers::goal_spec::GET_GOAL_TOOL_NAME;
-use crate::tools::handlers::goal_spec::create_get_goal_tool;
 use pretty_assertions::assert_eq;
 
 struct TestHandler {
     tool_name: codex_tools::ToolName,
 }
 
+#[async_trait::async_trait]
 impl ToolExecutor<ToolInvocation> for TestHandler {
-    type Output = crate::tools::context::FunctionToolOutput;
-
     fn tool_name(&self) -> codex_tools::ToolName {
         self.tool_name.clone()
     }
 
-    async fn handle(&self, _invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
-        Ok(crate::tools::context::FunctionToolOutput::from_text(
-            "ok".to_string(),
-            Some(true),
+    async fn handle(
+        &self,
+        _invocation: ToolInvocation,
+    ) -> Result<Box<dyn crate::tools::context::ToolOutput>, FunctionCallError> {
+        Ok(Box::new(
+            crate::tools::context::FunctionToolOutput::from_text("ok".to_string(), Some(true)),
         ))
     }
 }
 
-impl ToolHandler for TestHandler {}
+impl CoreToolRuntime for TestHandler {}
+
+#[derive(Clone)]
+enum LifecycleTestResult {
+    Ok { success: bool },
+    Err,
+}
+
+struct LifecycleTestHandler {
+    tool_name: codex_tools::ToolName,
+    result: LifecycleTestResult,
+}
+
+#[async_trait::async_trait]
+impl ToolExecutor<ToolInvocation> for LifecycleTestHandler {
+    fn tool_name(&self) -> codex_tools::ToolName {
+        self.tool_name.clone()
+    }
+
+    async fn handle(
+        &self,
+        _invocation: ToolInvocation,
+    ) -> Result<Box<dyn crate::tools::context::ToolOutput>, FunctionCallError> {
+        match self.result.clone() {
+            LifecycleTestResult::Ok { success } => Ok(Box::new(
+                crate::tools::context::FunctionToolOutput::from_text(
+                    "ok".to_string(),
+                    Some(success),
+                ),
+            )),
+            LifecycleTestResult::Err => Err(FunctionCallError::RespondToModel(
+                "handler failed".to_string(),
+            )),
+        }
+    }
+}
+
+impl CoreToolRuntime for LifecycleTestHandler {}
+
+#[derive(Debug, PartialEq, Eq)]
+enum RecordedToolLifecycle {
+    Start {
+        call_id: String,
+        tool_name: codex_tools::ToolName,
+    },
+    Finish {
+        call_id: String,
+        tool_name: codex_tools::ToolName,
+        outcome: codex_extension_api::ToolCallOutcome,
+    },
+}
+
+struct ToolLifecycleRecorder {
+    records: Arc<std::sync::Mutex<Vec<RecordedToolLifecycle>>>,
+}
+
+impl codex_extension_api::ToolLifecycleContributor for ToolLifecycleRecorder {
+    fn on_tool_start<'a>(
+        &'a self,
+        input: codex_extension_api::ToolStartInput<'a>,
+    ) -> codex_extension_api::ToolLifecycleFuture<'a> {
+        let records = Arc::clone(&self.records);
+        let record = RecordedToolLifecycle::Start {
+            call_id: input.call_id.to_string(),
+            tool_name: input.tool_name.clone(),
+        };
+        Box::pin(async move {
+            records
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner)
+                .push(record);
+        })
+    }
+
+    fn on_tool_finish<'a>(
+        &'a self,
+        input: codex_extension_api::ToolFinishInput<'a>,
+    ) -> codex_extension_api::ToolLifecycleFuture<'a> {
+        let records = Arc::clone(&self.records);
+        let record = RecordedToolLifecycle::Finish {
+            call_id: input.call_id.to_string(),
+            tool_name: input.tool_name.clone(),
+            outcome: input.outcome,
+        };
+        Box::pin(async move {
+            records
+                .lock()
+                .unwrap_or_else(std::sync::PoisonError::into_inner)
+                .push(record);
+        })
+    }
+}
 
 #[test]
 fn handler_looks_up_namespaced_aliases_explicitly() {
@@ -33,18 +122,18 @@ fn handler_looks_up_namespaced_aliases_explicitly() {
     let namespaced_name = codex_tools::ToolName::namespaced(namespace, tool_name);
     let plain_handler = Arc::new(TestHandler {
         tool_name: plain_name.clone(),
-    }) as Arc<dyn AnyToolHandler>;
+    }) as Arc<dyn CoreToolRuntime>;
     let namespaced_handler = Arc::new(TestHandler {
         tool_name: namespaced_name.clone(),
-    }) as Arc<dyn AnyToolHandler>;
+    }) as Arc<dyn CoreToolRuntime>;
     let registry = ToolRegistry::new(HashMap::from([
         (plain_name.clone(), Arc::clone(&plain_handler)),
         (namespaced_name.clone(), Arc::clone(&namespaced_handler)),
     ]));
 
-    let plain = registry.handler(&plain_name);
-    let namespaced = registry.handler(&namespaced_name);
-    let missing_namespaced = registry.handler(&codex_tools::ToolName::namespaced(
+    let plain = registry.tool(&plain_name);
+    let namespaced = registry.tool(&namespaced_name);
+    let missing_namespaced = registry.tool(&codex_tools::ToolName::namespaced(
         "mcp__codex_apps__calendar",
         tool_name,
     ));
@@ -64,14 +153,105 @@ fn handler_looks_up_namespaced_aliases_explicitly() {
     );
 }
 
-#[test]
-fn register_handler_adds_handler_and_spec() {
-    let mut builder = ToolRegistryBuilder::new();
-    builder.register_handler(Arc::new(GetGoalHandler));
+#[tokio::test]
+async fn dispatch_notifies_tool_lifecycle_contributors() -> anyhow::Result<()> {
+    let (mut session, turn) = crate::session::tests::make_session_and_context().await;
+    let records = Arc::new(std::sync::Mutex::new(Vec::new()));
+    let mut builder = codex_extension_api::ExtensionRegistryBuilder::<crate::config::Config>::new();
+    builder.tool_lifecycle_contributor(Arc::new(ToolLifecycleRecorder {
+        records: Arc::clone(&records),
+    }));
+    session.services.extensions = Arc::new(builder.build());
 
-    let (specs, registry) = builder.build();
+    let ok_tool = codex_tools::ToolName::plain("ok_tool");
+    let failing_tool = codex_tools::ToolName::plain("failing_tool");
+    let ok_handler = Arc::new(LifecycleTestHandler {
+        tool_name: ok_tool.clone(),
+        result: LifecycleTestResult::Ok { success: false },
+    }) as Arc<dyn CoreToolRuntime>;
+    let failing_handler = Arc::new(LifecycleTestHandler {
+        tool_name: failing_tool.clone(),
+        result: LifecycleTestResult::Err,
+    }) as Arc<dyn CoreToolRuntime>;
+    let registry = ToolRegistry::new(HashMap::from([
+        (ok_tool.clone(), ok_handler),
+        (failing_tool.clone(), failing_handler),
+    ]));
+    let session = Arc::new(session);
+    let turn = Arc::new(turn);
 
-    assert_eq!(specs.len(), 1);
-    assert_eq!(specs[0], create_get_goal_tool());
-    assert!(registry.has_handler(&codex_tools::ToolName::plain(GET_GOAL_TOOL_NAME)));
+    registry
+        .dispatch_any(test_invocation(
+            Arc::clone(&session),
+            Arc::clone(&turn),
+            "ok-call",
+            ok_tool.clone(),
+        ))
+        .await?;
+    let err = match registry
+        .dispatch_any(test_invocation(
+            Arc::clone(&session),
+            Arc::clone(&turn),
+            "failing-call",
+            failing_tool.clone(),
+        ))
+        .await
+    {
+        Ok(_) => panic!("failing handler should return an error"),
+        Err(err) => err,
+    };
+    assert_eq!(err.to_string(), "handler failed");
+
+    let expected = vec![
+        RecordedToolLifecycle::Start {
+            call_id: "ok-call".to_string(),
+            tool_name: ok_tool.clone(),
+        },
+        RecordedToolLifecycle::Finish {
+            call_id: "ok-call".to_string(),
+            tool_name: ok_tool,
+            outcome: codex_extension_api::ToolCallOutcome::Completed { success: false },
+        },
+        RecordedToolLifecycle::Start {
+            call_id: "failing-call".to_string(),
+            tool_name: failing_tool.clone(),
+        },
+        RecordedToolLifecycle::Finish {
+            call_id: "failing-call".to_string(),
+            tool_name: failing_tool,
+            outcome: codex_extension_api::ToolCallOutcome::Failed {
+                handler_executed: true,
+            },
+        },
+    ];
+    let actual = records
+        .lock()
+        .unwrap_or_else(std::sync::PoisonError::into_inner)
+        .drain(..)
+        .collect::<Vec<_>>();
+    assert_eq!(expected, actual);
+
+    Ok(())
+}
+
+fn test_invocation(
+    session: Arc<crate::session::session::Session>,
+    turn: Arc<crate::session::turn_context::TurnContext>,
+    call_id: &str,
+    tool_name: codex_tools::ToolName,
+) -> ToolInvocation {
+    ToolInvocation {
+        session,
+        turn,
+        cancellation_token: tokio_util::sync::CancellationToken::new(),
+        tracker: Arc::new(tokio::sync::Mutex::new(
+            crate::turn_diff_tracker::TurnDiffTracker::new(),
+        )),
+        call_id: call_id.to_string(),
+        tool_name,
+        source: crate::tools::context::ToolCallSource::Direct,
+        payload: ToolPayload::Function {
+            arguments: "{}".to_string(),
+        },
+    }
 }
diff --git a/codex-rs/core/src/tools/router.rs b/codex-rs/core/src/tools/router.rs
index abb0e18976..cfd4776890 100644
--- a/codex-rs/core/src/tools/router.rs
+++ b/codex-rs/core/src/tools/router.rs
@@ -1,5 +1,4 @@
 use crate::function_tool::FunctionCallError;
-use crate::sandboxing::SandboxPermissions;
 use crate::session::session::Session;
 use crate::session::turn_context::TurnContext;
 use crate::tools::context::SharedTurnDiffTracker;
@@ -8,21 +7,18 @@ use crate::tools::context::ToolPayload;
 use crate::tools::registry::AnyToolResult;
 use crate::tools::registry::ToolArgumentDiffConsumer;
 use crate::tools::registry::ToolRegistry;
-use crate::tools::spec::build_specs_with_discoverable_tools;
-use codex_extension_api::ExtensionToolExecutor;
+use crate::tools::spec_plan::build_tool_router;
 use codex_mcp::ToolInfo;
 use codex_protocol::dynamic_tools::DynamicToolSpec;
-use codex_protocol::models::LocalShellAction;
 use codex_protocol::models::ResponseItem;
 use codex_protocol::models::SearchToolCallParams;
-use codex_protocol::models::ShellToolCallParams;
 use codex_tools::DiscoverableTool;
-use codex_tools::ResponsesApiNamespaceTool;
+use codex_tools::ToolCall as ExtensionToolCall;
+use codex_tools::ToolExecutor;
 use codex_tools::ToolName;
 use codex_tools::ToolSpec;
-use codex_tools::ToolsConfig;
-use std::collections::HashSet;
 use std::sync::Arc;
+use std::sync::atomic::AtomicBool;
 use tokio_util::sync::CancellationToken;
 use tracing::instrument;
 
@@ -44,46 +40,16 @@ pub(crate) struct ToolRouterParams<'a> {
     pub(crate) mcp_tools: Option<Vec<ToolInfo>>,
     pub(crate) deferred_mcp_tools: Option<Vec<ToolInfo>>,
     pub(crate) discoverable_tools: Option<Vec<DiscoverableTool>>,
-    pub(crate) extension_tool_executors: Vec<Arc<dyn ExtensionToolExecutor>>,
+    pub(crate) extension_tool_executors: Vec<Arc<dyn ToolExecutor<ExtensionToolCall>>>,
     pub(crate) dynamic_tools: &'a [DynamicToolSpec],
 }
 
 impl ToolRouter {
-    pub fn from_config(config: &ToolsConfig, params: ToolRouterParams<'_>) -> Self {
-        let ToolRouterParams {
-            mcp_tools,
-            deferred_mcp_tools,
-            discoverable_tools,
-            extension_tool_executors,
-            dynamic_tools,
-        } = params;
-        let builder = build_specs_with_discoverable_tools(
-            config,
-            mcp_tools,
-            deferred_mcp_tools,
-            discoverable_tools,
-            &extension_tool_executors,
-            dynamic_tools,
-        );
-        let (specs, registry) = builder.build();
-        let deferred_dynamic_tools = dynamic_tools
-            .iter()
-            .filter(|tool| tool.defer_loading)
-            .map(|tool| ToolName::new(tool.namespace.clone(), tool.name.clone()))
-            .collect::<HashSet<_>>();
-        let model_visible_specs = specs
-            .iter()
-            .filter_map(|spec| {
-                if config.code_mode_only_enabled
-                    && codex_code_mode::is_code_mode_nested_tool(spec.name())
-                {
-                    return None;
-                }
-
-                filter_deferred_dynamic_tool_spec(spec.clone(), &deferred_dynamic_tools)
-            })
-            .collect();
+    pub fn from_turn_context(turn_context: &TurnContext, params: ToolRouterParams<'_>) -> Self {
+        build_tool_router(turn_context, params)
+    }
 
+    pub(crate) fn from_parts(registry: ToolRegistry, model_visible_specs: Vec<ToolSpec>) -> Self {
         Self {
             registry,
             model_visible_specs,
@@ -94,6 +60,19 @@ impl ToolRouter {
         self.model_visible_specs.clone()
     }
 
+    #[cfg(test)]
+    pub(crate) fn registered_tool_names_for_test(&self) -> Vec<ToolName> {
+        self.registry.tool_names_for_test()
+    }
+
+    #[cfg(test)]
+    pub(crate) fn tool_exposure_for_test(
+        &self,
+        name: &ToolName,
+    ) -> Option<crate::tools::registry::ToolExposure> {
+        self.registry.tool_exposure(name)
+    }
+
     pub(crate) fn create_diff_consumer(
         &self,
         tool_name: &ToolName,
@@ -153,39 +132,11 @@ impl ToolRouter {
                 call_id,
                 payload: ToolPayload::Custom { input },
             })),
-            ResponseItem::LocalShellCall {
-                id,
-                call_id,
-                action,
-                ..
-            } => {
-                let call_id = call_id
-                    .or(id)
-                    .ok_or(FunctionCallError::MissingLocalShellCallId)?;
-
-                match action {
-                    LocalShellAction::Exec(exec) => {
-                        let params = ShellToolCallParams {
-                            command: exec.command,
-                            workdir: exec.working_directory,
-                            timeout_ms: exec.timeout_ms,
-                            sandbox_permissions: Some(SandboxPermissions::UseDefault),
-                            additional_permissions: None,
-                            prefix_rule: None,
-                            justification: None,
-                        };
-                        Ok(Some(ToolCall {
-                            tool_name: ToolName::plain("local_shell"),
-                            call_id,
-                            payload: ToolPayload::LocalShell { params },
-                        }))
-                    }
-                }
-            }
             _ => Ok(None),
         }
     }
 
+    #[allow(dead_code)]
     #[instrument(level = "trace", skip_all, err)]
     pub async fn dispatch_tool_call_with_code_mode_result(
         &self,
@@ -195,6 +146,53 @@ impl ToolRouter {
         tracker: SharedTurnDiffTracker,
         call: ToolCall,
         source: ToolCallSource,
+    ) -> Result<AnyToolResult, FunctionCallError> {
+        self.dispatch_tool_call_with_code_mode_result_inner(
+            session,
+            turn,
+            cancellation_token,
+            tracker,
+            call,
+            source,
+            /*terminal_outcome_reached*/ None,
+        )
+        .await
+    }
+
+    #[instrument(level = "trace", skip_all, err)]
+    #[allow(clippy::too_many_arguments)]
+    pub(crate) async fn dispatch_tool_call_with_terminal_outcome(
+        &self,
+        session: Arc<Session>,
+        turn: Arc<TurnContext>,
+        cancellation_token: CancellationToken,
+        tracker: SharedTurnDiffTracker,
+        call: ToolCall,
+        source: ToolCallSource,
+        terminal_outcome_reached: Arc<AtomicBool>,
+    ) -> Result<AnyToolResult, FunctionCallError> {
+        self.dispatch_tool_call_with_code_mode_result_inner(
+            session,
+            turn,
+            cancellation_token,
+            tracker,
+            call,
+            source,
+            Some(terminal_outcome_reached),
+        )
+        .await
+    }
+
+    #[allow(clippy::too_many_arguments)]
+    async fn dispatch_tool_call_with_code_mode_result_inner(
+        &self,
+        session: Arc<Session>,
+        turn: Arc<TurnContext>,
+        cancellation_token: CancellationToken,
+        tracker: SharedTurnDiffTracker,
+        call: ToolCall,
+        source: ToolCallSource,
+        terminal_outcome_reached: Option<Arc<AtomicBool>>,
     ) -> Result<AnyToolResult, FunctionCallError> {
         let ToolCall {
             tool_name,
@@ -213,11 +211,15 @@ impl ToolRouter {
             payload,
         };
 
-        self.registry.dispatch_any(invocation).await
+        self.registry
+            .dispatch_any_with_terminal_outcome(invocation, terminal_outcome_reached)
+            .await
     }
 }
 
-pub(crate) fn extension_tool_executors(session: &Session) -> Vec<Arc<dyn ExtensionToolExecutor>> {
+pub(crate) fn extension_tool_executors(
+    session: &Session,
+) -> Vec<Arc<dyn ToolExecutor<ExtensionToolCall>>> {
     session
         .services
         .extensions
@@ -232,38 +234,6 @@ pub(crate) fn extension_tool_executors(session: &Session) -> Vec<Arc<dyn Extensi
         .collect()
 }
 
-fn filter_deferred_dynamic_tool_spec(
-    spec: ToolSpec,
-    deferred_dynamic_tools: &HashSet<ToolName>,
-) -> Option<ToolSpec> {
-    if deferred_dynamic_tools.is_empty() {
-        return Some(spec);
-    }
-
-    match spec {
-        ToolSpec::Function(tool) => {
-            if deferred_dynamic_tools.contains(&ToolName::plain(tool.name.as_str())) {
-                None
-            } else {
-                Some(ToolSpec::Function(tool))
-            }
-        }
-        ToolSpec::Namespace(mut namespace) => {
-            let namespace_name = namespace.name.clone();
-            namespace.tools.retain(|tool| match tool {
-                ResponsesApiNamespaceTool::Function(tool) => !deferred_dynamic_tools.contains(
-                    &ToolName::namespaced(namespace_name.as_str(), tool.name.as_str()),
-                ),
-            });
-            if namespace.tools.is_empty() {
-                None
-            } else {
-                Some(ToolSpec::Namespace(namespace))
-            }
-        }
-        spec => Some(spec),
-    }
-}
 #[cfg(test)]
 #[path = "router_tests.rs"]
 mod tests;
diff --git a/codex-rs/core/src/tools/router_tests.rs b/codex-rs/core/src/tools/router_tests.rs
index b4e935efb1..92073d56b1 100644
--- a/codex-rs/core/src/tools/router_tests.rs
+++ b/codex-rs/core/src/tools/router_tests.rs
@@ -7,17 +7,18 @@ use crate::turn_diff_tracker::TurnDiffTracker;
 use codex_extension_api::ExtensionData;
 use codex_extension_api::ExtensionRegistry;
 use codex_extension_api::ExtensionRegistryBuilder;
-use codex_extension_api::ExtensionToolExecutor;
-use codex_extension_api::ExtensionToolOutput;
 use codex_extension_api::ResponsesApiTool;
 use codex_extension_api::ToolCall as ExtensionToolCall;
+use codex_extension_api::ToolExecutor;
 use codex_protocol::dynamic_tools::DynamicToolSpec;
 use codex_protocol::models::FunctionCallOutputBody;
 use codex_protocol::models::ResponseInputItem;
 use codex_protocol::models::ResponseItem;
+use codex_tools::ResponsesApiNamespace;
 use codex_tools::ResponsesApiNamespaceTool;
 use codex_tools::ToolName;
 use codex_tools::ToolSpec;
+use codex_tools::default_namespace_description;
 use pretty_assertions::assert_eq;
 use serde_json::json;
 use tokio_util::sync::CancellationToken;
@@ -35,47 +36,53 @@ impl codex_extension_api::ToolContributor for ExtensionEchoContributor {
         &self,
         _session_store: &ExtensionData,
         _thread_store: &ExtensionData,
-    ) -> Vec<Arc<dyn ExtensionToolExecutor>> {
+    ) -> Vec<Arc<dyn ToolExecutor<ExtensionToolCall>>> {
         vec![Arc::new(ExtensionEchoExecutor)]
     }
 }
 
 struct ExtensionEchoExecutor;
 
-impl ExtensionToolExecutor for ExtensionEchoExecutor {
+#[async_trait::async_trait]
+impl ToolExecutor<ExtensionToolCall> for ExtensionEchoExecutor {
     fn tool_name(&self) -> ToolName {
-        ToolName::plain("extension_echo")
+        ToolName::namespaced("extension/", "echo")
     }
 
     fn spec(&self) -> Option<ToolSpec> {
-        Some(ToolSpec::Function(ResponsesApiTool {
-            name: "extension_echo".to_string(),
-            description: "Echoes arguments through an extension tool.".to_string(),
-            strict: true,
-            parameters: codex_extension_api::parse_tool_input_schema(&json!({
-                "type": "object",
-                "properties": {
-                    "message": { "type": "string" },
-                },
-                "required": ["message"],
-                "additionalProperties": false,
-            }))
-            .expect("extension schema should parse"),
-            output_schema: None,
-            defer_loading: None,
+        Some(ToolSpec::Namespace(ResponsesApiNamespace {
+            name: "extension/".to_string(),
+            description: default_namespace_description("extension/"),
+            tools: vec![ResponsesApiNamespaceTool::Function(ResponsesApiTool {
+                name: "echo".to_string(),
+                description: "Echoes arguments through an extension tool.".to_string(),
+                strict: true,
+                parameters: codex_extension_api::parse_tool_input_schema(&json!({
+                    "type": "object",
+                    "properties": {
+                        "message": { "type": "string" },
+                    },
+                    "required": ["message"],
+                    "additionalProperties": false,
+                }))
+                .expect("extension schema should parse"),
+                output_schema: None,
+                defer_loading: None,
+            })],
         }))
     }
 
-    fn handle(&self, call: ExtensionToolCall) -> codex_extension_api::ExtensionToolFuture<'_> {
-        Box::pin(async move {
-            let arguments: serde_json::Value = serde_json::from_str(call.function_arguments()?)
-                .expect("test arguments should parse");
-            Ok(ExtensionToolOutput::new(json!({
-                "arguments": arguments,
-                "callId": call.call_id.clone(),
-                "ok": true,
-            })))
-        })
+    async fn handle(
+        &self,
+        call: ExtensionToolCall,
+    ) -> Result<Box<dyn codex_tools::ToolOutput>, codex_tools::FunctionCallError> {
+        let arguments: serde_json::Value =
+            serde_json::from_str(call.function_arguments()?).expect("test arguments should parse");
+        Ok(Box::new(codex_tools::JsonToolOutput::new(json!({
+            "arguments": arguments,
+            "callId": call.call_id,
+            "ok": true,
+        }))))
     }
 }
 
@@ -99,8 +106,8 @@ async fn parallel_support_does_not_match_namespaced_local_tool_names() -> anyhow
         .await
         .list_all_tools()
         .await;
-    let router = ToolRouter::from_config(
-        &turn.tools_config,
+    let router = ToolRouter::from_turn_context(
+        &turn,
         ToolRouterParams {
             deferred_mcp_tools: None,
             mcp_tools: Some(mcp_tools),
@@ -110,7 +117,7 @@ async fn parallel_support_does_not_match_namespaced_local_tool_names() -> anyhow
         },
     );
 
-    let parallel_tool_name = ["shell", "local_shell", "exec_command", "shell_command"]
+    let parallel_tool_name = ["exec_command", "shell_command"]
         .into_iter()
         .find(|name| {
             router.tool_supports_parallel(&ToolCall {
@@ -165,8 +172,8 @@ async fn build_tool_call_uses_namespace_for_registry_name() -> anyhow::Result<()
 #[tokio::test]
 async fn mcp_parallel_support_uses_handler_data() -> anyhow::Result<()> {
     let (_, turn) = make_session_and_context().await;
-    let router = ToolRouter::from_config(
-        &turn.tools_config,
+    let router = ToolRouter::from_turn_context(
+        &turn,
         ToolRouterParams {
             deferred_mcp_tools: None,
             mcp_tools: Some(vec![
@@ -213,8 +220,8 @@ async fn mcp_parallel_support_uses_handler_data() -> anyhow::Result<()> {
 #[tokio::test]
 async fn tools_without_handlers_do_not_support_parallel() -> anyhow::Result<()> {
     let (_, turn) = make_session_and_context().await;
-    let router = ToolRouter::from_config(
-        &turn.tools_config,
+    let router = ToolRouter::from_turn_context(
+        &turn,
         ToolRouterParams {
             deferred_mcp_tools: None,
             mcp_tools: None,
@@ -265,8 +272,8 @@ async fn specs_filter_deferred_dynamic_tools() -> anyhow::Result<()> {
         },
     ];
 
-    let router = ToolRouter::from_config(
-        &turn.tools_config,
+    let router = ToolRouter::from_turn_context(
+        &turn,
         ToolRouterParams {
             deferred_mcp_tools: None,
             mcp_tools: None,
@@ -321,8 +328,8 @@ async fn extension_tool_executors_are_model_visible_and_dispatchable() -> anyhow
     let (mut session, turn) = make_session_and_context().await;
     session.services.extensions = extension_tool_test_registry();
 
-    let router = ToolRouter::from_config(
-        &turn.tools_config,
+    let router = ToolRouter::from_turn_context(
+        &turn,
         ToolRouterParams {
             deferred_mcp_tools: None,
             mcp_tools: None,
@@ -333,17 +340,21 @@ async fn extension_tool_executors_are_model_visible_and_dispatchable() -> anyhow
     );
 
     assert!(
-        router
-            .model_visible_specs()
-            .iter()
-            .any(|spec| spec.name() == "extension_echo"),
+        router.model_visible_specs().iter().any(
+            |spec| matches!(spec, ToolSpec::Namespace(namespace)
+            if namespace.name == "extension/"
+                && namespace.tools.iter().any(|tool| matches!(
+                    tool,
+                    ResponsesApiNamespaceTool::Function(tool) if tool.name == "echo"
+                )))
+        ),
         "expected extension-provided tool to be visible to the model"
     );
 
     let call = ToolRouter::build_tool_call(ResponseItem::FunctionCall {
         id: None,
-        name: "extension_echo".to_string(),
-        namespace: None,
+        name: "echo".to_string(),
+        namespace: Some("extension/".to_string()),
         arguments: json!({ "message": "hello" }).to_string(),
         call_id: "call-extension".to_string(),
     })?
@@ -399,7 +410,6 @@ fn namespace_function_names(specs: &[ToolSpec], namespace_name: &str) -> Vec<Str
             ToolSpec::Function(_)
             | ToolSpec::Freeform(_)
             | ToolSpec::ToolSearch { .. }
-            | ToolSpec::LocalShell {}
             | ToolSpec::ImageGeneration { .. }
             | ToolSpec::WebSearch { .. }
             | ToolSpec::Namespace(_) => None,
diff --git a/codex-rs/core/src/tools/runtimes/apply_patch_tests.rs b/codex-rs/core/src/tools/runtimes/apply_patch_tests.rs
index ff2c3d1e89..f4d8d461b2 100644
--- a/codex-rs/core/src/tools/runtimes/apply_patch_tests.rs
+++ b/codex-rs/core/src/tools/runtimes/apply_patch_tests.rs
@@ -7,7 +7,6 @@ use codex_protocol::models::PermissionProfile;
 use codex_protocol::permissions::FileSystemSandboxPolicy;
 use codex_protocol::permissions::NetworkSandboxPolicy;
 use codex_protocol::protocol::GranularApprovalConfig;
-use codex_protocol::protocol::SandboxPolicy;
 use codex_sandboxing::SandboxManager;
 use codex_sandboxing::SandboxType;
 use codex_sandboxing::policy_transforms::effective_file_system_sandbox_policy;
@@ -201,8 +200,7 @@ async fn file_system_sandbox_context_uses_active_attempt() {
         additional_permissions: Some(additional_permissions.clone()),
         permissions_preapproved: false,
     };
-    let sandbox_policy = SandboxPolicy::new_read_only_policy();
-    let file_system_policy = FileSystemSandboxPolicy::from(&sandbox_policy);
+    let file_system_policy = FileSystemSandboxPolicy::default();
     let permissions = PermissionProfile::from_runtime_permissions(
         &file_system_policy,
         NetworkSandboxPolicy::Restricted,
diff --git a/codex-rs/core/src/tools/runtimes/mod.rs b/codex-rs/core/src/tools/runtimes/mod.rs
index 073fda8ec4..bba1c572ef 100644
--- a/codex-rs/core/src/tools/runtimes/mod.rs
+++ b/codex-rs/core/src/tools/runtimes/mod.rs
@@ -8,6 +8,7 @@ use crate::exec_env::CODEX_THREAD_ID_ENV_VAR;
 use crate::path_utils;
 use crate::sandboxing::SandboxPermissions;
 use crate::shell::Shell;
+use crate::shell::ShellType;
 use crate::tools::sandboxing::ToolError;
 #[cfg(target_os = "macos")]
 use codex_network_proxy::CODEX_PROXY_GIT_SSH_COMMAND_MARKER;
@@ -15,8 +16,10 @@ use codex_network_proxy::PROXY_ACTIVE_ENV_KEY;
 use codex_network_proxy::PROXY_ENV_KEYS;
 #[cfg(target_os = "macos")]
 use codex_network_proxy::PROXY_GIT_SSH_COMMAND_ENV_KEY;
+use codex_protocol::config_types::WindowsSandboxLevel;
 use codex_protocol::models::AdditionalPermissionProfile;
 use codex_sandboxing::SandboxCommand;
+use codex_sandboxing::SandboxType;
 use codex_utils_absolute_path::AbsolutePathBuf;
 use std::collections::HashMap;
 
@@ -67,6 +70,35 @@ pub(crate) fn exec_env_for_sandbox_permissions(
     env
 }
 
+pub(crate) fn disable_powershell_profile_for_elevated_windows_sandbox(
+    command: &[String],
+    shell_type: Option<&ShellType>,
+    sandbox: SandboxType,
+    windows_sandbox_level: WindowsSandboxLevel,
+) -> Vec<String> {
+    if shell_type != Some(&ShellType::PowerShell)
+        || sandbox != SandboxType::WindowsRestrictedToken
+        || windows_sandbox_level != WindowsSandboxLevel::Elevated
+        || command.is_empty()
+    {
+        return command.to_vec();
+    }
+
+    if command[1..]
+        .iter()
+        .any(|arg| arg.eq_ignore_ascii_case("-NoProfile"))
+    {
+        return command.to_vec();
+    }
+
+    // The elevated Windows sandbox runs as a dedicated sandbox account while
+    // HOME/USERPROFILE may still point at the real user profile. Loading
+    // PowerShell profiles in that mixed context is not a valid login shell.
+    let mut command = command.to_vec();
+    command.insert(1, "-NoProfile".to_string());
+    command
+}
+
 /// POSIX-only helper: for commands produced by `Shell::derive_exec_args`
 /// for Bash/Zsh/sh of the form `[shell_path, "-lc", "<script>"]`, and
 /// when a snapshot is configured on the session shell, rewrite the argv
@@ -257,6 +289,137 @@ fn shell_single_quote(input: &str) -> String {
     input.replace('\'', r#"'"'"'"#)
 }
 
+#[cfg(test)]
+mod disable_powershell_profile_tests {
+    use super::*;
+    use pretty_assertions::assert_eq;
+
+    #[test]
+    fn inserts_no_profile_for_elevated_windows_sandbox() {
+        let command = vec![
+            "powershell.exe".to_string(),
+            "-Command".to_string(),
+            "Write-Output ok".to_string(),
+        ];
+
+        let rewritten = disable_powershell_profile_for_elevated_windows_sandbox(
+            &command,
+            Some(&ShellType::PowerShell),
+            SandboxType::WindowsRestrictedToken,
+            WindowsSandboxLevel::Elevated,
+        );
+
+        assert_eq!(
+            rewritten,
+            vec![
+                "powershell.exe".to_string(),
+                "-NoProfile".to_string(),
+                "-Command".to_string(),
+                "Write-Output ok".to_string(),
+            ]
+        );
+    }
+
+    #[test]
+    fn inserts_no_profile_before_encoded_command() {
+        let command = vec![
+            "powershell.exe".to_string(),
+            "-EncodedCommand".to_string(),
+            "VwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIABvAGsA".to_string(),
+        ];
+
+        let rewritten = disable_powershell_profile_for_elevated_windows_sandbox(
+            &command,
+            Some(&ShellType::PowerShell),
+            SandboxType::WindowsRestrictedToken,
+            WindowsSandboxLevel::Elevated,
+        );
+
+        assert_eq!(
+            rewritten,
+            vec![
+                "powershell.exe".to_string(),
+                "-NoProfile".to_string(),
+                "-EncodedCommand".to_string(),
+                "VwByAGkAdABlAC0ATwB1AHQAcAB1AHQAIABvAGsA".to_string(),
+            ]
+        );
+    }
+
+    #[test]
+    fn preserves_existing_no_profile() {
+        let command = vec![
+            "pwsh.exe".to_string(),
+            "-NoProfile".to_string(),
+            "-Command".to_string(),
+            "Write-Output ok".to_string(),
+        ];
+
+        let rewritten = disable_powershell_profile_for_elevated_windows_sandbox(
+            &command,
+            Some(&ShellType::PowerShell),
+            SandboxType::WindowsRestrictedToken,
+            WindowsSandboxLevel::Elevated,
+        );
+
+        assert_eq!(rewritten, command);
+    }
+
+    #[test]
+    fn leaves_legacy_restricted_token_backend_alone() {
+        let command = vec![
+            "powershell.exe".to_string(),
+            "-Command".to_string(),
+            "Write-Output ok".to_string(),
+        ];
+
+        let rewritten = disable_powershell_profile_for_elevated_windows_sandbox(
+            &command,
+            Some(&ShellType::PowerShell),
+            SandboxType::WindowsRestrictedToken,
+            WindowsSandboxLevel::RestrictedToken,
+        );
+
+        assert_eq!(rewritten, command);
+    }
+
+    #[test]
+    fn leaves_unsandboxed_attempts_alone() {
+        let command = vec![
+            "powershell.exe".to_string(),
+            "-Command".to_string(),
+            "Write-Output ok".to_string(),
+        ];
+
+        let rewritten = disable_powershell_profile_for_elevated_windows_sandbox(
+            &command,
+            Some(&ShellType::PowerShell),
+            SandboxType::None,
+            WindowsSandboxLevel::Elevated,
+        );
+
+        assert_eq!(rewritten, command);
+    }
+
+    #[test]
+    fn leaves_non_powershell_alone() {
+        let command = vec![
+            "/bin/bash".to_string(),
+            "-lc".to_string(),
+            "echo ok".to_string(),
+        ];
+
+        let rewritten = disable_powershell_profile_for_elevated_windows_sandbox(
+            &command,
+            Some(&ShellType::Bash),
+            SandboxType::WindowsRestrictedToken,
+            WindowsSandboxLevel::Elevated,
+        );
+
+        assert_eq!(rewritten, command);
+    }
+}
+
 #[cfg(all(test, unix))]
 #[path = "mod_tests.rs"]
 mod tests;
diff --git a/codex-rs/core/src/tools/runtimes/shell.rs b/codex-rs/core/src/tools/runtimes/shell.rs
index 4f6eb620aa..6251267773 100644
--- a/codex-rs/core/src/tools/runtimes/shell.rs
+++ b/codex-rs/core/src/tools/runtimes/shell.rs
@@ -21,6 +21,7 @@ use crate::tools::flat_tool_name;
 use crate::tools::network_approval::NetworkApprovalMode;
 use crate::tools::network_approval::NetworkApprovalSpec;
 use crate::tools::runtimes::build_sandbox_command;
+use crate::tools::runtimes::disable_powershell_profile_for_elevated_windows_sandbox;
 use crate::tools::runtimes::exec_env_for_sandbox_permissions;
 use crate::tools::runtimes::maybe_wrap_shell_lc_with_snapshot;
 use crate::tools::sandboxing::Approvable;
@@ -47,6 +48,7 @@ use std::collections::HashMap;
 #[derive(Clone, Debug)]
 pub struct ShellRequest {
     pub command: Vec<String>,
+    pub shell_type: Option<ShellType>,
     pub hook_command: String,
     pub cwd: AbsolutePathBuf,
     pub timeout_ms: Option<u64>,
@@ -62,19 +64,8 @@ pub struct ShellRequest {
 }
 
 /// Selects `ShellRuntime` behavior for different callers.
-///
-/// Note: `Generic` is not the same as `ShellCommandClassic`.
-/// `Generic` means "no `shell_command`-specific backend behavior" (used by the
-/// generic `shell` tool path). The `ShellCommand*` variants are only for the
-/// `shell_command` tool family.
-#[derive(Clone, Copy, Debug, Default, Eq, PartialEq)]
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
 pub(crate) enum ShellRuntimeBackend {
-    /// Tool-agnostic/default runtime path.
-    ///
-    /// Uses the normal `ShellRuntime` execution flow without enabling any
-    /// `shell_command`-specific backend selection.
-    #[default]
-    Generic,
     /// Legacy backend for the `shell_command` tool.
     ///
     /// Keeps `shell_command` on the standard shell runtime flow without the
@@ -88,7 +79,6 @@ pub(crate) enum ShellRuntimeBackend {
     ShellCommandZshFork,
 }
 
-#[derive(Default)]
 pub struct ShellRuntime {
     backend: ShellRuntimeBackend,
 }
@@ -102,12 +92,6 @@ pub(crate) struct ApprovalKey {
 }
 
 impl ShellRuntime {
-    pub fn new() -> Self {
-        Self {
-            backend: ShellRuntimeBackend::Generic,
-        }
-    }
-
     pub(crate) fn for_shell_command(backend: ShellRuntimeBackend) -> Self {
         Self { backend }
     }
@@ -255,6 +239,12 @@ impl ToolRuntime<ShellRequest, ExecToolCallOutput> for ShellRuntime {
             &req.explicit_env_overrides,
             &env,
         );
+        let command = disable_powershell_profile_for_elevated_windows_sandbox(
+            &command,
+            req.shell_type.as_ref(),
+            attempt.sandbox,
+            attempt.windows_sandbox_level,
+        );
         let command = if matches!(session_shell.shell_type, ShellType::PowerShell) {
             prefix_powershell_script_with_utf8(&command)
         } else {
diff --git a/codex-rs/core/src/tools/runtimes/shell/unix_escalation_tests.rs b/codex-rs/core/src/tools/runtimes/shell/unix_escalation_tests.rs
index 7c2aa5e8e5..43d8e46952 100644
--- a/codex-rs/core/src/tools/runtimes/shell/unix_escalation_tests.rs
+++ b/codex-rs/core/src/tools/runtimes/shell/unix_escalation_tests.rs
@@ -28,7 +28,6 @@ use codex_protocol::permissions::NetworkSandboxPolicy;
 use codex_protocol::protocol::AskForApproval;
 use codex_protocol::protocol::GranularApprovalConfig;
 use codex_protocol::protocol::GuardianCommandSource;
-use codex_protocol::protocol::SandboxPolicy;
 use codex_sandboxing::SandboxType;
 use codex_shell_escalation::EscalationExecution;
 use codex_shell_escalation::EscalationPermissions;
@@ -67,10 +66,6 @@ fn read_only_file_system_sandbox_policy() -> FileSystemSandboxPolicy {
     }])
 }
 
-fn permission_profile_from_sandbox_policy(sandbox_policy: &SandboxPolicy) -> PermissionProfile {
-    PermissionProfile::from_legacy_sandbox_policy(sandbox_policy)
-}
-
 fn test_sandbox_cwd() -> AbsolutePathBuf {
     AbsolutePathBuf::try_from(host_absolute_path(&["workspace"])).unwrap()
 }
@@ -286,7 +281,7 @@ fn shell_request_escalation_execution_is_explicit() {
             path: FileSystemPath::Path {
                 path: AbsolutePathBuf::from_absolute_path("/tmp/secret").unwrap(),
             },
-            access: FileSystemAccessMode::None,
+            access: FileSystemAccessMode::Deny,
         },
     ]);
     let network_sandbox_policy = NetworkSandboxPolicy::Restricted;
@@ -429,9 +424,7 @@ async fn execve_permission_request_hook_short_circuits_prompt() -> anyhow::Resul
         call_id: "execve-hook-call".to_string(),
         tool_name: GuardianCommandSource::Shell,
         approval_policy: AskForApproval::OnRequest,
-        permission_profile: permission_profile_from_sandbox_policy(
-            &SandboxPolicy::new_read_only_policy(),
-        ),
+        permission_profile: PermissionProfile::read_only(),
         file_system_sandbox_policy: read_only_file_system_sandbox_policy(),
         sandbox_policy_cwd: workdir.clone(),
         sandbox_permissions: SandboxPermissions::RequireEscalated,
@@ -498,9 +491,7 @@ fn evaluate_intercepted_exec_policy_uses_wrapper_command_when_shell_wrapper_pars
         ],
         InterceptedExecPolicyContext {
             approval_policy: AskForApproval::OnRequest,
-            permission_profile: permission_profile_from_sandbox_policy(
-                &SandboxPolicy::new_read_only_policy(),
-            ),
+            permission_profile: PermissionProfile::read_only(),
             file_system_sandbox_policy: &read_only_file_system_sandbox_policy(),
             sandbox_cwd: sandbox_cwd.as_path(),
             sandbox_permissions: SandboxPermissions::UseDefault,
@@ -553,9 +544,7 @@ fn evaluate_intercepted_exec_policy_matches_inner_shell_commands_when_enabled()
         ],
         InterceptedExecPolicyContext {
             approval_policy: AskForApproval::OnRequest,
-            permission_profile: permission_profile_from_sandbox_policy(
-                &SandboxPolicy::new_read_only_policy(),
-            ),
+            permission_profile: PermissionProfile::read_only(),
             file_system_sandbox_policy: &read_only_file_system_sandbox_policy(),
             sandbox_cwd: sandbox_cwd.as_path(),
             sandbox_permissions: SandboxPermissions::UseDefault,
@@ -599,9 +588,7 @@ host_executable(name = "git", paths = ["{git_path_literal}"])
         &["git".to_string(), "status".to_string()],
         InterceptedExecPolicyContext {
             approval_policy: AskForApproval::OnRequest,
-            permission_profile: permission_profile_from_sandbox_policy(
-                &SandboxPolicy::new_read_only_policy(),
-            ),
+            permission_profile: PermissionProfile::read_only(),
             file_system_sandbox_policy: &read_only_file_system_sandbox_policy(),
             sandbox_cwd: sandbox_cwd.as_path(),
             sandbox_permissions: SandboxPermissions::UseDefault,
@@ -633,7 +620,7 @@ fn intercepted_exec_policy_treats_preapproved_additional_permissions_as_default(
     let program = AbsolutePathBuf::try_from(host_absolute_path(&["usr", "bin", "printf"])).unwrap();
     let argv = ["printf".to_string(), "hello".to_string()];
     let approval_policy = AskForApproval::OnRequest;
-    let sandbox_policy = SandboxPolicy::new_workspace_write_policy();
+    let permission_profile = PermissionProfile::workspace_write();
     let file_system_sandbox_policy = read_only_file_system_sandbox_policy();
     let sandbox_cwd = test_sandbox_cwd();
 
@@ -643,7 +630,7 @@ fn intercepted_exec_policy_treats_preapproved_additional_permissions_as_default(
         &argv,
         InterceptedExecPolicyContext {
             approval_policy,
-            permission_profile: permission_profile_from_sandbox_policy(&sandbox_policy),
+            permission_profile: permission_profile.clone(),
             file_system_sandbox_policy: &file_system_sandbox_policy,
             sandbox_cwd: sandbox_cwd.as_path(),
             sandbox_permissions: super::approval_sandbox_permissions(
@@ -659,7 +646,7 @@ fn intercepted_exec_policy_treats_preapproved_additional_permissions_as_default(
         &argv,
         InterceptedExecPolicyContext {
             approval_policy,
-            permission_profile: permission_profile_from_sandbox_policy(&sandbox_policy),
+            permission_profile,
             file_system_sandbox_policy: &file_system_sandbox_policy,
             sandbox_cwd: sandbox_cwd.as_path(),
             sandbox_permissions: SandboxPermissions::WithAdditionalPermissions,
@@ -694,9 +681,7 @@ host_executable(name = "git", paths = ["{allowed_git_literal}"])
         &["git".to_string(), "status".to_string()],
         InterceptedExecPolicyContext {
             approval_policy: AskForApproval::OnRequest,
-            permission_profile: permission_profile_from_sandbox_policy(
-                &SandboxPolicy::new_read_only_policy(),
-            ),
+            permission_profile: PermissionProfile::read_only(),
             file_system_sandbox_policy: &read_only_file_system_sandbox_policy(),
             sandbox_cwd: sandbox_cwd.as_path(),
             sandbox_permissions: SandboxPermissions::UseDefault,
diff --git a/codex-rs/core/src/tools/runtimes/unified_exec.rs b/codex-rs/core/src/tools/runtimes/unified_exec.rs
index 2050ec6969..c613f198e0 100644
--- a/codex-rs/core/src/tools/runtimes/unified_exec.rs
+++ b/codex-rs/core/src/tools/runtimes/unified_exec.rs
@@ -18,6 +18,7 @@ use crate::tools::flat_tool_name;
 use crate::tools::network_approval::NetworkApprovalMode;
 use crate::tools::network_approval::NetworkApprovalSpec;
 use crate::tools::runtimes::build_sandbox_command;
+use crate::tools::runtimes::disable_powershell_profile_for_elevated_windows_sandbox;
 use crate::tools::runtimes::exec_env_for_sandbox_permissions;
 use crate::tools::runtimes::maybe_wrap_shell_lc_with_snapshot;
 use crate::tools::runtimes::shell::zsh_fork_backend;
@@ -56,6 +57,7 @@ use tokio_util::sync::CancellationToken;
 #[derive(Clone, Debug)]
 pub struct UnifiedExecRequest {
     pub command: Vec<String>,
+    pub shell_type: ShellType,
     pub hook_command: String,
     pub process_id: i32,
     pub cwd: AbsolutePathBuf,
@@ -271,6 +273,12 @@ impl<'a> ToolRuntime<UnifiedExecRequest, UnifiedExecProcess> for UnifiedExecRunt
                 &env,
             )
         };
+        let command = disable_powershell_profile_for_elevated_windows_sandbox(
+            &command,
+            Some(&req.shell_type),
+            attempt.sandbox,
+            attempt.windows_sandbox_level,
+        );
         let command = if matches!(session_shell.shell_type, ShellType::PowerShell) {
             prefix_powershell_script_with_utf8(&command)
         } else {
@@ -401,6 +409,7 @@ mod tests {
         let runtime = UnifiedExecRuntime::new(&manager, UnifiedExecShellMode::Direct);
         let request = UnifiedExecRequest {
             command: vec!["pwd".to_string()],
+            shell_type: ShellType::Sh,
             hook_command: "pwd".to_string(),
             process_id: 1000,
             cwd,
diff --git a/codex-rs/core/src/tools/sandboxing.rs b/codex-rs/core/src/tools/sandboxing.rs
index 656615d4d1..1ca589a5f9 100644
--- a/codex-rs/core/src/tools/sandboxing.rs
+++ b/codex-rs/core/src/tools/sandboxing.rs
@@ -19,8 +19,6 @@ use codex_protocol::permissions::FileSystemSandboxKind;
 use codex_protocol::permissions::FileSystemSandboxPolicy;
 use codex_protocol::protocol::AskForApproval;
 use codex_protocol::protocol::ReviewDecision;
-#[cfg(test)]
-use codex_protocol::protocol::SandboxPolicy;
 use codex_sandboxing::SandboxCommand;
 use codex_sandboxing::SandboxManager;
 use codex_sandboxing::SandboxTransformError;
diff --git a/codex-rs/core/src/tools/sandboxing_tests.rs b/codex-rs/core/src/tools/sandboxing_tests.rs
index 3989862ab5..f2e4c4cd64 100644
--- a/codex-rs/core/src/tools/sandboxing_tests.rs
+++ b/codex-rs/core/src/tools/sandboxing_tests.rs
@@ -5,7 +5,6 @@ use codex_protocol::permissions::FileSystemAccessMode;
 use codex_protocol::permissions::FileSystemPath;
 use codex_protocol::permissions::FileSystemSandboxEntry;
 use codex_protocol::protocol::GranularApprovalConfig;
-use codex_protocol::protocol::NetworkAccess;
 use pretty_assertions::assert_eq;
 use serde_json::json;
 
@@ -39,13 +38,10 @@ fn bash_permission_request_payload_includes_description_when_present() {
 
 #[test]
 fn external_sandbox_skips_exec_approval_on_request() {
-    let sandbox_policy = SandboxPolicy::ExternalSandbox {
-        network_access: NetworkAccess::Restricted,
-    };
     assert_eq!(
         default_exec_approval_requirement(
             AskForApproval::OnRequest,
-            &FileSystemSandboxPolicy::from(&sandbox_policy),
+            &FileSystemSandboxPolicy::external_sandbox(),
         ),
         ExecApprovalRequirement::Skip {
             bypass_sandbox: false,
@@ -56,11 +52,10 @@ fn external_sandbox_skips_exec_approval_on_request() {
 
 #[test]
 fn restricted_sandbox_requires_exec_approval_on_request() {
-    let sandbox_policy = SandboxPolicy::new_read_only_policy();
     assert_eq!(
         default_exec_approval_requirement(
             AskForApproval::OnRequest,
-            &FileSystemSandboxPolicy::from(&sandbox_policy)
+            &FileSystemSandboxPolicy::default()
         ),
         ExecApprovalRequirement::NeedsApproval {
             reason: None,
@@ -79,9 +74,8 @@ fn default_exec_approval_requirement_rejects_sandbox_prompt_when_granular_disabl
         mcp_elicitations: true,
     });
 
-    let sandbox_policy = SandboxPolicy::new_read_only_policy();
     let requirement =
-        default_exec_approval_requirement(policy, &FileSystemSandboxPolicy::from(&sandbox_policy));
+        default_exec_approval_requirement(policy, &FileSystemSandboxPolicy::default());
 
     assert_eq!(
         requirement,
@@ -101,9 +95,8 @@ fn default_exec_approval_requirement_keeps_prompt_when_granular_allows_sandbox_a
         mcp_elicitations: false,
     });
 
-    let sandbox_policy = SandboxPolicy::new_read_only_policy();
     let requirement =
-        default_exec_approval_requirement(policy, &FileSystemSandboxPolicy::from(&sandbox_policy));
+        default_exec_approval_requirement(policy, &FileSystemSandboxPolicy::default());
 
     assert_eq!(
         requirement,
@@ -150,7 +143,7 @@ fn deny_read_blocks_explicit_escalation_but_preserves_policy_bypass() {
         path: FileSystemPath::GlobPattern {
             pattern: "**/*.env".to_string(),
         },
-        access: FileSystemAccessMode::None,
+        access: FileSystemAccessMode::Deny,
     }]);
 
     assert_eq!(
diff --git a/codex-rs/core/src/tools/spec.rs b/codex-rs/core/src/tools/spec.rs
deleted file mode 100644
index 1eca4d1dd6..0000000000
--- a/codex-rs/core/src/tools/spec.rs
+++ /dev/null
@@ -1,68 +0,0 @@
-use crate::shell::Shell;
-use crate::shell::ShellType;
-use crate::tools::handlers::multi_agents_common::DEFAULT_WAIT_TIMEOUT_MS;
-use crate::tools::handlers::multi_agents_common::MAX_WAIT_TIMEOUT_MS;
-use crate::tools::handlers::multi_agents_common::MIN_WAIT_TIMEOUT_MS;
-use crate::tools::handlers::multi_agents_spec::WaitAgentTimeoutOptions;
-use crate::tools::registry::ToolRegistryBuilder;
-use crate::tools::spec_plan::build_tool_registry_builder;
-use crate::tools::spec_plan_types::ToolRegistryBuildParams;
-use codex_extension_api::ExtensionToolExecutor;
-use codex_mcp::ToolInfo;
-use codex_protocol::dynamic_tools::DynamicToolSpec;
-use codex_tools::DiscoverableTool;
-use codex_tools::ToolUserShellType;
-use codex_tools::ToolsConfig;
-use std::sync::Arc;
-
-pub(crate) fn tool_user_shell_type(user_shell: &Shell) -> ToolUserShellType {
-    match user_shell.shell_type {
-        ShellType::Zsh => ToolUserShellType::Zsh,
-        ShellType::Bash => ToolUserShellType::Bash,
-        ShellType::PowerShell => ToolUserShellType::PowerShell,
-        ShellType::Sh => ToolUserShellType::Sh,
-        ShellType::Cmd => ToolUserShellType::Cmd,
-    }
-}
-
-pub(crate) fn build_specs_with_discoverable_tools(
-    config: &ToolsConfig,
-    mcp_tools: Option<Vec<ToolInfo>>,
-    deferred_mcp_tools: Option<Vec<ToolInfo>>,
-    discoverable_tools: Option<Vec<DiscoverableTool>>,
-    extension_tool_executors: &[Arc<dyn ExtensionToolExecutor>],
-    dynamic_tools: &[DynamicToolSpec],
-) -> ToolRegistryBuilder {
-    let default_agent_type_description =
-        crate::agent::role::spawn_tool_spec::build(&std::collections::BTreeMap::new());
-    let min_wait_timeout_ms = if config.multi_agent_v2 {
-        config
-            .wait_agent_min_timeout_ms
-            .unwrap_or(MIN_WAIT_TIMEOUT_MS)
-            .clamp(1, MAX_WAIT_TIMEOUT_MS)
-    } else {
-        MIN_WAIT_TIMEOUT_MS
-    };
-    let default_wait_timeout_ms =
-        DEFAULT_WAIT_TIMEOUT_MS.clamp(min_wait_timeout_ms, MAX_WAIT_TIMEOUT_MS);
-    build_tool_registry_builder(
-        config,
-        ToolRegistryBuildParams {
-            mcp_tools: mcp_tools.as_deref(),
-            deferred_mcp_tools: deferred_mcp_tools.as_deref(),
-            discoverable_tools: discoverable_tools.as_deref(),
-            extension_tool_executors,
-            dynamic_tools,
-            default_agent_type_description: &default_agent_type_description,
-            wait_agent_timeouts: WaitAgentTimeoutOptions {
-                default_timeout_ms: default_wait_timeout_ms,
-                min_timeout_ms: min_wait_timeout_ms,
-                max_timeout_ms: MAX_WAIT_TIMEOUT_MS,
-            },
-        },
-    )
-}
-
-#[cfg(test)]
-#[path = "spec_tests.rs"]
-mod tests;
diff --git a/codex-rs/core/src/tools/spec_plan.rs b/codex-rs/core/src/tools/spec_plan.rs
index 86ff84f8e8..d75d56404d 100644
--- a/codex-rs/core/src/tools/spec_plan.rs
+++ b/codex-rs/core/src/tools/spec_plan.rs
@@ -1,165 +1,380 @@
+use crate::session::turn_context::TurnContext;
 use crate::tools::code_mode::execute_spec::create_code_mode_tool;
+use crate::tools::context::ToolInvocation;
 use crate::tools::handlers::ApplyPatchHandler;
 use crate::tools::handlers::CodeModeExecuteHandler;
 use crate::tools::handlers::CodeModeWaitHandler;
-use crate::tools::handlers::ContainerExecHandler;
 use crate::tools::handlers::CreateGoalHandler;
 use crate::tools::handlers::DynamicToolHandler;
-use crate::tools::handlers::ExecCommandHandler;
-use crate::tools::handlers::ExecCommandHandlerOptions;
 use crate::tools::handlers::GetGoalHandler;
 use crate::tools::handlers::ListMcpResourceTemplatesHandler;
 use crate::tools::handlers::ListMcpResourcesHandler;
-use crate::tools::handlers::LocalShellHandler;
 use crate::tools::handlers::McpHandler;
 use crate::tools::handlers::PlanHandler;
 use crate::tools::handlers::ReadMcpResourceHandler;
 use crate::tools::handlers::RequestPermissionsHandler;
 use crate::tools::handlers::RequestPluginInstallHandler;
 use crate::tools::handlers::RequestUserInputHandler;
-use crate::tools::handlers::ShellCommandHandler;
-use crate::tools::handlers::ShellCommandHandlerOptions;
-use crate::tools::handlers::ShellHandler;
 use crate::tools::handlers::TestSyncHandler;
 use crate::tools::handlers::ToolSearchHandler;
 use crate::tools::handlers::UpdateGoalHandler;
 use crate::tools::handlers::ViewImageHandler;
-use crate::tools::handlers::WriteStdinHandler;
 use crate::tools::handlers::agent_jobs::ReportAgentJobResultHandler;
 use crate::tools::handlers::agent_jobs::SpawnAgentsOnCsvHandler;
+use crate::tools::handlers::extension_tools::ExtensionToolAdapter;
 use crate::tools::handlers::multi_agents::CloseAgentHandler;
 use crate::tools::handlers::multi_agents::ResumeAgentHandler;
 use crate::tools::handlers::multi_agents::SendInputHandler;
 use crate::tools::handlers::multi_agents::SpawnAgentHandler;
 use crate::tools::handlers::multi_agents::WaitAgentHandler;
+use crate::tools::handlers::multi_agents_common::DEFAULT_WAIT_TIMEOUT_MS;
+use crate::tools::handlers::multi_agents_common::MAX_WAIT_TIMEOUT_MS;
+use crate::tools::handlers::multi_agents_common::MIN_WAIT_TIMEOUT_MS;
 use crate::tools::handlers::multi_agents_spec::SpawnAgentToolOptions;
+use crate::tools::handlers::multi_agents_spec::WaitAgentTimeoutOptions;
 use crate::tools::handlers::multi_agents_v2::CloseAgentHandler as CloseAgentHandlerV2;
 use crate::tools::handlers::multi_agents_v2::FollowupTaskHandler as FollowupTaskHandlerV2;
 use crate::tools::handlers::multi_agents_v2::ListAgentsHandler as ListAgentsHandlerV2;
 use crate::tools::handlers::multi_agents_v2::SendMessageHandler as SendMessageHandlerV2;
 use crate::tools::handlers::multi_agents_v2::SpawnAgentHandler as SpawnAgentHandlerV2;
 use crate::tools::handlers::multi_agents_v2::WaitAgentHandler as WaitAgentHandlerV2;
-use crate::tools::handlers::shell_spec::ShellToolOptions;
 use crate::tools::handlers::view_image_spec::ViewImageToolOptions;
 use crate::tools::hosted_spec::WebSearchToolOptions;
 use crate::tools::hosted_spec::create_image_generation_tool;
 use crate::tools::hosted_spec::create_web_search_tool;
-use crate::tools::registry::AnyToolHandler;
-use crate::tools::registry::ToolRegistryBuilder;
-use crate::tools::spec_plan_types::ToolRegistryBuildParams;
-use crate::tools::spec_plan_types::agent_type_description;
-use codex_extension_api::ExtensionToolExecutor;
-use codex_protocol::openai_models::ConfigShellToolType;
+use crate::tools::registry::CoreToolRuntime;
+use crate::tools::registry::ToolExposure;
+use crate::tools::registry::ToolRegistry;
+use crate::tools::registry::override_tool_exposure;
+use crate::tools::router::ToolRouter;
+use crate::tools::router::ToolRouterParams;
+use crate::tools::tool_family::shell::ShellToolsOptions;
+use crate::tools::tool_family::shell::build_shell_tools;
+use codex_features::Feature;
+use codex_login::AuthManager;
+use codex_mcp::ToolInfo;
+use codex_protocol::dynamic_tools::DynamicToolSpec;
+use codex_protocol::openai_models::InputModality;
+use codex_protocol::protocol::SessionSource;
+use codex_protocol::protocol::SubAgentSource;
+use codex_tools::DiscoverableTool;
+use codex_tools::ResponsesApiNamespace;
 use codex_tools::ResponsesApiNamespaceTool;
+use codex_tools::TOOL_SEARCH_TOOL_NAME;
+use codex_tools::ToolCall as ExtensionToolCall;
 use codex_tools::ToolEnvironmentMode;
+use codex_tools::ToolExecutor;
 use codex_tools::ToolName;
+use codex_tools::ToolOutput;
 use codex_tools::ToolSpec;
-use codex_tools::ToolsConfig;
+use codex_tools::can_request_original_image_detail;
 use codex_tools::collect_code_mode_exec_prompt_tool_definitions;
 use codex_tools::default_namespace_description;
+use codex_tools::request_user_input_available_modes;
+use codex_tools::shell_command_backend_for_features;
+use codex_tools::shell_type_for_model_and_features;
 use std::collections::BTreeMap;
 use std::collections::HashSet;
 use std::sync::Arc;
+use tracing::warn;
 
-pub fn build_tool_registry_builder(
-    config: &ToolsConfig,
-    params: ToolRegistryBuildParams<'_>,
-) -> ToolRegistryBuilder {
-    let mut builder = ToolRegistryBuilder::new();
-    let all_deferred_tools = params
-        .deferred_mcp_tools
-        .into_iter()
-        .flatten()
-        .map(codex_mcp::ToolInfo::canonical_tool_name)
-        .chain(
-            params
-                .dynamic_tools
-                .iter()
-                .filter(|tool| tool.defer_loading)
-                .map(|tool| ToolName::new(tool.namespace.clone(), tool.name.clone())),
-        )
-        .collect::<HashSet<_>>();
-    let handlers = collect_handler_tools(config, params);
+const MULTI_AGENT_V2_NAMESPACE_DESCRIPTION: &str = "Tools for spawning and managing sub-agents.";
 
-    for handler in build_code_mode_handlers(
-        config,
-        &handlers,
-        params.extension_tool_executors,
-        config.search_tool && !all_deferred_tools.is_empty(),
-    ) {
-        builder.register_any_handler(handler);
-    }
+type PlannedRuntime = Arc<dyn CoreToolRuntime>;
 
-    let mut non_deferred_specs = Vec::new();
-    let mut deferred_search_infos = Vec::new();
-    for handler in &handlers {
-        let tool_name = handler.tool_name();
-        if all_deferred_tools.contains(&tool_name) {
-            if let Some(search_info) = handler.search_info() {
-                deferred_search_infos.push(search_info);
-            }
-        } else if let Some(spec) = handler.spec() {
-            non_deferred_specs.push(spec);
-        }
-    }
-
-    if let Some(web_search_tool) = create_web_search_tool(WebSearchToolOptions {
-        web_search_mode: config.web_search_mode,
-        web_search_config: config.web_search_config.as_ref(),
-        web_search_tool_type: config.web_search_tool_type,
-    }) {
-        non_deferred_specs.push(web_search_tool);
-    }
-    if config.image_gen_tool {
-        non_deferred_specs.push(create_image_generation_tool("png"));
-    }
-
-    for spec in merge_into_namespaces(non_deferred_specs) {
-        if !config.namespace_tools && matches!(spec, ToolSpec::Namespace(_)) {
-            continue;
-        }
-        let spec = if config.code_mode_enabled {
-            codex_tools::augment_tool_spec_for_code_mode(spec)
-        } else {
-            spec
-        };
-        builder.push_spec(spec);
-    }
-
-    for handler in handlers {
-        builder.register_any_handler_without_spec(handler);
-    }
-
-    if config.search_tool && config.namespace_tools && !deferred_search_infos.is_empty() {
-        builder.register_handler(Arc::new(ToolSearchHandler::new(deferred_search_infos)));
-    }
-
-    for executor in params.extension_tool_executors.iter().cloned() {
-        builder.register_extension_tool_executor(executor);
-    }
-
-    builder
+#[derive(Default)]
+struct PlannedTools {
+    runtimes: Vec<PlannedRuntime>,
+    hosted_specs: Vec<ToolSpec>,
 }
 
-fn build_code_mode_handlers(
-    config: &ToolsConfig,
-    handlers: &[Arc<dyn AnyToolHandler>],
-    extension_tool_executors: &[Arc<dyn ExtensionToolExecutor>],
+impl PlannedTools {
+    fn add_runtime<T>(&mut self, runtime: T)
+    where
+        T: CoreToolRuntime + 'static,
+    {
+        self.runtimes.push(Arc::new(runtime));
+    }
+
+    fn add_runtime_arc(&mut self, runtime: PlannedRuntime) {
+        self.runtimes.push(runtime);
+    }
+
+    fn runtimes(&self) -> &[PlannedRuntime] {
+        &self.runtimes
+    }
+}
+
+#[derive(Clone, Copy)]
+struct CoreToolPlanContext<'a> {
+    turn_context: &'a TurnContext,
+    mcp_tools: Option<&'a [ToolInfo]>,
+    deferred_mcp_tools: Option<&'a [ToolInfo]>,
+    discoverable_tools: Option<&'a [DiscoverableTool]>,
+    extension_tool_executors: &'a [Arc<dyn ToolExecutor<ExtensionToolCall>>],
+    dynamic_tools: &'a [DynamicToolSpec],
+    default_agent_type_description: &'a str,
+    wait_agent_timeouts: WaitAgentTimeoutOptions,
+}
+
+pub(crate) fn build_tool_router(
+    turn_context: &TurnContext,
+    params: ToolRouterParams<'_>,
+) -> ToolRouter {
+    let (model_visible_specs, registry) = build_tool_specs_and_registry(turn_context, params);
+    ToolRouter::from_parts(registry, model_visible_specs)
+}
+
+fn build_tool_specs_and_registry(
+    turn_context: &TurnContext,
+    params: ToolRouterParams<'_>,
+) -> (Vec<ToolSpec>, ToolRegistry) {
+    let ToolRouterParams {
+        mcp_tools,
+        deferred_mcp_tools,
+        discoverable_tools,
+        extension_tool_executors,
+        dynamic_tools,
+    } = params;
+    let default_agent_type_description =
+        crate::agent::role::spawn_tool_spec::build(&std::collections::BTreeMap::new());
+    let context = CoreToolPlanContext {
+        turn_context,
+        mcp_tools: mcp_tools.as_deref(),
+        deferred_mcp_tools: deferred_mcp_tools.as_deref(),
+        discoverable_tools: discoverable_tools.as_deref(),
+        extension_tool_executors: &extension_tool_executors,
+        dynamic_tools,
+        default_agent_type_description: &default_agent_type_description,
+        wait_agent_timeouts: wait_agent_timeout_options(turn_context),
+    };
+    let mut planned_tools = PlannedTools::default();
+    add_tool_sources(&context, &mut planned_tools);
+    append_tool_search_executor(&context, &mut planned_tools);
+    prepend_code_mode_executors(&context, &mut planned_tools);
+    build_model_visible_specs_and_registry(turn_context, planned_tools)
+}
+
+fn build_model_visible_specs_and_registry(
+    turn_context: &TurnContext,
+    planned_tools: PlannedTools,
+) -> (Vec<ToolSpec>, ToolRegistry) {
+    let PlannedTools {
+        runtimes,
+        hosted_specs,
+    } = planned_tools;
+    let mut specs = Vec::new();
+    let mut seen_tool_names = HashSet::new();
+    for runtime in &runtimes {
+        let tool_name = runtime.tool_name();
+        if !seen_tool_names.insert(tool_name.clone()) {
+            continue;
+        }
+        let exposure = runtime.exposure();
+        if exposure.is_direct()
+            && !is_hidden_by_code_mode_only(turn_context, &tool_name, exposure)
+            && let Some(spec) = runtime.spec()
+        {
+            specs.push(spec_for_model_request(turn_context, exposure, spec));
+        }
+    }
+    for spec in hosted_specs {
+        if !is_hidden_by_code_mode_only(
+            turn_context,
+            &ToolName::plain(spec.name()),
+            ToolExposure::Direct,
+        ) {
+            specs.push(spec);
+        }
+    }
+
+    let registry = ToolRegistry::from_tools(runtimes);
+    let model_visible_specs = merge_into_namespaces(specs)
+        .into_iter()
+        .filter(|spec| {
+            namespace_tools_enabled(turn_context) || !matches!(spec, ToolSpec::Namespace(_))
+        })
+        .collect();
+
+    (model_visible_specs, registry)
+}
+
+fn spec_for_model_request(
+    turn_context: &TurnContext,
+    exposure: ToolExposure,
+    spec: ToolSpec,
+) -> ToolSpec {
+    if code_mode_enabled(turn_context)
+        && exposure != ToolExposure::DirectModelOnly
+        && codex_code_mode::is_code_mode_nested_tool(spec.name())
+    {
+        codex_tools::augment_tool_spec_for_code_mode(spec)
+    } else {
+        spec
+    }
+}
+
+pub(crate) fn hosted_model_tool_specs(turn_context: &TurnContext) -> Vec<ToolSpec> {
+    let mut specs = Vec::new();
+    let provider_capabilities = turn_context.provider.capabilities();
+    let web_search_mode = provider_capabilities
+        .web_search
+        .then_some(turn_context.config.web_search_mode.value());
+    let web_search_config = if provider_capabilities.web_search {
+        turn_context.config.web_search_config.as_ref()
+    } else {
+        None
+    };
+    if let Some(web_search_tool) = create_web_search_tool(WebSearchToolOptions {
+        web_search_mode,
+        web_search_config,
+        web_search_tool_type: turn_context.model_info.web_search_tool_type,
+    }) {
+        specs.push(web_search_tool);
+    }
+    if image_generation_tool_enabled(turn_context) {
+        specs.push(create_image_generation_tool("png"));
+    }
+    specs
+}
+
+pub(crate) fn search_tool_enabled(turn_context: &TurnContext) -> bool {
+    turn_context.model_info.supports_search_tool
+}
+
+pub(crate) fn tool_suggest_enabled(turn_context: &TurnContext) -> bool {
+    let features = turn_context.features.get();
+    features.enabled(Feature::ToolSuggest)
+        && features.enabled(Feature::Apps)
+        && features.enabled(Feature::Plugins)
+}
+
+fn namespace_tools_enabled(turn_context: &TurnContext) -> bool {
+    turn_context.provider.capabilities().namespace_tools
+}
+
+fn code_mode_enabled(turn_context: &TurnContext) -> bool {
+    turn_context.features.get().enabled(Feature::CodeMode)
+}
+
+fn code_mode_only_enabled(turn_context: &TurnContext) -> bool {
+    code_mode_enabled(turn_context) && turn_context.features.get().enabled(Feature::CodeModeOnly)
+}
+
+fn multi_agent_v2_enabled(turn_context: &TurnContext) -> bool {
+    turn_context.features.get().enabled(Feature::MultiAgentV2)
+}
+
+fn collab_tools_enabled(turn_context: &TurnContext) -> bool {
+    multi_agent_v2_enabled(turn_context) || turn_context.features.get().enabled(Feature::Collab)
+}
+
+fn goal_tools_enabled(turn_context: &TurnContext) -> bool {
+    turn_context.goal_tools_enabled()
+        && !matches!(
+            turn_context.session_source,
+            SessionSource::SubAgent(SubAgentSource::Review)
+        )
+}
+
+fn agent_jobs_tools_enabled(turn_context: &TurnContext) -> bool {
+    turn_context.features.get().enabled(Feature::SpawnCsv)
+}
+
+fn agent_jobs_worker_tools_enabled(turn_context: &TurnContext) -> bool {
+    agent_jobs_tools_enabled(turn_context)
+        && matches!(
+            &turn_context.session_source,
+            SessionSource::SubAgent(SubAgentSource::Other(label))
+                if label.starts_with("agent_job:")
+        )
+}
+
+fn image_generation_tool_enabled(turn_context: &TurnContext) -> bool {
+    turn_context
+        .auth_manager
+        .as_deref()
+        .is_some_and(AuthManager::current_auth_uses_codex_backend)
+        && turn_context.provider.capabilities().image_generation
+        && turn_context
+            .features
+            .get()
+            .enabled(Feature::ImageGeneration)
+        && turn_context
+            .model_info
+            .input_modalities
+            .contains(&InputModality::Image)
+}
+
+fn wait_agent_timeout_options(turn_context: &TurnContext) -> WaitAgentTimeoutOptions {
+    if multi_agent_v2_enabled(turn_context) {
+        return WaitAgentTimeoutOptions {
+            default_timeout_ms: turn_context.config.multi_agent_v2.default_wait_timeout_ms,
+            min_timeout_ms: turn_context.config.multi_agent_v2.min_wait_timeout_ms,
+            max_timeout_ms: turn_context.config.multi_agent_v2.max_wait_timeout_ms,
+        };
+    }
+
+    WaitAgentTimeoutOptions {
+        default_timeout_ms: DEFAULT_WAIT_TIMEOUT_MS,
+        min_timeout_ms: MIN_WAIT_TIMEOUT_MS,
+        max_timeout_ms: MAX_WAIT_TIMEOUT_MS,
+    }
+}
+
+fn max_concurrent_threads_per_session(turn_context: &TurnContext) -> Option<usize> {
+    multi_agent_v2_enabled(turn_context).then_some(
+        turn_context
+            .config
+            .multi_agent_v2
+            .max_concurrent_threads_per_session,
+    )
+}
+
+fn agent_type_description(
+    turn_context: &TurnContext,
+    default_agent_type_description: &str,
+) -> String {
+    let agent_type_description =
+        crate::agent::role::spawn_tool_spec::build(&turn_context.config.agent_roles);
+    if agent_type_description.is_empty() {
+        default_agent_type_description.to_string()
+    } else {
+        agent_type_description
+    }
+}
+
+fn is_hidden_by_code_mode_only(
+    turn_context: &TurnContext,
+    tool_name: &ToolName,
+    exposure: ToolExposure,
+) -> bool {
+    code_mode_only_enabled(turn_context)
+        && exposure != ToolExposure::DirectModelOnly
+        && codex_code_mode::is_code_mode_nested_tool(&codex_tools::code_mode_name_for_tool_name(
+            tool_name,
+        ))
+}
+
+fn build_code_mode_executors(
+    turn_context: &TurnContext,
+    executors: &[Arc<dyn CoreToolRuntime>],
     deferred_tools_available: bool,
-) -> Vec<Arc<dyn AnyToolHandler>> {
-    if !config.code_mode_enabled {
+) -> Vec<Arc<dyn CoreToolRuntime>> {
+    if !code_mode_enabled(turn_context) {
         return vec![];
     }
 
-    let mut code_mode_nested_tool_specs = handlers
+    let code_mode_nested_tool_specs = executors
         .iter()
-        .filter_map(|handler| handler.spec())
+        .filter_map(|executor| {
+            if executor.exposure() == ToolExposure::DirectModelOnly {
+                return None;
+            }
+
+            executor.spec()
+        })
         .collect::<Vec<_>>();
-    code_mode_nested_tool_specs.extend(
-        extension_tool_executors
-            .iter()
-            .filter_map(|executor| executor.spec()),
-    );
     let namespace_descriptions = code_mode_namespace_descriptions(&code_mode_nested_tool_specs);
     let mut enabled_tools =
         collect_code_mode_exec_prompt_tool_definitions(code_mode_nested_tool_specs.iter());
@@ -171,7 +386,7 @@ fn build_code_mode_handlers(
             create_code_mode_tool(
                 &enabled_tools,
                 &namespace_descriptions,
-                config.code_mode_only_enabled,
+                code_mode_only_enabled(turn_context),
                 deferred_tools_available,
             ),
             code_mode_nested_tool_specs,
@@ -248,194 +463,213 @@ fn code_mode_namespace_descriptions(
     namespace_descriptions
 }
 
-fn collect_handler_tools(
-    config: &ToolsConfig,
-    params: ToolRegistryBuildParams<'_>,
-) -> Vec<Arc<dyn AnyToolHandler>> {
-    let exec_permission_approvals_enabled = config.exec_permission_approvals_enabled;
-    let mut handlers = Vec::<Arc<dyn AnyToolHandler>>::new();
+fn add_tool_sources(context: &CoreToolPlanContext<'_>, planned_tools: &mut PlannedTools) {
+    add_shell_tools(context, planned_tools);
+    add_mcp_resource_tools(context, planned_tools);
+    add_core_utility_tools(context, planned_tools);
+    add_collaboration_tools(context, planned_tools);
+    add_mcp_runtime_tools(context, planned_tools);
+    add_dynamic_tools(context, planned_tools);
+    add_extension_tools(context, planned_tools);
+    planned_tools
+        .hosted_specs
+        .extend(hosted_model_tool_specs(context.turn_context));
+}
 
-    if config.environment_mode.has_environment() {
-        let include_environment_id =
-            matches!(config.environment_mode, ToolEnvironmentMode::Multiple);
-        match &config.shell_type {
-            ConfigShellToolType::Default => {
-                handlers.push(Arc::new(ShellHandler::new(ShellToolOptions {
-                    exec_permission_approvals_enabled,
-                })));
-            }
-            ConfigShellToolType::Local => {
-                handlers.push(Arc::new(LocalShellHandler::new()));
-            }
-            ConfigShellToolType::UnifiedExec => {
-                handlers.push(Arc::new(ExecCommandHandler::new(
-                    ExecCommandHandlerOptions {
-                        allow_login_shell: config.allow_login_shell,
-                        exec_permission_approvals_enabled,
-                        include_environment_id,
-                    },
-                )));
-                handlers.push(Arc::new(WriteStdinHandler));
-            }
-            ConfigShellToolType::Disabled => {}
-            ConfigShellToolType::ShellCommand => {
-                handlers.push(Arc::new(ShellCommandHandler::new(
-                    ShellCommandHandlerOptions {
-                        backend_config: config.shell_command_backend,
-                        allow_login_shell: config.allow_login_shell,
-                        exec_permission_approvals_enabled,
-                    },
-                )));
-            }
-        }
+fn add_shell_tools(context: &CoreToolPlanContext<'_>, planned_tools: &mut PlannedTools) {
+    let turn_context = context.turn_context;
+    let features = turn_context.features.get();
+    planned_tools
+        .runtimes
+        .extend(build_shell_tools(ShellToolsOptions {
+            shell_type: shell_type_for_model_and_features(&turn_context.model_info, features),
+            shell_command_backend: shell_command_backend_for_features(features),
+            environment_mode: turn_context.tool_environment_mode(),
+            allow_login_shell: turn_context.config.permissions.allow_login_shell,
+            exec_permission_approvals_enabled: features.enabled(Feature::ExecPermissionApprovals),
+        }));
+}
+
+fn add_mcp_resource_tools(context: &CoreToolPlanContext<'_>, planned_tools: &mut PlannedTools) {
+    if context.mcp_tools.is_some() {
+        planned_tools.add_runtime(ListMcpResourcesHandler);
+        planned_tools.add_runtime(ListMcpResourceTemplatesHandler);
+        planned_tools.add_runtime(ReadMcpResourceHandler);
+    }
+}
+
+fn add_core_utility_tools(context: &CoreToolPlanContext<'_>, planned_tools: &mut PlannedTools) {
+    let turn_context = context.turn_context;
+    let features = turn_context.features.get();
+    let environment_mode = turn_context.tool_environment_mode();
+
+    planned_tools.add_runtime(PlanHandler);
+    if goal_tools_enabled(turn_context) {
+        planned_tools.add_runtime(GetGoalHandler);
+        planned_tools.add_runtime(CreateGoalHandler);
+        planned_tools.add_runtime(UpdateGoalHandler);
     }
 
-    if config.environment_mode.has_environment()
-        && config.shell_type != ConfigShellToolType::Disabled
-    {
-        match &config.shell_type {
-            ConfigShellToolType::Default => {
-                handlers.push(Arc::new(ContainerExecHandler));
-                handlers.push(Arc::new(LocalShellHandler::default()));
-                handlers.push(Arc::new(ShellCommandHandler::from(
-                    config.shell_command_backend,
-                )));
-            }
-            ConfigShellToolType::Local => {
-                handlers.push(Arc::new(ShellHandler::default()));
-                handlers.push(Arc::new(ContainerExecHandler));
-                handlers.push(Arc::new(ShellCommandHandler::from(
-                    config.shell_command_backend,
-                )));
-            }
-            ConfigShellToolType::UnifiedExec => {
-                handlers.push(Arc::new(ShellHandler::default()));
-                handlers.push(Arc::new(ContainerExecHandler));
-                handlers.push(Arc::new(LocalShellHandler::default()));
-                handlers.push(Arc::new(ShellCommandHandler::from(
-                    config.shell_command_backend,
-                )));
-            }
-            ConfigShellToolType::ShellCommand => {
-                handlers.push(Arc::new(ShellHandler::default()));
-                handlers.push(Arc::new(ContainerExecHandler));
-                handlers.push(Arc::new(LocalShellHandler::default()));
-            }
-            ConfigShellToolType::Disabled => {}
-        }
+    planned_tools.add_runtime(RequestUserInputHandler {
+        available_modes: request_user_input_available_modes(features),
+    });
+
+    if features.enabled(Feature::RequestPermissionsTool) {
+        planned_tools.add_runtime(RequestPermissionsHandler);
     }
 
-    if params.mcp_tools.is_some() {
-        handlers.push(Arc::new(ListMcpResourcesHandler));
-        handlers.push(Arc::new(ListMcpResourceTemplatesHandler));
-        handlers.push(Arc::new(ReadMcpResourceHandler));
-    }
-
-    handlers.push(Arc::new(PlanHandler));
-    if config.goal_tools {
-        handlers.push(Arc::new(GetGoalHandler));
-        handlers.push(Arc::new(CreateGoalHandler));
-        handlers.push(Arc::new(UpdateGoalHandler));
-    }
-
-    handlers.push(Arc::new(RequestUserInputHandler {
-        available_modes: config.request_user_input_available_modes.clone(),
-    }));
-
-    if config.request_permissions_tool_enabled {
-        handlers.push(Arc::new(RequestPermissionsHandler));
-    }
-
-    if config.tool_suggest
+    if tool_suggest_enabled(turn_context)
         && let Some(discoverable_tools) =
-            params.discoverable_tools.filter(|tools| !tools.is_empty())
+            context.discoverable_tools.filter(|tools| !tools.is_empty())
     {
-        handlers.push(Arc::new(RequestPluginInstallHandler::new(
-            discoverable_tools,
-        )));
+        planned_tools.add_runtime(RequestPluginInstallHandler::new(discoverable_tools));
     }
 
-    if config.environment_mode.has_environment() && config.apply_patch_tool_type.is_some() {
-        let include_environment_id =
-            matches!(config.environment_mode, ToolEnvironmentMode::Multiple);
-        handlers.push(Arc::new(ApplyPatchHandler::new(include_environment_id)));
+    if environment_mode.has_environment() && turn_context.model_info.apply_patch_tool_type.is_some()
+    {
+        let include_environment_id = matches!(environment_mode, ToolEnvironmentMode::Multiple);
+        planned_tools.add_runtime(ApplyPatchHandler::new(include_environment_id));
     }
 
-    if config
+    if turn_context
+        .model_info
         .experimental_supported_tools
         .iter()
         .any(|tool| tool == "test_sync_tool")
     {
-        handlers.push(Arc::new(TestSyncHandler));
+        planned_tools.add_runtime(TestSyncHandler);
     }
 
-    if config.environment_mode.has_environment() {
-        let include_environment_id =
-            matches!(config.environment_mode, ToolEnvironmentMode::Multiple);
-        handlers.push(Arc::new(ViewImageHandler::new(ViewImageToolOptions {
-            can_request_original_image_detail: config.can_request_original_image_detail,
+    if environment_mode.has_environment() {
+        let include_environment_id = matches!(environment_mode, ToolEnvironmentMode::Multiple);
+        planned_tools.add_runtime(ViewImageHandler::new(ViewImageToolOptions {
+            can_request_original_image_detail: can_request_original_image_detail(
+                &turn_context.model_info,
+            ),
             include_environment_id,
-        })));
+        }));
     }
+}
 
-    if config.collab_tools {
-        if config.multi_agent_v2 {
+fn add_collaboration_tools(context: &CoreToolPlanContext<'_>, planned_tools: &mut PlannedTools) {
+    let turn_context = context.turn_context;
+    if collab_tools_enabled(turn_context) {
+        if multi_agent_v2_enabled(turn_context) {
+            let exposure = if turn_context.config.multi_agent_v2.non_code_mode_only {
+                ToolExposure::DirectModelOnly
+            } else {
+                ToolExposure::Direct
+            };
+            let tool_namespace = namespace_tools_enabled(turn_context)
+                .then_some(turn_context.config.multi_agent_v2.tool_namespace.as_deref())
+                .flatten();
             let agent_type_description =
-                agent_type_description(config, params.default_agent_type_description);
-            handlers.push(Arc::new(SpawnAgentHandlerV2::new(SpawnAgentToolOptions {
-                available_models: config.available_models.clone(),
-                agent_type_description,
-                hide_agent_type_model_reasoning: config.hide_spawn_agent_metadata,
-                include_usage_hint: config.spawn_agent_usage_hint,
-                usage_hint_text: config.spawn_agent_usage_hint_text.clone(),
-                max_concurrent_threads_per_session: config.max_concurrent_threads_per_session,
-            })));
-            handlers.push(Arc::new(SendMessageHandlerV2));
-            handlers.push(Arc::new(FollowupTaskHandlerV2));
-            handlers.push(Arc::new(WaitAgentHandlerV2::new(
-                params.wait_agent_timeouts,
-            )));
-            handlers.push(Arc::new(CloseAgentHandlerV2));
-            handlers.push(Arc::new(ListAgentsHandlerV2));
+                agent_type_description(turn_context, context.default_agent_type_description);
+            planned_tools.add_runtime_arc(multi_agent_v2_handler(
+                SpawnAgentHandlerV2::new(SpawnAgentToolOptions {
+                    available_models: turn_context.available_models.clone(),
+                    agent_type_description,
+                    hide_agent_type_model_reasoning: turn_context
+                        .config
+                        .multi_agent_v2
+                        .hide_spawn_agent_metadata,
+                    include_usage_hint: turn_context.config.multi_agent_v2.usage_hint_enabled,
+                    usage_hint_text: turn_context.config.multi_agent_v2.usage_hint_text.clone(),
+                    max_concurrent_threads_per_session: max_concurrent_threads_per_session(
+                        turn_context,
+                    ),
+                }),
+                exposure,
+                tool_namespace,
+            ));
+            planned_tools.add_runtime_arc(multi_agent_v2_handler(
+                SendMessageHandlerV2,
+                exposure,
+                tool_namespace,
+            ));
+            planned_tools.add_runtime_arc(multi_agent_v2_handler(
+                FollowupTaskHandlerV2,
+                exposure,
+                tool_namespace,
+            ));
+            planned_tools.add_runtime_arc(multi_agent_v2_handler(
+                WaitAgentHandlerV2::new(context.wait_agent_timeouts),
+                exposure,
+                tool_namespace,
+            ));
+            planned_tools.add_runtime_arc(multi_agent_v2_handler(
+                CloseAgentHandlerV2,
+                exposure,
+                tool_namespace,
+            ));
+            planned_tools.add_runtime_arc(multi_agent_v2_handler(
+                ListAgentsHandlerV2,
+                exposure,
+                tool_namespace,
+            ));
         } else {
             let agent_type_description =
-                agent_type_description(config, params.default_agent_type_description);
-            handlers.push(Arc::new(SpawnAgentHandler::new(SpawnAgentToolOptions {
-                available_models: config.available_models.clone(),
-                agent_type_description,
-                hide_agent_type_model_reasoning: config.hide_spawn_agent_metadata,
-                include_usage_hint: config.spawn_agent_usage_hint,
-                usage_hint_text: config.spawn_agent_usage_hint_text.clone(),
-                max_concurrent_threads_per_session: config.max_concurrent_threads_per_session,
-            })));
-            handlers.push(Arc::new(SendInputHandler));
-            handlers.push(Arc::new(ResumeAgentHandler));
-            handlers.push(Arc::new(WaitAgentHandler::new(params.wait_agent_timeouts)));
-            handlers.push(Arc::new(CloseAgentHandler));
+                agent_type_description(turn_context, context.default_agent_type_description);
+            let exposure =
+                if search_tool_enabled(turn_context) && namespace_tools_enabled(turn_context) {
+                    ToolExposure::Deferred
+                } else {
+                    ToolExposure::Direct
+                };
+            planned_tools.add_runtime_arc(multi_agent_v1_handler(
+                SpawnAgentHandler::new(SpawnAgentToolOptions {
+                    available_models: turn_context.available_models.clone(),
+                    agent_type_description,
+                    hide_agent_type_model_reasoning: turn_context
+                        .config
+                        .multi_agent_v2
+                        .hide_spawn_agent_metadata,
+                    include_usage_hint: turn_context.config.multi_agent_v2.usage_hint_enabled,
+                    usage_hint_text: turn_context.config.multi_agent_v2.usage_hint_text.clone(),
+                    max_concurrent_threads_per_session: max_concurrent_threads_per_session(
+                        turn_context,
+                    ),
+                }),
+                exposure,
+            ));
+            planned_tools.add_runtime_arc(multi_agent_v1_handler(SendInputHandler, exposure));
+            planned_tools.add_runtime_arc(multi_agent_v1_handler(ResumeAgentHandler, exposure));
+            planned_tools.add_runtime_arc(multi_agent_v1_handler(
+                WaitAgentHandler::new(context.wait_agent_timeouts),
+                exposure,
+            ));
+            planned_tools.add_runtime_arc(multi_agent_v1_handler(CloseAgentHandler, exposure));
         }
     }
 
-    if config.agent_jobs_tools {
-        handlers.push(Arc::new(SpawnAgentsOnCsvHandler));
-        if config.agent_jobs_worker_tools {
-            handlers.push(Arc::new(ReportAgentJobResultHandler));
+    if agent_jobs_tools_enabled(turn_context) {
+        planned_tools.add_runtime(SpawnAgentsOnCsvHandler);
+        if agent_jobs_worker_tools_enabled(turn_context) {
+            planned_tools.add_runtime(ReportAgentJobResultHandler);
         }
     }
+}
 
-    if let Some(mcp_tools) = params.mcp_tools {
+fn add_mcp_runtime_tools(context: &CoreToolPlanContext<'_>, planned_tools: &mut PlannedTools) {
+    if let Some(mcp_tools) = context.mcp_tools {
         for tool in mcp_tools {
-            handlers.push(Arc::new(McpHandler::new(tool.clone())));
+            planned_tools.add_runtime(McpHandler::new(tool.clone()));
         }
     }
 
-    if let Some(deferred_mcp_tools) = params.deferred_mcp_tools {
+    if let Some(deferred_mcp_tools) = context.deferred_mcp_tools {
         for tool in deferred_mcp_tools {
-            handlers.push(Arc::new(McpHandler::new(tool.clone())));
+            planned_tools.add_runtime(McpHandler::with_exposure(
+                tool.clone(),
+                ToolExposure::Deferred,
+            ));
         }
     }
+}
 
-    for tool in params.dynamic_tools {
-        let Some(handler) = DynamicToolHandler::new(tool).map(Arc::new) else {
+fn add_dynamic_tools(context: &CoreToolPlanContext<'_>, planned_tools: &mut PlannedTools) {
+    for tool in context.dynamic_tools {
+        let Some(handler) = DynamicToolHandler::new(tool) else {
             tracing::error!(
                 "Failed to convert dynamic tool {:?} to OpenAI tool",
                 tool.name
@@ -443,10 +677,172 @@ fn collect_handler_tools(
             continue;
         };
 
-        handlers.push(handler);
+        planned_tools.add_runtime(handler);
+    }
+}
+
+fn add_extension_tools(context: &CoreToolPlanContext<'_>, planned_tools: &mut PlannedTools) {
+    // Extension ToolContributor implementations are resolved into executors
+    // before planning. Core only adapts those executors into its runtime set.
+    append_extension_tool_executors(
+        context.turn_context,
+        context.extension_tool_executors,
+        planned_tools,
+    );
+}
+
+fn append_tool_search_executor(
+    context: &CoreToolPlanContext<'_>,
+    planned_tools: &mut PlannedTools,
+) {
+    let turn_context = context.turn_context;
+    if !(search_tool_enabled(turn_context) && namespace_tools_enabled(turn_context)) {
+        return;
     }
 
-    handlers
+    let search_infos = planned_tools
+        .runtimes()
+        .iter()
+        .filter(|executor| executor.exposure() == ToolExposure::Deferred)
+        .filter_map(|executor| executor.search_info())
+        .collect::<Vec<_>>();
+    if search_infos.is_empty() {
+        return;
+    }
+
+    planned_tools.add_runtime(ToolSearchHandler::new(search_infos));
+}
+
+fn prepend_code_mode_executors(
+    context: &CoreToolPlanContext<'_>,
+    planned_tools: &mut PlannedTools,
+) {
+    let turn_context = context.turn_context;
+    let deferred_tools_available = search_tool_enabled(turn_context)
+        && planned_tools
+            .runtimes()
+            .iter()
+            .any(|executor| executor.exposure() == ToolExposure::Deferred);
+    let code_mode_executors = build_code_mode_executors(
+        turn_context,
+        planned_tools.runtimes(),
+        deferred_tools_available,
+    );
+    planned_tools.runtimes.splice(0..0, code_mode_executors);
+}
+
+fn append_extension_tool_executors(
+    turn_context: &TurnContext,
+    executors: &[Arc<dyn ToolExecutor<ExtensionToolCall>>],
+    planned_tools: &mut PlannedTools,
+) {
+    if executors.is_empty() {
+        return;
+    }
+
+    let mut reserved_tool_names = planned_tools
+        .runtimes()
+        .iter()
+        .map(|executor| executor.tool_name())
+        .collect::<HashSet<_>>();
+    if code_mode_enabled(turn_context) {
+        reserved_tool_names.insert(ToolName::plain(codex_code_mode::PUBLIC_TOOL_NAME));
+        reserved_tool_names.insert(ToolName::plain(codex_code_mode::WAIT_TOOL_NAME));
+    }
+    if search_tool_enabled(turn_context)
+        && namespace_tools_enabled(turn_context)
+        && planned_tools
+            .runtimes()
+            .iter()
+            .any(|executor| executor.exposure() == ToolExposure::Deferred)
+    {
+        reserved_tool_names.insert(ToolName::plain(TOOL_SEARCH_TOOL_NAME));
+    }
+
+    for executor in executors.iter().cloned() {
+        let tool_name = executor.tool_name();
+        if !reserved_tool_names.insert(tool_name.clone()) {
+            warn!("Skipping extension tool `{tool_name}`: tool already registered");
+            continue;
+        }
+        planned_tools.add_runtime(ExtensionToolAdapter::new(executor));
+    }
+}
+
+fn multi_agent_v1_handler(
+    handler: impl CoreToolRuntime + 'static,
+    exposure: ToolExposure,
+) -> Arc<dyn CoreToolRuntime> {
+    override_tool_exposure(Arc::new(handler), exposure)
+}
+
+fn multi_agent_v2_handler(
+    handler: impl CoreToolRuntime + 'static,
+    exposure: ToolExposure,
+    namespace: Option<&str>,
+) -> Arc<dyn CoreToolRuntime> {
+    let handler: Arc<dyn CoreToolRuntime> = match namespace {
+        Some(namespace) => Arc::new(MultiAgentV2NamespaceOverride {
+            handler: Arc::new(handler),
+            namespace: namespace.to_string(),
+        }),
+        None => Arc::new(handler),
+    };
+    override_tool_exposure(handler, exposure)
+}
+
+struct MultiAgentV2NamespaceOverride {
+    handler: Arc<dyn CoreToolRuntime>,
+    namespace: String,
+}
+
+#[async_trait::async_trait]
+impl ToolExecutor<ToolInvocation> for MultiAgentV2NamespaceOverride {
+    fn tool_name(&self) -> ToolName {
+        ToolName::namespaced(self.namespace.clone(), self.handler.tool_name().name)
+    }
+
+    fn spec(&self) -> Option<ToolSpec> {
+        match self.handler.spec()? {
+            ToolSpec::Function(tool) => Some(ToolSpec::Namespace(ResponsesApiNamespace {
+                name: self.namespace.clone(),
+                description: MULTI_AGENT_V2_NAMESPACE_DESCRIPTION.to_string(),
+                tools: vec![ResponsesApiNamespaceTool::Function(tool)],
+            })),
+            spec => Some(spec),
+        }
+    }
+
+    fn exposure(&self) -> ToolExposure {
+        self.handler.exposure()
+    }
+
+    fn supports_parallel_tool_calls(&self) -> bool {
+        self.handler.supports_parallel_tool_calls()
+    }
+
+    async fn handle(
+        &self,
+        invocation: ToolInvocation,
+    ) -> Result<Box<dyn ToolOutput>, codex_tools::FunctionCallError> {
+        self.handler.handle(invocation).await
+    }
+}
+
+impl CoreToolRuntime for MultiAgentV2NamespaceOverride {
+    fn matches_kind(&self, payload: &crate::tools::context::ToolPayload) -> bool {
+        self.handler.matches_kind(payload)
+    }
+
+    fn search_info(&self) -> Option<crate::tools::tool_search_entry::ToolSearchInfo> {
+        self.handler.search_info()
+    }
+
+    fn create_diff_consumer(
+        &self,
+    ) -> Option<Box<dyn crate::tools::registry::ToolArgumentDiffConsumer>> {
+        self.handler.create_diff_consumer()
+    }
 }
 
 fn compare_code_mode_tools(
diff --git a/codex-rs/core/src/tools/spec_plan_tests.rs b/codex-rs/core/src/tools/spec_plan_tests.rs
index 207aa79234..22276af550 100644
--- a/codex-rs/core/src/tools/spec_plan_tests.rs
+++ b/codex-rs/core/src/tools/spec_plan_tests.rs
@@ -1,1193 +1,844 @@
-use super::*;
-use crate::tools::handlers::apply_patch_spec::create_apply_patch_freeform_tool;
-use crate::tools::handlers::goal_spec::create_create_goal_tool;
-use crate::tools::handlers::goal_spec::create_get_goal_tool;
-use crate::tools::handlers::goal_spec::create_update_goal_tool;
-use crate::tools::handlers::multi_agents_spec::WaitAgentTimeoutOptions;
-use crate::tools::handlers::multi_agents_spec::create_close_agent_tool_v1;
-use crate::tools::handlers::multi_agents_spec::create_close_agent_tool_v2;
-use crate::tools::handlers::multi_agents_spec::create_resume_agent_tool;
-use crate::tools::handlers::multi_agents_spec::create_send_input_tool_v1;
-use crate::tools::handlers::multi_agents_spec::create_send_message_tool;
-use crate::tools::handlers::multi_agents_spec::create_spawn_agent_tool_v1;
-use crate::tools::handlers::multi_agents_spec::create_spawn_agent_tool_v2;
-use crate::tools::handlers::multi_agents_spec::create_wait_agent_tool_v1;
-use crate::tools::handlers::multi_agents_spec::create_wait_agent_tool_v2;
-use crate::tools::handlers::plan_spec::create_update_plan_tool;
-use crate::tools::handlers::request_user_input_spec::REQUEST_USER_INPUT_TOOL_NAME;
-use crate::tools::handlers::request_user_input_spec::create_request_user_input_tool;
-use crate::tools::handlers::request_user_input_spec::request_user_input_tool_description;
-use crate::tools::handlers::shell_spec::CommandToolOptions;
-use crate::tools::handlers::shell_spec::create_exec_command_tool;
-use crate::tools::handlers::shell_spec::create_request_permissions_tool;
-use crate::tools::handlers::shell_spec::create_write_stdin_tool;
-use crate::tools::handlers::shell_spec::request_permissions_tool_description;
-use crate::tools::handlers::view_image_spec::ViewImageToolOptions;
-use crate::tools::handlers::view_image_spec::create_view_image_tool;
-use crate::tools::registry::ToolRegistry;
-use codex_app_server_protocol::AppInfo;
-use codex_extension_api::ExtensionToolExecutor;
-use codex_extension_api::ToolCall as ExtensionToolCall;
+use std::collections::BTreeMap;
+use std::sync::Arc;
+
 use codex_features::Feature;
-use codex_features::Features;
+use codex_login::AuthManager;
+use codex_login::CodexAuth;
 use codex_mcp::ToolInfo;
-use codex_protocol::config_types::ModeKind;
-use codex_protocol::config_types::WebSearchConfig;
+use codex_model_provider::create_model_provider;
+use codex_model_provider_info::AMAZON_BEDROCK_PROVIDER_ID;
+use codex_model_provider_info::ModelProviderInfo;
 use codex_protocol::config_types::WebSearchMode;
-use codex_protocol::config_types::WindowsSandboxLevel;
 use codex_protocol::dynamic_tools::DynamicToolSpec;
-use codex_protocol::models::PermissionProfile;
-use codex_protocol::models::VIEW_IMAGE_TOOL_NAME;
+use codex_protocol::openai_models::ApplyPatchToolType;
+use codex_protocol::openai_models::ConfigShellToolType;
 use codex_protocol::openai_models::InputModality;
-use codex_protocol::openai_models::ModelInfo;
 use codex_protocol::openai_models::WebSearchToolType;
 use codex_protocol::protocol::SessionSource;
 use codex_protocol::protocol::SubAgentSource;
-use codex_tools::AdditionalProperties;
 use codex_tools::DiscoverablePluginInfo;
 use codex_tools::DiscoverableTool;
-use codex_tools::FreeformTool;
-use codex_tools::JsonSchema;
-use codex_tools::JsonSchemaPrimitiveType;
-use codex_tools::JsonSchemaType;
-use codex_tools::REQUEST_PLUGIN_INSTALL_TOOL_NAME;
 use codex_tools::ResponsesApiNamespaceTool;
-use codex_tools::ResponsesApiTool;
-use codex_tools::ResponsesApiWebSearchFilters;
-use codex_tools::ResponsesApiWebSearchUserLocation;
-use codex_tools::TOOL_SEARCH_TOOL_NAME;
-use codex_tools::ToolEnvironmentMode;
+use codex_tools::ToolExposure;
 use codex_tools::ToolName;
-use codex_tools::ToolsConfigParams;
-use codex_tools::mcp_call_tool_result_output_schema;
-use codex_tools::request_user_input_available_modes;
+use codex_tools::ToolSpec;
 use pretty_assertions::assert_eq;
 use serde_json::json;
-use std::collections::BTreeMap;
-use std::collections::HashMap;
-use std::sync::Arc;
 
-const CODEX_APPS_MCP_SERVER_NAME: &str = "codex_apps";
-const DEFAULT_AGENT_TYPE_DESCRIPTION: &str = "Test agent type description.";
-const DEFAULT_WAIT_TIMEOUT_MS: i64 = 30_000;
-const MIN_WAIT_TIMEOUT_MS: i64 = 10_000;
-const MAX_WAIT_TIMEOUT_MS: i64 = 3_600_000;
+use crate::session::tests::make_session_and_context;
+use crate::session::turn_context::TurnContext;
+use crate::tools::handlers::multi_agents_spec::MULTI_AGENT_V1_NAMESPACE;
+use crate::tools::router::ToolRouter;
+use crate::tools::router::ToolRouterParams;
 
-fn extension_tool_executor(name: &str, description: &str) -> Arc<dyn ExtensionToolExecutor> {
-    struct SpecOnlyExtensionExecutor {
-        name: String,
-        description: String,
-    }
-
-    impl ExtensionToolExecutor for SpecOnlyExtensionExecutor {
-        fn tool_name(&self) -> ToolName {
-            ToolName::plain(self.name.as_str())
-        }
-
-        fn spec(&self) -> Option<ToolSpec> {
-            Some(ToolSpec::Function(ResponsesApiTool {
-                name: self.name.clone(),
-                description: self.description.clone(),
-                strict: true,
-                parameters: JsonSchema::object(
-                    BTreeMap::from([(
-                        "message".to_string(),
-                        JsonSchema::string(/*description*/ None),
-                    )]),
-                    Some(vec!["message".to_string()]),
-                    Some(false.into()),
-                ),
-                output_schema: None,
-                defer_loading: None,
-            }))
-        }
-
-        fn handle(&self, _call: ExtensionToolCall) -> codex_extension_api::ExtensionToolFuture<'_> {
-            Box::pin(async { panic!("spec planning should not execute extension tools") })
-        }
-    }
-
-    Arc::new(SpecOnlyExtensionExecutor {
-        name: name.to_string(),
-        description: description.to_string(),
-    })
+#[derive(Default)]
+struct ToolPlanInputs {
+    mcp_tools: Option<Vec<ToolInfo>>,
+    deferred_mcp_tools: Option<Vec<ToolInfo>>,
+    discoverable_tools: Option<Vec<DiscoverableTool>>,
+    dynamic_tools: Vec<DynamicToolSpec>,
 }
 
-#[test]
-fn extension_tools_do_not_replace_builtin_tools() {
-    let model_info = model_info();
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &Features::with_defaults(),
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let extension_tool_executors = vec![extension_tool_executor(
-        "update_plan",
-        "Extension attempt to replace a built-in tool.",
-    )];
-    let (tools, _) = build_specs_with_discoverable_tools(
-        &tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        /*discoverable_tools*/ None,
-        &extension_tool_executors,
-        &[],
-    );
+struct ToolPlanProbe {
+    visible_specs: Vec<ToolSpec>,
+    visible_names: Vec<String>,
+    namespace_functions: BTreeMap<String, Vec<String>>,
+    registered_names: Vec<String>,
+    exposures: BTreeMap<String, ToolExposure>,
+}
 
-    assert_eq!(
-        find_tool(&tools, "update_plan").clone(),
-        create_update_plan_tool()
-    );
-    assert_eq!(
-        tools
+impl ToolPlanProbe {
+    fn from_router(router: ToolRouter) -> Self {
+        let visible_specs = router.model_visible_specs();
+        let visible_names = visible_specs
             .iter()
-            .filter(|tool| tool.name() == "update_plan")
-            .count(),
-        1
-    );
-}
+            .map(|spec| spec.name().to_string())
+            .collect::<Vec<_>>();
+        let namespace_functions = visible_specs
+            .iter()
+            .filter_map(|spec| match spec {
+                ToolSpec::Namespace(namespace) => Some((
+                    namespace.name.clone(),
+                    namespace
+                        .tools
+                        .iter()
+                        .map(|tool| match tool {
+                            ResponsesApiNamespaceTool::Function(tool) => tool.name.clone(),
+                        })
+                        .collect::<Vec<_>>(),
+                )),
+                ToolSpec::Function(_)
+                | ToolSpec::ToolSearch { .. }
+                | ToolSpec::ImageGeneration { .. }
+                | ToolSpec::WebSearch { .. }
+                | ToolSpec::Freeform(_) => None,
+            })
+            .collect::<BTreeMap<_, _>>();
+        let registered_tool_names = router.registered_tool_names_for_test();
+        let registered_names = registered_tool_names
+            .iter()
+            .map(ToString::to_string)
+            .collect::<Vec<_>>();
+        let exposures = registered_tool_names
+            .iter()
+            .filter_map(|name| {
+                router
+                    .tool_exposure_for_test(name)
+                    .map(|exposure| (name.to_string(), exposure))
+            })
+            .collect::<BTreeMap<_, _>>();
 
-#[test]
-fn test_full_toolset_specs_for_gpt5_codex_unified_exec_web_search() {
-    let model_info = model_info();
-    let mut features = Features::with_defaults();
-    features.enable(Feature::UnifiedExec);
-    let available_models = Vec::new();
-    let config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Live),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let (tools, _) = build_specs(
-        &config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
-
-    let mut actual = BTreeMap::new();
-    let mut duplicate_names = Vec::new();
-    for tool in &tools {
-        let name = tool.name().to_string();
-        if actual.insert(name.clone(), tool.clone()).is_some() {
-            duplicate_names.push(name);
+        Self {
+            visible_specs,
+            visible_names,
+            namespace_functions,
+            registered_names,
+            exposures,
         }
     }
-    assert!(
-        duplicate_names.is_empty(),
-        "duplicate tool entries detected: {duplicate_names:?}"
-    );
 
-    let mut expected = BTreeMap::new();
-    for spec in [
-        create_exec_command_tool(CommandToolOptions {
-            allow_login_shell: true,
-            exec_permission_approvals_enabled: false,
-        }),
-        create_write_stdin_tool(),
-        create_update_plan_tool(),
-        request_user_input_tool_spec(&request_user_input_available_modes(&features)),
-        create_apply_patch_freeform_tool(/*include_environment_id*/ false),
-        ToolSpec::WebSearch {
-            external_web_access: Some(true),
-            filters: None,
-            user_location: None,
-            search_context_size: None,
-            search_content_types: None,
+    fn assert_visible_contains(&self, expected: &[&str]) {
+        for name in expected {
+            assert!(
+                self.visible_names.iter().any(|visible| visible == name),
+                "expected visible tool `{name}` in {:?}",
+                self.visible_names
+            );
+        }
+    }
+
+    fn assert_visible_lacks(&self, expected_absent: &[&str]) {
+        for name in expected_absent {
+            assert!(
+                !self.visible_names.iter().any(|visible| visible == name),
+                "expected visible tool `{name}` to be absent from {:?}",
+                self.visible_names
+            );
+        }
+    }
+
+    fn assert_registered_contains(&self, expected: &[&str]) {
+        for name in expected {
+            assert!(
+                self.registered_names
+                    .iter()
+                    .any(|registered| registered == name),
+                "expected registered tool `{name}` in {:?}",
+                self.registered_names
+            );
+        }
+    }
+
+    fn assert_registered_lacks(&self, expected_absent: &[&str]) {
+        for name in expected_absent {
+            assert!(
+                !self
+                    .registered_names
+                    .iter()
+                    .any(|registered| registered == name),
+                "expected registered tool `{name}` to be absent from {:?}",
+                self.registered_names
+            );
+        }
+    }
+
+    fn namespace_function_names(&self, namespace: &str) -> &[String] {
+        self.namespace_functions
+            .get(namespace)
+            .map_or(&[], Vec::as_slice)
+    }
+
+    fn visible_spec(&self, name: &str) -> &ToolSpec {
+        self.visible_specs
+            .iter()
+            .find(|spec| spec.name() == name)
+            .unwrap_or_else(|| panic!("expected visible spec `{name}` in {:?}", self.visible_names))
+    }
+
+    fn exposure(&self, name: &str) -> ToolExposure {
+        *self
+            .exposures
+            .get(name)
+            .unwrap_or_else(|| panic!("expected registered tool `{name}`"))
+    }
+}
+
+async fn probe_with(
+    configure_turn: impl FnOnce(&mut TurnContext),
+    inputs: ToolPlanInputs,
+) -> ToolPlanProbe {
+    let (_session, mut turn) = make_session_and_context().await;
+    configure_turn(&mut turn);
+    let router = ToolRouter::from_turn_context(
+        &turn,
+        ToolRouterParams {
+            mcp_tools: inputs.mcp_tools,
+            deferred_mcp_tools: inputs.deferred_mcp_tools,
+            discoverable_tools: inputs.discoverable_tools,
+            extension_tool_executors: Vec::new(),
+            dynamic_tools: inputs.dynamic_tools.as_slice(),
         },
-        create_image_generation_tool("png"),
-        create_view_image_tool(ViewImageToolOptions {
-            can_request_original_image_detail: config.can_request_original_image_detail,
-            include_environment_id: false,
-        }),
-    ] {
-        expected.insert(spec.name().to_string(), spec);
-    }
-    if config.goal_tools {
-        for spec in [
-            create_get_goal_tool(),
-            create_create_goal_tool(),
-            create_update_goal_tool(),
-        ] {
-            expected.insert(spec.name().to_string(), spec);
-        }
-    }
-    let collab_specs = if config.multi_agent_v2 {
-        vec![
-            create_spawn_agent_tool_v2(spawn_agent_tool_options(&config)),
-            create_send_message_tool(),
-            create_wait_agent_tool_v2(wait_agent_timeout_options()),
-            create_close_agent_tool_v2(),
-        ]
+    );
+    ToolPlanProbe::from_router(router)
+}
+
+async fn probe(configure_turn: impl FnOnce(&mut TurnContext)) -> ToolPlanProbe {
+    probe_with(configure_turn, ToolPlanInputs::default()).await
+}
+
+fn set_feature(turn: &mut TurnContext, feature: Feature, enabled: bool) {
+    if enabled {
+        turn.features
+            .enable(feature)
+            .expect("test feature should be enableable");
     } else {
-        vec![
-            create_spawn_agent_tool_v1(spawn_agent_tool_options(&config)),
-            create_send_input_tool_v1(),
-            create_wait_agent_tool_v1(wait_agent_timeout_options()),
-            create_close_agent_tool_v1(),
+        turn.features
+            .disable(feature)
+            .expect("test feature should be disableable");
+    }
+
+    let mut config = (*turn.config).clone();
+    if enabled {
+        config
+            .features
+            .enable(feature)
+            .expect("test feature should be enableable in config");
+    } else {
+        config
+            .features
+            .disable(feature)
+            .expect("test feature should be disableable in config");
+    }
+    turn.config = Arc::new(config);
+}
+
+fn set_features(turn: &mut TurnContext, features: &[Feature]) {
+    for feature in features {
+        set_feature(turn, *feature, /*enabled*/ true);
+    }
+}
+
+fn update_config(turn: &mut TurnContext, update: impl FnOnce(&mut crate::config::Config)) {
+    let mut config = (*turn.config).clone();
+    update(&mut config);
+    turn.config = Arc::new(config);
+}
+
+fn set_web_search_mode(turn: &mut TurnContext, mode: WebSearchMode) {
+    update_config(turn, |config| {
+        config
+            .web_search_mode
+            .set(mode)
+            .expect("test web search mode should be accepted");
+    });
+}
+
+fn use_chatgpt_auth(turn: &mut TurnContext) {
+    turn.auth_manager = Some(AuthManager::from_auth_for_testing(
+        CodexAuth::create_dummy_chatgpt_auth_for_testing(),
+    ));
+    turn.provider = create_model_provider(
+        turn.config.model_provider.clone(),
+        turn.auth_manager.clone(),
+    );
+}
+
+fn use_bedrock_provider(turn: &mut TurnContext) {
+    let provider_info = ModelProviderInfo::create_amazon_bedrock_provider(/*aws*/ None);
+    update_config(turn, |config| {
+        config.model_provider_id = AMAZON_BEDROCK_PROVIDER_ID.to_string();
+        config.model_provider = provider_info.clone();
+    });
+    turn.provider = create_model_provider(provider_info, turn.auth_manager.clone());
+}
+
+fn duplicate_primary_environment(turn: &mut TurnContext) {
+    let mut second_environment = turn.environments.turn_environments[0].clone();
+    second_environment.environment_id = "secondary".to_string();
+    turn.environments.turn_environments.push(second_environment);
+}
+
+fn mcp_tool(server: &str, namespace: &str, name: &str) -> ToolInfo {
+    ToolInfo {
+        server_name: server.to_string(),
+        supports_parallel_tool_calls: false,
+        server_origin: None,
+        callable_name: name.to_string(),
+        callable_namespace: namespace.to_string(),
+        namespace_description: Some(format!("Tools from {server}.")),
+        tool: rmcp::model::Tool {
+            name: name.to_string().into(),
+            title: None,
+            description: Some(format!("{name} test tool").into()),
+            input_schema: Arc::new(rmcp::model::object(json!({
+                "type": "object",
+                "properties": {},
+                "additionalProperties": false,
+            }))),
+            output_schema: None,
+            annotations: None,
+            execution: None,
+            icons: None,
+            meta: None,
+        },
+        connector_id: None,
+        connector_name: None,
+        plugin_display_names: Vec::new(),
+    }
+}
+
+fn dynamic_tool(namespace: Option<&str>, name: &str, defer_loading: bool) -> DynamicToolSpec {
+    DynamicToolSpec {
+        namespace: namespace.map(str::to_string),
+        name: name.to_string(),
+        description: format!("{name} dynamic tool"),
+        input_schema: json!({
+            "type": "object",
+            "properties": {},
+            "additionalProperties": false,
+        }),
+        defer_loading,
+    }
+}
+
+fn discoverable_plugin(id: &str, name: &str) -> DiscoverableTool {
+    DiscoverablePluginInfo {
+        id: id.to_string(),
+        name: name.to_string(),
+        description: Some(format!("{name} plugin")),
+        has_skills: false,
+        mcp_server_names: Vec::new(),
+        app_connector_ids: Vec::new(),
+    }
+    .into()
+}
+
+fn has_parameter(spec: &ToolSpec, parameter_name: &str) -> bool {
+    serde_json::to_value(spec)
+        .expect("tool spec should serialize")
+        .pointer(&format!("/parameters/properties/{parameter_name}"))
+        .is_some()
+}
+
+fn apply_patch_accepts_environment_id(spec: &ToolSpec) -> bool {
+    match spec {
+        ToolSpec::Freeform(tool) if tool.name == "apply_patch" => {
+            tool.format.definition.contains("Environment ID")
+        }
+        _ => false,
+    }
+}
+
+#[tokio::test]
+async fn shell_family_registers_visible_unified_exec_and_hidden_legacy_shell() {
+    let plan = probe(|turn| {
+        set_features(turn, &[Feature::ShellTool, Feature::UnifiedExec]);
+        set_feature(turn, Feature::ShellZshFork, /*enabled*/ false);
+        turn.model_info.shell_type = ConfigShellToolType::ShellCommand;
+    })
+    .await;
+
+    plan.assert_visible_contains(&["exec_command", "write_stdin"]);
+    plan.assert_visible_lacks(&["shell_command"]);
+    plan.assert_registered_contains(&["exec_command", "write_stdin", "shell_command"]);
+    assert_eq!(plan.exposure("shell_command"), ToolExposure::Direct);
+}
+
+#[tokio::test]
+async fn environment_count_controls_environment_backed_tools() {
+    let no_environment = probe(|turn| {
+        turn.environments.turn_environments.clear();
+        set_feature(turn, Feature::ShellTool, /*enabled*/ true);
+        turn.model_info.apply_patch_tool_type = Some(ApplyPatchToolType::Freeform);
+    })
+    .await;
+    no_environment.assert_visible_lacks(&[
+        "shell_command",
+        "exec_command",
+        "apply_patch",
+        "view_image",
+    ]);
+    no_environment.assert_registered_lacks(&[
+        "shell_command",
+        "exec_command",
+        "apply_patch",
+        "view_image",
+    ]);
+
+    let multiple_environments = probe(|turn| {
+        duplicate_primary_environment(turn);
+        set_feature(turn, Feature::ShellTool, /*enabled*/ true);
+        set_feature(turn, Feature::UnifiedExec, /*enabled*/ true);
+        turn.model_info.apply_patch_tool_type = Some(ApplyPatchToolType::Freeform);
+    })
+    .await;
+    multiple_environments.assert_visible_contains(&["exec_command", "apply_patch", "view_image"]);
+    assert!(has_parameter(
+        multiple_environments.visible_spec("exec_command"),
+        "environment_id"
+    ));
+    assert!(apply_patch_accepts_environment_id(
+        multiple_environments.visible_spec("apply_patch")
+    ));
+    assert!(has_parameter(
+        multiple_environments.visible_spec("view_image"),
+        "environment_id"
+    ));
+}
+
+#[tokio::test]
+async fn host_context_gates_goal_and_agent_job_tools() {
+    let feature_disabled = probe(|turn| {
+        set_feature(turn, Feature::Goals, /*enabled*/ false);
+        turn.goal_tools_supported = true;
+    })
+    .await;
+    feature_disabled.assert_visible_lacks(&["get_goal", "create_goal", "update_goal"]);
+
+    let host_disabled = probe(|turn| {
+        set_feature(turn, Feature::Goals, /*enabled*/ true);
+        turn.goal_tools_supported = false;
+    })
+    .await;
+    host_disabled.assert_visible_lacks(&["get_goal", "create_goal", "update_goal"]);
+
+    let enabled = probe(|turn| {
+        set_feature(turn, Feature::Goals, /*enabled*/ true);
+        turn.goal_tools_supported = true;
+    })
+    .await;
+    enabled.assert_visible_contains(&["get_goal", "create_goal", "update_goal"]);
+
+    let review_thread = probe(|turn| {
+        set_feature(turn, Feature::Goals, /*enabled*/ true);
+        turn.goal_tools_supported = true;
+        turn.session_source = SessionSource::SubAgent(SubAgentSource::Review);
+    })
+    .await;
+    review_thread.assert_visible_lacks(&["get_goal", "create_goal", "update_goal"]);
+
+    let normal_agent_job = probe(|turn| {
+        set_feature(turn, Feature::SpawnCsv, /*enabled*/ true);
+    })
+    .await;
+    normal_agent_job.assert_visible_contains(&["spawn_agents_on_csv"]);
+    normal_agent_job.assert_visible_lacks(&["report_agent_job_result"]);
+
+    let worker_agent_job = probe(|turn| {
+        set_feature(turn, Feature::SpawnCsv, /*enabled*/ true);
+        turn.session_source =
+            SessionSource::SubAgent(SubAgentSource::Other("agent_job:42".to_string()));
+    })
+    .await;
+    worker_agent_job.assert_visible_contains(&["spawn_agents_on_csv", "report_agent_job_result"]);
+}
+
+#[tokio::test]
+async fn mcp_and_tool_search_follow_direct_and_deferred_tool_exposure() {
+    let direct_mcp = probe_with(
+        |_| {},
+        ToolPlanInputs {
+            mcp_tools: Some(vec![mcp_tool("direct", "mcp__direct__", "lookup")]),
+            ..ToolPlanInputs::default()
+        },
+    )
+    .await;
+    direct_mcp.assert_visible_contains(&[
+        "list_mcp_resources",
+        "list_mcp_resource_templates",
+        "read_mcp_resource",
+    ]);
+    assert_eq!(
+        direct_mcp.namespace_function_names("mcp__direct__"),
+        &["lookup".to_string()]
+    );
+
+    let searchable_mcp = ToolPlanInputs {
+        deferred_mcp_tools: Some(vec![mcp_tool("searchable", "mcp__searchable__", "lookup")]),
+        ..ToolPlanInputs::default()
+    };
+
+    let missing_model_capability = probe_with(
+        |turn| {
+            turn.model_info.supports_search_tool = false;
+        },
+        ToolPlanInputs {
+            deferred_mcp_tools: searchable_mcp.deferred_mcp_tools.clone(),
+            ..ToolPlanInputs::default()
+        },
+    )
+    .await;
+    missing_model_capability.assert_visible_lacks(&["tool_search"]);
+
+    let missing_deferred_tools = probe(|turn| {
+        set_feature(turn, Feature::Collab, /*enabled*/ false);
+        turn.model_info.supports_search_tool = true;
+    })
+    .await;
+    missing_deferred_tools.assert_visible_lacks(&["tool_search"]);
+    missing_deferred_tools.assert_visible_lacks(&[
+        "list_mcp_resources",
+        "list_mcp_resource_templates",
+        "read_mcp_resource",
+    ]);
+
+    let missing_namespace_capability = probe_with(
+        |turn| {
+            turn.model_info.supports_search_tool = true;
+            use_bedrock_provider(turn);
+        },
+        ToolPlanInputs {
+            deferred_mcp_tools: searchable_mcp.deferred_mcp_tools.clone(),
+            ..ToolPlanInputs::default()
+        },
+    )
+    .await;
+    missing_namespace_capability.assert_visible_lacks(&["tool_search"]);
+
+    let enabled = probe_with(
+        |turn| {
+            turn.model_info.supports_search_tool = true;
+        },
+        searchable_mcp,
+    )
+    .await;
+    enabled.assert_visible_contains(&["tool_search"]);
+    enabled.assert_registered_contains(&["tool_search", "mcp__searchable__lookup"]);
+}
+
+#[tokio::test]
+async fn request_plugin_install_requires_all_discovery_features_and_discoverable_tools() {
+    let discoverable_tools = Some(vec![discoverable_plugin("github", "GitHub")]);
+    for disabled_feature in [Feature::ToolSuggest, Feature::Apps, Feature::Plugins] {
+        let plan = probe_with(
+            |turn| {
+                set_features(
+                    turn,
+                    &[Feature::ToolSuggest, Feature::Apps, Feature::Plugins],
+                );
+                set_feature(turn, disabled_feature, /*enabled*/ false);
+            },
+            ToolPlanInputs {
+                discoverable_tools: discoverable_tools.clone(),
+                ..ToolPlanInputs::default()
+            },
+        )
+        .await;
+        plan.assert_visible_lacks(&["request_plugin_install"]);
+    }
+
+    let no_candidates = probe(|turn| {
+        set_features(
+            turn,
+            &[Feature::ToolSuggest, Feature::Apps, Feature::Plugins],
+        );
+    })
+    .await;
+    no_candidates.assert_visible_lacks(&["request_plugin_install"]);
+
+    let enabled = probe_with(
+        |turn| {
+            set_features(
+                turn,
+                &[Feature::ToolSuggest, Feature::Apps, Feature::Plugins],
+            );
+        },
+        ToolPlanInputs {
+            discoverable_tools,
+            ..ToolPlanInputs::default()
+        },
+    )
+    .await;
+    enabled.assert_visible_contains(&["request_plugin_install"]);
+}
+
+#[tokio::test]
+async fn code_mode_only_exposes_code_executor_and_hides_nested_tools() {
+    let input = ToolPlanInputs {
+        dynamic_tools: vec![dynamic_tool(
+            Some("codex_app"),
+            "lookup",
+            /*defer_loading*/ false,
+        )],
+        ..ToolPlanInputs::default()
+    };
+    let plain = probe_with(|_| {}, input).await;
+    assert_eq!(
+        plain.namespace_function_names("codex_app"),
+        &["lookup".to_string()]
+    );
+    plain.assert_visible_lacks(&[
+        codex_code_mode::PUBLIC_TOOL_NAME,
+        codex_code_mode::WAIT_TOOL_NAME,
+    ]);
+
+    let code_mode_only = probe_with(
+        |turn| {
+            set_features(turn, &[Feature::CodeMode, Feature::CodeModeOnly]);
+        },
+        ToolPlanInputs {
+            dynamic_tools: vec![dynamic_tool(
+                Some("codex_app"),
+                "lookup",
+                /*defer_loading*/ false,
+            )],
+            ..ToolPlanInputs::default()
+        },
+    )
+    .await;
+    code_mode_only.assert_visible_contains(&[
+        codex_code_mode::PUBLIC_TOOL_NAME,
+        codex_code_mode::WAIT_TOOL_NAME,
+    ]);
+    assert_eq!(
+        code_mode_only.namespace_function_names("codex_app"),
+        Vec::<String>::new().as_slice()
+    );
+}
+
+#[tokio::test]
+async fn multi_agent_feature_selects_one_agent_tool_family() {
+    let v1 = probe(|turn| {
+        set_feature(turn, Feature::Collab, /*enabled*/ true);
+        set_feature(turn, Feature::MultiAgentV2, /*enabled*/ false);
+    })
+    .await;
+    v1.assert_visible_contains(&[MULTI_AGENT_V1_NAMESPACE]);
+    v1.assert_visible_lacks(&[
+        "spawn_agent",
+        "send_input",
+        "resume_agent",
+        "wait_agent",
+        "close_agent",
+        "send_message",
+        "followup_task",
+        "list_agents",
+    ]);
+    assert_eq!(
+        v1.namespace_function_names(MULTI_AGENT_V1_NAMESPACE),
+        &[
+            "close_agent".to_string(),
+            "resume_agent".to_string(),
+            "send_input".to_string(),
+            "spawn_agent".to_string(),
+            "wait_agent".to_string(),
         ]
-    };
-    for spec in collab_specs {
-        expected.insert(spec.name().to_string(), spec);
-    }
-    if !config.multi_agent_v2 {
-        let spec = create_resume_agent_tool();
-        expected.insert(spec.name().to_string(), spec);
-    }
-
-    if config.exec_permission_approvals_enabled {
-        let spec = create_request_permissions_tool(request_permissions_tool_description());
-        expected.insert(spec.name().to_string(), spec);
-    }
-
-    assert_eq!(
-        actual.keys().collect::<Vec<_>>(),
-        expected.keys().collect::<Vec<_>>(),
-        "tool name set mismatch"
     );
 
-    for name in expected.keys() {
-        let mut actual_spec = actual.get(name).expect("present").clone();
-        let mut expected_spec = expected.get(name).expect("present").clone();
-        strip_descriptions_tool(&mut actual_spec);
-        strip_descriptions_tool(&mut expected_spec);
-        assert_eq!(actual_spec, expected_spec, "spec mismatch for {name}");
-    }
-}
-
-#[test]
-fn exec_command_spec_includes_environment_id_only_for_multiple_selected_environments() {
-    let model_info = model_info();
-    let available_models = Vec::new();
-    let mut features = Features::with_defaults();
-    features.enable(Feature::UnifiedExec);
-    let config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-
-    let (single_environment_tools, _) = build_specs(
-        &config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
-    assert_process_tool_environment_id(
-        &single_environment_tools,
-        "exec_command",
-        /*expected_present*/ false,
-    );
-
-    let multi_environment_config = config.with_environment_mode(ToolEnvironmentMode::Multiple);
-    let (multi_environment_tools, _) = build_specs(
-        &multi_environment_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
-    assert_process_tool_environment_id(
-        &multi_environment_tools,
-        "exec_command",
-        /*expected_present*/ true,
-    );
-}
-
-#[test]
-fn apply_patch_spec_includes_environment_id_only_for_multiple_selected_environments() {
-    let model_info = model_info();
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &Features::with_defaults(),
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-
-    let (single_environment_tools, _) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
-    assert_apply_patch_environment_id(&single_environment_tools, /*expected_present*/ false);
-
-    let multi_environment_config =
-        tools_config.with_environment_mode(ToolEnvironmentMode::Multiple);
-    let (multi_environment_tools, _) = build_specs(
-        &multi_environment_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
-    assert_apply_patch_environment_id(&multi_environment_tools, /*expected_present*/ true);
-}
-
-#[test]
-fn test_build_specs_collab_tools_enabled() {
-    let model_info = model_info();
-    let mut features = Features::with_defaults();
-    features.enable(Feature::Collab);
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let (tools, _) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
-
-    assert_contains_tool_names(
-        &tools,
-        &["spawn_agent", "send_input", "wait_agent", "close_agent"],
-    );
-    assert_lacks_tool_name(&tools, "spawn_agents_on_csv");
-    assert_lacks_tool_name(&tools, "list_agents");
-
-    let spawn_agent = find_tool(&tools, "spawn_agent");
-    let ToolSpec::Function(ResponsesApiTool { parameters, .. }) = spawn_agent else {
-        panic!("spawn_agent should be a function tool");
-    };
-    let (properties, _) = expect_object_schema(parameters);
-    assert!(properties.contains_key("fork_context"));
-    assert!(!properties.contains_key("fork_turns"));
-}
-
-#[test]
-fn goal_tools_require_goals_feature() {
-    let model_info = model_info();
-    let available_models = Vec::new();
-    let mut features = Features::with_defaults();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let (tools, _) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
-    assert_lacks_tool_name(&tools, "get_goal");
-    assert_lacks_tool_name(&tools, "create_goal");
-    assert_lacks_tool_name(&tools, "update_goal");
-
-    features.enable(Feature::Goals);
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let (tools, _) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
-    assert_contains_tool_names(&tools, &["get_goal", "create_goal", "update_goal"]);
-}
-
-#[test]
-fn test_build_specs_multi_agent_v2_uses_task_names_and_hides_resume() {
-    let model_info = model_info();
-    let mut features = Features::with_defaults();
-    features.enable(Feature::Collab);
-    features.enable(Feature::MultiAgentV2);
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let (tools, _) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
-
-    assert_contains_tool_names(
-        &tools,
-        &[
-            "spawn_agent",
-            "send_message",
-            "followup_task",
-            "wait_agent",
-            "close_agent",
-            "list_agents",
-        ],
-    );
-
-    let spawn_agent = find_tool(&tools, "spawn_agent");
-    let ToolSpec::Function(ResponsesApiTool {
-        parameters,
-        output_schema,
-        ..
-    }) = spawn_agent
-    else {
-        panic!("spawn_agent should be a function tool");
-    };
-    let (properties, required) = expect_object_schema(parameters);
-    assert!(properties.contains_key("task_name"));
-    assert!(properties.contains_key("message"));
-    assert!(properties.contains_key("fork_turns"));
-    assert!(!properties.contains_key("items"));
-    assert!(!properties.contains_key("fork_context"));
-    assert_eq!(
-        required,
-        Some(&vec!["task_name".to_string(), "message".to_string()])
-    );
-    let output_schema = output_schema
-        .as_ref()
-        .expect("spawn_agent should define output schema");
-    assert_eq!(output_schema["required"], json!(["task_name", "nickname"]));
-
-    let send_message = find_tool(&tools, "send_message");
-    let ToolSpec::Function(ResponsesApiTool {
-        parameters,
-        output_schema,
-        ..
-    }) = send_message
-    else {
-        panic!("send_message should be a function tool");
-    };
-    assert_eq!(output_schema, &None);
-    let (properties, required) = expect_object_schema(parameters);
-    assert!(properties.contains_key("target"));
-    assert!(!properties.contains_key("interrupt"));
-    assert!(properties.contains_key("message"));
-    assert!(!properties.contains_key("items"));
-    assert_eq!(
-        required,
-        Some(&vec!["target".to_string(), "message".to_string()])
-    );
-
-    let followup_task = find_tool(&tools, "followup_task");
-    let ToolSpec::Function(ResponsesApiTool {
-        parameters,
-        output_schema,
-        ..
-    }) = followup_task
-    else {
-        panic!("followup_task should be a function tool");
-    };
-    assert_eq!(output_schema, &None);
-    let (properties, required) = expect_object_schema(parameters);
-    assert!(properties.contains_key("target"));
-    assert!(properties.contains_key("message"));
-    assert!(!properties.contains_key("items"));
-    assert_eq!(
-        required,
-        Some(&vec!["target".to_string(), "message".to_string()])
-    );
-
-    let wait_agent = find_tool(&tools, "wait_agent");
-    let ToolSpec::Function(ResponsesApiTool {
-        parameters,
-        output_schema,
-        ..
-    }) = wait_agent
-    else {
-        panic!("wait_agent should be a function tool");
-    };
-    let (properties, required) = expect_object_schema(parameters);
-    assert!(!properties.contains_key("targets"));
-    assert!(properties.contains_key("timeout_ms"));
-    assert_eq!(required, None);
-    let output_schema = output_schema
-        .as_ref()
-        .expect("wait_agent should define output schema");
-    assert_eq!(
-        output_schema["properties"]["message"]["description"],
-        json!("Brief wait summary without the agent's final content.")
-    );
-
-    let list_agents = find_tool(&tools, "list_agents");
-    let ToolSpec::Function(ResponsesApiTool {
-        parameters,
-        output_schema,
-        ..
-    }) = list_agents
-    else {
-        panic!("list_agents should be a function tool");
-    };
-    let (properties, required) = expect_object_schema(parameters);
-    assert!(properties.contains_key("path_prefix"));
-    assert_eq!(required, None);
-    let output_schema = output_schema
-        .as_ref()
-        .expect("list_agents should define output schema");
-    assert_eq!(
-        output_schema["properties"]["agents"]["items"]["required"],
-        json!(["agent_name", "agent_status", "last_task_message"])
-    );
-    assert_lacks_tool_name(&tools, "send_input");
-    assert_lacks_tool_name(&tools, "resume_agent");
-}
-
-#[test]
-fn test_build_specs_multi_agent_v2_does_not_require_collab_feature() {
-    let model_info = model_info();
-    let mut features = Features::with_defaults();
-    features.disable(Feature::Collab);
-    features.enable(Feature::MultiAgentV2);
-    assert!(!features.enabled(Feature::Collab));
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let (tools, _) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
-
-    assert_contains_tool_names(
-        &tools,
-        &[
-            "spawn_agent",
-            "send_message",
-            "followup_task",
-            "wait_agent",
-            "close_agent",
-            "list_agents",
-        ],
-    );
-    assert_lacks_tool_name(&tools, "send_input");
-    assert_lacks_tool_name(&tools, "resume_agent");
-}
-
-#[test]
-fn test_build_specs_enable_fanout_enables_agent_jobs_and_collab_tools() {
-    let model_info = model_info();
-    let mut features = Features::with_defaults();
-    features.enable(Feature::SpawnCsv);
-    features.normalize_dependencies();
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let (tools, _) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
-
-    assert_contains_tool_names(
-        &tools,
-        &[
-            "spawn_agent",
-            "send_input",
-            "wait_agent",
-            "close_agent",
-            "spawn_agents_on_csv",
-        ],
-    );
-}
-
-#[test]
-fn view_image_tool_omits_detail_without_original_detail_support() {
-    let mut model_info = model_info();
-    model_info.supports_image_detail_original = false;
-    let features = Features::with_defaults();
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let (tools, _) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
-    let view_image = find_tool(&tools, VIEW_IMAGE_TOOL_NAME);
-    let ToolSpec::Function(ResponsesApiTool { parameters, .. }) = view_image else {
-        panic!("view_image should be a function tool");
-    };
-    let (properties, _) = expect_object_schema(parameters);
-    assert!(!properties.contains_key("detail"));
-}
-
-#[test]
-fn view_image_tool_includes_detail_with_original_detail_support() {
-    let mut model_info = model_info();
-    model_info.supports_image_detail_original = true;
-    let features = Features::with_defaults();
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let (tools, _) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
-    let view_image = find_tool(&tools, VIEW_IMAGE_TOOL_NAME);
-    let ToolSpec::Function(ResponsesApiTool { parameters, .. }) = view_image else {
-        panic!("view_image should be a function tool");
-    };
-    let (properties, _) = expect_object_schema(parameters);
-    assert!(properties.contains_key("detail"));
-    let description = expect_string_description(
-        properties
-            .get("detail")
-            .expect("view_image detail should include a description"),
-    );
-    assert!(description.contains("only supported value is `original`"));
-    assert!(description.contains("omit this field for default resized behavior"));
-}
-
-#[test]
-fn disabled_environment_omits_environment_backed_tools() {
-    let model_info = model_info();
-    let mut features = Features::with_defaults();
-    features.enable(Feature::UnifiedExec);
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
+    let v2 = probe(|turn| {
+        set_feature(turn, Feature::MultiAgentV2, /*enabled*/ true);
+        update_config(turn, |config| {
+            config.multi_agent_v2.max_concurrent_threads_per_session = 17;
+        });
     })
-    .with_environment_mode(ToolEnvironmentMode::None);
-    let (tools, _) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
+    .await;
+    v2.assert_visible_contains(&[
+        "spawn_agent",
+        "send_message",
+        "followup_task",
+        "wait_agent",
+        "close_agent",
+        "list_agents",
+    ]);
+    v2.assert_visible_lacks(&["send_input", "resume_agent"]);
+    let spawn_agent_description = match v2.visible_spec("spawn_agent") {
+        ToolSpec::Function(tool) => tool.description.as_str(),
+        other => panic!("expected spawn_agent function spec, got {other:?}"),
+    };
+    assert!(spawn_agent_description.contains("max_concurrent_threads_per_session = 17"));
 
-    assert_lacks_tool_name(&tools, "exec_command");
-    assert_lacks_tool_name(&tools, "write_stdin");
-    assert_lacks_tool_name(&tools, "apply_patch");
-    assert_lacks_tool_name(&tools, VIEW_IMAGE_TOOL_NAME);
-}
-
-#[test]
-fn view_image_spec_includes_environment_id_only_for_multiple_selected_environments() {
-    let model_info = model_info();
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &Features::with_defaults(),
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-
-    let (single_environment_tools, _) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
-    assert_process_tool_environment_id(
-        &single_environment_tools,
-        VIEW_IMAGE_TOOL_NAME,
-        /*expected_present*/ false,
-    );
-
-    let multi_environment_config =
-        tools_config.with_environment_mode(ToolEnvironmentMode::Multiple);
-    let (multi_environment_tools, _) = build_specs(
-        &multi_environment_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
-    assert_process_tool_environment_id(
-        &multi_environment_tools,
-        VIEW_IMAGE_TOOL_NAME,
-        /*expected_present*/ true,
-    );
-}
-
-#[test]
-fn test_build_specs_agent_job_worker_tools_enabled() {
-    let model_info = model_info();
-    let mut features = Features::with_defaults();
-    features.enable(Feature::SpawnCsv);
-    features.normalize_dependencies();
-    features.enable(Feature::Sqlite);
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::SubAgent(SubAgentSource::Other(
-            "agent_job:test".to_string(),
-        )),
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let (tools, _) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
-
-    assert_contains_tool_names(
-        &tools,
-        &[
-            "spawn_agent",
-            "send_input",
-            "resume_agent",
-            "wait_agent",
-            "close_agent",
-            "spawn_agents_on_csv",
-            "report_agent_job_result",
-            REQUEST_USER_INPUT_TOOL_NAME,
-        ],
-    );
-}
-
-#[test]
-fn request_user_input_description_reflects_default_mode_feature_flag() {
-    let model_info = model_info();
-    let mut features = Features::with_defaults();
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let (tools, _) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
-    let request_user_input_tool = find_tool(&tools, REQUEST_USER_INPUT_TOOL_NAME);
+    let direct_model_only = probe(|turn| {
+        set_features(
+            turn,
+            &[
+                Feature::CodeMode,
+                Feature::CodeModeOnly,
+                Feature::MultiAgentV2,
+            ],
+        );
+        update_config(turn, |config| {
+            config.multi_agent_v2.non_code_mode_only = true;
+        });
+    })
+    .await;
+    direct_model_only.assert_visible_contains(&["spawn_agent", "send_message", "wait_agent"]);
     assert_eq!(
-        request_user_input_tool.clone(),
-        request_user_input_tool_spec(&request_user_input_available_modes(&features))
-    );
-
-    features.enable(Feature::DefaultModeRequestUserInput);
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let (tools, _) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
-    let request_user_input_tool = find_tool(&tools, REQUEST_USER_INPUT_TOOL_NAME);
-    assert_eq!(
-        request_user_input_tool.clone(),
-        request_user_input_tool_spec(&request_user_input_available_modes(&features))
+        direct_model_only.exposure("spawn_agent"),
+        ToolExposure::DirectModelOnly
     );
 }
 
-#[test]
-fn request_permissions_requires_feature_flag() {
-    let model_info = model_info();
-    let features = Features::with_defaults();
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let (tools, _) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
-    assert_lacks_tool_name(&tools, "request_permissions");
+#[tokio::test]
+async fn v1_multi_agent_tools_defer_when_tool_search_available() {
+    let plan = probe(|turn| {
+        turn.model_info.supports_search_tool = true;
+        set_feature(turn, Feature::Collab, /*enabled*/ true);
+        set_feature(turn, Feature::MultiAgentV2, /*enabled*/ false);
+    })
+    .await;
 
-    let mut features = Features::with_defaults();
-    features.enable(Feature::RequestPermissionsTool);
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let (tools, _) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
-    let request_permissions_tool = find_tool(&tools, "request_permissions");
-    assert_eq!(
-        request_permissions_tool.clone(),
-        create_request_permissions_tool(request_permissions_tool_description())
-    );
+    plan.assert_visible_contains(&["tool_search"]);
+    plan.assert_visible_lacks(&[
+        "spawn_agent",
+        "send_input",
+        "resume_agent",
+        "wait_agent",
+        "close_agent",
+    ]);
+    for tool_name in [
+        "spawn_agent",
+        "send_input",
+        "resume_agent",
+        "wait_agent",
+        "close_agent",
+    ] {
+        let namespaced_tool_name = ToolName::namespaced(MULTI_AGENT_V1_NAMESPACE, tool_name);
+        let namespaced_tool_name = namespaced_tool_name.to_string();
+        assert!(
+            plan.registered_names.contains(&namespaced_tool_name),
+            "expected namespaced runtime for {tool_name}"
+        );
+        assert!(
+            !plan
+                .registered_names
+                .contains(&ToolName::plain(tool_name).to_string()),
+            "expected no plain runtime for deferred {tool_name}"
+        );
+        assert_eq!(plan.exposure(&namespaced_tool_name), ToolExposure::Deferred);
+    }
+    let ToolSpec::ToolSearch { description, .. } = plan.visible_spec("tool_search") else {
+        panic!("expected visible tool_search spec");
+    };
+    assert!(description.contains("- Multi-agent tools: Spawn and manage sub-agents."));
 }
 
-#[test]
-fn request_permissions_tool_is_independent_from_additional_permissions() {
-    let model_info = model_info();
-    let mut features = Features::with_defaults();
-    features.enable(Feature::ExecPermissionApprovals);
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let (tools, _) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
+#[tokio::test]
+async fn multi_agent_v2_can_use_configured_tool_namespace() {
+    let namespaced = probe(|turn| {
+        set_feature(turn, Feature::MultiAgentV2, /*enabled*/ true);
+        update_config(turn, |config| {
+            config.multi_agent_v2.tool_namespace = Some("agents".to_string());
+        });
+    })
+    .await;
 
-    assert_lacks_tool_name(&tools, "request_permissions");
+    namespaced.assert_visible_contains(&["agents"]);
+    for tool_name in [
+        "spawn_agent",
+        "send_message",
+        "followup_task",
+        "wait_agent",
+        "close_agent",
+        "list_agents",
+    ] {
+        namespaced.assert_visible_lacks(&[tool_name]);
+        assert!(
+            namespaced
+                .registered_names
+                .contains(&ToolName::namespaced("agents", tool_name).to_string()),
+            "expected namespaced runtime for {tool_name}"
+        );
+        assert!(
+            !namespaced
+                .registered_names
+                .contains(&ToolName::plain(tool_name).to_string()),
+            "expected no plain runtime for {tool_name}"
+        );
+        assert!(
+            namespaced
+                .namespace_function_names("agents")
+                .iter()
+                .any(|name| name == tool_name),
+            "expected {tool_name} in agents namespace"
+        );
+    }
 }
 
-#[test]
-fn image_generation_tools_require_feature_and_supported_model() {
-    let supported_model_info = model_info();
-    let mut unsupported_model_info = supported_model_info.clone();
-    unsupported_model_info.input_modalities = vec![InputModality::Text];
-    let mut image_generation_disabled_features = Features::with_defaults();
-    image_generation_disabled_features.disable(Feature::ImageGeneration);
-    let mut image_generation_features = Features::with_defaults();
-    image_generation_features.enable(Feature::ImageGeneration);
+#[tokio::test]
+async fn multi_agent_v2_namespace_is_ignored_without_provider_namespace_support() {
+    let plan = probe(|turn| {
+        set_feature(turn, Feature::MultiAgentV2, /*enabled*/ true);
+        update_config(turn, |config| {
+            config.multi_agent_v2.tool_namespace = Some("agents".to_string());
+        });
+        use_bedrock_provider(turn);
+    })
+    .await;
 
-    let available_models = Vec::new();
-    let default_tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &supported_model_info,
-        available_models: &available_models,
-        features: &image_generation_disabled_features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let (default_tools, _) = build_specs(
-        &default_tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &[],
+    plan.assert_visible_contains(&["spawn_agent", "send_message", "list_agents"]);
+    plan.assert_visible_lacks(&["agents"]);
+    assert!(
+        plan.registered_names
+            .contains(&ToolName::plain("spawn_agent").to_string())
     );
     assert!(
-        !default_tools
-            .iter()
-            .any(|tool| tool.name() == "image_generation"),
-        "image_generation should be disabled when the feature is disabled"
-    );
-
-    let supported_tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &supported_model_info,
-        available_models: &available_models,
-        features: &image_generation_features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let (supported_tools, _) = build_specs(
-        &supported_tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
-    assert_contains_tool_names(&supported_tools, &["image_generation"]);
-    let image_generation_tool = find_tool(&supported_tools, "image_generation");
-    assert_eq!(
-        serde_json::to_value(image_generation_tool).expect("serialize image tool"),
-        serde_json::json!({
-            "type": "image_generation",
-            "output_format": "png"
-        })
-    );
-
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &unsupported_model_info,
-        available_models: &available_models,
-        features: &image_generation_features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let (tools, _) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
-    assert!(
-        !tools.iter().any(|tool| tool.name() == "image_generation"),
-        "image_generation should be disabled for unsupported models"
+        !plan
+            .registered_names
+            .contains(&ToolName::namespaced("agents", "spawn_agent").to_string())
     );
 }
 
-#[test]
-fn web_search_mode_cached_sets_external_web_access_false() {
-    let model_info = model_info();
-    let features = Features::with_defaults();
-
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let (tools, _) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
-
-    let tool = find_tool(&tools, "web_search");
-    assert_eq!(
-        tool.clone(),
-        ToolSpec::WebSearch {
-            external_web_access: Some(false),
-            filters: None,
-            user_location: None,
-            search_context_size: None,
-            search_content_types: None,
-        }
-    );
-}
-
-#[test]
-fn web_search_mode_live_sets_external_web_access_true() {
-    let model_info = model_info();
-    let features = Features::with_defaults();
-
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Live),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let (tools, _) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
-
-    let tool = find_tool(&tools, "web_search");
-    assert_eq!(
-        tool.clone(),
-        ToolSpec::WebSearch {
-            external_web_access: Some(true),
-            filters: None,
-            user_location: None,
-            search_context_size: None,
-            search_content_types: None,
-        }
-    );
-}
-
-#[test]
-fn web_search_config_is_forwarded_to_tool_spec() {
-    let model_info = model_info();
-    let features = Features::with_defaults();
-    let web_search_config = WebSearchConfig {
-        filters: Some(codex_protocol::config_types::WebSearchFilters {
-            allowed_domains: Some(vec!["example.com".to_string()]),
-        }),
-        user_location: Some(codex_protocol::config_types::WebSearchUserLocation {
-            r#type: codex_protocol::config_types::WebSearchUserLocationType::Approximate,
-            country: Some("US".to_string()),
-            region: Some("California".to_string()),
-            city: Some("San Francisco".to_string()),
-            timezone: Some("America/Los_Angeles".to_string()),
-        }),
-        search_context_size: Some(codex_protocol::config_types::WebSearchContextSize::High),
-    };
-
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Live),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
+#[tokio::test]
+async fn code_mode_only_can_expose_namespaced_multi_agent_v2_as_normal_tools() {
+    let plan = probe(|turn| {
+        set_features(
+            turn,
+            &[
+                Feature::CodeMode,
+                Feature::CodeModeOnly,
+                Feature::MultiAgentV2,
+            ],
+        );
+        update_config(turn, |config| {
+            config.multi_agent_v2.non_code_mode_only = true;
+            config.multi_agent_v2.tool_namespace = Some("agents".to_string());
+        });
     })
-    .with_web_search_config(Some(web_search_config.clone()));
-    let (tools, _) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
+    .await;
 
-    let tool = find_tool(&tools, "web_search");
-    assert_eq!(
-        tool.clone(),
-        ToolSpec::WebSearch {
-            external_web_access: Some(true),
-            filters: web_search_config
-                .filters
-                .map(ResponsesApiWebSearchFilters::from),
-            user_location: web_search_config
-                .user_location
-                .map(ResponsesApiWebSearchUserLocation::from),
-            search_context_size: web_search_config.search_context_size,
-            search_content_types: None,
-        }
-    );
+    assert_eq!(plan.visible_names, vec!["exec", "wait", "agents"]);
+    for tool_name in [
+        "spawn_agent",
+        "send_message",
+        "followup_task",
+        "wait_agent",
+        "close_agent",
+        "list_agents",
+    ] {
+        assert!(
+            plan.namespace_function_names("agents")
+                .iter()
+                .any(|name| name == tool_name),
+            "expected {tool_name} in agents namespace"
+        );
+    }
 }
 
-#[test]
-fn web_search_tool_type_text_and_image_sets_search_content_types() {
-    let mut model_info = model_info();
-    model_info.web_search_tool_type = WebSearchToolType::TextAndImage;
-    let features = Features::with_defaults();
+#[tokio::test]
+async fn hosted_tools_follow_provider_auth_model_and_config_gates() {
+    let api_key_auth = probe(|turn| {
+        set_feature(turn, Feature::ImageGeneration, /*enabled*/ true);
+        turn.model_info.input_modalities = vec![InputModality::Image];
+    })
+    .await;
+    api_key_auth.assert_visible_lacks(&["image_generation"]);
 
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Live),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let (tools, _) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
+    let image_generation = probe(|turn| {
+        use_chatgpt_auth(turn);
+        set_feature(turn, Feature::ImageGeneration, /*enabled*/ true);
+        turn.model_info.input_modalities = vec![InputModality::Image];
+    })
+    .await;
+    image_generation.assert_visible_contains(&["image_generation"]);
 
-    let tool = find_tool(&tools, "web_search");
+    let live_web_search = probe(|turn| {
+        set_web_search_mode(turn, WebSearchMode::Live);
+        turn.model_info.web_search_tool_type = WebSearchToolType::TextAndImage;
+    })
+    .await;
     assert_eq!(
-        tool.clone(),
-        ToolSpec::WebSearch {
+        live_web_search.visible_spec("web_search"),
+        &ToolSpec::WebSearch {
             external_web_access: Some(true),
             filters: None,
             user_location: None,
@@ -1195,1583 +846,11 @@ fn web_search_tool_type_text_and_image_sets_search_content_types() {
             search_content_types: Some(vec!["text".to_string(), "image".to_string()]),
         }
     );
-}
-
-#[test]
-fn mcp_resource_tools_are_hidden_without_mcp_servers() {
-    let model_info = model_info();
-    let features = Features::with_defaults();
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let (tools, _) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
-
-    assert!(
-        !tools.iter().any(|tool| matches!(
-            tool.name(),
-            "list_mcp_resources" | "list_mcp_resource_templates" | "read_mcp_resource"
-        )),
-        "MCP resource tools should be omitted when no MCP servers are configured"
-    );
-}
-
-#[test]
-fn mcp_resource_tools_are_included_when_mcp_servers_are_present() {
-    let model_info = model_info();
-    let features = Features::with_defaults();
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let (tools, _) = build_specs(
-        &tools_config,
-        Some(HashMap::new()),
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
-
-    assert_contains_tool_names(
-        &tools,
-        &[
-            "list_mcp_resources",
-            "list_mcp_resource_templates",
-            "read_mcp_resource",
-        ],
-    );
-}
-
-#[test]
-#[ignore]
-fn test_parallel_support_flags() {
-    let model_info = model_info();
-    let mut features = Features::with_defaults();
-    features.enable(Feature::UnifiedExec);
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let (tools, _) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
-
-    assert_contains_tool_names(&tools, &["exec_command", "write_stdin"]);
-}
-
-#[test]
-fn test_test_model_info_includes_sync_tool() {
-    let mut model_info = model_info();
-    model_info.experimental_supported_tools = vec!["test_sync_tool".to_string()];
-    let features = Features::with_defaults();
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let (tools, _) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
-
-    assert!(tools.iter().any(|tool| tool.name() == "test_sync_tool"));
-}
-
-#[test]
-fn test_build_specs_mcp_tools_converted() {
-    let model_info = model_info();
-    let mut features = Features::with_defaults();
-    features.enable(Feature::UnifiedExec);
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Live),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let (tools, _) = build_specs(
-        &tools_config,
-        Some(HashMap::from([(
-            ToolName::namespaced("test_server/", "do_something_cool"),
-            mcp_tool(
-                "do_something_cool",
-                "Do something cool",
-                serde_json::json!({
-                    "type": "object",
-                    "properties": {
-                        "string_argument": { "type": "string" },
-                        "number_argument": { "type": "number" },
-                        "object_argument": {
-                            "type": "object",
-                            "properties": {
-                                "string_property": { "type": "string" },
-                                "number_property": { "type": "number" },
-                            },
-                            "required": ["string_property", "number_property"],
-                            "additionalProperties": false,
-                        },
-                    },
-                }),
-            ),
-        )])),
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
-
-    let tool = find_namespace_function_tool(&tools, "test_server/", "do_something_cool");
-    assert_eq!(
-        tool,
-        &ResponsesApiTool {
-            name: "do_something_cool".to_string(),
-            parameters: JsonSchema::object(
-                BTreeMap::from([
-                    (
-                        "string_argument".to_string(),
-                        JsonSchema::string(/*description*/ None),
-                    ),
-                    (
-                        "number_argument".to_string(),
-                        JsonSchema::number(/*description*/ None),
-                    ),
-                    (
-                        "object_argument".to_string(),
-                        JsonSchema::object(
-                            BTreeMap::from([
-                                (
-                                    "string_property".to_string(),
-                                    JsonSchema::string(/*description*/ None),
-                                ),
-                                (
-                                    "number_property".to_string(),
-                                    JsonSchema::number(/*description*/ None),
-                                ),
-                            ]),
-                            Some(vec![
-                                "string_property".to_string(),
-                                "number_property".to_string(),
-                            ]),
-                            Some(false.into()),
-                        ),
-                    ),
-                ]),
-                /*required*/ None,
-                /*additional_properties*/ None
-            ),
-            description: "Do something cool".to_string(),
-            strict: false,
-            output_schema: Some(mcp_call_tool_result_output_schema(serde_json::json!({}))),
-            defer_loading: None,
-        }
-    );
-}
-
-#[test]
-fn namespace_specs_are_hidden_when_namespace_tools_are_disabled() {
-    let model_info = model_info();
-    let features = Features::with_defaults();
-    let available_models = Vec::new();
-    let mut tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    tools_config.namespace_tools = false;
-
-    let (tools, registry) = build_specs(
-        &tools_config,
-        Some(HashMap::from([(
-            ToolName::namespaced("mcp__sample__", "echo"),
-            mcp_tool("echo", "Echo", serde_json::json!({"type": "object"})),
-        )])),
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
-
-    assert_lacks_tool_name(&tools, "mcp__sample__");
-    assert!(registry.has_handler(&ToolName::namespaced("mcp__sample__", "echo")));
-}
-
-#[test]
-fn namespaced_dynamic_specs_are_hidden_when_namespace_tools_are_disabled() {
-    let model_info = model_info();
-    let features = Features::with_defaults();
-    let available_models = Vec::new();
-    let mut tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    tools_config.namespace_tools = false;
-    let dynamic_tools = vec![
-        DynamicToolSpec {
-            namespace: Some("codex_app".to_string()),
-            name: "automation_update".to_string(),
-            description: "Create or update automations.".to_string(),
-            input_schema: json!({"type": "object", "properties": {}}),
-            defer_loading: false,
-        },
-        DynamicToolSpec {
-            namespace: None,
-            name: "plain_dynamic".to_string(),
-            description: "Plain dynamic tool.".to_string(),
-            input_schema: json!({"type": "object", "properties": {}}),
-            defer_loading: false,
-        },
-    ];
-
-    let (tools, _) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &dynamic_tools,
-    );
-
-    assert_lacks_tool_name(&tools, "codex_app");
-    assert_contains_tool_names(&tools, &["plain_dynamic"]);
-}
-
-#[test]
-fn test_build_specs_mcp_namespace_description_falls_back_when_missing() {
-    let model_info = model_info();
-    let mut features = Features::with_defaults();
-    features.enable(Feature::UnifiedExec);
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let (tools, _) = build_specs(
-        &tools_config,
-        Some(HashMap::from([(
-            ToolName::namespaced("test_server/", "do_something_cool"),
-            mcp_tool(
-                "do_something_cool",
-                "Do something cool",
-                serde_json::json!({"type": "object"}),
-            ),
-        )])),
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
-
-    let namespace_tool = find_tool(&tools, "test_server/");
-    let ToolSpec::Namespace(namespace) = namespace_tool else {
-        panic!("expected namespace tool");
-    };
-    assert_eq!(
-        namespace.description,
-        "Tools in the test_server/ namespace."
-    );
-}
-
-#[test]
-fn test_build_specs_mcp_tools_sorted_by_name() {
-    let model_info = model_info();
-    let mut features = Features::with_defaults();
-    features.enable(Feature::UnifiedExec);
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-
-    let tools_map = HashMap::from([
-        (
-            ToolName::namespaced("test_server/", "do"),
-            mcp_tool("do", "a", serde_json::json!({"type": "object"})),
-        ),
-        (
-            ToolName::namespaced("test_server/", "something"),
-            mcp_tool("something", "b", serde_json::json!({"type": "object"})),
-        ),
-        (
-            ToolName::namespaced("test_server/", "cool"),
-            mcp_tool("cool", "c", serde_json::json!({"type": "object"})),
-        ),
-    ]);
-
-    let (tools, _) = build_specs(
-        &tools_config,
-        Some(tools_map),
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
-
-    assert_eq!(
-        namespace_function_names(&tools, "test_server/"),
-        vec![
-            "cool".to_string(),
-            "do".to_string(),
-            "something".to_string(),
-        ]
-    );
-}
-
-#[test]
-fn search_tool_description_lists_each_mcp_source_once() {
-    let model_info = search_capable_model_info();
-    let mut features = Features::with_defaults();
-    features.enable(Feature::Apps);
-    features.enable(Feature::ToolSearch);
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-
-    let (tools, registry) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        Some(vec![
-            deferred_mcp_tool(
-                "_create_event",
-                "mcp__codex_apps__calendar",
-                CODEX_APPS_MCP_SERVER_NAME,
-                Some("Calendar"),
-                Some("Plan events and manage your calendar."),
-            ),
-            deferred_mcp_tool(
-                "_list_events",
-                "mcp__codex_apps__calendar",
-                CODEX_APPS_MCP_SERVER_NAME,
-                Some("Calendar"),
-                Some("Plan events and manage your calendar."),
-            ),
-            deferred_mcp_tool(
-                "_search_threads",
-                "mcp__codex_apps__gmail",
-                CODEX_APPS_MCP_SERVER_NAME,
-                Some("Gmail"),
-                Some("Find and summarize email threads."),
-            ),
-            deferred_mcp_tool(
-                "echo",
-                "mcp__rmcp__",
-                "rmcp",
-                /*connector_name*/ None,
-                Some("Remote memory tools."),
-            ),
-        ]),
-        &[],
-    );
-
-    let search_tool = find_tool(&tools, TOOL_SEARCH_TOOL_NAME);
-    let ToolSpec::ToolSearch { description, .. } = search_tool else {
-        panic!("expected tool_search tool");
-    };
-    let description = description.as_str();
-    assert!(description.contains("- Calendar: Plan events and manage your calendar."));
-    assert!(description.contains("- Gmail: Find and summarize email threads."));
-    assert_eq!(
-        description
-            .matches("- Calendar: Plan events and manage your calendar.")
-            .count(),
-        1
-    );
-    assert!(description.contains("- rmcp: Remote memory tools."));
-    assert!(!description.contains("mcp__rmcp__echo"));
-
-    assert!(registry.has_handler(&ToolName::namespaced(
-        "mcp__codex_apps__calendar",
-        "_create_event",
-    )));
-    assert!(registry.has_handler(&ToolName::namespaced("mcp__rmcp__", "echo")));
-}
-
-#[test]
-fn search_tool_requires_model_capability_and_enabled_feature() {
-    let model_info = search_capable_model_info();
-    let deferred_mcp_tools = Some(vec![deferred_mcp_tool(
-        "_create_event",
-        "mcp__codex_apps__calendar",
-        CODEX_APPS_MCP_SERVER_NAME,
-        Some("Calendar"),
-        /*description*/ None,
-    )]);
-
-    let features = Features::with_defaults();
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &ModelInfo {
-            supports_search_tool: false,
-            ..model_info.clone()
-        },
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let (tools, _) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        deferred_mcp_tools.clone(),
-        &[],
-    );
-    assert_lacks_tool_name(&tools, TOOL_SEARCH_TOOL_NAME);
-
-    let mut features_without_tool_search = Features::with_defaults();
-    features_without_tool_search.disable(Feature::ToolSearch);
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features_without_tool_search,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let (tools, _) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        deferred_mcp_tools.clone(),
-        &[],
-    );
-    assert_lacks_tool_name(&tools, TOOL_SEARCH_TOOL_NAME);
-
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let (tools, _) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        deferred_mcp_tools,
-        &[],
-    );
-    assert_contains_tool_names(&tools, &[TOOL_SEARCH_TOOL_NAME]);
-}
-
-#[test]
-fn no_search_tool_when_namespaces_disabled() {
-    let model_info = search_capable_model_info();
-    let mut features = Features::with_defaults();
-    features.enable(Feature::ToolSearch);
-    let available_models = Vec::new();
-    let mut tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    tools_config.namespace_tools = false;
-
-    let (tools, registry) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        Some(vec![deferred_mcp_tool(
-            "_create_event",
-            "mcp__codex_apps__calendar",
-            CODEX_APPS_MCP_SERVER_NAME,
-            Some("Calendar"),
-            Some("Plan events and manage your calendar."),
-        )]),
-        &[],
-    );
-
-    assert_lacks_tool_name(&tools, TOOL_SEARCH_TOOL_NAME);
-    assert!(!registry.has_handler(&ToolName::plain(TOOL_SEARCH_TOOL_NAME)));
-}
-
-#[test]
-fn search_tool_registers_for_deferred_dynamic_tools() {
-    let model_info = search_capable_model_info();
-    let mut features = Features::with_defaults();
-    features.enable(Feature::ToolSearch);
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let dynamic_tools = vec![
-        DynamicToolSpec {
-            namespace: Some("codex_app".to_string()),
-            name: "automation_update".to_string(),
-            description: "Create, update, view, or delete recurring automations.".to_string(),
-            input_schema: json!({
-                "type": "object",
-                "properties": {
-                    "mode": { "type": "string" },
-                },
-            }),
-            defer_loading: true,
-        },
-        DynamicToolSpec {
-            namespace: Some("codex_app".to_string()),
-            name: "automation_list".to_string(),
-            description: "List recurring automations.".to_string(),
-            input_schema: json!({
-                "type": "object",
-                "properties": {},
-            }),
-            defer_loading: true,
-        },
-    ];
-
-    let (tools, registry) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &dynamic_tools,
-    );
-
-    let search_tool = find_tool(&tools, TOOL_SEARCH_TOOL_NAME);
-    let ToolSpec::ToolSearch { description, .. } = search_tool else {
-        panic!("expected tool_search tool");
-    };
-    assert!(description.contains("- Dynamic tools: Tools provided by the current Codex thread."));
-    assert_contains_tool_names(&tools, &[TOOL_SEARCH_TOOL_NAME]);
-    assert_lacks_tool_name(&tools, "codex_app");
-    assert!(registry.has_handler(&ToolName::plain(TOOL_SEARCH_TOOL_NAME)));
-    assert!(registry.has_handler(&ToolName::namespaced("codex_app", "automation_update")));
-    assert!(registry.has_handler(&ToolName::namespaced("codex_app", "automation_list")));
-}
-
-#[test]
-fn search_tool_is_hidden_for_deferred_dynamic_tools_when_namespace_tools_are_disabled() {
-    let model_info = search_capable_model_info();
-    let mut features = Features::with_defaults();
-    features.enable(Feature::ToolSearch);
-    let available_models = Vec::new();
-    let mut tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    tools_config.namespace_tools = false;
-    let dynamic_tools = vec![
-        DynamicToolSpec {
-            namespace: Some("codex_app".to_string()),
-            name: "automation_update".to_string(),
-            description: "Create or update automations.".to_string(),
-            input_schema: json!({"type": "object", "properties": {}}),
-            defer_loading: true,
-        },
-        DynamicToolSpec {
-            namespace: None,
-            name: "plain_dynamic".to_string(),
-            description: "Plain dynamic tool.".to_string(),
-            input_schema: json!({"type": "object", "properties": {}}),
-            defer_loading: true,
-        },
-    ];
-
-    let (tools, registry) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &dynamic_tools,
-    );
-
-    assert_lacks_tool_name(&tools, TOOL_SEARCH_TOOL_NAME);
-    assert_lacks_tool_name(&tools, "codex_app");
-    assert_lacks_tool_name(&tools, "plain_dynamic");
-    assert!(!registry.has_handler(&ToolName::plain(TOOL_SEARCH_TOOL_NAME)));
-    assert!(registry.has_handler(&ToolName::namespaced("codex_app", "automation_update")));
-    assert!(registry.has_handler(&ToolName::plain("plain_dynamic")));
-}
-
-#[test]
-fn request_plugin_install_is_not_registered_without_feature_flag() {
-    let model_info = search_capable_model_info();
-    let mut features = Features::with_defaults();
-    features.enable(Feature::ToolSearch);
-    features.enable(Feature::Apps);
-    features.enable(Feature::Plugins);
-    features.disable(Feature::ToolSuggest);
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let (tools, _) = build_specs_with_discoverable_tools(
-        &tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        Some(vec![discoverable_connector(
-            "connector_2128aebfecb84f64a069897515042a44",
-            "Google Calendar",
-            "Plan events and schedules.",
-        )]),
-        /*extension_tool_executors*/ &[],
-        &[],
-    );
-
-    assert!(
-        !tools
-            .iter()
-            .any(|tool| tool.name() == REQUEST_PLUGIN_INSTALL_TOOL_NAME)
-    );
-}
-
-#[test]
-fn request_plugin_install_can_be_registered_without_search_tool() {
-    let model_info = ModelInfo {
-        supports_search_tool: false,
-        ..search_capable_model_info()
-    };
-    let mut features = Features::with_defaults();
-    features.enable(Feature::Apps);
-    features.enable(Feature::Plugins);
-    features.enable(Feature::ToolSuggest);
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let (tools, _) = build_specs_with_discoverable_tools(
-        &tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        Some(vec![discoverable_connector(
-            "connector_2128aebfecb84f64a069897515042a44",
-            "Google Calendar",
-            "Plan events and schedules.",
-        )]),
-        /*extension_tool_executors*/ &[],
-        &[],
-    );
-
-    assert_contains_tool_names(&tools, &[REQUEST_PLUGIN_INSTALL_TOOL_NAME]);
-    let request_plugin_install = find_tool(&tools, REQUEST_PLUGIN_INSTALL_TOOL_NAME);
-    assert_lacks_tool_name(&tools, TOOL_SEARCH_TOOL_NAME);
-
-    let ToolSpec::Function(ResponsesApiTool { description, .. }) = request_plugin_install else {
-        panic!("expected function tool");
-    };
-    assert!(description.contains(
-        "Use this tool only to ask the user to install one known plugin or connector from the list below. The list contains known candidates that are not currently installed."
-    ));
-    assert!(description.contains(
-        "`tool_search` is not available, or it has already been called and did not find or make the requested tool callable."
-    ));
-}
-
-#[test]
-fn request_plugin_install_description_lists_discoverable_tools() {
-    let model_info = search_capable_model_info();
-    let mut features = Features::with_defaults();
-    features.enable(Feature::Apps);
-    features.enable(Feature::Plugins);
-    features.enable(Feature::ToolSearch);
-    features.enable(Feature::ToolSuggest);
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-
-    let discoverable_tools = vec![
-        discoverable_connector(
-            "connector_2128aebfecb84f64a069897515042a44",
-            "Google Calendar",
-            "Plan events and schedules.",
-        ),
-        discoverable_connector(
-            "connector_68df038e0ba48191908c8434991bbac2",
-            "Gmail",
-            "Find and summarize email threads.",
-        ),
-        DiscoverableTool::Plugin(Box::new(DiscoverablePluginInfo {
-            id: "sample@test".to_string(),
-            name: "Sample Plugin".to_string(),
-            description: None,
-            has_skills: true,
-            mcp_server_names: vec!["sample-docs".to_string()],
-            app_connector_ids: vec!["connector_sample".to_string()],
-        })),
-    ];
-
-    let (tools, registry) = build_specs_with_discoverable_tools(
-        &tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        Some(discoverable_tools),
-        /*extension_tool_executors*/ &[],
-        &[],
-    );
-    assert!(registry.has_handler(&ToolName::plain(REQUEST_PLUGIN_INSTALL_TOOL_NAME)));
-
-    let request_plugin_install = find_tool(&tools, REQUEST_PLUGIN_INSTALL_TOOL_NAME);
-    let ToolSpec::Function(ResponsesApiTool {
-        description,
-        parameters,
-        ..
-    }) = request_plugin_install
-    else {
-        panic!("expected function tool");
-    };
-    assert!(description.contains(
-        "Use this tool only to ask the user to install one known plugin or connector from the list below. The list contains known candidates that are not currently installed."
-    ));
-    assert!(description.contains("Google Calendar"));
-    assert!(description.contains("Gmail"));
-    assert!(description.contains("Sample Plugin"));
-    assert!(description.contains("Plan events and schedules."));
-    assert!(description.contains("Find and summarize email threads."));
-    assert!(description.contains("id: `sample@test`, type: plugin, action: install"));
-    assert!(description.contains("`action_type`: `install`"));
-    assert!(
-        description.contains("skills; MCP servers: sample-docs; app connectors: connector_sample")
-    );
-    assert!(
-        description.contains(
-            "The user explicitly asks to use a specific plugin or connector that is not already available in the current context or active `tools` list."
-        )
-    );
-    assert!(description.contains(
-        "`tool_search` is not available, or it has already been called and did not find or make the requested tool callable."
-    ));
-    assert!(description.contains(
-        "The plugin or connector is one of the known installable plugins or connectors listed below. Only ask to install plugins or connectors from this list."
-    ));
-    assert!(description.contains(
-        "Do not use this tool for adjacent capabilities, broad recommendations, or tools that merely seem useful."
-    ));
-    assert!(description.contains("IMPORTANT: DO NOT call this tool in parallel with other tools."));
-    assert!(description.contains(
-        "If current active tools aren't relevant and `tool_search` is available, only call this tool after `tool_search` has already been tried and found no relevant tool."
-    ));
-    assert!(!description.contains("targeted lookup"));
-    assert!(!description.contains("broad or speculative searches"));
-    assert!(description.contains("Only proceed when one listed plugin or connector exactly fits."));
-    assert!(description.contains(
-        "If we found both connectors and plugins to install, use plugins first, only use connectors if the corresponding plugin is installed but the connector is not."
-    ));
-    assert!(!description.contains("{{discoverable_tools}}"));
-    assert!(!description.contains("tool_search fails to find a good match"));
-    let (_, required) = expect_object_schema(parameters);
-    assert_eq!(
-        required,
-        Some(&vec![
-            "tool_type".to_string(),
-            "action_type".to_string(),
-            "tool_id".to_string(),
-            "suggest_reason".to_string(),
-        ])
-    );
-}
-
-#[test]
-fn code_mode_augments_mcp_tool_descriptions_with_namespaced_sample() {
-    let model_info = model_info();
-    let mut features = Features::with_defaults();
-    features.enable(Feature::CodeMode);
-    features.enable(Feature::CodeModeOnly);
-    features.enable(Feature::UnifiedExec);
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-
-    let (tools, _) = build_specs(
-        &tools_config,
-        Some(HashMap::from([(
-            ToolName::namespaced("mcp__sample__", "echo"),
-            mcp_tool(
-                "echo",
-                "Echo text",
-                serde_json::json!({
-                    "type": "object",
-                    "properties": {
-                        "message": {"type": "string"}
-                    },
-                    "required": ["message"],
-                    "additionalProperties": false
-                }),
-            ),
-        )])),
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
-
-    let ResponsesApiTool { description, .. } =
-        find_namespace_function_tool(&tools, "mcp__sample__", "echo");
-
-    assert_eq!(
-        description,
-        r#"Echo text
-
-exec tool declaration:
-```ts
-declare const tools: { mcp__sample__echo(args: { message: string; }): Promise<CallToolResult>; };
-```"#
-    );
-}
-
-#[test]
-fn code_mode_preserves_nullable_and_literal_mcp_input_shapes() {
-    let model_info = model_info();
-    let mut features = Features::with_defaults();
-    features.enable(Feature::CodeMode);
-    features.enable(Feature::UnifiedExec);
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-
-    let (tools, _) = build_specs(
-        &tools_config,
-        Some(HashMap::from([(
-            ToolName::namespaced("mcp__sample__", "fn"),
-            mcp_tool(
-                "fn",
-                "Sample fn",
-                serde_json::json!({
-                    "type": "object",
-                    "properties": {
-                        "open": {
-                            "anyOf": [
-                                {
-                                    "type": "array",
-                                    "items": {
-                                        "type": "object",
-                                        "properties": {
-                                            "ref_id": {"type": "string"},
-                                            "lineno": {"anyOf": [{"type": "integer"}, {"type": "null"}]}
-                                        },
-                                        "required": ["ref_id"],
-                                        "additionalProperties": false
-                                    }
-                                },
-                                {"type": "null"}
-                            ]
-                        },
-                        "tagged_list": {
-                            "anyOf": [
-                                {
-                                    "type": "array",
-                                    "items": {
-                                        "type": "object",
-                                        "properties": {
-                                            "kind": {"type": "const", "const": "tagged"},
-                                            "variant": {"type": "enum", "enum": ["alpha", "beta"]},
-                                            "scope": {"type": "enum", "enum": ["one", "two"]}
-                                        },
-                                        "required": ["kind", "variant", "scope"]
-                                    }
-                                },
-                                {"type": "null"}
-                            ]
-                        },
-                        "response_length": {"type": "enum", "enum": ["short", "medium", "long"]}
-                    },
-                    "additionalProperties": false
-                }),
-            ),
-        )])),
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
-
-    let ResponsesApiTool { description, .. } =
-        find_namespace_function_tool(&tools, "mcp__sample__", "fn");
-
-    assert!(description.contains(
-        r#"exec tool declaration:
-```ts
-declare const tools: { mcp__sample__fn(args: { open?: Array<{ lineno?: number | null; ref_id: string; }> | null; response_length?: "short" | "medium" | "long"; tagged_list?: Array<{ kind: "tagged"; scope: "one" | "two"; variant: "alpha" | "beta"; }> | null; }): Promise<CallToolResult>; };
-```"#
-    ));
-}
-
-#[test]
-fn code_mode_augments_builtin_tool_descriptions_with_typed_sample() {
-    let model_info = model_info();
-    let mut features = Features::with_defaults();
-    features.enable(Feature::CodeMode);
-    features.enable(Feature::UnifiedExec);
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-
-    let (tools, _) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
-    let ToolSpec::Function(ResponsesApiTool { description, .. }) =
-        find_tool(&tools, VIEW_IMAGE_TOOL_NAME)
-    else {
-        panic!("expected function tool");
-    };
-
-    assert_eq!(
-        description,
-        "View a local image from the filesystem (only use if given a full filepath by the user, and the image isn't already attached to the thread context within <image ...> tags).\n\nexec tool declaration:\n```ts\ndeclare const tools: { view_image(args: {\n  // Local filesystem path to an image file\n  path: string;\n}): Promise<{\n  // Image detail hint returned by view_image. Returns `original` when original resolution is preserved, otherwise `null`.\n  detail: string | null;\n  // Data URL for the loaded image.\n  image_url: string;\n}>; };\n```"
-    );
-}
-
-#[test]
-fn code_mode_only_exec_description_includes_full_nested_tool_details() {
-    let model_info = model_info();
-    let mut features = Features::with_defaults();
-    features.enable(Feature::CodeMode);
-    features.enable(Feature::CodeModeOnly);
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-
-    let (tools, _) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
-    let ToolSpec::Freeform(FreeformTool { description, .. }) = find_tool(&tools, "exec") else {
-        panic!("expected freeform tool");
-    };
-
-    assert!(!description.contains("Enabled nested tools:"));
-    assert!(!description.contains("Nested tool reference:"));
-    assert!(description.starts_with(
-        "Use `exec/wait` tool to run all other tools, do not attempt to use any other tools directly"
-    ));
-    assert!(description.contains("### `update_plan`"));
-    assert!(description.contains("### `view_image`"));
-}
-
-#[test]
-fn code_mode_only_exec_description_includes_extension_tool_details() {
-    let model_info = model_info();
-    let mut features = Features::with_defaults();
-    features.enable(Feature::CodeMode);
-    features.enable(Feature::CodeModeOnly);
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-
-    let extension_tool_executors = vec![extension_tool_executor(
-        "extension_echo",
-        "Echoes arguments through an extension tool.",
-    )];
-    let (tools, _) = build_specs_with_discoverable_tools(
-        &tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        /*discoverable_tools*/ None,
-        &extension_tool_executors,
-        &[],
-    );
-    let ToolSpec::Freeform(FreeformTool { description, .. }) = find_tool(&tools, "exec") else {
-        panic!("expected freeform tool");
-    };
-
-    assert!(description.contains("### `extension_echo`"));
-    assert!(description.contains("Echoes arguments through an extension tool."));
-}
-
-#[test]
-fn code_mode_exec_description_omits_nested_tool_details_when_not_code_mode_only() {
-    let model_info = model_info();
-    let mut features = Features::with_defaults();
-    features.enable(Feature::CodeMode);
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-
-    let (tools, _) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
-    let ToolSpec::Freeform(FreeformTool { description, .. }) = find_tool(&tools, "exec") else {
-        panic!("expected freeform tool");
-    };
-
-    assert!(!description.starts_with(
-        "Use `exec/wait` tool to run all other tools, do not attempt to use any other tools directly"
-    ));
-    assert!(!description.contains("### `update_plan`"));
-    assert!(!description.contains("### `view_image`"));
-}
-
-fn model_info() -> ModelInfo {
-    serde_json::from_value(json!({
-        "slug": "gpt-5-codex",
-        "display_name": "GPT-5 Codex",
-        "description": null,
-        "supported_reasoning_levels": [],
-        "shell_type": "shell_command",
-        "visibility": "list",
-        "supported_in_api": true,
-        "priority": 1,
-        "availability_nux": null,
-        "upgrade": null,
-        "base_instructions": "base",
-        "model_messages": null,
-        "supports_reasoning_summaries": false,
-        "default_reasoning_summary": "auto",
-        "support_verbosity": false,
-        "default_verbosity": null,
-        "apply_patch_tool_type": "freeform",
-        "truncation_policy": {
-            "mode": "bytes",
-            "limit": 10000
-        },
-        "supports_parallel_tool_calls": false,
-        "supports_image_detail_original": false,
-        "context_window": null,
-        "auto_compact_token_limit": null,
-        "effective_context_window_percent": 95,
-        "experimental_supported_tools": [],
-        "input_modalities": ["text", "image"],
-        "supports_search_tool": false
-    }))
-    .expect("deserialize test model")
-}
-
-fn search_capable_model_info() -> ModelInfo {
-    ModelInfo {
-        supports_search_tool: true,
-        ..model_info()
-    }
-}
-
-fn build_specs(
-    config: &ToolsConfig,
-    mcp_tools: Option<HashMap<ToolName, rmcp::model::Tool>>,
-    deferred_mcp_tools: Option<Vec<ToolInfo>>,
-    dynamic_tools: &[DynamicToolSpec],
-) -> (Vec<ToolSpec>, ToolRegistry) {
-    build_specs_with_discoverable_tools(
-        config,
-        mcp_tools,
-        deferred_mcp_tools,
-        /*discoverable_tools*/ None,
-        /*extension_tool_executors*/ &[],
-        dynamic_tools,
-    )
-}
-
-fn build_specs_with_discoverable_tools(
-    config: &ToolsConfig,
-    mcp_tools: Option<HashMap<ToolName, rmcp::model::Tool>>,
-    deferred_mcp_tools: Option<Vec<ToolInfo>>,
-    discoverable_tools: Option<Vec<DiscoverableTool>>,
-    extension_tool_executors: &[Arc<dyn ExtensionToolExecutor>],
-    dynamic_tools: &[DynamicToolSpec],
-) -> (Vec<ToolSpec>, ToolRegistry) {
-    let mcp_tool_inputs = mcp_tools.as_ref().map(|mcp_tools| {
-        mcp_tools
-            .iter()
-            .map(|(name, tool)| tool_info_from_parts(name, tool.clone()))
-            .collect::<Vec<_>>()
-    });
-    let builder = build_tool_registry_builder(
-        config,
-        ToolRegistryBuildParams {
-            mcp_tools: mcp_tool_inputs.as_deref(),
-            deferred_mcp_tools: deferred_mcp_tools.as_deref(),
-            discoverable_tools: discoverable_tools.as_deref(),
-            extension_tool_executors,
-            dynamic_tools,
-            default_agent_type_description: DEFAULT_AGENT_TYPE_DESCRIPTION,
-            wait_agent_timeouts: wait_agent_timeout_options(),
-        },
-    );
-    builder.build()
-}
-
-fn mcp_tool(name: &str, description: &str, input_schema: serde_json::Value) -> rmcp::model::Tool {
-    rmcp::model::Tool {
-        name: name.to_string().into(),
-        title: None,
-        description: Some(description.to_string().into()),
-        input_schema: std::sync::Arc::new(rmcp::model::object(input_schema)),
-        output_schema: None,
-        annotations: None,
-        execution: None,
-        icons: None,
-        meta: None,
-    }
-}
-
-fn tool_info_from_parts(name: &ToolName, tool: rmcp::model::Tool) -> ToolInfo {
-    ToolInfo {
-        server_name: server_name_from_tool_name(name),
-        supports_parallel_tool_calls: false,
-        server_origin: None,
-        callable_name: name.name.clone(),
-        callable_namespace: name.namespace.clone().unwrap_or_default(),
-        namespace_description: None,
-        tool,
-        connector_id: None,
-        connector_name: None,
-        plugin_display_names: Vec::new(),
-    }
-}
-
-fn server_name_from_tool_name(name: &ToolName) -> String {
-    name.namespace
-        .as_deref()
-        .and_then(|namespace| {
-            namespace
-                .strip_prefix("mcp__")
-                .and_then(|suffix| suffix.strip_suffix("__"))
-        })
-        .unwrap_or_else(|| name.namespace.as_deref().unwrap_or("test_server"))
-        .to_string()
-}
-
-#[test]
-fn code_mode_augments_mcp_tool_descriptions_with_structured_output_sample() {
-    let model_info = model_info();
-    let mut features = Features::with_defaults();
-    features.enable(Feature::CodeMode);
-    features.enable(Feature::CodeModeOnly);
-    features.enable(Feature::UnifiedExec);
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-
-    let mut tool = mcp_tool(
-        "echo",
-        "Echo text",
-        serde_json::json!({
-            "type": "object",
-            "properties": {
-                "message": {"type": "string"}
-            },
-            "required": ["message"],
-            "additionalProperties": false
-        }),
-    );
-    tool.output_schema = Some(std::sync::Arc::new(rmcp::model::object(
-        serde_json::json!({
-            "type": "object",
-            "properties": {
-                "echo": {"type": "string"},
-                "env": {
-                    "anyOf": [
-                        {"type": "string"},
-                        {"type": "null"}
-                    ]
-                }
-            },
-            "required": ["echo", "env"],
-            "additionalProperties": false
-        }),
-    )));
-
-    let (tools, _) = build_specs(
-        &tools_config,
-        Some(HashMap::from([(
-            ToolName::namespaced("mcp__sample__", "echo"),
-            tool,
-        )])),
-        /*deferred_mcp_tools*/ None,
-        &[],
-    );
-
-    let ResponsesApiTool { description, .. } =
-        find_namespace_function_tool(&tools, "mcp__sample__", "echo");
-
-    assert_eq!(
-        description,
-        r#"Echo text
-
-exec tool declaration:
-```ts
-declare const tools: { mcp__sample__echo(args: { message: string; }): Promise<CallToolResult<{ echo: string; env: string | null; }>>; };
-```"#
-    );
-}
-
-fn discoverable_connector(id: &str, name: &str, description: &str) -> DiscoverableTool {
-    let slug = name.replace(' ', "-").to_lowercase();
-    DiscoverableTool::Connector(Box::new(AppInfo {
-        id: id.to_string(),
-        name: name.to_string(),
-        description: Some(description.to_string()),
-        logo_url: None,
-        logo_url_dark: None,
-        distribution_channel: None,
-        branding: None,
-        app_metadata: None,
-        labels: None,
-        install_url: Some(format!("https://chatgpt.com/apps/{slug}/{id}")),
-        is_accessible: false,
-        is_enabled: true,
-        plugin_display_names: Vec::new(),
-    }))
-}
-
-fn deferred_mcp_tool(
-    tool_name: &str,
-    tool_namespace: &str,
-    server_name: &str,
-    connector_name: Option<&str>,
-    description: Option<&str>,
-) -> ToolInfo {
-    ToolInfo {
-        server_name: server_name.to_string(),
-        supports_parallel_tool_calls: false,
-        server_origin: None,
-        callable_name: tool_name.to_string(),
-        callable_namespace: tool_namespace.to_string(),
-        namespace_description: description.map(str::to_string),
-        tool: mcp_tool(
-            tool_name,
-            description.unwrap_or("Deferred MCP tool"),
-            json!({}),
-        ),
-        connector_id: None,
-        connector_name: connector_name.map(str::to_string),
-        plugin_display_names: Vec::new(),
-    }
-}
-
-fn assert_contains_tool_names(tools: &[ToolSpec], expected_subset: &[&str]) {
-    use std::collections::HashSet;
-
-    let mut names = HashSet::new();
-    let mut duplicates = Vec::new();
-    for name in tools.iter().map(ToolSpec::name) {
-        if !names.insert(name) {
-            duplicates.push(name);
-        }
-    }
-    assert!(
-        duplicates.is_empty(),
-        "duplicate tool entries detected: {duplicates:?}"
-    );
-    for expected in expected_subset {
-        assert!(
-            names.contains(expected),
-            "expected tool {expected} to be present; had: {names:?}"
-        );
-    }
-}
-
-fn assert_lacks_tool_name(tools: &[ToolSpec], expected_absent: &str) {
-    let names = tools.iter().map(ToolSpec::name).collect::<Vec<_>>();
-    assert!(
-        !names.contains(&expected_absent),
-        "expected tool {expected_absent} to be absent; had: {names:?}"
-    );
-}
-
-fn request_user_input_tool_spec(available_modes: &[ModeKind]) -> ToolSpec {
-    create_request_user_input_tool(request_user_input_tool_description(available_modes))
-}
-
-fn spawn_agent_tool_options(config: &ToolsConfig) -> SpawnAgentToolOptions {
-    SpawnAgentToolOptions {
-        available_models: config.available_models.clone(),
-        agent_type_description: agent_type_description(config, DEFAULT_AGENT_TYPE_DESCRIPTION),
-        hide_agent_type_model_reasoning: config.hide_spawn_agent_metadata,
-        include_usage_hint: config.spawn_agent_usage_hint,
-        usage_hint_text: config.spawn_agent_usage_hint_text.clone(),
-        max_concurrent_threads_per_session: config.max_concurrent_threads_per_session,
-    }
-}
-
-fn wait_agent_timeout_options() -> WaitAgentTimeoutOptions {
-    WaitAgentTimeoutOptions {
-        default_timeout_ms: DEFAULT_WAIT_TIMEOUT_MS,
-        min_timeout_ms: MIN_WAIT_TIMEOUT_MS,
-        max_timeout_ms: MAX_WAIT_TIMEOUT_MS,
-    }
-}
-
-fn find_tool<'a>(tools: &'a [ToolSpec], expected_name: &str) -> &'a ToolSpec {
-    tools
-        .iter()
-        .find(|tool| tool.name() == expected_name)
-        .unwrap_or_else(|| panic!("expected tool {expected_name}"))
-}
-
-fn assert_process_tool_environment_id(
-    tools: &[ToolSpec],
-    expected_name: &str,
-    expected_present: bool,
-) {
-    let tool = find_tool(tools, expected_name);
-    let ToolSpec::Function(ResponsesApiTool { parameters, .. }) = tool else {
-        panic!("expected function tool {expected_name}");
-    };
-    let (properties, _) = expect_object_schema(parameters);
-    assert_eq!(
-        properties.contains_key("environment_id"),
-        expected_present,
-        "{expected_name} environment_id parameter presence"
-    );
-}
-
-fn assert_apply_patch_environment_id(tools: &[ToolSpec], expected_present: bool) {
-    let tool = find_tool(tools, "apply_patch");
-    let ToolSpec::Freeform(FreeformTool { format, .. }) = tool else {
-        panic!("expected freeform apply_patch tool");
-    };
-    assert_eq!(
-        format.definition.contains("environment_id?"),
-        expected_present,
-        "apply_patch environment_id grammar presence"
-    );
-}
-
-fn find_namespace_function_tool<'a>(
-    tools: &'a [ToolSpec],
-    expected_namespace: &str,
-    expected_name: &str,
-) -> &'a ResponsesApiTool {
-    let namespace_tool = find_tool(tools, expected_namespace);
-    let ToolSpec::Namespace(namespace) = namespace_tool else {
-        panic!("expected namespace tool {expected_namespace}");
-    };
-    namespace
-        .tools
-        .iter()
-        .find_map(|tool| match tool {
-            ResponsesApiNamespaceTool::Function(tool) if tool.name == expected_name => Some(tool),
-            _ => None,
-        })
-        .unwrap_or_else(|| panic!("expected tool {expected_namespace}{expected_name} in namespace"))
-}
-
-fn namespace_function_names(tools: &[ToolSpec], expected_namespace: &str) -> Vec<String> {
-    let namespace_tool = find_tool(tools, expected_namespace);
-    let ToolSpec::Namespace(namespace) = namespace_tool else {
-        panic!("expected namespace tool {expected_namespace}");
-    };
-    namespace
-        .tools
-        .iter()
-        .map(|tool| match tool {
-            ResponsesApiNamespaceTool::Function(tool) => tool.name.clone(),
-        })
-        .collect()
-}
-
-fn expect_object_schema(
-    schema: &JsonSchema,
-) -> (&BTreeMap<String, JsonSchema>, Option<&Vec<String>>) {
-    assert_eq!(
-        schema.schema_type,
-        Some(JsonSchemaType::Single(JsonSchemaPrimitiveType::Object))
-    );
-    let properties = schema
-        .properties
-        .as_ref()
-        .expect("expected object properties");
-    (properties, schema.required.as_ref())
-}
-
-fn expect_string_description(schema: &JsonSchema) -> &str {
-    assert_eq!(
-        schema.schema_type,
-        Some(JsonSchemaType::Single(JsonSchemaPrimitiveType::String))
-    );
-    schema.description.as_deref().expect("expected description")
-}
-
-fn strip_descriptions_schema(schema: &mut JsonSchema) {
-    if let Some(variants) = &mut schema.any_of {
-        for variant in variants {
-            strip_descriptions_schema(variant);
-        }
-    }
-    if let Some(items) = &mut schema.items {
-        strip_descriptions_schema(items);
-    }
-    if let Some(properties) = &mut schema.properties {
-        for value in properties.values_mut() {
-            strip_descriptions_schema(value);
-        }
-    }
-    if let Some(AdditionalProperties::Schema(schema)) = &mut schema.additional_properties {
-        strip_descriptions_schema(schema);
-    }
-    schema.description = None;
-}
-
-fn strip_descriptions_tool(spec: &mut ToolSpec) {
-    match spec {
-        ToolSpec::ToolSearch { parameters, .. } => strip_descriptions_schema(parameters),
-        ToolSpec::Function(ResponsesApiTool { parameters, .. }) => {
-            strip_descriptions_schema(parameters);
-        }
-        ToolSpec::Namespace(namespace) => {
-            for tool in &mut namespace.tools {
-                match tool {
-                    ResponsesApiNamespaceTool::Function(ResponsesApiTool {
-                        parameters, ..
-                    }) => {
-                        strip_descriptions_schema(parameters);
-                    }
-                }
-            }
-        }
-        ToolSpec::Freeform(FreeformTool { .. })
-        | ToolSpec::LocalShell {}
-        | ToolSpec::ImageGeneration { .. }
-        | ToolSpec::WebSearch { .. } => {}
-    }
+
+    let unsupported_provider = probe(|turn| {
+        set_web_search_mode(turn, WebSearchMode::Live);
+        use_bedrock_provider(turn);
+    })
+    .await;
+    unsupported_provider.assert_visible_lacks(&["web_search"]);
 }
diff --git a/codex-rs/core/src/tools/spec_plan_types.rs b/codex-rs/core/src/tools/spec_plan_types.rs
deleted file mode 100644
index 247fa05715..0000000000
--- a/codex-rs/core/src/tools/spec_plan_types.rs
+++ /dev/null
@@ -1,29 +0,0 @@
-use crate::tools::handlers::multi_agents_spec::WaitAgentTimeoutOptions;
-use codex_extension_api::ExtensionToolExecutor;
-use codex_mcp::ToolInfo;
-use codex_protocol::dynamic_tools::DynamicToolSpec;
-use codex_tools::DiscoverableTool;
-use codex_tools::ToolsConfig;
-use std::sync::Arc;
-
-#[derive(Clone, Copy)]
-pub struct ToolRegistryBuildParams<'a> {
-    pub mcp_tools: Option<&'a [ToolInfo]>,
-    pub deferred_mcp_tools: Option<&'a [ToolInfo]>,
-    pub discoverable_tools: Option<&'a [DiscoverableTool]>,
-    pub extension_tool_executors: &'a [Arc<dyn ExtensionToolExecutor>],
-    pub dynamic_tools: &'a [DynamicToolSpec],
-    pub default_agent_type_description: &'a str,
-    pub wait_agent_timeouts: WaitAgentTimeoutOptions,
-}
-
-pub(crate) fn agent_type_description(
-    config: &ToolsConfig,
-    default_agent_type_description: &str,
-) -> String {
-    if config.agent_type_description.is_empty() {
-        default_agent_type_description.to_string()
-    } else {
-        config.agent_type_description.clone()
-    }
-}
diff --git a/codex-rs/core/src/tools/spec_tests.rs b/codex-rs/core/src/tools/spec_tests.rs
deleted file mode 100644
index 560f87b2f0..0000000000
--- a/codex-rs/core/src/tools/spec_tests.rs
+++ /dev/null
@@ -1,1386 +0,0 @@
-use crate::config::test_config;
-use crate::shell::Shell;
-use crate::shell::ShellType;
-use crate::test_support::construct_model_info_offline;
-use crate::tools::ToolRouter;
-use crate::tools::router::ToolRouterParams;
-use codex_app_server_protocol::AppInfo;
-use codex_features::Feature;
-use codex_features::Features;
-use codex_mcp::CODEX_APPS_MCP_SERVER_NAME;
-use codex_models_manager::bundled_models_response;
-use codex_models_manager::model_info::with_config_overrides;
-use codex_protocol::config_types::WebSearchMode;
-use codex_protocol::config_types::WindowsSandboxLevel;
-use codex_protocol::models::PermissionProfile;
-use codex_protocol::openai_models::ConfigShellToolType;
-use codex_protocol::openai_models::ModelInfo;
-use codex_protocol::protocol::SessionSource;
-use codex_tools::DiscoverableTool;
-use codex_tools::JsonSchema;
-use codex_tools::REQUEST_PLUGIN_INSTALL_TOOL_NAME;
-use codex_tools::ResponsesApiNamespaceTool;
-use codex_tools::ResponsesApiTool;
-use codex_tools::ShellCommandBackendConfig;
-use codex_tools::TOOL_SEARCH_TOOL_NAME;
-use codex_tools::ToolName;
-use codex_tools::ToolSpec;
-use codex_tools::ToolsConfig;
-use codex_tools::ToolsConfigParams;
-use codex_tools::UnifiedExecShellMode;
-use codex_tools::ZshForkConfig;
-use codex_tools::mcp_call_tool_result_output_schema;
-use codex_tools::mcp_tool_to_deferred_responses_api_tool;
-use codex_utils_absolute_path::AbsolutePathBuf;
-use core_test_support::assert_regex_match;
-use pretty_assertions::assert_eq;
-use std::collections::BTreeMap;
-use std::path::PathBuf;
-
-use super::*;
-
-fn mcp_tool(name: &str, description: &str, input_schema: serde_json::Value) -> rmcp::model::Tool {
-    rmcp::model::Tool {
-        name: name.to_string().into(),
-        title: None,
-        description: Some(description.to_string().into()),
-        input_schema: std::sync::Arc::new(rmcp::model::object(input_schema)),
-        output_schema: None,
-        annotations: None,
-        execution: None,
-        icons: None,
-        meta: None,
-    }
-}
-
-fn mcp_tool_info(tool: rmcp::model::Tool) -> ToolInfo {
-    ToolInfo {
-        server_name: "test_server".to_string(),
-        supports_parallel_tool_calls: false,
-        server_origin: None,
-        callable_name: tool.name.to_string(),
-        callable_namespace: "mcp__test_server__".to_string(),
-        namespace_description: None,
-        tool,
-        connector_id: None,
-        connector_name: None,
-        plugin_display_names: Vec::new(),
-    }
-}
-
-fn mcp_tool_info_with_display_name(display_name: &str, tool: rmcp::model::Tool) -> ToolInfo {
-    let (callable_namespace, callable_name) = display_name
-        .rsplit_once('/')
-        .map(|(namespace, callable_name)| (format!("{namespace}/"), callable_name.to_string()))
-        .unwrap_or_else(|| ("".to_string(), display_name.to_string()));
-
-    ToolInfo {
-        server_name: "test_server".to_string(),
-        supports_parallel_tool_calls: false,
-        server_origin: None,
-        callable_name,
-        callable_namespace,
-        namespace_description: None,
-        tool,
-        connector_id: None,
-        connector_name: None,
-        plugin_display_names: Vec::new(),
-    }
-}
-
-fn discoverable_connector(id: &str, name: &str, description: &str) -> DiscoverableTool {
-    let slug = name.replace(' ', "-").to_lowercase();
-    DiscoverableTool::Connector(Box::new(AppInfo {
-        id: id.to_string(),
-        name: name.to_string(),
-        description: Some(description.to_string()),
-        logo_url: None,
-        logo_url_dark: None,
-        distribution_channel: None,
-        branding: None,
-        app_metadata: None,
-        labels: None,
-        install_url: Some(format!("https://chatgpt.com/apps/{slug}/{id}")),
-        is_accessible: false,
-        is_enabled: true,
-        plugin_display_names: Vec::new(),
-    }))
-}
-
-async fn search_capable_model_info() -> ModelInfo {
-    let config = test_config().await;
-    let mut model_info = construct_model_info_offline("gpt-5.4", &config);
-    model_info.supports_search_tool = true;
-    model_info
-}
-
-#[test]
-fn deferred_responses_api_tool_serializes_with_defer_loading() {
-    let tool = mcp_tool(
-        "lookup_order",
-        "Look up an order",
-        serde_json::json!({
-            "type": "object",
-            "properties": {
-                "order_id": {"type": "string"}
-            },
-            "required": ["order_id"],
-            "additionalProperties": false,
-        }),
-    );
-
-    let serialized = serde_json::to_value(ToolSpec::Function(
-        mcp_tool_to_deferred_responses_api_tool(
-            &ToolName::namespaced("mcp__codex_apps__", "lookup_order"),
-            &tool,
-        )
-        .expect("convert deferred tool"),
-    ))
-    .expect("serialize deferred tool");
-
-    assert_eq!(
-        serialized,
-        serde_json::json!({
-            "type": "function",
-            "name": "lookup_order",
-            "description": "Look up an order",
-            "strict": false,
-            "defer_loading": true,
-            "parameters": {
-                "type": "object",
-                "properties": {
-                    "order_id": {"type": "string"}
-                },
-                "required": ["order_id"],
-                "additionalProperties": false,
-            }
-        })
-    );
-}
-
-// Avoid order-based assertions; compare via set containment instead.
-fn assert_contains_tool_names(tools: &[ToolSpec], expected_subset: &[&str]) {
-    use std::collections::HashSet;
-    let mut names = HashSet::new();
-    let mut duplicates = Vec::new();
-    for name in tools.iter().map(ToolSpec::name) {
-        if !names.insert(name) {
-            duplicates.push(name);
-        }
-    }
-    assert!(
-        duplicates.is_empty(),
-        "duplicate tool entries detected: {duplicates:?}"
-    );
-    for expected in expected_subset {
-        assert!(
-            names.contains(expected),
-            "expected tool {expected} to be present; had: {names:?}"
-        );
-    }
-}
-
-fn shell_tool_name(config: &ToolsConfig) -> Option<&'static str> {
-    match config.shell_type {
-        ConfigShellToolType::Default => Some("shell"),
-        ConfigShellToolType::Local => Some("local_shell"),
-        ConfigShellToolType::UnifiedExec => None,
-        ConfigShellToolType::Disabled => None,
-        ConfigShellToolType::ShellCommand => Some("shell_command"),
-    }
-}
-
-fn find_tool<'a>(tools: &'a [ToolSpec], expected_name: &str) -> &'a ToolSpec {
-    tools
-        .iter()
-        .find(|tool| tool.name() == expected_name)
-        .unwrap_or_else(|| panic!("expected tool {expected_name}"))
-}
-
-fn find_namespace_function_tool<'a>(
-    tools: &'a [ToolSpec],
-    expected_namespace: &str,
-    expected_name: &str,
-) -> &'a ResponsesApiTool {
-    let namespace_tool = find_tool(tools, expected_namespace);
-    let ToolSpec::Namespace(namespace) = namespace_tool else {
-        panic!("expected namespace tool {expected_namespace}");
-    };
-    namespace
-        .tools
-        .iter()
-        .find_map(|tool| match tool {
-            ResponsesApiNamespaceTool::Function(tool) if tool.name == expected_name => Some(tool),
-            _ => None,
-        })
-        .unwrap_or_else(|| panic!("expected tool {expected_namespace}{expected_name} in namespace"))
-}
-
-async fn multi_agent_v2_tools_config() -> ToolsConfig {
-    let config = test_config().await;
-    let model_info = construct_model_info_offline("gpt-5.4", &config);
-    let mut features = Features::with_defaults();
-    features.enable(Feature::Collab);
-    features.enable(Feature::MultiAgentV2);
-    let available_models = Vec::new();
-    ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    })
-    .with_max_concurrent_threads_per_session(Some(4))
-}
-
-fn multi_agent_v2_spawn_agent_description(tools_config: &ToolsConfig) -> String {
-    let (tools, _) = build_specs(
-        tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &[],
-    )
-    .build();
-    let spawn_agent = find_tool(&tools, "spawn_agent");
-    let ToolSpec::Function(ResponsesApiTool { description, .. }) = spawn_agent else {
-        panic!("spawn_agent should be a function tool");
-    };
-    description.clone()
-}
-
-async fn model_info_from_models_json(slug: &str) -> ModelInfo {
-    let config = test_config().await;
-    let response = bundled_models_response()
-        .unwrap_or_else(|err| panic!("bundled models.json should parse: {err}"));
-    let model = response
-        .models
-        .into_iter()
-        .find(|candidate| candidate.slug == slug)
-        .unwrap_or_else(|| panic!("model slug {slug} is missing from models.json"));
-    with_config_overrides(model, &config.to_models_manager_config())
-}
-
-/// Builds the tool registry builder while collecting tool specs for later serialization.
-fn build_specs(
-    config: &ToolsConfig,
-    mcp_tools: Option<Vec<ToolInfo>>,
-    deferred_mcp_tools: Option<Vec<ToolInfo>>,
-    dynamic_tools: &[DynamicToolSpec],
-) -> ToolRegistryBuilder {
-    build_specs_with_discoverable_tools(
-        config,
-        mcp_tools,
-        deferred_mcp_tools,
-        /*discoverable_tools*/ None,
-        /*extension_tool_executors*/ &[],
-        dynamic_tools,
-    )
-}
-
-#[tokio::test]
-async fn get_memory_requires_feature_flag() {
-    let config = test_config().await;
-    let model_info = construct_model_info_offline("gpt-5.4", &config);
-    let mut features = Features::with_defaults();
-    features.disable(Feature::MemoryTool);
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let (tools, _) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &[],
-    )
-    .build();
-    assert!(
-        !tools.iter().any(|t| t.name() == "get_memory"),
-        "get_memory should be disabled when memory_tool feature is off"
-    );
-}
-
-async fn assert_model_tools(
-    model_slug: &str,
-    features: &Features,
-    web_search_mode: Option<WebSearchMode>,
-    expected_tools: &[&str],
-) {
-    let _config = test_config().await;
-    let model_info = model_info_from_models_json(model_slug).await;
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode,
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let router = ToolRouter::from_config(
-        &tools_config,
-        ToolRouterParams {
-            mcp_tools: None,
-            deferred_mcp_tools: None,
-            discoverable_tools: None,
-            extension_tool_executors: Vec::new(),
-            dynamic_tools: &[],
-        },
-    );
-    let model_visible_specs = router.model_visible_specs();
-    let tool_names = model_visible_specs
-        .iter()
-        .map(ToolSpec::name)
-        .collect::<Vec<_>>();
-    assert_eq!(&tool_names, &expected_tools);
-}
-
-async fn assert_default_model_tools(
-    model_slug: &str,
-    features: &Features,
-    web_search_mode: Option<WebSearchMode>,
-    shell_tool: &'static str,
-    expected_tail: &[&str],
-) {
-    let mut expected = if features.enabled(Feature::UnifiedExec) {
-        vec!["exec_command", "write_stdin"]
-    } else {
-        vec![shell_tool]
-    };
-    expected.extend(expected_tail);
-    assert_model_tools(model_slug, features, web_search_mode, &expected).await;
-}
-
-#[tokio::test]
-async fn test_build_specs_gpt5_codex_default() {
-    let features = Features::with_defaults();
-    assert_default_model_tools(
-        "gpt-5.4",
-        &features,
-        Some(WebSearchMode::Cached),
-        "shell_command",
-        &[
-            "update_plan",
-            "request_user_input",
-            "apply_patch",
-            "view_image",
-            "spawn_agent",
-            "send_input",
-            "resume_agent",
-            "wait_agent",
-            "close_agent",
-            "web_search",
-            "image_generation",
-        ],
-    )
-    .await;
-}
-
-#[tokio::test]
-async fn test_build_specs_gpt51_codex_default() {
-    let features = Features::with_defaults();
-    assert_default_model_tools(
-        "gpt-5.4",
-        &features,
-        Some(WebSearchMode::Cached),
-        "shell_command",
-        &[
-            "update_plan",
-            "request_user_input",
-            "apply_patch",
-            "view_image",
-            "spawn_agent",
-            "send_input",
-            "resume_agent",
-            "wait_agent",
-            "close_agent",
-            "web_search",
-            "image_generation",
-        ],
-    )
-    .await;
-}
-
-#[tokio::test]
-async fn test_build_specs_gpt5_codex_unified_exec_web_search() {
-    let mut features = Features::with_defaults();
-    features.enable(Feature::UnifiedExec);
-    assert_model_tools(
-        "gpt-5.4",
-        &features,
-        Some(WebSearchMode::Live),
-        &[
-            "exec_command",
-            "write_stdin",
-            "update_plan",
-            "request_user_input",
-            "apply_patch",
-            "view_image",
-            "spawn_agent",
-            "send_input",
-            "resume_agent",
-            "wait_agent",
-            "close_agent",
-            "web_search",
-            "image_generation",
-        ],
-    )
-    .await;
-}
-
-#[tokio::test]
-async fn test_build_specs_gpt51_codex_unified_exec_web_search() {
-    let mut features = Features::with_defaults();
-    features.enable(Feature::UnifiedExec);
-    assert_model_tools(
-        "gpt-5.4",
-        &features,
-        Some(WebSearchMode::Live),
-        &[
-            "exec_command",
-            "write_stdin",
-            "update_plan",
-            "request_user_input",
-            "apply_patch",
-            "view_image",
-            "spawn_agent",
-            "send_input",
-            "resume_agent",
-            "wait_agent",
-            "close_agent",
-            "web_search",
-            "image_generation",
-        ],
-    )
-    .await;
-}
-
-#[tokio::test]
-async fn test_gpt_5_1_codex_max_defaults() {
-    let features = Features::with_defaults();
-    assert_default_model_tools(
-        "gpt-5.4",
-        &features,
-        Some(WebSearchMode::Cached),
-        "shell_command",
-        &[
-            "update_plan",
-            "request_user_input",
-            "apply_patch",
-            "view_image",
-            "spawn_agent",
-            "send_input",
-            "resume_agent",
-            "wait_agent",
-            "close_agent",
-            "web_search",
-            "image_generation",
-        ],
-    )
-    .await;
-}
-
-#[tokio::test]
-async fn test_codex_5_1_mini_defaults() {
-    let features = Features::with_defaults();
-    assert_default_model_tools(
-        "gpt-5.4-mini",
-        &features,
-        Some(WebSearchMode::Cached),
-        "shell_command",
-        &[
-            "update_plan",
-            "request_user_input",
-            "apply_patch",
-            "view_image",
-            "spawn_agent",
-            "send_input",
-            "resume_agent",
-            "wait_agent",
-            "close_agent",
-            "web_search",
-            "image_generation",
-        ],
-    )
-    .await;
-}
-
-#[tokio::test]
-async fn test_gpt_5_defaults() {
-    let features = Features::with_defaults();
-    assert_default_model_tools(
-        "gpt-5.2",
-        &features,
-        Some(WebSearchMode::Cached),
-        "shell_command",
-        &[
-            "update_plan",
-            "request_user_input",
-            "apply_patch",
-            "view_image",
-            "spawn_agent",
-            "send_input",
-            "resume_agent",
-            "wait_agent",
-            "close_agent",
-            "web_search",
-            "image_generation",
-        ],
-    )
-    .await;
-}
-
-#[tokio::test]
-async fn test_gpt_5_1_defaults() {
-    let features = Features::with_defaults();
-    assert_default_model_tools(
-        "gpt-5.4",
-        &features,
-        Some(WebSearchMode::Cached),
-        "shell_command",
-        &[
-            "update_plan",
-            "request_user_input",
-            "apply_patch",
-            "view_image",
-            "spawn_agent",
-            "send_input",
-            "resume_agent",
-            "wait_agent",
-            "close_agent",
-            "web_search",
-            "image_generation",
-        ],
-    )
-    .await;
-}
-
-#[tokio::test]
-async fn test_gpt_5_1_codex_max_unified_exec_web_search() {
-    let mut features = Features::with_defaults();
-    features.enable(Feature::UnifiedExec);
-    assert_model_tools(
-        "gpt-5.4",
-        &features,
-        Some(WebSearchMode::Live),
-        &[
-            "exec_command",
-            "write_stdin",
-            "update_plan",
-            "request_user_input",
-            "apply_patch",
-            "view_image",
-            "spawn_agent",
-            "send_input",
-            "resume_agent",
-            "wait_agent",
-            "close_agent",
-            "web_search",
-            "image_generation",
-        ],
-    )
-    .await;
-}
-
-#[tokio::test]
-async fn test_build_specs_default_shell_present() {
-    let config = test_config().await;
-    let model_info = construct_model_info_offline("o3", &config);
-    let mut features = Features::with_defaults();
-    features.enable(Feature::UnifiedExec);
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Live),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let (tools, _) = build_specs(
-        &tools_config,
-        Some(Vec::new()),
-        /*deferred_mcp_tools*/ None,
-        &[],
-    )
-    .build();
-
-    // Only check the shell variant and a couple of core tools.
-    let mut subset = vec!["exec_command", "write_stdin", "update_plan"];
-    if let Some(shell_tool) = shell_tool_name(&tools_config) {
-        subset.push(shell_tool);
-    }
-    assert_contains_tool_names(&tools, &subset);
-}
-
-#[tokio::test]
-async fn shell_zsh_fork_prefers_shell_command_over_unified_exec() {
-    let config = test_config().await;
-    let model_info = construct_model_info_offline("o3", &config);
-    let mut features = Features::with_defaults();
-    features.enable(Feature::UnifiedExec);
-    features.enable(Feature::ShellZshFork);
-
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Live),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let user_shell = Shell {
-        shell_type: ShellType::Zsh,
-        shell_path: PathBuf::from("/bin/zsh"),
-        shell_snapshot: crate::shell::empty_shell_snapshot_receiver(),
-    };
-
-    assert_eq!(tools_config.shell_type, ConfigShellToolType::ShellCommand);
-    assert_eq!(
-        tools_config.shell_command_backend,
-        ShellCommandBackendConfig::ZshFork
-    );
-    assert_eq!(
-        tools_config.unified_exec_shell_mode,
-        UnifiedExecShellMode::Direct
-    );
-    assert_eq!(
-        tools_config
-            .with_unified_exec_shell_mode_for_session(
-                tool_user_shell_type(&user_shell),
-                Some(&PathBuf::from(if cfg!(windows) {
-                    r"C:\opt\codex\zsh"
-                } else {
-                    "/opt/codex/zsh"
-                })),
-                Some(&PathBuf::from(if cfg!(windows) {
-                    r"C:\opt\codex\codex-execve-wrapper"
-                } else {
-                    "/opt/codex/codex-execve-wrapper"
-                })),
-            )
-            .unified_exec_shell_mode,
-        if cfg!(unix) {
-            UnifiedExecShellMode::ZshFork(ZshForkConfig {
-                shell_zsh_path: AbsolutePathBuf::from_absolute_path("/opt/codex/zsh").unwrap(),
-                main_execve_wrapper_exe: AbsolutePathBuf::from_absolute_path(
-                    "/opt/codex/codex-execve-wrapper",
-                )
-                .unwrap(),
-            })
-        } else {
-            UnifiedExecShellMode::Direct
-        }
-    );
-}
-
-#[tokio::test]
-async fn spawn_agent_description_omits_usage_hint_when_disabled() {
-    let tools_config = multi_agent_v2_tools_config()
-        .await
-        .with_spawn_agent_usage_hint(/*spawn_agent_usage_hint*/ false);
-    let description = multi_agent_v2_spawn_agent_description(&tools_config);
-
-    assert_regex_match(
-        r#"(?sx)
-            ^\s*
-            No\ picker-visible\ model\ overrides\ are\ currently\ loaded\.
-            \s+Spawns\ an\ agent\ to\ work\ on\ the\ specified\ task\.\ If\ your\ current\ task\ is\ `/root/task1`\ and\ you\ spawn_agent\ with\ task_name\ "task_3"\ the\ agent\ will\ have\ canonical\ task\ name\ `/root/task1/task_3`\.
-            \s+You\ are\ then\ able\ to\ refer\ to\ this\ agent\ as\ `task_3`\ or\ `/root/task1/task_3`\ interchangeably\.\ However\ an\ agent\ `/root/task2/task_3`\ would\ only\ be\ able\ to\ communicate\ with\ this\ agent\ via\ its\ canonical\ name\ `/root/task1/task_3`\.
-            \s+The\ spawned\ agent\ will\ have\ the\ same\ tools\ as\ you\ and\ the\ ability\ to\ spawn\ its\ own\ subagents\.
-            \s+Spawned\ agents\ inherit\ your\ current\ model\ by\ default\.\ Omit\ `model`\ to\ use\ that\ preferred\ default;\ set\ `model`\ only\ when\ an\ explicit\ override\ is\ needed\.
-            \s+It\ will\ be\ able\ to\ send\ you\ and\ other\ running\ agents\ messages,\ and\ its\ final\ answer\ will\ be\ provided\ to\ you\ when\ it\ finishes\.
-            \s+The\ new\ agent's\ canonical\ task\ name\ will\ be\ provided\ to\ it\ along\ with\ the\ message\.
-            \s+This\ session\ is\ configured\ with\ `max_concurrent_threads_per_session\ =\ 4`\ for\ concurrently\ open\ agent\ threads\.
-            \s*$
-        "#,
-        &description,
-    );
-}
-
-#[tokio::test]
-async fn spawn_agent_description_uses_configured_usage_hint_text() {
-    let tools_config = multi_agent_v2_tools_config()
-        .await
-        .with_spawn_agent_usage_hint_text(Some(
-            /*spawn_agent_usage_hint_text*/ "Custom delegation guidance only.".to_string(),
-        ));
-    let description = multi_agent_v2_spawn_agent_description(&tools_config);
-
-    assert_regex_match(
-        r#"(?sx)
-            ^\s*
-            No\ picker-visible\ model\ overrides\ are\ currently\ loaded\.
-            \s+Spawns\ an\ agent\ to\ work\ on\ the\ specified\ task\.\ If\ your\ current\ task\ is\ `/root/task1`\ and\ you\ spawn_agent\ with\ task_name\ "task_3"\ the\ agent\ will\ have\ canonical\ task\ name\ `/root/task1/task_3`\.
-            \s+You\ are\ then\ able\ to\ refer\ to\ this\ agent\ as\ `task_3`\ or\ `/root/task1/task_3`\ interchangeably\.\ However\ an\ agent\ `/root/task2/task_3`\ would\ only\ be\ able\ to\ communicate\ with\ this\ agent\ via\ its\ canonical\ name\ `/root/task1/task_3`\.
-            \s+The\ spawned\ agent\ will\ have\ the\ same\ tools\ as\ you\ and\ the\ ability\ to\ spawn\ its\ own\ subagents\.
-            \s+Spawned\ agents\ inherit\ your\ current\ model\ by\ default\.\ Omit\ `model`\ to\ use\ that\ preferred\ default;\ set\ `model`\ only\ when\ an\ explicit\ override\ is\ needed\.
-            \s+It\ will\ be\ able\ to\ send\ you\ and\ other\ running\ agents\ messages,\ and\ its\ final\ answer\ will\ be\ provided\ to\ you\ when\ it\ finishes\.
-            \s+The\ new\ agent's\ canonical\ task\ name\ will\ be\ provided\ to\ it\ along\ with\ the\ message\.
-            \s+This\ session\ is\ configured\ with\ `max_concurrent_threads_per_session\ =\ 4`\ for\ concurrently\ open\ agent\ threads\.
-            \s+Custom\ delegation\ guidance\ only\.
-            \s*$
-        "#,
-        &description,
-    );
-}
-
-#[tokio::test]
-async fn multi_agent_v2_wait_agent_schema_uses_configured_min_timeout() {
-    let wait_agent_min_timeout_ms = Some(60_000);
-    let tools_config = multi_agent_v2_tools_config()
-        .await
-        .with_wait_agent_min_timeout_ms(wait_agent_min_timeout_ms);
-    let (tools, _) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        /*deferred_mcp_tools*/ None,
-        &[],
-    )
-    .build();
-    let wait_agent = find_tool(&tools, "wait_agent");
-    let ToolSpec::Function(ResponsesApiTool { parameters, .. }) = wait_agent else {
-        panic!("wait_agent should be a function tool");
-    };
-    let timeout_description = parameters
-        .properties
-        .as_ref()
-        .and_then(|properties| properties.get("timeout_ms"))
-        .and_then(|schema| schema.description.as_deref());
-
-    assert_eq!(
-        timeout_description,
-        Some("Optional timeout in milliseconds. Defaults to 60000, min 60000, max 3600000.")
-    );
-}
-
-#[tokio::test]
-async fn request_plugin_install_requires_apps_and_plugins_features() {
-    let model_info = search_capable_model_info().await;
-    let discoverable_tools = Some(vec![discoverable_connector(
-        "connector_2128aebfecb84f64a069897515042a44",
-        "Google Calendar",
-        "Plan events and schedules.",
-    )]);
-    let available_models = Vec::new();
-
-    for disabled_feature in [Feature::Apps, Feature::Plugins] {
-        let mut features = Features::with_defaults();
-        features.enable(Feature::ToolSearch);
-        features.enable(Feature::ToolSuggest);
-        features.enable(Feature::Apps);
-        features.enable(Feature::Plugins);
-        features.disable(disabled_feature);
-
-        let tools_config = ToolsConfig::new(&ToolsConfigParams {
-            model_info: &model_info,
-            available_models: &available_models,
-            features: &features,
-            image_generation_tool_auth_allowed: true,
-            web_search_mode: Some(WebSearchMode::Cached),
-            session_source: SessionSource::Cli,
-            permission_profile: &PermissionProfile::Disabled,
-            windows_sandbox_level: WindowsSandboxLevel::Disabled,
-        });
-        let (tools, _) = build_specs_with_discoverable_tools(
-            &tools_config,
-            /*mcp_tools*/ None,
-            /*deferred_mcp_tools*/ None,
-            discoverable_tools.clone(),
-            /*extension_tool_executors*/ &[],
-            &[],
-        )
-        .build();
-
-        assert!(
-            !tools
-                .iter()
-                .any(|tool| tool.name() == REQUEST_PLUGIN_INSTALL_TOOL_NAME),
-            "tool_suggest should be absent when {disabled_feature:?} is disabled"
-        );
-    }
-}
-
-#[tokio::test]
-async fn search_tool_is_hidden_without_deferred_tools() {
-    let model_info = search_capable_model_info().await;
-    let mut features = Features::with_defaults();
-    features.enable(Feature::Apps);
-    features.enable(Feature::ToolSearch);
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-
-    let (tools, _) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        Some(Vec::new()),
-        &[],
-    )
-    .build();
-    assert!(
-        !tools
-            .iter()
-            .any(|tool| tool.name() == TOOL_SEARCH_TOOL_NAME)
-    );
-}
-
-#[tokio::test]
-async fn search_tool_description_falls_back_to_connector_name_without_description() {
-    let model_info = search_capable_model_info().await;
-    let mut features = Features::with_defaults();
-    features.enable(Feature::Apps);
-    features.enable(Feature::ToolSearch);
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-
-    let (tools, _) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        Some(vec![ToolInfo {
-            server_name: CODEX_APPS_MCP_SERVER_NAME.to_string(),
-            supports_parallel_tool_calls: false,
-            server_origin: None,
-            callable_name: "_create_event".to_string(),
-            callable_namespace: "mcp__codex_apps__calendar".to_string(),
-            namespace_description: None,
-            tool: mcp_tool(
-                "calendar_create_event",
-                "Create calendar event",
-                serde_json::json!({"type": "object"}),
-            ),
-            connector_id: Some("calendar".to_string()),
-            connector_name: Some("Calendar".to_string()),
-            plugin_display_names: Vec::new(),
-        }]),
-        &[],
-    )
-    .build();
-    let search_tool = find_tool(&tools, TOOL_SEARCH_TOOL_NAME);
-    let ToolSpec::ToolSearch { description, .. } = search_tool else {
-        panic!("expected tool_search tool");
-    };
-
-    assert!(description.contains("- Calendar"));
-    assert!(!description.contains("- Calendar:"));
-}
-
-#[tokio::test]
-async fn search_tool_registers_namespaced_mcp_tool_aliases() {
-    let model_info = search_capable_model_info().await;
-    let mut features = Features::with_defaults();
-    features.enable(Feature::Apps);
-    features.enable(Feature::ToolSearch);
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-
-    let (_, registry) = build_specs(
-        &tools_config,
-        /*mcp_tools*/ None,
-        Some(vec![
-            ToolInfo {
-                server_name: CODEX_APPS_MCP_SERVER_NAME.to_string(),
-                supports_parallel_tool_calls: false,
-                server_origin: None,
-                callable_name: "_create_event".to_string(),
-                callable_namespace: "mcp__codex_apps__calendar".to_string(),
-                namespace_description: None,
-                tool: mcp_tool(
-                    "calendar-create-event",
-                    "Create calendar event",
-                    serde_json::json!({"type": "object"}),
-                ),
-                connector_id: Some("calendar".to_string()),
-                connector_name: Some("Calendar".to_string()),
-                plugin_display_names: Vec::new(),
-            },
-            ToolInfo {
-                server_name: CODEX_APPS_MCP_SERVER_NAME.to_string(),
-                supports_parallel_tool_calls: false,
-                server_origin: None,
-                callable_name: "_list_events".to_string(),
-                callable_namespace: "mcp__codex_apps__calendar".to_string(),
-                namespace_description: None,
-                tool: mcp_tool(
-                    "calendar-list-events",
-                    "List calendar events",
-                    serde_json::json!({"type": "object"}),
-                ),
-                connector_id: Some("calendar".to_string()),
-                connector_name: Some("Calendar".to_string()),
-                plugin_display_names: Vec::new(),
-            },
-            ToolInfo {
-                server_name: "rmcp".to_string(),
-                supports_parallel_tool_calls: false,
-                server_origin: None,
-                callable_name: "echo".to_string(),
-                callable_namespace: "mcp__rmcp__".to_string(),
-                namespace_description: None,
-                tool: mcp_tool("echo", "Echo", serde_json::json!({"type": "object"})),
-                connector_id: None,
-                connector_name: None,
-                plugin_display_names: Vec::new(),
-            },
-        ]),
-        &[],
-    )
-    .build();
-
-    let app_alias = ToolName::namespaced("mcp__codex_apps__calendar", "_create_event");
-    let mcp_alias = ToolName::namespaced("mcp__rmcp__", "echo");
-
-    assert!(registry.has_handler(&ToolName::plain(TOOL_SEARCH_TOOL_NAME)));
-    assert!(registry.has_handler(&app_alias));
-    assert!(registry.has_handler(&mcp_alias));
-}
-
-#[tokio::test]
-async fn direct_mcp_tools_register_namespaced_handlers() {
-    let config = test_config().await;
-    let model_info = construct_model_info_offline("gpt-5.4", &config);
-    let mut features = Features::with_defaults();
-    features.enable(Feature::UnifiedExec);
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-
-    let (_, registry) = build_specs(
-        &tools_config,
-        Some(vec![mcp_tool_info(mcp_tool(
-            "echo",
-            "Echo",
-            serde_json::json!({"type": "object"}),
-        ))]),
-        /*deferred_mcp_tools*/ None,
-        &[],
-    )
-    .build();
-
-    assert!(registry.has_handler(&ToolName::namespaced("mcp__test_server__", "echo")));
-    assert!(!registry.has_handler(&ToolName::plain("mcp__test_server__echo")));
-}
-
-#[tokio::test]
-async fn test_mcp_tool_property_missing_type_defaults_to_string() {
-    let config = test_config().await;
-    let model_info = construct_model_info_offline("gpt-5.4", &config);
-    let mut features = Features::with_defaults();
-    features.enable(Feature::UnifiedExec);
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-
-    let (tools, _) = build_specs(
-        &tools_config,
-        Some(vec![mcp_tool_info_with_display_name(
-            "dash/search",
-            mcp_tool(
-                "search",
-                "Search docs",
-                serde_json::json!({
-                    "type": "object",
-                    "properties": {
-                        "query": {"description": "search query"}
-                    }
-                }),
-            ),
-        )]),
-        /*deferred_mcp_tools*/ None,
-        &[],
-    )
-    .build();
-
-    let tool = find_namespace_function_tool(&tools, "dash/", "search");
-    assert_eq!(
-        *tool,
-        ResponsesApiTool {
-            name: "search".to_string(),
-            parameters: JsonSchema::object(
-                /*properties*/
-                BTreeMap::from([(
-                    "query".to_string(),
-                    JsonSchema::string(Some("search query".to_string())),
-                )]),
-                /*required*/ None,
-                /*additional_properties*/ None
-            ),
-            description: "Search docs".to_string(),
-            strict: false,
-            output_schema: Some(mcp_call_tool_result_output_schema(serde_json::json!({}))),
-            defer_loading: None,
-        }
-    );
-}
-
-#[tokio::test]
-async fn test_mcp_tool_preserves_integer_schema() {
-    let config = test_config().await;
-    let model_info = construct_model_info_offline("gpt-5.4", &config);
-    let mut features = Features::with_defaults();
-    features.enable(Feature::UnifiedExec);
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-
-    let (tools, _) = build_specs(
-        &tools_config,
-        Some(vec![mcp_tool_info_with_display_name(
-            "dash/paginate",
-            mcp_tool(
-                "paginate",
-                "Pagination",
-                serde_json::json!({
-                    "type": "object",
-                    "properties": {"page": {"type": "integer"}}
-                }),
-            ),
-        )]),
-        /*deferred_mcp_tools*/ None,
-        &[],
-    )
-    .build();
-
-    let tool = find_namespace_function_tool(&tools, "dash/", "paginate");
-    assert_eq!(
-        *tool,
-        ResponsesApiTool {
-            name: "paginate".to_string(),
-            parameters: JsonSchema::object(
-                /*properties*/
-                BTreeMap::from([(
-                    "page".to_string(),
-                    JsonSchema::integer(/*description*/ None),
-                )]),
-                /*required*/ None,
-                /*additional_properties*/ None
-            ),
-            description: "Pagination".to_string(),
-            strict: false,
-            output_schema: Some(mcp_call_tool_result_output_schema(serde_json::json!({}))),
-            defer_loading: None,
-        }
-    );
-}
-
-#[tokio::test]
-async fn test_mcp_tool_array_without_items_gets_default_string_items() {
-    let config = test_config().await;
-    let model_info = construct_model_info_offline("gpt-5.4", &config);
-    let mut features = Features::with_defaults();
-    features.enable(Feature::UnifiedExec);
-    features.enable(Feature::ApplyPatchFreeform);
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-
-    let (tools, _) = build_specs(
-        &tools_config,
-        Some(vec![mcp_tool_info_with_display_name(
-            "dash/tags",
-            mcp_tool(
-                "tags",
-                "Tags",
-                serde_json::json!({
-                    "type": "object",
-                    "properties": {"tags": {"type": "array"}}
-                }),
-            ),
-        )]),
-        /*deferred_mcp_tools*/ None,
-        &[],
-    )
-    .build();
-
-    let tool = find_namespace_function_tool(&tools, "dash/", "tags");
-    assert_eq!(
-        *tool,
-        ResponsesApiTool {
-            name: "tags".to_string(),
-            parameters: JsonSchema::object(
-                /*properties*/
-                BTreeMap::from([(
-                    "tags".to_string(),
-                    JsonSchema::array(
-                        JsonSchema::string(/*description*/ None),
-                        /*description*/ None,
-                    ),
-                )]),
-                /*required*/ None,
-                /*additional_properties*/ None
-            ),
-            description: "Tags".to_string(),
-            strict: false,
-            output_schema: Some(mcp_call_tool_result_output_schema(serde_json::json!({}))),
-            defer_loading: None,
-        }
-    );
-}
-
-#[tokio::test]
-async fn test_mcp_tool_anyof_defaults_to_string() {
-    let config = test_config().await;
-    let model_info = construct_model_info_offline("gpt-5.4", &config);
-    let mut features = Features::with_defaults();
-    features.enable(Feature::UnifiedExec);
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-
-    let (tools, _) = build_specs(
-        &tools_config,
-        Some(vec![mcp_tool_info_with_display_name(
-            "dash/value",
-            mcp_tool(
-                "value",
-                "AnyOf Value",
-                serde_json::json!({
-                    "type": "object",
-                    "properties": {
-                        "value": {"anyOf": [{"type": "string"}, {"type": "number"}]}
-                    }
-                }),
-            ),
-        )]),
-        /*deferred_mcp_tools*/ None,
-        &[],
-    )
-    .build();
-
-    let tool = find_namespace_function_tool(&tools, "dash/", "value");
-    assert_eq!(
-        *tool,
-        ResponsesApiTool {
-            name: "value".to_string(),
-            parameters: JsonSchema::object(
-                /*properties*/
-                BTreeMap::from([(
-                    "value".to_string(),
-                    JsonSchema::any_of(
-                        vec![
-                            JsonSchema::string(/*description*/ None),
-                            JsonSchema::number(/*description*/ None),
-                        ],
-                        /*description*/ None,
-                    ),
-                )]),
-                /*required*/ None,
-                /*additional_properties*/ None
-            ),
-            description: "AnyOf Value".to_string(),
-            strict: false,
-            output_schema: Some(mcp_call_tool_result_output_schema(serde_json::json!({}))),
-            defer_loading: None,
-        }
-    );
-}
-
-#[tokio::test]
-async fn test_get_openai_tools_mcp_tools_with_additional_properties_schema() {
-    let config = test_config().await;
-    let model_info = construct_model_info_offline("gpt-5.4", &config);
-    let mut features = Features::with_defaults();
-    features.enable(Feature::UnifiedExec);
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let (tools, _) = build_specs(
-        &tools_config,
-        Some(vec![mcp_tool_info_with_display_name(
-            "test_server/do_something_cool",
-            mcp_tool(
-                "do_something_cool",
-                "Do something cool",
-                serde_json::json!({
-                    "type": "object",
-                    "properties": {
-                    "string_argument": {"type": "string"},
-                    "number_argument": {"type": "number"},
-                    "object_argument": {
-                        "type": "object",
-                        "properties": {
-                            "string_property": {"type": "string"},
-                            "number_property": {"type": "number"}
-                        },
-                        "required": ["string_property", "number_property"],
-                        "additionalProperties": {
-                            "type": "object",
-                            "properties": {
-                                "addtl_prop": {"type": "string"}
-                            },
-                            "required": ["addtl_prop"],
-                            "additionalProperties": false
-                            }
-                        }
-                    }
-                }),
-            ),
-        )]),
-        /*deferred_mcp_tools*/ None,
-        &[],
-    )
-    .build();
-
-    let tool = find_namespace_function_tool(&tools, "test_server/", "do_something_cool");
-    assert_eq!(
-        *tool,
-        ResponsesApiTool {
-            name: "do_something_cool".to_string(),
-            parameters: JsonSchema::object(
-                /*properties*/
-                BTreeMap::from([
-                    (
-                        "string_argument".to_string(),
-                        JsonSchema::string(/*description*/ None),
-                    ),
-                    (
-                        "number_argument".to_string(),
-                        JsonSchema::number(/*description*/ None),
-                    ),
-                    (
-                        "object_argument".to_string(),
-                        JsonSchema::object(
-                            BTreeMap::from([
-                                (
-                                    "string_property".to_string(),
-                                    JsonSchema::string(/*description*/ None),
-                                ),
-                                (
-                                    "number_property".to_string(),
-                                    JsonSchema::number(/*description*/ None),
-                                ),
-                            ]),
-                            Some(vec![
-                                "string_property".to_string(),
-                                "number_property".to_string(),
-                            ]),
-                            Some(
-                                JsonSchema::object(
-                                    BTreeMap::from([(
-                                        "addtl_prop".to_string(),
-                                        JsonSchema::string(/*description*/ None),
-                                    )]),
-                                    Some(vec!["addtl_prop".to_string()]),
-                                    Some(false.into()),
-                                )
-                                .into(),
-                            ),
-                        ),
-                    ),
-                ]),
-                /*required*/ None,
-                /*additional_properties*/ None
-            ),
-            description: "Do something cool".to_string(),
-            strict: false,
-            output_schema: Some(mcp_call_tool_result_output_schema(serde_json::json!({}))),
-            defer_loading: None,
-        }
-    );
-}
-
-#[tokio::test]
-async fn code_mode_only_restricts_model_tools_to_exec_tools() {
-    let mut features = Features::with_defaults();
-    features.enable(Feature::CodeMode);
-    features.enable(Feature::CodeModeOnly);
-
-    assert_model_tools(
-        "gpt-5.4",
-        &features,
-        Some(WebSearchMode::Live),
-        &["exec", "wait"],
-    )
-    .await;
-}
diff --git a/codex-rs/core/src/tools/tool_dispatch_trace.rs b/codex-rs/core/src/tools/tool_dispatch_trace.rs
index 6a0e635792..522e3cd1d8 100644
--- a/codex-rs/core/src/tools/tool_dispatch_trace.rs
+++ b/codex-rs/core/src/tools/tool_dispatch_trace.rs
@@ -111,15 +111,6 @@ fn tool_dispatch_payload(payload: &ToolPayload) -> ToolDispatchPayload {
         ToolPayload::Custom { input } => ToolDispatchPayload::Custom {
             input: input.clone(),
         },
-        ToolPayload::LocalShell { params } => ToolDispatchPayload::LocalShell {
-            command: params.command.clone(),
-            workdir: params.workdir.clone(),
-            timeout_ms: params.timeout_ms,
-            sandbox_permissions: params.sandbox_permissions,
-            prefix_rule: params.prefix_rule.clone(),
-            additional_permissions: params.additional_permissions.clone(),
-            justification: params.justification.clone(),
-        },
     }
 }
 
diff --git a/codex-rs/core/src/tools/tool_dispatch_trace_tests.rs b/codex-rs/core/src/tools/tool_dispatch_trace_tests.rs
index 3badf1155a..bccaf60c82 100644
--- a/codex-rs/core/src/tools/tool_dispatch_trace_tests.rs
+++ b/codex-rs/core/src/tools/tool_dispatch_trace_tests.rs
@@ -21,8 +21,8 @@ use crate::tools::context::FunctionToolOutput;
 use crate::tools::context::ToolCallSource;
 use crate::tools::context::ToolInvocation;
 use crate::tools::context::ToolPayload;
+use crate::tools::registry::CoreToolRuntime;
 use crate::tools::registry::ToolExecutor;
-use crate::tools::registry::ToolHandler;
 use crate::tools::registry::ToolRegistry;
 use crate::turn_diff_tracker::TurnDiffTracker;
 
@@ -30,19 +30,24 @@ struct TestHandler {
     tool_name: codex_tools::ToolName,
 }
 
+#[async_trait::async_trait]
 impl ToolExecutor<ToolInvocation> for TestHandler {
-    type Output = FunctionToolOutput;
-
     fn tool_name(&self) -> codex_tools::ToolName {
         self.tool_name.clone()
     }
 
-    async fn handle(&self, _invocation: ToolInvocation) -> Result<Self::Output, FunctionCallError> {
-        Ok(FunctionToolOutput::from_text("ok".to_string(), Some(true)))
+    async fn handle(
+        &self,
+        _invocation: ToolInvocation,
+    ) -> Result<Box<dyn crate::tools::context::ToolOutput>, FunctionCallError> {
+        Ok(Box::new(FunctionToolOutput::from_text(
+            "ok".to_string(),
+            Some(true),
+        )))
     }
 }
 
-impl ToolHandler for TestHandler {}
+impl CoreToolRuntime for TestHandler {}
 
 #[tokio::test]
 async fn dispatch_lifecycle_trace_records_direct_and_code_mode_requesters() -> anyhow::Result<()> {
diff --git a/codex-rs/core/src/tools/tool_family/mod.rs b/codex-rs/core/src/tools/tool_family/mod.rs
new file mode 100644
index 0000000000..d1e1cbd5a9
--- /dev/null
+++ b/codex-rs/core/src/tools/tool_family/mod.rs
@@ -0,0 +1 @@
+pub(crate) mod shell;
diff --git a/codex-rs/core/src/tools/tool_family/shell.rs b/codex-rs/core/src/tools/tool_family/shell.rs
new file mode 100644
index 0000000000..10777562b8
--- /dev/null
+++ b/codex-rs/core/src/tools/tool_family/shell.rs
@@ -0,0 +1,72 @@
+use std::sync::Arc;
+
+use codex_protocol::openai_models::ConfigShellToolType;
+use codex_tools::ShellCommandBackendConfig;
+use codex_tools::ToolEnvironmentMode;
+
+use crate::tools::handlers::ExecCommandHandler;
+use crate::tools::handlers::ExecCommandHandlerOptions;
+use crate::tools::handlers::ShellCommandHandler;
+use crate::tools::handlers::ShellCommandHandlerOptions;
+use crate::tools::handlers::WriteStdinHandler;
+use crate::tools::registry::CoreToolRuntime;
+
+#[derive(Clone, Copy, Debug)]
+pub(crate) struct ShellToolsOptions {
+    pub(crate) shell_type: ConfigShellToolType,
+    pub(crate) shell_command_backend: ShellCommandBackendConfig,
+    pub(crate) environment_mode: ToolEnvironmentMode,
+    pub(crate) allow_login_shell: bool,
+    pub(crate) exec_permission_approvals_enabled: bool,
+}
+
+pub(crate) fn build_shell_tools(options: ShellToolsOptions) -> Vec<Arc<dyn CoreToolRuntime>> {
+    let mut runtimes = Vec::new();
+    if !options.environment_mode.has_environment() {
+        return runtimes;
+    }
+
+    let include_environment_id = matches!(options.environment_mode, ToolEnvironmentMode::Multiple);
+    match options.shell_type {
+        ConfigShellToolType::UnifiedExec => {
+            add_runtime(
+                &mut runtimes,
+                ExecCommandHandler::new(ExecCommandHandlerOptions {
+                    allow_login_shell: options.allow_login_shell,
+                    exec_permission_approvals_enabled: options.exec_permission_approvals_enabled,
+                    include_environment_id,
+                }),
+            );
+            add_runtime(&mut runtimes, WriteStdinHandler);
+
+            // Keep the legacy shell tool registered as a hidden runtime while
+            // unified exec is model-visible.
+            add_runtime(
+                &mut runtimes,
+                ShellCommandHandler::from(options.shell_command_backend),
+            );
+        }
+        ConfigShellToolType::Disabled => {}
+        ConfigShellToolType::Default
+        | ConfigShellToolType::Local
+        | ConfigShellToolType::ShellCommand => {
+            add_runtime(
+                &mut runtimes,
+                ShellCommandHandler::new(ShellCommandHandlerOptions {
+                    backend_config: options.shell_command_backend,
+                    allow_login_shell: options.allow_login_shell,
+                    exec_permission_approvals_enabled: options.exec_permission_approvals_enabled,
+                }),
+            );
+        }
+    }
+
+    runtimes
+}
+
+fn add_runtime<T>(runtimes: &mut Vec<Arc<dyn CoreToolRuntime>>, runtime: T)
+where
+    T: CoreToolRuntime + 'static,
+{
+    runtimes.push(Arc::new(runtime));
+}
diff --git a/codex-rs/core/src/tools/tool_search_entry.rs b/codex-rs/core/src/tools/tool_search_entry.rs
index 7ecaf91a4d..8e37cdcfff 100644
--- a/codex-rs/core/src/tools/tool_search_entry.rs
+++ b/codex-rs/core/src/tools/tool_search_entry.rs
@@ -40,7 +40,6 @@ impl ToolSearchInfo {
                 LoadableToolSpec::Namespace(namespace)
             }
             ToolSpec::ToolSearch { .. }
-            | ToolSpec::LocalShell {}
             | ToolSpec::ImageGeneration { .. }
             | ToolSpec::WebSearch { .. }
             | ToolSpec::Freeform(_) => return None,
diff --git a/codex-rs/core/src/turn_metadata.rs b/codex-rs/core/src/turn_metadata.rs
index 02760582f2..1b2c6b4b12 100644
--- a/codex-rs/core/src/turn_metadata.rs
+++ b/codex-rs/core/src/turn_metadata.rs
@@ -3,6 +3,8 @@ use std::collections::HashMap;
 use std::sync::Arc;
 use std::sync::Mutex;
 use std::sync::RwLock;
+use std::sync::atomic::AtomicBool;
+use std::sync::atomic::Ordering;
 
 use codex_utils_string::to_ascii_json_string;
 use serde::Serialize;
@@ -23,6 +25,7 @@ use codex_utils_absolute_path::AbsolutePathBuf;
 const MODEL_KEY: &str = "model";
 const REASONING_EFFORT_KEY: &str = "reasoning_effort";
 const TURN_STARTED_AT_UNIX_MS_KEY: &str = "turn_started_at_unix_ms";
+const USER_INPUT_REQUESTED_DURING_TURN_KEY: &str = "user_input_requested_during_turn";
 
 pub(crate) struct McpTurnMetadataContext<'a> {
     pub(crate) model: &'a str,
@@ -186,6 +189,7 @@ pub(crate) struct TurnMetadataState {
     enriched_header: Arc<RwLock<Option<String>>>,
     turn_started_at_unix_ms: Arc<RwLock<Option<i64>>>,
     responsesapi_client_metadata: Arc<RwLock<Option<HashMap<String, String>>>>,
+    user_input_requested_during_turn: Arc<AtomicBool>,
     enrichment_task: Arc<Mutex<Option<JoinHandle<()>>>>,
 }
 
@@ -231,6 +235,7 @@ impl TurnMetadataState {
             enriched_header: Arc::new(RwLock::new(None)),
             turn_started_at_unix_ms: Arc::new(RwLock::new(None)),
             responsesapi_client_metadata: Arc::new(RwLock::new(None)),
+            user_input_requested_during_turn: Arc::new(AtomicBool::new(false)),
             enrichment_task: Arc::new(Mutex::new(None)),
         }
     }
@@ -285,9 +290,25 @@ impl TurnMetadataState {
                 metadata.remove(REASONING_EFFORT_KEY);
             }
         }
+        if self
+            .user_input_requested_during_turn
+            .load(Ordering::Relaxed)
+        {
+            metadata.insert(
+                USER_INPUT_REQUESTED_DURING_TURN_KEY.to_string(),
+                Value::Bool(true),
+            );
+        } else {
+            metadata.remove(USER_INPUT_REQUESTED_DURING_TURN_KEY);
+        }
         Some(Value::Object(metadata))
     }
 
+    pub(crate) fn mark_user_input_requested_during_turn(&self) {
+        self.user_input_requested_during_turn
+            .store(true, Ordering::Relaxed);
+    }
+
     pub(crate) fn set_responsesapi_client_metadata(
         &self,
         responsesapi_client_metadata: HashMap<String, String>,
diff --git a/codex-rs/core/src/turn_metadata_tests.rs b/codex-rs/core/src/turn_metadata_tests.rs
index 2a38447f86..2f79927103 100644
--- a/codex-rs/core/src/turn_metadata_tests.rs
+++ b/codex-rs/core/src/turn_metadata_tests.rs
@@ -1,9 +1,8 @@
 use super::*;
 
-use crate::sandbox_tags::sandbox_tag;
+use crate::sandbox_tags::permission_profile_sandbox_tag;
 use codex_protocol::models::PermissionProfile;
 use codex_protocol::openai_models::ReasoningEffort as ReasoningEffortConfig;
-use codex_protocol::protocol::SandboxPolicy;
 use codex_protocol::protocol::ThreadSource;
 use core_test_support::PathBufExt;
 use core_test_support::PathExt;
@@ -89,7 +88,6 @@ async fn build_turn_metadata_header_includes_has_changes_for_clean_repo() {
 fn turn_metadata_state_uses_platform_sandbox_tag() {
     let temp_dir = TempDir::new().expect("temp dir");
     let cwd = temp_dir.path().abs();
-    let sandbox_policy = SandboxPolicy::new_read_only_policy();
     let permission_profile = PermissionProfile::read_only();
 
     let state = TurnMetadataState::new(
@@ -110,7 +108,11 @@ fn turn_metadata_state_uses_platform_sandbox_tag() {
     let thread_id = json.get("thread_id").and_then(Value::as_str);
     let thread_source = json.get("thread_source").and_then(Value::as_str);
 
-    let expected_sandbox = sandbox_tag(&sandbox_policy, WindowsSandboxLevel::Disabled);
+    let expected_sandbox = permission_profile_sandbox_tag(
+        &permission_profile,
+        WindowsSandboxLevel::Disabled,
+        /*enforce_managed_network*/ false,
+    );
     assert_eq!(sandbox_name, Some(expected_sandbox));
     assert_eq!(session_id, Some("session-a"));
     assert_eq!(thread_id, Some("thread-a"));
@@ -213,6 +215,56 @@ fn turn_metadata_state_includes_model_and_reasoning_effort_only_in_request_meta(
     );
 }
 
+#[test]
+fn turn_metadata_state_marks_user_input_requested_during_turn_only_for_mcp_request_meta() {
+    let temp_dir = TempDir::new().expect("temp dir");
+    let cwd = temp_dir.path().abs();
+    let permission_profile = PermissionProfile::read_only();
+
+    let state = TurnMetadataState::new(
+        "session-a".to_string(),
+        "thread-a".to_string(),
+        /*thread_source*/ None,
+        "turn-a".to_string(),
+        cwd,
+        &permission_profile,
+        WindowsSandboxLevel::Disabled,
+        /*enforce_managed_network*/ false,
+    );
+
+    let header = state.current_header_value().expect("header");
+    let header_json: Value = serde_json::from_str(&header).expect("json");
+    assert!(
+        header_json
+            .get(USER_INPUT_REQUESTED_DURING_TURN_KEY)
+            .is_none()
+    );
+
+    let meta = state
+        .current_meta_value_for_mcp_request(test_mcp_turn_metadata_context())
+        .expect("turn metadata should be present");
+    assert!(meta.get(USER_INPUT_REQUESTED_DURING_TURN_KEY).is_none());
+
+    state.mark_user_input_requested_during_turn();
+
+    let header = state.current_header_value().expect("header");
+    let header_json: Value = serde_json::from_str(&header).expect("json");
+    assert!(
+        header_json
+            .get(USER_INPUT_REQUESTED_DURING_TURN_KEY)
+            .is_none()
+    );
+
+    let meta = state
+        .current_meta_value_for_mcp_request(test_mcp_turn_metadata_context())
+        .expect("turn metadata should be present");
+    assert_eq!(
+        meta.get(USER_INPUT_REQUESTED_DURING_TURN_KEY)
+            .and_then(Value::as_bool),
+        Some(true)
+    );
+}
+
 #[test]
 fn turn_metadata_state_ignores_client_turn_started_at_unix_ms_before_start() {
     let temp_dir = TempDir::new().expect("temp dir");
diff --git a/codex-rs/core/src/turn_timing.rs b/codex-rs/core/src/turn_timing.rs
index 3d35afae95..570e4a6e32 100644
--- a/codex-rs/core/src/turn_timing.rs
+++ b/codex-rs/core/src/turn_timing.rs
@@ -185,6 +185,7 @@ fn response_item_records_turn_ttft(item: &ResponseItem) -> bool {
         | ResponseItem::ImageGenerationCall { .. }
         | ResponseItem::Compaction { .. }
         | ResponseItem::ContextCompaction { .. } => true,
+        ResponseItem::CompactionTrigger => false,
         ResponseItem::FunctionCallOutput { .. }
         | ResponseItem::CustomToolCallOutput { .. }
         | ResponseItem::ToolSearchOutput { .. }
diff --git a/codex-rs/core/src/unified_exec/mod.rs b/codex-rs/core/src/unified_exec/mod.rs
index b6788e8e71..25abaf2835 100644
--- a/codex-rs/core/src/unified_exec/mod.rs
+++ b/codex-rs/core/src/unified_exec/mod.rs
@@ -38,6 +38,7 @@ use tokio::sync::Mutex;
 use crate::sandboxing::SandboxPermissions;
 use crate::session::session::Session;
 use crate::session::turn_context::TurnContext;
+use crate::shell::ShellType;
 use crate::tools::network_approval::DeferredNetworkApproval;
 
 mod async_watcher;
@@ -87,6 +88,7 @@ impl UnifiedExecContext {
 #[derive(Debug)]
 pub(crate) struct ExecCommandRequest {
     pub command: Vec<String>,
+    pub shell_type: ShellType,
     pub hook_command: String,
     pub process_id: i32,
     pub yield_time_ms: u64,
diff --git a/codex-rs/core/src/unified_exec/mod_tests.rs b/codex-rs/core/src/unified_exec/mod_tests.rs
index f8a1480af8..6926f9cbf1 100644
--- a/codex-rs/core/src/unified_exec/mod_tests.rs
+++ b/codex-rs/core/src/unified_exec/mod_tests.rs
@@ -83,6 +83,7 @@ async fn exec_command_with_tty(
 ) -> Result<ExecCommandToolOutput, UnifiedExecError> {
     let manager = &session.services.unified_exec_manager;
     let process_id = manager.allocate_process_id().await;
+    #[allow(deprecated)]
     let cwd = workdir
         .as_ref()
         .map_or_else(|| turn.cwd.clone(), |workdir| turn.cwd.join(workdir));
@@ -501,10 +502,12 @@ async fn reusing_completed_process_returns_unknown_process() -> anyhow::Result<(
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn completed_pipe_commands_preserve_exit_code() -> anyhow::Result<()> {
     let (_, turn) = make_session_and_context().await;
+    #[allow(deprecated)]
+    let cwd = turn.cwd.clone();
     let request = test_exec_request(
         &turn,
         vec!["bash".to_string(), "-lc".to_string(), "exit 17".to_string()],
-        turn.cwd.clone(),
+        cwd,
         shell_env(),
     );
 
@@ -598,10 +601,12 @@ async fn remote_exec_server_rejects_inherited_fd_launches() -> anyhow::Result<()
     turn.environments.turn_environments[0].environment =
         Arc::new(remote_test_env.environment().clone());
 
+    #[allow(deprecated)]
+    let cwd = turn.cwd.clone();
     let request = test_exec_request(
         &turn,
         vec!["bash".to_string(), "-lc".to_string(), "echo ok".to_string()],
-        turn.cwd.clone(),
+        cwd,
         shell_env(),
     );
 
diff --git a/codex-rs/core/src/unified_exec/process_manager.rs b/codex-rs/core/src/unified_exec/process_manager.rs
index 3032bd63f3..8c0cc89680 100644
--- a/codex-rs/core/src/unified_exec/process_manager.rs
+++ b/codex-rs/core/src/unified_exec/process_manager.rs
@@ -1014,10 +1014,8 @@ impl UnifiedExecProcessManager {
             local_policy_env,
         };
         let mut orchestrator = ToolOrchestrator::new();
-        let mut runtime = UnifiedExecRuntime::new(
-            self,
-            context.turn.tools_config.unified_exec_shell_mode.clone(),
-        );
+        let mut runtime =
+            UnifiedExecRuntime::new(self, context.turn.unified_exec_shell_mode.clone());
         let file_system_sandbox_policy = context.turn.file_system_sandbox_policy();
         let exec_approval_requirement = context
             .session
@@ -1041,6 +1039,7 @@ impl UnifiedExecProcessManager {
             .await;
         let req = UnifiedExecToolRequest {
             command: request.command.clone(),
+            shell_type: request.shell_type.clone(),
             hook_command: request.hook_command.clone(),
             process_id: request.process_id,
             cwd,
diff --git a/codex-rs/core/src/unified_exec/process_manager_tests.rs b/codex-rs/core/src/unified_exec/process_manager_tests.rs
index 5ef5994030..cd83ce7a9c 100644
--- a/codex-rs/core/src/unified_exec/process_manager_tests.rs
+++ b/codex-rs/core/src/unified_exec/process_manager_tests.rs
@@ -71,16 +71,10 @@ fn exec_server_params_use_env_policy_overlay_contract() {
         .expect("current dir")
         .try_into()
         .expect("absolute path");
-    let sandbox_policy = codex_protocol::protocol::SandboxPolicy::DangerFullAccess;
     let file_system_sandbox_policy =
-        codex_protocol::permissions::FileSystemSandboxPolicy::from(&sandbox_policy);
+        codex_protocol::permissions::FileSystemSandboxPolicy::unrestricted();
     let network_sandbox_policy = codex_protocol::permissions::NetworkSandboxPolicy::Restricted;
-    let permission_profile =
-        codex_protocol::models::PermissionProfile::from_runtime_permissions_with_enforcement(
-            codex_protocol::models::SandboxEnforcement::from_legacy_sandbox_policy(&sandbox_policy),
-            &file_system_sandbox_policy,
-            network_sandbox_policy,
-        );
+    let permission_profile = codex_protocol::models::PermissionProfile::Disabled;
     let request = ExecRequest {
         command: vec!["bash".to_string(), "-lc".to_string(), "true".to_string()],
         cwd: cwd.clone(),
@@ -171,11 +165,14 @@ async fn failed_initial_end_for_unstored_process_uses_fallback_output() {
             "-lc".to_string(),
             "echo before".to_string(),
         ],
+        shell_type: crate::shell::ShellType::Sh,
         hook_command: "echo before".to_string(),
         process_id: 123,
         yield_time_ms: 1000,
         max_output_tokens: None,
+        #[allow(deprecated)]
         cwd: turn.cwd.clone(),
+        #[allow(deprecated)]
         sandbox_cwd: turn.cwd.clone(),
         environment: turn
             .environments
@@ -200,6 +197,7 @@ async fn failed_initial_end_for_unstored_process_uses_fallback_output() {
         /*process_started_alive*/ false,
         &context,
         &request,
+        #[allow(deprecated)]
         turn.cwd.clone(),
         transcript,
         "PRE_DENIAL_MARKER".to_string(),
diff --git a/codex-rs/core/src/util.rs b/codex-rs/core/src/util.rs
index 97fb44ba11..631f9a9464 100644
--- a/codex-rs/core/src/util.rs
+++ b/codex-rs/core/src/util.rs
@@ -2,12 +2,9 @@ use std::path::Path;
 use std::path::PathBuf;
 use std::time::Duration;
 
-use codex_protocol::ThreadId;
 use rand::Rng;
 use tracing::error;
 
-use codex_shell_command::parse_command::shlex_join;
-
 const INITIAL_DELAY_MS: u64 = 200;
 const BACKOFF_FACTOR: f64 = 2.0;
 
@@ -118,22 +115,6 @@ pub fn normalize_thread_name(name: &str) -> Option<String> {
     }
 }
 
-pub fn resume_command(thread_name: Option<&str>, thread_id: Option<ThreadId>) -> Option<String> {
-    let resume_target = thread_name
-        .filter(|name| !name.is_empty())
-        .map(str::to_string)
-        .or_else(|| thread_id.map(|thread_id| thread_id.to_string()));
-    resume_target.map(|target| {
-        let needs_double_dash = target.starts_with('-');
-        let escaped = shlex_join(&[target]);
-        if needs_double_dash {
-            format!("codex resume -- {escaped}")
-        } else {
-            format!("codex resume {escaped}")
-        }
-    })
-}
-
 #[cfg(test)]
 #[path = "util_tests.rs"]
 mod tests;
diff --git a/codex-rs/core/src/util_tests.rs b/codex-rs/core/src/util_tests.rs
index 48dd6fc9a0..fdc7535159 100644
--- a/codex-rs/core/src/util_tests.rs
+++ b/codex-rs/core/src/util_tests.rs
@@ -432,41 +432,3 @@ fn normalize_thread_name_trims_and_rejects_empty() {
         Some("my thread".to_string())
     );
 }
-
-#[test]
-fn resume_command_prefers_name_over_id() {
-    let thread_id = ThreadId::from_string("123e4567-e89b-12d3-a456-426614174000").unwrap();
-    let command = resume_command(Some("my-thread"), Some(thread_id));
-    assert_eq!(command, Some("codex resume my-thread".to_string()));
-}
-
-#[test]
-fn resume_command_with_only_id() {
-    let thread_id = ThreadId::from_string("123e4567-e89b-12d3-a456-426614174000").unwrap();
-    let command = resume_command(/*thread_name*/ None, Some(thread_id));
-    assert_eq!(
-        command,
-        Some("codex resume 123e4567-e89b-12d3-a456-426614174000".to_string())
-    );
-}
-
-#[test]
-fn resume_command_with_no_name_or_id() {
-    let command = resume_command(/*thread_name*/ None, /*thread_id*/ None);
-    assert_eq!(command, None);
-}
-
-#[test]
-fn resume_command_quotes_thread_name_when_needed() {
-    let command = resume_command(Some("-starts-with-dash"), /*thread_id*/ None);
-    assert_eq!(
-        command,
-        Some("codex resume -- -starts-with-dash".to_string())
-    );
-
-    let command = resume_command(Some("two words"), /*thread_id*/ None);
-    assert_eq!(command, Some("codex resume 'two words'".to_string()));
-
-    let command = resume_command(Some("quote'case"), /*thread_id*/ None);
-    assert_eq!(command, Some("codex resume \"quote'case\"".to_string()));
-}
diff --git a/codex-rs/core/templates/goals/continuation.md b/codex-rs/core/templates/goals/continuation.md
index 5b4bd774ba..904d15c266 100644
--- a/codex-rs/core/templates/goals/continuation.md
+++ b/codex-rs/core/templates/goals/continuation.md
@@ -40,4 +40,12 @@ Before deciding that the goal is achieved, treat completion as unproven and veri
 
 Do not rely on intent, partial progress, memory of earlier work, or a plausible final answer as proof of completion. Marking the goal complete is a claim that the full objective has been finished and can withstand requirement-by-requirement scrutiny. Only mark the goal achieved when current evidence proves every requirement has been satisfied and no required work remains. If the evidence is incomplete, weak, indirect, merely consistent with completion, or leaves any requirement missing, incomplete, or unverified, keep working instead of marking the goal complete. If the objective is achieved, call update_goal with status "complete" so usage accounting is preserved. If the achieved goal has a token budget, report the final consumed token budget to the user after update_goal succeeds.
 
-Do not call update_goal unless the goal is complete. Do not mark a goal complete merely because the budget is nearly exhausted or because you are stopping work.
+Blocked audit:
+- Do not call update_goal with status "blocked" the first time a blocker appears.
+- Only use status "blocked" when the same blocking condition has repeated for at least three consecutive goal turns, counting the original/user-triggered turn and any automatic goal continuations.
+- If the user resumes a goal that was previously marked "blocked", treat the resumed run as a fresh blocked audit. If the same blocking condition then repeats for at least three consecutive resumed goal turns, call update_goal with status "blocked" again.
+- Use status "blocked" only when you are truly at an impasse and cannot make meaningful progress without user input or an external-state change.
+- Once the blocked threshold is satisfied, do not keep reporting that you are still blocked while leaving the goal active; call update_goal with status "blocked".
+- Never use status "blocked" merely because the work is hard, slow, uncertain, incomplete, or would benefit from clarification.
+
+Do not call update_goal unless the goal is complete or the strict blocked audit above is satisfied. Do not mark a goal complete merely because the budget is nearly exhausted or because you are stopping work.
diff --git a/codex-rs/core/tests/common/apps_test_server.rs b/codex-rs/core/tests/common/apps_test_server.rs
index 757fc146f2..702f96ef2d 100644
--- a/codex-rs/core/tests/common/apps_test_server.rs
+++ b/codex-rs/core/tests/common/apps_test_server.rs
@@ -1,4 +1,10 @@
+use crate::test_codex::TestCodexBuilder;
+use crate::test_codex::test_codex;
 use anyhow::Result;
+use codex_core::config::Config;
+use codex_features::Feature;
+use codex_login::CodexAuth;
+use codex_models_manager::bundled_models_response;
 use serde_json::Value;
 use serde_json::json;
 use wiremock::Mock;
@@ -15,10 +21,21 @@ const CONNECTOR_NAME: &str = "Calendar";
 const DISCOVERABLE_CALENDAR_ID: &str = "connector_2128aebfecb84f64a069897515042a44";
 const DISCOVERABLE_GMAIL_ID: &str = "connector_68df038e0ba48191908c8434991bbac2";
 const CONNECTOR_DESCRIPTION: &str = "Plan events and manage your calendar.";
+const CODEX_APPS_META_KEY: &str = "_codex_apps";
 const PROTOCOL_VERSION: &str = "2025-11-25";
 const SERVER_NAME: &str = "codex-apps-test";
 const SERVER_VERSION: &str = "1.0.0";
 const SEARCHABLE_TOOL_COUNT: usize = 100;
+const CALENDAR_CREATE_EVENT_TOOL_NAME: &str = "calendar_create_event";
+pub const CALENDAR_EXTRACT_TEXT_TOOL_NAME: &str = "calendar_extract_text";
+const CALENDAR_LIST_EVENTS_TOOL_NAME: &str = "calendar_list_events";
+pub const DIRECT_CALENDAR_CREATE_EVENT_TOOL: &str = "mcp__codex_apps__calendar_create_event";
+pub const DIRECT_CALENDAR_LIST_EVENTS_TOOL: &str = "mcp__codex_apps__calendar_list_events";
+pub const DIRECT_CALENDAR_EXTRACT_TEXT_TOOL: &str = "mcp__codex_apps__calendar_extract_text";
+pub const SEARCH_CALENDAR_NAMESPACE: &str = "mcp__codex_apps__calendar";
+pub const SEARCH_CALENDAR_CREATE_TOOL: &str = "_create_event";
+pub const SEARCH_CALENDAR_EXTRACT_TEXT_TOOL: &str = "_extract_text";
+pub const SEARCH_CALENDAR_LIST_TOOL: &str = "_list_events";
 pub const CALENDAR_CREATE_EVENT_RESOURCE_URI: &str =
     "connector://calendar/tools/calendar_create_event";
 pub const CALENDAR_CREATE_EVENT_MCP_APP_RESOURCE_URI: &str =
@@ -71,6 +88,103 @@ impl AppsTestServer {
     }
 }
 
+pub fn configure_search_capable_model(config: &mut Config) {
+    let mut model_catalog = bundled_models_response()
+        .unwrap_or_else(|err| panic!("bundled models.json should parse: {err}"));
+    let model = model_catalog
+        .models
+        .iter_mut()
+        .find(|model| model.slug == "gpt-5.4")
+        .expect("gpt-5.4 exists in bundled models.json");
+    config.model = Some("gpt-5.4".to_string());
+    model.supports_search_tool = true;
+    config.model_catalog = Some(model_catalog);
+}
+
+fn configure_apps(config: &mut Config, apps_base_url: &str) {
+    config
+        .features
+        .enable(Feature::Apps)
+        .expect("test config should allow feature update");
+    config.chatgpt_base_url = apps_base_url.to_string();
+}
+
+pub fn configure_search_capable_apps(config: &mut Config, apps_base_url: &str) {
+    configure_apps(config, apps_base_url);
+    configure_search_capable_model(config);
+}
+
+pub fn apps_enabled_builder(apps_base_url: impl Into<String>) -> TestCodexBuilder {
+    let apps_base_url = apps_base_url.into();
+    test_codex()
+        .with_auth(CodexAuth::create_dummy_chatgpt_auth_for_testing())
+        .with_config(move |config| configure_apps(config, apps_base_url.as_str()))
+}
+
+pub fn search_capable_apps_builder(apps_base_url: impl Into<String>) -> TestCodexBuilder {
+    let apps_base_url = apps_base_url.into();
+    test_codex()
+        .with_auth(CodexAuth::create_dummy_chatgpt_auth_for_testing())
+        .with_config(move |config| configure_search_capable_apps(config, apps_base_url.as_str()))
+}
+
+fn apps_tool_call_id(body: &Value) -> Option<&str> {
+    body.get("params")?
+        .get("_meta")?
+        .get(CODEX_APPS_META_KEY)?
+        .get("call_id")?
+        .as_str()
+}
+
+async fn recorded_apps_tool_calls(server: &MockServer) -> Vec<Value> {
+    server
+        .received_requests()
+        .await
+        .expect("mock server should capture requests")
+        .into_iter()
+        .filter_map(|request| {
+            let body: Value = serde_json::from_slice(&request.body).ok()?;
+            (request.url.path() == "/api/codex/apps"
+                && body.get("method").and_then(Value::as_str) == Some("tools/call"))
+            .then_some(body)
+        })
+        .collect()
+}
+
+pub async fn recorded_apps_tool_call_by_call_id(server: &MockServer, call_id: &str) -> Value {
+    let matches = recorded_apps_tool_calls(server)
+        .await
+        .into_iter()
+        .filter(|body| apps_tool_call_id(body) == Some(call_id))
+        .collect::<Vec<_>>();
+    assert_eq!(
+        matches.len(),
+        1,
+        "expected exactly one apps tools/call request for call_id {call_id}"
+    );
+    matches
+        .into_iter()
+        .next()
+        .expect("matching apps tools/call request should be recorded")
+}
+
+pub async fn recorded_apps_tool_call_by_name(server: &MockServer, tool_name: &str) -> Value {
+    let matches = recorded_apps_tool_calls(server)
+        .await
+        .into_iter()
+        .filter(|body| body.pointer("/params/name").and_then(Value::as_str) == Some(tool_name))
+        .collect::<Vec<_>>();
+    assert_eq!(
+        matches.len(),
+        1,
+        "expected exactly one apps tools/call request for tool {tool_name}"
+    );
+    matches
+        .into_iter()
+        .next()
+        .expect("matching apps tools/call request should be recorded")
+}
+
 async fn mount_oauth_metadata(server: &MockServer) {
     Mock::given(method("GET"))
         .and(path("/.well-known/oauth-authorization-server/mcp"))
@@ -187,7 +301,7 @@ impl Respond for CodexAppsJsonRpcResponder {
                     "result": {
                         "tools": [
                             {
-                                "name": "calendar_create_event",
+                                "name": CALENDAR_CREATE_EVENT_TOOL_NAME,
                                 "description": "Create a calendar event.",
                                 "annotations": {
                                     "readOnlyHint": false,
@@ -217,7 +331,7 @@ impl Respond for CodexAppsJsonRpcResponder {
                                 }
                             },
                             {
-                                "name": "calendar_list_events",
+                                "name": CALENDAR_LIST_EVENTS_TOOL_NAME,
                                 "description": "List calendar events.",
                                 "annotations": {
                                     "readOnlyHint": true
@@ -242,7 +356,7 @@ impl Respond for CodexAppsJsonRpcResponder {
                                 }
                             },
                             {
-                                "name": "calendar_extract_text",
+                                "name": CALENDAR_EXTRACT_TEXT_TOOL_NAME,
                                 "description": "Extract text from an uploaded document.",
                                 "annotations": {
                                     "readOnlyHint": false
diff --git a/codex-rs/core/tests/common/hooks.rs b/codex-rs/core/tests/common/hooks.rs
index 239041a22c..d549e04b25 100644
--- a/codex-rs/core/tests/common/hooks.rs
+++ b/codex-rs/core/tests/common/hooks.rs
@@ -34,7 +34,7 @@ pub fn trusted_config_layer_stack(
     hooks: Vec<HookListEntry>,
 ) -> ConfigLayerStack {
     let mut user_config = config_layer_stack
-        .get_user_layer()
+        .get_active_user_layer()
         .map(|layer| layer.config.clone())
         .unwrap_or_else(|| TomlValue::Table(Default::default()));
     let Some(user_table) = user_config.as_table_mut() else {
diff --git a/codex-rs/core/tests/common/lib.rs b/codex-rs/core/tests/common/lib.rs
index 70e1a3f0e4..194fb2ae0a 100644
--- a/codex-rs/core/tests/common/lib.rs
+++ b/codex-rs/core/tests/common/lib.rs
@@ -237,54 +237,6 @@ pub fn find_codex_linux_sandbox_exe() -> Result<PathBuf, CargoBinError> {
     codex_utils_cargo_bin::cargo_bin("codex-linux-sandbox")
 }
 
-/// Builds an SSE stream body from a JSON fixture.
-///
-/// The fixture must contain an array of objects where each object represents a
-/// single SSE event with at least a `type` field matching the `event:` value.
-/// Additional fields become the JSON payload for the `data:` line. An object
-/// with only a `type` field results in an event with no `data:` section. This
-/// makes it trivial to extend the fixtures as OpenAI adds new event kinds or
-/// fields.
-pub fn load_sse_fixture(path: impl AsRef<std::path::Path>) -> String {
-    let events: Vec<serde_json::Value> =
-        serde_json::from_reader(std::fs::File::open(path).expect("read fixture"))
-            .expect("parse JSON fixture");
-    events
-        .into_iter()
-        .map(|e| {
-            let kind = e
-                .get("type")
-                .and_then(|v| v.as_str())
-                .expect("fixture event missing type");
-            if e.as_object().map(|o| o.len() == 1).unwrap_or(false) {
-                format!("event: {kind}\n\n")
-            } else {
-                format!("event: {kind}\ndata: {e}\n\n")
-            }
-        })
-        .collect()
-}
-
-pub fn load_sse_fixture_with_id_from_str(raw: &str, id: &str) -> String {
-    let replaced = raw.replace("__ID__", id);
-    let events: Vec<serde_json::Value> =
-        serde_json::from_str(&replaced).expect("parse JSON fixture");
-    events
-        .into_iter()
-        .map(|e| {
-            let kind = e
-                .get("type")
-                .and_then(|v| v.as_str())
-                .expect("fixture event missing type");
-            if e.as_object().map(|o| o.len() == 1).unwrap_or(false) {
-                format!("event: {kind}\n\n")
-            } else {
-                format!("event: {kind}\ndata: {e}\n\n")
-            }
-        })
-        .collect()
-}
-
 pub async fn wait_for_event<F>(
     codex: &CodexThread,
     predicate: F,
@@ -296,6 +248,31 @@ where
     wait_for_event_with_timeout(codex, predicate, Duration::from_secs(1)).await
 }
 
+pub async fn submit_thread_settings(
+    codex: &CodexThread,
+    thread_settings: codex_protocol::protocol::ThreadSettingsOverrides,
+) -> anyhow::Result<()> {
+    use codex_protocol::protocol::EventMsg;
+    use codex_protocol::protocol::Op;
+    use tokio::time::Duration;
+    use tokio::time::timeout;
+
+    let submission_id = codex.submit(Op::ThreadSettings { thread_settings }).await?;
+    loop {
+        let ev = timeout(Duration::from_secs(10), codex.next_event())
+            .await
+            .expect("timeout waiting for thread settings update")
+            .expect("stream ended unexpectedly");
+        if ev.id == submission_id {
+            match ev.msg {
+                EventMsg::ThreadSettingsApplied(_) => return Ok(()),
+                EventMsg::Error(err) => panic!("thread settings update failed: {}", err.message),
+                other => panic!("unexpected thread settings update event: {other:?}"),
+            }
+        }
+    }
+}
+
 pub async fn wait_for_event_match<T, F>(codex: &CodexThread, matcher: F) -> T
 where
     F: Fn(&codex_protocol::protocol::EventMsg) -> Option<T>,
diff --git a/codex-rs/core/tests/common/responses.rs b/codex-rs/core/tests/common/responses.rs
index eab90c5aba..c917436b6d 100644
--- a/codex-rs/core/tests/common/responses.rs
+++ b/codex-rs/core/tests/common/responses.rs
@@ -35,8 +35,6 @@ use wiremock::http::HeaderValue;
 use wiremock::matchers::method;
 use wiremock::matchers::path_regex;
 
-use crate::test_codex::ApplyPatchModelOutput;
-
 #[derive(Debug, Clone)]
 pub struct ResponseMock {
     requests: Arc<Mutex<Vec<ResponsesRequest>>>,
@@ -883,23 +881,6 @@ pub fn ev_local_shell_call(call_id: &str, status: &str, command: Vec<&str>) -> V
     })
 }
 
-pub fn ev_apply_patch_call(
-    call_id: &str,
-    patch: &str,
-    output_type: ApplyPatchModelOutput,
-) -> Value {
-    match output_type {
-        ApplyPatchModelOutput::Freeform => ev_apply_patch_custom_tool_call(call_id, patch),
-        ApplyPatchModelOutput::Shell => ev_apply_patch_shell_call(call_id, patch),
-        ApplyPatchModelOutput::ShellViaHeredoc => {
-            ev_apply_patch_shell_call_via_heredoc(call_id, patch)
-        }
-        ApplyPatchModelOutput::ShellCommandViaHeredoc => {
-            ev_apply_patch_shell_command_call_via_heredoc(call_id, patch)
-        }
-    }
-}
-
 /// Convenience: SSE event for an `apply_patch` custom tool call with raw patch
 /// text. This mirrors the payload produced by the Responses API when the model
 /// invokes `apply_patch` directly.
@@ -925,21 +906,6 @@ pub fn ev_shell_command_call_with_args(call_id: &str, args: &serde_json::Value)
     ev_function_call(call_id, "shell_command", &arguments)
 }
 
-pub fn ev_apply_patch_shell_call(call_id: &str, patch: &str) -> Value {
-    let args = serde_json::json!({ "command": ["apply_patch", patch] });
-    let arguments = serde_json::to_string(&args).expect("serialize apply_patch arguments");
-
-    ev_function_call(call_id, "shell", &arguments)
-}
-
-pub fn ev_apply_patch_shell_call_via_heredoc(call_id: &str, patch: &str) -> Value {
-    let script = format!("apply_patch <<'EOF'\n{patch}\nEOF\n");
-    let args = serde_json::json!({ "command": ["bash", "-lc", script] });
-    let arguments = serde_json::to_string(&args).expect("serialize apply_patch arguments");
-
-    ev_function_call(call_id, "shell", &arguments)
-}
-
 pub fn ev_apply_patch_shell_command_call_via_heredoc(call_id: &str, patch: &str) -> Value {
     let args = serde_json::json!({ "command": format!("apply_patch <<'EOF'\n{patch}\nEOF\n") });
     let arguments = serde_json::to_string(&args).expect("serialize apply_patch arguments");
diff --git a/codex-rs/core/tests/common/test_codex.rs b/codex-rs/core/tests/common/test_codex.rs
index 24c25d6364..5f5c7ee85a 100644
--- a/codex-rs/core/tests/common/test_codex.rs
+++ b/codex-rs/core/tests/common/test_codex.rs
@@ -24,7 +24,6 @@ use codex_exec_server::CreateDirectoryOptions;
 use codex_exec_server::ExecutorFileSystem;
 use codex_exec_server::RemoveOptions;
 use codex_extension_api::empty_extension_registry;
-use codex_features::Feature;
 use codex_login::CodexAuth;
 use codex_model_provider_info::ModelProviderInfo;
 use codex_model_provider_info::built_in_model_providers;
@@ -185,26 +184,20 @@ fn docker_command_capture_stdout<const N: usize>(args: [&str; N]) -> Result<Stri
     String::from_utf8(output.stdout).context("docker stdout must be utf-8")
 }
 
-/// A collection of different ways the model can output an apply_patch call
+/// Non-default apply_patch model output shapes used by compatibility tests.
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
 pub enum ApplyPatchModelOutput {
-    Freeform,
-    Shell,
-    ShellViaHeredoc,
     ShellCommandViaHeredoc,
 }
 
 /// A collection of different ways the model can output an apply_patch call
 #[derive(Clone, Copy, Debug, PartialEq, Eq, Hash)]
 pub enum ShellModelOutput {
-    Shell,
     ShellCommand,
-    LocalShell,
     // UnifiedExec has its own set of tests
 }
 
-/// Returns the permission fields required by `Op::UserTurn` for tests that
-/// construct the op directly.
+/// Returns the permission fields required by test thread-settings overrides.
 pub fn turn_permission_fields(
     permission_profile: PermissionProfile,
     cwd: &Path,
@@ -300,11 +293,14 @@ impl TestCodexBuilder {
         };
         let base_url = format!("{}/v1", server.uri());
         let test_env = TestEnv::local().await?;
-        Box::pin(self.build_with_home_and_base_url(base_url, home, /*resume_from*/ None, test_env))
-            .await
+        Box::pin(self.build_with_home_and_base_url(
+            base_url, home, /*resume_from*/ None, test_env,
+            /*include_local_environment*/ false,
+        ))
+        .await
     }
 
-    pub async fn build_remote_aware(
+    pub async fn build_with_remote_env(
         &mut self,
         server: &wiremock::MockServer,
     ) -> anyhow::Result<TestCodex> {
@@ -314,8 +310,28 @@ impl TestCodexBuilder {
         };
         let base_url = format!("{}/v1", server.uri());
         let test_env = test_env().await?;
-        Box::pin(self.build_with_home_and_base_url(base_url, home, /*resume_from*/ None, test_env))
-            .await
+        Box::pin(self.build_with_home_and_base_url(
+            base_url, home, /*resume_from*/ None, test_env,
+            /*include_local_environment*/ false,
+        ))
+        .await
+    }
+
+    pub async fn build_with_remote_and_local_env(
+        &mut self,
+        server: &wiremock::MockServer,
+    ) -> anyhow::Result<TestCodex> {
+        let home = match self.home.clone() {
+            Some(home) => home,
+            None => Arc::new(TempDir::new()?),
+        };
+        let base_url = format!("{}/v1", server.uri());
+        let test_env = test_env().await?;
+        Box::pin(self.build_with_home_and_base_url(
+            base_url, home, /*resume_from*/ None, test_env,
+            /*include_local_environment*/ true,
+        ))
+        .await
     }
 
     pub async fn build_with_streaming_server(
@@ -333,6 +349,7 @@ impl TestCodexBuilder {
             home,
             /*resume_from*/ None,
             test_env,
+            /*include_local_environment*/ false,
         ))
         .await
     }
@@ -354,8 +371,11 @@ impl TestCodexBuilder {
             config.realtime.version = RealtimeWsVersion::V1;
         }));
         let test_env = TestEnv::local().await?;
-        Box::pin(self.build_with_home_and_base_url(base_url, home, /*resume_from*/ None, test_env))
-            .await
+        Box::pin(self.build_with_home_and_base_url(
+            base_url, home, /*resume_from*/ None, test_env,
+            /*include_local_environment*/ false,
+        ))
+        .await
     }
 
     pub async fn resume(
@@ -366,8 +386,14 @@ impl TestCodexBuilder {
     ) -> anyhow::Result<TestCodex> {
         let base_url = format!("{}/v1", server.uri());
         let test_env = TestEnv::local().await?;
-        Box::pin(self.build_with_home_and_base_url(base_url, home, Some(rollout_path), test_env))
-            .await
+        Box::pin(self.build_with_home_and_base_url(
+            base_url,
+            home,
+            Some(rollout_path),
+            test_env,
+            /*include_local_environment*/ false,
+        ))
+        .await
     }
 
     async fn build_with_home_and_base_url(
@@ -376,6 +402,7 @@ impl TestCodexBuilder {
         home: Arc<TempDir>,
         resume_from: Option<PathBuf>,
         test_env: TestEnv,
+        include_local_environment: bool,
     ) -> anyhow::Result<TestCodex> {
         let (config, fallback_cwd) = self
             .prepare_config(base_url, &home, test_env.cwd().clone())
@@ -395,13 +422,19 @@ impl TestCodexBuilder {
             std::env::current_exe()?,
             codex_linux_sandbox_exe,
         )?;
-        let environment_manager = Arc::new(
-            codex_exec_server::EnvironmentManager::create_for_tests(
+        let environment_manager = Arc::new(if include_local_environment {
+            codex_exec_server::EnvironmentManager::create_for_tests_with_local(
                 exec_server_url,
                 local_runtime_paths,
             )
-            .await,
-        );
+            .await
+        } else {
+            codex_exec_server::EnvironmentManager::create_for_tests(
+                exec_server_url,
+                Some(local_runtime_paths),
+            )
+            .await
+        });
         let file_system = test_env.environment().get_filesystem();
         let mut workspace_setups = vec![];
         swap(&mut self.workspace_setups, &mut workspace_setups);
@@ -545,12 +578,6 @@ impl TestCodexBuilder {
         }
         ensure_test_model_catalog(&mut config)?;
 
-        if config.include_apply_patch_tool {
-            config.features.enable(Feature::ApplyPatchFreeform)?;
-        } else {
-            config.features.disable(Feature::ApplyPatchFreeform)?;
-        }
-
         Ok((config, cwd))
     }
 }
@@ -733,24 +760,30 @@ impl TestCodex {
             turn_permission_fields(permission_profile, self.config.cwd.as_path());
         let session_model = self.session_configured.model.clone();
         self.codex
-            .submit(Op::UserTurn {
-                environments,
+            .submit(Op::UserInput {
                 items: vec![UserInput::Text {
                     text: prompt.into(),
                     text_elements: Vec::new(),
                 }],
+                environments,
                 final_output_json_schema: None,
-                cwd: self.config.cwd.to_path_buf(),
-                approval_policy,
-                approvals_reviewer: None,
-                sandbox_policy,
-                permission_profile,
-                model: session_model,
-                effort: None,
-                summary: None,
-                service_tier,
-                collaboration_mode: None,
-                personality: None,
+                responsesapi_client_metadata: None,
+                thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                    cwd: Some(self.config.cwd.to_path_buf()),
+                    approval_policy: Some(approval_policy),
+                    sandbox_policy: Some(sandbox_policy),
+                    permission_profile,
+                    service_tier,
+                    collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                        mode: codex_protocol::config_types::ModeKind::Default,
+                        settings: codex_protocol::config_types::Settings {
+                            model: session_model,
+                            reasoning_effort: None,
+                            developer_instructions: None,
+                        },
+                    }),
+                    ..Default::default()
+                },
             })
             .await?;
 
@@ -792,9 +825,9 @@ impl TestCodexHarness {
         Ok(Self { server, test })
     }
 
-    pub async fn with_remote_aware_builder(mut builder: TestCodexBuilder) -> Result<Self> {
+    pub async fn with_remote_env_builder(mut builder: TestCodexBuilder) -> Result<Self> {
         let server = start_mock_server().await;
-        let test = builder.build_remote_aware(&server).await?;
+        let test = builder.build_with_remote_env(&server).await?;
         Ok(Self { server, test })
     }
 
@@ -948,23 +981,8 @@ impl TestCodexHarness {
         custom_tool_call_output_text(&bodies, call_id)
     }
 
-    pub async fn apply_patch_output(
-        &self,
-        call_id: &str,
-        output_type: ApplyPatchModelOutput,
-    ) -> String {
-        // Box the awaited output helpers so callers do not inline request
-        // capture and response parsing into their own async state.
-        match output_type {
-            ApplyPatchModelOutput::Freeform => {
-                Box::pin(self.custom_tool_call_output(call_id)).await
-            }
-            ApplyPatchModelOutput::Shell
-            | ApplyPatchModelOutput::ShellViaHeredoc
-            | ApplyPatchModelOutput::ShellCommandViaHeredoc => {
-                Box::pin(self.function_call_stdout(call_id)).await
-            }
-        }
+    pub async fn apply_patch_output(&self, call_id: &str) -> String {
+        self.custom_tool_call_output(call_id).await
     }
 }
 
diff --git a/codex-rs/core/tests/fixtures/incomplete_sse.json b/codex-rs/core/tests/fixtures/incomplete_sse.json
deleted file mode 100644
index 2876bbfd29..0000000000
--- a/codex-rs/core/tests/fixtures/incomplete_sse.json
+++ /dev/null
@@ -1,3 +0,0 @@
-[
-  {"type": "response.output_item.done"}
-]
diff --git a/codex-rs/core/tests/suite/abort_tasks.rs b/codex-rs/core/tests/suite/abort_tasks.rs
index c81a1c2f68..c41502a9dc 100644
--- a/codex-rs/core/tests/suite/abort_tasks.rs
+++ b/codex-rs/core/tests/suite/abort_tasks.rs
@@ -53,6 +53,7 @@ async fn interrupt_long_running_tool_emits_turn_aborted() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -109,6 +110,7 @@ async fn interrupt_tool_records_history_entries() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -129,6 +131,7 @@ async fn interrupt_tool_records_history_entries() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -211,6 +214,7 @@ async fn interrupt_persists_turn_aborted_marker_in_next_request() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -231,6 +235,7 @@ async fn interrupt_persists_turn_aborted_marker_in_next_request() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
diff --git a/codex-rs/core/tests/suite/agents_md.rs b/codex-rs/core/tests/suite/agents_md.rs
index 724b852396..276fa4bb51 100644
--- a/codex-rs/core/tests/suite/agents_md.rs
+++ b/codex-rs/core/tests/suite/agents_md.rs
@@ -16,7 +16,7 @@ async fn agents_instructions(mut builder: TestCodexBuilder) -> Result<String> {
     )
     .await;
 
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_env(&server).await?;
     test.submit_turn("hello").await?;
 
     let request = resp_mock.single_request();
diff --git a/codex-rs/core/tests/suite/apply_patch_cli.rs b/codex-rs/core/tests/suite/apply_patch_cli.rs
index 82113ee494..f5a35003f8 100644
--- a/codex-rs/core/tests/suite/apply_patch_cli.rs
+++ b/codex-rs/core/tests/suite/apply_patch_cli.rs
@@ -3,8 +3,8 @@
 use anyhow::Result;
 use base64::Engine;
 use base64::engine::general_purpose::STANDARD as BASE64_STANDARD;
-use core_test_support::responses::ev_apply_patch_call;
 use core_test_support::responses::ev_apply_patch_custom_tool_call;
+use core_test_support::responses::ev_apply_patch_shell_command_call_via_heredoc;
 use core_test_support::responses::ev_shell_command_call;
 use core_test_support::test_codex::ApplyPatchModelOutput;
 use pretty_assertions::assert_eq;
@@ -45,7 +45,6 @@ use core_test_support::test_codex::test_codex;
 use core_test_support::wait_for_event;
 use core_test_support::wait_for_event_with_timeout;
 use serde_json::json;
-use test_case::test_case;
 use wiremock::Mock;
 use wiremock::Respond;
 use wiremock::ResponseTemplate;
@@ -59,12 +58,10 @@ pub async fn apply_patch_harness() -> Result<TestCodexHarness> {
 async fn apply_patch_harness_with(
     configure: impl FnOnce(TestCodexBuilder) -> TestCodexBuilder,
 ) -> Result<TestCodexHarness> {
-    let builder = configure(test_codex()).with_config(|config| {
-        config.include_apply_patch_tool = true;
-    });
+    let builder = configure(test_codex());
     // Box harness construction so apply_patch_cli tests do not inline the
     // full test-thread startup path into each test future.
-    Box::pin(TestCodexHarness::with_remote_aware_builder(builder)).await
+    Box::pin(TestCodexHarness::with_remote_env_builder(builder)).await
 }
 
 async fn submit_without_wait(harness: &TestCodexHarness, prompt: &str) -> Result<()> {
@@ -86,24 +83,29 @@ async fn submit_without_wait_with_turn_permissions(
     let test = harness.test();
     let session_model = test.session_configured.model.clone();
     test.codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: prompt.into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd: harness.cwd().to_path_buf(),
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy,
-            permission_profile,
-            model: session_model,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(harness.cwd().to_path_buf()),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: session_model,
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
     Ok(())
@@ -146,7 +148,7 @@ fn workspace_write_with_unreadable_path(unreadable_path: AbsolutePathBuf) -> Per
             path: FileSystemPath::Path {
                 path: unreadable_path,
             },
-            access: FileSystemAccessMode::None,
+            access: FileSystemAccessMode::Deny,
         },
         FileSystemSandboxEntry {
             path: FileSystemPath::Special {
@@ -184,11 +186,35 @@ pub async fn mount_apply_patch(
     call_id: &str,
     patch: &str,
     assistant_msg: &str,
-    output_type: ApplyPatchModelOutput,
 ) {
     mount_sse_sequence(
         harness.server(),
-        apply_patch_responses(call_id, patch, assistant_msg, output_type),
+        apply_patch_responses(
+            call_id,
+            patch,
+            assistant_msg,
+            ev_apply_patch_custom_tool_call,
+        ),
+    )
+    .await;
+}
+
+async fn mount_apply_patch_model_output(
+    harness: &TestCodexHarness,
+    call_id: &str,
+    patch: &str,
+    assistant_msg: &str,
+    model_output: ApplyPatchModelOutput,
+) {
+    let apply_patch_call = match model_output {
+        ApplyPatchModelOutput::ShellCommandViaHeredoc => {
+            ev_apply_patch_shell_command_call_via_heredoc
+        }
+    };
+
+    mount_sse_sequence(
+        harness.server(),
+        apply_patch_responses(call_id, patch, assistant_msg, apply_patch_call),
     )
     .await;
 }
@@ -197,12 +223,12 @@ fn apply_patch_responses(
     call_id: &str,
     patch: &str,
     assistant_msg: &str,
-    output_type: ApplyPatchModelOutput,
+    apply_patch_call: fn(&str, &str) -> serde_json::Value,
 ) -> Vec<String> {
     vec![
         sse(vec![
             ev_response_created("resp-1"),
-            ev_apply_patch_call(call_id, patch, output_type),
+            apply_patch_call(call_id, patch),
             ev_completed("resp-1"),
         ]),
         sse(vec![
@@ -233,20 +259,11 @@ async fn apply_patch_cli_uses_codex_self_exe_with_linux_sandbox_helper_alias() -
 
     let patch = "*** Begin Patch\n*** Add File: helper-alias.txt\n+hello\n*** End Patch";
     let call_id = "apply-helper-alias";
-    mount_apply_patch(
-        &harness,
-        call_id,
-        patch,
-        "done",
-        ApplyPatchModelOutput::Freeform,
-    )
-    .await;
+    mount_apply_patch(&harness, call_id, patch, "done").await;
 
     harness.submit("please apply helper alias patch").await?;
 
-    let out = harness
-        .apply_patch_output(call_id, ApplyPatchModelOutput::Freeform)
-        .await;
+    let out = harness.apply_patch_output(call_id).await;
     assert_regex_match(
         r"(?s)^Exit code: 0.*Success\. Updated the following files:\nA helper-alias\.txt\n?$",
         &out,
@@ -257,12 +274,7 @@ async fn apply_patch_cli_uses_codex_self_exe_with_linux_sandbox_helper_alias() -
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[test_case(ApplyPatchModelOutput::Freeform)]
-#[test_case(ApplyPatchModelOutput::Shell)]
-#[test_case(ApplyPatchModelOutput::ShellViaHeredoc)]
-async fn apply_patch_cli_multiple_operations_integration(
-    output_type: ApplyPatchModelOutput,
-) -> Result<()> {
+async fn apply_patch_cli_multiple_operations_integration() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
     let harness = apply_patch_harness_with(|builder| builder.with_model("gpt-5.4")).await?;
@@ -274,11 +286,11 @@ async fn apply_patch_cli_multiple_operations_integration(
     let patch = "*** Begin Patch\n*** Add File: nested/new.txt\n+created\n*** Delete File: delete.txt\n*** Update File: modify.txt\n@@\n-line2\n+changed\n*** End Patch";
 
     let call_id = "apply-multi-ops";
-    mount_apply_patch(&harness, call_id, patch, "done", output_type).await;
+    mount_apply_patch(&harness, call_id, patch, "done").await;
 
     harness.submit("please apply multi-ops patch").await?;
 
-    let out = harness.apply_patch_output(call_id, output_type).await;
+    let out = harness.apply_patch_output(call_id).await;
 
     let expected = r"(?s)^Exit code: 0
 Wall time: [0-9]+(?:\.[0-9]+)? seconds
@@ -301,11 +313,7 @@ D delete.txt
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[test_case(ApplyPatchModelOutput::Freeform)]
-#[test_case(ApplyPatchModelOutput::Shell)]
-#[test_case(ApplyPatchModelOutput::ShellViaHeredoc)]
-#[test_case(ApplyPatchModelOutput::ShellCommandViaHeredoc)]
-async fn apply_patch_cli_multiple_chunks(model_output: ApplyPatchModelOutput) -> Result<()> {
+async fn apply_patch_cli_multiple_chunks() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
     let harness = apply_patch_harness().await?;
@@ -316,7 +324,7 @@ async fn apply_patch_cli_multiple_chunks(model_output: ApplyPatchModelOutput) ->
 
     let patch = "*** Begin Patch\n*** Update File: multi.txt\n@@\n-line2\n+changed2\n@@\n-line4\n+changed4\n*** End Patch";
     let call_id = "apply-multi-chunks";
-    mount_apply_patch(&harness, call_id, patch, "ok", model_output).await;
+    mount_apply_patch(&harness, call_id, patch, "ok").await;
 
     harness.submit("apply multi-chunk patch").await?;
 
@@ -328,13 +336,7 @@ async fn apply_patch_cli_multiple_chunks(model_output: ApplyPatchModelOutput) ->
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[test_case(ApplyPatchModelOutput::Freeform)]
-#[test_case(ApplyPatchModelOutput::Shell)]
-#[test_case(ApplyPatchModelOutput::ShellViaHeredoc)]
-#[test_case(ApplyPatchModelOutput::ShellCommandViaHeredoc)]
-async fn apply_patch_cli_moves_file_to_new_directory(
-    model_output: ApplyPatchModelOutput,
-) -> Result<()> {
+async fn apply_patch_cli_moves_file_to_new_directory() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
     let harness = apply_patch_harness().await?;
@@ -343,7 +345,7 @@ async fn apply_patch_cli_moves_file_to_new_directory(
 
     let patch = "*** Begin Patch\n*** Update File: old/name.txt\n*** Move to: renamed/dir/name.txt\n@@\n-old content\n+new content\n*** End Patch";
     let call_id = "apply-move";
-    mount_apply_patch(&harness, call_id, patch, "ok", model_output).await;
+    mount_apply_patch(&harness, call_id, patch, "ok").await;
 
     harness.submit("apply move patch").await?;
 
@@ -356,13 +358,7 @@ async fn apply_patch_cli_moves_file_to_new_directory(
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[test_case(ApplyPatchModelOutput::Freeform)]
-#[test_case(ApplyPatchModelOutput::Shell)]
-#[test_case(ApplyPatchModelOutput::ShellViaHeredoc)]
-#[test_case(ApplyPatchModelOutput::ShellCommandViaHeredoc)]
-async fn apply_patch_cli_updates_file_appends_trailing_newline(
-    model_output: ApplyPatchModelOutput,
-) -> Result<()> {
+async fn apply_patch_cli_updates_file_appends_trailing_newline() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
     let harness = apply_patch_harness().await?;
@@ -373,7 +369,7 @@ async fn apply_patch_cli_updates_file_appends_trailing_newline(
 
     let patch = "*** Begin Patch\n*** Update File: no_newline.txt\n@@\n-no newline at end\n+first line\n+second line\n*** End Patch";
     let call_id = "apply-append-nl";
-    mount_apply_patch(&harness, call_id, patch, "ok", model_output).await;
+    mount_apply_patch(&harness, call_id, patch, "ok").await;
 
     harness.submit("apply newline patch").await?;
 
@@ -384,13 +380,7 @@ async fn apply_patch_cli_updates_file_appends_trailing_newline(
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[test_case(ApplyPatchModelOutput::Freeform)]
-#[test_case(ApplyPatchModelOutput::Shell)]
-#[test_case(ApplyPatchModelOutput::ShellViaHeredoc)]
-#[test_case(ApplyPatchModelOutput::ShellCommandViaHeredoc)]
-async fn apply_patch_cli_insert_only_hunk_modifies_file(
-    model_output: ApplyPatchModelOutput,
-) -> Result<()> {
+async fn apply_patch_cli_insert_only_hunk_modifies_file() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
     let harness = apply_patch_harness().await?;
@@ -401,7 +391,7 @@ async fn apply_patch_cli_insert_only_hunk_modifies_file(
 
     let patch = "*** Begin Patch\n*** Update File: insert_only.txt\n@@\n alpha\n+beta\n omega\n*** End Patch";
     let call_id = "apply-insert-only";
-    mount_apply_patch(&harness, call_id, patch, "ok", model_output).await;
+    mount_apply_patch(&harness, call_id, patch, "ok").await;
 
     harness.submit("insert lines via apply_patch").await?;
 
@@ -413,13 +403,7 @@ async fn apply_patch_cli_insert_only_hunk_modifies_file(
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[test_case(ApplyPatchModelOutput::Freeform)]
-#[test_case(ApplyPatchModelOutput::Shell)]
-#[test_case(ApplyPatchModelOutput::ShellViaHeredoc)]
-#[test_case(ApplyPatchModelOutput::ShellCommandViaHeredoc)]
-async fn apply_patch_cli_move_overwrites_existing_destination(
-    model_output: ApplyPatchModelOutput,
-) -> Result<()> {
+async fn apply_patch_cli_move_overwrites_existing_destination() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
     let harness = apply_patch_harness().await?;
@@ -431,7 +415,7 @@ async fn apply_patch_cli_move_overwrites_existing_destination(
 
     let patch = "*** Begin Patch\n*** Update File: old/name.txt\n*** Move to: renamed/dir/name.txt\n@@\n-from\n+new\n*** End Patch";
     let call_id = "apply-move-overwrite";
-    mount_apply_patch(&harness, call_id, patch, "ok", model_output).await;
+    mount_apply_patch(&harness, call_id, patch, "ok").await;
 
     harness.submit("apply move overwrite patch").await?;
 
@@ -444,13 +428,7 @@ async fn apply_patch_cli_move_overwrites_existing_destination(
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[test_case(ApplyPatchModelOutput::Freeform)]
-#[test_case(ApplyPatchModelOutput::Shell)]
-#[test_case(ApplyPatchModelOutput::ShellViaHeredoc)]
-#[test_case(ApplyPatchModelOutput::ShellCommandViaHeredoc)]
-async fn apply_patch_cli_move_without_content_change_has_no_turn_diff(
-    model_output: ApplyPatchModelOutput,
-) -> Result<()> {
+async fn apply_patch_cli_move_without_content_change_has_no_turn_diff() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
     let harness = apply_patch_harness().await?;
@@ -461,7 +439,7 @@ async fn apply_patch_cli_move_without_content_change_has_no_turn_diff(
 
     let patch = "*** Begin Patch\n*** Update File: old/name.txt\n*** Move to: renamed/name.txt\n@@\n same\n*** End Patch";
     let call_id = "apply-move-no-change";
-    mount_apply_patch(&harness, call_id, patch, "ok", model_output).await;
+    mount_apply_patch(&harness, call_id, patch, "ok").await;
 
     submit_without_wait(&harness, "rename without content change").await?;
 
@@ -483,13 +461,7 @@ async fn apply_patch_cli_move_without_content_change_has_no_turn_diff(
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[test_case(ApplyPatchModelOutput::Freeform)]
-#[test_case(ApplyPatchModelOutput::Shell)]
-#[test_case(ApplyPatchModelOutput::ShellViaHeredoc)]
-#[test_case(ApplyPatchModelOutput::ShellCommandViaHeredoc)]
-async fn apply_patch_cli_add_overwrites_existing_file(
-    model_output: ApplyPatchModelOutput,
-) -> Result<()> {
+async fn apply_patch_cli_add_overwrites_existing_file() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
     let harness = apply_patch_harness().await?;
@@ -498,7 +470,7 @@ async fn apply_patch_cli_add_overwrites_existing_file(
 
     let patch = "*** Begin Patch\n*** Add File: duplicate.txt\n+new content\n*** End Patch";
     let call_id = "apply-add-overwrite";
-    mount_apply_patch(&harness, call_id, patch, "ok", model_output).await;
+    mount_apply_patch(&harness, call_id, patch, "ok").await;
 
     harness.submit("apply add overwrite patch").await?;
 
@@ -510,24 +482,18 @@ async fn apply_patch_cli_add_overwrites_existing_file(
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[test_case(ApplyPatchModelOutput::Freeform)]
-#[test_case(ApplyPatchModelOutput::Shell)]
-#[test_case(ApplyPatchModelOutput::ShellViaHeredoc)]
-#[test_case(ApplyPatchModelOutput::ShellCommandViaHeredoc)]
-async fn apply_patch_cli_rejects_invalid_hunk_header(
-    model_output: ApplyPatchModelOutput,
-) -> Result<()> {
+async fn apply_patch_cli_rejects_invalid_hunk_header() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
     let harness = apply_patch_harness().await?;
 
     let patch = "*** Begin Patch\n*** Frobnicate File: foo\n*** End Patch";
     let call_id = "apply-invalid-header";
-    mount_apply_patch(&harness, call_id, patch, "ok", model_output).await;
+    mount_apply_patch(&harness, call_id, patch, "ok").await;
 
     harness.submit("apply invalid header patch").await?;
 
-    let out = harness.apply_patch_output(call_id, model_output).await;
+    let out = harness.apply_patch_output(call_id).await;
 
     assert!(
         out.contains("apply_patch verification failed"),
@@ -541,13 +507,7 @@ async fn apply_patch_cli_rejects_invalid_hunk_header(
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[test_case(ApplyPatchModelOutput::Freeform)]
-#[test_case(ApplyPatchModelOutput::Shell)]
-#[test_case(ApplyPatchModelOutput::ShellViaHeredoc)]
-#[test_case(ApplyPatchModelOutput::ShellCommandViaHeredoc)]
-async fn apply_patch_cli_reports_missing_context(
-    model_output: ApplyPatchModelOutput,
-) -> Result<()> {
+async fn apply_patch_cli_reports_missing_context() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
     let harness = apply_patch_harness().await?;
@@ -557,11 +517,11 @@ async fn apply_patch_cli_reports_missing_context(
     let patch =
         "*** Begin Patch\n*** Update File: modify.txt\n@@\n-missing\n+changed\n*** End Patch";
     let call_id = "apply-missing-context";
-    mount_apply_patch(&harness, call_id, patch, "ok", model_output).await;
+    mount_apply_patch(&harness, call_id, patch, "ok").await;
 
     harness.submit("apply missing context patch").await?;
 
-    let out = harness.apply_patch_output(call_id, model_output).await;
+    let out = harness.apply_patch_output(call_id).await;
 
     assert!(
         out.contains("apply_patch verification failed"),
@@ -576,24 +536,18 @@ async fn apply_patch_cli_reports_missing_context(
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[test_case(ApplyPatchModelOutput::Freeform)]
-#[test_case(ApplyPatchModelOutput::Shell)]
-#[test_case(ApplyPatchModelOutput::ShellViaHeredoc)]
-#[test_case(ApplyPatchModelOutput::ShellCommandViaHeredoc)]
-async fn apply_patch_cli_reports_missing_target_file(
-    model_output: ApplyPatchModelOutput,
-) -> Result<()> {
+async fn apply_patch_cli_reports_missing_target_file() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
     let harness = apply_patch_harness().await?;
 
     let patch = "*** Begin Patch\n*** Update File: missing.txt\n@@\n-nope\n+better\n*** End Patch";
     let call_id = "apply-missing-file";
-    mount_apply_patch(&harness, call_id, patch, "fail", model_output).await;
+    mount_apply_patch(&harness, call_id, patch, "fail").await;
 
     harness.submit("attempt to update a missing file").await?;
 
-    let out = harness.apply_patch_output(call_id, model_output).await;
+    let out = harness.apply_patch_output(call_id).await;
     assert!(
         out.contains("apply_patch verification failed"),
         "expected verification failure message"
@@ -611,24 +565,18 @@ async fn apply_patch_cli_reports_missing_target_file(
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[test_case(ApplyPatchModelOutput::Freeform)]
-#[test_case(ApplyPatchModelOutput::Shell)]
-#[test_case(ApplyPatchModelOutput::ShellViaHeredoc)]
-#[test_case(ApplyPatchModelOutput::ShellCommandViaHeredoc)]
-async fn apply_patch_cli_delete_missing_file_reports_error(
-    model_output: ApplyPatchModelOutput,
-) -> Result<()> {
+async fn apply_patch_cli_delete_missing_file_reports_error() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
     let harness = apply_patch_harness().await?;
 
     let patch = "*** Begin Patch\n*** Delete File: missing.txt\n*** End Patch";
     let call_id = "apply-delete-missing";
-    mount_apply_patch(&harness, call_id, patch, "fail", model_output).await;
+    mount_apply_patch(&harness, call_id, patch, "fail").await;
 
     harness.submit("attempt to delete missing file").await?;
 
-    let out = harness.apply_patch_output(call_id, model_output).await;
+    let out = harness.apply_patch_output(call_id).await;
 
     assert!(
         out.contains("apply_patch verification failed"),
@@ -647,22 +595,18 @@ async fn apply_patch_cli_delete_missing_file_reports_error(
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[test_case(ApplyPatchModelOutput::Freeform)]
-#[test_case(ApplyPatchModelOutput::Shell)]
-#[test_case(ApplyPatchModelOutput::ShellViaHeredoc)]
-#[test_case(ApplyPatchModelOutput::ShellCommandViaHeredoc)]
-async fn apply_patch_cli_rejects_empty_patch(model_output: ApplyPatchModelOutput) -> Result<()> {
+async fn apply_patch_cli_rejects_empty_patch() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
     let harness = apply_patch_harness().await?;
 
     let patch = "*** Begin Patch\n*** End Patch";
     let call_id = "apply-empty";
-    mount_apply_patch(&harness, call_id, patch, "ok", model_output).await;
+    mount_apply_patch(&harness, call_id, patch, "ok").await;
 
     harness.submit("apply empty patch").await?;
 
-    let out = harness.apply_patch_output(call_id, model_output).await;
+    let out = harness.apply_patch_output(call_id).await;
     assert!(
         out.contains("patch rejected: empty patch"),
         "expected rejection for empty patch: {out}"
@@ -671,13 +615,7 @@ async fn apply_patch_cli_rejects_empty_patch(model_output: ApplyPatchModelOutput
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[test_case(ApplyPatchModelOutput::Freeform)]
-#[test_case(ApplyPatchModelOutput::Shell)]
-#[test_case(ApplyPatchModelOutput::ShellViaHeredoc)]
-#[test_case(ApplyPatchModelOutput::ShellCommandViaHeredoc)]
-async fn apply_patch_cli_delete_directory_reports_verification_error(
-    model_output: ApplyPatchModelOutput,
-) -> Result<()> {
+async fn apply_patch_cli_delete_directory_reports_verification_error() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
     let harness = apply_patch_harness().await?;
@@ -686,24 +624,18 @@ async fn apply_patch_cli_delete_directory_reports_verification_error(
 
     let patch = "*** Begin Patch\n*** Delete File: dir\n*** End Patch";
     let call_id = "apply-delete-dir";
-    mount_apply_patch(&harness, call_id, patch, "ok", model_output).await;
+    mount_apply_patch(&harness, call_id, patch, "ok").await;
 
     harness.submit("delete a directory via apply_patch").await?;
 
-    let out = harness.apply_patch_output(call_id, model_output).await;
+    let out = harness.apply_patch_output(call_id).await;
     assert!(out.contains("apply_patch verification failed"));
     assert!(out.contains("Failed to read"));
     Ok(())
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[test_case(ApplyPatchModelOutput::Freeform)]
-#[test_case(ApplyPatchModelOutput::Shell)]
-#[test_case(ApplyPatchModelOutput::ShellViaHeredoc)]
-#[test_case(ApplyPatchModelOutput::ShellCommandViaHeredoc)]
-async fn apply_patch_cli_rejects_path_traversal_outside_workspace(
-    model_output: ApplyPatchModelOutput,
-) -> Result<()> {
+async fn apply_patch_cli_rejects_path_traversal_outside_workspace() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
     let harness = apply_patch_harness().await?;
@@ -719,7 +651,7 @@ async fn apply_patch_cli_rejects_path_traversal_outside_workspace(
 
     let patch = "*** Begin Patch\n*** Add File: ../escape.txt\n+outside\n*** End Patch";
     let call_id = "apply-path-traversal";
-    mount_apply_patch(&harness, call_id, patch, "fail", model_output).await;
+    mount_apply_patch(&harness, call_id, patch, "fail").await;
 
     harness
         .submit_with_permission_profile(
@@ -728,7 +660,7 @@ async fn apply_patch_cli_rejects_path_traversal_outside_workspace(
         )
         .await?;
 
-    let out = harness.apply_patch_output(call_id, model_output).await;
+    let out = harness.apply_patch_output(call_id).await;
     assert!(
         out.contains(
             "patch rejected: writing outside of the project; rejected by user approval settings"
@@ -744,12 +676,7 @@ async fn apply_patch_cli_rejects_path_traversal_outside_workspace(
 
 #[cfg(unix)]
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[test_case(ApplyPatchModelOutput::Shell ; "shell")]
-#[test_case(ApplyPatchModelOutput::ShellViaHeredoc ; "shell_heredoc")]
-#[test_case(ApplyPatchModelOutput::ShellCommandViaHeredoc ; "shell_command_heredoc")]
-async fn intercepted_apply_patch_verification_uses_local_sandbox(
-    model_output: ApplyPatchModelOutput,
-) -> Result<()> {
+async fn intercepted_apply_patch_verification_uses_local_sandbox() -> Result<()> {
     skip_if_no_network!(Ok(()));
     skip_if_remote!(Ok(()), "symlink setup needs local filesystem link creation");
 
@@ -769,7 +696,14 @@ async fn intercepted_apply_patch_verification_uses_local_sandbox(
 *** End Patch"#
     );
     let call_id = "apply-sandboxed-read";
-    mount_apply_patch(&harness, call_id, &patch, "fail", model_output).await;
+    mount_apply_patch_model_output(
+        &harness,
+        call_id,
+        &patch,
+        "fail",
+        ApplyPatchModelOutput::ShellCommandViaHeredoc,
+    )
+    .await;
 
     harness
         .submit_with_permission_profile(
@@ -778,7 +712,11 @@ async fn intercepted_apply_patch_verification_uses_local_sandbox(
         )
         .await?;
 
-    let out = harness.apply_patch_output(call_id, model_output).await;
+    let out = harness.function_call_stdout(call_id).await;
+    assert!(
+        serde_json::from_str::<serde_json::Value>(&out).is_err(),
+        "expected heredoc apply_patch output to be plain text"
+    );
     assert!(
         out.contains("apply_patch verification failed"),
         "expected sandboxed verification failure: {out}"
@@ -796,13 +734,7 @@ async fn intercepted_apply_patch_verification_uses_local_sandbox(
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[test_case(ApplyPatchModelOutput::Freeform ; "freeform")]
-#[test_case(ApplyPatchModelOutput::Shell ; "shell")]
-#[test_case(ApplyPatchModelOutput::ShellViaHeredoc ; "shell_heredoc")]
-#[test_case(ApplyPatchModelOutput::ShellCommandViaHeredoc ; "shell_command_heredoc")]
-async fn apply_patch_cli_does_not_write_through_symlink_escape_outside_workspace(
-    model_output: ApplyPatchModelOutput,
-) -> Result<()> {
+async fn apply_patch_cli_does_not_write_through_symlink_escape_outside_workspace() -> Result<()> {
     skip_if_no_network!(Ok(()));
     skip_if_remote!(
         Ok(()),
@@ -846,7 +778,7 @@ async fn apply_patch_cli_does_not_write_through_symlink_escape_outside_workspace
 *** End Patch"#
     );
     let call_id = "apply-symlink-escape";
-    mount_apply_patch(&harness, call_id, &patch, "fail", model_output).await;
+    mount_apply_patch(&harness, call_id, &patch, "fail").await;
 
     harness
         .submit_with_permission_profile(
@@ -855,7 +787,7 @@ async fn apply_patch_cli_does_not_write_through_symlink_escape_outside_workspace
         )
         .await?;
 
-    let out = harness.apply_patch_output(call_id, model_output).await;
+    let out = harness.apply_patch_output(call_id).await;
     assert_eq!(
         std::fs::read_to_string(&outside_file)?,
         original_contents,
@@ -867,13 +799,7 @@ async fn apply_patch_cli_does_not_write_through_symlink_escape_outside_workspace
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[test_case(ApplyPatchModelOutput::Freeform ; "freeform")]
-#[test_case(ApplyPatchModelOutput::Shell ; "shell")]
-#[test_case(ApplyPatchModelOutput::ShellViaHeredoc ; "shell_heredoc")]
-#[test_case(ApplyPatchModelOutput::ShellCommandViaHeredoc ; "shell_command_heredoc")]
-async fn apply_patch_cli_preserves_existing_hard_link_outside_workspace(
-    model_output: ApplyPatchModelOutput,
-) -> Result<()> {
+async fn apply_patch_cli_preserves_existing_hard_link_outside_workspace() -> Result<()> {
     skip_if_no_network!(Ok(()));
     skip_if_remote!(
         Ok(()),
@@ -909,7 +835,7 @@ async fn apply_patch_cli_preserves_existing_hard_link_outside_workspace(
 *** End Patch"#
     );
     let call_id = "apply-hard-link";
-    mount_apply_patch(&harness, call_id, &patch, "ok", model_output).await;
+    mount_apply_patch(&harness, call_id, &patch, "ok").await;
 
     harness
         .submit_with_permission_profile(
@@ -918,7 +844,7 @@ async fn apply_patch_cli_preserves_existing_hard_link_outside_workspace(
         )
         .await?;
 
-    let out = harness.apply_patch_output(call_id, model_output).await;
+    let out = harness.apply_patch_output(call_id).await;
     if cfg!(windows) {
         assert!(
             out.contains("patch rejected: writing outside of the project"),
@@ -971,13 +897,7 @@ async fn apply_patch_cli_preserves_existing_hard_link_outside_workspace(
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[test_case(ApplyPatchModelOutput::Freeform)]
-#[test_case(ApplyPatchModelOutput::Shell)]
-#[test_case(ApplyPatchModelOutput::ShellViaHeredoc)]
-#[test_case(ApplyPatchModelOutput::ShellCommandViaHeredoc)]
-async fn apply_patch_cli_rejects_move_path_traversal_outside_workspace(
-    model_output: ApplyPatchModelOutput,
-) -> Result<()> {
+async fn apply_patch_cli_rejects_move_path_traversal_outside_workspace() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
     let harness = apply_patch_harness().await?;
@@ -995,7 +915,7 @@ async fn apply_patch_cli_rejects_move_path_traversal_outside_workspace(
 
     let patch = "*** Begin Patch\n*** Update File: stay.txt\n*** Move to: ../escape-move.txt\n@@\n-from\n+to\n*** End Patch";
     let call_id = "apply-move-traversal";
-    mount_apply_patch(&harness, call_id, patch, "fail", model_output).await;
+    mount_apply_patch(&harness, call_id, patch, "fail").await;
 
     harness
         .submit_with_permission_profile(
@@ -1004,7 +924,7 @@ async fn apply_patch_cli_rejects_move_path_traversal_outside_workspace(
         )
         .await?;
 
-    let out = harness.apply_patch_output(call_id, model_output).await;
+    let out = harness.apply_patch_output(call_id).await;
     assert!(
         out.contains(
             "patch rejected: writing outside of the project; rejected by user approval settings"
@@ -1020,30 +940,16 @@ async fn apply_patch_cli_rejects_move_path_traversal_outside_workspace(
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[test_case(ApplyPatchModelOutput::Freeform)]
-#[test_case(ApplyPatchModelOutput::Shell)]
-#[test_case(ApplyPatchModelOutput::ShellViaHeredoc)]
-#[test_case(ApplyPatchModelOutput::ShellCommandViaHeredoc)]
-async fn apply_patch_cli_verification_failure_has_no_side_effects(
-    model_output: ApplyPatchModelOutput,
-) -> Result<()> {
+async fn apply_patch_cli_verification_failure_has_no_side_effects() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
-    let harness = apply_patch_harness_with(|builder| {
-        builder.with_config(|config| {
-            config
-                .features
-                .enable(Feature::ApplyPatchFreeform)
-                .expect("test config should allow feature update");
-        })
-    })
-    .await?;
+    let harness = apply_patch_harness().await?;
 
     // Compose a patch that would create a file, then fail verification on an update.
     let call_id = "apply-partial-no-side-effects";
     let patch = "*** Begin Patch\n*** Add File: created.txt\n+hello\n*** Update File: missing.txt\n@@\n-old\n+new\n*** End Patch";
 
-    mount_apply_patch(&harness, call_id, patch, "failed", model_output).await;
+    mount_apply_patch(&harness, call_id, patch, "failed").await;
 
     harness.submit("attempt partial apply patch").await?;
 
@@ -1443,14 +1349,7 @@ async fn apply_patch_turn_diff_paths_stay_repo_relative_when_session_cwd_is_nest
 
     let call_id = "apply-nested-cwd-repo-relative";
     let patch = "*** Begin Patch\n*** Update File: ../repo.txt\n@@\n-before\n+after\n*** End Patch";
-    mount_apply_patch(
-        &harness,
-        call_id,
-        patch,
-        "updated repo-relative path",
-        ApplyPatchModelOutput::Freeform,
-    )
-    .await;
+    mount_apply_patch(&harness, call_id, patch, "updated repo-relative path").await;
 
     submit_without_wait(&harness, "update file outside nested cwd but inside repo").await?;
 
@@ -1535,11 +1434,7 @@ async fn apply_patch_shell_command_failure_propagates_error_and_skips_diff() ->
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[test_case(ApplyPatchModelOutput::ShellViaHeredoc)]
-#[test_case(ApplyPatchModelOutput::ShellCommandViaHeredoc)]
-async fn apply_patch_shell_accepts_lenient_heredoc_wrapped_patch(
-    model_output: ApplyPatchModelOutput,
-) -> Result<()> {
+async fn apply_patch_shell_accepts_lenient_heredoc_wrapped_patch() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
     let harness = apply_patch_harness().await?;
@@ -1548,20 +1443,36 @@ async fn apply_patch_shell_accepts_lenient_heredoc_wrapped_patch(
     let patch_inner =
         format!("*** Begin Patch\n*** Add File: {file_name}\n+lenient\n*** End Patch\n");
     let call_id = "apply-lenient";
-    mount_apply_patch(&harness, call_id, patch_inner.as_str(), "ok", model_output).await;
+    mount_apply_patch_model_output(
+        &harness,
+        call_id,
+        patch_inner.as_str(),
+        "ok",
+        ApplyPatchModelOutput::ShellCommandViaHeredoc,
+    )
+    .await;
 
     harness.submit("apply lenient heredoc patch").await?;
 
+    let out = harness.function_call_stdout(call_id).await;
+    assert!(
+        serde_json::from_str::<serde_json::Value>(&out).is_err(),
+        "expected heredoc apply_patch output to be plain text"
+    );
+    assert!(
+        out.contains("Success. Updated the following files:"),
+        "expected successful apply_patch output: {out}"
+    );
+    assert!(
+        out.contains(&format!("A {file_name}")),
+        "expected created file in apply_patch output: {out}"
+    );
     assert_eq!(harness.read_file_text(file_name).await?, "lenient\n");
     Ok(())
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[test_case(ApplyPatchModelOutput::Freeform)]
-#[test_case(ApplyPatchModelOutput::Shell)]
-#[test_case(ApplyPatchModelOutput::ShellViaHeredoc)]
-#[test_case(ApplyPatchModelOutput::ShellCommandViaHeredoc)]
-async fn apply_patch_cli_end_of_file_anchor(model_output: ApplyPatchModelOutput) -> Result<()> {
+async fn apply_patch_cli_end_of_file_anchor() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
     let harness = apply_patch_harness().await?;
@@ -1570,7 +1481,7 @@ async fn apply_patch_cli_end_of_file_anchor(model_output: ApplyPatchModelOutput)
 
     let patch = "*** Begin Patch\n*** Update File: tail.txt\n@@\n-last\n+end\n*** End of File\n*** End Patch";
     let call_id = "apply-eof";
-    mount_apply_patch(&harness, call_id, patch, "ok", model_output).await;
+    mount_apply_patch(&harness, call_id, patch, "ok").await;
 
     harness.submit("apply EOF-anchored patch").await?;
     assert_eq!(harness.read_file_text("tail.txt").await?, "alpha\nend\n");
@@ -1578,13 +1489,7 @@ async fn apply_patch_cli_end_of_file_anchor(model_output: ApplyPatchModelOutput)
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[test_case(ApplyPatchModelOutput::Freeform)]
-#[test_case(ApplyPatchModelOutput::Shell)]
-#[test_case(ApplyPatchModelOutput::ShellViaHeredoc)]
-#[test_case(ApplyPatchModelOutput::ShellCommandViaHeredoc)]
-async fn apply_patch_cli_missing_second_chunk_context_rejected(
-    model_output: ApplyPatchModelOutput,
-) -> Result<()> {
+async fn apply_patch_cli_missing_second_chunk_context_rejected() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
     let harness = apply_patch_harness().await?;
@@ -1595,11 +1500,11 @@ async fn apply_patch_cli_missing_second_chunk_context_rejected(
     let patch =
         "*** Begin Patch\n*** Update File: two_chunks.txt\n@@\n-b\n+B\n\n-d\n+D\n*** End Patch";
     let call_id = "apply-missing-ctx-2nd";
-    mount_apply_patch(&harness, call_id, patch, "fail", model_output).await;
+    mount_apply_patch(&harness, call_id, patch, "fail").await;
 
     harness.submit("apply missing context second chunk").await?;
 
-    let out = harness.apply_patch_output(call_id, model_output).await;
+    let out = harness.apply_patch_output(call_id).await;
     assert!(out.contains("apply_patch verification failed"));
     assert!(
         out.contains("Failed to find expected lines in"),
@@ -1614,13 +1519,7 @@ async fn apply_patch_cli_missing_second_chunk_context_rejected(
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[test_case(ApplyPatchModelOutput::Freeform)]
-#[test_case(ApplyPatchModelOutput::Shell)]
-#[test_case(ApplyPatchModelOutput::ShellViaHeredoc)]
-#[test_case(ApplyPatchModelOutput::ShellCommandViaHeredoc)]
-async fn apply_patch_emits_turn_diff_event_with_unified_diff(
-    model_output: ApplyPatchModelOutput,
-) -> Result<()> {
+async fn apply_patch_emits_turn_diff_event_with_unified_diff() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
     let harness = apply_patch_harness().await?;
@@ -1630,7 +1529,7 @@ async fn apply_patch_emits_turn_diff_event_with_unified_diff(
     let call_id = "apply-diff-event";
     let file = "udiff.txt";
     let patch = format!("*** Begin Patch\n*** Add File: {file}\n+hello\n*** End Patch\n");
-    mount_apply_patch(&harness, call_id, patch.as_str(), "ok", model_output).await;
+    mount_apply_patch(&harness, call_id, patch.as_str(), "ok").await;
 
     submit_without_wait(&harness, "emit diff").await?;
 
@@ -1846,13 +1745,7 @@ async fn apply_patch_clears_aggregated_diff_after_inexact_delta() -> Result<()>
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[test_case(ApplyPatchModelOutput::Freeform)]
-#[test_case(ApplyPatchModelOutput::Shell)]
-#[test_case(ApplyPatchModelOutput::ShellViaHeredoc)]
-#[test_case(ApplyPatchModelOutput::ShellCommandViaHeredoc)]
-async fn apply_patch_change_context_disambiguates_target(
-    model_output: ApplyPatchModelOutput,
-) -> Result<()> {
+async fn apply_patch_change_context_disambiguates_target() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
     let harness = apply_patch_harness().await?;
@@ -1864,7 +1757,7 @@ async fn apply_patch_change_context_disambiguates_target(
     let patch =
         "*** Begin Patch\n*** Update File: multi_ctx.txt\n@@ fn b\n-x=10\n+x=11\n*** End Patch";
     let call_id = "apply-ctx";
-    mount_apply_patch(&harness, call_id, patch, "ok", model_output).await;
+    mount_apply_patch(&harness, call_id, patch, "ok").await;
 
     harness.submit("apply with change_context").await?;
 
diff --git a/codex-rs/core/tests/suite/approvals.rs b/codex-rs/core/tests/suite/approvals.rs
index 6db6495933..924253d8b8 100644
--- a/codex-rs/core/tests/suite/approvals.rs
+++ b/codex-rs/core/tests/suite/approvals.rs
@@ -25,6 +25,7 @@ use core_test_support::responses::ev_apply_patch_custom_tool_call;
 use core_test_support::responses::ev_assistant_message;
 use core_test_support::responses::ev_completed;
 use core_test_support::responses::ev_function_call;
+use core_test_support::responses::ev_function_call_with_namespace;
 use core_test_support::responses::ev_response_created;
 use core_test_support::responses::mount_sse_once;
 use core_test_support::responses::mount_sse_once_match;
@@ -644,24 +645,29 @@ async fn submit_turn(
     let session_model = test.session_configured.model.clone();
 
     test.codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: prompt.into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd: test.cwd.path().to_path_buf(),
-            approval_policy,
-            approvals_reviewer: Some(ApprovalsReviewer::User),
-            sandbox_policy,
-            permission_profile: None,
-            model: session_model,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(test.cwd.path().to_path_buf()),
+                approval_policy: Some(approval_policy),
+                approvals_reviewer: Some(ApprovalsReviewer::User),
+                sandbox_policy: Some(sandbox_policy),
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: session_model,
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
 
@@ -829,8 +835,8 @@ fn scenarios() -> Vec<ScenarioSpec> {
     let workspace_write = |network_access| SandboxPolicy::WorkspaceWrite {
         writable_roots: vec![],
         network_access,
-        exclude_tmpdir_env_var: false,
-        exclude_slash_tmp: false,
+        exclude_tmpdir_env_var: true,
+        exclude_slash_tmp: true,
     };
 
     vec![
@@ -1408,7 +1414,7 @@ fn scenarios() -> Vec<ScenarioSpec> {
                 content: "freeform-patch-danger",
             },
             sandbox_permissions: SandboxPermissions::UseDefault,
-            features: vec![Feature::ApplyPatchFreeform],
+            features: vec![],
             model_override: Some("gpt-5.4"),
             outcome: Outcome::Auto,
             expectation: Expectation::PatchApplied {
@@ -2049,8 +2055,8 @@ async fn approving_apply_patch_for_session_skips_future_prompts_for_same_file()
     let sandbox_policy = SandboxPolicy::WorkspaceWrite {
         writable_roots: vec![],
         network_access: false,
-        exclude_tmpdir_env_var: false,
-        exclude_slash_tmp: false,
+        exclude_tmpdir_env_var: true,
+        exclude_slash_tmp: true,
     };
     let sandbox_policy_for_config = sandbox_policy.clone();
 
@@ -2368,7 +2374,12 @@ async fn spawned_subagent_execpolicy_amendment_propagates_to_parent_session() ->
         |req: &Request| body_contains(req, PARENT_PROMPT),
         sse(vec![
             ev_response_created("resp-parent-1"),
-            ev_function_call(SPAWN_CALL_ID, "spawn_agent", &spawn_args),
+            ev_function_call_with_namespace(
+                SPAWN_CALL_ID,
+                "multi_agent_v1",
+                "spawn_agent",
+                &spawn_args,
+            ),
             ev_completed("resp-parent-1"),
         ]),
     )
@@ -2578,24 +2589,30 @@ async fn matched_prefix_rule_runs_unsandboxed_under_zsh_fork() -> Result<()> {
     let (sandbox_policy, permission_profile) =
         turn_permission_fields(permission_profile, test.cwd.path());
     test.codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "run allowed touch under zsh fork".into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd: test.cwd.path().to_path_buf(),
-            approval_policy,
-            approvals_reviewer: Some(ApprovalsReviewer::User),
-            sandbox_policy,
-            permission_profile,
-            model: session_model,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(test.cwd.path().to_path_buf()),
+                approval_policy: Some(approval_policy),
+                approvals_reviewer: Some(ApprovalsReviewer::User),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: session_model,
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
 
@@ -2805,8 +2822,8 @@ allow_local_binding = true
     let sandbox_policy = SandboxPolicy::WorkspaceWrite {
         writable_roots: vec![],
         network_access: true,
-        exclude_tmpdir_env_var: false,
-        exclude_slash_tmp: false,
+        exclude_tmpdir_env_var: true,
+        exclude_slash_tmp: true,
     };
     let sandbox_policy_for_config = sandbox_policy.clone();
     let mut builder = test_codex()
@@ -3085,8 +3102,8 @@ allow_local_binding = true
     let turn_sandbox_policy = SandboxPolicy::WorkspaceWrite {
         writable_roots: vec![],
         network_access: true,
-        exclude_tmpdir_env_var: false,
-        exclude_slash_tmp: false,
+        exclude_tmpdir_env_var: true,
+        exclude_slash_tmp: true,
     };
     let mut builder = test_codex()
         .with_home(home)
diff --git a/codex-rs/core/tests/suite/client.rs b/codex-rs/core/tests/suite/client.rs
index 2bb511312e..f6731a0ea4 100644
--- a/codex-rs/core/tests/suite/client.rs
+++ b/codex-rs/core/tests/suite/client.rs
@@ -52,6 +52,7 @@ use core_test_support::PathBufExt;
 use core_test_support::apps_test_server::AppsTestServer;
 use core_test_support::load_default_config_for_test;
 use core_test_support::responses::ResponsesRequest;
+use core_test_support::responses::ev_assistant_message;
 use core_test_support::responses::ev_completed;
 use core_test_support::responses::ev_completed_with_tokens;
 use core_test_support::responses::ev_message_item_added;
@@ -391,6 +392,7 @@ async fn resume_includes_initial_messages_and_sends_prior_items() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -756,6 +758,7 @@ async fn includes_session_id_thread_id_and_model_headers_in_request() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -764,10 +767,8 @@ async fn includes_session_id_thread_id_and_model_headers_in_request() {
 
     let request = resp_mock.single_request();
     assert_eq!(request.path(), "/v1/responses");
-    let request_session_id = request.header("session_id").expect("session_id header");
-    let request_session_id_hyphenated = request.header("session-id").expect("session-id header");
-    let request_thread_id = request.header("thread_id").expect("thread_id header");
-    let request_thread_id_hyphenated = request.header("thread-id").expect("thread-id header");
+    let request_session_id = request.header("session-id").expect("session-id header");
+    let request_thread_id = request.header("thread-id").expect("thread-id header");
     let request_authorization = request
         .header("authorization")
         .expect("authorization header");
@@ -779,12 +780,7 @@ async fn includes_session_id_thread_id_and_model_headers_in_request() {
     let thread_id_string = expected_thread_id.to_string();
 
     assert_eq!(request_session_id, expected_session_id.to_string());
-    assert_eq!(
-        request_session_id_hyphenated,
-        expected_session_id.to_string()
-    );
     assert_eq!(request_thread_id, thread_id_string.as_str());
-    assert_eq!(request_thread_id_hyphenated, thread_id_string.as_str());
     assert_eq!(request_originator, originator().value);
     assert_eq!(request_authorization, "Bearer Test API Key");
     assert_eq!(
@@ -973,6 +969,7 @@ async fn includes_base_instructions_override_in_request() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -1029,6 +1026,7 @@ async fn chatgpt_auth_sends_correct_request() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -1046,20 +1044,13 @@ async fn chatgpt_auth_sends_correct_request() {
         .expect("chatgpt-account-id header");
     let request_body = request.body_json();
 
-    let request_session_id = request.header("session_id").expect("session_id header");
-    let request_session_id_hyphenated = request.header("session-id").expect("session-id header");
-    let request_thread_id = request.header("thread_id").expect("thread_id header");
-    let request_thread_id_hyphenated = request.header("thread-id").expect("thread-id header");
+    let request_session_id = request.header("session-id").expect("session-id header");
+    let request_thread_id = request.header("thread-id").expect("thread-id header");
     let installation_id =
         std::fs::read_to_string(test.codex_home_path().join(INSTALLATION_ID_FILENAME))
             .expect("read installation id");
     assert_eq!(request_session_id, expected_session_id.to_string());
-    assert_eq!(
-        request_session_id_hyphenated,
-        expected_session_id.to_string()
-    );
     assert_eq!(request_thread_id, expected_thread_id.to_string());
-    assert_eq!(request_thread_id_hyphenated, expected_thread_id.to_string());
 
     assert_eq!(request_originator, originator().value);
     assert_eq!(request_authorization, "Bearer Access Token");
@@ -1159,6 +1150,7 @@ async fn prefers_apikey_when_config_prefers_apikey_even_with_chatgpt_tokens() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -1197,6 +1189,7 @@ async fn includes_user_instructions_message_in_request() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -1284,6 +1277,7 @@ async fn includes_apps_guidance_as_developer_message_for_chatgpt_auth() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -1346,6 +1340,7 @@ async fn omits_apps_guidance_for_api_key_auth_even_when_feature_enabled() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -1404,6 +1399,7 @@ async fn omits_apps_guidance_when_configured_off() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -1445,6 +1441,7 @@ async fn omits_environment_context_when_configured_off() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -1501,6 +1498,7 @@ async fn skills_append_to_developer_message() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -1583,6 +1581,7 @@ async fn skills_use_aliases_in_developer_message_under_budget_pressure() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -1643,6 +1642,7 @@ async fn includes_configured_effort_in_request() -> anyhow::Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -1684,6 +1684,7 @@ async fn includes_no_effort_in_request() -> anyhow::Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -1726,6 +1727,7 @@ async fn includes_default_reasoning_effort_in_request_when_defined_by_model_info
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -1756,12 +1758,7 @@ async fn user_turn_collaboration_mode_overrides_model_and_effort() -> anyhow::Re
         sse(vec![ev_response_created("resp1"), ev_completed("resp1")]),
     )
     .await;
-    let TestCodex {
-        codex,
-        config,
-        session_configured,
-        ..
-    } = test_codex().with_model("gpt-5.4").build(&server).await?;
+    let TestCodex { codex, config, .. } = test_codex().with_model("gpt-5.4").build(&server).await?;
 
     let collaboration_mode = CollaborationMode {
         mode: ModeKind::Default,
@@ -1773,28 +1770,26 @@ async fn user_turn_collaboration_mode_overrides_model_and_effort() -> anyhow::Re
     };
 
     codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "hello".into(),
                 text_elements: Vec::new(),
             }],
-            cwd: config.cwd.to_path_buf(),
-            approval_policy: config.permissions.approval_policy.value(),
-            approvals_reviewer: None,
-            sandbox_policy: config.legacy_sandbox_policy(),
-            permission_profile: None,
-            model: session_configured.model.clone(),
-            effort: Some(ReasoningEffort::Low),
-            summary: Some(
-                config
-                    .model_reasoning_summary
-                    .unwrap_or(ReasoningSummary::Auto),
-            ),
-            service_tier: None,
-            collaboration_mode: Some(collaboration_mode),
+            environments: None,
             final_output_json_schema: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(config.cwd.to_path_buf()),
+                approval_policy: Some(config.permissions.approval_policy.value()),
+                sandbox_policy: Some(config.legacy_sandbox_policy()),
+                summary: Some(
+                    config
+                        .model_reasoning_summary
+                        .unwrap_or(ReasoningSummary::Auto),
+                ),
+                collaboration_mode: Some(collaboration_mode),
+                ..Default::default()
+            },
         })
         .await?;
 
@@ -1839,6 +1834,7 @@ async fn configured_reasoning_summary_is_sent() -> anyhow::Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -1895,24 +1891,29 @@ async fn user_turn_explicit_reasoning_summary_overrides_model_catalog_default()
         .await?;
 
     codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "hello".into(),
                 text_elements: Vec::new(),
             }],
-            cwd: config.cwd.to_path_buf(),
-            approval_policy: config.permissions.approval_policy.value(),
-            approvals_reviewer: None,
-            sandbox_policy: config.legacy_sandbox_policy(),
-            permission_profile: None,
-            model: session_configured.model,
-            effort: None,
-            summary: Some(ReasoningSummary::Concise),
-            service_tier: None,
-            collaboration_mode: None,
+            environments: None,
             final_output_json_schema: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(config.cwd.to_path_buf()),
+                approval_policy: Some(config.permissions.approval_policy.value()),
+                sandbox_policy: Some(config.legacy_sandbox_policy()),
+                summary: Some(ReasoningSummary::Concise),
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: session_configured.model,
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await
         .unwrap();
@@ -1958,6 +1959,7 @@ async fn reasoning_summary_is_omitted_when_disabled() -> anyhow::Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -2016,6 +2018,7 @@ async fn reasoning_summary_none_overrides_model_catalog_default() -> anyhow::Res
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -2054,6 +2057,7 @@ async fn includes_default_verbosity_in_request() -> anyhow::Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -2101,6 +2105,7 @@ async fn configured_verbosity_not_sent_for_models_without_support() -> anyhow::R
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -2147,6 +2152,7 @@ async fn configured_verbosity_is_sent() -> anyhow::Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -2198,6 +2204,7 @@ async fn includes_developer_instructions_message_in_request() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -2493,6 +2500,7 @@ async fn token_count_includes_rate_limits_snapshot() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -2631,6 +2639,7 @@ async fn usage_limit_error_emits_rate_limit_event() -> anyhow::Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .expect("submission should succeed while emitting usage limit error events");
@@ -2707,6 +2716,7 @@ async fn context_window_error_sets_total_tokens_to_model_window() -> anyhow::Res
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
 
@@ -2721,6 +2731,7 @@ async fn context_window_error_sets_total_tokens_to_model_window() -> anyhow::Res
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
 
@@ -2805,6 +2816,7 @@ async fn incomplete_response_emits_content_filter_error_message() -> anyhow::Res
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
 
@@ -2915,6 +2927,7 @@ async fn azure_overrides_assign_properties_used_for_responses_url() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -3003,6 +3016,7 @@ async fn env_var_overrides_loaded_auth() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -3030,22 +3044,15 @@ async fn history_dedupes_streamed_and_final_messages_across_turns() {
     let server = MockServer::start().await;
 
     // Build a small SSE stream with deltas and a final assistant message.
-    // We emit the same body for all 3 turns; ids vary but are unused by assertions.
-    let sse_raw = r##"[
-        {"type":"response.output_item.added", "item":{
-            "type":"message", "role":"assistant",
-            "content":[{"type":"output_text","text":""}]
-        }},
-        {"type":"response.output_text.delta", "delta":"Hey "},
-        {"type":"response.output_text.delta", "delta":"there"},
-        {"type":"response.output_text.delta", "delta":"!\n"},
-        {"type":"response.output_item.done", "item":{
-            "type":"message", "role":"assistant",
-            "content":[{"type":"output_text","text":"Hey there!\n"}]
-        }},
-        {"type":"response.completed", "response": {"id": "__ID__"}}
-    ]"##;
-    let sse1 = core_test_support::load_sse_fixture_with_id_from_str(sse_raw, "resp1");
+    // We emit the same body for all 3 turns.
+    let sse1 = sse(vec![
+        ev_message_item_added("msg-1", ""),
+        ev_output_text_delta("Hey "),
+        ev_output_text_delta("there"),
+        ev_output_text_delta("!\n"),
+        ev_assistant_message("msg-1", "Hey there!\n"),
+        ev_completed("resp1"),
+    ]);
 
     let request_log = mount_sse_sequence(&server, vec![sse1.clone(), sse1.clone(), sse1]).await;
 
@@ -3066,6 +3073,7 @@ async fn history_dedupes_streamed_and_final_messages_across_turns() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -3081,6 +3089,7 @@ async fn history_dedupes_streamed_and_final_messages_across_turns() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -3096,6 +3105,7 @@ async fn history_dedupes_streamed_and_final_messages_across_turns() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
diff --git a/codex-rs/core/tests/suite/client_websockets.rs b/codex-rs/core/tests/suite/client_websockets.rs
index 489adb9a95..feee9d4227 100755
--- a/codex-rs/core/tests/suite/client_websockets.rs
+++ b/codex-rs/core/tests/suite/client_websockets.rs
@@ -132,11 +132,11 @@ async fn responses_websocket_streams_request() {
         Some(harness.thread_id.to_string())
     );
     assert_eq!(
-        handshake.header("session_id"),
+        handshake.header("session-id"),
         Some(harness.session_id.to_string())
     );
     assert_eq!(
-        handshake.header("thread_id"),
+        handshake.header("thread-id"),
         Some(harness.thread_id.to_string())
     );
     assert_eq!(
@@ -253,7 +253,7 @@ async fn responses_websocket_sends_response_processed_after_remote_compaction_v2
             json!({
                 "type": "response.output_item.done",
                 "item": {
-                    "type": "context_compaction",
+                    "type": "compaction",
                     "encrypted_content": "ENCRYPTED_CONTEXT_COMPACTION_SUMMARY",
                 }
             }),
@@ -1208,6 +1208,7 @@ async fn responses_websocket_usage_limit_error_emits_rate_limit_event() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .expect("submission should succeed while emitting usage limit error events");
@@ -1296,6 +1297,7 @@ async fn responses_websocket_invalid_request_error_with_status_is_forwarded() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .expect("submission should succeed while emitting invalid request events");
diff --git a/codex-rs/core/tests/suite/code_mode.rs b/codex-rs/core/tests/suite/code_mode.rs
index 3bcb37e7b2..19373b52e4 100644
--- a/codex-rs/core/tests/suite/code_mode.rs
+++ b/codex-rs/core/tests/suite/code_mode.rs
@@ -144,13 +144,11 @@ async fn run_code_mode_turn(
     server: &MockServer,
     prompt: &str,
     code: &str,
-    include_apply_patch: bool,
 ) -> Result<(TestCodex, ResponseMock)> {
     let mut builder = test_codex()
         .with_model("test-gpt-5.1-codex")
         .with_config(move |config| {
             let _ = config.features.enable(Feature::CodeMode);
-            config.include_apply_patch_tool = include_apply_patch;
         });
     let test = builder.build(server).await?;
 
@@ -244,6 +242,7 @@ async fn run_code_mode_turn_with_rmcp_config(
                 enabled_tools: None,
                 disabled_tools: None,
                 scopes: None,
+                oauth: None,
                 oauth_resource: None,
                 tools: HashMap::new(),
             },
@@ -290,7 +289,6 @@ async fn code_mode_can_return_exec_command_output() -> Result<()> {
         r#"
 text(JSON.stringify(await tools.exec_command({ cmd: "printf code_mode_exec_marker" })));
 "#,
-        /*include_apply_patch*/ false,
     )
     .await?;
 
@@ -402,10 +400,6 @@ if (!tool) {
                 .features
                 .enable(Feature::Apps)
                 .expect("test config should allow feature update");
-            config
-                .features
-                .enable(Feature::ToolSearch)
-                .expect("test config should allow feature update");
             config
                 .features
                 .enable(Feature::CodeMode)
@@ -540,7 +534,6 @@ const result = await tools.update_plan({
 });
 text(JSON.stringify(result));
 "#,
-        /*include_apply_patch*/ false,
     )
     .await?;
 
@@ -665,7 +658,6 @@ text(JSON.stringify(await tools.exec_command({
   max_output_tokens: 100
 })));
 "#,
-        /*include_apply_patch*/ false,
     )
     .await?;
 
@@ -704,7 +696,6 @@ text("before crash");
 text("still before crash");
 throw new Error("boom");
 "#,
-        /*include_apply_patch*/ false,
     )
     .await?;
 
@@ -751,7 +742,6 @@ try {
   text(`caught:${error?.message ?? String(error)}`);
 }
 "#,
-        /*include_apply_patch*/ false,
     )
     .await?;
 
@@ -1768,7 +1758,6 @@ async fn code_mode_can_output_serialized_text_via_global_helper() -> Result<()>
         r#"
 text({ json: true });
 "#,
-        /*include_apply_patch*/ false,
     )
     .await?;
 
@@ -1800,7 +1789,6 @@ async fn code_mode_can_resume_after_set_timeout() -> Result<()> {
 await new Promise((resolve) => setTimeout(resolve, 10));
 text("timer done");
 "#,
-        /*include_apply_patch*/ false,
     )
     .await?;
 
@@ -1829,7 +1817,6 @@ notify("code_mode_notify_marker");
 await tools.test_sync_tool({});
 text("done");
 "#,
-        /*include_apply_patch*/ false,
     )
     .await?;
 
@@ -1867,7 +1854,6 @@ text("before");
 exit();
 text("after");
 "#,
-        /*include_apply_patch*/ false,
     )
     .await?;
 
@@ -1906,7 +1892,6 @@ const circular = {};
 circular.self = circular;
 text(circular);
 "#,
-        /*include_apply_patch*/ false,
     )
     .await?;
 
@@ -1946,7 +1931,6 @@ async fn code_mode_can_output_images_via_global_helper() -> Result<()> {
 image("https://example.com/image.jpg");
 image("data:image/png;base64,AAA");
 "#,
-        /*include_apply_patch*/ false,
     )
     .await?;
 
@@ -2136,13 +2120,8 @@ async fn code_mode_can_apply_patch_via_nested_tool() -> Result<()> {
     );
     let code = format!("text(await tools.apply_patch({patch:?}));\n");
 
-    let (test, second_mock) = run_code_mode_turn(
-        &server,
-        "use exec to run apply_patch",
-        &code,
-        /*include_apply_patch*/ true,
-    )
-    .await?;
+    let (test, second_mock) =
+        run_code_mode_turn(&server, "use exec to run apply_patch", &code).await?;
 
     let req = second_mock.single_request();
     let items = custom_tool_output_items(&req, "call-1");
@@ -2464,13 +2443,8 @@ const tool = ALL_TOOLS.find(({ name }) => name === "view_image");
 text(JSON.stringify(tool));
 "#;
 
-    let (_test, second_mock) = run_code_mode_turn(
-        &server,
-        "use exec to inspect ALL_TOOLS",
-        code,
-        /*include_apply_patch*/ false,
-    )
-    .await?;
+    let (_test, second_mock) =
+        run_code_mode_turn(&server, "use exec to inspect ALL_TOOLS", code).await?;
 
     let req = second_mock.single_request();
     let (output, success) = custom_tool_output_body_and_success(&req, "call-1");
@@ -2488,7 +2462,7 @@ text(JSON.stringify(tool));
         parsed,
         serde_json::json!({
             "name": "view_image",
-            "description": "View a local image from the filesystem (only use if given a full filepath by the user, and the image isn't already attached to the thread context within <image ...> tags).\n\nexec tool declaration:\n```ts\ndeclare const tools: { view_image(args: {\n  // Local filesystem path to an image file\n  path: string;\n}): Promise<{\n  // Image detail hint returned by view_image. Returns `original` when original resolution is preserved, otherwise `null`.\n  detail: string | null;\n  // Data URL for the loaded image.\n  image_url: string;\n}>; };\n```",
+            "description": "View a local image from the filesystem (only use if given a full filepath by the user, and the image isn't already attached to the thread context within <image ...> tags).\n\nexec tool declaration:\n```ts\ndeclare const tools: { view_image(args: {\n  // Local filesystem path to an image file\n  path: string;\n}): Promise<{\n  // Image detail hint returned by view_image. Returns `high` for default resized behavior or `original` when original resolution is preserved.\n  detail: \"high\" | \"original\";\n  // Data URL for the loaded image.\n  image_url: string;\n}>; };\n```",
         })
     );
 
@@ -2610,24 +2584,29 @@ text(
         turn_permission_fields(PermissionProfile::Disabled, cwd.as_path());
 
     test.codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "use exec to inspect and call hidden tools".into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd,
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy,
-            permission_profile,
-            model: test.session_configured.model.clone(),
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(cwd),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: test.session_configured.model.clone(),
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
 
@@ -2889,7 +2868,6 @@ text(JSON.stringify({
   waited_long_enough: end_ms - start_ms >= 100,
 }));
 "#,
-        /*include_apply_patch*/ false,
     )
     .await?;
 
diff --git a/codex-rs/core/tests/suite/codex_delegate.rs b/codex-rs/core/tests/suite/codex_delegate.rs
index cc31aa5c77..f5db9856df 100644
--- a/codex-rs/core/tests/suite/codex_delegate.rs
+++ b/codex-rs/core/tests/suite/codex_delegate.rs
@@ -153,7 +153,6 @@ async fn codex_delegate_forwards_patch_approval_and_proceeds_on_decision() {
             .permissions
             .set_permission_profile(PermissionProfile::read_only())
             .expect("set permission profile");
-        config.include_apply_patch_tool = true;
     });
     let test = builder.build(&server).await.expect("build test codex");
 
diff --git a/codex-rs/core/tests/suite/collaboration_instructions.rs b/codex-rs/core/tests/suite/collaboration_instructions.rs
index 5ce115cdaf..0f9bee9431 100644
--- a/codex-rs/core/tests/suite/collaboration_instructions.rs
+++ b/codex-rs/core/tests/suite/collaboration_instructions.rs
@@ -49,13 +49,6 @@ fn developer_texts(input: &[Value]) -> Vec<String> {
         .collect()
 }
 
-fn developer_message_count(input: &[Value]) -> usize {
-    input
-        .iter()
-        .filter(|item| item.get("role").and_then(Value::as_str) == Some("developer"))
-        .count()
-}
-
 fn collab_xml(text: &str) -> String {
     format!("{COLLABORATION_MODE_OPEN_TAG}{text}{COLLABORATION_MODE_CLOSE_TAG}")
 }
@@ -86,12 +79,12 @@ async fn no_collaboration_instructions_by_default() -> Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
 
     let input = req.single_request().input();
-    assert_eq!(developer_message_count(&input), 1);
     let dev_texts = developer_texts(&input);
     assert!(
         dev_texts
@@ -122,22 +115,14 @@ async fn user_input_includes_collaboration_instructions_after_override() -> Resu
 
     let collab_text = "collab instructions";
     let collaboration_mode = collab_mode_with_instructions(Some(collab_text));
-    test.codex
-        .submit(Op::OverrideTurnContext {
-            cwd: None,
-            approval_policy: None,
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
-            model: None,
-            effort: None,
-            summary: None,
-            service_tier: None,
+    core_test_support::submit_thread_settings(
+        &test.codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             collaboration_mode: Some(collaboration_mode),
-            personality: None,
-        })
-        .await?;
+            ..Default::default()
+        },
+    )
+    .await?;
 
     test.codex
         .submit(Op::UserInput {
@@ -148,6 +133,7 @@ async fn user_input_includes_collaboration_instructions_after_override() -> Resu
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -176,28 +162,26 @@ async fn collaboration_instructions_added_on_user_turn() -> Result<()> {
     let collaboration_mode = collab_mode_with_instructions(Some(collab_text));
 
     test.codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "hello".into(),
                 text_elements: Vec::new(),
             }],
-            cwd: test.config.cwd.to_path_buf(),
-            approval_policy: test.config.permissions.approval_policy.value(),
-            approvals_reviewer: None,
-            sandbox_policy: test.config.legacy_sandbox_policy(),
-            permission_profile: None,
-            model: test.session_configured.model.clone(),
-            effort: None,
-            summary: Some(
-                test.config
-                    .model_reasoning_summary
-                    .unwrap_or(codex_protocol::config_types::ReasoningSummary::Auto),
-            ),
-            service_tier: None,
-            collaboration_mode: Some(collaboration_mode),
+            environments: None,
             final_output_json_schema: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(test.config.cwd.to_path_buf()),
+                approval_policy: Some(test.config.permissions.approval_policy.value()),
+                sandbox_policy: Some(test.config.legacy_sandbox_policy()),
+                summary: Some(
+                    test.config
+                        .model_reasoning_summary
+                        .unwrap_or(codex_protocol::config_types::ReasoningSummary::Auto),
+                ),
+                collaboration_mode: Some(collaboration_mode),
+                ..Default::default()
+            },
         })
         .await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -228,28 +212,26 @@ async fn collaboration_instructions_omitted_when_disabled() -> Result<()> {
     let collaboration_mode = collab_mode_with_instructions(Some("turn instructions"));
 
     test.codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "hello".into(),
                 text_elements: Vec::new(),
             }],
-            cwd: test.config.cwd.to_path_buf(),
-            approval_policy: test.config.permissions.approval_policy.value(),
-            approvals_reviewer: None,
-            sandbox_policy: test.config.legacy_sandbox_policy(),
-            permission_profile: None,
-            model: test.session_configured.model.clone(),
-            effort: None,
-            summary: Some(
-                test.config
-                    .model_reasoning_summary
-                    .unwrap_or(codex_protocol::config_types::ReasoningSummary::Auto),
-            ),
-            service_tier: None,
-            collaboration_mode: Some(collaboration_mode),
+            environments: None,
             final_output_json_schema: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(test.config.cwd.to_path_buf()),
+                approval_policy: Some(test.config.permissions.approval_policy.value()),
+                sandbox_policy: Some(test.config.legacy_sandbox_policy()),
+                summary: Some(
+                    test.config
+                        .model_reasoning_summary
+                        .unwrap_or(codex_protocol::config_types::ReasoningSummary::Auto),
+                ),
+                collaboration_mode: Some(collaboration_mode),
+                ..Default::default()
+            },
         })
         .await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -279,22 +261,14 @@ async fn override_then_next_turn_uses_updated_collaboration_instructions() -> Re
     let collab_text = "override instructions";
     let collaboration_mode = collab_mode_with_instructions(Some(collab_text));
 
-    test.codex
-        .submit(Op::OverrideTurnContext {
-            cwd: None,
-            approval_policy: None,
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
-            model: None,
-            effort: None,
-            summary: None,
-            service_tier: None,
+    core_test_support::submit_thread_settings(
+        &test.codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             collaboration_mode: Some(collaboration_mode),
-            personality: None,
-        })
-        .await?;
+            ..Default::default()
+        },
+    )
+    .await?;
 
     test.codex
         .submit(Op::UserInput {
@@ -305,6 +279,7 @@ async fn override_then_next_turn_uses_updated_collaboration_instructions() -> Re
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -334,46 +309,36 @@ async fn user_turn_overrides_collaboration_instructions_after_override() -> Resu
     let turn_text = "turn override";
     let turn_mode = collab_mode_with_instructions(Some(turn_text));
 
-    test.codex
-        .submit(Op::OverrideTurnContext {
-            cwd: None,
-            approval_policy: None,
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
-            model: None,
-            effort: None,
-            summary: None,
-            service_tier: None,
+    core_test_support::submit_thread_settings(
+        &test.codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             collaboration_mode: Some(base_mode),
-            personality: None,
-        })
-        .await?;
+            ..Default::default()
+        },
+    )
+    .await?;
 
     test.codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "hello".into(),
                 text_elements: Vec::new(),
             }],
-            cwd: test.config.cwd.to_path_buf(),
-            approval_policy: test.config.permissions.approval_policy.value(),
-            approvals_reviewer: None,
-            sandbox_policy: test.config.legacy_sandbox_policy(),
-            permission_profile: None,
-            model: test.session_configured.model.clone(),
-            effort: None,
-            summary: Some(
-                test.config
-                    .model_reasoning_summary
-                    .unwrap_or(codex_protocol::config_types::ReasoningSummary::Auto),
-            ),
-            service_tier: None,
-            collaboration_mode: Some(turn_mode),
+            environments: None,
             final_output_json_schema: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(test.config.cwd.to_path_buf()),
+                approval_policy: Some(test.config.permissions.approval_policy.value()),
+                sandbox_policy: Some(test.config.legacy_sandbox_policy()),
+                summary: Some(
+                    test.config
+                        .model_reasoning_summary
+                        .unwrap_or(codex_protocol::config_types::ReasoningSummary::Auto),
+                ),
+                collaboration_mode: Some(turn_mode),
+                ..Default::default()
+            },
         })
         .await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -408,22 +373,14 @@ async fn collaboration_mode_update_emits_new_instruction_message() -> Result<()>
     let first_text = "first instructions";
     let second_text = "second instructions";
 
-    test.codex
-        .submit(Op::OverrideTurnContext {
-            cwd: None,
-            approval_policy: None,
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
-            model: None,
-            effort: None,
-            summary: None,
-            service_tier: None,
+    core_test_support::submit_thread_settings(
+        &test.codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             collaboration_mode: Some(collab_mode_with_instructions(Some(first_text))),
-            personality: None,
-        })
-        .await?;
+            ..Default::default()
+        },
+    )
+    .await?;
 
     test.codex
         .submit(Op::UserInput {
@@ -434,26 +391,19 @@ async fn collaboration_mode_update_emits_new_instruction_message() -> Result<()>
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
 
-    test.codex
-        .submit(Op::OverrideTurnContext {
-            cwd: None,
-            approval_policy: None,
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
-            model: None,
-            effort: None,
-            summary: None,
-            service_tier: None,
+    core_test_support::submit_thread_settings(
+        &test.codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             collaboration_mode: Some(collab_mode_with_instructions(Some(second_text))),
-            personality: None,
-        })
-        .await?;
+            ..Default::default()
+        },
+    )
+    .await?;
 
     test.codex
         .submit(Op::UserInput {
@@ -464,6 +414,7 @@ async fn collaboration_mode_update_emits_new_instruction_message() -> Result<()>
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -497,22 +448,14 @@ async fn collaboration_mode_update_noop_does_not_append() -> Result<()> {
     let test = test_codex().build(&server).await?;
     let collab_text = "same instructions";
 
-    test.codex
-        .submit(Op::OverrideTurnContext {
-            cwd: None,
-            approval_policy: None,
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
-            model: None,
-            effort: None,
-            summary: None,
-            service_tier: None,
+    core_test_support::submit_thread_settings(
+        &test.codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             collaboration_mode: Some(collab_mode_with_instructions(Some(collab_text))),
-            personality: None,
-        })
-        .await?;
+            ..Default::default()
+        },
+    )
+    .await?;
 
     test.codex
         .submit(Op::UserInput {
@@ -523,26 +466,19 @@ async fn collaboration_mode_update_noop_does_not_append() -> Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
 
-    test.codex
-        .submit(Op::OverrideTurnContext {
-            cwd: None,
-            approval_policy: None,
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
-            model: None,
-            effort: None,
-            summary: None,
-            service_tier: None,
+    core_test_support::submit_thread_settings(
+        &test.codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             collaboration_mode: Some(collab_mode_with_instructions(Some(collab_text))),
-            personality: None,
-        })
-        .await?;
+            ..Default::default()
+        },
+    )
+    .await?;
 
     test.codex
         .submit(Op::UserInput {
@@ -553,6 +489,7 @@ async fn collaboration_mode_update_noop_does_not_append() -> Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -585,25 +522,17 @@ async fn collaboration_mode_update_emits_new_instruction_message_when_mode_chang
     let default_text = "default mode instructions";
     let plan_text = "plan mode instructions";
 
-    test.codex
-        .submit(Op::OverrideTurnContext {
-            cwd: None,
-            approval_policy: None,
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
-            model: None,
-            effort: None,
-            summary: None,
-            service_tier: None,
+    core_test_support::submit_thread_settings(
+        &test.codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             collaboration_mode: Some(collab_mode_with_mode_and_instructions(
                 ModeKind::Default,
                 Some(default_text),
             )),
-            personality: None,
-        })
-        .await?;
+            ..Default::default()
+        },
+    )
+    .await?;
 
     test.codex
         .submit(Op::UserInput {
@@ -614,29 +543,22 @@ async fn collaboration_mode_update_emits_new_instruction_message_when_mode_chang
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
 
-    test.codex
-        .submit(Op::OverrideTurnContext {
-            cwd: None,
-            approval_policy: None,
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
-            model: None,
-            effort: None,
-            summary: None,
-            service_tier: None,
+    core_test_support::submit_thread_settings(
+        &test.codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             collaboration_mode: Some(collab_mode_with_mode_and_instructions(
                 ModeKind::Plan,
                 Some(plan_text),
             )),
-            personality: None,
-        })
-        .await?;
+            ..Default::default()
+        },
+    )
+    .await?;
 
     test.codex
         .submit(Op::UserInput {
@@ -647,6 +569,7 @@ async fn collaboration_mode_update_emits_new_instruction_message_when_mode_chang
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -680,25 +603,17 @@ async fn collaboration_mode_update_noop_does_not_append_when_mode_is_unchanged()
     let test = test_codex().build(&server).await?;
     let collab_text = "mode-stable instructions";
 
-    test.codex
-        .submit(Op::OverrideTurnContext {
-            cwd: None,
-            approval_policy: None,
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
-            model: None,
-            effort: None,
-            summary: None,
-            service_tier: None,
+    core_test_support::submit_thread_settings(
+        &test.codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             collaboration_mode: Some(collab_mode_with_mode_and_instructions(
                 ModeKind::Default,
                 Some(collab_text),
             )),
-            personality: None,
-        })
-        .await?;
+            ..Default::default()
+        },
+    )
+    .await?;
 
     test.codex
         .submit(Op::UserInput {
@@ -709,29 +624,22 @@ async fn collaboration_mode_update_noop_does_not_append_when_mode_is_unchanged()
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
 
-    test.codex
-        .submit(Op::OverrideTurnContext {
-            cwd: None,
-            approval_policy: None,
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
-            model: None,
-            effort: None,
-            summary: None,
-            service_tier: None,
+    core_test_support::submit_thread_settings(
+        &test.codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             collaboration_mode: Some(collab_mode_with_mode_and_instructions(
                 ModeKind::Default,
                 Some(collab_text),
             )),
-            personality: None,
-        })
-        .await?;
+            ..Default::default()
+        },
+    )
+    .await?;
 
     test.codex
         .submit(Op::UserInput {
@@ -742,6 +650,7 @@ async fn collaboration_mode_update_noop_does_not_append_when_mode_is_unchanged()
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -780,23 +689,14 @@ async fn resume_replays_collaboration_instructions() -> Result<()> {
     let home = initial.home.clone();
 
     let collab_text = "resume instructions";
-    initial
-        .codex
-        .submit(Op::OverrideTurnContext {
-            cwd: None,
-            approval_policy: None,
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
-            model: None,
-            effort: None,
-            summary: None,
-            service_tier: None,
+    core_test_support::submit_thread_settings(
+        &initial.codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             collaboration_mode: Some(collab_mode_with_instructions(Some(collab_text))),
-            personality: None,
-        })
-        .await?;
+            ..Default::default()
+        },
+    )
+    .await?;
 
     initial
         .codex
@@ -808,6 +708,7 @@ async fn resume_replays_collaboration_instructions() -> Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&initial.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -823,6 +724,7 @@ async fn resume_replays_collaboration_instructions() -> Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&resumed.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -849,18 +751,9 @@ async fn empty_collaboration_instructions_are_ignored() -> Result<()> {
     let test = test_codex().build(&server).await?;
     let current_model = test.session_configured.model.clone();
 
-    test.codex
-        .submit(Op::OverrideTurnContext {
-            cwd: None,
-            approval_policy: None,
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
-            model: None,
-            effort: None,
-            summary: None,
-            service_tier: None,
+    core_test_support::submit_thread_settings(
+        &test.codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             collaboration_mode: Some(CollaborationMode {
                 mode: ModeKind::Default,
                 settings: Settings {
@@ -869,9 +762,10 @@ async fn empty_collaboration_instructions_are_ignored() -> Result<()> {
                     developer_instructions: Some("".to_string()),
                 },
             }),
-            personality: None,
-        })
-        .await?;
+            ..Default::default()
+        },
+    )
+    .await?;
 
     test.codex
         .submit(Op::UserInput {
@@ -882,12 +776,12 @@ async fn empty_collaboration_instructions_are_ignored() -> Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
 
     let input = req.single_request().input();
-    assert_eq!(developer_message_count(&input), 1);
     let dev_texts = developer_texts(&input);
     let collab_text = collab_xml("");
     assert_eq!(count_messages_containing(&dev_texts, &collab_text), 0);
diff --git a/codex-rs/core/tests/suite/compact.rs b/codex-rs/core/tests/suite/compact.rs
index b1620ee36b..140b4ec2b1 100644
--- a/codex-rs/core/tests/suite/compact.rs
+++ b/codex-rs/core/tests/suite/compact.rs
@@ -7,6 +7,7 @@ use codex_login::CodexAuth;
 use codex_model_provider_info::ModelProviderInfo;
 use codex_model_provider_info::built_in_model_providers;
 use codex_models_manager::bundled_models_response;
+use codex_protocol::config_types::AutoCompactTokenLimitScope;
 use codex_protocol::items::TurnItem;
 use codex_protocol::models::PermissionProfile;
 use codex_protocol::openai_models::ModelInfo;
@@ -26,7 +27,6 @@ use core_test_support::context_snapshot;
 use core_test_support::context_snapshot::ContextSnapshotOptions;
 use core_test_support::context_snapshot::ContextSnapshotRenderMode;
 use core_test_support::hooks::trust_discovered_hooks;
-use core_test_support::responses::ev_local_shell_call;
 use core_test_support::responses::ev_reasoning_item;
 use core_test_support::responses::mount_models_once;
 use core_test_support::skip_if_no_network;
@@ -78,27 +78,40 @@ const PRETURN_CONTEXT_DIFF_CWD: &str = "/tmp/PRETURN_CONTEXT_DIFF_CWD";
 
 pub(super) const COMPACT_WARNING_MESSAGE: &str = "Heads up: Long threads and multiple compactions can cause the model to be less accurate. Start a new thread when possible to keep threads small and targeted.";
 
+fn ev_shell_command_call(call_id: &str, command: &str) -> serde_json::Value {
+    ev_function_call(
+        call_id,
+        "shell_command",
+        &json!({ "command": command }).to_string(),
+    )
+}
+
 fn disabled_permission_user_turn(text: impl Into<String>, cwd: PathBuf, model: String) -> Op {
     let (sandbox_policy, permission_profile) =
         turn_permission_fields(PermissionProfile::Disabled, cwd.as_path());
-    Op::UserTurn {
-        environments: None,
+    Op::UserInput {
         items: vec![UserInput::Text {
             text: text.into(),
             text_elements: Vec::new(),
         }],
+        environments: None,
         final_output_json_schema: None,
-        cwd,
-        approval_policy: AskForApproval::Never,
-        approvals_reviewer: None,
-        sandbox_policy,
-        permission_profile,
-        model,
-        effort: None,
-        summary: None,
-        service_tier: None,
-        collaboration_mode: None,
-        personality: None,
+        responsesapi_client_metadata: None,
+        thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+            cwd: Some(cwd),
+            approval_policy: Some(AskForApproval::Never),
+            sandbox_policy: Some(sandbox_policy),
+            permission_profile,
+            collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                mode: codex_protocol::config_types::ModeKind::Default,
+                settings: codex_protocol::config_types::Settings {
+                    model,
+                    reasoning_effort: None,
+                    developer_instructions: None,
+                },
+            }),
+            ..Default::default()
+        },
     }
 }
 
@@ -114,6 +127,22 @@ fn set_test_compact_prompt(config: &mut Config) {
     config.compact_prompt = Some(SUMMARIZATION_PROMPT.to_string());
 }
 
+fn ev_completed_with_usage(id: &str, input_tokens: i64, output_tokens: i64) -> Value {
+    json!({
+        "type": "response.completed",
+        "response": {
+            "id": id,
+            "usage": {
+                "input_tokens": input_tokens,
+                "input_tokens_details": null,
+                "output_tokens": output_tokens,
+                "output_tokens_details": null,
+                "total_tokens": input_tokens + output_tokens
+            }
+        }
+    })
+}
+
 fn body_contains_text(body: &str, text: &str) -> bool {
     body.contains(&json_fragment(text))
 }
@@ -379,6 +408,7 @@ async fn summarize_context_three_requests_and_instructions() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -403,6 +433,7 @@ async fn summarize_context_three_requests_and_instructions() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -579,6 +610,7 @@ async fn manual_pre_compact_block_decision_does_not_block_compaction() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .expect("submit first user turn");
@@ -651,6 +683,7 @@ async fn compact_hooks_respect_matchers_and_post_runs_after_compaction() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .expect("submit first user turn");
@@ -720,6 +753,7 @@ async fn manual_compact_uses_custom_prompt() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .expect("submit first user turn");
@@ -866,6 +900,7 @@ async fn manual_compact_emits_context_compaction_items() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -954,7 +989,7 @@ async fn multiple_auto_compact_per_task_runs_after_token_limit_hit() {
     // first chunk of work
     let model_reasoning_response_1_sse = sse(vec![
         reasoning_response_1.clone(),
-        ev_local_shell_call("r1-shell", "completed", vec!["echo", "make-react"]),
+        ev_shell_command_call("r1-shell", "echo make-react"),
         ev_completed_with_tokens("r1", token_count_used),
     ]);
 
@@ -972,7 +1007,7 @@ async fn multiple_auto_compact_per_task_runs_after_token_limit_hit() {
     // second chunk of work
     let model_reasoning_response_2_sse = sse(vec![
         reasoning_response_2.clone(),
-        ev_local_shell_call("r3-shell", "completed", vec!["echo", "make-node"]),
+        ev_shell_command_call("r3-shell", "echo make-node"),
         ev_completed_with_tokens("r3", token_count_used),
     ]);
 
@@ -990,7 +1025,7 @@ async fn multiple_auto_compact_per_task_runs_after_token_limit_hit() {
     // third chunk of work
     let model_reasoning_response_3_sse = sse(vec![
         ev_reasoning_item("m6", &["I will create a python app"], &[]),
-        ev_local_shell_call("r6-shell", "completed", vec!["echo", "make-python"]),
+        ev_shell_command_call("r6-shell", "echo make-python"),
         ev_completed_with_tokens("r6", token_count_used),
     ]);
 
@@ -1031,6 +1066,7 @@ async fn multiple_auto_compact_per_task_runs_after_token_limit_hit() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .expect("submit user input");
@@ -1186,20 +1222,10 @@ async fn multiple_auto_compact_per_task_runs_after_token_limit_hit() {
         "type": "reasoning"
       },
       {
-        "action": {
-          "command": [
-            "echo",
-            "make-react"
-          ],
-          "env": null,
-          "timeout_ms": null,
-          "type": "exec",
-          "user": null,
-          "working_directory": null
-        },
+        "arguments": "{\"command\":\"echo make-react\"}",
         "call_id": "r1-shell",
-        "status": "completed",
-        "type": "local_shell_call"
+        "name": "shell_command",
+        "type": "function_call"
       },
       {
         "call_id": "r1-shell",
@@ -1296,20 +1322,10 @@ async fn multiple_auto_compact_per_task_runs_after_token_limit_hit() {
         "type": "reasoning"
       },
       {
-        "action": {
-          "command": [
-            "echo",
-            "make-node"
-          ],
-          "env": null,
-          "timeout_ms": null,
-          "type": "exec",
-          "user": null,
-          "working_directory": null
-        },
+        "arguments": "{\"command\":\"echo make-node\"}",
         "call_id": "r3-shell",
-        "status": "completed",
-        "type": "local_shell_call"
+        "name": "shell_command",
+        "type": "function_call"
       },
       {
         "call_id": "r3-shell",
@@ -1406,20 +1422,10 @@ async fn multiple_auto_compact_per_task_runs_after_token_limit_hit() {
         "type": "reasoning"
       },
       {
-        "action": {
-          "command": [
-            "echo",
-            "make-python"
-          ],
-          "env": null,
-          "timeout_ms": null,
-          "type": "exec",
-          "user": null,
-          "working_directory": null
-        },
+        "arguments": "{\"command\":\"echo make-python\"}",
         "call_id": "r6-shell",
-        "status": "completed",
-        "type": "local_shell_call"
+        "name": "shell_command",
+        "type": "function_call"
       },
       {
         "call_id": "r6-shell",
@@ -1532,6 +1538,7 @@ async fn auto_compact_runs_after_token_limit_hit() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -1547,6 +1554,7 @@ async fn auto_compact_runs_after_token_limit_hit() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -1562,6 +1570,7 @@ async fn auto_compact_runs_after_token_limit_hit() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -1732,6 +1741,7 @@ async fn auto_compact_emits_context_compaction_items() {
                 }],
                 final_output_json_schema: None,
                 responsesapi_client_metadata: None,
+                thread_settings: Default::default(),
             })
             .await
             .unwrap();
@@ -1812,6 +1822,7 @@ async fn auto_compact_starts_after_turn_started() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -1826,6 +1837,7 @@ async fn auto_compact_starts_after_turn_started() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -1840,6 +1852,7 @@ async fn auto_compact_starts_after_turn_started() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -2078,6 +2091,100 @@ async fn pre_sampling_compact_runs_on_switch_to_smaller_context_model() {
     );
 }
 
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn body_after_prefix_model_switch_budget_compacts_with_next_model() {
+    skip_if_no_network!();
+
+    let server = MockServer::start().await;
+    let previous_model = "gpt-5.3-codex";
+    let next_model = "gpt-5.2";
+
+    let models_mock = mount_models_once(
+        &server,
+        ModelsResponse {
+            models: vec![
+                model_info_with_context_window(previous_model, /*context_window*/ 273_000),
+                model_info_with_context_window(next_model, /*context_window*/ 125_000),
+            ],
+        },
+    )
+    .await;
+
+    let request_log = mount_sse_sequence(
+        &server,
+        vec![
+            sse(vec![
+                ev_assistant_message("m1", "before switch"),
+                ev_completed_with_usage("r1", /*input_tokens*/ 100, /*output_tokens*/ 50),
+            ]),
+            sse(vec![
+                ev_assistant_message("m2", "BODY_BUDGET_SUMMARY"),
+                ev_completed_with_tokens("r2", /*total_tokens*/ 10),
+            ]),
+            sse(vec![
+                ev_assistant_message("m3", "after switch"),
+                ev_completed_with_tokens("r3", /*total_tokens*/ 100),
+            ]),
+        ],
+    )
+    .await;
+
+    let model_provider = non_openai_model_provider(&server);
+    let mut builder = test_codex()
+        .with_auth(CodexAuth::create_dummy_chatgpt_auth_for_testing())
+        .with_model(previous_model)
+        .with_config(move |config| {
+            config.model_provider = model_provider;
+            set_test_compact_prompt(config);
+            let _ = config.features.enable(Feature::RemoteModels);
+            config.model_auto_compact_token_limit = Some(20);
+            config.model_auto_compact_token_limit_scope =
+                AutoCompactTokenLimitScope::BodyAfterPrefix;
+        });
+    let test = builder.build(&server).await.expect("build test codex");
+
+    test.codex
+        .submit(disabled_permission_user_turn(
+            "before switch",
+            test.cwd.path().to_path_buf(),
+            previous_model.to_string(),
+        ))
+        .await
+        .expect("submit first user turn");
+    wait_for_event(&test.codex, |event| {
+        matches!(event, EventMsg::TurnComplete(_))
+    })
+    .await;
+
+    test.codex
+        .submit(disabled_permission_user_turn(
+            "after switch",
+            test.cwd.path().to_path_buf(),
+            next_model.to_string(),
+        ))
+        .await
+        .expect("submit second user turn");
+    assert_compaction_uses_turn_lifecycle_id(&test.codex).await;
+
+    let requests = request_log.requests();
+    assert_eq!(models_mock.requests().len(), 1);
+    assert_eq!(
+        requests.len(),
+        3,
+        "expected user, compact, and follow-up requests"
+    );
+    assert_eq!(
+        requests[0].body_json()["model"].as_str(),
+        Some(previous_model)
+    );
+    assert_eq!(requests[1].body_json()["model"].as_str(), Some(next_model));
+    assert_eq!(requests[2].body_json()["model"].as_str(), Some(next_model));
+    assert!(
+        body_contains_text(&requests[1].body_json().to_string(), SUMMARIZATION_PROMPT),
+        "body-budget compaction request should include summarization prompt"
+    );
+}
+
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn pre_sampling_compact_runs_after_resume_and_switch_to_smaller_model() {
     skip_if_no_network!();
@@ -2273,6 +2380,7 @@ async fn auto_compact_persists_rollout_entries() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -2287,6 +2395,7 @@ async fn auto_compact_persists_rollout_entries() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -2301,6 +2410,7 @@ async fn auto_compact_persists_rollout_entries() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -2389,6 +2499,7 @@ async fn manual_compact_retries_after_context_window_error() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -2492,6 +2603,7 @@ async fn manual_compact_non_context_failure_retries_then_emits_task_error() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .expect("submit user input");
@@ -2586,6 +2698,7 @@ async fn manual_compact_twice_preserves_latest_user_messages() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -2603,6 +2716,7 @@ async fn manual_compact_twice_preserves_latest_user_messages() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -2620,6 +2734,7 @@ async fn manual_compact_twice_preserves_latest_user_messages() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -2783,6 +2898,7 @@ async fn auto_compact_allows_multiple_attempts_when_interleaved_with_other_turn_
                 }],
                 final_output_json_schema: None,
                 responsesapi_client_metadata: None,
+                thread_settings: Default::default(),
             })
             .await
             .unwrap();
@@ -2887,6 +3003,7 @@ async fn snapshot_request_shape_mid_turn_continuation_compaction() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -3005,6 +3122,237 @@ async fn auto_compact_clamps_config_limit_to_context_window() {
     );
 }
 
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn auto_compact_body_after_prefix_ignores_starting_window_prefix() {
+    skip_if_no_network!();
+
+    let server = start_mock_server().await;
+
+    let first_turn = sse(vec![
+        ev_assistant_message("m1", FIRST_REPLY),
+        ev_completed_with_usage("r1", /*input_tokens*/ 600, /*output_tokens*/ 50),
+    ]);
+    let second_turn = sse(vec![
+        ev_assistant_message("m2", SECOND_LARGE_REPLY),
+        ev_completed_with_usage("r2", /*input_tokens*/ 700, /*output_tokens*/ 50),
+    ]);
+    let auto_compact_turn = sse(vec![
+        ev_assistant_message("m3", AUTO_SUMMARY_TEXT),
+        ev_completed_with_tokens("r3", /*total_tokens*/ 20),
+    ]);
+    let third_turn = sse(vec![
+        ev_assistant_message("m4", FINAL_REPLY),
+        ev_completed_with_usage("r4", /*input_tokens*/ 750, /*output_tokens*/ 20),
+    ]);
+    let request_log = mount_sse_sequence(
+        &server,
+        vec![first_turn, second_turn, auto_compact_turn, third_turn],
+    )
+    .await;
+
+    let model_provider = non_openai_model_provider(&server);
+    let test = test_codex()
+        .with_config(move |config| {
+            config.model_provider = model_provider;
+            set_test_compact_prompt(config);
+            config.model_context_window = Some(1_000);
+            config.model_auto_compact_token_limit = Some(100);
+            config.model_auto_compact_token_limit_scope =
+                AutoCompactTokenLimitScope::BodyAfterPrefix;
+        })
+        .build(&server)
+        .await
+        .expect("build codex");
+
+    for user in ["PREFIX_FREE_ONE", "PREFIX_FREE_TWO"] {
+        test.submit_turn(user).await.expect("submit turn");
+    }
+
+    assert_eq!(
+        request_log.requests().len(),
+        2,
+        "the first two turns should not compact just because the prefix exceeds the body budget"
+    );
+
+    test.submit_turn("PREFIX_FREE_THREE")
+        .await
+        .expect("submit third turn");
+
+    let requests = request_log.requests();
+    assert_eq!(
+        requests.len(),
+        4,
+        "third turn should include pre-turn compaction plus the post-compaction request"
+    );
+    let compact_body = requests[2].body_json().to_string();
+    assert!(
+        body_contains_text(&compact_body, SUMMARIZATION_PROMPT),
+        "body-after-prefix mode should compact once tokens after the first assistant sample exceed the configured budget"
+    );
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn auto_compact_body_after_prefix_counts_growth_after_compaction() {
+    skip_if_no_network!();
+
+    let server = start_mock_server().await;
+
+    let first_turn = sse(vec![
+        ev_assistant_message("m1", FIRST_REPLY),
+        ev_completed_with_usage("r1", /*input_tokens*/ 100, /*output_tokens*/ 50),
+    ]);
+    let first_auto_compact_turn = sse(vec![
+        ev_assistant_message("m2", AUTO_SUMMARY_TEXT),
+        ev_completed_with_tokens("r2", /*total_tokens*/ 20),
+    ]);
+    let second_turn = sse(vec![
+        ev_assistant_message("m3", SECOND_LARGE_REPLY),
+        ev_completed_with_usage(
+            "r3", /*input_tokens*/ 100_000, /*output_tokens*/ 10,
+        ),
+    ]);
+    let third_turn = sse(vec![
+        ev_assistant_message("m4", FINAL_REPLY),
+        ev_completed_with_usage(
+            "r4", /*input_tokens*/ 100_100, /*output_tokens*/ 5,
+        ),
+    ]);
+    let second_auto_compact_turn = sse(vec![
+        ev_assistant_message("m5", AUTO_SUMMARY_TEXT),
+        ev_completed_with_tokens("r5", /*total_tokens*/ 20),
+    ]);
+    let fourth_turn = sse(vec![
+        ev_assistant_message("m6", FINAL_REPLY),
+        ev_completed_with_usage("r6", /*input_tokens*/ 80, /*output_tokens*/ 5),
+    ]);
+    let request_log = mount_sse_sequence(
+        &server,
+        vec![
+            first_turn,
+            first_auto_compact_turn,
+            second_turn,
+            third_turn,
+            second_auto_compact_turn,
+            fourth_turn,
+        ],
+    )
+    .await;
+
+    let model_provider = non_openai_model_provider(&server);
+    let test = test_codex()
+        .with_config(move |config| {
+            config.model_provider = model_provider;
+            set_test_compact_prompt(config);
+            config.model_context_window = Some(200_000);
+            config.model_auto_compact_token_limit = Some(40);
+            config.model_auto_compact_token_limit_scope =
+                AutoCompactTokenLimitScope::BodyAfterPrefix;
+        })
+        .build(&server)
+        .await
+        .expect("build codex");
+
+    test.submit_turn("WINDOW_PREFIX")
+        .await
+        .expect("submit first turn");
+    test.submit_turn("GROWTH_AFTER_COMPACT")
+        .await
+        .expect("submit second turn");
+
+    let requests = request_log.requests();
+    assert_eq!(
+        requests.len(),
+        3,
+        "second turn should compact first and then sample the new growth"
+    );
+
+    test.submit_turn("AFTER_GROWTH")
+        .await
+        .expect("submit third turn");
+
+    let requests = request_log.requests();
+    assert_eq!(
+        requests.len(),
+        4,
+        "the first server-observed input in the new window should become the prefill baseline"
+    );
+
+    test.submit_turn("AFTER_GROWTH_TRIGGER")
+        .await
+        .expect("submit fourth turn");
+
+    let requests = request_log.requests();
+    assert_eq!(
+        requests.len(),
+        6,
+        "fourth turn should compact because later post-compaction growth counted against the body budget"
+    );
+    let compact_body = requests[4].body_json().to_string();
+    assert!(
+        body_contains_text(&compact_body, SUMMARIZATION_PROMPT),
+        "post-compaction growth should trigger a second body-after-prefix compaction"
+    );
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn auto_compact_body_after_prefix_still_caps_at_context_window() {
+    skip_if_no_network!();
+
+    let server = start_mock_server().await;
+
+    let first_turn = sse(vec![
+        ev_assistant_message("m1", FIRST_REPLY),
+        ev_completed_with_usage("r1", /*input_tokens*/ 80, /*output_tokens*/ 5),
+    ]);
+    let second_turn = sse(vec![
+        ev_assistant_message("m2", SECOND_LARGE_REPLY),
+        ev_completed_with_usage("r2", /*input_tokens*/ 98, /*output_tokens*/ 1),
+    ]);
+    let auto_compact_turn = sse(vec![
+        ev_assistant_message("m3", AUTO_SUMMARY_TEXT),
+        ev_completed_with_tokens("r3", /*total_tokens*/ 20),
+    ]);
+    let third_turn = sse(vec![
+        ev_assistant_message("m4", FINAL_REPLY),
+        ev_completed_with_usage("r4", /*input_tokens*/ 80, /*output_tokens*/ 5),
+    ]);
+    let request_log = mount_sse_sequence(
+        &server,
+        vec![first_turn, second_turn, auto_compact_turn, third_turn],
+    )
+    .await;
+
+    let model_provider = non_openai_model_provider(&server);
+    let test = test_codex()
+        .with_config(move |config| {
+            config.model_provider = model_provider;
+            set_test_compact_prompt(config);
+            config.model_context_window = Some(100);
+            config.model_auto_compact_token_limit = Some(200);
+            config.model_auto_compact_token_limit_scope =
+                AutoCompactTokenLimitScope::BodyAfterPrefix;
+        })
+        .build(&server)
+        .await
+        .expect("build codex");
+
+    for user in ["CONTEXT_CAP_ONE", "CONTEXT_CAP_TWO", "CONTEXT_CAP_THREE"] {
+        test.submit_turn(user).await.expect("submit turn");
+    }
+
+    let requests = request_log.requests();
+    assert_eq!(
+        requests.len(),
+        4,
+        "third turn should compact before sampling because total context hit the usable window"
+    );
+    let compact_body = requests[2].body_json().to_string();
+    assert!(
+        body_contains_text(&compact_body, SUMMARIZATION_PROMPT),
+        "body-after-prefix mode should still clamp the total threshold to the usable context window"
+    );
+}
+
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn auto_compact_counts_encrypted_reasoning_before_last_user() {
     skip_if_no_network!();
@@ -3086,6 +3434,7 @@ async fn auto_compact_counts_encrypted_reasoning_before_last_user() {
                 }],
                 final_output_json_schema: None,
                 responsesapi_client_metadata: None,
+                thread_settings: Default::default(),
             })
             .await
             .unwrap();
@@ -3204,6 +3553,7 @@ async fn auto_compact_runs_when_reasoning_header_clears_between_turns() {
                 }],
                 final_output_json_schema: None,
                 responsesapi_client_metadata: None,
+                thread_settings: Default::default(),
             })
             .await
             .unwrap();
@@ -3265,28 +3615,21 @@ async fn snapshot_request_shape_pre_turn_compaction_including_incoming_user_mess
                 }],
                 final_output_json_schema: None,
                 responsesapi_client_metadata: None,
+                thread_settings: Default::default(),
             })
             .await
             .expect("submit user input");
         wait_for_event(&codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
     }
-    codex
-        .submit(Op::OverrideTurnContext {
+    core_test_support::submit_thread_settings(
+        &codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             cwd: Some(PathBuf::from(PRETURN_CONTEXT_DIFF_CWD)),
-            approval_policy: None,
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
-            model: None,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
-        })
-        .await
-        .expect("override turn context");
+            ..Default::default()
+        },
+    )
+    .await
+    .expect("override thread settings");
     let image_url = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR4nGNgYAAAAAMAASsJTYQAAAAASUVORK5CYII="
         .to_string();
     codex
@@ -3295,6 +3638,7 @@ async fn snapshot_request_shape_pre_turn_compaction_including_incoming_user_mess
             items: vec![
                 UserInput::Image {
                     image_url: image_url.clone(),
+                    detail: None,
                 },
                 UserInput::Text {
                     text: "USER_THREE".to_string(),
@@ -3303,6 +3647,7 @@ async fn snapshot_request_shape_pre_turn_compaction_including_incoming_user_mess
             ],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .expect("submit user input");
@@ -3491,6 +3836,7 @@ async fn snapshot_request_shape_pre_turn_compaction_context_window_exceeded() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .expect("submit first user");
@@ -3505,6 +3851,7 @@ async fn snapshot_request_shape_pre_turn_compaction_context_window_exceeded() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .expect("submit second user");
@@ -3577,6 +3924,7 @@ async fn snapshot_request_shape_manual_compact_without_previous_user_messages()
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .expect("submit follow-up user input");
diff --git a/codex-rs/core/tests/suite/compact_remote.rs b/codex-rs/core/tests/suite/compact_remote.rs
index bec0ea436f..d868abbfee 100644
--- a/codex-rs/core/tests/suite/compact_remote.rs
+++ b/codex-rs/core/tests/suite/compact_remote.rs
@@ -326,6 +326,7 @@ async fn remote_compact_replaces_history_for_followups() -> Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_turn_complete(&codex).await;
@@ -342,6 +343,7 @@ async fn remote_compact_replaces_history_for_followups() -> Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_turn_complete(&codex).await;
@@ -357,11 +359,11 @@ async fn remote_compact_replaces_history_for_followups() -> Result<()> {
         Some("Bearer Access Token")
     );
     assert_eq!(
-        compact_request.header("session_id").as_deref(),
+        compact_request.header("session-id").as_deref(),
         Some(session_id.as_str())
     );
     assert_eq!(
-        compact_request.header("thread_id").as_deref(),
+        compact_request.header("thread-id").as_deref(),
         Some(thread_id.as_str())
     );
     let compact_body = compact_request.body_json();
@@ -479,10 +481,9 @@ async fn assert_remote_manual_compact_request_parity(
                 responses::ev_completed("turn-three-final-response"),
             ]),
             responses::sse(vec![
-                responses::ev_local_shell_call(
-                    "turn-four-local-shell",
-                    "completed",
-                    vec!["/bin/echo", "TURN_FOUR_LOCAL_SHELL"],
+                responses::ev_shell_command_call(
+                    "turn-four-shell-command",
+                    "echo TURN_FOUR_LOCAL_SHELL",
                 ),
                 responses::ev_completed("turn-four-local-shell-response"),
             ]),
@@ -517,6 +518,7 @@ async fn assert_remote_manual_compact_request_parity(
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_turn_complete(&codex).await;
@@ -536,6 +538,7 @@ async fn assert_remote_manual_compact_request_parity(
             ],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_turn_complete(&codex).await;
@@ -549,6 +552,7 @@ async fn assert_remote_manual_compact_request_parity(
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_turn_complete(&codex).await;
@@ -557,7 +561,10 @@ async fn assert_remote_manual_compact_request_parity(
         .submit(Op::UserInput {
             environments: None,
             items: vec![
-                UserInput::Image { image_url },
+                UserInput::Image {
+                    image_url,
+                    detail: None,
+                },
                 UserInput::Text {
                     text: "TURN_FOUR_IMAGE_USER".to_string(),
                     text_elements: Vec::new(),
@@ -565,6 +572,7 @@ async fn assert_remote_manual_compact_request_parity(
             ],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_turn_complete(&codex).await;
@@ -578,6 +586,7 @@ async fn assert_remote_manual_compact_request_parity(
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_turn_complete(&codex).await;
@@ -589,7 +598,7 @@ async fn assert_remote_manual_compact_request_parity(
     assert_eq!(
         response_requests.len(),
         7,
-        "expected five turns with one unsupported tool continuation and one local shell continuation"
+        "expected five turns with one unsupported tool continuation and one shell command continuation"
     );
     assert_eq!(
         compact_mock.requests().len(),
@@ -698,7 +707,7 @@ async fn remote_manual_compact_chatgpt_auth_reuses_service_tier_and_prompt_cache
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn remote_compact_v2_reuses_context_compaction_for_followups() -> Result<()> {
+async fn remote_compact_v2_reuses_compaction_trigger_for_followups() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
     let harness = TestCodexHarness::with_builder(
@@ -722,7 +731,7 @@ async fn remote_compact_v2_reuses_context_compaction_for_followups() -> Result<(
                 serde_json::json!({
                     "type": "response.output_item.done",
                     "item": {
-                        "type": "context_compaction",
+                        "type": "compaction",
                         "encrypted_content": "ENCRYPTED_CONTEXT_COMPACTION_SUMMARY",
                     }
                 }),
@@ -745,6 +754,7 @@ async fn remote_compact_v2_reuses_context_compaction_for_followups() -> Result<(
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_turn_complete(&codex).await;
@@ -761,6 +771,7 @@ async fn remote_compact_v2_reuses_context_compaction_for_followups() -> Result<(
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_turn_complete(&codex).await;
@@ -779,8 +790,8 @@ async fn remote_compact_v2_reuses_context_compaction_for_followups() -> Result<(
     assert_eq!(compact_request.path(), "/v1/responses");
     let compact_body = compact_request.body_json().to_string();
     assert!(
-        compact_body.contains("\"type\":\"context_compaction\""),
-        "expected v2 compaction request to include the context_compaction trigger item"
+        compact_body.contains("\"type\":\"compaction_trigger\""),
+        "expected v2 compaction request to include the compaction_trigger item"
     );
     assert!(
         !compact_body.contains("ENCRYPTED_CONTEXT_COMPACTION_SUMMARY"),
@@ -790,12 +801,12 @@ async fn remote_compact_v2_reuses_context_compaction_for_followups() -> Result<(
     let follow_up_request = response_requests.last().expect("follow-up request missing");
     let follow_up_body = follow_up_request.body_json().to_string();
     assert!(
-        follow_up_body.contains("\"type\":\"context_compaction\""),
-        "expected follow-up request to preserve the v2 context_compaction item"
+        follow_up_body.contains("\"type\":\"compaction\""),
+        "expected follow-up request to preserve the compaction item"
     );
     assert!(
         follow_up_body.contains("ENCRYPTED_CONTEXT_COMPACTION_SUMMARY"),
-        "expected follow-up request to include the context compaction payload"
+        "expected follow-up request to include the compaction payload"
     );
     assert!(
         follow_up_body.contains("hello remote compact"),
@@ -806,8 +817,7 @@ async fn remote_compact_v2_reuses_context_compaction_for_followups() -> Result<(
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn remote_compact_v2_accepts_additional_output_items_before_context_compaction() -> Result<()>
-{
+async fn remote_compact_v2_accepts_additional_output_items_before_compaction() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
     let harness = TestCodexHarness::with_builder(
@@ -832,7 +842,7 @@ async fn remote_compact_v2_accepts_additional_output_items_before_context_compac
                 serde_json::json!({
                     "type": "response.output_item.done",
                     "item": {
-                        "type": "context_compaction",
+                        "type": "compaction",
                         "encrypted_content": "ENCRYPTED_CONTEXT_COMPACTION_SUMMARY",
                     }
                 }),
@@ -855,6 +865,7 @@ async fn remote_compact_v2_accepts_additional_output_items_before_context_compac
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_turn_complete(&codex).await;
@@ -871,6 +882,7 @@ async fn remote_compact_v2_accepts_additional_output_items_before_context_compac
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_turn_complete(&codex).await;
@@ -879,12 +891,12 @@ async fn remote_compact_v2_accepts_additional_output_items_before_context_compac
     let follow_up_request = response_requests.last().expect("follow-up request missing");
     let follow_up_body = follow_up_request.body_json().to_string();
     assert!(
-        follow_up_body.contains("\"type\":\"context_compaction\""),
-        "expected follow-up request to preserve the v2 context_compaction item"
+        follow_up_body.contains("\"type\":\"compaction\""),
+        "expected follow-up request to preserve the compaction item"
     );
     assert!(
         follow_up_body.contains("ENCRYPTED_CONTEXT_COMPACTION_SUMMARY"),
-        "expected follow-up request to include the context compaction payload"
+        "expected follow-up request to include the compaction payload"
     );
     assert!(
         !follow_up_body.contains("IGNORED_COMPACT_REPLY"),
@@ -961,6 +973,7 @@ async fn remote_compact_filters_deferred_dynamic_tools() -> Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_turn_complete(&codex).await;
@@ -1032,6 +1045,7 @@ async fn remote_compact_runs_automatically() -> Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
 
@@ -1046,12 +1060,12 @@ async fn remote_compact_runs_automatically() -> Result<()> {
     assert_eq!(
         compact_mock
             .single_request()
-            .header("session_id")
+            .header("session-id")
             .as_deref(),
         Some(session_id.as_str())
     );
     assert_eq!(
-        compact_mock.single_request().header("thread_id").as_deref(),
+        compact_mock.single_request().header("thread-id").as_deref(),
         Some(thread_id.as_str())
     );
     let follow_up_request = responses_mock.single_request();
@@ -1112,6 +1126,7 @@ async fn remote_compact_trims_function_call_history_to_fit_context_window() -> R
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&codex, |event| matches!(event, EventMsg::TurnComplete(_))).await;
@@ -1125,6 +1140,7 @@ async fn remote_compact_trims_function_call_history_to_fit_context_window() -> R
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&codex, |event| matches!(event, EventMsg::TurnComplete(_))).await;
@@ -1242,6 +1258,7 @@ async fn auto_remote_compact_trims_function_call_history_to_fit_context_window()
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&codex, |event| matches!(event, EventMsg::TurnComplete(_))).await;
@@ -1255,6 +1272,7 @@ async fn auto_remote_compact_trims_function_call_history_to_fit_context_window()
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&codex, |event| matches!(event, EventMsg::TurnComplete(_))).await;
@@ -1274,6 +1292,7 @@ async fn auto_remote_compact_trims_function_call_history_to_fit_context_window()
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&codex, |event| matches!(event, EventMsg::TurnComplete(_))).await;
@@ -1373,6 +1392,7 @@ async fn auto_remote_compact_failure_stops_agent_loop() -> Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&codex, |event| matches!(event, EventMsg::TurnComplete(_))).await;
@@ -1386,6 +1406,7 @@ async fn auto_remote_compact_failure_stops_agent_loop() -> Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
 
@@ -1479,6 +1500,7 @@ async fn remote_compact_trim_estimate_uses_session_base_instructions() -> Result
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&baseline_codex, |event| {
@@ -1495,6 +1517,7 @@ async fn remote_compact_trim_estimate_uses_session_base_instructions() -> Result
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&baseline_codex, |event| {
@@ -1530,7 +1553,7 @@ async fn remote_compact_trim_estimate_uses_session_base_instructions() -> Result
     let override_base_instructions = format!(
         "{}\nREMOTE_BASE_INSTRUCTIONS_OVERRIDE {}",
         baseline_compact_request.instructions_text(),
-        "x".repeat(4_000)
+        "x".repeat(8_000)
     );
     let override_context_window = baseline_payload_tokens.saturating_add(500);
     let pretrim_override_estimate =
@@ -1585,6 +1608,7 @@ async fn remote_compact_trim_estimate_uses_session_base_instructions() -> Result
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&override_codex, |event| {
@@ -1601,6 +1625,7 @@ async fn remote_compact_trim_estimate_uses_session_base_instructions() -> Result
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&override_codex, |event| {
@@ -1671,6 +1696,7 @@ async fn remote_manual_compact_emits_context_compaction_items() -> Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&codex, |event| matches!(event, EventMsg::TurnComplete(_))).await;
@@ -1751,6 +1777,7 @@ async fn remote_manual_compact_failure_emits_task_error_event() -> Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&codex, |event| matches!(event, EventMsg::TurnComplete(_))).await;
@@ -1834,6 +1861,7 @@ async fn remote_compact_persists_replacement_history_in_rollout() -> Result<()>
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -1976,6 +2004,7 @@ async fn remote_compact_and_resume_refresh_stale_developer_instructions() -> Res
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&initial.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -1993,6 +2022,7 @@ async fn remote_compact_and_resume_refresh_stale_developer_instructions() -> Res
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&initial.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -2017,6 +2047,7 @@ async fn remote_compact_and_resume_refresh_stale_developer_instructions() -> Res
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&resumed.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -2112,6 +2143,7 @@ async fn remote_compact_refreshes_stale_developer_instructions_without_resume()
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -2128,6 +2160,7 @@ async fn remote_compact_refreshes_stale_developer_instructions_without_resume()
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -2199,6 +2232,7 @@ async fn snapshot_request_shape_remote_pre_turn_compaction_restates_realtime_sta
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -2212,6 +2246,7 @@ async fn snapshot_request_shape_remote_pre_turn_compaction_restates_realtime_sta
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -2278,6 +2313,7 @@ async fn remote_request_uses_custom_experimental_realtime_start_instructions() -
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -2338,6 +2374,7 @@ async fn snapshot_request_shape_remote_pre_turn_compaction_restates_realtime_end
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -2353,6 +2390,7 @@ async fn snapshot_request_shape_remote_pre_turn_compaction_restates_realtime_end
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -2427,6 +2465,7 @@ async fn snapshot_request_shape_remote_manual_compact_restates_realtime_start()
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -2443,6 +2482,7 @@ async fn snapshot_request_shape_remote_manual_compact_restates_realtime_start()
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -2525,6 +2565,7 @@ async fn snapshot_request_shape_remote_mid_turn_compaction_does_not_restate_real
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -2540,6 +2581,7 @@ async fn snapshot_request_shape_remote_mid_turn_compaction_does_not_restate_real
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -2630,6 +2672,7 @@ async fn snapshot_request_shape_remote_compact_resume_restates_realtime_end() ->
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&initial.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -2659,6 +2702,7 @@ async fn snapshot_request_shape_remote_compact_resume_restates_realtime_end() ->
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&resumed.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -2729,22 +2773,14 @@ async fn snapshot_request_shape_remote_pre_turn_compaction_including_incoming_us
 
     for user in ["USER_ONE", "USER_TWO", "USER_THREE"] {
         if user == "USER_THREE" {
-            codex
-                .submit(Op::OverrideTurnContext {
+            core_test_support::submit_thread_settings(
+                &codex,
+                codex_protocol::protocol::ThreadSettingsOverrides {
                     cwd: Some(PathBuf::from(PRETURN_CONTEXT_DIFF_CWD)),
-                    approval_policy: None,
-                    approvals_reviewer: None,
-                    sandbox_policy: None,
-                    permission_profile: None,
-                    windows_sandbox_level: None,
-                    model: None,
-                    effort: None,
-                    summary: None,
-                    service_tier: None,
-                    collaboration_mode: None,
-                    personality: None,
-                })
-                .await?;
+                    ..Default::default()
+                },
+            )
+            .await?;
         }
         codex
             .submit(Op::UserInput {
@@ -2755,6 +2791,7 @@ async fn snapshot_request_shape_remote_pre_turn_compaction_including_incoming_us
                 }],
                 final_output_json_schema: None,
                 responsesapi_client_metadata: None,
+                thread_settings: Default::default(),
             })
             .await?;
         wait_for_event(&codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -2841,26 +2878,19 @@ async fn snapshot_request_shape_remote_pre_turn_compaction_strips_incoming_model
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
 
-    codex
-        .submit(Op::OverrideTurnContext {
-            cwd: None,
-            approval_policy: None,
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
+    core_test_support::submit_thread_settings(
+        &codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             model: Some(next_model.to_string()),
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
-        })
-        .await?;
+            ..Default::default()
+        },
+    )
+    .await?;
     codex
         .submit(Op::UserInput {
             environments: None,
@@ -2870,6 +2900,7 @@ async fn snapshot_request_shape_remote_pre_turn_compaction_strips_incoming_model
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -2988,6 +3019,7 @@ async fn snapshot_request_shape_remote_pre_turn_compaction_context_window_exceed
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -3001,6 +3033,7 @@ async fn snapshot_request_shape_remote_pre_turn_compaction_context_window_exceed
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     let error_message = wait_for_event_match(&codex, |event| match event {
@@ -3085,6 +3118,7 @@ async fn snapshot_request_shape_remote_mid_turn_continuation_compaction() -> Res
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -3162,6 +3196,7 @@ async fn snapshot_request_shape_remote_mid_turn_compaction_summary_only_reinject
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -3247,6 +3282,7 @@ async fn snapshot_request_shape_remote_mid_turn_compaction_multi_summary_reinjec
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -3263,6 +3299,7 @@ async fn snapshot_request_shape_remote_mid_turn_compaction_multi_summary_reinjec
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -3344,6 +3381,7 @@ async fn snapshot_request_shape_remote_manual_compact_without_previous_user_mess
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
diff --git a/codex-rs/core/tests/suite/compact_remote_parity.rs b/codex-rs/core/tests/suite/compact_remote_parity.rs
new file mode 100644
index 0000000000..ccbd427b1f
--- /dev/null
+++ b/codex-rs/core/tests/suite/compact_remote_parity.rs
@@ -0,0 +1,1162 @@
+#![allow(clippy::expect_used)]
+
+use std::fs;
+use std::path::Path;
+use std::path::PathBuf;
+
+use anyhow::Result;
+use codex_features::Feature;
+use codex_login::CodexAuth;
+use codex_protocol::config_types::ServiceTier;
+use codex_protocol::protocol::EventMsg;
+use codex_protocol::protocol::Op;
+use codex_protocol::protocol::RolloutItem;
+use codex_protocol::protocol::RolloutLine;
+use codex_protocol::user_input::UserInput;
+use core_test_support::hooks::trust_discovered_hooks;
+use core_test_support::responses;
+use core_test_support::responses::ResponseMock;
+use core_test_support::skip_if_no_network;
+use core_test_support::test_codex::TestCodexHarness;
+use core_test_support::test_codex::test_codex;
+use core_test_support::wait_for_event;
+use pretty_assertions::assert_eq;
+use serde_json::Value;
+use serde_json::json;
+
+const FIXED_CWD: &str = "/tmp/codex_remote_compaction_parity_workspace";
+const IMAGE_URL: &str = "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+/p9sAAAAASUVORK5CYII=";
+const SUMMARY: &str = "REMOTE_COMPACTION_PARITY_ENCRYPTED_SUMMARY";
+const DUMMY_FUNCTION_NAME: &str = "test_tool";
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+enum Mode {
+    Legacy,
+    V2,
+}
+
+#[derive(Clone, Copy, Debug)]
+enum AuthCase {
+    ChatGpt,
+    ApiKey,
+}
+
+impl AuthCase {
+    fn build(self) -> CodexAuth {
+        match self {
+            AuthCase::ChatGpt => CodexAuth::create_dummy_chatgpt_auth_for_testing(),
+            AuthCase::ApiKey => CodexAuth::from_api_key("dummy"),
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug)]
+struct RunSettings {
+    auth: AuthCase,
+    service_tier_fast: bool,
+}
+
+impl Default for RunSettings {
+    fn default() -> Self {
+        Self {
+            auth: AuthCase::ChatGpt,
+            service_tier_fast: false,
+        }
+    }
+}
+
+#[derive(Clone, Copy, Debug)]
+enum Step {
+    Assistant,
+    ReasoningAssistant,
+    FunctionTool,
+    ShellTool,
+    ImageAssistant,
+    WebSearchAssistant,
+}
+
+impl Step {
+    fn label(self) -> &'static str {
+        match self {
+            Step::Assistant => "assistant",
+            Step::ReasoningAssistant => "reasoning_assistant",
+            Step::FunctionTool => "function_tool",
+            Step::ShellTool => "shell_tool",
+            Step::ImageAssistant => "image_assistant",
+            Step::WebSearchAssistant => "web_search_assistant",
+        }
+    }
+}
+
+#[derive(Debug)]
+struct Scenario {
+    name: &'static str,
+    steps: &'static [Step],
+}
+
+#[derive(Debug)]
+struct Capture {
+    compact_body: Value,
+    follow_up_body: Value,
+    replacement_history: Value,
+    normal_response_requests: usize,
+    compact_requests: usize,
+}
+
+const ASSISTANT_ONLY: &[Step] = &[Step::Assistant];
+const REASONING_IMAGE: &[Step] = &[Step::ReasoningAssistant, Step::ImageAssistant];
+const TOOL_MIX: &[Step] = &[Step::Assistant, Step::FunctionTool, Step::ShellTool];
+const FULL_MIX: &[Step] = &[
+    Step::ReasoningAssistant,
+    Step::FunctionTool,
+    Step::ImageAssistant,
+    Step::ShellTool,
+    Step::WebSearchAssistant,
+    Step::Assistant,
+];
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn remote_compaction_parity_manual_transcripts() -> Result<()> {
+    skip_if_no_network!(Ok(()));
+
+    let scenarios = [
+        Scenario {
+            name: "assistant_only",
+            steps: ASSISTANT_ONLY,
+        },
+        Scenario {
+            name: "reasoning_image",
+            steps: REASONING_IMAGE,
+        },
+        Scenario {
+            name: "tool_mix",
+            steps: TOOL_MIX,
+        },
+        Scenario {
+            name: "full_mix",
+            steps: FULL_MIX,
+        },
+    ];
+
+    for scenario in scenarios {
+        compare_manual_scenario(&scenario, RunSettings::default()).await?;
+    }
+
+    Ok(())
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn remote_compaction_parity_v2_api_key_sends_service_tier_upgrade() -> Result<()> {
+    skip_if_no_network!(Ok(()));
+
+    let scenario = Scenario {
+        name: "api_key_service_tier",
+        steps: TOOL_MIX,
+    };
+    let settings = RunSettings {
+        auth: AuthCase::ApiKey,
+        service_tier_fast: true,
+    };
+    let legacy = run_manual_session(&scenario, Mode::Legacy, settings).await?;
+    let v2 = run_manual_session(&scenario, Mode::V2, settings).await?;
+
+    assert_eq!(
+        legacy.compact_body.get("service_tier"),
+        None,
+        "legacy /responses/compact should continue omitting service_tier for API-key auth"
+    );
+    assert_eq!(
+        v2.compact_body.get("service_tier").and_then(Value::as_str),
+        Some(ServiceTier::Fast.request_value()),
+        "v2 compaction should send service_tier through /responses for API-key auth"
+    );
+
+    assert_compact_requests_eq_except_v2_service_tier("api-key service tier", &legacy, &v2);
+    assert_follow_up_and_history_eq("api-key service tier", &legacy, &v2);
+    Ok(())
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn remote_compaction_parity_manual_hooks() -> Result<()> {
+    skip_if_no_network!(Ok(()));
+
+    let legacy = run_manual_hook_session(Mode::Legacy).await?;
+    let v2 = run_manual_hook_session(Mode::V2).await?;
+    assert_json_eq("manual compact hook payload parity mismatch", &legacy, &v2);
+    Ok(())
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn remote_compaction_parity_pre_turn_auto() -> Result<()> {
+    skip_if_no_network!(Ok(()));
+
+    let legacy = run_pre_turn_auto_session(Mode::Legacy).await?;
+    let v2 = run_pre_turn_auto_session(Mode::V2).await?;
+    assert_capture_eq("pre-turn auto", &legacy, &v2);
+    Ok(())
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn remote_compaction_parity_mid_turn_auto() -> Result<()> {
+    skip_if_no_network!(Ok(()));
+
+    let legacy = run_mid_turn_auto_session(Mode::Legacy).await?;
+    let v2 = run_mid_turn_auto_session(Mode::V2).await?;
+    assert_capture_eq("mid-turn auto", &legacy, &v2);
+    Ok(())
+}
+
+async fn compare_manual_scenario(scenario: &Scenario, settings: RunSettings) -> Result<()> {
+    let legacy = run_manual_session(scenario, Mode::Legacy, settings).await?;
+    let v2 = run_manual_session(scenario, Mode::V2, settings).await?;
+    assert_capture_eq(scenario.name, &legacy, &v2);
+    Ok(())
+}
+
+fn assert_capture_eq(label: &str, legacy: &Capture, v2: &Capture) {
+    assert_eq!(
+        legacy.compact_requests, 1,
+        "legacy compact endpoint should be called exactly once for {label}",
+    );
+    assert_eq!(
+        v2.compact_requests, 0,
+        "v2 should not call /responses/compact for {label}",
+    );
+
+    let legacy_compact = compact_request_view(&legacy.compact_body, Mode::Legacy);
+    let v2_compact = compact_request_view(&v2.compact_body, Mode::V2);
+    assert_json_eq(
+        &format!("compact request parity mismatch for {label}"),
+        &legacy_compact,
+        &v2_compact,
+    );
+
+    let legacy_follow_up = follow_up_request_view(&legacy.follow_up_body);
+    let v2_follow_up = follow_up_request_view(&v2.follow_up_body);
+    assert_json_eq(
+        &format!("post-compact follow-up request parity mismatch for {label}"),
+        &legacy_follow_up,
+        &v2_follow_up,
+    );
+
+    assert_json_eq(
+        &format!("replacement history parity mismatch for {label}"),
+        &legacy.replacement_history,
+        &v2.replacement_history,
+    );
+
+    println!(
+        "PARITY_OK scenario={} normal_response_requests={} compact_input_items={} replacement_history_items={} follow_up_input_items={}",
+        label,
+        legacy.normal_response_requests,
+        compact_input_len(&legacy.compact_body, Mode::Legacy),
+        replacement_history_len(&legacy.replacement_history),
+        follow_up_input_len(&legacy.follow_up_body)
+    );
+}
+
+fn assert_compact_requests_eq_except_v2_service_tier(label: &str, legacy: &Capture, v2: &Capture) {
+    assert_eq!(
+        legacy.compact_requests, 1,
+        "legacy compact endpoint should be called exactly once for {label}",
+    );
+    assert_eq!(
+        v2.compact_requests, 0,
+        "v2 should not call /responses/compact for {label}",
+    );
+
+    let legacy_compact = compact_request_view(&legacy.compact_body, Mode::Legacy);
+    let mut v2_compact = compact_request_view(&v2.compact_body, Mode::V2);
+    remove_object_field(&mut v2_compact, "service_tier");
+    assert_json_eq(
+        &format!("compact request parity mismatch for {label} after service_tier upgrade"),
+        &legacy_compact,
+        &v2_compact,
+    );
+}
+
+fn assert_follow_up_and_history_eq(label: &str, legacy: &Capture, v2: &Capture) {
+    let legacy_follow_up = follow_up_request_view(&legacy.follow_up_body);
+    let v2_follow_up = follow_up_request_view(&v2.follow_up_body);
+    assert_json_eq(
+        &format!("post-compact follow-up request parity mismatch for {label}"),
+        &legacy_follow_up,
+        &v2_follow_up,
+    );
+
+    assert_json_eq(
+        &format!("replacement history parity mismatch for {label}"),
+        &legacy.replacement_history,
+        &v2.replacement_history,
+    );
+}
+
+async fn run_manual_session(
+    scenario: &Scenario,
+    mode: Mode,
+    settings: RunSettings,
+) -> Result<Capture> {
+    let mut response_bodies = response_bodies_for_scenario(scenario);
+    if mode == Mode::V2 {
+        response_bodies.push(compaction_v2_response_body());
+    }
+    response_bodies.push(after_compact_response_body(scenario.name));
+
+    let harness = build_harness(mode, settings, /*hooks*/ false).await?;
+    let rollout_path = rollout_path(&harness);
+    let codex = harness.test().codex.clone();
+
+    let responses_mock = responses::mount_sse_sequence(harness.server(), response_bodies).await;
+    let compact_mock = mount_legacy_compact_if_needed(&harness, mode).await;
+
+    for (idx, step) in scenario.steps.iter().enumerate() {
+        submit_user_input(&codex, user_input_for_step(scenario.name, idx, *step)).await?;
+    }
+
+    codex.submit(Op::Compact).await?;
+    wait_for_turn_complete(&codex).await;
+
+    submit_user_input(
+        &codex,
+        vec![UserInput::Text {
+            text: format!("{}_AFTER_COMPACT_USER", scenario.name),
+            text_elements: Vec::new(),
+        }],
+    )
+    .await?;
+
+    capture_from_requests(
+        mode,
+        &codex,
+        &rollout_path,
+        &responses_mock,
+        compact_mock.as_ref(),
+        follow_up_index(responses_mock.requests().len()),
+    )
+    .await
+}
+
+async fn run_pre_turn_auto_session(mode: Mode) -> Result<Capture> {
+    let response_bodies = match mode {
+        Mode::Legacy => vec![
+            responses::sse(vec![
+                responses::ev_assistant_message("pre-turn-first-message", "PRE_TURN_FIRST_REPLY"),
+                responses::ev_completed_with_tokens(
+                    "pre-turn-first-response",
+                    /*total_tokens*/ 500,
+                ),
+            ]),
+            after_compact_response_body("pre_turn_auto"),
+        ],
+        Mode::V2 => vec![
+            responses::sse(vec![
+                responses::ev_assistant_message("pre-turn-first-message", "PRE_TURN_FIRST_REPLY"),
+                responses::ev_completed_with_tokens(
+                    "pre-turn-first-response",
+                    /*total_tokens*/ 500,
+                ),
+            ]),
+            compaction_v2_response_body(),
+            after_compact_response_body("pre_turn_auto"),
+        ],
+    };
+    let harness = build_auto_harness(mode).await?;
+    let rollout_path = rollout_path(&harness);
+    let codex = harness.test().codex.clone();
+    let responses_mock = responses::mount_sse_sequence(harness.server(), response_bodies).await;
+    let compact_mock = mount_legacy_compact_if_needed(&harness, mode).await;
+
+    submit_user_input(
+        &codex,
+        vec![UserInput::Text {
+            text: "pre_turn_auto_before".to_string(),
+            text_elements: Vec::new(),
+        }],
+    )
+    .await?;
+    submit_user_input(
+        &codex,
+        vec![UserInput::Text {
+            text: "pre_turn_auto_after".to_string(),
+            text_elements: Vec::new(),
+        }],
+    )
+    .await?;
+
+    capture_from_requests(
+        mode,
+        &codex,
+        &rollout_path,
+        &responses_mock,
+        compact_mock.as_ref(),
+        follow_up_index(responses_mock.requests().len()),
+    )
+    .await
+}
+
+async fn run_mid_turn_auto_session(mode: Mode) -> Result<Capture> {
+    let response_bodies = match mode {
+        Mode::Legacy => vec![
+            responses::sse(vec![
+                responses::ev_function_call("mid-turn-call", DUMMY_FUNCTION_NAME, "{}"),
+                responses::ev_completed_with_tokens(
+                    "mid-turn-call-response",
+                    /*total_tokens*/ 500,
+                ),
+            ]),
+            after_compact_response_body("mid_turn_auto"),
+        ],
+        Mode::V2 => vec![
+            responses::sse(vec![
+                responses::ev_function_call("mid-turn-call", DUMMY_FUNCTION_NAME, "{}"),
+                responses::ev_completed_with_tokens(
+                    "mid-turn-call-response",
+                    /*total_tokens*/ 500,
+                ),
+            ]),
+            compaction_v2_response_body(),
+            after_compact_response_body("mid_turn_auto"),
+        ],
+    };
+    let harness = build_auto_harness(mode).await?;
+    let rollout_path = rollout_path(&harness);
+    let codex = harness.test().codex.clone();
+    let responses_mock = responses::mount_sse_sequence(harness.server(), response_bodies).await;
+    let compact_mock = mount_legacy_compact_if_needed(&harness, mode).await;
+
+    submit_user_input(
+        &codex,
+        vec![UserInput::Text {
+            text: "mid_turn_auto_user".to_string(),
+            text_elements: Vec::new(),
+        }],
+    )
+    .await?;
+
+    capture_from_requests(
+        mode,
+        &codex,
+        &rollout_path,
+        &responses_mock,
+        compact_mock.as_ref(),
+        follow_up_index(responses_mock.requests().len()),
+    )
+    .await
+}
+
+async fn run_manual_hook_session(mode: Mode) -> Result<Value> {
+    let response_bodies = match mode {
+        Mode::Legacy => vec![responses::sse(vec![
+            responses::ev_assistant_message("hook-first-message", "HOOK_FIRST_REPLY"),
+            responses::ev_completed("hook-first-response"),
+        ])],
+        Mode::V2 => vec![
+            responses::sse(vec![
+                responses::ev_assistant_message("hook-first-message", "HOOK_FIRST_REPLY"),
+                responses::ev_completed("hook-first-response"),
+            ]),
+            compaction_v2_response_body(),
+        ],
+    };
+    let harness = build_harness(mode, RunSettings::default(), /*hooks*/ true).await?;
+    let codex = harness.test().codex.clone();
+    responses::mount_sse_sequence(harness.server(), response_bodies).await;
+    let compact_mock = mount_legacy_compact_if_needed(&harness, mode).await;
+
+    submit_user_input(
+        &codex,
+        vec![UserInput::Text {
+            text: "manual_hooks_before".to_string(),
+            text_elements: Vec::new(),
+        }],
+    )
+    .await?;
+    codex.submit(Op::Compact).await?;
+    wait_for_turn_complete(&codex).await;
+
+    if let Some(compact_mock) = compact_mock {
+        assert_eq!(compact_mock.requests().len(), 1);
+    }
+
+    let home = harness.test().codex_home_path();
+    let pre = hook_log_view(&home.join("pre_compact_manual_log.jsonl"))?;
+    let post = hook_log_view(&home.join("post_compact_manual_log.jsonl"))?;
+    Ok(json!({
+        "pre": pre,
+        "post": post,
+    }))
+}
+
+async fn build_auto_harness(mode: Mode) -> Result<TestCodexHarness> {
+    build_harness_inner(
+        mode,
+        RunSettings::default(),
+        /*hooks*/ false,
+        Some(200),
+    )
+    .await
+}
+
+async fn build_harness(mode: Mode, settings: RunSettings, hooks: bool) -> Result<TestCodexHarness> {
+    build_harness_inner(mode, settings, hooks, /*auto_compact_limit*/ None).await
+}
+
+async fn build_harness_inner(
+    mode: Mode,
+    settings: RunSettings,
+    hooks: bool,
+    auto_compact_limit: Option<i64>,
+) -> Result<TestCodexHarness> {
+    fs::create_dir_all(FIXED_CWD)?;
+    let mut builder = test_codex().with_auth(settings.auth.build());
+    if hooks {
+        builder = builder.with_pre_build_hook(write_manual_compact_hooks);
+    }
+    TestCodexHarness::with_builder(builder.with_config(move |config| {
+        config.cwd = codex_utils_absolute_path::AbsolutePathBuf::from_absolute_path(PathBuf::from(
+            FIXED_CWD,
+        ))
+        .expect("fixed cwd should be absolute");
+        config.user_instructions = Some("PARITY_USER_INSTRUCTIONS".to_string());
+        config.developer_instructions = Some("PARITY_DEVELOPER_INSTRUCTIONS".to_string());
+        if settings.service_tier_fast {
+            config.service_tier = Some(ServiceTier::Fast.request_value().to_string());
+        }
+        config.model_auto_compact_token_limit = auto_compact_limit;
+        if hooks {
+            trust_discovered_hooks(config);
+        }
+        if mode == Mode::V2 {
+            let _ = config.features.enable(Feature::RemoteCompactionV2);
+        }
+    }))
+    .await
+}
+
+fn rollout_path(harness: &TestCodexHarness) -> PathBuf {
+    harness
+        .test()
+        .session_configured
+        .rollout_path
+        .clone()
+        .expect("rollout path")
+}
+
+async fn mount_legacy_compact_if_needed(
+    harness: &TestCodexHarness,
+    mode: Mode,
+) -> Option<ResponseMock> {
+    match mode {
+        Mode::Legacy => Some(
+            responses::mount_compact_user_history_with_summary_once(harness.server(), SUMMARY)
+                .await,
+        ),
+        Mode::V2 => None,
+    }
+}
+
+fn follow_up_index(request_count: usize) -> usize {
+    request_count.checked_sub(1).expect("follow-up request")
+}
+
+async fn capture_from_requests(
+    mode: Mode,
+    codex: &codex_core::CodexThread,
+    rollout_path: &Path,
+    responses_mock: &ResponseMock,
+    compact_mock: Option<&ResponseMock>,
+    follow_up_index: usize,
+) -> Result<Capture> {
+    let response_requests = responses_mock.requests();
+    let follow_up_body = response_requests
+        .get(follow_up_index)
+        .expect("follow-up request should be present")
+        .body_json();
+
+    let (compact_body, compact_requests) = match (mode, compact_mock) {
+        (Mode::Legacy, Some(compact_mock)) => {
+            let compact_requests = compact_mock.requests().len();
+            (compact_mock.single_request().body_json(), compact_requests)
+        }
+        (Mode::V2, None) => {
+            let compact_index = follow_up_index
+                .checked_sub(1)
+                .expect("v2 compact request should precede follow-up");
+            (response_requests[compact_index].body_json(), 0)
+        }
+        (Mode::Legacy, None) | (Mode::V2, Some(_)) => panic!("unexpected compact mock state"),
+    };
+
+    codex.submit(Op::Shutdown).await?;
+    wait_for_event(codex, |ev| matches!(ev, EventMsg::ShutdownComplete)).await;
+
+    Ok(Capture {
+        compact_body,
+        follow_up_body,
+        replacement_history: replacement_history_from_rollout(rollout_path)?,
+        normal_response_requests: response_requests.len(),
+        compact_requests,
+    })
+}
+
+async fn submit_user_input(codex: &codex_core::CodexThread, items: Vec<UserInput>) -> Result<()> {
+    codex
+        .submit(Op::UserInput {
+            environments: None,
+            items,
+            final_output_json_schema: None,
+            responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
+        })
+        .await?;
+    wait_for_turn_complete(codex).await;
+    Ok(())
+}
+
+async fn wait_for_turn_complete(codex: &codex_core::CodexThread) {
+    wait_for_event(codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
+}
+
+fn user_input_for_step(scenario_name: &str, idx: usize, step: Step) -> Vec<UserInput> {
+    let mut items = Vec::new();
+    if matches!(step, Step::ImageAssistant) {
+        items.push(UserInput::Image {
+            image_url: IMAGE_URL.to_string(),
+            detail: None,
+        });
+    }
+    items.push(UserInput::Text {
+        text: format!("{}_USER_TURN_{}_{}", scenario_name, idx, step.label()),
+        text_elements: Vec::new(),
+    });
+    items
+}
+
+fn response_bodies_for_scenario(scenario: &Scenario) -> Vec<String> {
+    scenario
+        .steps
+        .iter()
+        .enumerate()
+        .flat_map(|(idx, step)| response_bodies_for_step(scenario.name, idx, *step))
+        .collect()
+}
+
+fn response_bodies_for_step(scenario_name: &str, idx: usize, step: Step) -> Vec<String> {
+    let response_id = format!("{scenario_name}-{idx}-{}", step.label());
+    match step {
+        Step::Assistant => vec![responses::sse(vec![
+            responses::ev_assistant_message(
+                &format!("{response_id}-message"),
+                &format!("{scenario_name} assistant reply {idx}"),
+            ),
+            responses::ev_completed(&format!("{response_id}-response")),
+        ])],
+        Step::ReasoningAssistant => vec![responses::sse(vec![
+            responses::ev_reasoning_item(
+                &format!("{response_id}-reasoning"),
+                &["PARITY_REASONING_SUMMARY"],
+                &["parity raw reasoning content"],
+            ),
+            responses::ev_assistant_message(
+                &format!("{response_id}-message"),
+                &format!("{scenario_name} reasoning reply {idx}"),
+            ),
+            responses::ev_completed(&format!("{response_id}-response")),
+        ])],
+        Step::FunctionTool => vec![
+            responses::sse(vec![
+                responses::ev_function_call(
+                    &format!("{response_id}-call"),
+                    DUMMY_FUNCTION_NAME,
+                    r#"{"case":"parity"}"#,
+                ),
+                responses::ev_completed(&format!("{response_id}-tool-response")),
+            ]),
+            responses::sse(vec![
+                responses::ev_assistant_message(
+                    &format!("{response_id}-final-message"),
+                    &format!("{scenario_name} function follow-up {idx}"),
+                ),
+                responses::ev_completed(&format!("{response_id}-final-response")),
+            ]),
+        ],
+        Step::ShellTool => vec![
+            responses::sse(vec![
+                responses::ev_shell_command_call(
+                    &format!("{response_id}-shell-call"),
+                    &format!("echo {scenario_name}_{idx}_SHELL_TOOL"),
+                ),
+                responses::ev_completed(&format!("{response_id}-shell-response")),
+            ]),
+            responses::sse(vec![
+                responses::ev_assistant_message(
+                    &format!("{response_id}-final-message"),
+                    &format!("{scenario_name} shell follow-up {idx}"),
+                ),
+                responses::ev_completed(&format!("{response_id}-final-response")),
+            ]),
+        ],
+        Step::ImageAssistant => vec![responses::sse(vec![
+            responses::ev_assistant_message(
+                &format!("{response_id}-message"),
+                &format!("{scenario_name} image reply {idx}"),
+            ),
+            responses::ev_completed(&format!("{response_id}-response")),
+        ])],
+        Step::WebSearchAssistant => vec![responses::sse(vec![
+            responses::ev_web_search_call_done(
+                &format!("{response_id}-web-search"),
+                "completed",
+                &format!("{scenario_name} parity query"),
+            ),
+            responses::ev_assistant_message(
+                &format!("{response_id}-message"),
+                &format!("{scenario_name} web search reply {idx}"),
+            ),
+            responses::ev_completed(&format!("{response_id}-response")),
+        ])],
+    }
+}
+
+fn compaction_v2_response_body() -> String {
+    responses::sse(vec![
+        json!({
+            "type": "response.output_item.done",
+            "item": {
+                "type": "compaction",
+                "encrypted_content": SUMMARY,
+            }
+        }),
+        responses::ev_completed("remote-compaction-v2-response"),
+    ])
+}
+
+fn after_compact_response_body(scenario_name: &str) -> String {
+    responses::sse(vec![
+        responses::ev_assistant_message(
+            &format!("{scenario_name}-after-compact-message"),
+            &format!("{scenario_name} after compact reply"),
+        ),
+        responses::ev_completed(&format!("{scenario_name}-after-compact-response")),
+    ])
+}
+
+fn compact_request_view(body: &Value, mode: Mode) -> Value {
+    let mut input = body
+        .get("input")
+        .and_then(Value::as_array)
+        .cloned()
+        .expect("compact request should include input");
+    if mode == Mode::V2 {
+        let trigger = input
+            .pop()
+            .expect("v2 compact input should end with trigger");
+        assert_eq!(
+            trigger,
+            json!({"type": "compaction_trigger"}),
+            "v2 compact input should append exactly one compaction_trigger"
+        );
+    }
+
+    let mut selected = selected_request_fields(body, SelectedFieldsMode::Compact);
+    selected["input"] = normalize_value(Value::Array(input));
+    canonical_json(&normalize_value(selected))
+}
+
+fn follow_up_request_view(body: &Value) -> Value {
+    let mut selected = selected_request_fields(body, SelectedFieldsMode::FollowUp);
+    selected["input"] = normalize_value(
+        body.get("input")
+            .cloned()
+            .expect("follow-up request should include input"),
+    );
+    canonical_json(&normalize_value(selected))
+}
+
+fn replacement_history_from_rollout(path: &Path) -> Result<Value> {
+    let rollout_text = fs::read_to_string(path)?;
+    let mut replacement_history = None;
+    for line in rollout_text
+        .lines()
+        .map(str::trim)
+        .filter(|line| !line.is_empty())
+    {
+        let Ok(entry) = serde_json::from_str::<RolloutLine>(line) else {
+            continue;
+        };
+        if let RolloutItem::Compacted(compacted) = entry.item
+            && compacted.message.is_empty()
+            && let Some(items) = compacted.replacement_history
+        {
+            let values = items
+                .into_iter()
+                .map(|item| serde_json::to_value(item).expect("serialize replacement item"))
+                .collect::<Vec<_>>();
+            replacement_history = Some(Value::Array(values));
+        }
+    }
+    let replacement_history =
+        replacement_history.expect("expected compacted rollout replacement history");
+    Ok(canonical_json(&normalize_value(replacement_history)))
+}
+
+fn write_manual_compact_hooks(home: &Path) {
+    write_hook_script(
+        &home.join("pre_compact_manual.py"),
+        &home.join("pre_compact_manual_log.jsonl"),
+    );
+    write_hook_script(
+        &home.join("post_compact_manual.py"),
+        &home.join("post_compact_manual_log.jsonl"),
+    );
+    let hooks = json!({
+        "hooks": {
+            "PreCompact": [{
+                "matcher": "manual",
+                "hooks": [{
+                    "type": "command",
+                    "command": python_hook_command(&home.join("pre_compact_manual.py")),
+                }]
+            }],
+            "PostCompact": [{
+                "matcher": "manual",
+                "hooks": [{
+                    "type": "command",
+                    "command": python_hook_command(&home.join("post_compact_manual.py")),
+                }]
+            }]
+        }
+    });
+    fs::write(home.join("hooks.json"), hooks.to_string()).expect("write hooks.json");
+}
+
+fn write_hook_script(script_path: &Path, log_path: &Path) {
+    let script = format!(
+        r#"import json
+from pathlib import Path
+import sys
+
+payload = json.load(sys.stdin)
+with Path(r"{log_path}").open("a", encoding="utf-8") as handle:
+    handle.write(json.dumps(payload, sort_keys=True) + "\n")
+"#,
+        log_path = log_path.display(),
+    );
+    fs::write(script_path, script).expect("write compact hook script");
+}
+
+fn python_hook_command(script_path: &Path) -> String {
+    format!("python3 \"{}\"", script_path.display())
+}
+
+fn hook_log_view(path: &Path) -> Result<Value> {
+    let text = fs::read_to_string(path)?;
+    let values = text
+        .lines()
+        .filter(|line| !line.trim().is_empty())
+        .map(|line| {
+            let payload: Value = serde_json::from_str(line).expect("parse compact hook payload");
+            json!({
+                "hook_event_name": payload["hook_event_name"].clone(),
+                "trigger": payload["trigger"].clone(),
+                "model": payload["model"].clone(),
+                "has_reason": payload.get("reason").is_some(),
+                "has_phase": payload.get("phase").is_some(),
+                "has_implementation": payload.get("implementation").is_some(),
+                "has_status": payload.get("status").is_some(),
+                "has_error": payload.get("error").is_some(),
+            })
+        })
+        .collect::<Vec<_>>();
+    Ok(Value::Array(values))
+}
+
+#[derive(Clone, Copy)]
+enum SelectedFieldsMode {
+    Compact,
+    FollowUp,
+}
+
+fn selected_request_fields(body: &Value, mode: SelectedFieldsMode) -> Value {
+    let mut selected = serde_json::Map::new();
+    let fields: &[&str] = match mode {
+        SelectedFieldsMode::Compact => &[
+            "model",
+            "instructions",
+            "parallel_tool_calls",
+            "reasoning",
+            "service_tier",
+            "prompt_cache_key",
+            "text",
+            "tools",
+            "previous_response_id",
+        ],
+        SelectedFieldsMode::FollowUp => &[
+            "model",
+            "instructions",
+            "parallel_tool_calls",
+            "reasoning",
+            "service_tier",
+            "prompt_cache_key",
+            "text",
+            "tools",
+            "tool_choice",
+            "previous_response_id",
+            "store",
+            "stream",
+            "include",
+        ],
+    };
+    for field in fields {
+        if let Some(value) = body.get(field) {
+            selected.insert((*field).to_string(), normalize_value(value.clone()));
+        }
+    }
+    Value::Object(selected)
+}
+
+fn normalize_value(value: Value) -> Value {
+    match value {
+        Value::String(text) => Value::String(normalize_string(&text)),
+        Value::Array(values) => Value::Array(values.into_iter().map(normalize_value).collect()),
+        Value::Object(map) => Value::Object(
+            map.into_iter()
+                .map(|(key, value)| (key, normalize_value(value)))
+                .collect(),
+        ),
+        Value::Null | Value::Bool(_) | Value::Number(_) => value,
+    }
+}
+
+fn normalize_string(value: &str) -> String {
+    if is_uuid_like(value) {
+        return "<UUID>".to_string();
+    }
+
+    let mut text = value.to_string();
+    normalize_tmp_prefix_before_marker(&mut text, "/skills/");
+    normalize_tmp_prefix_before_marker(&mut text, "\\skills\\");
+
+    let mut search_start = 0;
+    let wall_time_prefix = "Wall time: ";
+    let wall_time_suffix = " seconds";
+    while let Some(relative_start) = text[search_start..].find(wall_time_prefix) {
+        let value_start = search_start + relative_start + wall_time_prefix.len();
+        let Some(relative_end) = text[value_start..].find(wall_time_suffix) else {
+            break;
+        };
+        let value_end = value_start + relative_end;
+        let value = &text[value_start..value_end];
+        if !value.is_empty()
+            && value.chars().any(|ch| ch.is_ascii_digit())
+            && value.chars().all(|ch| ch.is_ascii_digit() || ch == '.')
+        {
+            text.replace_range(value_start..value_end, "<WALL_TIME>");
+            search_start = value_start + "<WALL_TIME>".len() + wall_time_suffix.len();
+        } else {
+            search_start = value_end + wall_time_suffix.len();
+        }
+    }
+    text
+}
+
+fn is_uuid_like(value: &str) -> bool {
+    let bytes = value.as_bytes();
+    bytes.len() == 36
+        && [8, 13, 18, 23].iter().all(|idx| bytes[*idx] == b'-')
+        && bytes
+            .iter()
+            .enumerate()
+            .all(|(idx, byte)| [8, 13, 18, 23].contains(&idx) || byte.is_ascii_hexdigit())
+}
+
+fn normalize_tmp_prefix_before_marker(text: &mut String, marker: &str) {
+    let mut search_start = 0;
+    while let Some(relative_marker_index) = text[search_start..].find(marker) {
+        let marker_index = search_start + relative_marker_index;
+        let prefix = &text[..marker_index];
+        let windows_appdata_temp_start = prefix
+            .rfind("/AppData/Local/Temp/.tmp")
+            .and_then(|temp_index| prefix[..temp_index].rfind(":/Users/"))
+            .and_then(|colon_index| colon_index.checked_sub(1))
+            .or_else(|| {
+                prefix
+                    .rfind("\\AppData\\Local\\Temp\\.tmp")
+                    .and_then(|temp_index| prefix[..temp_index].rfind(":\\Users\\"))
+                    .and_then(|colon_index| colon_index.checked_sub(1))
+            });
+        let start = prefix
+            .rfind("/private/var/folders/")
+            .or_else(|| prefix.rfind("/var/folders/"))
+            .or_else(|| prefix.rfind("/private/tmp/.tmp"))
+            .or_else(|| prefix.rfind("/tmp/.tmp"))
+            .or(windows_appdata_temp_start);
+        if let Some(start_index) = start {
+            text.replace_range(start_index..marker_index, "<CODEX_HOME>");
+            search_start = start_index + "<CODEX_HOME>".len() + marker.len();
+        } else {
+            search_start = marker_index + marker.len();
+        }
+    }
+}
+
+#[test]
+fn normalize_string_rewrites_linux_temp_skill_paths() {
+    let text = normalize_string(
+        "file: /tmp/.tmp5YYdK3/skills/.system/imagegen/SKILL.md and \
+         /private/tmp/.tmpw3wqF9/skills/custom/SKILL.md",
+    );
+
+    assert_eq!(
+        text,
+        "file: <CODEX_HOME>/skills/.system/imagegen/SKILL.md and \
+         <CODEX_HOME>/skills/custom/SKILL.md"
+    );
+}
+
+#[test]
+fn normalize_string_rewrites_windows_temp_skill_paths() {
+    let text = normalize_string(
+        "file: C:/Users/runneradmin/AppData/Local/Temp/.tmpDuYxa3/skills/.system/imagegen/SKILL.md and \
+         C:\\Users\\runneradmin\\AppData\\Local\\Temp\\.tmpiP36Yr\\skills\\custom\\SKILL.md",
+    );
+
+    assert_eq!(
+        text,
+        "file: <CODEX_HOME>/skills/.system/imagegen/SKILL.md and \
+         <CODEX_HOME>\\skills\\custom\\SKILL.md"
+    );
+}
+
+#[test]
+fn normalize_string_rewrites_shell_wall_times() {
+    let text = normalize_string(
+        "Exit code: 0\nWall time: 0 seconds\nOutput:\nok\n\
+         Exit code: 0\nWall time: 0.1 seconds\nOutput:\nok",
+    );
+
+    assert_eq!(
+        text,
+        "Exit code: 0\nWall time: <WALL_TIME> seconds\nOutput:\nok\n\
+         Exit code: 0\nWall time: <WALL_TIME> seconds\nOutput:\nok"
+    );
+}
+
+fn canonical_json(value: &Value) -> Value {
+    match value {
+        Value::Object(map) => {
+            let mut entries = map.iter().collect::<Vec<_>>();
+            entries.sort_by(|(left_key, _), (right_key, _)| left_key.cmp(right_key));
+            Value::Object(
+                entries
+                    .into_iter()
+                    .map(|(key, value)| (key.clone(), canonical_json(value)))
+                    .collect(),
+            )
+        }
+        Value::Array(values) => Value::Array(values.iter().map(canonical_json).collect()),
+        Value::Null | Value::Bool(_) | Value::Number(_) | Value::String(_) => value.clone(),
+    }
+}
+
+fn remove_object_field(value: &mut Value, field: &str) {
+    if let Value::Object(map) = value {
+        map.remove(field);
+    }
+}
+
+fn assert_json_eq(label: &str, left: &Value, right: &Value) {
+    if left != right {
+        panic!("{}\n{}", label, first_json_diff(left, right, "$"));
+    }
+}
+
+fn first_json_diff(left: &Value, right: &Value, path: &str) -> String {
+    match (left, right) {
+        (Value::Object(left_map), Value::Object(right_map)) => {
+            let mut keys = left_map.keys().chain(right_map.keys()).collect::<Vec<_>>();
+            keys.sort();
+            keys.dedup();
+            for key in keys {
+                match (left_map.get(key), right_map.get(key)) {
+                    (Some(left_value), Some(right_value)) if left_value != right_value => {
+                        return first_json_diff(left_value, right_value, &format!("{path}.{key}"));
+                    }
+                    (None, Some(right_value)) => {
+                        return format!(
+                            "{path}.{key}: missing on left, right={}",
+                            short_json(right_value)
+                        );
+                    }
+                    (Some(left_value), None) => {
+                        return format!(
+                            "{path}.{key}: left={}, missing on right",
+                            short_json(left_value)
+                        );
+                    }
+                    (Some(_), Some(_)) | (None, None) => {}
+                }
+            }
+            format!("{path}: object mismatch")
+        }
+        (Value::Array(left_values), Value::Array(right_values)) => {
+            let len = left_values.len().min(right_values.len());
+            for idx in 0..len {
+                if left_values[idx] != right_values[idx] {
+                    return first_json_diff(
+                        &left_values[idx],
+                        &right_values[idx],
+                        &format!("{path}[{idx}]"),
+                    );
+                }
+            }
+            if left_values.len() != right_values.len() {
+                return format!(
+                    "{path}: array len left={} right={}",
+                    left_values.len(),
+                    right_values.len()
+                );
+            }
+            format!("{path}: array mismatch")
+        }
+        _ => format!(
+            "{path}: left={} right={}",
+            short_json(left),
+            short_json(right)
+        ),
+    }
+}
+
+fn short_json(value: &Value) -> String {
+    let text = serde_json::to_string(value).expect("serialize short json value");
+    const MAX_LEN: usize = 1000;
+    if text.len() <= MAX_LEN {
+        text
+    } else {
+        let prefix = text.chars().take(MAX_LEN).collect::<String>();
+        format!("{prefix}...<{} chars>", text.len())
+    }
+}
+
+fn compact_input_len(body: &Value, mode: Mode) -> usize {
+    let len = body
+        .get("input")
+        .and_then(Value::as_array)
+        .map(Vec::len)
+        .unwrap_or_default();
+    match mode {
+        Mode::Legacy => len,
+        Mode::V2 => len.saturating_sub(1),
+    }
+}
+
+fn follow_up_input_len(body: &Value) -> usize {
+    body.get("input")
+        .and_then(Value::as_array)
+        .map(Vec::len)
+        .unwrap_or_default()
+}
+
+fn replacement_history_len(body: &Value) -> usize {
+    body.as_array().map(Vec::len).unwrap_or_default()
+}
diff --git a/codex-rs/core/tests/suite/compact_resume_fork.rs b/codex-rs/core/tests/suite/compact_resume_fork.rs
index 2788c8ef21..b2b02f5e66 100644
--- a/codex-rs/core/tests/suite/compact_resume_fork.rs
+++ b/codex-rs/core/tests/suite/compact_resume_fork.rs
@@ -30,6 +30,7 @@ use core_test_support::responses::ResponseMock;
 use core_test_support::responses::ResponsesRequest;
 use core_test_support::responses::ev_assistant_message;
 use core_test_support::responses::ev_completed;
+use core_test_support::responses::ev_response_created;
 use core_test_support::responses::mount_sse_once_match;
 use core_test_support::responses::mount_sse_sequence;
 use core_test_support::responses::sse;
@@ -507,7 +508,7 @@ async fn snapshot_rollback_past_compaction_replays_append_only_history() -> Resu
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-/// Scenario: rolling back a turn that introduced persistent pre-turn context
+/// Scenario: rolling back a turn that introduced persistent pre-thread settings
 /// diffs should trim those context updates so the next request includes them
 /// only once.
 async fn snapshot_rollback_followup_turn_trims_context_updates() -> Result<()> {
@@ -535,7 +536,7 @@ async fn snapshot_rollback_followup_turn_trims_context_updates() -> Result<()> {
                 ev_assistant_message("m2", "turn 2 assistant"),
                 ev_completed("r2"),
             ]),
-            sse(vec![ev_completed("r3")]),
+            sse(vec![ev_response_created("r3"), ev_completed("r3")]),
         ],
     )
     .await;
@@ -547,18 +548,10 @@ async fn snapshot_rollback_followup_turn_trims_context_updates() -> Result<()> {
 
     let override_cwd = config.cwd.join(PRETURN_CONTEXT_DIFF_CWD);
     std::fs::create_dir_all(&override_cwd)?;
-    conversation
-        .submit(Op::OverrideTurnContext {
+    core_test_support::submit_thread_settings(
+        &conversation,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             cwd: Some(override_cwd.to_path_buf()),
-            approval_policy: None,
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
-            model: None,
-            effort: None,
-            summary: None,
-            service_tier: None,
             collaboration_mode: Some(CollaborationMode {
                 mode: ModeKind::Default,
                 settings: Settings {
@@ -567,9 +560,10 @@ async fn snapshot_rollback_followup_turn_trims_context_updates() -> Result<()> {
                     developer_instructions: Some(ROLLED_BACK_DEV_INSTRUCTIONS.to_string()),
                 },
             }),
-            personality: None,
-        })
-        .await?;
+            ..Default::default()
+        },
+    )
+    .await?;
 
     user_turn(&conversation, TURN_TWO_USER).await;
 
@@ -789,6 +783,7 @@ async fn user_turn(conversation: &Arc<CodexThread>, text: &str) {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .expect("submit user turn");
diff --git a/codex-rs/core/tests/suite/deprecation_notice.rs b/codex-rs/core/tests/suite/deprecation_notice.rs
index 0ef7ddc339..c41ff47f2a 100644
--- a/codex-rs/core/tests/suite/deprecation_notice.rs
+++ b/codex-rs/core/tests/suite/deprecation_notice.rs
@@ -1,23 +1,16 @@
 #![cfg(not(target_os = "windows"))]
 
 use anyhow::Ok;
-use codex_app_server_protocol::ConfigLayerSource;
-use codex_config::ConfigLayerEntry;
-use codex_config::ConfigLayerStack;
-use codex_config::ConfigRequirements;
-use codex_config::ConfigRequirementsToml;
 use codex_features::Feature;
 use codex_protocol::protocol::DeprecationNoticeEvent;
 use codex_protocol::protocol::EventMsg;
 use core_test_support::responses::start_mock_server;
 use core_test_support::skip_if_no_network;
-use core_test_support::test_absolute_path;
 use core_test_support::test_codex::TestCodex;
 use core_test_support::test_codex::test_codex;
 use core_test_support::wait_for_event_match;
 use pretty_assertions::assert_eq;
 use std::collections::BTreeMap;
-use toml::Value as TomlValue;
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn emits_deprecation_notice_for_legacy_feature_flag() -> anyhow::Result<()> {
@@ -60,61 +53,6 @@ async fn emits_deprecation_notice_for_legacy_feature_flag() -> anyhow::Result<()
     Ok(())
 }
 
-#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn emits_deprecation_notice_for_experimental_instructions_file() -> anyhow::Result<()> {
-    skip_if_no_network!(Ok(()));
-
-    let server = start_mock_server().await;
-
-    let mut builder = test_codex().with_config(|config| {
-        let mut table = toml::map::Map::new();
-        table.insert(
-            "experimental_instructions_file".to_string(),
-            TomlValue::String("legacy.md".to_string()),
-        );
-        let config_layer = ConfigLayerEntry::new(
-            ConfigLayerSource::User {
-                file: test_absolute_path("/tmp/config.toml"),
-            },
-            TomlValue::Table(table),
-        );
-        let config_layer_stack = ConfigLayerStack::new(
-            vec![config_layer],
-            ConfigRequirements::default(),
-            ConfigRequirementsToml::default(),
-        )
-        .expect("build config layer stack");
-        config.config_layer_stack = config_layer_stack;
-    });
-
-    let TestCodex { codex, .. } = builder.build(&server).await?;
-
-    let notice = wait_for_event_match(&codex, |event| match event {
-        EventMsg::DeprecationNotice(ev)
-            if ev.summary.contains("experimental_instructions_file") =>
-        {
-            Some(ev.clone())
-        }
-        _ => None,
-    })
-    .await;
-
-    let DeprecationNoticeEvent { summary, details } = notice;
-    assert_eq!(
-        summary,
-        "`experimental_instructions_file` is deprecated and ignored. Use `model_instructions_file` instead."
-            .to_string(),
-    );
-    assert_eq!(
-        details.as_deref(),
-        Some(
-            "Move the setting to `model_instructions_file` in config.toml (or under a profile) to load instructions from a file."
-        ),
-    );
-
-    Ok(())
-}
-
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn emits_deprecation_notice_for_web_search_feature_flag_values() -> anyhow::Result<()> {
     skip_if_no_network!(Ok(()));
diff --git a/codex-rs/core/tests/suite/exec_policy.rs b/codex-rs/core/tests/suite/exec_policy.rs
index 3f6c9cfdc0..f1e01c22ce 100644
--- a/codex-rs/core/tests/suite/exec_policy.rs
+++ b/codex-rs/core/tests/suite/exec_policy.rs
@@ -46,24 +46,31 @@ async fn submit_user_turn(
     let (sandbox_policy, permission_profile) =
         turn_permission_fields(permission_profile, test.config.cwd.as_path());
     test.codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: prompt.into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd: test.cwd_path().to_path_buf(),
-            approval_policy,
-            approvals_reviewer: None,
-            sandbox_policy,
-            permission_profile,
-            model: session_model,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(test.cwd_path().to_path_buf()),
+                approval_policy: Some(approval_policy),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: collaboration_mode.or({
+                    Some(codex_protocol::config_types::CollaborationMode {
+                        mode: codex_protocol::config_types::ModeKind::Default,
+                        settings: codex_protocol::config_types::Settings {
+                            model: session_model,
+                            reasoning_effort: None,
+                            developer_instructions: None,
+                        },
+                    })
+                }),
+                ..Default::default()
+            },
         })
         .await?;
     Ok(())
@@ -126,24 +133,29 @@ async fn execpolicy_blocks_shell_invocation() -> Result<()> {
     let (sandbox_policy, permission_profile) =
         turn_permission_fields(PermissionProfile::Disabled, test.config.cwd.as_path());
     test.codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "run shell command".into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd: test.cwd_path().to_path_buf(),
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy,
-            permission_profile,
-            model: session_model,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(test.cwd_path().to_path_buf()),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: session_model,
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
 
diff --git a/codex-rs/core/tests/suite/fork_thread.rs b/codex-rs/core/tests/suite/fork_thread.rs
index 37456dce63..68a167f790 100644
--- a/codex-rs/core/tests/suite/fork_thread.rs
+++ b/codex-rs/core/tests/suite/fork_thread.rs
@@ -57,6 +57,7 @@ async fn fork_thread_twice_drops_to_first_message() {
                 }],
                 final_output_json_schema: None,
                 responsesapi_client_metadata: None,
+                thread_settings: Default::default(),
             })
             .await
             .unwrap();
@@ -180,6 +181,7 @@ async fn fork_thread_from_history_does_not_require_source_rollout_path() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
diff --git a/codex-rs/core/tests/suite/hierarchical_agents.rs b/codex-rs/core/tests/suite/hierarchical_agents.rs
index 212303ed0e..751807623b 100644
--- a/codex-rs/core/tests/suite/hierarchical_agents.rs
+++ b/codex-rs/core/tests/suite/hierarchical_agents.rs
@@ -32,7 +32,7 @@ async fn hierarchical_agents_appends_to_project_doc_in_user_instructions() {
             Ok::<(), anyhow::Error>(())
         });
     let test = builder
-        .build_remote_aware(&server)
+        .build_with_remote_env(&server)
         .await
         .expect("build test codex");
 
@@ -76,7 +76,7 @@ async fn hierarchical_agents_emits_when_no_project_doc() {
             .expect("test config should allow feature update");
     });
     let test = builder
-        .build_remote_aware(&server)
+        .build_with_remote_env(&server)
         .await
         .expect("build test codex");
 
diff --git a/codex-rs/core/tests/suite/hooks.rs b/codex-rs/core/tests/suite/hooks.rs
index 563719cec2..4f376573b3 100644
--- a/codex-rs/core/tests/suite/hooks.rs
+++ b/codex-rs/core/tests/suite/hooks.rs
@@ -1064,6 +1064,67 @@ async fn session_start_hook_spills_large_additional_context() -> Result<()> {
     Ok(())
 }
 
+#[tokio::test]
+async fn pre_tool_use_hook_spills_large_additional_context() -> Result<()> {
+    skip_if_no_network!(Ok(()));
+
+    let server = start_mock_server().await;
+    let call_id = "pretooluse-shell-command-large-context";
+    let command = "printf pre-tool-output".to_string();
+    let args = serde_json::json!({ "command": command });
+    let responses = mount_sse_sequence(
+        &server,
+        vec![
+            sse(vec![
+                ev_response_created("resp-1"),
+                core_test_support::responses::ev_function_call(
+                    call_id,
+                    "shell_command",
+                    &serde_json::to_string(&args)?,
+                ),
+                ev_completed("resp-1"),
+            ]),
+            sse(vec![
+                ev_response_created("resp-2"),
+                ev_assistant_message("msg-1", "pre hook context observed"),
+                ev_completed("resp-2"),
+            ]),
+        ],
+    )
+    .await;
+    let additional_context = "remember the pre tool reef ".repeat(800);
+
+    let mut builder = test_codex()
+        .with_pre_build_hook({
+            let additional_context = additional_context.clone();
+            move |home| {
+                if let Err(error) =
+                    write_pre_tool_use_hook(home, Some("^Bash$"), "context", &additional_context)
+                {
+                    panic!("failed to write pre tool use hook test fixture: {error}");
+                }
+            }
+        })
+        .with_config(trust_discovered_hooks);
+    let test = builder.build(&server).await?;
+
+    test.submit_turn("run the shell command with large pre hook context")
+        .await?;
+
+    let requests = responses.requests();
+    assert_eq!(requests.len(), 2);
+    let developer_messages = requests[1].message_input_texts("developer");
+    let developer_message = developer_messages
+        .iter()
+        .find(|message| spilled_hook_output_path(message).is_some())
+        .context("spilled developer hook message")?;
+    assert!(developer_message.contains("tokens truncated"));
+    let path = spilled_hook_output_path(developer_message).context("spill path")?;
+    assert_eq!(fs::read_to_string(path)?, additional_context);
+
+    Ok(())
+}
+
 #[tokio::test]
 async fn stop_hook_spills_large_continuation_prompt() -> Result<()> {
     skip_if_no_network!(Ok(()));
@@ -1379,6 +1440,7 @@ async fn blocked_queued_prompt_does_not_strand_earlier_accepted_prompt() -> Resu
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
 
@@ -1397,6 +1459,7 @@ async fn blocked_queued_prompt_does_not_strand_earlier_accepted_prompt() -> Resu
                 }],
                 final_output_json_schema: None,
                 responsesapi_client_metadata: None,
+                thread_settings: Default::default(),
             })
             .await?;
     }
@@ -1597,7 +1660,6 @@ async fn permission_request_hook_allows_apply_patch_with_write_alias() -> Result
             }
         })
         .with_config(|config| {
-            config.include_apply_patch_tool = true;
             trust_discovered_hooks(config);
         });
     let test = builder.build(&server).await?;
@@ -2135,48 +2197,25 @@ async fn blocked_pre_tool_use_records_additional_context_for_shell_command() ->
 
 #[derive(Clone, Copy)]
 enum BashRewriteSurface {
-    ContainerExec,
     ExecCommand,
-    LocalShell,
-    Shell,
     ShellCommand,
 }
 
 impl BashRewriteSurface {
     fn slug(self) -> &'static str {
         match self {
-            BashRewriteSurface::ContainerExec => "container-exec",
             BashRewriteSurface::ExecCommand => "exec-command",
-            BashRewriteSurface::LocalShell => "local-shell",
-            BashRewriteSurface::Shell => "shell",
             BashRewriteSurface::ShellCommand => "shell-command",
         }
     }
 
-    fn tool_call(self, call_id: &str, command: &[String], command_text: &str) -> Result<Value> {
+    fn tool_call(self, call_id: &str, command_text: &str) -> Result<Value> {
         match self {
-            BashRewriteSurface::ContainerExec => Ok(ev_function_call(
-                call_id,
-                "container.exec",
-                &serde_json::to_string(&serde_json::json!({ "command": command }))?,
-            )),
             BashRewriteSurface::ExecCommand => Ok(ev_function_call(
                 call_id,
                 "exec_command",
                 &serde_json::to_string(&serde_json::json!({ "cmd": command_text }))?,
             )),
-            BashRewriteSurface::LocalShell => {
-                Ok(core_test_support::responses::ev_local_shell_call(
-                    call_id,
-                    "completed",
-                    command.iter().map(String::as_str).collect(),
-                ))
-            }
-            BashRewriteSurface::Shell => Ok(ev_function_call(
-                call_id,
-                "shell",
-                &serde_json::to_string(&serde_json::json!({ "command": command }))?,
-            )),
             BashRewriteSurface::ShellCommand => Ok(ev_function_call(
                 call_id,
                 "shell_command",
@@ -2185,33 +2224,19 @@ impl BashRewriteSurface {
         }
     }
 
-    fn original_command(self, marker: &Path) -> (Vec<String>, String) {
-        let command_text = format!("printf original > {}", marker.display());
+    fn original_command(self, marker: &Path) -> String {
         match self {
-            BashRewriteSurface::ContainerExec
-            | BashRewriteSurface::LocalShell
-            | BashRewriteSurface::Shell => {
-                let command = vec!["/bin/sh".to_string(), "-c".to_string(), command_text];
-                let command_text = codex_shell_command::parse_command::shlex_join(&command);
-                (command, command_text)
-            }
             BashRewriteSurface::ExecCommand | BashRewriteSurface::ShellCommand => {
-                (Vec::new(), command_text)
+                format!("printf original > {}", marker.display())
             }
         }
     }
 
     fn rewritten_command(self, marker: &Path) -> String {
-        let command_text = format!("printf rewritten > {}", marker.display());
         match self {
-            BashRewriteSurface::ContainerExec
-            | BashRewriteSurface::LocalShell
-            | BashRewriteSurface::Shell => codex_shell_command::parse_command::shlex_join(&[
-                "/bin/sh".to_string(),
-                "-c".to_string(),
-                command_text,
-            ]),
-            BashRewriteSurface::ExecCommand | BashRewriteSurface::ShellCommand => command_text,
+            BashRewriteSurface::ExecCommand | BashRewriteSurface::ShellCommand => {
+                format!("printf rewritten > {}", marker.display())
+            }
         }
     }
 
@@ -2234,14 +2259,14 @@ async fn assert_pre_tool_use_rewrites_bash_surface(surface: BashRewriteSurface)
     let call_id = format!("pretooluse-{slug}-rewrite");
     let original_marker = std::env::temp_dir().join(format!("pretooluse-{slug}-original-marker"));
     let rewritten_marker = std::env::temp_dir().join(format!("pretooluse-{slug}-rewritten-marker"));
-    let (tool_command, original_command) = surface.original_command(&original_marker);
+    let original_command = surface.original_command(&original_marker);
     let rewritten_command = surface.rewritten_command(&rewritten_marker);
     let responses = mount_sse_sequence(
         &server,
         vec![
             sse(vec![
                 ev_response_created("resp-1"),
-                surface.tool_call(&call_id, &tool_command, &original_command)?,
+                surface.tool_call(&call_id, &original_command)?,
                 ev_completed("resp-1"),
             ]),
             sse(vec![
@@ -2295,21 +2320,6 @@ async fn assert_pre_tool_use_rewrites_bash_surface(surface: BashRewriteSurface)
     Ok(())
 }
 
-#[tokio::test]
-async fn pre_tool_use_rewrites_shell_before_execution() -> Result<()> {
-    assert_pre_tool_use_rewrites_bash_surface(BashRewriteSurface::Shell).await
-}
-
-#[tokio::test]
-async fn pre_tool_use_rewrites_container_exec_before_execution() -> Result<()> {
-    assert_pre_tool_use_rewrites_bash_surface(BashRewriteSurface::ContainerExec).await
-}
-
-#[tokio::test]
-async fn pre_tool_use_rewrites_local_shell_before_execution() -> Result<()> {
-    assert_pre_tool_use_rewrites_bash_surface(BashRewriteSurface::LocalShell).await
-}
-
 #[tokio::test]
 async fn pre_tool_use_rewrites_shell_command_before_execution() -> Result<()> {
     assert_pre_tool_use_rewrites_bash_surface(BashRewriteSurface::ShellCommand).await
@@ -2745,95 +2755,6 @@ async fn pre_tool_use_merges_hooks_json_and_config_toml() -> Result<()> {
     Ok(())
 }
 
-#[tokio::test]
-async fn pre_tool_use_blocks_local_shell_before_execution() -> Result<()> {
-    skip_if_no_network!(Ok(()));
-
-    let server = start_mock_server().await;
-    let call_id = "pretooluse-local-shell";
-    let marker = std::env::temp_dir().join("pretooluse-local-shell-marker");
-    let command = vec![
-        "/bin/sh".to_string(),
-        "-c".to_string(),
-        format!("printf blocked > {}", marker.display()),
-    ];
-    let responses = mount_sse_sequence(
-        &server,
-        vec![
-            sse(vec![
-                ev_response_created("resp-1"),
-                core_test_support::responses::ev_local_shell_call(
-                    call_id,
-                    "completed",
-                    command.iter().map(String::as_str).collect(),
-                ),
-                ev_completed("resp-1"),
-            ]),
-            sse(vec![
-                ev_response_created("resp-2"),
-                ev_assistant_message("msg-1", "local shell blocked"),
-                ev_completed("resp-2"),
-            ]),
-        ],
-    )
-    .await;
-
-    let mut builder = test_codex()
-        .with_pre_build_hook(|home| {
-            if let Err(error) =
-                write_pre_tool_use_hook(home, Some("^Bash$"), "json_deny", "blocked local shell")
-            {
-                panic!("failed to write pre tool use hook test fixture: {error}");
-            }
-        })
-        .with_config(trust_discovered_hooks);
-    let test = builder.build(&server).await?;
-
-    if marker.exists() {
-        fs::remove_file(&marker).context("remove leftover local shell marker")?;
-    }
-
-    test.submit_turn("run the blocked local shell command")
-        .await?;
-
-    let requests = responses.requests();
-    assert_eq!(requests.len(), 2);
-    let output_item = requests[1].function_call_output(call_id);
-    let output = output_item
-        .get("output")
-        .and_then(Value::as_str)
-        .expect("local shell output string");
-    assert!(
-        output.contains("Command blocked by PreToolUse hook: blocked local shell"),
-        "blocked local shell output should surface the hook reason",
-    );
-    assert!(
-        output.contains(&format!(
-            "Command: {}",
-            codex_shell_command::parse_command::shlex_join(&command)
-        )),
-        "blocked local shell output should surface the blocked command",
-    );
-    assert!(
-        !marker.exists(),
-        "blocked local shell command should not execute"
-    );
-
-    let hook_inputs = read_pre_tool_use_hook_inputs(test.codex_home_path())?;
-    assert_eq!(hook_inputs.len(), 1);
-    assert_eq!(
-        hook_inputs[0]["tool_input"]["command"],
-        codex_shell_command::parse_command::shlex_join(&command),
-    );
-    assert!(
-        hook_inputs[0]["turn_id"]
-            .as_str()
-            .is_some_and(|turn_id| !turn_id.is_empty())
-    );
-
-    Ok(())
-}
-
 #[tokio::test]
 async fn pre_tool_use_blocks_exec_command_before_execution() -> Result<()> {
     skip_if_no_network!(Ok(()));
@@ -2960,7 +2881,6 @@ async fn pre_tool_use_blocks_apply_patch_before_execution() -> Result<()> {
             }
         })
         .with_config(|config| {
-            config.include_apply_patch_tool = true;
             trust_discovered_hooks(config);
         });
     let test = builder.build(&server).await?;
@@ -3039,7 +2959,6 @@ async fn pre_tool_use_rewrites_apply_patch_before_execution() -> Result<()> {
             }
         })
         .with_config(|config| {
-            config.include_apply_patch_tool = true;
             trust_discovered_hooks(config);
         });
     let test = builder.build(&server).await?;
@@ -3105,7 +3024,6 @@ async fn pre_tool_use_blocks_apply_patch_with_write_alias() -> Result<()> {
             }
         })
         .with_config(|config| {
-            config.include_apply_patch_tool = true;
             trust_discovered_hooks(config);
         });
     let test = builder.build(&server).await?;
@@ -3424,75 +3342,6 @@ async fn post_tool_use_continue_false_replaces_shell_command_output_with_stop_re
     Ok(())
 }
 
-#[tokio::test]
-async fn post_tool_use_records_additional_context_for_local_shell() -> Result<()> {
-    skip_if_no_network!(Ok(()));
-
-    let server = start_mock_server().await;
-    let call_id = "posttooluse-local-shell";
-    let command = vec![
-        "/bin/sh".to_string(),
-        "-c".to_string(),
-        "printf local-post-tool-output".to_string(),
-    ];
-    let responses = mount_sse_sequence(
-        &server,
-        vec![
-            sse(vec![
-                ev_response_created("resp-1"),
-                core_test_support::responses::ev_local_shell_call(
-                    call_id,
-                    "completed",
-                    command.iter().map(String::as_str).collect(),
-                ),
-                ev_completed("resp-1"),
-            ]),
-            sse(vec![
-                ev_response_created("resp-2"),
-                ev_assistant_message("msg-1", "local shell post hook context observed"),
-                ev_completed("resp-2"),
-            ]),
-        ],
-    )
-    .await;
-
-    let post_context = "Remember the local shell post-tool note.";
-    let mut builder = test_codex()
-        .with_pre_build_hook(|home| {
-            if let Err(error) =
-                write_post_tool_use_hook(home, Some("^Bash$"), "context", post_context)
-            {
-                panic!("failed to write post tool use hook test fixture: {error}");
-            }
-        })
-        .with_config(trust_discovered_hooks);
-    let test = builder.build(&server).await?;
-
-    test.submit_turn("run the local shell command with post hook")
-        .await?;
-
-    let requests = responses.requests();
-    assert_eq!(requests.len(), 2);
-    assert!(
-        requests[1]
-            .message_input_texts("developer")
-            .contains(&post_context.to_string()),
-        "follow-up request should include local shell post tool use additional context",
-    );
-    let hook_inputs = read_post_tool_use_hook_inputs(test.codex_home_path())?;
-    assert_eq!(hook_inputs.len(), 1);
-    assert_eq!(
-        hook_inputs[0]["tool_input"]["command"],
-        codex_shell_command::parse_command::shlex_join(&command),
-    );
-    assert_eq!(
-        hook_inputs[0]["tool_response"],
-        Value::String("local-post-tool-output".to_string()),
-    );
-
-    Ok(())
-}
-
 #[tokio::test]
 async fn post_tool_use_exit_two_replaces_one_shot_exec_command_output_with_feedback() -> Result<()>
 {
@@ -3776,7 +3625,6 @@ async fn post_tool_use_records_additional_context_for_apply_patch() -> Result<()
             }
         })
         .with_config(|config| {
-            config.include_apply_patch_tool = true;
             trust_discovered_hooks(config);
         });
     let test = builder.build(&server).await?;
@@ -3804,22 +3652,9 @@ async fn post_tool_use_records_additional_context_for_apply_patch() -> Result<()
     let tool_response = hook_inputs[0]["tool_response"]
         .as_str()
         .context("apply_patch tool_response should be a string")?;
-    let mut parsed_tool_response = serde_json::from_str::<Value>(tool_response)?;
-    if let Some(metadata) = parsed_tool_response
-        .get_mut("metadata")
-        .and_then(Value::as_object_mut)
-    {
-        let _ = metadata.remove("duration_seconds");
-    }
-    assert_eq!(
-        parsed_tool_response,
-        serde_json::json!({
-            "output": "Success. Updated the following files:\nA post_tool_use_apply_patch.txt\n",
-            "metadata": {
-                "exit_code": 0,
-            },
-        })
-    );
+    assert!(tool_response.starts_with("Exit code: 0"));
+    assert!(tool_response.contains("Success. Updated the following files:"));
+    assert!(tool_response.contains("A post_tool_use_apply_patch.txt"));
 
     Ok(())
 }
@@ -3864,7 +3699,6 @@ async fn post_tool_use_records_apply_patch_context_with_edit_alias() -> Result<(
             }
         })
         .with_config(|config| {
-            config.include_apply_patch_tool = true;
             trust_discovered_hooks(config);
         });
     let test = builder.build(&server).await?;
diff --git a/codex-rs/core/tests/suite/hooks_mcp.rs b/codex-rs/core/tests/suite/hooks_mcp.rs
index 96ed732695..80290e31ba 100644
--- a/codex-rs/core/tests/suite/hooks_mcp.rs
+++ b/codex-rs/core/tests/suite/hooks_mcp.rs
@@ -193,6 +193,7 @@ fn insert_rmcp_test_server(config: &mut Config, command: String, approval_mode:
             enabled_tools: None,
             disabled_tools: None,
             scopes: None,
+            oauth: None,
             oauth_resource: None,
             tools: HashMap::new(),
         },
diff --git a/codex-rs/core/tests/suite/image_rollout.rs b/codex-rs/core/tests/suite/image_rollout.rs
index f819e1cfdf..085ca96f37 100644
--- a/codex-rs/core/tests/suite/image_rollout.rs
+++ b/codex-rs/core/tests/suite/image_rollout.rs
@@ -113,29 +113,35 @@ async fn copy_paste_local_image_persists_rollout_request_shape() -> anyhow::Resu
         turn_permission_fields(PermissionProfile::Disabled, cwd.path());
 
     codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![
                 UserInput::LocalImage {
                     path: abs_path.clone(),
+                    detail: None,
                 },
                 UserInput::Text {
                     text: "pasted image".to_string(),
                     text_elements: Vec::new(),
                 },
             ],
+            environments: None,
             final_output_json_schema: None,
-            cwd: cwd.path().to_path_buf(),
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy,
-            permission_profile,
-            model: session_model,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(cwd.path().to_path_buf()),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: session_model,
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
 
@@ -203,29 +209,35 @@ async fn drag_drop_image_persists_rollout_request_shape() -> anyhow::Result<()>
         turn_permission_fields(PermissionProfile::Disabled, cwd.path());
 
     codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![
                 UserInput::Image {
                     image_url: image_url.clone(),
+                    detail: None,
                 },
                 UserInput::Text {
                     text: "dropped image".to_string(),
                     text_elements: Vec::new(),
                 },
             ],
+            environments: None,
             final_output_json_schema: None,
-            cwd: cwd.path().to_path_buf(),
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy,
-            permission_profile,
-            model: session_model,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(cwd.path().to_path_buf()),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: session_model,
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
 
diff --git a/codex-rs/core/tests/suite/items.rs b/codex-rs/core/tests/suite/items.rs
index 65087a1fe7..82e01e2451 100644
--- a/codex-rs/core/tests/suite/items.rs
+++ b/codex-rs/core/tests/suite/items.rs
@@ -44,30 +44,28 @@ use std::path::PathBuf;
 
 fn disabled_plan_turn(
     text: &str,
-    model: String,
+    _model: String,
     collaboration_mode: CollaborationMode,
 ) -> anyhow::Result<Op> {
     let cwd = std::env::current_dir()?;
     let (sandbox_policy, permission_profile) =
         turn_permission_fields(PermissionProfile::Disabled, cwd.as_path());
-    Ok(Op::UserTurn {
-        environments: None,
+    Ok(Op::UserInput {
         items: vec![UserInput::Text {
             text: text.into(),
             text_elements: Vec::new(),
         }],
+        environments: None,
         final_output_json_schema: None,
-        cwd,
-        approval_policy: AskForApproval::Never,
-        approvals_reviewer: None,
-        sandbox_policy,
-        permission_profile,
-        model,
-        effort: None,
-        summary: None,
-        service_tier: None,
-        collaboration_mode: Some(collaboration_mode),
-        personality: None,
+        responsesapi_client_metadata: None,
+        thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+            cwd: Some(cwd),
+            approval_policy: Some(AskForApproval::Never),
+            sandbox_policy: Some(sandbox_policy),
+            permission_profile,
+            collaboration_mode: Some(collaboration_mode),
+            ..Default::default()
+        },
     })
 }
 
@@ -121,6 +119,7 @@ async fn user_message_item_is_emitted() -> anyhow::Result<()> {
             items: vec![expected_input.clone()],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
 
@@ -179,6 +178,7 @@ async fn assistant_message_item_is_emitted() -> anyhow::Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
 
@@ -239,6 +239,7 @@ async fn reasoning_item_is_emitted() -> anyhow::Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
 
@@ -300,6 +301,7 @@ async fn web_search_item_is_emitted() -> anyhow::Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
 
@@ -379,6 +381,7 @@ async fn image_generation_call_event_is_emitted() -> anyhow::Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
 
@@ -465,6 +468,7 @@ async fn image_generation_call_event_is_emitted_when_image_save_fails() -> anyho
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
 
@@ -520,6 +524,7 @@ async fn agent_message_content_delta_has_item_metadata() -> anyhow::Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
 
@@ -1103,6 +1108,7 @@ async fn reasoning_content_delta_has_item_metadata() -> anyhow::Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
 
@@ -1157,6 +1163,7 @@ async fn reasoning_raw_content_delta_respects_flag() -> anyhow::Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
 
diff --git a/codex-rs/core/tests/suite/json_result.rs b/codex-rs/core/tests/suite/json_result.rs
index c4ce8ac908..e81d7aa82a 100644
--- a/codex-rs/core/tests/suite/json_result.rs
+++ b/codex-rs/core/tests/suite/json_result.rs
@@ -75,24 +75,29 @@ async fn codex_returns_json_result(model: String) -> anyhow::Result<()> {
 
     // 1) Normal user input – should hit server once.
     codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "hello world".into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: Some(serde_json::from_str(SCHEMA)?),
-            cwd: cwd.path().to_path_buf(),
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy,
-            permission_profile,
-            model,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(cwd.path().to_path_buf()),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model,
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
 
diff --git a/codex-rs/core/tests/suite/live_cli.rs b/codex-rs/core/tests/suite/live_cli.rs
index c5c26a1c8e..5e2c0415ea 100644
--- a/codex-rs/core/tests/suite/live_cli.rs
+++ b/codex-rs/core/tests/suite/live_cli.rs
@@ -23,6 +23,9 @@ fn run_live(prompt: &str) -> (assert_cmd::assert::Assert, TempDir) {
     use std::thread;
 
     let dir = TempDir::new().unwrap();
+    let home = TempDir::new().unwrap();
+    let codex_home = home.path().join(".codex");
+    std::fs::create_dir_all(&codex_home).unwrap();
 
     // Build a plain `std::process::Command` so we have full control over the underlying stdio
     // handles. `assert_cmd`’s own `Command` wrapper always forces stdout/stderr to be piped
@@ -33,6 +36,8 @@ fn run_live(prompt: &str) -> (assert_cmd::assert::Assert, TempDir) {
     let mut cmd = Command::new(codex_utils_cargo_bin::cargo_bin("codex-rs").unwrap());
     cmd.current_dir(dir.path());
     cmd.env("OPENAI_API_KEY", require_api_key());
+    cmd.env("HOME", home.path());
+    cmd.env("CODEX_HOME", &codex_home);
 
     // We want three things at once:
     //   1. live streaming of the child’s stdout/stderr while the test is running
diff --git a/codex-rs/core/tests/suite/mcp_turn_metadata.rs b/codex-rs/core/tests/suite/mcp_turn_metadata.rs
new file mode 100644
index 0000000000..16e6cbe37d
--- /dev/null
+++ b/codex-rs/core/tests/suite/mcp_turn_metadata.rs
@@ -0,0 +1,320 @@
+#![cfg(not(target_os = "windows"))]
+#![allow(clippy::unwrap_used, clippy::expect_used)]
+
+use anyhow::Result;
+use codex_config::types::AppToolApproval;
+use codex_core::config::Config;
+use codex_features::Feature;
+use codex_protocol::config_types::CollaborationMode;
+use codex_protocol::config_types::ModeKind;
+use codex_protocol::config_types::Settings;
+use codex_protocol::models::PermissionProfile;
+use codex_protocol::protocol::AskForApproval;
+use codex_protocol::protocol::ElicitationAction;
+use codex_protocol::protocol::EventMsg;
+use codex_protocol::protocol::Op;
+use codex_protocol::request_user_input::RequestUserInputAnswer;
+use codex_protocol::request_user_input::RequestUserInputResponse;
+use codex_protocol::user_input::UserInput;
+use core_test_support::PathExt;
+use core_test_support::apps_test_server::AppsTestServer;
+use core_test_support::apps_test_server::SEARCH_CALENDAR_CREATE_TOOL;
+use core_test_support::apps_test_server::SEARCH_CALENDAR_NAMESPACE;
+use core_test_support::apps_test_server::recorded_apps_tool_call_by_call_id;
+use core_test_support::apps_test_server::search_capable_apps_builder;
+use core_test_support::responses::ev_assistant_message;
+use core_test_support::responses::ev_completed;
+use core_test_support::responses::ev_function_call;
+use core_test_support::responses::ev_function_call_with_namespace;
+use core_test_support::responses::ev_response_created;
+use core_test_support::responses::mount_sse_sequence;
+use core_test_support::responses::sse;
+use core_test_support::responses::start_mock_server;
+use core_test_support::skip_if_no_network;
+use core_test_support::test_codex::TestCodex;
+use core_test_support::test_codex::turn_permission_fields;
+use core_test_support::wait_for_event;
+use core_test_support::wait_for_event_match;
+use pretty_assertions::assert_eq;
+use serde_json::json;
+use std::collections::HashMap;
+
+fn set_calendar_approval_mode(config: &mut Config, approval_mode: AppToolApproval) {
+    let approval_mode = match approval_mode {
+        AppToolApproval::Auto => "auto",
+        AppToolApproval::Prompt => "prompt",
+        AppToolApproval::Approve => "approve",
+    };
+    let user_config_path = config.codex_home.join("config.toml").abs();
+    let user_config = toml::from_str(&format!(
+        r#"
+[apps.calendar]
+default_tools_approval_mode = "{approval_mode}"
+"#
+    ))
+    .expect("apps config should parse");
+    config.config_layer_stack = config
+        .config_layer_stack
+        .with_user_config(&user_config_path, user_config);
+}
+
+async fn submit_user_turn(
+    test: &TestCodex,
+    text: &str,
+    approval_policy: AskForApproval,
+    collaboration_mode: Option<CollaborationMode>,
+) -> Result<()> {
+    let session_model = test.session_configured.model.clone();
+    let (sandbox_policy, permission_profile) =
+        turn_permission_fields(PermissionProfile::Disabled, test.cwd.path());
+    test.codex
+        .submit(Op::UserInput {
+            items: vec![UserInput::Text {
+                text: text.to_string(),
+                text_elements: Vec::new(),
+            }],
+            environments: None,
+            final_output_json_schema: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(test.cwd.path().to_path_buf()),
+                approval_policy: Some(approval_policy),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: collaboration_mode.or({
+                    Some(codex_protocol::config_types::CollaborationMode {
+                        mode: codex_protocol::config_types::ModeKind::Default,
+                        settings: codex_protocol::config_types::Settings {
+                            model: session_model,
+                            reasoning_effort: None,
+                            developer_instructions: None,
+                        },
+                    })
+                }),
+                ..Default::default()
+            },
+        })
+        .await?;
+    Ok(())
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn approved_mcp_tool_call_metadata_records_prior_user_input_request() -> Result<()> {
+    skip_if_no_network!(Ok(()));
+
+    let server = start_mock_server().await;
+    let apps_server = AppsTestServer::mount(&server).await?;
+    let call_id = "calendar-call-approval";
+    let calendar_args = serde_json::to_string(&json!({
+        "title": "Lunch",
+        "starts_at": "2026-03-10T12:00:00Z"
+    }))?;
+    let mock = mount_sse_sequence(
+        &server,
+        vec![
+            sse(vec![
+                ev_response_created("resp-1"),
+                ev_function_call_with_namespace(
+                    call_id,
+                    SEARCH_CALENDAR_NAMESPACE,
+                    SEARCH_CALENDAR_CREATE_TOOL,
+                    &calendar_args,
+                ),
+                ev_completed("resp-1"),
+            ]),
+            sse(vec![
+                ev_response_created("resp-2"),
+                ev_assistant_message("msg-1", "done"),
+                ev_completed("resp-2"),
+            ]),
+        ],
+    )
+    .await;
+
+    let mut builder = search_capable_apps_builder(apps_server.chatgpt_base_url.clone())
+        .with_config(|config| {
+            config
+                .features
+                .enable(Feature::ToolCallMcpElicitation)
+                .expect("test config should allow feature update");
+            set_calendar_approval_mode(config, AppToolApproval::Prompt);
+        });
+    let test = builder.build(&server).await?;
+
+    submit_user_turn(
+        &test,
+        "Use [$calendar](app://calendar) to create a calendar event.",
+        AskForApproval::OnRequest,
+        /*collaboration_mode*/ None,
+    )
+    .await?;
+
+    let EventMsg::McpToolCallBegin(begin) = wait_for_event(&test.codex, |event| {
+        matches!(event, EventMsg::McpToolCallBegin(_))
+    })
+    .await
+    else {
+        unreachable!("event guard guarantees McpToolCallBegin");
+    };
+    assert_eq!(begin.call_id, call_id);
+
+    let EventMsg::ElicitationRequest(request) = wait_for_event(&test.codex, |event| {
+        matches!(event, EventMsg::ElicitationRequest(_))
+    })
+    .await
+    else {
+        unreachable!("event guard guarantees ElicitationRequest");
+    };
+
+    test.codex
+        .submit(Op::ResolveElicitation {
+            server_name: request.server_name,
+            request_id: request.id,
+            decision: ElicitationAction::Accept,
+            content: None,
+            meta: None,
+        })
+        .await?;
+
+    wait_for_event(&test.codex, |event| {
+        matches!(event, EventMsg::TurnComplete(_))
+    })
+    .await;
+
+    assert_eq!(mock.requests().len(), 2);
+    let apps_tool_call = recorded_apps_tool_call_by_call_id(&server, call_id).await;
+
+    assert_eq!(
+        apps_tool_call
+            .pointer("/params/_meta/x-codex-turn-metadata/user_input_requested_during_turn"),
+        Some(&json!(true))
+    );
+
+    Ok(())
+}
+
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn mcp_tool_call_metadata_records_prior_request_user_input_tool() -> Result<()> {
+    skip_if_no_network!(Ok(()));
+
+    let server = start_mock_server().await;
+    let apps_server = AppsTestServer::mount(&server).await?;
+    let request_user_input_call_id = "user-input-call";
+    let calendar_call_id = "calendar-call-after-user-input";
+    let request_user_input_args = json!({
+        "questions": [{
+            "id": "confirm_path",
+            "header": "Confirm",
+            "question": "Proceed with the plan?",
+            "options": [{
+                "label": "Yes (Recommended)",
+                "description": "Continue the current plan."
+            }, {
+                "label": "No",
+                "description": "Stop and revisit the approach."
+            }]
+        }]
+    })
+    .to_string();
+    let calendar_args = serde_json::to_string(&json!({
+        "title": "Lunch",
+        "starts_at": "2026-03-10T12:00:00Z"
+    }))?;
+    let mock = mount_sse_sequence(
+        &server,
+        vec![
+            sse(vec![
+                ev_response_created("resp-1"),
+                ev_function_call(
+                    request_user_input_call_id,
+                    "request_user_input",
+                    &request_user_input_args,
+                ),
+                ev_completed("resp-1"),
+            ]),
+            sse(vec![
+                ev_response_created("resp-2"),
+                ev_function_call_with_namespace(
+                    calendar_call_id,
+                    SEARCH_CALENDAR_NAMESPACE,
+                    SEARCH_CALENDAR_CREATE_TOOL,
+                    &calendar_args,
+                ),
+                ev_completed("resp-2"),
+            ]),
+            sse(vec![
+                ev_response_created("resp-3"),
+                ev_assistant_message("msg-1", "done"),
+                ev_completed("resp-3"),
+            ]),
+        ],
+    )
+    .await;
+
+    let mut builder = search_capable_apps_builder(apps_server.chatgpt_base_url.clone())
+        .with_config(|config| {
+            set_calendar_approval_mode(config, AppToolApproval::Approve);
+        });
+    let test = builder.build(&server).await?;
+
+    submit_user_turn(
+        &test,
+        "Ask for confirmation, then create a calendar event.",
+        AskForApproval::Never,
+        Some(CollaborationMode {
+            mode: ModeKind::Plan,
+            settings: Settings {
+                model: test.session_configured.model.clone(),
+                reasoning_effort: None,
+                developer_instructions: None,
+            },
+        }),
+    )
+    .await?;
+
+    let request = wait_for_event_match(&test.codex, |event| match event {
+        EventMsg::RequestUserInput(request) => Some(request.clone()),
+        _ => None,
+    })
+    .await;
+    assert_eq!(request.call_id, request_user_input_call_id);
+
+    test.codex
+        .submit(Op::UserInputAnswer {
+            id: request.turn_id,
+            response: RequestUserInputResponse {
+                answers: HashMap::from([(
+                    "confirm_path".to_string(),
+                    RequestUserInputAnswer {
+                        answers: vec!["Yes (Recommended)".to_string()],
+                    },
+                )]),
+            },
+        })
+        .await?;
+
+    let EventMsg::McpToolCallBegin(begin) = wait_for_event(&test.codex, |event| {
+        matches!(event, EventMsg::McpToolCallBegin(_))
+    })
+    .await
+    else {
+        unreachable!("event guard guarantees McpToolCallBegin");
+    };
+    assert_eq!(begin.call_id, calendar_call_id);
+
+    wait_for_event(&test.codex, |event| {
+        matches!(event, EventMsg::TurnComplete(_))
+    })
+    .await;
+
+    assert_eq!(mock.requests().len(), 3);
+    let apps_tool_call = recorded_apps_tool_call_by_call_id(&server, calendar_call_id).await;
+
+    assert_eq!(
+        apps_tool_call
+            .pointer("/params/_meta/x-codex-turn-metadata/user_input_requested_during_turn"),
+        Some(&json!(true))
+    );
+
+    Ok(())
+}
diff --git a/codex-rs/core/tests/suite/mod.rs b/codex-rs/core/tests/suite/mod.rs
index 2b5caf5a52..87772aa279 100644
--- a/codex-rs/core/tests/suite/mod.rs
+++ b/codex-rs/core/tests/suite/mod.rs
@@ -43,6 +43,7 @@ mod codex_delegate;
 mod collaboration_instructions;
 mod compact;
 mod compact_remote;
+mod compact_remote_parity;
 mod compact_resume_fork;
 mod deprecation_notice;
 mod exec;
@@ -57,6 +58,7 @@ mod image_rollout;
 mod items;
 mod json_result;
 mod live_cli;
+mod mcp_turn_metadata;
 mod model_overrides;
 mod model_switching;
 mod model_visible_layout;
diff --git a/codex-rs/core/tests/suite/model_overrides.rs b/codex-rs/core/tests/suite/model_overrides.rs
index 9f8835f19f..f70c0ae1c2 100644
--- a/codex-rs/core/tests/suite/model_overrides.rs
+++ b/codex-rs/core/tests/suite/model_overrides.rs
@@ -9,7 +9,7 @@ use pretty_assertions::assert_eq;
 const CONFIG_TOML: &str = "config.toml";
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn override_turn_context_does_not_persist_when_config_exists() {
+async fn thread_settings_update_does_not_persist_when_config_exists() {
     let server = start_mock_server().await;
     let initial_contents = "model = \"gpt-4o\"\n";
     let mut builder = test_codex()
@@ -24,23 +24,16 @@ async fn override_turn_context_does_not_persist_when_config_exists() {
     let codex = test.codex.clone();
     let config_path = test.home.path().join(CONFIG_TOML);
 
-    codex
-        .submit(Op::OverrideTurnContext {
-            cwd: None,
-            approval_policy: None,
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
+    core_test_support::submit_thread_settings(
+        &codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             model: Some("o3".to_string()),
             effort: Some(Some(ReasoningEffort::High)),
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
-        })
-        .await
-        .expect("submit override");
+            ..Default::default()
+        },
+    )
+    .await
+    .expect("submit override");
 
     codex.submit(Op::Shutdown).await.expect("request shutdown");
     wait_for_event(&codex, |ev| matches!(ev, EventMsg::ShutdownComplete)).await;
@@ -52,7 +45,7 @@ async fn override_turn_context_does_not_persist_when_config_exists() {
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn override_turn_context_does_not_create_config_file() {
+async fn thread_settings_update_does_not_create_config_file() {
     let server = start_mock_server().await;
     let mut builder = test_codex();
     let test = builder.build(&server).await.expect("create conversation");
@@ -63,23 +56,16 @@ async fn override_turn_context_does_not_create_config_file() {
         "test setup should start without config"
     );
 
-    codex
-        .submit(Op::OverrideTurnContext {
-            cwd: None,
-            approval_policy: None,
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
+    core_test_support::submit_thread_settings(
+        &codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             model: Some("o3".to_string()),
             effort: Some(Some(ReasoningEffort::Medium)),
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
-        })
-        .await
-        .expect("submit override");
+            ..Default::default()
+        },
+    )
+    .await
+    .expect("submit override");
 
     codex.submit(Op::Shutdown).await.expect("request shutdown");
     wait_for_event(&codex, |ev| matches!(ev, EventMsg::ShutdownComplete)).await;
diff --git a/codex-rs/core/tests/suite/model_switching.rs b/codex-rs/core/tests/suite/model_switching.rs
index 21ab43f10d..009dfda60f 100644
--- a/codex-rs/core/tests/suite/model_switching.rs
+++ b/codex-rs/core/tests/suite/model_switching.rs
@@ -42,21 +42,26 @@ use wiremock::MockServer;
 fn read_only_user_turn(test: &TestCodex, items: Vec<UserInput>, model: String) -> Op {
     let (sandbox_policy, permission_profile) =
         turn_permission_fields(PermissionProfile::read_only(), test.cwd_path());
-    Op::UserTurn {
-        environments: None,
+    Op::UserInput {
         items,
+        environments: None,
         final_output_json_schema: None,
-        cwd: test.cwd_path().to_path_buf(),
-        approval_policy: AskForApproval::Never,
-        approvals_reviewer: None,
-        sandbox_policy,
-        permission_profile,
-        model,
-        effort: test.config.model_reasoning_effort,
-        summary: None,
-        service_tier: None,
-        collaboration_mode: None,
-        personality: None,
+        responsesapi_client_metadata: None,
+        thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+            cwd: Some(test.cwd_path().to_path_buf()),
+            approval_policy: Some(AskForApproval::Never),
+            sandbox_policy: Some(sandbox_policy),
+            permission_profile,
+            collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                mode: codex_protocol::config_types::ModeKind::Default,
+                settings: codex_protocol::config_types::Settings {
+                    model,
+                    reasoning_effort: test.config.model_reasoning_effort,
+                    developer_instructions: None,
+                },
+            }),
+            ..Default::default()
+        },
     }
 }
 
@@ -156,22 +161,14 @@ async fn model_change_appends_model_instructions_developer_message() -> Result<(
         .await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
 
-    test.codex
-        .submit(Op::OverrideTurnContext {
-            cwd: None,
-            approval_policy: None,
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
+    core_test_support::submit_thread_settings(
+        &test.codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             model: Some(next_model.to_string()),
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
-        })
-        .await?;
+            ..Default::default()
+        },
+    )
+    .await?;
 
     test.codex
         .submit(read_only_user_turn(
@@ -236,22 +233,15 @@ async fn model_and_personality_change_only_appends_model_instructions() -> Resul
         .await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
 
-    test.codex
-        .submit(Op::OverrideTurnContext {
-            cwd: None,
-            approval_policy: None,
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
+    core_test_support::submit_thread_settings(
+        &test.codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             model: Some(next_model.to_string()),
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
             personality: Some(Personality::Pragmatic),
-        })
-        .await?;
+            ..Default::default()
+        },
+    )
+    .await?;
 
     test.codex
         .submit(read_only_user_turn(
@@ -439,6 +429,7 @@ async fn model_change_from_image_to_text_strips_prior_image_content() -> Result<
             vec![
                 UserInput::Image {
                     image_url: image_url.clone(),
+                    detail: None,
                 },
                 UserInput::Text {
                     text: "first turn".to_string(),
@@ -982,22 +973,14 @@ async fn model_switch_to_smaller_model_updates_token_context_window() -> Result<
     );
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
 
-    test.codex
-        .submit(Op::OverrideTurnContext {
-            cwd: None,
-            approval_policy: None,
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
+    core_test_support::submit_thread_settings(
+        &test.codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             model: Some(smaller_model_slug.to_string()),
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
-        })
-        .await?;
+            ..Default::default()
+        },
+    )
+    .await?;
 
     test.codex
         .submit(read_only_user_turn(
diff --git a/codex-rs/core/tests/suite/model_visible_layout.rs b/codex-rs/core/tests/suite/model_visible_layout.rs
index 7ae148788e..17bc0f6703 100644
--- a/codex-rs/core/tests/suite/model_visible_layout.rs
+++ b/codex-rs/core/tests/suite/model_visible_layout.rs
@@ -117,24 +117,29 @@ async fn snapshot_model_visible_layout_turn_overrides() -> Result<()> {
         turn_permission_fields(PermissionProfile::read_only(), first_turn_cwd.as_path());
 
     test.codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "first turn".into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd: first_turn_cwd,
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy: first_sandbox_policy,
-            permission_profile: first_permission_profile,
-            model: test.session_configured.model.clone(),
-            effort: test.config.model_reasoning_effort,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(first_turn_cwd),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(first_sandbox_policy),
+                permission_profile: first_permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: test.session_configured.model.clone(),
+                        reasoning_effort: test.config.model_reasoning_effort,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
     wait_for_event(&test.codex, |event| {
@@ -147,24 +152,30 @@ async fn snapshot_model_visible_layout_turn_overrides() -> Result<()> {
         preturn_context_diff_cwd.as_path(),
     );
     test.codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "second turn with context updates".into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd: preturn_context_diff_cwd,
-            approval_policy: AskForApproval::OnRequest,
-            approvals_reviewer: None,
-            sandbox_policy: second_sandbox_policy,
-            permission_profile: second_permission_profile,
-            model: test.session_configured.model.clone(),
-            effort: test.config.model_reasoning_effort,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: Some(Personality::Friendly),
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(preturn_context_diff_cwd),
+                approval_policy: Some(AskForApproval::OnRequest),
+                sandbox_policy: Some(second_sandbox_policy),
+                permission_profile: second_permission_profile,
+                personality: Some(Personality::Friendly),
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: test.session_configured.model.clone(),
+                        reasoning_effort: test.config.model_reasoning_effort,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
     wait_for_event(&test.codex, |event| {
@@ -230,24 +241,29 @@ async fn snapshot_model_visible_layout_cwd_change_does_not_refresh_agents() -> R
         turn_permission_fields(PermissionProfile::read_only(), cwd_one.as_path());
 
     test.codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "first turn in agents_one".into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd: cwd_one.clone(),
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy: first_sandbox_policy,
-            permission_profile: first_permission_profile,
-            model: test.session_configured.model.clone(),
-            effort: test.config.model_reasoning_effort,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(cwd_one.clone()),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(first_sandbox_policy),
+                permission_profile: first_permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: test.session_configured.model.clone(),
+                        reasoning_effort: test.config.model_reasoning_effort,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
     wait_for_event(&test.codex, |event| {
@@ -258,24 +274,29 @@ async fn snapshot_model_visible_layout_cwd_change_does_not_refresh_agents() -> R
     let (second_sandbox_policy, second_permission_profile) =
         turn_permission_fields(PermissionProfile::read_only(), cwd_two.as_path());
     test.codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "second turn in agents_two".into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd: cwd_two,
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy: second_sandbox_policy,
-            permission_profile: second_permission_profile,
-            model: test.session_configured.model.clone(),
-            effort: test.config.model_reasoning_effort,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(cwd_two),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(second_sandbox_policy),
+                permission_profile: second_permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: test.session_configured.model.clone(),
+                        reasoning_effort: test.config.model_reasoning_effort,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
     wait_for_event(&test.codex, |event| {
@@ -344,6 +365,7 @@ async fn snapshot_model_visible_layout_resume_with_personality_change() -> Resul
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&codex, |event| matches!(event, EventMsg::TurnComplete(_))).await;
@@ -376,24 +398,30 @@ async fn snapshot_model_visible_layout_resume_with_personality_change() -> Resul
     );
     resumed
         .codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "resume and change personality".into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd: resume_override_cwd,
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy,
-            permission_profile,
-            model: resumed.session_configured.model.clone(),
-            effort: resumed.config.model_reasoning_effort,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: Some(Personality::Friendly),
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(resume_override_cwd),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                personality: Some(Personality::Friendly),
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: resumed.session_configured.model.clone(),
+                        reasoning_effort: resumed.config.model_reasoning_effort,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
     wait_for_event(&resumed.codex, |event| {
@@ -451,6 +479,7 @@ async fn snapshot_model_visible_layout_resume_override_matches_rollout_model() -
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&codex, |event| matches!(event, EventMsg::TurnComplete(_))).await;
@@ -472,23 +501,15 @@ async fn snapshot_model_visible_layout_resume_override_matches_rollout_model() -
     let resumed = resume_builder.resume(&server, home, rollout_path).await?;
     let resume_override_cwd = resumed.cwd_path().join(PRETURN_CONTEXT_DIFF_CWD);
     fs::create_dir_all(&resume_override_cwd)?;
-    resumed
-        .codex
-        .submit(Op::OverrideTurnContext {
+    core_test_support::submit_thread_settings(
+        &resumed.codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             cwd: Some(resume_override_cwd),
-            approval_policy: None,
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
             model: Some("gpt-5.2".to_string()),
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
-        })
-        .await?;
+            ..Default::default()
+        },
+    )
+    .await?;
     resumed
         .codex
         .submit(Op::UserInput {
@@ -499,6 +520,7 @@ async fn snapshot_model_visible_layout_resume_override_matches_rollout_model() -
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&resumed.codex, |event| {
diff --git a/codex-rs/core/tests/suite/models_cache_ttl.rs b/codex-rs/core/tests/suite/models_cache_ttl.rs
index 8463ee1cf1..3b729738df 100644
--- a/codex-rs/core/tests/suite/models_cache_ttl.rs
+++ b/codex-rs/core/tests/suite/models_cache_ttl.rs
@@ -92,24 +92,29 @@ async fn renews_cache_ttl_on_matching_models_etag() -> Result<()> {
         turn_permission_fields(PermissionProfile::Disabled, test.cwd_path());
 
     codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "hi".into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd: test.cwd_path().to_path_buf(),
-            approval_policy: codex_protocol::protocol::AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy,
-            permission_profile,
-            model: test.session_configured.model.clone(),
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(test.cwd_path().to_path_buf()),
+                approval_policy: Some(codex_protocol::protocol::AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: test.session_configured.model.clone(),
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
 
diff --git a/codex-rs/core/tests/suite/models_etag_responses.rs b/codex-rs/core/tests/suite/models_etag_responses.rs
index a9aa843ad1..49f34d8644 100644
--- a/codex-rs/core/tests/suite/models_etag_responses.rs
+++ b/codex-rs/core/tests/suite/models_etag_responses.rs
@@ -15,8 +15,8 @@ use codex_protocol::user_input::UserInput;
 use core_test_support::responses;
 use core_test_support::responses::ev_assistant_message;
 use core_test_support::responses::ev_completed;
-use core_test_support::responses::ev_local_shell_call;
 use core_test_support::responses::ev_response_created;
+use core_test_support::responses::ev_shell_command_call;
 use core_test_support::responses::sse;
 use core_test_support::responses::sse_response;
 use core_test_support::skip_if_no_network;
@@ -32,7 +32,7 @@ async fn refresh_models_on_models_etag_mismatch_and_avoid_duplicate_models_fetch
 
     const ETAG_1: &str = "\"models-etag-1\"";
     const ETAG_2: &str = "\"models-etag-2\"";
-    const CALL_ID: &str = "local-shell-call-1";
+    const CALL_ID: &str = "shell-command-call-1";
 
     let server = MockServer::start().await;
 
@@ -81,7 +81,7 @@ async fn refresh_models_on_models_etag_mismatch_and_avoid_duplicate_models_fetch
     // It also includes a mismatched X-Models-Etag, which should trigger a /models refresh.
     let first_response_body = sse(vec![
         ev_response_created("resp-1"),
-        ev_local_shell_call(CALL_ID, "completed", vec!["/bin/echo", "etag ok"]),
+        ev_shell_command_call(CALL_ID, "/bin/echo 'etag ok'"),
         ev_completed("resp-1"),
     ]);
     responses::mount_response_once(
@@ -104,24 +104,29 @@ async fn refresh_models_on_models_etag_mismatch_and_avoid_duplicate_models_fetch
     .await;
 
     codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "please run a tool".into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd: cwd_path,
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy,
-            permission_profile,
-            model: session_model,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(cwd_path),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: session_model,
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
 
diff --git a/codex-rs/core/tests/suite/openai_file_mcp.rs b/codex-rs/core/tests/suite/openai_file_mcp.rs
index 0f0dcf46f1..a25cc36a86 100644
--- a/codex-rs/core/tests/suite/openai_file_mcp.rs
+++ b/codex-rs/core/tests/suite/openai_file_mcp.rs
@@ -5,13 +5,16 @@ use std::path::Path;
 
 use anyhow::Context;
 use anyhow::Result;
-use codex_core::config::Config;
-use codex_features::Feature;
-use codex_login::CodexAuth;
 use codex_protocol::models::PermissionProfile;
 use codex_protocol::protocol::AskForApproval;
 use core_test_support::apps_test_server::AppsTestServer;
+use core_test_support::apps_test_server::CALENDAR_EXTRACT_TEXT_TOOL_NAME;
+use core_test_support::apps_test_server::DIRECT_CALENDAR_EXTRACT_TEXT_TOOL as DOCUMENT_EXTRACT_HOOK_MATCHER;
 use core_test_support::apps_test_server::DOCUMENT_EXTRACT_TEXT_RESOURCE_URI;
+use core_test_support::apps_test_server::SEARCH_CALENDAR_EXTRACT_TEXT_TOOL as DOCUMENT_EXTRACT_TOOL;
+use core_test_support::apps_test_server::SEARCH_CALENDAR_NAMESPACE as DOCUMENT_EXTRACT_NAMESPACE;
+use core_test_support::apps_test_server::apps_enabled_builder;
+use core_test_support::apps_test_server::recorded_apps_tool_call_by_name;
 use core_test_support::hooks::trust_discovered_hooks;
 use core_test_support::responses::ev_assistant_message;
 use core_test_support::responses::ev_completed;
@@ -20,7 +23,6 @@ use core_test_support::responses::ev_response_created;
 use core_test_support::responses::mount_sse_sequence;
 use core_test_support::responses::sse;
 use core_test_support::responses::start_mock_server;
-use core_test_support::test_codex::test_codex;
 use pretty_assertions::assert_eq;
 use serde_json::Value;
 use serde_json::json;
@@ -31,17 +33,6 @@ use wiremock::matchers::header;
 use wiremock::matchers::method;
 use wiremock::matchers::path;
 
-const DOCUMENT_EXTRACT_NAMESPACE: &str = "mcp__codex_apps__calendar";
-const DOCUMENT_EXTRACT_TOOL: &str = "_extract_text";
-const DOCUMENT_EXTRACT_HOOK_MATCHER: &str = "mcp__codex_apps__calendar_extract_text";
-
-fn configure_apps(config: &mut Config, chatgpt_base_url: &str) {
-    if let Err(err) = config.features.enable(Feature::Apps) {
-        panic!("test config should allow feature update: {err}");
-    }
-    config.chatgpt_base_url = chatgpt_base_url.to_string();
-}
-
 fn write_post_tool_use_hook(home: &Path) -> Result<()> {
     let script_path = home.join("post_tool_use_hook.py");
     let log_path = home.join("post_tool_use_hook_log.jsonl");
@@ -154,15 +145,13 @@ async fn codex_apps_file_params_upload_local_paths_before_mcp_tool_call() -> Res
     )
     .await;
 
-    let mut builder = test_codex()
-        .with_auth(CodexAuth::create_dummy_chatgpt_auth_for_testing())
+    let mut builder = apps_enabled_builder(apps_server.chatgpt_base_url.clone())
         .with_pre_build_hook(move |home| {
             if let Err(error) = write_post_tool_use_hook(home) {
                 panic!("failed to write apps file post tool use hook fixture: {error}");
             }
         })
         .with_config(move |config| {
-            configure_apps(config, apps_server.chatgpt_base_url.as_str());
             trust_discovered_hooks(config);
         });
     let test = builder.build(&server).await?;
@@ -192,20 +181,8 @@ async fn codex_apps_file_params_upload_local_paths_before_mcp_tool_call() -> Res
         }))
     );
 
-    let apps_tool_call = server
-        .received_requests()
-        .await
-        .unwrap_or_default()
-        .into_iter()
-        .find_map(|request| {
-            let body: Value = serde_json::from_slice(&request.body).ok()?;
-            (request.url.path() == "/api/codex/apps"
-                && body.get("method").and_then(Value::as_str) == Some("tools/call")
-                && body.pointer("/params/name").and_then(Value::as_str)
-                    == Some("calendar_extract_text"))
-            .then_some(body)
-        })
-        .expect("apps calendar_extract_text tools/call request should be recorded");
+    let apps_tool_call =
+        recorded_apps_tool_call_by_name(&server, CALENDAR_EXTRACT_TEXT_TOOL_NAME).await;
 
     assert_eq!(
         apps_tool_call.pointer("/params/arguments/file"),
diff --git a/codex-rs/core/tests/suite/otel.rs b/codex-rs/core/tests/suite/otel.rs
index eb05b8a645..9d2df4e60e 100644
--- a/codex-rs/core/tests/suite/otel.rs
+++ b/codex-rs/core/tests/suite/otel.rs
@@ -11,7 +11,6 @@ use core_test_support::responses::ev_assistant_message;
 use core_test_support::responses::ev_completed;
 use core_test_support::responses::ev_custom_tool_call;
 use core_test_support::responses::ev_function_call;
-use core_test_support::responses::ev_local_shell_call;
 use core_test_support::responses::ev_message_item_added;
 use core_test_support::responses::ev_output_text_delta;
 use core_test_support::responses::ev_reasoning_item;
@@ -72,6 +71,19 @@ fn assert_empty_mcp_tool_fields(line: &str) -> Result<(), String> {
     Ok(())
 }
 
+fn shell_command_call(call_id: &str, command: &str) -> serde_json::Value {
+    let args = serde_json::json!({ "command": command }).to_string();
+    ev_function_call(call_id, "shell_command", &args)
+}
+
+fn touch_command(path: &str) -> String {
+    if cfg!(windows) {
+        format!("New-Item -ItemType File -Path {path} -Force | Out-Null")
+    } else {
+        format!("/usr/bin/touch {path}")
+    }
+}
+
 #[test]
 fn extract_log_field_handles_empty_bare_values() {
     let line = "event.name=\"codex.tool_result\" mcp_server= mcp_server_origin=";
@@ -110,6 +122,7 @@ async fn responses_api_emits_api_request_event() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -155,6 +168,7 @@ async fn process_sse_emits_tracing_for_output_item() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -200,6 +214,7 @@ async fn process_sse_emits_failed_event_on_parse_error() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -246,6 +261,7 @@ async fn process_sse_records_failed_event_when_stream_closes_without_completed()
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -312,6 +328,7 @@ async fn process_sse_failed_event_records_response_error_message() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -376,6 +393,7 @@ async fn process_sse_failed_event_logs_parse_error() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -427,6 +445,7 @@ async fn process_sse_failed_event_logs_missing_error() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -487,6 +506,7 @@ async fn process_sse_failed_event_logs_response_completed_parse_error() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -541,6 +561,7 @@ async fn process_sse_emits_completed_telemetry() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -619,6 +640,7 @@ async fn turn_and_completed_response_spans_record_token_usage() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -706,6 +728,7 @@ async fn handle_responses_span_records_response_kind_and_tool_name() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -799,6 +822,7 @@ async fn record_responses_sets_span_fields_for_response_events() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -887,6 +911,7 @@ async fn handle_response_item_records_tool_result_for_custom_tool_call() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -962,6 +987,7 @@ async fn handle_response_item_records_tool_result_for_function_call() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -996,23 +1022,13 @@ async fn handle_response_item_records_tool_result_for_function_call() {
 
 #[tokio::test]
 #[traced_test]
-async fn handle_response_item_records_tool_result_for_local_shell_missing_ids() {
+async fn handle_response_item_records_tool_result_for_shell_command_call() {
     let server = start_mock_server().await;
 
     mount_sse_once(
         &server,
         sse(vec![
-            serde_json::json!({
-                "type": "response.output_item.done",
-                "item": {
-                    "type": "local_shell_call",
-                    "status": "completed",
-                    "action": {
-                        "type": "exec",
-                        "command": vec!["/bin/echo", "hello"],
-                    }
-                }
-            }),
+            shell_command_call("shell-call", "echo shell"),
             ev_completed("done"),
         ]),
     )
@@ -1021,76 +1037,7 @@ async fn handle_response_item_records_tool_result_for_local_shell_missing_ids()
     mount_sse_once(
         &server,
         sse(vec![
-            ev_assistant_message("msg-1", "local shell done"),
-            ev_completed("done"),
-        ]),
-    )
-    .await;
-
-    let TestCodex { codex, .. } = test_codex()
-        .with_config(move |config| {
-            config
-                .features
-                .disable(Feature::GhostCommit)
-                .expect("test config should allow feature update");
-        })
-        .build(&server)
-        .await
-        .unwrap();
-
-    codex
-        .submit(Op::UserInput {
-            environments: None,
-            items: vec![UserInput::Text {
-                text: "hello".into(),
-                text_elements: Vec::new(),
-            }],
-            final_output_json_schema: None,
-            responsesapi_client_metadata: None,
-        })
-        .await
-        .unwrap();
-
-    wait_for_event(&codex, |ev| matches!(ev, EventMsg::TokenCount(_))).await;
-
-    logs_assert(|lines: &[&str]| {
-        let line = lines
-            .iter()
-            .find(|line| {
-                line.contains("codex.tool_result")
-                    && line.contains(&"tool_name=local_shell".to_string())
-                    && line.contains("output=LocalShellCall without call_id or id")
-            })
-            .ok_or_else(|| "missing codex.tool_result event".to_string())?;
-
-        if !line.contains("success=false") {
-            return Err("missing success field".to_string());
-        }
-        assert_empty_mcp_tool_fields(line)?;
-
-        Ok(())
-    });
-}
-
-#[cfg(target_os = "macos")]
-#[tokio::test]
-#[traced_test]
-async fn handle_response_item_records_tool_result_for_local_shell_call() {
-    let server = start_mock_server().await;
-
-    mount_sse_once(
-        &server,
-        sse(vec![
-            ev_local_shell_call("shell-call", "completed", vec!["/bin/echo", "shell"]),
-            ev_completed("done"),
-        ]),
-    )
-    .await;
-
-    mount_sse_once(
-        &server,
-        sse(vec![
-            ev_assistant_message("msg-1", "local shell done"),
+            ev_assistant_message("msg-1", "shell command done"),
             ev_completed("done"),
         ]),
     )
@@ -1117,6 +1064,7 @@ async fn handle_response_item_records_tool_result_for_local_shell_call() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -1129,10 +1077,10 @@ async fn handle_response_item_records_tool_result_for_local_shell_call() {
             .find(|line| line.contains("codex.tool_result") && line.contains("call_id=shell-call"))
             .ok_or_else(|| "missing codex.tool_result event".to_string())?;
 
-        if !line.contains("tool_name=local_shell") {
+        if !line.contains("tool_name=shell_command") {
             return Err("missing tool_name field".to_string());
         }
-        if !line.contains("arguments=/bin/echo shell") {
+        if !line.contains("arguments={\"command\":\"echo shell\"}") {
             return Err("missing arguments field".to_string());
         }
         let output_idx = line
@@ -1168,8 +1116,8 @@ fn tool_decision_assertion<'a>(
             .ok_or_else(|| format!("missing codex.tool_decision event for {call_id}"))?;
 
         let lower = line.to_lowercase();
-        if !lower.contains("tool_name=local_shell") {
-            return Err("missing tool_name for local_shell".to_string());
+        if !lower.contains("tool_name=shell_command") {
+            return Err("missing tool_name for shell_command".to_string());
         }
         if !lower.contains(&format!("decision={expected_decision}")) {
             return Err(format!("unexpected decision for {call_id}"));
@@ -1184,16 +1132,12 @@ fn tool_decision_assertion<'a>(
 
 #[tokio::test]
 #[traced_test]
-async fn handle_container_exec_autoapprove_from_config_records_tool_decision() {
+async fn handle_shell_command_autoapprove_from_config_records_tool_decision() {
     let server = start_mock_server().await;
     mount_sse_once(
         &server,
         sse(vec![
-            ev_local_shell_call(
-                "auto_config_call",
-                "completed",
-                vec!["/bin/echo", "local shell"],
-            ),
+            shell_command_call("auto_config_call", "echo local shell"),
             ev_completed("done"),
         ]),
     )
@@ -1202,7 +1146,7 @@ async fn handle_container_exec_autoapprove_from_config_records_tool_decision() {
     mount_sse_once(
         &server,
         sse(vec![
-            ev_assistant_message("msg-1", "local shell done"),
+            ev_assistant_message("msg-1", "shell command done"),
             ev_completed("done"),
         ]),
     )
@@ -1229,6 +1173,7 @@ async fn handle_container_exec_autoapprove_from_config_records_tool_decision() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -1244,16 +1189,13 @@ async fn handle_container_exec_autoapprove_from_config_records_tool_decision() {
 
 #[tokio::test]
 #[traced_test]
-async fn handle_container_exec_user_approved_records_tool_decision() {
+async fn handle_shell_command_user_approved_records_tool_decision() {
     let server = start_mock_server().await;
+    let command = touch_command("codex-otel-approval-test");
     mount_sse_once(
         &server,
         sse(vec![
-            ev_local_shell_call(
-                "user_approved_call",
-                "completed",
-                vec!["/usr/bin/touch", "codex-otel-approval-test"],
-            ),
+            shell_command_call("user_approved_call", &command),
             ev_completed("done"),
         ]),
     )
@@ -1262,7 +1204,7 @@ async fn handle_container_exec_user_approved_records_tool_decision() {
     mount_sse_once(
         &server,
         sse(vec![
-            ev_assistant_message("msg-1", "local shell done"),
+            ev_assistant_message("msg-1", "shell command done"),
             ev_completed("done"),
         ]),
     )
@@ -1286,6 +1228,7 @@ async fn handle_container_exec_user_approved_records_tool_decision() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -1316,17 +1259,14 @@ async fn handle_container_exec_user_approved_records_tool_decision() {
 
 #[tokio::test]
 #[traced_test]
-async fn handle_container_exec_user_approved_for_session_records_tool_decision() {
+async fn handle_shell_command_user_approved_for_session_records_tool_decision() {
     let server = start_mock_server().await;
+    let command = touch_command("codex-otel-approval-test");
 
     mount_sse_once(
         &server,
         sse(vec![
-            ev_local_shell_call(
-                "user_approved_session_call",
-                "completed",
-                vec!["/usr/bin/touch", "codex-otel-approval-test"],
-            ),
+            shell_command_call("user_approved_session_call", &command),
             ev_completed("done"),
         ]),
     )
@@ -1334,7 +1274,7 @@ async fn handle_container_exec_user_approved_for_session_records_tool_decision()
     mount_sse_once(
         &server,
         sse(vec![
-            ev_assistant_message("msg-1", "local shell done"),
+            ev_assistant_message("msg-1", "shell command done"),
             ev_completed("done"),
         ]),
     )
@@ -1358,6 +1298,7 @@ async fn handle_container_exec_user_approved_for_session_records_tool_decision()
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -1390,15 +1331,12 @@ async fn handle_container_exec_user_approved_for_session_records_tool_decision()
 #[traced_test]
 async fn handle_sandbox_error_user_approves_retry_records_tool_decision() {
     let server = start_mock_server().await;
+    let command = touch_command("codex-otel-approval-test");
 
     mount_sse_once(
         &server,
         sse(vec![
-            ev_local_shell_call(
-                "sandbox_retry_call",
-                "completed",
-                vec!["/usr/bin/touch", "codex-otel-approval-test"],
-            ),
+            shell_command_call("sandbox_retry_call", &command),
             ev_completed("done"),
         ]),
     )
@@ -1406,7 +1344,7 @@ async fn handle_sandbox_error_user_approves_retry_records_tool_decision() {
     mount_sse_once(
         &server,
         sse(vec![
-            ev_assistant_message("msg-1", "local shell done"),
+            ev_assistant_message("msg-1", "shell command done"),
             ev_completed("done"),
         ]),
     )
@@ -1430,6 +1368,7 @@ async fn handle_sandbox_error_user_approves_retry_records_tool_decision() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -1460,17 +1399,14 @@ async fn handle_sandbox_error_user_approves_retry_records_tool_decision() {
 
 #[tokio::test]
 #[traced_test]
-async fn handle_container_exec_user_denies_records_tool_decision() {
+async fn handle_shell_command_user_denies_records_tool_decision() {
     let server = start_mock_server().await;
+    let command = touch_command("codex-otel-approval-test");
 
     mount_sse_once(
         &server,
         sse(vec![
-            ev_local_shell_call(
-                "user_denied_call",
-                "completed",
-                vec!["/usr/bin/touch", "codex-otel-approval-test"],
-            ),
+            shell_command_call("user_denied_call", &command),
             ev_completed("done"),
         ]),
     )
@@ -1479,7 +1415,7 @@ async fn handle_container_exec_user_denies_records_tool_decision() {
     mount_sse_once(
         &server,
         sse(vec![
-            ev_assistant_message("msg-1", "local shell done"),
+            ev_assistant_message("msg-1", "shell command done"),
             ev_completed("done"),
         ]),
     )
@@ -1502,6 +1438,7 @@ async fn handle_container_exec_user_denies_records_tool_decision() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -1534,15 +1471,12 @@ async fn handle_container_exec_user_denies_records_tool_decision() {
 #[traced_test]
 async fn handle_sandbox_error_user_approves_for_session_records_tool_decision() {
     let server = start_mock_server().await;
+    let command = touch_command("codex-otel-approval-test");
 
     mount_sse_once(
         &server,
         sse(vec![
-            ev_local_shell_call(
-                "sandbox_session_call",
-                "completed",
-                vec!["/usr/bin/touch", "codex-otel-approval-test"],
-            ),
+            shell_command_call("sandbox_session_call", &command),
             ev_completed("done"),
         ]),
     )
@@ -1550,7 +1484,7 @@ async fn handle_sandbox_error_user_approves_for_session_records_tool_decision()
     mount_sse_once(
         &server,
         sse(vec![
-            ev_assistant_message("msg-1", "local shell done"),
+            ev_assistant_message("msg-1", "shell command done"),
             ev_completed("done"),
         ]),
     )
@@ -1574,6 +1508,7 @@ async fn handle_sandbox_error_user_approves_for_session_records_tool_decision()
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -1606,15 +1541,12 @@ async fn handle_sandbox_error_user_approves_for_session_records_tool_decision()
 #[traced_test]
 async fn handle_sandbox_error_user_denies_records_tool_decision() {
     let server = start_mock_server().await;
+    let command = touch_command("codex-otel-approval-test");
 
     mount_sse_once(
         &server,
         sse(vec![
-            ev_local_shell_call(
-                "sandbox_deny_call",
-                "completed",
-                vec!["/usr/bin/touch", "codex-otel-approval-test"],
-            ),
+            shell_command_call("sandbox_deny_call", &command),
             ev_completed("done"),
         ]),
     )
@@ -1623,7 +1555,7 @@ async fn handle_sandbox_error_user_denies_records_tool_decision() {
     mount_sse_once(
         &server,
         sse(vec![
-            ev_assistant_message("msg-1", "local shell done"),
+            ev_assistant_message("msg-1", "shell command done"),
             ev_completed("done"),
         ]),
     )
@@ -1647,6 +1579,7 @@ async fn handle_sandbox_error_user_denies_records_tool_decision() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
diff --git a/codex-rs/core/tests/suite/override_updates.rs b/codex-rs/core/tests/suite/override_updates.rs
index d0e949947a..ce7c87a93b 100644
--- a/codex-rs/core/tests/suite/override_updates.rs
+++ b/codex-rs/core/tests/suite/override_updates.rs
@@ -24,7 +24,7 @@ fn collab_mode_with_instructions(instructions: Option<&str>) -> CollaborationMod
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn override_turn_context_without_user_turn_does_not_record_permissions_update() -> Result<()>
+async fn thread_settings_update_without_user_turn_does_not_record_permissions_update() -> Result<()>
 {
     skip_if_no_network!(Ok(()));
 
@@ -34,22 +34,14 @@ async fn override_turn_context_without_user_turn_does_not_record_permissions_upd
     });
     let test = builder.build(&server).await?;
 
-    test.codex
-        .submit(Op::OverrideTurnContext {
-            cwd: None,
+    core_test_support::submit_thread_settings(
+        &test.codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             approval_policy: Some(AskForApproval::Never),
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
-            model: None,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
-        })
-        .await?;
+            ..Default::default()
+        },
+    )
+    .await?;
 
     test.codex.submit(Op::Shutdown).await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::ShutdownComplete)).await;
@@ -64,7 +56,7 @@ async fn override_turn_context_without_user_turn_does_not_record_permissions_upd
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn override_turn_context_without_user_turn_does_not_record_environment_update() -> Result<()>
+async fn thread_settings_update_without_user_turn_does_not_record_environment_update() -> Result<()>
 {
     skip_if_no_network!(Ok(()));
 
@@ -72,22 +64,14 @@ async fn override_turn_context_without_user_turn_does_not_record_environment_upd
     let test = test_codex().build(&server).await?;
     let new_cwd = TempDir::new()?;
 
-    test.codex
-        .submit(Op::OverrideTurnContext {
+    core_test_support::submit_thread_settings(
+        &test.codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             cwd: Some(new_cwd.path().to_path_buf()),
-            approval_policy: None,
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
-            model: None,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
-        })
-        .await?;
+            ..Default::default()
+        },
+    )
+    .await?;
 
     test.codex.submit(Op::Shutdown).await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::ShutdownComplete)).await;
@@ -102,8 +86,8 @@ async fn override_turn_context_without_user_turn_does_not_record_environment_upd
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn override_turn_context_without_user_turn_does_not_record_collaboration_update() -> Result<()>
-{
+async fn thread_settings_update_without_user_turn_does_not_record_collaboration_update()
+-> Result<()> {
     skip_if_no_network!(Ok(()));
 
     let server = start_mock_server().await;
@@ -111,22 +95,14 @@ async fn override_turn_context_without_user_turn_does_not_record_collaboration_u
     let collab_text = "override collaboration instructions";
     let collaboration_mode = collab_mode_with_instructions(Some(collab_text));
 
-    test.codex
-        .submit(Op::OverrideTurnContext {
-            cwd: None,
-            approval_policy: None,
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
-            model: None,
-            effort: None,
-            summary: None,
-            service_tier: None,
+    core_test_support::submit_thread_settings(
+        &test.codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             collaboration_mode: Some(collaboration_mode),
-            personality: None,
-        })
-        .await?;
+            ..Default::default()
+        },
+    )
+    .await?;
 
     test.codex.submit(Op::Shutdown).await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::ShutdownComplete)).await;
diff --git a/codex-rs/core/tests/suite/pending_input.rs b/codex-rs/core/tests/suite/pending_input.rs
index 62851c515d..b057b86171 100644
--- a/codex-rs/core/tests/suite/pending_input.rs
+++ b/codex-rs/core/tests/suite/pending_input.rs
@@ -103,6 +103,7 @@ async fn submit_user_input(codex: &CodexThread, text: &str) {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap_or_else(|err| panic!("submit user input: {err}"));
@@ -112,24 +113,29 @@ async fn submit_danger_full_access_user_turn(test: &TestCodex, text: &str) {
     let (sandbox_policy, permission_profile) =
         turn_permission_fields(PermissionProfile::Disabled, test.config.cwd.as_path());
     test.codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: text.to_string(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd: test.config.cwd.to_path_buf(),
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy,
-            permission_profile,
-            model: test.session_configured.model.clone(),
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(test.config.cwd.to_path_buf()),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: test.session_configured.model.clone(),
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await
         .unwrap_or_else(|err| panic!("submit user turn: {err}"));
@@ -285,6 +291,7 @@ async fn injected_user_input_triggers_follow_up_request_with_deltas() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -303,6 +310,7 @@ async fn injected_user_input_triggers_follow_up_request_with_deltas() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
diff --git a/codex-rs/core/tests/suite/permissions_messages.rs b/codex-rs/core/tests/suite/permissions_messages.rs
index 4d6259a599..b77e65c0f5 100644
--- a/codex-rs/core/tests/suite/permissions_messages.rs
+++ b/codex-rs/core/tests/suite/permissions_messages.rs
@@ -58,6 +58,7 @@ async fn permissions_message_sent_once_on_start() -> Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -97,26 +98,19 @@ async fn permissions_message_added_on_override_change() -> Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
 
-    test.codex
-        .submit(Op::OverrideTurnContext {
-            cwd: None,
+    core_test_support::submit_thread_settings(
+        &test.codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             approval_policy: Some(AskForApproval::Never),
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
-            model: None,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
-        })
-        .await?;
+            ..Default::default()
+        },
+    )
+    .await?;
 
     test.codex
         .submit(Op::UserInput {
@@ -127,6 +121,7 @@ async fn permissions_message_added_on_override_change() -> Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -172,6 +167,7 @@ async fn permissions_message_not_added_when_no_change() -> Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -185,6 +181,7 @@ async fn permissions_message_not_added_when_no_change() -> Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -230,26 +227,19 @@ async fn permissions_message_omitted_when_disabled() -> Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
 
-    test.codex
-        .submit(Op::OverrideTurnContext {
-            cwd: None,
+    core_test_support::submit_thread_settings(
+        &test.codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             approval_policy: Some(AskForApproval::Never),
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
-            model: None,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
-        })
-        .await?;
+            ..Default::default()
+        },
+    )
+    .await?;
 
     test.codex
         .submit(Op::UserInput {
@@ -260,6 +250,7 @@ async fn permissions_message_omitted_when_disabled() -> Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -318,27 +309,19 @@ async fn resume_replays_permissions_messages() -> Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&initial.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
 
-    initial
-        .codex
-        .submit(Op::OverrideTurnContext {
-            cwd: None,
+    core_test_support::submit_thread_settings(
+        &initial.codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             approval_policy: Some(AskForApproval::Never),
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
-            model: None,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
-        })
-        .await?;
+            ..Default::default()
+        },
+    )
+    .await?;
 
     initial
         .codex
@@ -350,6 +333,7 @@ async fn resume_replays_permissions_messages() -> Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&initial.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -365,6 +349,7 @@ async fn resume_replays_permissions_messages() -> Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&resumed.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -424,27 +409,19 @@ async fn resume_and_fork_append_permissions_messages() -> Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&initial.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
 
-    initial
-        .codex
-        .submit(Op::OverrideTurnContext {
-            cwd: None,
+    core_test_support::submit_thread_settings(
+        &initial.codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             approval_policy: Some(AskForApproval::Never),
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
-            model: None,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
-        })
-        .await?;
+            ..Default::default()
+        },
+    )
+    .await?;
 
     initial
         .codex
@@ -456,6 +433,7 @@ async fn resume_and_fork_append_permissions_messages() -> Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&initial.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -477,6 +455,7 @@ async fn resume_and_fork_append_permissions_messages() -> Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&resumed.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -512,6 +491,7 @@ async fn resume_and_fork_append_permissions_messages() -> Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&forked.thread, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -542,8 +522,9 @@ async fn permissions_message_includes_writable_roots() -> Result<()> {
     .await;
     let writable = TempDir::new()?;
     let writable_root = AbsolutePathBuf::try_from(writable.path())?;
+    let writable_root_for_config = writable_root.clone();
     let permission_profile = PermissionProfile::workspace_write_with(
-        &[writable_root],
+        std::slice::from_ref(&writable_root),
         NetworkSandboxPolicy::Restricted,
         /*exclude_tmpdir_env_var*/ false,
         /*exclude_slash_tmp*/ false,
@@ -555,6 +536,9 @@ async fn permissions_message_includes_writable_roots() -> Result<()> {
             .permissions
             .set_permission_profile(permission_profile)
             .expect("test permission profile should be allowed");
+        let workspace_roots = vec![config.cwd.clone(), writable_root_for_config];
+        config.workspace_roots = workspace_roots.clone();
+        config.permissions.set_workspace_roots(workspace_roots);
         config.config_layer_stack = ConfigLayerStack::default();
     });
     let test = builder.build(&server).await?;
@@ -568,6 +552,7 @@ async fn permissions_message_includes_writable_roots() -> Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -575,9 +560,9 @@ async fn permissions_message_includes_writable_roots() -> Result<()> {
     let permissions = permissions_texts(&req.single_request());
     let normalize_line_endings = |s: &str| s.replace("\r\n", "\n");
     let exec_policy = load_exec_policy(&test.config.config_layer_stack).await?;
-    let sandbox_policy = test.config.legacy_sandbox_policy();
-    let expected = PermissionsInstructions::from_policy(
-        &sandbox_policy,
+    let permission_profile = test.config.permissions.effective_permission_profile();
+    let expected = PermissionsInstructions::from_permission_profile(
+        &permission_profile,
         AskForApproval::OnRequest,
         test.config.approvals_reviewer,
         &exec_policy,
diff --git a/codex-rs/core/tests/suite/personality.rs b/codex-rs/core/tests/suite/personality.rs
index 09eb61fa69..bbe8178f8d 100644
--- a/codex-rs/core/tests/suite/personality.rs
+++ b/codex-rs/core/tests/suite/personality.rs
@@ -60,24 +60,30 @@ fn read_only_text_turn_with_personality(
 ) -> Op {
     let (sandbox_policy, permission_profile) =
         turn_permission_fields(PermissionProfile::read_only(), test.cwd_path());
-    Op::UserTurn {
-        environments: None,
+    Op::UserInput {
         items: vec![UserInput::Text {
             text: text.into(),
             text_elements: Vec::new(),
         }],
+        environments: None,
         final_output_json_schema: None,
-        cwd: test.cwd_path().to_path_buf(),
-        approval_policy,
-        approvals_reviewer: None,
-        sandbox_policy,
-        permission_profile,
-        model,
-        effort: test.config.model_reasoning_effort,
-        summary: None,
-        service_tier: None,
-        collaboration_mode: None,
-        personality,
+        responsesapi_client_metadata: None,
+        thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+            cwd: Some(test.cwd_path().to_path_buf()),
+            approval_policy: Some(approval_policy),
+            sandbox_policy: Some(sandbox_policy),
+            permission_profile,
+            personality,
+            collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                mode: codex_protocol::config_types::ModeKind::Default,
+                settings: codex_protocol::config_types::Settings {
+                    model,
+                    reasoning_effort: test.config.model_reasoning_effort,
+                    developer_instructions: None,
+                },
+            }),
+            ..Default::default()
+        },
     }
 }
 
@@ -327,22 +333,14 @@ async fn user_turn_personality_some_adds_update_message() -> anyhow::Result<()>
 
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
 
-    test.codex
-        .submit(Op::OverrideTurnContext {
-            cwd: None,
-            approval_policy: None,
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
-            model: None,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
+    core_test_support::submit_thread_settings(
+        &test.codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             personality: Some(Personality::Friendly),
-        })
-        .await?;
+            ..Default::default()
+        },
+    )
+    .await?;
 
     test.codex
         .submit(read_only_text_turn(
@@ -411,22 +409,14 @@ async fn user_turn_personality_same_value_does_not_add_update_message() -> anyho
 
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
 
-    test.codex
-        .submit(Op::OverrideTurnContext {
-            cwd: None,
-            approval_policy: None,
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
-            model: None,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
+    core_test_support::submit_thread_settings(
+        &test.codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             personality: Some(Personality::Pragmatic),
-        })
-        .await?;
+            ..Default::default()
+        },
+    )
+    .await?;
 
     test.codex
         .submit(read_only_text_turn(
@@ -508,22 +498,14 @@ async fn user_turn_personality_skips_if_feature_disabled() -> anyhow::Result<()>
 
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
 
-    test.codex
-        .submit(Op::OverrideTurnContext {
-            cwd: None,
-            approval_policy: None,
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
-            model: None,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
+    core_test_support::submit_thread_settings(
+        &test.codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             personality: Some(Personality::Pragmatic),
-        })
-        .await?;
+            ..Default::default()
+        },
+    )
+    .await?;
 
     test.codex
         .submit(read_only_text_turn(
@@ -757,22 +739,14 @@ async fn user_turn_personality_remote_model_template_includes_update_message() -
 
     wait_for_event(&test.codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
 
-    test.codex
-        .submit(Op::OverrideTurnContext {
-            cwd: None,
-            approval_policy: None,
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
-            model: None,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
+    core_test_support::submit_thread_settings(
+        &test.codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             personality: Some(Personality::Friendly),
-        })
-        .await?;
+            ..Default::default()
+        },
+    )
+    .await?;
 
     test.codex
         .submit(read_only_text_turn(
diff --git a/codex-rs/core/tests/suite/personality_migration.rs b/codex-rs/core/tests/suite/personality_migration.rs
index 0b89a9cfba..5151d4e55d 100644
--- a/codex-rs/core/tests/suite/personality_migration.rs
+++ b/codex-rs/core/tests/suite/personality_migration.rs
@@ -88,6 +88,7 @@ async fn write_rollout_with_user_event(dir: &Path, thread_id: ThreadId) -> io::R
             images: None,
             local_images: Vec::new(),
             text_elements: Vec::new(),
+            ..Default::default()
         })),
     };
 
diff --git a/codex-rs/core/tests/suite/plugins.rs b/codex-rs/core/tests/suite/plugins.rs
index 7b10db0259..45fdf3df07 100644
--- a/codex-rs/core/tests/suite/plugins.rs
+++ b/codex-rs/core/tests/suite/plugins.rs
@@ -227,6 +227,7 @@ async fn capability_sections_render_in_developer_message_in_order() -> Result<()
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
 
@@ -305,6 +306,7 @@ async fn explicit_plugin_mentions_inject_plugin_guidance() -> Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -386,6 +388,7 @@ async fn explicit_plugin_mentions_track_plugin_used_analytics() -> Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
diff --git a/codex-rs/core/tests/suite/prompt_caching.rs b/codex-rs/core/tests/suite/prompt_caching.rs
index 5b861ab219..a4b337f059 100644
--- a/codex-rs/core/tests/suite/prompt_caching.rs
+++ b/codex-rs/core/tests/suite/prompt_caching.rs
@@ -153,6 +153,7 @@ async fn prompt_tools_are_consistent_across_requests() -> anyhow::Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -166,6 +167,7 @@ async fn prompt_tools_are_consistent_across_requests() -> anyhow::Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -180,11 +182,7 @@ async fn prompt_tools_are_consistent_across_requests() -> anyhow::Result<()> {
         "request_user_input",
         "apply_patch",
         "view_image",
-        "spawn_agent",
-        "send_input",
-        "resume_agent",
-        "wait_agent",
-        "close_agent",
+        "tool_search",
         "web_search",
     ]);
     let body0 = req1.single_request().body_json();
@@ -231,10 +229,6 @@ async fn gpt_5_tools_without_apply_patch_append_apply_patch_instructions() -> an
     let TestCodex { codex, .. } = test_codex()
         .with_config(|config| {
             config.user_instructions = Some("be consistent and helpful".to_string());
-            config
-                .features
-                .disable(Feature::ApplyPatchFreeform)
-                .expect("test config should allow feature update");
             config
                 .features
                 .enable(Feature::CollaborationModes)
@@ -253,6 +247,7 @@ async fn gpt_5_tools_without_apply_patch_append_apply_patch_instructions() -> an
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
 
@@ -266,6 +261,7 @@ async fn gpt_5_tools_without_apply_patch_append_apply_patch_instructions() -> an
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
 
@@ -330,6 +326,7 @@ async fn prefixes_context_and_instructions_once_and_consistently_across_requests
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -343,6 +340,7 @@ async fn prefixes_context_and_instructions_once_and_consistently_across_requests
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -425,6 +423,7 @@ async fn overrides_turn_context_but_keeps_cached_prefix_and_key_constant() -> an
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -439,22 +438,18 @@ async fn overrides_turn_context_but_keeps_cached_prefix_and_key_constant() -> an
     let sandbox_policy = permission_profile
         .to_legacy_sandbox_policy(config.cwd.as_path())
         .expect("workspace profile should have legacy projection");
-    codex
-        .submit(Op::OverrideTurnContext {
-            cwd: None,
+    core_test_support::submit_thread_settings(
+        &codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             approval_policy: Some(AskForApproval::Never),
-            approvals_reviewer: None,
             sandbox_policy: Some(sandbox_policy),
             permission_profile: Some(permission_profile),
-            windows_sandbox_level: None,
-            model: None,
             effort: Some(Some(ReasoningEffort::High)),
             summary: Some(ReasoningSummary::Detailed),
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
-        })
-        .await?;
+            ..Default::default()
+        },
+    )
+    .await?;
 
     // Second turn after overrides
     codex
@@ -466,6 +461,7 @@ async fn overrides_turn_context_but_keeps_cached_prefix_and_key_constant() -> an
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -489,7 +485,7 @@ async fn overrides_turn_context_but_keeps_cached_prefix_and_key_constant() -> an
     });
     let expected_permissions_msg = body1["input"][0].clone();
     let body1_input = body1["input"].as_array().expect("input array");
-    // After overriding the turn context, emit one updated permissions message.
+    // After overriding the thread settings, emit one updated permissions message.
     let expected_permissions_msg_2 = body2["input"][body1_input.len()].clone();
     assert_ne!(
         expected_permissions_msg_2, expected_permissions_msg,
@@ -525,22 +521,17 @@ async fn override_before_first_turn_emits_environment_context() -> anyhow::Resul
         },
     };
 
-    codex
-        .submit(Op::OverrideTurnContext {
-            cwd: None,
+    core_test_support::submit_thread_settings(
+        &codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             approval_policy: Some(AskForApproval::Never),
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
             model: Some("gpt-5.4".to_string()),
             effort: Some(Some(ReasoningEffort::Low)),
-            summary: None,
-            service_tier: None,
             collaboration_mode: Some(collaboration_mode),
-            personality: None,
-        })
-        .await?;
+            ..Default::default()
+        },
+    )
+    .await?;
 
     codex
         .submit(Op::UserInput {
@@ -551,6 +542,7 @@ async fn override_before_first_turn_emits_environment_context() -> anyhow::Resul
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
 
@@ -704,11 +696,12 @@ async fn per_turn_overrides_keep_cached_prefix_and_key_constant() -> anyhow::Res
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
 
-    // Second turn using per-turn overrides via UserTurn
+    // Second turn using per-turn thread-settings overrides.
     let new_cwd = TempDir::new().unwrap();
     let writable = TempDir::new().unwrap();
     let permission_profile = PermissionProfile::workspace_write_with(
@@ -720,24 +713,24 @@ async fn per_turn_overrides_keep_cached_prefix_and_key_constant() -> anyhow::Res
     let (sandbox_policy, permission_profile) =
         turn_permission_fields(permission_profile, new_cwd.path());
     codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "hello 2".into(),
                 text_elements: Vec::new(),
             }],
-            cwd: new_cwd.path().to_path_buf(),
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy,
-            permission_profile,
-            model: "o3".to_string(),
-            effort: Some(ReasoningEffort::High),
-            summary: Some(ReasoningSummary::Detailed),
-            service_tier: None,
-            collaboration_mode: None,
+            environments: None,
             final_output_json_schema: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(new_cwd.path().to_path_buf()),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                model: Some("o3".to_string()),
+                effort: Some(Some(ReasoningEffort::High)),
+                summary: Some(ReasoningSummary::Detailed),
+                ..Default::default()
+            },
         })
         .await?;
     wait_for_event(&codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -834,47 +827,57 @@ async fn send_user_turn_with_no_changes_does_not_send_environment_context() -> a
     let default_summary = config.model_reasoning_summary;
 
     codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "hello 1".into(),
                 text_elements: Vec::new(),
             }],
-            cwd: default_cwd.to_path_buf(),
-            approval_policy: default_approval_policy,
-            approvals_reviewer: None,
-            sandbox_policy: default_sandbox_policy.clone(),
-            permission_profile: None,
-            model: default_model.clone(),
-            effort: default_effort,
-            summary: Some(default_summary.unwrap_or(ReasoningSummary::Auto)),
-            service_tier: None,
-            collaboration_mode: None,
+            environments: None,
             final_output_json_schema: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(default_cwd.to_path_buf()),
+                approval_policy: Some(default_approval_policy),
+                sandbox_policy: Some(default_sandbox_policy.clone()),
+                summary: Some(default_summary.unwrap_or(ReasoningSummary::Auto)),
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: default_model.clone(),
+                        reasoning_effort: default_effort,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
     wait_for_event(&codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
 
     codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "hello 2".into(),
                 text_elements: Vec::new(),
             }],
-            cwd: default_cwd.to_path_buf(),
-            approval_policy: default_approval_policy,
-            approvals_reviewer: None,
-            sandbox_policy: default_sandbox_policy.clone(),
-            permission_profile: None,
-            model: default_model.clone(),
-            effort: default_effort,
-            summary: Some(default_summary.unwrap_or(ReasoningSummary::Auto)),
-            service_tier: None,
-            collaboration_mode: None,
+            environments: None,
             final_output_json_schema: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(default_cwd.to_path_buf()),
+                approval_policy: Some(default_approval_policy),
+                sandbox_policy: Some(default_sandbox_policy.clone()),
+                summary: Some(default_summary.unwrap_or(ReasoningSummary::Auto)),
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: default_model.clone(),
+                        reasoning_effort: default_effort,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
     wait_for_event(&codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -963,24 +966,29 @@ async fn send_user_turn_with_changes_sends_environment_context() -> anyhow::Resu
     let default_summary = config.model_reasoning_summary;
 
     codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "hello 1".into(),
                 text_elements: Vec::new(),
             }],
-            cwd: default_cwd.to_path_buf(),
-            approval_policy: default_approval_policy,
-            approvals_reviewer: None,
-            sandbox_policy: default_sandbox_policy.clone(),
-            permission_profile: None,
-            model: default_model,
-            effort: default_effort,
-            summary: Some(default_summary.unwrap_or(ReasoningSummary::Auto)),
-            service_tier: None,
-            collaboration_mode: None,
+            environments: None,
             final_output_json_schema: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(default_cwd.to_path_buf()),
+                approval_policy: Some(default_approval_policy),
+                sandbox_policy: Some(default_sandbox_policy.clone()),
+                summary: Some(default_summary.unwrap_or(ReasoningSummary::Auto)),
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: default_model,
+                        reasoning_effort: default_effort,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
     wait_for_event(&codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
@@ -988,24 +996,30 @@ async fn send_user_turn_with_changes_sends_environment_context() -> anyhow::Resu
     let (sandbox_policy, permission_profile) =
         turn_permission_fields(PermissionProfile::Disabled, default_cwd.as_path());
     codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "hello 2".into(),
                 text_elements: Vec::new(),
             }],
-            cwd: default_cwd.to_path_buf(),
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy,
-            permission_profile,
-            model: "o3".to_string(),
-            effort: Some(ReasoningEffort::High),
-            summary: Some(ReasoningSummary::Detailed),
-            service_tier: None,
-            collaboration_mode: None,
+            environments: None,
             final_output_json_schema: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(default_cwd.to_path_buf()),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                summary: Some(ReasoningSummary::Detailed),
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: "o3".to_string(),
+                        reasoning_effort: Some(ReasoningEffort::High),
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
     wait_for_event(&codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
diff --git a/codex-rs/core/tests/suite/quota_exceeded.rs b/codex-rs/core/tests/suite/quota_exceeded.rs
index 4c0677e69a..413855f641 100644
--- a/codex-rs/core/tests/suite/quota_exceeded.rs
+++ b/codex-rs/core/tests/suite/quota_exceeded.rs
@@ -48,6 +48,7 @@ async fn quota_exceeded_emits_single_error_event() -> Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
diff --git a/codex-rs/core/tests/suite/realtime_conversation.rs b/codex-rs/core/tests/suite/realtime_conversation.rs
index 31d30d824e..232d2380b0 100644
--- a/codex-rs/core/tests/suite/realtime_conversation.rs
+++ b/codex-rs/core/tests/suite/realtime_conversation.rs
@@ -2168,6 +2168,7 @@ async fn conversation_user_text_turn_is_sent_to_realtime_when_active() -> Result
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
 
@@ -2302,6 +2303,7 @@ async fn conversation_user_text_turn_is_capped_when_mirrored_to_realtime() -> Re
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
 
@@ -3497,6 +3499,7 @@ async fn inbound_handoff_request_steers_active_turn() -> Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
 
diff --git a/codex-rs/core/tests/suite/remote_env.rs b/codex-rs/core/tests/suite/remote_env.rs
index dc6d5cefc5..873796ff6c 100644
--- a/codex-rs/core/tests/suite/remote_env.rs
+++ b/codex-rs/core/tests/suite/remote_env.rs
@@ -58,7 +58,7 @@ async fn unified_exec_test(server: &wiremock::MockServer) -> Result<TestCodex> {
             "unified exec should enable for test: {result:?}",
         );
     });
-    builder.build_remote_aware(server).await
+    builder.build_with_remote_and_local_env(server).await
 }
 
 async fn submit_turn_with_approval_and_environments(
@@ -67,24 +67,29 @@ async fn submit_turn_with_approval_and_environments(
     environments: Vec<TurnEnvironmentSelection>,
 ) -> Result<()> {
     test.codex
-        .submit(Op::UserTurn {
-            environments: Some(environments),
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: prompt.into(),
                 text_elements: Vec::new(),
             }],
+            environments: Some(environments),
             final_output_json_schema: None,
-            cwd: test.cwd.path().to_path_buf(),
-            approval_policy: AskForApproval::OnRequest,
-            approvals_reviewer: Some(ApprovalsReviewer::User),
-            sandbox_policy: SandboxPolicy::new_workspace_write_policy(),
-            permission_profile: None,
-            model: test.session_configured.model.clone(),
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(test.cwd.path().to_path_buf()),
+                approval_policy: Some(AskForApproval::OnRequest),
+                approvals_reviewer: Some(ApprovalsReviewer::User),
+                sandbox_policy: Some(SandboxPolicy::new_read_only_policy()),
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: test.session_configured.model.clone(),
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
 
@@ -347,10 +352,8 @@ async fn apply_patch_freeform_routes_to_selected_remote_environment() -> Result<
     };
 
     let server = start_mock_server().await;
-    let mut builder = test_codex().with_config(|config| {
-        config.include_apply_patch_tool = true;
-    });
-    let test = builder.build_remote_aware(&server).await?;
+    let mut builder = test_codex();
+    let test = builder.build_with_remote_and_local_env(&server).await?;
     let local_cwd = TempDir::new()?;
     let file_name = "apply_patch_remote_freeform.txt";
     let remote_cwd = PathBuf::from(format!(
@@ -435,11 +438,10 @@ async fn apply_patch_approvals_are_remembered_per_environment() -> Result<()> {
 
     let server = start_mock_server().await;
     let mut builder = test_codex().with_config(|config| {
-        config.include_apply_patch_tool = true;
         config.permissions.approval_policy = Constrained::allow_any(AskForApproval::OnRequest);
         config.approvals_reviewer = ApprovalsReviewer::User;
     });
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_and_local_env(&server).await?;
     let local_cwd = TempDir::new()?;
     let remote_cwd = PathBuf::from(format!(
         "/tmp/codex-remote-apply-patch-approval-cwd-{}",
diff --git a/codex-rs/core/tests/suite/remote_models.rs b/codex-rs/core/tests/suite/remote_models.rs
index d1caf24836..e143cb8e3e 100644
--- a/codex-rs/core/tests/suite/remote_models.rs
+++ b/codex-rs/core/tests/suite/remote_models.rs
@@ -142,9 +142,7 @@ async fn remote_models_config_context_window_override_clamps_to_max_context_wind
     )
     .await;
 
-    let TestCodex {
-        codex, cwd, config, ..
-    } = test_codex()
+    let TestCodex { codex, .. } = test_codex()
         .with_auth(CodexAuth::create_dummy_chatgpt_auth_for_testing())
         .with_config(|config| {
             config.model = Some(requested_model.to_string());
@@ -154,24 +152,15 @@ async fn remote_models_config_context_window_override_clamps_to_max_context_wind
         .await?;
 
     codex
-        .submit(Op::UserTurn {
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "check context window".into(),
                 text_elements: Vec::new(),
             }],
-            final_output_json_schema: None,
-            cwd: cwd.path().to_path_buf(),
-            approval_policy: config.permissions.approval_policy.value(),
-            approvals_reviewer: None,
-            sandbox_policy: config.legacy_sandbox_policy(),
-            model: requested_model.to_string(),
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            permission_profile: None,
-            personality: None,
             environments: None,
+            final_output_json_schema: None,
+            responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
 
@@ -220,9 +209,7 @@ async fn remote_models_config_override_above_max_uses_max_context_window() -> Re
     )
     .await;
 
-    let TestCodex {
-        codex, cwd, config, ..
-    } = test_codex()
+    let TestCodex { codex, .. } = test_codex()
         .with_auth(CodexAuth::create_dummy_chatgpt_auth_for_testing())
         .with_config(|config| {
             config.model = Some(requested_model.to_string());
@@ -232,24 +219,15 @@ async fn remote_models_config_override_above_max_uses_max_context_window() -> Re
         .await?;
 
     codex
-        .submit(Op::UserTurn {
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "check context window".into(),
                 text_elements: Vec::new(),
             }],
-            final_output_json_schema: None,
-            cwd: cwd.path().to_path_buf(),
-            approval_policy: config.permissions.approval_policy.value(),
-            approvals_reviewer: None,
-            sandbox_policy: config.legacy_sandbox_policy(),
-            model: requested_model.to_string(),
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            permission_profile: None,
-            personality: None,
             environments: None,
+            final_output_json_schema: None,
+            responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
 
@@ -298,9 +276,7 @@ async fn remote_models_use_context_window_when_config_override_is_absent() -> Re
     )
     .await;
 
-    let TestCodex {
-        codex, cwd, config, ..
-    } = test_codex()
+    let TestCodex { codex, .. } = test_codex()
         .with_auth(CodexAuth::create_dummy_chatgpt_auth_for_testing())
         .with_config(|config| {
             config.model = Some(requested_model.to_string());
@@ -309,24 +285,15 @@ async fn remote_models_use_context_window_when_config_override_is_absent() -> Re
         .await?;
 
     codex
-        .submit(Op::UserTurn {
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "check context window".into(),
                 text_elements: Vec::new(),
             }],
-            final_output_json_schema: None,
-            cwd: cwd.path().to_path_buf(),
-            approval_policy: config.permissions.approval_policy.value(),
-            approvals_reviewer: None,
-            sandbox_policy: config.legacy_sandbox_policy(),
-            model: requested_model.to_string(),
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            permission_profile: None,
-            personality: None,
             environments: None,
+            final_output_json_schema: None,
+            responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
 
@@ -388,9 +355,7 @@ async fn remote_models_long_model_slug_is_sent_with_high_reasoning() -> Result<(
     )
     .await;
 
-    let TestCodex {
-        codex, cwd, config, ..
-    } = test_codex()
+    let TestCodex { codex, .. } = test_codex()
         .with_auth(CodexAuth::create_dummy_chatgpt_auth_for_testing())
         .with_config(|config| {
             config.model = Some(requested_model.to_string());
@@ -399,24 +364,15 @@ async fn remote_models_long_model_slug_is_sent_with_high_reasoning() -> Result<(
         .await?;
 
     codex
-        .submit(Op::UserTurn {
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "check model slug".into(),
                 text_elements: Vec::new(),
             }],
-            final_output_json_schema: None,
-            cwd: cwd.path().to_path_buf(),
-            approval_policy: config.permissions.approval_policy.value(),
-            approvals_reviewer: None,
-            sandbox_policy: config.legacy_sandbox_policy(),
-            permission_profile: None,
-            model: requested_model.to_string(),
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
             environments: None,
+            final_output_json_schema: None,
+            responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
 
@@ -452,36 +408,21 @@ async fn namespaced_model_slug_uses_catalog_metadata_without_fallback_warning()
     )
     .await;
 
-    let TestCodex {
-        codex, cwd, config, ..
-    } = test_codex()
+    let TestCodex { codex, .. } = test_codex()
         .with_model(requested_model)
         .build(&server)
         .await?;
 
     codex
-        .submit(Op::UserTurn {
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "check namespaced model metadata".into(),
                 text_elements: Vec::new(),
             }],
-            final_output_json_schema: None,
-            cwd: cwd.path().to_path_buf(),
-            approval_policy: config.permissions.approval_policy.value(),
-            approvals_reviewer: None,
-            sandbox_policy: config.legacy_sandbox_policy(),
-            permission_profile: None,
-            model: requested_model.to_string(),
-            effort: None,
-            summary: Some(
-                config
-                    .model_reasoning_summary
-                    .unwrap_or(ReasoningSummary::Auto),
-            ),
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
             environments: None,
+            final_output_json_schema: None,
+            responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
 
@@ -593,22 +534,14 @@ async fn remote_models_remote_model_uses_unified_exec() -> Result<()> {
         .await;
     assert_eq!(model_info.shell_type, ConfigShellToolType::UnifiedExec);
 
-    codex
-        .submit(Op::OverrideTurnContext {
-            cwd: None,
-            approval_policy: None,
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
+    core_test_support::submit_thread_settings(
+        &codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             model: Some(REMOTE_MODEL_SLUG.to_string()),
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
-        })
-        .await?;
+            ..Default::default()
+        },
+    )
+    .await?;
 
     let call_id = "call";
     let args = json!({
@@ -633,24 +566,22 @@ async fn remote_models_remote_model_uses_unified_exec() -> Result<()> {
     let (sandbox_policy, permission_profile) =
         turn_permission_fields(PermissionProfile::Disabled, cwd_path.as_path());
     codex
-        .submit(Op::UserTurn {
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "run call".into(),
                 text_elements: Vec::new(),
             }],
-            final_output_json_schema: None,
-            cwd: cwd_path,
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy,
-            permission_profile,
-            model: REMOTE_MODEL_SLUG.to_string(),
-            effort: None,
-            summary: Some(ReasoningSummary::Auto),
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
             environments: None,
+            final_output_json_schema: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(cwd_path),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                summary: Some(ReasoningSummary::Auto),
+                ..Default::default()
+            },
         })
         .await?;
 
@@ -844,45 +775,35 @@ async fn remote_models_apply_remote_base_instructions() -> Result<()> {
     let models_manager = thread_manager.get_models_manager();
     wait_for_model_available(&models_manager, model).await;
 
-    codex
-        .submit(Op::OverrideTurnContext {
-            cwd: None,
-            approval_policy: None,
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
+    core_test_support::submit_thread_settings(
+        &codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             model: Some(model.to_string()),
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
-        })
-        .await?;
+            ..Default::default()
+        },
+    )
+    .await?;
 
     let cwd_path = cwd.path().to_path_buf();
     let (sandbox_policy, permission_profile) =
         turn_permission_fields(PermissionProfile::Disabled, cwd_path.as_path());
     codex
-        .submit(Op::UserTurn {
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "hello remote".into(),
                 text_elements: Vec::new(),
             }],
-            final_output_json_schema: None,
-            cwd: cwd_path,
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy,
-            permission_profile,
-            model: model.to_string(),
-            effort: None,
-            summary: Some(ReasoningSummary::Auto),
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
             environments: None,
+            final_output_json_schema: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(cwd_path),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                summary: Some(ReasoningSummary::Auto),
+                ..Default::default()
+            },
         })
         .await?;
 
diff --git a/codex-rs/core/tests/suite/request_compression.rs b/codex-rs/core/tests/suite/request_compression.rs
index fddb18f15b..2d66389d53 100644
--- a/codex-rs/core/tests/suite/request_compression.rs
+++ b/codex-rs/core/tests/suite/request_compression.rs
@@ -47,6 +47,7 @@ async fn request_body_is_zstd_compressed_for_codex_backend_when_enabled() -> any
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
 
@@ -96,6 +97,7 @@ async fn request_body_is_not_compressed_for_api_key_auth_even_when_enabled() ->
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
 
diff --git a/codex-rs/core/tests/suite/request_permissions.rs b/codex-rs/core/tests/suite/request_permissions.rs
index 455c1fabb9..9800104685 100644
--- a/codex-rs/core/tests/suite/request_permissions.rs
+++ b/codex-rs/core/tests/suite/request_permissions.rs
@@ -7,13 +7,14 @@ use codex_features::Feature;
 use codex_protocol::config_types::ApprovalsReviewer;
 use codex_protocol::models::AdditionalPermissionProfile as PermissionProfile;
 use codex_protocol::models::FileSystemPermissions;
+use codex_protocol::models::PermissionProfile as CorePermissionProfile;
+use codex_protocol::permissions::NetworkSandboxPolicy;
 use codex_protocol::protocol::AskForApproval;
 use codex_protocol::protocol::EventMsg;
 use codex_protocol::protocol::ExecApprovalRequestEvent;
 use codex_protocol::protocol::GranularApprovalConfig;
 use codex_protocol::protocol::Op;
 use codex_protocol::protocol::ReviewDecision;
-use codex_protocol::protocol::SandboxPolicy;
 use codex_protocol::request_permissions::PermissionGrantScope;
 use codex_protocol::request_permissions::RequestPermissionProfile;
 use codex_protocol::request_permissions::RequestPermissionsResponse;
@@ -31,6 +32,7 @@ use core_test_support::skip_if_no_network;
 use core_test_support::skip_if_sandbox;
 use core_test_support::test_codex::TestCodex;
 use core_test_support::test_codex::test_codex;
+use core_test_support::test_codex::turn_permission_fields;
 use core_test_support::wait_for_event;
 use pretty_assertions::assert_eq;
 use regex_lite::Regex;
@@ -182,28 +184,36 @@ async fn submit_turn(
     test: &TestCodex,
     prompt: &str,
     approval_policy: AskForApproval,
-    sandbox_policy: SandboxPolicy,
+    permission_profile: CorePermissionProfile,
 ) -> Result<()> {
     let session_model = test.session_configured.model.clone();
+    let (sandbox_policy, permission_profile) =
+        turn_permission_fields(permission_profile, test.cwd.path());
     test.codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: prompt.into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd: test.cwd.path().to_path_buf(),
-            approval_policy,
-            approvals_reviewer: Some(ApprovalsReviewer::User),
-            sandbox_policy,
-            permission_profile: None,
-            model: session_model,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(test.cwd.path().to_path_buf()),
+                approval_policy: Some(approval_policy),
+                approvals_reviewer: Some(ApprovalsReviewer::User),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: session_model,
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
     Ok(())
@@ -283,13 +293,13 @@ async fn expect_request_permissions_event(
     }
 }
 
-fn workspace_write_excluding_tmp() -> SandboxPolicy {
-    SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![],
-        network_access: false,
-        exclude_tmpdir_env_var: true,
-        exclude_slash_tmp: true,
-    }
+fn workspace_write_excluding_tmp() -> CorePermissionProfile {
+    CorePermissionProfile::workspace_write_with(
+        &[],
+        NetworkSandboxPolicy::Restricted,
+        /*exclude_tmpdir_env_var*/ true,
+        /*exclude_slash_tmp*/ true,
+    )
 }
 
 fn requested_directory_write_permissions(path: &Path) -> RequestPermissionProfile {
@@ -319,14 +329,15 @@ async fn with_additional_permissions_requires_approval_under_on_request() -> Res
 
     let server = start_mock_server().await;
     let approval_policy = AskForApproval::OnRequest;
-    let sandbox_policy = SandboxPolicy::new_read_only_policy();
-    let sandbox_policy_for_config = sandbox_policy.clone();
+    let permission_profile = CorePermissionProfile::read_only();
+    let permission_profile_for_config = CorePermissionProfile::read_only();
 
     let mut builder = test_codex().with_config(move |config| {
         config.permissions.approval_policy = Constrained::allow_any(approval_policy);
         config
-            .set_legacy_sandbox_policy(sandbox_policy_for_config)
-            .expect("set sandbox policy");
+            .permissions
+            .set_permission_profile(permission_profile_for_config)
+            .expect("set permission profile");
         config
             .features
             .enable(Feature::ExecPermissionApprovals)
@@ -372,7 +383,7 @@ async fn with_additional_permissions_requires_approval_under_on_request() -> Res
     )
     .await;
 
-    submit_turn(&test, call_id, approval_policy, sandbox_policy.clone()).await?;
+    submit_turn(&test, call_id, approval_policy, permission_profile.clone()).await?;
     let approval = expect_exec_approval(&test, command).await;
     assert_eq!(
         approval.additional_permissions,
@@ -416,14 +427,15 @@ async fn request_permissions_tool_is_auto_denied_when_granular_request_permissio
         request_permissions: false,
         mcp_elicitations: true,
     });
-    let sandbox_policy = SandboxPolicy::new_read_only_policy();
-    let sandbox_policy_for_config = sandbox_policy.clone();
+    let permission_profile = CorePermissionProfile::read_only();
+    let permission_profile_for_config = CorePermissionProfile::read_only();
 
     let mut builder = test_codex().with_config(move |config| {
         config.permissions.approval_policy = Constrained::allow_any(approval_policy);
         config
-            .set_legacy_sandbox_policy(sandbox_policy_for_config)
-            .expect("set sandbox policy");
+            .permissions
+            .set_permission_profile(permission_profile_for_config)
+            .expect("set permission profile");
         config
             .features
             .enable(Feature::RequestPermissionsTool)
@@ -463,7 +475,7 @@ async fn request_permissions_tool_is_auto_denied_when_granular_request_permissio
         &test,
         "request permissions under granular.request_permissions = false",
         approval_policy,
-        sandbox_policy,
+        permission_profile,
     )
     .await?;
 
@@ -501,14 +513,15 @@ async fn relative_additional_permissions_resolve_against_tool_workdir() -> Resul
 
     let server = start_mock_server().await;
     let approval_policy = AskForApproval::OnRequest;
-    let sandbox_policy = SandboxPolicy::new_read_only_policy();
-    let sandbox_policy_for_config = sandbox_policy.clone();
+    let permission_profile = CorePermissionProfile::read_only();
+    let permission_profile_for_config = CorePermissionProfile::read_only();
 
     let mut builder = test_codex().with_config(move |config| {
         config.permissions.approval_policy = Constrained::allow_any(approval_policy);
         config
-            .set_legacy_sandbox_policy(sandbox_policy_for_config)
-            .expect("set sandbox policy");
+            .permissions
+            .set_permission_profile(permission_profile_for_config)
+            .expect("set permission profile");
         config
             .features
             .enable(Feature::ExecPermissionApprovals)
@@ -564,7 +577,7 @@ async fn relative_additional_permissions_resolve_against_tool_workdir() -> Resul
     )
     .await;
 
-    submit_turn(&test, call_id, approval_policy, sandbox_policy.clone()).await?;
+    submit_turn(&test, call_id, approval_policy, permission_profile.clone()).await?;
 
     let approval = expect_exec_approval(&test, command).await;
     assert_eq!(
@@ -604,14 +617,15 @@ async fn read_only_with_additional_permissions_does_not_widen_to_unrequested_cwd
 
     let server = start_mock_server().await;
     let approval_policy = AskForApproval::OnRequest;
-    let sandbox_policy = SandboxPolicy::new_read_only_policy();
-    let sandbox_policy_for_config = sandbox_policy.clone();
+    let permission_profile = CorePermissionProfile::read_only();
+    let permission_profile_for_config = CorePermissionProfile::read_only();
 
     let mut builder = test_codex().with_config(move |config| {
         config.permissions.approval_policy = Constrained::allow_any(approval_policy);
         config
-            .set_legacy_sandbox_policy(sandbox_policy_for_config)
-            .expect("set sandbox policy");
+            .permissions
+            .set_permission_profile(permission_profile_for_config)
+            .expect("set permission profile");
         config
             .features
             .enable(Feature::ExecPermissionApprovals)
@@ -660,7 +674,7 @@ async fn read_only_with_additional_permissions_does_not_widen_to_unrequested_cwd
     )
     .await;
 
-    submit_turn(&test, call_id, approval_policy, sandbox_policy.clone()).await?;
+    submit_turn(&test, call_id, approval_policy, permission_profile.clone()).await?;
 
     let approval = expect_exec_approval(&test, &command).await;
     assert_eq!(
@@ -706,14 +720,15 @@ async fn read_only_with_additional_permissions_does_not_widen_to_unrequested_tmp
 
     let server = start_mock_server().await;
     let approval_policy = AskForApproval::OnRequest;
-    let sandbox_policy = SandboxPolicy::new_read_only_policy();
-    let sandbox_policy_for_config = sandbox_policy.clone();
+    let permission_profile = CorePermissionProfile::read_only();
+    let permission_profile_for_config = CorePermissionProfile::read_only();
 
     let mut builder = test_codex().with_config(move |config| {
         config.permissions.approval_policy = Constrained::allow_any(approval_policy);
         config
-            .set_legacy_sandbox_policy(sandbox_policy_for_config)
-            .expect("set sandbox policy");
+            .permissions
+            .set_permission_profile(permission_profile_for_config)
+            .expect("set permission profile");
         config
             .features
             .enable(Feature::ExecPermissionApprovals)
@@ -763,7 +778,7 @@ async fn read_only_with_additional_permissions_does_not_widen_to_unrequested_tmp
     )
     .await;
 
-    submit_turn(&test, call_id, approval_policy, sandbox_policy.clone()).await?;
+    submit_turn(&test, call_id, approval_policy, permission_profile.clone()).await?;
 
     let approval = expect_exec_approval(&test, &command).await;
     assert_eq!(
@@ -807,14 +822,15 @@ async fn workspace_write_with_additional_permissions_can_write_outside_cwd() ->
 
     let server = start_mock_server().await;
     let approval_policy = AskForApproval::OnRequest;
-    let sandbox_policy = workspace_write_excluding_tmp();
-    let sandbox_policy_for_config = sandbox_policy.clone();
+    let permission_profile = workspace_write_excluding_tmp();
+    let permission_profile_for_config = workspace_write_excluding_tmp();
 
     let mut builder = test_codex().with_config(move |config| {
         config.permissions.approval_policy = Constrained::allow_any(approval_policy);
         config
-            .set_legacy_sandbox_policy(sandbox_policy_for_config)
-            .expect("set sandbox policy");
+            .permissions
+            .set_permission_profile(permission_profile_for_config)
+            .expect("set permission profile");
         config
             .features
             .enable(Feature::ExecPermissionApprovals)
@@ -873,7 +889,7 @@ async fn workspace_write_with_additional_permissions_can_write_outside_cwd() ->
     )
     .await;
 
-    submit_turn(&test, call_id, approval_policy, sandbox_policy.clone()).await?;
+    submit_turn(&test, call_id, approval_policy, permission_profile.clone()).await?;
 
     let approval = expect_exec_approval(&test, &command).await;
     assert_eq!(
@@ -913,14 +929,15 @@ async fn with_additional_permissions_denied_approval_blocks_execution() -> Resul
     skip_if_no_network!(Ok(()));
     let server = start_mock_server().await;
     let approval_policy = AskForApproval::OnRequest;
-    let sandbox_policy = workspace_write_excluding_tmp();
-    let sandbox_policy_for_config = sandbox_policy.clone();
+    let permission_profile = workspace_write_excluding_tmp();
+    let permission_profile_for_config = workspace_write_excluding_tmp();
 
     let mut builder = test_codex().with_config(move |config| {
         config.permissions.approval_policy = Constrained::allow_any(approval_policy);
         config
-            .set_legacy_sandbox_policy(sandbox_policy_for_config)
-            .expect("set sandbox policy");
+            .permissions
+            .set_permission_profile(permission_profile_for_config)
+            .expect("set permission profile");
         config
             .features
             .enable(Feature::ExecPermissionApprovals)
@@ -977,7 +994,7 @@ async fn with_additional_permissions_denied_approval_blocks_execution() -> Resul
     )
     .await;
 
-    submit_turn(&test, call_id, approval_policy, sandbox_policy.clone()).await?;
+    submit_turn(&test, call_id, approval_policy, permission_profile.clone()).await?;
 
     let approval = expect_exec_approval(&test, &command).await;
     assert_eq!(
@@ -1020,14 +1037,15 @@ async fn request_permissions_grants_apply_to_later_exec_command_calls() -> Resul
 
     let server = start_mock_server().await;
     let approval_policy = AskForApproval::OnRequest;
-    let sandbox_policy = workspace_write_excluding_tmp();
-    let sandbox_policy_for_config = sandbox_policy.clone();
+    let permission_profile = workspace_write_excluding_tmp();
+    let permission_profile_for_config = workspace_write_excluding_tmp();
 
     let mut builder = test_codex().with_config(move |config| {
         config.permissions.approval_policy = Constrained::allow_any(approval_policy);
         config
-            .set_legacy_sandbox_policy(sandbox_policy_for_config)
-            .expect("set sandbox policy");
+            .permissions
+            .set_permission_profile(permission_profile_for_config)
+            .expect("set permission profile");
         config
             .features
             .enable(Feature::ExecPermissionApprovals)
@@ -1091,7 +1109,7 @@ async fn request_permissions_grants_apply_to_later_exec_command_calls() -> Resul
         &test,
         "write outside the workspace",
         approval_policy,
-        sandbox_policy,
+        permission_profile,
     )
     .await?;
 
@@ -1146,14 +1164,15 @@ async fn request_permissions_preapprove_explicit_exec_permissions_outside_on_req
 
     let server = start_mock_server().await;
     let approval_policy = AskForApproval::OnRequest;
-    let sandbox_policy = workspace_write_excluding_tmp();
-    let sandbox_policy_for_config = sandbox_policy.clone();
+    let permission_profile = workspace_write_excluding_tmp();
+    let permission_profile_for_config = workspace_write_excluding_tmp();
 
     let mut builder = test_codex().with_config(move |config| {
         config.permissions.approval_policy = Constrained::allow_any(approval_policy);
         config
-            .set_legacy_sandbox_policy(sandbox_policy_for_config)
-            .expect("set sandbox policy");
+            .permissions
+            .set_permission_profile(permission_profile_for_config)
+            .expect("set permission profile");
         config
             .features
             .enable(Feature::ExecPermissionApprovals)
@@ -1208,7 +1227,7 @@ async fn request_permissions_preapprove_explicit_exec_permissions_outside_on_req
         &test,
         "write outside the workspace",
         approval_policy,
-        sandbox_policy,
+        permission_profile,
     )
     .await?;
 
@@ -1266,14 +1285,15 @@ async fn request_permissions_grants_apply_to_later_shell_command_calls() -> Resu
 
     let server = start_mock_server().await;
     let approval_policy = AskForApproval::OnRequest;
-    let sandbox_policy = workspace_write_excluding_tmp();
-    let sandbox_policy_for_config = sandbox_policy.clone();
+    let permission_profile = workspace_write_excluding_tmp();
+    let permission_profile_for_config = workspace_write_excluding_tmp();
 
     let mut builder = test_codex().with_config(move |config| {
         config.permissions.approval_policy = Constrained::allow_any(approval_policy);
         config
-            .set_legacy_sandbox_policy(sandbox_policy_for_config)
-            .expect("set sandbox policy");
+            .permissions
+            .set_permission_profile(permission_profile_for_config)
+            .expect("set permission profile");
         config
             .features
             .enable(Feature::ExecPermissionApprovals)
@@ -1324,7 +1344,7 @@ async fn request_permissions_grants_apply_to_later_shell_command_calls() -> Resu
         &test,
         "write outside the workspace",
         approval_policy,
-        sandbox_policy,
+        permission_profile,
     )
     .await?;
 
@@ -1380,14 +1400,15 @@ async fn request_permissions_grants_apply_to_later_shell_command_calls_without_i
 
     let server = start_mock_server().await;
     let approval_policy = AskForApproval::OnRequest;
-    let sandbox_policy = workspace_write_excluding_tmp();
-    let sandbox_policy_for_config = sandbox_policy.clone();
+    let permission_profile = workspace_write_excluding_tmp();
+    let permission_profile_for_config = workspace_write_excluding_tmp();
 
     let mut builder = test_codex().with_config(move |config| {
         config.permissions.approval_policy = Constrained::allow_any(approval_policy);
         config
-            .set_legacy_sandbox_policy(sandbox_policy_for_config)
-            .expect("set sandbox policy");
+            .permissions
+            .set_permission_profile(permission_profile_for_config)
+            .expect("set permission profile");
         config
             .features
             .enable(Feature::RequestPermissionsTool)
@@ -1436,7 +1457,7 @@ async fn request_permissions_grants_apply_to_later_shell_command_calls_without_i
         &test,
         "write outside the workspace without inline permission feature",
         approval_policy,
-        sandbox_policy,
+        permission_profile,
     )
     .await?;
 
@@ -1494,14 +1515,15 @@ async fn partial_request_permissions_grants_do_not_preapprove_new_permissions()
 
     let server = start_mock_server().await;
     let approval_policy = AskForApproval::OnRequest;
-    let sandbox_policy = workspace_write_excluding_tmp();
-    let sandbox_policy_for_config = sandbox_policy.clone();
+    let permission_profile = workspace_write_excluding_tmp();
+    let permission_profile_for_config = workspace_write_excluding_tmp();
 
     let mut builder = test_codex().with_config(move |config| {
         config.permissions.approval_policy = Constrained::allow_any(approval_policy);
         config
-            .set_legacy_sandbox_policy(sandbox_policy_for_config)
-            .expect("set sandbox policy");
+            .permissions
+            .set_permission_profile(permission_profile_for_config)
+            .expect("set permission profile");
         config
             .features
             .enable(Feature::ExecPermissionApprovals)
@@ -1588,7 +1610,7 @@ async fn partial_request_permissions_grants_do_not_preapprove_new_permissions()
         &test,
         "write outside the workspace",
         approval_policy,
-        sandbox_policy,
+        permission_profile,
     )
     .await?;
 
@@ -1660,14 +1682,15 @@ async fn request_permissions_grants_do_not_carry_across_turns() -> Result<()> {
 
     let server = start_mock_server().await;
     let approval_policy = AskForApproval::OnRequest;
-    let sandbox_policy = workspace_write_excluding_tmp();
-    let sandbox_policy_for_config = sandbox_policy.clone();
+    let permission_profile = workspace_write_excluding_tmp();
+    let permission_profile_for_config = workspace_write_excluding_tmp();
 
     let mut builder = test_codex().with_config(move |config| {
         config.permissions.approval_policy = Constrained::allow_any(approval_policy);
         config
-            .set_legacy_sandbox_policy(sandbox_policy_for_config)
-            .expect("set sandbox policy");
+            .permissions
+            .set_permission_profile(permission_profile_for_config)
+            .expect("set permission profile");
         config
             .features
             .enable(Feature::ExecPermissionApprovals)
@@ -1709,7 +1732,7 @@ async fn request_permissions_grants_do_not_carry_across_turns() -> Result<()> {
         &test,
         "request permissions for later use",
         approval_policy,
-        sandbox_policy.clone(),
+        permission_profile.clone(),
     )
     .await?;
 
@@ -1754,7 +1777,7 @@ async fn request_permissions_grants_do_not_carry_across_turns() -> Result<()> {
         &test,
         "try to reuse permissions in a later turn",
         approval_policy,
-        sandbox_policy,
+        permission_profile,
     )
     .await?;
     wait_for_completion(&test).await;
@@ -1775,14 +1798,15 @@ async fn request_permissions_session_grants_carry_across_turns() -> Result<()> {
 
     let server = start_mock_server().await;
     let approval_policy = AskForApproval::OnRequest;
-    let sandbox_policy = workspace_write_excluding_tmp();
-    let sandbox_policy_for_config = sandbox_policy.clone();
+    let permission_profile = workspace_write_excluding_tmp();
+    let permission_profile_for_config = workspace_write_excluding_tmp();
 
     let mut builder = test_codex().with_config(move |config| {
         config.permissions.approval_policy = Constrained::allow_any(approval_policy);
         config
-            .set_legacy_sandbox_policy(sandbox_policy_for_config)
-            .expect("set sandbox policy");
+            .permissions
+            .set_permission_profile(permission_profile_for_config)
+            .expect("set permission profile");
         config
             .features
             .enable(Feature::ExecPermissionApprovals)
@@ -1829,7 +1853,7 @@ async fn request_permissions_session_grants_carry_across_turns() -> Result<()> {
         &test,
         "request session permissions for later use",
         approval_policy,
-        sandbox_policy.clone(),
+        permission_profile.clone(),
     )
     .await?;
 
@@ -1871,7 +1895,7 @@ async fn request_permissions_session_grants_carry_across_turns() -> Result<()> {
         &test,
         "reuse session permissions in a later turn",
         approval_policy,
-        sandbox_policy,
+        permission_profile,
     )
     .await?;
 
diff --git a/codex-rs/core/tests/suite/request_permissions_tool.rs b/codex-rs/core/tests/suite/request_permissions_tool.rs
index 30b887ab08..84e101e73a 100644
--- a/codex-rs/core/tests/suite/request_permissions_tool.rs
+++ b/codex-rs/core/tests/suite/request_permissions_tool.rs
@@ -142,24 +142,30 @@ async fn submit_turn(
     let (sandbox_policy, permission_profile) =
         turn_permission_fields(permission_profile, test.config.cwd.as_path());
     test.codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: prompt.into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd: test.cwd.path().to_path_buf(),
-            approval_policy,
-            approvals_reviewer,
-            sandbox_policy,
-            permission_profile,
-            model: session_model,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(test.cwd.path().to_path_buf()),
+                approval_policy: Some(approval_policy),
+                approvals_reviewer,
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: session_model,
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
     Ok(())
@@ -340,7 +346,6 @@ async fn apply_patch_after_request_permissions(strict_auto_review: bool) -> Resu
     let permission_profile_for_config = permission_profile.clone();
 
     let mut builder = test_codex().with_config(move |config| {
-        config.include_apply_patch_tool = true;
         config.permissions.approval_policy = Constrained::allow_any(approval_policy);
         config
             .permissions
diff --git a/codex-rs/core/tests/suite/request_user_input.rs b/codex-rs/core/tests/suite/request_user_input.rs
index 6ddd9d0b5e..e0ec684797 100644
--- a/codex-rs/core/tests/suite/request_user_input.rs
+++ b/codex-rs/core/tests/suite/request_user_input.rs
@@ -132,36 +132,33 @@ async fn request_user_input_round_trip_for_mode(mode: ModeKind) -> anyhow::Resul
     ]);
     let second_mock = responses::mount_sse_once(&server, second_response).await;
 
-    let session_model = session_configured.model.clone();
     let (sandbox_policy, permission_profile) =
         turn_permission_fields(PermissionProfile::Disabled, cwd.path());
 
     codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "please confirm".into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd: cwd.path().to_path_buf(),
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy,
-            permission_profile,
-            model: session_model,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: Some(CollaborationMode {
-                mode,
-                settings: Settings {
-                    model: session_configured.model.clone(),
-                    reasoning_effort: None,
-                    developer_instructions: None,
-                },
-            }),
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(cwd.path().to_path_buf()),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(CollaborationMode {
+                    mode,
+                    settings: Settings {
+                        model: session_configured.model.clone(),
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
 
@@ -282,31 +279,29 @@ async fn request_user_input_interrupt_emits_deferred_token_count() -> anyhow::Re
     let (sandbox_policy, permission_profile) =
         turn_permission_fields(PermissionProfile::Disabled, cwd.path());
     codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "please confirm".into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd: cwd.path().to_path_buf(),
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy,
-            permission_profile,
-            model: session_configured.model.clone(),
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: Some(CollaborationMode {
-                mode: ModeKind::Plan,
-                settings: Settings {
-                    model: session_configured.model,
-                    reasoning_effort: None,
-                    developer_instructions: None,
-                },
-            }),
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(cwd.path().to_path_buf()),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(CollaborationMode {
+                    mode: ModeKind::Plan,
+                    settings: Settings {
+                        model: session_configured.model,
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
 
@@ -388,24 +383,22 @@ where
         turn_permission_fields(PermissionProfile::Disabled, cwd.path());
 
     codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "please confirm".into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd: cwd.path().to_path_buf(),
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy,
-            permission_profile,
-            model: session_model,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: Some(collaboration_mode),
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(cwd.path().to_path_buf()),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(collaboration_mode),
+                ..Default::default()
+            },
         })
         .await?;
 
diff --git a/codex-rs/core/tests/suite/responses_api_proxy_headers.rs b/codex-rs/core/tests/suite/responses_api_proxy_headers.rs
index 09e99f78c3..c18b431984 100644
--- a/codex-rs/core/tests/suite/responses_api_proxy_headers.rs
+++ b/codex-rs/core/tests/suite/responses_api_proxy_headers.rs
@@ -13,7 +13,7 @@ use core_test_support::responses::ResponseMock;
 use core_test_support::responses::ResponsesRequest;
 use core_test_support::responses::ev_assistant_message;
 use core_test_support::responses::ev_completed;
-use core_test_support::responses::ev_function_call;
+use core_test_support::responses::ev_function_call_with_namespace;
 use core_test_support::responses::ev_response_created;
 use core_test_support::responses::mount_sse_once_match;
 use core_test_support::responses::sse;
@@ -46,7 +46,12 @@ async fn responses_api_parent_and_subagent_requests_include_identity_headers() -
         },
         sse(vec![
             ev_response_created("resp-parent-1"),
-            ev_function_call(SPAWN_CALL_ID, "spawn_agent", &spawn_args),
+            ev_function_call_with_namespace(
+                SPAWN_CALL_ID,
+                "multi_agent_v1",
+                "spawn_agent",
+                &spawn_args,
+            ),
             ev_completed("resp-parent-1"),
         ]),
     )
@@ -130,24 +135,29 @@ async fn submit_turn_with_timeout(test: &TestCodex, prompt: &str) -> Result<()>
     let (sandbox_policy, permission_profile) =
         turn_permission_fields(PermissionProfile::workspace_write(), cwd.as_path());
     test.codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: prompt.into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd,
-            approval_policy: AskForApproval::OnRequest,
-            approvals_reviewer: None,
-            sandbox_policy,
-            permission_profile,
-            model: session_model,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(cwd),
+                approval_policy: Some(AskForApproval::OnRequest),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: session_model,
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
 
diff --git a/codex-rs/core/tests/suite/resume.rs b/codex-rs/core/tests/suite/resume.rs
index 3211d336e5..fc7a23215f 100644
--- a/codex-rs/core/tests/suite/resume.rs
+++ b/codex-rs/core/tests/suite/resume.rs
@@ -93,6 +93,7 @@ async fn resume_includes_initial_messages_from_rollout_events() -> Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
 
@@ -178,6 +179,7 @@ async fn resume_includes_initial_messages_from_reasoning_events() -> Result<()>
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
 
@@ -267,6 +269,7 @@ async fn resume_switches_models_preserves_base_instructions() -> Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&codex, |event| matches!(event, EventMsg::TurnComplete(_))).await;
@@ -309,6 +312,7 @@ async fn resume_switches_models_preserves_base_instructions() -> Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&resumed.codex, |event| {
@@ -326,6 +330,7 @@ async fn resume_switches_models_preserves_base_instructions() -> Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&resumed.codex, |event| {
@@ -398,6 +403,7 @@ async fn resume_model_switch_is_not_duplicated_after_pre_turn_override() -> Resu
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&codex, |event| matches!(event, EventMsg::TurnComplete(_))).await;
@@ -417,23 +423,14 @@ async fn resume_model_switch_is_not_duplicated_after_pre_turn_override() -> Resu
         config.model = Some("gpt-5.3-codex".to_string());
     });
     let resumed = resume_builder.resume(&server, home, rollout_path).await?;
-    resumed
-        .codex
-        .submit(Op::OverrideTurnContext {
-            cwd: None,
-            approval_policy: None,
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
+    core_test_support::submit_thread_settings(
+        &resumed.codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             model: Some("gpt-5.4".to_string()),
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
-        })
-        .await?;
+            ..Default::default()
+        },
+    )
+    .await?;
     resumed
         .codex
         .submit(Op::UserInput {
@@ -444,6 +441,7 @@ async fn resume_model_switch_is_not_duplicated_after_pre_turn_override() -> Resu
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&resumed.codex, |event| {
diff --git a/codex-rs/core/tests/suite/resume_warning.rs b/codex-rs/core/tests/suite/resume_warning.rs
index cb545df351..d2bdcd1d32 100644
--- a/codex-rs/core/tests/suite/resume_warning.rs
+++ b/codex-rs/core/tests/suite/resume_warning.rs
@@ -27,7 +27,6 @@ fn resume_history(
     let turn_id = "resume-warning-seed-turn".to_string();
     let turn_ctx = TurnContextItem {
         turn_id: Some(turn_id.clone()),
-        trace_id: None,
         cwd: config.cwd.to_path_buf(),
         current_date: None,
         timezone: None,
@@ -44,10 +43,6 @@ fn resume_history(
         summary: config
             .model_reasoning_summary
             .unwrap_or(ReasoningSummary::Auto),
-        user_instructions: None,
-        developer_instructions: None,
-        final_output_json_schema: None,
-        truncation_policy: None,
     };
 
     InitialHistory::Resumed(ResumedHistory {
@@ -64,6 +59,7 @@ fn resume_history(
                 images: None,
                 local_images: vec![],
                 text_elements: vec![],
+                ..Default::default()
             })),
             RolloutItem::TurnContext(turn_ctx),
             RolloutItem::EventMsg(EventMsg::TurnComplete(TurnCompleteEvent {
diff --git a/codex-rs/core/tests/suite/review.rs b/codex-rs/core/tests/suite/review.rs
index f371cdacad..05ec967d09 100644
--- a/codex-rs/core/tests/suite/review.rs
+++ b/codex-rs/core/tests/suite/review.rs
@@ -18,7 +18,7 @@ use codex_protocol::protocol::RolloutItem;
 use codex_protocol::protocol::RolloutLine;
 use codex_protocol::user_input::UserInput;
 use core_test_support::PathBufExt;
-use core_test_support::load_sse_fixture_with_id_from_str;
+use core_test_support::responses;
 use core_test_support::responses::ResponseMock;
 use core_test_support::responses::mount_sse_sequence;
 use core_test_support::responses::start_mock_server;
@@ -61,17 +61,11 @@ async fn review_op_emits_lifecycle_and_review_output() {
         "overall_confidence_score": 0.8
     })
     .to_string();
-    let sse_template = r#"[
-            {"type":"response.output_item.done", "item":{
-                "type":"message", "role":"assistant",
-                "content":[{"type":"output_text","text":__REVIEW__}]
-            }},
-            {"type":"response.completed", "response": {"id": "__ID__"}}
-        ]"#;
-    let review_json_escaped = serde_json::to_string(&review_json).unwrap();
-    let sse_raw = sse_template.replace("__REVIEW__", &review_json_escaped);
-    let (server, _request_log) =
-        start_responses_server_with_sse(&sse_raw, /*expected_requests*/ 1).await;
+    let (server, _request_log) = start_responses_server_with_sse(
+        assistant_message_sse(&review_json),
+        /*expected_requests*/ 1,
+    )
+    .await;
     let codex_home = Arc::new(TempDir::new().unwrap());
     let codex = new_conversation_for_server(&server, codex_home.clone(), |_| {}).await;
 
@@ -186,15 +180,11 @@ async fn review_op_emits_lifecycle_and_review_output() {
 async fn review_op_with_plain_text_emits_review_fallback() {
     skip_if_no_network!();
 
-    let sse_raw = r#"[
-        {"type":"response.output_item.done", "item":{
-            "type":"message", "role":"assistant",
-            "content":[{"type":"output_text","text":"just plain text"}]
-        }},
-        {"type":"response.completed", "response": {"id": "__ID__"}}
-    ]"#;
-    let (server, _request_log) =
-        start_responses_server_with_sse(sse_raw, /*expected_requests*/ 1).await;
+    let (server, _request_log) = start_responses_server_with_sse(
+        assistant_message_sse("just plain text"),
+        /*expected_requests*/ 1,
+    )
+    .await;
     let codex_home = Arc::new(TempDir::new().unwrap());
     let codex = new_conversation_for_server(&server, codex_home.clone(), |_| {}).await;
 
@@ -240,22 +230,17 @@ async fn review_op_with_plain_text_emits_review_fallback() {
 async fn review_filters_agent_message_related_events() {
     skip_if_no_network!();
 
-    // Stream simulating a typing assistant message with deltas and finalization.
-    let sse_raw = r#"[
-        {"type":"response.output_item.added", "item":{
-            "type":"message", "role":"assistant", "id":"msg-1",
-            "content":[{"type":"output_text","text":""}]
-        }},
-        {"type":"response.output_text.delta", "delta":"Hi"},
-        {"type":"response.output_text.delta", "delta":" there"},
-        {"type":"response.output_item.done", "item":{
-            "type":"message", "role":"assistant", "id":"msg-1",
-            "content":[{"type":"output_text","text":"Hi there"}]
-        }},
-        {"type":"response.completed", "response": {"id": "__ID__"}}
-    ]"#;
-    let (server, _request_log) =
-        start_responses_server_with_sse(sse_raw, /*expected_requests*/ 1).await;
+    let (server, _request_log) = start_responses_server_with_sse(
+        vec![
+            responses::ev_message_item_added("msg-1", ""),
+            responses::ev_output_text_delta("Hi"),
+            responses::ev_output_text_delta(" there"),
+            responses::ev_assistant_message("msg-1", "Hi there"),
+            responses::ev_completed("resp-1"),
+        ],
+        /*expected_requests*/ 1,
+    )
+    .await;
     let codex_home = Arc::new(TempDir::new().unwrap());
     let codex = new_conversation_for_server(&server, codex_home.clone(), |_| {}).await;
 
@@ -325,17 +310,11 @@ async fn review_does_not_emit_agent_message_on_structured_output() {
         "overall_confidence_score": 0.5
     })
     .to_string();
-    let sse_template = r#"[
-            {"type":"response.output_item.done", "item":{
-                "type":"message", "role":"assistant",
-                "content":[{"type":"output_text","text":__REVIEW__}]
-            }},
-            {"type":"response.completed", "response": {"id": "__ID__"}}
-        ]"#;
-    let review_json_escaped = serde_json::to_string(&review_json).unwrap();
-    let sse_raw = sse_template.replace("__REVIEW__", &review_json_escaped);
-    let (server, _request_log) =
-        start_responses_server_with_sse(&sse_raw, /*expected_requests*/ 1).await;
+    let (server, _request_log) = start_responses_server_with_sse(
+        assistant_message_sse(&review_json),
+        /*expected_requests*/ 1,
+    )
+    .await;
     let codex_home = Arc::new(TempDir::new().unwrap());
     let codex = new_conversation_for_server(&server, codex_home.clone(), |_| {}).await;
 
@@ -386,12 +365,8 @@ async fn review_does_not_emit_agent_message_on_structured_output() {
 async fn review_uses_custom_review_model_from_config() {
     skip_if_no_network!();
 
-    // Minimal stream: just a completed event
-    let sse_raw = r#"[
-        {"type":"response.completed", "response": {"id": "__ID__"}}
-    ]"#;
     let (server, request_log) =
-        start_responses_server_with_sse(sse_raw, /*expected_requests*/ 1).await;
+        start_responses_server_with_sse(completed_sse(), /*expected_requests*/ 1).await;
     let codex_home = Arc::new(TempDir::new().unwrap());
     // Choose a review model different from the main model; ensure it is used.
     let codex = new_conversation_for_server(&server, codex_home.clone(), |cfg| {
@@ -441,12 +416,8 @@ async fn review_uses_custom_review_model_from_config() {
 async fn review_uses_session_model_when_review_model_unset() {
     skip_if_no_network!();
 
-    // Minimal stream: just a completed event
-    let sse_raw = r#"[
-        {"type":"response.completed", "response": {"id": "__ID__"}}
-    ]"#;
     let (server, request_log) =
-        start_responses_server_with_sse(sse_raw, /*expected_requests*/ 1).await;
+        start_responses_server_with_sse(completed_sse(), /*expected_requests*/ 1).await;
     let codex_home = Arc::new(TempDir::new().unwrap());
     let codex = new_conversation_for_server(&server, codex_home.clone(), |cfg| {
         cfg.model = Some("gpt-4.1".to_string());
@@ -496,12 +467,8 @@ async fn review_uses_session_model_when_review_model_unset() {
 async fn review_input_isolated_from_parent_history() {
     skip_if_no_network!();
 
-    // Mock server for the single review request
-    let sse_raw = r#"[
-        {"type":"response.completed", "response": {"id": "__ID__"}}
-    ]"#;
     let (server, request_log) =
-        start_responses_server_with_sse(sse_raw, /*expected_requests*/ 1).await;
+        start_responses_server_with_sse(completed_sse(), /*expected_requests*/ 1).await;
 
     // Seed a parent session history via resume file with both user + assistant items.
     let codex_home = Arc::new(TempDir::new().unwrap());
@@ -674,16 +641,11 @@ async fn review_input_isolated_from_parent_history() {
 async fn review_history_surfaces_in_parent_session() {
     skip_if_no_network!();
 
-    // Respond to both the review request and the subsequent parent request.
-    let sse_raw = r#"[
-        {"type":"response.output_item.done", "item":{
-            "type":"message", "role":"assistant",
-            "content":[{"type":"output_text","text":"review assistant output"}]
-        }},
-        {"type":"response.completed", "response": {"id": "__ID__"}}
-    ]"#;
-    let (server, request_log) =
-        start_responses_server_with_sse(sse_raw, /*expected_requests*/ 2).await;
+    let (server, request_log) = start_responses_server_with_sse(
+        assistant_message_sse("review assistant output"),
+        /*expected_requests*/ 2,
+    )
+    .await;
     let codex_home = Arc::new(TempDir::new().unwrap());
     let codex = new_conversation_for_server(&server, codex_home.clone(), |_| {}).await;
 
@@ -722,6 +684,7 @@ async fn review_history_surfaces_in_parent_session() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -776,9 +739,8 @@ async fn review_history_surfaces_in_parent_session() {
 async fn review_uses_overridden_cwd_for_base_branch_merge_base() {
     skip_if_no_network!();
 
-    let sse_raw = r#"[{"type":"response.completed", "response": {"id": "__ID__"}}]"#;
     let (server, request_log) =
-        start_responses_server_with_sse(sse_raw, /*expected_requests*/ 1).await;
+        start_responses_server_with_sse(completed_sse(), /*expected_requests*/ 1).await;
 
     let initial_cwd = TempDir::new().unwrap();
 
@@ -827,23 +789,15 @@ async fn review_uses_overridden_cwd_for_base_branch_merge_base() {
     })
     .await;
 
-    codex
-        .submit(Op::OverrideTurnContext {
+    core_test_support::submit_thread_settings(
+        &codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             cwd: Some(repo_path.to_path_buf()),
-            approval_policy: None,
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
-            model: None,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
-        })
-        .await
-        .unwrap();
+            ..Default::default()
+        },
+    )
+    .await
+    .unwrap();
 
     codex
         .submit(Op::Review {
@@ -881,13 +835,24 @@ async fn review_uses_overridden_cwd_for_base_branch_merge_base() {
     server.verify().await;
 }
 
-/// Start a mock Responses API server and mount the given SSE stream body.
+fn assistant_message_sse(text: &str) -> Vec<serde_json::Value> {
+    vec![
+        responses::ev_assistant_message("msg-1", text),
+        responses::ev_completed("resp-1"),
+    ]
+}
+
+fn completed_sse() -> Vec<serde_json::Value> {
+    vec![responses::ev_completed("resp-1")]
+}
+
+/// Start a mock Responses API server and mount the given SSE events.
 async fn start_responses_server_with_sse(
-    sse_raw: &str,
+    events: Vec<serde_json::Value>,
     expected_requests: usize,
 ) -> (MockServer, ResponseMock) {
     let server = start_mock_server().await;
-    let sse = load_sse_fixture_with_id_from_str(sse_raw, &Uuid::new_v4().to_string());
+    let sse = responses::sse(events);
     let responses = vec![sse; expected_requests];
     let request_log = mount_sse_sequence(&server, responses).await;
     (server, request_log)
diff --git a/codex-rs/core/tests/suite/rmcp_client.rs b/codex-rs/core/tests/suite/rmcp_client.rs
index 1a7062bdb1..7c811a88e0 100644
--- a/codex-rs/core/tests/suite/rmcp_client.rs
+++ b/codex-rs/core/tests/suite/rmcp_client.rs
@@ -105,24 +105,29 @@ fn read_only_user_turn_with_model(
     let cwd = fixture.cwd.path().to_path_buf();
     let (sandbox_policy, permission_profile) =
         turn_permission_fields(PermissionProfile::read_only(), cwd.as_path());
-    Op::UserTurn {
+    Op::UserInput {
         items: vec![UserInput::Text {
             text: text.into(),
             text_elements: Vec::new(),
         }],
-        final_output_json_schema: None,
-        cwd,
-        approval_policy: AskForApproval::Never,
-        approvals_reviewer: None,
-        sandbox_policy,
-        permission_profile,
-        model,
-        effort: None,
-        summary: None,
-        service_tier: None,
-        collaboration_mode: None,
-        personality: None,
         environments: None,
+        final_output_json_schema: None,
+        responsesapi_client_metadata: None,
+        thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+            cwd: Some(cwd),
+            approval_policy: Some(AskForApproval::Never),
+            sandbox_policy: Some(sandbox_policy),
+            permission_profile,
+            collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                mode: codex_protocol::config_types::ModeKind::Default,
+                settings: codex_protocol::config_types::Settings {
+                    model,
+                    reasoning_effort: None,
+                    developer_instructions: None,
+                },
+            }),
+            ..Default::default()
+        },
     }
 }
 
@@ -332,6 +337,7 @@ fn insert_mcp_server(
             enabled_tools: None,
             disabled_tools: None,
             scopes: None,
+            oauth: None,
             oauth_resource: None,
             tools: HashMap::new(),
         },
@@ -479,7 +485,7 @@ async fn stdio_server_round_trip() -> anyhow::Result<()> {
                 },
             );
         })
-        .build_remote_aware(&server)
+        .build_with_remote_env(&server)
         .await?;
     fixture
         .codex
@@ -602,7 +608,7 @@ async fn stdio_server_uses_configured_cwd_before_runtime_fallback() -> anyhow::R
                 },
             );
         })
-        .build_remote_aware(&server)
+        .build_with_remote_env(&server)
         .await?;
 
     let expected_cwd = expected_cwd
@@ -655,7 +661,7 @@ async fn remote_stdio_server_uses_runtime_fallback_cwd_when_config_omits_cwd() -
                 },
             );
         })
-        .build_remote_aware(&server)
+        .build_with_remote_env(&server)
         .await?;
 
     let expected_cwd = expected_cwd
@@ -774,7 +780,7 @@ async fn stdio_mcp_tool_call_includes_sandbox_state_meta() -> anyhow::Result<()>
                 },
             );
         })
-        .build_remote_aware(&server)
+        .build_with_remote_env(&server)
         .await?;
 
     wait_for_mcp_server(&fixture, server_name).await?;
@@ -872,7 +878,7 @@ async fn stdio_mcp_parallel_tool_calls_default_false_runs_serially() -> anyhow::
                 },
             );
         })
-        .build_remote_aware(&server)
+        .build_with_remote_env(&server)
         .await?;
     fixture
         .codex
@@ -989,7 +995,7 @@ async fn stdio_mcp_parallel_tool_calls_opt_in_runs_concurrently() -> anyhow::Res
                 },
             );
         })
-        .build_remote_aware(&server)
+        .build_with_remote_env(&server)
         .await?;
     fixture
         .codex
@@ -1070,7 +1076,7 @@ async fn stdio_image_responses_round_trip() -> anyhow::Result<()> {
                 },
             );
         })
-        .build_remote_aware(&server)
+        .build_with_remote_env(&server)
         .await?;
     wait_for_mcp_server(&fixture, server_name).await?;
 
@@ -1202,7 +1208,7 @@ async fn stdio_image_responses_preserve_original_detail_metadata() -> anyhow::Re
                 },
             );
         })
-        .build_remote_aware(&server)
+        .build_with_remote_env(&server)
         .await?;
     wait_for_mcp_server(&fixture, server_name).await?;
 
@@ -1337,7 +1343,7 @@ async fn stdio_image_responses_are_sanitized_for_text_only_model() -> anyhow::Re
                 },
             );
         })
-        .build_remote_aware(&server)
+        .build_with_remote_env(&server)
         .await?;
 
     fixture
@@ -1439,7 +1445,7 @@ async fn stdio_server_propagates_whitelisted_env_vars() -> anyhow::Result<()> {
                 },
             );
         })
-        .build_remote_aware(&server)
+        .build_with_remote_env(&server)
         .await?;
     fixture
         .codex
@@ -1557,7 +1563,7 @@ async fn stdio_server_propagates_explicit_local_env_var_source() -> anyhow::Resu
                 },
             );
         })
-        .build_remote_aware(&server)
+        .build_with_remote_env(&server)
         .await?;
 
     fixture
@@ -1649,7 +1655,7 @@ async fn remote_stdio_env_var_source_does_not_copy_local_env() -> anyhow::Result
                 },
             );
         })
-        .build_remote_aware(&server)
+        .build_with_remote_env(&server)
         .await?;
 
     fixture
@@ -1832,7 +1838,7 @@ async fn streamable_http_tool_call_round_trip() -> anyhow::Result<()> {
                 },
             );
         })
-        .build_remote_aware(&server)
+        .build_with_remote_env(&server)
         .await?;
     // Phase 4: submit the user turn that should trigger the MCP tool call.
     fixture
@@ -2018,7 +2024,7 @@ async fn streamable_http_with_oauth_round_trip_impl() -> anyhow::Result<()> {
                 },
             );
         })
-        .build_remote_aware(&server)
+        .build_with_remote_env(&server)
         .await?;
     // Phase 5: wait for MCP startup before the turn is submitted, which keeps
     // failures tied to server startup/discovery.
diff --git a/codex-rs/core/tests/suite/safety_check_downgrade.rs b/codex-rs/core/tests/suite/safety_check_downgrade.rs
index c937d49ad4..ab985ce0f7 100644
--- a/codex-rs/core/tests/suite/safety_check_downgrade.rs
+++ b/codex-rs/core/tests/suite/safety_check_downgrade.rs
@@ -37,24 +37,29 @@ const CYBER_POLICY_MESSAGE: &str =
 fn disabled_text_turn(test: &TestCodex, text: &str) -> Op {
     let (sandbox_policy, permission_profile) =
         turn_permission_fields(PermissionProfile::Disabled, test.cwd_path());
-    Op::UserTurn {
-        environments: None,
+    Op::UserInput {
         items: vec![UserInput::Text {
             text: text.to_string(),
             text_elements: Vec::new(),
         }],
+        environments: None,
         final_output_json_schema: None,
-        cwd: test.cwd_path().to_path_buf(),
-        approval_policy: AskForApproval::Never,
-        approvals_reviewer: None,
-        sandbox_policy,
-        permission_profile,
-        model: REQUESTED_MODEL.to_string(),
-        effort: test.config.model_reasoning_effort,
-        summary: None,
-        service_tier: None,
-        collaboration_mode: None,
-        personality: None,
+        responsesapi_client_metadata: None,
+        thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+            cwd: Some(test.cwd_path().to_path_buf()),
+            approval_policy: Some(AskForApproval::Never),
+            sandbox_policy: Some(sandbox_policy),
+            permission_profile,
+            collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                mode: codex_protocol::config_types::ModeKind::Default,
+                settings: codex_protocol::config_types::Settings {
+                    model: REQUESTED_MODEL.to_string(),
+                    reasoning_effort: test.config.model_reasoning_effort,
+                    developer_instructions: None,
+                },
+            }),
+            ..Default::default()
+        },
     }
 }
 
diff --git a/codex-rs/core/tests/suite/search_tool.rs b/codex-rs/core/tests/suite/search_tool.rs
index b3cf2e3bca..706ff4871e 100644
--- a/codex-rs/core/tests/suite/search_tool.rs
+++ b/codex-rs/core/tests/suite/search_tool.rs
@@ -4,10 +4,8 @@
 use anyhow::Result;
 use codex_config::types::McpServerConfig;
 use codex_config::types::McpServerTransportConfig;
-use codex_core::config::Config;
 use codex_features::Feature;
 use codex_login::CodexAuth;
-use codex_models_manager::bundled_models_response;
 use codex_protocol::dynamic_tools::DynamicToolCallOutputContentItem;
 use codex_protocol::dynamic_tools::DynamicToolResponse;
 use codex_protocol::dynamic_tools::DynamicToolSpec;
@@ -21,6 +19,15 @@ use codex_protocol::user_input::UserInput;
 use core_test_support::apps_test_server::AppsTestServer;
 use core_test_support::apps_test_server::CALENDAR_CREATE_EVENT_MCP_APP_RESOURCE_URI;
 use core_test_support::apps_test_server::CALENDAR_CREATE_EVENT_RESOURCE_URI;
+use core_test_support::apps_test_server::DIRECT_CALENDAR_CREATE_EVENT_TOOL as CALENDAR_CREATE_TOOL;
+use core_test_support::apps_test_server::DIRECT_CALENDAR_LIST_EVENTS_TOOL as CALENDAR_LIST_TOOL;
+use core_test_support::apps_test_server::SEARCH_CALENDAR_CREATE_TOOL;
+use core_test_support::apps_test_server::SEARCH_CALENDAR_LIST_TOOL;
+use core_test_support::apps_test_server::SEARCH_CALENDAR_NAMESPACE;
+use core_test_support::apps_test_server::configure_search_capable_apps;
+use core_test_support::apps_test_server::configure_search_capable_model;
+use core_test_support::apps_test_server::recorded_apps_tool_call_by_call_id;
+use core_test_support::apps_test_server::search_capable_apps_builder as configured_builder;
 use core_test_support::responses::ResponsesRequest;
 use core_test_support::responses::ev_assistant_message;
 use core_test_support::responses::ev_completed;
@@ -34,7 +41,6 @@ use core_test_support::responses::sse;
 use core_test_support::responses::start_mock_server;
 use core_test_support::skip_if_no_network;
 use core_test_support::stdio_server_bin;
-use core_test_support::test_codex::TestCodexBuilder;
 use core_test_support::test_codex::test_codex;
 use core_test_support::wait_for_event;
 use pretty_assertions::assert_eq;
@@ -48,11 +54,6 @@ const SEARCH_TOOL_DESCRIPTION_SNIPPETS: [&str; 2] = [
     "- Calendar: Plan events and manage your calendar.",
 ];
 const TOOL_SEARCH_TOOL_NAME: &str = "tool_search";
-const CALENDAR_CREATE_TOOL: &str = "mcp__codex_apps__calendar_create_event";
-const CALENDAR_LIST_TOOL: &str = "mcp__codex_apps__calendar_list_events";
-const SEARCH_CALENDAR_NAMESPACE: &str = "mcp__codex_apps__calendar";
-const SEARCH_CALENDAR_CREATE_TOOL: &str = "_create_event";
-const SEARCH_CALENDAR_LIST_TOOL: &str = "_list_events";
 
 fn tool_names(body: &Value) -> Vec<String> {
     body.get("tools")
@@ -111,46 +112,6 @@ fn tool_search_output_has_namespace_child(
     namespace_child_tool(&output, namespace, tool_name).is_some()
 }
 
-fn configure_search_capable_model(config: &mut Config) {
-    let mut model_catalog = bundled_models_response()
-        .unwrap_or_else(|err| panic!("bundled models.json should parse: {err}"));
-    let model = model_catalog
-        .models
-        .iter_mut()
-        .find(|model| model.slug == "gpt-5.4")
-        .expect("gpt-5.4 exists in bundled models.json");
-    config.model = Some("gpt-5.4".to_string());
-    model.supports_search_tool = true;
-    config.model_catalog = Some(model_catalog);
-}
-
-fn configure_search_capable_apps(config: &mut Config, apps_base_url: &str) {
-    config
-        .features
-        .enable(Feature::Apps)
-        .expect("test config should allow feature update");
-    config.chatgpt_base_url = apps_base_url.to_string();
-    configure_search_capable_model(config);
-}
-
-fn configure_apps_without_tool_search(config: &mut Config, apps_base_url: &str) {
-    configure_search_capable_apps(config, apps_base_url);
-    config
-        .features
-        .disable(Feature::ToolSearch)
-        .expect("test config should allow feature update");
-}
-
-fn configure_apps(config: &mut Config, apps_base_url: &str) {
-    configure_search_capable_apps(config, apps_base_url);
-}
-
-fn configured_builder(apps_base_url: String) -> TestCodexBuilder {
-    test_codex()
-        .with_auth(CodexAuth::create_dummy_chatgpt_auth_for_testing())
-        .with_config(move |config| configure_apps(config, apps_base_url.as_str()))
-}
-
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn search_tool_enabled_by_default_adds_tool_search() -> Result<()> {
     skip_if_no_network!(Ok(()));
@@ -256,55 +217,7 @@ async fn always_defer_feature_hides_small_app_tool_sets() -> Result<()> {
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn tool_search_disabled_exposes_apps_tools_directly() -> Result<()> {
-    skip_if_no_network!(Ok(()));
-
-    let server = start_mock_server().await;
-    let apps_server = AppsTestServer::mount_searchable(&server).await?;
-    let mock = mount_sse_once(
-        &server,
-        sse(vec![
-            ev_response_created("resp-1"),
-            ev_assistant_message("msg-1", "done"),
-            ev_completed("resp-1"),
-        ]),
-    )
-    .await;
-
-    let mut builder = test_codex()
-        .with_auth(CodexAuth::create_dummy_chatgpt_auth_for_testing())
-        .with_config(move |config| {
-            configure_apps_without_tool_search(config, apps_server.chatgpt_base_url.as_str())
-        });
-    let test = builder.build(&server).await?;
-
-    test.submit_turn_with_approval_and_permission_profile(
-        "list tools",
-        AskForApproval::Never,
-        PermissionProfile::Disabled,
-    )
-    .await?;
-
-    let body = mock.single_request().body_json();
-    let tools = tool_names(&body);
-    assert!(!tools.iter().any(|name| name == TOOL_SEARCH_TOOL_NAME));
-    assert!(
-        namespace_child_tool(
-            &body,
-            SEARCH_CALENDAR_NAMESPACE,
-            SEARCH_CALENDAR_CREATE_TOOL
-        )
-        .is_some()
-    );
-    assert!(
-        namespace_child_tool(&body, SEARCH_CALENDAR_NAMESPACE, SEARCH_CALENDAR_LIST_TOOL).is_some()
-    );
-
-    Ok(())
-}
-
-#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn search_tool_is_hidden_for_api_key_auth() -> Result<()> {
+async fn app_search_sources_are_hidden_for_api_key_auth() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
     let server = start_mock_server().await;
@@ -321,7 +234,9 @@ async fn search_tool_is_hidden_for_api_key_auth() -> Result<()> {
 
     let mut builder = test_codex()
         .with_auth(CodexAuth::from_api_key("Test API Key"))
-        .with_config(move |config| configure_apps(config, apps_server.chatgpt_base_url.as_str()));
+        .with_config(move |config| {
+            configure_search_capable_apps(config, apps_server.chatgpt_base_url.as_str())
+        });
     let test = builder.build(&server).await?;
 
     test.submit_turn_with_approval_and_permission_profile(
@@ -334,8 +249,13 @@ async fn search_tool_is_hidden_for_api_key_auth() -> Result<()> {
     let body = mock.single_request().body_json();
     let tools = tool_names(&body);
     assert!(
-        !tools.iter().any(|name| name == TOOL_SEARCH_TOOL_NAME),
-        "tools list should not include {TOOL_SEARCH_TOOL_NAME} for API key auth: {tools:?}"
+        !tools.iter().any(|name| name == SEARCH_CALENDAR_NAMESPACE),
+        "tools list should not include app tools for API key auth: {tools:?}"
+    );
+    let description = tool_search_description(&body).unwrap_or_default();
+    assert!(
+        !description.contains("Calendar"),
+        "tool_search description should not include app sources for API key auth: {description}"
     );
 
     Ok(())
@@ -420,7 +340,7 @@ async fn search_tool_hides_apps_tools_without_search() -> Result<()> {
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn explicit_app_mentions_expose_apps_tools_without_search() -> Result<()> {
+async fn explicit_app_mentions_respect_always_defer() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
     let server = start_mock_server().await;
@@ -435,7 +355,13 @@ async fn explicit_app_mentions_expose_apps_tools_without_search() -> Result<()>
     )
     .await;
 
-    let mut builder = configured_builder(apps_server.chatgpt_base_url.clone());
+    let mut builder =
+        configured_builder(apps_server.chatgpt_base_url.clone()).with_config(|config| {
+            config
+                .features
+                .enable(Feature::ToolSearchAlwaysDeferMcpTools)
+                .expect("test config should allow feature update");
+        });
     let test = builder.build(&server).await?;
 
     test.submit_turn_with_approval_and_permission_profile(
@@ -447,18 +373,22 @@ async fn explicit_app_mentions_expose_apps_tools_without_search() -> Result<()>
 
     let body = mock.single_request().body_json();
     let tools = tool_names(&body);
+    assert!(
+        tools.iter().any(|name| name == TOOL_SEARCH_TOOL_NAME),
+        "explicit app mentions should leave app tools deferred when always-defer is active: {tools:?}"
+    );
     assert!(
         namespace_child_tool(
             &body,
             SEARCH_CALENDAR_NAMESPACE,
             SEARCH_CALENDAR_CREATE_TOOL
         )
-        .is_some(),
-        "expected explicit app mention to expose create tool, got tools: {tools:?}"
+        .is_none(),
+        "explicit app mentions should not directly expose create tool, got tools: {tools:?}"
     );
     assert!(
-        namespace_child_tool(&body, SEARCH_CALENDAR_NAMESPACE, SEARCH_CALENDAR_LIST_TOOL).is_some(),
-        "expected explicit app mention to expose list tool, got tools: {tools:?}"
+        namespace_child_tool(&body, SEARCH_CALENDAR_NAMESPACE, SEARCH_CALENDAR_LIST_TOOL).is_none(),
+        "explicit app mentions should not directly expose list tool, got tools: {tools:?}"
     );
 
     Ok(())
@@ -522,6 +452,7 @@ async fn tool_search_returns_deferred_tools_without_follow_up_tool_injection() -
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
 
@@ -585,18 +516,7 @@ async fn tool_search_returns_deferred_tools_without_follow_up_tool_injection() -
     assert_eq!(requests.len(), 3);
     let first_request_body = requests[0].body_json();
 
-    let apps_tool_call = server
-        .received_requests()
-        .await
-        .unwrap_or_default()
-        .into_iter()
-        .find_map(|request| {
-            let body: Value = serde_json::from_slice(&request.body).ok()?;
-            (request.url.path() == "/api/codex/apps"
-                && body.get("method").and_then(Value::as_str) == Some("tools/call"))
-            .then_some(body)
-        })
-        .expect("apps tools/call request should be recorded");
+    let apps_tool_call = recorded_apps_tool_call_by_call_id(&server, "calendar-call-1").await;
 
     assert_eq!(
         apps_tool_call.pointer("/params/_meta/_codex_apps"),
@@ -756,6 +676,108 @@ async fn tool_search_returns_deferred_tools_without_follow_up_tool_injection() -
     Ok(())
 }
 
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn tool_search_returns_deferred_v1_multi_agent_tools() -> Result<()> {
+    skip_if_no_network!(Ok(()));
+
+    let server = start_mock_server().await;
+    let call_id = "tool-search-spawn-agent";
+    let mock = mount_sse_sequence(
+        &server,
+        vec![
+            sse(vec![
+                ev_response_created("resp-1"),
+                ev_tool_search_call(
+                    call_id,
+                    &json!({
+                        "query": "spawn agent",
+                        "limit": 1,
+                    }),
+                ),
+                ev_completed("resp-1"),
+            ]),
+            sse(vec![
+                ev_response_created("resp-2"),
+                ev_assistant_message("msg-1", "done"),
+                ev_completed("resp-2"),
+            ]),
+        ],
+    )
+    .await;
+
+    let mut builder = test_codex().with_config(configure_search_capable_model);
+    let test = builder.build(&server).await?;
+    test.submit_turn_with_approval_and_permission_profile(
+        "Find the spawn agent tool",
+        AskForApproval::Never,
+        PermissionProfile::Disabled,
+    )
+    .await?;
+
+    let requests = mock.requests();
+    assert_eq!(requests.len(), 2);
+
+    let first_request_body = requests[0].body_json();
+    let first_request_tools = tool_names(&first_request_body);
+    assert!(
+        first_request_tools
+            .iter()
+            .any(|name| name == TOOL_SEARCH_TOOL_NAME),
+        "first request should advertise tool_search: {first_request_tools:?}"
+    );
+    for tool_name in [
+        "spawn_agent",
+        "send_input",
+        "resume_agent",
+        "wait_agent",
+        "close_agent",
+    ] {
+        assert!(
+            !first_request_tools.iter().any(|name| name == tool_name),
+            "v1 multi-agent tools should be hidden before search: {first_request_tools:?}"
+        );
+    }
+    assert!(
+        !first_request_body
+            .to_string()
+            .contains("Only use `spawn_agent` if and only if"),
+        "deferred v1 multi-agent guidance should stay out of initial developer context"
+    );
+
+    let tools = tool_search_output_tools(&requests[1], call_id);
+    assert!(
+        !tools.iter().any(|tool| {
+            tool.get("type").and_then(Value::as_str) == Some("function")
+                && tool.get("name").and_then(Value::as_str) == Some("spawn_agent")
+        }),
+        "spawn_agent should be returned as a namespace child, not a flat function: {tools:?}"
+    );
+    assert!(
+        tools.iter().any(|tool| {
+            tool.get("type").and_then(Value::as_str) == Some("namespace")
+                && tool.get("name").and_then(Value::as_str) == Some("multi_agent_v1")
+        }),
+        "expected tool_search to return multi_agent_v1 namespace: {tools:?}"
+    );
+    let output = tool_search_output_item(&requests[1], call_id);
+    let spawn_agent = namespace_child_tool(&output, "multi_agent_v1", "spawn_agent")
+        .unwrap_or_else(|| {
+            panic!("expected tool_search to return multi_agent_v1.spawn_agent: {output:?}")
+        });
+    assert_eq!(
+        spawn_agent.get("defer_loading").and_then(Value::as_bool),
+        Some(true)
+    );
+    let description = spawn_agent
+        .get("description")
+        .and_then(Value::as_str)
+        .expect("spawn_agent description should be present");
+    assert!(description.contains("Only use `spawn_agent` if and only if"));
+    assert!(description.contains("### Designing delegated subtasks"));
+
+    Ok(())
+}
+
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn tool_search_returns_deferred_dynamic_tool_and_routes_follow_up_call() -> Result<()> {
     skip_if_no_network!(Ok(()));
@@ -843,6 +865,7 @@ async fn tool_search_returns_deferred_dynamic_tool_and_routes_follow_up_call() -
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
 
@@ -999,6 +1022,7 @@ async fn tool_search_indexes_only_enabled_non_app_mcp_tools() -> Result<()> {
                     enabled_tools: Some(vec!["echo".to_string(), "image".to_string()]),
                     disabled_tools: Some(vec!["image".to_string()]),
                     scopes: None,
+                    oauth: None,
                     oauth_resource: None,
                     supports_parallel_tool_calls: false,
                     tools: HashMap::new(),
@@ -1127,6 +1151,7 @@ async fn tool_search_surfaced_mcp_tool_errors_are_returned_to_model() -> Result<
                     enabled_tools: Some(vec!["echo".to_string()]),
                     disabled_tools: None,
                     scopes: None,
+                    oauth: None,
                     oauth_resource: None,
                     supports_parallel_tool_calls: false,
                     tools: HashMap::new(),
@@ -1148,6 +1173,7 @@ async fn tool_search_surfaced_mcp_tool_errors_are_returned_to_model() -> Result<
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
 
@@ -1272,6 +1298,7 @@ async fn tool_search_uses_non_app_mcp_server_instructions_as_namespace_descripti
                     enabled_tools: Some(vec!["echo".to_string()]),
                     disabled_tools: None,
                     scopes: None,
+                    oauth: None,
                     oauth_resource: None,
                     supports_parallel_tool_calls: false,
                     tools: HashMap::new(),
@@ -1466,6 +1493,7 @@ async fn tool_search_matches_dynamic_tools_by_name_description_namespace_and_sch
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
 
diff --git a/codex-rs/core/tests/suite/shell_command.rs b/codex-rs/core/tests/suite/shell_command.rs
index 1b3b3d0b40..eb545fce0b 100644
--- a/codex-rs/core/tests/suite/shell_command.rs
+++ b/codex-rs/core/tests/suite/shell_command.rs
@@ -61,9 +61,7 @@ fn shell_responses(call_id: &str, command: &str, login: Option<bool>) -> Vec<Str
 async fn shell_command_harness_with(
     configure: impl FnOnce(TestCodexBuilder) -> TestCodexBuilder,
 ) -> Result<TestCodexHarness> {
-    let builder = configure(test_codex()).with_config(|config| {
-        config.include_apply_patch_tool = true;
-    });
+    let builder = configure(test_codex());
     TestCodexHarness::with_builder(builder).await
 }
 
diff --git a/codex-rs/core/tests/suite/shell_serialization.rs b/codex-rs/core/tests/suite/shell_serialization.rs
index 01b1563a6b..2295798daa 100644
--- a/codex-rs/core/tests/suite/shell_serialization.rs
+++ b/codex-rs/core/tests/suite/shell_serialization.rs
@@ -7,22 +7,17 @@ use core_test_support::assert_regex_match;
 use core_test_support::responses::ev_assistant_message;
 use core_test_support::responses::ev_completed;
 use core_test_support::responses::ev_function_call;
-use core_test_support::responses::ev_local_shell_call;
 use core_test_support::responses::ev_response_created;
 use core_test_support::responses::mount_sse_sequence;
 use core_test_support::responses::sse;
 use core_test_support::responses::start_mock_server;
 use core_test_support::skip_if_no_network;
-use core_test_support::test_codex::ApplyPatchModelOutput;
-use core_test_support::test_codex::ShellModelOutput;
-use core_test_support::test_codex::TestCodexBuilder;
 use core_test_support::test_codex::test_codex;
 use pretty_assertions::assert_eq;
 use regex_lite::Regex;
 use serde_json::Value;
 use serde_json::json;
 use std::fs;
-use test_case::test_case;
 
 use crate::suite::apply_patch_cli::apply_patch_harness;
 use crate::suite::apply_patch_cli::mount_apply_patch;
@@ -39,105 +34,50 @@ const FIXTURE_JSON: &str = r#"{
 }
 "#;
 
-fn shell_responses(
-    call_id: &str,
-    command: Vec<&str>,
-    output_type: ShellModelOutput,
-) -> Result<Vec<String>> {
-    match output_type {
-        ShellModelOutput::ShellCommand => {
-            let command = shlex::try_join(command)?;
-            let parameters = json!({
-                "command": command,
-                "timeout_ms": 2_000,
-            });
-            Ok(vec![
-                sse(vec![
-                    ev_response_created("resp-1"),
-                    ev_function_call(
-                        call_id,
-                        "shell_command",
-                        &serde_json::to_string(&parameters)?,
-                    ),
-                    ev_completed("resp-1"),
-                ]),
-                sse(vec![
-                    ev_assistant_message("msg-1", "done"),
-                    ev_completed("resp-2"),
-                ]),
-            ])
-        }
-        ShellModelOutput::Shell => {
-            let parameters = json!({
-                "command": command,
-                "timeout_ms": 2_000,
-            });
-            Ok(vec![
-                sse(vec![
-                    ev_response_created("resp-1"),
-                    ev_function_call(call_id, "shell", &serde_json::to_string(&parameters)?),
-                    ev_completed("resp-1"),
-                ]),
-                sse(vec![
-                    ev_assistant_message("msg-1", "done"),
-                    ev_completed("resp-2"),
-                ]),
-            ])
-        }
-        ShellModelOutput::LocalShell => Ok(vec![
-            sse(vec![
-                ev_response_created("resp-1"),
-                ev_local_shell_call(call_id, "completed", command),
-                ev_completed("resp-1"),
-            ]),
-            sse(vec![
-                ev_assistant_message("msg-1", "done"),
-                ev_completed("resp-2"),
-            ]),
+fn shell_responses(call_id: &str, command: Vec<&str>) -> Result<Vec<String>> {
+    let command = shlex::try_join(command)?;
+    let parameters = json!({
+        "command": command,
+        "timeout_ms": 2_000,
+    });
+    Ok(vec![
+        sse(vec![
+            ev_response_created("resp-1"),
+            ev_function_call(
+                call_id,
+                "shell_command",
+                &serde_json::to_string(&parameters)?,
+            ),
+            ev_completed("resp-1"),
         ]),
-    }
-}
-
-fn configure_shell_model(
-    builder: TestCodexBuilder,
-    output_type: ShellModelOutput,
-    include_apply_patch_tool: bool,
-) -> TestCodexBuilder {
-    let builder = match (output_type, include_apply_patch_tool) {
-        (ShellModelOutput::ShellCommand, _) => builder.with_model("test-gpt-5-codex"),
-        (ShellModelOutput::LocalShell, true) => builder.with_model("gpt-5.4"),
-        (ShellModelOutput::Shell, true) => builder.with_model("gpt-5.4"),
-        (ShellModelOutput::LocalShell, false) => builder.with_model("test-local-shell-json"),
-        (ShellModelOutput::Shell, false) => builder.with_model("test-shell-json"),
-    };
-
-    builder.with_config(move |config| {
-        config.include_apply_patch_tool = include_apply_patch_tool;
-    })
+        sse(vec![
+            ev_assistant_message("msg-1", "done"),
+            ev_completed("resp-2"),
+        ]),
+    ])
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[test_case(ShellModelOutput::Shell)]
-#[test_case(ShellModelOutput::LocalShell)]
-async fn shell_output_stays_json_without_freeform_apply_patch(
-    output_type: ShellModelOutput,
-) -> Result<()> {
+async fn shell_output_preserves_fixture_json_as_freeform() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
     let server = start_mock_server().await;
-    let mut builder = configure_shell_model(
-        test_codex(),
-        output_type,
-        /*include_apply_patch_tool*/ false,
-    );
+    let mut builder = test_codex().with_model("test-gpt-5-codex");
     let test = builder.build(&server).await?;
 
-    let call_id = "shell-json";
-    let responses = shell_responses(call_id, vec!["/bin/echo", "shell json"], output_type)?;
+    let fixture_path = test.cwd.path().join("fixture.json");
+    fs::write(&fixture_path, FIXTURE_JSON)?;
+    let fixture_path_str = fixture_path.to_string_lossy().to_string();
+
+    let call_id = "shell-freeform-fixture";
+    let responses = shell_responses(
+        call_id,
+        vec!["/usr/bin/sed", "-n", "p", fixture_path_str.as_str()],
+    )?;
     let mock = mount_sse_sequence(&server, responses).await;
 
     test.submit_turn_with_permission_profile(
-        "run the json shell command",
+        "read the fixture JSON with shell output",
         PermissionProfile::Disabled,
     )
     .await?;
@@ -149,196 +89,13 @@ async fn shell_output_stays_json_without_freeform_apply_patch(
         .and_then(Value::as_str)
         .expect("shell output string");
 
-    let mut parsed: Value = serde_json::from_str(output)?;
-    if let Some(metadata) = parsed.get_mut("metadata").and_then(Value::as_object_mut) {
-        let _ = metadata.remove("duration_seconds");
-    }
-
-    assert_eq!(
-        parsed
-            .get("metadata")
-            .and_then(|metadata| metadata.get("exit_code"))
-            .and_then(Value::as_i64),
-        Some(0),
-        "expected zero exit code in unformatted JSON output",
-    );
-    let stdout = parsed
-        .get("output")
-        .and_then(Value::as_str)
-        .unwrap_or_default();
-    assert_regex_match(r"(?s)^shell json\n?$", stdout);
-
-    Ok(())
-}
-
-#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[test_case(ShellModelOutput::Shell)]
-#[test_case(ShellModelOutput::ShellCommand)]
-#[test_case(ShellModelOutput::LocalShell)]
-async fn shell_output_is_structured_with_freeform_apply_patch(
-    output_type: ShellModelOutput,
-) -> Result<()> {
-    skip_if_no_network!(Ok(()));
-
-    let server = start_mock_server().await;
-    let mut builder = configure_shell_model(
-        test_codex(),
-        output_type,
-        /*include_apply_patch_tool*/ true,
-    );
-    let test = builder.build(&server).await?;
-
-    let call_id = "shell-structured";
-    let responses = shell_responses(call_id, vec!["/bin/echo", "freeform shell"], output_type)?;
-    let mock = mount_sse_sequence(&server, responses).await;
-
-    test.submit_turn_with_permission_profile(
-        "run the structured shell command",
-        PermissionProfile::Disabled,
-    )
-    .await?;
-
-    let req = mock
-        .last_request()
-        .expect("structured shell output request recorded");
-    let output_item = req.function_call_output(call_id);
-    let output = output_item
-        .get("output")
-        .and_then(Value::as_str)
-        .expect("structured output string");
-
     assert!(
         serde_json::from_str::<Value>(output).is_err(),
-        "expected structured shell output to be plain text",
-    );
-    let expected_pattern = r"(?s)^Exit code: 0
-Wall time: [0-9]+(?:\.[0-9]+)? seconds
-Output:
-freeform shell
-?$";
-    assert_regex_match(expected_pattern, output);
-
-    Ok(())
-}
-
-#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[test_case(ShellModelOutput::Shell)]
-#[test_case(ShellModelOutput::LocalShell)]
-async fn shell_output_preserves_fixture_json_without_serialization(
-    output_type: ShellModelOutput,
-) -> Result<()> {
-    skip_if_no_network!(Ok(()));
-
-    let server = start_mock_server().await;
-    let mut builder = configure_shell_model(
-        test_codex(),
-        output_type,
-        /*include_apply_patch_tool*/ false,
-    );
-    let test = builder.build(&server).await?;
-
-    let fixture_path = test.cwd.path().join("fixture.json");
-    fs::write(&fixture_path, FIXTURE_JSON)?;
-    let fixture_path_str = fixture_path.to_string_lossy().to_string();
-
-    let call_id = "shell-json-fixture";
-    let responses = shell_responses(
-        call_id,
-        vec!["/usr/bin/sed", "-n", "p", fixture_path_str.as_str()],
-        output_type,
-    )?;
-    let mock = mount_sse_sequence(&server, responses).await;
-
-    test.submit_turn_with_permission_profile(
-        "read the fixture JSON with sed",
-        PermissionProfile::Disabled,
-    )
-    .await?;
-
-    let req = mock.last_request().expect("shell output request recorded");
-    let output_item = req.function_call_output(call_id);
-    let output = output_item
-        .get("output")
-        .and_then(Value::as_str)
-        .expect("shell output string");
-
-    let mut parsed: Value = serde_json::from_str(output)?;
-    if let Some(metadata) = parsed.get_mut("metadata").and_then(Value::as_object_mut) {
-        let _ = metadata.remove("duration_seconds");
-    }
-
-    assert_eq!(
-        parsed
-            .get("metadata")
-            .and_then(|metadata| metadata.get("exit_code"))
-            .and_then(Value::as_i64),
-        Some(0),
-        "expected zero exit code when serialization is disabled",
-    );
-    let stdout = parsed
-        .get("output")
-        .and_then(Value::as_str)
-        .unwrap_or_default()
-        .to_string();
-    assert_eq!(
-        stdout, FIXTURE_JSON,
-        "expected shell output to match the fixture contents"
-    );
-
-    Ok(())
-}
-
-#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[test_case(ShellModelOutput::Shell)]
-#[test_case(ShellModelOutput::ShellCommand)]
-#[test_case(ShellModelOutput::LocalShell)]
-async fn shell_output_structures_fixture_with_serialization(
-    output_type: ShellModelOutput,
-) -> Result<()> {
-    skip_if_no_network!(Ok(()));
-
-    let server = start_mock_server().await;
-    let mut builder = configure_shell_model(
-        test_codex(),
-        output_type,
-        /*include_apply_patch_tool*/ true,
-    );
-    let test = builder.build(&server).await?;
-
-    let fixture_path = test.cwd.path().join("fixture.json");
-    fs::write(&fixture_path, FIXTURE_JSON)?;
-    let fixture_path_str = fixture_path.to_string_lossy().to_string();
-
-    let call_id = "shell-structured-fixture";
-    let responses = shell_responses(
-        call_id,
-        vec!["/usr/bin/sed", "-n", "p", fixture_path_str.as_str()],
-        output_type,
-    )?;
-    let mock = mount_sse_sequence(&server, responses).await;
-
-    test.submit_turn_with_permission_profile(
-        "read the fixture JSON with structured output",
-        PermissionProfile::Disabled,
-    )
-    .await?;
-
-    let req = mock
-        .last_request()
-        .expect("structured output request recorded");
-    let output_item = req.function_call_output(call_id);
-    let output = output_item
-        .get("output")
-        .and_then(Value::as_str)
-        .expect("structured output string");
-
-    assert!(
-        serde_json::from_str::<Value>(output).is_err(),
-        "expected structured output to be plain text"
+        "expected shell output to be plain text"
     );
     let (header, body) = output
         .split_once("Output:\n")
-        .expect("structured output contains an Output section");
+        .expect("shell output contains an Output section");
     assert_regex_match(
         r"(?s)^Exit code: 0\nWall time: [0-9]+(?:\.[0-9]+)? seconds$",
         header.trim_end(),
@@ -352,40 +109,26 @@ async fn shell_output_structures_fixture_with_serialization(
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[test_case(ShellModelOutput::Shell)]
-#[test_case(ShellModelOutput::ShellCommand)]
-#[test_case(ShellModelOutput::LocalShell)]
-async fn shell_output_for_freeform_tool_records_duration(
-    output_type: ShellModelOutput,
-) -> Result<()> {
+async fn shell_output_records_duration() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
     let server = start_mock_server().await;
-    let mut builder = configure_shell_model(
-        test_codex(),
-        output_type,
-        /*include_apply_patch_tool*/ true,
-    );
+    let mut builder = test_codex().with_model("test-gpt-5-codex");
     let test = builder.build(&server).await?;
 
-    let call_id = "shell-structured";
-    let responses = shell_responses(call_id, vec!["/bin/sh", "-c", "sleep 0.2"], output_type)?;
+    let call_id = "shell-freeform";
+    let responses = shell_responses(call_id, vec!["/bin/sh", "-c", "sleep 0.2"])?;
     let mock = mount_sse_sequence(&server, responses).await;
 
-    test.submit_turn_with_permission_profile(
-        "run the structured shell command",
-        PermissionProfile::Disabled,
-    )
-    .await?;
+    test.submit_turn_with_permission_profile("run the shell command", PermissionProfile::Disabled)
+        .await?;
 
-    let req = mock
-        .last_request()
-        .expect("structured output request recorded");
+    let req = mock.last_request().expect("shell output request recorded");
     let output_item = req.function_call_output(call_id);
     let output = output_item
         .get("output")
         .and_then(Value::as_str)
-        .expect("structured output string");
+        .expect("shell output string");
 
     let expected_pattern = r#"(?s)^Exit code: 0
 Wall time: [0-9]+(?:\.[0-9]+)? seconds
@@ -399,7 +142,7 @@ $"#;
         .captures(output)
         .and_then(|caps| caps.get(1))
         .and_then(|value| value.as_str().parse::<f32>().ok())
-        .expect("expected structured shell output to contain wall time seconds");
+        .expect("expected shell output to contain wall time seconds");
     assert!(
         wall_time_seconds > 0.1,
         "expected wall time to be greater than zero seconds, got {wall_time_seconds}"
@@ -409,119 +152,7 @@ $"#;
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[test_case(ShellModelOutput::Shell)]
-#[test_case(ShellModelOutput::LocalShell)]
-async fn shell_output_reserializes_truncated_content(output_type: ShellModelOutput) -> Result<()> {
-    skip_if_no_network!(Ok(()));
-
-    let server = start_mock_server().await;
-    let mut builder = configure_shell_model(
-        test_codex(),
-        output_type,
-        /*include_apply_patch_tool*/ true,
-    )
-    .with_config(move |config| {
-        config.tool_output_token_limit = Some(200);
-    });
-    let test = builder.build(&server).await?;
-
-    let call_id = "shell-truncated";
-    let responses = shell_responses(call_id, vec!["/bin/sh", "-c", "seq 1 400"], output_type)?;
-    let mock = mount_sse_sequence(&server, responses).await;
-
-    test.submit_turn_with_permission_profile(
-        "run the truncation shell command",
-        PermissionProfile::Disabled,
-    )
-    .await?;
-
-    let req = mock
-        .last_request()
-        .expect("truncated output request recorded");
-    let output_item = req.function_call_output(call_id);
-    let output = output_item
-        .get("output")
-        .and_then(Value::as_str)
-        .expect("truncated output string");
-
-    assert!(
-        serde_json::from_str::<Value>(output).is_err(),
-        "expected truncated shell output to be plain text",
-    );
-    let truncated_pattern = r#"(?s)^Exit code: 0
-Wall time: [0-9]+(?:\.[0-9]+)? seconds
-Total output lines: 400
-Output:
-1
-2
-3
-4
-5
-6
-.*…46 tokens truncated….*
-396
-397
-398
-399
-400
-$"#;
-    assert_regex_match(truncated_pattern, output);
-
-    Ok(())
-}
-
-#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[test_case(ApplyPatchModelOutput::Freeform)]
-#[test_case(ApplyPatchModelOutput::Shell)]
-#[test_case(ApplyPatchModelOutput::ShellViaHeredoc)]
-async fn apply_patch_custom_tool_output_is_structured(
-    output_type: ApplyPatchModelOutput,
-) -> Result<()> {
-    skip_if_no_network!(Ok(()));
-
-    let harness = apply_patch_harness().await?;
-
-    let call_id = "apply-patch-structured";
-    let file_name = "structured.txt";
-    let patch = format!(
-        r#"*** Begin Patch
-*** Add File: {file_name}
-+from custom tool
-*** End Patch
-"#
-    );
-    mount_apply_patch(&harness, call_id, &patch, "done", output_type).await;
-
-    harness
-        .test()
-        .submit_turn_with_permission_profile(
-            "apply the patch via custom tool",
-            PermissionProfile::Disabled,
-        )
-        .await?;
-
-    let output = harness.apply_patch_output(call_id, output_type).await;
-
-    let expected_pattern = format!(
-        r"(?s)^Exit code: 0
-Wall time: [0-9]+(?:\.[0-9]+)? seconds
-Output:
-Success. Updated the following files:
-A {file_name}
-?$"
-    );
-    assert_regex_match(&expected_pattern, output.as_str());
-
-    Ok(())
-}
-
-#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[test_case(ApplyPatchModelOutput::Freeform)]
-#[test_case(ApplyPatchModelOutput::Shell)]
-#[test_case(ApplyPatchModelOutput::ShellViaHeredoc)]
-async fn apply_patch_custom_tool_call_creates_file(
-    output_type: ApplyPatchModelOutput,
-) -> Result<()> {
+async fn apply_patch_custom_tool_call_creates_file() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
     let harness = apply_patch_harness().await?;
@@ -531,7 +162,7 @@ async fn apply_patch_custom_tool_call_creates_file(
     let patch = format!(
         "*** Begin Patch\n*** Add File: {file_name}\n+custom tool content\n*** End Patch\n"
     );
-    mount_apply_patch(&harness, call_id, &patch, "apply_patch done", output_type).await;
+    mount_apply_patch(&harness, call_id, &patch, "apply_patch done").await;
 
     harness
         .test()
@@ -541,7 +172,7 @@ async fn apply_patch_custom_tool_call_creates_file(
         )
         .await?;
 
-    let output = harness.apply_patch_output(call_id, output_type).await;
+    let output = harness.apply_patch_output(call_id).await;
 
     let expected_pattern = format!(
         r"(?s)^Exit code: 0
@@ -563,12 +194,7 @@ A {file_name}
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[test_case(ApplyPatchModelOutput::Freeform)]
-#[test_case(ApplyPatchModelOutput::Shell)]
-#[test_case(ApplyPatchModelOutput::ShellViaHeredoc)]
-async fn apply_patch_custom_tool_call_updates_existing_file(
-    output_type: ApplyPatchModelOutput,
-) -> Result<()> {
+async fn apply_patch_custom_tool_call_updates_existing_file() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
     let harness = apply_patch_harness().await?;
@@ -579,14 +205,7 @@ async fn apply_patch_custom_tool_call_updates_existing_file(
     let patch = format!(
         "*** Begin Patch\n*** Update File: {file_name}\n@@\n-before\n+after\n*** End Patch\n"
     );
-    mount_apply_patch(
-        &harness,
-        call_id,
-        &patch,
-        "apply_patch update done",
-        output_type,
-    )
-    .await;
+    mount_apply_patch(&harness, call_id, &patch, "apply_patch update done").await;
 
     harness
         .test()
@@ -596,7 +215,7 @@ async fn apply_patch_custom_tool_call_updates_existing_file(
         )
         .await?;
 
-    let output = harness.apply_patch_output(call_id, output_type).await;
+    let output = harness.apply_patch_output(call_id).await;
 
     let expected_pattern = format!(
         r"(?s)^Exit code: 0
@@ -615,12 +234,7 @@ M {file_name}
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[test_case(ApplyPatchModelOutput::Freeform)]
-#[test_case(ApplyPatchModelOutput::Shell)]
-#[test_case(ApplyPatchModelOutput::ShellViaHeredoc)]
-async fn apply_patch_custom_tool_call_reports_failure_output(
-    output_type: ApplyPatchModelOutput,
-) -> Result<()> {
+async fn apply_patch_custom_tool_call_reports_failure_output() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
     let harness = apply_patch_harness().await?;
@@ -630,14 +244,7 @@ async fn apply_patch_custom_tool_call_reports_failure_output(
     let patch = format!(
         "*** Begin Patch\n*** Update File: {missing_file}\n@@\n-before\n+after\n*** End Patch\n"
     );
-    mount_apply_patch(
-        &harness,
-        call_id,
-        &patch,
-        "apply_patch failure done",
-        output_type,
-    )
-    .await;
+    mount_apply_patch(&harness, call_id, &patch, "apply_patch failure done").await;
 
     harness
         .test()
@@ -647,7 +254,7 @@ async fn apply_patch_custom_tool_call_reports_failure_output(
         )
         .await?;
 
-    let output = harness.apply_patch_output(call_id, output_type).await;
+    let output = harness.apply_patch_output(call_id).await;
 
     let expected_output = format!(
         "apply_patch verification failed: Failed to read file to update {}/{missing_file}: No such file or directory (os error 2)",
@@ -659,65 +266,15 @@ async fn apply_patch_custom_tool_call_reports_failure_output(
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[test_case(ApplyPatchModelOutput::Freeform)]
-#[test_case(ApplyPatchModelOutput::Shell)]
-#[test_case(ApplyPatchModelOutput::ShellViaHeredoc)]
-async fn apply_patch_tool_output_is_structured(output_type: ApplyPatchModelOutput) -> Result<()> {
-    skip_if_no_network!(Ok(()));
-
-    let harness = apply_patch_harness().await?;
-
-    let call_id = "apply-patch-function";
-    let file_name = "freeform_apply_patch.txt";
-    let patch =
-        format!("*** Begin Patch\n*** Add File: {file_name}\n+via apply_patch\n*** End Patch\n");
-    mount_apply_patch(
-        &harness,
-        call_id,
-        &patch,
-        "apply_patch function done",
-        output_type,
-    )
-    .await;
-    harness
-        .test()
-        .submit_turn_with_permission_profile(
-            "apply the patch via freeform apply_patch",
-            PermissionProfile::Disabled,
-        )
-        .await?;
-
-    let output = harness.apply_patch_output(call_id, output_type).await;
-    let expected_pattern = format!(
-        r"(?s)^Exit code: 0
-Wall time: [0-9]+(?:\.[0-9]+)? seconds
-Output:
-Success. Updated the following files:
-A {file_name}
-?$"
-    );
-    assert_regex_match(&expected_pattern, output.as_str());
-
-    Ok(())
-}
-
-#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-#[test_case(ShellModelOutput::Shell)]
-#[test_case(ShellModelOutput::ShellCommand)]
-#[test_case(ShellModelOutput::LocalShell)]
-async fn shell_output_is_structured_for_nonzero_exit(output_type: ShellModelOutput) -> Result<()> {
+async fn shell_output_is_freeform_for_nonzero_exit() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
     let server = start_mock_server().await;
-    let mut builder = test_codex()
-        .with_model("gpt-5.4")
-        .with_config(move |config| {
-            config.include_apply_patch_tool = true;
-        });
+    let mut builder = test_codex().with_model("gpt-5.4");
     let test = builder.build(&server).await?;
 
     let call_id = "shell-nonzero-exit";
-    let responses = shell_responses(call_id, vec!["/bin/sh", "-c", "exit 42"], output_type)?;
+    let responses = shell_responses(call_id, vec!["/bin/sh", "-c", "exit 42"])?;
     let mock = mount_sse_sequence(&server, responses).await;
 
     test.submit_turn_with_permission_profile(
@@ -747,9 +304,7 @@ async fn shell_command_output_is_freeform() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
     let server = start_mock_server().await;
-    let mut builder = test_codex().with_config(move |config| {
-        config.include_apply_patch_tool = true;
-    });
+    let mut builder = test_codex();
     let test = builder.build(&server).await?;
 
     let call_id = "shell-command";
@@ -897,52 +452,3 @@ Output:
 
     Ok(())
 }
-
-#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn local_shell_call_output_is_structured() -> Result<()> {
-    skip_if_no_network!(Ok(()));
-
-    let server = start_mock_server().await;
-    let mut builder = test_codex().with_model("gpt-5.4").with_config(|config| {
-        config.include_apply_patch_tool = true;
-    });
-    let test = builder.build(&server).await?;
-
-    let call_id = "local-shell-call";
-    let responses = vec![
-        sse(vec![
-            json!({"type": "response.created", "response": {"id": "resp-1"}}),
-            ev_local_shell_call(call_id, "completed", vec!["/bin/echo", "local shell"]),
-            ev_completed("resp-1"),
-        ]),
-        sse(vec![
-            ev_assistant_message("msg-1", "local shell done"),
-            ev_completed("resp-2"),
-        ]),
-    ];
-    let mock = mount_sse_sequence(&server, responses).await;
-
-    test.submit_turn_with_permission_profile(
-        "run the local shell command",
-        PermissionProfile::Disabled,
-    )
-    .await?;
-
-    let req = mock
-        .last_request()
-        .expect("local shell output request recorded");
-    let output_item = req.function_call_output(call_id);
-    let output = output_item
-        .get("output")
-        .and_then(Value::as_str)
-        .expect("local shell output string");
-
-    let expected_pattern = r"(?s)^Exit code: 0
-Wall time: [0-9]+(?:\.[0-9]+)? seconds
-Output:
-local shell
-?$";
-    assert_regex_match(expected_pattern, output);
-
-    Ok(())
-}
diff --git a/codex-rs/core/tests/suite/shell_snapshot.rs b/codex-rs/core/tests/suite/shell_snapshot.rs
index f757fa322a..14241ffafb 100644
--- a/codex-rs/core/tests/suite/shell_snapshot.rs
+++ b/codex-rs/core/tests/suite/shell_snapshot.rs
@@ -159,24 +159,29 @@ async fn run_snapshot_command_with_options(
         turn_permission_fields(PermissionProfile::Disabled, cwd.as_path());
 
     codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "run unified exec with shell snapshot".into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd,
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy,
-            permission_profile,
-            model: session_model,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(cwd),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: session_model,
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
 
@@ -254,24 +259,29 @@ async fn run_shell_command_snapshot_with_options(
         turn_permission_fields(PermissionProfile::Disabled, cwd.as_path());
 
     codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "run shell_command with shell snapshot".into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd,
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy,
-            permission_profile,
-            model: session_model,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(cwd),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: session_model,
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
 
@@ -329,24 +339,29 @@ async fn run_tool_turn_on_harness(
     let (sandbox_policy, permission_profile) =
         turn_permission_fields(PermissionProfile::Disabled, cwd.as_path());
     codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: prompt.into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd,
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy,
-            permission_profile,
-            model: session_model,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(cwd),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: session_model,
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
 
@@ -531,7 +546,6 @@ async fn shell_command_snapshot_still_intercepts_apply_patch() -> Result<()> {
             .features
             .enable(Feature::ShellSnapshot)
             .expect("test config should allow feature update");
-        config.include_apply_patch_tool = true;
     });
     let harness = TestCodexHarness::with_builder(builder).await?;
 
@@ -568,24 +582,29 @@ async fn shell_command_snapshot_still_intercepts_apply_patch() -> Result<()> {
     let (sandbox_policy, permission_profile) =
         turn_permission_fields(PermissionProfile::Disabled, cwd.as_path());
     codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "apply patch via shell_command with snapshot".into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd: cwd.clone(),
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy,
-            permission_profile,
-            model,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(cwd.clone()),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model,
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
 
diff --git a/codex-rs/core/tests/suite/skill_approval.rs b/codex-rs/core/tests/suite/skill_approval.rs
index 72244d534e..ad8ad6a91a 100644
--- a/codex-rs/core/tests/suite/skill_approval.rs
+++ b/codex-rs/core/tests/suite/skill_approval.rs
@@ -46,24 +46,29 @@ async fn submit_turn_with_policies(
     let (sandbox_policy, permission_profile) =
         turn_permission_fields(permission_profile, test.cwd_path());
     test.codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: prompt.to_string(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd: test.cwd_path().to_path_buf(),
-            approval_policy,
-            approvals_reviewer: None,
-            sandbox_policy,
-            permission_profile,
-            model: test.session_configured.model.clone(),
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(test.cwd_path().to_path_buf()),
+                approval_policy: Some(approval_policy),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: test.session_configured.model.clone(),
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
     Ok(())
diff --git a/codex-rs/core/tests/suite/skills.rs b/codex-rs/core/tests/suite/skills.rs
index 894110a6fb..9173f60c4a 100644
--- a/codex-rs/core/tests/suite/skills.rs
+++ b/codex-rs/core/tests/suite/skills.rs
@@ -50,7 +50,7 @@ async fn user_turn_includes_skill_instructions() -> Result<()> {
     let mut builder = test_codex().with_workspace_setup(move |cwd, fs| async move {
         write_repo_skill(cwd, fs, "demo", "demo skill", skill_body).await
     });
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_env(&server).await?;
 
     let skill_path = test
         .config
@@ -74,8 +74,7 @@ async fn user_turn_includes_skill_instructions() -> Result<()> {
     let (sandbox_policy, permission_profile) =
         turn_permission_fields(PermissionProfile::Disabled, test.config.cwd.as_path());
     test.codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![
                 UserInput::Text {
                     text: "please use $demo".to_string(),
@@ -86,18 +85,24 @@ async fn user_turn_includes_skill_instructions() -> Result<()> {
                     path: skill_path.clone(),
                 },
             ],
+            environments: None,
             final_output_json_schema: None,
-            cwd: test.config.cwd.to_path_buf(),
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy,
-            permission_profile,
-            model: session_model,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(test.config.cwd.to_path_buf()),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: session_model,
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
 
diff --git a/codex-rs/core/tests/suite/snapshots/all__suite__pending_input__pending_input_user_input_no_preempt_after_reasoning.snap b/codex-rs/core/tests/suite/snapshots/all__suite__pending_input__pending_input_user_input_no_preempt_after_reasoning.snap
index 724efd706a..d6bd5a7b22 100644
--- a/codex-rs/core/tests/suite/snapshots/all__suite__pending_input__pending_input_user_input_no_preempt_after_reasoning.snap
+++ b/codex-rs/core/tests/suite/snapshots/all__suite__pending_input__pending_input_user_input_no_preempt_after_reasoning.snap
@@ -16,5 +16,5 @@ Scenario: /responses POST bodies (input only, redacted like other suite snapshot
 03:reasoning:summary=thinking:encrypted=true
 04:function_call/shell
 05:message/assistant:first answer
-06:function_call_output:failed to parse function arguments: invalid type: string "echo preserved tool call", expected a sequence at line 1 column 37
+06:function_call_output:unsupported call: shell
 07:message/user:second prompt
diff --git a/codex-rs/core/tests/suite/spawn_agent_description.rs b/codex-rs/core/tests/suite/spawn_agent_description.rs
index 5aab77cd7d..9a7d70adeb 100644
--- a/codex-rs/core/tests/suite/spawn_agent_description.rs
+++ b/codex-rs/core/tests/suite/spawn_agent_description.rs
@@ -20,6 +20,7 @@ use core_test_support::responses::ev_completed;
 use core_test_support::responses::ev_response_created;
 use core_test_support::responses::mount_models_once;
 use core_test_support::responses::mount_sse_once;
+use core_test_support::responses::namespace_child_tool;
 use core_test_support::responses::sse;
 use core_test_support::responses::start_mock_server;
 use core_test_support::test_codex::test_codex;
@@ -28,22 +29,14 @@ use std::time::Duration;
 use std::time::Instant;
 use tokio::time::sleep;
 
+const MULTI_AGENT_V1_NAMESPACE: &str = "multi_agent_v1";
 const SPAWN_AGENT_TOOL_NAME: &str = "spawn_agent";
 
 fn spawn_agent_description(body: &Value) -> Option<String> {
-    body.get("tools")
-        .and_then(Value::as_array)
-        .and_then(|tools| {
-            tools.iter().find_map(|tool| {
-                if tool.get("name").and_then(Value::as_str) == Some(SPAWN_AGENT_TOOL_NAME) {
-                    tool.get("description")
-                        .and_then(Value::as_str)
-                        .map(str::to_string)
-                } else {
-                    None
-                }
-            })
-        })
+    namespace_child_tool(body, MULTI_AGENT_V1_NAMESPACE, SPAWN_AGENT_TOOL_NAME)
+        .and_then(|tool| tool.get("description"))
+        .and_then(Value::as_str)
+        .map(str::to_string)
 }
 
 fn test_model_info(
@@ -123,6 +116,10 @@ async fn spawn_agent_description_lists_visible_models_and_reasoning_efforts() ->
                             effort: ReasoningEffort::Low,
                             description: "Quick scan".to_string(),
                         },
+                        ReasoningEffortPreset {
+                            effort: ReasoningEffort::Medium,
+                            description: "Balanced".to_string(),
+                        },
                         ReasoningEffortPreset {
                             effort: ReasoningEffort::High,
                             description: "Deep dive".to_string(),
@@ -175,7 +172,7 @@ async fn spawn_agent_description_lists_visible_models_and_reasoning_efforts() ->
         spawn_agent_description(&body).expect("spawn_agent description should be present");
 
     assert!(
-        description.contains("- Visible Model (`visible-model`): Fast and capable"),
+        description.contains("- `visible-model`: Fast and capable"),
         "expected visible model summary in spawn_agent description: {description:?}"
     );
     assert!(
@@ -196,20 +193,15 @@ async fn spawn_agent_description_lists_visible_models_and_reasoning_efforts() ->
         "expected model override usage guidance in spawn_agent description: {description:?}"
     );
     assert!(
-        description.contains("Default reasoning effort: medium."),
+        description.contains("Reasoning efforts: low, medium (default), high."),
         "expected default reasoning effort in spawn_agent description: {description:?}"
     );
     assert!(
-        description.contains("low (Quick scan), high (Deep dive)."),
-        "expected reasoning efforts in spawn_agent description: {description:?}"
-    );
-    assert!(
-        description
-            .contains("Supported service tiers: priority (Fast: 1.5x speed, increased usage)."),
+        description.contains("Service tiers: priority."),
         "expected service tier guidance in spawn_agent description: {description:?}"
     );
     assert!(
-        !description.contains("Hidden Model"),
+        !description.contains("hidden-model"),
         "hidden picker model should be omitted from spawn_agent description: {description:?}"
     );
     assert!(
diff --git a/codex-rs/core/tests/suite/sqlite_state.rs b/codex-rs/core/tests/suite/sqlite_state.rs
index b2a2778047..f576e55a3d 100644
--- a/codex-rs/core/tests/suite/sqlite_state.rs
+++ b/codex-rs/core/tests/suite/sqlite_state.rs
@@ -168,6 +168,7 @@ async fn backfill_scans_existing_rollouts() -> Result<()> {
                         images: None,
                         local_images: Vec::new(),
                         text_elements: Vec::new(),
+                        ..Default::default()
                     })),
                 },
             ];
@@ -386,6 +387,7 @@ async fn mcp_call_marks_thread_memory_mode_polluted_when_configured() -> Result<
                 enabled_tools: None,
                 disabled_tools: None,
                 scopes: None,
+                oauth: None,
                 oauth_resource: None,
                 tools: HashMap::new(),
             },
@@ -403,24 +405,29 @@ async fn mcp_call_marks_thread_memory_mode_polluted_when_configured() -> Result<
         turn_permission_fields(PermissionProfile::read_only(), cwd.as_path());
 
     test.codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "call the rmcp echo tool".to_string(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd,
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy,
-            permission_profile,
-            model: test.session_configured.model.clone(),
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(cwd),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: test.session_configured.model.clone(),
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
     wait_for_event(&test.codex, |event| {
diff --git a/codex-rs/core/tests/suite/stream_error_allows_next_turn.rs b/codex-rs/core/tests/suite/stream_error_allows_next_turn.rs
index af86141261..5709cdd12b 100644
--- a/codex-rs/core/tests/suite/stream_error_allows_next_turn.rs
+++ b/codex-rs/core/tests/suite/stream_error_allows_next_turn.rs
@@ -101,6 +101,7 @@ async fn continue_after_stream_error() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
@@ -122,6 +123,7 @@ async fn continue_after_stream_error() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
diff --git a/codex-rs/core/tests/suite/stream_no_completed.rs b/codex-rs/core/tests/suite/stream_no_completed.rs
index 984220a086..40763960f4 100644
--- a/codex-rs/core/tests/suite/stream_no_completed.rs
+++ b/codex-rs/core/tests/suite/stream_no_completed.rs
@@ -6,8 +6,6 @@ use codex_model_provider_info::WireApi;
 use codex_protocol::protocol::EventMsg;
 use codex_protocol::protocol::Op;
 use codex_protocol::user_input::UserInput;
-use codex_utils_cargo_bin::find_resource;
-use core_test_support::load_sse_fixture;
 use core_test_support::responses;
 use core_test_support::skip_if_no_network;
 use core_test_support::streaming_sse::StreamingSseChunk;
@@ -17,9 +15,9 @@ use core_test_support::test_codex::test_codex;
 use core_test_support::wait_for_event;
 
 fn sse_incomplete() -> String {
-    let fixture = find_resource!("tests/fixtures/incomplete_sse.json")
-        .unwrap_or_else(|err| panic!("failed to resolve incomplete_sse fixture: {err}"));
-    load_sse_fixture(fixture)
+    responses::sse(vec![serde_json::json!({
+        "type": "response.output_item.done",
+    })])
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
@@ -85,6 +83,7 @@ async fn retries_on_early_close() {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .unwrap();
diff --git a/codex-rs/core/tests/suite/subagent_notifications.rs b/codex-rs/core/tests/suite/subagent_notifications.rs
index 3a0c37acc7..25d16faa51 100644
--- a/codex-rs/core/tests/suite/subagent_notifications.rs
+++ b/codex-rs/core/tests/suite/subagent_notifications.rs
@@ -7,10 +7,13 @@ use codex_protocol::openai_models::ReasoningEffort;
 use core_test_support::responses::ResponsesRequest;
 use core_test_support::responses::ev_assistant_message;
 use core_test_support::responses::ev_completed;
-use core_test_support::responses::ev_function_call;
+use core_test_support::responses::ev_function_call_with_namespace;
 use core_test_support::responses::ev_response_created;
+use core_test_support::responses::ev_tool_search_call;
 use core_test_support::responses::mount_response_once_match;
 use core_test_support::responses::mount_sse_once_match;
+use core_test_support::responses::mount_sse_sequence;
+use core_test_support::responses::namespace_child_tool;
 use core_test_support::responses::sse;
 use core_test_support::responses::sse_response;
 use core_test_support::responses::start_mock_server;
@@ -18,6 +21,7 @@ use core_test_support::skip_if_no_network;
 use core_test_support::test_codex::TestCodex;
 use core_test_support::test_codex::test_codex;
 use pretty_assertions::assert_eq;
+use serde_json::Value;
 use serde_json::json;
 use std::fs;
 use std::path::Path;
@@ -27,6 +31,7 @@ use tokio::time::sleep;
 use wiremock::MockServer;
 
 const SPAWN_CALL_ID: &str = "spawn-call-1";
+const MULTI_AGENT_V1_NAMESPACE: &str = "multi_agent_v1";
 const TURN_0_FORK_PROMPT: &str = "seed fork context";
 const TURN_1_PROMPT: &str = "spawn a child and continue";
 const TURN_2_NO_WAIT_PROMPT: &str = "follow up without wait";
@@ -37,6 +42,7 @@ const REQUESTED_MODEL: &str = "gpt-5.4";
 const REQUESTED_REASONING_EFFORT: ReasoningEffort = ReasoningEffort::Low;
 const ROLE_MODEL: &str = "gpt-5.4";
 const ROLE_REASONING_EFFORT: ReasoningEffort = ReasoningEffort::High;
+const SUBAGENT_START_CONTEXT: &str = "subagent start context reaches child";
 
 fn body_contains(req: &wiremock::Request, text: &str) -> bool {
     let is_zstd = req
@@ -64,28 +70,13 @@ fn has_subagent_notification(req: &ResponsesRequest) -> bool {
         .any(|text| text.contains("<subagent_notification>"))
 }
 
-fn tool_parameter_description(
-    req: &ResponsesRequest,
-    tool_name: &str,
-    parameter_name: &str,
-) -> Option<String> {
-    req.body_json()
-        .get("tools")
-        .and_then(serde_json::Value::as_array)
-        .and_then(|tools| {
-            tools.iter().find_map(|tool| {
-                if tool.get("name").and_then(serde_json::Value::as_str) == Some(tool_name) {
-                    tool.get("parameters")
-                        .and_then(|parameters| parameters.get("properties"))
-                        .and_then(|properties| properties.get(parameter_name))
-                        .and_then(|parameter| parameter.get("description"))
-                        .and_then(serde_json::Value::as_str)
-                        .map(str::to_owned)
-                } else {
-                    None
-                }
-            })
-        })
+fn tool_parameter_description(tool: &Value, parameter_name: &str) -> Option<String> {
+    tool.get("parameters")
+        .and_then(|parameters| parameters.get("properties"))
+        .and_then(|properties| properties.get(parameter_name))
+        .and_then(|parameter| parameter.get("description"))
+        .and_then(Value::as_str)
+        .map(str::to_owned)
 }
 
 fn role_block(description: &str, role_name: &str) -> Option<String> {
@@ -110,6 +101,96 @@ fn write_home_skill(codex_home: &Path, dir: &str, name: &str, description: &str)
     Ok(())
 }
 
+fn write_subagent_start_hooks(home: &Path) -> Result<()> {
+    let session_start_script_path = home.join("session_start_hook.py");
+    let session_start_log_path = home.join("session_start_hook_log.jsonl");
+    let session_start_script = format!(
+        r#"import json
+from pathlib import Path
+import sys
+
+log_path = Path(r"{session_start_log_path}")
+payload = json.load(sys.stdin)
+with log_path.open("a", encoding="utf-8") as handle:
+    handle.write(json.dumps(payload) + "\n")
+"#,
+        session_start_log_path = session_start_log_path.display(),
+    );
+
+    let start_script_path = home.join("subagent_start_hook.py");
+    let start_log_path = home.join("subagent_start_hook_log.jsonl");
+    let start_script = format!(
+        r#"import json
+from pathlib import Path
+import sys
+
+log_path = Path(r"{start_log_path}")
+payload = json.load(sys.stdin)
+with log_path.open("a", encoding="utf-8") as handle:
+    handle.write(json.dumps(payload) + "\n")
+print(json.dumps({{"hookSpecificOutput": {{"hookEventName": "SubagentStart", "additionalContext": {SUBAGENT_START_CONTEXT:?}}}}}))
+"#,
+        start_log_path = start_log_path.display(),
+    );
+
+    let hooks = serde_json::json!({
+        "hooks": {
+            "SessionStart": [{
+                "matcher": "startup",
+                "hooks": [{
+                    "type": "command",
+                    "command": format!("python3 {}", session_start_script_path.display()),
+                }]
+            }],
+            "SubagentStart": [{
+                "matcher": "worker",
+                "hooks": [{
+                    "type": "command",
+                    "command": format!("python3 {}", start_script_path.display()),
+                }]
+            }]
+        }
+    });
+
+    fs::write(&session_start_script_path, session_start_script)?;
+    fs::write(&start_script_path, start_script)?;
+    fs::write(home.join("hooks.json"), hooks.to_string())?;
+    Ok(())
+}
+
+fn read_hook_log(home: &Path, filename: &str) -> Result<Vec<serde_json::Value>> {
+    let path = home.join(filename);
+    if !path.exists() {
+        return Ok(Vec::new());
+    }
+    fs::read_to_string(path)?
+        .lines()
+        .filter(|line| !line.trim().is_empty())
+        .map(|line| serde_json::from_str(line).map_err(Into::into))
+        .collect()
+}
+
+async fn wait_for_hook_log(
+    home: &Path,
+    filename: &str,
+    expected_len: usize,
+) -> Result<Vec<serde_json::Value>> {
+    let deadline = Instant::now() + Duration::from_secs(2);
+    loop {
+        let inputs = read_hook_log(home, filename)?;
+        if inputs.len() >= expected_len {
+            return Ok(inputs);
+        }
+        if Instant::now() >= deadline {
+            anyhow::bail!(
+                "expected at least {expected_len} entries in {filename}, got {}",
+                inputs.len()
+            );
+        }
+        sleep(Duration::from_millis(10)).await;
+    }
+}
+
 async fn wait_for_spawned_thread_id(test: &TestCodex) -> Result<String> {
     let deadline = Instant::now() + Duration::from_secs(2);
     loop {
@@ -147,7 +228,7 @@ async fn setup_turn_one_with_spawned_child(
     server: &MockServer,
     child_response_delay: Option<Duration>,
 ) -> Result<(TestCodex, String)> {
-    setup_turn_one_with_custom_spawned_child(
+    let (test, spawned_id, _child_request_log) = setup_turn_one_with_custom_spawned_child(
         server,
         json!({
             "message": CHILD_PROMPT,
@@ -156,7 +237,8 @@ async fn setup_turn_one_with_spawned_child(
         /*wait_for_parent_notification*/ true,
         |builder| builder,
     )
-    .await
+    .await?;
+    Ok((test, spawned_id))
 }
 
 async fn setup_turn_one_with_custom_spawned_child(
@@ -167,7 +249,11 @@ async fn setup_turn_one_with_custom_spawned_child(
     configure_test: impl FnOnce(
         core_test_support::test_codex::TestCodexBuilder,
     ) -> core_test_support::test_codex::TestCodexBuilder,
-) -> Result<(TestCodex, String)> {
+) -> Result<(
+    TestCodex,
+    String,
+    core_test_support::responses::ResponseMock,
+)> {
     let spawn_args = serde_json::to_string(&spawn_args)?;
 
     mount_sse_once_match(
@@ -175,7 +261,12 @@ async fn setup_turn_one_with_custom_spawned_child(
         |req: &wiremock::Request| body_contains(req, TURN_1_PROMPT),
         sse(vec![
             ev_response_created("resp-turn1-1"),
-            ev_function_call(SPAWN_CALL_ID, "spawn_agent", &spawn_args),
+            ev_function_call_with_namespace(
+                SPAWN_CALL_ID,
+                MULTI_AGENT_V1_NAMESPACE,
+                "spawn_agent",
+                &spawn_args,
+            ),
             ev_completed("resp-turn1-1"),
         ]),
     )
@@ -252,7 +343,7 @@ async fn setup_turn_one_with_custom_spawned_child(
     }
     let spawned_id = wait_for_spawned_thread_id(&test).await?;
 
-    Ok((test, spawned_id))
+    Ok((test, spawned_id, child_request_log))
 }
 
 async fn spawn_child_and_capture_snapshot(
@@ -262,7 +353,7 @@ async fn spawn_child_and_capture_snapshot(
         core_test_support::test_codex::TestCodexBuilder,
     ) -> core_test_support::test_codex::TestCodexBuilder,
 ) -> Result<ThreadConfigSnapshot> {
-    let (test, spawned_id) = setup_turn_one_with_custom_spawned_child(
+    let (test, spawned_id, _child_request_log) = setup_turn_one_with_custom_spawned_child(
         server,
         spawn_args,
         /*child_response_delay*/ None,
@@ -279,6 +370,110 @@ async fn spawn_child_and_capture_snapshot(
         .await)
 }
 
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn subagent_start_replaces_session_start_and_injects_context() -> Result<()> {
+    skip_if_no_network!(Ok(()));
+
+    let server = start_mock_server().await;
+    let spawn_args = serde_json::to_string(&json!({
+        "message": CHILD_PROMPT,
+        "task_name": "child",
+        "agent_type": "worker",
+    }))?;
+
+    mount_sse_once_match(
+        &server,
+        |req: &wiremock::Request| body_contains(req, TURN_1_PROMPT),
+        sse(vec![
+            ev_response_created("resp-turn1-1"),
+            ev_function_call_with_namespace(
+                SPAWN_CALL_ID,
+                MULTI_AGENT_V1_NAMESPACE,
+                "spawn_agent",
+                &spawn_args,
+            ),
+            ev_completed("resp-turn1-1"),
+        ]),
+    )
+    .await;
+
+    let child_request_log = mount_sse_once_match(
+        &server,
+        |req: &wiremock::Request| {
+            body_contains(req, CHILD_PROMPT)
+                && body_contains(req, SUBAGENT_START_CONTEXT)
+                && !body_contains(req, "<subagent_notification>")
+                && !body_contains(req, SPAWN_CALL_ID)
+        },
+        sse(vec![
+            ev_response_created("resp-child-1"),
+            ev_assistant_message("msg-child-1", "child done"),
+            ev_completed("resp-child-1"),
+        ]),
+    )
+    .await;
+
+    let _turn1_followup = mount_sse_once_match(
+        &server,
+        |req: &wiremock::Request| body_contains(req, SPAWN_CALL_ID),
+        sse(vec![
+            ev_response_created("resp-turn1-2"),
+            ev_assistant_message("msg-turn1-2", "parent done"),
+            ev_completed("resp-turn1-2"),
+        ]),
+    )
+    .await;
+
+    let test = test_codex()
+        .with_pre_build_hook(|home| {
+            if let Err(error) = write_subagent_start_hooks(home) {
+                panic!("failed to write subagent hook fixture: {error}");
+            }
+        })
+        .with_config(|config| {
+            core_test_support::hooks::trust_discovered_hooks(config);
+            config
+                .features
+                .enable(Feature::Collab)
+                .expect("test config should allow feature update");
+        })
+        .build(&server)
+        .await?;
+
+    test.submit_turn(TURN_1_PROMPT).await?;
+    let child_requests = wait_for_requests(&child_request_log).await?;
+    assert_eq!(child_requests.len(), 1);
+
+    let start_inputs = wait_for_hook_log(
+        test.codex_home_path(),
+        "subagent_start_hook_log.jsonl",
+        /*expected_len*/ 1,
+    )
+    .await?;
+    assert_eq!(start_inputs.len(), 1);
+    assert_eq!(start_inputs[0]["agent_type"].as_str(), Some("worker"));
+    let spawned_id = wait_for_spawned_thread_id(&test).await?;
+    assert_eq!(
+        start_inputs[0]["agent_id"].as_str(),
+        Some(spawned_id.as_str())
+    );
+
+    let session_start_inputs = wait_for_hook_log(
+        test.codex_home_path(),
+        "session_start_hook_log.jsonl",
+        /*expected_len*/ 1,
+    )
+    .await?;
+    assert_eq!(session_start_inputs.len(), 1);
+    assert_eq!(session_start_inputs[0]["source"].as_str(), Some("startup"));
+    assert_ne!(
+        session_start_inputs[0]["session_id"].as_str(),
+        Some(spawned_id.as_str())
+    );
+
+    Ok(())
+}
+
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn subagent_notification_is_included_without_wait() -> Result<()> {
     skip_if_no_network!(Ok(()));
@@ -331,7 +526,12 @@ async fn spawned_child_receives_forked_parent_context() -> Result<()> {
         |req: &wiremock::Request| body_contains(req, TURN_1_PROMPT),
         sse(vec![
             ev_response_created("resp-turn1-1"),
-            ev_function_call(SPAWN_CALL_ID, "spawn_agent", &spawn_args),
+            ev_function_call_with_namespace(
+                SPAWN_CALL_ID,
+                MULTI_AGENT_V1_NAMESPACE,
+                "spawn_agent",
+                &spawn_args,
+            ),
             ev_completed("resp-turn1-1"),
         ]),
     )
@@ -437,15 +637,22 @@ async fn spawned_multi_agent_v2_child_inherits_parent_developer_context() -> Res
         |req: &wiremock::Request| body_contains(req, TURN_1_PROMPT),
         sse(vec![
             ev_response_created("resp-turn1-1"),
-            ev_function_call(SPAWN_CALL_ID, "spawn_agent", &spawn_args),
+            ev_function_call_with_namespace(
+                SPAWN_CALL_ID,
+                MULTI_AGENT_V1_NAMESPACE,
+                "spawn_agent",
+                &spawn_args,
+            ),
             ev_completed("resp-turn1-1"),
         ]),
     )
     .await;
 
-    let _child_request_log = mount_sse_once_match(
+    let child_request_log = mount_sse_once_match(
         &server,
-        |req: &wiremock::Request| body_contains(req, CHILD_PROMPT),
+        |req: &wiremock::Request| {
+            body_contains(req, CHILD_PROMPT) && !body_contains(req, SPAWN_CALL_ID)
+        },
         sse(vec![
             ev_response_created("resp-child-1"),
             ev_completed("resp-child-1"),
@@ -455,9 +662,7 @@ async fn spawned_multi_agent_v2_child_inherits_parent_developer_context() -> Res
 
     let _turn1_followup = mount_sse_once_match(
         &server,
-        |req: &wiremock::Request| {
-            body_contains(req, "function_call_output") && body_contains(req, "/root/worker")
-        },
+        |req: &wiremock::Request| body_contains(req, SPAWN_CALL_ID),
         sse(vec![
             ev_response_created("resp-turn1-2"),
             ev_assistant_message("msg-turn1-2", "parent done"),
@@ -481,29 +686,12 @@ async fn spawned_multi_agent_v2_child_inherits_parent_developer_context() -> Res
 
     test.submit_turn(TURN_1_PROMPT).await?;
 
-    let deadline = Instant::now() + Duration::from_secs(2);
-    let child_request = loop {
-        if let Some(request) = server
-            .received_requests()
-            .await
-            .unwrap_or_default()
-            .into_iter()
-            .find(|request| {
-                body_contains(request, CHILD_PROMPT) && !body_contains(request, SPAWN_CALL_ID)
-            })
-        {
-            break request;
-        }
-        if Instant::now() >= deadline {
-            anyhow::bail!("timed out waiting for spawned child request with developer context");
-        }
-        sleep(Duration::from_millis(10)).await;
-    };
-    assert!(body_contains(
-        &child_request,
-        "Parent developer instructions."
-    ));
-    assert!(body_contains(&child_request, CHILD_PROMPT));
+    let child_requests = wait_for_requests(&child_request_log).await?;
+    let child_request = child_requests
+        .last()
+        .expect("child request log should capture at least one request");
+    assert!(child_request.body_contains_text("Parent developer instructions."));
+    assert!(child_request.body_contains_text(CHILD_PROMPT));
 
     Ok(())
 }
@@ -522,15 +710,22 @@ async fn skills_toggle_skips_instructions_for_parent_and_spawned_child() -> Resu
         |req: &wiremock::Request| body_contains(req, TURN_1_PROMPT),
         sse(vec![
             ev_response_created("resp-turn1-1"),
-            ev_function_call(SPAWN_CALL_ID, "spawn_agent", &spawn_args),
+            ev_function_call_with_namespace(
+                SPAWN_CALL_ID,
+                MULTI_AGENT_V1_NAMESPACE,
+                "spawn_agent",
+                &spawn_args,
+            ),
             ev_completed("resp-turn1-1"),
         ]),
     )
     .await;
 
-    let _child_request_log = mount_sse_once_match(
+    let child_request_log = mount_sse_once_match(
         &server,
-        |req: &wiremock::Request| body_contains(req, CHILD_PROMPT),
+        |req: &wiremock::Request| {
+            body_contains(req, CHILD_PROMPT) && !body_contains(req, SPAWN_CALL_ID)
+        },
         sse(vec![
             ev_response_created("resp-child-1"),
             ev_completed("resp-child-1"),
@@ -540,9 +735,7 @@ async fn skills_toggle_skips_instructions_for_parent_and_spawned_child() -> Resu
 
     let _turn1_followup = mount_sse_once_match(
         &server,
-        |req: &wiremock::Request| {
-            body_contains(req, "function_call_output") && body_contains(req, "/root/worker")
-        },
+        |req: &wiremock::Request| body_contains(req, SPAWN_CALL_ID),
         sse(vec![
             ev_response_created("resp-turn1-2"),
             ev_assistant_message("msg-turn1-2", "parent done"),
@@ -575,26 +768,12 @@ async fn skills_toggle_skips_instructions_for_parent_and_spawned_child() -> Resu
     assert!(!parent_request.body_contains_text("<skills_instructions>"));
     assert!(!parent_request.body_contains_text("demo-skill"));
 
-    let deadline = Instant::now() + Duration::from_secs(2);
-    let child_request = loop {
-        if let Some(request) = server
-            .received_requests()
-            .await
-            .unwrap_or_default()
-            .into_iter()
-            .find(|request| {
-                body_contains(request, CHILD_PROMPT) && !body_contains(request, SPAWN_CALL_ID)
-            })
-        {
-            break request;
-        }
-        if Instant::now() >= deadline {
-            anyhow::bail!("timed out waiting for spawned child request");
-        }
-        sleep(Duration::from_millis(10)).await;
-    };
-    assert!(!body_contains(&child_request, "<skills_instructions>"));
-    assert!(!body_contains(&child_request, "demo-skill"));
+    let child_requests = wait_for_requests(&child_request_log).await?;
+    let child_request = child_requests
+        .last()
+        .expect("child request log should capture at least one request");
+    assert!(!child_request.body_contains_text("<skills_instructions>"));
+    assert!(!child_request.body_contains_text("demo-skill"));
 
     Ok(())
 }
@@ -646,14 +825,27 @@ async fn spawn_agent_tool_description_mentions_role_locked_settings() -> Result<
     skip_if_no_network!(Ok(()));
 
     let server = start_mock_server().await;
-    let resp_mock = mount_sse_once_match(
+    let call_id = "tool-search-spawn-agent";
+    let resp_mock = mount_sse_sequence(
         &server,
-        |req: &wiremock::Request| body_contains(req, TURN_1_PROMPT),
-        sse(vec![
-            ev_response_created("resp-turn1-1"),
-            ev_assistant_message("msg-turn1-1", "done"),
-            ev_completed("resp-turn1-1"),
-        ]),
+        vec![
+            sse(vec![
+                ev_response_created("resp-turn1-1"),
+                ev_tool_search_call(
+                    call_id,
+                    &json!({
+                        "query": "spawn agent custom role",
+                        "limit": 1,
+                    }),
+                ),
+                ev_completed("resp-turn1-1"),
+            ]),
+            sse(vec![
+                ev_response_created("resp-turn1-2"),
+                ev_assistant_message("msg-turn1-2", "done"),
+                ev_completed("resp-turn1-2"),
+            ]),
+        ],
     )
     .await;
 
@@ -683,8 +875,14 @@ async fn spawn_agent_tool_description_mentions_role_locked_settings() -> Result<
 
     test.submit_turn(TURN_1_PROMPT).await?;
 
-    let request = resp_mock.single_request();
-    let agent_type_description = tool_parameter_description(&request, "spawn_agent", "agent_type")
+    let requests = resp_mock.requests();
+    assert_eq!(requests.len(), 2);
+    let output = requests[1].tool_search_output(call_id);
+    let spawn_agent = namespace_child_tool(&output, "multi_agent_v1", "spawn_agent")
+        .unwrap_or_else(|| {
+            panic!("expected tool_search to return multi_agent_v1.spawn_agent: {output:?}")
+        });
+    let agent_type_description = tool_parameter_description(spawn_agent, "agent_type")
         .expect("spawn_agent agent_type description");
     let custom_role_description =
         role_block(&agent_type_description, "custom").expect("custom role description");
diff --git a/codex-rs/core/tests/suite/tool_harness.rs b/codex-rs/core/tests/suite/tool_harness.rs
index a2017c99b3..2227e5b34e 100644
--- a/codex-rs/core/tests/suite/tool_harness.rs
+++ b/codex-rs/core/tests/suite/tool_harness.rs
@@ -3,7 +3,6 @@
 use std::fs;
 
 use assert_matches::assert_matches;
-use codex_features::Feature;
 use codex_protocol::items::TurnItem;
 use codex_protocol::models::PermissionProfile;
 use codex_protocol::plan_tool::StepStatus;
@@ -18,7 +17,6 @@ use core_test_support::responses::ev_apply_patch_custom_tool_call;
 use core_test_support::responses::ev_assistant_message;
 use core_test_support::responses::ev_completed;
 use core_test_support::responses::ev_function_call;
-use core_test_support::responses::ev_local_shell_call;
 use core_test_support::responses::ev_response_created;
 use core_test_support::responses::sse;
 use core_test_support::responses::start_mock_server;
@@ -66,12 +64,12 @@ fn custom_call_output(req: &ResponsesRequest, call_id: &str) -> (String, Option<
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn shell_tool_executes_command_and_streams_output() -> anyhow::Result<()> {
+async fn shell_command_tool_executes_command_and_streams_output() -> anyhow::Result<()> {
     skip_if_no_network!(Ok(()));
 
     let server = start_mock_server().await;
 
-    let mut builder = test_codex().with_model("test-local-shell-json");
+    let mut builder = test_codex().with_model("test-gpt-5-codex");
     let TestCodex {
         codex,
         cwd,
@@ -79,11 +77,15 @@ async fn shell_tool_executes_command_and_streams_output() -> anyhow::Result<()>
         ..
     } = builder.build(&server).await?;
 
-    let call_id = "shell-tool-call";
-    let command = vec!["/bin/echo", "tool harness"];
+    let call_id = "shell-command-tool-call";
+    let command_args = json!({
+        "command": "echo tool harness",
+        "login": false,
+    })
+    .to_string();
     let first_response = sse(vec![
         ev_response_created("resp-1"),
-        ev_local_shell_call(call_id, "completed", command),
+        ev_function_call(call_id, "shell_command", &command_args),
         ev_completed("resp-1"),
     ]);
     responses::mount_sse_once(&server, first_response).await;
@@ -100,24 +102,29 @@ async fn shell_tool_executes_command_and_streams_output() -> anyhow::Result<()>
         turn_permission_fields(PermissionProfile::Disabled, cwd_path.as_path());
 
     codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "please run the shell command".into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd: cwd_path,
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy,
-            permission_profile,
-            model: session_model,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(cwd_path),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: session_model,
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
 
@@ -176,24 +183,29 @@ async fn update_plan_tool_emits_plan_update_event() -> anyhow::Result<()> {
         turn_permission_fields(PermissionProfile::Disabled, cwd_path.as_path());
 
     codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "please update the plan".into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd: cwd_path,
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy,
-            permission_profile,
-            model: session_model,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(cwd_path),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: session_model,
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
 
@@ -262,24 +274,29 @@ async fn update_plan_tool_rejects_malformed_payload() -> anyhow::Result<()> {
         turn_permission_fields(PermissionProfile::Disabled, cwd_path.as_path());
 
     codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "please update the plan".into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd: cwd_path,
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy,
-            permission_profile,
-            model: session_model,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(cwd_path),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: session_model,
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
 
@@ -321,12 +338,7 @@ async fn apply_patch_tool_executes_and_emits_patch_events() -> anyhow::Result<()
 
     let server = start_mock_server().await;
 
-    let mut builder = test_codex().with_config(|config| {
-        config
-            .features
-            .enable(Feature::ApplyPatchFreeform)
-            .expect("test config should allow feature update");
-    });
+    let mut builder = test_codex();
     let TestCodex {
         codex,
         cwd,
@@ -363,24 +375,29 @@ async fn apply_patch_tool_executes_and_emits_patch_events() -> anyhow::Result<()
         turn_permission_fields(PermissionProfile::Disabled, cwd_path.as_path());
 
     codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "please apply a patch".into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd: cwd_path,
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy,
-            permission_profile,
-            model: session_model,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(cwd_path),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: session_model,
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
 
@@ -464,12 +481,7 @@ async fn apply_patch_reports_parse_diagnostics() -> anyhow::Result<()> {
 
     let server = start_mock_server().await;
 
-    let mut builder = test_codex().with_config(|config| {
-        config
-            .features
-            .enable(Feature::ApplyPatchFreeform)
-            .expect("test config should allow feature update");
-    });
+    let mut builder = test_codex();
     let TestCodex {
         codex,
         cwd,
@@ -501,24 +513,29 @@ async fn apply_patch_reports_parse_diagnostics() -> anyhow::Result<()> {
         turn_permission_fields(PermissionProfile::Disabled, cwd_path.as_path());
 
     codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "please apply a patch".into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd: cwd_path,
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy,
-            permission_profile,
-            model: session_model,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(cwd_path),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: session_model,
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
 
diff --git a/codex-rs/core/tests/suite/tool_parallelism.rs b/codex-rs/core/tests/suite/tool_parallelism.rs
index 47282c283d..6663991e02 100644
--- a/codex-rs/core/tests/suite/tool_parallelism.rs
+++ b/codex-rs/core/tests/suite/tool_parallelism.rs
@@ -37,24 +37,29 @@ async fn run_turn(test: &TestCodex, prompt: &str) -> anyhow::Result<()> {
         turn_permission_fields(PermissionProfile::Disabled, test.cwd.path());
 
     test.codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: prompt.into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd: test.cwd.path().to_path_buf(),
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy,
-            permission_profile,
-            model: session_model,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(test.cwd.path().to_path_buf()),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: session_model,
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
 
@@ -358,24 +363,29 @@ async fn shell_tools_start_before_response_completed_when_stream_delayed() -> an
     let (sandbox_policy, permission_profile) =
         turn_permission_fields(PermissionProfile::Disabled, test.cwd.path());
     test.codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "stream delayed completion".into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd: test.cwd.path().to_path_buf(),
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy,
-            permission_profile,
-            model: session_model,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(test.cwd.path().to_path_buf()),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: session_model,
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
 
diff --git a/codex-rs/core/tests/suite/tools.rs b/codex-rs/core/tests/suite/tools.rs
index 737ea122d4..7949abfb60 100644
--- a/codex-rs/core/tests/suite/tools.rs
+++ b/codex-rs/core/tests/suite/tools.rs
@@ -71,7 +71,6 @@ async fn empty_turn_environments_omits_environment_backed_tools() -> Result<()>
             .features
             .enable(Feature::UnifiedExec)
             .expect("unified exec should enable for test");
-        config.include_apply_patch_tool = true;
     });
     let test = builder.build(&server).await?;
 
@@ -182,24 +181,26 @@ async fn custom_tool_unknown_returns_custom_output_error() -> Result<()> {
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn shell_escalated_permissions_rejected_then_ok() -> Result<()> {
+async fn shell_command_escalated_permissions_rejected_then_ok() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
     let server = start_mock_server().await;
-    let mut builder = test_codex().with_model("test-shell-json");
+    let mut builder = test_codex().with_model("test-gpt-5-codex");
     let test = builder.build(&server).await?;
 
-    let command = ["/bin/echo", "shell ok"];
-    let call_id_blocked = "shell-blocked";
-    let call_id_success = "shell-success";
+    let command = "echo shell ok";
+    let call_id_blocked = "shell-command-blocked";
+    let call_id_success = "shell-command-success";
 
     let first_args = json!({
         "command": command,
+        "login": false,
         "timeout_ms": 1_000,
         "sandbox_permissions": SandboxPermissions::RequireEscalated,
     });
     let second_args = json!({
         "command": command,
+        "login": false,
         "timeout_ms": 1_000,
     });
 
@@ -209,7 +210,7 @@ async fn shell_escalated_permissions_rejected_then_ok() -> Result<()> {
             ev_response_created("resp-1"),
             ev_function_call(
                 call_id_blocked,
-                "shell",
+                "shell_command",
                 &serde_json::to_string(&first_args)?,
             ),
             ev_completed("resp-1"),
@@ -222,7 +223,7 @@ async fn shell_escalated_permissions_rejected_then_ok() -> Result<()> {
             ev_response_created("resp-2"),
             ev_function_call(
                 call_id_success,
-                "shell",
+                "shell_command",
                 &serde_json::to_string(&second_args)?,
             ),
             ev_completed("resp-2"),
@@ -239,7 +240,7 @@ async fn shell_escalated_permissions_rejected_then_ok() -> Result<()> {
     .await;
 
     test.submit_turn_with_approval_and_permission_profile(
-        "run the shell command",
+        "run the shell_command script",
         AskForApproval::Never,
         PermissionProfile::Disabled,
     )
@@ -274,35 +275,32 @@ async fn shell_escalated_permissions_rejected_then_ok() -> Result<()> {
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn sandbox_denied_shell_returns_original_output() -> Result<()> {
+async fn sandbox_denied_shell_command_returns_original_output() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
     let server = start_mock_server().await;
     let mut builder = test_codex().with_model("gpt-5.4");
     let fixture = builder.build(&server).await?;
 
-    let call_id = "sandbox-denied-shell";
+    let call_id = "sandbox-denied-shell-command";
     let target_path = fixture.workspace_path("sandbox-denied.txt");
     let sentinel = "sandbox-denied sentinel output";
-    let command = vec![
-        "/bin/sh".to_string(),
-        "-c".to_string(),
-        format!(
-            "printf {sentinel:?}; printf {content:?} > {path:?}",
-            sentinel = format!("{sentinel}\n"),
-            content = "sandbox denied",
-            path = &target_path
-        ),
-    ];
+    let command = format!(
+        "printf {sentinel:?}; printf {content:?} > {path:?}",
+        sentinel = format!("{sentinel}\n"),
+        content = "sandbox denied",
+        path = &target_path
+    );
     let args = json!({
         "command": command,
+        "login": false,
         "timeout_ms": 5_000,
     });
 
     let responses = vec![
         sse(vec![
             ev_response_created("resp-1"),
-            ev_function_call(call_id, "shell", &serde_json::to_string(&args)?),
+            ev_function_call(call_id, "shell_command", &serde_json::to_string(&args)?),
             ev_completed("resp-1"),
         ]),
         sse(vec![
@@ -367,7 +365,7 @@ async fn sandbox_denied_shell_returns_original_output() -> Result<()> {
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn shell_enforces_glob_deny_read_policy() -> Result<()> {
+async fn shell_command_enforces_glob_deny_read_policy() -> Result<()> {
     skip_if_no_network!(Ok(()));
     skip_if_sandbox!(Ok(()));
 
@@ -382,7 +380,7 @@ async fn shell_enforces_glob_deny_read_policy() -> Result<()> {
                     path: FileSystemPath::GlobPattern {
                         pattern: format!("{}/**/*.env", config.cwd.as_path().display()),
                     },
-                    access: FileSystemAccessMode::None,
+                    access: FileSystemAccessMode::Deny,
                 });
             config
                 .permissions
@@ -403,24 +401,22 @@ async fn shell_enforces_glob_deny_read_policy() -> Result<()> {
     fs::write(&denied_path, format!("{secret}\n")).context("write denied fixture")?;
     fs::write(&allowed_path, format!("{allowed}\n")).context("write allowed fixture")?;
 
-    let call_id = "shell-glob-deny-read";
-    let command = vec![
-        "/bin/sh".to_string(),
-        "-c".to_string(),
-        "status=0; cat \"$1\" || status=$?; cat \"$2\"; exit \"$status\"".to_string(),
-        "sh".to_string(),
-        denied_path.to_string_lossy().into_owned(),
-        allowed_path.to_string_lossy().into_owned(),
-    ];
+    let call_id = "shell-command-glob-deny-read";
+    let command = format!(
+        "rc=0; cat {denied_path:?} || rc=$?; cat {allowed_path:?}; exit \"$rc\"",
+        denied_path = denied_path.to_string_lossy(),
+        allowed_path = allowed_path.to_string_lossy(),
+    );
     let args = json!({
         "command": command,
+        "login": false,
         "timeout_ms": 1_000,
     });
 
     let responses = vec![
         sse(vec![
             ev_response_created("resp-1"),
-            ev_function_call(call_id, "shell", &serde_json::to_string(&args)?),
+            ev_function_call(call_id, "shell_command", &serde_json::to_string(&args)?),
             ev_completed("resp-1"),
         ]),
         sse(vec![
@@ -537,17 +533,18 @@ async fn unified_exec_spec_toggle_end_to_end() -> Result<()> {
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn shell_timeout_includes_timeout_prefix_and_metadata() -> Result<()> {
+async fn shell_command_timeout_includes_timeout_prefix_and_metadata() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
     let server = start_mock_server().await;
-    let mut builder = test_codex().with_model("test-shell-json");
+    let mut builder = test_codex().with_model("test-gpt-5-codex");
     let test = builder.build(&server).await?;
 
-    let call_id = "shell-timeout";
+    let call_id = "shell-command-timeout";
     let timeout_ms = 50u64;
     let args = json!({
-        "command": ["/bin/sh", "-c", "yes line | head -n 400; sleep 1"],
+        "command": "yes line | head -n 400; sleep 1",
+        "login": false,
         "timeout_ms": timeout_ms,
     });
 
@@ -555,7 +552,7 @@ async fn shell_timeout_includes_timeout_prefix_and_metadata() -> Result<()> {
         &server,
         sse(vec![
             ev_response_created("resp-1"),
-            ev_function_call(call_id, "shell", &serde_json::to_string(&args)?),
+            ev_function_call(call_id, "shell_command", &serde_json::to_string(&args)?),
             ev_completed("resp-1"),
         ]),
     )
@@ -622,7 +619,7 @@ async fn shell_timeout_includes_timeout_prefix_and_metadata() -> Result<()> {
 }
 
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn shell_timeout_handles_background_grandchild_stdout() -> Result<()> {
+async fn shell_command_timeout_handles_background_grandchild_stdout() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
     let server = start_mock_server().await;
@@ -634,7 +631,7 @@ async fn shell_timeout_handles_background_grandchild_stdout() -> Result<()> {
     });
     let test = builder.build(&server).await?;
 
-    let call_id = "shell-grandchild-timeout";
+    let call_id = "shell-command-grandchild-timeout";
     let pid_path = test.cwd.path().join("grandchild_pid.txt");
     let script_path = test.cwd.path().join("spawn_detached.py");
     let script = format!(
@@ -651,7 +648,8 @@ time.sleep(60)
     fs::write(&script_path, script)?;
 
     let args = json!({
-        "command": ["python3", script_path.to_string_lossy()],
+        "command": format!("python3 {:?}", script_path.to_string_lossy()),
+        "login": false,
         "timeout_ms": 200,
     });
 
@@ -659,7 +657,7 @@ time.sleep(60)
         &server,
         sse(vec![
             ev_response_created("resp-1"),
-            ev_function_call(call_id, "shell", &serde_json::to_string(&args)?),
+            ev_function_call(call_id, "shell_command", &serde_json::to_string(&args)?),
             ev_completed("resp-1"),
         ]),
     )
@@ -716,82 +714,3 @@ time.sleep(60)
 
     Ok(())
 }
-
-#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
-async fn shell_spawn_failure_truncates_exec_error() -> Result<()> {
-    skip_if_no_network!(Ok(()));
-
-    let server = start_mock_server().await;
-    let mut builder = test_codex().with_config(|cfg| {
-        cfg.permissions
-            .set_permission_profile(PermissionProfile::Disabled)
-            .expect("set permission profile");
-    });
-    let test = builder.build(&server).await?;
-
-    let call_id = "shell-spawn-failure";
-    let bogus_component = "missing-bin-".repeat(700);
-    let bogus_exe = test
-        .cwd
-        .path()
-        .join(bogus_component)
-        .to_string_lossy()
-        .into_owned();
-
-    let args = json!({
-        "command": [bogus_exe],
-        "timeout_ms": 1_000,
-    });
-
-    mount_sse_once(
-        &server,
-        sse(vec![
-            ev_response_created("resp-1"),
-            ev_function_call(call_id, "shell", &serde_json::to_string(&args)?),
-            ev_completed("resp-1"),
-        ]),
-    )
-    .await;
-    let second_mock = mount_sse_once(
-        &server,
-        sse(vec![
-            ev_assistant_message("msg-1", "done"),
-            ev_completed("resp-2"),
-        ]),
-    )
-    .await;
-
-    test.submit_turn_with_approval_and_permission_profile(
-        "spawn a missing binary",
-        AskForApproval::Never,
-        PermissionProfile::Disabled,
-    )
-    .await?;
-
-    let failure_item = second_mock.single_request().function_call_output(call_id);
-
-    let output = failure_item
-        .get("output")
-        .and_then(Value::as_str)
-        .expect("spawn failure output string");
-
-    let spawn_error_pattern = r#"(?s)^Exit code: -?\d+
-Wall time: [0-9]+(?:\.[0-9]+)? seconds
-Output:
-execution error: .*$"#;
-    let spawn_truncated_pattern = r#"(?s)^Exit code: -?\d+
-Wall time: [0-9]+(?:\.[0-9]+)? seconds
-Total output lines: \d+
-Output:
-
-execution error: .*$"#;
-    let spawn_error_regex = Regex::new(spawn_error_pattern)?;
-    let spawn_truncated_regex = Regex::new(spawn_truncated_pattern)?;
-    if !spawn_error_regex.is_match(output) && !spawn_truncated_regex.is_match(output) {
-        let fallback_pattern = r"(?s)^execution error: .*$";
-        assert_regex_match(fallback_pattern, output);
-    }
-    assert!(output.len() <= 10 * 1024);
-
-    Ok(())
-}
diff --git a/codex-rs/core/tests/suite/truncation.rs b/codex-rs/core/tests/suite/truncation.rs
index 0fd072a70f..be9267934d 100644
--- a/codex-rs/core/tests/suite/truncation.rs
+++ b/codex-rs/core/tests/suite/truncation.rs
@@ -398,6 +398,7 @@ async fn mcp_tool_call_output_exceeds_limit_truncated_for_model() -> Result<()>
                 enabled_tools: None,
                 disabled_tools: None,
                 scopes: None,
+                oauth: None,
                 oauth_resource: None,
                 tools: HashMap::new(),
             },
@@ -497,6 +498,7 @@ async fn mcp_image_output_preserves_image_and_no_text_summary() -> Result<()> {
                 enabled_tools: None,
                 disabled_tools: None,
                 scopes: None,
+                oauth: None,
                 oauth_resource: None,
                 tools: HashMap::new(),
             },
@@ -513,24 +515,29 @@ async fn mcp_image_output_preserves_image_and_no_text_summary() -> Result<()> {
 
     fixture
         .codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "call the rmcp image tool".into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd: fixture.cwd.path().to_path_buf(),
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy,
-            permission_profile: Some(permission_profile),
-            model: session_model,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(fixture.cwd.path().to_path_buf()),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile: Some(permission_profile),
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: session_model,
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
 
@@ -779,6 +786,7 @@ async fn mcp_tool_call_output_not_truncated_with_custom_limit() -> Result<()> {
                 enabled_tools: None,
                 disabled_tools: None,
                 scopes: None,
+                oauth: None,
                 oauth_resource: None,
                 tools: HashMap::new(),
             },
diff --git a/codex-rs/core/tests/suite/unified_exec.rs b/codex-rs/core/tests/suite/unified_exec.rs
index 76ed9cdcbf..d61e427386 100644
--- a/codex-rs/core/tests/suite/unified_exec.rs
+++ b/codex-rs/core/tests/suite/unified_exec.rs
@@ -9,12 +9,12 @@ use codex_exec_server::CreateDirectoryOptions;
 use codex_features::Feature;
 use codex_protocol::models::PermissionProfile;
 use codex_protocol::models::ResponseItem;
+use codex_protocol::permissions::NetworkSandboxPolicy;
 use codex_protocol::protocol::AskForApproval;
 use codex_protocol::protocol::EventMsg;
 use codex_protocol::protocol::ExecCommandSource;
 use codex_protocol::protocol::ExecCommandStatus;
 use codex_protocol::protocol::Op;
-use codex_protocol::protocol::SandboxPolicy;
 use codex_protocol::user_input::UserInput;
 use core_test_support::assert_regex_match;
 use core_test_support::managed_network_requirements_loader;
@@ -34,6 +34,7 @@ use core_test_support::skip_if_windows;
 use core_test_support::test_codex::TestCodex;
 use core_test_support::test_codex::TestCodexHarness;
 use core_test_support::test_codex::test_codex;
+use core_test_support::test_codex::turn_permission_fields;
 use core_test_support::wait_for_event;
 use core_test_support::wait_for_event_match;
 use core_test_support::wait_for_event_with_timeout;
@@ -184,29 +185,36 @@ async fn wait_for_raw_unified_exec_output(
 async fn submit_unified_exec_turn(
     test: &TestCodex,
     prompt: &str,
-    sandbox_policy: SandboxPolicy,
+    permission_profile: PermissionProfile,
 ) -> Result<()> {
     let session_model = test.session_configured.model.clone();
+    let (sandbox_policy, permission_profile) =
+        turn_permission_fields(permission_profile, test.config.cwd.as_path());
 
     test.codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: prompt.into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd: test.config.cwd.to_path_buf(),
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy,
-            permission_profile: None,
-            model: session_model,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(test.config.cwd.to_path_buf()),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: session_model,
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
 
@@ -235,7 +243,6 @@ async fn unified_exec_intercepts_apply_patch_exec_command() -> Result<()> {
     skip_if_windows!(Ok(()));
 
     let builder = test_codex().with_config(|config| {
-        config.include_apply_patch_tool = true;
         config.use_experimental_unified_exec_tool = true;
         if let Err(err) = config.features.enable(Feature::UnifiedExec) {
             panic!("test config should allow feature update: {err}");
@@ -272,26 +279,33 @@ async fn unified_exec_intercepts_apply_patch_exec_command() -> Result<()> {
     let codex = test.codex.clone();
     let cwd = test.cwd_path().to_path_buf();
     let session_model = test.session_configured.model.clone();
+    let (sandbox_policy, permission_profile) =
+        turn_permission_fields(PermissionProfile::Disabled, &cwd);
 
     codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "apply patch via unified exec".into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd,
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy: SandboxPolicy::DangerFullAccess,
-            permission_profile: None,
-            model: session_model,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(cwd),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: session_model,
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
 
@@ -379,7 +393,7 @@ async fn unified_exec_emits_exec_command_begin_event() -> Result<()> {
             .enable(Feature::UnifiedExec)
             .expect("test config should allow feature update");
     });
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_env(&server).await?;
     let cwd = test.config.cwd.to_path_buf();
 
     let call_id = "uexec-begin-event";
@@ -403,7 +417,7 @@ async fn unified_exec_emits_exec_command_begin_event() -> Result<()> {
     ];
     mount_sse_sequence(&server, responses).await;
 
-    submit_unified_exec_turn(&test, "emit begin event", SandboxPolicy::DangerFullAccess).await?;
+    submit_unified_exec_turn(&test, "emit begin event", PermissionProfile::Disabled).await?;
 
     let begin_event = wait_for_event_match(&test.codex, |msg| match msg {
         EventMsg::ExecCommandBegin(event) if event.call_id == call_id => Some(event.clone()),
@@ -438,7 +452,7 @@ async fn unified_exec_resolves_relative_workdir() -> Result<()> {
             .enable(Feature::UnifiedExec)
             .expect("test config should allow feature update");
     });
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_env(&server).await?;
 
     let workdir_rel = std::path::PathBuf::from("uexec_relative_workdir");
     let workdir = create_workspace_directory(&test, &workdir_rel).await?;
@@ -467,7 +481,7 @@ async fn unified_exec_resolves_relative_workdir() -> Result<()> {
     submit_unified_exec_turn(
         &test,
         "run relative workdir test",
-        SandboxPolicy::DangerFullAccess,
+        PermissionProfile::Disabled,
     )
     .await?;
 
@@ -507,7 +521,7 @@ async fn unified_exec_respects_workdir_override() -> Result<()> {
             .enable(Feature::UnifiedExec)
             .expect("test config should allow feature update");
     });
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_env(&server).await?;
 
     let workdir = create_workspace_directory(&test, "uexec_workdir_test").await?;
 
@@ -532,7 +546,7 @@ async fn unified_exec_respects_workdir_override() -> Result<()> {
     ];
     let request_log = mount_sse_sequence(&server, responses).await;
 
-    submit_unified_exec_turn(&test, "run workdir test", SandboxPolicy::DangerFullAccess).await?;
+    submit_unified_exec_turn(&test, "run workdir test", PermissionProfile::Disabled).await?;
 
     let begin_event = wait_for_event_match(&test.codex, |msg| match msg {
         EventMsg::ExecCommandBegin(event) if event.call_id == call_id => Some(event.clone()),
@@ -572,7 +586,7 @@ async fn unified_exec_emits_exec_command_end_event() -> Result<()> {
             .enable(Feature::UnifiedExec)
             .expect("test config should allow feature update");
     });
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_env(&server).await?;
 
     let call_id = "uexec-end-event";
     let args = json!({
@@ -609,7 +623,7 @@ async fn unified_exec_emits_exec_command_end_event() -> Result<()> {
     ];
     mount_sse_sequence(&server, responses).await;
 
-    submit_unified_exec_turn(&test, "emit end event", SandboxPolicy::DangerFullAccess).await?;
+    submit_unified_exec_turn(&test, "emit end event", PermissionProfile::Disabled).await?;
 
     let end_event = wait_for_event_match(&test.codex, |msg| match msg {
         EventMsg::ExecCommandEnd(ev) if ev.call_id == call_id => Some(ev.clone()),
@@ -645,7 +659,7 @@ async fn unified_exec_emits_output_delta_for_exec_command() -> Result<()> {
             .enable(Feature::UnifiedExec)
             .expect("test config should allow feature update");
     });
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_env(&server).await?;
 
     let call_id = "uexec-delta-1";
     let args = json!({
@@ -667,7 +681,7 @@ async fn unified_exec_emits_output_delta_for_exec_command() -> Result<()> {
     ];
     mount_sse_sequence(&server, responses).await;
 
-    submit_unified_exec_turn(&test, "emit delta", SandboxPolicy::DangerFullAccess).await?;
+    submit_unified_exec_turn(&test, "emit delta", PermissionProfile::Disabled).await?;
 
     let event = wait_for_event_match(&test.codex, |msg| match msg {
         EventMsg::ExecCommandEnd(ev) if ev.call_id == call_id => Some(ev.clone()),
@@ -703,7 +717,7 @@ async fn unified_exec_full_lifecycle_with_background_end_event() -> Result<()> {
             .enable(Feature::UnifiedExec)
             .expect("test config should allow feature update");
     });
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_env(&server).await?;
 
     let call_id = "uexec-full-lifecycle";
     // This timing force the long-standing PTY
@@ -729,7 +743,7 @@ async fn unified_exec_full_lifecycle_with_background_end_event() -> Result<()> {
     submit_unified_exec_turn(
         &test,
         "exercise full unified exec lifecycle",
-        SandboxPolicy::DangerFullAccess,
+        PermissionProfile::Disabled,
     )
     .await?;
 
@@ -872,7 +886,7 @@ async fn unified_exec_short_lived_network_denial_emits_failed_end_event() -> Res
 #[allow(clippy::expect_used)]
 async fn unified_exec_network_denial_test(
     server: &wiremock::MockServer,
-) -> Result<(TestCodex, SandboxPolicy)> {
+) -> Result<(TestCodex, PermissionProfile)> {
     use codex_config::Constrained;
     use std::sync::Arc;
     use tempfile::TempDir;
@@ -891,11 +905,13 @@ mode = "limited"
 allow_local_binding = true
 "#,
     )?;
-    let mut sandbox_policy = SandboxPolicy::new_workspace_write_policy();
-    if let SandboxPolicy::WorkspaceWrite { network_access, .. } = &mut sandbox_policy {
-        *network_access = true;
-    }
-    let sandbox_policy_for_config = sandbox_policy.clone();
+    let permission_profile_for_config = PermissionProfile::workspace_write_with(
+        &[],
+        NetworkSandboxPolicy::Enabled,
+        /*exclude_tmpdir_env_var*/ false,
+        /*exclude_slash_tmp*/ false,
+    );
+    let permission_profile = permission_profile_for_config.clone();
     let mut builder = test_codex()
         .with_home(home)
         .with_cloud_requirements(managed_network_requirements_loader())
@@ -906,17 +922,18 @@ allow_local_binding = true
                 .enable(Feature::UnifiedExec)
                 .expect("test config should allow feature update");
             config.permissions.approval_policy = Constrained::allow_any(AskForApproval::Never);
-            config.permissions.permission_profile = Constrained::allow_any(
-                PermissionProfile::from_legacy_sandbox_policy(&sandbox_policy_for_config),
-            );
+            config
+                .permissions
+                .set_permission_profile(permission_profile_for_config)
+                .expect("set permission profile");
         });
-    let test = builder.build_remote_aware(server).await?;
+    let test = builder.build_with_remote_env(server).await?;
     assert!(
         test.config.permissions.network.is_some(),
         "expected managed network proxy config to be present"
     );
 
-    Ok((test, sandbox_policy))
+    Ok((test, permission_profile))
 }
 
 async fn mount_unified_exec_network_denial_responses(
@@ -991,7 +1008,7 @@ async fn unified_exec_emits_terminal_interaction_for_write_stdin() -> Result<()>
             .enable(Feature::UnifiedExec)
             .expect("test config should allow feature update");
     });
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_env(&server).await?;
 
     let open_call_id = "uexec-open";
     let open_args = json!({
@@ -1034,7 +1051,7 @@ async fn unified_exec_emits_terminal_interaction_for_write_stdin() -> Result<()>
     ];
     mount_sse_sequence(&server, responses).await;
 
-    submit_unified_exec_turn(&test, "stdin delta", SandboxPolicy::DangerFullAccess).await?;
+    submit_unified_exec_turn(&test, "stdin delta", PermissionProfile::Disabled).await?;
 
     let mut terminal_interaction = None;
 
@@ -1074,7 +1091,7 @@ async fn unified_exec_terminal_interaction_captures_delayed_output() -> Result<(
             .enable(Feature::UnifiedExec)
             .expect("test config should allow feature update");
     });
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_env(&server).await?;
 
     let open_call_id = "uexec-delayed-open";
     let open_args = json!({
@@ -1154,7 +1171,7 @@ async fn unified_exec_terminal_interaction_captures_delayed_output() -> Result<(
     submit_unified_exec_turn(
         &test,
         "delayed terminal interaction output",
-        SandboxPolicy::DangerFullAccess,
+        PermissionProfile::Disabled,
     )
     .await?;
 
@@ -1253,7 +1270,7 @@ async fn unified_exec_emits_one_begin_and_one_end_event() -> Result<()> {
             .enable(Feature::UnifiedExec)
             .expect("test config should allow feature update");
     });
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_env(&server).await?;
 
     let open_call_id = "uexec-open-session";
     let open_args = json!({
@@ -1299,7 +1316,7 @@ async fn unified_exec_emits_one_begin_and_one_end_event() -> Result<()> {
     submit_unified_exec_turn(
         &test,
         "check poll event behavior",
-        SandboxPolicy::DangerFullAccess,
+        PermissionProfile::Disabled,
     )
     .await?;
 
@@ -1367,7 +1384,7 @@ async fn exec_command_reports_chunk_and_exit_metadata() -> Result<()> {
             .enable(Feature::UnifiedExec)
             .expect("test config should allow feature update");
     });
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_env(&server).await?;
 
     let call_id = "uexec-metadata";
     let args = serde_json::json!({
@@ -1389,7 +1406,7 @@ async fn exec_command_reports_chunk_and_exit_metadata() -> Result<()> {
     ];
     let request_log = mount_sse_sequence(&server, responses).await;
 
-    submit_unified_exec_turn(&test, "run metadata test", SandboxPolicy::DangerFullAccess).await?;
+    submit_unified_exec_turn(&test, "run metadata test", PermissionProfile::Disabled).await?;
 
     wait_for_event(&test.codex, |event| {
         matches!(event, EventMsg::TurnComplete(_))
@@ -1462,7 +1479,7 @@ async fn exec_command_clamps_model_requested_max_output_tokens_to_policy() -> Re
             .enable(Feature::UnifiedExec)
             .expect("test config should allow feature update");
     });
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_env(&server).await?;
 
     let call_id = "uexec-clamped-max-output";
     let args = serde_json::json!({
@@ -1488,7 +1505,7 @@ async fn exec_command_clamps_model_requested_max_output_tokens_to_policy() -> Re
     submit_unified_exec_turn(
         &test,
         "run clamped max output test",
-        SandboxPolicy::DangerFullAccess,
+        PermissionProfile::Disabled,
     )
     .await?;
 
@@ -1524,7 +1541,7 @@ async fn write_stdin_clamps_model_requested_max_output_tokens_to_policy() -> Res
             .enable(Feature::UnifiedExec)
             .expect("test config should allow feature update");
     });
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_env(&server).await?;
 
     let start_call_id = "uexec-stdin-clamp-start";
     let start_args = serde_json::json!({
@@ -1571,7 +1588,7 @@ async fn write_stdin_clamps_model_requested_max_output_tokens_to_policy() -> Res
     submit_unified_exec_turn(
         &test,
         "run clamped write_stdin output test",
-        SandboxPolicy::DangerFullAccess,
+        PermissionProfile::Disabled,
     )
     .await?;
 
@@ -1611,7 +1628,7 @@ async fn unified_exec_defaults_to_pipe() -> Result<()> {
             .enable(Feature::UnifiedExec)
             .expect("test config should allow feature update");
     });
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_env(&server).await?;
 
     let call_id = "uexec-default-pipe";
     let args = serde_json::json!({
@@ -1636,7 +1653,7 @@ async fn unified_exec_defaults_to_pipe() -> Result<()> {
     submit_unified_exec_turn(
         &test,
         "check default pipe mode",
-        SandboxPolicy::DangerFullAccess,
+        PermissionProfile::Disabled,
     )
     .await?;
 
@@ -1680,7 +1697,7 @@ async fn unified_exec_can_enable_tty() -> Result<()> {
             .enable(Feature::UnifiedExec)
             .expect("test config should allow feature update");
     });
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_env(&server).await?;
 
     let call_id = "uexec-tty-enabled";
     let args = serde_json::json!({
@@ -1703,7 +1720,7 @@ async fn unified_exec_can_enable_tty() -> Result<()> {
     ];
     let request_log = mount_sse_sequence(&server, responses).await;
 
-    submit_unified_exec_turn(&test, "check tty enabled", SandboxPolicy::DangerFullAccess).await?;
+    submit_unified_exec_turn(&test, "check tty enabled", PermissionProfile::Disabled).await?;
 
     wait_for_event(&test.codex, |event| {
         matches!(event, EventMsg::TurnComplete(_))
@@ -1746,7 +1763,7 @@ async fn unified_exec_respects_early_exit_notifications() -> Result<()> {
             .enable(Feature::UnifiedExec)
             .expect("test config should allow feature update");
     });
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_env(&server).await?;
 
     let call_id = "uexec-early-exit";
     let args = serde_json::json!({
@@ -1770,7 +1787,7 @@ async fn unified_exec_respects_early_exit_notifications() -> Result<()> {
     submit_unified_exec_turn(
         &test,
         "watch early exit timing",
-        SandboxPolicy::DangerFullAccess,
+        PermissionProfile::Disabled,
     )
     .await?;
 
@@ -1829,7 +1846,7 @@ async fn write_stdin_returns_exit_metadata_and_clears_session() -> Result<()> {
             .enable(Feature::UnifiedExec)
             .expect("test config should allow feature update");
     });
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_env(&server).await?;
 
     let start_call_id = "uexec-cat-start";
     let send_call_id = "uexec-cat-send";
@@ -1889,7 +1906,7 @@ async fn write_stdin_returns_exit_metadata_and_clears_session() -> Result<()> {
     submit_unified_exec_turn(
         &test,
         "test write_stdin exit behavior",
-        SandboxPolicy::DangerFullAccess,
+        PermissionProfile::Disabled,
     )
     .await?;
 
@@ -1983,7 +2000,7 @@ async fn unified_exec_emits_end_event_when_session_dies_via_stdin() -> Result<()
             .enable(Feature::UnifiedExec)
             .expect("test config should allow feature update");
     });
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_env(&server).await?;
 
     let start_call_id = "uexec-end-on-exit-start";
     let start_args = serde_json::json!({
@@ -2042,7 +2059,7 @@ async fn unified_exec_emits_end_event_when_session_dies_via_stdin() -> Result<()
     ];
     mount_sse_sequence(&server, responses).await;
 
-    submit_unified_exec_turn(&test, "end on exit", SandboxPolicy::DangerFullAccess).await?;
+    submit_unified_exec_turn(&test, "end on exit", PermissionProfile::Disabled).await?;
 
     // We expect the ExecCommandEnd event to match the initial exec_command call_id.
     let end_event = wait_for_event_match(&test.codex, |msg| match msg {
@@ -2108,26 +2125,34 @@ async fn unified_exec_keeps_long_running_session_after_turn_end() -> Result<()>
     mount_sse_sequence(&server, responses).await;
 
     let session_model = session_configured.model.clone();
+    let turn_cwd = cwd.path().to_path_buf();
+    let (sandbox_policy, permission_profile) =
+        turn_permission_fields(PermissionProfile::Disabled, &turn_cwd);
 
     codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "keep unified exec process after turn end".into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd: cwd.path().to_path_buf(),
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy: SandboxPolicy::DangerFullAccess,
-            permission_profile: None,
-            model: session_model,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(turn_cwd),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: session_model,
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
 
@@ -2203,26 +2228,34 @@ async fn unified_exec_interrupt_preserves_long_running_session() -> Result<()> {
     mount_sse_sequence(&server, responses).await;
 
     let session_model = session_configured.model.clone();
+    let turn_cwd = cwd.path().to_path_buf();
+    let (sandbox_policy, permission_profile) =
+        turn_permission_fields(PermissionProfile::Disabled, &turn_cwd);
 
     codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "interrupt long-running unified exec".into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd: cwd.path().to_path_buf(),
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy: SandboxPolicy::DangerFullAccess,
-            permission_profile: None,
-            model: session_model,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(turn_cwd),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: session_model,
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
 
@@ -2266,7 +2299,7 @@ async fn unified_exec_reuses_session_via_stdin() -> Result<()> {
             .enable(Feature::UnifiedExec)
             .expect("test config should allow feature update");
     });
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_env(&server).await?;
 
     let first_call_id = "uexec-start";
     let first_args = serde_json::json!({
@@ -2308,7 +2341,7 @@ async fn unified_exec_reuses_session_via_stdin() -> Result<()> {
     ];
     let request_log = mount_sse_sequence(&server, responses).await;
 
-    submit_unified_exec_turn(&test, "run unified exec", SandboxPolicy::DangerFullAccess).await?;
+    submit_unified_exec_turn(&test, "run unified exec", PermissionProfile::Disabled).await?;
 
     wait_for_event(&test.codex, |event| {
         matches!(event, EventMsg::TurnComplete(_))
@@ -2365,7 +2398,7 @@ async fn unified_exec_streams_after_lagged_output() -> Result<()> {
             .enable(Feature::UnifiedExec)
             .expect("test config should allow feature update");
     });
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_env(&server).await?;
 
     let script = r#"python3 - <<'PY'
 import sys
@@ -2426,12 +2459,7 @@ PY
     ];
     let request_log = mount_sse_sequence(&server, responses).await;
 
-    submit_unified_exec_turn(
-        &test,
-        "exercise lag handling",
-        SandboxPolicy::DangerFullAccess,
-    )
-    .await?;
+    submit_unified_exec_turn(&test, "exercise lag handling", PermissionProfile::Disabled).await?;
     // This is a worst case scenario for the truncate logic, and CI can spend a
     // while draining the lagged tail before the follow-up tool call completes.
     wait_for_event_with_timeout(
@@ -2485,7 +2513,7 @@ async fn unified_exec_timeout_and_followup_poll() -> Result<()> {
             .enable(Feature::UnifiedExec)
             .expect("test config should allow feature update");
     });
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_env(&server).await?;
 
     let first_call_id = "uexec-timeout";
     let first_args = serde_json::json!({
@@ -2526,7 +2554,7 @@ async fn unified_exec_timeout_and_followup_poll() -> Result<()> {
     ];
     let request_log = mount_sse_sequence(&server, responses).await;
 
-    submit_unified_exec_turn(&test, "check timeout", SandboxPolicy::DangerFullAccess).await?;
+    submit_unified_exec_turn(&test, "check timeout", PermissionProfile::Disabled).await?;
 
     loop {
         let event = test.codex.next_event().await.expect("event");
@@ -2574,7 +2602,7 @@ async fn unified_exec_formats_large_output_summary() -> Result<()> {
             .enable(Feature::UnifiedExec)
             .expect("test config should allow feature update");
     });
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_env(&server).await?;
 
     let script = r#"python3 - <<'PY'
 import sys
@@ -2602,12 +2630,7 @@ PY
     ];
     let request_log = mount_sse_sequence(&server, responses).await;
 
-    submit_unified_exec_turn(
-        &test,
-        "summarize large output",
-        SandboxPolicy::DangerFullAccess,
-    )
-    .await?;
+    submit_unified_exec_turn(&test, "summarize large output", PermissionProfile::Disabled).await?;
 
     wait_for_event(&test.codex, |event| {
         matches!(event, EventMsg::TurnComplete(_))
@@ -2677,27 +2700,34 @@ async fn unified_exec_runs_under_sandbox() -> Result<()> {
     let request_log = mount_sse_sequence(&server, responses).await;
 
     let session_model = session_configured.model.clone();
+    let turn_cwd = cwd.path().to_path_buf();
+    let (sandbox_policy, permission_profile) =
+        turn_permission_fields(PermissionProfile::read_only(), &turn_cwd);
 
     codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "summarize large output".into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd: cwd.path().to_path_buf(),
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            // Important!
-            sandbox_policy: SandboxPolicy::new_read_only_policy(),
-            permission_profile: None,
-            model: session_model,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(turn_cwd),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: session_model,
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
 
@@ -2721,7 +2751,6 @@ async fn unified_exec_runs_under_sandbox() -> Result<()> {
 #[cfg(unix)]
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn unified_exec_enforces_glob_deny_read_policy() -> Result<()> {
-    use codex_config::Constrained;
     use codex_protocol::models::PermissionProfile;
     use codex_protocol::permissions::FileSystemAccessMode;
     use codex_protocol::permissions::FileSystemPath;
@@ -2733,16 +2762,11 @@ async fn unified_exec_enforces_glob_deny_read_policy() -> Result<()> {
     skip_if_sandbox!(Ok(()));
 
     let server = start_mock_server().await;
-    let read_only_policy = SandboxPolicy::new_read_only_policy();
-    let read_only_policy_for_config = read_only_policy.clone();
     let mut builder = test_codex().with_config(move |config| {
         config
             .features
             .enable(Feature::UnifiedExec)
             .expect("test config should allow feature update");
-        config
-            .set_legacy_sandbox_policy(read_only_policy_for_config)
-            .expect("set sandbox policy");
         let mut file_system_sandbox_policy = FileSystemSandboxPolicy::default();
         file_system_sandbox_policy
             .entries
@@ -2750,13 +2774,15 @@ async fn unified_exec_enforces_glob_deny_read_policy() -> Result<()> {
                 path: FileSystemPath::GlobPattern {
                     pattern: format!("{}/**/*.env", config.cwd.as_path().display()),
                 },
-                access: FileSystemAccessMode::None,
+                access: FileSystemAccessMode::Deny,
             });
-        config.permissions.permission_profile =
-            Constrained::allow_any(PermissionProfile::from_runtime_permissions(
+        config
+            .permissions
+            .set_permission_profile(PermissionProfile::from_runtime_permissions(
                 &file_system_sandbox_policy,
                 NetworkSandboxPolicy::Restricted,
-            ));
+            ))
+            .expect("set permission profile");
     });
     let TestCodex {
         codex,
@@ -2797,25 +2823,33 @@ async fn unified_exec_enforces_glob_deny_read_policy() -> Result<()> {
     let request_log = mount_sse_sequence(&server, responses).await;
 
     let session_model = session_configured.model.clone();
+    let turn_cwd = cwd.path().to_path_buf();
+    let (sandbox_policy, permission_profile) =
+        turn_permission_fields(PermissionProfile::read_only(), &turn_cwd);
     codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "read the fixture files".into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd: cwd.path().to_path_buf(),
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy: read_only_policy,
-            permission_profile: None,
-            model: session_model,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(turn_cwd),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: session_model,
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
 
@@ -2926,26 +2960,34 @@ async fn unified_exec_python_prompt_under_seatbelt() -> Result<()> {
     let request_log = mount_sse_sequence(&server, responses).await;
 
     let session_model = session_configured.model.clone();
+    let turn_cwd = cwd.path().to_path_buf();
+    let (sandbox_policy, permission_profile) =
+        turn_permission_fields(PermissionProfile::read_only(), &turn_cwd);
 
     codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "start python under seatbelt".into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd: cwd.path().to_path_buf(),
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy: SandboxPolicy::new_read_only_policy(),
-            permission_profile: None,
-            model: session_model,
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(turn_cwd),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: session_model,
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
 
@@ -3002,7 +3044,7 @@ async fn unified_exec_runs_on_all_platforms() -> Result<()> {
             .enable(Feature::UnifiedExec)
             .expect("test config should allow feature update");
     });
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_env(&server).await?;
 
     let call_id = "uexec";
     let args = serde_json::json!({
@@ -3022,12 +3064,7 @@ async fn unified_exec_runs_on_all_platforms() -> Result<()> {
     ];
     let request_log = mount_sse_sequence(&server, responses).await;
 
-    submit_unified_exec_turn(
-        &test,
-        "summarize large output",
-        SandboxPolicy::DangerFullAccess,
-    )
-    .await?;
+    submit_unified_exec_turn(&test, "summarize large output", PermissionProfile::Disabled).await?;
 
     wait_for_event(&test.codex, |event| {
         matches!(event, EventMsg::TurnComplete(_))
@@ -3066,7 +3103,7 @@ async fn unified_exec_prunes_exited_sessions_first() -> Result<()> {
             .enable(Feature::UnifiedExec)
             .expect("test config should allow feature update");
     });
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_env(&server).await?;
 
     const MAX_SESSIONS_FOR_TEST: i32 = 64;
     const FILLER_SESSIONS: i32 = MAX_SESSIONS_FOR_TEST - 1;
@@ -3145,7 +3182,7 @@ async fn unified_exec_prunes_exited_sessions_first() -> Result<()> {
     let response_mock =
         mount_sse_sequence(&server, vec![first_response, completion_response]).await;
 
-    submit_unified_exec_turn(&test, "fill session cache", SandboxPolicy::DangerFullAccess).await?;
+    submit_unified_exec_turn(&test, "fill session cache", PermissionProfile::Disabled).await?;
 
     wait_for_event(&test.codex, |event| {
         matches!(event, EventMsg::TurnComplete(_))
diff --git a/codex-rs/core/tests/suite/user_notification.rs b/codex-rs/core/tests/suite/user_notification.rs
index 5fe08789f4..343afd8d53 100644
--- a/codex-rs/core/tests/suite/user_notification.rs
+++ b/codex-rs/core/tests/suite/user_notification.rs
@@ -64,6 +64,7 @@ mv "${tmp_path}" "${payload_path}""#,
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(&codex, |ev| matches!(ev, EventMsg::TurnComplete(_))).await;
diff --git a/codex-rs/core/tests/suite/user_shell_cmd.rs b/codex-rs/core/tests/suite/user_shell_cmd.rs
index 1285b9f925..536ee7b495 100644
--- a/codex-rs/core/tests/suite/user_shell_cmd.rs
+++ b/codex-rs/core/tests/suite/user_shell_cmd.rs
@@ -174,24 +174,29 @@ async fn user_shell_command_does_not_replace_active_turn() -> anyhow::Result<()>
 
     fixture
         .codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "run model shell command".to_string(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd,
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy,
-            permission_profile,
-            model: fixture.session_configured.model.clone(),
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(cwd),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: fixture.session_configured.model.clone(),
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
 
@@ -344,11 +349,13 @@ async fn user_shell_command_does_not_set_network_sandbox_env_var() -> anyhow::Re
     let server = responses::start_mock_server().await;
     let mut builder = core_test_support::test_codex::test_codex().with_config(|config| {
         let file_system_sandbox_policy = config.permissions.file_system_sandbox_policy();
-        config.permissions.permission_profile =
-            codex_config::Constrained::allow_any(PermissionProfile::from_runtime_permissions(
+        config
+            .permissions
+            .set_permission_profile(PermissionProfile::from_runtime_permissions(
                 &file_system_sandbox_policy,
                 NetworkSandboxPolicy::Restricted,
-            ));
+            ))
+            .expect("set permission profile");
     });
     let test = builder.build(&server).await?;
 
diff --git a/codex-rs/core/tests/suite/view_image.rs b/codex-rs/core/tests/suite/view_image.rs
index 4ff2062b40..6306b88b8f 100644
--- a/codex-rs/core/tests/suite/view_image.rs
+++ b/codex-rs/core/tests/suite/view_image.rs
@@ -72,21 +72,26 @@ const VIEW_IMAGE_TURN_COMPLETE_TIMEOUT: Duration = Duration::from_secs(30);
 fn disabled_user_turn(test: &TestCodex, items: Vec<UserInput>, model: String) -> Op {
     let (sandbox_policy, permission_profile) =
         turn_permission_fields(PermissionProfile::Disabled, test.config.cwd.as_path());
-    Op::UserTurn {
-        environments: None,
+    Op::UserInput {
         items,
+        environments: None,
         final_output_json_schema: None,
-        cwd: test.config.cwd.to_path_buf(),
-        approval_policy: AskForApproval::Never,
-        approvals_reviewer: None,
-        sandbox_policy,
-        permission_profile,
-        model,
-        effort: None,
-        summary: None,
-        service_tier: None,
-        collaboration_mode: None,
-        personality: None,
+        responsesapi_client_metadata: None,
+        thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+            cwd: Some(test.config.cwd.to_path_buf()),
+            approval_policy: Some(AskForApproval::Never),
+            sandbox_policy: Some(sandbox_policy),
+            permission_profile,
+            collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                mode: codex_protocol::config_types::ModeKind::Default,
+                settings: codex_protocol::config_types::Settings {
+                    model,
+                    reasoning_effort: None,
+                    developer_instructions: None,
+                },
+            }),
+            ..Default::default()
+        },
     }
 }
 
@@ -174,7 +179,7 @@ async fn assert_user_turn_local_image_resizes_to(
     let server = start_mock_server().await;
 
     let mut builder = test_codex();
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_env(&server).await?;
     let TestCodex {
         codex,
         session_configured,
@@ -201,6 +206,7 @@ async fn assert_user_turn_local_image_resizes_to(
             &test,
             vec![UserInput::LocalImage {
                 path: abs_path.clone(),
+                detail: None,
             }],
             session_model,
         ))
@@ -266,7 +272,7 @@ async fn view_image_tool_attaches_local_image() -> anyhow::Result<()> {
 
     let server = start_mock_server().await;
     let mut builder = test_codex();
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_env(&server).await?;
     let TestCodex {
         codex,
         session_configured,
@@ -521,7 +527,7 @@ async fn view_image_tool_applies_local_sandbox_read_denies() -> anyhow::Result<(
             path: FileSystemPath::Path {
                 path: denied_path.clone(),
             },
-            access: FileSystemAccessMode::None,
+            access: FileSystemAccessMode::Deny,
         });
     let permission_profile = PermissionProfile::from_runtime_permissions(
         &file_system_sandbox_policy,
@@ -562,7 +568,7 @@ async fn view_image_routes_to_selected_remote_environment() -> anyhow::Result<()
 
     let server = start_mock_server().await;
     let mut builder = test_codex();
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_and_local_env(&server).await?;
     let local_cwd = TempDir::new()?;
     fs::write(local_cwd.path().join("remote.png"), b"not a remote image")?;
     let local_selection = TurnEnvironmentSelection {
@@ -582,9 +588,7 @@ async fn view_image_routes_to_selected_remote_environment() -> anyhow::Result<()
             /*sandbox*/ None,
         )
         .await?;
-    let png = BASE64_STANDARD.decode(
-        "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mP8/x8AAwMCAO+/p9sAAAAASUVORK5CYII=",
-    )?;
+    let png = png_bytes(/*width*/ 1, /*height*/ 1, [0, 255, 0, 255])?;
     test.fs()
         .write_file(&image_path, png, /*sandbox*/ None)
         .await?;
@@ -664,7 +668,7 @@ async fn view_image_tool_can_preserve_original_resolution_when_requested_on_gpt5
 
     let server = start_mock_server().await;
     let mut builder = test_codex().with_model("gpt-5.3-codex");
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_env(&server).await?;
     let TestCodex {
         codex,
         session_configured,
@@ -755,7 +759,7 @@ async fn view_image_tool_errors_clearly_for_unsupported_detail_values() -> anyho
 
     let server = start_mock_server().await;
     let mut builder = test_codex().with_model("gpt-5.3-codex");
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_env(&server).await?;
     let TestCodex {
         codex,
         session_configured,
@@ -816,7 +820,7 @@ async fn view_image_tool_errors_clearly_for_unsupported_detail_values() -> anyho
         .expect("output text present");
     assert_eq!(
         output_text,
-        "view_image.detail only supports `original`; omit `detail` for default resized behavior, got `low`"
+        "view_image.detail only supports `high` or `original`; omit `detail` for default high resized behavior, got `low`"
     );
 
     assert!(
@@ -833,7 +837,7 @@ async fn view_image_tool_treats_null_detail_as_omitted() -> anyhow::Result<()> {
 
     let server = start_mock_server().await;
     let mut builder = test_codex().with_model("gpt-5.3-codex");
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_env(&server).await?;
     let TestCodex {
         codex,
         session_configured,
@@ -923,7 +927,7 @@ async fn view_image_tool_resizes_when_model_lacks_original_detail_support() -> a
 
     let server = start_mock_server().await;
     let mut builder = test_codex().with_model("gpt-5.2");
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_env(&server).await?;
     let TestCodex {
         codex,
         session_configured,
@@ -1017,7 +1021,7 @@ async fn view_image_tool_does_not_force_original_resolution_with_capability_only
 
     let server = start_mock_server().await;
     let mut builder = test_codex().with_model("gpt-5.3-codex");
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_env(&server).await?;
     let TestCodex {
         codex,
         session_configured,
@@ -1108,7 +1112,7 @@ async fn view_image_tool_errors_when_path_is_directory() -> anyhow::Result<()> {
     let server = start_mock_server().await;
 
     let mut builder = test_codex();
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_env(&server).await?;
     let TestCodex {
         codex,
         session_configured,
@@ -1178,7 +1182,7 @@ async fn view_image_tool_errors_for_non_image_files() -> anyhow::Result<()> {
     let server = start_mock_server().await;
 
     let mut builder = test_codex();
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_env(&server).await?;
     let TestCodex {
         codex,
         session_configured,
@@ -1255,7 +1259,7 @@ async fn view_image_tool_errors_when_file_missing() -> anyhow::Result<()> {
     let server = start_mock_server().await;
 
     let mut builder = test_codex();
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_env(&server).await?;
     let TestCodex {
         codex,
         config,
@@ -1385,7 +1389,7 @@ async fn view_image_tool_returns_unsupported_message_for_text_only_model() -> an
         .with_config(|config| {
             config.model = Some(model_slug.to_string());
         });
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_env(&server).await?;
     let TestCodex { codex, .. } = &test;
 
     let rel_path = "assets/example.png";
@@ -1472,7 +1476,7 @@ async fn replaces_invalid_local_image_after_bad_request() -> anyhow::Result<()>
     let completion_mock = responses::mount_sse_once(&server, success_response).await;
 
     let mut builder = test_codex();
-    let test = builder.build_remote_aware(&server).await?;
+    let test = builder.build_with_remote_env(&server).await?;
     let TestCodex {
         codex,
         session_configured,
@@ -1489,6 +1493,7 @@ async fn replaces_invalid_local_image_after_bad_request() -> anyhow::Result<()>
             &test,
             vec![UserInput::LocalImage {
                 path: abs_path.clone(),
+                detail: None,
             }],
             session_model,
         ))
diff --git a/codex-rs/core/tests/suite/websocket_fallback.rs b/codex-rs/core/tests/suite/websocket_fallback.rs
index f073ce7ab8..32a6e30caf 100644
--- a/codex-rs/core/tests/suite/websocket_fallback.rs
+++ b/codex-rs/core/tests/suite/websocket_fallback.rs
@@ -152,24 +152,29 @@ async fn websocket_fallback_hides_first_websocket_retry_stream_error() -> Result
         turn_permission_fields(PermissionProfile::Disabled, cwd.path());
 
     codex
-        .submit(Op::UserTurn {
-            environments: None,
+        .submit(Op::UserInput {
             items: vec![UserInput::Text {
                 text: "hello".into(),
                 text_elements: Vec::new(),
             }],
+            environments: None,
             final_output_json_schema: None,
-            cwd: cwd.path().to_path_buf(),
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: None,
-            sandbox_policy,
-            permission_profile,
-            model: session_configured.model.clone(),
-            effort: None,
-            summary: None,
-            service_tier: None,
-            collaboration_mode: None,
-            personality: None,
+            responsesapi_client_metadata: None,
+            thread_settings: codex_protocol::protocol::ThreadSettingsOverrides {
+                cwd: Some(cwd.path().to_path_buf()),
+                approval_policy: Some(AskForApproval::Never),
+                sandbox_policy: Some(sandbox_policy),
+                permission_profile,
+                collaboration_mode: Some(codex_protocol::config_types::CollaborationMode {
+                    mode: codex_protocol::config_types::ModeKind::Default,
+                    settings: codex_protocol::config_types::Settings {
+                        model: session_configured.model.clone(),
+                        reasoning_effort: None,
+                        developer_instructions: None,
+                    },
+                }),
+                ..Default::default()
+            },
         })
         .await?;
 
diff --git a/codex-rs/core/tests/suite/window_headers.rs b/codex-rs/core/tests/suite/window_headers.rs
index d0e207d963..76fcacf7a9 100644
--- a/codex-rs/core/tests/suite/window_headers.rs
+++ b/codex-rs/core/tests/suite/window_headers.rs
@@ -112,6 +112,7 @@ async fn submit_user_turn(codex: &Arc<CodexThread>, text: &str) -> Result<()> {
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await?;
     wait_for_event(codex, |event| matches!(event, EventMsg::TurnComplete(_))).await;
diff --git a/codex-rs/core/tests/suite/windows_sandbox.rs b/codex-rs/core/tests/suite/windows_sandbox.rs
index d0919b3dee..189248be3a 100644
--- a/codex-rs/core/tests/suite/windows_sandbox.rs
+++ b/codex-rs/core/tests/suite/windows_sandbox.rs
@@ -91,13 +91,13 @@ async fn windows_restricted_token_rejects_exact_and_glob_deny_read_policy() -> a
             path: FileSystemPath::GlobPattern {
                 pattern: "**/*.env".to_string(),
             },
-            access: FileSystemAccessMode::None,
+            access: FileSystemAccessMode::Deny,
         },
         FileSystemSandboxEntry {
             path: FileSystemPath::Path {
                 path: future_secret,
             },
-            access: FileSystemAccessMode::None,
+            access: FileSystemAccessMode::Deny,
         },
     ]);
     let permission_profile = PermissionProfile::from_runtime_permissions(
@@ -173,11 +173,11 @@ async fn windows_elevated_enforces_exact_and_glob_deny_read_policy() -> anyhow::
             path: FileSystemPath::GlobPattern {
                 pattern: "**/*.env".to_string(),
             },
-            access: FileSystemAccessMode::None,
+            access: FileSystemAccessMode::Deny,
         },
         FileSystemSandboxEntry {
             path: FileSystemPath::Path { path: exact_secret },
-            access: FileSystemAccessMode::None,
+            access: FileSystemAccessMode::Deny,
         },
     ]);
     let permission_profile = PermissionProfile::from_runtime_permissions(
diff --git a/codex-rs/docs/protocol_v1.md b/codex-rs/docs/protocol_v1.md
index d18aa669ca..464e8187b4 100644
--- a/codex-rs/docs/protocol_v1.md
+++ b/codex-rs/docs/protocol_v1.md
@@ -70,7 +70,7 @@ For complete documentation of the `Op` and `EventMsg` variants, refer to [protoc
   - `Op::Interrupt` – Interrupts a running turn
   - `Op::ExecApproval` – Approve or deny code execution
   - `Op::UserInputAnswer` – Provide answers for a `request_user_input` tool call
-  - `Op::UserTurn` and `Op::OverrideTurnContext` accept an optional `personality` override that updates the model’s communication style
+  - `Op::UserInput` accepts an optional `personality` turn-context override that updates the model’s communication style
 
 Valid `personality` values are `friendly`, `pragmatic`, and `none`. When `none` is selected, the personality placeholder is replaced with an empty string.
 
diff --git a/codex-rs/exec-server/Cargo.toml b/codex-rs/exec-server/Cargo.toml
index 09a9a71ea0..d842094a16 100644
--- a/codex-rs/exec-server/Cargo.toml
+++ b/codex-rs/exec-server/Cargo.toml
@@ -17,6 +17,7 @@ axum = { workspace = true, features = ["http1", "tokio", "ws"] }
 base64 = { workspace = true }
 bytes = { workspace = true }
 codex-app-server-protocol = { workspace = true }
+codex-api = { workspace = true }
 codex-client = { workspace = true }
 codex-file-system = { workspace = true }
 codex-protocol = { workspace = true }
@@ -51,6 +52,7 @@ uuid = { workspace = true, features = ["v4"] }
 anyhow = { workspace = true }
 codex-test-binary-support = { workspace = true }
 ctor = { workspace = true }
+http = { workspace = true }
 pretty_assertions = { workspace = true }
 serial_test = { workspace = true }
 tempfile = { workspace = true }
diff --git a/codex-rs/exec-server/README.md b/codex-rs/exec-server/README.md
index 1eaf6e69eb..01439108f8 100644
--- a/codex-rs/exec-server/README.md
+++ b/codex-rs/exec-server/README.md
@@ -26,7 +26,11 @@ The CLI entrypoint supports:
 
 Remote mode registers the local exec-server with the executor registry,
 then reconnects to the service-provided rendezvous websocket as the executor.
-It requires a bearer token in `CODEX_EXEC_SERVER_REMOTE_BEARER_TOKEN`.
+It uses the standard Codex ChatGPT sign-in state; run `codex login` first when
+remote registration needs authentication. Containerized callers that receive an
+Agent Identity JWT in `CODEX_ACCESS_TOKEN` can opt into that auth path with
+`--use-agent-identity-auth`; Codex then registers an Agent task and sends the
+derived AgentAssertion headers on the registry request.
 
 Wire framing:
 
@@ -376,7 +380,9 @@ The crate exports:
 
 Callers must pass `ExecServerRuntimePaths` to `run_main()`. The top-level
 `codex exec-server` command builds these paths from the `codex` arg0 dispatch
-state.
+state. `RemoteExecutorConfig::new(...)` also takes the auth provider that
+remote registration should use; the CLI builds that provider from Codex auth
+state before starting remote mode.
 
 ## Example session
 
diff --git a/codex-rs/exec-server/src/connection.rs b/codex-rs/exec-server/src/connection.rs
index d5ff1f966f..b211c504ac 100644
--- a/codex-rs/exec-server/src/connection.rs
+++ b/codex-rs/exec-server/src/connection.rs
@@ -30,6 +30,10 @@ use tokio::io::BufWriter;
 
 pub(crate) const CHANNEL_CAPACITY: usize = 128;
 const STDIO_TERMINATION_GRACE_PERIOD: Duration = Duration::from_secs(2);
+#[cfg(test)]
+pub(crate) const WEBSOCKET_KEEPALIVE_INTERVAL: Duration = Duration::from_millis(25);
+#[cfg(not(test))]
+pub(crate) const WEBSOCKET_KEEPALIVE_INTERVAL: Duration = Duration::from_secs(30);
 
 #[derive(Debug)]
 pub(crate) enum JsonRpcConnectionEvent {
@@ -319,23 +323,20 @@ impl JsonRpcConnection {
     where
         S: AsyncRead + AsyncWrite + Unpin + Send + 'static,
     {
-        let (websocket_writer, websocket_reader) = stream.split();
-        Self::from_websocket_parts(websocket_writer, websocket_reader, connection_label)
+        Self::from_websocket_stream(stream, connection_label, /*ping_interval*/ None)
     }
 
     pub(crate) fn from_axum_websocket(stream: AxumWebSocket, connection_label: String) -> Self {
-        let (websocket_writer, websocket_reader) = stream.split();
-        Self::from_websocket_parts(websocket_writer, websocket_reader, connection_label)
+        Self::from_websocket_stream(stream, connection_label, Some(WEBSOCKET_KEEPALIVE_INTERVAL))
     }
 
-    fn from_websocket_parts<W, R, M, E>(
-        mut websocket_writer: W,
-        mut websocket_reader: R,
+    fn from_websocket_stream<T, M, E>(
+        mut websocket: T,
         connection_label: String,
+        ping_interval: Option<Duration>,
     ) -> Self
     where
-        W: Sink<M, Error = E> + Unpin + Send + 'static,
-        R: Stream<Item = Result<M, E>> + Unpin + Send + 'static,
+        T: Sink<M, Error = E> + Stream<Item = Result<M, E>> + Unpin + Send + 'static,
         M: JsonRpcWebSocketMessage,
         E: std::fmt::Display + Send + 'static,
     {
@@ -343,92 +344,104 @@ impl JsonRpcConnection {
         let (incoming_tx, incoming_rx) = mpsc::channel(CHANNEL_CAPACITY);
         let (disconnected_tx, disconnected_rx) = watch::channel(false);
 
-        let reader_label = connection_label.clone();
-        let incoming_tx_for_reader = incoming_tx.clone();
-        let disconnected_tx_for_reader = disconnected_tx.clone();
-        let reader_task = tokio::spawn(async move {
+        let websocket_task = tokio::spawn(async move {
+            let mut ping_interval = ping_interval.map(|ping_interval| {
+                let mut interval = tokio::time::interval_at(
+                    tokio::time::Instant::now() + ping_interval,
+                    ping_interval,
+                );
+                interval.set_missed_tick_behavior(tokio::time::MissedTickBehavior::Skip);
+                interval
+            });
+
             loop {
-                match websocket_reader.next().await {
-                    Some(Ok(message)) => match message.parse_jsonrpc_frame() {
-                        Ok(JsonRpcWebSocketFrame::Message(message)) => {
-                            if incoming_tx_for_reader
-                                .send(JsonRpcConnectionEvent::Message(message))
-                                .await
-                                .is_err()
-                            {
-                                break;
-                            }
-                        }
-                        Err(err) => {
-                            send_malformed_message(
-                                &incoming_tx_for_reader,
-                                Some(format!(
-                                    "failed to parse websocket JSON-RPC message from {reader_label}: {err}"
-                                )),
-                            )
-                            .await;
-                        }
-                        Ok(JsonRpcWebSocketFrame::Close) => {
-                            send_disconnected(
-                                &incoming_tx_for_reader,
-                                &disconnected_tx_for_reader,
-                                /*reason*/ None,
-                            )
-                            .await;
+                tokio::select! {
+                    maybe_message = outgoing_rx.recv() => {
+                        let Some(message) = maybe_message else {
+                            break;
+                        };
+                        if let Err(reason) = send_websocket_jsonrpc_message(
+                            &mut websocket,
+                            &connection_label,
+                            &message,
+                        )
+                        .await
+                        {
+                            send_disconnected(&incoming_tx, &disconnected_tx, Some(reason)).await;
                             break;
                         }
-                        Ok(JsonRpcWebSocketFrame::Ignore) => {}
-                    },
-                    Some(Err(err)) => {
-                        send_disconnected(
-                            &incoming_tx_for_reader,
-                            &disconnected_tx_for_reader,
-                            Some(format!(
-                                "failed to read websocket JSON-RPC message from {reader_label}: {err}"
-                            )),
-                        )
-                        .await;
-                        break;
                     }
-                    None => {
-                        send_disconnected(
-                            &incoming_tx_for_reader,
-                            &disconnected_tx_for_reader,
-                            /*reason*/ None,
-                        )
-                        .await;
-                        break;
-                    }
-                }
-            }
-        });
-
-        let writer_task = tokio::spawn(async move {
-            while let Some(message) = outgoing_rx.recv().await {
-                match serialize_jsonrpc_message(&message) {
-                    Ok(encoded) => {
-                        if let Err(err) = websocket_writer.send(M::from_text(encoded)).await {
+                    _ = async {
+                        match ping_interval.as_mut() {
+                            Some(interval) => interval.tick().await,
+                            None => std::future::pending().await,
+                        }
+                    } => {
+                        if let Err(err) = websocket.send(M::ping()).await {
                             send_disconnected(
                                 &incoming_tx,
                                 &disconnected_tx,
                                 Some(format!(
-                                    "failed to write websocket JSON-RPC message to {connection_label}: {err}"
+                                    "failed to write websocket ping to {connection_label}: {err}"
                                 )),
                             )
                             .await;
                             break;
                         }
                     }
-                    Err(err) => {
-                        send_disconnected(
-                            &incoming_tx,
-                            &disconnected_tx,
-                            Some(format!(
-                                "failed to serialize JSON-RPC message for {connection_label}: {err}"
-                            )),
-                        )
-                        .await;
-                        break;
+                    incoming_message = websocket.next() => {
+                        match incoming_message {
+                            Some(Ok(message)) => match message.parse_jsonrpc_frame() {
+                                Ok(JsonRpcWebSocketFrame::Message(message)) => {
+                                    if incoming_tx
+                                        .send(JsonRpcConnectionEvent::Message(message))
+                                        .await
+                                        .is_err()
+                                    {
+                                        break;
+                                    }
+                                }
+                                Ok(JsonRpcWebSocketFrame::Close) => {
+                                    send_disconnected(
+                                        &incoming_tx,
+                                        &disconnected_tx,
+                                        /*reason*/ None,
+                                    )
+                                    .await;
+                                    break;
+                                }
+                                Ok(JsonRpcWebSocketFrame::Ignore) => {}
+                                Err(err) => {
+                                    send_malformed_message(
+                                        &incoming_tx,
+                                        Some(format!(
+                                            "failed to parse websocket JSON-RPC message from {connection_label}: {err}"
+                                        )),
+                                    )
+                                    .await;
+                                }
+                            },
+                            Some(Err(err)) => {
+                                send_disconnected(
+                                    &incoming_tx,
+                                    &disconnected_tx,
+                                    Some(format!(
+                                        "failed to read websocket JSON-RPC message from {connection_label}: {err}"
+                                    )),
+                                )
+                                .await;
+                                break;
+                            }
+                            None => {
+                                send_disconnected(
+                                    &incoming_tx,
+                                    &disconnected_tx,
+                                    /*reason*/ None,
+                                )
+                                .await;
+                                break;
+                            }
+                        }
                     }
                 }
             }
@@ -438,7 +451,7 @@ impl JsonRpcConnection {
             outgoing_tx,
             incoming_rx,
             disconnected_rx,
-            task_handles: vec![reader_task, writer_task],
+            task_handles: vec![websocket_task],
             transport: JsonRpcTransport::Plain,
         }
     }
@@ -458,6 +471,7 @@ enum JsonRpcWebSocketFrame {
 trait JsonRpcWebSocketMessage: Send + 'static {
     fn parse_jsonrpc_frame(self) -> Result<JsonRpcWebSocketFrame, serde_json::Error>;
     fn from_text(text: String) -> Self;
+    fn ping() -> Self;
 }
 
 impl JsonRpcWebSocketMessage for Message {
@@ -479,6 +493,10 @@ impl JsonRpcWebSocketMessage for Message {
     fn from_text(text: String) -> Self {
         Self::Text(text.into())
     }
+
+    fn ping() -> Self {
+        Self::Ping(Vec::new().into())
+    }
 }
 
 impl JsonRpcWebSocketMessage for AxumWebSocketMessage {
@@ -500,6 +518,10 @@ impl JsonRpcWebSocketMessage for AxumWebSocketMessage {
     fn from_text(text: String) -> Self {
         Self::Text(text.into())
     }
+
+    fn ping() -> Self {
+        Self::Ping(Vec::new().into())
+    }
 }
 
 async fn send_disconnected(
@@ -538,6 +560,303 @@ where
     writer.flush().await
 }
 
+async fn send_websocket_jsonrpc_message<W, M, E>(
+    websocket_writer: &mut W,
+    connection_label: &str,
+    message: &JSONRPCMessage,
+) -> Result<(), String>
+where
+    W: Sink<M, Error = E> + Unpin,
+    M: JsonRpcWebSocketMessage,
+    E: std::fmt::Display,
+{
+    match serialize_jsonrpc_message(message) {
+        Ok(encoded) => websocket_writer
+            .send(M::from_text(encoded))
+            .await
+            .map_err(|err| {
+                format!("failed to write websocket JSON-RPC message to {connection_label}: {err}")
+            }),
+        Err(err) => Err(format!(
+            "failed to serialize JSON-RPC message for {connection_label}: {err}"
+        )),
+    }
+}
+
 fn serialize_jsonrpc_message(message: &JSONRPCMessage) -> Result<String, serde_json::Error> {
     serde_json::to_string(message)
 }
+
+#[cfg(test)]
+mod tests {
+    use std::pin::Pin;
+    use std::sync::Arc;
+    use std::sync::atomic::AtomicBool;
+    use std::sync::atomic::Ordering;
+    use std::task::Context;
+    use std::task::Poll;
+
+    use codex_app_server_protocol::JSONRPCRequest;
+    use codex_app_server_protocol::RequestId;
+    use futures::channel::mpsc as futures_mpsc;
+    use futures::task::AtomicWaker;
+    use tokio::net::TcpListener;
+    use tokio::time::timeout;
+    use tokio_tungstenite::accept_async;
+    use tokio_tungstenite::connect_async;
+
+    use super::*;
+
+    #[tokio::test]
+    async fn websocket_connection_sends_configured_ping() -> anyhow::Result<()> {
+        let (client_websocket, mut server_websocket) = websocket_pair().await?;
+        let connection = JsonRpcConnection::from_websocket_stream(
+            client_websocket,
+            "test".into(),
+            Some(WEBSOCKET_KEEPALIVE_INTERVAL),
+        );
+
+        let message = timeout(Duration::from_secs(1), server_websocket.next())
+            .await?
+            .expect("websocket should stay open")?;
+        assert!(matches!(message, Message::Ping(_)));
+
+        drop(connection);
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn websocket_connection_ignores_server_pong() -> anyhow::Result<()> {
+        let (client_websocket, mut server_websocket) = websocket_pair().await?;
+        let mut connection = JsonRpcConnection::from_websocket(client_websocket, "test".into());
+
+        server_websocket
+            .send(Message::Pong(b"check".to_vec().into()))
+            .await?;
+        assert!(
+            timeout(Duration::from_millis(50), connection.incoming_rx.recv())
+                .await
+                .is_err()
+        );
+
+        drop(connection);
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn websocket_connection_reports_server_close() -> anyhow::Result<()> {
+        let (client_websocket, mut server_websocket) = websocket_pair().await?;
+        let mut connection = JsonRpcConnection::from_websocket(client_websocket, "test".into());
+
+        server_websocket.close(None).await?;
+        assert!(matches!(
+            timeout(Duration::from_secs(1), connection.incoming_rx.recv()).await?,
+            Some(JsonRpcConnectionEvent::Disconnected { reason: None })
+        ));
+
+        drop(connection);
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn websocket_connection_accepts_binary_jsonrpc_message() -> anyhow::Result<()> {
+        let (client_websocket, mut server_websocket) = websocket_pair().await?;
+        let mut connection = JsonRpcConnection::from_websocket(client_websocket, "test".into());
+        let message = JSONRPCMessage::Request(JSONRPCRequest {
+            id: RequestId::Integer(1),
+            method: "test".to_string(),
+            params: None,
+            trace: None,
+        });
+
+        server_websocket
+            .send(Message::Binary(serde_json::to_vec(&message)?.into()))
+            .await?;
+        assert!(matches!(
+            timeout(Duration::from_secs(1), connection.incoming_rx.recv()).await?,
+            Some(JsonRpcConnectionEvent::Message(actual)) if actual == message
+        ));
+
+        drop(connection);
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn websocket_connection_keeps_outbound_message_while_send_is_backpressured()
+    -> anyhow::Result<()> {
+        let (websocket, control, mut outbound_rx) =
+            ControlledWebSocket::new(/*write_ready*/ false);
+        let mut connection = JsonRpcConnection::from_websocket_stream(
+            websocket,
+            "test".into(),
+            /*ping_interval*/ None,
+        );
+        let message = test_jsonrpc_message();
+
+        connection.outgoing_tx.send(message.clone()).await?;
+        control.wait_for_blocked_write().await?;
+        control.send_inbound(Message::Pong(b"check".to_vec().into()))?;
+        assert!(
+            timeout(Duration::from_millis(50), connection.incoming_rx.recv())
+                .await
+                .is_err()
+        );
+
+        control.set_write_ready();
+        assert!(matches!(
+            timeout(Duration::from_secs(1), outbound_rx.next()).await?,
+            Some(Message::Text(text)) if serde_json::from_str::<JSONRPCMessage>(&text)? == message
+        ));
+        drop(connection);
+        Ok(())
+    }
+
+    async fn websocket_pair() -> anyhow::Result<(
+        WebSocketStream<tokio_tungstenite::MaybeTlsStream<tokio::net::TcpStream>>,
+        WebSocketStream<tokio::net::TcpStream>,
+    )> {
+        let listener = TcpListener::bind("127.0.0.1:0").await?;
+        let websocket_url = format!("ws://{}", listener.local_addr()?);
+        let server_task = tokio::spawn(async move {
+            let (stream, _) = listener.accept().await?;
+            accept_async(stream).await.map_err(anyhow::Error::from)
+        });
+        let (client_websocket, _) = connect_async(websocket_url).await?;
+        let server_websocket = server_task.await??;
+        Ok((client_websocket, server_websocket))
+    }
+
+    fn test_jsonrpc_message() -> JSONRPCMessage {
+        JSONRPCMessage::Request(JSONRPCRequest {
+            id: RequestId::Integer(1),
+            method: "test".to_string(),
+            params: None,
+            trace: None,
+        })
+    }
+
+    struct ControlledWebSocket {
+        inbound_rx: futures_mpsc::UnboundedReceiver<Result<Message, std::convert::Infallible>>,
+        outbound_tx: futures_mpsc::UnboundedSender<Message>,
+        write_ready: Arc<AtomicBool>,
+        write_blocked: Arc<AtomicBool>,
+        write_blocked_waker: Arc<AtomicWaker>,
+        write_waker: Arc<AtomicWaker>,
+    }
+
+    struct ControlledWebSocketHandle {
+        inbound_tx: futures_mpsc::UnboundedSender<Result<Message, std::convert::Infallible>>,
+        write_ready: Arc<AtomicBool>,
+        write_blocked: Arc<AtomicBool>,
+        write_blocked_waker: Arc<AtomicWaker>,
+        write_waker: Arc<AtomicWaker>,
+    }
+
+    impl ControlledWebSocket {
+        fn new(
+            write_ready: bool,
+        ) -> (
+            Self,
+            ControlledWebSocketHandle,
+            futures_mpsc::UnboundedReceiver<Message>,
+        ) {
+            let (inbound_tx, inbound_rx) = futures_mpsc::unbounded();
+            let (outbound_tx, outbound_rx) = futures_mpsc::unbounded();
+            let write_ready = Arc::new(AtomicBool::new(write_ready));
+            let write_blocked = Arc::new(AtomicBool::new(false));
+            let write_blocked_waker = Arc::new(AtomicWaker::new());
+            let write_waker = Arc::new(AtomicWaker::new());
+            (
+                Self {
+                    inbound_rx,
+                    outbound_tx,
+                    write_ready: Arc::clone(&write_ready),
+                    write_blocked: Arc::clone(&write_blocked),
+                    write_blocked_waker: Arc::clone(&write_blocked_waker),
+                    write_waker: Arc::clone(&write_waker),
+                },
+                ControlledWebSocketHandle {
+                    inbound_tx,
+                    write_ready,
+                    write_blocked,
+                    write_blocked_waker,
+                    write_waker,
+                },
+                outbound_rx,
+            )
+        }
+    }
+
+    impl ControlledWebSocketHandle {
+        fn send_inbound(&self, message: Message) -> anyhow::Result<()> {
+            self.inbound_tx
+                .unbounded_send(Ok(message))
+                .map_err(anyhow::Error::from)
+        }
+
+        fn set_write_ready(&self) {
+            self.write_ready.store(true, Ordering::Release);
+            self.write_waker.wake();
+        }
+
+        async fn wait_for_blocked_write(&self) -> anyhow::Result<()> {
+            timeout(
+                Duration::from_secs(1),
+                futures::future::poll_fn(|cx| {
+                    if self.write_blocked.load(Ordering::Acquire) {
+                        Poll::Ready(())
+                    } else {
+                        self.write_blocked_waker.register(cx.waker());
+                        Poll::Pending
+                    }
+                }),
+            )
+            .await?;
+            Ok(())
+        }
+    }
+
+    impl Sink<Message> for ControlledWebSocket {
+        type Error = std::convert::Infallible;
+
+        fn poll_ready(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Result<(), Self::Error>> {
+            if self.write_ready.load(Ordering::Acquire) {
+                Poll::Ready(Ok(()))
+            } else {
+                self.write_blocked.store(true, Ordering::Release);
+                self.write_blocked_waker.wake();
+                self.write_waker.register(cx.waker());
+                Poll::Pending
+            }
+        }
+
+        fn start_send(self: Pin<&mut Self>, item: Message) -> Result<(), Self::Error> {
+            self.outbound_tx
+                .unbounded_send(item)
+                .expect("test outbound receiver should stay open");
+            Ok(())
+        }
+
+        fn poll_flush(
+            self: Pin<&mut Self>,
+            _cx: &mut Context<'_>,
+        ) -> Poll<Result<(), Self::Error>> {
+            Poll::Ready(Ok(()))
+        }
+
+        fn poll_close(
+            self: Pin<&mut Self>,
+            _cx: &mut Context<'_>,
+        ) -> Poll<Result<(), Self::Error>> {
+            Poll::Ready(Ok(()))
+        }
+    }
+
+    impl Stream for ControlledWebSocket {
+        type Item = Result<Message, std::convert::Infallible>;
+
+        fn poll_next(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Option<Self::Item>> {
+            Pin::new(&mut self.inbound_rx).poll_next(cx)
+        }
+    }
+}
diff --git a/codex-rs/exec-server/src/environment.rs b/codex-rs/exec-server/src/environment.rs
index 7e4a3fb056..55dc031273 100644
--- a/codex-rs/exec-server/src/environment.rs
+++ b/codex-rs/exec-server/src/environment.rs
@@ -27,12 +27,11 @@ pub const CODEX_EXEC_SERVER_URL_ENV_VAR: &str = "CODEX_EXEC_SERVER_URL";
 ///
 /// `EnvironmentManager` is a shared registry for concrete environments. Its
 /// default constructor preserves the legacy `CODEX_EXEC_SERVER_URL` behavior
-/// while provider-based construction accepts a provider-supplied snapshot.
+/// while configured construction accepts a provider-supplied snapshot.
 ///
 /// Setting `CODEX_EXEC_SERVER_URL=none` disables environment access by leaving
-/// the default environment unset while still keeping an explicit local
-/// environment available through `local_environment()`. Callers use
-/// `default_environment().is_some()` as the signal for model-facing
+/// the default environment unset and omitting the local environment. Callers
+/// use `default_environment().is_some()` as the signal for model-facing
 /// shell/filesystem tool availability.
 ///
 /// Remote environments create remote filesystem and execution backends that
@@ -42,25 +41,13 @@ pub const CODEX_EXEC_SERVER_URL_ENV_VAR: &str = "CODEX_EXEC_SERVER_URL";
 pub struct EnvironmentManager {
     default_environment: Option<String>,
     environments: RwLock<HashMap<String, Arc<Environment>>>,
-    local_environment: Arc<Environment>,
+    local_environment: Option<Arc<Environment>>,
+    local_runtime_paths: Option<ExecServerRuntimePaths>,
 }
 
 pub const LOCAL_ENVIRONMENT_ID: &str = "local";
 pub const REMOTE_ENVIRONMENT_ID: &str = "remote";
 
-#[derive(Clone, Debug)]
-pub struct EnvironmentManagerArgs {
-    pub local_runtime_paths: ExecServerRuntimePaths,
-}
-
-impl EnvironmentManagerArgs {
-    pub fn new(local_runtime_paths: ExecServerRuntimePaths) -> Self {
-        Self {
-            local_runtime_paths,
-        }
-    }
-}
-
 impl EnvironmentManager {
     /// Builds a test-only manager without configured sandbox helper paths.
     pub fn default_for_tests() -> Self {
@@ -70,37 +57,29 @@ impl EnvironmentManager {
                 LOCAL_ENVIRONMENT_ID.to_string(),
                 Arc::new(Environment::default_for_tests()),
             )])),
-            local_environment: Arc::new(Environment::default_for_tests()),
+            local_environment: Some(Arc::new(Environment::default_for_tests())),
+            local_runtime_paths: None,
         }
     }
 
-    /// Builds a test-only manager with environment access disabled.
-    pub fn disabled_for_tests(local_runtime_paths: ExecServerRuntimePaths) -> Self {
+    /// Builds a manager with no configured execution environments.
+    pub fn without_environments() -> Self {
         Self {
             default_environment: None,
             environments: RwLock::new(HashMap::new()),
-            local_environment: Arc::new(Environment::local(local_runtime_paths)),
+            local_environment: None,
+            local_runtime_paths: None,
         }
     }
 
     /// Builds a test-only manager from a raw exec-server URL value.
     pub async fn create_for_tests(
         exec_server_url: Option<String>,
-        local_runtime_paths: ExecServerRuntimePaths,
+        local_runtime_paths: Option<ExecServerRuntimePaths>,
     ) -> Self {
         Self::from_default_provider_url(exec_server_url, local_runtime_paths).await
     }
 
-    /// Builds a manager from `CODEX_EXEC_SERVER_URL` and local runtime paths
-    /// used when creating local filesystem helpers.
-    pub async fn new(args: EnvironmentManagerArgs) -> Self {
-        let EnvironmentManagerArgs {
-            local_runtime_paths,
-        } = args;
-        let exec_server_url = std::env::var(CODEX_EXEC_SERVER_URL_ENV_VAR).ok();
-        Self::from_default_provider_url(exec_server_url, local_runtime_paths).await
-    }
-
     /// Builds a manager from `CODEX_HOME` and local runtime paths used when
     /// creating local filesystem helpers.
     ///
@@ -109,46 +88,49 @@ impl EnvironmentManager {
     /// `CODEX_EXEC_SERVER_URL` behavior.
     pub async fn from_codex_home(
         codex_home: impl AsRef<std::path::Path>,
-        local_runtime_paths: ExecServerRuntimePaths,
+        local_runtime_paths: Option<ExecServerRuntimePaths>,
     ) -> Result<Self, ExecServerError> {
         let provider = environment_provider_from_codex_home(codex_home.as_ref())?;
-        Self::from_provider(provider.as_ref(), local_runtime_paths).await
+        Self::from_snapshot(provider.snapshot().await?, local_runtime_paths)
     }
 
     /// Builds a manager from the legacy environment-variable provider without
     /// reading user config files from `CODEX_HOME`.
     pub async fn from_env(
-        local_runtime_paths: ExecServerRuntimePaths,
+        local_runtime_paths: Option<ExecServerRuntimePaths>,
     ) -> Result<Self, ExecServerError> {
         let provider = DefaultEnvironmentProvider::from_env();
-        Self::from_provider(&provider, local_runtime_paths).await
+        Self::from_snapshot(provider.snapshot().await?, local_runtime_paths)
     }
 
     async fn from_default_provider_url(
         exec_server_url: Option<String>,
-        local_runtime_paths: ExecServerRuntimePaths,
+        local_runtime_paths: Option<ExecServerRuntimePaths>,
     ) -> Self {
         let provider = DefaultEnvironmentProvider::new(exec_server_url);
-        match Self::from_provider(&provider, local_runtime_paths).await {
+        match Self::from_snapshot(provider.snapshot_inner(), local_runtime_paths) {
             Ok(manager) => manager,
             Err(err) => panic!("default provider should create valid environments: {err}"),
         }
     }
 
-    /// Builds a manager from a provider-supplied startup snapshot.
-    pub async fn from_provider<P>(
-        provider: &P,
+    /// Builds a test-only manager that keeps the provider default while also
+    /// allowing tests to select the local environment explicitly.
+    pub async fn create_for_tests_with_local(
+        exec_server_url: Option<String>,
         local_runtime_paths: ExecServerRuntimePaths,
-    ) -> Result<Self, ExecServerError>
-    where
-        P: EnvironmentProvider + ?Sized,
-    {
-        Self::from_provider_snapshot(provider.snapshot().await?, local_runtime_paths)
+    ) -> Self {
+        let mut snapshot = DefaultEnvironmentProvider::new(exec_server_url).snapshot_inner();
+        snapshot.include_local = true;
+        match Self::from_snapshot(snapshot, Some(local_runtime_paths)) {
+            Ok(manager) => manager,
+            Err(err) => panic!("test provider with local should create valid environments: {err}"),
+        }
     }
 
-    fn from_provider_snapshot(
+    fn from_snapshot(
         snapshot: EnvironmentProviderSnapshot,
-        local_runtime_paths: ExecServerRuntimePaths,
+        local_runtime_paths: Option<ExecServerRuntimePaths>,
     ) -> Result<Self, ExecServerError> {
         let EnvironmentProviderSnapshot {
             environments,
@@ -157,13 +139,21 @@ impl EnvironmentManager {
         } = snapshot;
         let mut environment_map =
             HashMap::with_capacity(environments.len() + usize::from(include_local));
-        let local_environment = Arc::new(Environment::local(local_runtime_paths));
-        if include_local {
+        let local_environment = if include_local {
+            let local_runtime_paths = local_runtime_paths.clone().ok_or_else(|| {
+                ExecServerError::Protocol(
+                    "local environment requires configured runtime paths".to_string(),
+                )
+            })?;
+            let local_environment = Arc::new(Environment::local(local_runtime_paths));
             environment_map.insert(
                 LOCAL_ENVIRONMENT_ID.to_string(),
                 Arc::clone(&local_environment),
             );
-        }
+            Some(local_environment)
+        } else {
+            None
+        };
         for (id, environment) in environments {
             if id.is_empty() {
                 return Err(ExecServerError::Protocol(
@@ -199,6 +189,7 @@ impl EnvironmentManager {
             default_environment,
             environments: RwLock::new(environment_map),
             local_environment,
+            local_runtime_paths,
         })
     }
 
@@ -234,9 +225,15 @@ impl EnvironmentManager {
         environment_ids
     }
 
-    /// Returns the local environment instance used for internal runtime work.
-    pub fn local_environment(&self) -> Arc<Environment> {
-        Arc::clone(&self.local_environment)
+    /// Returns the local environment instance when one is configured.
+    pub fn try_local_environment(&self) -> Option<Arc<Environment>> {
+        self.local_environment.as_ref().map(Arc::clone)
+    }
+
+    /// Returns the default environment or local environment when either exists.
+    pub fn default_or_local_environment(&self) -> Option<Arc<Environment>> {
+        self.default_environment()
+            .or_else(|| self.try_local_environment())
     }
 
     /// Returns a named environment instance.
@@ -271,10 +268,8 @@ impl EnvironmentManager {
                 "remote environment requires an exec-server url".to_string(),
             ));
         };
-        let environment = Environment::remote_inner(
-            exec_server_url,
-            self.local_environment.local_runtime_paths.clone(),
-        );
+        let environment =
+            Environment::remote_inner(exec_server_url, self.local_runtime_paths.clone());
         self.environments
             .write()
             .unwrap_or_else(std::sync::PoisonError::into_inner)
@@ -438,25 +433,12 @@ mod tests {
     use super::EnvironmentManager;
     use super::LOCAL_ENVIRONMENT_ID;
     use super::REMOTE_ENVIRONMENT_ID;
-    use crate::EnvironmentProvider;
-    use crate::ExecServerError;
     use crate::ExecServerRuntimePaths;
     use crate::ProcessId;
     use crate::environment_provider::EnvironmentDefault;
     use crate::environment_provider::EnvironmentProviderSnapshot;
     use pretty_assertions::assert_eq;
 
-    struct TestEnvironmentProvider {
-        snapshot: EnvironmentProviderSnapshot,
-    }
-
-    #[async_trait::async_trait]
-    impl EnvironmentProvider for TestEnvironmentProvider {
-        async fn snapshot(&self) -> Result<EnvironmentProviderSnapshot, ExecServerError> {
-            Ok(self.snapshot.clone())
-        }
-    }
-
     fn test_runtime_paths() -> ExecServerRuntimePaths {
         ExecServerRuntimePaths::new(
             std::env::current_exe().expect("current exe"),
@@ -465,6 +447,10 @@ mod tests {
         .expect("runtime paths")
     }
 
+    fn assert_local_environment_unavailable(manager: &EnvironmentManager) {
+        assert!(manager.try_local_environment().is_none());
+    }
+
     #[tokio::test]
     async fn create_local_environment_does_not_connect() {
         let environment = Environment::create(/*exec_server_url*/ None, test_runtime_paths())
@@ -477,7 +463,8 @@ mod tests {
     #[tokio::test]
     async fn environment_manager_normalizes_empty_url() {
         let manager =
-            EnvironmentManager::create_for_tests(Some(String::new()), test_runtime_paths()).await;
+            EnvironmentManager::create_for_tests(Some(String::new()), Some(test_runtime_paths()))
+                .await;
 
         let environment = manager.default_environment().expect("default environment");
         assert_eq!(manager.default_environment_id(), Some(LOCAL_ENVIRONMENT_ID));
@@ -487,18 +474,22 @@ mod tests {
                 .get_environment(LOCAL_ENVIRONMENT_ID)
                 .expect("local environment")
         ));
-        assert!(Arc::ptr_eq(&environment, &manager.local_environment()));
+        assert!(Arc::ptr_eq(
+            &environment,
+            &manager.try_local_environment().expect("local environment")
+        ));
+        assert!(manager.try_local_environment().is_some());
         assert!(manager.get_environment(REMOTE_ENVIRONMENT_ID).is_none());
         assert!(!environment.is_remote());
     }
 
     #[tokio::test]
-    async fn disabled_environment_manager_has_no_default_but_keeps_explicit_local_environment() {
-        let manager = EnvironmentManager::disabled_for_tests(test_runtime_paths());
+    async fn disabled_environment_manager_has_no_default_or_local_environment() {
+        let manager = EnvironmentManager::without_environments();
 
         assert!(manager.default_environment().is_none());
         assert_eq!(manager.default_environment_id(), None);
-        assert!(!manager.local_environment().is_remote());
+        assert_local_environment_unavailable(&manager);
         assert!(manager.get_environment(LOCAL_ENVIRONMENT_ID).is_none());
         assert!(manager.get_environment(REMOTE_ENVIRONMENT_ID).is_none());
     }
@@ -507,7 +498,7 @@ mod tests {
     async fn environment_manager_reports_remote_url() {
         let manager = EnvironmentManager::create_for_tests(
             Some("ws://127.0.0.1:8765".to_string()),
-            test_runtime_paths(),
+            Some(test_runtime_paths()),
         )
         .await;
 
@@ -525,7 +516,7 @@ mod tests {
                 .expect("remote environment")
         ));
         assert!(manager.get_environment(LOCAL_ENVIRONMENT_ID).is_none());
-        assert!(!manager.local_environment().is_remote());
+        assert_local_environment_unavailable(&manager);
     }
 
     #[tokio::test]
@@ -543,20 +534,17 @@ mod tests {
     }
 
     #[tokio::test]
-    async fn environment_manager_builds_from_provider() {
-        let provider = TestEnvironmentProvider {
-            snapshot: EnvironmentProviderSnapshot {
-                environments: vec![(
-                    REMOTE_ENVIRONMENT_ID.to_string(),
-                    Environment::create_for_tests(Some("ws://127.0.0.1:8765".to_string()))
-                        .expect("remote environment"),
-                )],
-                default: EnvironmentDefault::EnvironmentId(REMOTE_ENVIRONMENT_ID.to_string()),
-                include_local: false,
-            },
+    async fn environment_manager_builds_from_snapshot() {
+        let snapshot = EnvironmentProviderSnapshot {
+            environments: vec![(
+                REMOTE_ENVIRONMENT_ID.to_string(),
+                Environment::create_for_tests(Some("ws://127.0.0.1:8765".to_string()))
+                    .expect("remote environment"),
+            )],
+            default: EnvironmentDefault::EnvironmentId(REMOTE_ENVIRONMENT_ID.to_string()),
+            include_local: false,
         };
-        let manager = EnvironmentManager::from_provider(&provider, test_runtime_paths())
-            .await
+        let manager = EnvironmentManager::from_snapshot(snapshot, Some(test_runtime_paths()))
             .expect("environment manager");
 
         assert_eq!(
@@ -570,20 +558,17 @@ mod tests {
                 .is_remote()
         );
         assert!(manager.get_environment(LOCAL_ENVIRONMENT_ID).is_none());
-        assert!(!manager.local_environment().is_remote());
+        assert_local_environment_unavailable(&manager);
     }
 
     #[tokio::test]
     async fn environment_manager_rejects_empty_environment_id() {
-        let provider = TestEnvironmentProvider {
-            snapshot: EnvironmentProviderSnapshot {
-                environments: vec![("".to_string(), Environment::default_for_tests())],
-                default: EnvironmentDefault::Disabled,
-                include_local: false,
-            },
+        let snapshot = EnvironmentProviderSnapshot {
+            environments: vec![("".to_string(), Environment::default_for_tests())],
+            default: EnvironmentDefault::Disabled,
+            include_local: false,
         };
-        let err = EnvironmentManager::from_provider(&provider, test_runtime_paths())
-            .await
+        let err = EnvironmentManager::from_snapshot(snapshot, Some(test_runtime_paths()))
             .expect_err("empty id should fail");
 
         assert_eq!(
@@ -594,18 +579,15 @@ mod tests {
 
     #[tokio::test]
     async fn environment_manager_rejects_provider_supplied_local_environment() {
-        let provider = TestEnvironmentProvider {
-            snapshot: EnvironmentProviderSnapshot {
-                environments: vec![(
-                    LOCAL_ENVIRONMENT_ID.to_string(),
-                    Environment::default_for_tests(),
-                )],
-                default: EnvironmentDefault::Disabled,
-                include_local: false,
-            },
+        let snapshot = EnvironmentProviderSnapshot {
+            environments: vec![(
+                LOCAL_ENVIRONMENT_ID.to_string(),
+                Environment::default_for_tests(),
+            )],
+            default: EnvironmentDefault::Disabled,
+            include_local: false,
         };
-        let err = EnvironmentManager::from_provider(&provider, test_runtime_paths())
-            .await
+        let err = EnvironmentManager::from_snapshot(snapshot, Some(test_runtime_paths()))
             .expect_err("local id should fail");
 
         assert_eq!(
@@ -616,19 +598,16 @@ mod tests {
 
     #[tokio::test]
     async fn environment_manager_uses_explicit_provider_default() {
-        let provider = TestEnvironmentProvider {
-            snapshot: EnvironmentProviderSnapshot {
-                environments: vec![(
-                    "devbox".to_string(),
-                    Environment::create_for_tests(Some("ws://127.0.0.1:8765".to_string()))
-                        .expect("remote environment"),
-                )],
-                default: EnvironmentDefault::EnvironmentId("devbox".to_string()),
-                include_local: true,
-            },
+        let snapshot = EnvironmentProviderSnapshot {
+            environments: vec![(
+                "devbox".to_string(),
+                Environment::create_for_tests(Some("ws://127.0.0.1:8765".to_string()))
+                    .expect("remote environment"),
+            )],
+            default: EnvironmentDefault::EnvironmentId("devbox".to_string()),
+            include_local: true,
         };
-        let manager = EnvironmentManager::from_provider(&provider, test_runtime_paths())
-            .await
+        let manager = EnvironmentManager::from_snapshot(snapshot, Some(test_runtime_paths()))
             .expect("manager");
 
         assert_eq!(manager.default_environment_id(), Some("devbox"));
@@ -641,19 +620,16 @@ mod tests {
 
     #[tokio::test]
     async fn environment_manager_disables_provider_default() {
-        let provider = TestEnvironmentProvider {
-            snapshot: EnvironmentProviderSnapshot {
-                environments: vec![(
-                    "devbox".to_string(),
-                    Environment::create_for_tests(Some("ws://127.0.0.1:8765".to_string()))
-                        .expect("remote environment"),
-                )],
-                default: EnvironmentDefault::Disabled,
-                include_local: true,
-            },
+        let snapshot = EnvironmentProviderSnapshot {
+            environments: vec![(
+                "devbox".to_string(),
+                Environment::create_for_tests(Some("ws://127.0.0.1:8765".to_string()))
+                    .expect("remote environment"),
+            )],
+            default: EnvironmentDefault::Disabled,
+            include_local: true,
         };
-        let manager = EnvironmentManager::from_provider(&provider, test_runtime_paths())
-            .await
+        let manager = EnvironmentManager::from_snapshot(snapshot, Some(test_runtime_paths()))
             .expect("manager");
 
         assert_eq!(manager.default_environment_id(), None);
@@ -662,25 +638,22 @@ mod tests {
             &manager
                 .get_environment(LOCAL_ENVIRONMENT_ID)
                 .expect("local environment"),
-            &manager.local_environment()
+            &manager.try_local_environment().expect("local environment")
         ));
     }
 
     #[tokio::test]
     async fn environment_manager_rejects_unknown_provider_default() {
-        let provider = TestEnvironmentProvider {
-            snapshot: EnvironmentProviderSnapshot {
-                environments: vec![(
-                    "devbox".to_string(),
-                    Environment::create_for_tests(Some("ws://127.0.0.1:8765".to_string()))
-                        .expect("remote environment"),
-                )],
-                default: EnvironmentDefault::EnvironmentId("missing".to_string()),
-                include_local: true,
-            },
+        let snapshot = EnvironmentProviderSnapshot {
+            environments: vec![(
+                "devbox".to_string(),
+                Environment::create_for_tests(Some("ws://127.0.0.1:8765".to_string()))
+                    .expect("remote environment"),
+            )],
+            default: EnvironmentDefault::EnvironmentId("missing".to_string()),
+            include_local: true,
         };
-        let err = EnvironmentManager::from_provider(&provider, test_runtime_paths())
-            .await
+        let err = EnvironmentManager::from_snapshot(snapshot, Some(test_runtime_paths()))
             .expect_err("unknown default should fail");
 
         assert_eq!(
@@ -693,7 +666,7 @@ mod tests {
     async fn environment_manager_includes_local_for_default_provider_without_url() {
         let manager = EnvironmentManager::create_for_tests(
             /*exec_server_url*/ None,
-            test_runtime_paths(),
+            Some(test_runtime_paths()),
         )
         .await;
 
@@ -705,7 +678,10 @@ mod tests {
                 .get_environment(LOCAL_ENVIRONMENT_ID)
                 .expect("local environment")
         ));
-        assert!(Arc::ptr_eq(&environment, &manager.local_environment()));
+        assert!(Arc::ptr_eq(
+            &environment,
+            &manager.try_local_environment().expect("local environment")
+        ));
         assert!(!environment.is_remote());
     }
 
@@ -714,44 +690,59 @@ mod tests {
         let runtime_paths = test_runtime_paths();
         let manager = EnvironmentManager::create_for_tests(
             /*exec_server_url*/ None,
-            runtime_paths.clone(),
+            Some(runtime_paths.clone()),
         )
         .await;
 
-        let environment = manager.local_environment();
+        let environment = manager.try_local_environment().expect("local environment");
 
         assert_eq!(environment.local_runtime_paths(), Some(&runtime_paths));
         let manager = EnvironmentManager::create_for_tests(
             environment.exec_server_url().map(str::to_owned),
-            environment
-                .local_runtime_paths()
-                .expect("local runtime paths")
-                .clone(),
+            Some(
+                environment
+                    .local_runtime_paths()
+                    .expect("local runtime paths")
+                    .clone(),
+            ),
         )
         .await;
-        let environment = manager.local_environment();
+        let environment = manager.try_local_environment().expect("local environment");
         assert_eq!(environment.local_runtime_paths(), Some(&runtime_paths));
     }
 
-    #[tokio::test]
-    async fn disabled_environment_manager_has_no_default_environment() {
-        let manager = EnvironmentManager::disabled_for_tests(test_runtime_paths());
-
-        assert!(manager.default_environment().is_none());
-        assert_eq!(manager.default_environment_id(), None);
-    }
-
     #[tokio::test]
     async fn environment_manager_omits_default_provider_local_lookup_when_default_disabled() {
-        let manager =
-            EnvironmentManager::create_for_tests(Some("none".to_string()), test_runtime_paths())
-                .await;
+        let manager = EnvironmentManager::create_for_tests(
+            Some("none".to_string()),
+            Some(test_runtime_paths()),
+        )
+        .await;
 
         assert!(manager.default_environment().is_none());
         assert_eq!(manager.default_environment_id(), None);
         assert!(manager.get_environment(LOCAL_ENVIRONMENT_ID).is_none());
         assert!(manager.get_environment(REMOTE_ENVIRONMENT_ID).is_none());
-        assert!(!manager.local_environment().is_remote());
+        assert_local_environment_unavailable(&manager);
+    }
+
+    #[tokio::test]
+    async fn environment_manager_snapshot_without_local_environment_disables_local_default() {
+        let mut snapshot = EnvironmentProviderSnapshot {
+            environments: Vec::new(),
+            default: EnvironmentDefault::EnvironmentId(LOCAL_ENVIRONMENT_ID.to_string()),
+            include_local: true,
+        };
+        snapshot.include_local = false;
+        snapshot.default = EnvironmentDefault::Disabled;
+        let manager =
+            EnvironmentManager::from_snapshot(snapshot, /*local_runtime_paths*/ None)
+                .expect("environment manager");
+
+        assert!(manager.default_environment().is_none());
+        assert_eq!(manager.default_environment_id(), None);
+        assert!(manager.get_environment(LOCAL_ENVIRONMENT_ID).is_none());
+        assert_local_environment_unavailable(&manager);
     }
 
     #[tokio::test]
@@ -763,7 +754,7 @@ mod tests {
 
     #[tokio::test]
     async fn environment_manager_upserts_named_remote_environment() {
-        let manager = EnvironmentManager::disabled_for_tests(test_runtime_paths());
+        let manager = EnvironmentManager::without_environments();
 
         manager
             .upsert_environment("executor-a".to_string(), "ws://127.0.0.1:8765".to_string())
@@ -788,7 +779,7 @@ mod tests {
 
     #[tokio::test]
     async fn environment_manager_rejects_empty_remote_environment_url() {
-        let manager = EnvironmentManager::disabled_for_tests(test_runtime_paths());
+        let manager = EnvironmentManager::without_environments();
 
         let err = manager
             .upsert_environment("executor-a".to_string(), String::new())
diff --git a/codex-rs/exec-server/src/environment_toml.rs b/codex-rs/exec-server/src/environment_toml.rs
index 90f4c78262..26c178b5b8 100644
--- a/codex-rs/exec-server/src/environment_toml.rs
+++ b/codex-rs/exec-server/src/environment_toml.rs
@@ -27,6 +27,7 @@ const MAX_ENVIRONMENT_ID_LEN: usize = 64;
 #[serde(deny_unknown_fields)]
 struct EnvironmentsToml {
     default: Option<String>,
+    include_local: Option<bool>,
 
     #[serde(default)]
     environments: Vec<EnvironmentToml>,
@@ -50,6 +51,7 @@ struct EnvironmentToml {
 #[derive(Clone, Debug, PartialEq, Eq)]
 struct TomlEnvironmentProvider {
     default: EnvironmentDefault,
+    include_local: bool,
     environments: Vec<(String, ExecServerTransportParams)>,
 }
 
@@ -63,21 +65,31 @@ impl TomlEnvironmentProvider {
         config: EnvironmentsToml,
         config_dir: Option<&Path>,
     ) -> Result<Self, ExecServerError> {
-        let mut ids = HashSet::from([LOCAL_ENVIRONMENT_ID.to_string()]);
-        let mut environments = Vec::with_capacity(config.environments.len());
-        for item in config.environments {
+        let EnvironmentsToml {
+            default,
+            include_local,
+            environments,
+        } = config;
+        let include_local = include_local.unwrap_or(true);
+        let mut ids = HashSet::new();
+        if include_local {
+            ids.insert(LOCAL_ENVIRONMENT_ID.to_string());
+        }
+        let mut parsed_environments = Vec::with_capacity(environments.len());
+        for item in environments {
             let (id, transport) = parse_environment_toml(item, config_dir)?;
             if !ids.insert(id.clone()) {
                 return Err(ExecServerError::Protocol(format!(
                     "environment id `{id}` is duplicated"
                 )));
             }
-            environments.push((id, transport));
+            parsed_environments.push((id, transport));
         }
-        let default = normalize_default_environment_id(config.default.as_deref(), &ids)?;
+        let default = normalize_default_environment_id(default.as_deref(), include_local, &ids)?;
         Ok(Self {
             default,
-            environments,
+            include_local,
+            environments: parsed_environments,
         })
     }
 }
@@ -99,7 +111,7 @@ impl EnvironmentProvider for TomlEnvironmentProvider {
         Ok(EnvironmentProviderSnapshot {
             environments,
             default: self.default.clone(),
-            include_local: true,
+            include_local: self.include_local,
         })
     }
 }
@@ -212,12 +224,17 @@ pub(crate) fn environment_provider_from_codex_home(
 
 fn normalize_default_environment_id(
     default: Option<&str>,
+    include_local: bool,
     ids: &HashSet<String>,
 ) -> Result<EnvironmentDefault, ExecServerError> {
     let Some(default) = default.map(str::trim) else {
-        return Ok(EnvironmentDefault::EnvironmentId(
-            LOCAL_ENVIRONMENT_ID.to_string(),
-        ));
+        return if include_local {
+            Ok(EnvironmentDefault::EnvironmentId(
+                LOCAL_ENVIRONMENT_ID.to_string(),
+            ))
+        } else {
+            Ok(EnvironmentDefault::Disabled)
+        };
     };
     if default.is_empty() {
         return Err(ExecServerError::Protocol(
@@ -330,6 +347,7 @@ mod tests {
     async fn toml_provider_includes_local_and_adds_configured_environments() {
         let provider = TomlEnvironmentProvider::new(EnvironmentsToml {
             default: Some("ssh-dev".to_string()),
+            include_local: None,
             environments: vec![
                 EnvironmentToml {
                     id: "devbox".to_string(),
@@ -396,6 +414,7 @@ mod tests {
     async fn toml_provider_default_none_disables_default() {
         let provider = TomlEnvironmentProvider::new(EnvironmentsToml {
             default: Some("none".to_string()),
+            include_local: None,
             environments: Vec::new(),
         })
         .expect("provider");
@@ -405,6 +424,55 @@ mod tests {
         assert_eq!(snapshot.default, EnvironmentDefault::Disabled);
     }
 
+    #[tokio::test]
+    async fn toml_provider_can_disable_local_environment() {
+        let provider = TomlEnvironmentProvider::new(EnvironmentsToml {
+            default: Some("ssh-dev".to_string()),
+            include_local: Some(false),
+            environments: vec![EnvironmentToml {
+                id: "ssh-dev".to_string(),
+                program: Some("ssh".to_string()),
+                ..Default::default()
+            }],
+        })
+        .expect("provider");
+        let snapshot = provider.snapshot().await.expect("environments");
+
+        assert!(!snapshot.include_local);
+        assert_eq!(
+            snapshot.default,
+            EnvironmentDefault::EnvironmentId("ssh-dev".to_string())
+        );
+    }
+
+    #[tokio::test]
+    async fn toml_provider_without_local_and_default_omitted_disables_default() {
+        let provider = TomlEnvironmentProvider::new(EnvironmentsToml {
+            include_local: Some(false),
+            ..Default::default()
+        })
+        .expect("provider");
+        let snapshot = provider.snapshot().await.expect("environments");
+
+        assert!(!snapshot.include_local);
+        assert_eq!(snapshot.default, EnvironmentDefault::Disabled);
+    }
+
+    #[test]
+    fn toml_provider_rejects_local_default_when_local_is_disabled() {
+        let err = TomlEnvironmentProvider::new(EnvironmentsToml {
+            default: Some(LOCAL_ENVIRONMENT_ID.to_string()),
+            include_local: Some(false),
+            environments: Vec::new(),
+        })
+        .expect_err("local default without local environment should fail");
+
+        assert_eq!(
+            err.to_string(),
+            "exec-server protocol error: default environment `local` is not configured"
+        );
+    }
+
     #[test]
     fn toml_provider_rejects_invalid_environments() {
         let cases = [
@@ -479,6 +547,7 @@ mod tests {
         for (item, expected) in cases {
             let err = TomlEnvironmentProvider::new(EnvironmentsToml {
                 default: None,
+                include_local: None,
                 environments: vec![item],
             })
             .expect_err("invalid item should fail");
@@ -496,6 +565,7 @@ mod tests {
         let provider = TomlEnvironmentProvider::new_with_config_dir(
             EnvironmentsToml {
                 default: None,
+                include_local: None,
                 environments: vec![EnvironmentToml {
                     id: "ssh-dev".to_string(),
                     program: Some("ssh".to_string()),
@@ -525,6 +595,7 @@ mod tests {
     fn toml_provider_parses_configured_transport_timeouts() {
         let provider = TomlEnvironmentProvider::new(EnvironmentsToml {
             default: None,
+            include_local: None,
             environments: vec![
                 EnvironmentToml {
                     id: "devbox".to_string(),
@@ -569,6 +640,7 @@ mod tests {
     fn toml_provider_rejects_relative_stdio_cwd_without_config_dir() {
         let err = TomlEnvironmentProvider::new(EnvironmentsToml {
             default: None,
+            include_local: None,
             environments: vec![EnvironmentToml {
                 id: "ssh-dev".to_string(),
                 program: Some("ssh".to_string()),
@@ -588,6 +660,7 @@ mod tests {
     fn toml_provider_rejects_duplicate_ids() {
         let err = TomlEnvironmentProvider::new(EnvironmentsToml {
             default: None,
+            include_local: None,
             environments: vec![
                 EnvironmentToml {
                     id: "devbox".to_string(),
@@ -614,6 +687,7 @@ mod tests {
         let id = "a".repeat(MAX_ENVIRONMENT_ID_LEN + 1);
         let err = TomlEnvironmentProvider::new(EnvironmentsToml {
             default: None,
+            include_local: None,
             environments: vec![EnvironmentToml {
                 id: id.clone(),
                 url: Some("ws://127.0.0.1:8765".to_string()),
@@ -634,6 +708,7 @@ mod tests {
     fn toml_provider_rejects_unknown_default() {
         let err = TomlEnvironmentProvider::new(EnvironmentsToml {
             default: Some("missing".to_string()),
+            include_local: None,
             environments: Vec::new(),
         })
         .expect_err("unknown default should fail");
@@ -652,6 +727,7 @@ mod tests {
             &path,
             r#"
 default = "ssh-dev"
+include_local = false
 
 [[environments]]
 id = "devbox"
@@ -673,6 +749,7 @@ CODEX_LOG = "debug"
         let environments = load_environments_toml(&path).expect("environments.toml");
 
         assert_eq!(environments.default.as_deref(), Some("ssh-dev"));
+        assert_eq!(environments.include_local, Some(false));
         assert_eq!(environments.environments.len(), 2);
         assert_eq!(
             environments.environments[0],
@@ -736,6 +813,7 @@ unknown = true
     fn toml_provider_rejects_malformed_websocket_url() {
         let err = TomlEnvironmentProvider::new(EnvironmentsToml {
             default: None,
+            include_local: None,
             environments: vec![EnvironmentToml {
                 id: "devbox".to_string(),
                 url: Some("ws://".to_string()),
@@ -758,6 +836,7 @@ unknown = true
             codex_home.path().join(ENVIRONMENTS_TOML_FILE),
             r#"
 default = "none"
+include_local = false
 "#,
         )
         .expect("write environments.toml");
@@ -772,7 +851,7 @@ default = "none"
             .map(|(id, _environment)| id)
             .collect();
 
-        assert!(snapshot.include_local);
+        assert!(!snapshot.include_local);
         assert!(!environment_ids.contains(&LOCAL_ENVIRONMENT_ID.to_string()));
         assert_eq!(snapshot.default, EnvironmentDefault::Disabled);
     }
diff --git a/codex-rs/exec-server/src/lib.rs b/codex-rs/exec-server/src/lib.rs
index 872f16ce32..bd556638ea 100644
--- a/codex-rs/exec-server/src/lib.rs
+++ b/codex-rs/exec-server/src/lib.rs
@@ -91,7 +91,6 @@ pub use protocol::TerminateResponse;
 pub use protocol::WriteParams;
 pub use protocol::WriteResponse;
 pub use protocol::WriteStatus;
-pub use remote::CODEX_EXEC_SERVER_REMOTE_BEARER_TOKEN_ENV_VAR;
 pub use remote::RemoteExecutorConfig;
 pub use remote::run_remote_executor;
 pub use runtime_paths::ExecServerRuntimePaths;
diff --git a/codex-rs/exec-server/src/relay.rs b/codex-rs/exec-server/src/relay.rs
index bce787cfc2..b3708f1d83 100644
--- a/codex-rs/exec-server/src/relay.rs
+++ b/codex-rs/exec-server/src/relay.rs
@@ -1,7 +1,9 @@
 use std::collections::HashMap;
 
 use codex_app_server_protocol::JSONRPCMessage;
+use futures::Sink;
 use futures::SinkExt;
+use futures::Stream;
 use futures::StreamExt;
 use prost::Message as ProstMessage;
 use tokio::io::AsyncRead;
@@ -139,121 +141,25 @@ fn jsonrpc_payload(message: &JSONRPCMessage) -> Result<Vec<u8>, ExecServerError>
     serde_json::to_vec(message).map_err(ExecServerError::Json)
 }
 
-pub(crate) fn harness_connection_from_websocket<S>(
-    stream: WebSocketStream<S>,
+pub(crate) fn harness_connection_from_websocket<T, E>(
+    stream: T,
     connection_label: String,
 ) -> JsonRpcConnection
 where
-    S: AsyncRead + AsyncWrite + Unpin + Send + 'static,
+    T: Sink<Message, Error = E> + Stream<Item = Result<Message, E>> + Unpin + Send + 'static,
+    E: std::fmt::Display + Send + 'static,
 {
     let stream_id = Uuid::new_v4().to_string();
-    let (mut websocket_writer, mut websocket_reader) = stream.split();
     let (outgoing_tx, mut outgoing_rx) = mpsc::channel(CHANNEL_CAPACITY);
     let (incoming_tx, incoming_rx) = mpsc::channel(CHANNEL_CAPACITY);
     let (disconnected_tx, disconnected_rx) = watch::channel(false);
 
-    let reader_label = connection_label;
-    let reader_stream_id = stream_id.clone();
-    let incoming_tx_for_reader = incoming_tx;
-    let disconnected_tx_for_reader = disconnected_tx.clone();
-    let reader_task = tokio::spawn(async move {
-        loop {
-            match websocket_reader.next().await {
-                Some(Ok(Message::Binary(payload))) => {
-                    let frame = match decode_relay_message_frame(payload.as_ref()) {
-                        Ok(frame) => frame,
-                        Err(err) => {
-                            let _ = incoming_tx_for_reader
-                                .send(JsonRpcConnectionEvent::MalformedMessage {
-                                    reason: format!(
-                                        "failed to parse relay message frame from {reader_label}: {err}"
-                                    ),
-                                })
-                                .await;
-                            continue;
-                        }
-                    };
-                    if frame.stream_id != reader_stream_id {
-                        continue;
-                    }
-                    let kind = match frame.validate() {
-                        Ok(kind) => kind,
-                        Err(err) => {
-                            let _ = incoming_tx_for_reader
-                                .send(JsonRpcConnectionEvent::MalformedMessage {
-                                    reason: err.to_string(),
-                                })
-                                .await;
-                            continue;
-                        }
-                    };
-                    match kind {
-                        RelayFrameBodyKind::Data => match frame.into_jsonrpc_message() {
-                            Ok(message) => {
-                                if incoming_tx_for_reader
-                                    .send(JsonRpcConnectionEvent::Message(message))
-                                    .await
-                                    .is_err()
-                                {
-                                    break;
-                                }
-                            }
-                            Err(err) => {
-                                let _ = incoming_tx_for_reader
-                                    .send(JsonRpcConnectionEvent::MalformedMessage {
-                                        reason: err.to_string(),
-                                    })
-                                    .await;
-                            }
-                        },
-                        RelayFrameBodyKind::Reset => {
-                            let _ = disconnected_tx_for_reader.send(true);
-                            let _ = incoming_tx_for_reader
-                                .send(JsonRpcConnectionEvent::Disconnected {
-                                    reason: frame.into_reset_reason(),
-                                })
-                                .await;
-                            break;
-                        }
-                        RelayFrameBodyKind::Ack
-                        | RelayFrameBodyKind::Resume
-                        | RelayFrameBodyKind::Heartbeat => {}
-                    }
-                }
-                Some(Ok(Message::Close(_))) | None => {
-                    let _ = disconnected_tx_for_reader.send(true);
-                    let _ = incoming_tx_for_reader
-                        .send(JsonRpcConnectionEvent::Disconnected { reason: None })
-                        .await;
-                    break;
-                }
-                Some(Ok(Message::Ping(_) | Message::Pong(_) | Message::Frame(_))) => {}
-                Some(Ok(Message::Text(_))) => {
-                    let _ = incoming_tx_for_reader
-                        .send(JsonRpcConnectionEvent::MalformedMessage {
-                            reason: "relay exec-server transport expects binary protobuf frames"
-                                .to_string(),
-                        })
-                        .await;
-                }
-                Some(Err(err)) => {
-                    let _ = disconnected_tx_for_reader.send(true);
-                    let _ = incoming_tx_for_reader
-                        .send(JsonRpcConnectionEvent::Disconnected {
-                            reason: Some(format!(
-                                "failed to read relay websocket frame from {reader_label}: {err}"
-                            )),
-                        })
-                        .await;
-                    break;
-                }
-            }
-        }
-    });
-
-    let writer_task = tokio::spawn(async move {
+    let websocket_task = tokio::spawn(async move {
+        let mut websocket = stream;
+        let reader_label = connection_label;
+        let reader_stream_id = stream_id.clone();
         let resume = RelayMessageFrame::resume(stream_id.clone());
-        if websocket_writer
+        if websocket
             .send(Message::Binary(encode_relay_message_frame(&resume).into()))
             .await
             .is_err()
@@ -263,23 +169,122 @@ where
         }
 
         let mut next_seq = 0u32;
-        while let Some(message) = outgoing_rx.recv().await {
-            let payload = match jsonrpc_payload(&message) {
-                Ok(payload) => payload,
-                Err(err) => {
-                    warn!("failed to serialize JSON-RPC payload for relay transport: {err}");
-                    break;
+        loop {
+            tokio::select! {
+                maybe_message = outgoing_rx.recv() => {
+                    let Some(message) = maybe_message else {
+                        break;
+                    };
+                    let payload = match jsonrpc_payload(&message) {
+                        Ok(payload) => payload,
+                        Err(err) => {
+                            warn!("failed to serialize JSON-RPC payload for relay transport: {err}");
+                            break;
+                        }
+                    };
+                    let frame = RelayMessageFrame::data(stream_id.clone(), next_seq, payload);
+                    next_seq = next_seq.wrapping_add(1);
+                    if websocket
+                        .send(Message::Binary(encode_relay_message_frame(&frame).into()))
+                        .await
+                        .is_err()
+                    {
+                        let _ = disconnected_tx.send(true);
+                        break;
+                    }
+                }
+                incoming_message = websocket.next() => {
+                    match incoming_message {
+                        Some(Ok(Message::Binary(payload))) => {
+                            let frame = match decode_relay_message_frame(payload.as_ref()) {
+                                Ok(frame) => frame,
+                                Err(err) => {
+                                    let _ = incoming_tx
+                                        .send(JsonRpcConnectionEvent::MalformedMessage {
+                                            reason: format!(
+                                                "failed to parse relay message frame from {reader_label}: {err}"
+                                            ),
+                                        })
+                                        .await;
+                                    continue;
+                                }
+                            };
+                            if frame.stream_id != reader_stream_id {
+                                continue;
+                            }
+                            let kind = match frame.validate() {
+                                Ok(kind) => kind,
+                                Err(err) => {
+                                    let _ = incoming_tx
+                                        .send(JsonRpcConnectionEvent::MalformedMessage {
+                                            reason: err.to_string(),
+                                        })
+                                        .await;
+                                    continue;
+                                }
+                            };
+                            match kind {
+                                RelayFrameBodyKind::Data => match frame.into_jsonrpc_message() {
+                                    Ok(message) => {
+                                        if incoming_tx
+                                            .send(JsonRpcConnectionEvent::Message(message))
+                                            .await
+                                            .is_err()
+                                        {
+                                            break;
+                                        }
+                                    }
+                                    Err(err) => {
+                                        let _ = incoming_tx
+                                            .send(JsonRpcConnectionEvent::MalformedMessage {
+                                                reason: err.to_string(),
+                                            })
+                                            .await;
+                                    }
+                                },
+                                RelayFrameBodyKind::Reset => {
+                                    let _ = disconnected_tx.send(true);
+                                    let _ = incoming_tx
+                                        .send(JsonRpcConnectionEvent::Disconnected {
+                                            reason: frame.into_reset_reason(),
+                                        })
+                                        .await;
+                                    break;
+                                }
+                                RelayFrameBodyKind::Ack
+                                | RelayFrameBodyKind::Resume
+                                | RelayFrameBodyKind::Heartbeat => {}
+                            }
+                        }
+                        Some(Ok(Message::Close(_))) | None => {
+                            let _ = disconnected_tx.send(true);
+                            let _ = incoming_tx
+                                .send(JsonRpcConnectionEvent::Disconnected { reason: None })
+                                .await;
+                            break;
+                        }
+                        Some(Ok(Message::Ping(_) | Message::Pong(_) | Message::Frame(_))) => {}
+                        Some(Ok(Message::Text(_))) => {
+                            let _ = incoming_tx
+                                .send(JsonRpcConnectionEvent::MalformedMessage {
+                                    reason: "relay exec-server transport expects binary protobuf frames"
+                                        .to_string(),
+                                })
+                                .await;
+                        }
+                        Some(Err(err)) => {
+                            let _ = disconnected_tx.send(true);
+                            let _ = incoming_tx
+                                .send(JsonRpcConnectionEvent::Disconnected {
+                                    reason: Some(format!(
+                                        "failed to read relay websocket frame from {reader_label}: {err}"
+                                    )),
+                                })
+                                .await;
+                            break;
+                        }
+                    }
                 }
-            };
-            let frame = RelayMessageFrame::data(stream_id.clone(), next_seq, payload);
-            next_seq = next_seq.wrapping_add(1);
-            if websocket_writer
-                .send(Message::Binary(encode_relay_message_frame(&frame).into()))
-                .await
-                .is_err()
-            {
-                let _ = disconnected_tx.send(true);
-                break;
             }
         }
     });
@@ -288,7 +293,7 @@ where
         outgoing_tx,
         incoming_rx,
         disconnected_rx,
-        task_handles: vec![reader_task, writer_task],
+        task_handles: vec![websocket_task],
         transport: JsonRpcTransport::Plain,
     }
 }
@@ -299,42 +304,42 @@ pub(crate) async fn run_multiplexed_executor<S>(
 ) where
     S: AsyncRead + AsyncWrite + Unpin + Send + 'static,
 {
-    let (mut websocket_writer, mut websocket_reader) = stream.split();
+    let mut websocket = stream;
     let (physical_outgoing_tx, mut physical_outgoing_rx) =
         mpsc::channel::<Vec<u8>>(CHANNEL_CAPACITY);
-    let writer_task = tokio::spawn(async move {
-        while let Some(encoded) = physical_outgoing_rx.recv().await {
-            if websocket_writer
-                .send(Message::Binary(encoded.into()))
-                .await
-                .is_err()
-            {
-                break;
-            }
-        }
-    });
 
     let mut streams: HashMap<String, VirtualStream> = HashMap::new();
     loop {
-        let frame = match websocket_reader.next().await {
-            Some(Ok(Message::Binary(payload))) => {
-                match decode_relay_message_frame(payload.as_ref()) {
-                    Ok(frame) => frame,
-                    Err(err) => {
-                        warn!("dropping malformed relay message frame from harness: {err}");
-                        continue;
-                    }
+        let frame = tokio::select! {
+            maybe_encoded = physical_outgoing_rx.recv() => {
+                let Some(encoded) = maybe_encoded else {
+                    break;
+                };
+                if websocket.send(Message::Binary(encoded.into())).await.is_err() {
+                    break;
                 }
-            }
-            Some(Ok(Message::Close(_))) | None => break,
-            Some(Ok(Message::Ping(_) | Message::Pong(_) | Message::Frame(_))) => continue,
-            Some(Ok(Message::Text(_))) => {
-                warn!("dropping non-binary relay message frame from harness");
                 continue;
             }
-            Some(Err(err)) => {
-                debug!("multiplexed executor websocket read failed: {err}");
-                break;
+            incoming_message = websocket.next() => match incoming_message {
+                Some(Ok(Message::Binary(payload))) => {
+                    match decode_relay_message_frame(payload.as_ref()) {
+                        Ok(frame) => frame,
+                        Err(err) => {
+                            warn!("dropping malformed relay message frame from harness: {err}");
+                            continue;
+                        }
+                    }
+                }
+                Some(Ok(Message::Close(_))) | None => break,
+                Some(Ok(Message::Ping(_) | Message::Pong(_) | Message::Frame(_))) => continue,
+                Some(Ok(Message::Text(_))) => {
+                    warn!("dropping non-binary relay message frame from harness");
+                    continue;
+                }
+                Some(Err(err)) => {
+                    debug!("multiplexed executor websocket read failed: {err}");
+                    break;
+                }
             }
         };
 
@@ -387,7 +392,6 @@ pub(crate) async fn run_multiplexed_executor<S>(
         stream.disconnect(/*reason*/ None).await;
     }
     drop(physical_outgoing_tx);
-    let _ = writer_task.await;
 }
 
 struct VirtualStream {
@@ -453,3 +457,296 @@ fn spawn_virtual_stream(
         disconnected_tx,
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use std::pin::Pin;
+    use std::sync::Arc;
+    use std::sync::atomic::AtomicBool;
+    use std::sync::atomic::Ordering;
+    use std::task::Context;
+    use std::task::Poll;
+    use std::time::Duration;
+
+    use codex_app_server_protocol::JSONRPCRequest;
+    use codex_app_server_protocol::RequestId;
+    use futures::Sink;
+    use futures::Stream;
+    use futures::channel::mpsc as futures_mpsc;
+    use futures::task::AtomicWaker;
+    use tokio::net::TcpListener;
+    use tokio::time::timeout;
+    use tokio_tungstenite::accept_async;
+    use tokio_tungstenite::connect_async;
+    use tokio_tungstenite::tungstenite::Message;
+
+    use super::*;
+
+    #[tokio::test]
+    async fn harness_connection_receives_relay_data() -> anyhow::Result<()> {
+        let (client_websocket, mut server_websocket) = websocket_pair().await?;
+        let mut connection =
+            harness_connection_from_websocket(client_websocket, "test".to_string());
+        let stream_id = read_resume_stream_id(&mut server_websocket).await?;
+        let message = test_jsonrpc_message();
+
+        server_websocket
+            .send(Message::Binary(
+                encode_relay_message_frame(&RelayMessageFrame::data(
+                    stream_id,
+                    /*seq*/ 0,
+                    jsonrpc_payload(&message)?,
+                ))
+                .into(),
+            ))
+            .await?;
+        assert!(matches!(
+            timeout(Duration::from_secs(1), connection.incoming_rx.recv()).await?,
+            Some(JsonRpcConnectionEvent::Message(actual)) if actual == message
+        ));
+
+        drop(connection);
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn harness_connection_reports_text_frames_as_malformed() -> anyhow::Result<()> {
+        let (client_websocket, mut server_websocket) = websocket_pair().await?;
+        let mut connection =
+            harness_connection_from_websocket(client_websocket, "test".to_string());
+
+        read_resume_stream_id(&mut server_websocket).await?;
+        server_websocket.send(Message::Text("nope".into())).await?;
+        assert!(matches!(
+            timeout(Duration::from_secs(1), connection.incoming_rx.recv()).await?,
+            Some(JsonRpcConnectionEvent::MalformedMessage { reason })
+                if reason == "relay exec-server transport expects binary protobuf frames"
+        ));
+
+        drop(connection);
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn harness_connection_reports_server_close() -> anyhow::Result<()> {
+        let (client_websocket, mut server_websocket) = websocket_pair().await?;
+        let mut connection =
+            harness_connection_from_websocket(client_websocket, "test".to_string());
+
+        read_resume_stream_id(&mut server_websocket).await?;
+        server_websocket.close(None).await?;
+        assert!(matches!(
+            timeout(Duration::from_secs(1), connection.incoming_rx.recv()).await?,
+            Some(JsonRpcConnectionEvent::Disconnected { reason: None })
+        ));
+
+        drop(connection);
+        Ok(())
+    }
+
+    #[tokio::test]
+    async fn harness_connection_keeps_outbound_frame_while_send_is_backpressured()
+    -> anyhow::Result<()> {
+        let (websocket, control, mut outbound_rx) =
+            ControlledWebSocket::new(/*write_ready*/ true);
+        let mut connection = harness_connection_from_websocket(websocket, "test".to_string());
+        let Message::Binary(resume_payload) = timeout(Duration::from_secs(1), outbound_rx.next())
+            .await?
+            .expect("resume frame")
+        else {
+            anyhow::bail!("expected relay resume frame");
+        };
+        let stream_id = decode_relay_message_frame(resume_payload.as_ref())?.stream_id;
+        let message = test_jsonrpc_message();
+
+        control.set_write_blocked();
+        connection.outgoing_tx.send(message.clone()).await?;
+        control.wait_for_blocked_write().await?;
+        control.send_inbound(Message::Pong(b"check".to_vec().into()))?;
+        assert!(
+            timeout(Duration::from_millis(50), connection.incoming_rx.recv())
+                .await
+                .is_err()
+        );
+
+        control.set_write_ready();
+        let Message::Binary(data_payload) = timeout(Duration::from_secs(1), outbound_rx.next())
+            .await?
+            .expect("data frame")
+        else {
+            anyhow::bail!("expected relay data frame");
+        };
+        let frame = decode_relay_message_frame(data_payload.as_ref())?;
+        assert_eq!(frame.stream_id, stream_id);
+        assert_eq!(frame.into_jsonrpc_message()?, message);
+        drop(connection);
+        Ok(())
+    }
+
+    async fn websocket_pair() -> anyhow::Result<(
+        WebSocketStream<tokio_tungstenite::MaybeTlsStream<tokio::net::TcpStream>>,
+        WebSocketStream<tokio::net::TcpStream>,
+    )> {
+        let listener = TcpListener::bind("127.0.0.1:0").await?;
+        let websocket_url = format!("ws://{}", listener.local_addr()?);
+        let server_task = tokio::spawn(async move {
+            let (stream, _) = listener.accept().await?;
+            accept_async(stream).await.map_err(anyhow::Error::from)
+        });
+        let (client_websocket, _) = connect_async(websocket_url).await?;
+        let server_websocket = server_task.await??;
+        Ok((client_websocket, server_websocket))
+    }
+
+    async fn read_resume_stream_id(
+        websocket: &mut WebSocketStream<tokio::net::TcpStream>,
+    ) -> anyhow::Result<String> {
+        let message = timeout(Duration::from_secs(1), websocket.next())
+            .await?
+            .expect("websocket should stay open")?;
+        let Message::Binary(payload) = message else {
+            anyhow::bail!("expected relay resume frame, got {message:?}");
+        };
+        let frame = decode_relay_message_frame(payload.as_ref())?;
+        assert_eq!(frame.validate()?, RelayFrameBodyKind::Resume);
+        Ok(frame.stream_id)
+    }
+
+    fn test_jsonrpc_message() -> JSONRPCMessage {
+        JSONRPCMessage::Request(JSONRPCRequest {
+            id: RequestId::Integer(1),
+            method: "test".to_string(),
+            params: None,
+            trace: None,
+        })
+    }
+
+    struct ControlledWebSocket {
+        inbound_rx: futures_mpsc::UnboundedReceiver<Result<Message, std::convert::Infallible>>,
+        outbound_tx: futures_mpsc::UnboundedSender<Message>,
+        write_ready: Arc<AtomicBool>,
+        write_blocked: Arc<AtomicBool>,
+        write_blocked_waker: Arc<AtomicWaker>,
+        write_waker: Arc<AtomicWaker>,
+    }
+
+    struct ControlledWebSocketHandle {
+        inbound_tx: futures_mpsc::UnboundedSender<Result<Message, std::convert::Infallible>>,
+        write_ready: Arc<AtomicBool>,
+        write_blocked: Arc<AtomicBool>,
+        write_blocked_waker: Arc<AtomicWaker>,
+        write_waker: Arc<AtomicWaker>,
+    }
+
+    impl ControlledWebSocket {
+        fn new(
+            write_ready: bool,
+        ) -> (
+            Self,
+            ControlledWebSocketHandle,
+            futures_mpsc::UnboundedReceiver<Message>,
+        ) {
+            let (inbound_tx, inbound_rx) = futures_mpsc::unbounded();
+            let (outbound_tx, outbound_rx) = futures_mpsc::unbounded();
+            let write_ready = Arc::new(AtomicBool::new(write_ready));
+            let write_blocked = Arc::new(AtomicBool::new(false));
+            let write_blocked_waker = Arc::new(AtomicWaker::new());
+            let write_waker = Arc::new(AtomicWaker::new());
+            (
+                Self {
+                    inbound_rx,
+                    outbound_tx,
+                    write_ready: Arc::clone(&write_ready),
+                    write_blocked: Arc::clone(&write_blocked),
+                    write_blocked_waker: Arc::clone(&write_blocked_waker),
+                    write_waker: Arc::clone(&write_waker),
+                },
+                ControlledWebSocketHandle {
+                    inbound_tx,
+                    write_ready,
+                    write_blocked,
+                    write_blocked_waker,
+                    write_waker,
+                },
+                outbound_rx,
+            )
+        }
+    }
+
+    impl ControlledWebSocketHandle {
+        fn send_inbound(&self, message: Message) -> anyhow::Result<()> {
+            self.inbound_tx
+                .unbounded_send(Ok(message))
+                .map_err(anyhow::Error::from)
+        }
+
+        fn set_write_blocked(&self) {
+            self.write_ready.store(false, Ordering::Release);
+        }
+
+        fn set_write_ready(&self) {
+            self.write_ready.store(true, Ordering::Release);
+            self.write_waker.wake();
+        }
+
+        async fn wait_for_blocked_write(&self) -> anyhow::Result<()> {
+            timeout(
+                Duration::from_secs(1),
+                futures::future::poll_fn(|cx| {
+                    if self.write_blocked.load(Ordering::Acquire) {
+                        Poll::Ready(())
+                    } else {
+                        self.write_blocked_waker.register(cx.waker());
+                        Poll::Pending
+                    }
+                }),
+            )
+            .await?;
+            Ok(())
+        }
+    }
+
+    impl Sink<Message> for ControlledWebSocket {
+        type Error = std::convert::Infallible;
+
+        fn poll_ready(self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Result<(), Self::Error>> {
+            if self.write_ready.load(Ordering::Acquire) {
+                Poll::Ready(Ok(()))
+            } else {
+                self.write_blocked.store(true, Ordering::Release);
+                self.write_blocked_waker.wake();
+                self.write_waker.register(cx.waker());
+                Poll::Pending
+            }
+        }
+
+        fn start_send(self: Pin<&mut Self>, item: Message) -> Result<(), Self::Error> {
+            self.outbound_tx
+                .unbounded_send(item)
+                .expect("test outbound receiver should stay open");
+            Ok(())
+        }
+
+        fn poll_flush(
+            self: Pin<&mut Self>,
+            _cx: &mut Context<'_>,
+        ) -> Poll<Result<(), Self::Error>> {
+            Poll::Ready(Ok(()))
+        }
+
+        fn poll_close(
+            self: Pin<&mut Self>,
+            _cx: &mut Context<'_>,
+        ) -> Poll<Result<(), Self::Error>> {
+            Poll::Ready(Ok(()))
+        }
+    }
+
+    impl Stream for ControlledWebSocket {
+        type Item = Result<Message, std::convert::Infallible>;
+
+        fn poll_next(mut self: Pin<&mut Self>, cx: &mut Context<'_>) -> Poll<Option<Self::Item>> {
+            Pin::new(&mut self.inbound_rx).poll_next(cx)
+        }
+    }
+}
diff --git a/codex-rs/exec-server/src/remote.rs b/codex-rs/exec-server/src/remote.rs
index 32c0d5bc8e..2493135c9a 100644
--- a/codex-rs/exec-server/src/remote.rs
+++ b/codex-rs/exec-server/src/remote.rs
@@ -1,6 +1,6 @@
-use std::env;
 use std::time::Duration;
 
+use codex_api::SharedAuthProvider;
 use reqwest::StatusCode;
 use serde::Deserialize;
 use tokio::time::sleep;
@@ -14,15 +14,12 @@ use crate::ExecServerRuntimePaths;
 use crate::relay::run_multiplexed_executor;
 use crate::server::ConnectionProcessor;
 
-pub const CODEX_EXEC_SERVER_REMOTE_BEARER_TOKEN_ENV_VAR: &str =
-    "CODEX_EXEC_SERVER_REMOTE_BEARER_TOKEN";
-
 const ERROR_BODY_PREVIEW_BYTES: usize = 4096;
 
 #[derive(Clone)]
 struct ExecutorRegistryClient {
     base_url: String,
-    bearer_token: String,
+    auth_provider: SharedAuthProvider,
     http: reqwest::Client,
 }
 
@@ -30,17 +27,17 @@ impl std::fmt::Debug for ExecutorRegistryClient {
     fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
         f.debug_struct("ExecutorRegistryClient")
             .field("base_url", &self.base_url)
-            .field("bearer_token", &"<redacted>")
+            .field("auth_provider", &"<redacted>")
             .finish_non_exhaustive()
     }
 }
 
 impl ExecutorRegistryClient {
-    fn new(base_url: String, bearer_token: String) -> Result<Self, ExecServerError> {
+    fn new(base_url: String, auth_provider: SharedAuthProvider) -> Result<Self, ExecServerError> {
         let base_url = normalize_base_url(base_url)?;
         Ok(Self {
             base_url,
-            bearer_token,
+            auth_provider,
             http: reqwest::Client::new(),
         })
     }
@@ -55,7 +52,7 @@ impl ExecutorRegistryClient {
                 &self.base_url,
                 &format!("/cloud/executor/{executor_id}/register"),
             ))
-            .bearer_auth(&self.bearer_token)
+            .headers(self.auth_provider.to_auth_headers())
             .send()
             .await?;
         self.parse_json_response(response).await
@@ -89,12 +86,12 @@ struct ExecutorRegistryExecutorRegistrationResponse {
 }
 
 /// Configuration for registering an exec-server for remote use.
-#[derive(Clone, Eq, PartialEq)]
+#[derive(Clone)]
 pub struct RemoteExecutorConfig {
     pub base_url: String,
     pub executor_id: String,
     pub name: String,
-    bearer_token: String,
+    auth_provider: SharedAuthProvider,
 }
 
 impl std::fmt::Debug for RemoteExecutorConfig {
@@ -103,28 +100,23 @@ impl std::fmt::Debug for RemoteExecutorConfig {
             .field("base_url", &self.base_url)
             .field("executor_id", &self.executor_id)
             .field("name", &self.name)
-            .field("bearer_token", &"<redacted>")
+            .field("auth_provider", &"<redacted>")
             .finish()
     }
 }
 
 impl RemoteExecutorConfig {
-    pub fn new(base_url: String, executor_id: String) -> Result<Self, ExecServerError> {
-        Self::with_bearer_token(base_url, executor_id, read_remote_bearer_token_from_env()?)
-    }
-
-    pub fn with_bearer_token(
+    pub fn new(
         base_url: String,
         executor_id: String,
-        bearer_token: String,
+        auth_provider: SharedAuthProvider,
     ) -> Result<Self, ExecServerError> {
         let executor_id = normalize_executor_id(executor_id)?;
-        let bearer_token = normalize_bearer_token(bearer_token)?;
         Ok(Self {
             base_url,
             executor_id,
             name: "codex-exec-server".to_string(),
-            bearer_token,
+            auth_provider,
         })
     }
 }
@@ -136,7 +128,8 @@ pub async fn run_remote_executor(
     runtime_paths: ExecServerRuntimePaths,
 ) -> Result<(), ExecServerError> {
     ensure_rustls_crypto_provider();
-    let client = ExecutorRegistryClient::new(config.base_url.clone(), config.bearer_token.clone())?;
+    let client =
+        ExecutorRegistryClient::new(config.base_url.clone(), config.auth_provider.clone())?;
     let processor = ConnectionProcessor::new(runtime_paths);
     let mut backoff = Duration::from_secs(1);
 
@@ -162,32 +155,6 @@ pub async fn run_remote_executor(
     }
 }
 
-fn read_remote_bearer_token_from_env() -> Result<String, ExecServerError> {
-    read_remote_bearer_token_from_env_with(|name| env::var(name))
-}
-
-fn read_remote_bearer_token_from_env_with<F>(get_var: F) -> Result<String, ExecServerError>
-where
-    F: FnOnce(&str) -> Result<String, env::VarError>,
-{
-    let bearer_token = get_var(CODEX_EXEC_SERVER_REMOTE_BEARER_TOKEN_ENV_VAR).map_err(|_| {
-        ExecServerError::ExecutorRegistryAuth(format!(
-            "executor registry bearer token environment variable `{CODEX_EXEC_SERVER_REMOTE_BEARER_TOKEN_ENV_VAR}` is not set"
-        ))
-    })?;
-    normalize_bearer_token(bearer_token)
-}
-
-fn normalize_bearer_token(bearer_token: String) -> Result<String, ExecServerError> {
-    let bearer_token = bearer_token.trim().to_string();
-    if bearer_token.is_empty() {
-        return Err(ExecServerError::ExecutorRegistryAuth(format!(
-            "executor registry bearer token environment variable `{CODEX_EXEC_SERVER_REMOTE_BEARER_TOKEN_ENV_VAR}` is empty"
-        )));
-    }
-    Ok(bearer_token)
-}
-
 fn normalize_executor_id(executor_id: String) -> Result<String, ExecServerError> {
     let executor_id = executor_id.trim().to_string();
     if executor_id.is_empty() {
@@ -274,6 +241,11 @@ fn preview_error_body(body: &str) -> Option<String> {
 
 #[cfg(test)]
 mod tests {
+    use std::sync::Arc;
+
+    use codex_api::AuthProvider;
+    use http::HeaderMap;
+    use http::HeaderValue;
     use pretty_assertions::assert_eq;
     use wiremock::Mock;
     use wiremock::MockServer;
@@ -284,25 +256,46 @@ mod tests {
 
     use super::*;
 
+    #[derive(Debug)]
+    struct StaticRegistryAuthProvider;
+
+    impl AuthProvider for StaticRegistryAuthProvider {
+        fn add_auth_headers(&self, headers: &mut HeaderMap) {
+            let _ = headers.insert(
+                http::header::AUTHORIZATION,
+                HeaderValue::from_static("Bearer registry-token"),
+            );
+            let _ = headers.insert(
+                "ChatGPT-Account-ID",
+                HeaderValue::from_static("workspace-123"),
+            );
+        }
+    }
+
+    fn static_registry_auth_provider() -> SharedAuthProvider {
+        Arc::new(StaticRegistryAuthProvider)
+    }
+
     #[tokio::test]
-    async fn register_executor_posts_with_bearer_token_header() {
+    async fn register_executor_posts_with_auth_provider_headers() {
         let server = MockServer::start().await;
-        let config = RemoteExecutorConfig::with_bearer_token(
+        let config = RemoteExecutorConfig::new(
             server.uri(),
             "exec-requested".to_string(),
-            "registry-token".to_string(),
+            static_registry_auth_provider(),
         )
         .expect("config");
         Mock::given(method("POST"))
             .and(path("/cloud/executor/exec-requested/register"))
             .and(header("authorization", "Bearer registry-token"))
+            .and(header("chatgpt-account-id", "workspace-123"))
             .respond_with(ResponseTemplate::new(200).set_body_json(serde_json::json!({
                 "executor_id": "exec-1",
                 "url": "wss://rendezvous.test/executor/exec-1?role=executor&sig=abc"
             })))
             .mount(&server)
             .await;
-        let client = ExecutorRegistryClient::new(server.uri(), "registry-token".to_string())
+        let client = ExecutorRegistryClient::new(server.uri(), static_registry_auth_provider())
             .expect("client");
 
         let response = client
@@ -320,17 +313,17 @@ mod tests {
     }
 
     #[test]
-    fn debug_output_redacts_bearer_token() {
-        let config = RemoteExecutorConfig::with_bearer_token(
+    fn debug_output_redacts_auth_provider() {
+        let config = RemoteExecutorConfig::new(
             "https://registry.example".to_string(),
             "exec-1".to_string(),
-            "secret-token".to_string(),
+            static_registry_auth_provider(),
         )
         .expect("config");
 
         let debug = format!("{config:?}");
 
         assert!(debug.contains("<redacted>"));
-        assert!(!debug.contains("secret-token"));
+        assert!(!debug.contains("workspace-123"));
     }
 }
diff --git a/codex-rs/exec-server/tests/relay.rs b/codex-rs/exec-server/tests/relay.rs
index d228db9ee5..9f985e6982 100644
--- a/codex-rs/exec-server/tests/relay.rs
+++ b/codex-rs/exec-server/tests/relay.rs
@@ -10,6 +10,7 @@ use anyhow::Context;
 use anyhow::Result;
 use anyhow::anyhow;
 use anyhow::bail;
+use codex_api::AuthProvider;
 use codex_app_server_protocol::JSONRPCError;
 use codex_app_server_protocol::JSONRPCMessage;
 use codex_app_server_protocol::JSONRPCNotification;
@@ -22,12 +23,15 @@ use codex_exec_server::InitializeResponse;
 use codex_exec_server::RemoteExecutorConfig;
 use futures::SinkExt;
 use futures::StreamExt;
+use http::HeaderMap;
+use http::HeaderValue;
 use pretty_assertions::assert_eq;
 use prost::Message as ProstMessage;
 use relay_proto::RelayData;
 use relay_proto::RelayMessageFrame;
 use relay_proto::RelayReset;
 use relay_proto::relay_message_frame;
+use std::sync::Arc;
 use tokio::net::TcpListener;
 use tokio::time::timeout;
 use tokio_tungstenite::WebSocketStream;
@@ -46,6 +50,22 @@ const REGISTRY_TOKEN: &str = "registry-token";
 const RELAY_MESSAGE_FRAME_VERSION: u32 = 1;
 const TEST_TIMEOUT: Duration = Duration::from_secs(5);
 
+#[derive(Debug)]
+struct StaticRegistryAuthProvider;
+
+impl AuthProvider for StaticRegistryAuthProvider {
+    fn add_auth_headers(&self, headers: &mut HeaderMap) {
+        let _ = headers.insert(
+            http::header::AUTHORIZATION,
+            HeaderValue::from_static("Bearer registry-token"),
+        );
+    }
+}
+
+fn static_registry_auth_provider() -> codex_api::SharedAuthProvider {
+    Arc::new(StaticRegistryAuthProvider)
+}
+
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn multiplexed_remote_executor_routes_independent_virtual_streams() -> Result<()> {
     let listener = TcpListener::bind("127.0.0.1:0").await?;
@@ -63,10 +83,10 @@ async fn multiplexed_remote_executor_routes_independent_virtual_streams() -> Res
 
     let (codex_exe, codex_linux_sandbox_exe) = common::current_test_binary_helper_paths()?;
     let runtime_paths = ExecServerRuntimePaths::new(codex_exe, codex_linux_sandbox_exe)?;
-    let config = RemoteExecutorConfig::with_bearer_token(
+    let config = RemoteExecutorConfig::new(
         registry.uri(),
         EXECUTOR_ID.to_string(),
-        REGISTRY_TOKEN.to_string(),
+        static_registry_auth_provider(),
     )?;
     let remote_executor = tokio::spawn(codex_exec_server::run_remote_executor(
         config,
diff --git a/codex-rs/exec/Cargo.toml b/codex-rs/exec/Cargo.toml
index 546e4e44fb..37a577e2c8 100644
--- a/codex-rs/exec/Cargo.toml
+++ b/codex-rs/exec/Cargo.toml
@@ -39,6 +39,7 @@ codex-protocol = { workspace = true }
 codex-utils-absolute-path = { workspace = true }
 codex-utils-cli = { workspace = true }
 codex-utils-oss = { workspace = true }
+codex-utils-sandbox-summary = { workspace = true }
 owo-colors = { workspace = true }
 serde = { workspace = true, features = ["derive"] }
 serde_json = { workspace = true }
diff --git a/codex-rs/exec/src/cli.rs b/codex-rs/exec/src/cli.rs
index 5a94e815ae..53124c11a5 100644
--- a/codex-rs/exec/src/cli.rs
+++ b/codex-rs/exec/src/cli.rs
@@ -16,6 +16,10 @@ pub struct Cli {
     #[command(subcommand)]
     pub command: Option<Command>,
 
+    /// Error out when config.toml contains fields that are not recognized by this version of Codex.
+    #[arg(long = "strict-config", global = true, default_value_t = false)]
+    pub strict_config: bool,
+
     #[clap(flatten)]
     pub shared: ExecSharedCliOptions,
 
@@ -46,7 +50,7 @@ pub struct Cli {
     pub removed_full_auto: bool,
 
     /// Path to a JSON Schema file describing the model's final response shape.
-    #[arg(long = "output-schema", value_name = "FILE")]
+    #[arg(long = "output-schema", value_name = "FILE", global = true)]
     pub output_schema: Option<PathBuf>,
 
     #[clap(skip)]
@@ -258,7 +262,7 @@ impl FromArgMatches for ResumeArgs {
     }
 }
 
-#[derive(Parser, Debug)]
+#[derive(Args, Debug)]
 pub struct ReviewArgs {
     /// Review staged, unstaged, and untracked changes.
     #[arg(
diff --git a/codex-rs/exec/src/cli_tests.rs b/codex-rs/exec/src/cli_tests.rs
index 45f2aa330d..524067dd66 100644
--- a/codex-rs/exec/src/cli_tests.rs
+++ b/codex-rs/exec/src/cli_tests.rs
@@ -36,7 +36,7 @@ fn resume_parses_prompt_after_global_flags() {
 }
 
 #[test]
-fn resume_accepts_output_last_message_flag_after_subcommand() {
+fn resume_accepts_output_flags_after_subcommand() {
     const PROMPT: &str = "echo resume-with-output-file";
     let cli = Cli::parse_from([
         "codex-exec",
@@ -44,6 +44,8 @@ fn resume_accepts_output_last_message_flag_after_subcommand() {
         "session-123",
         "-o",
         "/tmp/resume-output.md",
+        "--output-schema",
+        "/tmp/schema.json",
         PROMPT,
     ]);
 
@@ -51,6 +53,7 @@ fn resume_accepts_output_last_message_flag_after_subcommand() {
         cli.last_message_file,
         Some(PathBuf::from("/tmp/resume-output.md"))
     );
+    assert_eq!(cli.output_schema, Some(PathBuf::from("/tmp/schema.json")));
     let Some(Command::Resume(args)) = cli.command else {
         panic!("expected resume command");
     };
diff --git a/codex-rs/exec/src/event_processor_with_human_output.rs b/codex-rs/exec/src/event_processor_with_human_output.rs
index 92248c19ec..c3190b8740 100644
--- a/codex-rs/exec/src/event_processor_with_human_output.rs
+++ b/codex-rs/exec/src/event_processor_with_human_output.rs
@@ -1,5 +1,4 @@
 use std::io::IsTerminal;
-use std::path::Path;
 use std::path::PathBuf;
 
 use codex_app_server_protocol::CommandExecutionStatus;
@@ -11,11 +10,9 @@ use codex_app_server_protocol::ThreadTokenUsage;
 use codex_app_server_protocol::TurnStatus;
 use codex_core::config::Config;
 use codex_model_provider_info::WireApi;
-use codex_protocol::models::PermissionProfile;
 use codex_protocol::num_format::format_with_separators;
-use codex_protocol::permissions::NetworkSandboxPolicy;
 use codex_protocol::protocol::SessionConfiguredEvent;
-use codex_utils_absolute_path::canonicalize_preserving_symlinks;
+use codex_utils_sandbox_summary::summarize_permission_profile;
 use owo_colors::OwoColorize;
 use owo_colors::Style;
 
@@ -423,6 +420,7 @@ fn config_summary_entries(
     config: &Config,
     session_configured_event: &SessionConfiguredEvent,
 ) -> Vec<(&'static str, String)> {
+    let permission_profile = config.permissions.effective_permission_profile();
     let mut entries = vec![
         ("workdir", config.cwd.display().to_string()),
         ("model", session_configured_event.model.clone()),
@@ -437,8 +435,9 @@ fn config_summary_entries(
         (
             "sandbox",
             summarize_permission_profile(
-                config.permissions.permission_profile.get(),
-                config.cwd.as_path(),
+                &permission_profile,
+                &config.cwd,
+                config.effective_workspace_roots().as_slice(),
             ),
         ),
     ];
@@ -465,83 +464,6 @@ fn config_summary_entries(
     entries
 }
 
-fn summarize_permission_profile(permission_profile: &PermissionProfile, cwd: &Path) -> String {
-    match permission_profile {
-        PermissionProfile::Disabled => "danger-full-access".to_string(),
-        PermissionProfile::External { network } => {
-            let mut summary = "external-sandbox".to_string();
-            append_network_summary(&mut summary, *network);
-            summary
-        }
-        PermissionProfile::Managed { .. } => {
-            let file_system_policy = permission_profile.file_system_sandbox_policy();
-            let network_policy = permission_profile.network_sandbox_policy();
-            if file_system_policy.has_full_disk_write_access() {
-                let mut summary = "workspace-write [/]".to_string();
-                append_network_summary(&mut summary, network_policy);
-                return summary;
-            }
-
-            let writable_roots = file_system_policy.get_writable_roots_with_cwd(cwd);
-            if writable_roots.is_empty() {
-                let mut summary = "read-only".to_string();
-                append_network_summary(&mut summary, network_policy);
-                return summary;
-            }
-
-            let mut summary = "workspace-write".to_string();
-            let writable_entries = writable_roots
-                .iter()
-                .map(|root| writable_root_label(root.root.as_path(), cwd))
-                .collect::<Vec<_>>();
-            summary.push_str(&format!(" [{}]", writable_entries.join(", ")));
-            append_network_summary(&mut summary, network_policy);
-            summary
-        }
-    }
-}
-
-fn append_network_summary(summary: &mut String, network_policy: NetworkSandboxPolicy) {
-    if network_policy.is_enabled() {
-        summary.push_str(" (network access enabled)");
-    }
-}
-
-fn writable_root_label(root: &Path, cwd: &Path) -> String {
-    if paths_match_after_canonicalization(root, cwd) {
-        return "workdir".to_string();
-    }
-    if paths_match_after_canonicalization(root, Path::new("/tmp")) {
-        return "/tmp".to_string();
-    }
-    if std::env::var_os("TMPDIR")
-        .filter(|tmpdir| !tmpdir.is_empty())
-        .is_some_and(|tmpdir| paths_match_after_canonicalization(root, Path::new(&tmpdir)))
-    {
-        return "$TMPDIR".to_string();
-    }
-    display_path_label(root)
-}
-
-fn paths_match_after_canonicalization(left: &Path, right: &Path) -> bool {
-    match (
-        canonicalize_preserving_symlinks(left),
-        canonicalize_preserving_symlinks(right),
-    ) {
-        (Ok(left), Ok(right)) if left == right => true,
-        _ => display_path_label(left) == display_path_label(right),
-    }
-}
-
-fn display_path_label(path: &Path) -> String {
-    path.strip_prefix("/private/tmp")
-        .ok()
-        .map(|suffix| Path::new("/tmp").join(suffix))
-        .unwrap_or_else(|| path.to_path_buf())
-        .to_string_lossy()
-        .to_string()
-}
-
 fn reasoning_text(
     summary: &[String],
     content: &[String],
diff --git a/codex-rs/exec/src/event_processor_with_human_output_tests.rs b/codex-rs/exec/src/event_processor_with_human_output_tests.rs
index 479758f9a0..1e900f2b61 100644
--- a/codex-rs/exec/src/event_processor_with_human_output_tests.rs
+++ b/codex-rs/exec/src/event_processor_with_human_output_tests.rs
@@ -2,24 +2,29 @@ use codex_app_server_protocol::ServerNotification;
 use codex_app_server_protocol::ThreadItem;
 use codex_app_server_protocol::Turn;
 use codex_app_server_protocol::TurnStatus;
+use codex_core::config::ConfigBuilder;
+use codex_protocol::SessionId;
+use codex_protocol::ThreadId;
 use codex_protocol::models::PermissionProfile;
 use codex_protocol::permissions::FileSystemAccessMode;
 use codex_protocol::permissions::FileSystemPath;
 use codex_protocol::permissions::FileSystemSandboxEntry;
 use codex_protocol::permissions::FileSystemSandboxPolicy;
 use codex_protocol::permissions::NetworkSandboxPolicy;
+use codex_protocol::protocol::AskForApproval;
+use codex_protocol::protocol::SessionConfiguredEvent;
 use codex_utils_absolute_path::test_support::PathBufExt;
 use codex_utils_absolute_path::test_support::test_path_buf;
+use codex_utils_sandbox_summary::summarize_permission_profile;
 use owo_colors::Style;
 use pretty_assertions::assert_eq;
 
 use super::EventProcessorWithHumanOutput;
+use super::config_summary_entries;
 use super::final_message_from_turn_items;
-use super::paths_match_after_canonicalization;
 use super::reasoning_text;
 use super::should_print_final_message_to_stdout;
 use super::should_print_final_message_to_tty;
-use super::summarize_permission_profile;
 use crate::event_processor::EventProcessor;
 
 #[test]
@@ -101,10 +106,13 @@ fn reasoning_text_uses_raw_content_when_enabled() {
 
 #[test]
 fn summarizes_disabled_permission_profile_as_danger_full_access() {
+    let cwd = test_path_buf("/tmp").abs();
+
     assert_eq!(
         summarize_permission_profile(
             &PermissionProfile::Disabled,
-            test_path_buf("/tmp").as_path()
+            &cwd,
+            std::slice::from_ref(&cwd),
         ),
         "danger-full-access"
     );
@@ -112,12 +120,15 @@ fn summarizes_disabled_permission_profile_as_danger_full_access() {
 
 #[test]
 fn summarizes_external_permission_profile() {
+    let cwd = test_path_buf("/tmp").abs();
+
     assert_eq!(
         summarize_permission_profile(
             &PermissionProfile::External {
                 network: NetworkSandboxPolicy::Enabled,
             },
-            test_path_buf("/tmp").as_path(),
+            &cwd,
+            std::slice::from_ref(&cwd),
         ),
         "external-sandbox (network access enabled)"
     );
@@ -144,30 +155,88 @@ fn summarizes_managed_workspace_write_permission_profile() {
     );
 
     assert_eq!(
-        summarize_permission_profile(&profile, cwd.as_path()),
+        summarize_permission_profile(&profile, &cwd, &[cwd.clone(), cache_root.clone()]),
         format!("workspace-write [workdir, {}]", cache_root.display())
     );
 }
 
 #[test]
 fn summarizes_managed_read_only_permission_profile() {
+    let cwd = test_path_buf("/tmp/project").abs();
     let profile = PermissionProfile::from_runtime_permissions(
         &FileSystemSandboxPolicy::restricted(Vec::new()),
         NetworkSandboxPolicy::Restricted,
     );
 
     assert_eq!(
-        summarize_permission_profile(&profile, test_path_buf("/tmp/project").as_path()),
+        summarize_permission_profile(&profile, &cwd, std::slice::from_ref(&cwd)),
         "read-only"
     );
 }
 
-#[test]
-fn distinct_missing_paths_do_not_match_after_canonicalization() {
-    assert!(!paths_match_after_canonicalization(
-        test_path_buf("/tmp/codex-missing-left").as_path(),
-        test_path_buf("/tmp/codex-missing-right").as_path(),
-    ));
+#[tokio::test]
+async fn config_summary_entries_include_runtime_workspace_roots() {
+    let codex_home = tempfile::tempdir().expect("create codex home");
+    let cwd = tempfile::tempdir().expect("create cwd");
+    let extra_root = tempfile::tempdir().expect("create extra root");
+    let mut config = ConfigBuilder::default()
+        .codex_home(codex_home.path().to_path_buf())
+        .fallback_cwd(Some(cwd.path().to_path_buf()))
+        .build()
+        .await
+        .expect("build default config");
+    let cwd = cwd.path().to_path_buf().abs();
+    let extra_root = extra_root.path().to_path_buf().abs();
+    let expected_extra_root_name = extra_root
+        .file_name()
+        .expect("extra root should have file name")
+        .to_string_lossy()
+        .to_string();
+    config.cwd = cwd.clone();
+    config.workspace_roots = vec![cwd.clone(), extra_root];
+    config
+        .permissions
+        .set_workspace_roots(config.workspace_roots.clone());
+    config
+        .permissions
+        .set_permission_profile(PermissionProfile::workspace_write_with(
+            &[],
+            NetworkSandboxPolicy::Restricted,
+            /*exclude_tmpdir_env_var*/ true,
+            /*exclude_slash_tmp*/ true,
+        ))
+        .expect("set permission profile");
+
+    let session_configured_event = SessionConfiguredEvent {
+        session_id: SessionId::new(),
+        thread_id: ThreadId::new(),
+        forked_from_id: None,
+        thread_source: None,
+        thread_name: None,
+        model: "gpt-5.4".to_string(),
+        model_provider_id: config.model_provider_id.clone(),
+        service_tier: None,
+        approval_policy: AskForApproval::Never,
+        approvals_reviewer: config.approvals_reviewer,
+        permission_profile: config.permissions.effective_permission_profile(),
+        active_permission_profile: None,
+        cwd,
+        reasoning_effort: None,
+        initial_messages: None,
+        network_proxy: None,
+        rollout_path: None,
+    };
+
+    let summary_entries = config_summary_entries(&config, &session_configured_event);
+    let sandbox_summary = summary_entries
+        .iter()
+        .find_map(|(key, value)| (*key == "sandbox").then_some(value))
+        .expect("sandbox summary entry");
+    assert!(
+        sandbox_summary.starts_with("workspace-write [workdir, ")
+            && sandbox_summary.contains(&expected_extra_root_name),
+        "expected runtime workspace root in sandbox summary: {summary_entries:?}"
+    );
 }
 
 #[test]
diff --git a/codex-rs/exec/src/event_processor_with_jsonl_output.rs b/codex-rs/exec/src/event_processor_with_jsonl_output.rs
index 045baacc7b..89e41eacb1 100644
--- a/codex-rs/exec/src/event_processor_with_jsonl_output.rs
+++ b/codex-rs/exec/src/event_processor_with_jsonl_output.rs
@@ -223,6 +223,7 @@ impl EventProcessorWithJsonOutput {
                     arguments,
                     result: result.map(|result| McpToolCallItemResult {
                         content: result.content,
+                        meta: result.meta,
                         structured_content: result.structured_content,
                     }),
                     error: error.map(|error| McpToolCallItemError {
diff --git a/codex-rs/exec/src/event_processor_with_jsonl_output_tests.rs b/codex-rs/exec/src/event_processor_with_jsonl_output_tests.rs
index 88fd042f7c..6bd358f6be 100644
--- a/codex-rs/exec/src/event_processor_with_jsonl_output_tests.rs
+++ b/codex-rs/exec/src/event_processor_with_jsonl_output_tests.rs
@@ -1,5 +1,6 @@
 use super::*;
 use pretty_assertions::assert_eq;
+use serde_json::json;
 use tempfile::tempdir;
 
 #[test]
@@ -57,3 +58,53 @@ fn failed_turn_does_not_overwrite_output_last_message_file() {
         "keep existing contents"
     );
 }
+
+#[test]
+fn mcp_tool_call_result_preserves_meta_in_jsonl_event() {
+    let mut processor = EventProcessorWithJsonOutput::new(/*last_message_path*/ None);
+
+    let collected = processor.collect_thread_events(ServerNotification::ItemCompleted(
+        codex_app_server_protocol::ItemCompletedNotification {
+            item: ThreadItem::McpToolCall {
+                id: "mcp-1".to_string(),
+                server: "search service".to_string(),
+                tool: "web_run".to_string(),
+                status: McpToolCallStatus::Completed,
+                arguments: json!({"search_query": [{"q": "OpenAI Codex CLI documentation"}]}),
+                mcp_app_resource_uri: None,
+                result: Some(Box::new(codex_app_server_protocol::McpToolCallResult {
+                    content: vec![json!({"type": "text", "text": "search result"})],
+                    structured_content: None,
+                    meta: Some(json!({"raw_messages": [{"ref_id": "turn0search0"}]})),
+                })),
+                error: None,
+                duration_ms: Some(42),
+            },
+            thread_id: "thread-1".to_string(),
+            turn_id: "turn-1".to_string(),
+            completed_at_ms: 0,
+        },
+    ));
+
+    assert_eq!(collected.status, CodexStatus::Running);
+    assert_eq!(collected.events.len(), 1);
+
+    let ThreadEvent::ItemCompleted(ItemCompletedEvent { item }) = &collected.events[0] else {
+        panic!("expected item.completed event");
+    };
+    let ThreadItemDetails::McpToolCall(item) = &item.details else {
+        panic!("expected MCP tool call item");
+    };
+    let result = item.result.as_ref().expect("expected MCP tool result");
+    assert_eq!(
+        result.meta,
+        Some(json!({"raw_messages": [{"ref_id": "turn0search0"}]}))
+    );
+
+    let serialized = serde_json::to_value(&collected.events[0]).expect("serialize event");
+    assert_eq!(
+        serialized["item"]["result"]["_meta"],
+        json!({"raw_messages": [{"ref_id": "turn0search0"}]})
+    );
+    assert!(serialized["item"]["result"].get("meta").is_none());
+}
diff --git a/codex-rs/exec/src/exec_events.rs b/codex-rs/exec/src/exec_events.rs
index 4a84ef7494..078a876ef4 100644
--- a/codex-rs/exec/src/exec_events.rs
+++ b/codex-rs/exec/src/exec_events.rs
@@ -266,6 +266,9 @@ pub struct McpToolCallItemResult {
     // representations). Using `JsonValue` keeps the payload wire-shaped and
     // easy to export.
     pub content: Vec<JsonValue>,
+    #[serde(rename = "_meta", skip_serializing_if = "Option::is_none")]
+    #[ts(optional)]
+    pub meta: Option<JsonValue>,
     pub structured_content: Option<JsonValue>,
 }
 
diff --git a/codex-rs/exec/src/lib.rs b/codex-rs/exec/src/lib.rs
index e7a960c02e..3db7a51576 100644
--- a/codex-rs/exec/src/lib.rs
+++ b/codex-rs/exec/src/lib.rs
@@ -24,8 +24,6 @@ use codex_app_server_protocol::ConfigWarningNotification;
 use codex_app_server_protocol::JSONRPCErrorError;
 use codex_app_server_protocol::McpServerElicitationAction;
 use codex_app_server_protocol::McpServerElicitationRequestResponse;
-use codex_app_server_protocol::PermissionProfileModificationParams;
-use codex_app_server_protocol::PermissionProfileSelectionParams;
 use codex_app_server_protocol::RequestId;
 use codex_app_server_protocol::ReviewStartParams;
 use codex_app_server_protocol::ReviewStartResponse;
@@ -41,6 +39,7 @@ use codex_app_server_protocol::ThreadReadResponse;
 use codex_app_server_protocol::ThreadResumeParams;
 use codex_app_server_protocol::ThreadResumeResponse;
 use codex_app_server_protocol::ThreadSortKey;
+use codex_app_server_protocol::ThreadSource;
 use codex_app_server_protocol::ThreadSourceKind;
 use codex_app_server_protocol::ThreadStartParams;
 use codex_app_server_protocol::ThreadStartResponse;
@@ -54,6 +53,7 @@ use codex_app_server_protocol::TurnStartedNotification;
 use codex_arg0::Arg0DispatchPaths;
 use codex_cloud_requirements::cloud_requirements_loader_for_storage;
 use codex_config::ConfigLoadError;
+use codex_config::ConfigLoadOptions;
 use codex_config::LoaderOverrides;
 use codex_config::format_config_error_with_source;
 use codex_core::StateDbHandle;
@@ -62,8 +62,9 @@ use codex_core::config::Config;
 use codex_core::config::ConfigBuilder;
 use codex_core::config::ConfigOverrides;
 use codex_core::config::find_codex_home;
-use codex_core::config::load_config_as_toml_with_cli_and_loader_overrides;
+use codex_core::config::load_config_as_toml_with_cli_and_load_options;
 use codex_core::config::resolve_oss_provider;
+use codex_core::config::resolve_profile_v2_config_path;
 use codex_core::find_thread_meta_by_name_str;
 use codex_core::format_exec_policy_error_with_source;
 use codex_core::path_utils;
@@ -81,7 +82,6 @@ use codex_protocol::SessionId;
 use codex_protocol::ThreadId;
 use codex_protocol::config_types::SandboxMode;
 use codex_protocol::models::ActivePermissionProfile;
-use codex_protocol::models::ActivePermissionProfileModification;
 use codex_protocol::models::PermissionProfile;
 use codex_protocol::protocol::AskForApproval;
 use codex_protocol::protocol::ReviewRequest;
@@ -242,6 +242,7 @@ pub async fn run_main(cli: Cli, arg0_paths: Arg0DispatchPaths) -> anyhow::Result
 
     let Cli {
         command,
+        strict_config,
         shared,
         skip_git_repo_check,
         ephemeral,
@@ -262,6 +263,7 @@ pub async fn run_main(cli: Cli, arg0_paths: Arg0DispatchPaths) -> anyhow::Result
         oss,
         oss_provider,
         config_profile,
+        config_profile_v2,
         sandbox_mode: sandbox_mode_cli_arg,
         dangerously_bypass_approvals_and_sandbox,
         bypass_hook_trust,
@@ -317,19 +319,25 @@ pub async fn run_main(cli: Cli, arg0_paths: Arg0DispatchPaths) -> anyhow::Result
             std::process::exit(1);
         }
     };
-
-    #[allow(clippy::print_stderr)]
+    let user_config_path = config_profile_v2
+        .as_ref()
+        .map(|profile_v2| resolve_profile_v2_config_path(&codex_home, profile_v2));
     let loader_overrides = LoaderOverrides {
+        user_config_path,
+        user_config_profile: config_profile_v2,
         ignore_user_config,
         ignore_user_and_project_exec_policy_rules: ignore_rules,
         ..Default::default()
     };
 
-    let config_toml = match load_config_as_toml_with_cli_and_loader_overrides(
+    let config_toml = match load_config_as_toml_with_cli_and_load_options(
         &codex_home,
         Some(&config_cwd),
         cli_kv_overrides.clone(),
-        loader_overrides.clone(),
+        ConfigLoadOptions {
+            loader_overrides: loader_overrides.clone(),
+            strict_config,
+        },
     )
     .await
     {
@@ -409,6 +417,7 @@ pub async fn run_main(cli: Cli, arg0_paths: Arg0DispatchPaths) -> anyhow::Result
         permission_profile: None,
         default_permissions: None,
         cwd: resolved_cwd,
+        workspace_roots: None,
         model_provider: model_provider.clone(),
         service_tier: None,
         codex_self_exe: arg0_paths.codex_self_exe.clone(),
@@ -419,7 +428,6 @@ pub async fn run_main(cli: Cli, arg0_paths: Arg0DispatchPaths) -> anyhow::Result
         developer_instructions: None,
         personality: None,
         compact_prompt: None,
-        include_apply_patch_tool: None,
         show_raw_agent_reasoning: oss.then_some(true),
         tools_web_search_request: None,
         ephemeral: ephemeral.then_some(true),
@@ -431,6 +439,7 @@ pub async fn run_main(cli: Cli, arg0_paths: Arg0DispatchPaths) -> anyhow::Result
         .cli_overrides(cli_kv_overrides)
         .harness_overrides(overrides)
         .loader_overrides(loader_overrides)
+        .strict_config(strict_config)
         .cloud_requirements(cloud_requirements)
         .build()
         .await?;
@@ -513,15 +522,17 @@ pub async fn run_main(cli: Cli, arg0_paths: Arg0DispatchPaths) -> anyhow::Result
     )?;
     let state_db = codex_core::init_state_db(&config).await;
     let environment_manager = if run_loader_overrides.ignore_user_config {
-        EnvironmentManager::from_env(local_runtime_paths).await?
+        EnvironmentManager::from_env(Some(local_runtime_paths)).await?
     } else {
-        EnvironmentManager::from_codex_home(config.codex_home.clone(), local_runtime_paths).await?
+        EnvironmentManager::from_codex_home(config.codex_home.clone(), Some(local_runtime_paths))
+            .await?
     };
     let in_process_start_args = InProcessClientStartArgs {
         arg0_paths,
         config: std::sync::Arc::new(config.clone()),
         cli_overrides: run_cli_overrides,
         loader_overrides: run_loader_overrides,
+        strict_config,
         cloud_requirements: run_cloud_requirements,
         feedback: CodexFeedback::new(),
         log_db: None,
@@ -627,7 +638,7 @@ async fn run_exec_session(args: ExecRunArgs) -> anyhow::Result<()> {
             let mut items: Vec<UserInput> = imgs
                 .into_iter()
                 .chain(args.images.iter().cloned())
-                .map(|path| UserInput::LocalImage { path })
+                .map(|path| UserInput::LocalImage { path, detail: None })
                 .collect();
             items.push(UserInput::Text {
                 text: prompt_text.clone(),
@@ -647,7 +658,7 @@ async fn run_exec_session(args: ExecRunArgs) -> anyhow::Result<()> {
             let prompt_text = resolve_root_prompt(root_prompt);
             let mut items: Vec<UserInput> = imgs
                 .into_iter()
-                .map(|path| UserInput::LocalImage { path })
+                .map(|path| UserInput::LocalImage { path, detail: None })
                 .collect();
             items.push(UserInput::Text {
                 text: prompt_text.clone(),
@@ -749,7 +760,7 @@ async fn run_exec_session(args: ExecRunArgs) -> anyhow::Result<()> {
     event_processor.print_config_summary(&config, &prompt_summary, &session_configured);
     if !json_mode
         && let Some(message) =
-            codex_core::config::system_bwrap_warning(config.permissions.permission_profile.get())
+            codex_core::config::system_bwrap_warning(config.permissions.permission_profile())
     {
         event_processor.process_warning(message);
     }
@@ -779,6 +790,7 @@ async fn run_exec_session(args: ExecRunArgs) -> anyhow::Result<()> {
                         responsesapi_client_metadata: None,
                         environments: None,
                         cwd: Some(default_cwd),
+                        runtime_workspace_roots: None,
                         approval_policy: Some(default_approval_policy.into()),
                         approvals_reviewer: None,
                         sandbox_policy: None,
@@ -942,7 +954,7 @@ fn thread_start_params_from_config(config: &Config) -> ThreadStartParams {
     let permissions = permissions_selection_from_config(config);
     let sandbox = permissions.is_none().then(|| {
         sandbox_mode_from_permission_profile(
-            &config.permissions.permission_profile(),
+            &config.permissions.effective_permission_profile(),
             config.cwd.as_path(),
         )
     });
@@ -950,12 +962,20 @@ fn thread_start_params_from_config(config: &Config) -> ThreadStartParams {
         model: config.model.clone(),
         model_provider: Some(config.model_provider_id.clone()),
         cwd: Some(config.cwd.to_string_lossy().to_string()),
+        runtime_workspace_roots: Some(
+            config
+                .workspace_roots
+                .iter()
+                .map(AbsolutePathBuf::to_path_buf)
+                .collect(),
+        ),
         approval_policy: Some(config.permissions.approval_policy.value().into()),
         approvals_reviewer: approvals_reviewer_override_from_config(config),
         sandbox: sandbox.flatten(),
         permissions,
         config: config_request_overrides_from_config(config),
         ephemeral: Some(config.ephemeral),
+        thread_source: Some(ThreadSource::User),
         ..ThreadStartParams::default()
     }
 }
@@ -964,7 +984,7 @@ fn thread_resume_params_from_config(config: &Config, thread_id: String) -> Threa
     let permissions = permissions_selection_from_config(config);
     let sandbox = permissions.is_none().then(|| {
         sandbox_mode_from_permission_profile(
-            &config.permissions.permission_profile(),
+            &config.permissions.effective_permission_profile(),
             config.cwd.as_path(),
         )
     });
@@ -973,6 +993,13 @@ fn thread_resume_params_from_config(config: &Config, thread_id: String) -> Threa
         model: config.model.clone(),
         model_provider: Some(config.model_provider_id.clone()),
         cwd: Some(config.cwd.to_string_lossy().to_string()),
+        runtime_workspace_roots: Some(
+            config
+                .workspace_roots
+                .iter()
+                .map(AbsolutePathBuf::to_path_buf)
+                .collect(),
+        ),
         approval_policy: Some(config.permissions.approval_policy.value().into()),
         approvals_reviewer: approvals_reviewer_override_from_config(config),
         sandbox: sandbox.flatten(),
@@ -982,29 +1009,15 @@ fn thread_resume_params_from_config(config: &Config, thread_id: String) -> Threa
     }
 }
 
-fn permissions_selection_from_config(config: &Config) -> Option<PermissionProfileSelectionParams> {
+fn permissions_selection_from_config(config: &Config) -> Option<String> {
     config
         .permissions
         .active_permission_profile()
-        .map(permissions_selection_from_active_profile)
+        .map(permission_profile_id_from_active_profile)
 }
 
-fn permissions_selection_from_active_profile(
-    active: ActivePermissionProfile,
-) -> PermissionProfileSelectionParams {
-    let modifications = active
-        .modifications
-        .into_iter()
-        .map(|modification| match modification {
-            ActivePermissionProfileModification::AdditionalWritableRoot { path } => {
-                PermissionProfileModificationParams::AdditionalWritableRoot { path }
-            }
-        })
-        .collect::<Vec<_>>();
-    PermissionProfileSelectionParams::Profile {
-        id: active.id,
-        modifications: (!modifications.is_empty()).then_some(modifications),
-    }
+fn permission_profile_id_from_active_profile(active: ActivePermissionProfile) -> String {
+    active.id
 }
 
 fn sandbox_mode_from_permission_profile(
@@ -1069,6 +1082,7 @@ fn session_configured_from_thread_start_response(
     session_configured_from_thread_response(
         &response.thread.session_id,
         &response.thread.id,
+        response.thread.thread_source.map(Into::into),
         response.thread.name.clone(),
         response.thread.path.clone(),
         response.model.clone(),
@@ -1076,11 +1090,7 @@ fn session_configured_from_thread_start_response(
         response.service_tier.clone(),
         response.approval_policy.to_core(),
         response.approvals_reviewer.to_core(),
-        response
-            .permission_profile
-            .clone()
-            .map(Into::into)
-            .unwrap_or_else(|| config.permissions.permission_profile()),
+        config.permissions.effective_permission_profile(),
         response.active_permission_profile.clone().map(Into::into),
         response.cwd.clone(),
         response.reasoning_effort,
@@ -1094,6 +1104,7 @@ fn session_configured_from_thread_resume_response(
     session_configured_from_thread_response(
         &response.thread.session_id,
         &response.thread.id,
+        response.thread.thread_source.map(Into::into),
         response.thread.name.clone(),
         response.thread.path.clone(),
         response.model.clone(),
@@ -1101,11 +1112,7 @@ fn session_configured_from_thread_resume_response(
         response.service_tier.clone(),
         response.approval_policy.to_core(),
         response.approvals_reviewer.to_core(),
-        response
-            .permission_profile
-            .clone()
-            .map(Into::into)
-            .unwrap_or_else(|| config.permissions.permission_profile()),
+        config.permissions.effective_permission_profile(),
         response.active_permission_profile.clone().map(Into::into),
         response.cwd.clone(),
         response.reasoning_effort,
@@ -1128,6 +1135,7 @@ fn review_target_to_api(target: ReviewTarget) -> ApiReviewTarget {
 fn session_configured_from_thread_response(
     session_id: &str,
     thread_id: &str,
+    thread_source: Option<codex_protocol::protocol::ThreadSource>,
     thread_name: Option<String>,
     rollout_path: Option<PathBuf>,
     model: String,
@@ -1149,7 +1157,7 @@ fn session_configured_from_thread_response(
         session_id,
         thread_id,
         forked_from_id: None,
-        thread_source: None,
+        thread_source,
         thread_name,
         model,
         model_provider_id,
diff --git a/codex-rs/exec/src/lib_tests.rs b/codex-rs/exec/src/lib_tests.rs
index c12b483e89..79d07a0b76 100644
--- a/codex-rs/exec/src/lib_tests.rs
+++ b/codex-rs/exec/src/lib_tests.rs
@@ -1,6 +1,8 @@
 use super::*;
 use codex_otel::set_parent_from_w3c_trace_context;
 use codex_protocol::config_types::ApprovalsReviewer;
+use codex_protocol::models::ActivePermissionProfile;
+use codex_protocol::models::BUILT_IN_PERMISSION_PROFILE_WORKSPACE;
 use codex_utils_absolute_path::test_support::PathBufExt;
 use codex_utils_absolute_path::test_support::test_path_buf;
 use opentelemetry::trace::TraceContextExt;
@@ -409,6 +411,7 @@ async fn thread_start_params_include_review_policy_when_review_policy_is_manual_
     let codex_home = tempdir().expect("create temp codex home");
     let cwd = tempdir().expect("create temp cwd");
     let config = ConfigBuilder::default()
+        .loader_overrides(LoaderOverrides::without_managed_config_for_tests())
         .codex_home(codex_home.path().to_path_buf())
         .harness_overrides(ConfigOverrides {
             approvals_reviewer: Some(ApprovalsReviewer::User),
@@ -455,6 +458,34 @@ async fn thread_start_params_include_review_policy_when_auto_review_is_enabled()
     );
 }
 
+#[tokio::test]
+async fn thread_start_params_include_user_thread_source() {
+    let codex_home = tempdir().expect("create temp codex home");
+    let cwd = tempdir().expect("create temp cwd");
+    let config = ConfigBuilder::default()
+        .codex_home(codex_home.path().to_path_buf())
+        .fallback_cwd(Some(cwd.path().to_path_buf()))
+        .build()
+        .await
+        .expect("build config");
+
+    let params = thread_start_params_from_config(&config);
+
+    assert_eq!(
+        params.thread_source,
+        Some(codex_app_server_protocol::ThreadSource::User)
+    );
+}
+
+#[test]
+fn active_profile_selection_uses_profile_id_only() {
+    let selection = permission_profile_id_from_active_profile(ActivePermissionProfile::new(
+        BUILT_IN_PERMISSION_PROFILE_WORKSPACE,
+    ));
+
+    assert_eq!(selection, BUILT_IN_PERMISSION_PROFILE_WORKSPACE.to_string());
+}
+
 #[tokio::test]
 async fn thread_lifecycle_params_include_legacy_sandbox_when_no_active_profile() {
     let codex_home = tempdir().expect("create temp codex home");
@@ -513,7 +544,7 @@ async fn session_configured_from_thread_response_uses_review_policy_from_respons
 }
 
 #[tokio::test]
-async fn session_configured_from_thread_response_uses_permission_profile_from_response() {
+async fn session_configured_from_thread_response_uses_permission_profile_from_config() {
     let codex_home = tempdir().expect("create temp codex home");
     let cwd = tempdir().expect("create temp cwd");
     let config = ConfigBuilder::default()
@@ -522,13 +553,36 @@ async fn session_configured_from_thread_response_uses_permission_profile_from_re
         .build()
         .await
         .expect("build config");
-    let mut response = sample_thread_start_response();
-    response.permission_profile = Some(PermissionProfile::Disabled.into());
+    let response = sample_thread_start_response();
 
     let event = session_configured_from_thread_start_response(&response, &config)
         .expect("build bootstrap session configured event");
 
-    assert_eq!(event.permission_profile, PermissionProfile::Disabled);
+    assert_eq!(
+        event.permission_profile,
+        config.permissions.effective_permission_profile()
+    );
+}
+
+#[tokio::test]
+async fn session_configured_from_thread_response_preserves_thread_source() {
+    let codex_home = tempdir().expect("create temp codex home");
+    let cwd = tempdir().expect("create temp cwd");
+    let config = ConfigBuilder::default()
+        .codex_home(codex_home.path().to_path_buf())
+        .fallback_cwd(Some(cwd.path().to_path_buf()))
+        .build()
+        .await
+        .expect("build config");
+    let response = sample_thread_start_response();
+
+    let event = session_configured_from_thread_start_response(&response, &config)
+        .expect("build bootstrap session configured event");
+
+    assert_eq!(
+        event.thread_source,
+        Some(codex_protocol::protocol::ThreadSource::User)
+    );
 }
 
 fn sample_thread_start_response() -> ThreadStartResponse {
@@ -547,7 +601,7 @@ fn sample_thread_start_response() -> ThreadStartResponse {
             cwd: test_path_buf("/tmp").abs(),
             cli_version: "0.0.0".to_string(),
             source: codex_app_server_protocol::SessionSource::Cli,
-            thread_source: None,
+            thread_source: Some(codex_app_server_protocol::ThreadSource::User),
             agent_nickname: None,
             agent_role: None,
             git_info: None,
@@ -558,6 +612,7 @@ fn sample_thread_start_response() -> ThreadStartResponse {
         model_provider: "openai".to_string(),
         service_tier: None,
         cwd: test_path_buf("/tmp").abs(),
+        runtime_workspace_roots: Vec::new(),
         instruction_sources: Vec::new(),
         approval_policy: codex_app_server_protocol::AskForApproval::OnRequest,
         approvals_reviewer: codex_app_server_protocol::ApprovalsReviewer::AutoReview,
@@ -567,7 +622,6 @@ fn sample_thread_start_response() -> ThreadStartResponse {
             exclude_tmpdir_env_var: false,
             exclude_slash_tmp: false,
         },
-        permission_profile: None,
         active_permission_profile: None,
         reasoning_effort: None,
     }
diff --git a/codex-rs/exec/src/main.rs b/codex-rs/exec/src/main.rs
index 79a681b146..61eaecdd0a 100644
--- a/codex-rs/exec/src/main.rs
+++ b/codex-rs/exec/src/main.rs
@@ -32,8 +32,7 @@ fn main() -> anyhow::Result<()> {
         let mut inner = top_cli.inner;
         inner
             .config_overrides
-            .raw_overrides
-            .splice(0..0, top_cli.config_overrides.raw_overrides);
+            .prepend_root_overrides(top_cli.config_overrides);
 
         run_main(inner, arg0_paths).await?;
         Ok(())
diff --git a/codex-rs/exec/src/main_tests.rs b/codex-rs/exec/src/main_tests.rs
index a9cb0ec633..5c0a8a3bfc 100644
--- a/codex-rs/exec/src/main_tests.rs
+++ b/codex-rs/exec/src/main_tests.rs
@@ -7,6 +7,7 @@ fn top_cli_parses_resume_prompt_after_config_flag() {
     let cli = TopCli::parse_from([
         "codex-exec",
         "resume",
+        "--strict-config",
         "--last",
         "--json",
         "--model",
@@ -17,8 +18,12 @@ fn top_cli_parses_resume_prompt_after_config_flag() {
         "--skip-git-repo-check",
         PROMPT,
     ]);
+    let mut inner = cli.inner;
+    inner
+        .config_overrides
+        .prepend_root_overrides(cli.config_overrides);
 
-    let Some(codex_exec::Command::Resume(args)) = cli.inner.command else {
+    let Some(codex_exec::Command::Resume(args)) = inner.command.as_ref() else {
         panic!("expected resume command");
     };
     let effective_prompt = args.prompt.clone().or_else(|| {
@@ -29,9 +34,10 @@ fn top_cli_parses_resume_prompt_after_config_flag() {
         }
     });
     assert_eq!(effective_prompt.as_deref(), Some(PROMPT));
-    assert_eq!(cli.config_overrides.raw_overrides.len(), 1);
+    assert_eq!(inner.config_overrides.raw_overrides.len(), 1);
     assert_eq!(
-        cli.config_overrides.raw_overrides[0],
+        inner.config_overrides.raw_overrides[0],
         "reasoning_level=xhigh"
     );
+    assert!(inner.strict_config);
 }
diff --git a/codex-rs/exec/tests/event_processor_with_json_output.rs b/codex-rs/exec/tests/event_processor_with_json_output.rs
index efda58f412..acbac8254c 100644
--- a/codex-rs/exec/tests/event_processor_with_json_output.rs
+++ b/codex-rs/exec/tests/event_processor_with_json_output.rs
@@ -540,6 +540,7 @@ fn mcp_tool_call_begin_and_end_emit_item_events() {
                         arguments: json!({ "key": "value" }),
                         result: Some(McpToolCallItemResult {
                             content: Vec::new(),
+                            meta: None,
                             structured_content: None,
                         }),
                         error: None,
@@ -681,6 +682,7 @@ fn mcp_tool_call_defaults_arguments_and_preserves_structured_content() {
                                 "type": "text",
                                 "text": "done",
                             })],
+                            meta: None,
                             structured_content: Some(json!({ "status": "ok" })),
                         }),
                         error: None,
diff --git a/codex-rs/exec/tests/suite/resume.rs b/codex-rs/exec/tests/suite/resume.rs
index 2bf6416ccc..904c6a8f19 100644
--- a/codex-rs/exec/tests/suite/resume.rs
+++ b/codex-rs/exec/tests/suite/resume.rs
@@ -375,6 +375,62 @@ async fn exec_resume_accepts_global_flags_after_subcommand() -> anyhow::Result<(
     Ok(())
 }
 
+#[tokio::test(flavor = "multi_thread", worker_threads = 2)]
+async fn exec_resume_includes_output_schema_in_request() -> anyhow::Result<()> {
+    skip_if_no_network!(Ok(()));
+
+    let test = test_codex_exec();
+    let server = MockServer::start().await;
+    let response_mock = mount_exec_responses(&server, /*count*/ 2).await;
+
+    let schema_contents = serde_json::json!({
+        "type": "object",
+        "properties": {
+            "answer": { "type": "string" }
+        },
+        "required": ["answer"],
+        "additionalProperties": false
+    });
+    let schema_path = test.cwd_path().join("schema.json");
+    std::fs::write(&schema_path, serde_json::to_vec_pretty(&schema_contents)?)?;
+
+    test.cmd_with_server(&server)
+        .arg("--skip-git-repo-check")
+        .arg("echo seed-resume-session")
+        .assert()
+        .success();
+
+    test.cmd_with_server(&server)
+        .arg("--skip-git-repo-check")
+        .arg("resume")
+        .arg("--last")
+        .arg("--json")
+        .arg("--output-schema")
+        .arg(&schema_path)
+        .arg("echo resume-with-schema")
+        .assert()
+        .success();
+
+    let requests = response_mock.requests();
+    assert_eq!(requests.len(), 2);
+    let payload: Value = requests[1].body_json();
+    let text = payload.get("text").expect("request missing text field");
+    let format = text
+        .get("format")
+        .expect("request missing text.format field");
+    assert_eq!(
+        format,
+        &serde_json::json!({
+            "name": "codex_output_schema",
+            "type": "json_schema",
+            "strict": true,
+            "schema": schema_contents,
+        })
+    );
+
+    Ok(())
+}
+
 #[tokio::test(flavor = "multi_thread", worker_threads = 2)]
 async fn exec_resume_by_id_appends_to_existing_file() -> anyhow::Result<()> {
     skip_if_no_network!(Ok(()));
diff --git a/codex-rs/exec/tests/suite/sandbox.rs b/codex-rs/exec/tests/suite/sandbox.rs
index feb1a7b8c8..0a5381b1ef 100644
--- a/codex-rs/exec/tests/suite/sandbox.rs
+++ b/codex-rs/exec/tests/suite/sandbox.rs
@@ -1,6 +1,7 @@
 #![cfg(unix)]
 use codex_core::spawn::StdioPolicy;
-use codex_protocol::protocol::SandboxPolicy;
+use codex_protocol::models::PermissionProfile;
+use codex_protocol::permissions::NetworkSandboxPolicy;
 use codex_utils_absolute_path::AbsolutePathBuf;
 use codex_utils_absolute_path::test_support::PathBufExt;
 use std::collections::HashMap;
@@ -14,7 +15,7 @@ use tokio::process::Child;
 async fn spawn_command_under_sandbox(
     command: Vec<String>,
     command_cwd: AbsolutePathBuf,
-    sandbox_policy: &SandboxPolicy,
+    permission_profile: &PermissionProfile,
     sandbox_cwd: &AbsolutePathBuf,
     stdio_policy: StdioPolicy,
     env: HashMap<String, String>,
@@ -24,7 +25,6 @@ async fn spawn_command_under_sandbox(
     use codex_core::exec::build_exec_request;
     use codex_core::sandboxing::SandboxPermissions;
     use codex_protocol::config_types::WindowsSandboxLevel;
-    use codex_protocol::models::PermissionProfile;
     use std::process::Stdio;
 
     let codex_linux_sandbox_exe = None;
@@ -42,7 +42,7 @@ async fn spawn_command_under_sandbox(
             justification: None,
             arg0: None,
         },
-        &PermissionProfile::from_legacy_sandbox_policy(sandbox_policy),
+        permission_profile,
         sandbox_cwd,
         &codex_linux_sandbox_exe,
         /*use_legacy_landlock*/ false,
@@ -83,22 +83,20 @@ async fn spawn_command_under_sandbox(
 async fn spawn_command_under_sandbox(
     command: Vec<String>,
     command_cwd: AbsolutePathBuf,
-    sandbox_policy: &SandboxPolicy,
+    permission_profile: &PermissionProfile,
     sandbox_cwd: &AbsolutePathBuf,
     stdio_policy: StdioPolicy,
     env: HashMap<String, String>,
 ) -> std::io::Result<Child> {
     use codex_core::spawn_command_under_linux_sandbox;
-    use codex_protocol::models::PermissionProfile;
 
     let codex_linux_sandbox_exe = core_test_support::find_codex_linux_sandbox_exe()
         .map_err(|err| io::Error::new(io::ErrorKind::NotFound, err))?;
-    let permission_profile = PermissionProfile::from_legacy_sandbox_policy(sandbox_policy);
     spawn_command_under_linux_sandbox(
         codex_linux_sandbox_exe,
         command,
         command_cwd,
-        &permission_profile,
+        permission_profile,
         sandbox_cwd,
         /*use_legacy_landlock*/ false,
         stdio_policy,
@@ -118,9 +116,16 @@ async fn spawn_command_under_sandbox(
 async fn linux_sandbox_test_env() -> Option<HashMap<String, String>> {
     let command_cwd = AbsolutePathBuf::current_dir().ok()?;
     let sandbox_cwd = command_cwd.clone();
-    let policy = SandboxPolicy::new_read_only_policy();
+    let permission_profile = PermissionProfile::read_only();
 
-    if can_apply_linux_sandbox_policy(&policy, &command_cwd, &sandbox_cwd, HashMap::new()).await {
+    if can_apply_linux_sandbox_policy(
+        &permission_profile,
+        &command_cwd,
+        &sandbox_cwd,
+        HashMap::new(),
+    )
+    .await
+    {
         return Some(HashMap::new());
     }
 
@@ -135,7 +140,7 @@ async fn linux_sandbox_test_env() -> Option<HashMap<String, String>> {
 /// This is used as a capability probe so sandbox behavior tests only run when
 /// Landlock enforcement is actually active.
 async fn can_apply_linux_sandbox_policy(
-    policy: &SandboxPolicy,
+    permission_profile: &PermissionProfile,
     command_cwd: &AbsolutePathBuf,
     sandbox_cwd: &AbsolutePathBuf,
     env: HashMap<String, String>,
@@ -143,7 +148,7 @@ async fn can_apply_linux_sandbox_policy(
     let spawn_result = spawn_command_under_sandbox(
         vec!["/usr/bin/true".to_string()],
         command_cwd.clone(),
-        policy,
+        permission_profile,
         sandbox_cwd,
         StdioPolicy::RedirectForShellTool,
         env,
@@ -180,12 +185,12 @@ async fn python_multiprocessing_lock_works_under_sandbox() {
     #[cfg(target_os = "linux")]
     let writable_roots: Vec<AbsolutePathBuf> = vec!["/dev/shm".try_into().unwrap()];
 
-    let policy = SandboxPolicy::WorkspaceWrite {
-        writable_roots,
-        network_access: false,
-        exclude_tmpdir_env_var: false,
-        exclude_slash_tmp: false,
-    };
+    let permission_profile = PermissionProfile::workspace_write_with(
+        &writable_roots,
+        NetworkSandboxPolicy::Restricted,
+        /*exclude_tmpdir_env_var*/ true,
+        /*exclude_slash_tmp*/ true,
+    );
 
     let python_code = r#"import multiprocessing
 from multiprocessing import Lock, Process
@@ -210,7 +215,7 @@ if __name__ == '__main__':
             python_code.to_string(),
         ],
         command_cwd,
-        &policy,
+        &permission_profile,
         &sandbox_cwd,
         StdioPolicy::Inherit,
         sandbox_env,
@@ -242,7 +247,7 @@ async fn python_getpwuid_works_under_sandbox() {
         return;
     }
 
-    let policy = SandboxPolicy::new_read_only_policy();
+    let permission_profile = PermissionProfile::read_only();
     let command_cwd = AbsolutePathBuf::current_dir().expect("should be able to get current dir");
     let sandbox_cwd = command_cwd.clone();
 
@@ -253,7 +258,7 @@ async fn python_getpwuid_works_under_sandbox() {
             "import pwd, os; print(pwd.getpwuid(os.getuid()))".to_string(),
         ],
         command_cwd,
-        &policy,
+        &permission_profile,
         &sandbox_cwd,
         StdioPolicy::RedirectForShellTool,
         sandbox_env,
@@ -294,12 +299,12 @@ async fn sandbox_distinguishes_command_and_policy_cwds() {
     // Note writable_roots is empty: verify that `canonical_allowed_path` is
     // writable only because it is under the sandbox policy cwd, not because it
     // is under a writable root.
-    let policy = SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![],
-        network_access: false,
-        exclude_tmpdir_env_var: true,
-        exclude_slash_tmp: true,
-    };
+    let permission_profile = PermissionProfile::workspace_write_with(
+        &[],
+        NetworkSandboxPolicy::Restricted,
+        /*exclude_tmpdir_env_var*/ true,
+        /*exclude_slash_tmp*/ true,
+    );
 
     // Attempt to write inside the command cwd, which is outside of the sandbox policy cwd.
     let mut child = spawn_command_under_sandbox(
@@ -309,7 +314,7 @@ async fn sandbox_distinguishes_command_and_policy_cwds() {
             "echo forbidden > forbidden.txt".to_string(),
         ],
         command_root.clone(),
-        &policy,
+        &permission_profile,
         &canonical_sandbox_root,
         StdioPolicy::Inherit,
         sandbox_env.clone(),
@@ -340,7 +345,7 @@ async fn sandbox_distinguishes_command_and_policy_cwds() {
             canonical_allowed_path.to_string_lossy().into_owned(),
         ],
         command_root,
-        &policy,
+        &permission_profile,
         &canonical_sandbox_root,
         StdioPolicy::Inherit,
         sandbox_env,
@@ -375,12 +380,12 @@ async fn sandbox_blocks_first_time_dot_codex_creation() {
     create_dir_all(&repo_root).await.expect("mkdir repo");
     let dot_codex = repo_root.join(".codex");
     let config_toml = dot_codex.join("config.toml");
-    let policy = SandboxPolicy::WorkspaceWrite {
-        writable_roots: vec![],
-        network_access: false,
-        exclude_tmpdir_env_var: true,
-        exclude_slash_tmp: true,
-    };
+    let permission_profile = PermissionProfile::workspace_write_with(
+        &[],
+        NetworkSandboxPolicy::Restricted,
+        /*exclude_tmpdir_env_var*/ true,
+        /*exclude_slash_tmp*/ true,
+    );
 
     let mut child = spawn_command_under_sandbox(
         vec![
@@ -390,7 +395,7 @@ async fn sandbox_blocks_first_time_dot_codex_creation() {
                 .to_string(),
         ],
         repo_root.clone(),
-        &policy,
+        &permission_profile,
         &repo_root,
         StdioPolicy::RedirectForShellTool,
         sandbox_env,
@@ -507,7 +512,7 @@ fn unix_sock_body() {
 async fn allow_unix_socketpair_recvfrom() {
     run_code_under_sandbox(
         "allow_unix_socketpair_recvfrom",
-        &SandboxPolicy::new_read_only_policy(),
+        &PermissionProfile::read_only(),
         || async { unix_sock_body() },
     )
     .await
@@ -519,7 +524,7 @@ const IN_SANDBOX_ENV_VAR: &str = "IN_SANDBOX";
 #[expect(clippy::expect_used)]
 pub async fn run_code_under_sandbox<F, Fut>(
     test_selector: &str,
-    policy: &SandboxPolicy,
+    permission_profile: &PermissionProfile,
     child_body: F,
 ) -> io::Result<Option<ExitStatus>>
 where
@@ -544,7 +549,7 @@ where
         let mut child = spawn_command_under_sandbox(
             cmds,
             command_cwd,
-            policy,
+            permission_profile,
             &sandbox_cwd,
             stdio_policy,
             HashMap::from([("IN_SANDBOX".into(), "1".into())]),
diff --git a/codex-rs/ext/extension-api/Cargo.toml b/codex-rs/ext/extension-api/Cargo.toml
index ceecc48023..15f6e99fa0 100644
--- a/codex-rs/ext/extension-api/Cargo.toml
+++ b/codex-rs/ext/extension-api/Cargo.toml
@@ -14,5 +14,6 @@ doctest = false
 workspace = true
 
 [dependencies]
+async-trait = { workspace = true }
 codex-protocol = { workspace = true }
 codex-tools = { workspace = true }
diff --git a/codex-rs/ext/extension-api/src/capabilities/events.rs b/codex-rs/ext/extension-api/src/capabilities/events.rs
new file mode 100644
index 0000000000..d8fda1aea7
--- /dev/null
+++ b/codex-rs/ext/extension-api/src/capabilities/events.rs
@@ -0,0 +1,19 @@
+use codex_protocol::protocol::Event;
+
+/// Host-provided fire-and-forget sink for extension-generated events.
+///
+/// Extensions construct protocol events with the correlation id appropriate for
+/// the callback they are handling, then leave persistence, ordering, transport
+/// fanout, and logging decisions to the host.
+pub trait ExtensionEventSink: Send + Sync {
+    /// Queue one protocol event for host-owned delivery.
+    fn emit(&self, event: Event);
+}
+
+/// Event sink used when the host does not expose extension event emission.
+#[derive(Debug, Default, Clone, Copy)]
+pub struct NoopExtensionEventSink;
+
+impl ExtensionEventSink for NoopExtensionEventSink {
+    fn emit(&self, _event: Event) {}
+}
diff --git a/codex-rs/ext/extension-api/src/capabilities/mod.rs b/codex-rs/ext/extension-api/src/capabilities/mod.rs
index bcc33da975..cd23146542 100644
--- a/codex-rs/ext/extension-api/src/capabilities/mod.rs
+++ b/codex-rs/ext/extension-api/src/capabilities/mod.rs
@@ -1,4 +1,7 @@
 mod agent;
+mod events;
 
 pub use agent::AgentSpawnFuture;
 pub use agent::AgentSpawner;
+pub use events::ExtensionEventSink;
+pub use events::NoopExtensionEventSink;
diff --git a/codex-rs/ext/extension-api/src/contributors.rs b/codex-rs/ext/extension-api/src/contributors.rs
index f3d1375ac8..8968e08573 100644
--- a/codex-rs/ext/extension-api/src/contributors.rs
+++ b/codex-rs/ext/extension-api/src/contributors.rs
@@ -4,12 +4,14 @@ use std::sync::Arc;
 use codex_protocol::items::TurnItem;
 use codex_protocol::protocol::ReviewDecision;
 use codex_protocol::protocol::TokenUsageInfo;
+use codex_tools::ToolCall;
+use codex_tools::ToolExecutor;
 
 use crate::ExtensionData;
 
 mod prompt;
 mod thread_lifecycle;
-mod tools;
+mod tool_lifecycle;
 mod turn_lifecycle;
 
 pub use prompt::PromptFragment;
@@ -17,9 +19,11 @@ pub use prompt::PromptSlot;
 pub use thread_lifecycle::ThreadResumeInput;
 pub use thread_lifecycle::ThreadStartInput;
 pub use thread_lifecycle::ThreadStopInput;
-pub use tools::ExtensionToolExecutor;
-pub use tools::ExtensionToolFuture;
-pub use tools::ExtensionToolOutput;
+pub use tool_lifecycle::ToolCallOutcome;
+pub use tool_lifecycle::ToolCallSource;
+pub use tool_lifecycle::ToolFinishInput;
+pub use tool_lifecycle::ToolLifecycleFuture;
+pub use tool_lifecycle::ToolStartInput;
 pub use turn_lifecycle::TurnAbortInput;
 pub use turn_lifecycle::TurnStartInput;
 pub use turn_lifecycle::TurnStopInput;
@@ -38,16 +42,17 @@ pub trait ContextContributor: Send + Sync {
 /// Implementations should use these callbacks to seed, rehydrate, or flush
 /// extension-private thread state. Heavy dependencies belong on the extension
 /// value created by the host, not in these inputs.
-pub trait ThreadLifecycleContributor<C>: Send + Sync {
+#[async_trait::async_trait]
+pub trait ThreadLifecycleContributor<C: Sync>: Send + Sync {
     /// Called after thread-scoped extension stores are created, before later
     /// contributors can read from them.
-    fn on_thread_start(&self, _input: ThreadStartInput<'_, C>) {}
+    async fn on_thread_start(&self, _input: ThreadStartInput<'_, C>) {}
 
     /// Called after the host constructs a runtime from persisted history.
-    fn on_thread_resume(&self, _input: ThreadResumeInput<'_>) {}
+    async fn on_thread_resume(&self, _input: ThreadResumeInput<'_>) {}
 
     /// Called before the host drops the thread runtime and thread-scoped store.
-    fn on_thread_stop(&self, _input: ThreadStopInput<'_>) {}
+    async fn on_thread_stop(&self, _input: ThreadStopInput<'_>) {}
 }
 
 /// Contributor for host-owned turn lifecycle gates.
@@ -55,16 +60,17 @@ pub trait ThreadLifecycleContributor<C>: Send + Sync {
 /// Implementations should use these callbacks to seed, observe, or clear
 /// extension-private turn state. The host exposes stable identifiers and
 /// extension stores instead of core runtime objects.
+#[async_trait::async_trait]
 pub trait TurnLifecycleContributor: Send + Sync {
     /// Called after turn-scoped extension stores are created, before the task
     /// for the turn starts running.
-    fn on_turn_start(&self, _input: TurnStartInput<'_>) {}
+    async fn on_turn_start(&self, _input: TurnStartInput<'_>) {}
 
     /// Called before the host drops the completed turn runtime and turn store.
-    fn on_turn_stop(&self, _input: TurnStopInput<'_>) {}
+    async fn on_turn_stop(&self, _input: TurnStopInput<'_>) {}
 
     /// Called after the host aborts a running turn.
-    fn on_turn_abort(&self, _input: TurnAbortInput<'_>) {}
+    async fn on_turn_abort(&self, _input: TurnAbortInput<'_>) {}
 }
 
 /// Contributor for host-owned configuration changes.
@@ -88,9 +94,10 @@ pub trait ConfigContributor<C>: Send + Sync {
 /// Implementations should keep this callback cheap. The host calls it after
 /// updating cached token usage and before emitting the corresponding client
 /// token-count notification.
+#[async_trait::async_trait]
 pub trait TokenUsageContributor: Send + Sync {
     /// Called each time the host records token usage from a model response.
-    fn on_token_usage(
+    async fn on_token_usage(
         &self,
         _session_store: &ExtensionData,
         _thread_store: &ExtensionData,
@@ -107,7 +114,24 @@ pub trait ToolContributor: Send + Sync {
         &self,
         session_store: &ExtensionData,
         thread_store: &ExtensionData,
-    ) -> Vec<Arc<dyn ExtensionToolExecutor>>;
+    ) -> Vec<Arc<dyn ToolExecutor<ToolCall>>>;
+}
+
+/// Contributor for host-owned tool lifecycle gates.
+///
+/// Implementations should use these callbacks to observe tool execution without
+/// inspecting or rewriting tool input/output. Use `ToolContributor` for owning a
+/// tool implementation and hooks for policy that needs tool payloads.
+pub trait ToolLifecycleContributor: Send + Sync {
+    /// Called once the host has accepted a tool call for execution.
+    fn on_tool_start<'a>(&'a self, _input: ToolStartInput<'a>) -> ToolLifecycleFuture<'a> {
+        Box::pin(std::future::ready(()))
+    }
+
+    /// Called after the tool call returns, is blocked, fails, or is cancelled.
+    fn on_tool_finish<'a>(&'a self, _input: ToolFinishInput<'a>) -> ToolLifecycleFuture<'a> {
+        Box::pin(std::future::ready(()))
+    }
 }
 
 /// Future returned by one claimed approval-review contribution.
diff --git a/codex-rs/ext/extension-api/src/contributors/tool_lifecycle.rs b/codex-rs/ext/extension-api/src/contributors/tool_lifecycle.rs
new file mode 100644
index 0000000000..486bca2643
--- /dev/null
+++ b/codex-rs/ext/extension-api/src/contributors/tool_lifecycle.rs
@@ -0,0 +1,82 @@
+use std::future::Future;
+use std::pin::Pin;
+
+use codex_tools::ToolName;
+
+use crate::ExtensionData;
+
+/// Future returned by one tool-lifecycle callback.
+pub type ToolLifecycleFuture<'a> = Pin<Box<dyn Future<Output = ()> + Send + 'a>>;
+
+/// Host-visible source for a model tool call.
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub enum ToolCallSource {
+    /// The model invoked the tool directly.
+    Direct,
+    /// Code mode invoked the tool while executing a runtime cell.
+    CodeMode {
+        /// Runtime cell that issued the nested tool request.
+        cell_id: String,
+        /// Code-mode's per-cell tool invocation id.
+        runtime_tool_call_id: String,
+    },
+}
+
+/// Extension-facing outcome for a finished tool call.
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum ToolCallOutcome {
+    /// The tool returned a normal output.
+    Completed {
+        /// The tool output's own success marker for telemetry/logging.
+        success: bool,
+    },
+    /// The tool was blocked by host policy before the handler ran.
+    Blocked,
+    /// The tool did not produce a normal output.
+    Failed {
+        /// Whether the host reached the tool handler before the failure.
+        handler_executed: bool,
+    },
+    /// The host cancelled the tool before normal completion. Cancellation can
+    /// win before the dispatch path accepts the call, so contributors should not
+    /// assume a matching start callback exists.
+    Aborted,
+}
+
+/// Input supplied when the host starts executing one tool call.
+pub struct ToolStartInput<'a> {
+    /// Store scoped to the host session runtime.
+    pub session_store: &'a ExtensionData,
+    /// Store scoped to this thread runtime.
+    pub thread_store: &'a ExtensionData,
+    /// Store scoped to this turn runtime.
+    pub turn_store: &'a ExtensionData,
+    /// Current turn submission id.
+    pub turn_id: &'a str,
+    /// Model-visible tool call id.
+    pub call_id: &'a str,
+    /// Tool name as routed by the host.
+    pub tool_name: &'a ToolName,
+    /// Source that issued the tool call.
+    pub source: ToolCallSource,
+}
+
+/// Input supplied when the host finishes executing one tool call.
+pub struct ToolFinishInput<'a> {
+    /// Store scoped to the host session runtime.
+    pub session_store: &'a ExtensionData,
+    /// Store scoped to this thread runtime.
+    pub thread_store: &'a ExtensionData,
+    /// Store scoped to this turn runtime.
+    pub turn_store: &'a ExtensionData,
+    /// Current turn submission id.
+    pub turn_id: &'a str,
+    /// Model-visible tool call id.
+    pub call_id: &'a str,
+    /// Tool name as routed by the host.
+    pub tool_name: &'a ToolName,
+    /// Source that issued the tool call.
+    pub source: ToolCallSource,
+    /// Host-observed result of the tool call.
+    pub outcome: ToolCallOutcome,
+}
diff --git a/codex-rs/ext/extension-api/src/contributors/tools.rs b/codex-rs/ext/extension-api/src/contributors/tools.rs
deleted file mode 100644
index 41d08986e9..0000000000
--- a/codex-rs/ext/extension-api/src/contributors/tools.rs
+++ /dev/null
@@ -1,32 +0,0 @@
-use std::future::Future;
-use std::pin::Pin;
-
-use codex_tools::FunctionCallError;
-use codex_tools::JsonToolOutput;
-use codex_tools::ToolCall;
-use codex_tools::ToolName;
-use codex_tools::ToolSpec;
-
-/// Model-facing output returned by extension-owned tools.
-pub type ExtensionToolOutput = JsonToolOutput;
-
-/// Future returned by extension-owned tool execution.
-pub type ExtensionToolFuture<'a> =
-    Pin<Box<dyn Future<Output = Result<ExtensionToolOutput, FunctionCallError>> + Send + 'a>>;
-
-/// Object-safe runtime contract for extension-owned model-visible tools.
-///
-/// Implementations keep an extension tool's model-visible spec attached to the
-/// executable runtime that handles calls for that tool.
-pub trait ExtensionToolExecutor: Send + Sync {
-    /// The concrete tool name handled by this extension runtime.
-    fn tool_name(&self) -> ToolName;
-
-    /// The model-visible spec for this extension tool.
-    fn spec(&self) -> Option<ToolSpec> {
-        None
-    }
-
-    /// Execute one extension tool invocation.
-    fn handle(&self, call: ToolCall) -> ExtensionToolFuture<'_>;
-}
diff --git a/codex-rs/ext/extension-api/src/lib.rs b/codex-rs/ext/extension-api/src/lib.rs
index ccfa2520e4..373f3735a4 100644
--- a/codex-rs/ext/extension-api/src/lib.rs
+++ b/codex-rs/ext/extension-api/src/lib.rs
@@ -5,11 +5,15 @@ mod state;
 
 pub use capabilities::AgentSpawnFuture;
 pub use capabilities::AgentSpawner;
+pub use capabilities::ExtensionEventSink;
+pub use capabilities::NoopExtensionEventSink;
 pub use codex_tools::FunctionCallError;
 pub use codex_tools::JsonToolOutput;
 pub use codex_tools::ResponsesApiTool;
 pub use codex_tools::ToolCall;
+pub use codex_tools::ToolExecutor;
 pub use codex_tools::ToolName;
+pub use codex_tools::ToolOutput;
 pub use codex_tools::ToolPayload;
 pub use codex_tools::ToolSpec;
 pub use codex_tools::parse_tool_input_schema;
@@ -17,9 +21,6 @@ pub use contributors::ApprovalReviewContributor;
 pub use contributors::ApprovalReviewFuture;
 pub use contributors::ConfigContributor;
 pub use contributors::ContextContributor;
-pub use contributors::ExtensionToolExecutor;
-pub use contributors::ExtensionToolFuture;
-pub use contributors::ExtensionToolOutput;
 pub use contributors::PromptFragment;
 pub use contributors::PromptSlot;
 pub use contributors::ThreadLifecycleContributor;
@@ -27,7 +28,13 @@ pub use contributors::ThreadResumeInput;
 pub use contributors::ThreadStartInput;
 pub use contributors::ThreadStopInput;
 pub use contributors::TokenUsageContributor;
+pub use contributors::ToolCallOutcome;
+pub use contributors::ToolCallSource;
 pub use contributors::ToolContributor;
+pub use contributors::ToolFinishInput;
+pub use contributors::ToolLifecycleContributor;
+pub use contributors::ToolLifecycleFuture;
+pub use contributors::ToolStartInput;
 pub use contributors::TurnAbortInput;
 pub use contributors::TurnItemContributionFuture;
 pub use contributors::TurnItemContributor;
diff --git a/codex-rs/ext/extension-api/src/registry.rs b/codex-rs/ext/extension-api/src/registry.rs
index 8193f5c1d1..4577ddc048 100644
--- a/codex-rs/ext/extension-api/src/registry.rs
+++ b/codex-rs/ext/extension-api/src/registry.rs
@@ -5,27 +5,33 @@ use crate::ApprovalReviewFuture;
 use crate::ConfigContributor;
 use crate::ContextContributor;
 use crate::ExtensionData;
+use crate::ExtensionEventSink;
+use crate::NoopExtensionEventSink;
 use crate::ThreadLifecycleContributor;
 use crate::TokenUsageContributor;
 use crate::ToolContributor;
+use crate::ToolLifecycleContributor;
 use crate::TurnItemContributor;
 use crate::TurnLifecycleContributor;
 
 /// Mutable registry used while hosts register typed runtime contributions.
-pub struct ExtensionRegistryBuilder<C> {
+pub struct ExtensionRegistryBuilder<C: Sync> {
+    event_sink: Arc<dyn ExtensionEventSink>,
     thread_lifecycle_contributors: Vec<Arc<dyn ThreadLifecycleContributor<C>>>,
     turn_lifecycle_contributors: Vec<Arc<dyn TurnLifecycleContributor>>,
     config_contributors: Vec<Arc<dyn ConfigContributor<C>>>,
     token_usage_contributors: Vec<Arc<dyn TokenUsageContributor>>,
     context_contributors: Vec<Arc<dyn ContextContributor>>,
     tool_contributors: Vec<Arc<dyn ToolContributor>>,
+    tool_lifecycle_contributors: Vec<Arc<dyn ToolLifecycleContributor>>,
     turn_item_contributors: Vec<Arc<dyn TurnItemContributor>>,
     approval_review_contributors: Vec<Arc<dyn ApprovalReviewContributor>>,
 }
 
-impl<C> Default for ExtensionRegistryBuilder<C> {
+impl<C: Sync> Default for ExtensionRegistryBuilder<C> {
     fn default() -> Self {
         Self {
+            event_sink: Arc::new(NoopExtensionEventSink),
             thread_lifecycle_contributors: Vec::new(),
             turn_lifecycle_contributors: Vec::new(),
             config_contributors: Vec::new(),
@@ -33,17 +39,31 @@ impl<C> Default for ExtensionRegistryBuilder<C> {
             approval_review_contributors: Vec::new(),
             context_contributors: Vec::new(),
             tool_contributors: Vec::new(),
+            tool_lifecycle_contributors: Vec::new(),
             turn_item_contributors: Vec::new(),
         }
     }
 }
 
-impl<C> ExtensionRegistryBuilder<C> {
+impl<C: Sync> ExtensionRegistryBuilder<C> {
     /// Creates an empty registry builder.
     pub fn new() -> Self {
         Self::default()
     }
 
+    /// Creates an empty registry builder with a host-provided event sink.
+    pub fn with_event_sink(event_sink: Arc<dyn ExtensionEventSink>) -> Self {
+        Self {
+            event_sink,
+            ..Self::default()
+        }
+    }
+
+    /// Returns the host event sink to pass into extension constructors.
+    pub fn event_sink(&self) -> Arc<dyn ExtensionEventSink> {
+        Arc::clone(&self.event_sink)
+    }
+
     /// Registers one approval-review contributor.
     pub fn approval_review_contributor(&mut self, contributor: Arc<dyn ApprovalReviewContributor>) {
         self.approval_review_contributors.push(contributor);
@@ -82,6 +102,11 @@ impl<C> ExtensionRegistryBuilder<C> {
         self.tool_contributors.push(contributor);
     }
 
+    /// Registers one tool-lifecycle contributor.
+    pub fn tool_lifecycle_contributor(&mut self, contributor: Arc<dyn ToolLifecycleContributor>) {
+        self.tool_lifecycle_contributors.push(contributor);
+    }
+
     /// Registers one ordered turn-item contributor.
     pub fn turn_item_contributor(&mut self, contributor: Arc<dyn TurnItemContributor>) {
         self.turn_item_contributors.push(contributor);
@@ -90,6 +115,7 @@ impl<C> ExtensionRegistryBuilder<C> {
     /// Finishes construction and returns the immutable registry.
     pub fn build(self) -> ExtensionRegistry<C> {
         ExtensionRegistry {
+            event_sink: self.event_sink,
             thread_lifecycle_contributors: self.thread_lifecycle_contributors,
             turn_lifecycle_contributors: self.turn_lifecycle_contributors,
             config_contributors: self.config_contributors,
@@ -97,24 +123,32 @@ impl<C> ExtensionRegistryBuilder<C> {
             approval_review_contributors: self.approval_review_contributors,
             context_contributors: self.context_contributors,
             tool_contributors: self.tool_contributors,
+            tool_lifecycle_contributors: self.tool_lifecycle_contributors,
             turn_item_contributors: self.turn_item_contributors,
         }
     }
 }
 
 /// Immutable typed registry produced after extensions are installed.
-pub struct ExtensionRegistry<C> {
+pub struct ExtensionRegistry<C: Sync> {
+    event_sink: Arc<dyn ExtensionEventSink>,
     thread_lifecycle_contributors: Vec<Arc<dyn ThreadLifecycleContributor<C>>>,
     turn_lifecycle_contributors: Vec<Arc<dyn TurnLifecycleContributor>>,
     config_contributors: Vec<Arc<dyn ConfigContributor<C>>>,
     token_usage_contributors: Vec<Arc<dyn TokenUsageContributor>>,
     context_contributors: Vec<Arc<dyn ContextContributor>>,
     tool_contributors: Vec<Arc<dyn ToolContributor>>,
+    tool_lifecycle_contributors: Vec<Arc<dyn ToolLifecycleContributor>>,
     turn_item_contributors: Vec<Arc<dyn TurnItemContributor>>,
     approval_review_contributors: Vec<Arc<dyn ApprovalReviewContributor>>,
 }
 
-impl<C> ExtensionRegistry<C> {
+impl<C: Sync> ExtensionRegistry<C> {
+    /// Returns the host event sink retained by this registry.
+    pub fn event_sink(&self) -> Arc<dyn ExtensionEventSink> {
+        Arc::clone(&self.event_sink)
+    }
+
     /// Returns the registered thread-lifecycle contributors.
     pub fn thread_lifecycle_contributors(&self) -> &[Arc<dyn ThreadLifecycleContributor<C>>] {
         &self.thread_lifecycle_contributors
@@ -158,6 +192,11 @@ impl<C> ExtensionRegistry<C> {
         &self.tool_contributors
     }
 
+    /// Returns the registered tool-lifecycle contributors.
+    pub fn tool_lifecycle_contributors(&self) -> &[Arc<dyn ToolLifecycleContributor>] {
+        &self.tool_lifecycle_contributors
+    }
+
     /// Returns the registered ordered turn-item contributors.
     pub fn turn_item_contributors(&self) -> &[Arc<dyn TurnItemContributor>] {
         &self.turn_item_contributors
@@ -165,6 +204,6 @@ impl<C> ExtensionRegistry<C> {
 }
 
 /// Creates an empty shared registry for hosts that do not register contributions.
-pub fn empty_extension_registry<C>() -> Arc<ExtensionRegistry<C>> {
+pub fn empty_extension_registry<C: Sync>() -> Arc<ExtensionRegistry<C>> {
     Arc::new(ExtensionRegistryBuilder::new().build())
 }
diff --git a/codex-rs/ext/git-attribution/BUILD.bazel b/codex-rs/ext/git-attribution/BUILD.bazel
deleted file mode 100644
index 0cb1ab5764..0000000000
--- a/codex-rs/ext/git-attribution/BUILD.bazel
+++ /dev/null
@@ -1,6 +0,0 @@
-load("//:defs.bzl", "codex_rust_crate")
-
-codex_rust_crate(
-    name = "git-attribution",
-    crate_name = "codex_git_attribution",
-)
diff --git a/codex-rs/ext/git-attribution/Cargo.toml b/codex-rs/ext/git-attribution/Cargo.toml
deleted file mode 100644
index edf8c07196..0000000000
--- a/codex-rs/ext/git-attribution/Cargo.toml
+++ /dev/null
@@ -1,21 +0,0 @@
-[package]
-edition.workspace = true
-license.workspace = true
-name = "codex-git-attribution"
-version.workspace = true
-
-[lib]
-name = "codex_git_attribution"
-path = "src/lib.rs"
-doctest = false
-
-[lints]
-workspace = true
-
-[dependencies]
-codex-core = { workspace = true }
-codex-extension-api = { workspace = true }
-codex-features = { workspace = true }
-
-[dev-dependencies]
-pretty_assertions = { workspace = true }
diff --git a/codex-rs/ext/git-attribution/src/lib.rs b/codex-rs/ext/git-attribution/src/lib.rs
deleted file mode 100644
index 03655296da..0000000000
--- a/codex-rs/ext/git-attribution/src/lib.rs
+++ /dev/null
@@ -1,134 +0,0 @@
-use std::sync::Arc;
-
-use codex_core::config::Config;
-use codex_extension_api::ContextContributor;
-use codex_extension_api::ExtensionData;
-use codex_extension_api::ExtensionRegistryBuilder;
-use codex_extension_api::PromptFragment;
-use codex_extension_api::ThreadLifecycleContributor;
-use codex_extension_api::ThreadStartInput;
-use codex_features::Feature;
-
-const DEFAULT_ATTRIBUTION_VALUE: &str = "Codex <noreply@openai.com>";
-
-/// Contributes the configured git-attribution instruction.
-#[derive(Clone, Copy, Debug, Default)]
-pub struct GitAttributionExtension;
-
-impl ContextContributor for GitAttributionExtension {
-    fn contribute<'a>(
-        &'a self,
-        _session_store: &'a ExtensionData,
-        thread_store: &'a ExtensionData,
-    ) -> std::pin::Pin<Box<dyn std::future::Future<Output = Vec<PromptFragment>> + Send + 'a>> {
-        Box::pin(async move {
-            let Some(config_store) = thread_store.get::<GitAttributionConfig>() else {
-                return Vec::new();
-            };
-            if !config_store.enabled {
-                return Vec::new();
-            }
-            build_instruction(config_store.prompt.as_deref())
-                .map(PromptFragment::developer_policy)
-                .into_iter()
-                .collect()
-        })
-    }
-}
-
-#[derive(Clone, Debug, Default)]
-struct GitAttributionConfig {
-    enabled: bool,
-    prompt: Option<String>,
-}
-
-impl ThreadLifecycleContributor<Config> for GitAttributionExtension {
-    fn on_thread_start(&self, input: ThreadStartInput<'_, Config>) {
-        input.thread_store.insert(GitAttributionConfig {
-            enabled: input.config.features.enabled(Feature::CodexGitCommit),
-            prompt: input.config.commit_attribution.clone(),
-        });
-    }
-}
-
-/// Installs the git-attribution contributors into the extension registry.
-pub fn install(registry: &mut ExtensionRegistryBuilder<Config>) {
-    let extension = Arc::new(GitAttributionExtension);
-    registry.thread_lifecycle_contributor(extension.clone());
-    registry.prompt_contributor(extension);
-}
-
-fn build_commit_message_trailer(config_attribution: Option<&str>) -> Option<String> {
-    let value = resolve_attribution_value(config_attribution)?;
-    Some(format!("Co-authored-by: {value}"))
-}
-
-fn build_instruction(config_attribution: Option<&str>) -> Option<String> {
-    let trailer = build_commit_message_trailer(config_attribution)?;
-    Some(format!(
-        "When you write or edit a git commit message, ensure the message ends with this trailer exactly once:\n{trailer}\n\nRules:\n- Keep existing trailers and append this trailer at the end if missing.\n- Do not duplicate this trailer if it already exists.\n- Keep one blank line between the commit body and trailer block."
-    ))
-}
-
-fn resolve_attribution_value(config_attribution: Option<&str>) -> Option<String> {
-    match config_attribution {
-        Some(value) => {
-            let trimmed = value.trim();
-            if trimmed.is_empty() {
-                None
-            } else {
-                Some(trimmed.to_string())
-            }
-        }
-        None => Some(DEFAULT_ATTRIBUTION_VALUE.to_string()),
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use pretty_assertions::assert_eq;
-
-    use super::build_commit_message_trailer;
-    use super::build_instruction;
-    use super::resolve_attribution_value;
-
-    #[test]
-    fn blank_attribution_disables_trailer_prompt() {
-        assert_eq!(build_commit_message_trailer(Some("")), None);
-        assert_eq!(build_instruction(Some("   ")), None);
-    }
-
-    #[test]
-    fn default_attribution_uses_codex_trailer() {
-        assert_eq!(
-            build_commit_message_trailer(/*config_attribution*/ None).as_deref(),
-            Some("Co-authored-by: Codex <noreply@openai.com>")
-        );
-    }
-
-    #[test]
-    fn resolve_value_handles_default_custom_and_blank() {
-        assert_eq!(
-            resolve_attribution_value(/*config_attribution*/ None),
-            Some("Codex <noreply@openai.com>".to_string())
-        );
-        assert_eq!(
-            resolve_attribution_value(Some("MyAgent <me@example.com>")),
-            Some("MyAgent <me@example.com>".to_string())
-        );
-        assert_eq!(
-            resolve_attribution_value(Some("MyAgent")),
-            Some("MyAgent".to_string())
-        );
-        assert_eq!(resolve_attribution_value(Some("   ")), None);
-    }
-
-    #[test]
-    fn instruction_mentions_trailer_and_omits_generated_with() {
-        let instruction =
-            build_instruction(Some("AgentX <agent@example.com>")).expect("instruction expected");
-        assert!(instruction.contains("Co-authored-by: AgentX <agent@example.com>"));
-        assert!(instruction.contains("exactly once"));
-        assert!(!instruction.contains("Generated-with"));
-    }
-}
diff --git a/codex-rs/ext/goal/BUILD.bazel b/codex-rs/ext/goal/BUILD.bazel
new file mode 100644
index 0000000000..037313da37
--- /dev/null
+++ b/codex-rs/ext/goal/BUILD.bazel
@@ -0,0 +1,6 @@
+load("//:defs.bzl", "codex_rust_crate")
+
+codex_rust_crate(
+    name = "goal",
+    crate_name = "codex_goal_extension",
+)
diff --git a/codex-rs/ext/goal/Cargo.toml b/codex-rs/ext/goal/Cargo.toml
new file mode 100644
index 0000000000..7f8b9bd308
--- /dev/null
+++ b/codex-rs/ext/goal/Cargo.toml
@@ -0,0 +1,22 @@
+[package]
+edition.workspace = true
+license.workspace = true
+name = "codex-goal-extension"
+version.workspace = true
+
+[lib]
+name = "codex_goal_extension"
+path = "src/lib.rs"
+test = false
+doctest = false
+
+[lints]
+workspace = true
+
+[dependencies]
+async-trait = { workspace = true }
+codex-extension-api = { workspace = true }
+codex-protocol = { workspace = true }
+codex-tools = { workspace = true }
+serde = { workspace = true, features = ["derive"] }
+serde_json = { workspace = true }
diff --git a/codex-rs/ext/goal/src/accounting.rs b/codex-rs/ext/goal/src/accounting.rs
new file mode 100644
index 0000000000..712e325849
--- /dev/null
+++ b/codex-rs/ext/goal/src/accounting.rs
@@ -0,0 +1,73 @@
+use codex_protocol::protocol::TokenUsage;
+use std::collections::HashMap;
+use std::sync::Mutex;
+use std::sync::PoisonError;
+
+#[derive(Debug, Default)]
+pub(crate) struct GoalAccountingState {
+    inner: Mutex<GoalAccountingInner>,
+}
+
+#[derive(Debug, Default)]
+struct GoalAccountingInner {
+    turns: HashMap<String, GoalTurnAccounting>,
+    unflushed_token_delta: i64,
+}
+
+#[derive(Debug, Default)]
+struct GoalTurnAccounting {
+    token_delta: i64,
+    stopped: bool,
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub(crate) struct RecordedTokenDelta {
+    pub(crate) turn_delta: i64,
+    pub(crate) thread_unflushed_delta: i64,
+}
+
+impl GoalAccountingState {
+    pub(crate) fn start_turn(&self, turn_id: impl Into<String>) {
+        let turn_id = turn_id.into();
+        self.inner().turns.entry(turn_id).or_default().stopped = false;
+    }
+
+    pub(crate) fn record_token_usage(
+        &self,
+        turn_id: impl Into<String>,
+        usage: &TokenUsage,
+    ) -> Option<RecordedTokenDelta> {
+        let delta = goal_token_delta_for_usage(usage);
+        if delta <= 0 {
+            return None;
+        }
+
+        let turn_id = turn_id.into();
+        let mut inner = self.inner();
+        let turn = inner.turns.entry(turn_id).or_default();
+        turn.token_delta = turn.token_delta.saturating_add(delta);
+        let turn_delta = turn.token_delta;
+        inner.unflushed_token_delta = inner.unflushed_token_delta.saturating_add(delta);
+        Some(RecordedTokenDelta {
+            turn_delta,
+            thread_unflushed_delta: inner.unflushed_token_delta,
+        })
+    }
+
+    pub(crate) fn stop_turn(&self, turn_id: &str) {
+        if let Some(turn) = self.inner().turns.get_mut(turn_id) {
+            turn.stopped = true;
+        }
+    }
+
+    fn inner(&self) -> std::sync::MutexGuard<'_, GoalAccountingInner> {
+        self.inner.lock().unwrap_or_else(PoisonError::into_inner)
+    }
+}
+
+pub(crate) fn goal_token_delta_for_usage(usage: &TokenUsage) -> i64 {
+    usage
+        .input_tokens
+        .saturating_sub(usage.cached_input_tokens)
+        .saturating_add(usage.output_tokens.max(0))
+}
diff --git a/codex-rs/ext/goal/src/events.rs b/codex-rs/ext/goal/src/events.rs
new file mode 100644
index 0000000000..ab9eda4056
--- /dev/null
+++ b/codex-rs/ext/goal/src/events.rs
@@ -0,0 +1,34 @@
+use std::sync::Arc;
+
+use codex_extension_api::ExtensionEventSink;
+use codex_protocol::protocol::Event;
+use codex_protocol::protocol::EventMsg;
+use codex_protocol::protocol::ThreadGoal;
+use codex_protocol::protocol::ThreadGoalUpdatedEvent;
+
+#[derive(Clone)]
+pub(crate) struct GoalEventEmitter {
+    sink: Arc<dyn ExtensionEventSink>,
+}
+
+impl GoalEventEmitter {
+    pub(crate) fn new(sink: Arc<dyn ExtensionEventSink>) -> Self {
+        Self { sink }
+    }
+
+    pub(crate) fn thread_goal_updated(
+        &self,
+        event_id: impl Into<String>,
+        turn_id: Option<String>,
+        goal: ThreadGoal,
+    ) {
+        self.sink.emit(Event {
+            id: event_id.into(),
+            msg: EventMsg::ThreadGoalUpdated(ThreadGoalUpdatedEvent {
+                thread_id: goal.thread_id,
+                turn_id,
+                goal,
+            }),
+        });
+    }
+}
diff --git a/codex-rs/ext/goal/src/extension.rs b/codex-rs/ext/goal/src/extension.rs
new file mode 100644
index 0000000000..a8d4f5c289
--- /dev/null
+++ b/codex-rs/ext/goal/src/extension.rs
@@ -0,0 +1,341 @@
+use std::sync::Arc;
+
+use async_trait::async_trait;
+use codex_extension_api::ConfigContributor;
+use codex_extension_api::ExtensionData;
+use codex_extension_api::ExtensionEventSink;
+use codex_extension_api::ExtensionRegistryBuilder;
+use codex_extension_api::NoopExtensionEventSink;
+use codex_extension_api::ThreadLifecycleContributor;
+use codex_extension_api::ThreadStartInput;
+use codex_extension_api::TokenUsageContributor;
+use codex_extension_api::ToolCallOutcome;
+use codex_extension_api::ToolContributor;
+use codex_extension_api::ToolFinishInput;
+use codex_extension_api::ToolLifecycleContributor;
+use codex_extension_api::ToolLifecycleFuture;
+use codex_extension_api::TurnAbortInput;
+use codex_extension_api::TurnLifecycleContributor;
+use codex_extension_api::TurnStartInput;
+use codex_extension_api::TurnStopInput;
+use codex_protocol::ThreadId;
+use codex_protocol::protocol::ThreadGoal;
+use codex_protocol::protocol::TokenUsageInfo;
+use codex_protocol::protocol::TurnAbortReason;
+
+use crate::accounting::GoalAccountingState;
+use crate::events::GoalEventEmitter;
+use crate::spec::UPDATE_GOAL_TOOL_NAME;
+use crate::tool::CreateGoalRequest;
+use crate::tool::GoalToolExecutor;
+
+#[derive(Clone, Debug)]
+pub struct GoalExtensionConfig {
+    pub enabled: bool,
+}
+
+impl GoalExtensionConfig {
+    fn from_enabled(enabled: bool) -> Self {
+        Self { enabled }
+    }
+}
+
+#[derive(Clone)]
+pub struct GoalExtension<C> {
+    backend: Arc<dyn GoalToolBackend>,
+    event_emitter: GoalEventEmitter,
+    goals_enabled: Arc<dyn Fn(&C) -> bool + Send + Sync>,
+}
+
+impl<C> std::fmt::Debug for GoalExtension<C> {
+    fn fmt(&self, f: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        f.debug_struct("GoalExtension").finish_non_exhaustive()
+    }
+}
+
+impl<C> GoalExtension<C> {
+    pub fn new(
+        backend: Arc<dyn GoalToolBackend>,
+        goals_enabled: impl Fn(&C) -> bool + Send + Sync + 'static,
+    ) -> Self {
+        Self::new_with_event_sink(backend, Arc::new(NoopExtensionEventSink), goals_enabled)
+    }
+
+    pub fn new_with_event_sink(
+        backend: Arc<dyn GoalToolBackend>,
+        event_sink: Arc<dyn ExtensionEventSink>,
+        goals_enabled: impl Fn(&C) -> bool + Send + Sync + 'static,
+    ) -> Self {
+        Self {
+            backend,
+            event_emitter: GoalEventEmitter::new(event_sink),
+            goals_enabled: Arc::new(goals_enabled),
+        }
+    }
+
+    pub fn without_backend(goals_enabled: impl Fn(&C) -> bool + Send + Sync + 'static) -> Self {
+        Self::new(Arc::new(NoGoalToolBackend), goals_enabled)
+    }
+}
+
+#[async_trait]
+pub trait GoalToolBackend: Send + Sync {
+    async fn get_goal(&self, thread_id: ThreadId) -> Result<Option<ThreadGoal>, String>;
+
+    async fn create_goal(
+        &self,
+        thread_id: ThreadId,
+        request: CreateGoalRequest,
+    ) -> Result<ThreadGoal, String>;
+
+    async fn complete_goal(&self, thread_id: ThreadId) -> Result<ThreadGoal, String>;
+}
+
+#[derive(Clone, Copy, Debug, Default)]
+pub struct NoGoalToolBackend;
+
+#[async_trait]
+impl GoalToolBackend for NoGoalToolBackend {
+    async fn get_goal(&self, _thread_id: ThreadId) -> Result<Option<ThreadGoal>, String> {
+        Err(missing_backend_message())
+    }
+
+    async fn create_goal(
+        &self,
+        _thread_id: ThreadId,
+        _request: CreateGoalRequest,
+    ) -> Result<ThreadGoal, String> {
+        Err(missing_backend_message())
+    }
+
+    async fn complete_goal(&self, _thread_id: ThreadId) -> Result<ThreadGoal, String> {
+        Err(missing_backend_message())
+    }
+}
+
+fn missing_backend_message() -> String {
+    // TODO: replace this fallback with a host-provided goal backend once
+    // ToolContributor invocations can reach thread-scoped goal persistence and
+    // the current turn context.
+    "goal tools are not connected to host goal persistence yet".to_string()
+}
+
+#[async_trait]
+impl<C> ThreadLifecycleContributor<C> for GoalExtension<C>
+where
+    C: Send + Sync + 'static,
+{
+    async fn on_thread_start(&self, input: ThreadStartInput<'_, C>) {
+        input
+            .thread_store
+            .insert(GoalExtensionConfig::from_enabled((self.goals_enabled)(
+                input.config,
+            )));
+        input
+            .thread_store
+            .get_or_init::<GoalAccountingState>(GoalAccountingState::default);
+    }
+}
+
+impl<C> ConfigContributor<C> for GoalExtension<C>
+where
+    C: Send + Sync + 'static,
+{
+    fn on_config_changed(
+        &self,
+        _session_store: &ExtensionData,
+        thread_store: &ExtensionData,
+        _previous_config: &C,
+        new_config: &C,
+    ) {
+        thread_store.insert(GoalExtensionConfig::from_enabled((self.goals_enabled)(
+            new_config,
+        )));
+    }
+}
+
+#[async_trait]
+impl<C> TurnLifecycleContributor for GoalExtension<C>
+where
+    C: Send + Sync + 'static,
+{
+    async fn on_turn_start(&self, input: TurnStartInput<'_>) {
+        if !goal_enabled(input.thread_store) {
+            return;
+        }
+
+        // TODO: TurnStartInput should expose collaboration mode and token usage
+        // at turn start. Goals need mode to suppress plan-mode accounting and
+        // the token baseline to account deltas exactly.
+        accounting_state(input.thread_store).start_turn(input.turn_store.level_id());
+    }
+
+    async fn on_turn_stop(&self, input: TurnStopInput<'_>) {
+        if !goal_enabled(input.thread_store) {
+            return;
+        }
+
+        // TODO: this should flush wall-clock and any unflushed token usage to
+        // persisted goal storage, emit ThreadGoalUpdated, and optionally inject
+        // budget-limit steering through a host event/input capability.
+        // TODO: the host also needs an idle/next-turn wake capability so an
+        // active goal can enqueue continuation context after the turn is fully
+        // cleared, only when there is no pending user or mailbox work.
+        accounting_state(input.thread_store).stop_turn(input.turn_store.level_id());
+    }
+
+    async fn on_turn_abort(&self, input: TurnAbortInput<'_>) {
+        if !goal_enabled(input.thread_store) {
+            return;
+        }
+
+        accounting_state(input.thread_store).stop_turn(input.turn_store.level_id());
+        if input.reason == TurnAbortReason::Interrupted {
+            // TODO: interrupted turns should pause the active goal via persisted
+            // goal storage and emit ThreadGoalUpdated with turn_id None.
+        }
+    }
+}
+
+#[async_trait]
+impl<C> TokenUsageContributor for GoalExtension<C>
+where
+    C: Send + Sync + 'static,
+{
+    async fn on_token_usage(
+        &self,
+        _session_store: &ExtensionData,
+        thread_store: &ExtensionData,
+        turn_store: &ExtensionData,
+        token_usage: &TokenUsageInfo,
+    ) {
+        if !goal_enabled(thread_store) {
+            return;
+        }
+
+        let Some(_recorded) = accounting_state(thread_store)
+            .record_token_usage(turn_store.level_id(), &token_usage.last_token_usage)
+        else {
+            return;
+        };
+
+        // TODO: TokenUsageContributor needs a host goal storage capability so
+        // this recorded delta can be committed to the active persisted goal.
+        // It also needs an event/input capability to emit ThreadGoalUpdated and
+        // inject budget-limit steering when accounting changes goal status.
+    }
+}
+
+impl<C> ToolLifecycleContributor for GoalExtension<C>
+where
+    C: Send + Sync + 'static,
+{
+    fn on_tool_finish<'a>(&'a self, input: ToolFinishInput<'a>) -> ToolLifecycleFuture<'a> {
+        Box::pin(async move {
+            let _should_count_for_goal_progress = goal_enabled(input.thread_store)
+                && tool_attempt_counts_for_goal_progress(input.outcome)
+                && !(input.tool_name.namespace.is_none()
+                    && input.tool_name.name == UPDATE_GOAL_TOOL_NAME);
+
+            // TODO: commit active goal progress through host goal storage and emit
+            // ThreadGoalUpdated when the persisted goal changes. This replaces
+            // GoalRuntimeEvent::ToolCompleted once the goal extension owns runtime
+            // accounting.
+        })
+    }
+}
+
+// TODO: app-server initiated goal set/clear operations need a contributor or
+// backend callback here. They currently happen outside thread/turn/token
+// lifecycle, but the goal extension must observe them to account before
+// mutation, refresh active-goal accounting, emit objective-update steering, and
+// clear runtime state when a goal is removed.
+
+impl<C> ToolContributor for GoalExtension<C>
+where
+    C: Send + Sync + 'static,
+{
+    fn tools(
+        &self,
+        _session_store: &ExtensionData,
+        thread_store: &ExtensionData,
+    ) -> Vec<Arc<dyn codex_extension_api::ToolExecutor<codex_extension_api::ToolCall>>> {
+        if !goal_enabled(thread_store) {
+            return Vec::new();
+        }
+
+        let Ok(thread_id) = ThreadId::from_string(thread_store.level_id()) else {
+            return Vec::new();
+        };
+        vec![
+            Arc::new(GoalToolExecutor::get(
+                thread_id,
+                Arc::clone(&self.backend),
+                self.event_emitter.clone(),
+            )),
+            Arc::new(GoalToolExecutor::create(
+                thread_id,
+                Arc::clone(&self.backend),
+                self.event_emitter.clone(),
+            )),
+            Arc::new(GoalToolExecutor::update(
+                thread_id,
+                Arc::clone(&self.backend),
+                self.event_emitter.clone(),
+            )),
+        ]
+    }
+}
+
+pub fn install<C>(
+    registry: &mut ExtensionRegistryBuilder<C>,
+    goals_enabled: impl Fn(&C) -> bool + Send + Sync + 'static,
+) where
+    C: Send + Sync + 'static,
+{
+    install_with_backend(registry, Arc::new(NoGoalToolBackend), goals_enabled);
+}
+
+pub fn install_with_backend<C>(
+    registry: &mut ExtensionRegistryBuilder<C>,
+    backend: Arc<dyn GoalToolBackend>,
+    goals_enabled: impl Fn(&C) -> bool + Send + Sync + 'static,
+) where
+    C: Send + Sync + 'static,
+{
+    let extension = Arc::new(GoalExtension::new_with_event_sink(
+        backend,
+        registry.event_sink(),
+        goals_enabled,
+    ));
+    registry.thread_lifecycle_contributor(extension.clone());
+    registry.config_contributor(extension.clone());
+    registry.turn_lifecycle_contributor(extension.clone());
+    registry.token_usage_contributor(extension.clone());
+    registry.tool_lifecycle_contributor(extension.clone());
+    registry.tool_contributor(extension);
+}
+
+fn goal_enabled(thread_store: &ExtensionData) -> bool {
+    thread_store
+        .get::<GoalExtensionConfig>()
+        .is_some_and(|config| config.enabled)
+}
+
+fn accounting_state(thread_store: &ExtensionData) -> Arc<GoalAccountingState> {
+    thread_store.get_or_init::<GoalAccountingState>(GoalAccountingState::default)
+}
+
+fn tool_attempt_counts_for_goal_progress(outcome: ToolCallOutcome) -> bool {
+    match outcome {
+        ToolCallOutcome::Completed { .. } => true,
+        ToolCallOutcome::Failed {
+            handler_executed: true,
+        } => true,
+        ToolCallOutcome::Blocked
+        | ToolCallOutcome::Failed {
+            handler_executed: false,
+        }
+        | ToolCallOutcome::Aborted => false,
+    }
+}
diff --git a/codex-rs/ext/goal/src/lib.rs b/codex-rs/ext/goal/src/lib.rs
new file mode 100644
index 0000000000..38332aee41
--- /dev/null
+++ b/codex-rs/ext/goal/src/lib.rs
@@ -0,0 +1,22 @@
+//! Extension crate sketch for the `/goal` feature.
+//!
+//! This crate is intentionally not wired into the host yet. It contains the
+//! goal tool specs, extension registration shape, and the parts of runtime
+//! accounting that can be represented with today's extension API.
+
+mod accounting;
+mod events;
+mod extension;
+mod spec;
+mod tool;
+
+pub use extension::GoalExtension;
+pub use extension::GoalExtensionConfig;
+pub use extension::GoalToolBackend;
+pub use extension::NoGoalToolBackend;
+pub use extension::install;
+pub use extension::install_with_backend;
+pub use spec::CREATE_GOAL_TOOL_NAME;
+pub use spec::GET_GOAL_TOOL_NAME;
+pub use spec::UPDATE_GOAL_TOOL_NAME;
+pub use tool::CreateGoalRequest;
diff --git a/codex-rs/ext/goal/src/spec.rs b/codex-rs/ext/goal/src/spec.rs
new file mode 100644
index 0000000000..e127846ab5
--- /dev/null
+++ b/codex-rs/ext/goal/src/spec.rs
@@ -0,0 +1,89 @@
+//! Responses API tool definitions for persisted thread goals.
+
+use codex_tools::JsonSchema;
+use codex_tools::ResponsesApiTool;
+use codex_tools::ToolSpec;
+use serde_json::json;
+use std::collections::BTreeMap;
+
+pub const GET_GOAL_TOOL_NAME: &str = "get_goal";
+pub const CREATE_GOAL_TOOL_NAME: &str = "create_goal";
+pub const UPDATE_GOAL_TOOL_NAME: &str = "update_goal";
+
+pub fn create_get_goal_tool() -> ToolSpec {
+    ToolSpec::Function(ResponsesApiTool {
+        name: GET_GOAL_TOOL_NAME.to_string(),
+        description: "Get the current goal for this thread, including status, budgets, token and elapsed-time usage, and remaining token budget."
+            .to_string(),
+        strict: false,
+        defer_loading: None,
+        parameters: JsonSchema::object(BTreeMap::new(), Some(Vec::new()), Some(false.into())),
+        output_schema: None,
+    })
+}
+
+pub fn create_create_goal_tool() -> ToolSpec {
+    let properties = BTreeMap::from([
+        (
+            "objective".to_string(),
+            JsonSchema::string(Some(
+                "Required. The concrete objective to start pursuing. This starts a new active goal only when no goal is currently defined; if a goal already exists, this tool fails."
+                    .to_string(),
+            )),
+        ),
+        (
+            "token_budget".to_string(),
+            JsonSchema::integer(Some(
+                "Optional positive token budget for the new active goal.".to_string(),
+            )),
+        ),
+    ]);
+
+    ToolSpec::Function(ResponsesApiTool {
+        name: CREATE_GOAL_TOOL_NAME.to_string(),
+        description: format!(
+            r#"Create a goal only when explicitly requested by the user or system/developer instructions; do not infer goals from ordinary tasks.
+Set token_budget only when an explicit token budget is requested. Fails if a goal exists; use {UPDATE_GOAL_TOOL_NAME} only for status."#
+        ),
+        strict: false,
+        defer_loading: None,
+        parameters: JsonSchema::object(
+            properties,
+            /*required*/ Some(vec!["objective".to_string()]),
+            Some(false.into()),
+        ),
+        output_schema: None,
+    })
+}
+
+pub fn create_update_goal_tool() -> ToolSpec {
+    let properties = BTreeMap::from([(
+        "status".to_string(),
+        JsonSchema::string_enum(
+            vec![json!("complete")],
+            Some(
+                "Required. Set to complete only when the objective is achieved and no required work remains."
+                    .to_string(),
+            ),
+        ),
+    )]);
+
+    ToolSpec::Function(ResponsesApiTool {
+        name: UPDATE_GOAL_TOOL_NAME.to_string(),
+        description: r#"Update the existing goal.
+Use this tool only to mark the goal achieved.
+Set status to `complete` only when the objective has actually been achieved and no required work remains.
+Do not mark a goal complete merely because its budget is nearly exhausted or because you are stopping work.
+You cannot use this tool to pause, resume, or budget-limit a goal; those status changes are controlled by the user or system.
+When marking a budgeted goal achieved with status `complete`, report the final token usage from the tool result to the user."#
+            .to_string(),
+        strict: false,
+        defer_loading: None,
+        parameters: JsonSchema::object(
+            properties,
+            /*required*/ Some(vec!["status".to_string()]),
+            Some(false.into()),
+        ),
+        output_schema: None,
+    })
+}
diff --git a/codex-rs/ext/goal/src/tool.rs b/codex-rs/ext/goal/src/tool.rs
new file mode 100644
index 0000000000..8ad4541a3c
--- /dev/null
+++ b/codex-rs/ext/goal/src/tool.rs
@@ -0,0 +1,261 @@
+use std::sync::Arc;
+
+use async_trait::async_trait;
+use codex_extension_api::FunctionCallError;
+use codex_extension_api::JsonToolOutput;
+use codex_extension_api::ToolCall;
+use codex_extension_api::ToolExecutor;
+use codex_extension_api::ToolName;
+use codex_extension_api::ToolOutput;
+use codex_extension_api::ToolSpec;
+use codex_protocol::ThreadId;
+use codex_protocol::protocol::ThreadGoal;
+use codex_protocol::protocol::ThreadGoalStatus;
+use codex_protocol::protocol::validate_thread_goal_objective;
+use serde::Deserialize;
+use serde::Serialize;
+
+use crate::events::GoalEventEmitter;
+use crate::extension::GoalToolBackend;
+use crate::spec::CREATE_GOAL_TOOL_NAME;
+use crate::spec::GET_GOAL_TOOL_NAME;
+use crate::spec::UPDATE_GOAL_TOOL_NAME;
+use crate::spec::create_create_goal_tool;
+use crate::spec::create_get_goal_tool;
+use crate::spec::create_update_goal_tool;
+
+#[derive(Clone)]
+pub(crate) struct GoalToolExecutor {
+    kind: GoalToolKind,
+    thread_id: ThreadId,
+    backend: Arc<dyn GoalToolBackend>,
+    event_emitter: GoalEventEmitter,
+}
+
+#[derive(Clone, Copy)]
+enum GoalToolKind {
+    Get,
+    Create,
+    Update,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "snake_case")]
+pub struct CreateGoalRequest {
+    pub objective: String,
+    pub token_budget: Option<i64>,
+}
+
+#[derive(Debug, Deserialize)]
+#[serde(rename_all = "snake_case")]
+struct UpdateGoalArgs {
+    status: ThreadGoalStatus,
+}
+
+#[derive(Debug, PartialEq, Serialize)]
+#[serde(rename_all = "camelCase")]
+struct GoalToolResponse {
+    goal: Option<ThreadGoal>,
+    remaining_tokens: Option<i64>,
+    completion_budget_report: Option<String>,
+}
+
+#[derive(Clone, Copy)]
+enum CompletionBudgetReport {
+    Include,
+    Omit,
+}
+
+impl GoalToolExecutor {
+    pub(crate) fn get(
+        thread_id: ThreadId,
+        backend: Arc<dyn GoalToolBackend>,
+        event_emitter: GoalEventEmitter,
+    ) -> Self {
+        Self {
+            kind: GoalToolKind::Get,
+            thread_id,
+            backend,
+            event_emitter,
+        }
+    }
+
+    pub(crate) fn create(
+        thread_id: ThreadId,
+        backend: Arc<dyn GoalToolBackend>,
+        event_emitter: GoalEventEmitter,
+    ) -> Self {
+        Self {
+            kind: GoalToolKind::Create,
+            thread_id,
+            backend,
+            event_emitter,
+        }
+    }
+
+    pub(crate) fn update(
+        thread_id: ThreadId,
+        backend: Arc<dyn GoalToolBackend>,
+        event_emitter: GoalEventEmitter,
+    ) -> Self {
+        Self {
+            kind: GoalToolKind::Update,
+            thread_id,
+            backend,
+            event_emitter,
+        }
+    }
+}
+
+#[async_trait]
+impl ToolExecutor<ToolCall> for GoalToolExecutor {
+    fn tool_name(&self) -> ToolName {
+        ToolName::plain(match self.kind {
+            GoalToolKind::Get => GET_GOAL_TOOL_NAME,
+            GoalToolKind::Create => CREATE_GOAL_TOOL_NAME,
+            GoalToolKind::Update => UPDATE_GOAL_TOOL_NAME,
+        })
+    }
+
+    fn spec(&self) -> Option<ToolSpec> {
+        Some(match self.kind {
+            GoalToolKind::Get => create_get_goal_tool(),
+            GoalToolKind::Create => create_create_goal_tool(),
+            GoalToolKind::Update => create_update_goal_tool(),
+        })
+    }
+
+    async fn handle(&self, invocation: ToolCall) -> Result<Box<dyn ToolOutput>, FunctionCallError> {
+        match self.kind {
+            GoalToolKind::Get => self.handle_get(invocation).await,
+            GoalToolKind::Create => self.handle_create(invocation).await,
+            GoalToolKind::Update => self.handle_update(invocation).await,
+        }
+    }
+}
+
+impl GoalToolExecutor {
+    async fn handle_get(
+        &self,
+        invocation: ToolCall,
+    ) -> Result<Box<dyn ToolOutput>, FunctionCallError> {
+        let _ = invocation.function_arguments()?;
+        let goal = self
+            .backend
+            .get_goal(self.thread_id)
+            .await
+            .map_err(FunctionCallError::RespondToModel)?;
+        goal_response(goal, CompletionBudgetReport::Omit)
+    }
+
+    async fn handle_create(
+        &self,
+        invocation: ToolCall,
+    ) -> Result<Box<dyn ToolOutput>, FunctionCallError> {
+        let mut request: CreateGoalRequest = parse_arguments(invocation.function_arguments()?)?;
+        request.objective = request.objective.trim().to_string();
+        validate_thread_goal_objective(&request.objective)
+            .map_err(FunctionCallError::RespondToModel)?;
+        validate_goal_budget(request.token_budget).map_err(FunctionCallError::RespondToModel)?;
+
+        let goal = self
+            .backend
+            .create_goal(self.thread_id, request)
+            .await
+            .map_err(FunctionCallError::RespondToModel)?;
+        self.emit_goal_updated_from_tool_call(&invocation, goal.clone());
+        goal_response(Some(goal), CompletionBudgetReport::Omit)
+    }
+
+    async fn handle_update(
+        &self,
+        invocation: ToolCall,
+    ) -> Result<Box<dyn ToolOutput>, FunctionCallError> {
+        let args: UpdateGoalArgs = parse_arguments(invocation.function_arguments()?)?;
+        if args.status != ThreadGoalStatus::Complete {
+            return Err(FunctionCallError::RespondToModel(
+                "update_goal can only mark the existing goal complete; pause, resume, and budget-limited status changes are controlled by the user or system"
+                    .to_string(),
+            ));
+        }
+
+        // TODO: update_goal needs a host callback before completion to flush
+        // final active-turn accounting with budget steering suppressed.
+        let goal = self
+            .backend
+            .complete_goal(self.thread_id)
+            .await
+            .map_err(FunctionCallError::RespondToModel)?;
+        self.emit_goal_updated_from_tool_call(&invocation, goal.clone());
+        goal_response(Some(goal), CompletionBudgetReport::Include)
+    }
+
+    fn emit_goal_updated_from_tool_call(&self, invocation: &ToolCall, goal: ThreadGoal) {
+        // TODO: ToolCall should expose the current turn submission id so goal
+        // tool events can set ThreadGoalUpdatedEvent.turn_id exactly as core
+        // does today. Until then, correlate the event with the tool call id.
+        self.event_emitter.thread_goal_updated(
+            invocation.call_id.clone(),
+            /*turn_id*/ None,
+            goal,
+        );
+    }
+}
+
+fn parse_arguments<T>(arguments: &str) -> Result<T, FunctionCallError>
+where
+    T: for<'de> Deserialize<'de>,
+{
+    serde_json::from_str(arguments)
+        .map_err(|err| FunctionCallError::RespondToModel(err.to_string()))
+}
+
+fn validate_goal_budget(value: Option<i64>) -> Result<(), String> {
+    if let Some(value) = value
+        && value <= 0
+    {
+        return Err("goal budgets must be positive when provided".to_string());
+    }
+    Ok(())
+}
+
+fn goal_response(
+    goal: Option<ThreadGoal>,
+    completion_budget_report: CompletionBudgetReport,
+) -> Result<Box<dyn ToolOutput>, FunctionCallError> {
+    let value = serde_json::to_value(GoalToolResponse::new(goal, completion_budget_report))
+        .map_err(|err| FunctionCallError::Fatal(err.to_string()))?;
+    Ok(Box::new(JsonToolOutput::new(value)))
+}
+
+impl GoalToolResponse {
+    fn new(goal: Option<ThreadGoal>, report_mode: CompletionBudgetReport) -> Self {
+        let remaining_tokens = goal.as_ref().and_then(|goal| {
+            goal.token_budget
+                .map(|budget| (budget - goal.tokens_used).max(0))
+        });
+        let completion_budget_report = match report_mode {
+            CompletionBudgetReport::Include => goal
+                .as_ref()
+                .filter(|goal| goal.status == ThreadGoalStatus::Complete)
+                .and_then(completion_budget_report),
+            CompletionBudgetReport::Omit => None,
+        };
+        Self {
+            goal,
+            remaining_tokens,
+            completion_budget_report,
+        }
+    }
+}
+
+fn completion_budget_report(goal: &ThreadGoal) -> Option<String> {
+    if goal.token_budget.is_none() && goal.time_used_seconds <= 0 {
+        None
+    } else {
+        Some(
+            "Goal achieved. Report final usage from this tool result's structured goal fields. If `goal.tokenBudget` is present, include token usage from `goal.tokensUsed` and `goal.tokenBudget`. If `goal.timeUsedSeconds` is greater than 0, summarize elapsed time in a concise, human-friendly form appropriate to the response language."
+                .to_string(),
+        )
+    }
+}
diff --git a/codex-rs/ext/guardian/Cargo.toml b/codex-rs/ext/guardian/Cargo.toml
index 513254b7cf..53e553ec1c 100644
--- a/codex-rs/ext/guardian/Cargo.toml
+++ b/codex-rs/ext/guardian/Cargo.toml
@@ -14,6 +14,7 @@ doctest = false
 workspace = true
 
 [dependencies]
+async-trait = { workspace = true }
 codex-core = { workspace = true }
 codex-extension-api = { workspace = true }
 codex-protocol = { workspace = true }
diff --git a/codex-rs/ext/guardian/src/lib.rs b/codex-rs/ext/guardian/src/lib.rs
index 809a381471..0591887c25 100644
--- a/codex-rs/ext/guardian/src/lib.rs
+++ b/codex-rs/ext/guardian/src/lib.rs
@@ -47,11 +47,12 @@ impl GuardianThreadContext {
     }
 }
 
+#[async_trait::async_trait]
 impl<S> ThreadLifecycleContributor<Config> for GuardianExtension<S>
 where
     S: Send + Sync,
 {
-    fn on_thread_start(&self, input: ThreadStartInput<'_, Config>) {
+    async fn on_thread_start(&self, input: ThreadStartInput<'_, Config>) {
         let Ok(forked_from_thread_id) = ThreadId::from_string(input.thread_store.level_id()) else {
             return;
         };
diff --git a/codex-rs/ext/memories/Cargo.toml b/codex-rs/ext/memories/Cargo.toml
index 542eaa6bc5..5485eedc9f 100644
--- a/codex-rs/ext/memories/Cargo.toml
+++ b/codex-rs/ext/memories/Cargo.toml
@@ -13,10 +13,12 @@ doctest = false
 workspace = true
 
 [dependencies]
+async-trait = { workspace = true }
 codex-core = { workspace = true }
 codex-extension-api = { workspace = true }
 codex-features = { workspace = true }
 codex-memories-read = { workspace = true }
+codex-tools = { workspace = true }
 codex-utils-absolute-path = { workspace = true }
 codex-utils-output-truncation = { workspace = true }
 schemars = { workspace = true }
@@ -26,7 +28,6 @@ thiserror = { workspace = true }
 tokio = { workspace = true, features = ["fs"] }
 
 [dev-dependencies]
-codex-tools = { workspace = true }
 pretty_assertions = { workspace = true }
 tempfile = { workspace = true }
 tokio = { workspace = true, features = ["fs", "macros"] }
diff --git a/codex-rs/ext/memories/src/extension.rs b/codex-rs/ext/memories/src/extension.rs
index 2b49559183..a50949e919 100644
--- a/codex-rs/ext/memories/src/extension.rs
+++ b/codex-rs/ext/memories/src/extension.rs
@@ -1,6 +1,7 @@
 use std::sync::Arc;
 
 use codex_core::config::Config;
+use codex_extension_api::ConfigContributor;
 use codex_extension_api::ContextContributor;
 use codex_extension_api::ExtensionData;
 use codex_extension_api::ExtensionRegistryBuilder;
@@ -25,6 +26,15 @@ pub(crate) struct MemoriesExtensionConfig {
     pub(crate) codex_home: AbsolutePathBuf,
 }
 
+impl MemoriesExtensionConfig {
+    fn from_config(config: &Config) -> Self {
+        Self {
+            enabled: config.features.enabled(Feature::MemoryTool) && config.memories.use_memories,
+            codex_home: config.codex_home.clone(),
+        }
+    }
+}
+
 impl ContextContributor for MemoriesExtension {
     fn contribute<'a>(
         &'a self,
@@ -48,13 +58,24 @@ impl ContextContributor for MemoriesExtension {
     }
 }
 
+#[async_trait::async_trait]
 impl ThreadLifecycleContributor<Config> for MemoriesExtension {
-    fn on_thread_start(&self, input: ThreadStartInput<'_, Config>) {
-        input.thread_store.insert(MemoriesExtensionConfig {
-            enabled: input.config.features.enabled(Feature::MemoryTool)
-                && input.config.memories.use_memories,
-            codex_home: input.config.codex_home.clone(),
-        });
+    async fn on_thread_start(&self, input: ThreadStartInput<'_, Config>) {
+        input
+            .thread_store
+            .insert(MemoriesExtensionConfig::from_config(input.config));
+    }
+}
+
+impl ConfigContributor<Config> for MemoriesExtension {
+    fn on_config_changed(
+        &self,
+        _session_store: &ExtensionData,
+        thread_store: &ExtensionData,
+        _previous_config: &Config,
+        new_config: &Config,
+    ) {
+        thread_store.insert(MemoriesExtensionConfig::from_config(new_config));
     }
 }
 
@@ -63,7 +84,7 @@ impl ToolContributor for MemoriesExtension {
         &self,
         _session_store: &ExtensionData,
         thread_store: &ExtensionData,
-    ) -> Vec<Arc<dyn codex_extension_api::ExtensionToolExecutor>> {
+    ) -> Vec<Arc<dyn codex_extension_api::ToolExecutor<codex_extension_api::ToolCall>>> {
         let Some(config) = thread_store.get::<MemoriesExtensionConfig>() else {
             return Vec::new();
         };
@@ -79,6 +100,8 @@ impl ToolContributor for MemoriesExtension {
 pub fn install(registry: &mut ExtensionRegistryBuilder<Config>) {
     let extension = Arc::new(MemoriesExtension);
     registry.thread_lifecycle_contributor(extension.clone());
-    registry.prompt_contributor(extension.clone());
-    registry.tool_contributor(extension);
+    registry.config_contributor(extension.clone());
+    registry.prompt_contributor(extension);
+    // Keep the read/retrieval tools out of app-server until that rollout is intentional.
+    // registry.tool_contributor(extension);
 }
diff --git a/codex-rs/ext/memories/src/lib.rs b/codex-rs/ext/memories/src/lib.rs
index 4b6f74c571..bb7b07bc69 100644
--- a/codex-rs/ext/memories/src/lib.rs
+++ b/codex-rs/ext/memories/src/lib.rs
@@ -12,9 +12,10 @@ pub(crate) const DEFAULT_SEARCH_MAX_RESULTS: usize = 200;
 pub(crate) const MAX_SEARCH_RESULTS: usize = 200;
 pub(crate) const DEFAULT_READ_MAX_TOKENS: usize = 20_000;
 
-pub(crate) const LIST_TOOL_NAME: &str = "memory_list";
-pub(crate) const READ_TOOL_NAME: &str = "memory_read";
-pub(crate) const SEARCH_TOOL_NAME: &str = "memory_search";
+pub(crate) const MEMORY_TOOLS_NAMESPACE: &str = "memories/";
+pub(crate) const LIST_TOOL_NAME: &str = "list";
+pub(crate) const READ_TOOL_NAME: &str = "read";
+pub(crate) const SEARCH_TOOL_NAME: &str = "search";
 
 #[cfg(test)]
 mod tests;
diff --git a/codex-rs/ext/memories/src/tests.rs b/codex-rs/ext/memories/src/tests.rs
index 3d9cd9a79b..b732ca22c2 100644
--- a/codex-rs/ext/memories/src/tests.rs
+++ b/codex-rs/ext/memories/src/tests.rs
@@ -3,10 +3,10 @@ use std::sync::Arc;
 
 use codex_extension_api::ContextContributor;
 use codex_extension_api::ExtensionData;
-use codex_extension_api::ExtensionToolExecutor;
 use codex_extension_api::PromptSlot;
 use codex_extension_api::ToolCall;
 use codex_extension_api::ToolContributor;
+use codex_extension_api::ToolExecutor;
 use codex_extension_api::ToolName;
 use codex_extension_api::ToolPayload;
 use codex_tools::ToolOutput;
@@ -62,15 +62,15 @@ fn tools_are_contributed_when_enabled() {
     let tool_names = extension
         .tools(&ExtensionData::new("session"), &thread_store)
         .into_iter()
-        .map(|tool| tool.tool_name().to_string())
+        .map(|tool| tool.tool_name())
         .collect::<Vec<_>>();
 
     assert_eq!(
         tool_names,
         vec![
-            "memory_list".to_string(),
-            "memory_read".to_string(),
-            "memory_search".to_string()
+            memory_tool_name(crate::LIST_TOOL_NAME),
+            memory_tool_name(crate::READ_TOOL_NAME),
+            memory_tool_name(crate::SEARCH_TOOL_NAME),
         ]
     );
 }
@@ -135,7 +135,7 @@ async fn read_tool_reads_memory_file() {
     let output = tool
         .handle(ToolCall {
             call_id: "call-1".to_string(),
-            tool_name: ToolName::plain(crate::READ_TOOL_NAME),
+            tool_name: memory_tool_name(crate::READ_TOOL_NAME),
             payload: payload.clone(),
         })
         .await
@@ -177,7 +177,7 @@ async fn search_tool_accepts_multiple_queries() {
     let output = tool
         .handle(ToolCall {
             call_id: "call-1".to_string(),
-            tool_name: ToolName::plain(crate::SEARCH_TOOL_NAME),
+            tool_name: memory_tool_name(crate::SEARCH_TOOL_NAME),
             payload: payload.clone(),
         })
         .await
@@ -245,7 +245,7 @@ async fn search_tool_accepts_windowed_all_match_mode() {
     let output = tool
         .handle(ToolCall {
             call_id: "call-1".to_string(),
-            tool_name: ToolName::plain(crate::SEARCH_TOOL_NAME),
+            tool_name: memory_tool_name(crate::SEARCH_TOOL_NAME),
             payload: payload.clone(),
         })
         .await
@@ -290,22 +290,30 @@ async fn search_tool_rejects_legacy_single_query() {
         .to_string(),
     };
 
-    let err = tool
+    let result = tool
         .handle(ToolCall {
             call_id: "call-1".to_string(),
-            tool_name: ToolName::plain(crate::SEARCH_TOOL_NAME),
+            tool_name: memory_tool_name(crate::SEARCH_TOOL_NAME),
             payload,
         })
-        .await
-        .expect_err("legacy query field should be rejected");
+        .await;
+    let err = match result {
+        Ok(_) => panic!("legacy query field should be rejected"),
+        Err(err) => err,
+    };
 
     assert!(err.to_string().contains("unknown field"));
     assert!(err.to_string().contains("query"));
 }
 
-fn memory_tool(memory_root: &Path, tool_name: &str) -> Arc<dyn ExtensionToolExecutor> {
+fn memory_tool(memory_root: &Path, tool_name: &str) -> Arc<dyn ToolExecutor<ToolCall>> {
+    let expected_tool_name = memory_tool_name(tool_name);
     crate::tools::memory_tools(LocalMemoriesBackend::from_memory_root(memory_root))
         .into_iter()
-        .find(|tool| tool.tool_name().to_string() == tool_name)
+        .find(|tool| tool.tool_name() == expected_tool_name)
         .unwrap_or_else(|| panic!("{tool_name} tool should be registered"))
 }
+
+fn memory_tool_name(tool_name: &str) -> ToolName {
+    ToolName::namespaced(crate::MEMORY_TOOLS_NAMESPACE, tool_name)
+}
diff --git a/codex-rs/ext/memories/src/tools/list.rs b/codex-rs/ext/memories/src/tools/list.rs
index bd1599047e..baed3c30a2 100644
--- a/codex-rs/ext/memories/src/tools/list.rs
+++ b/codex-rs/ext/memories/src/tools/list.rs
@@ -1,7 +1,6 @@
-use codex_extension_api::ExtensionToolExecutor;
-use codex_extension_api::ExtensionToolFuture;
 use codex_extension_api::JsonToolOutput;
 use codex_extension_api::ToolCall;
+use codex_extension_api::ToolExecutor;
 use codex_extension_api::ToolName;
 use codex_extension_api::ToolSpec;
 use schemars::JsonSchema;
@@ -17,7 +16,8 @@ use crate::backend::MemoriesBackend;
 
 use super::backend_error_to_function_call;
 use super::clamp_max_results;
-use super::function_tool;
+use super::memory_function_tool;
+use super::memory_tool_name;
 use super::parse_args;
 
 #[derive(Deserialize, JsonSchema)]
@@ -34,38 +34,41 @@ pub(super) struct ListTool<B> {
     pub(super) backend: B,
 }
 
-impl<B> ExtensionToolExecutor for ListTool<B>
+#[async_trait::async_trait]
+impl<B> ToolExecutor<ToolCall> for ListTool<B>
 where
     B: MemoriesBackend,
 {
     fn tool_name(&self) -> ToolName {
-        ToolName::plain(LIST_TOOL_NAME)
+        memory_tool_name(LIST_TOOL_NAME)
     }
 
     fn spec(&self) -> Option<ToolSpec> {
-        Some(function_tool::<ListArgs, ListMemoriesResponse>(
+        Some(memory_function_tool::<ListArgs, ListMemoriesResponse>(
             LIST_TOOL_NAME,
             "List immediate files and directories under a path in the Codex memories store.",
         ))
     }
 
-    fn handle(&self, call: ToolCall) -> ExtensionToolFuture<'_> {
+    async fn handle(
+        &self,
+        call: ToolCall,
+    ) -> Result<Box<dyn codex_extension_api::ToolOutput>, codex_extension_api::FunctionCallError>
+    {
         let backend = self.backend.clone();
-        Box::pin(async move {
-            let args: ListArgs = parse_args(&call)?;
-            let response = backend
-                .list(ListMemoriesRequest {
-                    path: args.path,
-                    cursor: args.cursor,
-                    max_results: clamp_max_results(
-                        args.max_results,
-                        DEFAULT_LIST_MAX_RESULTS,
-                        MAX_LIST_RESULTS,
-                    ),
-                })
-                .await
-                .map_err(backend_error_to_function_call)?;
-            Ok(JsonToolOutput::new(json!(response)))
-        })
+        let args: ListArgs = parse_args(&call)?;
+        let response = backend
+            .list(ListMemoriesRequest {
+                path: args.path,
+                cursor: args.cursor,
+                max_results: clamp_max_results(
+                    args.max_results,
+                    DEFAULT_LIST_MAX_RESULTS,
+                    MAX_LIST_RESULTS,
+                ),
+            })
+            .await
+            .map_err(backend_error_to_function_call)?;
+        Ok(Box::new(JsonToolOutput::new(json!(response))))
     }
 }
diff --git a/codex-rs/ext/memories/src/tools/mod.rs b/codex-rs/ext/memories/src/tools/mod.rs
index b488cc5e87..b78a125652 100644
--- a/codex-rs/ext/memories/src/tools/mod.rs
+++ b/codex-rs/ext/memories/src/tools/mod.rs
@@ -1,15 +1,20 @@
 use std::sync::Arc;
 
-use codex_extension_api::ExtensionToolExecutor;
 use codex_extension_api::FunctionCallError;
 use codex_extension_api::ResponsesApiTool;
 use codex_extension_api::ToolCall;
+use codex_extension_api::ToolExecutor;
+use codex_extension_api::ToolName;
 use codex_extension_api::ToolSpec;
 use codex_extension_api::parse_tool_input_schema;
+use codex_tools::ResponsesApiNamespace;
+use codex_tools::ResponsesApiNamespaceTool;
+use codex_tools::default_namespace_description;
 use schemars::JsonSchema;
 use serde::Deserialize;
 use serde_json::Value;
 
+use crate::MEMORY_TOOLS_NAMESPACE;
 use crate::backend::MemoriesBackend;
 use crate::backend::MemoriesBackendError;
 use crate::schema;
@@ -18,7 +23,7 @@ mod list;
 mod read;
 mod search;
 
-pub(crate) fn memory_tools<B>(backend: B) -> Vec<Arc<dyn ExtensionToolExecutor>>
+pub(crate) fn memory_tools<B>(backend: B) -> Vec<Arc<dyn ToolExecutor<ToolCall>>>
 where
     B: MemoriesBackend,
 {
@@ -33,8 +38,15 @@ where
     ]
 }
 
-fn function_tool<I: JsonSchema, O: JsonSchema>(name: &str, description: &str) -> ToolSpec {
-    ToolSpec::Function(ResponsesApiTool {
+pub(super) fn memory_tool_name(name: &str) -> ToolName {
+    ToolName::namespaced(MEMORY_TOOLS_NAMESPACE, name)
+}
+
+pub(super) fn memory_function_tool<I: JsonSchema, O: JsonSchema>(
+    name: &str,
+    description: &str,
+) -> ToolSpec {
+    let tool = ResponsesApiTool {
         name: name.to_string(),
         description: description.to_string(),
         strict: false,
@@ -42,6 +54,12 @@ fn function_tool<I: JsonSchema, O: JsonSchema>(name: &str, description: &str) ->
         parameters: parse_tool_input_schema(&schema::input_schema_for::<I>())
             .unwrap_or_else(|err| panic!("generated input schema for {name} should parse: {err}")),
         output_schema: Some(schema::output_schema_for::<O>()),
+    };
+
+    ToolSpec::Namespace(ResponsesApiNamespace {
+        name: MEMORY_TOOLS_NAMESPACE.to_string(),
+        description: default_namespace_description(MEMORY_TOOLS_NAMESPACE),
+        tools: vec![ResponsesApiNamespaceTool::Function(tool)],
     })
 }
 
diff --git a/codex-rs/ext/memories/src/tools/read.rs b/codex-rs/ext/memories/src/tools/read.rs
index ec411a9947..6e7f771d75 100644
--- a/codex-rs/ext/memories/src/tools/read.rs
+++ b/codex-rs/ext/memories/src/tools/read.rs
@@ -1,7 +1,6 @@
-use codex_extension_api::ExtensionToolExecutor;
-use codex_extension_api::ExtensionToolFuture;
 use codex_extension_api::JsonToolOutput;
 use codex_extension_api::ToolCall;
+use codex_extension_api::ToolExecutor;
 use codex_extension_api::ToolName;
 use codex_extension_api::ToolSpec;
 use schemars::JsonSchema;
@@ -15,7 +14,8 @@ use crate::backend::ReadMemoryRequest;
 use crate::backend::ReadMemoryResponse;
 
 use super::backend_error_to_function_call;
-use super::function_tool;
+use super::memory_function_tool;
+use super::memory_tool_name;
 use super::parse_args;
 
 #[derive(Deserialize, JsonSchema)]
@@ -33,35 +33,38 @@ pub(super) struct ReadTool<B> {
     pub(super) backend: B,
 }
 
-impl<B> ExtensionToolExecutor for ReadTool<B>
+#[async_trait::async_trait]
+impl<B> ToolExecutor<ToolCall> for ReadTool<B>
 where
     B: MemoriesBackend,
 {
     fn tool_name(&self) -> ToolName {
-        ToolName::plain(READ_TOOL_NAME)
+        memory_tool_name(READ_TOOL_NAME)
     }
 
     fn spec(&self) -> Option<ToolSpec> {
-        Some(function_tool::<ReadArgs, ReadMemoryResponse>(
+        Some(memory_function_tool::<ReadArgs, ReadMemoryResponse>(
             READ_TOOL_NAME,
             "Read a Codex memory file by relative path, optionally starting at a 1-indexed line offset and limiting the number of lines returned.",
         ))
     }
 
-    fn handle(&self, call: ToolCall) -> ExtensionToolFuture<'_> {
+    async fn handle(
+        &self,
+        call: ToolCall,
+    ) -> Result<Box<dyn codex_extension_api::ToolOutput>, codex_extension_api::FunctionCallError>
+    {
         let backend = self.backend.clone();
-        Box::pin(async move {
-            let args: ReadArgs = parse_args(&call)?;
-            let response = backend
-                .read(ReadMemoryRequest {
-                    path: args.path,
-                    line_offset: args.line_offset.unwrap_or(1),
-                    max_lines: args.max_lines,
-                    max_tokens: DEFAULT_READ_MAX_TOKENS,
-                })
-                .await
-                .map_err(backend_error_to_function_call)?;
-            Ok(JsonToolOutput::new(json!(response)))
-        })
+        let args: ReadArgs = parse_args(&call)?;
+        let response = backend
+            .read(ReadMemoryRequest {
+                path: args.path,
+                line_offset: args.line_offset.unwrap_or(1),
+                max_lines: args.max_lines,
+                max_tokens: DEFAULT_READ_MAX_TOKENS,
+            })
+            .await
+            .map_err(backend_error_to_function_call)?;
+        Ok(Box::new(JsonToolOutput::new(json!(response))))
     }
 }
diff --git a/codex-rs/ext/memories/src/tools/search.rs b/codex-rs/ext/memories/src/tools/search.rs
index 38863bcad5..422ce06b7e 100644
--- a/codex-rs/ext/memories/src/tools/search.rs
+++ b/codex-rs/ext/memories/src/tools/search.rs
@@ -1,7 +1,6 @@
-use codex_extension_api::ExtensionToolExecutor;
-use codex_extension_api::ExtensionToolFuture;
 use codex_extension_api::JsonToolOutput;
 use codex_extension_api::ToolCall;
+use codex_extension_api::ToolExecutor;
 use codex_extension_api::ToolName;
 use codex_extension_api::ToolSpec;
 use schemars::JsonSchema;
@@ -18,7 +17,8 @@ use crate::backend::SearchMemoriesResponse;
 
 use super::backend_error_to_function_call;
 use super::clamp_max_results;
-use super::function_tool;
+use super::memory_function_tool;
+use super::memory_tool_name;
 use super::parse_args;
 
 #[derive(Debug, Deserialize, JsonSchema)]
@@ -42,31 +42,34 @@ pub(super) struct SearchTool<B> {
     pub(super) backend: B,
 }
 
-impl<B> ExtensionToolExecutor for SearchTool<B>
+#[async_trait::async_trait]
+impl<B> ToolExecutor<ToolCall> for SearchTool<B>
 where
     B: MemoriesBackend,
 {
     fn tool_name(&self) -> ToolName {
-        ToolName::plain(SEARCH_TOOL_NAME)
+        memory_tool_name(SEARCH_TOOL_NAME)
     }
 
     fn spec(&self) -> Option<ToolSpec> {
-        Some(function_tool::<SearchArgs, SearchMemoriesResponse>(
+        Some(memory_function_tool::<SearchArgs, SearchMemoriesResponse>(
             SEARCH_TOOL_NAME,
             "Search Codex memory files for substring matches, optionally normalizing separators or requiring all query substrings on the same line or within a line window.",
         ))
     }
 
-    fn handle(&self, call: ToolCall) -> ExtensionToolFuture<'_> {
+    async fn handle(
+        &self,
+        call: ToolCall,
+    ) -> Result<Box<dyn codex_extension_api::ToolOutput>, codex_extension_api::FunctionCallError>
+    {
         let backend = self.backend.clone();
-        Box::pin(async move {
-            let args: SearchArgs = parse_args(&call)?;
-            let response = backend
-                .search(args.into_request())
-                .await
-                .map_err(backend_error_to_function_call)?;
-            Ok(JsonToolOutput::new(json!(response)))
-        })
+        let args: SearchArgs = parse_args(&call)?;
+        let response = backend
+            .search(args.into_request())
+            .await
+            .map_err(backend_error_to_function_call)?;
+        Ok(Box::new(JsonToolOutput::new(json!(response))))
     }
 }
 
diff --git a/codex-rs/external-agent-sessions/src/export.rs b/codex-rs/external-agent-sessions/src/export.rs
index 8f34f6ba5a..3682a4f7f8 100644
--- a/codex-rs/external-agent-sessions/src/export.rs
+++ b/codex-rs/external-agent-sessions/src/export.rs
@@ -81,6 +81,7 @@ fn rollout_items_from_messages(messages: &[ConversationMessage]) -> Vec<RolloutI
                         images: None,
                         local_images: Vec::new(),
                         text_elements: Vec::new(),
+                        ..Default::default()
                     },
                 )));
                 current_turn = Some((turn_id, None));
diff --git a/codex-rs/features/src/feature_configs.rs b/codex-rs/features/src/feature_configs.rs
index 7665a4ca8b..bfd14237d5 100644
--- a/codex-rs/features/src/feature_configs.rs
+++ b/codex-rs/features/src/feature_configs.rs
@@ -13,9 +13,15 @@ pub struct MultiAgentV2ConfigToml {
     #[schemars(range(min = 1))]
     pub max_concurrent_threads_per_session: Option<usize>,
     #[serde(skip_serializing_if = "Option::is_none")]
-    #[schemars(range(min = 1, max = 3600000))]
+    #[schemars(range(min = 0, max = 3600000))]
     pub min_wait_timeout_ms: Option<i64>,
     #[serde(skip_serializing_if = "Option::is_none")]
+    #[schemars(range(min = 0, max = 3600000))]
+    pub max_wait_timeout_ms: Option<i64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    #[schemars(range(min = 0, max = 3600000))]
+    pub default_wait_timeout_ms: Option<i64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
     pub usage_hint_enabled: Option<bool>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub usage_hint_text: Option<String>,
@@ -24,7 +30,12 @@ pub struct MultiAgentV2ConfigToml {
     #[serde(skip_serializing_if = "Option::is_none")]
     pub subagent_usage_hint_text: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
+    #[schemars(length(min = 1, max = 64), regex(pattern = r"^[a-zA-Z0-9_-]+$"))]
+    pub tool_namespace: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
     pub hide_spawn_agent_metadata: Option<bool>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub non_code_mode_only: Option<bool>,
 }
 
 impl FeatureConfig for MultiAgentV2ConfigToml {
diff --git a/codex-rs/features/src/legacy.rs b/codex-rs/features/src/legacy.rs
index e87f14f590..1a8b3d24dc 100644
--- a/codex-rs/features/src/legacy.rs
+++ b/codex-rs/features/src/legacy.rs
@@ -21,14 +21,6 @@ const ALIASES: &[Alias] = &[
         legacy_key: "experimental_use_unified_exec_tool",
         feature: Feature::UnifiedExec,
     },
-    Alias {
-        legacy_key: "experimental_use_freeform_apply_patch",
-        feature: Feature::ApplyPatchFreeform,
-    },
-    Alias {
-        legacy_key: "include_apply_patch_tool",
-        feature: Feature::ApplyPatchFreeform,
-    },
     Alias {
         legacy_key: "request_permissions",
         feature: Feature::ExecPermissionApprovals,
@@ -71,25 +63,11 @@ pub(crate) fn feature_for_key(key: &str) -> Option<Feature> {
 
 #[derive(Debug, Default)]
 pub(crate) struct LegacyFeatureToggles {
-    pub include_apply_patch_tool: Option<bool>,
-    pub experimental_use_freeform_apply_patch: Option<bool>,
     pub experimental_use_unified_exec_tool: Option<bool>,
 }
 
 impl LegacyFeatureToggles {
     pub fn apply(self, features: &mut Features) {
-        set_if_some(
-            features,
-            Feature::ApplyPatchFreeform,
-            self.include_apply_patch_tool,
-            "include_apply_patch_tool",
-        );
-        set_if_some(
-            features,
-            Feature::ApplyPatchFreeform,
-            self.experimental_use_freeform_apply_patch,
-            "experimental_use_freeform_apply_patch",
-        );
         set_if_some(
             features,
             Feature::UnifiedExec,
diff --git a/codex-rs/features/src/lib.rs b/codex-rs/features/src/lib.rs
index e019178c21..c20fa8683a 100644
--- a/codex-rs/features/src/lib.rs
+++ b/codex-rs/features/src/lib.rs
@@ -76,31 +76,22 @@ impl Stage {
 #[derive(Debug, Clone, Copy, PartialEq, Eq, PartialOrd, Ord, Hash)]
 pub enum Feature {
     // Stable.
-    /// Removed compatibility flag retained as a no-op so old configs can
-    /// still parse `undo`.
-    GhostCommit,
     /// Enable the default shell tool.
     ShellTool,
     /// Enable Claude-style lifecycle hooks loaded from hooks.json files.
     CodexHooks,
 
     // Experimental
-    /// Removed compatibility flag for the deleted JavaScript REPL feature.
-    JsRepl,
     /// Enable JavaScript code mode backed by the in-process V8 runtime.
     CodeMode,
     /// Restrict model-visible tools to code mode entrypoints (`exec`, `wait`).
     CodeModeOnly,
-    /// Removed compatibility flag for the deleted JavaScript REPL tool-only mode.
-    JsReplToolsOnly,
     /// Use the single unified PTY-backed exec tool.
     UnifiedExec,
     /// Route shell tool execution through the zsh exec bridge.
     ShellZshFork,
     /// Reflow transcript scrollback when the terminal is resized.
     TerminalResizeReflow,
-    /// Include the freeform apply_patch tool.
-    ApplyPatchFreeform,
     /// Stream structured progress while apply_patch input is being generated.
     ApplyPatchStreamingEvents,
     /// Allow exec tools to request additional permissions while staying sandboxed.
@@ -112,30 +103,13 @@ pub enum Feature {
     /// Allow the model to request web searches that fetch cached content.
     /// Takes precedence over `WebSearchRequest`.
     WebSearchCached,
-    /// Legacy search-tool feature flag kept for backward compatibility.
-    SearchTool,
-    /// Removed legacy Linux bubblewrap opt-in flag retained as a no-op so old
-    /// wrappers and config can still parse it.
-    UseLinuxSandboxBwrap,
     /// Use the legacy Landlock Linux sandbox fallback instead of the default
     /// bubblewrap pipeline.
     UseLegacyLandlock,
-    /// Allow the model to request approval and propose exec rules.
-    RequestRule,
-    /// Enable Windows sandbox (restricted token) on Windows.
-    WindowsSandbox,
-    /// Use the elevated Windows sandbox pipeline (setup + runner).
-    WindowsSandboxElevated,
-    /// Legacy remote models flag kept for backward compatibility.
-    RemoteModels,
     /// Experimental shell snapshotting.
     ShellSnapshot,
-    /// Enable git commit attribution guidance via model instructions.
-    CodexGitCommit,
     /// Enable runtime metrics snapshots via a manual reader.
     RuntimeMetrics,
-    /// Persist rollout metadata to a local SQLite database.
-    Sqlite,
     /// Enable startup memory extraction and file-backed memory consolidation.
     MemoryTool,
     /// Enable the Chronicle sidecar for passive screen-context memories.
@@ -158,12 +132,10 @@ pub enum Feature {
     EnableMcpApps,
     /// Use the new path for the host-owned apps MCP server.
     AppsMcpPathOverride,
-    /// Enable the tool_search tool for apps.
+    /// Removed compatibility flag retained as a no-op now that tool_search is always enabled.
     ToolSearch,
     /// Always defer MCP tools behind tool_search instead of exposing small sets directly.
     ToolSearchAlwaysDeferMcpTools,
-    /// Removed compatibility flag for the deleted unavailable-tool placeholder backfill.
-    UnavailableDummyTools,
     /// Enable discoverable tool suggestions for apps.
     ToolSuggest,
     /// Enable plugins.
@@ -196,22 +168,16 @@ pub enum Feature {
     ImageGeneration,
     /// Allow prompting and installing missing MCP dependencies.
     SkillMcpDependencyInstall,
-    /// Prompt for missing skill env var dependencies.
+    /// Removed compatibility flag for deleted skill env var dependency prompting.
     SkillEnvVarDependencyPrompt,
     /// Enable the unified mention popup prototype.
     MentionsV2,
-    /// Steer feature flag - when enabled, Enter submits immediately instead of queuing.
-    /// Kept for config backward compatibility; behavior is always steer-enabled.
-    Steer,
     /// Allow request_user_input in Default collaboration mode.
     DefaultModeRequestUserInput,
     /// Enable automatic review for approval prompts.
     GuardianApproval,
     /// Enable persisted thread goals and automatic goal continuation.
     Goals,
-    /// Enable collaboration modes (Plan, Default).
-    /// Kept for config backward compatibility; behavior is always collaboration-modes-enabled.
-    CollaborationModes,
     /// Route MCP tool approval prompts through the MCP elicitation request path.
     ToolCallMcpElicitation,
     /// Prompt Codex Apps connector auth failures through MCP URL elicitations.
@@ -224,15 +190,57 @@ pub enum Feature {
     FastMode,
     /// Enable experimental realtime voice conversation mode in the TUI.
     RealtimeConversation,
-    /// Connect app-server to the ChatGPT remote control service.
+    /// Prevent idle system sleep while a turn is actively running.
+    PreventIdleSleep,
+    /// Send `response.processed` over Responses API websockets after a turn response is recorded.
+    ResponsesWebsocketResponseProcessed,
+    /// Enable remote compaction v2 over the normal Responses API.
+    RemoteCompactionV2,
+    /// Enable workspace dependency support.
+    WorkspaceDependencies,
+
+    // Removed
+    /// Removed compatibility flag retained as a no-op so old configs can
+    /// still parse `undo`.
+    GhostCommit,
+    /// Removed compatibility flag for the deleted JavaScript REPL feature.
+    JsRepl,
+    /// Removed compatibility flag for the deleted JavaScript REPL tool-only mode.
+    JsReplToolsOnly,
+    /// Legacy search-tool feature flag kept for backward compatibility.
+    SearchTool,
+    /// Removed legacy Linux bubblewrap opt-in flag retained as a no-op so old
+    /// wrappers and config can still parse it.
+    UseLinuxSandboxBwrap,
+    /// Allow the model to request approval and propose exec rules.
+    RequestRule,
+    /// Enable Windows sandbox (restricted token) on Windows.
+    WindowsSandbox,
+    /// Use the elevated Windows sandbox pipeline (setup + runner).
+    WindowsSandboxElevated,
+    /// Legacy remote models flag kept for backward compatibility.
+    RemoteModels,
+    /// Removed legacy git commit attribution guidance flag.
+    CodexGitCommit,
+    /// Persist rollout metadata to a local SQLite database.
+    Sqlite,
+    /// Removed compatibility flag for the deleted apply_patch fallback feature.
+    ApplyPatchFreeform,
+    /// Removed compatibility flag for the deleted unavailable-tool placeholder backfill.
+    UnavailableDummyTools,
+    /// Steer feature flag - when enabled, Enter submits immediately instead of queuing.
+    /// Kept for config backward compatibility; behavior is always steer-enabled.
+    Steer,
+    /// Enable collaboration modes (Plan, Default).
+    /// Kept for config backward compatibility; behavior is always collaboration-modes-enabled.
+    CollaborationModes,
+    /// Removed compatibility flag for the deleted remote control feature.
     RemoteControl,
     /// Removed compatibility flag retained as a no-op so old wrappers can
     /// still pass `--enable image_detail_original`.
     ImageDetailOriginal,
     /// Removed compatibility flag. The TUI now always uses the app-server implementation.
     TuiAppServer,
-    /// Prevent idle system sleep while a turn is actively running.
-    PreventIdleSleep,
     /// Removed compatibility flag retained as a no-op now that workspace owner
     /// usage nudges are always enabled.
     WorkspaceOwnerUsageNudge,
@@ -240,12 +248,6 @@ pub enum Feature {
     ResponsesWebsockets,
     /// Legacy rollout flag for Responses API WebSocket transport v2 experiments.
     ResponsesWebsocketsV2,
-    /// Send `response.processed` over Responses API websockets after a turn response is recorded.
-    ResponsesWebsocketResponseProcessed,
-    /// Enable remote compaction v2 over the normal Responses API.
-    RemoteCompactionV2,
-    /// Enable workspace dependency support.
-    WorkspaceDependencies,
 }
 
 impl Feature {
@@ -286,25 +288,17 @@ pub struct Features {
 
 #[derive(Debug, Clone, Default)]
 pub struct FeatureOverrides {
-    pub include_apply_patch_tool: Option<bool>,
     pub web_search_request: Option<bool>,
 }
 
 #[derive(Debug, Clone, Copy, Default)]
 pub struct FeatureConfigSource<'a> {
     pub features: Option<&'a FeaturesToml>,
-    pub include_apply_patch_tool: Option<bool>,
-    pub experimental_use_freeform_apply_patch: Option<bool>,
     pub experimental_use_unified_exec_tool: Option<bool>,
 }
 
 impl FeatureOverrides {
     fn apply(self, features: &mut Features) {
-        LegacyFeatureToggles {
-            include_apply_patch_tool: self.include_apply_patch_tool,
-            ..Default::default()
-        }
-        .apply(features);
         if let Some(enabled) = self.web_search_request {
             if enabled {
                 features.enable(Feature::WebSearchRequest);
@@ -428,9 +422,21 @@ impl Features {
                 "js_repl_tools_only" => {
                     continue;
                 }
+                "remote_control" => {
+                    continue;
+                }
+                "apply_patch_freeform" => {
+                    continue;
+                }
+                "tool_search" => {
+                    continue;
+                }
                 "image_detail_original" => {
                     continue;
                 }
+                "skill_env_var_dependency_prompt" => {
+                    continue;
+                }
                 "use_legacy_landlock" => {
                     self.record_legacy_usage_force(
                         "features.use_legacy_landlock",
@@ -469,8 +475,6 @@ impl Features {
 
         for source in [base, profile] {
             LegacyFeatureToggles {
-                include_apply_patch_tool: source.include_apply_patch_tool,
-                experimental_use_freeform_apply_patch: source.experimental_use_freeform_apply_patch,
                 experimental_use_unified_exec_tool: source.experimental_use_unified_exec_tool,
             }
             .apply(&mut features);
@@ -784,11 +788,10 @@ pub const FEATURES: &[FeatureSpec] = &[
         stage: Stage::Removed,
         default_enabled: false,
     },
-    // Experimental program. Rendered in the `/experimental` menu for users.
     FeatureSpec {
         id: Feature::CodexGitCommit,
         key: "codex_git_commit",
-        stage: Stage::UnderDevelopment,
+        stage: Stage::Removed,
         default_enabled: false,
     },
     FeatureSpec {
@@ -828,8 +831,8 @@ pub const FEATURES: &[FeatureSpec] = &[
     FeatureSpec {
         id: Feature::ApplyPatchFreeform,
         key: "apply_patch_freeform",
-        stage: Stage::Stable,
-        default_enabled: true,
+        stage: Stage::Removed,
+        default_enabled: false,
     },
     FeatureSpec {
         id: Feature::ApplyPatchStreamingEvents,
@@ -946,8 +949,8 @@ pub const FEATURES: &[FeatureSpec] = &[
     FeatureSpec {
         id: Feature::ToolSearch,
         key: "tool_search",
-        stage: Stage::Stable,
-        default_enabled: true,
+        stage: Stage::Removed,
+        default_enabled: false,
     },
     FeatureSpec {
         id: Feature::ToolSearchAlwaysDeferMcpTools,
@@ -976,8 +979,8 @@ pub const FEATURES: &[FeatureSpec] = &[
     FeatureSpec {
         id: Feature::PluginHooks,
         key: "plugin_hooks",
-        stage: Stage::UnderDevelopment,
-        default_enabled: false,
+        stage: Stage::Stable,
+        default_enabled: true,
     },
     FeatureSpec {
         id: Feature::InAppBrowser,
@@ -1040,7 +1043,7 @@ pub const FEATURES: &[FeatureSpec] = &[
     FeatureSpec {
         id: Feature::SkillEnvVarDependencyPrompt,
         key: "skill_env_var_dependency_prompt",
-        stage: Stage::UnderDevelopment,
+        stage: Stage::Removed,
         default_enabled: false,
     },
     FeatureSpec {
diff --git a/codex-rs/features/src/tests.rs b/codex-rs/features/src/tests.rs
index 073c2064eb..e2a456f1bb 100644
--- a/codex-rs/features/src/tests.rs
+++ b/codex-rs/features/src/tests.rs
@@ -66,6 +66,16 @@ fn image_detail_original_is_removed_and_disabled_by_default() {
     assert_eq!(Feature::ImageDetailOriginal.default_enabled(), false);
 }
 
+#[test]
+fn apply_patch_freeform_is_removed_and_disabled_by_default() {
+    assert_eq!(Feature::ApplyPatchFreeform.stage(), Stage::Removed);
+    assert_eq!(Feature::ApplyPatchFreeform.default_enabled(), false);
+    assert_eq!(
+        feature_for_key("apply_patch_freeform"),
+        Some(Feature::ApplyPatchFreeform)
+    );
+}
+
 #[test]
 fn code_mode_only_requires_code_mode() {
     let mut features = Features::with_defaults();
@@ -178,9 +188,16 @@ fn network_proxy_is_experimental_and_disabled_by_default() {
 }
 
 #[test]
-fn tool_search_is_stable_and_enabled_by_default() {
-    assert_eq!(Feature::ToolSearch.stage(), Stage::Stable);
-    assert_eq!(Feature::ToolSearch.default_enabled(), true);
+fn tool_search_is_removed_and_disabled_by_default() {
+    assert_eq!(Feature::ToolSearch.stage(), Stage::Removed);
+    assert_eq!(Feature::ToolSearch.default_enabled(), false);
+    assert_eq!(feature_for_key("tool_search"), Some(Feature::ToolSearch));
+}
+
+#[test]
+fn plugin_hooks_are_stable_and_enabled_by_default() {
+    assert_eq!(Feature::PluginHooks.stage(), Stage::Stable);
+    assert_eq!(Feature::PluginHooks.default_enabled(), true);
 }
 
 #[test]
@@ -290,6 +307,21 @@ fn auth_elicitation_is_under_development() {
 fn remote_control_is_removed_and_disabled_by_default() {
     assert_eq!(Feature::RemoteControl.stage(), Stage::Removed);
     assert_eq!(Feature::RemoteControl.default_enabled(), false);
+    assert_eq!(
+        feature_for_key("remote_control"),
+        Some(Feature::RemoteControl)
+    );
+}
+
+#[test]
+fn remote_control_config_is_ignored() {
+    let mut entries = BTreeMap::new();
+    entries.insert("remote_control".to_string(), true);
+
+    let mut features = Features::with_defaults();
+    features.apply_map(&entries);
+
+    assert_eq!(features.enabled(Feature::RemoteControl), false);
 }
 
 #[test]
@@ -382,19 +414,17 @@ fn from_sources_applies_base_profile_and_overrides() {
         },
         FeatureConfigSource {
             features: Some(&profile_features),
-            include_apply_patch_tool: Some(true),
             ..Default::default()
         },
         FeatureOverrides {
             web_search_request: Some(false),
-            ..Default::default()
         },
     );
 
     assert_eq!(features.enabled(Feature::Plugins), true);
     assert_eq!(features.enabled(Feature::CodeModeOnly), true);
     assert_eq!(features.enabled(Feature::CodeMode), true);
-    assert_eq!(features.enabled(Feature::ApplyPatchFreeform), true);
+    assert_eq!(features.enabled(Feature::ApplyPatchFreeform), false);
     assert_eq!(features.enabled(Feature::WebSearchRequest), false);
 }
 
@@ -452,6 +482,23 @@ fn from_sources_ignores_removed_js_repl_feature_keys() {
     assert_eq!(features, Features::with_defaults());
 }
 
+#[test]
+fn from_sources_ignores_removed_apply_patch_freeform_feature_key() {
+    let features_toml =
+        FeaturesToml::from(BTreeMap::from([("apply_patch_freeform".to_string(), true)]));
+
+    let features = Features::from_sources(
+        FeatureConfigSource {
+            features: Some(&features_toml),
+            ..Default::default()
+        },
+        FeatureConfigSource::default(),
+        FeatureOverrides::default(),
+    );
+
+    assert_eq!(features, Features::with_defaults());
+}
+
 #[test]
 fn multi_agent_v2_feature_config_deserializes_boolean_toggle() {
     let features: FeaturesToml = toml::from_str(
@@ -476,11 +523,15 @@ fn multi_agent_v2_feature_config_deserializes_table() {
 enabled = true
 max_concurrent_threads_per_session = 4
 min_wait_timeout_ms = 2500
+max_wait_timeout_ms = 120000
+default_wait_timeout_ms = 30000
 usage_hint_enabled = false
 usage_hint_text = "Custom delegation guidance."
 root_agent_usage_hint_text = "Root guidance."
 subagent_usage_hint_text = "Subagent guidance."
+tool_namespace = "agents"
 hide_spawn_agent_metadata = true
+non_code_mode_only = true
 "#,
     )
     .expect("features table should deserialize");
@@ -495,11 +546,15 @@ hide_spawn_agent_metadata = true
             enabled: Some(true),
             max_concurrent_threads_per_session: Some(4),
             min_wait_timeout_ms: Some(2500),
+            max_wait_timeout_ms: Some(120000),
+            default_wait_timeout_ms: Some(30000),
             usage_hint_enabled: Some(false),
             usage_hint_text: Some("Custom delegation guidance.".to_string()),
             root_agent_usage_hint_text: Some("Root guidance.".to_string()),
             subagent_usage_hint_text: Some("Subagent guidance.".to_string()),
+            tool_namespace: Some("agents".to_string()),
             hide_spawn_agent_metadata: Some(true),
+            non_code_mode_only: Some(true),
         }))
     );
 }
@@ -530,11 +585,15 @@ usage_hint_enabled = false
             enabled: None,
             max_concurrent_threads_per_session: None,
             min_wait_timeout_ms: None,
+            max_wait_timeout_ms: None,
+            default_wait_timeout_ms: None,
             usage_hint_enabled: Some(false),
             usage_hint_text: None,
             root_agent_usage_hint_text: None,
             subagent_usage_hint_text: None,
+            tool_namespace: None,
             hide_spawn_agent_metadata: None,
+            non_code_mode_only: None,
         }))
     );
 }
@@ -545,7 +604,6 @@ fn materialize_resolved_enabled_writes_all_features_and_preserves_custom_config(
     features.enable(Feature::CodeMode);
     features.enable(Feature::MultiAgentV2);
     features.enable(Feature::NetworkProxy);
-    features.disable(Feature::ToolSearch);
 
     let mut features_toml = FeaturesToml {
         multi_agent_v2: Some(FeatureToml::Config(crate::MultiAgentV2ConfigToml {
@@ -558,14 +616,13 @@ fn materialize_resolved_enabled_writes_all_features_and_preserves_custom_config(
             proxy_url: Some("http://127.0.0.1:43128".to_string()),
             ..Default::default()
         })),
-        entries: BTreeMap::from([("include_apply_patch_tool".to_string(), true)]),
+        entries: BTreeMap::new(),
         ..Default::default()
     };
 
     features_toml.materialize_resolved_enabled(&features);
 
     let entries = features_toml.entries();
-    assert_eq!(entries.get("include_apply_patch_tool"), None);
     for spec in crate::FEATURES {
         assert_eq!(
             entries.get(spec.key),
@@ -598,7 +655,7 @@ fn materialize_resolved_enabled_writes_all_features_and_preserves_custom_config(
         FeatureConfigSource::default(),
         FeatureOverrides::default(),
     );
-    assert_eq!(replayed.enabled(Feature::ApplyPatchFreeform), true);
+    assert_eq!(replayed.enabled(Feature::ApplyPatchFreeform), false);
 }
 
 #[test]
diff --git a/codex-rs/feedback/src/lib.rs b/codex-rs/feedback/src/lib.rs
index 0adf864d64..9a8caf489a 100644
--- a/codex-rs/feedback/src/lib.rs
+++ b/codex-rs/feedback/src/lib.rs
@@ -27,6 +27,8 @@ pub use feedback_diagnostics::FEEDBACK_DIAGNOSTICS_ATTACHMENT_FILENAME;
 pub use feedback_diagnostics::FeedbackDiagnostic;
 pub use feedback_diagnostics::FeedbackDiagnostics;
 
+/// Filename used for the redacted `codex doctor --json` feedback attachment.
+pub const DOCTOR_REPORT_ATTACHMENT_FILENAME: &str = "codex-doctor-report.json";
 const DEFAULT_MAX_BYTES: usize = 4 * 1024 * 1024; // 4 MiB
 const SENTRY_DSN: &str =
     "https://ae32ed50620d7a7792c1ce5df38b3e3e@o33249.ingest.us.sentry.io/4510195390611458";
@@ -344,11 +346,37 @@ pub struct FeedbackAttachmentPath {
     pub attachment_filename_override: Option<String>,
 }
 
+/// In-memory attachment to include in a feedback upload.
+///
+/// Use this for generated diagnostics that should not be materialized on disk,
+/// such as the redacted doctor report. File-backed artifacts should use
+/// `FeedbackAttachmentPath` so upload-time read failures can be logged and
+/// skipped independently.
+pub struct FeedbackAttachment {
+    /// Attachment filename shown in Sentry and in the feedback consent UI.
+    pub filename: String,
+    /// Optional MIME type for consumers that render or classify attachments.
+    pub content_type: Option<String>,
+    /// Attachment bytes captured before the upload starts.
+    pub buffer: Vec<u8>,
+}
+
+/// Inputs that control one feedback upload to Sentry.
+///
+/// The caller is responsible for applying any user-consent gate before setting
+/// `include_logs` or passing diagnostic attachments. This type only describes
+/// what to upload once that decision has been made.
 pub struct FeedbackUploadOptions<'a> {
     pub classification: &'a str,
     pub reason: Option<&'a str>,
     pub tags: Option<&'a BTreeMap<String, String>>,
     pub include_logs: bool,
+    /// Generated attachments that are already buffered and safe to upload.
+    ///
+    /// These are included after `codex-logs.log` and before path-backed rollout
+    /// attachments. They are only passed by the caller after any user consent
+    /// gate has decided logs and diagnostics should be uploaded.
+    pub extra_attachments: &'a [FeedbackAttachment],
     pub extra_attachment_paths: &'a [FeedbackAttachmentPath],
     pub session_source: Option<SessionSource>,
     pub logs_override: Option<Vec<u8>>,
@@ -444,6 +472,7 @@ impl FeedbackSnapshot {
 
         for attachment in self.feedback_attachments(
             options.include_logs,
+            options.extra_attachments,
             options.extra_attachment_paths,
             options.logs_override,
         ) {
@@ -507,6 +536,7 @@ impl FeedbackSnapshot {
     fn feedback_attachments(
         &self,
         include_logs: bool,
+        extra_attachments: &[FeedbackAttachment],
         extra_attachment_paths: &[FeedbackAttachmentPath],
         logs_override: Option<Vec<u8>>,
     ) -> Vec<sentry::protocol::Attachment> {
@@ -523,6 +553,13 @@ impl FeedbackSnapshot {
             });
         }
 
+        attachments.extend(extra_attachments.iter().map(|attachment| Attachment {
+            buffer: attachment.buffer.clone(),
+            filename: attachment.filename.clone(),
+            content_type: attachment.content_type.clone(),
+            ty: None,
+        }));
+
         if let Some(text) = self.feedback_diagnostics_attachment_text(include_logs) {
             attachments.push(Attachment {
                 buffer: text.into_bytes(),
@@ -704,6 +741,11 @@ mod tests {
 
         let attachments_with_diagnostics = snapshot_with_diagnostics.feedback_attachments(
             /*include_logs*/ true,
+            &[FeedbackAttachment {
+                filename: DOCTOR_REPORT_ATTACHMENT_FILENAME.to_string(),
+                content_type: Some("application/json".to_string()),
+                buffer: b"{\"overallStatus\":\"ok\"}".to_vec(),
+            }],
             std::slice::from_ref(&extra_attachment_path),
             Some(vec![1]),
         );
@@ -715,6 +757,7 @@ mod tests {
                 .collect::<Vec<_>>(),
             vec![
                 "codex-logs.log",
+                DOCTOR_REPORT_ATTACHMENT_FILENAME,
                 FEEDBACK_DIAGNOSTICS_ATTACHMENT_FILENAME,
                 extra_filename.as_str()
             ]
@@ -722,17 +765,21 @@ mod tests {
         assert_eq!(attachments_with_diagnostics[0].buffer, vec![1]);
         assert_eq!(
             attachments_with_diagnostics[1].buffer,
+            b"{\"overallStatus\":\"ok\"}".to_vec()
+        );
+        assert_eq!(
+            attachments_with_diagnostics[2].buffer,
             b"Connectivity diagnostics\n\n- Proxy environment variables are set and may affect connectivity.\n  - HTTPS_PROXY = https://example.com:443".to_vec()
         );
-        assert_eq!(attachments_with_diagnostics[2].buffer, b"rollout".to_vec());
+        assert_eq!(attachments_with_diagnostics[3].buffer, b"rollout".to_vec());
         assert_eq!(
-            OsStr::new(attachments_with_diagnostics[2].filename.as_str()),
+            OsStr::new(attachments_with_diagnostics[3].filename.as_str()),
             OsStr::new(extra_filename.as_str())
         );
         let attachments_without_diagnostics = CodexFeedback::new()
             .snapshot(/*session_id*/ None)
             .with_feedback_diagnostics(FeedbackDiagnostics::default())
-            .feedback_attachments(/*include_logs*/ true, &[], Some(vec![1]));
+            .feedback_attachments(/*include_logs*/ true, &[], &[], Some(vec![1]));
 
         assert_eq!(
             attachments_without_diagnostics
diff --git a/codex-rs/git-utils/src/baseline.rs b/codex-rs/git-utils/src/baseline.rs
index c63b894049..083dd6010f 100644
--- a/codex-rs/git-utils/src/baseline.rs
+++ b/codex-rs/git-utils/src/baseline.rs
@@ -584,6 +584,51 @@ mod tests {
         assert_eq!(git_stdout(&root, &["ls-files"]), "MEMORY.md\n");
     }
 
+    #[cfg(unix)]
+    #[tokio::test]
+    async fn write_index_ignores_configured_hooks_path() {
+        use std::os::unix::fs::PermissionsExt;
+
+        let home = TempDir::new().expect("tempdir");
+        let root = home.path().join("repo");
+        let hooks_dir = root.join(".git/hooks-path-test");
+        let marker_path = root.join("hook-ran");
+        let hook_path = hooks_dir.join("post-index-change");
+
+        fs::create_dir_all(&root).expect("create root");
+        fs::write(root.join("MEMORY.md"), "baseline").expect("write memory");
+        reset_git_repository(&root).await.expect("reset repo");
+        fs::create_dir_all(&hooks_dir).expect("create hook dir");
+        fs::write(
+            &hook_path,
+            format!(
+                "#!/bin/sh\nprintf ran > \"{}\"\n",
+                marker_path.to_string_lossy()
+            ),
+        )
+        .expect("write post-index-change hook");
+        let mut permissions = fs::metadata(&hook_path)
+            .expect("read hook metadata")
+            .permissions();
+        permissions.set_mode(0o755);
+        fs::set_permissions(&hook_path, permissions).expect("mark hook executable");
+        git_stdout(
+            &root,
+            &[
+                "config",
+                "core.hooksPath",
+                hooks_dir.to_string_lossy().as_ref(),
+            ],
+        );
+
+        write_index_from_head(&root).expect("rewrite baseline index");
+
+        assert!(
+            !marker_path.exists(),
+            "baseline index writes should not invoke configured hook directories"
+        );
+    }
+
     #[tokio::test]
     async fn diff_reports_added_modified_and_deleted_files() {
         let home = TempDir::new().expect("tempdir");
diff --git a/codex-rs/git-utils/src/info.rs b/codex-rs/git-utils/src/info.rs
index c6656b8fa5..a188d9a876 100644
--- a/codex-rs/git-utils/src/info.rs
+++ b/codex-rs/git-utils/src/info.rs
@@ -38,8 +38,26 @@ pub fn get_git_repo_root(base_dir: &Path) -> Option<PathBuf> {
     find_ancestor_git_entry(base).map(|(repo_root, _)| repo_root)
 }
 
+/// Return the repository root for `cwd` using the provided filesystem.
+///
+/// This mirrors [`get_git_repo_root`] for local paths, but works when `cwd`
+/// only exists inside a selected remote environment.
+pub async fn get_git_repo_root_with_fs(
+    fs: &dyn ExecutorFileSystem,
+    cwd: &AbsolutePathBuf,
+) -> Option<AbsolutePathBuf> {
+    let base = match fs.get_metadata(cwd, /*sandbox*/ None).await {
+        Ok(metadata) if metadata.is_directory => cwd.clone(),
+        _ => cwd.parent()?,
+    };
+    find_ancestor_git_entry_with_fs(fs, &base)
+        .await
+        .map(|(repo_root, _)| repo_root)
+}
+
 /// Timeout for git commands to prevent freezing on large repositories
 const GIT_COMMAND_TIMEOUT: TokioDuration = TokioDuration::from_secs(5);
+const DISABLED_HOOKS_PATH: &str = if cfg!(windows) { "NUL" } else { "/dev/null" };
 
 #[derive(Serialize, Deserialize, Clone, Debug, JsonSchema, TS)]
 pub struct GitInfo {
@@ -375,6 +393,9 @@ async fn run_git_command_with_timeout(args: &[&str], cwd: &Path) -> Option<std::
     let mut command = Command::new("git");
     command
         .env("GIT_OPTIONAL_LOCKS", "0")
+        // Keep internal Git helper commands independent of configured hook directories.
+        .args(["-c", &format!("core.hooksPath={DISABLED_HOOKS_PATH}")])
+        .args(["-c", "core.fsmonitor=false"])
         .args(args)
         .current_dir(cwd)
         .kill_on_drop(true);
@@ -725,11 +746,8 @@ pub async fn resolve_root_git_project_for_trust(
     fs: &dyn ExecutorFileSystem,
     cwd: &AbsolutePathBuf,
 ) -> Option<AbsolutePathBuf> {
-    let base = match fs.get_metadata(cwd, /*sandbox*/ None).await {
-        Ok(metadata) if metadata.is_directory => cwd.clone(),
-        _ => cwd.parent()?,
-    };
-    let (repo_root, dot_git) = find_ancestor_git_entry_with_fs(fs, &base).await?;
+    let repo_root = get_git_repo_root_with_fs(fs, cwd).await?;
+    let dot_git = repo_root.join(".git");
     if fs
         .get_metadata(&dot_git, /*sandbox*/ None)
         .await
diff --git a/codex-rs/git-utils/src/lib.rs b/codex-rs/git-utils/src/lib.rs
index bcd1a8b5c9..986a7434d2 100644
--- a/codex-rs/git-utils/src/lib.rs
+++ b/codex-rs/git-utils/src/lib.rs
@@ -31,6 +31,7 @@ pub use info::default_branch_name;
 pub use info::get_git_remote_urls;
 pub use info::get_git_remote_urls_assume_git_repo;
 pub use info::get_git_repo_root;
+pub use info::get_git_repo_root_with_fs;
 pub use info::get_has_changes;
 pub use info::get_head_commit_hash;
 pub use info::git_diff_to_remote;
diff --git a/codex-rs/git-utils/src/operations.rs b/codex-rs/git-utils/src/operations.rs
index 921a5fd69d..f17ce209b0 100644
--- a/codex-rs/git-utils/src/operations.rs
+++ b/codex-rs/git-utils/src/operations.rs
@@ -6,6 +6,8 @@ use std::process::Command;
 
 use crate::GitToolingError;
 
+const DISABLED_HOOKS_PATH: &str = if cfg!(windows) { "NUL" } else { "/dev/null" };
+
 pub(crate) fn ensure_git_repository(path: &Path) -> Result<(), GitToolingError> {
     match run_git_for_stdout(
         path,
@@ -98,7 +100,12 @@ where
 {
     let iterator = args.into_iter();
     let (lower, upper) = iterator.size_hint();
-    let mut args_vec = Vec::with_capacity(upper.unwrap_or(lower));
+    let mut args_vec = Vec::with_capacity(upper.unwrap_or(lower) + 2);
+    // Keep internal Git helper commands independent of configured hook directories.
+    args_vec.push(OsString::from("-c"));
+    args_vec.push(OsString::from(format!(
+        "core.hooksPath={DISABLED_HOOKS_PATH}"
+    )));
     for arg in iterator {
         args_vec.push(OsString::from(arg.as_ref()));
     }
diff --git a/codex-rs/hooks/schema/generated/permission-request.command.output.schema.json b/codex-rs/hooks/schema/generated/permission-request.command.output.schema.json
index c89f80a3b0..44e775a03d 100644
--- a/codex-rs/hooks/schema/generated/permission-request.command.output.schema.json
+++ b/codex-rs/hooks/schema/generated/permission-request.command.output.schema.json
@@ -11,6 +11,7 @@
         "PostCompact",
         "SessionStart",
         "UserPromptSubmit",
+        "SubagentStart",
         "Stop"
       ],
       "type": "string"
diff --git a/codex-rs/hooks/schema/generated/post-tool-use.command.output.schema.json b/codex-rs/hooks/schema/generated/post-tool-use.command.output.schema.json
index 2b64c0ad00..b762c549c5 100644
--- a/codex-rs/hooks/schema/generated/post-tool-use.command.output.schema.json
+++ b/codex-rs/hooks/schema/generated/post-tool-use.command.output.schema.json
@@ -17,6 +17,7 @@
         "PostCompact",
         "SessionStart",
         "UserPromptSubmit",
+        "SubagentStart",
         "Stop"
       ],
       "type": "string"
diff --git a/codex-rs/hooks/schema/generated/pre-tool-use.command.output.schema.json b/codex-rs/hooks/schema/generated/pre-tool-use.command.output.schema.json
index 3ab17b9f5c..c4c4132448 100644
--- a/codex-rs/hooks/schema/generated/pre-tool-use.command.output.schema.json
+++ b/codex-rs/hooks/schema/generated/pre-tool-use.command.output.schema.json
@@ -11,6 +11,7 @@
         "PostCompact",
         "SessionStart",
         "UserPromptSubmit",
+        "SubagentStart",
         "Stop"
       ],
       "type": "string"
diff --git a/codex-rs/hooks/schema/generated/session-start.command.output.schema.json b/codex-rs/hooks/schema/generated/session-start.command.output.schema.json
index 4d6ba033fe..d8a0f46482 100644
--- a/codex-rs/hooks/schema/generated/session-start.command.output.schema.json
+++ b/codex-rs/hooks/schema/generated/session-start.command.output.schema.json
@@ -11,6 +11,7 @@
         "PostCompact",
         "SessionStart",
         "UserPromptSubmit",
+        "SubagentStart",
         "Stop"
       ],
       "type": "string"
diff --git a/codex-rs/hooks/schema/generated/subagent-start.command.input.schema.json b/codex-rs/hooks/schema/generated/subagent-start.command.input.schema.json
new file mode 100644
index 0000000000..2f6edd6038
--- /dev/null
+++ b/codex-rs/hooks/schema/generated/subagent-start.command.input.schema.json
@@ -0,0 +1,63 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "additionalProperties": false,
+  "definitions": {
+    "NullableString": {
+      "type": [
+        "string",
+        "null"
+      ]
+    }
+  },
+  "properties": {
+    "agent_id": {
+      "type": "string"
+    },
+    "agent_type": {
+      "type": "string"
+    },
+    "cwd": {
+      "type": "string"
+    },
+    "hook_event_name": {
+      "const": "SubagentStart",
+      "type": "string"
+    },
+    "model": {
+      "type": "string"
+    },
+    "permission_mode": {
+      "enum": [
+        "default",
+        "acceptEdits",
+        "plan",
+        "dontAsk",
+        "bypassPermissions"
+      ],
+      "type": "string"
+    },
+    "session_id": {
+      "type": "string"
+    },
+    "transcript_path": {
+      "$ref": "#/definitions/NullableString"
+    },
+    "turn_id": {
+      "description": "Codex extension: expose the active turn id to internal turn-scoped hooks.",
+      "type": "string"
+    }
+  },
+  "required": [
+    "agent_id",
+    "agent_type",
+    "cwd",
+    "hook_event_name",
+    "model",
+    "permission_mode",
+    "session_id",
+    "transcript_path",
+    "turn_id"
+  ],
+  "title": "subagent-start.command.input",
+  "type": "object"
+}
\ No newline at end of file
diff --git a/codex-rs/hooks/schema/generated/subagent-start.command.output.schema.json b/codex-rs/hooks/schema/generated/subagent-start.command.output.schema.json
new file mode 100644
index 0000000000..16140f326b
--- /dev/null
+++ b/codex-rs/hooks/schema/generated/subagent-start.command.output.schema.json
@@ -0,0 +1,64 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "additionalProperties": false,
+  "definitions": {
+    "HookEventNameWire": {
+      "enum": [
+        "PreToolUse",
+        "PermissionRequest",
+        "PostToolUse",
+        "PreCompact",
+        "PostCompact",
+        "SessionStart",
+        "UserPromptSubmit",
+        "SubagentStart",
+        "Stop"
+      ],
+      "type": "string"
+    },
+    "SessionStartHookSpecificOutputWire": {
+      "additionalProperties": false,
+      "properties": {
+        "additionalContext": {
+          "default": null,
+          "type": "string"
+        },
+        "hookEventName": {
+          "$ref": "#/definitions/HookEventNameWire"
+        }
+      },
+      "required": [
+        "hookEventName"
+      ],
+      "type": "object"
+    }
+  },
+  "properties": {
+    "continue": {
+      "default": true,
+      "type": "boolean"
+    },
+    "hookSpecificOutput": {
+      "allOf": [
+        {
+          "$ref": "#/definitions/SessionStartHookSpecificOutputWire"
+        }
+      ],
+      "default": null
+    },
+    "stopReason": {
+      "default": null,
+      "type": "string"
+    },
+    "suppressOutput": {
+      "default": false,
+      "type": "boolean"
+    },
+    "systemMessage": {
+      "default": null,
+      "type": "string"
+    }
+  },
+  "title": "subagent-start.command.output",
+  "type": "object"
+}
\ No newline at end of file
diff --git a/codex-rs/hooks/schema/generated/user-prompt-submit.command.output.schema.json b/codex-rs/hooks/schema/generated/user-prompt-submit.command.output.schema.json
index 6baceb149f..d4d66d2976 100644
--- a/codex-rs/hooks/schema/generated/user-prompt-submit.command.output.schema.json
+++ b/codex-rs/hooks/schema/generated/user-prompt-submit.command.output.schema.json
@@ -17,6 +17,7 @@
         "PostCompact",
         "SessionStart",
         "UserPromptSubmit",
+        "SubagentStart",
         "Stop"
       ],
       "type": "string"
diff --git a/codex-rs/hooks/src/config_rules.rs b/codex-rs/hooks/src/config_rules.rs
index 3f9c48df2b..2935cabc80 100644
--- a/codex-rs/hooks/src/config_rules.rs
+++ b/codex-rs/hooks/src/config_rules.rs
@@ -87,6 +87,7 @@ mod tests {
                 ConfigLayerEntry::new(
                     ConfigLayerSource::User {
                         file: test_path_buf("/tmp/config.toml").abs(),
+                        profile: None,
                     },
                     config_with_hook_override(key, Some(/*enabled*/ false)),
                 ),
@@ -120,6 +121,7 @@ mod tests {
                 ConfigLayerEntry::new(
                     ConfigLayerSource::User {
                         file: test_path_buf("/tmp/config.toml").abs(),
+                        profile: None,
                     },
                     config_with_hook_state(
                         key,
@@ -175,6 +177,7 @@ mod tests {
             vec![ConfigLayerEntry::new(
                 ConfigLayerSource::User {
                     file: test_path_buf("/tmp/config.toml").abs(),
+                    profile: None,
                 },
                 config,
             )],
@@ -215,6 +218,7 @@ mod tests {
             vec![ConfigLayerEntry::new(
                 ConfigLayerSource::User {
                     file: test_path_buf("/tmp/config.toml").abs(),
+                    profile: None,
                 },
                 config,
             )],
diff --git a/codex-rs/hooks/src/engine/discovery.rs b/codex-rs/hooks/src/engine/discovery.rs
index bd831ae966..b708f562bc 100644
--- a/codex-rs/hooks/src/engine/discovery.rs
+++ b/codex-rs/hooks/src/engine/discovery.rs
@@ -353,7 +353,7 @@ fn load_toml_hooks_from_layer(
 fn config_toml_source_path(layer: &ConfigLayerEntry) -> AbsolutePathBuf {
     match &layer.name {
         ConfigLayerSource::System { file }
-        | ConfigLayerSource::User { file }
+        | ConfigLayerSource::User { file, .. }
         | ConfigLayerSource::LegacyManagedConfigTomlFromFile { file } => file.clone(),
         ConfigLayerSource::Project { dot_codex_folder } => layer
             .hooks_config_folder()
@@ -989,6 +989,7 @@ mod tests {
         let layer = ConfigLayerEntry::new(
             ConfigLayerSource::User {
                 file: test_path_buf("/tmp/config.toml").abs(),
+                profile: None,
             },
             config_with_malformed_state_and_session_start_hook(),
         );
@@ -1090,6 +1091,7 @@ mod tests {
         assert_eq!(
             super::hook_metadata_for_config_layer_source(&ConfigLayerSource::User {
                 file: config_file.clone(),
+                profile: None,
             }),
             (HookSource::User, false),
         );
diff --git a/codex-rs/hooks/src/engine/dispatcher.rs b/codex-rs/hooks/src/engine/dispatcher.rs
index ac40c1b931..c96d3ad5e3 100644
--- a/codex-rs/hooks/src/engine/dispatcher.rs
+++ b/codex-rs/hooks/src/engine/dispatcher.rs
@@ -49,6 +49,7 @@ pub(crate) fn select_handlers_for_matcher_inputs(
             | HookEventName::PermissionRequest
             | HookEventName::PostToolUse
             | HookEventName::SessionStart
+            | HookEventName::SubagentStart
             | HookEventName::PreCompact
             | HookEventName::PostCompact => {
                 if matcher_inputs.is_empty() {
@@ -141,7 +142,7 @@ pub(crate) fn completed_summary(
 
 fn scope_for_event(event_name: HookEventName) -> HookScope {
     match event_name {
-        HookEventName::SessionStart => HookScope::Thread,
+        HookEventName::SessionStart | HookEventName::SubagentStart => HookScope::Thread,
         HookEventName::PreToolUse
         | HookEventName::PermissionRequest
         | HookEventName::PostToolUse
diff --git a/codex-rs/hooks/src/engine/mod.rs b/codex-rs/hooks/src/engine/mod.rs
index 401e8e1fa9..76dd71b57a 100644
--- a/codex-rs/hooks/src/engine/mod.rs
+++ b/codex-rs/hooks/src/engine/mod.rs
@@ -4,8 +4,6 @@ pub(crate) mod dispatcher;
 pub(crate) mod output_parser;
 pub(crate) mod schema_loader;
 
-use std::collections::HashMap;
-
 use crate::events::compact::PostCompactRequest;
 use crate::events::compact::PreCompactOutcome;
 use crate::events::compact::PreCompactRequest;
@@ -33,6 +31,7 @@ use codex_protocol::protocol::HookSource;
 use codex_protocol::protocol::HookTrustStatus;
 use codex_protocol::protocol::HookVisibilityHint;
 use codex_utils_absolute_path::AbsolutePathBuf;
+use std::collections::HashMap;
 
 #[derive(Debug, Clone)]
 pub(crate) struct CommandShell {
@@ -73,6 +72,7 @@ impl ConfiguredHandler {
             codex_protocol::protocol::HookEventName::PostCompact => "post-compact",
             codex_protocol::protocol::HookEventName::SessionStart => "session-start",
             codex_protocol::protocol::HookEventName::UserPromptSubmit => "user-prompt-submit",
+            codex_protocol::protocol::HookEventName::SubagentStart => "subagent-start",
             codex_protocol::protocol::HookEventName::Stop => "stop",
         }
     }
@@ -182,7 +182,13 @@ impl ClaudeHooksEngine {
     }
 
     pub(crate) async fn run_pre_tool_use(&self, request: PreToolUseRequest) -> PreToolUseOutcome {
-        crate::events::pre_tool_use::run(&self.handlers, &self.shell, request).await
+        let session_id = request.session_id;
+        let mut outcome =
+            crate::events::pre_tool_use::run(&self.handlers, &self.shell, request).await;
+        outcome.additional_contexts = self
+            .maybe_spill_texts(session_id, outcome.additional_contexts)
+            .await;
+        outcome
     }
 
     pub(crate) async fn run_permission_request(
diff --git a/codex-rs/hooks/src/engine/mod_tests.rs b/codex-rs/hooks/src/engine/mod_tests.rs
index d65d82c174..dffcce2a76 100644
--- a/codex-rs/hooks/src/engine/mod_tests.rs
+++ b/codex-rs/hooks/src/engine/mod_tests.rs
@@ -446,7 +446,10 @@ fn user_disablement_filters_non_managed_hooks_but_not_managed_hooks() {
     );
     let config_layer_stack = ConfigLayerStack::new(
         vec![ConfigLayerEntry::new(
-            ConfigLayerSource::User { file: config_path },
+            ConfigLayerSource::User {
+                file: config_path,
+                profile: None,
+            },
             user_config,
         )],
         ConfigRequirements {
@@ -510,6 +513,7 @@ fn user_disablement_does_not_filter_managed_layer_hooks() {
             ConfigLayerEntry::new(
                 ConfigLayerSource::User {
                     file: user_config_path,
+                    profile: None,
                 },
                 config_with_hook_state(&managed_key, /*enabled*/ false),
             ),
@@ -638,7 +642,10 @@ fn trusted_plugin_hook_stack(
 
     ConfigLayerStack::new(
         vec![ConfigLayerEntry::new(
-            ConfigLayerSource::User { file: config_path },
+            ConfigLayerSource::User {
+                file: config_path,
+                profile: None,
+            },
             config,
         )],
         ConfigRequirements::default(),
@@ -728,7 +735,10 @@ fn allow_managed_hooks_only_false_keeps_unmanaged_hooks() {
     );
     let config_layer_stack = ConfigLayerStack::new(
         vec![ConfigLayerEntry::new(
-            ConfigLayerSource::User { file: config_path },
+            ConfigLayerSource::User {
+                file: config_path,
+                profile: None,
+            },
             config_toml_with_pre_tool_use("python3 /tmp/user-hook.py"),
         )],
         requirements,
@@ -779,7 +789,10 @@ fn allow_managed_hooks_only_in_config_toml_does_not_enable_policy() {
     );
     let config_layer_stack = ConfigLayerStack::new(
         vec![ConfigLayerEntry::new(
-            ConfigLayerSource::User { file: config_path },
+            ConfigLayerSource::User {
+                file: config_path,
+                profile: None,
+            },
             config_toml,
         )],
         ConfigRequirements::default(),
@@ -846,7 +859,10 @@ fn allow_managed_hooks_only_skips_unmanaged_json_and_toml_hooks() {
     );
     let config_layer_stack = ConfigLayerStack::new(
         vec![ConfigLayerEntry::new(
-            ConfigLayerSource::User { file: config_path },
+            ConfigLayerSource::User {
+                file: config_path,
+                profile: None,
+            },
             config_toml_with_pre_tool_use("python3 /tmp/toml-hook.py"),
         )],
         requirements,
diff --git a/codex-rs/hooks/src/engine/output_parser.rs b/codex-rs/hooks/src/engine/output_parser.rs
index 48ad1aff2d..1ea44c0903 100644
--- a/codex-rs/hooks/src/engine/output_parser.rs
+++ b/codex-rs/hooks/src/engine/output_parser.rs
@@ -86,17 +86,34 @@ use crate::schema::PreToolUseDecisionWire;
 use crate::schema::PreToolUsePermissionDecisionWire;
 use crate::schema::SessionStartCommandOutputWire;
 use crate::schema::StopCommandOutputWire;
+use crate::schema::SubagentStartCommandOutputWire;
 use crate::schema::UserPromptSubmitCommandOutputWire;
 
 pub(crate) fn parse_session_start(stdout: &str) -> Option<SessionStartOutput> {
     let wire: SessionStartCommandOutputWire = parse_json(stdout)?;
-    let additional_context = wire
-        .hook_specific_output
-        .and_then(|output| output.additional_context);
-    Some(SessionStartOutput {
-        universal: UniversalOutput::from(wire.universal),
+    Some(session_start_output(
+        wire.universal,
+        wire.hook_specific_output,
+    ))
+}
+
+pub(crate) fn parse_subagent_start(stdout: &str) -> Option<SessionStartOutput> {
+    let wire: SubagentStartCommandOutputWire = parse_json(stdout)?;
+    Some(session_start_output(
+        wire.universal,
+        wire.hook_specific_output,
+    ))
+}
+
+fn session_start_output(
+    universal: HookUniversalOutputWire,
+    hook_specific_output: Option<crate::schema::SessionStartHookSpecificOutputWire>,
+) -> SessionStartOutput {
+    let additional_context = hook_specific_output.and_then(|output| output.additional_context);
+    SessionStartOutput {
+        universal: UniversalOutput::from(universal),
         additional_context,
-    })
+    }
 }
 
 pub(crate) fn parse_pre_tool_use(stdout: &str) -> Option<PreToolUseOutput> {
diff --git a/codex-rs/hooks/src/engine/schema_loader.rs b/codex-rs/hooks/src/engine/schema_loader.rs
index 704edea4ba..2b1994f28d 100644
--- a/codex-rs/hooks/src/engine/schema_loader.rs
+++ b/codex-rs/hooks/src/engine/schema_loader.rs
@@ -16,6 +16,8 @@ pub(crate) struct GeneratedHookSchemas {
     pub pre_compact_command_output: Value,
     pub session_start_command_input: Value,
     pub session_start_command_output: Value,
+    pub subagent_start_command_input: Value,
+    pub subagent_start_command_output: Value,
     pub user_prompt_submit_command_input: Value,
     pub user_prompt_submit_command_output: Value,
     pub stop_command_input: Value,
@@ -73,6 +75,14 @@ pub(crate) fn generated_hook_schemas() -> &'static GeneratedHookSchemas {
             "session-start.command.output",
             include_str!("../../schema/generated/session-start.command.output.schema.json"),
         ),
+        subagent_start_command_input: parse_json_schema(
+            "subagent-start.command.input",
+            include_str!("../../schema/generated/subagent-start.command.input.schema.json"),
+        ),
+        subagent_start_command_output: parse_json_schema(
+            "subagent-start.command.output",
+            include_str!("../../schema/generated/subagent-start.command.output.schema.json"),
+        ),
         user_prompt_submit_command_input: parse_json_schema(
             "user-prompt-submit.command.input",
             include_str!("../../schema/generated/user-prompt-submit.command.input.schema.json"),
@@ -118,6 +128,8 @@ mod tests {
         assert_eq!(schemas.pre_compact_command_output["type"], "object");
         assert_eq!(schemas.session_start_command_input["type"], "object");
         assert_eq!(schemas.session_start_command_output["type"], "object");
+        assert_eq!(schemas.subagent_start_command_input["type"], "object");
+        assert_eq!(schemas.subagent_start_command_output["type"], "object");
         assert_eq!(schemas.user_prompt_submit_command_input["type"], "object");
         assert_eq!(schemas.user_prompt_submit_command_output["type"], "object");
         assert_eq!(schemas.stop_command_input["type"], "object");
diff --git a/codex-rs/hooks/src/events/common.rs b/codex-rs/hooks/src/events/common.rs
index e79a139b79..f96de58020 100644
--- a/codex-rs/hooks/src/events/common.rs
+++ b/codex-rs/hooks/src/events/common.rs
@@ -104,6 +104,7 @@ pub(crate) fn matcher_pattern_for_event(
         | HookEventName::PermissionRequest
         | HookEventName::PostToolUse
         | HookEventName::SessionStart
+        | HookEventName::SubagentStart
         | HookEventName::PreCompact
         | HookEventName::PostCompact => matcher,
         HookEventName::UserPromptSubmit | HookEventName::Stop => None,
diff --git a/codex-rs/hooks/src/events/session_start.rs b/codex-rs/hooks/src/events/session_start.rs
index f8f8b08693..62a6fd7b42 100644
--- a/codex-rs/hooks/src/events/session_start.rs
+++ b/codex-rs/hooks/src/events/session_start.rs
@@ -15,7 +15,9 @@ use crate::engine::ConfiguredHandler;
 use crate::engine::command_runner::CommandRunResult;
 use crate::engine::dispatcher;
 use crate::engine::output_parser;
+use crate::schema::NullableString;
 use crate::schema::SessionStartCommandInput;
+use crate::schema::SubagentStartCommandInput;
 
 #[derive(Debug, Clone, Copy)]
 pub enum SessionStartSource {
@@ -41,7 +43,35 @@ pub struct SessionStartRequest {
     pub transcript_path: Option<PathBuf>,
     pub model: String,
     pub permission_mode: String,
-    pub source: SessionStartSource,
+    pub target: StartHookTarget,
+}
+
+#[derive(Debug, Clone)]
+pub enum StartHookTarget {
+    SessionStart {
+        source: SessionStartSource,
+    },
+    SubagentStart {
+        turn_id: String,
+        agent_id: String,
+        agent_type: String,
+    },
+}
+
+impl StartHookTarget {
+    fn event_name(&self) -> HookEventName {
+        match self {
+            Self::SessionStart { .. } => HookEventName::SessionStart,
+            Self::SubagentStart { .. } => HookEventName::SubagentStart,
+        }
+    }
+
+    fn matcher_input(&self) -> &str {
+        match self {
+            Self::SessionStart { source } => source.as_str(),
+            Self::SubagentStart { agent_type, .. } => agent_type.as_str(),
+        }
+    }
 }
 
 #[derive(Debug)]
@@ -65,8 +95,8 @@ pub(crate) fn preview(
 ) -> Vec<HookRunSummary> {
     dispatcher::select_handlers(
         handlers,
-        HookEventName::SessionStart,
-        Some(request.source.as_str()),
+        request.target.event_name(),
+        Some(request.target.matcher_input()),
     )
     .into_iter()
     .map(|handler| dispatcher::running_summary(&handler))
@@ -81,8 +111,8 @@ pub(crate) async fn run(
 ) -> SessionStartOutcome {
     let matched = dispatcher::select_handlers(
         handlers,
-        HookEventName::SessionStart,
-        Some(request.source.as_str()),
+        request.target.event_name(),
+        Some(request.target.matcher_input()),
     );
     if matched.is_empty() {
         return SessionStartOutcome {
@@ -93,21 +123,58 @@ pub(crate) async fn run(
         };
     }
 
-    let input_json = match serde_json::to_string(&SessionStartCommandInput::new(
-        request.session_id.to_string(),
-        request.transcript_path.clone(),
-        request.cwd.display().to_string(),
-        request.model.clone(),
-        request.permission_mode.clone(),
-        request.source.as_str().to_string(),
-    )) {
-        Ok(input_json) => input_json,
-        Err(error) => {
-            return serialization_failure_outcome(common::serialization_failure_hook_events(
-                matched,
-                turn_id,
-                format!("failed to serialize session start hook input: {error}"),
-            ));
+    let (input_json, turn_id) = match request.target {
+        StartHookTarget::SessionStart { source } => {
+            let input_json = match serde_json::to_string(&SessionStartCommandInput::new(
+                request.session_id.to_string(),
+                request.transcript_path.clone(),
+                request.cwd.display().to_string(),
+                request.model.clone(),
+                request.permission_mode.clone(),
+                source.as_str().to_string(),
+            )) {
+                Ok(input_json) => input_json,
+                Err(error) => {
+                    return serialization_failure_outcome(
+                        common::serialization_failure_hook_events(
+                            matched,
+                            turn_id,
+                            format!("failed to serialize session start hook input: {error}"),
+                        ),
+                    );
+                }
+            };
+            (input_json, turn_id)
+        }
+        StartHookTarget::SubagentStart {
+            turn_id: subagent_turn_id,
+            agent_id,
+            agent_type,
+        } => {
+            let input = SubagentStartCommandInput {
+                session_id: request.session_id.to_string(),
+                turn_id: subagent_turn_id.clone(),
+                transcript_path: NullableString::from_path(request.transcript_path.clone()),
+                cwd: request.cwd.display().to_string(),
+                hook_event_name: "SubagentStart".to_string(),
+                model: request.model.clone(),
+                permission_mode: request.permission_mode.clone(),
+                agent_id,
+                agent_type,
+            };
+            let input_json = match serde_json::to_string(&input) {
+                Ok(input_json) => input_json,
+                Err(error) => {
+                    return serialization_failure_outcome(
+                        common::serialization_failure_hook_events(
+                            matched,
+                            Some(subagent_turn_id),
+                            format!("failed to serialize subagent start hook input: {error}"),
+                        ),
+                    );
+                }
+            };
+            (input_json, Some(subagent_turn_id))
         }
     };
 
@@ -139,6 +206,12 @@ pub(crate) async fn run(
     }
 }
 
+/// Interprets completed `SessionStart` and `SubagentStart` hook runs.
+///
+/// The two events have different input payloads but share most output
+/// handling: hook JSON can emit warnings/context, invalid JSON-looking stdout
+/// fails, and plain stdout becomes model context. Only `SessionStart` honors
+/// `continue:false`; `SubagentStart` stays context-injection-only.
 fn parse_completed(
     handler: &ConfiguredHandler,
     run_result: CommandRunResult,
@@ -162,8 +235,17 @@ fn parse_completed(
             Some(0) => {
                 let trimmed_stdout = run_result.stdout.trim();
                 if trimmed_stdout.is_empty() {
-                } else if let Some(parsed) = output_parser::parse_session_start(&run_result.stdout)
-                {
+                } else if let Some(parsed) = match handler.event_name {
+                    HookEventName::SessionStart => {
+                        output_parser::parse_session_start(&run_result.stdout)
+                    }
+                    HookEventName::SubagentStart => {
+                        output_parser::parse_subagent_start(&run_result.stdout)
+                    }
+                    event_name => {
+                        panic!("expected start hook event, got {event_name:?}")
+                    }
+                } {
                     if let Some(system_message) = parsed.universal.system_message {
                         entries.push(HookOutputEntry {
                             kind: HookOutputEntryKind::Warning,
@@ -178,7 +260,9 @@ fn parse_completed(
                         );
                     }
                     let _ = parsed.universal.suppress_output;
-                    if !parsed.universal.continue_processing {
+                    if handler.event_name == HookEventName::SessionStart
+                        && !parsed.universal.continue_processing
+                    {
                         status = HookRunStatus::Stopped;
                         should_stop = true;
                         stop_reason = parsed.universal.stop_reason.clone();
@@ -189,12 +273,22 @@ fn parse_completed(
                             });
                         }
                     }
-                // Preserve plain-text context support without treating malformed JSON as context.
                 } else if output_parser::looks_like_json(&run_result.stdout) {
                     status = HookRunStatus::Failed;
                     entries.push(HookOutputEntry {
                         kind: HookOutputEntryKind::Error,
-                        text: "hook returned invalid session start JSON output".to_string(),
+                        text: match handler.event_name {
+                            HookEventName::SessionStart => {
+                                "hook returned invalid session start JSON output"
+                            }
+                            HookEventName::SubagentStart => {
+                                "hook returned invalid subagent start JSON output"
+                            }
+                            event_name => {
+                                panic!("expected start hook event, got {event_name:?}")
+                            }
+                        }
+                        .to_string(),
                     });
                 } else {
                     let additional_context = trimmed_stdout.to_string();
@@ -354,9 +448,71 @@ mod tests {
         );
     }
 
+    #[test]
+    fn subagent_start_plain_stdout_becomes_model_context() {
+        let parsed = parse_completed(
+            &handler_for(HookEventName::SubagentStart),
+            run_result(Some(0), "hello from subagent hook\n", ""),
+            /*turn_id*/ Some("turn-1".to_string()),
+        );
+
+        assert_eq!(
+            parsed.data,
+            SessionStartHandlerData {
+                should_stop: false,
+                stop_reason: None,
+                additional_contexts_for_model: vec!["hello from subagent hook".to_string()],
+            }
+        );
+        assert_eq!(parsed.completed.turn_id.as_deref(), Some("turn-1"));
+        assert_eq!(parsed.completed.run.status, HookRunStatus::Completed);
+        assert_eq!(
+            parsed.completed.run.entries,
+            vec![HookOutputEntry {
+                kind: HookOutputEntryKind::Context,
+                text: "hello from subagent hook".to_string(),
+            }]
+        );
+    }
+
+    #[test]
+    fn subagent_start_continue_false_is_ignored() {
+        let parsed = parse_completed(
+            &handler_for(HookEventName::SubagentStart),
+            run_result(
+                Some(0),
+                r#"{"continue":false,"stopReason":"skip child","hookSpecificOutput":{"hookEventName":"SubagentStart","additionalContext":"child context"}}"#,
+                "",
+            ),
+            /*turn_id*/ Some("turn-1".to_string()),
+        );
+
+        assert_eq!(
+            parsed.data,
+            SessionStartHandlerData {
+                should_stop: false,
+                stop_reason: None,
+                additional_contexts_for_model: vec!["child context".to_string()],
+            }
+        );
+        assert_eq!(parsed.completed.turn_id.as_deref(), Some("turn-1"));
+        assert_eq!(parsed.completed.run.status, HookRunStatus::Completed);
+        assert_eq!(
+            parsed.completed.run.entries,
+            vec![HookOutputEntry {
+                kind: HookOutputEntryKind::Context,
+                text: "child context".to_string(),
+            }]
+        );
+    }
+
     fn handler() -> ConfiguredHandler {
+        handler_for(HookEventName::SessionStart)
+    }
+
+    fn handler_for(event_name: HookEventName) -> ConfiguredHandler {
         ConfiguredHandler {
-            event_name: HookEventName::SessionStart,
+            event_name,
             matcher: None,
             command: "echo hook".to_string(),
             timeout_sec: 600,
diff --git a/codex-rs/hooks/src/lib.rs b/codex-rs/hooks/src/lib.rs
index ec59368d30..5675d11e71 100644
--- a/codex-rs/hooks/src/lib.rs
+++ b/codex-rs/hooks/src/lib.rs
@@ -15,7 +15,7 @@ pub use declarations::PluginHookDeclaration;
 pub use declarations::plugin_hook_declarations;
 pub use engine::HookListEntry;
 /// Hook event names as they appear in hooks JSON and config files.
-pub const HOOK_EVENT_NAMES: [&str; 8] = [
+pub const HOOK_EVENT_NAMES: [&str; 9] = [
     "PreToolUse",
     "PermissionRequest",
     "PostToolUse",
@@ -23,6 +23,7 @@ pub const HOOK_EVENT_NAMES: [&str; 8] = [
     "PostCompact",
     "SessionStart",
     "UserPromptSubmit",
+    "SubagentStart",
     "Stop",
 ];
 
@@ -31,13 +32,14 @@ pub const HOOK_EVENT_NAMES: [&str; 8] = [
 /// Other events can appear in hooks JSON, but Codex ignores their matcher
 /// fields because those events do not dispatch against a tool, compaction
 /// trigger, or session-start source.
-pub const HOOK_EVENT_NAMES_WITH_MATCHERS: [&str; 6] = [
+pub const HOOK_EVENT_NAMES_WITH_MATCHERS: [&str; 7] = [
     "PreToolUse",
     "PermissionRequest",
     "PostToolUse",
     "PreCompact",
     "PostCompact",
     "SessionStart",
+    "SubagentStart",
 ];
 
 pub use events::compact::PostCompactRequest;
@@ -54,6 +56,7 @@ pub use events::pre_tool_use::PreToolUseRequest;
 pub use events::session_start::SessionStartOutcome;
 pub use events::session_start::SessionStartRequest;
 pub use events::session_start::SessionStartSource;
+pub use events::session_start::StartHookTarget;
 pub use events::stop::StopOutcome;
 pub use events::stop::StopRequest;
 pub use events::user_prompt_submit::UserPromptSubmitOutcome;
@@ -83,6 +86,7 @@ pub fn hook_event_key_label(event_name: HookEventName) -> &'static str {
         HookEventName::PostCompact => "post_compact",
         HookEventName::SessionStart => "session_start",
         HookEventName::UserPromptSubmit => "user_prompt_submit",
+        HookEventName::SubagentStart => "subagent_start",
         HookEventName::Stop => "stop",
     }
 }
diff --git a/codex-rs/hooks/src/schema.rs b/codex-rs/hooks/src/schema.rs
index d4f408d8c3..96d5f790be 100644
--- a/codex-rs/hooks/src/schema.rs
+++ b/codex-rs/hooks/src/schema.rs
@@ -27,6 +27,8 @@ const SESSION_START_INPUT_FIXTURE: &str = "session-start.command.input.schema.js
 const SESSION_START_OUTPUT_FIXTURE: &str = "session-start.command.output.schema.json";
 const USER_PROMPT_SUBMIT_INPUT_FIXTURE: &str = "user-prompt-submit.command.input.schema.json";
 const USER_PROMPT_SUBMIT_OUTPUT_FIXTURE: &str = "user-prompt-submit.command.output.schema.json";
+const SUBAGENT_START_INPUT_FIXTURE: &str = "subagent-start.command.input.schema.json";
+const SUBAGENT_START_OUTPUT_FIXTURE: &str = "subagent-start.command.output.schema.json";
 const STOP_INPUT_FIXTURE: &str = "stop.command.input.schema.json";
 const STOP_OUTPUT_FIXTURE: &str = "stop.command.output.schema.json";
 
@@ -87,6 +89,8 @@ pub(crate) enum HookEventNameWire {
     SessionStart,
     #[serde(rename = "UserPromptSubmit")]
     UserPromptSubmit,
+    #[serde(rename = "SubagentStart")]
+    SubagentStart,
     #[serde(rename = "Stop")]
     Stop,
 }
@@ -345,6 +349,17 @@ pub(crate) struct SessionStartHookSpecificOutputWire {
     pub additional_context: Option<String>,
 }
 
+#[derive(Debug, Clone, Serialize, Deserialize, JsonSchema)]
+#[serde(rename_all = "camelCase")]
+#[serde(deny_unknown_fields)]
+#[schemars(rename = "subagent-start.command.output")]
+pub(crate) struct SubagentStartCommandOutputWire {
+    #[serde(flatten)]
+    pub universal: HookUniversalOutputWire,
+    #[serde(default)]
+    pub hook_specific_output: Option<SessionStartHookSpecificOutputWire>,
+}
+
 #[derive(Debug, Clone, Serialize, Deserialize, JsonSchema)]
 #[serde(rename_all = "camelCase")]
 #[serde(deny_unknown_fields)]
@@ -427,6 +442,24 @@ impl SessionStartCommandInput {
     }
 }
 
+#[derive(Debug, Clone, Serialize, JsonSchema)]
+#[serde(deny_unknown_fields)]
+#[schemars(rename = "subagent-start.command.input")]
+pub(crate) struct SubagentStartCommandInput {
+    pub session_id: String,
+    /// Codex extension: expose the active turn id to internal turn-scoped hooks.
+    pub turn_id: String,
+    pub transcript_path: NullableString,
+    pub cwd: String,
+    #[schemars(schema_with = "subagent_start_hook_event_name_schema")]
+    pub hook_event_name: String,
+    pub model: String,
+    #[schemars(schema_with = "permission_mode_schema")]
+    pub permission_mode: String,
+    pub agent_id: String,
+    pub agent_type: String,
+}
+
 #[derive(Debug, Clone, Serialize, JsonSchema)]
 #[serde(deny_unknown_fields)]
 #[schemars(rename = "user-prompt-submit.command.input")]
@@ -522,6 +555,14 @@ pub fn write_schema_fixtures(schema_root: &Path) -> anyhow::Result<()> {
         &generated_dir.join(USER_PROMPT_SUBMIT_OUTPUT_FIXTURE),
         schema_json::<UserPromptSubmitCommandOutputWire>()?,
     )?;
+    write_schema(
+        &generated_dir.join(SUBAGENT_START_INPUT_FIXTURE),
+        schema_json::<SubagentStartCommandInput>()?,
+    )?;
+    write_schema(
+        &generated_dir.join(SUBAGENT_START_OUTPUT_FIXTURE),
+        schema_json::<SubagentStartCommandOutputWire>()?,
+    )?;
     write_schema(
         &generated_dir.join(STOP_INPUT_FIXTURE),
         schema_json::<StopCommandInput>()?,
@@ -613,6 +654,10 @@ fn user_prompt_submit_hook_event_name_schema(_gen: &mut SchemaGenerator) -> Sche
     string_const_schema("UserPromptSubmit")
 }
 
+fn subagent_start_hook_event_name_schema(_gen: &mut SchemaGenerator) -> Schema {
+    string_const_schema("SubagentStart")
+}
+
 fn stop_hook_event_name_schema(_gen: &mut SchemaGenerator) -> Schema {
     string_const_schema("Stop")
 }
@@ -683,7 +728,10 @@ mod tests {
     use super::SESSION_START_OUTPUT_FIXTURE;
     use super::STOP_INPUT_FIXTURE;
     use super::STOP_OUTPUT_FIXTURE;
+    use super::SUBAGENT_START_INPUT_FIXTURE;
+    use super::SUBAGENT_START_OUTPUT_FIXTURE;
     use super::StopCommandInput;
+    use super::SubagentStartCommandInput;
     use super::USER_PROMPT_SUBMIT_INPUT_FIXTURE;
     use super::USER_PROMPT_SUBMIT_OUTPUT_FIXTURE;
     use super::UserPromptSubmitCommandInput;
@@ -737,6 +785,12 @@ mod tests {
             USER_PROMPT_SUBMIT_OUTPUT_FIXTURE => {
                 include_str!("../schema/generated/user-prompt-submit.command.output.schema.json")
             }
+            SUBAGENT_START_INPUT_FIXTURE => {
+                include_str!("../schema/generated/subagent-start.command.input.schema.json")
+            }
+            SUBAGENT_START_OUTPUT_FIXTURE => {
+                include_str!("../schema/generated/subagent-start.command.output.schema.json")
+            }
             STOP_INPUT_FIXTURE => {
                 include_str!("../schema/generated/stop.command.input.schema.json")
             }
@@ -772,6 +826,8 @@ mod tests {
             SESSION_START_OUTPUT_FIXTURE,
             USER_PROMPT_SUBMIT_INPUT_FIXTURE,
             USER_PROMPT_SUBMIT_OUTPUT_FIXTURE,
+            SUBAGENT_START_INPUT_FIXTURE,
+            SUBAGENT_START_OUTPUT_FIXTURE,
             STOP_INPUT_FIXTURE,
             STOP_OUTPUT_FIXTURE,
         ] {
@@ -814,6 +870,11 @@ mod tests {
                 .expect("serialize user prompt submit input schema"),
         )
         .expect("parse user prompt submit input schema");
+        let subagent_start: Value = serde_json::from_slice(
+            &schema_json::<SubagentStartCommandInput>()
+                .expect("serialize subagent start input schema"),
+        )
+        .expect("parse subagent start input schema");
         let stop: Value = serde_json::from_slice(
             &schema_json::<StopCommandInput>().expect("serialize stop input schema"),
         )
@@ -826,6 +887,7 @@ mod tests {
             &pre_compact,
             &post_compact,
             &user_prompt_submit,
+            &subagent_start,
             &stop,
         ] {
             assert_eq!(schema["properties"]["turn_id"]["type"], "string");
diff --git a/codex-rs/linux-sandbox/README.md b/codex-rs/linux-sandbox/README.md
index 1b4c1e5aa7..4fc65c7499 100644
--- a/codex-rs/linux-sandbox/README.md
+++ b/codex-rs/linux-sandbox/README.md
@@ -74,7 +74,7 @@ commands that would enter the bubblewrap path.
   [permissions.workspace.filesystem]
   glob_scan_max_depth = 2
 
-  [permissions.workspace.filesystem.":project_roots"]
+  [permissions.workspace.filesystem.":workspace_roots"]
   "**/*.env" = "none"
   ```
 
diff --git a/codex-rs/linux-sandbox/src/bwrap.rs b/codex-rs/linux-sandbox/src/bwrap.rs
index 22e7d72531..25a3814fb5 100644
--- a/codex-rs/linux-sandbox/src/bwrap.rs
+++ b/codex-rs/linux-sandbox/src/bwrap.rs
@@ -1347,7 +1347,7 @@ mod tests {
     fn unreadable_glob_entry(pattern: String) -> FileSystemSandboxEntry {
         FileSystemSandboxEntry {
             path: FileSystemPath::GlobPattern { pattern },
-            access: FileSystemAccessMode::None,
+            access: FileSystemAccessMode::Deny,
         }
     }
 
@@ -1547,7 +1547,7 @@ mod tests {
             },
             FileSystemSandboxEntry {
                 path: FileSystemPath::Path { path: link_blocked },
-                access: FileSystemAccessMode::None,
+                access: FileSystemAccessMode::Deny,
             },
         ]);
 
@@ -1672,7 +1672,7 @@ mod tests {
             },
             FileSystemSandboxEntry {
                 path: FileSystemPath::Path { path: link_private },
-                access: FileSystemAccessMode::None,
+                access: FileSystemAccessMode::Deny,
             },
         ]);
 
@@ -1989,7 +1989,7 @@ mod tests {
                 path: FileSystemPath::Special {
                     value: FileSystemSpecialPath::project_roots(Some(".secrets".into())),
                 },
-                access: FileSystemAccessMode::None,
+                access: FileSystemAccessMode::Deny,
             },
         ]);
 
@@ -2172,7 +2172,7 @@ mod tests {
             },
             FileSystemSandboxEntry {
                 path: FileSystemPath::Path { path: blocked },
-                access: FileSystemAccessMode::None,
+                access: FileSystemAccessMode::Deny,
             },
         ]);
 
@@ -2299,7 +2299,7 @@ mod tests {
                 path: FileSystemPath::Path {
                     path: blocked.clone(),
                 },
-                access: FileSystemAccessMode::None,
+                access: FileSystemAccessMode::Deny,
             },
             FileSystemSandboxEntry {
                 path: FileSystemPath::Path {
@@ -2368,7 +2368,7 @@ mod tests {
                 path: FileSystemPath::Path {
                     path: blocked.clone(),
                 },
-                access: FileSystemAccessMode::None,
+                access: FileSystemAccessMode::Deny,
             },
             FileSystemSandboxEntry {
                 path: FileSystemPath::Path {
@@ -2447,7 +2447,7 @@ mod tests {
             },
             FileSystemSandboxEntry {
                 path: FileSystemPath::Path { path: blocked },
-                access: FileSystemAccessMode::None,
+                access: FileSystemAccessMode::Deny,
             },
             FileSystemSandboxEntry {
                 path: FileSystemPath::Path { path: allowed },
@@ -2498,7 +2498,7 @@ mod tests {
                 path: FileSystemPath::Path {
                     path: blocked.clone(),
                 },
-                access: FileSystemAccessMode::None,
+                access: FileSystemAccessMode::Deny,
             },
         ]);
 
@@ -2542,7 +2542,7 @@ mod tests {
                 path: FileSystemPath::Path {
                     path: blocked_file.clone(),
                 },
-                access: FileSystemAccessMode::None,
+                access: FileSystemAccessMode::Deny,
             },
         ]);
 
diff --git a/codex-rs/linux-sandbox/tests/suite/landlock.rs b/codex-rs/linux-sandbox/tests/suite/landlock.rs
index 87e4ce68ae..e18f2a17b4 100644
--- a/codex-rs/linux-sandbox/tests/suite/landlock.rs
+++ b/codex-rs/linux-sandbox/tests/suite/landlock.rs
@@ -805,7 +805,7 @@ async fn sandbox_blocks_explicit_split_policy_carveouts_under_bwrap() {
             path: FileSystemPath::Path {
                 path: AbsolutePathBuf::try_from(blocked.as_path()).expect("absolute blocked dir"),
             },
-            access: FileSystemAccessMode::None,
+            access: FileSystemAccessMode::Deny,
         },
     ]);
     let permission_profile = PermissionProfile::from_runtime_permissions(
@@ -873,7 +873,7 @@ async fn sandbox_reenables_writable_subpaths_under_unreadable_parents() {
             path: FileSystemPath::Path {
                 path: AbsolutePathBuf::try_from(blocked.as_path()).expect("absolute blocked dir"),
             },
-            access: FileSystemAccessMode::None,
+            access: FileSystemAccessMode::Deny,
         },
         FileSystemSandboxEntry {
             path: FileSystemPath::Path {
@@ -931,7 +931,7 @@ async fn sandbox_blocks_root_read_carveouts_under_bwrap() {
             path: FileSystemPath::Path {
                 path: AbsolutePathBuf::try_from(blocked.as_path()).expect("absolute blocked dir"),
             },
-            access: FileSystemAccessMode::None,
+            access: FileSystemAccessMode::Deny,
         },
     ]);
     let permission_profile = PermissionProfile::from_runtime_permissions(
diff --git a/codex-rs/login/src/auth/auth_tests.rs b/codex-rs/login/src/auth/auth_tests.rs
index fe57be06fa..63ab3e0c42 100644
--- a/codex-rs/login/src/auth/auth_tests.rs
+++ b/codex-rs/login/src/auth/auth_tests.rs
@@ -22,6 +22,10 @@ use wiremock::ResponseTemplate;
 use wiremock::matchers::method;
 use wiremock::matchers::path;
 
+const WORKSPACE_ID_ALLOWED: &str = "123e4567-e89b-42d3-a456-426614174000";
+const WORKSPACE_ID_SECOND_ALLOWED: &str = "123e4567-e89b-42d3-a456-426614174001";
+const WORKSPACE_ID_DISALLOWED: &str = "123e4567-e89b-42d3-a456-426614174002";
+
 #[tokio::test]
 async fn refresh_without_id_token() {
     let codex_home = tempdir().unwrap();
@@ -87,7 +91,7 @@ fn login_with_api_key_overwrites_existing_auth_json() {
 async fn login_with_access_token_writes_only_token() {
     let dir = tempdir().unwrap();
     let auth_path = dir.path().join("auth.json");
-    let record = agent_identity_record("account-123");
+    let record = agent_identity_record(WORKSPACE_ID_ALLOWED);
     let agent_identity =
         signed_agent_identity_jwt(&record, json!(record.plan_type)).expect("signed agent identity");
     let server = MockServer::start().await;
@@ -145,7 +149,7 @@ async fn login_with_access_token_rejects_invalid_jwt() {
 #[tokio::test]
 async fn login_with_access_token_rejects_unsigned_jwt() {
     let dir = tempdir().unwrap();
-    let record = agent_identity_record("account-123");
+    let record = agent_identity_record(WORKSPACE_ID_ALLOWED);
     let agent_identity = fake_agent_identity_jwt(&record).expect("fake agent identity");
     let server = MockServer::start().await;
     Mock::given(method("GET"))
@@ -329,7 +333,7 @@ async fn refresh_failure_is_scoped_to_the_matching_auth_snapshot() {
         AuthFileParams {
             openai_api_key: None,
             chatgpt_plan_type: Some("pro".to_string()),
-            chatgpt_account_id: Some("org_mine".to_string()),
+            chatgpt_account_id: Some(WORKSPACE_ID_ALLOWED.to_string()),
         },
         codex_home.path(),
     )
@@ -654,7 +658,7 @@ fn fake_jwt_for_auth_file_params(params: &AuthFileParams) -> std::io::Result<Str
 async fn build_config(
     codex_home: &Path,
     forced_login_method: Option<ForcedLoginMethod>,
-    forced_chatgpt_workspace_id: Option<String>,
+    forced_chatgpt_workspace_id: Option<Vec<String>>,
 ) -> AuthConfig {
     AuthConfig {
         codex_home: codex_home.to_path_buf(),
@@ -712,7 +716,7 @@ fn remove_access_token_env_var() -> EnvVarGuard {
 #[serial(codex_auth_env)]
 async fn load_auth_reads_access_token_from_env() {
     let codex_home = tempdir().unwrap();
-    let expected_record = agent_identity_record("account-123");
+    let expected_record = agent_identity_record(WORKSPACE_ID_ALLOWED);
     let agent_identity =
         signed_agent_identity_jwt(&expected_record, json!(expected_record.plan_type))
             .expect("signed agent identity");
@@ -762,7 +766,7 @@ async fn load_auth_reads_access_token_from_env() {
 #[serial(codex_auth_env)]
 async fn load_auth_keeps_codex_api_key_env_precedence() {
     let codex_home = tempdir().unwrap();
-    let record = agent_identity_record("account-123");
+    let record = agent_identity_record(WORKSPACE_ID_ALLOWED);
     let agent_identity = fake_agent_identity_jwt(&record).expect("fake agent identity");
     let _access_token_guard = EnvVarGuard::set(CODEX_ACCESS_TOKEN_ENV_VAR, &agent_identity);
     let _api_key_guard = EnvVarGuard::set(CODEX_API_KEY_ENV_VAR, "sk-env");
@@ -814,7 +818,7 @@ async fn enforce_login_restrictions_logs_out_for_workspace_mismatch() {
         AuthFileParams {
             openai_api_key: None,
             chatgpt_plan_type: Some("pro".to_string()),
-            chatgpt_account_id: Some("org_another_org".to_string()),
+            chatgpt_account_id: Some(WORKSPACE_ID_DISALLOWED.to_string()),
         },
         codex_home.path(),
     )
@@ -823,14 +827,17 @@ async fn enforce_login_restrictions_logs_out_for_workspace_mismatch() {
     let config = build_config(
         codex_home.path(),
         /*forced_login_method*/ None,
-        Some("org_mine".to_string()),
+        Some(vec![WORKSPACE_ID_ALLOWED.to_string()]),
     )
     .await;
 
     let err = super::enforce_login_restrictions(&config)
         .await
         .expect_err("expected workspace mismatch to error");
-    assert!(err.to_string().contains("workspace org_mine"));
+    assert!(
+        err.to_string()
+            .contains(&format!("workspace(s) {WORKSPACE_ID_ALLOWED}"))
+    );
     assert!(
         !codex_home.path().join("auth.json").exists(),
         "auth.json should be removed on mismatch"
@@ -846,7 +853,7 @@ async fn enforce_login_restrictions_allows_matching_workspace() {
         AuthFileParams {
             openai_api_key: None,
             chatgpt_plan_type: Some("pro".to_string()),
-            chatgpt_account_id: Some("org_mine".to_string()),
+            chatgpt_account_id: Some(WORKSPACE_ID_ALLOWED.to_string()),
         },
         codex_home.path(),
     )
@@ -855,7 +862,7 @@ async fn enforce_login_restrictions_allows_matching_workspace() {
     let config = build_config(
         codex_home.path(),
         /*forced_login_method*/ None,
-        Some("org_mine".to_string()),
+        Some(vec![WORKSPACE_ID_ALLOWED.to_string()]),
     )
     .await;
 
@@ -870,6 +877,94 @@ async fn enforce_login_restrictions_allows_matching_workspace() {
 
 #[tokio::test]
 #[serial(codex_auth_env)]
+async fn enforce_login_restrictions_allows_any_matching_workspace_in_list() {
+    let codex_home = tempdir().unwrap();
+    let _jwt = write_auth_file(
+        AuthFileParams {
+            openai_api_key: None,
+            chatgpt_plan_type: Some("pro".to_string()),
+            chatgpt_account_id: Some(WORKSPACE_ID_ALLOWED.to_string()),
+        },
+        codex_home.path(),
+    )
+    .expect("failed to write auth file");
+
+    let config = build_config(
+        codex_home.path(),
+        /*forced_login_method*/ None,
+        Some(vec![
+            WORKSPACE_ID_SECOND_ALLOWED.to_string(),
+            WORKSPACE_ID_ALLOWED.to_string(),
+        ]),
+    )
+    .await;
+
+    super::enforce_login_restrictions(&config)
+        .await
+        .expect("any matching workspace in the allowed list should succeed");
+}
+
+#[tokio::test]
+#[serial(codex_auth_env)]
+async fn enforce_login_restrictions_logs_out_for_agent_identity_workspace_mismatch() {
+    let codex_home = tempdir().unwrap();
+    let _access_token_guard = remove_access_token_env_var();
+    let record = agent_identity_record(WORKSPACE_ID_DISALLOWED);
+    let agent_identity =
+        signed_agent_identity_jwt(&record, json!(record.plan_type)).expect("signed agent identity");
+    let server = MockServer::start().await;
+    Mock::given(method("GET"))
+        .and(path("/backend-api/wham/agent-identities/jwks"))
+        .respond_with(ResponseTemplate::new(200).set_body_json(test_jwks_body()))
+        .expect(1)
+        .mount(&server)
+        .await;
+    Mock::given(method("POST"))
+        .and(path("/backend-api/v1/agent/agent-runtime-id/task/register"))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+            "task_id": "task-123",
+        })))
+        .expect(1)
+        .mount(&server)
+        .await;
+    let chatgpt_base_url = format!("{}/backend-api", server.uri());
+    let _authapi_guard =
+        EnvVarGuard::set("CODEX_AGENT_IDENTITY_AUTHAPI_BASE_URL", &chatgpt_base_url);
+    save_auth(
+        codex_home.path(),
+        &AuthDotJson {
+            auth_mode: Some(ApiAuthMode::AgentIdentity),
+            openai_api_key: None,
+            tokens: None,
+            last_refresh: None,
+            agent_identity: Some(agent_identity),
+        },
+        AuthCredentialsStoreMode::File,
+    )
+    .expect("seed agent identity auth");
+
+    let config = AuthConfig {
+        codex_home: codex_home.path().to_path_buf(),
+        auth_credentials_store_mode: AuthCredentialsStoreMode::File,
+        forced_login_method: None,
+        forced_chatgpt_workspace_id: Some(vec![WORKSPACE_ID_ALLOWED.to_string()]),
+        chatgpt_base_url: Some(chatgpt_base_url),
+    };
+
+    let err = super::enforce_login_restrictions(&config)
+        .await
+        .expect_err("expected workspace mismatch to error");
+    assert!(err.to_string().contains(&format!(
+        "current credentials belong to {WORKSPACE_ID_DISALLOWED}"
+    )));
+    assert!(
+        !codex_home.path().join("auth.json").exists(),
+        "auth.json should be removed on mismatch"
+    );
+    server.verify().await;
+}
+
+#[tokio::test]
 async fn enforce_login_restrictions_allows_api_key_if_login_method_not_set_but_forced_chatgpt_workspace_id_is_set()
  {
     let codex_home = tempdir().unwrap();
@@ -880,7 +975,7 @@ async fn enforce_login_restrictions_allows_api_key_if_login_method_not_set_but_f
     let config = build_config(
         codex_home.path(),
         /*forced_login_method*/ None,
-        Some("org_mine".to_string()),
+        Some(vec![WORKSPACE_ID_ALLOWED.to_string()]),
     )
     .await;
 
diff --git a/codex-rs/login/src/auth/manager.rs b/codex-rs/login/src/auth/manager.rs
index 45bd55302b..a2e4e8e0d8 100644
--- a/codex-rs/login/src/auth/manager.rs
+++ b/codex-rs/login/src/auth/manager.rs
@@ -610,8 +610,8 @@ pub struct AuthConfig {
     pub codex_home: PathBuf,
     pub auth_credentials_store_mode: AuthCredentialsStoreMode,
     pub forced_login_method: Option<ForcedLoginMethod>,
-    pub forced_chatgpt_workspace_id: Option<String>,
     pub chatgpt_base_url: Option<String>,
+    pub forced_chatgpt_workspace_id: Option<Vec<String>>,
 }
 
 pub async fn enforce_login_restrictions(config: &AuthConfig) -> std::io::Result<()> {
@@ -653,9 +653,8 @@ pub async fn enforce_login_restrictions(config: &AuthConfig) -> std::io::Result<
         }
     }
 
-    if let Some(expected_account_id) = config.forced_chatgpt_workspace_id.as_deref() {
-        // workspace is the external identifier for account id.
-        let chatgpt_account_id = match auth {
+    if let Some(expected_account_ids) = config.forced_chatgpt_workspace_id.as_deref() {
+        let chatgpt_account_id = match &auth {
             CodexAuth::ApiKey(_) => return Ok(()),
             CodexAuth::AgentIdentity(_) => auth.get_account_id(),
             CodexAuth::Chatgpt(_) | CodexAuth::ChatgptAuthTokens(_) => {
@@ -674,13 +673,21 @@ pub async fn enforce_login_restrictions(config: &AuthConfig) -> std::io::Result<
                 token_data.id_token.chatgpt_account_id
             }
         };
-        if chatgpt_account_id.as_deref() != Some(expected_account_id) {
+
+        // workspace is the external identifier for account id.
+        let chatgpt_account_id = chatgpt_account_id.as_deref();
+        if !chatgpt_account_id.is_some_and(|actual| {
+            expected_account_ids
+                .iter()
+                .any(|expected| expected == actual)
+        }) {
+            let expected_workspaces = expected_account_ids.join(", ");
             let message = match chatgpt_account_id {
                 Some(actual) => format!(
-                    "Login is restricted to workspace {expected_account_id}, but current credentials belong to {actual}. Logging out."
+                    "Login is restricted to workspace(s) {expected_workspaces}, but current credentials belong to {actual}. Logging out."
                 ),
                 None => format!(
-                    "Login is restricted to workspace {expected_account_id}, but current credentials lack a workspace identifier. Logging out."
+                    "Login is restricted to workspace(s) {expected_workspaces}, but current credentials lack a workspace identifier. Logging out."
                 ),
             };
             return logout_with_message(
@@ -1247,7 +1254,7 @@ pub struct AuthManager {
     inner: RwLock<CachedAuth>,
     enable_codex_api_key_env: bool,
     auth_credentials_store_mode: AuthCredentialsStoreMode,
-    forced_chatgpt_workspace_id: RwLock<Option<String>>,
+    forced_chatgpt_workspace_id: RwLock<Option<Vec<String>>>,
     chatgpt_base_url: Option<String>,
     refresh_lock: Semaphore,
     external_auth: RwLock<Option<Arc<dyn ExternalAuth>>>,
@@ -1266,8 +1273,8 @@ pub trait AuthManagerConfig {
     /// Returns the CLI auth credential storage mode for auth loading.
     fn cli_auth_credentials_store_mode(&self) -> AuthCredentialsStoreMode;
 
-    /// Returns the workspace ID that ChatGPT auth should be restricted to, if any.
-    fn forced_chatgpt_workspace_id(&self) -> Option<String>;
+    /// Returns the workspace IDs that ChatGPT auth should be restricted to, if any.
+    fn forced_chatgpt_workspace_id(&self) -> Option<Vec<String>>;
 
     /// Returns the ChatGPT backend base URL used for first-party backend authorization.
     fn chatgpt_base_url(&self) -> String;
@@ -1548,7 +1555,7 @@ impl AuthManager {
         }
     }
 
-    pub fn set_forced_chatgpt_workspace_id(&self, workspace_id: Option<String>) {
+    pub fn set_forced_chatgpt_workspace_id(&self, workspace_id: Option<Vec<String>>) {
         if let Ok(mut guard) = self.forced_chatgpt_workspace_id.write()
             && *guard != workspace_id
         {
@@ -1556,7 +1563,7 @@ impl AuthManager {
         }
     }
 
-    pub fn forced_chatgpt_workspace_id(&self) -> Option<String> {
+    pub fn forced_chatgpt_workspace_id(&self) -> Option<Vec<String>> {
         self.forced_chatgpt_workspace_id
             .read()
             .ok()
@@ -1836,13 +1843,13 @@ impl AuthManager {
                 "external auth refresh did not return ChatGPT metadata",
             )));
         };
-        if let Some(expected_workspace_id) = forced_chatgpt_workspace_id.as_deref()
-            && chatgpt_metadata.account_id != expected_workspace_id
+        if let Some(expected_workspace_ids) = forced_chatgpt_workspace_id.as_deref()
+            && !expected_workspace_ids.contains(&chatgpt_metadata.account_id)
         {
             return Err(RefreshTokenError::Transient(std::io::Error::other(
                 format!(
-                    "external auth refresh returned workspace {:?}, expected {expected_workspace_id:?}",
-                    chatgpt_metadata.account_id,
+                    "external auth refresh returned workspace {:?}, expected one of {:?}",
+                    chatgpt_metadata.account_id, expected_workspace_ids,
                 ),
             )));
         }
diff --git a/codex-rs/login/src/server.rs b/codex-rs/login/src/server.rs
index ad0d6b5e5e..b72bc946f2 100644
--- a/codex-rs/login/src/server.rs
+++ b/codex-rs/login/src/server.rs
@@ -69,7 +69,7 @@ pub struct ServerOptions {
     pub port: u16,
     pub open_browser: bool,
     pub force_state: Option<String>,
-    pub forced_chatgpt_workspace_id: Option<String>,
+    pub forced_chatgpt_workspace_id: Option<Vec<String>>,
     pub codex_streamlined_login: bool,
     pub cli_auth_credentials_store_mode: AuthCredentialsStoreMode,
 }
@@ -79,7 +79,7 @@ impl ServerOptions {
     pub fn new(
         codex_home: PathBuf,
         client_id: String,
-        forced_chatgpt_workspace_id: Option<String>,
+        forced_chatgpt_workspace_id: Option<Vec<String>>,
         cli_auth_credentials_store_mode: AuthCredentialsStoreMode,
     ) -> Self {
         Self {
@@ -486,7 +486,7 @@ fn build_authorize_url(
     redirect_uri: &str,
     pkce: &PkceCodes,
     state: &str,
-    forced_chatgpt_workspace_id: Option<&str>,
+    forced_chatgpt_workspace_ids: Option<&[String]>,
 ) -> String {
     let mut query = vec![
         ("response_type".to_string(), "code".to_string()),
@@ -507,8 +507,8 @@ fn build_authorize_url(
         ("state".to_string(), state.to_string()),
         ("originator".to_string(), originator().value),
     ];
-    if let Some(workspace_id) = forced_chatgpt_workspace_id {
-        query.push(("allowed_workspace_id".to_string(), workspace_id.to_string()));
+    if let Some(workspace_ids) = forced_chatgpt_workspace_ids {
+        query.push(("allowed_workspace_id".to_string(), workspace_ids.join(",")));
     }
     let qs = query
         .into_iter()
@@ -928,7 +928,7 @@ fn jwt_auth_claims(jwt: &str) -> serde_json::Map<String, serde_json::Value> {
 
 /// Validates the ID token against an optional workspace restriction.
 pub(crate) fn ensure_workspace_allowed(
-    expected: Option<&str>,
+    expected: Option<&[String]>,
     id_token: &str,
 ) -> Result<(), String> {
     let Some(expected) = expected else {
@@ -940,10 +940,13 @@ pub(crate) fn ensure_workspace_allowed(
         return Err("Login is restricted to a specific workspace, but the token did not include an chatgpt_account_id claim.".to_string());
     };
 
-    if actual == expected {
+    if expected.iter().any(|workspace_id| workspace_id == actual) {
         Ok(())
     } else {
-        Err(format!("Login is restricted to workspace id {expected}."))
+        Err(format!(
+            "Login is restricted to workspace id(s) {}.",
+            expected.join(", ")
+        ))
     }
 }
 
diff --git a/codex-rs/login/tests/suite/device_code_login.rs b/codex-rs/login/tests/suite/device_code_login.rs
index bed94c7005..e575e6b8c7 100644
--- a/codex-rs/login/tests/suite/device_code_login.rs
+++ b/codex-rs/login/tests/suite/device_code_login.rs
@@ -23,6 +23,9 @@ use core_test_support::skip_if_no_network;
 
 // ---------- Small helpers  ----------
 
+const WORKSPACE_ID_ALLOWED: &str = "123e4567-e89b-42d3-a456-426614174000";
+const WORKSPACE_ID_DISALLOWED: &str = "123e4567-e89b-42d3-a456-426614174002";
+
 fn make_jwt(payload: serde_json::Value) -> String {
     let header = json!({ "alg": "none", "typ": "JWT" });
     let header_b64 = URL_SAFE_NO_PAD.encode(serde_json::to_vec(&header).unwrap());
@@ -131,7 +134,7 @@ async fn device_code_login_integration_succeeds() -> anyhow::Result<()> {
 
     let jwt = make_jwt(json!({
         "https://api.openai.com/auth": {
-            "chatgpt_account_id": "acct_321"
+            "chatgpt_account_id": WORKSPACE_ID_ALLOWED
         }
     }));
 
@@ -152,7 +155,7 @@ async fn device_code_login_integration_succeeds() -> anyhow::Result<()> {
     assert_eq!(tokens.access_token, "access-token-123");
     assert_eq!(tokens.refresh_token, "refresh-token-123");
     assert_eq!(tokens.id_token.raw_jwt, jwt);
-    assert_eq!(tokens.account_id.as_deref(), Some("acct_321"));
+    assert_eq!(tokens.account_id.as_deref(), Some(WORKSPACE_ID_ALLOWED));
     Ok(())
 }
 
@@ -174,8 +177,8 @@ async fn device_code_login_rejects_workspace_mismatch() -> anyhow::Result<()> {
 
     let jwt = make_jwt(json!({
         "https://api.openai.com/auth": {
-            "chatgpt_account_id": "acct_321",
-            "organization_id": "org-actual"
+            "chatgpt_account_id": WORKSPACE_ID_DISALLOWED,
+            "organization_id": WORKSPACE_ID_DISALLOWED
         }
     }));
 
@@ -183,7 +186,7 @@ async fn device_code_login_rejects_workspace_mismatch() -> anyhow::Result<()> {
 
     let issuer = mock_server.uri();
     let mut opts = server_opts(&codex_home, issuer, AuthCredentialsStoreMode::File);
-    opts.forced_chatgpt_workspace_id = Some("org-required".to_string());
+    opts.forced_chatgpt_workspace_id = Some(vec![WORKSPACE_ID_ALLOWED.to_string()]);
 
     let err = run_device_code_login(opts)
         .await
diff --git a/codex-rs/login/tests/suite/login_server_e2e.rs b/codex-rs/login/tests/suite/login_server_e2e.rs
index ce58a51358..bc7bb401e8 100644
--- a/codex-rs/login/tests/suite/login_server_e2e.rs
+++ b/codex-rs/login/tests/suite/login_server_e2e.rs
@@ -12,10 +12,15 @@ use codex_config::types::AuthCredentialsStoreMode;
 use codex_login::ServerOptions;
 use codex_login::run_login_server;
 use core_test_support::skip_if_no_network;
+use pretty_assertions::assert_eq;
 use tempfile::tempdir;
+use url::Url;
 
 const DEFAULT_LOGIN_PORT: u16 = 1455;
 const FALLBACK_LOGIN_PORT: u16 = 1457;
+const WORKSPACE_ID_ALLOWED: &str = "123e4567-e89b-42d3-a456-426614174000";
+const WORKSPACE_ID_SECOND_ALLOWED: &str = "123e4567-e89b-42d3-a456-426614174001";
+const WORKSPACE_ID_DISALLOWED: &str = "123e4567-e89b-42d3-a456-426614174002";
 
 // See spawn.rs for details
 
@@ -121,7 +126,7 @@ async fn end_to_end_login_flow_persists_auth_json() -> Result<()> {
         port: 0,
         open_browser: false,
         force_state: Some(state),
-        forced_chatgpt_workspace_id: Some(chatgpt_account_id.to_string()),
+        forced_chatgpt_workspace_id: Some(vec![chatgpt_account_id.to_string()]),
         codex_streamlined_login: false,
     };
     let server = run_login_server(opts)?;
@@ -165,7 +170,7 @@ async fn end_to_end_login_flow_persists_auth_json() -> Result<()> {
 async fn creates_missing_codex_home_dir() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
-    let (issuer_addr, _issuer_handle) = start_mock_issuer("org-123");
+    let (issuer_addr, _issuer_handle) = start_mock_issuer(WORKSPACE_ID_ALLOWED);
     let issuer = format!("http://{}:{}", issuer_addr.ip(), issuer_addr.port());
 
     let tmp = tempdir()?;
@@ -204,11 +209,52 @@ async fn creates_missing_codex_home_dir() -> Result<()> {
     Ok(())
 }
 
+#[tokio::test]
+async fn login_server_includes_forced_workspaces_as_one_query_param() -> Result<()> {
+    skip_if_no_network!(Ok(()));
+
+    let (issuer_addr, _issuer_handle) = start_mock_issuer(WORKSPACE_ID_ALLOWED);
+    let issuer = format!("http://{}:{}", issuer_addr.ip(), issuer_addr.port());
+
+    let tmp = tempdir()?;
+    let codex_home = tmp.path().to_path_buf();
+    let state = "state-multi".to_string();
+
+    let opts = ServerOptions {
+        codex_home,
+        cli_auth_credentials_store_mode: AuthCredentialsStoreMode::File,
+        client_id: codex_login::CLIENT_ID.to_string(),
+        issuer,
+        port: 0,
+        open_browser: false,
+        force_state: Some(state),
+        forced_chatgpt_workspace_id: Some(vec![
+            WORKSPACE_ID_ALLOWED.to_string(),
+            WORKSPACE_ID_SECOND_ALLOWED.to_string(),
+        ]),
+        codex_streamlined_login: false,
+    };
+    let server = run_login_server(opts)?;
+    let auth_url = Url::parse(&server.auth_url)?;
+    let allowed_workspace_ids = auth_url
+        .query_pairs()
+        .filter_map(|(key, value)| (key == "allowed_workspace_id").then(|| value.into_owned()))
+        .collect::<Vec<_>>();
+    assert_eq!(
+        allowed_workspace_ids,
+        vec![format!(
+            "{WORKSPACE_ID_ALLOWED},{WORKSPACE_ID_SECOND_ALLOWED}"
+        )]
+    );
+
+    Ok(())
+}
+
 #[tokio::test]
 async fn forced_chatgpt_workspace_id_mismatch_blocks_login() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
-    let (issuer_addr, _issuer_handle) = start_mock_issuer("org-actual");
+    let (issuer_addr, _issuer_handle) = start_mock_issuer(WORKSPACE_ID_DISALLOWED);
     let issuer = format!("http://{}:{}", issuer_addr.ip(), issuer_addr.port());
 
     let tmp = tempdir()?;
@@ -223,14 +269,14 @@ async fn forced_chatgpt_workspace_id_mismatch_blocks_login() -> Result<()> {
         port: 0,
         open_browser: false,
         force_state: Some(state.clone()),
-        forced_chatgpt_workspace_id: Some("org-required".to_string()),
+        forced_chatgpt_workspace_id: Some(vec![WORKSPACE_ID_ALLOWED.to_string()]),
         codex_streamlined_login: false,
     };
     let server = run_login_server(opts)?;
     assert!(
         server
             .auth_url
-            .contains("allowed_workspace_id=org-required"),
+            .contains(&format!("allowed_workspace_id={WORKSPACE_ID_ALLOWED}")),
         "auth URL should include forced workspace parameter"
     );
     let login_port = server.actual_port;
@@ -241,7 +287,9 @@ async fn forced_chatgpt_workspace_id_mismatch_blocks_login() -> Result<()> {
     assert!(resp.status().is_success());
     let body = resp.text().await?;
     assert!(
-        body.contains("Login is restricted to workspace id org-required"),
+        body.contains(&format!(
+            "Login is restricted to workspace id(s) {WORKSPACE_ID_ALLOWED}"
+        )),
         "error body should mention workspace restriction"
     );
 
@@ -266,7 +314,7 @@ async fn forced_chatgpt_workspace_id_mismatch_blocks_login() -> Result<()> {
 async fn oauth_access_denied_missing_entitlement_blocks_login_with_clear_error() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
-    let (issuer_addr, _issuer_handle) = start_mock_issuer("org-123");
+    let (issuer_addr, _issuer_handle) = start_mock_issuer(WORKSPACE_ID_ALLOWED);
     let issuer = format!("http://{}:{}", issuer_addr.ip(), issuer_addr.port());
 
     let tmp = tempdir()?;
@@ -334,7 +382,7 @@ async fn oauth_access_denied_missing_entitlement_blocks_login_with_clear_error()
 async fn oauth_access_denied_unknown_reason_uses_generic_error_page() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
-    let (issuer_addr, _issuer_handle) = start_mock_issuer("org-123");
+    let (issuer_addr, _issuer_handle) = start_mock_issuer(WORKSPACE_ID_ALLOWED);
     let issuer = format!("http://{}:{}", issuer_addr.ip(), issuer_addr.port());
 
     let tmp = tempdir()?;
@@ -442,7 +490,7 @@ async fn falls_back_to_registered_fallback_port_when_default_port_is_in_use() ->
         })
     };
 
-    let (issuer_addr, _issuer_handle) = start_mock_issuer("org-123");
+    let (issuer_addr, _issuer_handle) = start_mock_issuer(WORKSPACE_ID_ALLOWED);
     let issuer = format!("http://{}:{}", issuer_addr.ip(), issuer_addr.port());
     let tmp = tempdir()?;
 
@@ -480,7 +528,7 @@ async fn falls_back_to_registered_fallback_port_when_default_port_is_in_use() ->
 async fn cancels_previous_login_server_when_port_is_in_use() -> Result<()> {
     skip_if_no_network!(Ok(()));
 
-    let (issuer_addr, _issuer_handle) = start_mock_issuer("org-123");
+    let (issuer_addr, _issuer_handle) = start_mock_issuer(WORKSPACE_ID_ALLOWED);
     let issuer = format!("http://{}:{}", issuer_addr.ip(), issuer_addr.port());
 
     let first_tmp = tempdir()?;
diff --git a/codex-rs/mcp-server/src/codex_tool_config.rs b/codex-rs/mcp-server/src/codex_tool_config.rs
index f83fd4fd5a..2f9f354277 100644
--- a/codex-rs/mcp-server/src/codex_tool_config.rs
+++ b/codex-rs/mcp-server/src/codex_tool_config.rs
@@ -2,6 +2,7 @@
 
 use codex_arg0::Arg0DispatchPaths;
 use codex_core::config::Config;
+use codex_core::config::ConfigBuilder;
 use codex_core::config::ConfigOverrides;
 use codex_protocol::ThreadId;
 use codex_protocol::config_types::SandboxMode;
@@ -191,8 +192,11 @@ impl CodexToolCallParam {
             .map(|(k, v)| (k, json_to_toml(v)))
             .collect();
 
-        let cfg =
-            Config::load_with_cli_overrides_and_harness_overrides(cli_overrides, overrides).await?;
+        let cfg = ConfigBuilder::default()
+            .cli_overrides(cli_overrides)
+            .harness_overrides(overrides)
+            .build()
+            .await?;
 
         Ok((prompt, cfg))
     }
diff --git a/codex-rs/mcp-server/src/codex_tool_runner.rs b/codex-rs/mcp-server/src/codex_tool_runner.rs
index 9e3ac1bae9..167d56da5b 100644
--- a/codex-rs/mcp-server/src/codex_tool_runner.rs
+++ b/codex-rs/mcp-server/src/codex_tool_runner.rs
@@ -116,6 +116,7 @@ pub async fn run_codex_tool_session(
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         },
         trace: None,
     };
@@ -165,6 +166,7 @@ pub async fn run_codex_tool_session_reply(
             }],
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
     {
@@ -331,6 +333,7 @@ async fn run_codex_tool_session_inner(
                     }
                     EventMsg::AgentReasoningRawContent(_)
                     | EventMsg::TurnStarted(_)
+                    | EventMsg::ThreadSettingsApplied(_)
                     | EventMsg::TokenCount(_)
                     | EventMsg::AgentReasoning(_)
                     | EventMsg::AgentReasoningSectionBreak(_)
diff --git a/codex-rs/mcp-server/src/lib.rs b/codex-rs/mcp-server/src/lib.rs
index 45daf99a01..4a4ff054be 100644
--- a/codex-rs/mcp-server/src/lib.rs
+++ b/codex-rs/mcp-server/src/lib.rs
@@ -6,7 +6,7 @@ use std::io::Result as IoResult;
 use std::sync::Arc;
 
 use codex_arg0::Arg0DispatchPaths;
-use codex_core::config::Config;
+use codex_core::config::ConfigBuilder;
 use codex_core::resolve_installation_id;
 use codex_exec_server::EnvironmentManager;
 use codex_exec_server::ExecServerRuntimePaths;
@@ -59,6 +59,7 @@ type IncomingMessage = JsonRpcMessage<ClientRequest, Value, ClientNotification>;
 pub async fn run_main(
     arg0_paths: Arg0DispatchPaths,
     cli_config_overrides: CliConfigOverrides,
+    strict_config: bool,
 ) -> IoResult<()> {
     // Parse CLI overrides once and derive the base Config eagerly so later
     // components do not need to work with raw TOML values.
@@ -68,7 +69,10 @@ pub async fn run_main(
             format!("error parsing -c overrides: {e}"),
         )
     })?;
-    let config = Config::load_with_cli_overrides(cli_kv_overrides)
+    let config = ConfigBuilder::default()
+        .cli_overrides(cli_kv_overrides)
+        .strict_config(strict_config)
+        .build()
         .await
         .map_err(|e| {
             std::io::Error::new(ErrorKind::InvalidData, format!("error loading config: {e}"))
@@ -92,10 +96,10 @@ pub async fn run_main(
     let environment_manager = Arc::new(
         EnvironmentManager::from_codex_home(
             config.codex_home.clone(),
-            ExecServerRuntimePaths::from_optional_paths(
+            Some(ExecServerRuntimePaths::from_optional_paths(
                 arg0_paths.codex_self_exe.clone(),
                 arg0_paths.codex_linux_sandbox_exe.clone(),
-            )?,
+            )?),
         )
         .await
         .map_err(std::io::Error::other)?,
diff --git a/codex-rs/mcp-server/src/main.rs b/codex-rs/mcp-server/src/main.rs
index ce61fd04d1..220507446a 100644
--- a/codex-rs/mcp-server/src/main.rs
+++ b/codex-rs/mcp-server/src/main.rs
@@ -5,7 +5,12 @@ use codex_utils_cli::CliConfigOverrides;
 
 fn main() -> anyhow::Result<()> {
     arg0_dispatch_or_else(|arg0_paths: Arg0DispatchPaths| async move {
-        run_main(arg0_paths, CliConfigOverrides::default()).await?;
+        run_main(
+            arg0_paths,
+            CliConfigOverrides::default(),
+            /*strict_config*/ false,
+        )
+        .await?;
         Ok(())
     })
 }
diff --git a/codex-rs/memories/read/src/lib.rs b/codex-rs/memories/read/src/lib.rs
index 2f7b7645e4..ac6aa4d7f1 100644
--- a/codex-rs/memories/read/src/lib.rs
+++ b/codex-rs/memories/read/src/lib.rs
@@ -13,7 +13,7 @@ use codex_utils_absolute_path::AbsolutePathBuf;
 
 pub use prompts::build_memory_tool_developer_instructions;
 
-const MEMORY_TOOL_DEVELOPER_INSTRUCTIONS_SUMMARY_TOKEN_LIMIT: usize = 5_000;
+const MEMORY_TOOL_DEVELOPER_INSTRUCTIONS_SUMMARY_TOKEN_LIMIT: usize = 2_500;
 
 pub fn memory_root(codex_home: &AbsolutePathBuf) -> AbsolutePathBuf {
     codex_home.join("memories")
diff --git a/codex-rs/memories/read/templates/memories/read_path.md b/codex-rs/memories/read/templates/memories/read_path.md
index 828b30923e..00639c7e8c 100644
--- a/codex-rs/memories/read/templates/memories/read_path.md
+++ b/codex-rs/memories/read/templates/memories/read_path.md
@@ -25,7 +25,7 @@ Memory layout (general -> specific):
   - scripts/ (optional helper scripts)
   - examples/ (optional example outputs)
   - templates/ (optional templates)
- - {{ base_path }}/rollout_summaries/ (per-rollout recaps + evidence snippets)
+- {{ base_path }}/rollout_summaries/ (per-rollout recaps + evidence snippets)
   - The paths of these entries can be found in {{ base_path }}/MEMORY.md or {{ base_path }}/rollout_summaries/ as `rollout_path`
   - These files are append-only `jsonl`: `session_meta.payload.id` identifies the session, `turn_context` marks turn boundaries, `event_msg` is the lightweight status stream, and `response_item` contains actual messages, tool calls, and tool outputs.
   - For efficient lookup, prefer matching the filename suffix or `session_meta.payload.id`; avoid broad full-content scans unless needed.
@@ -57,9 +57,6 @@ How to decide whether to verify memory:
   disruptive, it is acceptable to answer from memory in an interactive turn,
   but you should say that it is memory-derived, note that it may be stale, and
   consider offering to refresh it live.
-- If a fact is lower-drift and cheap to verify, use judgment: verification is
-  more important when the fact is central to the answer or especially easy to
-  confirm.
 - If a fact is lower-drift and expensive to verify, it is usually fine to
   answer from memory directly.
 
@@ -72,10 +69,8 @@ When answering from memory without current verification:
 - If live verification was skipped and a refresh would be useful in the
   interactive context, consider offering to verify or refresh it live.
 - Do not present unverified memory-derived facts as confirmed-current.
-- For interactive requests, prefer a short refresh offer over silently doing
-  expensive verification that the user did not ask for.
-- When the unverified fact is about prior results, commands, timing, or an
-  older snapshot, a concrete refresh offer can be especially helpful.
+- Prefer a short refresh offer for interactive questions, especially about prior
+  results, commands, timing, or older snapshots.
 
 Memory citation requirements:
 
@@ -88,7 +83,7 @@ Memory citation requirements:
 <oai-mem-citation>
 <citation_entries>
 MEMORY.md:234-236|note=[responsesapi citation extraction code pointer]
-rollout_summaries/2026-02-17T21-23-02-LN3m-weekly_memory_report_pivot_from_git_history.md:10-12|note=[weekly report format]
+rollout_summaries/2026-02-17T21-23-02-LN3m-example.md:10-12|note=[weekly report format]
 </citation_entries>
 <rollout_ids>
 019c6e27-e55b-73d1-87d8-4e01f1f75043
diff --git a/codex-rs/memories/write/src/runtime.rs b/codex-rs/memories/write/src/runtime.rs
index 18b1bd6db1..b1ffb2d215 100644
--- a/codex-rs/memories/write/src/runtime.rs
+++ b/codex-rs/memories/write/src/runtime.rs
@@ -261,6 +261,7 @@ impl MemoryStartupContext {
                 environments: None,
                 final_output_json_schema: None,
                 responsesapi_client_metadata: None,
+                thread_settings: Default::default(),
             })
             .await
         {
diff --git a/codex-rs/memories/write/src/startup_tests.rs b/codex-rs/memories/write/src/startup_tests.rs
index 4fcb1d409b..30240f04ca 100644
--- a/codex-rs/memories/write/src/startup_tests.rs
+++ b/codex-rs/memories/write/src/startup_tests.rs
@@ -242,22 +242,14 @@ async fn memories_startup_phase1_uses_live_thread_service_tier() -> anyhow::Resu
     let test = build_test_codex(&server, home).await?;
     assert_eq!(test.config.service_tier, None);
 
-    test.codex
-        .submit(Op::OverrideTurnContext {
-            cwd: None,
-            approval_policy: None,
-            approvals_reviewer: None,
-            sandbox_policy: None,
-            permission_profile: None,
-            windows_sandbox_level: None,
-            model: None,
-            effort: None,
-            summary: None,
+    core_test_support::submit_thread_settings(
+        &test.codex,
+        codex_protocol::protocol::ThreadSettingsOverrides {
             service_tier: Some(Some(ServiceTier::Fast.request_value().to_string())),
-            collaboration_mode: None,
-            personality: None,
-        })
-        .await?;
+            ..Default::default()
+        },
+    )
+    .await?;
 
     let config_snapshot =
         wait_for_service_tier(&test, Some(ServiceTier::Fast.request_value().to_string())).await?;
diff --git a/codex-rs/memories/write/templates/memories/consolidation.md b/codex-rs/memories/write/templates/memories/consolidation.md
index cc586bd4c1..0eef7580b5 100644
--- a/codex-rs/memories/write/templates/memories/consolidation.md
+++ b/codex-rs/memories/write/templates/memories/consolidation.md
@@ -20,8 +20,8 @@ CONTEXT: MEMORY FOLDER STRUCTURE
 Folder structure (under {{ memory_root }}/):
 
 - memory_summary.md
-  - Always loaded into the system prompt. Must remain informative and highly navigational,
-    but still discriminative enough to guide retrieval.
+  - Always loaded into the system prompt. First line must be exactly `v1`.
+    Must stay dense, highly navigational, and discriminative enough to guide retrieval.
 - MEMORY.md
   - Handbook entries. Used to grep for keywords; aggregated insights from rollouts;
     pointers to rollout summaries if certain past rollouts are very relevant.
@@ -133,7 +133,8 @@ Under `{{ memory_root }}/`:
   - merged memories; produce a lightly clustered version if applicable
 - `rollout_summaries/*.md`
 - `memory_summary.md`
-  - read the existing summary so updates stay consistent
+  - read the existing summary so updates stay consistent only if its first line is exactly `v1`;
+    otherwise treat the summary as schema-incompatible and regenerate the whole file from scratch
 - `skills/*`
   - read existing skills so updates are incremental and non-duplicative
 {{ memory_extensions_primary_inputs }}
@@ -143,6 +144,8 @@ Mode selection:
   and `skills/`).
 - INCREMENTAL UPDATE: existing artifacts already exist and `raw_memories.md`
   mostly contains new additions.
+- Summary schema reset: if `memory_summary.md` is missing, empty, or does not start with exactly
+  `v1`, regenerate only `memory_summary.md` from scratch after `MEMORY.md` is current.
 
 Memory workspace diff:
 
@@ -183,6 +186,8 @@ Rules:
 
 - If there is no meaningful signal to add beyond what already exists, keep outputs minimal.
 - You should always make sure `MEMORY.md` and `memory_summary.md` exist and are up to date.
+- `memory_summary.md` must start with the exact line `v1`; if it does not, rewrite the entire
+  file rather than patching the previous summary in place.
 - Follow the format and schema of the artifacts below.
 - Do not target fixed counts (memory blocks, task groups, topics, or bullets). Let the
   signal determine the granularity and depth.
@@ -441,14 +446,40 @@ task group/task` from the full raw inventory so you can have a better overview.
 - Prefer placing reusable user preferences in `## User preferences` and the rest of the durable
   know-how in `## Reusable knowledge` and `## Failures and how to do differently`.
 - Use `memory_summary.md` as the cross-task summary layer, not the place for project-specific
-  runbooks. It should stay compact in narrative/profile sections, but its `## User preferences`
-  section is the main actionable payload and may be much longer when that helps future agents
-  avoid repeated user steering.
+  runbooks. Its `## User preferences` section is the main actionable payload, but it should
+  still stay compact, deduplicated, and limited to preferences likely to change future behavior.
 
 ============================================================
 2) `memory_summary.md` FORMAT (STRICT)
 ============================================================
 
+File header:
+
+The file must begin exactly:
+
+```md
+v1
+
+## User Profile
+```
+
+- The first line must be exactly `v1` with no leading/trailing whitespace and no frontmatter
+  before it.
+- If the existing `memory_summary.md` first line is not exactly `v1`, discard the old summary
+  structure and regenerate the entire file from the finalized `MEMORY.md`, skills, and current
+  rollout evidence.
+
+Density objective (strict):
+
+- `memory_summary.md` is prompt-loaded context, so optimize for high signal per token.
+- Keep only high-level, cross-task signal and brief routing summaries. Put details, provenance,
+  runbooks, and task-local nuance in `MEMORY.md`, skills, or rollout summaries.
+- Deduplicate aggressively. If two bullets would cause the same future behavior or route to the
+  same `MEMORY.md` area, merge them or keep the sharper one.
+- Prefer short, concrete bullets over narrative explanation. Delete low-signal caveats,
+  examples, and historical detail unless they change future agent behavior.
+- Give directly links to important information to maximize the retrieval efficiency.
+
 Format:
 
 ## User Profile
@@ -474,15 +505,15 @@ For example, include (when known):
 You may end with short fun facts if they are real and useful, but keep the main profile concrete
 and grounded. Do not let the optional fun-facts tail make the rest of the section more stylized
 or abstract.
-This entire section is free-form, <= 500 words.
+This entire section is free-form, <= 350 words.
 
 ## User preferences
 Include a dedicated bullet list of actionable user preferences that are likely to matter again,
 not just inside one task group.
 This section should be more concrete and easier to apply than `## User Profile`.
 Prefer preferences that repeatedly save user keystrokes or avoid predictable interruption.
-This section may be long. Do not compress it to just a few umbrella bullets when `MEMORY.md`
-contains many distinct actionable preferences.
+Keep it dense and non-duplicative. Include only stable or high-leverage preferences that would
+change future agent behavior across recurring workflows.
 Treat this as the main actionable payload of `memory_summary.md`.
 
 For example, include (when known):
@@ -500,16 +531,12 @@ Rules:
 - Keep each bullet actionable and future-facing.
 - Default to lifting or lightly adapting strong bullets from `MEMORY.md` `## User preferences`
   rather than rewriting them into smoother higher-level summaries.
-- Preserve more of the user's original point than a terse summary would. Prefer evidence-aware
-  bullets that still keep some original wording over abstract umbrella summaries.
+- Preserve the user's original point when it is compact and behavior-changing; otherwise compress
+  to the shortest faithful wording.
 - When a short quoted or near-verbatim phrase makes the preference easier to recognize or grep
   for later, keep that phrase in the bullet instead of replacing it with an abstraction.
-- Do not over-merge adjacent preferences. If several distinct preferences would change different
-  future defaults, keep them as separate bullets.
-- Prefer many narrow actionable bullets over a few broad umbrella bullets.
-- Prefer a broad actionable inventory over a short highly deduped list.
-- Do not treat 5-10 bullets as an implicit target; long-lived memory sets may justify a much
-  longer list.
+- Merge adjacent preferences unless they would change different future defaults.
+- Prefer a compact set of sharp bullets over a broad inventory.
 - Do not require a preference to be broad across task families. If it is likely to matter again
   in a recurring workflow, it belongs here.
 - When deciding whether to include a preference, ask whether omitting it would make the next
@@ -542,16 +569,20 @@ For example, include (when known):
 
 This is a compact index to help future agents quickly find details in `MEMORY.md`,
 `skills/`, and `rollout_summaries/`.
-Treat it as a routing/index layer, not a mini-handbook:
+Treat it as a dense routing/index layer, not a mini-handbook:
 
 - tell future agents what to search first,
 - preserve enough specificity to route into the right `MEMORY.md` block quickly.
+- keep topic descriptions brief; delete stale, duplicated, or low-signal topics even if they
+  existed in the previous summary.
 
 Topic selection and quality rules:
 
 - Organize the index first by cwd / project scope, then by topic.
 - Split the index into a recent high-utility window and older topics.
 - Do not target a fixed topic count. Include informative topics and omit low-signal noise.
+- Keep the index current. Feel free to restructure, rename, merge, or delete topics when the
+  current `MEMORY.md` organization or evidence has changed.
 - Prefer grouping by task family / workflow intent, not by incidental tool overlap alone.
 - Order topics by utility, using `updated_at` recency as a strong default proxy unless there is
   strong contrary evidence.
@@ -588,7 +619,7 @@ Recent Active Memory Window behavior (scope-first, then day-ordered):
 - Within each scope, order day subsections by recency.
 - If a scope has only one meaningful recent day, include only that day for that scope.
 - For each recent-day subsection inside a scope, prioritize informative, likely-to-recur topics and make
-  those entries richer (better keywords, clearer descriptions, and useful recent learnings);
+  those entries denser (better keywords, brief descriptions, and useful recent learnings);
   do not spend much space on trivial tasks touched that day.
 - Preserve routing coverage for `MEMORY.md` in the overall index. If a scope/day includes
   less useful topics, include shorter/compact entries for routing rather than dropping them.
@@ -596,16 +627,16 @@ Recent Active Memory Window behavior (scope-first, then day-ordered):
   appears; do not duplicate it under multiple day sections.
 - If a topic spans multiple scopes and retrieval would differ by scope, split it. Otherwise,
   place it under the dominant scope and mention the secondary scope in the description.
-- Recent-day entries should be richer than older-topic entries: stronger keywords, clearer
-  descriptions, and concise recent learnings/change notes.
+- Recent-day entries should be more informative than older-topic entries through stronger
+  keywords and concise recent learnings/change notes, not longer prose.
 - Group similar tasks/topics together when it improves routing clarity.
 - Do not over cluster topics together, especially when they contain distinct task intents.
 
 Recent-topic format:
 
 - <topic>: <keyword1>, <keyword2>, <keyword3>, ...
-  - desc: <clear and specific description of what tasks are inside this topic; what future task/user goal this helps with; what kinds of outcomes/artifacts/procedures are covered; when to search this topic first; preserve original source phrasing when it is a useful retrieval handle; and include explicit cwd applicability text when the work is checkout-sensitive>
-  - learnings: <some concise, topic-local recent takeaways / decision triggers / updates worth checking first; include useful specifics, original source phrasing where possible, and cwd mismatch caveats when important; avoid overlap with `## User preferences` and `## General Tips` (cross-task actionable defaults belong in `## User preferences`; broad reusable guidance belongs in `## General Tips`)>
+  - desc: <brief description of what is inside this topic, when to search it first, and any cwd applicability needed for routing>
+  - learnings: <one dense line of topic-local takeaways / decision triggers / updates worth checking first; avoid overlap with `## User preferences` and `## General Tips`>
 
 ### <cwd / project scope>
 
@@ -643,10 +674,9 @@ Notes:
   caveats, and decision triggers; move cross-task, stable, broadly reusable user defaults to
   `## User preferences`.
 - Coverage guardrail: ensure every top-level `# Task Group` in `MEMORY.md` is represented by
-  at least one topic bullet in this index (either directly or via a clearly subsuming topic).
-- Keep descriptions explicit: what is inside, when to use it, and what kind of
-  outcome/procedure depth is available (for example: runbook, diagnostics, reporting, recovery),
-  so a future agent can quickly choose which topic/keyword cluster to search first.
+  at least one topic bullet in this index (either directly or via a clearly subsuming compact topic).
+- Keep descriptions explicit but short: enough for a future agent to choose the right
+  topic/keyword cluster, not enough to replace opening `MEMORY.md`.
 - `memory_summary.md` should not sound like a second-order executive summary. Prefer concrete,
   source-faithful wording over polished abstraction, especially in:
   - `## User preferences`
@@ -731,6 +761,9 @@ WORKFLOW
 ============================================================
 
 1. Determine mode (INIT vs INCREMENTAL UPDATE) using artifact availability and current run context.
+   Independently check `memory_summary.md` first line: if it is not exactly `v1`, regenerate
+   `memory_summary.md` from scratch after the other artifacts are finalized, even when `MEMORY.md`
+   itself can be updated incrementally.
 
 2. INIT phase behavior:
    - Read `raw_memories.md` first, then rollout summaries carefully.
@@ -747,8 +780,8 @@ WORKFLOW
      conflicting task families until MEMORY blocks are richer and more useful than raw memories
 
 3. INCREMENTAL UPDATE behavior:
-   - Read existing `MEMORY.md` and `memory_summary.md` first for continuity and to locate
-     existing references that may need surgical cleanup.
+   - Read existing `MEMORY.md` and, only when it starts with exactly `v1`, existing
+     `memory_summary.md` first for continuity and to locate references that may need surgical cleanup.
    - Use the injected git-style workspace changes as the first routing pass:
      - added/modified `raw_memories.md` and `rollout_summaries/*.md` = ingestion queue
      - deleted `rollout_summaries/*.md` and `extensions/*/resources/*.md` = forgetting /
@@ -775,6 +808,8 @@ WORKFLOW
      - doing light clustering and merging if needed
      - refreshing `MEMORY.md` top-of-file ordering so recent high-utility task families stay easy to find
      - rebuilding the `memory_summary.md` recent active window (last 3 memory days) from current `updated_at` coverage
+     - freely restructuring `memory_summary.md` so it reflects the current memory set without
+       stale topics, duplicated preference bullets, or obsolete routing labels
      - updating existing skills or adding new skills only when there is clear new reusable procedure
      - updating `memory_summary.md` last to reflect the final state of the memory folder
    - Minimize churn in incremental mode: if an existing `MEMORY.md` block or `## What's in Memory`
@@ -816,6 +851,9 @@ WORKFLOW
 
 7. Final pass:
    - remove duplication in memory_summary, skills/, and MEMORY.md
+   - verify `memory_summary.md` still begins with exactly `v1`
+   - verify `memory_summary.md` is dense: brief high-level profile, compact actionable
+     preferences, compact general tips, and a routing index rather than a second handbook
    - remove stale or low-signal blocks that are less likely to be useful in the future
    - remove or rewrite blocks/task sections whose supporting rollout references point only to
      deleted inputs or missing rollout summary files
diff --git a/codex-rs/models-manager/src/manager.rs b/codex-rs/models-manager/src/manager.rs
index 517bb0abbb..af510c8d73 100644
--- a/codex-rs/models-manager/src/manager.rs
+++ b/codex-rs/models-manager/src/manager.rs
@@ -3,11 +3,13 @@ use crate::collaboration_mode_presets::builtin_collaboration_mode_presets;
 use crate::config::ModelsManagerConfig;
 use crate::model_info;
 use async_trait::async_trait;
+use codex_app_server_protocol::AuthMode;
 use codex_login::AuthManager;
 use codex_protocol::config_types::CollaborationModeMask;
 use codex_protocol::error::Result as CoreResult;
 use codex_protocol::openai_models::ModelInfo;
 use codex_protocol::openai_models::ModelPreset;
+use codex_protocol::openai_models::ModelVisibility;
 use codex_protocol::openai_models::ModelsResponse;
 use std::fmt;
 use std::path::PathBuf;
@@ -319,6 +321,23 @@ impl OpenAiModelsManager {
 
     /// Replace the cached remote models and rebuild the derived presets list.
     async fn apply_remote_models(&self, models: Vec<ModelInfo>) {
+        // Use the remote models list as the source of truth if it contains at least one
+        // non-hidden model and the user is using ChatGPT auth.
+        let should_use_remote_models_only = !models.is_empty()
+            && models
+                .iter()
+                .any(|model| model.visibility == ModelVisibility::List)
+            && self.auth_manager.as_ref().is_some_and(|auth_manager| {
+                matches!(
+                    auth_manager.auth_mode(),
+                    Some(AuthMode::Chatgpt | AuthMode::ChatgptAuthTokens)
+                )
+            });
+        if should_use_remote_models_only {
+            *self.remote_models.write().await = models;
+            return;
+        }
+
         let mut existing_models = load_remote_models_from_file().unwrap_or_default();
         for model in models {
             if let Some(existing_index) = existing_models
diff --git a/codex-rs/models-manager/src/manager_tests.rs b/codex-rs/models-manager/src/manager_tests.rs
index 9df9fb09c9..ede7cfe795 100644
--- a/codex-rs/models-manager/src/manager_tests.rs
+++ b/codex-rs/models-manager/src/manager_tests.rs
@@ -366,6 +366,160 @@ async fn refresh_available_models_sorts_by_priority() {
     assert_eq!(endpoint.fetch_count(), 1, "expected a single model fetch");
 }
 
+#[tokio::test]
+async fn refresh_available_models_uses_remote_only_catalog_for_chatgpt_auth() {
+    let remote_models = vec![remote_model(
+        "chatgpt-visible-source-of-truth",
+        "ChatGPT Visible",
+        /*priority*/ 0,
+    )];
+    let codex_home = tempdir().expect("temp dir");
+    let endpoint = TestModelsEndpoint::new(vec![remote_models.clone()]);
+    let manager = openai_manager_for_tests(codex_home.path().to_path_buf(), endpoint.clone());
+
+    manager
+        .refresh_available_models(RefreshStrategy::OnlineIfUncached)
+        .await
+        .expect("refresh succeeds");
+
+    assert_eq!(manager.get_remote_models().await, remote_models);
+    assert_eq!(endpoint.fetch_count(), 1, "expected a single model fetch");
+}
+
+#[tokio::test]
+async fn refresh_available_models_uses_cached_remote_only_catalog_for_chatgpt_auth() {
+    let remote_models = vec![remote_model(
+        "chatgpt-cached-source-of-truth",
+        "ChatGPT Cached",
+        /*priority*/ 0,
+    )];
+    let codex_home = tempdir().expect("temp dir");
+    let fetch_endpoint = TestModelsEndpoint::new(vec![remote_models.clone()]);
+    let fetch_manager =
+        openai_manager_for_tests(codex_home.path().to_path_buf(), fetch_endpoint.clone());
+
+    fetch_manager
+        .refresh_available_models(RefreshStrategy::OnlineIfUncached)
+        .await
+        .expect("initial refresh succeeds");
+
+    let cache_endpoint = TestModelsEndpoint::new(Vec::new());
+    let cache_manager =
+        openai_manager_for_tests(codex_home.path().to_path_buf(), cache_endpoint.clone());
+
+    cache_manager
+        .refresh_available_models(RefreshStrategy::OnlineIfUncached)
+        .await
+        .expect("cached refresh succeeds");
+
+    assert_eq!(cache_manager.get_remote_models().await, remote_models);
+    assert_eq!(
+        cache_endpoint.fetch_count(),
+        0,
+        "fresh cache should avoid a model fetch"
+    );
+}
+
+#[tokio::test]
+async fn get_model_info_uses_fallback_for_bundled_models_when_chatgpt_remote_is_authoritative() {
+    let remote_models = vec![remote_model(
+        "chatgpt-authoritative-model-info",
+        "ChatGPT Model Info",
+        /*priority*/ 0,
+    )];
+    let codex_home = tempdir().expect("temp dir");
+    let endpoint = TestModelsEndpoint::new(vec![remote_models]);
+    let manager = openai_manager_for_tests(codex_home.path().to_path_buf(), endpoint);
+    let bundled_slug = load_remote_models_from_file()
+        .expect("bundled models should parse")
+        .first()
+        .expect("bundled models should contain at least one model")
+        .slug
+        .clone();
+
+    manager
+        .refresh_available_models(RefreshStrategy::OnlineIfUncached)
+        .await
+        .expect("refresh succeeds");
+
+    let model_info = manager
+        .get_model_info(&bundled_slug, &ModelsManagerConfig::default())
+        .await;
+
+    assert_eq!(model_info.slug, bundled_slug);
+    assert!(model_info.used_fallback_model_metadata);
+}
+
+#[tokio::test]
+async fn refresh_available_models_preserves_bundled_catalog_for_empty_chatgpt_remote() {
+    let codex_home = tempdir().expect("temp dir");
+    let endpoint = TestModelsEndpoint::new(vec![Vec::new()]);
+    let manager = openai_manager_for_tests(codex_home.path().to_path_buf(), endpoint);
+    let expected = load_remote_models_from_file().expect("bundled models should parse");
+
+    manager
+        .refresh_available_models(RefreshStrategy::OnlineIfUncached)
+        .await
+        .expect("refresh succeeds");
+
+    assert_eq!(manager.get_remote_models().await, expected);
+}
+
+#[tokio::test]
+async fn refresh_available_models_merges_hidden_only_chatgpt_remote_with_bundled_catalog() {
+    let hidden_remote = remote_model_with_visibility(
+        "chatgpt-hidden-only",
+        "ChatGPT Hidden",
+        /*priority*/ 0,
+        "hide",
+    );
+    let codex_home = tempdir().expect("temp dir");
+    let endpoint = TestModelsEndpoint::new(vec![vec![hidden_remote.clone()]]);
+    let manager = openai_manager_for_tests(codex_home.path().to_path_buf(), endpoint);
+    let mut expected = load_remote_models_from_file().expect("bundled models should parse");
+    expected.push(hidden_remote);
+
+    manager
+        .refresh_available_models(RefreshStrategy::OnlineIfUncached)
+        .await
+        .expect("refresh succeeds");
+
+    assert_eq!(manager.get_remote_models().await, expected);
+}
+
+#[tokio::test]
+async fn refresh_available_models_keeps_merging_for_api_auth() {
+    let remote_models = vec![remote_model(
+        "api-auth-visible-remote",
+        "API Auth Visible",
+        /*priority*/ 0,
+    )];
+    let codex_home = tempdir().expect("temp dir");
+    let endpoint = Arc::new(TestModelsEndpoint {
+        has_command_auth: true,
+        uses_codex_backend: false,
+        responses: Mutex::new(vec![remote_models.clone()].into()),
+        fetch_count: AtomicUsize::new(0),
+    });
+    let manager = openai_manager_for_tests_with_auth(
+        codex_home.path().to_path_buf(),
+        endpoint.clone(),
+        Some(AuthManager::from_auth_for_testing(CodexAuth::from_api_key(
+            "test-api-key",
+        ))),
+    );
+    let mut expected = load_remote_models_from_file().expect("bundled models should parse");
+    expected.extend(remote_models);
+
+    manager
+        .refresh_available_models(RefreshStrategy::OnlineIfUncached)
+        .await
+        .expect("refresh succeeds");
+
+    assert_eq!(manager.get_remote_models().await, expected);
+    assert_eq!(endpoint.fetch_count(), 1, "expected a single model fetch");
+}
+
 #[tokio::test]
 async fn refresh_available_models_uses_cache_when_fresh() {
     let remote_models = vec![remote_model("cached", "Cached", /*priority*/ 5)];
diff --git a/codex-rs/otel/src/events/session_telemetry.rs b/codex-rs/otel/src/events/session_telemetry.rs
index 49d8b8eb7e..6394c73ea2 100644
--- a/codex-rs/otel/src/events/session_telemetry.rs
+++ b/codex-rs/otel/src/events/session_telemetry.rs
@@ -1141,6 +1141,7 @@ impl SessionTelemetry {
             ResponseItem::WebSearchCall { .. } => "web_search_call".into(),
             ResponseItem::ImageGenerationCall { .. } => "image_generation_call".into(),
             ResponseItem::Compaction { .. } => "compaction".into(),
+            ResponseItem::CompactionTrigger => "compaction_trigger".into(),
             ResponseItem::ContextCompaction { .. } => "context_compaction".into(),
             ResponseItem::Other => "other".into(),
         }
diff --git a/codex-rs/otel/src/metrics/names.rs b/codex-rs/otel/src/metrics/names.rs
index 82fae06734..17a39816a7 100644
--- a/codex-rs/otel/src/metrics/names.rs
+++ b/codex-rs/otel/src/metrics/names.rs
@@ -29,8 +29,11 @@ pub const TURN_MEMORY_METRIC: &str = "codex.turn.memory";
 pub const TURN_TOOL_CALL_METRIC: &str = "codex.turn.tool.call";
 pub const TURN_TOKEN_USAGE_METRIC: &str = "codex.turn.token_usage";
 pub const GOAL_CREATED_METRIC: &str = "codex.goal.created";
+pub const GOAL_RESUMED_METRIC: &str = "codex.goal.resumed";
 pub const GOAL_COMPLETED_METRIC: &str = "codex.goal.completed";
 pub const GOAL_BUDGET_LIMITED_METRIC: &str = "codex.goal.budget_limited";
+pub const GOAL_USAGE_LIMITED_METRIC: &str = "codex.goal.usage_limited";
+pub const GOAL_BLOCKED_METRIC: &str = "codex.goal.blocked";
 pub const GOAL_TOKEN_COUNT_METRIC: &str = "codex.goal.token_count";
 pub const GOAL_DURATION_SECONDS_METRIC: &str = "codex.goal.duration_s";
 pub const PROFILE_USAGE_METRIC: &str = "codex.profile.usage";
diff --git a/codex-rs/otel/tests/suite/otel_export_routing_policy.rs b/codex-rs/otel/tests/suite/otel_export_routing_policy.rs
index ef30fbcd83..aba22a8e80 100644
--- a/codex-rs/otel/tests/suite/otel_export_routing_policy.rs
+++ b/codex-rs/otel/tests/suite/otel_export_routing_policy.rs
@@ -139,9 +139,11 @@ fn otel_export_routing_policy_routes_user_prompt_log_and_trace_events() {
             },
             UserInput::Image {
                 image_url: "https://example.com/image.png".to_string(),
+                detail: None,
             },
             UserInput::LocalImage {
                 path: PathBuf::from("/tmp/secret.png"),
+                detail: None,
             },
         ]);
     });
diff --git a/codex-rs/protocol/src/config_types.rs b/codex-rs/protocol/src/config_types.rs
index 37e8d95e25..b4b4759c9b 100644
--- a/codex-rs/protocol/src/config_types.rs
+++ b/codex-rs/protocol/src/config_types.rs
@@ -9,7 +9,10 @@ use serde::Deserialize;
 use serde::Serialize;
 use serde_json::Value;
 use std::collections::HashMap;
+use std::fmt;
 use std::num::NonZeroU64;
+use std::ops::Deref;
+use std::str::FromStr;
 use std::time::Duration;
 use strum_macros::Display;
 use strum_macros::EnumIter;
@@ -18,6 +21,21 @@ use wildmatch::WildMatchPattern;
 
 use crate::openai_models::ReasoningEffort;
 
+/// Selects which part of the active context is charged against
+/// `model_auto_compact_token_limit`.
+#[derive(
+    Debug, Serialize, Deserialize, Default, Clone, Copy, PartialEq, Eq, Display, JsonSchema, TS,
+)]
+#[serde(rename_all = "snake_case")]
+#[strum(serialize_all = "snake_case")]
+pub enum AutoCompactTokenLimitScope {
+    /// Count the full active context against the limit.
+    #[default]
+    Total,
+    /// Count sampled output and later growth after the carried window prefix.
+    BodyAfterPrefix,
+}
+
 /// A summary of the reasoning performed by the model. This can be useful for
 /// debugging and understanding the model's reasoning process.
 /// See https://platform.openai.com/docs/guides/reasoning?api-mode=responses#reasoning-summaries
@@ -77,6 +95,65 @@ pub enum SandboxMode {
     DangerFullAccess,
 }
 
+/// Validated plain profile-v2 name used to select `$CODEX_HOME/<name>.config.toml`.
+#[derive(Clone, Debug, PartialEq, Eq)]
+pub struct ProfileV2Name(String);
+
+impl ProfileV2Name {
+    pub fn as_str(&self) -> &str {
+        &self.0
+    }
+}
+
+#[derive(Debug, PartialEq, Eq)]
+pub struct ProfileV2NameParseError {
+    value: String,
+}
+
+impl fmt::Display for ProfileV2NameParseError {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        write!(
+            f,
+            "invalid --profile-v2 value `{}`; pass a plain name such as `work`",
+            self.value
+        )
+    }
+}
+
+impl std::error::Error for ProfileV2NameParseError {}
+
+impl FromStr for ProfileV2Name {
+    type Err = ProfileV2NameParseError;
+
+    fn from_str(value: &str) -> Result<Self, Self::Err> {
+        if value.is_empty()
+            || !value
+                .bytes()
+                .all(|byte| byte.is_ascii_alphanumeric() || matches!(byte, b'_' | b'-'))
+        {
+            return Err(ProfileV2NameParseError {
+                value: value.to_string(),
+            });
+        }
+
+        Ok(Self(value.to_string()))
+    }
+}
+
+impl Deref for ProfileV2Name {
+    type Target = str;
+
+    fn deref(&self) -> &Self::Target {
+        self.as_str()
+    }
+}
+
+impl fmt::Display for ProfileV2Name {
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        self.0.fmt(f)
+    }
+}
+
 #[derive(Deserialize, Debug, Clone, Copy, PartialEq, Eq, Default, Serialize, Display, TS)]
 #[strum(serialize_all = "snake_case")]
 #[ts(type = r#""user" | "auto_review" | "guardian_subagent""#)]
@@ -690,6 +767,24 @@ mod tests {
         }
     }
 
+    #[test]
+    fn profile_v2_name_rejects_paths_and_empty_names() {
+        assert_eq!(
+            ProfileV2Name::from_str("../foo"),
+            Err(ProfileV2NameParseError {
+                value: "../foo".to_string(),
+            }),
+            "dots and slashes are disallowed to prevent reading arbitrary files"
+        );
+        assert_eq!(
+            ProfileV2Name::from_str(""),
+            Err(ProfileV2NameParseError {
+                value: String::new(),
+            }),
+            "profile name cannot be empty"
+        );
+    }
+
     #[test]
     fn tui_visible_collaboration_modes_match_mode_kind_visibility() {
         let expected = [ModeKind::Default, ModeKind::Plan];
diff --git a/codex-rs/protocol/src/items.rs b/codex-rs/protocol/src/items.rs
index 499db6fc85..9263d54796 100644
--- a/codex-rs/protocol/src/items.rs
+++ b/codex-rs/protocol/src/items.rs
@@ -1,6 +1,7 @@
 use crate::mcp::CallToolResult;
 use crate::memory_citation::MemoryCitation;
 use crate::models::ContentItem;
+use crate::models::ImageDetail;
 use crate::models::MessagePhase;
 use crate::models::ResponseItem;
 use crate::models::WebSearchAction;
@@ -243,7 +244,9 @@ impl UserMessageItem {
         EventMsg::UserMessage(UserMessageEvent {
             message: self.message(),
             images: Some(self.image_urls()),
+            image_details: self.image_details(),
             local_images: self.local_image_paths(),
+            local_image_details: self.local_image_details(),
             text_elements: self.text_elements(),
         })
     }
@@ -290,21 +293,54 @@ impl UserMessageItem {
         self.content
             .iter()
             .filter_map(|c| match c {
-                UserInput::Image { image_url } => Some(image_url.clone()),
+                UserInput::Image { image_url, .. } => Some(image_url.clone()),
                 _ => None,
             })
             .collect()
     }
 
+    pub fn image_details(&self) -> Vec<Option<ImageDetail>> {
+        trim_trailing_default_image_details(
+            self.content
+                .iter()
+                .filter_map(|c| match c {
+                    UserInput::Image { detail, .. } => Some(*detail),
+                    _ => None,
+                })
+                .collect(),
+        )
+    }
+
     pub fn local_image_paths(&self) -> Vec<std::path::PathBuf> {
         self.content
             .iter()
             .filter_map(|c| match c {
-                UserInput::LocalImage { path } => Some(path.clone()),
+                UserInput::LocalImage { path, .. } => Some(path.clone()),
                 _ => None,
             })
             .collect()
     }
+
+    pub fn local_image_details(&self) -> Vec<Option<ImageDetail>> {
+        trim_trailing_default_image_details(
+            self.content
+                .iter()
+                .filter_map(|c| match c {
+                    UserInput::LocalImage { detail, .. } => Some(*detail),
+                    _ => None,
+                })
+                .collect(),
+        )
+    }
+}
+
+fn trim_trailing_default_image_details(
+    mut details: Vec<Option<ImageDetail>>,
+) -> Vec<Option<ImageDetail>> {
+    while matches!(details.last(), Some(None)) {
+        details.pop();
+    }
+    details
 }
 
 impl HookPromptItem {
diff --git a/codex-rs/protocol/src/models.rs b/codex-rs/protocol/src/models.rs
index 5a0fafad94..d1d2abe755 100644
--- a/codex-rs/protocol/src/models.rs
+++ b/codex-rs/protocol/src/models.rs
@@ -126,7 +126,7 @@ impl FileSystemPermissions {
             match entry.access {
                 FileSystemAccessMode::Read => read.push(path.clone()),
                 FileSystemAccessMode::Write => write.push(path.clone()),
-                FileSystemAccessMode::None => return None,
+                FileSystemAccessMode::Deny => return None,
             }
         }
 
@@ -297,6 +297,15 @@ impl ManagedFileSystemPermissions {
     }
 }
 
+/// Reserved identifier for the built-in read-only permission profile.
+pub const BUILT_IN_PERMISSION_PROFILE_READ_ONLY: &str = ":read-only";
+
+/// Reserved identifier for the built-in workspace-write permission profile.
+pub const BUILT_IN_PERMISSION_PROFILE_WORKSPACE: &str = ":workspace";
+
+/// Reserved identifier for the built-in full-access permission profile.
+pub const BUILT_IN_PERMISSION_PROFILE_DANGER_FULL_ACCESS: &str = ":danger-full-access";
+
 /// Canonical active runtime permissions for a conversation, turn, or command.
 #[derive(Debug, Clone, Eq, PartialEq, Serialize, JsonSchema, TS)]
 #[serde(tag = "type", rename_all = "snake_case")]
@@ -335,21 +344,6 @@ pub struct ActivePermissionProfile {
     #[serde(default, skip_serializing_if = "Option::is_none")]
     #[ts(optional)]
     pub extends: Option<String>,
-
-    /// Bounded user-requested modifications applied on top of the named
-    /// profile, if any.
-    #[serde(default, skip_serializing_if = "Vec::is_empty")]
-    pub modifications: Vec<ActivePermissionProfileModification>,
-}
-
-#[derive(Debug, Clone, Eq, PartialEq, Deserialize, Serialize, JsonSchema, TS)]
-#[serde(tag = "type", rename_all = "snake_case")]
-#[ts(tag = "type")]
-pub enum ActivePermissionProfileModification {
-    /// Additional concrete directory that should be writable.
-    #[serde(rename_all = "snake_case")]
-    #[ts(rename_all = "snake_case")]
-    AdditionalWritableRoot { path: AbsolutePathBuf },
 }
 
 impl ActivePermissionProfile {
@@ -357,16 +351,11 @@ impl ActivePermissionProfile {
         Self {
             id: id.into(),
             extends: None,
-            modifications: Vec::new(),
         }
     }
 
-    pub fn with_modifications(
-        mut self,
-        modifications: Vec<ActivePermissionProfileModification>,
-    ) -> Self {
-        self.modifications = modifications;
-        self
+    pub fn read_only() -> Self {
+        Self::new(BUILT_IN_PERMISSION_PROFILE_READ_ONLY)
     }
 }
 
@@ -402,7 +391,7 @@ impl PermissionProfile {
     /// Managed workspace-write filesystem access with restricted network
     /// access.
     ///
-    /// The returned profile contains symbolic `:project_roots` entries that
+    /// The returned profile contains symbolic `:workspace_roots` entries that
     /// must be resolved against the active permission root before enforcement.
     pub fn workspace_write() -> Self {
         Self::workspace_write_with(
@@ -416,7 +405,7 @@ impl PermissionProfile {
     /// Managed workspace-write filesystem access with the legacy
     /// `sandbox_workspace_write` knobs applied directly to the profile.
     ///
-    /// The returned profile contains symbolic `:project_roots` entries that
+    /// The returned profile contains symbolic `:workspace_roots` entries that
     /// must be resolved against the active permission root before enforcement.
     pub fn workspace_write_with(
         writable_roots: &[AbsolutePathBuf],
@@ -435,6 +424,28 @@ impl PermissionProfile {
         }
     }
 
+    pub fn materialize_project_roots_with_workspace_roots(
+        self,
+        workspace_roots: &[AbsolutePathBuf],
+    ) -> Self {
+        match self {
+            Self::Managed {
+                file_system,
+                network,
+            } => {
+                let file_system = file_system
+                    .to_sandbox_policy()
+                    .materialize_project_roots_with_workspace_roots(workspace_roots);
+                Self::Managed {
+                    file_system: ManagedFileSystemPermissions::from_sandbox_policy(&file_system),
+                    network,
+                }
+            }
+            Self::Disabled => Self::Disabled,
+            Self::External { network } => Self::External { network },
+        }
+    }
+
     pub fn from_runtime_permissions(
         file_system_sandbox_policy: &FileSystemSandboxPolicy,
         network_sandbox_policy: NetworkSandboxPolicy,
@@ -714,8 +725,6 @@ pub enum ContentItem {
 #[derive(Debug, Clone, Copy, Serialize, Deserialize, PartialEq, Eq, JsonSchema, TS)]
 #[serde(rename_all = "lowercase")]
 pub enum ImageDetail {
-    Auto,
-    Low,
     High,
     Original,
 }
@@ -880,7 +889,10 @@ pub enum ResponseItem {
         result: String,
     },
     #[serde(alias = "compaction_summary")]
-    Compaction { encrypted_content: String },
+    Compaction {
+        encrypted_content: String,
+    },
+    CompactionTrigger,
     ContextCompaction {
         #[serde(default, skip_serializing_if = "Option::is_none")]
         #[ts(optional)]
@@ -1054,8 +1066,13 @@ pub fn local_image_content_items_with_label_number(
     path: &std::path::Path,
     file_bytes: Vec<u8>,
     label_number: Option<usize>,
-    mode: PromptImageMode,
+    detail: ImageDetail,
 ) -> Vec<ContentItem> {
+    let mode = match detail {
+        ImageDetail::Original => PromptImageMode::Original,
+        ImageDetail::High => PromptImageMode::ResizeToFit,
+    };
+
     match load_for_prompt_bytes(path, file_bytes, mode) {
         Ok(image) => {
             let mut items = Vec::with_capacity(3);
@@ -1066,7 +1083,7 @@ pub fn local_image_content_items_with_label_number(
             }
             items.push(ContentItem::InputImage {
                 image_url: image.into_data_url(),
-                detail: Some(DEFAULT_IMAGE_DETAIL),
+                detail: Some(detail),
             });
             if label_number.is_some() {
                 items.push(ContentItem::InputText {
@@ -1211,29 +1228,31 @@ impl From<Vec<UserInput>> for ResponseInputItem {
                 .into_iter()
                 .flat_map(|c| match c {
                     UserInput::Text { text, .. } => vec![ContentItem::InputText { text }],
-                    UserInput::Image { image_url } => {
+                    UserInput::Image { image_url, detail } => {
                         image_index += 1;
+                        let detail = detail.unwrap_or(DEFAULT_IMAGE_DETAIL);
                         vec![
                             ContentItem::InputText {
                                 text: image_open_tag_text(),
                             },
                             ContentItem::InputImage {
                                 image_url,
-                                detail: Some(DEFAULT_IMAGE_DETAIL),
+                                detail: Some(detail),
                             },
                             ContentItem::InputText {
                                 text: image_close_tag_text(),
                             },
                         ]
                     }
-                    UserInput::LocalImage { path } => {
+                    UserInput::LocalImage { path, detail } => {
                         image_index += 1;
+                        let detail = detail.unwrap_or(DEFAULT_IMAGE_DETAIL);
                         match std::fs::read(&path) {
                             Ok(file_bytes) => local_image_content_items_with_label_number(
                                 &path,
                                 file_bytes,
                                 Some(image_index),
-                                PromptImageMode::ResizeToFit,
+                                detail,
                             ),
                             Err(err) => vec![local_image_error_placeholder(&path, err)],
                         }
@@ -1253,30 +1272,6 @@ pub struct SearchToolCallParams {
     pub limit: Option<usize>,
 }
 
-/// If the `name` of a `ResponseItem::FunctionCall` is either `container.exec`
-/// or `shell`, the `arguments` field should deserialize to this struct.
-#[derive(Deserialize, Debug, Clone, PartialEq, JsonSchema, TS)]
-pub struct ShellToolCallParams {
-    pub command: Vec<String>,
-    pub workdir: Option<String>,
-
-    /// This is the maximum time in milliseconds that the command is allowed to run.
-    #[serde(alias = "timeout")]
-    pub timeout_ms: Option<u64>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    #[ts(optional)]
-    pub sandbox_permissions: Option<SandboxPermissions>,
-    /// Suggests a command prefix to persist for future sessions
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    #[ts(optional)]
-    pub prefix_rule: Option<Vec<String>>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    #[ts(optional)]
-    pub additional_permissions: Option<AdditionalPermissionProfile>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub justification: Option<String>,
-}
-
 /// If the `name` of a `ResponseItem::FunctionCall` is `shell_command`, the
 /// `arguments` field should deserialize to this struct.
 #[derive(Deserialize, Debug, Clone, PartialEq, JsonSchema, TS)]
@@ -1601,8 +1596,6 @@ fn convert_mcp_content_to_items(
                         .and_then(|meta| meta.get(CODEX_IMAGE_DETAIL_META_KEY))
                         .and_then(serde_json::Value::as_str)
                         .and_then(|detail| match detail {
-                            "auto" => Some(ImageDetail::Auto),
-                            "low" => Some(ImageDetail::Low),
                             "high" => Some(ImageDetail::High),
                             "original" => Some(ImageDetail::Original),
                             _ => None,
@@ -1647,6 +1640,14 @@ mod tests {
     use std::path::PathBuf;
     use tempfile::tempdir;
 
+    // A tiny valid PNG (1x1) so image conversion tests don't depend on cross-crate
+    // file paths, which break under Bazel sandboxing.
+    const TINY_PNG_BYTES: &[u8] = &[
+        137, 80, 78, 71, 13, 10, 26, 10, 0, 0, 0, 13, 73, 72, 68, 82, 0, 0, 0, 1, 0, 0, 0, 1, 8, 6,
+        0, 0, 0, 31, 21, 196, 137, 0, 0, 0, 11, 73, 68, 65, 84, 120, 156, 99, 96, 0, 2, 0, 0, 5, 0,
+        1, 122, 94, 171, 63, 0, 0, 0, 0, 73, 69, 78, 68, 174, 66, 96, 130,
+    ];
+
     #[test]
     fn response_input_message_conversion_preserves_phase() {
         let item = ResponseItem::from(ResponseInputItem::Message {
@@ -1787,7 +1788,7 @@ mod tests {
                 path: FileSystemPath::GlobPattern {
                     pattern: "**/*.env".to_string(),
                 },
-                access: FileSystemAccessMode::None,
+                access: FileSystemAccessMode::Deny,
             }]);
         file_system_sandbox_policy.glob_scan_max_depth = Some(2);
 
@@ -2424,20 +2425,28 @@ mod tests {
     }
 
     #[test]
-    fn serializes_context_compaction_trigger_without_payload() -> Result<()> {
-        let item = ResponseItem::ContextCompaction {
-            encrypted_content: None,
-        };
+    fn serializes_compaction_trigger_without_payload() -> Result<()> {
+        let item = ResponseItem::CompactionTrigger;
 
         assert_eq!(
             serde_json::to_value(item)?,
             serde_json::json!({
-                "type": "context_compaction",
+                "type": "compaction_trigger",
             })
         );
         Ok(())
     }
 
+    #[test]
+    fn deserializes_compaction_trigger_without_payload() -> Result<()> {
+        let json = r#"{"type":"compaction_trigger"}"#;
+
+        let item: ResponseItem = serde_json::from_str(json)?;
+
+        assert_eq!(item, ResponseItem::CompactionTrigger);
+        Ok(())
+    }
+
     #[test]
     fn deserializes_legacy_ghost_snapshot_as_other() -> Result<()> {
         let json = r#"{
@@ -2545,36 +2554,13 @@ mod tests {
         Ok(())
     }
 
-    #[test]
-    fn deserialize_shell_tool_call_params() -> Result<()> {
-        let json = r#"{
-            "command": ["ls", "-l"],
-            "workdir": "/tmp",
-            "timeout": 1000
-        }"#;
-
-        let params: ShellToolCallParams = serde_json::from_str(json)?;
-        assert_eq!(
-            ShellToolCallParams {
-                command: vec!["ls".to_string(), "-l".to_string()],
-                workdir: Some("/tmp".to_string()),
-                timeout_ms: Some(1000),
-                sandbox_permissions: None,
-                prefix_rule: None,
-                additional_permissions: None,
-                justification: None,
-            },
-            params
-        );
-        Ok(())
-    }
-
     #[test]
     fn wraps_image_user_input_with_tags() -> Result<()> {
         let image_url = "data:image/png;base64,abc".to_string();
 
         let item = ResponseInputItem::from(vec![UserInput::Image {
             image_url: image_url.clone(),
+            detail: None,
         }]);
 
         match item {
@@ -2599,6 +2585,31 @@ mod tests {
         Ok(())
     }
 
+    #[test]
+    fn image_user_input_preserves_requested_detail() -> Result<()> {
+        let image_url = "data:image/png;base64,abc".to_string();
+
+        let item = ResponseInputItem::from(vec![UserInput::Image {
+            image_url: image_url.clone(),
+            detail: Some(ImageDetail::Original),
+        }]);
+
+        match item {
+            ResponseInputItem::Message { content, .. } => {
+                assert_eq!(
+                    content.get(1),
+                    Some(&ContentItem::InputImage {
+                        image_url,
+                        detail: Some(ImageDetail::Original),
+                    })
+                );
+            }
+            other => panic!("expected message response but got {other:?}"),
+        }
+
+        Ok(())
+    }
+
     #[test]
     fn tool_search_call_roundtrips() -> Result<()> {
         let parsed: ResponseItem = serde_json::from_str(
@@ -2767,20 +2778,17 @@ mod tests {
         let image_url = "data:image/png;base64,abc".to_string();
         let dir = tempdir()?;
         let local_path = dir.path().join("local.png");
-        // A tiny valid PNG (1x1) so this test doesn't depend on cross-crate file paths, which
-        // break under Bazel sandboxing.
-        const TINY_PNG_BYTES: &[u8] = &[
-            137, 80, 78, 71, 13, 10, 26, 10, 0, 0, 0, 13, 73, 72, 68, 82, 0, 0, 0, 1, 0, 0, 0, 1,
-            8, 6, 0, 0, 0, 31, 21, 196, 137, 0, 0, 0, 11, 73, 68, 65, 84, 120, 156, 99, 96, 0, 2,
-            0, 0, 5, 0, 1, 122, 94, 171, 63, 0, 0, 0, 0, 73, 69, 78, 68, 174, 66, 96, 130,
-        ];
         std::fs::write(&local_path, TINY_PNG_BYTES)?;
 
         let item = ResponseInputItem::from(vec![
             UserInput::Image {
                 image_url: image_url.clone(),
+                detail: None,
+            },
+            UserInput::LocalImage {
+                path: local_path,
+                detail: None,
             },
-            UserInput::LocalImage { path: local_path },
         ]);
 
         match item {
@@ -2827,6 +2835,33 @@ mod tests {
         Ok(())
     }
 
+    #[test]
+    fn local_image_user_input_preserves_requested_detail() -> Result<()> {
+        let dir = tempdir()?;
+        let local_path = dir.path().join("local.png");
+        std::fs::write(&local_path, TINY_PNG_BYTES)?;
+
+        let item = ResponseInputItem::from(vec![UserInput::LocalImage {
+            path: local_path,
+            detail: Some(ImageDetail::Original),
+        }]);
+
+        match item {
+            ResponseInputItem::Message { content, .. } => {
+                assert!(matches!(
+                    content.get(1),
+                    Some(ContentItem::InputImage {
+                        detail: Some(ImageDetail::Original),
+                        ..
+                    })
+                ));
+            }
+            other => panic!("expected message response but got {other:?}"),
+        }
+
+        Ok(())
+    }
+
     #[test]
     fn local_image_read_error_adds_placeholder() -> Result<()> {
         let dir = tempdir()?;
@@ -2834,6 +2869,7 @@ mod tests {
 
         let item = ResponseInputItem::from(vec![UserInput::LocalImage {
             path: missing_path.clone(),
+            detail: None,
         }]);
 
         match item {
@@ -2868,6 +2904,7 @@ mod tests {
 
         let item = ResponseInputItem::from(vec![UserInput::LocalImage {
             path: json_path.clone(),
+            detail: None,
         }]);
 
         match item {
@@ -2905,6 +2942,7 @@ mod tests {
 
         let item = ResponseInputItem::from(vec![UserInput::LocalImage {
             path: svg_path.clone(),
+            detail: None,
         }]);
 
         match item {
diff --git a/codex-rs/protocol/src/permissions.rs b/codex-rs/protocol/src/permissions.rs
index abbfc0b19f..f90859a92b 100644
--- a/codex-rs/protocol/src/permissions.rs
+++ b/codex-rs/protocol/src/permissions.rs
@@ -95,7 +95,7 @@ impl NetworkSandboxPolicy {
 /// Access mode for a filesystem entry.
 ///
 /// When two equally specific entries target the same path, we compare these by
-/// conflict precedence rather than by capability breadth: `none` beats
+/// conflict precedence rather than by capability breadth: `deny` beats
 /// `write`, and `write` beats `read`.
 #[derive(
     Debug,
@@ -117,12 +117,14 @@ impl NetworkSandboxPolicy {
 pub enum FileSystemAccessMode {
     Read,
     Write,
-    None,
+    /// `none` is a legacy input alias retained temporarily for compatibility.
+    #[serde(alias = "none")]
+    Deny,
 }
 
 impl FileSystemAccessMode {
     pub fn can_read(self) -> bool {
-        !matches!(self, FileSystemAccessMode::None)
+        !matches!(self, FileSystemAccessMode::Deny)
     }
 
     pub fn can_write(self) -> bool {
@@ -341,7 +343,7 @@ pub enum FileSystemPath {
         path: AbsolutePathBuf,
     },
     /// A git-style glob pattern. Pattern entries currently support
-    /// FileSystemAccessMode::None only.
+    /// FileSystemAccessMode::Deny only.
     GlobPattern {
         pattern: String,
     },
@@ -350,6 +352,12 @@ pub enum FileSystemPath {
     },
 }
 
+const PROJECT_ROOTS_GLOB_PATTERN_PREFIX: &str = "codex-project-roots://";
+
+pub fn project_roots_glob_pattern(subpath: &Path) -> String {
+    format!("{PROJECT_ROOTS_GLOB_PATTERN_PREFIX}{}", subpath.display())
+}
+
 impl Default for FileSystemSandboxPolicy {
     fn default() -> Self {
         Self {
@@ -406,7 +414,7 @@ impl FileSystemSandboxPolicy {
             && self
                 .entries
                 .iter()
-                .any(|entry| entry.access == FileSystemAccessMode::None)
+                .any(|entry| entry.access == FileSystemAccessMode::Deny)
     }
 
     pub fn from_legacy_sandbox_policy_preserving_deny_entries(
@@ -423,7 +431,7 @@ impl FileSystemSandboxPolicy {
         for deny_entry in existing
             .entries
             .iter()
-            .filter(|entry| entry.access == FileSystemAccessMode::None)
+            .filter(|entry| entry.access == FileSystemAccessMode::Deny)
         {
             if !rebuilt.entries.iter().any(|entry| entry == deny_entry) {
                 rebuilt.entries.push(deny_entry.clone());
@@ -439,7 +447,7 @@ impl FileSystemSandboxPolicy {
         let has_deny_read_entries = existing
             .entries
             .iter()
-            .any(|entry| entry.access == FileSystemAccessMode::None);
+            .any(|entry| entry.access == FileSystemAccessMode::Deny);
         if matches!(self.kind, FileSystemSandboxKind::Unrestricted) && has_deny_read_entries {
             *self = Self::restricted(vec![FileSystemSandboxEntry {
                 path: FileSystemPath::Special {
@@ -460,7 +468,7 @@ impl FileSystemSandboxPolicy {
         for deny_entry in existing
             .entries
             .iter()
-            .filter(|entry| entry.access == FileSystemAccessMode::None)
+            .filter(|entry| entry.access == FileSystemAccessMode::Deny)
         {
             if !self.entries.iter().any(|entry| entry == deny_entry) {
                 self.entries.push(deny_entry.clone());
@@ -486,7 +494,7 @@ impl FileSystemSandboxPolicy {
                     FileSystemPath::Path { .. } => !self.has_same_target_write_override(entry),
                     FileSystemPath::GlobPattern { .. } => true,
                     FileSystemPath::Special { value } => match value {
-                        FileSystemSpecialPath::Root => entry.access == FileSystemAccessMode::None,
+                        FileSystemSpecialPath::Root => entry.access == FileSystemAccessMode::Deny,
                         FileSystemSpecialPath::Minimal | FileSystemSpecialPath::Unknown { .. } => {
                             false
                         }
@@ -648,7 +656,7 @@ impl FileSystemSandboxPolicy {
         }
 
         let Some(path) = resolve_candidate_path(path, cwd) else {
-            return FileSystemAccessMode::None;
+            return FileSystemAccessMode::Deny;
         };
 
         self.resolved_entries_with_cwd(cwd)
@@ -656,7 +664,7 @@ impl FileSystemSandboxPolicy {
             .filter(|entry| path.as_path().starts_with(entry.path.as_path()))
             .max_by_key(resolved_entry_precedence)
             .map(|entry| entry.access)
-            .unwrap_or(FileSystemAccessMode::None)
+            .unwrap_or(FileSystemAccessMode::Deny)
     }
 
     pub fn can_read_path_with_cwd(&self, path: &Path, cwd: &Path) -> bool {
@@ -695,7 +703,7 @@ impl FileSystemSandboxPolicy {
         )
     }
 
-    /// Replaces symbolic `:project_roots` entries with absolute paths resolved
+    /// Replaces symbolic `:workspace_roots` entries with absolute paths resolved
     /// against `cwd`.
     ///
     /// Use this when a durable permission profile must survive a cwd-only
@@ -703,15 +711,100 @@ impl FileSystemSandboxPolicy {
     pub fn materialize_project_roots_with_cwd(mut self, cwd: &Path) -> Self {
         let cwd = AbsolutePathBuf::from_absolute_path(cwd).ok();
         for entry in &mut self.entries {
-            let FileSystemPath::Special {
-                value: FileSystemSpecialPath::ProjectRoots { .. },
-            } = &entry.path
-            else {
-                continue;
-            };
+            match &entry.path {
+                FileSystemPath::Special {
+                    value: FileSystemSpecialPath::ProjectRoots { .. },
+                } => {
+                    if let Some(path) = resolve_file_system_path(&entry.path, cwd.as_ref()) {
+                        entry.path = FileSystemPath::Path { path };
+                    }
+                }
+                FileSystemPath::GlobPattern { pattern } => {
+                    if let (Some(cwd), Some(subpath)) =
+                        (cwd.as_ref(), parse_project_roots_glob_pattern(pattern))
+                    {
+                        entry.path = FileSystemPath::GlobPattern {
+                            pattern: resolve_project_roots_glob_pattern(subpath, cwd),
+                        };
+                    }
+                }
+                FileSystemPath::Special { value: _ } => {}
+                FileSystemPath::Path { .. } => {}
+            }
+        }
+        self
+    }
 
-            if let Some(path) = resolve_file_system_path(&entry.path, cwd.as_ref()) {
-                entry.path = FileSystemPath::Path { path };
+    /// Replaces symbolic `:workspace_roots` entries with concrete entries for
+    /// each workspace root.
+    pub fn materialize_project_roots_with_workspace_roots(
+        mut self,
+        workspace_roots: &[AbsolutePathBuf],
+    ) -> Self {
+        let mut entries = Vec::with_capacity(self.entries.len());
+        for entry in self.entries {
+            match entry.path {
+                FileSystemPath::Special {
+                    value: FileSystemSpecialPath::ProjectRoots { subpath },
+                } => {
+                    entries.extend(workspace_roots.iter().map(|root| FileSystemSandboxEntry {
+                        path: FileSystemPath::Path {
+                            path: match subpath.as_ref() {
+                                Some(subpath) => AbsolutePathBuf::resolve_path_against_base(
+                                    subpath,
+                                    root.as_path(),
+                                ),
+                                None => root.clone(),
+                            },
+                        },
+                        access: entry.access,
+                    }));
+                }
+                FileSystemPath::GlobPattern { pattern } => {
+                    if let Some(subpath) = parse_project_roots_glob_pattern(&pattern) {
+                        entries.extend(workspace_roots.iter().map(|root| FileSystemSandboxEntry {
+                            path: FileSystemPath::GlobPattern {
+                                pattern: resolve_project_roots_glob_pattern(subpath, root),
+                            },
+                            access: entry.access,
+                        }));
+                    } else {
+                        entries.push(FileSystemSandboxEntry {
+                            path: FileSystemPath::GlobPattern { pattern },
+                            access: entry.access,
+                        });
+                    }
+                }
+                FileSystemPath::Path { path } => {
+                    entries.push(FileSystemSandboxEntry {
+                        path: FileSystemPath::Path { path },
+                        access: entry.access,
+                    });
+                }
+                FileSystemPath::Special { value } => {
+                    entries.push(FileSystemSandboxEntry {
+                        path: FileSystemPath::Special { value },
+                        access: entry.access,
+                    });
+                }
+            }
+        }
+        self.entries = entries;
+        self
+    }
+
+    /// Preserves symbolic `:workspace_roots` entries while also adding concrete
+    /// entries for each provided workspace root.
+    pub fn with_materialized_project_roots_for_workspace_roots(
+        mut self,
+        workspace_roots: &[AbsolutePathBuf],
+    ) -> Self {
+        let materialized = self
+            .clone()
+            .materialize_project_roots_with_workspace_roots(workspace_roots);
+        for entry in materialized.entries {
+            if !self.entries.contains(&entry) {
+                self.entries.push(entry);
             }
         }
         self
@@ -763,7 +856,7 @@ impl FileSystemSandboxPolicy {
     ///
     /// Unlike [`Self::with_additional_writable_roots`], this mirrors legacy
     /// writable-roots semantics by adding exact roots even when they are
-    /// already writable through `:project_roots`, and by adding the default
+    /// already writable through `:workspace_roots`, and by adding the default
     /// read-only protected subpaths for each new root.
     pub fn with_additional_legacy_workspace_writable_roots(
         mut self,
@@ -971,7 +1064,7 @@ impl FileSystemSandboxPolicy {
         dedup_absolute_paths(
             self.resolved_entries_with_cwd(cwd)
                 .iter()
-                .filter(|entry| entry.access == FileSystemAccessMode::None)
+                .filter(|entry| entry.access == FileSystemAccessMode::Deny)
                 .filter(|entry| !self.can_read_path_with_cwd(entry.path.as_path(), cwd))
                 // Restricted policies already deny reads outside explicit allow roots,
                 // so materializing the filesystem root here would erase narrower
@@ -992,7 +1085,7 @@ impl FileSystemSandboxPolicy {
         let mut patterns = self
             .entries
             .iter()
-            .filter(|entry| entry.access == FileSystemAccessMode::None)
+            .filter(|entry| entry.access == FileSystemAccessMode::Deny)
             .filter_map(|entry| match &entry.path {
                 FileSystemPath::GlobPattern { pattern } => {
                     Some(AbsolutePathBuf::resolve_path_against_base(pattern, cwd))
@@ -1051,7 +1144,7 @@ impl FileSystemSandboxPolicy {
                         }
                         FileSystemPath::Special { value } => match value {
                             FileSystemSpecialPath::Root => match entry.access {
-                                FileSystemAccessMode::None => {}
+                                FileSystemAccessMode::Deny => {}
                                 FileSystemAccessMode::Read => {}
                                 FileSystemAccessMode::Write => {
                                     unbridgeable_root_write = true;
@@ -1209,6 +1302,18 @@ fn resolve_entry_path(
     }
 }
 
+fn parse_project_roots_glob_pattern(pattern: &str) -> Option<&Path> {
+    pattern
+        .strip_prefix(PROJECT_ROOTS_GLOB_PATTERN_PREFIX)
+        .map(Path::new)
+}
+
+fn resolve_project_roots_glob_pattern(subpath: &Path, root: &AbsolutePathBuf) -> String {
+    AbsolutePathBuf::resolve_path_against_base(subpath, root.as_path())
+        .to_string_lossy()
+        .into_owned()
+}
+
 fn resolve_candidate_path(path: &Path, cwd: &Path) -> Option<AbsolutePathBuf> {
     if path.is_absolute() {
         AbsolutePathBuf::from_absolute_path(path).ok()
@@ -2088,7 +2193,7 @@ mod tests {
             },
             FileSystemSandboxEntry {
                 path: FileSystemPath::Path { path: link_blocked },
-                access: FileSystemAccessMode::None,
+                access: FileSystemAccessMode::Deny,
             },
         ]);
 
@@ -2150,7 +2255,7 @@ mod tests {
             },
             FileSystemSandboxEntry {
                 path: FileSystemPath::Path { path: link_blocked },
-                access: FileSystemAccessMode::None,
+                access: FileSystemAccessMode::Deny,
             },
         ]);
 
@@ -2251,7 +2356,7 @@ mod tests {
             },
             FileSystemSandboxEntry {
                 path: FileSystemPath::Path { path: link_private },
-                access: FileSystemAccessMode::None,
+                access: FileSystemAccessMode::Deny,
             },
         ]);
 
@@ -2298,7 +2403,7 @@ mod tests {
             },
             FileSystemSandboxEntry {
                 path: FileSystemPath::Path { path: link_private },
-                access: FileSystemAccessMode::None,
+                access: FileSystemAccessMode::Deny,
             },
         ]);
 
@@ -2340,7 +2445,7 @@ mod tests {
             },
             FileSystemSandboxEntry {
                 path: FileSystemPath::Path { path: alias },
-                access: FileSystemAccessMode::None,
+                access: FileSystemAccessMode::Deny,
             },
         ]);
 
@@ -2400,7 +2505,7 @@ mod tests {
             },
             FileSystemSandboxEntry {
                 path: FileSystemPath::Path { path: link_blocked },
-                access: FileSystemAccessMode::None,
+                access: FileSystemAccessMode::Deny,
             },
         ]);
 
@@ -2446,7 +2551,7 @@ mod tests {
                 path: FileSystemPath::Path {
                     path: docs_private.clone(),
                 },
-                access: FileSystemAccessMode::None,
+                access: FileSystemAccessMode::Deny,
             },
             FileSystemSandboxEntry {
                 path: FileSystemPath::Path {
@@ -2466,7 +2571,7 @@ mod tests {
         );
         assert_eq!(
             policy.resolve_access_with_cwd(docs_private.as_path(), cwd.path()),
-            FileSystemAccessMode::None
+            FileSystemAccessMode::Deny
         );
         assert_eq!(
             policy.resolve_access_with_cwd(docs_private_public.as_path(), cwd.path()),
@@ -2607,7 +2712,7 @@ mod tests {
                 path: FileSystemPath::Special {
                     value: FileSystemSpecialPath::Root,
                 },
-                access: FileSystemAccessMode::None,
+                access: FileSystemAccessMode::Deny,
             },
             FileSystemSandboxEntry {
                 path: FileSystemPath::Path { path: docs.clone() },
@@ -2643,14 +2748,14 @@ mod tests {
                 path: FileSystemPath::Special {
                     value: FileSystemSpecialPath::Root,
                 },
-                access: FileSystemAccessMode::None,
+                access: FileSystemAccessMode::Deny,
             },
         ]);
 
         assert!(!policy.has_full_disk_write_access());
         assert_eq!(
             policy.resolve_access_with_cwd(root.as_path(), cwd.path()),
-            FileSystemAccessMode::None
+            FileSystemAccessMode::Deny
         );
     }
 
@@ -2750,6 +2855,115 @@ mod tests {
         );
     }
 
+    #[test]
+    fn materialize_project_roots_with_workspace_roots_expands_exact_and_glob_entries() {
+        let temp_dir = TempDir::new().expect("tempdir");
+        let first = AbsolutePathBuf::from_absolute_path(temp_dir.path().join("first"))
+            .expect("resolve first root");
+        let second = AbsolutePathBuf::from_absolute_path(temp_dir.path().join("second"))
+            .expect("resolve second root");
+        let policy = FileSystemSandboxPolicy::restricted(vec![
+            FileSystemSandboxEntry {
+                path: FileSystemPath::Special {
+                    value: FileSystemSpecialPath::project_roots(/*subpath*/ None),
+                },
+                access: FileSystemAccessMode::Write,
+            },
+            FileSystemSandboxEntry {
+                path: FileSystemPath::Special {
+                    value: FileSystemSpecialPath::project_roots(Some(".git".into())),
+                },
+                access: FileSystemAccessMode::Read,
+            },
+            FileSystemSandboxEntry {
+                path: FileSystemPath::GlobPattern {
+                    pattern: project_roots_glob_pattern(Path::new("**/*.env")),
+                },
+                access: FileSystemAccessMode::Deny,
+            },
+        ]);
+
+        let actual =
+            policy.materialize_project_roots_with_workspace_roots(&[first.clone(), second.clone()]);
+
+        assert_eq!(
+            actual,
+            FileSystemSandboxPolicy::restricted(vec![
+                FileSystemSandboxEntry {
+                    path: FileSystemPath::Path {
+                        path: first.clone(),
+                    },
+                    access: FileSystemAccessMode::Write,
+                },
+                FileSystemSandboxEntry {
+                    path: FileSystemPath::Path {
+                        path: second.clone(),
+                    },
+                    access: FileSystemAccessMode::Write,
+                },
+                FileSystemSandboxEntry {
+                    path: FileSystemPath::Path {
+                        path: first.join(".git"),
+                    },
+                    access: FileSystemAccessMode::Read,
+                },
+                FileSystemSandboxEntry {
+                    path: FileSystemPath::Path {
+                        path: second.join(".git"),
+                    },
+                    access: FileSystemAccessMode::Read,
+                },
+                FileSystemSandboxEntry {
+                    path: FileSystemPath::GlobPattern {
+                        pattern: AbsolutePathBuf::resolve_path_against_base(
+                            "**/*.env",
+                            first.as_path(),
+                        )
+                        .to_string_lossy()
+                        .into_owned(),
+                    },
+                    access: FileSystemAccessMode::Deny,
+                },
+                FileSystemSandboxEntry {
+                    path: FileSystemPath::GlobPattern {
+                        pattern: AbsolutePathBuf::resolve_path_against_base(
+                            "**/*.env",
+                            second.as_path(),
+                        )
+                        .to_string_lossy()
+                        .into_owned(),
+                    },
+                    access: FileSystemAccessMode::Deny,
+                },
+            ])
+        );
+    }
+
+    #[test]
+    fn materialize_project_roots_with_cwd_expands_symbolic_glob_entries() {
+        let cwd = TempDir::new().expect("tempdir");
+        let policy = FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
+            path: FileSystemPath::GlobPattern {
+                pattern: project_roots_glob_pattern(Path::new("**/*.env")),
+            },
+            access: FileSystemAccessMode::Deny,
+        }]);
+
+        let actual = policy.materialize_project_roots_with_cwd(cwd.path());
+
+        assert_eq!(
+            actual,
+            FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
+                path: FileSystemPath::GlobPattern {
+                    pattern: AbsolutePathBuf::resolve_path_against_base("**/*.env", cwd.path())
+                        .to_string_lossy()
+                        .into_owned(),
+                },
+                access: FileSystemAccessMode::Deny,
+            }])
+        );
+    }
+
     #[test]
     fn with_additional_legacy_workspace_writable_roots_protects_metadata() {
         let temp_dir = TempDir::new().expect("tempdir");
@@ -2794,7 +3008,7 @@ mod tests {
     #[test]
     fn file_system_access_mode_orders_by_conflict_precedence() {
         assert!(FileSystemAccessMode::Write > FileSystemAccessMode::Read);
-        assert!(FileSystemAccessMode::None > FileSystemAccessMode::Write);
+        assert!(FileSystemAccessMode::Deny > FileSystemAccessMode::Write);
     }
 
     #[test]
@@ -2804,7 +3018,7 @@ mod tests {
             path: FileSystemPath::Path {
                 path: denied.clone(),
             },
-            access: FileSystemAccessMode::None,
+            access: FileSystemAccessMode::Deny,
         }]);
 
         let rebuilt = FileSystemSandboxPolicy::from_legacy_sandbox_policy_preserving_deny_entries(
@@ -2819,7 +3033,7 @@ mod tests {
                     == FileSystemPath::Path {
                         path: denied.clone(),
                     }
-                    && entry.access == FileSystemAccessMode::None
+                    && entry.access == FileSystemAccessMode::Deny
             }),
             "expected explicit deny entry to be preserved"
         );
@@ -2852,14 +3066,14 @@ mod tests {
             path: FileSystemPath::Path {
                 path: AbsolutePathBuf::try_from(path).expect("absolute deny path"),
             },
-            access: FileSystemAccessMode::None,
+            access: FileSystemAccessMode::Deny,
         }])
     }
 
     fn unreadable_glob_entry(pattern: String) -> FileSystemSandboxEntry {
         FileSystemSandboxEntry {
             path: FileSystemPath::GlobPattern { pattern },
-            access: FileSystemAccessMode::None,
+            access: FileSystemAccessMode::Deny,
         }
     }
 
diff --git a/codex-rs/protocol/src/protocol.rs b/codex-rs/protocol/src/protocol.rs
index 22b2099f6b..b864b29bc7 100644
--- a/codex-rs/protocol/src/protocol.rs
+++ b/codex-rs/protocol/src/protocol.rs
@@ -34,6 +34,7 @@ use crate::memory_citation::MemoryCitation;
 use crate::models::ActivePermissionProfile;
 use crate::models::BaseInstructions;
 use crate::models::ContentItem;
+use crate::models::ImageDetail;
 use crate::models::MessagePhase;
 use crate::models::PermissionProfile;
 use crate::models::ResponseInputItem;
@@ -395,6 +396,81 @@ pub struct ConversationTextParams {
     pub text: String,
 }
 
+/// Persistent thread-settings overrides that can be applied before user input or
+/// on their own.
+#[derive(Debug, Clone, Default, Deserialize, Serialize, PartialEq, JsonSchema)]
+pub struct ThreadSettingsOverrides {
+    /// Updated `cwd` for sandbox/tool calls.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub cwd: Option<PathBuf>,
+
+    /// Updated runtime workspace roots used to materialize symbolic
+    /// `:workspace_roots` filesystem permissions.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub workspace_roots: Option<Vec<AbsolutePathBuf>>,
+
+    /// Updated profile-defined workspace roots for status summaries and
+    /// per-turn config reconstruction.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub profile_workspace_roots: Option<Vec<AbsolutePathBuf>>,
+
+    /// Updated command approval policy.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub approval_policy: Option<AskForApproval>,
+
+    /// Updated approval reviewer for future approval prompts.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub approvals_reviewer: Option<ApprovalsReviewer>,
+
+    /// Updated sandbox policy for tool calls.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub sandbox_policy: Option<SandboxPolicy>,
+
+    /// Updated permissions profile for tool calls.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub permission_profile: Option<PermissionProfile>,
+
+    /// Named or built-in profile that produced `permission_profile`, if the
+    /// update selected a profile rather than supplying raw permissions.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub active_permission_profile: Option<ActivePermissionProfile>,
+
+    /// Updated Windows sandbox mode for tool execution.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub windows_sandbox_level: Option<WindowsSandboxLevel>,
+
+    /// Updated model slug. When set, the model info is derived automatically.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub model: Option<String>,
+
+    /// Updated reasoning effort (honored only for reasoning-capable models).
+    ///
+    /// Use `Some(Some(_))` to set a specific effort, `Some(None)` to clear the
+    /// effort, or `None` to leave the existing value unchanged.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub effort: Option<Option<ReasoningEffortConfig>>,
+
+    /// Updated reasoning summary preference (honored only for reasoning-capable models).
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub summary: Option<ReasoningSummaryConfig>,
+
+    /// Updated service tier preference for future turns.
+    ///
+    /// Use `Some(Some(_))` to set a specific tier, `Some(None)` to clear the
+    /// preference, or `None` to leave the existing value unchanged.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub service_tier: Option<Option<String>>,
+
+    /// EXPERIMENTAL - set a pre-set collaboration mode.
+    /// Takes precedence over model, effort, and developer instructions if set.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub collaboration_mode: Option<CollaborationMode>,
+
+    /// Updated personality preference.
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub personality: Option<Personality>,
+}
+
 /// Submission operation
 #[derive(Debug, Clone, Deserialize, Serialize, PartialEq, JsonSchema)]
 #[serde(tag = "type", rename_all = "snake_case")]
@@ -424,10 +500,7 @@ pub enum Op {
     /// Request the list of voices supported by realtime conversation streams.
     RealtimeConversationListVoices,
 
-    /// Legacy user input.
-    ///
-    /// Prefer [`Op::UserTurn`] so the caller provides full turn context
-    /// (cwd/approval/sandbox/model/etc.) for each turn.
+    /// User input, optionally with thread-settings overrides applied first.
     UserInput {
         /// User input items, see `InputItem`
         items: Vec<UserInput>,
@@ -440,153 +513,20 @@ pub enum Op {
         /// Optional turn-scoped Responses API `client_metadata`.
         #[serde(default, skip_serializing_if = "Option::is_none")]
         responsesapi_client_metadata: Option<HashMap<String, String>>,
+
+        /// Persistent thread-settings overrides to apply before the input.
+        #[serde(default, flatten)]
+        thread_settings: ThreadSettingsOverrides,
     },
 
-    /// Similar to [`Op::UserInput`], but first applies persistent turn-context
-    /// overrides in the same queued operation. This preserves submission order
-    /// and prevents the input from starting if the overrides are rejected.
-    UserInputWithTurnContext {
-        /// User input items, see `InputItem`
-        items: Vec<UserInput>,
-        /// Optional turn-scoped environment selections.
-        #[serde(default, skip_serializing_if = "Option::is_none")]
-        environments: Option<Vec<TurnEnvironmentSelection>>,
-        /// Optional JSON Schema used to constrain the final assistant message for this turn.
-        #[serde(skip_serializing_if = "Option::is_none")]
-        final_output_json_schema: Option<Value>,
-        /// Optional turn-scoped Responses API `client_metadata`.
-        #[serde(default, skip_serializing_if = "Option::is_none")]
-        responsesapi_client_metadata: Option<HashMap<String, String>>,
-
-        /// Updated `cwd` for sandbox/tool calls.
-        #[serde(skip_serializing_if = "Option::is_none")]
-        cwd: Option<PathBuf>,
-
-        /// Updated command approval policy.
-        #[serde(skip_serializing_if = "Option::is_none")]
-        approval_policy: Option<AskForApproval>,
-
-        /// Updated approval reviewer for future approval prompts.
-        #[serde(skip_serializing_if = "Option::is_none")]
-        approvals_reviewer: Option<ApprovalsReviewer>,
-
-        /// Updated sandbox policy for tool calls.
-        #[serde(skip_serializing_if = "Option::is_none")]
-        sandbox_policy: Option<SandboxPolicy>,
-
-        /// Updated permissions profile for tool calls.
-        #[serde(skip_serializing_if = "Option::is_none")]
-        permission_profile: Option<PermissionProfile>,
-
-        /// Named or built-in profile that produced `permission_profile`, if
-        /// the update selected a profile rather than supplying raw
-        /// permissions.
-        #[serde(skip_serializing_if = "Option::is_none")]
-        active_permission_profile: Option<ActivePermissionProfile>,
-
-        /// Updated Windows sandbox mode for tool execution.
-        #[serde(skip_serializing_if = "Option::is_none")]
-        windows_sandbox_level: Option<WindowsSandboxLevel>,
-
-        /// Updated model slug. When set, the model info is derived
-        /// automatically.
-        #[serde(skip_serializing_if = "Option::is_none")]
-        model: Option<String>,
-
-        /// Updated reasoning effort (honored only for reasoning-capable models).
-        ///
-        /// Use `Some(Some(_))` to set a specific effort, `Some(None)` to clear
-        /// the effort, or `None` to leave the existing value unchanged.
-        #[serde(skip_serializing_if = "Option::is_none")]
-        effort: Option<Option<ReasoningEffortConfig>>,
-
-        /// Updated reasoning summary preference (honored only for reasoning-capable models).
-        #[serde(skip_serializing_if = "Option::is_none")]
-        summary: Option<ReasoningSummaryConfig>,
-
-        /// Updated service tier preference for future turns.
-        ///
-        /// Use `Some(Some(_))` to set a specific tier, `Some(None)` to clear the
-        /// preference, or `None` to leave the existing value unchanged.
-        #[serde(skip_serializing_if = "Option::is_none")]
-        service_tier: Option<Option<String>>,
-
-        /// EXPERIMENTAL - set a pre-set collaboration mode.
-        /// Takes precedence over model, effort, and developer instructions if set.
-        #[serde(skip_serializing_if = "Option::is_none")]
-        collaboration_mode: Option<CollaborationMode>,
-
-        /// Updated personality preference.
-        #[serde(skip_serializing_if = "Option::is_none")]
-        personality: Option<Personality>,
-    },
-
-    /// Similar to [`Op::UserInput`], but contains additional context required
-    /// for a turn of a [`crate::codex_thread::CodexThread`].
-    UserTurn {
-        /// User input items, see `InputItem`
-        items: Vec<UserInput>,
-
-        /// `cwd` to use with the [`SandboxPolicy`] and potentially tool calls
-        /// such as `local_shell`.
-        cwd: PathBuf,
-
-        /// Policy to use for command approval.
-        approval_policy: AskForApproval,
-
-        /// Reviewer to use for approval requests raised during this turn.
-        ///
-        /// When omitted, the session keeps the current setting
-        approvals_reviewer: Option<ApprovalsReviewer>,
-
-        /// Policy to use for tool calls such as `local_shell`.
-        sandbox_policy: SandboxPolicy,
-
-        /// Full permissions profile to use for tool calls such as `local_shell`.
-        ///
-        /// When omitted, `sandbox_policy` is used as a legacy compatibility
-        /// projection.
-        #[serde(default, skip_serializing_if = "Option::is_none")]
-        permission_profile: Option<PermissionProfile>,
-
-        /// Must be a valid model slug for the configured client session
-        /// associated with this conversation.
-        model: String,
-
-        /// Will only be honored if the model is configured to use reasoning.
-        #[serde(skip_serializing_if = "Option::is_none")]
-        effort: Option<ReasoningEffortConfig>,
-
-        /// Will only be honored if the model is configured to use reasoning.
-        ///
-        /// When omitted, the session keeps the current setting (which allows core to
-        /// fall back to the selected model's default on new sessions).
-        #[serde(default, skip_serializing_if = "Option::is_none")]
-        summary: Option<ReasoningSummaryConfig>,
-
-        /// Optional service tier override for this turn.
-        ///
-        /// Use `Some(Some(_))` to set a specific tier for this turn, `Some(None)` to
-        /// explicitly clear the tier for this turn, or `None` to keep the existing
-        /// session preference.
-        #[serde(default, skip_serializing_if = "Option::is_none")]
-        service_tier: Option<Option<String>>,
-
-        // The JSON schema to use for the final assistant message
-        final_output_json_schema: Option<Value>,
-
-        /// EXPERIMENTAL - set a pre-set collaboration mode.
-        /// Takes precedence over model, effort, and developer instructions if set.
-        #[serde(skip_serializing_if = "Option::is_none")]
-        collaboration_mode: Option<CollaborationMode>,
-
-        /// Optional personality override for this turn.
-        #[serde(skip_serializing_if = "Option::is_none")]
-        personality: Option<Personality>,
-
-        /// Optional turn-scoped environments.
-        #[serde(default, skip_serializing_if = "Option::is_none")]
-        environments: Option<Vec<TurnEnvironmentSelection>>,
+    /// Apply persistent thread-settings overrides without starting a turn.
+    ///
+    /// This uses the same submission queue as turn starts so app-server can
+    /// preserve caller order between both kinds of mutation.
+    ThreadSettings {
+        /// Persistent thread-settings overrides to apply.
+        #[serde(flatten)]
+        thread_settings: ThreadSettingsOverrides,
     },
 
     /// Inter-agent communication that should be recorded as assistant history
@@ -595,70 +535,6 @@ pub enum Op {
         communication: InterAgentCommunication,
     },
 
-    /// Override parts of the persistent turn context for subsequent turns.
-    ///
-    /// All fields are optional; when omitted, the existing value is preserved.
-    /// This does not enqueue any input – it only updates defaults used for
-    /// turns that rely on persistent session-level context (for example,
-    /// [`Op::UserInput`]).
-    OverrideTurnContext {
-        /// Updated `cwd` for sandbox/tool calls.
-        #[serde(skip_serializing_if = "Option::is_none")]
-        cwd: Option<PathBuf>,
-
-        /// Updated command approval policy.
-        #[serde(skip_serializing_if = "Option::is_none")]
-        approval_policy: Option<AskForApproval>,
-
-        /// Updated approval reviewer for future approval prompts.
-        #[serde(skip_serializing_if = "Option::is_none")]
-        approvals_reviewer: Option<ApprovalsReviewer>,
-
-        /// Updated sandbox policy for tool calls.
-        #[serde(skip_serializing_if = "Option::is_none")]
-        sandbox_policy: Option<SandboxPolicy>,
-
-        /// Updated permissions profile for tool calls.
-        #[serde(skip_serializing_if = "Option::is_none")]
-        permission_profile: Option<PermissionProfile>,
-
-        /// Updated Windows sandbox mode for tool execution.
-        #[serde(skip_serializing_if = "Option::is_none")]
-        windows_sandbox_level: Option<WindowsSandboxLevel>,
-
-        /// Updated model slug. When set, the model info is derived
-        /// automatically.
-        #[serde(skip_serializing_if = "Option::is_none")]
-        model: Option<String>,
-
-        /// Updated reasoning effort (honored only for reasoning-capable models).
-        ///
-        /// Use `Some(Some(_))` to set a specific effort, `Some(None)` to clear
-        /// the effort, or `None` to leave the existing value unchanged.
-        #[serde(skip_serializing_if = "Option::is_none")]
-        effort: Option<Option<ReasoningEffortConfig>>,
-
-        /// Updated reasoning summary preference (honored only for reasoning-capable models).
-        #[serde(skip_serializing_if = "Option::is_none")]
-        summary: Option<ReasoningSummaryConfig>,
-
-        /// Updated service tier preference for future turns.
-        ///
-        /// Use `Some(Some(_))` to set a specific tier, `Some(None)` to clear the
-        /// preference, or `None` to leave the existing value unchanged.
-        #[serde(skip_serializing_if = "Option::is_none")]
-        service_tier: Option<Option<String>>,
-
-        /// EXPERIMENTAL - set a pre-set collaboration mode.
-        /// Takes precedence over model, effort, and developer instructions if set.
-        #[serde(skip_serializing_if = "Option::is_none")]
-        collaboration_mode: Option<CollaborationMode>,
-
-        /// Updated personality preference.
-        #[serde(skip_serializing_if = "Option::is_none")]
-        personality: Option<Personality>,
-    },
-
     /// Approve a command execution
     ExecApproval {
         /// The id of the submission we are approving
@@ -779,6 +655,7 @@ impl From<Vec<UserInput>> for Op {
             items: value,
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: ThreadSettingsOverrides::default(),
         }
     }
 }
@@ -845,10 +722,8 @@ impl Op {
             Self::RealtimeConversationClose => "realtime_conversation_close",
             Self::RealtimeConversationListVoices => "realtime_conversation_list_voices",
             Self::UserInput { .. } => "user_input",
-            Self::UserInputWithTurnContext { .. } => "user_input_with_turn_context",
-            Self::UserTurn { .. } => "user_turn",
+            Self::ThreadSettings { .. } => "thread_settings",
             Self::InterAgentCommunication { .. } => "inter_agent_communication",
-            Self::OverrideTurnContext { .. } => "override_turn_context",
             Self::ExecApproval { .. } => "exec_approval",
             Self::PatchApproval { .. } => "patch_approval",
             Self::ResolveElicitation { .. } => "resolve_elicitation",
@@ -1299,6 +1174,10 @@ pub enum EventMsg {
     #[serde(rename = "task_started", alias = "turn_started")]
     TurnStarted(TurnStartedEvent),
 
+    /// Persistent thread-settings overrides from the correlated submission have
+    /// been applied to the session configuration.
+    ThreadSettingsApplied(ThreadSettingsAppliedEvent),
+
     /// Agent has completed all actions.
     /// v1 wire format uses `task_complete`; accept `turn_complete` for v2 interop.
     #[serde(rename = "task_complete", alias = "turn_complete")]
@@ -1458,6 +1337,7 @@ pub enum HookEventName {
     PostCompact,
     SessionStart,
     UserPromptSubmit,
+    SubagentStart,
     Stop,
 }
 
@@ -1995,6 +1875,33 @@ pub struct TurnStartedEvent {
     pub collaboration_mode_kind: ModeKind,
 }
 
+#[derive(Debug, Clone, Deserialize, Serialize, JsonSchema, TS)]
+pub struct ThreadSettingsAppliedEvent {
+    pub thread_settings: ThreadSettingsSnapshot,
+}
+
+#[derive(Debug, Clone, Deserialize, Serialize, JsonSchema, TS)]
+pub struct ThreadSettingsSnapshot {
+    pub model: String,
+    pub model_provider_id: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub service_tier: Option<String>,
+    pub approval_policy: AskForApproval,
+    pub approvals_reviewer: ApprovalsReviewer,
+    pub permission_profile: PermissionProfile,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    #[ts(optional)]
+    pub active_permission_profile: Option<ActivePermissionProfile>,
+    pub cwd: AbsolutePathBuf,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reasoning_effort: Option<ReasoningEffortConfig>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub reasoning_summary: Option<ReasoningSummaryConfig>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub personality: Option<Personality>,
+    pub collaboration_mode: CollaborationMode,
+}
+
 #[derive(Debug, Clone, Deserialize, Serialize, Default, PartialEq, Eq, JsonSchema, TS)]
 pub struct TokenUsage {
     #[ts(type = "number")]
@@ -2231,7 +2138,7 @@ pub struct AgentMessageEvent {
     pub memory_citation: Option<MemoryCitation>,
 }
 
-#[derive(Debug, Clone, Deserialize, Serialize, JsonSchema, TS)]
+#[derive(Debug, Clone, Default, Deserialize, Serialize, JsonSchema, TS)]
 pub struct UserMessageEvent {
     pub message: String,
     /// Image URLs sourced from `UserInput::Image`. These are safe
@@ -2239,11 +2146,19 @@ pub struct UserMessageEvent {
     /// the model.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub images: Option<Vec<String>>,
+    /// Detail hints for `images`, indexed in parallel. Missing entries imply
+    /// default image detail behavior.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub image_details: Vec<Option<ImageDetail>>,
     /// Local file paths sourced from `UserInput::LocalImage`. These are kept so
     /// the UI can reattach images when editing history, and should not be sent
     /// to the model or treated as API-ready URLs.
     #[serde(default)]
     pub local_images: Vec<std::path::PathBuf>,
+    /// Detail hints for `local_images`, indexed in parallel. Missing entries
+    /// imply default image detail behavior.
+    #[serde(default, skip_serializing_if = "Vec::is_empty")]
+    pub local_image_details: Vec<Option<ImageDetail>>,
     /// UI-defined spans within `message` used to render or persist special elements.
     #[serde(default)]
     pub text_elements: Vec<crate::user_input::TextElement>,
@@ -2821,8 +2736,6 @@ pub struct TurnContextNetworkItem {
 pub struct TurnContextItem {
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub turn_id: Option<String>,
-    #[serde(default, skip_serializing_if = "Option::is_none")]
-    pub trace_id: Option<String>,
     pub cwd: PathBuf,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub current_date: Option<String>,
@@ -2845,15 +2758,11 @@ pub struct TurnContextItem {
     pub realtime_active: Option<bool>,
     #[serde(skip_serializing_if = "Option::is_none")]
     pub effort: Option<ReasoningEffortConfig>,
+    // Compatibility-only field written with a default value so older Codex
+    // versions can deserialize turn-context rollout items. It is no longer
+    // read by context reconstruction and should be removed in a future schema
+    // cleanup.
     pub summary: ReasoningSummaryConfig,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub user_instructions: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub developer_instructions: Option<String>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub final_output_json_schema: Option<Value>,
-    #[serde(skip_serializing_if = "Option::is_none")]
-    pub truncation_policy: Option<TruncationPolicy>,
 }
 
 impl TurnContextItem {
@@ -3558,6 +3467,8 @@ impl<'de> Deserialize<'de> for SessionConfiguredEvent {
 pub enum ThreadGoalStatus {
     Active,
     Paused,
+    Blocked,
+    UsageLimited,
     BudgetLimited,
     Complete,
 }
@@ -4317,7 +4228,7 @@ mod tests {
             },
             FileSystemSandboxEntry {
                 path: FileSystemPath::Path { path: blocked },
-                access: FileSystemAccessMode::None,
+                access: FileSystemAccessMode::Deny,
             },
         ]);
 
@@ -4374,7 +4285,7 @@ mod tests {
             },
             FileSystemSandboxEntry {
                 path: FileSystemPath::Path { path: secret },
-                access: FileSystemAccessMode::None,
+                access: FileSystemAccessMode::Deny,
             },
         ]);
 
@@ -5029,6 +4940,7 @@ mod tests {
             items: Vec::new(),
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         };
 
         let json_op = serde_json::to_value(op)?;
@@ -5048,6 +4960,7 @@ mod tests {
                 items: Vec::new(),
                 final_output_json_schema: None,
                 responsesapi_client_metadata: None,
+                thread_settings: Default::default(),
             }
         );
 
@@ -5069,6 +4982,7 @@ mod tests {
             items: Vec::new(),
             final_output_json_schema: Some(schema.clone()),
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         };
 
         let json_op = serde_json::to_value(op)?;
@@ -5094,6 +5008,7 @@ mod tests {
                 "fiber_run_id".to_string(),
                 "fiber-123".to_string(),
             )])),
+            thread_settings: Default::default(),
         };
 
         let json_op = serde_json::to_value(&op)?;
@@ -5139,6 +5054,7 @@ mod tests {
             images: None,
             local_images: Vec::new(),
             text_elements: Vec::new(),
+            ..Default::default()
         };
 
         let json_event = serde_json::to_value(event)?;
@@ -5154,6 +5070,62 @@ mod tests {
         Ok(())
     }
 
+    #[test]
+    fn user_message_event_deserializes_without_image_detail_fields() -> Result<()> {
+        let event: UserMessageEvent = serde_json::from_value(json!({
+            "message": "hello",
+            "images": ["https://example.com/image.png"],
+            "local_images": ["/tmp/local.png"],
+            "text_elements": [],
+        }))?;
+
+        assert_eq!(event.message, "hello");
+        assert_eq!(
+            event.images,
+            Some(vec!["https://example.com/image.png".to_string()])
+        );
+        assert_eq!(event.image_details, Vec::<Option<ImageDetail>>::new());
+        assert_eq!(event.local_images, vec![PathBuf::from("/tmp/local.png")]);
+        assert_eq!(event.local_image_details, Vec::<Option<ImageDetail>>::new());
+        assert_eq!(event.text_elements, Vec::new());
+
+        Ok(())
+    }
+
+    #[test]
+    fn user_message_item_legacy_event_preserves_image_details() {
+        let local_path = PathBuf::from("/tmp/local.png");
+        let item = UserMessageItem::new(&[
+            crate::user_input::UserInput::Image {
+                image_url: "https://example.com/first.png".to_string(),
+                detail: Some(ImageDetail::Original),
+            },
+            crate::user_input::UserInput::Image {
+                image_url: "https://example.com/second.png".to_string(),
+                detail: None,
+            },
+            crate::user_input::UserInput::LocalImage {
+                path: local_path.clone(),
+                detail: Some(ImageDetail::Original),
+            },
+        ]);
+
+        let EventMsg::UserMessage(event) = item.as_legacy_event() else {
+            panic!("expected user message event");
+        };
+
+        assert_eq!(
+            event.images,
+            Some(vec![
+                "https://example.com/first.png".to_string(),
+                "https://example.com/second.png".to_string(),
+            ])
+        );
+        assert_eq!(event.image_details, vec![Some(ImageDetail::Original)]);
+        assert_eq!(event.local_images, vec![local_path]);
+        assert_eq!(event.local_image_details, vec![Some(ImageDetail::Original)]);
+    }
+
     #[test]
     fn turn_aborted_event_deserializes_without_turn_id() -> Result<()> {
         let event: EventMsg = serde_json::from_value(json!({
@@ -5184,7 +5156,6 @@ mod tests {
             "summary": "auto",
         }))?;
 
-        assert_eq!(item.trace_id, None);
         assert_eq!(item.network, None);
         assert_eq!(item.file_system_sandbox_policy, None);
         Ok(())
@@ -5194,7 +5165,6 @@ mod tests {
     fn turn_context_item_serializes_network_when_present() -> Result<()> {
         let item = TurnContextItem {
             turn_id: None,
-            trace_id: None,
             cwd: test_path_buf("/tmp"),
             current_date: None,
             timezone: None,
@@ -5210,7 +5180,7 @@ mod tests {
                     path: FileSystemPath::GlobPattern {
                         pattern: "/tmp/private/**/*.txt".to_string(),
                     },
-                    access: FileSystemAccessMode::None,
+                    access: FileSystemAccessMode::Deny,
                 },
             ])),
             model: "gpt-5".to_string(),
@@ -5219,10 +5189,6 @@ mod tests {
             realtime_active: None,
             effort: None,
             summary: ReasoningSummaryConfig::Auto,
-            user_instructions: None,
-            developer_instructions: None,
-            final_output_json_schema: None,
-            truncation_policy: None,
         };
 
         let value = serde_json::to_value(item)?;
@@ -5242,10 +5208,11 @@ mod tests {
                         "type": "glob_pattern",
                         "pattern": "/tmp/private/**/*.txt"
                     },
-                    "access": "none"
+                    "access": "deny"
                 }]
             })
         );
+        assert_eq!(value["summary"], json!("auto"));
         Ok(())
     }
 
diff --git a/codex-rs/protocol/src/user_input.rs b/codex-rs/protocol/src/user_input.rs
index 4ed112df8d..ce4cf99eba 100644
--- a/codex-rs/protocol/src/user_input.rs
+++ b/codex-rs/protocol/src/user_input.rs
@@ -3,6 +3,8 @@ use serde::Deserialize;
 use serde::Serialize;
 use ts_rs::TS;
 
+use crate::models::ImageDetail;
+
 /// Conservative cap so one user message cannot monopolize a large context window.
 pub const MAX_USER_INPUT_TEXT_CHARS: usize = 1 << 20;
 
@@ -21,11 +23,21 @@ pub enum UserInput {
         text_elements: Vec<TextElement>,
     },
     /// Pre‑encoded data: URI image.
-    Image { image_url: String },
+    Image {
+        image_url: String,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        #[ts(optional)]
+        detail: Option<ImageDetail>,
+    },
 
     /// Local image path provided by the user.  This will be converted to an
     /// `Image` variant (base64 data URL) during request serialization.
-    LocalImage { path: std::path::PathBuf },
+    LocalImage {
+        path: std::path::PathBuf,
+        #[serde(default, skip_serializing_if = "Option::is_none")]
+        #[ts(optional)]
+        detail: Option<ImageDetail>,
+    },
 
     /// Skill selected by the user (name + path to SKILL.md).
     Skill {
diff --git a/codex-rs/rmcp-client/Cargo.toml b/codex-rs/rmcp-client/Cargo.toml
index 9be90e277a..0efd8a4178 100644
--- a/codex-rs/rmcp-client/Cargo.toml
+++ b/codex-rs/rmcp-client/Cargo.toml
@@ -13,6 +13,7 @@ axum = { workspace = true, default-features = false, features = [
     "http1",
     "tokio",
 ] }
+base64 = { workspace = true }
 codex-api = { workspace = true }
 codex-client = { workspace = true }
 codex-config = { workspace = true }
diff --git a/codex-rs/rmcp-client/src/perform_oauth_login.rs b/codex-rs/rmcp-client/src/perform_oauth_login.rs
index 5bdb315381..eb6c7906a8 100644
--- a/codex-rs/rmcp-client/src/perform_oauth_login.rs
+++ b/codex-rs/rmcp-client/src/perform_oauth_login.rs
@@ -7,9 +7,16 @@ use anyhow::Context;
 use anyhow::Result;
 use anyhow::anyhow;
 use anyhow::bail;
+use base64::Engine;
+use base64::engine::general_purpose::URL_SAFE_NO_PAD;
 use reqwest::ClientBuilder;
 use reqwest::Url;
+use rmcp::transport::AuthorizationManager;
+use rmcp::transport::AuthorizationSession;
+use rmcp::transport::auth::OAuthClientConfig;
 use rmcp::transport::auth::OAuthState;
+use sha2::Digest;
+use sha2::Sha256;
 use tiny_http::Response;
 use tiny_http::Server;
 use tokio::sync::oneshot;
@@ -77,6 +84,7 @@ pub async fn perform_oauth_login(
     http_headers: Option<HashMap<String, String>>,
     env_http_headers: Option<HashMap<String, String>>,
     scopes: &[String],
+    oauth_client_id: Option<&str>,
     oauth_resource: Option<&str>,
     callback_port: Option<u16>,
     callback_url: Option<&str>,
@@ -88,6 +96,7 @@ pub async fn perform_oauth_login(
         http_headers,
         env_http_headers,
         scopes,
+        oauth_client_id,
         oauth_resource,
         callback_port,
         callback_url,
@@ -104,6 +113,7 @@ pub async fn perform_oauth_login_silent(
     http_headers: Option<HashMap<String, String>>,
     env_http_headers: Option<HashMap<String, String>>,
     scopes: &[String],
+    oauth_client_id: Option<&str>,
     oauth_resource: Option<&str>,
     callback_port: Option<u16>,
     callback_url: Option<&str>,
@@ -115,6 +125,7 @@ pub async fn perform_oauth_login_silent(
         http_headers,
         env_http_headers,
         scopes,
+        oauth_client_id,
         oauth_resource,
         callback_port,
         callback_url,
@@ -131,6 +142,7 @@ async fn perform_oauth_login_with_browser_output(
     http_headers: Option<HashMap<String, String>>,
     env_http_headers: Option<HashMap<String, String>>,
     scopes: &[String],
+    oauth_client_id: Option<&str>,
     oauth_resource: Option<&str>,
     callback_port: Option<u16>,
     callback_url: Option<&str>,
@@ -146,6 +158,7 @@ async fn perform_oauth_login_with_browser_output(
         store_mode,
         headers,
         scopes,
+        oauth_client_id,
         oauth_resource,
         /*launch_browser*/ true,
         callback_port,
@@ -165,6 +178,7 @@ pub async fn perform_oauth_login_return_url(
     http_headers: Option<HashMap<String, String>>,
     env_http_headers: Option<HashMap<String, String>>,
     scopes: &[String],
+    oauth_client_id: Option<&str>,
     oauth_resource: Option<&str>,
     timeout_secs: Option<i64>,
     callback_port: Option<u16>,
@@ -180,6 +194,7 @@ pub async fn perform_oauth_login_return_url(
         store_mode,
         headers,
         scopes,
+        oauth_client_id,
         oauth_resource,
         /*launch_browser*/ false,
         callback_port,
@@ -378,6 +393,31 @@ fn resolve_redirect_uri(server: &Server, callback_url: Option<&str>) -> Result<S
     Ok(callback_url.to_string())
 }
 
+fn callback_id_from_server_url(server_url: &str) -> Result<String> {
+    let mut parsed =
+        Url::parse(server_url).with_context(|| format!("invalid MCP server URL `{server_url}`"))?;
+    parsed
+        .host_str()
+        .ok_or_else(|| anyhow!("MCP server URL `{server_url}` must include a host"))?;
+    parsed.set_fragment(None);
+
+    let digest = Sha256::digest(parsed.as_str().as_bytes());
+    Ok(URL_SAFE_NO_PAD.encode(&digest[..9]))
+}
+
+fn append_callback_id_to_redirect_uri(redirect_uri: &str, callback_id: &str) -> Result<String> {
+    let mut parsed = Url::parse(redirect_uri)
+        .with_context(|| format!("invalid redirect URI `{redirect_uri}`"))?;
+    let path = parsed.path();
+    let new_path = if path.ends_with('/') {
+        format!("{path}{callback_id}")
+    } else {
+        format!("{path}/{callback_id}")
+    };
+    parsed.set_path(&new_path);
+    Ok(parsed.to_string())
+}
+
 fn callback_path_from_redirect_uri(redirect_uri: &str) -> Result<String> {
     let parsed = Url::parse(redirect_uri)
         .with_context(|| format!("invalid redirect URI `{redirect_uri}`"))?;
@@ -407,6 +447,7 @@ impl OauthLoginFlow {
         store_mode: OAuthCredentialsStoreMode,
         headers: OauthHeaders,
         scopes: &[String],
+        oauth_client_id: Option<&str>,
         oauth_resource: Option<&str>,
         launch_browser: bool,
         callback_port: Option<u16>,
@@ -428,6 +469,8 @@ impl OauthLoginFlow {
         };
 
         let redirect_uri = resolve_redirect_uri(&server, callback_url)?;
+        let callback_id = callback_id_from_server_url(server_url)?;
+        let redirect_uri = append_callback_id_to_redirect_uri(&redirect_uri, &callback_id)?;
         let callback_path = callback_path_from_redirect_uri(&redirect_uri)?;
 
         let (tx, rx) = oneshot::channel();
@@ -440,11 +483,15 @@ impl OauthLoginFlow {
         let default_headers = build_default_headers(http_headers, env_http_headers)?;
         let http_client = apply_default_headers(ClientBuilder::new(), &default_headers).build()?;
 
-        let mut oauth_state = OAuthState::new(server_url, Some(http_client)).await?;
         let scope_refs: Vec<&str> = scopes.iter().map(String::as_str).collect();
-        oauth_state
-            .start_authorization(&scope_refs, &redirect_uri, Some("Codex"))
-            .await?;
+        let oauth_state = start_authorization(
+            server_url,
+            http_client,
+            &scope_refs,
+            &redirect_uri,
+            oauth_client_id,
+        )
+        .await?;
         let auth_url = append_query_param(
             &oauth_state.get_authorization_url().await?,
             "resource",
@@ -554,6 +601,41 @@ impl OauthLoginFlow {
     }
 }
 
+async fn start_authorization(
+    server_url: &str,
+    http_client: reqwest::Client,
+    scopes: &[&str],
+    redirect_uri: &str,
+    oauth_client_id: Option<&str>,
+) -> Result<OAuthState> {
+    let Some(oauth_client_id) = oauth_client_id.filter(|client_id| !client_id.trim().is_empty())
+    else {
+        let mut oauth_state = OAuthState::new(server_url, Some(http_client)).await?;
+        oauth_state
+            .start_authorization(scopes, redirect_uri, Some("Codex"))
+            .await?;
+        return Ok(oauth_state);
+    };
+
+    let mut auth_manager = AuthorizationManager::new(server_url).await?;
+    auth_manager.with_client(http_client)?;
+    let metadata = auth_manager.discover_metadata().await?;
+    auth_manager.set_metadata(metadata);
+    auth_manager.configure_client(OAuthClientConfig {
+        client_id: oauth_client_id.to_string(),
+        client_secret: None,
+        scopes: scopes.iter().map(|scope| (*scope).to_string()).collect(),
+        redirect_uri: redirect_uri.to_string(),
+    })?;
+    let auth_url = auth_manager.get_authorization_url(scopes).await?;
+
+    Ok(OAuthState::Session(AuthorizationSession {
+        auth_manager,
+        auth_url,
+        redirect_uri: redirect_uri.to_string(),
+    }))
+}
+
 fn append_query_param(url: &str, key: &str, value: Option<&str>) -> String {
     let Some(value) = value else {
         return url.to_string();
@@ -573,13 +655,85 @@ fn append_query_param(url: &str, key: &str, value: Option<&str>) -> String {
 
 #[cfg(test)]
 mod tests {
+    use axum::Json;
+    use axum::Router;
+    use axum::routing::get;
     use pretty_assertions::assert_eq;
+    use reqwest::Url;
+    use serde_json::json;
+    use tokio::net::TcpListener;
 
     use super::CallbackOutcome;
     use super::OAuthProviderError;
+    use super::append_callback_id_to_redirect_uri;
     use super::append_query_param;
+    use super::callback_id_from_server_url;
     use super::callback_path_from_redirect_uri;
     use super::parse_oauth_callback;
+    use super::start_authorization;
+
+    async fn spawn_oauth_metadata_server() -> String {
+        let listener = TcpListener::bind("127.0.0.1:0")
+            .await
+            .expect("bind metadata listener");
+        let addr = listener.local_addr().expect("read metadata listener addr");
+        let base_url = format!("http://{addr}");
+        let metadata = json!({
+            "authorization_endpoint": format!("{base_url}/oauth/authorize"),
+            "token_endpoint": format!("{base_url}/oauth/token"),
+            "scopes_supported": [""],
+        });
+        let path_scoped_metadata = metadata.clone();
+        let app = Router::new()
+            .route(
+                "/.well-known/oauth-authorization-server/mcp",
+                get(move || {
+                    let metadata = path_scoped_metadata.clone();
+                    async move { Json(metadata) }
+                }),
+            )
+            .route(
+                "/.well-known/oauth-authorization-server",
+                get(move || {
+                    let metadata = metadata.clone();
+                    async move { Json(metadata) }
+                }),
+            );
+
+        tokio::spawn(async move {
+            axum::serve(listener, app)
+                .await
+                .expect("serve oauth metadata");
+        });
+
+        base_url
+    }
+
+    #[tokio::test]
+    async fn start_authorization_uses_configured_client_id() {
+        let base_url = spawn_oauth_metadata_server().await;
+        let oauth_state = start_authorization(
+            &format!("{base_url}/mcp"),
+            reqwest::Client::new(),
+            &[],
+            "http://127.0.0.1/callback",
+            Some("eci-prd-pub-codex-123"),
+        )
+        .await
+        .expect("start oauth authorization");
+
+        let authorization_url = oauth_state
+            .get_authorization_url()
+            .await
+            .expect("read authorization url");
+        let auth_url = Url::parse(&authorization_url).expect("authorization url should parse");
+        let client_id = auth_url
+            .query_pairs()
+            .find(|(key, _)| key == "client_id")
+            .map(|(_, value)| value.into_owned());
+
+        assert_eq!(client_id.as_deref(), Some("eci-prd-pub-codex-123"));
+    }
 
     #[test]
     fn parse_oauth_callback_accepts_default_path() {
@@ -593,6 +747,19 @@ mod tests {
         assert!(matches!(parsed, CallbackOutcome::Success(_)));
     }
 
+    #[test]
+    fn parse_oauth_callback_accepts_callback_id_path() {
+        let parsed =
+            parse_oauth_callback("/callback/abc123?code=abc&state=xyz", "/callback/abc123");
+        assert!(matches!(parsed, CallbackOutcome::Success(_)));
+    }
+
+    #[test]
+    fn parse_oauth_callback_rejects_missing_callback_id_path() {
+        let parsed = parse_oauth_callback("/callback?code=abc&state=xyz", "/callback/abc123");
+        assert!(matches!(parsed, CallbackOutcome::Invalid));
+    }
+
     #[test]
     fn parse_oauth_callback_rejects_wrong_path() {
         let parsed = parse_oauth_callback("/callback?code=abc&state=xyz", "/oauth/callback");
@@ -622,6 +789,55 @@ mod tests {
         assert_eq!(path, "/oauth/callback");
     }
 
+    #[test]
+    fn callback_id_is_bound_to_server_url() {
+        let callback_id = callback_id_from_server_url("https://mcp.example.com/mcp?tenant=one")
+            .expect("server URL should parse");
+        let same_without_fragment =
+            callback_id_from_server_url("https://mcp.example.com/mcp?tenant=one#unused")
+                .expect("server URL should parse");
+        let different_path = callback_id_from_server_url("https://mcp.example.com/sse?tenant=one")
+            .expect("server URL should parse");
+        let different_query = callback_id_from_server_url("https://mcp.example.com/mcp?tenant=two")
+            .expect("server URL should parse");
+        let different_origin = callback_id_from_server_url("https://mcp.example.com:8443/mcp")
+            .expect("server URL should parse");
+
+        assert_eq!(callback_id, same_without_fragment);
+        assert_ne!(callback_id, different_path);
+        assert_ne!(callback_id, different_query);
+        assert_ne!(callback_id, different_origin);
+        assert_eq!(callback_id.len(), 12);
+        assert!(
+            callback_id
+                .chars()
+                .all(|ch| ch.is_ascii_alphanumeric() || ch == '-' || ch == '_')
+        );
+    }
+
+    #[test]
+    fn callback_id_is_appended_to_redirect_uri_path() {
+        let redirect_uri =
+            append_callback_id_to_redirect_uri("http://127.0.0.1:1234/callback", "abc123")
+                .expect("redirect URI should parse");
+
+        assert_eq!(redirect_uri, "http://127.0.0.1:1234/callback/abc123");
+    }
+
+    #[test]
+    fn callback_id_is_appended_before_redirect_uri_query() {
+        let redirect_uri = append_callback_id_to_redirect_uri(
+            "https://callbacks.example.com/oauth/callback?provider=github",
+            "abc123",
+        )
+        .expect("redirect URI should parse");
+
+        assert_eq!(
+            redirect_uri,
+            "https://callbacks.example.com/oauth/callback/abc123?provider=github"
+        );
+    }
+
     #[test]
     fn append_query_param_adds_resource_to_absolute_url() {
         let url = append_query_param(
diff --git a/codex-rs/rollout-trace/src/lib.rs b/codex-rs/rollout-trace/src/lib.rs
index 3d9e04f36b..54094f0525 100644
--- a/codex-rs/rollout-trace/src/lib.rs
+++ b/codex-rs/rollout-trace/src/lib.rs
@@ -10,6 +10,7 @@ mod bundle;
 mod code_cell;
 mod compaction;
 mod inference;
+mod mcp;
 mod model;
 mod payload;
 mod protocol_event;
@@ -33,6 +34,8 @@ pub use compaction::CompactionTraceContext;
 pub use inference::InferenceTraceAttempt;
 /// Shared recorder context for inference attempts within one Codex turn.
 pub use inference::InferenceTraceContext;
+/// Trace-owned MCP execution correlation propagated to bridge request metadata.
+pub use mcp::McpCallTraceContext;
 /// Public reduced trace model returned by replay.
 pub use model::*;
 /// Stable identifier for one raw payload inside a rollout bundle.
diff --git a/codex-rs/rollout-trace/src/mcp.rs b/codex-rs/rollout-trace/src/mcp.rs
new file mode 100644
index 0000000000..b8564e1579
--- /dev/null
+++ b/codex-rs/rollout-trace/src/mcp.rs
@@ -0,0 +1,99 @@
+//! Hot-path helpers for correlating concrete MCP executions with rollout traces.
+//!
+//! Core decides when an MCP request is actually going to execute. The trace
+//! crate owns the globally unique ID, the trace event that preserves it in the
+//! reduced artifact, and the bridge-private MCP request metadata key.
+
+use crate::McpCallId;
+use serde_json::Value as JsonValue;
+
+const MCP_CALL_ID_META_KEY: &str = "codex_bridge_mcp_call_id";
+
+/// No-op capable handle for one concrete MCP backend call.
+#[derive(Clone, Debug)]
+pub struct McpCallTraceContext {
+    mcp_call_id: Option<McpCallId>,
+}
+
+impl McpCallTraceContext {
+    /// Builds a context that records nothing and leaves request metadata unchanged.
+    pub fn disabled() -> Self {
+        Self { mcp_call_id: None }
+    }
+
+    /// Builds the trace handle for one concrete MCP execution.
+    pub(crate) fn enabled(mcp_call_id: McpCallId) -> Self {
+        Self {
+            mcp_call_id: Some(mcp_call_id),
+        }
+    }
+
+    /// Returns the trace-owned MCP call ID when rollout tracing is enabled.
+    pub(crate) fn mcp_call_id(&self) -> Option<&str> {
+        self.mcp_call_id.as_deref()
+    }
+
+    /// Adds bridge-private MCP correlation metadata to one outgoing request.
+    pub fn add_request_meta(&self, meta: Option<JsonValue>) -> Option<JsonValue> {
+        let Some(mcp_call_id) = self.mcp_call_id() else {
+            return meta;
+        };
+
+        match meta {
+            Some(JsonValue::Object(mut map)) => {
+                map.insert(
+                    MCP_CALL_ID_META_KEY.to_string(),
+                    JsonValue::String(mcp_call_id.to_string()),
+                );
+                Some(JsonValue::Object(map))
+            }
+            None => {
+                let mut map = serde_json::Map::new();
+                map.insert(
+                    MCP_CALL_ID_META_KEY.to_string(),
+                    JsonValue::String(mcp_call_id.to_string()),
+                );
+                Some(JsonValue::Object(map))
+            }
+            // This should never happen but if it does then we'll fallback to
+            // a noop rather than any breaking behavior. The tracing is best
+            // effort after all.
+            Some(_) => meta,
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use serde_json::json;
+
+    use super::MCP_CALL_ID_META_KEY;
+    use super::McpCallTraceContext;
+
+    #[test]
+    fn disabled_mcp_trace_leaves_request_meta_unchanged() {
+        let meta = Some(json!({"source": "test"}));
+
+        assert_eq!(
+            McpCallTraceContext::disabled().add_request_meta(meta.clone()),
+            meta
+        );
+    }
+
+    #[test]
+    fn enabled_mcp_trace_adds_bridge_correlation_meta() {
+        let trace = McpCallTraceContext::enabled("mcp-call-id".to_string());
+        let meta = trace
+            .add_request_meta(Some(json!({"source": "test"})))
+            .expect("enabled trace keeps request metadata");
+        let object = meta
+            .as_object()
+            .expect("MCP request metadata remains an object");
+
+        assert_eq!(object["source"], json!("test"));
+        assert_eq!(
+            object[MCP_CALL_ID_META_KEY],
+            json!(trace.mcp_call_id().expect("enabled trace has an ID"))
+        );
+    }
+}
diff --git a/codex-rs/rollout-trace/src/model/mod.rs b/codex-rs/rollout-trace/src/model/mod.rs
index e265e29100..0166121da9 100644
--- a/codex-rs/rollout-trace/src/model/mod.rs
+++ b/codex-rs/rollout-trace/src/model/mod.rs
@@ -28,6 +28,8 @@ pub type CodexTurnId = String;
 pub type ConversationItemId = String;
 /// Local ID for one outbound upstream inference request.
 pub type InferenceCallId = String;
+/// Globally unique ID for one concrete MCP backend request.
+pub type McpCallId = String;
 /// Reducer-owned ID for one runtime tool-call object.
 pub type ToolCallId = String;
 /// Responses `call_id` / custom-tool call ID visible in inference payloads.
diff --git a/codex-rs/rollout-trace/src/model/runtime.rs b/codex-rs/rollout-trace/src/model/runtime.rs
index a2afcb0636..f0d1d1caf1 100644
--- a/codex-rs/rollout-trace/src/model/runtime.rs
+++ b/codex-rs/rollout-trace/src/model/runtime.rs
@@ -13,6 +13,7 @@ use super::CompactionId;
 use super::CompactionRequestId;
 use super::ConversationItemId;
 use super::EdgeId;
+use super::McpCallId;
 use super::ModelVisibleCallId;
 use super::TerminalId;
 use super::TerminalOperationId;
@@ -113,6 +114,8 @@ pub struct CompactionRequest {
 #[derive(Debug, Clone, PartialEq, Serialize, Deserialize)]
 pub struct ToolCall {
     pub tool_call_id: ToolCallId,
+    /// Globally unique MCP execution ID, when this tool reached an MCP backend.
+    pub mcp_call_id: Option<McpCallId>,
     /// Model-visible protocol call ID, if the model directly requested this tool.
     pub model_visible_call_id: Option<ModelVisibleCallId>,
     /// Code-mode runtime's internal tool invocation ID, if this call came from JS.
diff --git a/codex-rs/rollout-trace/src/protocol_event.rs b/codex-rs/rollout-trace/src/protocol_event.rs
index 1e49c82be2..a862af116c 100644
--- a/codex-rs/rollout-trace/src/protocol_event.rs
+++ b/codex-rs/rollout-trace/src/protocol_event.rs
@@ -228,6 +228,7 @@ pub(crate) fn tool_runtime_trace_event(event: &EventMsg) -> Option<ToolRuntimeTr
         | EventMsg::ThreadRolledBack(_)
         | EventMsg::ThreadGoalUpdated(_)
         | EventMsg::TurnStarted(_)
+        | EventMsg::ThreadSettingsApplied(_)
         | EventMsg::TurnComplete(_)
         | EventMsg::TokenCount(_)
         | EventMsg::AgentMessage(_)
@@ -297,6 +298,7 @@ pub(crate) fn wrapped_protocol_event_type(event: &EventMsg) -> Option<&'static s
         | EventMsg::ModelReroute(_)
         | EventMsg::ModelVerification(_)
         | EventMsg::ContextCompacted(_)
+        | EventMsg::ThreadSettingsApplied(_)
         | EventMsg::TokenCount(_)
         | EventMsg::AgentMessage(_)
         | EventMsg::UserMessage(_)
diff --git a/codex-rs/rollout-trace/src/raw_event.rs b/codex-rs/rollout-trace/src/raw_event.rs
index d60a2b6c48..bd9010d7bb 100644
--- a/codex-rs/rollout-trace/src/raw_event.rs
+++ b/codex-rs/rollout-trace/src/raw_event.rs
@@ -8,6 +8,7 @@ use crate::model::CompactionRequestId;
 use crate::model::EdgeId;
 use crate::model::ExecutionStatus;
 use crate::model::InferenceCallId;
+use crate::model::McpCallId;
 use crate::model::ModelVisibleCallId;
 use crate::model::RolloutStatus;
 use crate::model::ToolCallId;
@@ -138,6 +139,11 @@ pub enum RawTraceEventPayload {
         summary: ToolCallSummary,
         invocation_payload: Option<RawPayloadRef>,
     },
+    /// Bridge correlation UUID assigned only when a tool reaches an MCP backend.
+    McpToolCallCorrelationAssigned {
+        tool_call_id: ToolCallId,
+        mcp_call_id: McpCallId,
+    },
     ToolCallRuntimeStarted {
         tool_call_id: ToolCallId,
         /// Runtime/protocol observation for how Codex began executing the tool.
@@ -236,6 +242,7 @@ impl RawTraceEventPayload {
             | RawTraceEventPayload::CodexTurnEnded { .. }
             | RawTraceEventPayload::CompactionRequestFailed { .. }
             | RawTraceEventPayload::CodeCellStarted { .. }
+            | RawTraceEventPayload::McpToolCallCorrelationAssigned { .. }
             | RawTraceEventPayload::AgentResultObserved {
                 carried_payload: None,
                 ..
diff --git a/codex-rs/rollout-trace/src/reducer/mod.rs b/codex-rs/rollout-trace/src/reducer/mod.rs
index 3e8f6f1353..4a908b6e57 100644
--- a/codex-rs/rollout-trace/src/reducer/mod.rs
+++ b/codex-rs/rollout-trace/src/reducer/mod.rs
@@ -261,6 +261,12 @@ impl TraceReducer {
                     },
                 )?;
             }
+            RawTraceEventPayload::McpToolCallCorrelationAssigned {
+                tool_call_id,
+                mcp_call_id,
+            } => {
+                self.assign_mcp_tool_call_correlation(tool_call_id, mcp_call_id)?;
+            }
             RawTraceEventPayload::ToolCallRuntimeStarted {
                 tool_call_id,
                 runtime_payload,
diff --git a/codex-rs/rollout-trace/src/reducer/tool.rs b/codex-rs/rollout-trace/src/reducer/tool.rs
index d481bb6acd..43845ea939 100644
--- a/codex-rs/rollout-trace/src/reducer/tool.rs
+++ b/codex-rs/rollout-trace/src/reducer/tool.rs
@@ -7,6 +7,7 @@ use crate::model::CodeModeRuntimeToolId;
 use crate::model::ConversationItemKind;
 use crate::model::ExecutionStatus;
 use crate::model::ExecutionWindow;
+use crate::model::McpCallId;
 use crate::model::ModelVisibleCallId;
 use crate::model::ProducerRef;
 use crate::model::ToolCall;
@@ -128,6 +129,7 @@ impl TraceReducer {
             tool_call_id.clone(),
             ToolCall {
                 tool_call_id: tool_call_id.clone(),
+                mcp_call_id: None,
                 model_visible_call_id,
                 code_mode_runtime_tool_id: started.code_mode_runtime_tool_id,
                 thread_id,
@@ -166,6 +168,21 @@ impl TraceReducer {
         Ok(())
     }
 
+    /// Attaches the bridge-visible MCP UUID after the generic tool call exists.
+    pub(super) fn assign_mcp_tool_call_correlation(
+        &mut self,
+        tool_call_id: ToolCallId,
+        mcp_call_id: McpCallId,
+    ) -> Result<()> {
+        let Some(tool_call) = self.rollout.tool_calls.get_mut(&tool_call_id) else {
+            bail!("MCP correlation referenced unknown tool call {tool_call_id}");
+        };
+        if tool_call.mcp_call_id.replace(mcp_call_id).is_some() {
+            bail!("duplicate MCP correlation for tool call {tool_call_id}");
+        }
+        Ok(())
+    }
+
     /// Completes the canonical tool call and any terminal operation driven by dispatch output.
     ///
     /// Protocol-backed terminal tools end from runtime events; direct tools
diff --git a/codex-rs/rollout-trace/src/thread.rs b/codex-rs/rollout-trace/src/thread.rs
index 47526807a1..514b8d382b 100644
--- a/codex-rs/rollout-trace/src/thread.rs
+++ b/codex-rs/rollout-trace/src/thread.rs
@@ -22,11 +22,13 @@ use crate::CodexTurnId;
 use crate::CompactionId;
 use crate::CompactionTraceContext;
 use crate::InferenceTraceContext;
+use crate::McpCallTraceContext;
 use crate::RawPayloadKind;
 use crate::RawPayloadRef;
 use crate::RawTraceEventContext;
 use crate::RawTraceEventPayload;
 use crate::RolloutStatus;
+use crate::ToolCallId;
 use crate::ToolDispatchInvocation;
 use crate::ToolDispatchTraceContext;
 use crate::TraceWriter;
@@ -395,6 +397,24 @@ impl ThreadTraceContext {
             provider_name.into(),
         )
     }
+
+    /// Starts bridge correlation for one concrete MCP backend request.
+    ///
+    /// Dispatch-level tool IDs remain compact and UI-friendly. This UUID is
+    /// deliberately separate: it is only for cross-process log joins where a
+    /// rollout-local counter would collide across samples.
+    pub fn start_mcp_call_trace(&self, tool_call_id: impl Into<ToolCallId>) -> McpCallTraceContext {
+        let ThreadTraceContextState::Enabled(context) = &self.state else {
+            return McpCallTraceContext::disabled();
+        };
+        let mcp_call_id = Uuid::new_v4().to_string();
+        let trace = McpCallTraceContext::enabled(mcp_call_id.clone());
+        context.append_best_effort(RawTraceEventPayload::McpToolCallCorrelationAssigned {
+            tool_call_id: tool_call_id.into(),
+            mcp_call_id,
+        });
+        trace
+    }
 }
 
 fn start_root_in_root(
diff --git a/codex-rs/rollout/src/policy.rs b/codex-rs/rollout/src/policy.rs
index 9c42f8db61..b6dbba98f8 100644
--- a/codex-rs/rollout/src/policy.rs
+++ b/codex-rs/rollout/src/policy.rs
@@ -79,6 +79,7 @@ pub fn should_persist_response_item(item: &ResponseItem) -> bool {
         | ResponseItem::ImageGenerationCall { .. }
         | ResponseItem::Compaction { .. }
         | ResponseItem::ContextCompaction { .. } => true,
+        ResponseItem::CompactionTrigger => false,
         ResponseItem::Other => false,
     }
 }
@@ -99,6 +100,7 @@ pub fn should_persist_response_item_for_memories(item: &ResponseItem) -> bool {
         ResponseItem::Reasoning { .. }
         | ResponseItem::ImageGenerationCall { .. }
         | ResponseItem::Compaction { .. }
+        | ResponseItem::CompactionTrigger
         | ResponseItem::ContextCompaction { .. }
         | ResponseItem::Other => false,
     }
@@ -181,6 +183,7 @@ fn event_msg_persistence_mode(ev: &EventMsg) -> Option<EventPersistenceMode> {
         | EventMsg::AgentReasoningSectionBreak(_)
         | EventMsg::RawResponseItem(_)
         | EventMsg::SessionConfigured(_)
+        | EventMsg::ThreadSettingsApplied(_)
         | EventMsg::McpToolCallBegin(_)
         | EventMsg::ExecCommandBegin(_)
         | EventMsg::TerminalInteraction(_)
diff --git a/codex-rs/rollout/src/recorder_tests.rs b/codex-rs/rollout/src/recorder_tests.rs
index ede7f720a9..90fe15c312 100644
--- a/codex-rs/rollout/src/recorder_tests.rs
+++ b/codex-rs/rollout/src/recorder_tests.rs
@@ -4,7 +4,6 @@ use super::*;
 use crate::config::RolloutConfig;
 use chrono::TimeZone;
 use codex_protocol::ThreadId;
-use codex_protocol::config_types::ReasoningSummary as ReasoningSummaryConfig;
 use codex_protocol::models::ResponseItem;
 use codex_protocol::protocol::AgentMessageEvent;
 use codex_protocol::protocol::AskForApproval;
@@ -114,6 +113,7 @@ async fn state_db_init_backfills_before_returning() -> anyhow::Result<()> {
                 images: None,
                 local_images: Vec::new(),
                 text_elements: Vec::new(),
+                ..Default::default()
             })),
         },
     ];
@@ -404,6 +404,7 @@ async fn recorder_materializes_on_flush_with_pending_items() -> std::io::Result<
                 images: None,
                 local_images: Vec::new(),
                 text_elements: Vec::new(),
+                ..Default::default()
             },
         ))])
         .await?;
@@ -1125,7 +1126,6 @@ async fn resume_candidate_matches_cwd_reads_latest_turn_context() -> std::io::Re
         timestamp: "2025-01-03T13:00:01Z".to_string(),
         item: RolloutItem::TurnContext(TurnContextItem {
             turn_id: Some("turn-1".to_string()),
-            trace_id: None,
             cwd: latest_cwd.clone(),
             current_date: None,
             timezone: None,
@@ -1139,11 +1139,7 @@ async fn resume_candidate_matches_cwd_reads_latest_turn_context() -> std::io::Re
             collaboration_mode: None,
             realtime_active: None,
             effort: None,
-            summary: ReasoningSummaryConfig::Auto,
-            user_instructions: None,
-            developer_instructions: None,
-            final_output_json_schema: None,
-            truncation_policy: None,
+            summary: codex_protocol::config_types::ReasoningSummary::Auto,
         }),
     };
     writeln!(file, "{}", serde_json::to_string(&turn_context)?)?;
diff --git a/codex-rs/rollout/src/tests.rs b/codex-rs/rollout/src/tests.rs
index 22f9a73a4e..bcd395d820 100644
--- a/codex-rs/rollout/src/tests.rs
+++ b/codex-rs/rollout/src/tests.rs
@@ -1404,6 +1404,7 @@ async fn test_updated_at_uses_file_mtime() -> Result<()> {
             images: None,
             text_elements: Vec::new(),
             local_images: Vec::new(),
+            ..Default::default()
         })),
     };
     writeln!(file, "{}", serde_json::to_string(&user_event_line)?)?;
diff --git a/codex-rs/sandboxing/src/manager_tests.rs b/codex-rs/sandboxing/src/manager_tests.rs
index 31f74b9c0a..b00e9779be 100644
--- a/codex-rs/sandboxing/src/manager_tests.rs
+++ b/codex-rs/sandboxing/src/manager_tests.rs
@@ -183,7 +183,7 @@ fn transform_additional_permissions_preserves_denied_entries() {
             path: FileSystemPath::Path {
                 path: denied_path.clone(),
             },
-            access: FileSystemAccessMode::None,
+            access: FileSystemAccessMode::Deny,
         },
     ]);
     let permissions = PermissionProfile::from_runtime_permissions(
@@ -228,7 +228,7 @@ fn transform_additional_permissions_preserves_denied_entries() {
             },
             FileSystemSandboxEntry {
                 path: FileSystemPath::Path { path: denied_path },
-                access: FileSystemAccessMode::None,
+                access: FileSystemAccessMode::Deny,
             },
             FileSystemSandboxEntry {
                 path: FileSystemPath::Path { path: allowed_path },
diff --git a/codex-rs/sandboxing/src/policy_transforms.rs b/codex-rs/sandboxing/src/policy_transforms.rs
index 3dad862bea..958a259182 100644
--- a/codex-rs/sandboxing/src/policy_transforms.rs
+++ b/codex-rs/sandboxing/src/policy_transforms.rs
@@ -28,7 +28,7 @@ pub fn normalize_additional_permissions(
             let glob_scan_max_depth = file_system.glob_scan_max_depth;
             for entry in file_system.entries {
                 if matches!(&entry.path, FileSystemPath::GlobPattern { .. })
-                    && entry.access != FileSystemAccessMode::None
+                    && entry.access != FileSystemAccessMode::Deny
                 {
                     return Err(
                         "glob file system permissions only support deny-read entries".to_string(),
@@ -221,7 +221,7 @@ fn effective_glob_scan_depth(
     entries
         .iter()
         .any(|entry| {
-            entry.access == FileSystemAccessMode::None
+            entry.access == FileSystemAccessMode::Deny
                 && matches!(&entry.path, FileSystemPath::GlobPattern { .. })
         })
         .then_some(match depth {
@@ -273,7 +273,7 @@ fn retain_constraining_deny_entries(
     let mut retained_entries = Vec::new();
     for entry in source_entries
         .iter()
-        .filter(|entry| entry.access == FileSystemAccessMode::None)
+        .filter(|entry| entry.access == FileSystemAccessMode::Deny)
     {
         if !deny_entry_constrains_accepted_grant(entry, accepted_entries, cwd) {
             continue;
@@ -340,7 +340,7 @@ fn access_covers(requested: FileSystemAccessMode, granted: FileSystemAccessMode)
     match granted {
         FileSystemAccessMode::Read => requested.can_read(),
         FileSystemAccessMode::Write => requested.can_write(),
-        FileSystemAccessMode::None => false,
+        FileSystemAccessMode::Deny => false,
     }
 }
 
diff --git a/codex-rs/sandboxing/src/policy_transforms_tests.rs b/codex-rs/sandboxing/src/policy_transforms_tests.rs
index 3404eee3da..ffe504c02b 100644
--- a/codex-rs/sandboxing/src/policy_transforms_tests.rs
+++ b/codex-rs/sandboxing/src/policy_transforms_tests.rs
@@ -58,7 +58,7 @@ fn root_write_policy_with_carveouts_still_uses_platform_sandbox() {
         },
         FileSystemSandboxEntry {
             path: FileSystemPath::Path { path: blocked },
-            access: FileSystemAccessMode::None,
+            access: FileSystemAccessMode::Deny,
         },
     ]);
 
@@ -187,7 +187,7 @@ fn normalize_additional_permissions_preserves_deny_globs() {
                 path: FileSystemPath::GlobPattern {
                     pattern: "**/*.env".to_string(),
                 },
-                access: FileSystemAccessMode::None,
+                access: FileSystemAccessMode::Deny,
             }],
             glob_scan_max_depth: std::num::NonZeroUsize::new(2),
         }),
@@ -203,7 +203,7 @@ fn normalize_additional_permissions_preserves_deny_globs() {
                     path: FileSystemPath::GlobPattern {
                         pattern: "**/*.env".to_string(),
                     },
-                    access: FileSystemAccessMode::None,
+                    access: FileSystemAccessMode::Deny,
                 }],
                 glob_scan_max_depth: std::num::NonZeroUsize::new(2),
             }),
@@ -427,7 +427,7 @@ fn intersect_permission_profiles_materializes_cwd_deny_entries() {
                     path: FileSystemPath::Special {
                         value: FileSystemSpecialPath::project_roots(/*subpath*/ None),
                     },
-                    access: FileSystemAccessMode::None,
+                    access: FileSystemAccessMode::Deny,
                 },
             ],
             glob_scan_max_depth: None,
@@ -448,7 +448,7 @@ fn intersect_permission_profiles_materializes_cwd_deny_entries() {
                     },
                     FileSystemSandboxEntry {
                         path: FileSystemPath::Path { path: request_cwd },
-                        access: FileSystemAccessMode::None,
+                        access: FileSystemAccessMode::Deny,
                     },
                 ],
                 glob_scan_max_depth: None,
@@ -480,7 +480,7 @@ fn intersect_permission_profiles_drops_deny_entries_without_filesystem_grants()
                 },
                 FileSystemSandboxEntry {
                     path: FileSystemPath::Path { path: secret },
-                    access: FileSystemAccessMode::None,
+                    access: FileSystemAccessMode::Deny,
                 },
             ],
             glob_scan_max_depth: None,
@@ -520,7 +520,7 @@ fn intersect_permission_profiles_rejects_concrete_grants_matched_by_requested_de
                     path: FileSystemPath::GlobPattern {
                         pattern: "**/*.env".to_string(),
                     },
-                    access: FileSystemAccessMode::None,
+                    access: FileSystemAccessMode::Deny,
                 },
             ],
             glob_scan_max_depth: std::num::NonZeroUsize::new(2),
@@ -558,7 +558,7 @@ fn intersect_permission_profiles_materializes_relative_deny_globs_for_reuse() {
         path: FileSystemPath::GlobPattern {
             pattern: "**/*.env".to_string(),
         },
-        access: FileSystemAccessMode::None,
+        access: FileSystemAccessMode::Deny,
     };
     let permissions = PermissionProfile {
         file_system: Some(FileSystemPermissions {
@@ -586,7 +586,7 @@ fn intersect_permission_profiles_materializes_relative_deny_globs_for_reuse() {
                         path: FileSystemPath::GlobPattern {
                             pattern: request_cwd.join("**/*.env").to_string_lossy().into_owned(),
                         },
-                        access: FileSystemAccessMode::None,
+                        access: FileSystemAccessMode::Deny,
                     },
                 ],
                 glob_scan_max_depth: std::num::NonZeroUsize::new(2),
@@ -657,7 +657,7 @@ fn intersect_permission_profiles_uses_granted_bounded_glob_scan_depth() {
         path: FileSystemPath::GlobPattern {
             pattern: "**/*.env".to_string(),
         },
-        access: FileSystemAccessMode::None,
+        access: FileSystemAccessMode::Deny,
     };
     let requested = PermissionProfile {
         file_system: Some(FileSystemPermissions {
@@ -689,7 +689,7 @@ fn intersect_permission_profiles_uses_granted_bounded_glob_scan_depth() {
                             .to_string_lossy()
                             .into_owned(),
                         },
-                        access: FileSystemAccessMode::None,
+                        access: FileSystemAccessMode::Deny,
                     },
                 ],
                 glob_scan_max_depth: std::num::NonZeroUsize::new(4),
@@ -712,7 +712,7 @@ fn intersect_permission_profiles_uses_granted_unbounded_glob_scan_depth() {
         path: FileSystemPath::GlobPattern {
             pattern: "**/*.env".to_string(),
         },
-        access: FileSystemAccessMode::None,
+        access: FileSystemAccessMode::Deny,
     };
     let requested = PermissionProfile {
         file_system: Some(FileSystemPermissions {
@@ -744,7 +744,7 @@ fn intersect_permission_profiles_uses_granted_unbounded_glob_scan_depth() {
                             .to_string_lossy()
                             .into_owned(),
                         },
-                        access: FileSystemAccessMode::None,
+                        access: FileSystemAccessMode::Deny,
                     },
                 ],
                 glob_scan_max_depth: None,
@@ -775,7 +775,7 @@ fn merge_file_system_policy_with_additional_permissions_preserves_unreadable_roo
                 path: FileSystemPath::Path {
                     path: denied_path.clone(),
                 },
-                access: FileSystemAccessMode::None,
+                access: FileSystemAccessMode::Deny,
             },
         ]),
         &FileSystemPermissions::from_read_write_roots(
@@ -787,7 +787,7 @@ fn merge_file_system_policy_with_additional_permissions_preserves_unreadable_roo
     assert_eq!(
         merged_policy.entries.contains(&FileSystemSandboxEntry {
             path: FileSystemPath::Path { path: denied_path },
-            access: FileSystemAccessMode::None,
+            access: FileSystemAccessMode::Deny,
         }),
         true
     );
@@ -806,7 +806,7 @@ fn merge_file_system_policy_with_additional_permissions_carries_bounded_glob_sca
         path: FileSystemPath::GlobPattern {
             pattern: "**/*.env".to_string(),
         },
-        access: FileSystemAccessMode::None,
+        access: FileSystemAccessMode::Deny,
     };
     let merged_policy = merge_file_system_policy_with_additional_permissions(
         &FileSystemSandboxPolicy::restricted(vec![FileSystemSandboxEntry {
@@ -853,7 +853,7 @@ fn effective_file_system_sandbox_policy_returns_base_policy_without_additional_p
         },
         FileSystemSandboxEntry {
             path: FileSystemPath::Path { path: denied_path },
-            access: FileSystemAccessMode::None,
+            access: FileSystemAccessMode::Deny,
         },
     ]);
 
@@ -883,7 +883,7 @@ fn effective_file_system_sandbox_policy_merges_additional_write_roots() {
             path: FileSystemPath::Path {
                 path: denied_path.clone(),
             },
-            access: FileSystemAccessMode::None,
+            access: FileSystemAccessMode::Deny,
         },
     ]);
     let additional_permissions = PermissionProfile {
@@ -900,7 +900,7 @@ fn effective_file_system_sandbox_policy_merges_additional_write_roots() {
     assert_eq!(
         effective_policy.entries.contains(&FileSystemSandboxEntry {
             path: FileSystemPath::Path { path: denied_path },
-            access: FileSystemAccessMode::None,
+            access: FileSystemAccessMode::Deny,
         }),
         true
     );
diff --git a/codex-rs/sandboxing/src/seatbelt_tests.rs b/codex-rs/sandboxing/src/seatbelt_tests.rs
index ecaea5d9af..d905d0adcf 100644
--- a/codex-rs/sandboxing/src/seatbelt_tests.rs
+++ b/codex-rs/sandboxing/src/seatbelt_tests.rs
@@ -166,8 +166,8 @@ fn dynamic_network_policy_allows_tls_without_darwin_user_cache_write() {
         &SandboxPolicy::WorkspaceWrite {
             writable_roots: vec![],
             network_access: true,
-            exclude_tmpdir_env_var: false,
-            exclude_slash_tmp: false,
+            exclude_tmpdir_env_var: true,
+            exclude_slash_tmp: true,
         },
         /*enforce_managed_network*/ false,
         &ProxyPolicyInputs::default(),
@@ -195,7 +195,7 @@ fn explicit_unreadable_paths_are_excluded_from_full_disk_read_and_write_access()
         },
         FileSystemSandboxEntry {
             path: FileSystemPath::Path { path: unreadable },
-            access: FileSystemAccessMode::None,
+            access: FileSystemAccessMode::Deny,
         },
     ]);
 
@@ -267,7 +267,7 @@ fn explicit_unreadable_paths_are_excluded_from_readable_roots() {
         },
         FileSystemSandboxEntry {
             path: FileSystemPath::Path { path: unreadable },
-            access: FileSystemAccessMode::None,
+            access: FileSystemAccessMode::Deny,
         },
     ]);
 
@@ -372,7 +372,7 @@ fn unreadable_glob_policy_includes_canonicalized_static_prefix() {
     let mut policy = FileSystemSandboxPolicy::default();
     policy.entries.push(FileSystemSandboxEntry {
         path: FileSystemPath::GlobPattern { pattern },
-        access: FileSystemAccessMode::None,
+        access: FileSystemAccessMode::Deny,
     });
 
     let seatbelt_policy = build_seatbelt_unreadable_glob_policy(&policy, temp_dir.path());
@@ -439,8 +439,8 @@ fn dynamic_network_policy_preserves_restricted_policy_when_proxy_config_without_
         &SandboxPolicy::WorkspaceWrite {
             writable_roots: vec![],
             network_access: true,
-            exclude_tmpdir_env_var: false,
-            exclude_slash_tmp: false,
+            exclude_tmpdir_env_var: true,
+            exclude_slash_tmp: true,
         },
         /*enforce_managed_network*/ false,
         &ProxyPolicyInputs {
@@ -475,8 +475,8 @@ fn dynamic_network_policy_blocks_dns_when_local_binding_has_no_proxy_ports() {
         &SandboxPolicy::WorkspaceWrite {
             writable_roots: vec![],
             network_access: true,
-            exclude_tmpdir_env_var: false,
-            exclude_slash_tmp: false,
+            exclude_tmpdir_env_var: true,
+            exclude_slash_tmp: true,
         },
         /*enforce_managed_network*/ false,
         &ProxyPolicyInputs {
@@ -503,8 +503,8 @@ fn dynamic_network_policy_preserves_restricted_policy_for_managed_network_withou
         &SandboxPolicy::WorkspaceWrite {
             writable_roots: vec![],
             network_access: true,
-            exclude_tmpdir_env_var: false,
-            exclude_slash_tmp: false,
+            exclude_tmpdir_env_var: true,
+            exclude_slash_tmp: true,
         },
         /*enforce_managed_network*/ true,
         &ProxyPolicyInputs {
@@ -793,8 +793,8 @@ fn create_seatbelt_args_full_network_with_proxy_is_still_proxy_only() {
         &SandboxPolicy::WorkspaceWrite {
             writable_roots: vec![],
             network_access: true,
-            exclude_tmpdir_env_var: false,
-            exclude_slash_tmp: false,
+            exclude_tmpdir_env_var: true,
+            exclude_slash_tmp: true,
         },
         /*enforce_managed_network*/ false,
         &ProxyPolicyInputs {
diff --git a/codex-rs/shell-command/src/command_safety/powershell_parser.ps1 b/codex-rs/shell-command/src/command_safety/powershell_parser.ps1
index 9f19f172eb..de696c88bd 100644
--- a/codex-rs/shell-command/src/command_safety/powershell_parser.ps1
+++ b/codex-rs/shell-command/src/command_safety/powershell_parser.ps1
@@ -42,6 +42,15 @@ function Invoke-ParseRequest {
         return @{ id = $RequestId; status = 'parse_errors' }
     }
 
+    # PowerShell's stop-parsing marker hands the remaining source text to native
+    # commands with runtime argument handling that does not match the AST shape we
+    # flatten below. Keep that form out of the argv-like lowering path entirely.
+    foreach ($token in $tokens) {
+        if ($token.Text -eq '--%') {
+            return @{ id = $RequestId; status = 'unsupported' }
+        }
+    }
+
     # Only accept AST shapes we can flatten into a list of argv-like command words.
     # Anything more dynamic than that becomes "unsupported" instead of being guessed at.
     $commands = [System.Collections.ArrayList]::new()
diff --git a/codex-rs/shell-command/src/command_safety/powershell_parser.rs b/codex-rs/shell-command/src/command_safety/powershell_parser.rs
index 580f177f9f..ddcbdf5727 100644
--- a/codex-rs/shell-command/src/command_safety/powershell_parser.rs
+++ b/codex-rs/shell-command/src/command_safety/powershell_parser.rs
@@ -296,4 +296,18 @@ mod tests {
             ]),
         );
     }
+
+    #[test]
+    fn parser_process_rejects_stop_parsing_forms() {
+        let Some(powershell) = try_find_powershell_executable_blocking() else {
+            return;
+        };
+        let powershell = powershell.as_path().to_str().unwrap();
+        let mut parser = PowershellParserProcess::spawn(powershell).unwrap();
+
+        let parsed = parser
+            .parse("git log --% HEAD --output=codex_poc.txt")
+            .unwrap();
+        assert_eq!(parsed, PowershellParseOutcome::Unsupported);
+    }
 }
diff --git a/codex-rs/shell-command/src/command_safety/windows_safe_commands.rs b/codex-rs/shell-command/src/command_safety/windows_safe_commands.rs
index 8ef3f8e8f9..a8dcef6de6 100644
--- a/codex-rs/shell-command/src/command_safety/windows_safe_commands.rs
+++ b/codex-rs/shell-command/src/command_safety/windows_safe_commands.rs
@@ -402,6 +402,16 @@ mod tests {
         );
     }
 
+    #[test]
+    fn rejects_stop_parsing_git_forms() {
+        assert!(!is_safe_command_windows(&vec_str(&[
+            "powershell.exe",
+            "-NoProfile",
+            "-Command",
+            "git log --% HEAD --output=codex_poc.txt",
+        ])));
+    }
+
     #[test]
     fn rejects_powershell_commands_with_side_effects() {
         assert!(!is_safe_command_windows(&vec_str(&[
diff --git a/codex-rs/skills/src/assets/samples/plugin-creator/SKILL.md b/codex-rs/skills/src/assets/samples/plugin-creator/SKILL.md
index 4a90165c07..dde5779e6c 100644
--- a/codex-rs/skills/src/assets/samples/plugin-creator/SKILL.md
+++ b/codex-rs/skills/src/assets/samples/plugin-creator/SKILL.md
@@ -1,6 +1,6 @@
 ---
 name: plugin-creator
-description: Create and scaffold plugin directories for Codex with a required `.codex-plugin/plugin.json`, optional plugin folders/files, and baseline placeholders you can edit before publishing or testing. Use when Codex needs to create a new personal plugin, add optional plugin structure, or generate or update personal or repo-root `.agents/plugins/marketplace.json` entries for plugin ordering and availability metadata.
+description: Create and scaffold plugin directories for Codex with a required `.codex-plugin/plugin.json`, optional plugin folders/files, valid manifest defaults, and personal-marketplace entries by default. Use when Codex needs to create a new personal plugin, add optional plugin structure, or generate or update marketplace entries for plugin ordering and availability metadata.
 ---
 
 # Plugin Creator
@@ -17,7 +17,8 @@ description: Create and scaffold plugin directories for Codex with a required `.
 python3 .agents/skills/plugin-creator/scripts/create_basic_plugin.py <plugin-name>
 ```
 
-2. Open `<plugin-path>/.codex-plugin/plugin.json` and replace `[TODO: ...]` placeholders.
+2. Edit `<plugin-path>/.codex-plugin/plugin.json` when the request gives specific metadata.
+   The scaffold starts with valid defaults and must not contain `[TODO: ...]` placeholders.
 
 3. Generate or update the personal marketplace entry when the plugin should appear in Codex UI ordering:
 
@@ -26,14 +27,12 @@ python3 .agents/skills/plugin-creator/scripts/create_basic_plugin.py <plugin-nam
 python3 .agents/skills/plugin-creator/scripts/create_basic_plugin.py my-plugin --with-marketplace
 ```
 
-If the current Git repo already has `.agents/plugins/marketplace.json` and the user has not said
-whether the plugin is personal or shared with their team, ask before generating a marketplace entry.
-When they choose the repo marketplace, use:
+Only use a repo/team marketplace when the user specifically asks for that destination:
 
 ```bash
 python3 .agents/skills/plugin-creator/scripts/create_basic_plugin.py my-plugin \
-  --path ./plugins \
-  --marketplace-path ./.agents/plugins/marketplace.json \
+  --path <repo-root>/plugins \
+  --marketplace-path <repo-root>/.agents/plugins/marketplace.json \
   --with-marketplace
 ```
 
@@ -48,17 +47,21 @@ python3 .agents/skills/plugin-creator/scripts/create_basic_plugin.py my-plugin \
 
 `<parent-plugin-directory>` is the directory where the plugin folder `<plugin-name>` will be created (for example `~/code/plugins`).
 
+5. Before handing back a generated plugin, run:
+
+```bash
+python3 .agents/skills/plugin-creator/scripts/validate_plugin.py <plugin-path>
+```
+
 ## What this skill creates
 
 - Default marketplace-backed scaffolds are personal: `~/plugins/<plugin-name>/` plus
   `~/.agents/plugins/marketplace.json`.
-- If the current Git repo already has `.agents/plugins/marketplace.json` and the user has not said
-  personal vs team, ask which marketplace to update before generating a marketplace entry.
 - Creates plugin root at `/<parent-plugin-directory>/<plugin-name>/`.
 - Always creates `/<parent-plugin-directory>/<plugin-name>/.codex-plugin/plugin.json`.
-- Fills the manifest with the full schema shape, placeholder values, and the complete `interface` section.
-- Creates or updates the selected marketplace when `--with-marketplace` is set.
-  - If the marketplace file does not exist yet, seed top-level `name` plus `interface.displayName` placeholders before adding the first plugin entry.
+- Fills the manifest with the validated schema shape that the ingestion path accepts.
+- Creates or updates `~/.agents/plugins/marketplace.json` when `--with-marketplace` is set.
+  - If the marketplace file does not exist yet, seed a personal marketplace root before adding the first plugin entry.
 - `<plugin-name>` is normalized using skill-creator naming rules:
   - `My Plugin` → `my-plugin`
   - `My--Plugin` → `my-plugin`
@@ -74,8 +77,10 @@ python3 .agents/skills/plugin-creator/scripts/create_basic_plugin.py my-plugin \
 
 ## Marketplace workflow
 
-- Personal plugins use `~/.agents/plugins/marketplace.json`.
-- Repo/team plugins use `<repo-root>/.agents/plugins/marketplace.json`.
+- Personal creation defaults to `~/.agents/plugins/marketplace.json`.
+- Repo/team marketplace creation is opt-in through both `--path` and `--marketplace-path`, only
+  when the user specifically requests it.
+- In either location, the generated source path remains `./plugins/<plugin-name>`.
 - Marketplace root metadata supports top-level `name` plus optional `interface.displayName`.
 - Treat plugin order in `plugins[]` as render order in Codex. Append new entries unless a user explicitly asks to reorder the list.
 - `displayName` belongs inside the marketplace `interface` object, not individual `plugins[]` entries.
@@ -113,15 +118,15 @@ python3 .agents/skills/plugin-creator/scripts/create_basic_plugin.py my-plugin \
 ```
 
 - Use `--force` only when intentionally replacing an existing marketplace entry for the same plugin name.
-- If the selected marketplace file does not exist yet, create it with top-level `"name"`, an `"interface"` object containing `"displayName"`, and a `plugins` array, then add the new entry.
+- If the target marketplace file does not exist yet, create it with top-level `"name"`, an `"interface"` object containing `"displayName"`, and a `plugins` array, then add the new entry.
 
 - For a brand-new marketplace file, the root object should look like:
 
 ```json
 {
-  "name": "[TODO: marketplace-name]",
+  "name": "personal",
   "interface": {
-    "displayName": "[TODO: Marketplace Display Name]"
+    "displayName": "Personal"
   },
   "plugins": [
     {
@@ -144,7 +149,9 @@ python3 .agents/skills/plugin-creator/scripts/create_basic_plugin.py my-plugin \
 
 - Outer folder name and `plugin.json` `"name"` are always the same normalized plugin name.
 - Do not remove required structure; keep `.codex-plugin/plugin.json` present.
-- Keep manifest values as placeholders until a human or follow-up step explicitly fills them.
+- Do not leave `[TODO: ...]` placeholders in plugin manifests.
+- Keep `apps` and `mcpServers` out of `plugin.json` unless their companion files are actually created.
+- Omit unsupported plugin manifest fields that validation rejects, including `hooks`.
 - If creating files inside an existing plugin path, use `--force` only when overwrite is intentional.
 - Preserve any existing marketplace `interface.displayName`.
 - When generating marketplace entries, always write `policy.installation`, `policy.authentication`, and `category` even if their values are defaults.
@@ -176,3 +183,9 @@ After editing `SKILL.md`, run:
 ```bash
 python3 <path-to-skill-creator>/scripts/quick_validate.py .agents/skills/plugin-creator
 ```
+
+Before handing back a generated plugin, run:
+
+```bash
+python3 .agents/skills/plugin-creator/scripts/validate_plugin.py <plugin-path>
+```
diff --git a/codex-rs/skills/src/assets/samples/plugin-creator/agents/openai.yaml b/codex-rs/skills/src/assets/samples/plugin-creator/agents/openai.yaml
index 979b49859f..19a9a6fc5b 100644
--- a/codex-rs/skills/src/assets/samples/plugin-creator/agents/openai.yaml
+++ b/codex-rs/skills/src/assets/samples/plugin-creator/agents/openai.yaml
@@ -1,6 +1,6 @@
 interface:
   display_name: "Plugin Creator"
   short_description: "Scaffold plugins and marketplace entries"
-  default_prompt: "Use $plugin-creator to scaffold a plugin with placeholder plugin.json, optional structure, and a marketplace.json entry."
+  default_prompt: "Use $plugin-creator to scaffold a valid plugin in the personal marketplace, then validate it before handing it back."
   icon_small: "./assets/plugin-creator-small.svg"
   icon_large: "./assets/plugin-creator.png"
diff --git a/codex-rs/skills/src/assets/samples/plugin-creator/references/plugin-json-spec.md b/codex-rs/skills/src/assets/samples/plugin-creator/references/plugin-json-spec.md
index ee66dfe4f6..0fd444e64b 100644
--- a/codex-rs/skills/src/assets/samples/plugin-creator/references/plugin-json-spec.md
+++ b/codex-rs/skills/src/assets/samples/plugin-creator/references/plugin-json-spec.md
@@ -97,7 +97,8 @@
 
 # Marketplace JSON sample spec
 
-`marketplace.json` depends on where the plugin should live:
+`marketplace.json` depends on where the plugin should live. New plugin creation defaults to the
+personal marketplace unless the caller explicitly requests a repo-local destination:
 
 - Personal plugin: `~/.agents/plugins/marketplace.json`
 - Repo/team plugin: `<repo-root>/.agents/plugins/marketplace.json`
@@ -166,8 +167,25 @@
 - Append new entries unless the user explicitly requests reordering.
 - Replace an existing entry for the same plugin only when overwrite is intentional.
 - Default new plugin creation to the personal marketplace.
-- If the current Git repo already has `.agents/plugins/marketplace.json` and the user has not said
-  personal or team, ask which marketplace to update before creating the entry.
+- Use a repo/team marketplace only when the user specifically requests that destination.
 - Choose marketplace location to match the selected destination:
   - Personal plugin: `~/.agents/plugins/marketplace.json`
   - Repo/team plugin: `<repo-root>/.agents/plugins/marketplace.json`
+
+### Plugin validation notes
+
+- The validator mirrors the workspace plugin ingestion schema so generated plugins follow the same
+  manifest contract from the start.
+- Plugin manifests must include real values for `name`, `version`, `description`,
+  `author.name`, and the required `interface` fields.
+- `version` must use strict semver.
+- `websiteURL`, `privacyPolicyURL`, and `termsOfServiceURL` must be absolute `https://` URLs when
+  present.
+- `composerIcon`, `logo`, and `screenshots` must point to real files inside the plugin archive when
+  present.
+- `apps` and `mcpServers` should appear in `plugin.json` only when `.app.json` and `.mcp.json`
+  actually exist.
+- Validation rejects unsupported manifest fields such as `hooks`, so the scaffold keeps them out of
+  generated manifests.
+- Run `scripts/validate_plugin.py <plugin-path>` before handing back a generated plugin. It adds one
+  intentional preflight check that rejects leftover `[TODO: ...]` placeholders.
diff --git a/codex-rs/skills/src/assets/samples/plugin-creator/scripts/create_basic_plugin.py b/codex-rs/skills/src/assets/samples/plugin-creator/scripts/create_basic_plugin.py
index dcb24562e8..fb882ce99a 100755
--- a/codex-rs/skills/src/assets/samples/plugin-creator/scripts/create_basic_plugin.py
+++ b/codex-rs/skills/src/assets/samples/plugin-creator/scripts/create_basic_plugin.py
@@ -16,7 +16,8 @@ DEFAULT_MARKETPLACE_PATH = Path.home() / ".agents" / "plugins" / "marketplace.js
 DEFAULT_INSTALL_POLICY = "AVAILABLE"
 DEFAULT_AUTH_POLICY = "ON_INSTALL"
 DEFAULT_CATEGORY = "Productivity"
-DEFAULT_MARKETPLACE_DISPLAY_NAME = "[TODO: Marketplace Display Name]"
+DEFAULT_MARKETPLACE_NAME = "personal"
+DEFAULT_MARKETPLACE_DISPLAY_NAME = "Personal"
 VALID_INSTALL_POLICIES = {"NOT_AVAILABLE", "AVAILABLE", "INSTALLED_BY_DEFAULT"}
 VALID_AUTH_POLICIES = {"ON_INSTALL", "ON_USE"}
 
@@ -40,49 +41,35 @@ def validate_plugin_name(plugin_name: str) -> None:
         )
 
 
-def build_plugin_json(plugin_name: str) -> dict:
-    return {
+def display_name_from_plugin_name(plugin_name: str) -> str:
+    return " ".join(part.capitalize() for part in plugin_name.split("-"))
+
+
+def build_plugin_json(plugin_name: str, *, with_mcp: bool, with_apps: bool) -> dict[str, Any]:
+    display_name = display_name_from_plugin_name(plugin_name)
+    payload: dict[str, Any] = {
         "name": plugin_name,
-        "version": "[TODO: 1.2.0]",
-        "description": "[TODO: Brief plugin description]",
+        "version": "0.1.0",
+        "description": f"{display_name} plugin",
         "author": {
-            "name": "[TODO: Author Name]",
-            "email": "[TODO: author@example.com]",
-            "url": "[TODO: https://github.com/author]",
+            "name": "Local developer",
         },
-        "homepage": "[TODO: https://docs.example.com/plugin]",
-        "repository": "[TODO: https://github.com/author/plugin]",
-        "license": "[TODO: MIT]",
-        "keywords": ["[TODO: keyword1]", "[TODO: keyword2]"],
-        "skills": "[TODO: ./skills/]",
-        "hooks": "[TODO: ./hooks.json]",
-        "mcpServers": "[TODO: ./.mcp.json]",
-        "apps": "[TODO: ./.app.json]",
+        "skills": "./skills/",
         "interface": {
-            "displayName": "[TODO: Plugin Display Name]",
-            "shortDescription": "[TODO: Short description for subtitle]",
-            "longDescription": "[TODO: Long description for details page]",
-            "developerName": "[TODO: OpenAI]",
-            "category": "[TODO: Productivity]",
-            "capabilities": ["[TODO: Interactive]", "[TODO: Write]"],
-            "websiteURL": "[TODO: https://openai.com/]",
-            "privacyPolicyURL": "[TODO: https://openai.com/policies/row-privacy-policy/]",
-            "termsOfServiceURL": "[TODO: https://openai.com/policies/row-terms-of-use/]",
-            "defaultPrompt": [
-                "[TODO: Summarize my inbox and draft replies for me.]",
-                "[TODO: Find open bugs and turn them into tickets.]",
-                "[TODO: Review today's meetings and flag gaps.]",
-            ],
-            "brandColor": "[TODO: #3B82F6]",
-            "composerIcon": "[TODO: ./assets/icon.png]",
-            "logo": "[TODO: ./assets/logo.png]",
-            "screenshots": [
-                "[TODO: ./assets/screenshot1.png]",
-                "[TODO: ./assets/screenshot2.png]",
-                "[TODO: ./assets/screenshot3.png]",
-            ],
+            "displayName": display_name,
+            "shortDescription": f"Use {display_name} in Codex.",
+            "longDescription": f"{display_name} adds a local Codex plugin scaffold.",
+            "developerName": "Local developer",
+            "category": DEFAULT_CATEGORY,
+            "capabilities": [],
+            "defaultPrompt": f"Help me use {display_name}.",
         },
     }
+    if with_mcp:
+        payload["mcpServers"] = "./.mcp.json"
+    if with_apps:
+        payload["apps"] = "./.app.json"
+    return payload
 
 
 def build_marketplace_entry(
@@ -112,7 +99,7 @@ def load_json(path: Path) -> dict[str, Any]:
 
 def build_default_marketplace() -> dict[str, Any]:
     return {
-        "name": "[TODO: marketplace-name]",
+        "name": DEFAULT_MARKETPLACE_NAME,
         "interface": {
             "displayName": DEFAULT_MARKETPLACE_DISPLAY_NAME,
         },
@@ -185,7 +172,7 @@ def create_stub_file(path: Path, payload: dict, force: bool) -> None:
 
 def parse_args() -> argparse.Namespace:
     parser = argparse.ArgumentParser(
-        description="Create a plugin skeleton with placeholder plugin.json."
+        description="Create a plugin skeleton with a validation-ready plugin.json."
     )
     parser.add_argument("plugin_name")
     parser.add_argument(
@@ -193,7 +180,7 @@ def parse_args() -> argparse.Namespace:
         default=str(DEFAULT_PLUGIN_PARENT),
         help=(
             "Parent directory for plugin creation (defaults to <home>/plugins). "
-            "Use <repo>/plugins when creating a repo/team plugin."
+            "Pass an explicit repo path only when a repo/team plugin is intended."
         ),
     )
     parser.add_argument("--with-skills", action="store_true", help="Create skills/ directory")
@@ -216,7 +203,7 @@ def parse_args() -> argparse.Namespace:
         default=str(DEFAULT_MARKETPLACE_PATH),
         help=(
             "Path to marketplace.json (defaults to <home>/.agents/plugins/marketplace.json). "
-            "Use <repo>/.agents/plugins/marketplace.json for a repo/team plugin."
+            "Pass a repo-rooted marketplace path only when a repo/team plugin is intended."
         ),
     )
     parser.add_argument(
@@ -252,7 +239,11 @@ def main() -> None:
     plugin_root.mkdir(parents=True, exist_ok=True)
 
     plugin_json_path = plugin_root / ".codex-plugin" / "plugin.json"
-    write_json(plugin_json_path, build_plugin_json(plugin_name), args.force)
+    write_json(
+        plugin_json_path,
+        build_plugin_json(plugin_name, with_mcp=args.with_mcp, with_apps=args.with_apps),
+        args.force,
+    )
 
     optional_directories = {
         "skills": args.with_skills,
diff --git a/codex-rs/skills/src/assets/samples/plugin-creator/scripts/validate_plugin.py b/codex-rs/skills/src/assets/samples/plugin-creator/scripts/validate_plugin.py
new file mode 100644
index 0000000000..64518064e5
--- /dev/null
+++ b/codex-rs/skills/src/assets/samples/plugin-creator/scripts/validate_plugin.py
@@ -0,0 +1,586 @@
+#!/usr/bin/env python3
+"""Validate a generated plugin against the plugin ingestion contract."""
+
+from __future__ import annotations
+
+import argparse
+import json
+import re
+from pathlib import Path, PurePosixPath
+from typing import Any
+from urllib.parse import urlparse
+
+import yaml
+
+
+TODO_MARKER = "[TODO:"
+SEMVER_RE = re.compile(
+    r"^(0|[1-9]\d*)\."
+    r"(0|[1-9]\d*)\."
+    r"(0|[1-9]\d*)"
+    r"(?:-(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*)(?:\."
+    r"(?:0|[1-9]\d*|\d*[A-Za-z-][0-9A-Za-z-]*))*)?"
+    r"(?:\+[0-9A-Za-z-]+(?:\.[0-9A-Za-z-]+)*)?$"
+)
+HEX_COLOR_RE = re.compile(r"^#[0-9A-F]{6}$", re.IGNORECASE)
+
+
+def parse_args() -> argparse.Namespace:
+    parser = argparse.ArgumentParser(description="Validate a local Codex plugin.")
+    parser.add_argument("plugin_path", help="Path to the plugin root directory")
+    return parser.parse_args()
+
+
+def main() -> None:
+    args = parse_args()
+    plugin_root = Path(args.plugin_path).expanduser().resolve()
+    errors = validate_plugin(plugin_root)
+    if errors:
+        print("Plugin validation failed:")
+        for error in errors:
+            print(f"- {error}")
+        raise SystemExit(1)
+    print(f"Plugin validation passed: {plugin_root}")
+
+
+def validate_plugin(plugin_root: Path) -> list[str]:
+    errors: list[str] = []
+    manifest_path = plugin_root / ".codex-plugin" / "plugin.json"
+    manifest = load_json_object(manifest_path, errors)
+    if manifest is None:
+        return errors
+
+    reject_todo_markers(manifest, "$", errors)
+    validate_manifest_shape(plugin_root, manifest, errors)
+    return errors
+
+
+def load_json_object(path: Path, errors: list[str]) -> dict[str, Any] | None:
+    if not path.is_file():
+        errors.append("missing `.codex-plugin/plugin.json`")
+        return None
+    try:
+        payload = json.loads(path.read_text(encoding="utf-8"))
+    except OSError:
+        errors.append("unable to read `.codex-plugin/plugin.json`")
+        return None
+    except json.JSONDecodeError:
+        errors.append("`.codex-plugin/plugin.json` must be valid JSON")
+        return None
+    if not isinstance(payload, dict):
+        errors.append("`.codex-plugin/plugin.json` must contain a JSON object")
+        return None
+    return payload
+
+
+def reject_todo_markers(value: Any, path: str, errors: list[str]) -> None:
+    if isinstance(value, str):
+        if TODO_MARKER in value:
+            errors.append(f"{path} still contains a `[TODO: ...]` placeholder")
+        return
+    if isinstance(value, list):
+        for index, item in enumerate(value):
+            reject_todo_markers(item, f"{path}[{index}]", errors)
+        return
+    if isinstance(value, dict):
+        for key, item in value.items():
+            reject_todo_markers(item, f"{path}.{key}", errors)
+
+
+def validate_manifest_shape(
+    plugin_root: Path,
+    manifest: dict[str, Any],
+    errors: list[str],
+) -> None:
+    allowed_keys = {
+        "id",
+        "name",
+        "version",
+        "description",
+        "skills",
+        "apps",
+        "mcpServers",
+        "interface",
+        "author",
+        "homepage",
+        "repository",
+        "license",
+        "keywords",
+    }
+    for key in sorted(set(manifest) - allowed_keys):
+        errors.append(f"plugin.json field `{key}` is not accepted by plugin validation")
+
+    validate_optional_non_empty_string(manifest, "id", errors)
+    require_non_empty_string(manifest, "name", errors)
+    version = require_non_empty_string(manifest, "version", errors)
+    if version is not None and SEMVER_RE.fullmatch(version) is None:
+        errors.append("plugin.json field `version` must be strict semver")
+    require_non_empty_string(manifest, "description", errors)
+
+    author = require_object(manifest, "author", errors)
+    if author is not None:
+        reject_unknown_fields(author, {"name", "email", "url"}, "author", errors)
+        require_non_empty_string(author, "name", errors, prefix="author")
+        validate_optional_non_empty_string(author, "email", errors, prefix="author")
+        validate_optional_https_url(author, "url", errors, prefix="author")
+
+    validate_optional_contract_path(manifest, "skills", "skills", errors)
+    validate_optional_contract_path(manifest, "apps", ".app.json", errors)
+    validate_optional_contract_path(manifest, "mcpServers", ".mcp.json", errors)
+
+    if manifest.get("apps") is not None:
+        validate_app_manifest(
+            plugin_root / ".app.json",
+            errors,
+        )
+    if manifest.get("mcpServers") is not None:
+        validate_mcp_manifest(
+            plugin_root / ".mcp.json",
+            errors,
+        )
+    validate_skill_manifests(plugin_root, errors)
+
+    interface = require_object(manifest, "interface", errors)
+    if interface is None:
+        return
+    reject_unknown_fields(
+        interface,
+        {
+            "displayName",
+            "shortDescription",
+            "longDescription",
+            "developerName",
+            "category",
+            "capabilities",
+            "websiteURL",
+            "privacyPolicyURL",
+            "termsOfServiceURL",
+            "brandColor",
+            "composerIcon",
+            "logo",
+            "screenshots",
+            "defaultPrompt",
+            "default_prompt",
+        },
+        "interface",
+        errors,
+    )
+    for field in (
+        "displayName",
+        "shortDescription",
+        "longDescription",
+        "developerName",
+        "category",
+    ):
+        require_non_empty_string(interface, field, errors, prefix="interface")
+    if "defaultPrompt" not in interface and "default_prompt" not in interface:
+        errors.append(
+            "plugin.json field `interface.defaultPrompt` or `interface.default_prompt` is required"
+        )
+    capabilities = interface.get("capabilities")
+    if not isinstance(capabilities, list) or not all(
+        isinstance(value, str) and value.strip() for value in capabilities
+    ):
+        errors.append("plugin.json field `interface.capabilities` must be an array of strings")
+    for field in ("websiteURL", "privacyPolicyURL", "termsOfServiceURL"):
+        validate_optional_https_url(interface, field, errors, prefix="interface")
+    brand_color = interface.get("brandColor")
+    if brand_color is not None and (
+        not isinstance(brand_color, str) or HEX_COLOR_RE.fullmatch(brand_color) is None
+    ):
+        errors.append("plugin.json field `interface.brandColor` must use `#RRGGBB`")
+    for field in ("composerIcon", "logo"):
+        validate_optional_asset_path(plugin_root, plugin_root, interface, field, errors)
+    screenshots = interface.get("screenshots", [])
+    if not isinstance(screenshots, list):
+        errors.append("plugin.json field `interface.screenshots` must be an array")
+    else:
+        for index, raw_path in enumerate(screenshots):
+            validate_asset_path(
+                plugin_root,
+                plugin_root,
+                raw_path,
+                f"interface.screenshots[{index}]",
+                errors,
+            )
+
+
+def require_object(
+    payload: dict[str, Any],
+    key: str,
+    errors: list[str],
+) -> dict[str, Any] | None:
+    value = payload.get(key)
+    if not isinstance(value, dict):
+        errors.append(f"plugin.json field `{key}` must be an object")
+        return None
+    return value
+
+
+def require_non_empty_string(
+    payload: dict[str, Any],
+    key: str,
+    errors: list[str],
+    *,
+    prefix: str | None = None,
+) -> str | None:
+    value = payload.get(key)
+    field = f"{prefix}.{key}" if prefix is not None else key
+    if not isinstance(value, str) or not value.strip():
+        errors.append(f"plugin.json field `{field}` must be a non-empty string")
+        return None
+    return value
+
+
+def validate_optional_non_empty_string(
+    payload: dict[str, Any],
+    key: str,
+    errors: list[str],
+    *,
+    prefix: str | None = None,
+) -> None:
+    value = payload.get(key)
+    if value is None:
+        return
+    field = f"{prefix}.{key}" if prefix is not None else key
+    if not isinstance(value, str) or not value.strip():
+        errors.append(f"plugin.json field `{field}` must be a non-empty string")
+
+
+def reject_unknown_fields(
+    payload: dict[str, Any],
+    allowed_keys: set[str],
+    prefix: str,
+    errors: list[str],
+) -> None:
+    for key in sorted(set(payload) - allowed_keys):
+        errors.append(f"plugin.json field `{prefix}.{key}` is not accepted by plugin validation")
+
+
+def validate_optional_https_url(
+    payload: dict[str, Any],
+    key: str,
+    errors: list[str],
+    *,
+    prefix: str,
+) -> None:
+    value = payload.get(key)
+    if value is None:
+        return
+    parsed = urlparse(value) if isinstance(value, str) else None
+    if parsed is None or parsed.scheme != "https" or not parsed.netloc:
+        errors.append(f"plugin.json field `{prefix}.{key}` must be an absolute `https://` URL")
+
+
+def validate_optional_contract_path(
+    payload: dict[str, Any],
+    key: str,
+    expected: str,
+    errors: list[str],
+) -> None:
+    value = payload.get(key)
+    if value is None:
+        return
+    normalized = normalize_contract_path(value) if isinstance(value, str) else None
+    if normalized != expected:
+        errors.append(f"plugin.json field `{key}` must resolve to `{expected}`")
+
+
+def normalize_contract_path(raw_path: str) -> str | None:
+    path = Path(raw_path)
+    if path.is_absolute():
+        return None
+    normalized = path.as_posix().rstrip("/")
+    return normalized or None
+
+
+def validate_app_manifest(path: Path, errors: list[str]) -> None:
+    payload = load_companion_json_object(path, "`.app.json`", errors)
+    if payload is None:
+        return
+    reject_companion_unknown_fields(payload, {"apps"}, "`.app.json`", errors)
+    apps = payload.get("apps")
+    if not isinstance(apps, dict):
+        errors.append("`.app.json` field `apps` must be an object")
+        return
+    for key, value in apps.items():
+        if not isinstance(value, dict):
+            errors.append(f"`.app.json` app `{key}` must be an object")
+            continue
+        reject_companion_unknown_fields(value, {"id"}, f"`.app.json` app `{key}`", errors)
+        app_id = value.get("id")
+        if not isinstance(app_id, str) or not app_id.strip():
+            errors.append(f"`.app.json` app `{key}` field `id` must be a non-empty string")
+
+
+def validate_mcp_manifest(path: Path, errors: list[str]) -> None:
+    payload = load_companion_json_object(path, "`.mcp.json`", errors)
+    if payload is None:
+        return
+    reject_companion_unknown_fields(payload, {"mcpServers"}, "`.mcp.json`", errors)
+    servers = payload.get("mcpServers")
+    if not isinstance(servers, dict):
+        errors.append("`.mcp.json` field `mcpServers` must be an object")
+        return
+    for key, value in servers.items():
+        if not isinstance(key, str) or not key.strip():
+            errors.append("`.mcp.json` server names must be non-empty strings")
+        if not isinstance(value, dict):
+            errors.append(f"`.mcp.json` server `{key}` must be an object")
+
+
+def load_companion_json_object(
+    path: Path,
+    label: str,
+    errors: list[str],
+) -> dict[str, Any] | None:
+    if not path.is_file():
+        errors.append(f"{label} is required when its plugin.json field is present")
+        return None
+    try:
+        payload = json.loads(path.read_text(encoding="utf-8"))
+    except (OSError, json.JSONDecodeError):
+        errors.append(f"{label} must contain valid JSON")
+        return None
+    if not isinstance(payload, dict):
+        errors.append(f"{label} must contain a JSON object")
+        return None
+    return payload
+
+
+def reject_companion_unknown_fields(
+    payload: dict[str, Any],
+    allowed_keys: set[str],
+    prefix: str,
+    errors: list[str],
+) -> None:
+    for key in sorted(set(payload) - allowed_keys):
+        errors.append(f"{prefix} field `{key}` is not accepted by plugin validation")
+
+
+def validate_skill_manifests(plugin_root: Path, errors: list[str]) -> None:
+    skills_root = plugin_root / "skills"
+    if not skills_root.is_dir():
+        return
+    for skill_root in sorted(skills_root.iterdir(), key=lambda path: path.name):
+        if skill_root.name.startswith(".") or not skill_root.is_dir():
+            continue
+        validate_skill_manifest(skill_root, errors)
+
+
+def validate_skill_manifest(skill_root: Path, errors: list[str]) -> None:
+    skill_md_path = skill_root / "SKILL.md"
+    if not skill_md_path.is_file():
+        errors.append(f"skill `{skill_root.name}` is missing `SKILL.md`")
+        return
+    try:
+        contents = skill_md_path.read_text(encoding="utf-8")
+    except OSError:
+        errors.append(f"unable to read skill `{skill_root.name}`")
+        return
+    if not contents.startswith("---\n"):
+        errors.append(f"skill `{skill_root.name}` must start with YAML frontmatter")
+        return
+    frontmatter_end = contents.find("\n---", 4)
+    if frontmatter_end == -1:
+        errors.append(f"skill `{skill_root.name}` frontmatter is not closed")
+        return
+    try:
+        frontmatter = yaml.safe_load(contents[4:frontmatter_end])
+    except yaml.YAMLError:
+        errors.append(f"skill `{skill_root.name}` frontmatter must be valid YAML")
+        return
+    if not isinstance(frontmatter, dict):
+        errors.append(f"skill `{skill_root.name}` frontmatter must be an object")
+        return
+    skill_name = frontmatter.get("name")
+    if not isinstance(skill_name, str) or not skill_name.strip():
+        errors.append(f"skill `{skill_root.name}` frontmatter field `name` must be non-empty")
+    description = frontmatter.get("description")
+    if not isinstance(description, str) or not description.strip():
+        errors.append(
+            f"skill `{skill_root.name}` frontmatter field `description` must be non-empty"
+        )
+    disable_model_invocation = frontmatter.get("disable-model-invocation")
+    if disable_model_invocation is None:
+        disable_model_invocation = frontmatter.get("disable_model_invocation")
+    if disable_model_invocation not in (None, False):
+        errors.append(
+            f"skill `{skill_root.name}` frontmatter field `disable-model-invocation` must be false"
+        )
+    agent_yaml_path = skill_root / "agents" / "openai.yaml"
+    if agent_yaml_path.is_file():
+        validate_skill_agent_manifest(
+            plugin_root=skill_root.parent.parent,
+            skill_root=skill_root,
+            agent_yaml_path=agent_yaml_path,
+            errors=errors,
+        )
+
+
+def validate_skill_agent_manifest(
+    *,
+    plugin_root: Path,
+    skill_root: Path,
+    agent_yaml_path: Path,
+    errors: list[str],
+) -> None:
+    try:
+        payload = yaml.safe_load(agent_yaml_path.read_text(encoding="utf-8"))
+    except OSError:
+        errors.append(f"unable to read skill `{skill_root.name}` agent YAML")
+        return
+    except yaml.YAMLError:
+        errors.append(f"skill `{skill_root.name}` agent YAML must be valid YAML")
+        return
+    if not isinstance(payload, dict):
+        errors.append(f"skill `{skill_root.name}` agent YAML must be an object")
+        return
+
+    reject_skill_agent_unknown_fields(
+        payload,
+        {"interface", "policy", "dependencies"},
+        skill_root,
+        errors,
+    )
+    interface = payload.get("interface")
+    if not isinstance(interface, dict):
+        errors.append(f"skill `{skill_root.name}` agent field `interface` must be an object")
+        return
+    reject_skill_agent_unknown_fields(
+        interface,
+        {
+            "display_name",
+            "short_description",
+            "icon_small",
+            "icon_large",
+            "brand_color",
+            "default_prompt",
+        },
+        skill_root,
+        errors,
+        prefix="interface",
+    )
+    for field in ("display_name", "short_description"):
+        value = interface.get(field)
+        if not isinstance(value, str) or not value.strip():
+            errors.append(
+                f"skill `{skill_root.name}` agent field `interface.{field}` must be non-empty"
+            )
+    for field in ("icon_small", "icon_large"):
+        validate_optional_asset_path(
+            skill_root,
+            plugin_root,
+            interface,
+            field,
+            errors,
+            prefix=f"skill `{skill_root.name}` agent field `interface",
+        )
+    brand_color = interface.get("brand_color")
+    if brand_color is not None and (
+        not isinstance(brand_color, str) or HEX_COLOR_RE.fullmatch(brand_color) is None
+    ):
+        errors.append(
+            f"skill `{skill_root.name}` agent field `interface.brand_color` must use `#RRGGBB`"
+        )
+    default_prompt = interface.get("default_prompt")
+    if default_prompt is not None and (
+        not isinstance(default_prompt, str) or not default_prompt.strip()
+    ):
+        errors.append(
+            f"skill `{skill_root.name}` agent field `interface.default_prompt` must be non-empty"
+        )
+
+    policy = payload.get("policy")
+    if policy is not None:
+        if not isinstance(policy, dict):
+            errors.append(f"skill `{skill_root.name}` agent field `policy` must be an object")
+        else:
+            reject_skill_agent_unknown_fields(
+                policy,
+                {"allow_implicit_invocation"},
+                skill_root,
+                errors,
+                prefix="policy",
+            )
+            allow_implicit_invocation = policy.get("allow_implicit_invocation")
+            if allow_implicit_invocation is not None and not isinstance(
+                allow_implicit_invocation,
+                bool,
+            ):
+                errors.append(
+                    f"skill `{skill_root.name}` agent field "
+                    "`policy.allow_implicit_invocation` must be a boolean"
+                )
+
+    dependencies = payload.get("dependencies")
+    if dependencies is not None:
+        if not isinstance(dependencies, dict):
+            errors.append(
+                f"skill `{skill_root.name}` agent field `dependencies` must be an object"
+            )
+        else:
+            reject_skill_agent_unknown_fields(
+                dependencies,
+                {"tools"},
+                skill_root,
+                errors,
+                prefix="dependencies",
+            )
+
+
+def reject_skill_agent_unknown_fields(
+    payload: dict[str, Any],
+    allowed_keys: set[str],
+    skill_root: Path,
+    errors: list[str],
+    *,
+    prefix: str | None = None,
+) -> None:
+    for key in sorted(set(payload) - allowed_keys):
+        field = f"{prefix}.{key}" if prefix is not None else key
+        errors.append(
+            f"skill `{skill_root.name}` agent field `{field}` is not accepted by plugin validation"
+        )
+
+
+def validate_optional_asset_path(
+    base_dir: Path,
+    allowed_root: Path,
+    payload: dict[str, Any],
+    key: str,
+    errors: list[str],
+    *,
+    prefix: str = "interface",
+) -> None:
+    raw_path = payload.get(key)
+    if raw_path is None:
+        return
+    validate_asset_path(base_dir, allowed_root, raw_path, f"{prefix}.{key}", errors)
+
+
+def validate_asset_path(
+    base_dir: Path,
+    allowed_root: Path,
+    raw_path: Any,
+    field: str,
+    errors: list[str],
+) -> None:
+    label = field if field.startswith("skill `") else f"plugin.json field `{field}`"
+    if not isinstance(raw_path, str) or not raw_path.strip():
+        errors.append(f"{label} must be a non-empty relative path")
+        return
+    candidate = PurePosixPath(raw_path.replace("\\", "/"))
+    if candidate.is_absolute() or any(part in {"", ".", ".."} for part in candidate.parts):
+        errors.append(f"{label} must stay inside the plugin archive")
+        return
+    resolved_path = (base_dir / candidate.as_posix()).resolve()
+    if not resolved_path.is_relative_to(allowed_root.resolve()):
+        errors.append(f"{label} must stay inside the plugin archive")
+        return
+    if not resolved_path.is_file():
+        errors.append(f"{label} points to a missing file")
+
+
+if __name__ == "__main__":
+    main()
diff --git a/codex-rs/state/BUILD.bazel b/codex-rs/state/BUILD.bazel
index e10ac17c90..b3f0fecab7 100644
--- a/codex-rs/state/BUILD.bazel
+++ b/codex-rs/state/BUILD.bazel
@@ -3,5 +3,5 @@ load("//:defs.bzl", "codex_rust_crate")
 codex_rust_crate(
     name = "state",
     crate_name = "codex_state",
-    compile_data = glob(["logs_migrations/**", "migrations/**"]),
+    compile_data = glob(["goals_migrations/**", "logs_migrations/**", "migrations/**"]),
 )
diff --git a/codex-rs/state/goals_migrations/0001_thread_goals.sql b/codex-rs/state/goals_migrations/0001_thread_goals.sql
new file mode 100644
index 0000000000..943226ee8a
--- /dev/null
+++ b/codex-rs/state/goals_migrations/0001_thread_goals.sql
@@ -0,0 +1,18 @@
+CREATE TABLE thread_goals (
+    thread_id TEXT PRIMARY KEY NOT NULL,
+    goal_id TEXT NOT NULL,
+    objective TEXT NOT NULL,
+    status TEXT NOT NULL CHECK(status IN (
+        'active',
+        'paused',
+        'blocked',
+        'usage_limited',
+        'budget_limited',
+        'complete'
+    )),
+    token_budget INTEGER,
+    tokens_used INTEGER NOT NULL DEFAULT 0,
+    time_used_seconds INTEGER NOT NULL DEFAULT 0,
+    created_at_ms INTEGER NOT NULL,
+    updated_at_ms INTEGER NOT NULL
+);
diff --git a/codex-rs/state/migrations/0033_thread_goal_stopped_statuses.sql b/codex-rs/state/migrations/0033_thread_goal_stopped_statuses.sql
new file mode 100644
index 0000000000..4e89f7469b
--- /dev/null
+++ b/codex-rs/state/migrations/0033_thread_goal_stopped_statuses.sql
@@ -0,0 +1,48 @@
+PRAGMA foreign_keys=OFF;
+
+CREATE TABLE thread_goals_new (
+    thread_id TEXT PRIMARY KEY NOT NULL REFERENCES threads(id) ON DELETE CASCADE,
+    goal_id TEXT NOT NULL,
+    objective TEXT NOT NULL,
+    status TEXT NOT NULL CHECK(status IN (
+        'active',
+        'paused',
+        'blocked',
+        'usage_limited',
+        'budget_limited',
+        'complete'
+    )),
+    token_budget INTEGER,
+    tokens_used INTEGER NOT NULL DEFAULT 0,
+    time_used_seconds INTEGER NOT NULL DEFAULT 0,
+    created_at_ms INTEGER NOT NULL,
+    updated_at_ms INTEGER NOT NULL
+);
+
+INSERT INTO thread_goals_new (
+    thread_id,
+    goal_id,
+    objective,
+    status,
+    token_budget,
+    tokens_used,
+    time_used_seconds,
+    created_at_ms,
+    updated_at_ms
+)
+SELECT
+    thread_id,
+    goal_id,
+    objective,
+    status,
+    token_budget,
+    tokens_used,
+    time_used_seconds,
+    created_at_ms,
+    updated_at_ms
+FROM thread_goals;
+
+DROP TABLE thread_goals;
+ALTER TABLE thread_goals_new RENAME TO thread_goals;
+
+PRAGMA foreign_keys=ON;
diff --git a/codex-rs/state/migrations/0034_drop_thread_goals.sql b/codex-rs/state/migrations/0034_drop_thread_goals.sql
new file mode 100644
index 0000000000..8954bd6d5b
--- /dev/null
+++ b/codex-rs/state/migrations/0034_drop_thread_goals.sql
@@ -0,0 +1 @@
+DROP TABLE IF EXISTS thread_goals;
diff --git a/codex-rs/state/src/extract.rs b/codex-rs/state/src/extract.rs
index d815d444ce..2369addf23 100644
--- a/codex-rs/state/src/extract.rs
+++ b/codex-rs/state/src/extract.rs
@@ -156,7 +156,6 @@ mod tests {
     use chrono::DateTime;
     use chrono::Utc;
     use codex_protocol::ThreadId;
-    use codex_protocol::config_types::ReasoningSummary;
     use codex_protocol::models::ContentItem;
     use codex_protocol::models::ResponseItem;
     use codex_protocol::openai_models::ReasoningEffort;
@@ -205,6 +204,7 @@ mod tests {
             images: Some(vec![]),
             local_images: vec![],
             text_elements: vec![],
+            ..Default::default()
         }));
 
         apply_rollout_item(&mut metadata, &item, "test-provider");
@@ -225,6 +225,7 @@ mod tests {
             images: Some(vec!["https://example.com/image.png".to_string()]),
             local_images: vec![],
             text_elements: vec![],
+            ..Default::default()
         }));
 
         apply_rollout_item(&mut metadata, &item, "test-provider");
@@ -248,6 +249,7 @@ mod tests {
             images: Some(vec![]),
             local_images: vec![],
             text_elements: vec![],
+            ..Default::default()
         }));
 
         apply_rollout_item(&mut metadata, &item, "test-provider");
@@ -287,6 +289,7 @@ mod tests {
             images: Some(vec![]),
             local_images: vec![],
             text_elements: vec![],
+            ..Default::default()
         }));
 
         apply_rollout_item(&mut metadata, &user_item, "test-provider");
@@ -335,7 +338,6 @@ mod tests {
             &mut metadata,
             &RolloutItem::TurnContext(TurnContextItem {
                 turn_id: Some("turn-1".to_string()),
-                trace_id: None,
                 cwd: PathBuf::from("/parent/workspace"),
                 current_date: None,
                 timezone: None,
@@ -349,11 +351,7 @@ mod tests {
                 collaboration_mode: None,
                 realtime_active: None,
                 effort: None,
-                summary: ReasoningSummary::Auto,
-                user_instructions: None,
-                developer_instructions: None,
-                final_output_json_schema: None,
-                truncation_policy: None,
+                summary: codex_protocol::config_types::ReasoningSummary::Auto,
             }),
             "test-provider",
         );
@@ -375,7 +373,6 @@ mod tests {
             &mut metadata,
             &RolloutItem::TurnContext(TurnContextItem {
                 turn_id: Some("turn-1".to_string()),
-                trace_id: None,
                 cwd: PathBuf::from("/fallback/workspace"),
                 current_date: None,
                 timezone: None,
@@ -389,11 +386,7 @@ mod tests {
                 collaboration_mode: None,
                 realtime_active: None,
                 effort: Some(ReasoningEffort::High),
-                summary: ReasoningSummary::Auto,
-                user_instructions: None,
-                developer_instructions: None,
-                final_output_json_schema: None,
-                truncation_policy: None,
+                summary: codex_protocol::config_types::ReasoningSummary::Auto,
             }),
             "test-provider",
         );
@@ -409,7 +402,6 @@ mod tests {
             &mut metadata,
             &RolloutItem::TurnContext(TurnContextItem {
                 turn_id: Some("turn-1".to_string()),
-                trace_id: None,
                 cwd: PathBuf::from("/fallback/workspace"),
                 current_date: None,
                 timezone: None,
@@ -423,11 +415,7 @@ mod tests {
                 collaboration_mode: None,
                 realtime_active: None,
                 effort: Some(ReasoningEffort::High),
-                summary: ReasoningSummary::Auto,
-                user_instructions: None,
-                developer_instructions: None,
-                final_output_json_schema: None,
-                truncation_policy: None,
+                summary: codex_protocol::config_types::ReasoningSummary::Auto,
             }),
             "test-provider",
         );
diff --git a/codex-rs/state/src/lib.rs b/codex-rs/state/src/lib.rs
index 3c98a77978..8746ff3a0d 100644
--- a/codex-rs/state/src/lib.rs
+++ b/codex-rs/state/src/lib.rs
@@ -48,13 +48,19 @@ pub use model::ThreadGoalStatus;
 pub use model::ThreadMetadata;
 pub use model::ThreadMetadataBuilder;
 pub use model::ThreadsPage;
+pub use runtime::GoalStore;
 pub use runtime::RemoteControlEnrollmentRecord;
+pub use runtime::RuntimeDbPath;
 pub use runtime::ThreadFilterOptions;
 pub use runtime::ThreadGoalAccountingMode;
 pub use runtime::ThreadGoalAccountingOutcome;
 pub use runtime::ThreadGoalUpdate;
+pub use runtime::goals_db_filename;
+pub use runtime::goals_db_path;
 pub use runtime::logs_db_filename;
 pub use runtime::logs_db_path;
+pub use runtime::runtime_db_paths;
+pub use runtime::sqlite_integrity_check;
 pub use runtime::state_db_filename;
 pub use runtime::state_db_path;
 pub use telemetry::DbTelemetry;
@@ -67,6 +73,7 @@ pub use telemetry::record_fallback;
 pub const SQLITE_HOME_ENV: &str = "CODEX_SQLITE_HOME";
 
 pub const LOGS_DB_FILENAME: &str = "logs_2.sqlite";
+pub const GOALS_DB_FILENAME: &str = "goals_1.sqlite";
 pub const STATE_DB_FILENAME: &str = "state_5.sqlite";
 
 /// Errors encountered during DB operations. Tags: [stage]
diff --git a/codex-rs/state/src/migrations.rs b/codex-rs/state/src/migrations.rs
index 883129a943..526e958b5a 100644
--- a/codex-rs/state/src/migrations.rs
+++ b/codex-rs/state/src/migrations.rs
@@ -4,6 +4,7 @@ use sqlx::migrate::Migrator;
 
 pub(crate) static STATE_MIGRATOR: Migrator = sqlx::migrate!("./migrations");
 pub(crate) static LOGS_MIGRATOR: Migrator = sqlx::migrate!("./logs_migrations");
+pub(crate) static GOALS_MIGRATOR: Migrator = sqlx::migrate!("./goals_migrations");
 
 /// Allow an older Codex binary to open a database that has already been
 /// migrated by a newer binary running in parallel.
@@ -27,3 +28,7 @@ pub(crate) fn runtime_state_migrator() -> Migrator {
 pub(crate) fn runtime_logs_migrator() -> Migrator {
     runtime_migrator(&LOGS_MIGRATOR)
 }
+
+pub(crate) fn runtime_goals_migrator() -> Migrator {
+    runtime_migrator(&GOALS_MIGRATOR)
+}
diff --git a/codex-rs/state/src/model/thread_goal.rs b/codex-rs/state/src/model/thread_goal.rs
index e943c145f8..4806250069 100644
--- a/codex-rs/state/src/model/thread_goal.rs
+++ b/codex-rs/state/src/model/thread_goal.rs
@@ -12,6 +12,8 @@ use super::epoch_millis_to_datetime;
 pub enum ThreadGoalStatus {
     Active,
     Paused,
+    Blocked,
+    UsageLimited,
     BudgetLimited,
     Complete,
 }
@@ -21,6 +23,8 @@ impl ThreadGoalStatus {
         match self {
             Self::Active => "active",
             Self::Paused => "paused",
+            Self::Blocked => "blocked",
+            Self::UsageLimited => "usage_limited",
             Self::BudgetLimited => "budget_limited",
             Self::Complete => "complete",
         }
@@ -42,6 +46,8 @@ impl TryFrom<&str> for ThreadGoalStatus {
         match value {
             "active" => Ok(Self::Active),
             "paused" => Ok(Self::Paused),
+            "blocked" => Ok(Self::Blocked),
+            "usage_limited" => Ok(Self::UsageLimited),
             "budget_limited" => Ok(Self::BudgetLimited),
             "complete" => Ok(Self::Complete),
             other => Err(anyhow!("unknown thread goal status `{other}`")),
diff --git a/codex-rs/state/src/runtime.rs b/codex-rs/state/src/runtime.rs
index a5748da9eb..ac03f227da 100644
--- a/codex-rs/state/src/runtime.rs
+++ b/codex-rs/state/src/runtime.rs
@@ -5,6 +5,7 @@ use crate::AgentJobItemCreateParams;
 use crate::AgentJobItemStatus;
 use crate::AgentJobProgress;
 use crate::AgentJobStatus;
+use crate::GOALS_DB_FILENAME;
 use crate::LOGS_DB_FILENAME;
 use crate::LogEntry;
 use crate::LogQuery;
@@ -15,10 +16,10 @@ use crate::ThreadMetadata;
 use crate::ThreadMetadataBuilder;
 use crate::ThreadsPage;
 use crate::apply_rollout_item;
+use crate::migrations::runtime_goals_migrator;
 use crate::migrations::runtime_logs_migrator;
 use crate::migrations::runtime_state_migrator;
 use crate::model::AgentJobRow;
-use crate::model::ThreadGoalRow;
 use crate::model::ThreadRow;
 use crate::model::anchor_from_item;
 use crate::model::datetime_to_epoch_millis;
@@ -65,6 +66,7 @@ mod remote_control;
 mod test_support;
 mod threads;
 
+pub use goals::GoalStore;
 pub use goals::ThreadGoalAccountingMode;
 pub use goals::ThreadGoalAccountingOutcome;
 pub use goals::ThreadGoalUpdate;
@@ -80,12 +82,60 @@ pub use threads::ThreadFilterOptions;
 const LOG_PARTITION_SIZE_LIMIT_BYTES: i64 = 10 * 1024 * 1024;
 const LOG_PARTITION_ROW_LIMIT: i64 = 1_000;
 
+#[derive(Clone, Copy)]
+struct RuntimeDbSpec {
+    label: &'static str,
+    filename: &'static str,
+    kind: DbKind,
+    open_phase: &'static str,
+    migrate_phase: &'static str,
+}
+
+impl RuntimeDbSpec {
+    fn path(self, codex_home: &Path) -> PathBuf {
+        codex_home.join(self.filename)
+    }
+}
+
+const STATE_DB: RuntimeDbSpec = RuntimeDbSpec {
+    label: "state DB",
+    filename: STATE_DB_FILENAME,
+    kind: DbKind::State,
+    open_phase: "open_state",
+    migrate_phase: "migrate_state",
+};
+
+const LOGS_DB: RuntimeDbSpec = RuntimeDbSpec {
+    label: "log DB",
+    filename: LOGS_DB_FILENAME,
+    kind: DbKind::Logs,
+    open_phase: "open_logs",
+    migrate_phase: "migrate_logs",
+};
+
+const GOALS_DB: RuntimeDbSpec = RuntimeDbSpec {
+    label: "goals DB",
+    filename: GOALS_DB_FILENAME,
+    kind: DbKind::Goals,
+    open_phase: "open_goals",
+    migrate_phase: "migrate_goals",
+};
+
+const RUNTIME_DBS: [RuntimeDbSpec; 3] = [STATE_DB, LOGS_DB, GOALS_DB];
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub struct RuntimeDbPath {
+    pub label: &'static str,
+    pub path: PathBuf,
+}
+
 #[derive(Clone)]
 pub struct StateRuntime {
     codex_home: PathBuf,
     default_provider: String,
     pool: Arc<sqlx::SqlitePool>,
     logs_pool: Arc<sqlx::SqlitePool>,
+    thread_goals: GoalStore,
     thread_updated_at_millis: Arc<AtomicI64>,
 }
 
@@ -121,8 +171,10 @@ impl StateRuntime {
         tokio::fs::create_dir_all(&codex_home).await?;
         let state_migrator = runtime_state_migrator();
         let logs_migrator = runtime_logs_migrator();
-        let state_path = state_db_path(codex_home.as_path());
-        let logs_path = logs_db_path(codex_home.as_path());
+        let goals_migrator = runtime_goals_migrator();
+        let state_path = STATE_DB.path(codex_home.as_path());
+        let logs_path = LOGS_DB.path(codex_home.as_path());
+        let goals_path = GOALS_DB.path(codex_home.as_path());
         let pool = match open_state_sqlite(&state_path, &state_migrator, telemetry_override).await {
             Ok(db) => Arc::new(db),
             Err(err) => {
@@ -138,6 +190,14 @@ impl StateRuntime {
                 return Err(err);
             }
         };
+        let goals_pool =
+            match open_goals_sqlite(&goals_path, &goals_migrator, telemetry_override).await {
+                Ok(db) => Arc::new(db),
+                Err(err) => {
+                    warn!("failed to open goals db at {}: {err}", goals_path.display());
+                    return Err(err);
+                }
+            };
         let started = Instant::now();
         let backfill_state_result = ensure_backfill_state_row_in_pool(pool.as_ref()).await;
         crate::telemetry::record_init_result(
@@ -164,6 +224,7 @@ impl StateRuntime {
         let thread_updated_at_millis = thread_updated_at_millis_result?;
         let thread_updated_at_millis = thread_updated_at_millis.unwrap_or(0);
         let runtime = Arc::new(Self {
+            thread_goals: GoalStore::new(Arc::clone(&goals_pool)),
             pool,
             logs_pool,
             codex_home,
@@ -183,6 +244,10 @@ impl StateRuntime {
     pub fn codex_home(&self) -> &Path {
         self.codex_home.as_path()
     }
+
+    pub fn thread_goals(&self) -> &GoalStore {
+        &self.thread_goals
+    }
 }
 
 fn base_sqlite_options(path: &Path) -> SqliteConnectOptions {
@@ -203,15 +268,7 @@ async fn open_state_sqlite(
     // New state DBs should use incremental auto-vacuum, but retrofitting an
     // existing DB requires a full VACUUM. Do not attempt that during process
     // startup: it is maintenance work that can contend with foreground writers.
-    open_sqlite(
-        path,
-        migrator,
-        DbKind::State,
-        "open_state",
-        "migrate_state",
-        telemetry_override,
-    )
-    .await
+    open_sqlite(path, migrator, STATE_DB, telemetry_override).await
 }
 
 async fn open_logs_sqlite(
@@ -219,23 +276,21 @@ async fn open_logs_sqlite(
     migrator: &Migrator,
     telemetry_override: Option<&dyn DbTelemetry>,
 ) -> anyhow::Result<SqlitePool> {
-    open_sqlite(
-        path,
-        migrator,
-        DbKind::Logs,
-        "open_logs",
-        "migrate_logs",
-        telemetry_override,
-    )
-    .await
+    open_sqlite(path, migrator, LOGS_DB, telemetry_override).await
+}
+
+async fn open_goals_sqlite(
+    path: &Path,
+    migrator: &Migrator,
+    telemetry_override: Option<&dyn DbTelemetry>,
+) -> anyhow::Result<SqlitePool> {
+    open_sqlite(path, migrator, GOALS_DB, telemetry_override).await
 }
 
 async fn open_sqlite(
     path: &Path,
     migrator: &Migrator,
-    db: DbKind,
-    open_phase: &'static str,
-    migrate_phase: &'static str,
+    spec: RuntimeDbSpec,
     telemetry_override: Option<&dyn DbTelemetry>,
 ) -> anyhow::Result<SqlitePool> {
     let options = base_sqlite_options(path).auto_vacuum(SqliteAutoVacuum::Incremental);
@@ -247,8 +302,8 @@ async fn open_sqlite(
         .map_err(anyhow::Error::from);
     crate::telemetry::record_init_result(
         telemetry_override,
-        db,
-        open_phase,
+        spec.kind,
+        spec.open_phase,
         started.elapsed(),
         &pool_result,
     );
@@ -257,8 +312,8 @@ async fn open_sqlite(
     let migrate_result = migrator.run(&pool).await.map_err(anyhow::Error::from);
     crate::telemetry::record_init_result(
         telemetry_override,
-        db,
-        migrate_phase,
+        spec.kind,
+        spec.migrate_phase,
         started.elapsed(),
         &migrate_result,
     );
@@ -285,19 +340,55 @@ ON CONFLICT(id) DO NOTHING
 }
 
 pub fn state_db_filename() -> String {
-    STATE_DB_FILENAME.to_string()
+    STATE_DB.filename.to_string()
 }
 
 pub fn state_db_path(codex_home: &Path) -> PathBuf {
-    codex_home.join(state_db_filename())
+    STATE_DB.path(codex_home)
 }
 
 pub fn logs_db_filename() -> String {
-    LOGS_DB_FILENAME.to_string()
+    LOGS_DB.filename.to_string()
 }
 
 pub fn logs_db_path(codex_home: &Path) -> PathBuf {
-    codex_home.join(logs_db_filename())
+    LOGS_DB.path(codex_home)
+}
+
+pub fn goals_db_filename() -> String {
+    GOALS_DB.filename.to_string()
+}
+
+pub fn goals_db_path(codex_home: &Path) -> PathBuf {
+    GOALS_DB.path(codex_home)
+}
+
+pub fn runtime_db_paths(codex_home: &Path) -> Vec<RuntimeDbPath> {
+    RUNTIME_DBS
+        .iter()
+        .map(|spec| RuntimeDbPath {
+            label: spec.label,
+            path: spec.path(codex_home),
+        })
+        .collect()
+}
+
+/// Run SQLite's built-in integrity check against an existing database file.
+pub async fn sqlite_integrity_check(path: &Path) -> anyhow::Result<Vec<String>> {
+    let options = SqliteConnectOptions::new()
+        .filename(path)
+        .create_if_missing(false)
+        .read_only(true)
+        .log_statements(LevelFilter::Off);
+    let pool = SqlitePoolOptions::new()
+        .max_connections(1)
+        .connect_with(options)
+        .await?;
+    let rows = sqlx::query_scalar::<_, String>("PRAGMA integrity_check")
+        .fetch_all(&pool)
+        .await?;
+    pool.close().await;
+    Ok(rows)
 }
 
 #[cfg(test)]
@@ -305,6 +396,7 @@ mod tests {
     use super::StateRuntime;
     use super::open_state_sqlite;
     use super::runtime_state_migrator;
+    use super::sqlite_integrity_check;
     use super::state_db_path;
     use super::test_support::unique_temp_dir;
     use crate::DB_INIT_METRIC;
@@ -380,6 +472,34 @@ mod tests {
         .expect("open sqlite pool")
     }
 
+    #[tokio::test]
+    async fn sqlite_integrity_check_reports_ok_for_valid_db() {
+        let codex_home = unique_temp_dir();
+        tokio::fs::create_dir_all(&codex_home)
+            .await
+            .expect("create codex home");
+        let path = state_db_path(codex_home.as_path());
+        let pool = SqlitePool::connect_with(
+            SqliteConnectOptions::new()
+                .filename(&path)
+                .create_if_missing(true),
+        )
+        .await
+        .expect("open sqlite db");
+        sqlx::query("CREATE TABLE sample (id INTEGER PRIMARY KEY)")
+            .execute(&pool)
+            .await
+            .expect("create sample table");
+        pool.close().await;
+
+        let result = sqlite_integrity_check(&path)
+            .await
+            .expect("integrity check should run");
+
+        assert_eq!(result, vec!["ok".to_string()]);
+        let _ = tokio::fs::remove_dir_all(codex_home).await;
+    }
+
     #[tokio::test]
     async fn open_state_sqlite_tolerates_newer_applied_migrations() {
         let codex_home = unique_temp_dir();
@@ -457,6 +577,8 @@ mod tests {
             "migrate_state",
             "open_logs",
             "migrate_logs",
+            "open_goals",
+            "migrate_goals",
             "ensure_backfill_state",
             "post_init_query",
         ]
diff --git a/codex-rs/state/src/runtime/goals.rs b/codex-rs/state/src/runtime/goals.rs
index 63dc63557c..bf5a7bd825 100644
--- a/codex-rs/state/src/runtime/goals.rs
+++ b/codex-rs/state/src/runtime/goals.rs
@@ -1,6 +1,18 @@
 use super::*;
+use crate::model::ThreadGoalRow;
 use uuid::Uuid;
 
+#[derive(Clone)]
+pub struct GoalStore {
+    pool: Arc<SqlitePool>,
+}
+
+impl GoalStore {
+    pub(crate) fn new(pool: Arc<SqlitePool>) -> Self {
+        Self { pool }
+    }
+}
+
 pub struct ThreadGoalUpdate {
     pub objective: Option<String>,
     pub status: Option<crate::ThreadGoalStatus>,
@@ -21,7 +33,7 @@ pub enum ThreadGoalAccountingMode {
     ActiveOrStopped,
 }
 
-impl StateRuntime {
+impl GoalStore {
     pub async fn get_thread_goal(
         &self,
         thread_id: ThreadId,
@@ -103,8 +115,6 @@ RETURNING
         .fetch_one(self.pool.as_ref())
         .await?;
 
-        self.set_thread_preview_if_empty(thread_id, objective)
-            .await?;
         thread_goal_from_row(&row)
     }
 
@@ -154,10 +164,6 @@ RETURNING
         .fetch_optional(self.pool.as_ref())
         .await?;
 
-        if row.is_some() {
-            self.set_thread_preview_if_empty(thread_id, objective)
-                .await?;
-        }
         row.map(|row| thread_goal_from_row(&row)).transpose()
     }
 
@@ -183,7 +189,7 @@ UPDATE thread_goals
 SET
     objective = COALESCE(?, objective),
     status = CASE
-        WHEN status = ? AND ? = ? THEN status
+        WHEN status = ? AND ? IN (?, ?) THEN status
         WHEN ? = 'active' AND ? IS NOT NULL AND tokens_used >= ? THEN ?
         ELSE ?
     END,
@@ -197,6 +203,7 @@ WHERE thread_id = ?
                 .bind(crate::ThreadGoalStatus::BudgetLimited.as_str())
                 .bind(status.as_str())
                 .bind(crate::ThreadGoalStatus::Paused.as_str())
+                .bind(crate::ThreadGoalStatus::Blocked.as_str())
                 .bind(status.as_str())
                 .bind(token_budget)
                 .bind(token_budget)
@@ -217,7 +224,7 @@ UPDATE thread_goals
 SET
     objective = COALESCE(?, objective),
     status = CASE
-        WHEN status = ? AND ? = ? THEN status
+        WHEN status = ? AND ? IN (?, ?) THEN status
         WHEN ? = 'active' AND token_budget IS NOT NULL AND tokens_used >= token_budget THEN ?
         ELSE ?
     END,
@@ -230,6 +237,7 @@ WHERE thread_id = ?
                 .bind(crate::ThreadGoalStatus::BudgetLimited.as_str())
                 .bind(status.as_str())
                 .bind(crate::ThreadGoalStatus::Paused.as_str())
+                .bind(crate::ThreadGoalStatus::Blocked.as_str())
                 .bind(status.as_str())
                 .bind(crate::ThreadGoalStatus::BudgetLimited.as_str())
                 .bind(status.as_str())
@@ -308,32 +316,26 @@ WHERE thread_id = ?
         self.get_thread_goal(thread_id).await
     }
 
-    async fn set_thread_preview_if_empty(
-        &self,
-        thread_id: ThreadId,
-        preview: &str,
-    ) -> anyhow::Result<()> {
-        let preview = preview.trim();
-        if preview.is_empty() {
-            return Ok(());
-        }
-        sqlx::query(
-            r#"
-UPDATE threads
-SET preview = ?
-WHERE id = ? AND preview = ''
-            "#,
-        )
-        .bind(preview)
-        .bind(thread_id.to_string())
-        .execute(self.pool.as_ref())
-        .await?;
-        Ok(())
-    }
-
     pub async fn pause_active_thread_goal(
         &self,
         thread_id: ThreadId,
+    ) -> anyhow::Result<Option<crate::ThreadGoal>> {
+        self.update_active_thread_goal_status(thread_id, crate::ThreadGoalStatus::Paused)
+            .await
+    }
+
+    pub async fn usage_limit_active_thread_goal(
+        &self,
+        thread_id: ThreadId,
+    ) -> anyhow::Result<Option<crate::ThreadGoal>> {
+        self.update_active_thread_goal_status(thread_id, crate::ThreadGoalStatus::UsageLimited)
+            .await
+    }
+
+    async fn update_active_thread_goal_status(
+        &self,
+        thread_id: ThreadId,
+        status: crate::ThreadGoalStatus,
     ) -> anyhow::Result<Option<crate::ThreadGoal>> {
         let now_ms = datetime_to_epoch_millis(Utc::now());
         let result = sqlx::query(
@@ -343,12 +345,19 @@ SET
     status = ?,
     updated_at_ms = ?
 WHERE thread_id = ?
-  AND status = 'active'
+  AND (
+      status = 'active'
+      OR (
+          ? = 'usage_limited'
+          AND status = 'budget_limited'
+      )
+  )
             "#,
         )
-        .bind(crate::ThreadGoalStatus::Paused.as_str())
+        .bind(status.as_str())
         .bind(now_ms)
         .bind(thread_id.to_string())
+        .bind(status.as_str())
         .execute(self.pool.as_ref())
         .await?;
 
@@ -397,7 +406,7 @@ WHERE thread_id = ?
                 "status IN ('active', 'budget_limited', 'complete')"
             }
             ThreadGoalAccountingMode::ActiveOrStopped => {
-                "status IN ('active', 'paused', 'budget_limited')"
+                "status IN ('active', 'paused', 'blocked', 'usage_limited', 'budget_limited')"
             }
         };
         let budget_limit_status_filter = match mode {
@@ -405,7 +414,7 @@ WHERE thread_id = ?
             | ThreadGoalAccountingMode::ActiveOnly
             | ThreadGoalAccountingMode::ActiveOrComplete => "status = 'active'",
             ThreadGoalAccountingMode::ActiveOrStopped => {
-                "status IN ('active', 'paused', 'budget_limited')"
+                "status IN ('active', 'paused', 'blocked', 'usage_limited', 'budget_limited')"
             }
         };
         let goal_id_filter = if expected_goal_id.is_some() {
@@ -519,6 +528,7 @@ mod tests {
         upsert_test_thread(&runtime, thread_id).await;
 
         let goal = runtime
+            .thread_goals()
             .replace_thread_goal(
                 thread_id,
                 "optimize the benchmark",
@@ -529,7 +539,11 @@ mod tests {
             .expect("goal replacement should succeed");
         assert_eq!(
             Some(goal.clone()),
-            runtime.get_thread_goal(thread_id).await.unwrap()
+            runtime
+                .thread_goals()
+                .get_thread_goal(thread_id)
+                .await
+                .unwrap()
         );
         let metadata = runtime
             .get_thread(thread_id)
@@ -539,6 +553,7 @@ mod tests {
         assert_eq!(metadata.preview.as_deref(), Some("hello"));
 
         let updated = runtime
+            .thread_goals()
             .update_thread_goal(
                 thread_id,
                 ThreadGoalUpdate {
@@ -560,6 +575,7 @@ mod tests {
         assert_eq!(expected, updated);
 
         let replaced = runtime
+            .thread_goals()
             .replace_thread_goal(
                 thread_id,
                 "ship the new result",
@@ -574,44 +590,28 @@ mod tests {
         assert_eq!(0, replaced.tokens_used);
         assert_eq!(0, replaced.time_used_seconds);
 
-        assert!(runtime.delete_thread_goal(thread_id).await.unwrap());
-        assert_eq!(None, runtime.get_thread_goal(thread_id).await.unwrap());
-        assert!(!runtime.delete_thread_goal(thread_id).await.unwrap());
-    }
-
-    #[tokio::test]
-    async fn replace_thread_goal_sets_preview_when_empty() {
-        let runtime = test_runtime().await;
-        let thread_id = test_thread_id();
-        let mut metadata = test_thread_metadata(
-            runtime.codex_home(),
-            thread_id,
-            runtime.codex_home().join("workspace"),
+        assert!(
+            runtime
+                .thread_goals()
+                .delete_thread_goal(thread_id)
+                .await
+                .unwrap()
+        );
+        assert_eq!(
+            None,
+            runtime
+                .thread_goals()
+                .get_thread_goal(thread_id)
+                .await
+                .unwrap()
+        );
+        assert!(
+            !runtime
+                .thread_goals()
+                .delete_thread_goal(thread_id)
+                .await
+                .unwrap()
         );
-        metadata.preview = None;
-        metadata.first_user_message = None;
-        runtime
-            .upsert_thread(&metadata)
-            .await
-            .expect("test thread should be upserted");
-
-        runtime
-            .replace_thread_goal(
-                thread_id,
-                "optimize the benchmark",
-                crate::ThreadGoalStatus::Active,
-                /*token_budget*/ None,
-            )
-            .await
-            .expect("goal replacement should succeed");
-
-        let metadata = runtime
-            .get_thread(thread_id)
-            .await
-            .expect("thread metadata should load")
-            .expect("thread should exist");
-        assert_eq!(metadata.preview.as_deref(), Some("optimize the benchmark"));
-        assert_eq!(metadata.first_user_message, None);
     }
 
     #[tokio::test]
@@ -621,6 +621,7 @@ mod tests {
         upsert_test_thread(&runtime, thread_id).await;
 
         let replaced = runtime
+            .thread_goals()
             .replace_thread_goal(
                 thread_id,
                 "stay within budget",
@@ -643,6 +644,7 @@ mod tests {
         upsert_test_thread(&runtime, thread_id).await;
 
         let inserted = runtime
+            .thread_goals()
             .insert_thread_goal(
                 thread_id,
                 "optimize the benchmark",
@@ -654,6 +656,7 @@ mod tests {
             .expect("goal should be inserted");
 
         let duplicate = runtime
+            .thread_goals()
             .insert_thread_goal(
                 thread_id,
                 "replace the benchmark",
@@ -666,7 +669,11 @@ mod tests {
         assert_eq!(None, duplicate);
         assert_eq!(
             Some(inserted),
-            runtime.get_thread_goal(thread_id).await.unwrap()
+            runtime
+                .thread_goals()
+                .get_thread_goal(thread_id)
+                .await
+                .unwrap()
         );
     }
 
@@ -677,6 +684,7 @@ mod tests {
         upsert_test_thread(&runtime, thread_id).await;
 
         let inserted = runtime
+            .thread_goals()
             .insert_thread_goal(
                 thread_id,
                 "stay within budget",
@@ -700,6 +708,7 @@ mod tests {
         upsert_test_thread(&runtime, thread_id).await;
 
         let original = runtime
+            .thread_goals()
             .replace_thread_goal(
                 thread_id,
                 "old objective",
@@ -709,6 +718,7 @@ mod tests {
             .await
             .expect("goal replacement should succeed");
         let replacement = runtime
+            .thread_goals()
             .replace_thread_goal(
                 thread_id,
                 "new objective",
@@ -719,6 +729,7 @@ mod tests {
             .expect("goal replacement should succeed");
 
         let stale_update = runtime
+            .thread_goals()
             .update_thread_goal(
                 thread_id,
                 ThreadGoalUpdate {
@@ -735,12 +746,14 @@ mod tests {
         assert_eq!(
             Some(replacement.clone()),
             runtime
+                .thread_goals()
                 .get_thread_goal(thread_id)
                 .await
                 .expect("goal read should succeed")
         );
 
         let fresh_update = runtime
+            .thread_goals()
             .update_thread_goal(
                 thread_id,
                 ThreadGoalUpdate {
@@ -763,6 +776,7 @@ mod tests {
         upsert_test_thread(&runtime, thread_id).await;
 
         let original = runtime
+            .thread_goals()
             .replace_thread_goal(
                 thread_id,
                 "old objective",
@@ -772,6 +786,7 @@ mod tests {
             .await
             .expect("goal replacement should succeed");
         let replacement = runtime
+            .thread_goals()
             .replace_thread_goal(
                 thread_id,
                 "new objective",
@@ -782,6 +797,7 @@ mod tests {
             .expect("goal replacement should succeed");
 
         let outcome = runtime
+            .thread_goals()
             .account_thread_goal_usage(
                 thread_id,
                 /*time_delta_seconds*/ 5,
@@ -809,6 +825,7 @@ mod tests {
         upsert_test_thread(&runtime, thread_id).await;
 
         runtime
+            .thread_goals()
             .replace_thread_goal(
                 thread_id,
                 "draft the report",
@@ -818,6 +835,7 @@ mod tests {
             .await
             .expect("goal replacement should succeed");
         let outcome = runtime
+            .thread_goals()
             .account_thread_goal_usage(
                 thread_id,
                 /*time_delta_seconds*/ 12,
@@ -832,6 +850,7 @@ mod tests {
         };
 
         let updated = runtime
+            .thread_goals()
             .update_thread_goal(
                 thread_id,
                 ThreadGoalUpdate {
@@ -860,6 +879,7 @@ mod tests {
         let thread_id = test_thread_id();
         upsert_test_thread(&runtime, thread_id).await;
         runtime
+            .thread_goals()
             .replace_thread_goal(
                 thread_id,
                 "optimize the benchmark",
@@ -869,7 +889,7 @@ mod tests {
             .await
             .expect("goal replacement should succeed");
 
-        let status_update = runtime.update_thread_goal(
+        let status_update = runtime.thread_goals().update_thread_goal(
             thread_id,
             ThreadGoalUpdate {
                 objective: None,
@@ -878,7 +898,7 @@ mod tests {
                 expected_goal_id: None,
             },
         );
-        let budget_update = runtime.update_thread_goal(
+        let budget_update = runtime.thread_goals().update_thread_goal(
             thread_id,
             ThreadGoalUpdate {
                 objective: None,
@@ -892,6 +912,7 @@ mod tests {
         budget_update.expect("budget update should succeed");
 
         let goal = runtime
+            .thread_goals()
             .get_thread_goal(thread_id)
             .await
             .expect("goal read should succeed")
@@ -906,6 +927,7 @@ mod tests {
         let thread_id = test_thread_id();
         upsert_test_thread(&runtime, thread_id).await;
         let goal = runtime
+            .thread_goals()
             .replace_thread_goal(
                 thread_id,
                 "optimize the benchmark",
@@ -916,6 +938,7 @@ mod tests {
             .expect("goal replacement should succeed");
 
         let paused = runtime
+            .thread_goals()
             .pause_active_thread_goal(thread_id)
             .await
             .expect("active pause should succeed")
@@ -928,6 +951,7 @@ mod tests {
         assert_eq!(expected, paused);
 
         let complete = runtime
+            .thread_goals()
             .update_thread_goal(
                 thread_id,
                 ThreadGoalUpdate {
@@ -941,6 +965,7 @@ mod tests {
             .expect("goal update should succeed")
             .expect("goal should exist");
         let pause_result = runtime
+            .thread_goals()
             .pause_active_thread_goal(thread_id)
             .await
             .expect("terminal pause attempt should succeed");
@@ -948,18 +973,80 @@ mod tests {
         assert_eq!(
             Some(complete),
             runtime
+                .thread_goals()
                 .get_thread_goal(thread_id)
                 .await
                 .expect("goal read should succeed")
         );
     }
 
+    #[tokio::test]
+    async fn usage_limit_active_thread_goal_updates_active_or_budget_limited_goals() {
+        let runtime = test_runtime().await;
+        let thread_id = test_thread_id();
+        upsert_test_thread(&runtime, thread_id).await;
+        let goal = runtime
+            .thread_goals()
+            .replace_thread_goal(
+                thread_id,
+                "optimize the benchmark",
+                crate::ThreadGoalStatus::Active,
+                /*token_budget*/ None,
+            )
+            .await
+            .expect("goal replacement should succeed");
+
+        let usage_limited = runtime
+            .thread_goals()
+            .usage_limit_active_thread_goal(thread_id)
+            .await
+            .expect("usage limiting should succeed")
+            .expect("active goal should become usage limited");
+        let expected = crate::ThreadGoal {
+            status: crate::ThreadGoalStatus::UsageLimited,
+            updated_at: usage_limited.updated_at,
+            ..goal
+        };
+        assert_eq!(expected, usage_limited);
+
+        let second_update = runtime
+            .thread_goals()
+            .usage_limit_active_thread_goal(thread_id)
+            .await
+            .expect("repeated usage limiting should succeed");
+        assert_eq!(None, second_update);
+
+        let budget_limited = runtime
+            .thread_goals()
+            .replace_thread_goal(
+                thread_id,
+                "keep the usage failure visible",
+                crate::ThreadGoalStatus::BudgetLimited,
+                /*token_budget*/ Some(1),
+            )
+            .await
+            .expect("goal replacement should succeed");
+        let usage_limited = runtime
+            .thread_goals()
+            .usage_limit_active_thread_goal(thread_id)
+            .await
+            .expect("usage limiting should succeed")
+            .expect("budget-limited goal should become usage limited");
+        let expected = crate::ThreadGoal {
+            status: crate::ThreadGoalStatus::UsageLimited,
+            updated_at: usage_limited.updated_at,
+            ..budget_limited
+        };
+        assert_eq!(expected, usage_limited);
+    }
+
     #[tokio::test]
     async fn usage_accounting_updates_active_goals_and_accounts_budget_limited_in_flight_usage() {
         let runtime = test_runtime().await;
         let thread_id = test_thread_id();
         upsert_test_thread(&runtime, thread_id).await;
         runtime
+            .thread_goals()
             .replace_thread_goal(
                 thread_id,
                 "stay within budget",
@@ -970,6 +1057,7 @@ mod tests {
             .expect("goal replacement should succeed");
 
         let outcome = runtime
+            .thread_goals()
             .account_thread_goal_usage(
                 thread_id,
                 /*time_delta_seconds*/ 7,
@@ -987,6 +1075,7 @@ mod tests {
         assert_eq!(7, goal.time_used_seconds);
 
         let outcome = runtime
+            .thread_goals()
             .account_thread_goal_usage(
                 thread_id,
                 /*time_delta_seconds*/ 3,
@@ -1004,6 +1093,7 @@ mod tests {
         assert_eq!(10, goal.time_used_seconds);
 
         let outcome = runtime
+            .thread_goals()
             .account_thread_goal_usage(
                 thread_id,
                 /*time_delta_seconds*/ 5,
@@ -1027,6 +1117,7 @@ mod tests {
         let thread_id = test_thread_id();
         upsert_test_thread(&runtime, thread_id).await;
         runtime
+            .thread_goals()
             .replace_thread_goal(
                 thread_id,
                 "stay stopped",
@@ -1037,6 +1128,7 @@ mod tests {
             .expect("goal replacement should succeed");
 
         let outcome = runtime
+            .thread_goals()
             .account_thread_goal_usage(
                 thread_id,
                 /*time_delta_seconds*/ 5,
@@ -1060,6 +1152,7 @@ mod tests {
         let thread_id = test_thread_id();
         upsert_test_thread(&runtime, thread_id).await;
         runtime
+            .thread_goals()
             .replace_thread_goal(
                 thread_id,
                 "stop before overrun",
@@ -1069,6 +1162,7 @@ mod tests {
             .await
             .expect("goal replacement should succeed");
         runtime
+            .thread_goals()
             .update_thread_goal(
                 thread_id,
                 crate::ThreadGoalUpdate {
@@ -1082,6 +1176,7 @@ mod tests {
             .expect("goal update should succeed");
 
         let outcome = runtime
+            .thread_goals()
             .account_thread_goal_usage(
                 thread_id,
                 /*time_delta_seconds*/ 3,
@@ -1105,6 +1200,7 @@ mod tests {
         let thread_id = test_thread_id();
         upsert_test_thread(&runtime, thread_id).await;
         runtime
+            .thread_goals()
             .replace_thread_goal(
                 thread_id,
                 "stay within budget",
@@ -1114,6 +1210,7 @@ mod tests {
             .await
             .expect("goal replacement should succeed");
         runtime
+            .thread_goals()
             .account_thread_goal_usage(
                 thread_id,
                 /*time_delta_seconds*/ 1,
@@ -1125,6 +1222,7 @@ mod tests {
             .expect("usage accounting should succeed");
 
         let lowered = runtime
+            .thread_goals()
             .update_thread_goal(
                 thread_id,
                 ThreadGoalUpdate {
@@ -1149,6 +1247,7 @@ mod tests {
         let thread_id = test_thread_id();
         upsert_test_thread(&runtime, thread_id).await;
         runtime
+            .thread_goals()
             .replace_thread_goal(
                 thread_id,
                 "stay within budget",
@@ -1158,6 +1257,7 @@ mod tests {
             .await
             .expect("goal replacement should succeed");
         runtime
+            .thread_goals()
             .account_thread_goal_usage(
                 thread_id,
                 /*time_delta_seconds*/ 1,
@@ -1169,6 +1269,7 @@ mod tests {
             .expect("usage accounting should succeed");
 
         let reactivated = runtime
+            .thread_goals()
             .update_thread_goal(
                 thread_id,
                 ThreadGoalUpdate {
@@ -1197,6 +1298,7 @@ mod tests {
         let thread_id = test_thread_id();
         upsert_test_thread(&runtime, thread_id).await;
         runtime
+            .thread_goals()
             .replace_thread_goal(
                 thread_id,
                 "stay within budget",
@@ -1206,6 +1308,7 @@ mod tests {
             .await
             .expect("goal replacement should succeed");
         runtime
+            .thread_goals()
             .account_thread_goal_usage(
                 thread_id,
                 /*time_delta_seconds*/ 1,
@@ -1217,6 +1320,7 @@ mod tests {
             .expect("usage accounting should succeed");
 
         let paused = runtime
+            .thread_goals()
             .update_thread_goal(
                 thread_id,
                 ThreadGoalUpdate {
@@ -1235,12 +1339,65 @@ mod tests {
         assert_eq!(50, paused.tokens_used);
     }
 
+    #[tokio::test]
+    async fn blocking_budget_limited_goal_preserves_terminal_status() {
+        let runtime = test_runtime().await;
+        let thread_id = test_thread_id();
+        upsert_test_thread(&runtime, thread_id).await;
+        runtime
+            .thread_goals()
+            .replace_thread_goal(
+                thread_id,
+                "stay within budget",
+                crate::ThreadGoalStatus::Active,
+                /*token_budget*/ Some(40),
+            )
+            .await
+            .expect("goal replacement should succeed");
+        let outcome = runtime
+            .thread_goals()
+            .account_thread_goal_usage(
+                thread_id,
+                /*time_delta_seconds*/ 1,
+                /*token_delta*/ 50,
+                ThreadGoalAccountingMode::ActiveOnly,
+                /*expected_goal_id*/ None,
+            )
+            .await
+            .expect("usage accounting should succeed");
+        let ThreadGoalAccountingOutcome::Updated(budget_limited) = outcome else {
+            panic!("budget crossing should update the goal");
+        };
+
+        let blocked = runtime
+            .thread_goals()
+            .update_thread_goal(
+                thread_id,
+                ThreadGoalUpdate {
+                    objective: None,
+                    status: Some(crate::ThreadGoalStatus::Blocked),
+                    token_budget: None,
+                    expected_goal_id: None,
+                },
+            )
+            .await
+            .expect("goal update should succeed")
+            .expect("goal should exist");
+
+        let expected = crate::ThreadGoal {
+            updated_at: blocked.updated_at,
+            ..budget_limited
+        };
+        assert_eq!(expected, blocked);
+    }
+
     #[tokio::test]
     async fn usage_accounting_can_finalize_completed_goal_for_completing_turn() {
         let runtime = test_runtime().await;
         let thread_id = test_thread_id();
         upsert_test_thread(&runtime, thread_id).await;
         runtime
+            .thread_goals()
             .replace_thread_goal(
                 thread_id,
                 "finish the report",
@@ -1251,6 +1408,7 @@ mod tests {
             .expect("goal replacement should succeed");
 
         let active_only = runtime
+            .thread_goals()
             .account_thread_goal_usage(
                 thread_id,
                 /*time_delta_seconds*/ 30,
@@ -1268,6 +1426,7 @@ mod tests {
         assert_eq!(0, goal.time_used_seconds);
 
         let completing_turn = runtime
+            .thread_goals()
             .account_thread_goal_usage(
                 thread_id,
                 /*time_delta_seconds*/ 30,
@@ -1291,6 +1450,7 @@ mod tests {
         let thread_id = test_thread_id();
         upsert_test_thread(&runtime, thread_id).await;
         runtime
+            .thread_goals()
             .replace_thread_goal(
                 thread_id,
                 "finish the report",
@@ -1300,6 +1460,7 @@ mod tests {
             .await
             .expect("goal replacement should succeed");
         runtime
+            .thread_goals()
             .update_thread_goal(
                 thread_id,
                 ThreadGoalUpdate {
@@ -1314,6 +1475,7 @@ mod tests {
             .expect("goal should exist");
 
         let active_only = runtime
+            .thread_goals()
             .account_thread_goal_usage(
                 thread_id,
                 /*time_delta_seconds*/ 30,
@@ -1331,6 +1493,7 @@ mod tests {
         assert_eq!(0, goal.time_used_seconds);
 
         let in_flight_turn = runtime
+            .thread_goals()
             .account_thread_goal_usage(
                 thread_id,
                 /*time_delta_seconds*/ 30,
@@ -1354,6 +1517,7 @@ mod tests {
         let thread_id = test_thread_id();
         upsert_test_thread(&runtime, thread_id).await;
         runtime
+            .thread_goals()
             .replace_thread_goal(
                 thread_id,
                 "count every token",
@@ -1363,14 +1527,14 @@ mod tests {
             .await
             .expect("goal replacement should succeed");
 
-        let first = runtime.account_thread_goal_usage(
+        let first = runtime.thread_goals().account_thread_goal_usage(
             thread_id,
             /*time_delta_seconds*/ 4,
             /*token_delta*/ 40,
             ThreadGoalAccountingMode::ActiveOnly,
             /*expected_goal_id*/ None,
         );
-        let second = runtime.account_thread_goal_usage(
+        let second = runtime.thread_goals().account_thread_goal_usage(
             thread_id,
             /*time_delta_seconds*/ 6,
             /*token_delta*/ 60,
@@ -1382,6 +1546,7 @@ mod tests {
         second.expect("second usage accounting should succeed");
 
         let goal = runtime
+            .thread_goals()
             .get_thread_goal(thread_id)
             .await
             .expect("goal read should succeed")
@@ -1396,6 +1561,7 @@ mod tests {
         let thread_id = test_thread_id();
         upsert_test_thread(&runtime, thread_id).await;
         runtime
+            .thread_goals()
             .replace_thread_goal(
                 thread_id,
                 "clean up with the thread",
@@ -1413,6 +1579,7 @@ mod tests {
         assert_eq!(
             None,
             runtime
+                .thread_goals()
                 .get_thread_goal(thread_id)
                 .await
                 .expect("goal read should succeed")
diff --git a/codex-rs/state/src/runtime/threads.rs b/codex-rs/state/src/runtime/threads.rs
index 925fb45288..c7030d7e44 100644
--- a/codex-rs/state/src/runtime/threads.rs
+++ b/codex-rs/state/src/runtime/threads.rs
@@ -51,6 +51,29 @@ WHERE threads.id = ?
         Ok(row.and_then(|row| row.try_get("memory_mode").ok()))
     }
 
+    pub async fn set_thread_preview_if_empty(
+        &self,
+        thread_id: ThreadId,
+        preview: &str,
+    ) -> anyhow::Result<bool> {
+        let preview = preview.trim();
+        if preview.is_empty() {
+            return Ok(false);
+        }
+        let result = sqlx::query(
+            r#"
+UPDATE threads
+SET preview = ?
+WHERE id = ? AND preview = ''
+            "#,
+        )
+        .bind(preview)
+        .bind(thread_id.to_string())
+        .execute(self.pool.as_ref())
+        .await?;
+        Ok(result.rows_affected() > 0)
+    }
+
     /// Get dynamic tools for a thread, if present.
     pub async fn get_dynamic_tools(
         &self,
@@ -947,7 +970,11 @@ ON CONFLICT(thread_id, position) DO NOTHING
             .bind(thread_id.to_string())
             .execute(self.pool.as_ref())
             .await?;
-        Ok(result.rows_affected())
+        let rows_affected = result.rows_affected();
+        if rows_affected > 0 {
+            self.thread_goals.delete_thread_goal(thread_id).await?;
+        }
+        Ok(rows_affected)
     }
 }
 
@@ -1565,6 +1592,47 @@ mod tests {
         assert_eq!(persisted.preview.as_deref(), Some("migrated goal preview"));
     }
 
+    #[tokio::test]
+    async fn set_thread_preview_if_empty_only_fills_blank_preview() {
+        let codex_home = unique_temp_dir();
+        let runtime = StateRuntime::init(codex_home.clone(), "test-provider".to_string())
+            .await
+            .expect("state db should initialize");
+        let thread_id =
+            ThreadId::from_string("00000000-0000-0000-0000-000000000460").expect("valid thread id");
+        let mut metadata = test_thread_metadata(&codex_home, thread_id, codex_home.clone());
+        metadata.first_user_message = None;
+        metadata.preview = None;
+
+        runtime
+            .upsert_thread(&metadata)
+            .await
+            .expect("initial upsert should succeed");
+
+        let empty_updated = runtime
+            .set_thread_preview_if_empty(thread_id, "  ")
+            .await
+            .expect("empty preview update should succeed");
+        assert!(!empty_updated);
+        let goal_updated = runtime
+            .set_thread_preview_if_empty(thread_id, "  goal preview  ")
+            .await
+            .expect("goal preview update should succeed");
+        assert!(goal_updated);
+        let overwrite_updated = runtime
+            .set_thread_preview_if_empty(thread_id, "new preview")
+            .await
+            .expect("overwrite preview update should succeed");
+        assert!(!overwrite_updated);
+
+        let persisted = runtime
+            .get_thread(thread_id)
+            .await
+            .expect("thread should load")
+            .expect("thread should exist");
+        assert_eq!(persisted.preview.as_deref(), Some("goal preview"));
+    }
+
     #[tokio::test]
     async fn update_thread_git_info_preserves_newer_non_git_metadata() {
         let codex_home = unique_temp_dir();
diff --git a/codex-rs/state/src/telemetry.rs b/codex-rs/state/src/telemetry.rs
index a4a26db0ce..da2b7de7a8 100644
--- a/codex-rs/state/src/telemetry.rs
+++ b/codex-rs/state/src/telemetry.rs
@@ -39,6 +39,7 @@ pub fn install_process_db_telemetry(telemetry: DbTelemetryHandle) -> bool {
 pub(crate) enum DbKind {
     State,
     Logs,
+    Goals,
 }
 
 impl DbKind {
@@ -46,6 +47,7 @@ impl DbKind {
         match self {
             Self::State => "state",
             Self::Logs => "logs",
+            Self::Goals => "goals",
         }
     }
 }
diff --git a/codex-rs/terminal-detection/src/lib.rs b/codex-rs/terminal-detection/src/lib.rs
index 6474c189a5..c42733380d 100644
--- a/codex-rs/terminal-detection/src/lib.rs
+++ b/codex-rs/terminal-detection/src/lib.rs
@@ -64,7 +64,10 @@ pub enum Multiplexer {
         version: Option<String>,
     },
     /// zellij terminal multiplexer.
-    Zellij {},
+    Zellij {
+        /// Zellij version string when ZELLIJ_VERSION is available.
+        version: Option<String>,
+    },
 }
 
 /// tmux client terminal identification captured via `tmux display-message`.
@@ -207,7 +210,7 @@ impl TerminalInfo {
 
     /// Returns whether the active terminal multiplexer is Zellij.
     pub fn is_zellij(&self) -> bool {
-        matches!(self.multiplexer, Some(Multiplexer::Zellij {}))
+        matches!(self.multiplexer, Some(Multiplexer::Zellij { .. }))
     }
 }
 
@@ -237,6 +240,11 @@ trait Environment {
 
     /// Returns tmux client details when available.
     fn tmux_client_info(&self) -> TmuxClientInfo;
+
+    /// Returns Zellij version details when available.
+    fn zellij_version(&self) -> Option<String> {
+        self.var_non_empty("ZELLIJ_VERSION")
+    }
 }
 
 /// Reads environment variables from the running process.
@@ -257,6 +265,11 @@ impl Environment for ProcessEnvironment {
     fn tmux_client_info(&self) -> TmuxClientInfo {
         tmux_client_info()
     }
+
+    fn zellij_version(&self) -> Option<String> {
+        self.var_non_empty("ZELLIJ_VERSION")
+            .or_else(zellij_version_from_command)
+    }
 }
 
 /// Returns a sanitized terminal identifier for User-Agent strings.
@@ -385,7 +398,9 @@ fn detect_multiplexer(env: &dyn Environment) -> Option<Multiplexer> {
         || env.has_non_empty("ZELLIJ_SESSION_NAME")
         || env.has_non_empty("ZELLIJ_VERSION")
     {
-        return Some(Multiplexer::Zellij {});
+        return Some(Multiplexer::Zellij {
+            version: env.zellij_version(),
+        });
     }
 
     None
@@ -456,6 +471,32 @@ fn tmux_display_message(format: &str) -> Option<String> {
     none_if_whitespace(value.trim().to_string())
 }
 
+fn zellij_version_from_command() -> Option<String> {
+    // Best-effort fallback: missing or broken zellij binaries should not affect
+    // terminal detection.
+    let output = std::process::Command::new("zellij")
+        .arg("--version")
+        .output()
+        .ok()?;
+    if !output.status.success() {
+        return None;
+    }
+
+    let stdout = String::from_utf8(output.stdout).ok()?;
+    parse_zellij_version(stdout.trim())
+}
+
+fn parse_zellij_version(value: &str) -> Option<String> {
+    let value = none_if_whitespace(value.to_string())?;
+    let mut parts = value.split_whitespace();
+    match (parts.next(), parts.next()) {
+        (Some(command), Some(version)) if command.eq_ignore_ascii_case("zellij") => {
+            Some(version.to_string())
+        }
+        _ => Some(value),
+    }
+}
+
 /// Sanitizes a terminal token for use in User-Agent headers.
 ///
 /// Invalid header characters are replaced with underscores.
diff --git a/codex-rs/terminal-detection/src/terminal_tests.rs b/codex-rs/terminal-detection/src/terminal_tests.rs
index ec2a3b1166..54f0a7a5a9 100644
--- a/codex-rs/terminal-detection/src/terminal_tests.rs
+++ b/codex-rs/terminal-detection/src/terminal_tests.rs
@@ -5,6 +5,7 @@ use std::collections::HashMap;
 struct FakeEnvironment {
     vars: HashMap<String, String>,
     tmux_client_info: TmuxClientInfo,
+    zellij_version: Option<String>,
 }
 
 impl FakeEnvironment {
@@ -12,6 +13,7 @@ impl FakeEnvironment {
         Self {
             vars: HashMap::new(),
             tmux_client_info: TmuxClientInfo::default(),
+            zellij_version: None,
         }
     }
 
@@ -27,6 +29,11 @@ impl FakeEnvironment {
         };
         self
     }
+
+    fn with_zellij_version(mut self, version: &str) -> Self {
+        self.zellij_version = Some(version.to_string());
+        self
+    }
 }
 
 impl Environment for FakeEnvironment {
@@ -37,6 +44,12 @@ impl Environment for FakeEnvironment {
     fn tmux_client_info(&self) -> TmuxClientInfo {
         self.tmux_client_info.clone()
     }
+
+    fn zellij_version(&self) -> Option<String> {
+        self.zellij_version
+            .clone()
+            .or_else(|| self.var_non_empty("ZELLIJ_VERSION"))
+    }
 }
 
 fn terminal_info(
@@ -129,7 +142,7 @@ fn terminal_info_reports_is_zellij() {
         /*term_program*/ None,
         /*version*/ None,
         /*term*/ None,
-        Some(Multiplexer::Zellij {}),
+        Some(Multiplexer::Zellij { version: None }),
     );
     assert!(zellij.is_zellij());
 
@@ -312,12 +325,62 @@ fn detects_zellij_multiplexer() {
             term_program: None,
             version: None,
             term: None,
-            multiplexer: Some(Multiplexer::Zellij {}),
+            multiplexer: Some(Multiplexer::Zellij { version: None }),
         },
         "zellij_multiplexer"
     );
 }
 
+#[test]
+fn detects_zellij_multiplexer_version() {
+    let env = FakeEnvironment::new().with_var("ZELLIJ_VERSION", "0.43.1");
+    let terminal = detect_terminal_info_from_env(&env);
+    assert_eq!(
+        terminal,
+        terminal_info(
+            TerminalName::Unknown,
+            /*term_program*/ None,
+            /*version*/ None,
+            /*term*/ None,
+            Some(Multiplexer::Zellij {
+                version: Some("0.43.1".to_string()),
+            }),
+        ),
+        "zellij_multiplexer_version"
+    );
+}
+
+#[test]
+fn detects_zellij_multiplexer_command_version() {
+    let env = FakeEnvironment::new()
+        .with_var("ZELLIJ", "1")
+        .with_zellij_version("0.44.1");
+    let terminal = detect_terminal_info_from_env(&env);
+    assert_eq!(
+        terminal,
+        terminal_info(
+            TerminalName::Unknown,
+            /*term_program*/ None,
+            /*version*/ None,
+            /*term*/ None,
+            Some(Multiplexer::Zellij {
+                version: Some("0.44.1".to_string()),
+            }),
+        ),
+        "zellij_multiplexer_command_version"
+    );
+}
+
+#[test]
+fn parses_zellij_version_output() {
+    assert_eq!(
+        parse_zellij_version("zellij 0.44.1"),
+        Some("0.44.1".to_string())
+    );
+    assert_eq!(parse_zellij_version("0.44.1"), Some("0.44.1".to_string()));
+    assert_eq!(parse_zellij_version(""), None);
+}
+
 #[test]
 fn detects_tmux_client_termtype() {
     let env = FakeEnvironment::new()
diff --git a/codex-rs/thread-manager-sample/src/main.rs b/codex-rs/thread-manager-sample/src/main.rs
index 5f9fa813e0..9fdd6db90f 100644
--- a/codex-rs/thread-manager-sample/src/main.rs
+++ b/codex-rs/thread-manager-sample/src/main.rs
@@ -15,6 +15,7 @@ use codex_core_api::Arg0DispatchPaths;
 use codex_core_api::AskForApproval;
 use codex_core_api::AuthCredentialsStoreMode;
 use codex_core_api::AuthManager;
+use codex_core_api::AutoCompactTokenLimitScope;
 use codex_core_api::CodexThread;
 use codex_core_api::Config;
 use codex_core_api::ConfigLayerStack;
@@ -41,7 +42,6 @@ use codex_core_api::RealtimeAudioConfig;
 use codex_core_api::RealtimeConfig;
 use codex_core_api::SessionPickerViewMode;
 use codex_core_api::SessionSource;
-use codex_core_api::ShellEnvironmentPolicy;
 use codex_core_api::TerminalResizeReflowConfig;
 use codex_core_api::ThreadManager;
 use codex_core_api::ThreadStoreConfig;
@@ -116,7 +116,8 @@ async fn run_main(arg0_paths: Arg0DispatchPaths) -> anyhow::Result<()> {
     )?;
     let thread_store = thread_store_from_config(&config, state_db.clone());
     let environment_manager = Arc::new(
-        EnvironmentManager::from_codex_home(config.codex_home.clone(), local_runtime_paths).await?,
+        EnvironmentManager::from_codex_home(config.codex_home.clone(), Some(local_runtime_paths))
+            .await?,
     );
     let installation_id = resolve_installation_id(&config.codex_home).await?;
     let thread_manager = ThreadManager::new(
@@ -169,19 +170,16 @@ fn new_config(model: Option<String>, arg0_paths: Arg0DispatchPaths) -> anyhow::R
         review_model: None,
         model_context_window: None,
         model_auto_compact_token_limit: None,
+        model_auto_compact_token_limit_scope: AutoCompactTokenLimitScope::Total,
         model_provider_id,
         model_provider,
         personality: None,
-        permissions: Permissions {
-            approval_policy: Constrained::allow_any(AskForApproval::Never),
-            permission_profile: Constrained::allow_any(PermissionProfile::read_only()),
-            active_permission_profile: None,
-            network: None,
-            allow_login_shell: true,
-            shell_environment_policy: ShellEnvironmentPolicy::default(),
-            windows_sandbox_mode: None,
-            windows_sandbox_private_desktop: true,
-        },
+        permissions: Permissions::from_approval_and_profile(
+            Constrained::allow_any(AskForApproval::Never),
+            Constrained::allow_any(PermissionProfile::read_only()),
+        )?,
+        explicit_permission_profile_mode: false,
+        custom_permission_profile_ids: Vec::new(),
         approvals_reviewer: ApprovalsReviewer::User,
         enforce_residency: Constrained::allow_any(/*initial_value*/ None),
         hide_agent_reasoning: false,
@@ -196,7 +194,6 @@ fn new_config(model: Option<String>, arg0_paths: Arg0DispatchPaths) -> anyhow::R
         include_skill_instructions: false,
         include_environment_context: false,
         compact_prompt: None,
-        commit_attribution: None,
         notify: None,
         tui_notifications: TuiNotificationSettings::default(),
         animations: true,
@@ -214,7 +211,9 @@ fn new_config(model: Option<String>, arg0_paths: Arg0DispatchPaths) -> anyhow::R
         tui_keymap: TuiKeymap::default(),
         tui_session_picker_view: SessionPickerViewMode::Dense,
         tui_vim_mode_default: false,
-        cwd,
+        cwd: cwd.clone(),
+        workspace_roots: vec![cwd],
+        workspace_roots_explicit: false,
         cli_auth_credentials_store_mode: AuthCredentialsStoreMode::File,
         mcp_servers: Constrained::allow_any(HashMap::new()),
         mcp_oauth_credentials_store_mode: OAuthCredentialsStoreMode::File,
@@ -252,6 +251,7 @@ fn new_config(model: Option<String>, arg0_paths: Arg0DispatchPaths) -> anyhow::R
         model_verbosity: None,
         chatgpt_base_url: "https://chatgpt.com/backend-api/".to_string(),
         apps_mcp_path_override: None,
+        apps_mcp_product_sku: None,
         realtime_audio: RealtimeAudioConfig::default(),
         experimental_realtime_ws_base_url: None,
         experimental_realtime_ws_model: None,
@@ -263,7 +263,6 @@ fn new_config(model: Option<String>, arg0_paths: Arg0DispatchPaths) -> anyhow::R
         experimental_thread_store: ThreadStoreConfig::Local,
         forced_chatgpt_workspace_id: None,
         forced_login_method: None,
-        include_apply_patch_tool: false,
         web_search_mode: Constrained::allow_any(WebSearchMode::Disabled),
         web_search_config: None,
         use_experimental_unified_exec_tool: false,
@@ -274,7 +273,6 @@ fn new_config(model: Option<String>, arg0_paths: Arg0DispatchPaths) -> anyhow::R
         suppress_unstable_features_warning: false,
         active_profile: None,
         active_project: ProjectConfig { trust_level: None },
-        windows_wsl_setup_acknowledged: false,
         notices: Notice::default(),
         check_for_update_on_startup: false,
         disable_paste_burst: false,
@@ -300,6 +298,7 @@ async fn run_turn(thread: &CodexThread, thread_id: &str, prompt: String) -> anyh
             environments: None,
             final_output_json_schema: None,
             responsesapi_client_metadata: None,
+            thread_settings: Default::default(),
         })
         .await
         .context("submit user input")?;
diff --git a/codex-rs/thread-store/src/local/mod.rs b/codex-rs/thread-store/src/local/mod.rs
index ab53e12bbe..f6a48a400b 100644
--- a/codex-rs/thread-store/src/local/mod.rs
+++ b/codex-rs/thread-store/src/local/mod.rs
@@ -1036,6 +1036,7 @@ mod tests {
             images: None,
             local_images: Vec::new(),
             text_elements: Vec::new(),
+            ..Default::default()
         }))
     }
 
diff --git a/codex-rs/thread-store/src/local/update_thread_metadata.rs b/codex-rs/thread-store/src/local/update_thread_metadata.rs
index c09ca80f97..16f9f79e06 100644
--- a/codex-rs/thread-store/src/local/update_thread_metadata.rs
+++ b/codex-rs/thread-store/src/local/update_thread_metadata.rs
@@ -14,6 +14,7 @@ use codex_rollout::find_archived_thread_path_by_id_str;
 use codex_rollout::find_thread_path_by_id_str;
 use codex_rollout::read_session_meta_line;
 use codex_state::ThreadMetadataBuilder;
+use tracing::warn;
 
 use super::LocalThreadStore;
 use super::helpers::git_info_from_parts;
@@ -51,8 +52,15 @@ pub(super) async fn update_thread_metadata(
     }
 
     let needs_rollout_compat = needs_rollout_compatibility_update(&patch);
-    let updated =
-        apply_metadata_update(store, thread_id, patch.clone(), params.include_archived).await?;
+    let require_sqlite_write = sqlite_write_failure_should_block(&patch);
+    let updated = apply_metadata_update(
+        store,
+        thread_id,
+        patch.clone(),
+        params.include_archived,
+        require_sqlite_write,
+    )
+    .await?;
     if !needs_rollout_compat {
         return Ok(updated);
     }
@@ -169,6 +177,7 @@ async fn apply_metadata_update(
     thread_id: ThreadId,
     patch: ThreadMetadataPatch,
     include_archived: bool,
+    require_sqlite_write: bool,
 ) -> ThreadStoreResult<StoredThread> {
     let live_rollout_path = live_writer::rollout_path(store, thread_id).await.ok();
     let mut rollout_path = patch.rollout_path.clone().or(live_rollout_path);
@@ -316,9 +325,19 @@ async fn apply_metadata_update(
     };
     match (state_db.is_some(), sqlite_write_result) {
         (true, Ok(())) => {}
-        (true, Err(err)) => return Err(err),
+        (true, Err(err)) if require_sqlite_write || !sqlite_write_error_is_best_effort(&err) => {
+            return Err(err);
+        }
+        (true, Err(err)) => {
+            warn!("state db update_thread_metadata failed for {thread_id}: {err}");
+        }
         (false, Ok(())) => {}
-        (false, Err(err)) => return Err(err),
+        (false, Err(err)) if require_sqlite_write || !sqlite_write_error_is_best_effort(&err) => {
+            return Err(err);
+        }
+        (false, Err(err)) => {
+            warn!("state db update_thread_metadata failed for {thread_id}: {err}");
+        }
     }
 
     read_thread::read_thread(
@@ -342,6 +361,19 @@ fn needs_rollout_compatibility_update(patch: &ThreadMetadataPatch) -> bool {
     !has_observed_metadata_facts(patch)
 }
 
+fn sqlite_write_failure_should_block(patch: &ThreadMetadataPatch) -> bool {
+    // Before live metadata sync moved above the rollout writer, SQLite sync failures for
+    // transcript-derived metadata, thread names, and memory-mode indexing were log-only. Keep that
+    // failure isolation so a corrupted optional state DB does not make JSONL transcript durability
+    // look broken. Explicit git-only updates still require SQLite because partial git patches need
+    // the existing SQLite value to preserve unspecified fields.
+    patch.git_info.is_some() && !has_observed_metadata_facts(patch)
+}
+
+fn sqlite_write_error_is_best_effort(err: &ThreadStoreError) -> bool {
+    matches!(err, ThreadStoreError::Internal { .. })
+}
+
 fn has_observed_metadata_facts(patch: &ThreadMetadataPatch) -> bool {
     patch.rollout_path.is_some()
         || patch.preview.is_some()
@@ -1136,6 +1168,46 @@ mod tests {
         assert_eq!(memory_mode.as_deref(), Some("disabled"));
     }
 
+    #[test]
+    fn sqlite_failures_are_best_effort_for_legacy_rollout_compat_updates() {
+        assert!(!sqlite_write_failure_should_block(&ThreadMetadataPatch {
+            name: Some(Some("User chosen name".to_string())),
+            ..Default::default()
+        }));
+        assert!(!sqlite_write_failure_should_block(&ThreadMetadataPatch {
+            memory_mode: Some(ThreadMemoryMode::Disabled),
+            ..Default::default()
+        }));
+    }
+
+    #[test]
+    fn sqlite_failures_are_best_effort_for_observed_metadata_updates() {
+        assert!(!sqlite_write_failure_should_block(&ThreadMetadataPatch {
+            updated_at: Some(Utc::now()),
+            ..Default::default()
+        }));
+        assert!(!sqlite_write_failure_should_block(&ThreadMetadataPatch {
+            preview: Some("Observed preview".to_string()),
+            git_info: Some(GitInfoPatch {
+                branch: Some(Some("main".to_string())),
+                ..Default::default()
+            }),
+            memory_mode: Some(ThreadMemoryMode::Enabled),
+            ..Default::default()
+        }));
+    }
+
+    #[test]
+    fn sqlite_failures_still_block_for_explicit_git_only_updates() {
+        assert!(sqlite_write_failure_should_block(&ThreadMetadataPatch {
+            git_info: Some(GitInfoPatch {
+                branch: Some(Some("main".to_string())),
+                ..Default::default()
+            }),
+            ..Default::default()
+        }));
+    }
+
     #[tokio::test]
     async fn metadata_patch_applies_title_over_existing_name() {
         let home = TempDir::new().expect("temp dir");
diff --git a/codex-rs/thread-store/src/thread_metadata_sync.rs b/codex-rs/thread-store/src/thread_metadata_sync.rs
index 37afda8bc2..edc78a36c2 100644
--- a/codex-rs/thread-store/src/thread_metadata_sync.rs
+++ b/codex-rs/thread-store/src/thread_metadata_sync.rs
@@ -546,6 +546,7 @@ mod tests {
             images: None,
             local_images: Vec::new(),
             text_elements: Vec::new(),
+            ..Default::default()
         }
     }
 
diff --git a/codex-rs/tools/Cargo.toml b/codex-rs/tools/Cargo.toml
index b11ee2fe7c..e8d1134a6d 100644
--- a/codex-rs/tools/Cargo.toml
+++ b/codex-rs/tools/Cargo.toml
@@ -8,6 +8,7 @@ version.workspace = true
 workspace = true
 
 [dependencies]
+async-trait = { workspace = true }
 codex-app-server-protocol = { workspace = true }
 codex-code-mode = { workspace = true }
 codex-features = { workspace = true }
diff --git a/codex-rs/tools/README.md b/codex-rs/tools/README.md
index 68f4080957..92cccaf30a 100644
--- a/codex-rs/tools/README.md
+++ b/codex-rs/tools/README.md
@@ -1,7 +1,7 @@
 # codex-tools
 
-`codex-tools` is the shared support crate for building, adapting, planning, and
-executing model-visible tool sets outside `codex-core`.
+`codex-tools` is the shared support crate for building, adapting, and executing
+model-visible tools outside `codex-core`.
 
 Today this crate owns the host-facing tool models and helpers that no longer
 need to live in `core/src/tools/spec.rs` or `core/src/client_common.rs`:
@@ -9,8 +9,8 @@ need to live in `core/src/tools/spec.rs` or `core/src/client_common.rs`:
 - aggregate host models such as `ToolSpec`, `ConfiguredToolSpec`,
   `LoadableToolSpec`, `ResponsesApiNamespace`, and
   `ResponsesApiNamespaceTool`
-- host config and discovery models used while assembling tool sets, including
-  `ToolsConfig`, discoverable-tool models, and request-plugin-install helpers
+- host discovery models used while assembling tool sets, including
+  discoverable-tool models and request-plugin-install helpers
 - host adapters such as schema sanitization, MCP/dynamic conversion, code-mode
   augmentation, and image-detail normalization
 - shared executable-tool contracts such as `ToolExecutor`, `ToolCall`, and
diff --git a/codex-rs/tools/src/code_mode.rs b/codex-rs/tools/src/code_mode.rs
index a0c2173cac..052edbac59 100644
--- a/codex-rs/tools/src/code_mode.rs
+++ b/codex-rs/tools/src/code_mode.rs
@@ -136,8 +136,7 @@ fn code_mode_tool_definitions_for_spec(spec: &ToolSpec) -> Vec<CodeModeToolDefin
                 }
             })
             .collect(),
-        ToolSpec::LocalShell {}
-        | ToolSpec::ImageGeneration { .. }
+        ToolSpec::ImageGeneration { .. }
         | ToolSpec::ToolSearch { .. }
         | ToolSpec::WebSearch { .. } => Vec::new(),
     }
diff --git a/codex-rs/tools/src/dynamic_tool_tests.rs b/codex-rs/tools/src/dynamic_tool_tests.rs
index 077a0622ce..284ce4853b 100644
--- a/codex-rs/tools/src/dynamic_tool_tests.rs
+++ b/codex-rs/tools/src/dynamic_tool_tests.rs
@@ -27,10 +27,7 @@ fn parse_dynamic_tool_sanitizes_input_schema() {
             name: "lookup_ticket".to_string(),
             description: "Fetch a ticket".to_string(),
             input_schema: JsonSchema::object(
-                BTreeMap::from([(
-                    "id".to_string(),
-                    JsonSchema::string(Some("Ticket identifier".to_string()),),
-                )]),
+                BTreeMap::from([("id".to_string(), JsonSchema::default(),)]),
                 /*required*/ None,
                 /*additional_properties*/ None
             ),
diff --git a/codex-rs/tools/src/function_call_error.rs b/codex-rs/tools/src/function_call_error.rs
index 3881c7af1b..1ab8335b25 100644
--- a/codex-rs/tools/src/function_call_error.rs
+++ b/codex-rs/tools/src/function_call_error.rs
@@ -5,8 +5,6 @@ use thiserror::Error;
 pub enum FunctionCallError {
     #[error("{0}")]
     RespondToModel(String),
-    #[error("LocalShellCall without call_id or id")]
-    MissingLocalShellCallId,
     #[error("Fatal error: {0}")]
     Fatal(String),
 }
diff --git a/codex-rs/tools/src/image_detail.rs b/codex-rs/tools/src/image_detail.rs
index 37086f691d..145cda663c 100644
--- a/codex-rs/tools/src/image_detail.rs
+++ b/codex-rs/tools/src/image_detail.rs
@@ -16,7 +16,7 @@ pub fn normalize_output_image_detail(
             Some(ImageDetail::Original)
         }
         Some(ImageDetail::Original) | None => None,
-        Some(ImageDetail::Auto | ImageDetail::Low | ImageDetail::High) => detail,
+        Some(ImageDetail::High) => Some(ImageDetail::High),
     }
 }
 
diff --git a/codex-rs/tools/src/image_detail_tests.rs b/codex-rs/tools/src/image_detail_tests.rs
index 393a962ac4..919537acf7 100644
--- a/codex-rs/tools/src/image_detail_tests.rs
+++ b/codex-rs/tools/src/image_detail_tests.rs
@@ -70,10 +70,6 @@ fn explicit_original_is_dropped_without_model_support() {
 fn explicit_non_original_detail_is_preserved() {
     let model_info = model_info();
 
-    assert_eq!(
-        normalize_output_image_detail(&model_info, Some(ImageDetail::Low)),
-        Some(ImageDetail::Low)
-    );
     assert_eq!(
         normalize_output_image_detail(&model_info, Some(ImageDetail::High)),
         Some(ImageDetail::High)
@@ -92,7 +88,7 @@ fn sanitize_original_falls_back_to_high_without_support() {
         },
         FunctionCallOutputContentItem::InputImage {
             image_url: "data:image/png;base64,BBB".to_string(),
-            detail: Some(ImageDetail::Low),
+            detail: Some(ImageDetail::High),
         },
     ];
 
@@ -110,7 +106,7 @@ fn sanitize_original_falls_back_to_high_without_support() {
             },
             FunctionCallOutputContentItem::InputImage {
                 image_url: "data:image/png;base64,BBB".to_string(),
-                detail: Some(ImageDetail::Low),
+                detail: Some(ImageDetail::High),
             },
         ]
     );
diff --git a/codex-rs/tools/src/json_schema.rs b/codex-rs/tools/src/json_schema.rs
index 22a641491e..ecd880cc7a 100644
--- a/codex-rs/tools/src/json_schema.rs
+++ b/codex-rs/tools/src/json_schema.rs
@@ -166,6 +166,7 @@ pub fn parse_tool_input_schema(input_schema: &JsonValue) -> Result<JsonSchema, s
 /// - Collapses `const` into single-value `enum`.
 /// - Fills required child fields for object/array schema types, including
 ///   nullable unions, with permissive defaults when absent.
+/// - Coerces object schemas with no recognized schema hints into `{}`.
 fn sanitize_json_schema(value: &mut JsonValue) {
     match value {
         JsonValue::Bool(_) => {
@@ -228,7 +229,8 @@ fn sanitize_json_schema(value: &mut JsonValue) {
                 {
                     schema_types.push(JsonSchemaPrimitiveType::Number);
                 } else {
-                    schema_types.push(JsonSchemaPrimitiveType::String);
+                    map.clear();
+                    return;
                 }
             }
 
diff --git a/codex-rs/tools/src/json_schema_tests.rs b/codex-rs/tools/src/json_schema_tests.rs
index 3f13df7638..5daaf048d0 100644
--- a/codex-rs/tools/src/json_schema_tests.rs
+++ b/codex-rs/tools/src/json_schema_tests.rs
@@ -34,7 +34,8 @@ fn parse_tool_input_schema_infers_object_shape_and_defaults_properties() {
     //
     // Expected normalization behavior:
     // - `properties` implies an object schema when `type` is omitted.
-    // - The child property keeps its description and defaults to a string type.
+    // - The child property has no recognized schema hints, so it is coerced to
+    //   an empty permissive schema.
     let schema = parse_tool_input_schema(&serde_json::json!({
         "properties": {
             "query": {"description": "search query"}
@@ -45,16 +46,33 @@ fn parse_tool_input_schema_infers_object_shape_and_defaults_properties() {
     assert_eq!(
         schema,
         JsonSchema::object(
-            BTreeMap::from([(
-                "query".to_string(),
-                JsonSchema::string(Some("search query".to_string())),
-            )]),
+            BTreeMap::from([("query".to_string(), JsonSchema::default())]),
             /*required*/ None,
             /*additional_properties*/ None
         )
     );
 }
 
+#[test]
+fn parse_tool_input_schema_coerces_unrecognized_object_schema_to_empty_schema() {
+    // Example schema shape:
+    // {
+    //   "description": "Ticket identifier",
+    //   "title": "Ticket ID"
+    // }
+    //
+    // Expected normalization behavior:
+    // - Object schemas with no recognized schema hints are treated as
+    //   malformed and coerced to the empty permissive schema.
+    let schema = parse_tool_input_schema(&serde_json::json!({
+        "description": "Ticket identifier",
+        "title": "Ticket ID"
+    }))
+    .expect("parse schema");
+
+    assert_eq!(schema, JsonSchema::default());
+}
+
 #[test]
 fn parse_tool_input_schema_preserves_integer_and_defaults_array_items() {
     // Example schema shape:
@@ -250,16 +268,62 @@ fn parse_tool_input_schema_infers_string_from_enum_const_and_format_keywords() {
 }
 
 #[test]
-fn parse_tool_input_schema_defaults_empty_schema_to_string() {
+fn parse_tool_input_schema_preserves_empty_schema() {
     // Example schema shape:
     // {}
     //
     // Expected normalization behavior:
-    // - With no structural hints at all, the normalizer falls back to a
-    //   permissive string schema.
+    // - An empty JSON Schema is already a valid permissive schema, so it stays
+    //   empty rather than being rewritten as an object schema.
     let schema = parse_tool_input_schema(&serde_json::json!({})).expect("parse schema");
 
-    assert_eq!(schema, JsonSchema::string(/*description*/ None));
+    assert_eq!(schema, JsonSchema::default());
+}
+
+#[test]
+fn parse_tool_input_schema_preserves_nested_empty_schema() {
+    // Example schema shape:
+    // {
+    //   "type": "object",
+    //   "properties": {
+    //     "metadata": {
+    //       "properties": {
+    //         "extra": {}
+    //       }
+    //     }
+    //   }
+    // }
+    //
+    // Expected normalization behavior:
+    // - The sanitizer recurses through nested object properties.
+    // - The innermost `extra` field is an empty JSON Schema and stays empty.
+    let schema = parse_tool_input_schema(&serde_json::json!({
+        "type": "object",
+        "properties": {
+            "metadata": {
+                "properties": {
+                    "extra": {}
+                }
+            }
+        }
+    }))
+    .expect("parse schema");
+
+    assert_eq!(
+        schema,
+        JsonSchema::object(
+            BTreeMap::from([(
+                "metadata".to_string(),
+                JsonSchema::object(
+                    BTreeMap::from([("extra".to_string(), JsonSchema::default())]),
+                    /*required*/ None,
+                    /*additional_properties*/ None,
+                )
+            )]),
+            /*required*/ None,
+            /*additional_properties*/ None,
+        )
+    );
 }
 
 #[test]
diff --git a/codex-rs/tools/src/lib.rs b/codex-rs/tools/src/lib.rs
index 86e4750b32..4d972af2cf 100644
--- a/codex-rs/tools/src/lib.rs
+++ b/codex-rs/tools/src/lib.rs
@@ -61,11 +61,11 @@ pub use tool_call::ToolCall;
 pub use tool_config::ShellCommandBackendConfig;
 pub use tool_config::ToolEnvironmentMode;
 pub use tool_config::ToolUserShellType;
-pub use tool_config::ToolsConfig;
-pub use tool_config::ToolsConfigParams;
 pub use tool_config::UnifiedExecShellMode;
 pub use tool_config::ZshForkConfig;
 pub use tool_config::request_user_input_available_modes;
+pub use tool_config::shell_command_backend_for_features;
+pub use tool_config::shell_type_for_model_and_features;
 pub use tool_definition::ToolDefinition;
 pub use tool_discovery::DiscoverablePluginInfo;
 pub use tool_discovery::DiscoverableTool;
@@ -79,6 +79,7 @@ pub use tool_discovery::ToolSearchSourceInfo;
 pub use tool_discovery::collect_request_plugin_install_entries;
 pub use tool_discovery::filter_request_plugin_install_discoverable_tools_for_client;
 pub use tool_executor::ToolExecutor;
+pub use tool_executor::ToolExposure;
 pub use tool_output::JsonToolOutput;
 pub use tool_output::ToolOutput;
 pub use tool_payload::ToolPayload;
diff --git a/codex-rs/tools/src/tool_config.rs b/codex-rs/tools/src/tool_config.rs
index 4639b404b1..3eaa73f189 100644
--- a/codex-rs/tools/src/tool_config.rs
+++ b/codex-rs/tools/src/tool_config.rs
@@ -1,20 +1,9 @@
-use crate::can_request_original_image_detail;
 use codex_features::Feature;
 use codex_features::Features;
 use codex_protocol::config_types::ModeKind;
 use codex_protocol::config_types::TUI_VISIBLE_COLLABORATION_MODES;
-use codex_protocol::config_types::WebSearchConfig;
-use codex_protocol::config_types::WebSearchMode;
-use codex_protocol::config_types::WindowsSandboxLevel;
-use codex_protocol::models::PermissionProfile;
-use codex_protocol::openai_models::ApplyPatchToolType;
 use codex_protocol::openai_models::ConfigShellToolType;
-use codex_protocol::openai_models::InputModality;
 use codex_protocol::openai_models::ModelInfo;
-use codex_protocol::openai_models::ModelPreset;
-use codex_protocol::openai_models::WebSearchToolType;
-use codex_protocol::protocol::SessionSource;
-use codex_protocol::protocol::SubAgentSource;
 use codex_utils_absolute_path::AbsolutePathBuf;
 use std::path::PathBuf;
 
@@ -44,6 +33,44 @@ pub fn request_user_input_available_modes(features: &Features) -> Vec<ModeKind>
         .collect()
 }
 
+pub fn shell_command_backend_for_features(features: &Features) -> ShellCommandBackendConfig {
+    if features.enabled(Feature::ShellTool) && features.enabled(Feature::ShellZshFork) {
+        ShellCommandBackendConfig::ZshFork
+    } else {
+        ShellCommandBackendConfig::Classic
+    }
+}
+
+pub fn shell_type_for_model_and_features(
+    model_info: &ModelInfo,
+    features: &Features,
+) -> ConfigShellToolType {
+    let unified_exec_enabled = features.enabled(Feature::UnifiedExec);
+    let model_shell_type = match model_info.shell_type {
+        ConfigShellToolType::UnifiedExec if !unified_exec_enabled => {
+            ConfigShellToolType::ShellCommand
+        }
+        ConfigShellToolType::Default | ConfigShellToolType::Local => {
+            ConfigShellToolType::ShellCommand
+        }
+        other => other,
+    };
+
+    if !features.enabled(Feature::ShellTool) {
+        ConfigShellToolType::Disabled
+    } else if features.enabled(Feature::ShellZshFork) {
+        ConfigShellToolType::ShellCommand
+    } else if unified_exec_enabled {
+        if codex_utils_pty::conpty_supported() {
+            ConfigShellToolType::UnifiedExec
+        } else {
+            ConfigShellToolType::ShellCommand
+        }
+    } else {
+        model_shell_type
+    }
+}
+
 #[derive(Debug, Clone, Eq, PartialEq)]
 pub enum UnifiedExecShellMode {
     Direct,
@@ -93,53 +120,6 @@ impl UnifiedExecShellMode {
     }
 }
 
-#[derive(Debug, Clone)]
-pub struct ToolsConfig {
-    pub available_models: Vec<ModelPreset>,
-    pub shell_type: ConfigShellToolType,
-    pub shell_command_backend: ShellCommandBackendConfig,
-    pub unified_exec_shell_mode: UnifiedExecShellMode,
-    pub environment_mode: ToolEnvironmentMode,
-    pub allow_login_shell: bool,
-    pub apply_patch_tool_type: Option<ApplyPatchToolType>,
-    pub web_search_mode: Option<WebSearchMode>,
-    pub web_search_config: Option<WebSearchConfig>,
-    pub web_search_tool_type: WebSearchToolType,
-    pub image_gen_tool: bool,
-    pub search_tool: bool,
-    pub namespace_tools: bool,
-    pub tool_suggest: bool,
-    pub exec_permission_approvals_enabled: bool,
-    pub request_permissions_tool_enabled: bool,
-    pub code_mode_enabled: bool,
-    pub code_mode_only_enabled: bool,
-    pub can_request_original_image_detail: bool,
-    pub collab_tools: bool,
-    pub goal_tools: bool,
-    pub multi_agent_v2: bool,
-    pub hide_spawn_agent_metadata: bool,
-    pub spawn_agent_usage_hint: bool,
-    pub spawn_agent_usage_hint_text: Option<String>,
-    pub max_concurrent_threads_per_session: Option<usize>,
-    pub wait_agent_min_timeout_ms: Option<i64>,
-    pub request_user_input_available_modes: Vec<ModeKind>,
-    pub experimental_supported_tools: Vec<String>,
-    pub agent_jobs_tools: bool,
-    pub agent_jobs_worker_tools: bool,
-    pub agent_type_description: String,
-}
-
-pub struct ToolsConfigParams<'a> {
-    pub model_info: &'a ModelInfo,
-    pub available_models: &'a [ModelPreset],
-    pub features: &'a Features,
-    pub image_generation_tool_auth_allowed: bool,
-    pub web_search_mode: Option<WebSearchMode>,
-    pub session_source: SessionSource,
-    pub permission_profile: &'a PermissionProfile,
-    pub windows_sandbox_level: WindowsSandboxLevel,
-}
-
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum ToolEnvironmentMode {
     None,
@@ -161,227 +141,6 @@ impl ToolEnvironmentMode {
     }
 }
 
-impl ToolsConfig {
-    pub fn new(params: &ToolsConfigParams<'_>) -> Self {
-        let ToolsConfigParams {
-            model_info,
-            available_models,
-            features,
-            image_generation_tool_auth_allowed,
-            web_search_mode,
-            session_source,
-            ..
-        } = params;
-        let include_apply_patch_tool = features.enabled(Feature::ApplyPatchFreeform);
-        let include_code_mode = features.enabled(Feature::CodeMode);
-        let include_code_mode_only = include_code_mode && features.enabled(Feature::CodeModeOnly);
-        let include_goal_tools = features.enabled(Feature::Goals);
-        let include_multi_agent_v2 = features.enabled(Feature::MultiAgentV2);
-        let include_collab_tools = include_multi_agent_v2 || features.enabled(Feature::Collab);
-        let include_agent_jobs = features.enabled(Feature::SpawnCsv);
-        let include_search_tool =
-            model_info.supports_search_tool && features.enabled(Feature::ToolSearch);
-        let include_tool_suggest = features.enabled(Feature::ToolSuggest)
-            && features.enabled(Feature::Apps)
-            && features.enabled(Feature::Plugins);
-        let include_original_image_detail = can_request_original_image_detail(model_info);
-        // API-key auth bypasses Codex backend entitlement/tool normalization, so
-        // callers must confirm ChatGPT auth before exposing the built-in tool.
-        let include_image_gen_tool = *image_generation_tool_auth_allowed
-            && features.enabled(Feature::ImageGeneration)
-            && supports_image_generation(model_info);
-        let exec_permission_approvals_enabled = features.enabled(Feature::ExecPermissionApprovals);
-        let request_permissions_tool_enabled = features.enabled(Feature::RequestPermissionsTool);
-        let shell_command_backend =
-            if features.enabled(Feature::ShellTool) && features.enabled(Feature::ShellZshFork) {
-                ShellCommandBackendConfig::ZshFork
-            } else {
-                ShellCommandBackendConfig::Classic
-            };
-        let unified_exec_enabled = features.enabled(Feature::UnifiedExec);
-        let model_shell_type = match model_info.shell_type {
-            ConfigShellToolType::UnifiedExec if !unified_exec_enabled => {
-                ConfigShellToolType::ShellCommand
-            }
-            other => other,
-        };
-        let shell_type = if !features.enabled(Feature::ShellTool) {
-            ConfigShellToolType::Disabled
-        } else if features.enabled(Feature::ShellZshFork) {
-            ConfigShellToolType::ShellCommand
-        } else if unified_exec_enabled {
-            if codex_utils_pty::conpty_supported() {
-                ConfigShellToolType::UnifiedExec
-            } else {
-                ConfigShellToolType::ShellCommand
-            }
-        } else {
-            model_shell_type
-        };
-
-        let apply_patch_tool_type = model_info
-            .apply_patch_tool_type
-            .clone()
-            .or_else(|| include_apply_patch_tool.then_some(ApplyPatchToolType::Freeform));
-
-        let agent_jobs_worker_tools = include_agent_jobs
-            && matches!(
-                session_source,
-                SessionSource::SubAgent(SubAgentSource::Other(label))
-                    if label.starts_with("agent_job:")
-            );
-
-        Self {
-            available_models: available_models.to_vec(),
-            shell_type,
-            shell_command_backend,
-            unified_exec_shell_mode: UnifiedExecShellMode::Direct,
-            environment_mode: ToolEnvironmentMode::Single,
-            allow_login_shell: true,
-            apply_patch_tool_type,
-            web_search_mode: *web_search_mode,
-            web_search_config: None,
-            web_search_tool_type: model_info.web_search_tool_type,
-            image_gen_tool: include_image_gen_tool,
-            search_tool: include_search_tool,
-            namespace_tools: true,
-            tool_suggest: include_tool_suggest,
-            exec_permission_approvals_enabled,
-            request_permissions_tool_enabled,
-            code_mode_enabled: include_code_mode,
-            code_mode_only_enabled: include_code_mode_only,
-            can_request_original_image_detail: include_original_image_detail,
-            collab_tools: include_collab_tools,
-            goal_tools: include_goal_tools,
-            multi_agent_v2: include_multi_agent_v2,
-            hide_spawn_agent_metadata: false,
-            spawn_agent_usage_hint: true,
-            spawn_agent_usage_hint_text: None,
-            max_concurrent_threads_per_session: None,
-            wait_agent_min_timeout_ms: None,
-            request_user_input_available_modes: request_user_input_available_modes(features),
-            experimental_supported_tools: model_info.experimental_supported_tools.clone(),
-            agent_jobs_tools: include_agent_jobs,
-            agent_jobs_worker_tools,
-            agent_type_description: String::new(),
-        }
-    }
-
-    pub fn with_agent_type_description(mut self, agent_type_description: String) -> Self {
-        self.agent_type_description = agent_type_description;
-        self
-    }
-
-    pub fn with_namespace_tools_capability(mut self, namespace_tools: bool) -> Self {
-        if !namespace_tools {
-            self.namespace_tools = false;
-        }
-        self
-    }
-
-    pub fn with_image_generation_capability(mut self, image_generation: bool) -> Self {
-        if !image_generation {
-            self.image_gen_tool = false;
-        }
-        self
-    }
-
-    pub fn with_web_search_capability(mut self, web_search: bool) -> Self {
-        if !web_search {
-            self.web_search_mode = None;
-        }
-        self
-    }
-
-    pub fn with_spawn_agent_usage_hint(mut self, spawn_agent_usage_hint: bool) -> Self {
-        self.spawn_agent_usage_hint = spawn_agent_usage_hint;
-        self
-    }
-
-    pub fn with_spawn_agent_usage_hint_text(
-        mut self,
-        spawn_agent_usage_hint_text: Option<String>,
-    ) -> Self {
-        self.spawn_agent_usage_hint_text = spawn_agent_usage_hint_text;
-        self
-    }
-
-    pub fn with_hide_spawn_agent_metadata(mut self, hide_spawn_agent_metadata: bool) -> Self {
-        self.hide_spawn_agent_metadata = hide_spawn_agent_metadata;
-        self
-    }
-
-    pub fn with_goal_tools_allowed(mut self, allowed: bool) -> Self {
-        self.goal_tools = self.goal_tools && allowed;
-        self
-    }
-
-    pub fn with_max_concurrent_threads_per_session(
-        mut self,
-        max_concurrent_threads_per_session: Option<usize>,
-    ) -> Self {
-        self.max_concurrent_threads_per_session = max_concurrent_threads_per_session;
-        self
-    }
-
-    pub fn with_wait_agent_min_timeout_ms(
-        mut self,
-        wait_agent_min_timeout_ms: Option<i64>,
-    ) -> Self {
-        self.wait_agent_min_timeout_ms = wait_agent_min_timeout_ms;
-        self
-    }
-
-    pub fn with_allow_login_shell(mut self, allow_login_shell: bool) -> Self {
-        self.allow_login_shell = allow_login_shell;
-        self
-    }
-
-    pub fn with_environment_mode(mut self, environment_mode: ToolEnvironmentMode) -> Self {
-        self.environment_mode = environment_mode;
-        self
-    }
-
-    pub fn with_unified_exec_shell_mode(
-        mut self,
-        unified_exec_shell_mode: UnifiedExecShellMode,
-    ) -> Self {
-        self.unified_exec_shell_mode = unified_exec_shell_mode;
-        self
-    }
-
-    pub fn with_unified_exec_shell_mode_for_session(
-        mut self,
-        user_shell_type: ToolUserShellType,
-        shell_zsh_path: Option<&PathBuf>,
-        main_execve_wrapper_exe: Option<&PathBuf>,
-    ) -> Self {
-        self.unified_exec_shell_mode = UnifiedExecShellMode::for_session(
-            self.shell_command_backend,
-            user_shell_type,
-            shell_zsh_path,
-            main_execve_wrapper_exe,
-        );
-        self
-    }
-
-    pub fn with_web_search_config(mut self, web_search_config: Option<WebSearchConfig>) -> Self {
-        self.web_search_config = web_search_config;
-        self
-    }
-
-    pub fn for_code_mode_nested_tools(&self) -> Self {
-        let mut nested = self.clone();
-        nested.code_mode_enabled = false;
-        nested.code_mode_only_enabled = false;
-        nested
-    }
-}
-
-fn supports_image_generation(model_info: &ModelInfo) -> bool {
-    model_info.input_modalities.contains(&InputModality::Image)
-}
-
 #[cfg(test)]
 #[path = "tool_config_tests.rs"]
 mod tests;
diff --git a/codex-rs/tools/src/tool_config_tests.rs b/codex-rs/tools/src/tool_config_tests.rs
index 252ad7a320..8ce68acbba 100644
--- a/codex-rs/tools/src/tool_config_tests.rs
+++ b/codex-rs/tools/src/tool_config_tests.rs
@@ -1,298 +1,153 @@
-use super::*;
 use codex_features::Feature;
 use codex_features::Features;
-use codex_protocol::config_types::WebSearchMode;
-use codex_protocol::config_types::WindowsSandboxLevel;
-use codex_protocol::models::PermissionProfile;
-use codex_protocol::openai_models::ApplyPatchToolType;
+use codex_protocol::config_types::ModeKind;
 use codex_protocol::openai_models::ConfigShellToolType;
-use codex_protocol::openai_models::InputModality;
 use codex_protocol::openai_models::ModelInfo;
-use codex_protocol::protocol::SessionSource;
-use codex_protocol::protocol::SubAgentSource;
-use codex_utils_absolute_path::AbsolutePathBuf;
+use codex_protocol::openai_models::ModelVisibility;
+use codex_protocol::openai_models::TruncationPolicyConfig;
 use pretty_assertions::assert_eq;
-use serde_json::json;
-use std::path::PathBuf;
 
-fn model_info() -> ModelInfo {
-    serde_json::from_value(json!({
-        "slug": "test-model",
-        "display_name": "Test Model",
-        "description": null,
-        "supported_reasoning_levels": [],
-        "shell_type": "unified_exec",
-        "visibility": "list",
-        "supported_in_api": true,
-        "priority": 1,
-        "availability_nux": null,
-        "upgrade": null,
-        "base_instructions": "base",
-        "model_messages": null,
-        "supports_reasoning_summaries": false,
-        "default_reasoning_summary": "auto",
-        "support_verbosity": false,
-        "default_verbosity": null,
-        "apply_patch_tool_type": null,
-        "truncation_policy": {
-            "mode": "bytes",
-            "limit": 10000
-        },
-        "supports_parallel_tool_calls": false,
-        "supports_image_detail_original": false,
-        "context_window": null,
-        "auto_compact_token_limit": null,
-        "effective_context_window_percent": 95,
-        "experimental_supported_tools": [],
-        "input_modalities": ["text", "image"],
-        "supports_search_tool": false
-    }))
-    .expect("deserialize test model")
+use super::*;
+
+fn model_with_shell_type(shell_type: ConfigShellToolType) -> ModelInfo {
+    ModelInfo {
+        slug: "test-model".to_string(),
+        display_name: "Test Model".to_string(),
+        description: None,
+        default_reasoning_level: None,
+        supported_reasoning_levels: Vec::new(),
+        shell_type,
+        visibility: ModelVisibility::List,
+        supported_in_api: true,
+        priority: 0,
+        additional_speed_tiers: Vec::new(),
+        service_tiers: Vec::new(),
+        availability_nux: None,
+        upgrade: None,
+        base_instructions: String::new(),
+        model_messages: None,
+        supports_reasoning_summaries: false,
+        default_reasoning_summary: Default::default(),
+        support_verbosity: false,
+        default_verbosity: None,
+        apply_patch_tool_type: None,
+        web_search_tool_type: Default::default(),
+        truncation_policy: TruncationPolicyConfig::tokens(/*limit*/ 1024),
+        supports_parallel_tool_calls: true,
+        supports_image_detail_original: false,
+        context_window: None,
+        max_context_window: None,
+        auto_compact_token_limit: None,
+        effective_context_window_percent: 95,
+        experimental_supported_tools: Vec::new(),
+        input_modalities: codex_protocol::openai_models::default_input_modalities(),
+        used_fallback_model_metadata: false,
+        supports_search_tool: false,
+    }
 }
 
-#[test]
-fn model_provided_unified_exec_requires_feature_flag() {
-    let model_info = model_info();
+fn shell_features() -> Features {
     let mut features = Features::with_defaults();
+    features.enable(Feature::ShellTool);
+    features.disable(Feature::ShellZshFork);
     features.disable(Feature::UnifiedExec);
-
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-
-    assert_eq!(tools_config.shell_type, ConfigShellToolType::ShellCommand);
+    features
 }
 
 #[test]
-fn unified_exec_can_be_enabled_for_restricted_token_workspace_write() {
-    let model_info = model_info();
-    let mut features = Features::with_defaults();
+fn shell_type_is_derived_from_model_and_feature_gates() {
+    let model = model_with_shell_type(ConfigShellToolType::UnifiedExec);
+    let mut features = shell_features();
+    assert_eq!(
+        shell_type_for_model_and_features(&model, &features),
+        ConfigShellToolType::ShellCommand
+    );
+
     features.enable(Feature::UnifiedExec);
-
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::workspace_write(),
-        windows_sandbox_level: WindowsSandboxLevel::RestrictedToken,
-    });
-
-    let expected_shell_type = if codex_utils_pty::conpty_supported() {
+    let expected_unified_exec = if codex_utils_pty::conpty_supported() {
         ConfigShellToolType::UnifiedExec
     } else {
         ConfigShellToolType::ShellCommand
     };
-    assert_eq!(tools_config.shell_type, expected_shell_type);
+    assert_eq!(
+        shell_type_for_model_and_features(&model, &features),
+        expected_unified_exec
+    );
+
+    features.enable(Feature::ShellZshFork);
+    assert_eq!(
+        shell_type_for_model_and_features(&model, &features),
+        ConfigShellToolType::ShellCommand
+    );
+
+    features.disable(Feature::ShellTool);
+    assert_eq!(
+        shell_type_for_model_and_features(&model, &features),
+        ConfigShellToolType::Disabled
+    );
 }
 
 #[test]
-fn shell_zsh_fork_prefers_shell_command_over_unified_exec() {
-    let model_info = model_info();
-    let mut features = Features::with_defaults();
-    features.enable(Feature::UnifiedExec);
-    features.enable(Feature::ShellZshFork);
-
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Live),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-
-    assert_eq!(tools_config.shell_type, ConfigShellToolType::ShellCommand);
+fn shell_command_backend_requires_both_shell_tool_and_zsh_fork() {
+    let mut features = shell_features();
     assert_eq!(
-        tools_config.shell_command_backend,
+        shell_command_backend_for_features(&features),
+        ShellCommandBackendConfig::Classic
+    );
+
+    features.enable(Feature::ShellZshFork);
+    assert_eq!(
+        shell_command_backend_for_features(&features),
         ShellCommandBackendConfig::ZshFork
     );
+
+    features.disable(Feature::ShellTool);
     assert_eq!(
-        tools_config.unified_exec_shell_mode,
+        shell_command_backend_for_features(&features),
+        ShellCommandBackendConfig::Classic
+    );
+}
+
+#[test]
+fn request_user_input_modes_follow_default_mode_feature() {
+    let mut features = Features::with_defaults();
+    features.disable(Feature::DefaultModeRequestUserInput);
+    assert_eq!(
+        request_user_input_available_modes(&features),
+        vec![ModeKind::Plan]
+    );
+
+    features.enable(Feature::DefaultModeRequestUserInput);
+    assert_eq!(
+        request_user_input_available_modes(&features),
+        vec![ModeKind::Default, ModeKind::Plan]
+    );
+}
+
+#[test]
+fn unified_exec_shell_mode_uses_zsh_fork_only_when_all_inputs_match() {
+    let exe = std::env::current_exe().expect("current exe path");
+    let shell = exe.clone();
+
+    let mode = UnifiedExecShellMode::for_session(
+        ShellCommandBackendConfig::ZshFork,
+        ToolUserShellType::Zsh,
+        Some(&shell),
+        Some(&exe),
+    );
+    if cfg!(unix) {
+        assert!(matches!(mode, UnifiedExecShellMode::ZshFork(_)));
+    } else {
+        assert_eq!(mode, UnifiedExecShellMode::Direct);
+    }
+
+    assert_eq!(
+        UnifiedExecShellMode::for_session(
+            ShellCommandBackendConfig::Classic,
+            ToolUserShellType::Zsh,
+            Some(&shell),
+            Some(&exe),
+        ),
         UnifiedExecShellMode::Direct
     );
-    assert_eq!(
-        tools_config
-            .with_unified_exec_shell_mode_for_session(
-                ToolUserShellType::Zsh,
-                Some(&PathBuf::from(if cfg!(windows) {
-                    r"C:\opt\codex\zsh"
-                } else {
-                    "/opt/codex/zsh"
-                })),
-                Some(&PathBuf::from(if cfg!(windows) {
-                    r"C:\opt\codex\codex-execve-wrapper"
-                } else {
-                    "/opt/codex/codex-execve-wrapper"
-                })),
-            )
-            .unified_exec_shell_mode,
-        if cfg!(unix) {
-            UnifiedExecShellMode::ZshFork(ZshForkConfig {
-                shell_zsh_path: AbsolutePathBuf::from_absolute_path("/opt/codex/zsh").unwrap(),
-                main_execve_wrapper_exe: AbsolutePathBuf::from_absolute_path(
-                    "/opt/codex/codex-execve-wrapper",
-                )
-                .unwrap(),
-            })
-        } else {
-            UnifiedExecShellMode::Direct
-        }
-    );
-}
-
-#[test]
-fn fallback_apply_patch_models_use_freeform_tool_by_default() {
-    let model_info = model_info();
-    let features = Features::with_defaults();
-
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-
-    assert_eq!(
-        tools_config.apply_patch_tool_type,
-        Some(ApplyPatchToolType::Freeform)
-    );
-}
-
-#[test]
-fn subagents_keep_request_user_input_config_and_agent_jobs_workers_opt_in_by_label() {
-    let model_info = model_info();
-    let mut features = Features::with_defaults();
-    features.enable(Feature::DefaultModeRequestUserInput);
-    features.enable(Feature::SpawnCsv);
-
-    let available_models = Vec::new();
-    let tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::SubAgent(SubAgentSource::Other(
-            "agent_job:test".to_string(),
-        )),
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-
-    assert_eq!(
-        tools_config.request_user_input_available_modes,
-        request_user_input_available_modes(&features)
-    );
-    assert!(tools_config.agent_jobs_tools);
-    assert!(tools_config.agent_jobs_worker_tools);
-}
-
-#[test]
-fn image_generation_requires_feature_and_supported_model() {
-    let supported_model_info = model_info();
-    let mut unsupported_model_info = supported_model_info.clone();
-    unsupported_model_info.input_modalities = vec![InputModality::Text];
-
-    let mut image_generation_disabled_features = Features::with_defaults();
-    image_generation_disabled_features.disable(Feature::ImageGeneration);
-    let mut image_generation_features = Features::with_defaults();
-    image_generation_features.enable(Feature::ImageGeneration);
-
-    let available_models = Vec::new();
-    let default_tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &supported_model_info,
-        available_models: &available_models,
-        features: &image_generation_disabled_features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let supported_tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &supported_model_info,
-        available_models: &available_models,
-        features: &image_generation_features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let auth_disallowed_tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &supported_model_info,
-        available_models: &available_models,
-        features: &image_generation_features,
-        image_generation_tool_auth_allowed: false,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    let unsupported_tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &unsupported_model_info,
-        available_models: &available_models,
-        features: &image_generation_features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    assert!(!default_tools_config.image_gen_tool);
-    assert!(supported_tools_config.image_gen_tool);
-    assert!(!auth_disallowed_tools_config.image_gen_tool);
-    assert!(!unsupported_tools_config.image_gen_tool);
-}
-
-#[test]
-fn provider_capability_methods_disable_provider_bound_tool_surfaces() {
-    let model_info = model_info();
-    let features = Features::with_defaults();
-    let available_models = Vec::new();
-    let mut tools_config = ToolsConfig::new(&ToolsConfigParams {
-        model_info: &model_info,
-        available_models: &available_models,
-        features: &features,
-        image_generation_tool_auth_allowed: true,
-        web_search_mode: Some(WebSearchMode::Cached),
-        session_source: SessionSource::Cli,
-        permission_profile: &PermissionProfile::Disabled,
-        windows_sandbox_level: WindowsSandboxLevel::Disabled,
-    });
-    tools_config.search_tool = true;
-    tools_config.tool_suggest = true;
-    tools_config.image_gen_tool = true;
-    tools_config.namespace_tools = true;
-
-    let tools_config = tools_config
-        .with_namespace_tools_capability(/*namespace_tools*/ false)
-        .with_image_generation_capability(/*image_generation*/ false)
-        .with_web_search_capability(/*web_search*/ false);
-
-    assert!(tools_config.search_tool);
-    assert!(tools_config.tool_suggest);
-    assert!(!tools_config.image_gen_tool);
-    assert!(!tools_config.namespace_tools);
-    assert_eq!(tools_config.web_search_mode, None);
 }
diff --git a/codex-rs/tools/src/tool_executor.rs b/codex-rs/tools/src/tool_executor.rs
index 8c38e9fc8c..2557dc3490 100644
--- a/codex-rs/tools/src/tool_executor.rs
+++ b/codex-rs/tools/src/tool_executor.rs
@@ -1,18 +1,41 @@
-use std::future::Future;
-
 use crate::FunctionCallError;
 use crate::ToolName;
 use crate::ToolOutput;
 use crate::ToolSpec;
 
+/// Controls where a tool is exposed to the model.
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub enum ToolExposure {
+    /// Include this tool in the initial model-visible tool list.
+    ///
+    /// When code mode is enabled, this tool is also available as a nested
+    /// code-mode tool.
+    Direct,
+
+    /// Register this tool for later discovery, but omit it from the initial
+    /// model-visible tool list.
+    Deferred,
+
+    /// Include this tool in the initial model-visible tool list only.
+    ///
+    /// In code-mode-only sessions, this keeps the tool callable as a normal
+    /// model tool while excluding it from the nested code-mode tool surface.
+    DirectModelOnly,
+}
+
+impl ToolExposure {
+    pub fn is_direct(self) -> bool {
+        matches!(self, Self::Direct | Self::DirectModelOnly)
+    }
+}
+
 /// Shared runtime contract for model-visible tools.
 ///
 /// Implementations keep the model-visible spec tied to the executable runtime.
 /// Host crates can layer routing, hooks, telemetry, or other orchestration on
 /// top without reopening the spec/runtime split.
+#[async_trait::async_trait]
 pub trait ToolExecutor<Invocation>: Send + Sync {
-    type Output: ToolOutput + 'static;
-
     /// The concrete tool name handled by this runtime instance.
     fn tool_name(&self) -> ToolName;
 
@@ -20,12 +43,16 @@ pub trait ToolExecutor<Invocation>: Send + Sync {
         None
     }
 
+    fn exposure(&self) -> ToolExposure {
+        ToolExposure::Direct
+    }
+
     fn supports_parallel_tool_calls(&self) -> bool {
         false
     }
 
-    fn handle(
+    async fn handle(
         &self,
         invocation: Invocation,
-    ) -> impl Future<Output = Result<Self::Output, FunctionCallError>> + Send;
+    ) -> Result<Box<dyn ToolOutput>, FunctionCallError>;
 }
diff --git a/codex-rs/tools/src/tool_output.rs b/codex-rs/tools/src/tool_output.rs
index 2044295174..64a8164da3 100644
--- a/codex-rs/tools/src/tool_output.rs
+++ b/codex-rs/tools/src/tool_output.rs
@@ -20,6 +20,16 @@ pub trait ToolOutput: Send {
 
     fn to_response_item(&self, call_id: &str, payload: &ToolPayload) -> ResponseInputItem;
 
+    /// Returns the tool call id exposed to `PostToolUse` hooks for this output.
+    fn post_tool_use_id(&self, call_id: &str) -> String {
+        call_id.to_string()
+    }
+
+    /// Returns the tool input exposed to `PostToolUse` hooks for this output.
+    fn post_tool_use_input(&self, _payload: &ToolPayload) -> Option<JsonValue> {
+        None
+    }
+
     /// Returns the stable value exposed to `PostToolUse` hooks for this tool output.
     ///
     /// Tool handlers decide whether a tool participates in `PostToolUse`, but
@@ -52,6 +62,14 @@ where
         (**self).to_response_item(call_id, payload)
     }
 
+    fn post_tool_use_id(&self, call_id: &str) -> String {
+        (**self).post_tool_use_id(call_id)
+    }
+
+    fn post_tool_use_input(&self, payload: &ToolPayload) -> Option<JsonValue> {
+        (**self).post_tool_use_input(payload)
+    }
+
     fn post_tool_use_response(&self, call_id: &str, payload: &ToolPayload) -> Option<JsonValue> {
         (**self).post_tool_use_response(call_id, payload)
     }
diff --git a/codex-rs/tools/src/tool_payload.rs b/codex-rs/tools/src/tool_payload.rs
index b335e58372..71af457743 100644
--- a/codex-rs/tools/src/tool_payload.rs
+++ b/codex-rs/tools/src/tool_payload.rs
@@ -1,7 +1,6 @@
 use std::borrow::Cow;
 
 use codex_protocol::models::SearchToolCallParams;
-use codex_protocol::models::ShellToolCallParams;
 
 /// Canonical payload shapes accepted by model-visible tool runtimes.
 #[derive(Clone, Debug)]
@@ -9,7 +8,6 @@ pub enum ToolPayload {
     Function { arguments: String },
     ToolSearch { arguments: SearchToolCallParams },
     Custom { input: String },
-    LocalShell { params: ShellToolCallParams },
 }
 
 impl ToolPayload {
@@ -18,7 +16,6 @@ impl ToolPayload {
             ToolPayload::Function { arguments } => Cow::Borrowed(arguments),
             ToolPayload::ToolSearch { arguments } => Cow::Owned(arguments.query.clone()),
             ToolPayload::Custom { input } => Cow::Borrowed(input),
-            ToolPayload::LocalShell { params } => Cow::Owned(params.command.join(" ")),
         }
     }
 }
diff --git a/codex-rs/tools/src/tool_spec.rs b/codex-rs/tools/src/tool_spec.rs
index 2a0183a905..98f705363c 100644
--- a/codex-rs/tools/src/tool_spec.rs
+++ b/codex-rs/tools/src/tool_spec.rs
@@ -25,8 +25,6 @@ pub enum ToolSpec {
         description: String,
         parameters: JsonSchema,
     },
-    #[serde(rename = "local_shell")]
-    LocalShell {},
     #[serde(rename = "image_generation")]
     ImageGeneration { output_format: String },
     // TODO: Understand why we get an error on web_search although the API docs
@@ -58,7 +56,6 @@ impl ToolSpec {
             ToolSpec::Function(tool) => tool.name.as_str(),
             ToolSpec::Namespace(namespace) => namespace.name.as_str(),
             ToolSpec::ToolSearch { .. } => "tool_search",
-            ToolSpec::LocalShell {} => "local_shell",
             ToolSpec::ImageGeneration { .. } => "image_generation",
             ToolSpec::WebSearch { .. } => "web_search",
             ToolSpec::Freeform(tool) => tool.name.as_str(),
diff --git a/codex-rs/tools/src/tool_spec_tests.rs b/codex-rs/tools/src/tool_spec_tests.rs
index 6d2017e553..a181cd247b 100644
--- a/codex-rs/tools/src/tool_spec_tests.rs
+++ b/codex-rs/tools/src/tool_spec_tests.rs
@@ -57,7 +57,6 @@ fn tool_spec_name_covers_all_variants() {
         .name(),
         "tool_search"
     );
-    assert_eq!(ToolSpec::LocalShell {}.name(), "local_shell");
     assert_eq!(
         ToolSpec::ImageGeneration {
             output_format: "png".to_string(),
diff --git a/codex-rs/tui/Cargo.toml b/codex-rs/tui/Cargo.toml
index f539db5f5c..c213e92bae 100644
--- a/codex-rs/tui/Cargo.toml
+++ b/codex-rs/tui/Cargo.toml
@@ -52,6 +52,7 @@ codex-plugin = { workspace = true }
 codex-protocol = { workspace = true }
 codex-realtime-webrtc = { workspace = true }
 codex-rollout = { workspace = true }
+codex-sandboxing = { workspace = true }
 codex-shell-command = { workspace = true }
 codex-state = { workspace = true }
 codex-terminal-detection = { workspace = true }
@@ -60,6 +61,7 @@ codex-utils-absolute-path = { workspace = true }
 codex-utils-cli = { workspace = true }
 codex-utils-elapsed = { workspace = true }
 codex-utils-fuzzy-match = { workspace = true }
+codex-utils-home-dir = { workspace = true }
 codex-utils-oss = { workspace = true }
 codex-utils-path = { workspace = true }
 codex-utils-plugins = { workspace = true }
@@ -154,7 +156,6 @@ codex-cli = { workspace = true }
 codex-mcp = { workspace = true }
 core_test_support = { workspace = true }
 codex-utils-cargo-bin = { workspace = true }
-codex-utils-pty = { workspace = true }
 assert_matches = { workspace = true }
 chrono = { workspace = true, features = ["serde"] }
 insta = { workspace = true }
diff --git a/codex-rs/tui/src/additional_dirs.rs b/codex-rs/tui/src/additional_dirs.rs
index b503b13112..6d94509a4f 100644
--- a/codex-rs/tui/src/additional_dirs.rs
+++ b/codex-rs/tui/src/additional_dirs.rs
@@ -46,14 +46,13 @@ fn format_warning(additional_dirs: &[PathBuf]) -> String {
 #[cfg(test)]
 mod tests {
     use super::add_dir_warning_message;
-    use codex_app_server_protocol::FileSystemAccessMode;
-    use codex_app_server_protocol::FileSystemPath;
-    use codex_app_server_protocol::FileSystemSandboxEntry;
-    use codex_app_server_protocol::FileSystemSpecialPath;
-    use codex_app_server_protocol::PermissionProfile as AppServerPermissionProfile;
-    use codex_app_server_protocol::PermissionProfileFileSystemPermissions;
-    use codex_app_server_protocol::PermissionProfileNetworkPermissions;
+    use codex_protocol::models::ManagedFileSystemPermissions;
     use codex_protocol::models::PermissionProfile;
+    use codex_protocol::permissions::FileSystemAccessMode;
+    use codex_protocol::permissions::FileSystemPath;
+    use codex_protocol::permissions::FileSystemSandboxEntry;
+    use codex_protocol::permissions::FileSystemSpecialPath;
+    use codex_protocol::permissions::NetworkSandboxPolicy;
     use pretty_assertions::assert_eq;
     use std::path::Path;
     use std::path::PathBuf;
@@ -80,10 +79,9 @@ mod tests {
 
     #[test]
     fn returns_none_for_external_sandbox() {
-        let profile: PermissionProfile = AppServerPermissionProfile::External {
-            network: PermissionProfileNetworkPermissions { enabled: true },
-        }
-        .into();
+        let profile: PermissionProfile = PermissionProfile::External {
+            network: NetworkSandboxPolicy::Enabled,
+        };
         let dirs = vec![PathBuf::from("/tmp/example")];
         assert_eq!(
             add_dir_warning_message(&dirs, &profile, Path::new("/tmp/project")),
@@ -105,9 +103,9 @@ mod tests {
 
     #[test]
     fn warns_when_profile_can_write_elsewhere_but_not_cwd() {
-        let profile: PermissionProfile = AppServerPermissionProfile::Managed {
-            network: PermissionProfileNetworkPermissions { enabled: false },
-            file_system: PermissionProfileFileSystemPermissions::Restricted {
+        let profile: PermissionProfile = PermissionProfile::Managed {
+            network: NetworkSandboxPolicy::Restricted,
+            file_system: ManagedFileSystemPermissions::Restricted {
                 entries: vec![
                     FileSystemSandboxEntry {
                         path: FileSystemPath::Special {
@@ -124,8 +122,7 @@ mod tests {
                 ],
                 glob_scan_max_depth: None,
             },
-        }
-        .into();
+        };
         let dirs = vec![PathBuf::from("/tmp/extra")];
 
         assert_eq!(
diff --git a/codex-rs/tui/src/app.rs b/codex-rs/tui/src/app.rs
index 62b29f5b3e..5cfb520dbe 100644
--- a/codex-rs/tui/src/app.rs
+++ b/codex-rs/tui/src/app.rs
@@ -16,6 +16,7 @@ use crate::app_event::WindowsSandboxEnableMode;
 use crate::app_event_sender::AppEventSender;
 use crate::app_server_session::AppServerSession;
 use crate::app_server_session::AppServerStartedThread;
+use crate::app_server_session::TurnPermissionsOverride;
 use crate::app_server_session::app_server_rate_limit_snapshots;
 use crate::bottom_pane::AppLinkViewParams;
 use crate::bottom_pane::ApprovalRequest;
@@ -46,6 +47,7 @@ use crate::keymap::RuntimeKeymap;
 use crate::legacy_core::config::Config;
 use crate::legacy_core::config::ConfigBuilder;
 use crate::legacy_core::config::ConfigOverrides;
+use crate::legacy_core::config::PermissionProfileSnapshot;
 use crate::legacy_core::config::edit::ConfigEdit;
 use crate::legacy_core::config::edit::ConfigEditsBuilder;
 #[cfg(target_os = "windows")]
@@ -125,9 +127,9 @@ use codex_app_server_protocol::Turn;
 use codex_app_server_protocol::TurnError as AppServerTurnError;
 use codex_app_server_protocol::TurnStatus;
 use codex_config::ConfigLayerStackOrdering;
+use codex_config::LoaderOverrides;
 use codex_config::types::ApprovalsReviewer;
 use codex_config::types::ModelAvailabilityNuxConfig;
-use codex_core_plugins::PluginsManager;
 use codex_exec_server::EnvironmentManager;
 use codex_features::Feature;
 use codex_model_provider::create_model_provider;
@@ -139,6 +141,8 @@ use codex_protocol::ThreadId;
 use codex_protocol::config_types::Personality;
 #[cfg(target_os = "windows")]
 use codex_protocol::config_types::WindowsSandboxLevel;
+use codex_protocol::models::ActivePermissionProfile;
+use codex_protocol::models::BUILT_IN_PERMISSION_PROFILE_WORKSPACE;
 use codex_protocol::models::PermissionProfile;
 use codex_protocol::openai_models::ModelAvailabilityNux;
 use codex_protocol::openai_models::ModelPreset;
@@ -149,6 +153,7 @@ use codex_protocol::permissions::FileSystemSandboxKind;
 use codex_rollout::StateDbHandle;
 use codex_terminal_detection::user_agent;
 use codex_utils_absolute_path::AbsolutePathBuf;
+use codex_utils_approval_presets::builtin_permission_profile_for_active_permission_profile;
 use color_eyre::eyre::Result;
 use color_eyre::eyre::WrapErr;
 use crossterm::event::KeyCode;
@@ -196,6 +201,7 @@ mod loaded_threads;
 mod pending_interactive_replay;
 mod pets;
 mod platform_actions;
+mod plugin_mentions;
 mod replay_filter;
 mod resize_reflow;
 mod session_lifecycle;
@@ -325,7 +331,7 @@ fn default_exec_approval_decisions(
 struct AutoReviewMode {
     approval_policy: AskForApproval,
     approvals_reviewer: ApprovalsReviewer,
-    permission_profile: PermissionProfile,
+    active_permission_profile: ActivePermissionProfile,
 }
 
 /// Enabling the Auto-review experiment in the TUI should also switch the
@@ -336,7 +342,17 @@ fn auto_review_mode() -> AutoReviewMode {
     AutoReviewMode {
         approval_policy: AskForApproval::OnRequest,
         approvals_reviewer: ApprovalsReviewer::AutoReview,
-        permission_profile: PermissionProfile::workspace_write(),
+        active_permission_profile: ActivePermissionProfile::new(
+            BUILT_IN_PERMISSION_PROFILE_WORKSPACE,
+        ),
+    }
+}
+
+#[cfg(test)]
+impl AutoReviewMode {
+    fn permission_profile(&self) -> PermissionProfile {
+        builtin_permission_profile_for_active_permission_profile(&self.active_permission_profile)
+            .expect("auto-review mode should use a built-in permission profile")
     }
 }
 
@@ -394,18 +410,18 @@ fn session_summary(
     rollout_path: Option<&Path>,
 ) -> Option<SessionSummary> {
     let usage_line = (!token_usage.is_zero()).then(|| token_usage.to_string());
-    let thread_id =
-        resumable_thread(thread_id, thread_name, rollout_path).map(|thread| thread.thread_id);
-    let resume_command =
-        crate::legacy_core::util::resume_command(/*thread_name*/ None, thread_id);
+    let resumable_thread = resumable_thread(thread_id, thread_name, rollout_path);
+    let resume_hint = resumable_thread.as_ref().and_then(|thread| {
+        codex_utils_cli::resume_hint(thread.thread_name.as_deref(), Some(thread.thread_id))
+    });
 
-    if usage_line.is_none() && resume_command.is_none() {
+    if usage_line.is_none() && resume_hint.is_none() {
         return None;
     }
 
     Some(SessionSummary {
         usage_line,
-        resume_command,
+        resume_hint,
     })
 }
 
@@ -444,7 +460,7 @@ fn errors_for_cwd(cwd: &Path, response: &SkillsListResponse) -> Vec<SkillErrorIn
 #[derive(Debug, Clone, PartialEq, Eq)]
 struct SessionSummary {
     usage_line: Option<String>,
-    resume_command: Option<String>,
+    resume_hint: Option<String>,
 }
 
 #[derive(Debug, Default)]
@@ -465,6 +481,7 @@ pub(crate) struct App {
     pub(crate) active_profile: Option<String>,
     cli_kv_overrides: Vec<(String, TomlValue)>,
     harness_overrides: ConfigOverrides,
+    loader_overrides: LoaderOverrides,
     runtime_approval_policy_override: Option<AskForApproval>,
     runtime_permission_profile_override: Option<PermissionProfile>,
 
@@ -598,7 +615,6 @@ impl App {
     ) -> crate::chatwidget::ChatWidgetInit {
         crate::chatwidget::ChatWidgetInit {
             config: cfg,
-            environment_manager: self.environment_manager.clone(),
             frame_requester: tui.frame_requester(),
             app_event_tx: self.app_event_tx.clone(),
             workspace_command_runner: self.workspace_command_runner.clone(),
@@ -629,6 +645,7 @@ impl App {
         mut config: Config,
         cli_kv_overrides: Vec<(String, TomlValue)>,
         harness_overrides: ConfigOverrides,
+        loader_overrides: LoaderOverrides,
         active_profile: Option<String>,
         initial_prompt: Option<String>,
         initial_images: Vec<PathBuf>,
@@ -643,6 +660,7 @@ impl App {
         startup_hooks_browser: Option<HooksListEntry>,
     ) -> Result<AppExitInfo> {
         use tokio_stream::StreamExt;
+        let startup_started_at = Instant::now();
         let (app_event_tx, mut app_event_rx) = unbounded_channel();
         let app_event_tx = AppEventSender::new(app_event_tx);
         emit_project_config_warnings(&app_event_tx, &config);
@@ -686,7 +704,9 @@ impl App {
                 });
             }
         };
+        let bootstrap_started_at = Instant::now();
         let bootstrap = app_server.bootstrap(&config).await?;
+        let bootstrap_ms = bootstrap_started_at.elapsed().as_millis();
         let mut model = bootstrap.default_model;
         let available_models = bootstrap.available_models;
         let exit_info = handle_model_migration_prompt_if_needed(
@@ -743,8 +763,10 @@ impl App {
         let workspace_command_runner: WorkspaceCommandRunner = Arc::new(
             AppServerWorkspaceCommandRunner::new(app_server.request_handle()),
         );
+        let runtime_model_provider_started_at = Instant::now();
         let runtime_model_provider_base_url =
             resolve_runtime_model_provider_base_url(&config.model_provider).await;
+        let runtime_model_provider_ms = runtime_model_provider_started_at.elapsed().as_millis();
 
         let enhanced_keys_supported = tui.enhanced_keys_supported();
         let wait_for_initial_session_configured =
@@ -755,15 +777,16 @@ impl App {
                 &initial_prompt,
                 &initial_images,
             );
+        let thread_and_widget_started_at = Instant::now();
         let (mut chat_widget, initial_started_thread) = match session_selection {
             SessionSelection::StartFresh | SessionSelection::Exit => {
                 let started = app_server.start_thread(&config).await?;
+                // Only count a startup tooltip once the fresh thread can actually render it.
                 let startup_tooltip_override =
                     prepare_startup_tooltip_override(&mut config, &available_models, is_first_run)
                         .await;
                 let init = crate::chatwidget::ChatWidgetInit {
                     config: config.clone(),
-                    environment_manager: environment_manager.clone(),
                     frame_requester: tui.frame_requester(),
                     app_event_tx: app_event_tx.clone(),
                     workspace_command_runner: Some(workspace_command_runner.clone()),
@@ -800,7 +823,6 @@ impl App {
                     })?;
                 let init = crate::chatwidget::ChatWidgetInit {
                     config: config.clone(),
-                    environment_manager: environment_manager.clone(),
                     frame_requester: tui.frame_requester(),
                     app_event_tx: app_event_tx.clone(),
                     workspace_command_runner: Some(workspace_command_runner.clone()),
@@ -842,7 +864,6 @@ impl App {
                     })?;
                 let init = crate::chatwidget::ChatWidgetInit {
                     config: config.clone(),
-                    environment_manager: environment_manager.clone(),
                     frame_requester: tui.frame_requester(),
                     app_event_tx: app_event_tx.clone(),
                     workspace_command_runner: Some(workspace_command_runner.clone()),
@@ -870,6 +891,7 @@ impl App {
                 (ChatWidget::new_with_app_event(init), Some(forked))
             }
         };
+        let thread_and_widget_ms = thread_and_widget_started_at.elapsed().as_millis();
         if let Some(message) = external_agent_config_migration_message {
             chat_widget.add_info_message(message, /*hint*/ None);
         }
@@ -899,6 +921,7 @@ See the Codex keymap documentation for supported actions and examples."
             active_profile,
             cli_kv_overrides,
             harness_overrides,
+            loader_overrides,
             runtime_approval_policy_override: None,
             runtime_permission_profile_override: None,
             file_search,
@@ -939,6 +962,7 @@ See the Codex keymap documentation for supported actions and examples."
         if let Some(entry) = startup_hooks_browser {
             app.chat_widget.open_hooks_browser(entry);
         }
+        let initial_session_started_at = Instant::now();
         if let Some(started) = initial_started_thread {
             let thread_id = started.session.thread_id;
             app.enqueue_primary_thread_session(started.session, started.turns)
@@ -948,12 +972,13 @@ See the Codex keymap documentation for supported actions and examples."
                     .await;
             }
         }
+        let initial_session_ms = initial_session_started_at.elapsed().as_millis();
 
         // On startup, if a managed filesystem sandbox is active, warn about
         // world-writable dirs on Windows.
         #[cfg(target_os = "windows")]
         {
-            let startup_permission_profile = app.config.permissions.permission_profile();
+            let startup_permission_profile = app.config.permissions.effective_permission_profile();
             let should_check = WindowsSandboxLevel::from_config(&app.config)
                 != WindowsSandboxLevel::Disabled
                 && managed_filesystem_sandbox_is_restricted(&startup_permission_profile)
@@ -977,10 +1002,20 @@ See the Codex keymap documentation for supported actions and examples."
             }
         }
 
+        let event_stream_started_at = Instant::now();
         let tui_events = tui.event_stream();
         tokio::pin!(tui_events);
 
         tui.frame_requester().schedule_frame();
+        tracing::info!(
+            duration_ms = %startup_started_at.elapsed().as_millis(),
+            bootstrap_ms = %bootstrap_ms,
+            runtime_model_provider_ms = %runtime_model_provider_ms,
+            thread_and_widget_ms = %thread_and_widget_ms,
+            initial_session_ms = %initial_session_ms,
+            event_stream_ms = %event_stream_started_at.elapsed().as_millis(),
+            "tui startup initial frame scheduled"
+        );
         app.refresh_startup_skills(&app_server);
         // Kick off a non-blocking rate-limit prefetch so the first `/status`
         // already has data, without delaying the initial frame render.
@@ -1157,30 +1192,8 @@ See the Codex keymap documentation for supported actions and examples."
                     }
                     // Allow widgets to process any pending timers before rendering.
                     self.chat_widget.pre_draw_tick();
-                    let desired_height =
-                        self.chat_widget.desired_height(tui.terminal.size()?.width);
-                    let mut rendered_area = Rect::default();
-                    if terminal_resize_reflow_enabled {
-                        tui.draw_with_resize_reflow(desired_height, |frame| {
-                            let area = frame.area();
-                            rendered_area = area;
-                            self.chat_widget.render(area, frame.buffer);
-                            if let Some((x, y)) = self.chat_widget.cursor_pos(area) {
-                                frame.set_cursor_style(self.chat_widget.cursor_style(area));
-                                frame.set_cursor_position((x, y));
-                            }
-                        })?;
-                    } else {
-                        tui.draw(desired_height, |frame| {
-                            let area = frame.area();
-                            rendered_area = area;
-                            self.chat_widget.render(area, frame.buffer);
-                            if let Some((x, y)) = self.chat_widget.cursor_pos(area) {
-                                frame.set_cursor_style(self.chat_widget.cursor_style(area));
-                                frame.set_cursor_position((x, y));
-                            }
-                        })?;
-                    }
+                    let rendered_area =
+                        self.render_chat_widget_frame(tui, terminal_resize_reflow_enabled)?;
                     if self.chat_widget.ambient_pet_image_enabled() {
                         let terminal_size = tui.terminal.size()?;
                         let ambient_pet_area = Rect::new(
@@ -1215,6 +1228,49 @@ See the Codex keymap documentation for supported actions and examples."
         }
         Ok(AppRunControl::Continue)
     }
+
+    pub(super) fn show_shutdown_feedback(&mut self, tui: &mut tui::Tui) -> Result<()> {
+        self.disable_ambient_pet_before_shutdown(tui)?;
+        self.chat_widget.show_shutdown_in_progress();
+        let terminal_resize_reflow_enabled = self.terminal_resize_reflow_enabled();
+        if terminal_resize_reflow_enabled {
+            self.handle_draw_pre_render(tui)?;
+        }
+        self.chat_widget.pre_draw_tick();
+        self.render_chat_widget_frame(tui, terminal_resize_reflow_enabled)?;
+        Ok(())
+    }
+
+    fn render_chat_widget_frame(
+        &mut self,
+        tui: &mut tui::Tui,
+        terminal_resize_reflow_enabled: bool,
+    ) -> Result<Rect> {
+        let desired_height = self.chat_widget.desired_height(tui.terminal.size()?.width);
+        let mut rendered_area = Rect::default();
+        if terminal_resize_reflow_enabled {
+            tui.draw_with_resize_reflow(desired_height, |frame| {
+                let area = frame.area();
+                rendered_area = area;
+                self.chat_widget.render(area, frame.buffer);
+                if let Some((x, y)) = self.chat_widget.cursor_pos(area) {
+                    frame.set_cursor_style(self.chat_widget.cursor_style(area));
+                    frame.set_cursor_position((x, y));
+                }
+            })?;
+        } else {
+            tui.draw(desired_height, |frame| {
+                let area = frame.area();
+                rendered_area = area;
+                self.chat_widget.render(area, frame.buffer);
+                if let Some((x, y)) = self.chat_widget.cursor_pos(area) {
+                    frame.set_cursor_style(self.chat_widget.cursor_style(area));
+                    frame.set_cursor_position((x, y));
+                }
+            })?;
+        }
+        Ok(rendered_area)
+    }
 }
 
 impl Drop for App {
diff --git a/codex-rs/tui/src/app/app_server_events.rs b/codex-rs/tui/src/app/app_server_events.rs
index 413e8b8c80..18e6116e58 100644
--- a/codex-rs/tui/src/app/app_server_events.rs
+++ b/codex-rs/tui/src/app/app_server_events.rs
@@ -6,6 +6,7 @@ use super::app_server_event_targets::server_notification_thread_target;
 use super::app_server_event_targets::server_request_thread_id;
 use crate::app_command::AppCommand;
 use crate::app_event::AppEvent;
+use crate::app_event::ConnectorsSnapshot;
 use crate::app_server_session::AppServerSession;
 use crate::app_server_session::status_account_display_from_auth_mode;
 use codex_app_server_client::AppServerEvent;
@@ -106,6 +107,15 @@ impl App {
                 self.fetch_plugins_list(app_server_client, cwd);
                 return;
             }
+            ServerNotification::AppListUpdated(notification) => {
+                self.chat_widget.on_connectors_loaded(
+                    Ok(ConnectorsSnapshot {
+                        connectors: notification.data.clone(),
+                    }),
+                    /*is_final*/ false,
+                );
+                return;
+            }
             _ => {}
         }
 
diff --git a/codex-rs/tui/src/app/background_requests.rs b/codex-rs/tui/src/app/background_requests.rs
index 57c82cb7f7..dcf1f672be 100644
--- a/codex-rs/tui/src/app/background_requests.rs
+++ b/codex-rs/tui/src/app/background_requests.rs
@@ -4,7 +4,11 @@
 //! limits, add-credit nudges, and feedback uploads. Results are routed back through `AppEvent` so
 //! the main event loop remains single-threaded.
 
+use super::plugin_mentions::fetch_plugin_mentions;
 use super::*;
+use crate::app_event::ConnectorsSnapshot;
+use codex_app_server_protocol::AppsListParams;
+use codex_app_server_protocol::AppsListResponse;
 use codex_app_server_protocol::MarketplaceAddParams;
 use codex_app_server_protocol::MarketplaceAddResponse;
 use codex_app_server_protocol::MarketplaceRemoveParams;
@@ -91,6 +95,27 @@ impl App {
         });
     }
 
+    pub(super) fn fetch_connectors_list(
+        &mut self,
+        app_server: &AppServerSession,
+        force_refetch: bool,
+    ) {
+        let request_handle = app_server.request_handle();
+        let app_event_tx = self.app_event_tx.clone();
+        let thread_id = self
+            .current_displayed_thread_id()
+            .map(|thread_id| thread_id.to_string());
+        tokio::spawn(async move {
+            let result = fetch_connectors_list(request_handle, force_refetch, thread_id)
+                .await
+                .map_err(|err| err.to_string());
+            app_event_tx.send(AppEvent::ConnectorsLoaded {
+                result,
+                is_final: true,
+            });
+        });
+    }
+
     pub(super) fn fetch_plugins_list(&mut self, app_server: &AppServerSession, cwd: PathBuf) {
         let request_handle = app_server.request_handle();
         let app_event_tx = self.app_event_tx.clone();
@@ -358,8 +383,9 @@ impl App {
         });
     }
 
-    pub(super) fn refresh_plugin_mentions(&mut self) {
+    pub(super) fn refresh_plugin_mentions(&mut self, app_server: &AppServerSession) {
         let config = self.config.clone();
+        let request_handle = app_server.request_handle();
         let app_event_tx = self.app_event_tx.clone();
         if !config.features.enabled(Feature::Plugins) {
             app_event_tx.send(AppEvent::PluginMentionsLoaded { plugins: None });
@@ -367,15 +393,16 @@ impl App {
         }
 
         tokio::spawn(async move {
-            let plugins_input = config.plugins_config_input();
-            let plugins = PluginsManager::new(config.codex_home.to_path_buf())
-                .plugins_for_config(&plugins_input)
-                .await
-                .capability_summaries()
-                .to_vec();
-            app_event_tx.send(AppEvent::PluginMentionsLoaded {
-                plugins: Some(plugins),
-            });
+            match fetch_plugin_mentions(request_handle, config).await {
+                Ok(plugins) => {
+                    app_event_tx.send(AppEvent::PluginMentionsLoaded {
+                        plugins: Some(plugins),
+                    });
+                }
+                Err(err) => {
+                    tracing::warn!(error = %err, "plugin/list failed while refreshing plugin mention candidates");
+                }
+            }
         });
     }
 
@@ -631,22 +658,36 @@ pub(super) async fn fetch_skills_list(
         .wrap_err("skills/list failed in TUI")
 }
 
+pub(super) async fn fetch_connectors_list(
+    request_handle: AppServerRequestHandle,
+    force_refetch: bool,
+    thread_id: Option<String>,
+) -> Result<ConnectorsSnapshot> {
+    let request_id = RequestId::String(format!("apps-list-{}", Uuid::new_v4()));
+    let response: AppsListResponse = request_handle
+        .request_typed(ClientRequest::AppsList {
+            request_id,
+            params: AppsListParams {
+                cursor: None,
+                limit: None,
+                thread_id,
+                force_refetch,
+            },
+        })
+        .await
+        .wrap_err("app/list failed in TUI")?;
+    Ok(ConnectorsSnapshot {
+        connectors: response.data,
+    })
+}
+
 pub(super) async fn fetch_plugins_list(
     request_handle: AppServerRequestHandle,
     cwd: PathBuf,
 ) -> Result<PluginListResponse> {
-    let cwd = AbsolutePathBuf::try_from(cwd).wrap_err("plugin list cwd must be absolute")?;
-    let request_id = RequestId::String(format!("plugin-list-{}", Uuid::new_v4()));
-    let mut response = request_handle
-        .request_typed(ClientRequest::PluginList {
-            request_id,
-            params: PluginListParams {
-                cwds: Some(vec![cwd]),
-                marketplace_kinds: None,
-            },
-        })
+    let mut response = request_plugin_list(request_handle, cwd)
         .await
-        .wrap_err("plugin/list failed in TUI")?;
+        .wrap_err("plugin/list failed while loading the plugins menu")?;
     hide_cli_only_plugin_marketplaces(&mut response);
     Ok(response)
 }
@@ -659,6 +700,24 @@ pub(super) fn hide_cli_only_plugin_marketplaces(response: &mut PluginListRespons
         .retain(|marketplace| !CLI_HIDDEN_PLUGIN_MARKETPLACES.contains(&marketplace.name.as_str()));
 }
 
+pub(super) async fn request_plugin_list(
+    request_handle: AppServerRequestHandle,
+    cwd: PathBuf,
+) -> Result<PluginListResponse> {
+    let cwd = AbsolutePathBuf::try_from(cwd).wrap_err("plugin list cwd must be absolute")?;
+    let request_id = RequestId::String(format!("plugin-list-{}", Uuid::new_v4()));
+    request_handle
+        .request_typed(ClientRequest::PluginList {
+            request_id,
+            params: PluginListParams {
+                cwds: Some(vec![cwd]),
+                marketplace_kinds: None,
+            },
+        })
+        .await
+        .wrap_err("plugin/list failed in TUI")
+}
+
 pub(super) async fn fetch_plugin_detail(
     request_handle: AppServerRequestHandle,
     params: PluginReadParams,
diff --git a/codex-rs/tui/src/app/config_persistence.rs b/codex-rs/tui/src/app/config_persistence.rs
index d20ffb8218..5b2b5ab23a 100644
--- a/codex-rs/tui/src/app/config_persistence.rs
+++ b/codex-rs/tui/src/app/config_persistence.rs
@@ -15,6 +15,7 @@ impl App {
             .codex_home(self.config.codex_home.to_path_buf())
             .cli_overrides(self.cli_kv_overrides.clone())
             .harness_overrides(overrides)
+            .loader_overrides(self.loader_overrides.clone())
             .build()
             .await
             .wrap_err_with(|| format!("Failed to rebuild config for cwd {cwd_display}"))
@@ -104,24 +105,41 @@ impl App {
         true
     }
 
-    pub(super) fn try_set_permission_profile_on_config(
+    pub(super) fn try_set_builtin_active_permission_profile_on_config(
         &mut self,
         config: &mut Config,
-        permission_profile: PermissionProfile,
+        active_permission_profile: ActivePermissionProfile,
         user_message_prefix: &str,
         log_message: &str,
-    ) -> bool {
+    ) -> Option<PermissionProfile> {
+        let Some(permission_profile) =
+            builtin_permission_profile_for_active_permission_profile(&active_permission_profile)
+        else {
+            tracing::warn!(
+                id = %active_permission_profile.id,
+                "{log_message}: unsupported active permission profile"
+            );
+            self.chat_widget.add_error_message(format!(
+                "{user_message_prefix}: unsupported active permission profile `{}`",
+                active_permission_profile.id
+            ));
+            return None;
+        };
+
         if let Err(err) = config
             .permissions
-            .set_permission_profile(permission_profile)
+            .set_permission_profile_from_session_snapshot(PermissionProfileSnapshot::active(
+                permission_profile.clone(),
+                active_permission_profile,
+            ))
         {
             tracing::warn!(error = %err, "{log_message}");
             self.chat_widget
                 .add_error_message(format!("{user_message_prefix}: {err}"));
-            return false;
+            return None;
         }
 
-        true
+        Some(permission_profile)
     }
 
     pub(super) async fn update_feature_flags(&mut self, updates: Vec<(Feature, bool)>) {
@@ -148,6 +166,7 @@ impl App {
         let mut approval_policy_override = None;
         let mut approvals_reviewer_override = None;
         let mut permission_profile_override = None;
+        let mut active_permission_profile_override = None;
         let mut feature_updates_to_apply = Vec::with_capacity(updates.len());
         // Auto-Review owns `approvals_reviewer`, but disabling the feature
         // from inside a profile should not silently clear a value configured at
@@ -170,7 +189,7 @@ impl App {
             (root_blocks_disable, profile_configured)
         };
         let mut permissions_history_label: Option<&'static str> = None;
-        let mut builder = ConfigEditsBuilder::new(&self.config.codex_home)
+        let mut builder = ConfigEditsBuilder::for_config(&self.config)
             .with_profile(self.active_profile.as_deref());
 
         for (feature, enabled) in updates {
@@ -239,14 +258,16 @@ impl App {
                 ) {
                     continue;
                 }
-                if !self.try_set_permission_profile_on_config(
-                    &mut feature_config,
-                    auto_review_preset.permission_profile.clone(),
-                    "Failed to enable Auto-review",
-                    "failed to set auto-review permission profile on staged config",
-                ) {
+                let Some(permission_profile) = self
+                    .try_set_builtin_active_permission_profile_on_config(
+                        &mut feature_config,
+                        auto_review_preset.active_permission_profile.clone(),
+                        "Failed to enable Auto-review",
+                        "failed to set auto-review permission profile on staged config",
+                    )
+                else {
                     continue;
-                }
+                };
                 feature_edits.extend([
                     ConfigEdit::SetPath {
                         segments: scoped_segments("approval_policy"),
@@ -258,7 +279,9 @@ impl App {
                     },
                 ]);
                 approval_policy_override = Some(auto_review_preset.approval_policy);
-                permission_profile_override = Some(auto_review_preset.permission_profile.clone());
+                permission_profile_override = Some(permission_profile);
+                active_permission_profile_override =
+                    Some(auto_review_preset.active_permission_profile.clone());
             }
             next_config = feature_config;
             feature_updates_to_apply.push((feature, effective_enabled));
@@ -298,10 +321,18 @@ impl App {
                 self.config.permissions.approval_policy.value(),
             ));
         }
-        if permission_profile_override.is_some()
+        let permission_profile_override_value = permission_profile_override
+            .is_some()
+            .then(|| self.config.permissions.permission_profile().clone());
+        if let Some(permission_profile) = permission_profile_override_value.as_ref()
             && let Err(err) = self
                 .chat_widget
-                .set_permission_profile(self.config.permissions.permission_profile())
+                .set_permission_profile_from_session_snapshot(
+                    PermissionProfileSnapshot::from_session_snapshot(
+                        permission_profile.clone(),
+                        active_permission_profile_override.clone(),
+                    ),
+                )
         {
             tracing::error!(
                 error = %err,
@@ -310,9 +341,8 @@ impl App {
             self.chat_widget
                 .add_error_message(format!("Failed to enable Auto-review: {err}"));
         }
-        if permission_profile_override.is_some() {
-            self.runtime_permission_profile_override =
-                Some(self.config.permissions.permission_profile());
+        if let Some(permission_profile) = permission_profile_override_value {
+            self.runtime_permission_profile_override = Some(permission_profile);
         }
 
         if approval_policy_override.is_some()
@@ -330,7 +360,7 @@ impl App {
                 /*cwd*/ None,
                 approval_policy_override,
                 approvals_reviewer_override,
-                permission_profile_override,
+                active_permission_profile_override,
                 /*windows_sandbox_level*/ None,
                 /*model*/ None,
                 /*effort*/ None,
@@ -357,7 +387,7 @@ impl App {
                         /*cwd*/ None,
                         /*approval_policy*/ None,
                         /*approvals_reviewer*/ None,
-                        /*permission_profile*/ None,
+                        /*active_permission_profile*/ None,
                         #[cfg(target_os = "windows")]
                         Some(windows_sandbox_level),
                         /*model*/ None,
@@ -407,7 +437,7 @@ impl App {
             },
         ];
 
-        if let Err(err) = ConfigEditsBuilder::new(&self.config.codex_home)
+        if let Err(err) = ConfigEditsBuilder::for_config(&self.config)
             .with_edits(edits)
             .apply()
             .await
@@ -559,6 +589,7 @@ mod tests {
     use super::*;
     use crate::app::test_support::app_enabled_in_effective_config;
     use crate::app::test_support::make_test_app;
+    use crate::legacy_core::config::edit::ConfigEdit;
     use crate::test_support::PathBufExt;
     use codex_protocol::models::PermissionProfile;
     use pretty_assertions::assert_eq;
@@ -591,7 +622,7 @@ mod tests {
 
         assert_eq!(app_enabled_in_effective_config(&app.config, &app_id), None);
 
-        ConfigEditsBuilder::new(&app.config.codex_home)
+        ConfigEditsBuilder::for_config(&app.config)
             .with_edits([
                 ConfigEdit::SetPath {
                     segments: vec!["apps".to_string(), app_id.clone(), "enabled".to_string()],
@@ -658,6 +689,7 @@ mod tests {
                 permission_profile: PermissionProfile::read_only(),
                 active_permission_profile: None,
                 cwd: next_cwd.clone().abs(),
+                runtime_workspace_roots: Vec::new(),
                 instruction_source_paths: Vec::new(),
                 reasoning_effort: None,
                 message_history: None,
diff --git a/codex-rs/tui/src/app/event_dispatch.rs b/codex-rs/tui/src/app/event_dispatch.rs
index 1d2df3db16..987c9490d7 100644
--- a/codex-rs/tui/src/app/event_dispatch.rs
+++ b/codex-rs/tui/src/app/event_dispatch.rs
@@ -152,7 +152,7 @@ impl App {
                                         if let Some(usage_line) = summary.usage_line {
                                             lines.push(usage_line.into());
                                         }
-                                        if let Some(command) = summary.resume_command {
+                                        if let Some(command) = summary.resume_hint {
                                             let spans = vec![
                                                 "To continue this session, run ".into(),
                                                 command.cyan(),
@@ -296,10 +296,14 @@ impl App {
                 self.chat_widget.on_commit_tick();
             }
             AppEvent::Exit(mode) => {
+                if mode == ExitMode::ShutdownFirst {
+                    self.show_shutdown_feedback(tui)?;
+                }
                 return Ok(self.handle_exit_mode(app_server, mode).await);
             }
             AppEvent::Logout => match app_server.logout_account().await {
                 Ok(()) => {
+                    self.show_shutdown_feedback(tui)?;
                     return Ok(self
                         .handle_exit_mode(app_server, ExitMode::ShutdownFirst)
                         .await);
@@ -416,6 +420,9 @@ impl App {
             AppEvent::RefreshConnectors { force_refetch } => {
                 self.chat_widget.refresh_connectors(force_refetch);
             }
+            AppEvent::FetchConnectorsList { force_refetch } => {
+                self.fetch_connectors_list(app_server, force_refetch);
+            }
             AppEvent::PluginInstallAuthAdvance { refresh_connectors } => {
                 if refresh_connectors {
                     self.chat_widget.refresh_connectors(/*force_refetch*/ true);
@@ -756,9 +763,6 @@ impl App {
             AppEvent::UpdateModel(model) => {
                 self.chat_widget.set_model(&model);
             }
-            AppEvent::UpdateCollaborationMode(mask) => {
-                self.chat_widget.set_collaboration_mask(mask);
-            }
             AppEvent::UpdatePersonality(personality) => {
                 self.on_update_personality(personality);
             }
@@ -1082,7 +1086,7 @@ impl App {
                     }
                     let profile = self.active_profile.as_deref();
                     let elevated_enabled = matches!(mode, WindowsSandboxEnableMode::Elevated);
-                    let builder = ConfigEditsBuilder::new(&self.config.codex_home)
+                    let builder = ConfigEditsBuilder::for_config(&self.config)
                         .with_profile(profile)
                         .set_windows_sandbox_mode(if elevated_enabled {
                             "elevated"
@@ -1114,7 +1118,7 @@ impl App {
                                         /*cwd*/ None,
                                         /*approval_policy*/ None,
                                         /*approvals_reviewer*/ None,
-                                        /*permission_profile*/ None,
+                                        /*active_permission_profile*/ None,
                                         #[cfg(target_os = "windows")]
                                         Some(windows_sandbox_level),
                                         /*model*/ None,
@@ -1139,7 +1143,7 @@ impl App {
                                         /*cwd*/ None,
                                         Some(AskForApproval::from(preset.approval)),
                                         Some(self.config.approvals_reviewer),
-                                        Some(preset.permission_profile.clone()),
+                                        Some(preset.active_permission_profile.clone()),
                                         #[cfg(target_os = "windows")]
                                         Some(windows_sandbox_level),
                                         /*model*/ None,
@@ -1153,9 +1157,10 @@ impl App {
                                 self.app_event_tx.send(AppEvent::UpdateAskForApprovalPolicy(
                                     AskForApproval::from(preset.approval),
                                 ));
-                                self.app_event_tx.send(AppEvent::UpdatePermissionProfile(
-                                    preset.permission_profile.clone(),
-                                ));
+                                self.app_event_tx
+                                    .send(AppEvent::UpdateActivePermissionProfile(
+                                        preset.active_permission_profile.clone(),
+                                    ));
                                 let _ = mode;
                                 self.chat_widget.add_plain_history_lines(vec![
                                     Line::from(vec!["• ".dim(), "Sandbox ready".into()]),
@@ -1185,11 +1190,15 @@ impl App {
             }
             AppEvent::PersistModelSelection { model, effort } => {
                 let profile = self.active_profile.as_deref();
-                match ConfigEditsBuilder::new(&self.config.codex_home)
-                    .with_profile(profile)
-                    .set_model(Some(model.as_str()), effort)
-                    .apply()
-                    .await
+                match crate::config_update::write_config_batch(
+                    app_server.request_handle(),
+                    crate::config_update::build_model_selection_edits(
+                        profile,
+                        model.as_str(),
+                        effort,
+                    ),
+                )
+                .await
                 {
                     Ok(()) => {
                         let effort_label = effort
@@ -1253,7 +1262,7 @@ impl App {
                 }
             }
             AppEvent::RefreshPluginMentions => {
-                self.refresh_plugin_mentions();
+                self.refresh_plugin_mentions(app_server);
             }
             AppEvent::PluginMentionsLoaded { mut plugins } => {
                 if !self.config.features.enabled(Feature::Plugins) {
@@ -1263,11 +1272,14 @@ impl App {
             }
             AppEvent::PersistPersonalitySelection { personality } => {
                 let profile = self.active_profile.as_deref();
-                match ConfigEditsBuilder::new(&self.config.codex_home)
-                    .with_profile(profile)
-                    .set_personality(Some(personality))
-                    .apply()
-                    .await
+                match crate::config_update::write_config_batch(
+                    app_server.request_handle(),
+                    vec![crate::config_update::replace_config_value(
+                        crate::config_update::profile_scoped_key_path(profile, "personality"),
+                        serde_json::json!(personality.to_string()),
+                    )],
+                )
+                .await
                 {
                     Ok(()) => {
                         let label = Self::personality_label(personality);
@@ -1298,16 +1310,20 @@ impl App {
             }
             AppEvent::PersistServiceTierSelection { service_tier } => {
                 self.refresh_status_line();
-                let profile = self.active_profile.as_deref();
                 self.config.service_tier = service_tier.clone();
-                let mut edits = ConfigEditsBuilder::new(&self.config.codex_home)
-                    .with_profile(profile)
-                    .set_service_tier(service_tier.clone());
+                self.sync_active_thread_service_tier_to_cached_session()
+                    .await;
+                let profile = self.active_profile.as_deref();
+                let edits = crate::config_update::build_service_tier_selection_edits(
+                    profile,
+                    service_tier.as_deref(),
+                );
                 if service_tier.is_none() {
                     self.config.notices.fast_default_opt_out = Some(true);
-                    edits = edits.set_fast_default_opt_out(/*opted_out*/ true);
                 }
-                match edits.apply().await {
+                match crate::config_update::write_config_batch(app_server.request_handle(), edits)
+                    .await
+                {
                     Ok(()) => {
                         let mut message = if let Some(service_tier) = service_tier {
                             format!("Service tier set to {service_tier}")
@@ -1338,11 +1354,11 @@ impl App {
             AppEvent::PersistRealtimeAudioDeviceSelection { kind, name } => {
                 let builder = match kind {
                     RealtimeAudioDeviceKind::Microphone => {
-                        ConfigEditsBuilder::new(&self.config.codex_home)
+                        ConfigEditsBuilder::for_config(&self.config)
                             .set_realtime_microphone(name.as_deref())
                     }
                     RealtimeAudioDeviceKind::Speaker => {
-                        ConfigEditsBuilder::new(&self.config.codex_home)
+                        ConfigEditsBuilder::for_config(&self.config)
                             .set_realtime_speaker(name.as_deref())
                     }
                 };
@@ -1403,25 +1419,32 @@ impl App {
                 self.sync_active_thread_permission_settings_to_cached_session()
                     .await;
             }
-            AppEvent::UpdatePermissionProfile(permission_profile) => {
+            AppEvent::UpdateActivePermissionProfile(active_permission_profile) => {
+                let mut config = self.config.clone();
+                let Some(permission_profile) = self
+                    .try_set_builtin_active_permission_profile_on_config(
+                        &mut config,
+                        active_permission_profile.clone(),
+                        "Failed to set permission profile",
+                        "failed to set active permission profile on app config",
+                    )
+                else {
+                    return Ok(AppRunControl::Continue);
+                };
                 #[cfg(target_os = "windows")]
                 let permission_profile_is_managed_restricted =
                     managed_filesystem_sandbox_is_restricted(&permission_profile);
                 let permission_profile_for_chat = permission_profile.clone();
 
-                let mut config = self.config.clone();
-                if !self.try_set_permission_profile_on_config(
-                    &mut config,
-                    permission_profile,
-                    "Failed to set permission profile",
-                    "failed to set permission profile on app config",
-                ) {
-                    return Ok(AppRunControl::Continue);
-                }
                 self.config = config;
                 if let Err(err) = self
                     .chat_widget
-                    .set_permission_profile(permission_profile_for_chat)
+                    .set_permission_profile_from_session_snapshot(
+                        PermissionProfileSnapshot::active(
+                            permission_profile_for_chat,
+                            active_permission_profile,
+                        ),
+                    )
                 {
                     tracing::warn!(%err, "failed to set permission profile on chat config");
                     self.chat_widget
@@ -1429,7 +1452,7 @@ impl App {
                     return Ok(AppRunControl::Continue);
                 }
                 self.runtime_permission_profile_override =
-                    Some(self.config.permissions.permission_profile());
+                    Some(self.config.permissions.permission_profile().clone());
                 self.sync_active_thread_permission_settings_to_cached_session()
                     .await;
 
@@ -1453,7 +1476,8 @@ impl App {
                             std::env::vars().collect();
                         let tx = self.app_event_tx.clone();
                         let logs_base_dir = self.config.codex_home.clone();
-                        let permission_profile = self.config.permissions.permission_profile();
+                        let permission_profile =
+                            self.config.permissions.effective_permission_profile();
                         Self::spawn_world_writable_scan(
                             cwd,
                             env_map,
@@ -1470,23 +1494,17 @@ impl App {
                 self.sync_active_thread_permission_settings_to_cached_session()
                     .await;
                 let profile = self.active_profile.as_deref();
-                let segments = if let Some(profile) = profile {
-                    vec![
-                        "profiles".to_string(),
-                        profile.to_string(),
-                        "approvals_reviewer".to_string(),
-                    ]
-                } else {
-                    vec!["approvals_reviewer".to_string()]
-                };
-                if let Err(err) = ConfigEditsBuilder::new(&self.config.codex_home)
-                    .with_profile(profile)
-                    .with_edits([ConfigEdit::SetPath {
-                        segments,
-                        value: policy.to_string().into(),
-                    }])
-                    .apply()
-                    .await
+                if let Err(err) = crate::config_update::write_config_batch(
+                    app_server.request_handle(),
+                    vec![crate::config_update::replace_config_value(
+                        crate::config_update::profile_scoped_key_path(
+                            profile,
+                            "approvals_reviewer",
+                        ),
+                        serde_json::json!(policy.to_string()),
+                    )],
+                )
+                .await
                 {
                     tracing::error!(
                         error = %err,
@@ -1531,7 +1549,7 @@ impl App {
                 self.chat_widget.set_plan_mode_reasoning_effort(effort);
             }
             AppEvent::PersistFullAccessWarningAcknowledged => {
-                if let Err(err) = ConfigEditsBuilder::new(&self.config.codex_home)
+                if let Err(err) = ConfigEditsBuilder::for_config(&self.config)
                     .set_hide_full_access_warning(/*acknowledged*/ true)
                     .apply()
                     .await
@@ -1546,7 +1564,7 @@ impl App {
                 }
             }
             AppEvent::PersistWorldWritableWarningAcknowledged => {
-                if let Err(err) = ConfigEditsBuilder::new(&self.config.codex_home)
+                if let Err(err) = ConfigEditsBuilder::for_config(&self.config)
                     .set_hide_world_writable_warning(/*acknowledged*/ true)
                     .apply()
                     .await
@@ -1561,7 +1579,7 @@ impl App {
                 }
             }
             AppEvent::PersistRateLimitSwitchPromptHidden => {
-                if let Err(err) = ConfigEditsBuilder::new(&self.config.codex_home)
+                if let Err(err) = ConfigEditsBuilder::for_config(&self.config)
                     .set_hide_rate_limit_model_nudge(/*acknowledged*/ true)
                     .apply()
                     .await
@@ -1577,27 +1595,23 @@ impl App {
             }
             AppEvent::PersistPlanModeReasoningEffort(effort) => {
                 let profile = self.active_profile.as_deref();
-                let segments = if let Some(profile) = profile {
-                    vec![
-                        "profiles".to_string(),
-                        profile.to_string(),
-                        "plan_mode_reasoning_effort".to_string(),
-                    ]
-                } else {
-                    vec!["plan_mode_reasoning_effort".to_string()]
-                };
+                let key_path = crate::config_update::profile_scoped_key_path(
+                    profile,
+                    "plan_mode_reasoning_effort",
+                );
                 let edit = if let Some(effort) = effort {
-                    ConfigEdit::SetPath {
-                        segments,
-                        value: effort.to_string().into(),
-                    }
+                    crate::config_update::replace_config_value(
+                        key_path,
+                        serde_json::json!(effort.to_string()),
+                    )
                 } else {
-                    ConfigEdit::ClearPath { segments }
+                    crate::config_update::clear_config_value(key_path)
                 };
-                if let Err(err) = ConfigEditsBuilder::new(&self.config.codex_home)
-                    .with_edits([edit])
-                    .apply()
-                    .await
+                if let Err(err) = crate::config_update::write_config_batch(
+                    app_server.request_handle(),
+                    vec![edit],
+                )
+                .await
                 {
                     tracing::error!(
                         error = %err,
@@ -1618,7 +1632,7 @@ impl App {
                 from_model,
                 to_model,
             } => {
-                if let Err(err) = ConfigEditsBuilder::new(&self.config.codex_home)
+                if let Err(err) = ConfigEditsBuilder::for_config(&self.config)
                     .record_model_migration_seen(from_model.as_str(), to_model.as_str())
                     .apply()
                     .await
@@ -1657,18 +1671,18 @@ impl App {
                 self.chat_widget.open_manage_skills_popup();
             }
             AppEvent::SetSkillEnabled { path, enabled } => {
-                let edits = [ConfigEdit::SetSkillConfig {
-                    path: path.to_path_buf(),
+                match crate::config_update::write_skill_enabled(
+                    app_server.request_handle(),
+                    path.clone(),
                     enabled,
-                }];
-                match ConfigEditsBuilder::new(&self.config.codex_home)
-                    .with_edits(edits)
-                    .apply()
-                    .await
+                )
+                .await
                 {
                     Ok(()) => {
                         self.chat_widget.update_skill_enabled(path, enabled);
-                        if let Err(err) = self.refresh_in_memory_config_from_disk().await {
+                        if !app_server.is_remote()
+                            && let Err(err) = self.refresh_in_memory_config_from_disk().await
+                        {
                             tracing::warn!(
                                 error = %err,
                                 "failed to refresh config after skill toggle"
@@ -1686,44 +1700,35 @@ impl App {
             AppEvent::SetAppEnabled { id, enabled } => {
                 let edits = if enabled {
                     vec![
-                        ConfigEdit::ClearPath {
-                            segments: vec!["apps".to_string(), id.clone(), "enabled".to_string()],
-                        },
-                        ConfigEdit::ClearPath {
-                            segments: vec![
-                                "apps".to_string(),
-                                id.clone(),
-                                "disabled_reason".to_string(),
-                            ],
-                        },
+                        crate::config_update::clear_config_value(
+                            crate::config_update::app_scoped_key_path(&id, "enabled"),
+                        ),
+                        crate::config_update::clear_config_value(
+                            crate::config_update::app_scoped_key_path(&id, "disabled_reason"),
+                        ),
                     ]
                 } else {
                     vec![
-                        ConfigEdit::SetPath {
-                            segments: vec!["apps".to_string(), id.clone(), "enabled".to_string()],
-                            value: false.into(),
-                        },
-                        ConfigEdit::SetPath {
-                            segments: vec![
-                                "apps".to_string(),
-                                id.clone(),
-                                "disabled_reason".to_string(),
-                            ],
-                            value: "user".into(),
-                        },
+                        crate::config_update::replace_config_value(
+                            crate::config_update::app_scoped_key_path(&id, "enabled"),
+                            serde_json::json!(false),
+                        ),
+                        crate::config_update::replace_config_value(
+                            crate::config_update::app_scoped_key_path(&id, "disabled_reason"),
+                            serde_json::json!("user"),
+                        ),
                     ]
                 };
-                match ConfigEditsBuilder::new(&self.config.codex_home)
-                    .with_edits(edits)
-                    .apply()
+                match crate::config_update::write_config_batch(app_server.request_handle(), edits)
                     .await
                 {
-                    Ok(()) => {
+                    Ok(_) => {
                         self.chat_widget.update_connector_enabled(&id, enabled);
-                        if let Err(err) = self.refresh_in_memory_config_from_disk().await {
+                        if !app_server.is_remote()
+                            && let Err(err) = self.refresh_in_memory_config_from_disk().await
+                        {
                             tracing::warn!(error = %err, "failed to refresh config after app toggle");
                         }
-                        self.chat_widget.submit_op(AppCommand::reload_user_config());
                     }
                     Err(err) => {
                         self.chat_widget.add_error_message(format!(
@@ -1876,7 +1881,7 @@ impl App {
                 let items_edit = crate::legacy_core::config::edit::status_line_items_edit(&ids);
                 let colors_edit =
                     crate::legacy_core::config::edit::status_line_use_colors_edit(use_theme_colors);
-                let apply_result = ConfigEditsBuilder::new(&self.config.codex_home)
+                let apply_result = ConfigEditsBuilder::for_config(&self.config)
                     .with_edits([items_edit, colors_edit])
                     .apply()
                     .await;
@@ -1908,7 +1913,7 @@ impl App {
             AppEvent::TerminalTitleSetup { items } => {
                 let ids = items.iter().map(ToString::to_string).collect::<Vec<_>>();
                 let edit = crate::legacy_core::config::edit::terminal_title_items_edit(&ids);
-                let apply_result = ConfigEditsBuilder::new(&self.config.codex_home)
+                let apply_result = ConfigEditsBuilder::for_config(&self.config)
                     .with_edits([edit])
                     .apply()
                     .await;
@@ -1934,7 +1939,7 @@ impl App {
             }
             AppEvent::SyntaxThemeSelected { name } => {
                 let edit = crate::legacy_core::config::edit::syntax_theme_edit(&name);
-                let apply_result = ConfigEditsBuilder::new(&self.config.codex_home)
+                let apply_result = ConfigEditsBuilder::for_config(&self.config)
                     .with_edits([edit])
                     .apply()
                     .await;
@@ -2046,7 +2051,7 @@ impl App {
 
         let edit =
             crate::legacy_core::config::edit::keymap_bindings_edit(&context, &action, &bindings);
-        match ConfigEditsBuilder::new(&self.config.codex_home)
+        match ConfigEditsBuilder::for_config(&self.config)
             .with_edits([edit])
             .apply()
             .await
@@ -2091,7 +2096,7 @@ impl App {
         };
 
         let edit = crate::legacy_core::config::edit::keymap_binding_clear_edit(&context, &action);
-        match ConfigEditsBuilder::new(&self.config.codex_home)
+        match ConfigEditsBuilder::for_config(&self.config)
             .with_edits([edit])
             .apply()
             .await
diff --git a/codex-rs/tui/src/app/input.rs b/codex-rs/tui/src/app/input.rs
index 905f62f86f..f6530cad26 100644
--- a/codex-rs/tui/src/app/input.rs
+++ b/codex-rs/tui/src/app/input.rs
@@ -5,6 +5,9 @@
 
 use super::*;
 
+const SIDE_EDIT_PREVIOUS_UNAVAILABLE_MESSAGE: &str =
+    "Editing previous prompts is unavailable in side conversations.";
+
 impl App {
     pub(super) async fn launch_external_editor(&mut self, tui: &mut tui::Tui) {
         let editor_cmd = match external_editor::resolve_editor_command() {
@@ -197,6 +200,8 @@ impl App {
             // handles it.
             if self.should_handle_backtrack_esc(key_event) {
                 self.handle_backtrack_esc_key(tui);
+            } else if self.should_reject_side_backtrack_esc(key_event) {
+                self.reject_side_backtrack_esc();
             } else {
                 self.chat_widget.handle_key_event(key_event);
             }
@@ -252,11 +257,25 @@ impl App {
     }
 
     pub(super) fn should_handle_backtrack_esc(&self, key_event: KeyEvent) -> bool {
-        self.chat_widget.is_normal_backtrack_mode()
+        !self.chat_widget.side_conversation_active()
+            && self.chat_widget.is_normal_backtrack_mode()
             && self.chat_widget.composer_is_empty()
             && !self.chat_widget.should_handle_vim_insert_escape(key_event)
     }
 
+    pub(super) fn should_reject_side_backtrack_esc(&self, key_event: KeyEvent) -> bool {
+        self.chat_widget.side_conversation_active()
+            && self.chat_widget.is_normal_backtrack_mode()
+            && self.chat_widget.composer_is_empty()
+            && !self.chat_widget.should_handle_vim_insert_escape(key_event)
+    }
+
+    pub(super) fn reject_side_backtrack_esc(&mut self) {
+        self.reset_backtrack_state();
+        self.chat_widget
+            .add_error_message(SIDE_EDIT_PREVIOUS_UNAVAILABLE_MESSAGE.to_string());
+    }
+
     fn app_keymap_shortcuts_available(&self) -> bool {
         self.overlay.is_none() && self.chat_widget.no_modal_or_popup_active()
     }
diff --git a/codex-rs/tui/src/app/pets.rs b/codex-rs/tui/src/app/pets.rs
index fe6e90673b..eef38b894e 100644
--- a/codex-rs/tui/src/app/pets.rs
+++ b/codex-rs/tui/src/app/pets.rs
@@ -3,6 +3,22 @@
 use super::*;
 
 impl App {
+    pub(super) fn disable_ambient_pet_before_shutdown(&mut self, tui: &mut tui::Tui) -> Result<()> {
+        self.chat_widget.disable_ambient_pet_for_session();
+        if let Err(clear_err) = tui.clear_ambient_pet_image() {
+            match clear_err {
+                crate::pets::PetImageRenderError::Terminal(err) => return Err(err.into()),
+                crate::pets::PetImageRenderError::Asset(err) => {
+                    tracing::warn!(
+                        error = %err,
+                        "failed to clear ambient pet image before shutdown feedback"
+                    );
+                }
+            }
+        }
+        Ok(())
+    }
+
     pub(super) fn handle_ambient_pet_image_render_error(
         &mut self,
         tui: &mut tui::Tui,
diff --git a/codex-rs/tui/src/app/platform_actions.rs b/codex-rs/tui/src/app/platform_actions.rs
index f19ed0bb60..11289bc2aa 100644
--- a/codex-rs/tui/src/app/platform_actions.rs
+++ b/codex-rs/tui/src/app/platform_actions.rs
@@ -54,24 +54,16 @@ fn send_world_writable_scan_failed(tx: &AppEventSender) {
 }
 
 pub(super) fn side_return_shortcut_matches(key_event: KeyEvent) -> bool {
-    match key_event {
-        KeyEvent {
-            code: KeyCode::Esc,
-            kind: KeyEventKind::Press | KeyEventKind::Repeat,
-            ..
-        } => true,
+    matches!(
+        key_event,
         KeyEvent {
             code: KeyCode::Char(c),
             modifiers,
             kind: KeyEventKind::Press,
             ..
         } if modifiers.contains(KeyModifiers::CONTROL)
-            && (c.eq_ignore_ascii_case(&'c') || c.eq_ignore_ascii_case(&'d')) =>
-        {
-            true
-        }
-        _ => false,
-    }
+            && (c.eq_ignore_ascii_case(&'c') || c.eq_ignore_ascii_case(&'d'))
+    )
 }
 
 #[cfg(test)]
@@ -79,16 +71,7 @@ mod tests {
     use super::*;
 
     #[test]
-    fn side_return_shortcuts_match_esc_ctrl_c_and_ctrl_d() {
-        assert!(side_return_shortcut_matches(KeyEvent::new(
-            KeyCode::Esc,
-            KeyModifiers::NONE,
-        )));
-        assert!(side_return_shortcut_matches(KeyEvent::new_with_kind(
-            KeyCode::Esc,
-            KeyModifiers::NONE,
-            KeyEventKind::Repeat,
-        )));
+    fn side_return_shortcuts_match_ctrl_c_and_ctrl_d() {
         assert!(side_return_shortcut_matches(KeyEvent::new(
             KeyCode::Char('c'),
             KeyModifiers::CONTROL,
@@ -105,6 +88,11 @@ mod tests {
             KeyCode::Char('D'),
             KeyModifiers::CONTROL,
         )));
+        assert!(!side_return_shortcut_matches(KeyEvent::new_with_kind(
+            KeyCode::Esc,
+            KeyModifiers::NONE,
+            KeyEventKind::Press,
+        )));
         assert!(!side_return_shortcut_matches(KeyEvent::new_with_kind(
             KeyCode::Esc,
             KeyModifiers::NONE,
diff --git a/codex-rs/tui/src/app/plugin_mentions.rs b/codex-rs/tui/src/app/plugin_mentions.rs
new file mode 100644
index 0000000000..ef300896bc
--- /dev/null
+++ b/codex-rs/tui/src/app/plugin_mentions.rs
@@ -0,0 +1,147 @@
+//! Plugin mention capability enrichment for the TUI.
+//!
+//! Mention inventory comes from app-server `plugin/list`, while mention eligibility still reuses
+//! the older local bulk capability summaries. That keeps the feature app-server-shaped without
+//! paying for a `plugin/read` per plugin.
+
+use super::background_requests::request_plugin_list;
+use super::*;
+use codex_app_server_protocol::PluginListResponse;
+use codex_app_server_protocol::PluginMarketplaceEntry;
+use codex_app_server_protocol::PluginSummary;
+use codex_core_plugins::PluginsManager;
+use codex_plugin::PluginCapabilitySummary;
+use std::collections::HashMap;
+
+#[derive(Debug, Clone)]
+struct PluginMentionEntry {
+    config_name: String,
+    display_name: String,
+    description: Option<String>,
+}
+
+impl PluginMentionEntry {
+    fn capability_summary(
+        self,
+        capabilities_by_config_name: &HashMap<String, PluginCapabilitySummary>,
+    ) -> Option<PluginCapabilitySummary> {
+        let capabilities = capabilities_by_config_name.get(&self.config_name)?;
+        Some(PluginCapabilitySummary {
+            config_name: self.config_name,
+            display_name: self.display_name,
+            description: self.description,
+            has_skills: capabilities.has_skills,
+            mcp_server_names: capabilities.mcp_server_names.clone(),
+            app_connector_ids: capabilities.app_connector_ids.clone(),
+        })
+    }
+}
+
+pub(super) async fn fetch_plugin_mentions(
+    request_handle: AppServerRequestHandle,
+    config: crate::legacy_core::config::Config,
+) -> Result<Vec<PluginCapabilitySummary>> {
+    let response = request_plugin_list(request_handle, config.cwd.to_path_buf()).await?;
+    let mention_entries = plugin_mention_entries_from_list_response(response);
+    let capabilities_by_config_name = load_plugin_mention_capabilities(&config).await;
+
+    Ok(mention_entries
+        .into_iter()
+        .filter_map(|entry| entry.capability_summary(&capabilities_by_config_name))
+        .collect())
+}
+
+async fn load_plugin_mention_capabilities(
+    config: &crate::legacy_core::config::Config,
+) -> HashMap<String, PluginCapabilitySummary> {
+    let plugins_input = config.plugins_config_input();
+    PluginsManager::new(config.codex_home.to_path_buf())
+        .plugins_for_config(&plugins_input)
+        .await
+        .capability_summaries()
+        .iter()
+        .cloned()
+        .map(|summary| (summary.config_name.clone(), summary))
+        .collect()
+}
+
+fn plugin_mention_entries_from_list_response(
+    response: PluginListResponse,
+) -> Vec<PluginMentionEntry> {
+    response
+        .marketplaces
+        .into_iter()
+        .flat_map(plugin_mention_entries_from_marketplace)
+        .collect()
+}
+
+fn plugin_mention_entries_from_marketplace(
+    marketplace: PluginMarketplaceEntry,
+) -> Vec<PluginMentionEntry> {
+    let marketplace_name = marketplace.name;
+    marketplace
+        .plugins
+        .into_iter()
+        .filter_map(|plugin| plugin_mention_entry(&marketplace_name, plugin))
+        .collect()
+}
+
+fn plugin_mention_entry(
+    marketplace_name: &str,
+    plugin: PluginSummary,
+) -> Option<PluginMentionEntry> {
+    if !plugin_is_eligible_for_mentions(&plugin) {
+        return None;
+    }
+
+    let config_name = plugin_mention_config_name(marketplace_name, &plugin)?;
+    Some(PluginMentionEntry {
+        config_name,
+        display_name: plugin_mention_display_name(&plugin),
+        description: plugin_mention_description(&plugin),
+    })
+}
+
+fn plugin_is_eligible_for_mentions(plugin: &PluginSummary) -> bool {
+    plugin.installed && plugin.enabled
+}
+
+fn plugin_mention_config_name(marketplace_name: &str, plugin: &PluginSummary) -> Option<String> {
+    codex_plugin::PluginId::new(plugin.name.clone(), marketplace_name.to_string())
+        .map(|plugin_id| plugin_id.as_key())
+        .map_err(|err| {
+            tracing::warn!(
+                plugin_name = plugin.name,
+                marketplace_name,
+                error = %err,
+                "skipping plugin mention with invalid identity"
+            );
+        })
+        .ok()
+}
+
+fn plugin_mention_display_name(plugin: &PluginSummary) -> String {
+    plugin
+        .interface
+        .as_ref()
+        .and_then(|interface| interface.display_name.as_deref())
+        .map(str::trim)
+        .filter(|display_name| !display_name.is_empty())
+        .map(str::to_string)
+        .unwrap_or_else(|| plugin.name.clone())
+}
+
+fn plugin_mention_description(plugin: &PluginSummary) -> Option<String> {
+    plugin
+        .interface
+        .as_ref()
+        .and_then(|interface| {
+            interface
+                .short_description
+                .as_deref()
+                .or(interface.long_description.as_deref())
+        })
+        .map(str::trim)
+        .filter(|description| !description.is_empty())
+        .map(str::to_string)
+}
diff --git a/codex-rs/tui/src/app/session_lifecycle.rs b/codex-rs/tui/src/app/session_lifecycle.rs
index 75af2f1da9..1a57b596b0 100644
--- a/codex-rs/tui/src/app/session_lifecycle.rs
+++ b/codex-rs/tui/src/app/session_lifecycle.rs
@@ -473,7 +473,7 @@ impl App {
                     if let Some(usage_line) = summary.usage_line {
                         lines.push(usage_line.into());
                     }
-                    if let Some(command) = summary.resume_command {
+                    if let Some(command) = summary.resume_hint {
                         let spans = vec!["To continue this session, run ".into(), command.cyan()];
                         lines.push(spans.into());
                     }
@@ -701,7 +701,7 @@ impl App {
                             if let Some(usage_line) = summary.usage_line {
                                 lines.push(usage_line.into());
                             }
-                            if let Some(command) = summary.resume_command {
+                            if let Some(command) = summary.resume_hint {
                                 let spans =
                                     vec!["To continue this session, run ".into(), command.cyan()];
                                 lines.push(spans.into());
diff --git a/codex-rs/tui/src/app/side.rs b/codex-rs/tui/src/app/side.rs
index 6414e61047..044cb9b391 100644
--- a/codex-rs/tui/src/app/side.rs
+++ b/codex-rs/tui/src/app/side.rs
@@ -20,7 +20,7 @@ const SIDE_NO_STARTED_CONVERSATION_MESSAGE: &str = concat!(
     "Send a message first, then try /side again."
 );
 const SIDE_ALREADY_OPEN_MESSAGE: &str =
-    "A side conversation is already open. Press Esc to return before starting another.";
+    "A side conversation is already open. Press Ctrl+C to return before starting another.";
 const SIDE_BOUNDARY_PROMPT: &str = r#"Side conversation boundary.
 
 Everything before this boundary is inherited history from the parent thread. It is reference context only. It is not your current task.
@@ -247,7 +247,7 @@ impl App {
         if let Some(parent_status) = parent_status {
             label_parts.push(parent_status.label(parent_is_main).to_string());
         }
-        label_parts.push("Esc to return".to_string());
+        label_parts.push("Ctrl+C to return".to_string());
         self.chat_widget
             .set_side_conversation_context_label(Some(format!("Side {}", label_parts.join(" · "))));
     }
diff --git a/codex-rs/tui/src/app/startup_prompts.rs b/codex-rs/tui/src/app/startup_prompts.rs
index 41972e6751..802cda3f80 100644
--- a/codex-rs/tui/src/app/startup_prompts.rs
+++ b/codex-rs/tui/src/app/startup_prompts.rs
@@ -66,9 +66,9 @@ pub(super) fn emit_project_config_warnings(app_event_tx: &AppEventSender, config
 }
 
 pub(super) fn emit_system_bwrap_warning(app_event_tx: &AppEventSender, config: &Config) {
-    let Some(message) = crate::legacy_core::config::system_bwrap_warning(
-        config.permissions.permission_profile.get(),
-    ) else {
+    let Some(message) =
+        codex_sandboxing::system_bwrap_warning(config.permissions.permission_profile())
+    else {
         return;
     };
 
@@ -209,7 +209,7 @@ pub(super) async fn prepare_startup_tooltip_override(
     let mut updated_shown_count = config.model_availability_nux.shown_count.clone();
     updated_shown_count.insert(tooltip_override.model_slug.clone(), next_count);
 
-    if let Err(err) = ConfigEditsBuilder::new(&config.codex_home)
+    if let Err(err) = ConfigEditsBuilder::for_config(config)
         .set_model_availability_nux_count(&updated_shown_count)
         .apply()
         .await
diff --git a/codex-rs/tui/src/app/test_support.rs b/codex-rs/tui/src/app/test_support.rs
index b52402ab49..a22107c226 100644
--- a/codex-rs/tui/src/app/test_support.rs
+++ b/codex-rs/tui/src/app/test_support.rs
@@ -25,6 +25,7 @@ pub(super) async fn make_test_app() -> App {
         active_profile: None,
         cli_kv_overrides: Vec::new(),
         harness_overrides: ConfigOverrides::default(),
+        loader_overrides: LoaderOverrides::without_managed_config_for_tests(),
         runtime_approval_policy_override: None,
         runtime_permission_profile_override: None,
         file_search,
diff --git a/codex-rs/tui/src/app/tests.rs b/codex-rs/tui/src/app/tests.rs
index ec20fffea3..547f70890c 100644
--- a/codex-rs/tui/src/app/tests.rs
+++ b/codex-rs/tui/src/app/tests.rs
@@ -1,6 +1,8 @@
 //! App-level orchestration tests for the TUI.
 
 mod model_catalog;
+mod session_summary;
+mod startup;
 
 use super::*;
 use crate::app_backtrack::BacktrackSelection;
@@ -26,6 +28,7 @@ use crate::app_command::AppCommand as Op;
 use crate::diff_model::FileChange;
 use crate::legacy_core::config::ConfigBuilder;
 use crate::legacy_core::config::ConfigOverrides;
+use crate::legacy_core::config::PermissionProfileSnapshot;
 use crate::legacy_core::config::TerminalResizeReflowMaxRows;
 use codex_app_server_protocol::AdditionalFileSystemPermissions;
 use codex_app_server_protocol::AdditionalNetworkPermissions;
@@ -127,183 +130,6 @@ async fn handle_mcp_inventory_result_clears_committed_loading_cell() {
     assert_eq!(app.transcript_cells.len(), 0);
 }
 
-#[test]
-fn startup_waiting_gate_is_only_for_fresh_or_exit_session_selection() {
-    assert_eq!(
-        App::should_wait_for_initial_session(&SessionSelection::StartFresh),
-        true
-    );
-    assert_eq!(
-        App::should_wait_for_initial_session(&SessionSelection::Exit),
-        true
-    );
-    assert_eq!(
-        App::should_wait_for_initial_session(&SessionSelection::Resume(
-            crate::resume_picker::SessionTarget {
-                path: Some(PathBuf::from("/tmp/restore")),
-                thread_id: ThreadId::new(),
-            }
-        )),
-        false
-    );
-    assert_eq!(
-        App::should_wait_for_initial_session(&SessionSelection::Fork(
-            crate::resume_picker::SessionTarget {
-                path: Some(PathBuf::from("/tmp/fork")),
-                thread_id: ThreadId::new(),
-            }
-        )),
-        false
-    );
-}
-
-#[test]
-fn startup_paused_goal_prompt_gate_is_only_for_quiet_resume() {
-    let resume = SessionSelection::Resume(crate::resume_picker::SessionTarget {
-        path: Some(PathBuf::from("/tmp/restore")),
-        thread_id: ThreadId::new(),
-    });
-    let fork = SessionSelection::Fork(crate::resume_picker::SessionTarget {
-        path: Some(PathBuf::from("/tmp/fork")),
-        thread_id: ThreadId::new(),
-    });
-    let no_images: Vec<PathBuf> = Vec::new();
-    let initial_images = vec![PathBuf::from("/tmp/image.png")];
-
-    assert!(App::should_prompt_for_paused_goal_after_startup_resume(
-        &resume, &None, &no_images
-    ));
-    assert!(!App::should_prompt_for_paused_goal_after_startup_resume(
-        &resume,
-        &Some("continue from here".to_string()),
-        &no_images
-    ));
-    assert!(!App::should_prompt_for_paused_goal_after_startup_resume(
-        &resume,
-        &None,
-        &initial_images
-    ));
-    assert!(!App::should_prompt_for_paused_goal_after_startup_resume(
-        &SessionSelection::StartFresh,
-        &None,
-        &no_images
-    ));
-    assert!(!App::should_prompt_for_paused_goal_after_startup_resume(
-        &fork, &None, &no_images
-    ));
-}
-
-#[test]
-fn startup_waiting_gate_holds_active_thread_events_until_primary_thread_configured() {
-    let mut wait_for_initial_session =
-        App::should_wait_for_initial_session(&SessionSelection::StartFresh);
-    assert_eq!(wait_for_initial_session, true);
-    assert_eq!(
-        App::should_handle_active_thread_events(
-            wait_for_initial_session,
-            /*has_active_thread_receiver*/ true
-        ),
-        false
-    );
-
-    assert_eq!(
-        App::should_stop_waiting_for_initial_session(
-            wait_for_initial_session,
-            /*primary_thread_id*/ None
-        ),
-        false
-    );
-    if App::should_stop_waiting_for_initial_session(wait_for_initial_session, Some(ThreadId::new()))
-    {
-        wait_for_initial_session = false;
-    }
-    assert_eq!(wait_for_initial_session, false);
-
-    assert_eq!(
-        App::should_handle_active_thread_events(
-            wait_for_initial_session,
-            /*has_active_thread_receiver*/ true
-        ),
-        true
-    );
-}
-
-#[test]
-fn startup_waiting_gate_not_applied_for_resume_or_fork_session_selection() {
-    let wait_for_resume = App::should_wait_for_initial_session(&SessionSelection::Resume(
-        crate::resume_picker::SessionTarget {
-            path: Some(PathBuf::from("/tmp/restore")),
-            thread_id: ThreadId::new(),
-        },
-    ));
-    assert_eq!(
-        App::should_handle_active_thread_events(
-            wait_for_resume,
-            /*has_active_thread_receiver*/ true
-        ),
-        true
-    );
-    let wait_for_fork = App::should_wait_for_initial_session(&SessionSelection::Fork(
-        crate::resume_picker::SessionTarget {
-            path: Some(PathBuf::from("/tmp/fork")),
-            thread_id: ThreadId::new(),
-        },
-    ));
-    assert_eq!(
-        App::should_handle_active_thread_events(
-            wait_for_fork,
-            /*has_active_thread_receiver*/ true
-        ),
-        true
-    );
-}
-
-#[tokio::test]
-async fn ignore_same_thread_resume_reports_noop_for_current_thread() {
-    let (mut app, mut app_event_rx, _op_rx) = make_test_app_with_channels().await;
-    let thread_id = ThreadId::new();
-    let session = test_thread_session(thread_id, test_path_buf("/tmp/project"));
-    app.chat_widget.handle_thread_session(session.clone());
-    app.thread_event_channels.insert(
-        thread_id,
-        ThreadEventChannel::new_with_session(THREAD_EVENT_CHANNEL_CAPACITY, session, Vec::new()),
-    );
-    app.activate_thread_channel(thread_id).await;
-    while app_event_rx.try_recv().is_ok() {}
-
-    let ignored = app.ignore_same_thread_resume(&crate::resume_picker::SessionTarget {
-        path: Some(test_path_buf("/tmp/project")),
-        thread_id,
-    });
-
-    assert!(ignored);
-    let cell = match app_event_rx.try_recv() {
-        Ok(AppEvent::InsertHistoryCell(cell)) => cell,
-        other => panic!("expected info message after same-thread resume, saw {other:?}"),
-    };
-    let rendered = lines_to_single_string(&cell.display_lines(/*width*/ 80));
-    assert!(rendered.contains(&format!(
-        "Already viewing {}.",
-        test_path_display("/tmp/project")
-    )));
-}
-
-#[tokio::test]
-async fn ignore_same_thread_resume_allows_reattaching_displayed_inactive_thread() {
-    let mut app = make_test_app().await;
-    let thread_id = ThreadId::new();
-    let session = test_thread_session(thread_id, test_path_buf("/tmp/project"));
-    app.chat_widget.handle_thread_session(session);
-
-    let ignored = app.ignore_same_thread_resume(&crate::resume_picker::SessionTarget {
-        path: Some(test_path_buf("/tmp/project")),
-        thread_id,
-    });
-
-    assert!(!ignored);
-    assert!(app.transcript_cells.is_empty());
-}
-
 #[test]
 fn bypass_hook_trust_startup_warning_snapshot() {
     let rendered = lines_to_single_string(
@@ -439,7 +265,6 @@ async fn enqueue_primary_thread_session_replays_turns_before_initial_prompt_subm
     let model = crate::legacy_core::test_support::get_model_offline(config.model.as_deref());
     app.chat_widget = ChatWidget::new_with_app_event(ChatWidgetInit {
         config,
-        environment_manager: app.environment_manager.clone(),
         frame_requester: crate::tui::FrameRequester::test_dummy(),
         app_event_tx: app.app_event_tx.clone(),
         workspace_command_runner: None,
@@ -1815,7 +1640,18 @@ async fn update_feature_flags_enabling_guardian_selects_auto_review() -> Result<
             .config_ref()
             .permissions
             .permission_profile(),
-        auto_review.permission_profile
+        &auto_review.permission_profile()
+    );
+    assert_eq!(
+        app.config.permissions.active_permission_profile(),
+        Some(auto_review.active_permission_profile.clone())
+    );
+    assert_eq!(
+        app.chat_widget
+            .config_ref()
+            .permissions
+            .active_permission_profile(),
+        Some(auto_review.active_permission_profile.clone())
     );
     assert_eq!(
         app.chat_widget.config_ref().approvals_reviewer,
@@ -1824,7 +1660,7 @@ async fn update_feature_flags_enabling_guardian_selects_auto_review() -> Result<
     assert_eq!(app.runtime_approval_policy_override, None);
     assert_eq!(
         app.runtime_permission_profile_override,
-        Some(auto_review.permission_profile.clone())
+        Some(auto_review.permission_profile())
     );
     assert_eq!(
         op_rx.try_recv(),
@@ -1832,7 +1668,7 @@ async fn update_feature_flags_enabling_guardian_selects_auto_review() -> Result<
             cwd: None,
             approval_policy: Some(auto_review.approval_policy),
             approvals_reviewer: Some(auto_review.approvals_reviewer),
-            permission_profile: Some(auto_review.permission_profile.clone()),
+            active_permission_profile: Some(auto_review.active_permission_profile.clone()),
             windows_sandbox_level: None,
             model: None,
             effort: None,
@@ -1894,7 +1730,9 @@ async fn update_feature_flags_disabling_guardian_clears_review_policy_and_restor
     app.chat_widget
         .set_approval_policy(AskForApproval::OnRequest);
     app.chat_widget
-        .set_permission_profile(PermissionProfile::workspace_write())?;
+        .set_permission_profile_from_session_snapshot(PermissionProfileSnapshot::legacy(
+            PermissionProfile::workspace_write(),
+        ))?;
 
     app.update_feature_flags(vec![(Feature::GuardianApproval, false)])
         .await;
@@ -1922,7 +1760,7 @@ async fn update_feature_flags_disabling_guardian_clears_review_policy_and_restor
             cwd: None,
             approval_policy: None,
             approvals_reviewer: Some(ApprovalsReviewer::User),
-            permission_profile: None,
+            active_permission_profile: None,
             windows_sandbox_level: None,
             model: None,
             effort: None,
@@ -1992,7 +1830,7 @@ async fn update_feature_flags_enabling_guardian_overrides_explicit_manual_review
             .config_ref()
             .permissions
             .permission_profile(),
-        auto_review.permission_profile
+        &auto_review.permission_profile()
     );
     assert_eq!(
         op_rx.try_recv(),
@@ -2000,7 +1838,7 @@ async fn update_feature_flags_enabling_guardian_overrides_explicit_manual_review
             cwd: None,
             approval_policy: Some(auto_review.approval_policy),
             approvals_reviewer: Some(auto_review.approvals_reviewer),
-            permission_profile: Some(auto_review.permission_profile.clone()),
+            active_permission_profile: Some(auto_review.active_permission_profile.clone()),
             windows_sandbox_level: None,
             model: None,
             effort: None,
@@ -2057,7 +1895,7 @@ async fn update_feature_flags_disabling_guardian_clears_manual_review_policy_wit
             cwd: None,
             approval_policy: None,
             approvals_reviewer: Some(ApprovalsReviewer::User),
-            permission_profile: None,
+            active_permission_profile: None,
             windows_sandbox_level: None,
             model: None,
             effort: None,
@@ -2116,7 +1954,7 @@ async fn update_feature_flags_enabling_guardian_in_profile_sets_profile_auto_rev
             cwd: None,
             approval_policy: Some(auto_review.approval_policy),
             approvals_reviewer: Some(auto_review.approvals_reviewer),
-            permission_profile: Some(auto_review.permission_profile.clone()),
+            active_permission_profile: Some(auto_review.active_permission_profile.clone()),
             windows_sandbox_level: None,
             model: None,
             effort: None,
@@ -2203,7 +2041,7 @@ guardian_approval = true
             cwd: None,
             approval_policy: None,
             approvals_reviewer: Some(ApprovalsReviewer::User),
-            permission_profile: None,
+            active_permission_profile: None,
             windows_sandbox_level: None,
             model: None,
             effort: None,
@@ -2971,10 +2809,13 @@ async fn inactive_thread_started_notification_initializes_replay_session() -> Re
         ThreadId::from_string("00000000-0000-0000-0000-000000000101").expect("valid thread");
     let agent_thread_id =
         ThreadId::from_string("00000000-0000-0000-0000-000000000202").expect("valid thread");
+    let primary_cwd = test_path_buf("/tmp/main").abs();
+    let shared_root = test_path_buf("/tmp/shared").abs();
     let primary_session = ThreadSessionState {
         approval_policy: AskForApproval::OnRequest,
         permission_profile: PermissionProfile::workspace_write(),
-        ..test_thread_session(main_thread_id, test_path_buf("/tmp/main"))
+        runtime_workspace_roots: vec![primary_cwd.clone(), shared_root.clone()],
+        ..test_thread_session(main_thread_id, primary_cwd.to_path_buf())
     };
 
     app.primary_thread_id = Some(main_thread_id);
@@ -3046,6 +2887,10 @@ async fn inactive_thread_started_notification_initializes_replay_session() -> Re
     assert_eq!(session.model_provider_id, "agent-provider");
     assert_eq!(session.approval_policy, primary_session.approval_policy);
     assert_eq!(session.cwd.as_path(), test_path_buf("/tmp/agent").as_path());
+    assert_eq!(
+        session.runtime_workspace_roots,
+        vec![test_path_buf("/tmp/agent").abs(), shared_root]
+    );
     assert_eq!(session.rollout_path, Some(rollout_path));
     assert_eq!(
         app.agent_navigation.get(&agent_thread_id),
@@ -3067,10 +2912,12 @@ async fn inactive_thread_started_notification_preserves_primary_model_when_path_
         ThreadId::from_string("00000000-0000-0000-0000-000000000301").expect("valid thread");
     let agent_thread_id =
         ThreadId::from_string("00000000-0000-0000-0000-000000000302").expect("valid thread");
+    let primary_cwd = test_path_buf("/tmp/main").abs();
     let primary_session = ThreadSessionState {
         approval_policy: AskForApproval::OnRequest,
         permission_profile: PermissionProfile::workspace_write(),
-        ..test_thread_session(main_thread_id, test_path_buf("/tmp/main"))
+        runtime_workspace_roots: vec![primary_cwd.clone()],
+        ..test_thread_session(main_thread_id, primary_cwd.to_path_buf())
     };
 
     app.primary_thread_id = Some(main_thread_id);
@@ -3137,10 +2984,12 @@ async fn thread_read_session_state_does_not_reuse_primary_permission_profile() {
         ThreadId::from_string("00000000-0000-0000-0000-000000000401").expect("valid thread");
     let read_thread_id =
         ThreadId::from_string("00000000-0000-0000-0000-000000000402").expect("valid thread");
+    let primary_cwd = test_path_buf("/tmp/main").abs();
     let primary_session = ThreadSessionState {
         approval_policy: AskForApproval::OnRequest,
         permission_profile: PermissionProfile::workspace_write(),
-        ..test_thread_session(main_thread_id, test_path_buf("/tmp/main"))
+        runtime_workspace_roots: vec![primary_cwd.clone()],
+        ..test_thread_session(main_thread_id, primary_cwd.to_path_buf())
     };
     app.primary_session_configured = Some(primary_session);
 
@@ -3172,11 +3021,16 @@ async fn thread_read_session_state_does_not_reuse_primary_permission_profile() {
 
     assert_eq!(session.thread_id, read_thread_id);
     assert_eq!(session.cwd.as_path(), test_path_buf("/tmp/read").as_path());
+    assert_eq!(
+        session.runtime_workspace_roots,
+        vec![test_path_buf("/tmp/read").abs()]
+    );
     let expected_permission_profile = app
         .chat_widget
         .config_ref()
         .permissions
-        .permission_profile();
+        .permission_profile()
+        .clone();
     assert_eq!(
         session.permission_profile, expected_permission_profile,
         "thread/read does not return fresh server permissions; the fallback profile must use the \
@@ -3298,7 +3152,9 @@ async fn side_fork_config_inherits_parent_thread_runtime_settings() {
     app.chat_widget
         .set_approval_policy(AskForApproval::OnRequest);
     app.chat_widget
-        .set_permission_profile(parent_permission_profile.clone())
+        .set_permission_profile_from_session_snapshot(PermissionProfileSnapshot::legacy(
+            parent_permission_profile.clone(),
+        ))
         .expect("test permission profile should be accepted");
     app.chat_widget
         .set_approvals_reviewer(ApprovalsReviewer::AutoReview);
@@ -3319,7 +3175,7 @@ async fn side_fork_config_inherits_parent_thread_runtime_settings() {
             Some(ReasoningEffortConfig::High),
             Some(parent_service_tier),
             AskForApproval::OnRequest.to_core(),
-            parent_permission_profile,
+            &parent_permission_profile,
             ApprovalsReviewer::AutoReview,
         )
     );
@@ -3343,7 +3199,9 @@ async fn side_start_block_message_tracks_open_side_conversation() {
 
     assert_eq!(
         app.side_start_block_message(),
-        Some("A side conversation is already open. Press Esc to return before starting another.")
+        Some(
+            "A side conversation is already open. Press Ctrl+C to return before starting another."
+        )
     );
 
     app.side_threads.remove(&side_thread_id);
@@ -3664,35 +3522,38 @@ async fn discard_side_thread_removes_agent_navigation_entry() -> Result<()> {
 
 #[tokio::test]
 async fn discard_side_thread_keeps_local_state_when_server_close_fails() -> Result<()> {
-    let mut app = make_test_app().await;
-    let mut app_server =
-        crate::start_embedded_app_server_for_picker(app.chat_widget.config_ref()).await?;
-    let parent_thread_id = ThreadId::new();
-    let side_thread_id = ThreadId::new();
-    app.active_thread_id = Some(side_thread_id);
-    app.side_threads
-        .insert(side_thread_id, SideThreadState::new(parent_thread_id));
-    app.agent_navigation.upsert(
-        side_thread_id,
-        Some("Side".to_string()),
-        Some("side".to_string()),
-        /*is_closed*/ false,
-    );
-
-    assert!(
-        !app.discard_side_thread(&mut app_server, side_thread_id)
-            .await
-    );
-
-    assert_eq!(app.active_thread_id, Some(side_thread_id));
-    assert_eq!(
+    Box::pin(async {
+        let mut app = make_test_app().await;
+        let mut app_server =
+            crate::start_embedded_app_server_for_picker(app.chat_widget.config_ref()).await?;
+        let parent_thread_id = ThreadId::new();
+        let side_thread_id = ThreadId::new();
+        app.active_thread_id = Some(side_thread_id);
         app.side_threads
-            .get(&side_thread_id)
-            .map(|state| state.parent_thread_id),
-        Some(parent_thread_id)
-    );
-    assert!(app.agent_navigation.get(&side_thread_id).is_some());
-    Ok(())
+            .insert(side_thread_id, SideThreadState::new(parent_thread_id));
+        app.agent_navigation.upsert(
+            side_thread_id,
+            Some("Side".to_string()),
+            Some("side".to_string()),
+            /*is_closed*/ false,
+        );
+
+        assert!(
+            !app.discard_side_thread(&mut app_server, side_thread_id)
+                .await
+        );
+
+        assert_eq!(app.active_thread_id, Some(side_thread_id));
+        assert_eq!(
+            app.side_threads
+                .get(&side_thread_id)
+                .map(|state| state.parent_thread_id),
+            Some(parent_thread_id)
+        );
+        assert!(app.agent_navigation.get(&side_thread_id).is_some());
+        Ok(())
+    })
+    .await
 }
 
 #[tokio::test]
@@ -3857,6 +3718,7 @@ async fn render_clear_ui_header_after_long_transcript_for_snapshot() -> String {
             permission_profile: PermissionProfile::read_only(),
             active_permission_profile: None,
             cwd: test_path_buf("/tmp/project").abs(),
+            runtime_workspace_roots: Vec::new(),
             instruction_source_paths: Vec::new(),
             reasoning_effort: Some(ReasoningEffortConfig::High),
             message_history: None,
@@ -3985,6 +3847,7 @@ async fn make_test_app() -> App {
         active_profile: None,
         cli_kv_overrides: Vec::new(),
         harness_overrides: ConfigOverrides::default(),
+        loader_overrides: LoaderOverrides::without_managed_config_for_tests(),
         runtime_approval_policy_override: None,
         runtime_permission_profile_override: None,
         file_search,
@@ -4047,6 +3910,7 @@ async fn make_test_app_with_channels() -> (
             active_profile: None,
             cli_kv_overrides: Vec::new(),
             harness_overrides: ConfigOverrides::default(),
+            loader_overrides: LoaderOverrides::without_managed_config_for_tests(),
             runtime_approval_policy_override: None,
             runtime_permission_profile_override: None,
             file_search,
@@ -4103,6 +3967,7 @@ fn test_thread_session(thread_id: ThreadId, cwd: PathBuf) -> ThreadSessionState
         permission_profile: PermissionProfile::read_only(),
         active_permission_profile: None,
         cwd: cwd.abs(),
+        runtime_workspace_roots: Vec::new(),
         instruction_source_paths: Vec::new(),
         reasoning_effort: None,
         message_history: None,
@@ -4678,6 +4543,7 @@ async fn backtrack_selection_with_duplicate_history_targets_unique_turn() {
             permission_profile: PermissionProfile::read_only(),
             active_permission_profile: None,
             cwd: test_path_buf("/home/user/project").abs(),
+            runtime_workspace_roots: Vec::new(),
             instruction_source_paths: Vec::new(),
             reasoning_effort: None,
             message_history: None,
@@ -4741,6 +4607,7 @@ async fn backtrack_selection_with_duplicate_history_targets_unique_turn() {
             permission_profile: PermissionProfile::read_only(),
             active_permission_profile: None,
             cwd: test_path_buf("/home/user/project").abs(),
+            runtime_workspace_roots: Vec::new(),
             instruction_source_paths: Vec::new(),
             reasoning_effort: None,
             message_history: None,
@@ -4833,6 +4700,7 @@ async fn backtrack_resubmit_preserves_data_image_urls_in_user_turn() {
             permission_profile: PermissionProfile::read_only(),
             active_permission_profile: None,
             cwd: test_path_buf("/home/user/project").abs(),
+            runtime_workspace_roots: Vec::new(),
             instruction_source_paths: Vec::new(),
             reasoning_effort: None,
             message_history: None,
@@ -4874,7 +4742,7 @@ async fn backtrack_resubmit_preserves_data_image_urls_in_user_turn() {
     assert!(items.iter().any(|item| {
         matches!(
             item,
-            UserInput::Image { url } if url == &data_image_url
+            UserInput::Image { url, .. } if url == &data_image_url
         )
     }));
 }
@@ -4973,7 +4841,6 @@ async fn replace_chat_widget_reseeds_collab_agent_metadata_for_replay() {
 
     let replacement = ChatWidget::new_with_app_event(ChatWidgetInit {
         config: app.config.clone(),
-        environment_manager: app.environment_manager.clone(),
         frame_requester: crate::tui::FrameRequester::test_dummy(),
         app_event_tx: app.app_event_tx.clone(),
         workspace_command_runner: None,
@@ -5068,6 +4935,7 @@ async fn refreshed_snapshot_session_persists_resumed_turns() {
     )];
     let resumed_session = ThreadSessionState {
         cwd: test_path_buf("/tmp/refreshed").abs(),
+        runtime_workspace_roots: Vec::new(),
         instruction_source_paths: Vec::new(),
         ..initial_session.clone()
     };
@@ -5232,6 +5100,7 @@ async fn new_session_requests_shutdown_for_previous_conversation() {
             permission_profile: PermissionProfile::read_only(),
             active_permission_profile: None,
             cwd: test_path_buf("/home/user/project").abs(),
+            runtime_workspace_roots: Vec::new(),
             instruction_source_paths: Vec::new(),
             reasoning_effort: None,
             message_history: None,
@@ -5353,6 +5222,7 @@ async fn clear_only_ui_reset_preserves_chat_session_state() {
             permission_profile: PermissionProfile::read_only(),
             active_permission_profile: None,
             cwd: test_path_buf("/tmp/project").abs(),
+            runtime_workspace_roots: Vec::new(),
             instruction_source_paths: Vec::new(),
             reasoning_effort: None,
             message_history: None,
@@ -5419,88 +5289,48 @@ async fn backtrack_esc_does_not_steal_empty_vim_insert_escape() {
 }
 
 #[tokio::test]
-async fn session_summary_skips_when_no_usage_or_resume_hint() {
-    assert!(
-        session_summary(
-            TokenUsage::default(),
-            /*thread_id*/ None,
-            /*thread_name*/ None,
-            /*rollout_path*/ None,
-        )
-        .is_none()
-    );
+async fn side_conversations_reject_backtrack_esc_without_stealing_vim_insert_escape() {
+    let mut app = make_test_app().await;
+    let esc = crossterm::event::KeyEvent::new(crossterm::event::KeyCode::Esc, KeyModifiers::NONE);
+
+    app.chat_widget
+        .set_side_conversation_active(/*active*/ true);
+    assert!(app.chat_widget.composer_is_empty());
+    assert!(!app.should_handle_backtrack_esc(esc));
+    assert!(app.should_reject_side_backtrack_esc(esc));
+
+    app.chat_widget.toggle_vim_mode_and_notify();
+    app.chat_widget
+        .handle_key_event(crossterm::event::KeyEvent::new(
+            crossterm::event::KeyCode::Char('i'),
+            KeyModifiers::NONE,
+        ));
+
+    assert!(app.chat_widget.should_handle_vim_insert_escape(esc));
+    assert!(!app.should_handle_backtrack_esc(esc));
+    assert!(!app.should_reject_side_backtrack_esc(esc));
 }
 
 #[tokio::test]
-async fn session_summary_skips_resume_hint_until_rollout_exists() {
-    let usage = TokenUsage::default();
-    let conversation = ThreadId::from_string("123e4567-e89b-12d3-a456-426614174000").unwrap();
-    let temp_dir = tempdir().expect("temp dir");
-    let rollout_path = temp_dir.path().join("rollout.jsonl");
+async fn side_backtrack_rejection_reports_unavailable_message_snapshot() {
+    let (mut app, mut app_event_rx, _op_rx) = make_test_app_with_channels().await;
+    app.backtrack.primed = true;
 
-    assert!(
-        session_summary(
-            usage,
-            Some(conversation),
-            /*thread_name*/ None,
-            Some(&rollout_path),
-        )
-        .is_none()
-    );
-}
+    app.reject_side_backtrack_esc();
 
-#[tokio::test]
-async fn session_summary_includes_resume_hint_for_persisted_rollout() {
-    let usage = TokenUsage {
-        input_tokens: 10,
-        output_tokens: 2,
-        total_tokens: 12,
-        ..Default::default()
+    assert!(!app.backtrack.primed);
+    let cell = match app_event_rx.try_recv() {
+        Ok(AppEvent::InsertHistoryCell(cell)) => cell,
+        other => panic!("expected InsertHistoryCell event, got {other:?}"),
     };
-    let conversation = ThreadId::from_string("123e4567-e89b-12d3-a456-426614174000").unwrap();
-    let temp_dir = tempdir().expect("temp dir");
-    let rollout_path = temp_dir.path().join("rollout.jsonl");
-    std::fs::write(&rollout_path, "{}\n").expect("write rollout");
-
-    let summary = session_summary(
-        usage,
-        Some(conversation),
-        /*thread_name*/ None,
-        Some(&rollout_path),
-    )
-    .expect("summary");
-    assert_eq!(
-        summary.usage_line,
-        Some("Token usage: total=12 input=10 output=2".to_string())
-    );
-    assert_eq!(
-        summary.resume_command,
-        Some("codex resume 123e4567-e89b-12d3-a456-426614174000".to_string())
-    );
-}
-
-#[tokio::test]
-async fn session_summary_uses_id_even_when_thread_has_name() {
-    let usage = TokenUsage {
-        input_tokens: 10,
-        output_tokens: 2,
-        total_tokens: 12,
-        ..Default::default()
-    };
-    let conversation = ThreadId::from_string("123e4567-e89b-12d3-a456-426614174000").unwrap();
-    let temp_dir = tempdir().expect("temp dir");
-    let rollout_path = temp_dir.path().join("rollout.jsonl");
-    std::fs::write(&rollout_path, "{}\n").expect("write rollout");
-
-    let summary = session_summary(
-        usage,
-        Some(conversation),
-        Some("my-session".to_string()),
-        Some(&rollout_path),
-    )
-    .expect("summary");
-    assert_eq!(
-        summary.resume_command,
-        Some("codex resume 123e4567-e89b-12d3-a456-426614174000".to_string())
+    let rendered = cell
+        .display_lines(/*width*/ 80)
+        .into_iter()
+        .map(|line| line.to_string())
+        .collect::<Vec<_>>()
+        .join("\n");
+    assert_app_snapshot!(
+        "side_backtrack_rejection_reports_unavailable_message",
+        rendered
     );
 }
diff --git a/codex-rs/tui/src/app/tests/model_catalog.rs b/codex-rs/tui/src/app/tests/model_catalog.rs
index ba04a3634f..7d2eb9c125 100644
--- a/codex-rs/tui/src/app/tests/model_catalog.rs
+++ b/codex-rs/tui/src/app/tests/model_catalog.rs
@@ -174,6 +174,46 @@ fn select_model_availability_nux_returns_none_when_all_models_are_exhausted() {
     assert_eq!(selected, None);
 }
 
+#[tokio::test]
+async fn prepare_startup_tooltip_override_persists_model_availability_nux_count() {
+    let codex_home = tempdir().expect("temp codex home");
+    let mut config = ConfigBuilder::default()
+        .codex_home(codex_home.path().to_path_buf())
+        .build()
+        .await
+        .expect("config");
+    let mut presets = all_model_presets();
+    presets.iter_mut().for_each(|preset| {
+        preset.availability_nux = None;
+    });
+    let target = presets
+        .iter_mut()
+        .find(|preset| preset.model == "gpt-5.4")
+        .expect("target preset present");
+    target.availability_nux = Some(ModelAvailabilityNux {
+        message: "gpt-5.4 is available".to_string(),
+    });
+
+    let tooltip =
+        prepare_startup_tooltip_override(&mut config, &presets, /*is_first_run*/ false).await;
+
+    assert_eq!(tooltip.as_deref(), Some("gpt-5.4 is available"));
+    assert_eq!(
+        config.model_availability_nux.shown_count,
+        HashMap::from([("gpt-5.4".to_string(), 1)])
+    );
+
+    let reloaded = ConfigBuilder::default()
+        .codex_home(codex_home.path().to_path_buf())
+        .build()
+        .await
+        .expect("reloaded config");
+    assert_eq!(
+        reloaded.model_availability_nux.shown_count,
+        HashMap::from([("gpt-5.4".to_string(), 1)])
+    );
+}
+
 #[tokio::test]
 async fn accepted_model_migration_persists_target_default_reasoning_effort() {
     let codex_home = tempdir().expect("temp codex home");
diff --git a/codex-rs/tui/src/app/tests/session_summary.rs b/codex-rs/tui/src/app/tests/session_summary.rs
new file mode 100644
index 0000000000..63ff92a097
--- /dev/null
+++ b/codex-rs/tui/src/app/tests/session_summary.rs
@@ -0,0 +1,92 @@
+use super::*;
+use pretty_assertions::assert_eq;
+
+#[tokio::test]
+async fn session_summary_skips_when_no_usage_or_resume_hint() {
+    assert!(
+        session_summary(
+            TokenUsage::default(),
+            /*thread_id*/ None,
+            /*thread_name*/ None,
+            /*rollout_path*/ None,
+        )
+        .is_none()
+    );
+}
+
+#[tokio::test]
+async fn session_summary_skips_resume_hint_until_rollout_exists() {
+    let usage = TokenUsage::default();
+    let conversation = ThreadId::from_string("123e4567-e89b-12d3-a456-426614174000").unwrap();
+    let temp_dir = tempdir().expect("temp dir");
+    let rollout_path = temp_dir.path().join("rollout.jsonl");
+
+    assert!(
+        session_summary(
+            usage,
+            Some(conversation),
+            /*thread_name*/ None,
+            Some(&rollout_path),
+        )
+        .is_none()
+    );
+}
+
+#[tokio::test]
+async fn session_summary_includes_resume_hint_for_persisted_rollout() {
+    let usage = TokenUsage {
+        input_tokens: 10,
+        output_tokens: 2,
+        total_tokens: 12,
+        ..Default::default()
+    };
+    let conversation = ThreadId::from_string("123e4567-e89b-12d3-a456-426614174000").unwrap();
+    let temp_dir = tempdir().expect("temp dir");
+    let rollout_path = temp_dir.path().join("rollout.jsonl");
+    std::fs::write(&rollout_path, "{}\n").expect("write rollout");
+
+    let summary = session_summary(
+        usage,
+        Some(conversation),
+        /*thread_name*/ None,
+        Some(&rollout_path),
+    )
+    .expect("summary");
+    assert_eq!(
+        summary.usage_line,
+        Some("Token usage: total=12 input=10 output=2".to_string())
+    );
+    assert_eq!(
+        summary.resume_hint,
+        Some("codex resume 123e4567-e89b-12d3-a456-426614174000".to_string())
+    );
+}
+
+#[tokio::test]
+async fn session_summary_names_picker_item_when_thread_has_name() {
+    let usage = TokenUsage {
+        input_tokens: 10,
+        output_tokens: 2,
+        total_tokens: 12,
+        ..Default::default()
+    };
+    let conversation = ThreadId::from_string("123e4567-e89b-12d3-a456-426614174000").unwrap();
+    let temp_dir = tempdir().expect("temp dir");
+    let rollout_path = temp_dir.path().join("rollout.jsonl");
+    std::fs::write(&rollout_path, "{}\n").expect("write rollout");
+
+    let summary = session_summary(
+        usage,
+        Some(conversation),
+        Some("my-session".to_string()),
+        Some(&rollout_path),
+    )
+    .expect("summary");
+    assert_eq!(
+        summary.resume_hint,
+        Some(
+            "codex resume, then select my-session (123e4567-e89b-12d3-a456-426614174000)"
+                .to_string()
+        )
+    );
+}
diff --git a/codex-rs/tui/src/app/tests/startup.rs b/codex-rs/tui/src/app/tests/startup.rs
new file mode 100644
index 0000000000..c0aa1b61b7
--- /dev/null
+++ b/codex-rs/tui/src/app/tests/startup.rs
@@ -0,0 +1,179 @@
+use super::*;
+use pretty_assertions::assert_eq;
+
+#[test]
+fn startup_waiting_gate_is_only_for_fresh_or_exit_session_selection() {
+    assert_eq!(
+        App::should_wait_for_initial_session(&SessionSelection::StartFresh),
+        true
+    );
+    assert_eq!(
+        App::should_wait_for_initial_session(&SessionSelection::Exit),
+        true
+    );
+    assert_eq!(
+        App::should_wait_for_initial_session(&SessionSelection::Resume(
+            crate::resume_picker::SessionTarget {
+                path: Some(PathBuf::from("/tmp/restore")),
+                thread_id: ThreadId::new(),
+            }
+        )),
+        false
+    );
+    assert_eq!(
+        App::should_wait_for_initial_session(&SessionSelection::Fork(
+            crate::resume_picker::SessionTarget {
+                path: Some(PathBuf::from("/tmp/fork")),
+                thread_id: ThreadId::new(),
+            }
+        )),
+        false
+    );
+}
+
+#[test]
+fn startup_paused_goal_prompt_gate_is_only_for_quiet_resume() {
+    let resume = SessionSelection::Resume(crate::resume_picker::SessionTarget {
+        path: Some(PathBuf::from("/tmp/restore")),
+        thread_id: ThreadId::new(),
+    });
+    let fork = SessionSelection::Fork(crate::resume_picker::SessionTarget {
+        path: Some(PathBuf::from("/tmp/fork")),
+        thread_id: ThreadId::new(),
+    });
+    let no_images: Vec<PathBuf> = Vec::new();
+    let initial_images = vec![PathBuf::from("/tmp/image.png")];
+
+    assert!(App::should_prompt_for_paused_goal_after_startup_resume(
+        &resume, &None, &no_images
+    ));
+    assert!(!App::should_prompt_for_paused_goal_after_startup_resume(
+        &resume,
+        &Some("continue from here".to_string()),
+        &no_images
+    ));
+    assert!(!App::should_prompt_for_paused_goal_after_startup_resume(
+        &resume,
+        &None,
+        &initial_images
+    ));
+    assert!(!App::should_prompt_for_paused_goal_after_startup_resume(
+        &SessionSelection::StartFresh,
+        &None,
+        &no_images
+    ));
+    assert!(!App::should_prompt_for_paused_goal_after_startup_resume(
+        &fork, &None, &no_images
+    ));
+}
+
+#[test]
+fn startup_waiting_gate_holds_active_thread_events_until_primary_thread_configured() {
+    let mut wait_for_initial_session =
+        App::should_wait_for_initial_session(&SessionSelection::StartFresh);
+    assert_eq!(wait_for_initial_session, true);
+    assert_eq!(
+        App::should_handle_active_thread_events(
+            wait_for_initial_session,
+            /*has_active_thread_receiver*/ true
+        ),
+        false
+    );
+
+    assert_eq!(
+        App::should_stop_waiting_for_initial_session(
+            wait_for_initial_session,
+            /*primary_thread_id*/ None
+        ),
+        false
+    );
+    if App::should_stop_waiting_for_initial_session(wait_for_initial_session, Some(ThreadId::new()))
+    {
+        wait_for_initial_session = false;
+    }
+    assert_eq!(wait_for_initial_session, false);
+
+    assert_eq!(
+        App::should_handle_active_thread_events(
+            wait_for_initial_session,
+            /*has_active_thread_receiver*/ true
+        ),
+        true
+    );
+}
+
+#[test]
+fn startup_waiting_gate_not_applied_for_resume_or_fork_session_selection() {
+    let wait_for_resume = App::should_wait_for_initial_session(&SessionSelection::Resume(
+        crate::resume_picker::SessionTarget {
+            path: Some(PathBuf::from("/tmp/restore")),
+            thread_id: ThreadId::new(),
+        },
+    ));
+    assert_eq!(
+        App::should_handle_active_thread_events(
+            wait_for_resume,
+            /*has_active_thread_receiver*/ true
+        ),
+        true
+    );
+    let wait_for_fork = App::should_wait_for_initial_session(&SessionSelection::Fork(
+        crate::resume_picker::SessionTarget {
+            path: Some(PathBuf::from("/tmp/fork")),
+            thread_id: ThreadId::new(),
+        },
+    ));
+    assert_eq!(
+        App::should_handle_active_thread_events(
+            wait_for_fork,
+            /*has_active_thread_receiver*/ true
+        ),
+        true
+    );
+}
+
+#[tokio::test]
+async fn ignore_same_thread_resume_reports_noop_for_current_thread() {
+    let (mut app, mut app_event_rx, _op_rx) = make_test_app_with_channels().await;
+    let thread_id = ThreadId::new();
+    let session = test_thread_session(thread_id, test_path_buf("/tmp/project"));
+    app.chat_widget.handle_thread_session(session.clone());
+    app.thread_event_channels.insert(
+        thread_id,
+        ThreadEventChannel::new_with_session(THREAD_EVENT_CHANNEL_CAPACITY, session, Vec::new()),
+    );
+    app.activate_thread_channel(thread_id).await;
+    while app_event_rx.try_recv().is_ok() {}
+
+    let ignored = app.ignore_same_thread_resume(&crate::resume_picker::SessionTarget {
+        path: Some(test_path_buf("/tmp/project")),
+        thread_id,
+    });
+
+    assert!(ignored);
+    let cell = match app_event_rx.try_recv() {
+        Ok(AppEvent::InsertHistoryCell(cell)) => cell,
+        other => panic!("expected info message after same-thread resume, saw {other:?}"),
+    };
+    let rendered = lines_to_single_string(&cell.display_lines(/*width*/ 80));
+    assert!(rendered.contains(&format!(
+        "Already viewing {}.",
+        test_path_display("/tmp/project")
+    )));
+}
+
+#[tokio::test]
+async fn ignore_same_thread_resume_allows_reattaching_displayed_inactive_thread() {
+    let mut app = make_test_app().await;
+    let thread_id = ThreadId::new();
+    let session = test_thread_session(thread_id, test_path_buf("/tmp/project"));
+    app.chat_widget.handle_thread_session(session);
+
+    let ignored = app.ignore_same_thread_resume(&crate::resume_picker::SessionTarget {
+        path: Some(test_path_buf("/tmp/project")),
+        thread_id,
+    });
+
+    assert!(!ignored);
+    assert!(app.transcript_cells.is_empty());
+}
diff --git a/codex-rs/tui/src/app/thread_events.rs b/codex-rs/tui/src/app/thread_events.rs
index 1ab1edc951..dec37611fe 100644
--- a/codex-rs/tui/src/app/thread_events.rs
+++ b/codex-rs/tui/src/app/thread_events.rs
@@ -352,6 +352,7 @@ mod tests {
             permission_profile: PermissionProfile::read_only(),
             active_permission_profile: None,
             cwd: cwd.abs(),
+            runtime_workspace_roots: Vec::new(),
             instruction_source_paths: Vec::new(),
             reasoning_effort: None,
             message_history: None,
diff --git a/codex-rs/tui/src/app/thread_goal_actions.rs b/codex-rs/tui/src/app/thread_goal_actions.rs
index e43183ffc7..89b5465a96 100644
--- a/codex-rs/tui/src/app/thread_goal_actions.rs
+++ b/codex-rs/tui/src/app/thread_goal_actions.rs
@@ -63,7 +63,10 @@ impl App {
         let Some(goal) = response.goal else {
             return;
         };
-        if goal.status == ThreadGoalStatus::Paused {
+        if matches!(
+            goal.status,
+            ThreadGoalStatus::Paused | ThreadGoalStatus::Blocked | ThreadGoalStatus::UsageLimited
+        ) {
             self.chat_widget
                 .show_resume_paused_goal_prompt(thread_id, goal.objective);
         }
diff --git a/codex-rs/tui/src/app/thread_routing.rs b/codex-rs/tui/src/app/thread_routing.rs
index f25398b0b8..d270bb53ce 100644
--- a/codex-rs/tui/src/app/thread_routing.rs
+++ b/codex-rs/tui/src/app/thread_routing.rs
@@ -510,7 +510,7 @@ impl App {
                 cwd,
                 approval_policy,
                 approvals_reviewer,
-                permission_profile,
+                active_permission_profile,
                 model,
                 effort,
                 summary,
@@ -588,12 +588,11 @@ impl App {
                     let config = self.chat_widget.config_ref();
                     let approvals_reviewer =
                         approvals_reviewer.unwrap_or(config.approvals_reviewer);
-                    let active_permission_profile =
-                        if config.permissions.permission_profile() == permission_profile.clone() {
-                            config.permissions.active_permission_profile()
-                        } else {
-                            None
-                        };
+                    let permissions_override = Self::turn_permissions_override_from_config(
+                        config,
+                        active_permission_profile.as_ref(),
+                        self.runtime_permission_profile_override.as_ref(),
+                    );
                     app_server
                         .turn_start(
                             thread_id,
@@ -601,8 +600,8 @@ impl App {
                             cwd.clone(),
                             *approval_policy,
                             approvals_reviewer,
-                            permission_profile.clone(),
-                            active_permission_profile,
+                            permissions_override,
+                            config.permissions.user_visible_workspace_roots(),
                             model.to_string(),
                             *effort,
                             *summary,
@@ -697,6 +696,34 @@ impl App {
         }
     }
 
+    fn turn_permissions_override_from_config(
+        config: &Config,
+        active_permission_profile: Option<&ActivePermissionProfile>,
+        runtime_permission_profile_override: Option<&PermissionProfile>,
+    ) -> TurnPermissionsOverride {
+        if let Some(active_permission_profile) = active_permission_profile {
+            return TurnPermissionsOverride::ActiveProfile(active_permission_profile.clone());
+        }
+
+        let effective_permission_profile = config.permissions.effective_permission_profile();
+        let runtime_permission_profile_override =
+            runtime_permission_profile_override.map(|profile| {
+                profile
+                    .clone()
+                    .materialize_project_roots_with_workspace_roots(
+                        &config.effective_workspace_roots(),
+                    )
+            });
+        if runtime_permission_profile_override
+            .as_ref()
+            .is_some_and(|profile| profile == &effective_permission_profile)
+        {
+            return TurnPermissionsOverride::LegacySandbox(effective_permission_profile);
+        }
+
+        TurnPermissionsOverride::Preserve
+    }
+
     pub(super) fn handle_skills_list_result(
         &mut self,
         result: Result<SkillsListResponse>,
@@ -892,7 +919,8 @@ impl App {
         session.thread_id = thread_id;
         session.thread_name = notification.thread.name.clone();
         session.model_provider_id = notification.thread.model_provider.clone();
-        session.cwd = notification.thread.cwd.clone();
+        session
+            .set_cwd_retargeting_implicit_runtime_workspace_root(notification.thread.cwd.clone());
         let rollout_path = notification.thread.path.clone();
         if let Some(model) =
             read_session_model(self.state_db.as_deref(), thread_id, rollout_path.as_deref()).await
@@ -1453,3 +1481,77 @@ impl App {
         Ok(())
     }
 }
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use codex_protocol::models::ActivePermissionProfile;
+    use codex_protocol::models::BUILT_IN_PERMISSION_PROFILE_WORKSPACE;
+
+    async fn config_with_workspace_profile() -> Config {
+        let temp_dir = tempfile::tempdir().expect("tempdir");
+        ConfigBuilder::default()
+            .codex_home(temp_dir.path().to_path_buf())
+            .harness_overrides(ConfigOverrides {
+                default_permissions: Some(BUILT_IN_PERMISSION_PROFILE_WORKSPACE.to_string()),
+                ..ConfigOverrides::default()
+            })
+            .build()
+            .await
+            .expect("config should build")
+    }
+
+    #[tokio::test]
+    async fn turn_permissions_use_active_profile_when_available() {
+        let config = config_with_workspace_profile().await;
+        let active_permission_profile = config.permissions.active_permission_profile();
+
+        assert_eq!(
+            App::turn_permissions_override_from_config(
+                &config,
+                active_permission_profile.as_ref(),
+                /*runtime_permission_profile_override*/ None,
+            ),
+            TurnPermissionsOverride::ActiveProfile(ActivePermissionProfile::new(
+                BUILT_IN_PERMISSION_PROFILE_WORKSPACE
+            ))
+        );
+    }
+
+    #[tokio::test]
+    async fn turn_permissions_preserve_server_snapshot_without_local_override() {
+        let mut config = config_with_workspace_profile().await;
+        config
+            .permissions
+            .set_permission_profile(PermissionProfile::read_only())
+            .expect("read-only profile should be allowed");
+
+        assert_eq!(
+            App::turn_permissions_override_from_config(
+                &config, /*active_permission_profile*/ None,
+                /*runtime_permission_profile_override*/ None,
+            ),
+            TurnPermissionsOverride::Preserve
+        );
+    }
+
+    #[tokio::test]
+    async fn turn_permissions_send_legacy_sandbox_for_local_override() {
+        let mut config = config_with_workspace_profile().await;
+        let permission_profile = PermissionProfile::workspace_write();
+        config
+            .permissions
+            .set_permission_profile(permission_profile.clone())
+            .expect("workspace profile should be allowed");
+        let effective_permission_profile = config.permissions.effective_permission_profile();
+
+        assert_eq!(
+            App::turn_permissions_override_from_config(
+                &config,
+                /*active_permission_profile*/ None,
+                Some(&permission_profile),
+            ),
+            TurnPermissionsOverride::LegacySandbox(effective_permission_profile)
+        );
+    }
+}
diff --git a/codex-rs/tui/src/app/thread_session_state.rs b/codex-rs/tui/src/app/thread_session_state.rs
index 4f5f48cfc8..4e7f0c6741 100644
--- a/codex-rs/tui/src/app/thread_session_state.rs
+++ b/codex-rs/tui/src/app/thread_session_state.rs
@@ -8,6 +8,30 @@ use codex_protocol::models::ActivePermissionProfile;
 use codex_protocol::models::PermissionProfile;
 
 impl App {
+    pub(super) async fn sync_active_thread_service_tier_to_cached_session(&mut self) {
+        let Some(active_thread_id) = self.active_thread_id else {
+            return;
+        };
+
+        let service_tier = self.chat_widget.current_service_tier().map(str::to_string);
+        let update_session = |session: &mut ThreadSessionState| {
+            session.service_tier = service_tier.clone();
+        };
+
+        if self.primary_thread_id == Some(active_thread_id)
+            && let Some(session) = self.primary_session_configured.as_mut()
+        {
+            update_session(session);
+        }
+
+        if let Some(channel) = self.thread_event_channels.get(&active_thread_id) {
+            let mut store = channel.store.lock().await;
+            if let Some(session) = store.session.as_mut() {
+                update_session(session);
+            }
+        }
+    }
+
     pub(super) async fn sync_active_thread_permission_settings_to_cached_session(&mut self) {
         let Some(active_thread_id) = self.active_thread_id else {
             return;
@@ -19,7 +43,8 @@ impl App {
             .chat_widget
             .config_ref()
             .permissions
-            .permission_profile();
+            .permission_profile()
+            .clone();
         let active_permission_profile = self
             .chat_widget
             .config_ref()
@@ -71,6 +96,7 @@ impl App {
                 permission_profile: permission_profile.clone(),
                 active_permission_profile: active_permission_profile.clone(),
                 cwd: thread.cwd.clone(),
+                runtime_workspace_roots: self.config.workspace_roots.clone(),
                 instruction_source_paths: Vec::new(),
                 reasoning_effort: self.chat_widget.current_reasoning_effort(),
                 message_history: None,
@@ -80,7 +106,7 @@ impl App {
         session.thread_id = thread_id;
         session.thread_name = thread.name.clone();
         session.model_provider_id = thread.model_provider.clone();
-        session.cwd = thread.cwd.clone();
+        session.set_cwd_retargeting_implicit_runtime_workspace_root(thread.cwd.clone());
         session.permission_profile = permission_profile;
         session.active_permission_profile = active_permission_profile;
         session.instruction_source_paths = Vec::new();
@@ -101,6 +127,7 @@ impl App {
             .config_ref()
             .permissions
             .permission_profile()
+            .clone()
     }
 
     fn current_active_permission_profile(&self) -> Option<ActivePermissionProfile> {
@@ -117,18 +144,20 @@ mod tests {
     use crate::app::side::SideThreadState;
     use crate::app::test_support::make_test_app;
     use crate::app::thread_events::ThreadEventChannel;
+    use crate::legacy_core::config::PermissionProfileSnapshot;
     use crate::test_support::PathBufExt;
     use crate::test_support::test_path_buf;
     use codex_app_server_protocol::AskForApproval;
-    use codex_app_server_protocol::FileSystemAccessMode;
-    use codex_app_server_protocol::FileSystemPath;
-    use codex_app_server_protocol::FileSystemSandboxEntry;
-    use codex_app_server_protocol::FileSystemSpecialPath;
-    use codex_app_server_protocol::PermissionProfile as AppServerPermissionProfile;
-    use codex_app_server_protocol::PermissionProfileFileSystemPermissions;
-    use codex_app_server_protocol::PermissionProfileNetworkPermissions;
     use codex_config::types::ApprovalsReviewer;
+    use codex_protocol::config_types::ServiceTier;
+    use codex_protocol::models::BUILT_IN_PERMISSION_PROFILE_WORKSPACE;
+    use codex_protocol::models::ManagedFileSystemPermissions;
     use codex_protocol::models::PermissionProfile;
+    use codex_protocol::permissions::FileSystemAccessMode;
+    use codex_protocol::permissions::FileSystemPath;
+    use codex_protocol::permissions::FileSystemSandboxEntry;
+    use codex_protocol::permissions::FileSystemSpecialPath;
+    use codex_protocol::permissions::NetworkSandboxPolicy;
     use pretty_assertions::assert_eq;
     use std::path::PathBuf;
 
@@ -146,6 +175,7 @@ mod tests {
             permission_profile: PermissionProfile::read_only(),
             active_permission_profile: None,
             cwd: cwd.abs(),
+            runtime_workspace_roots: vec![cwd.abs()],
             instruction_source_paths: Vec::new(),
             reasoning_effort: None,
             message_history: None,
@@ -193,9 +223,14 @@ mod tests {
             codex_config::Constrained::allow_any(AskForApproval::OnRequest.to_core());
         app.config.approvals_reviewer = ApprovalsReviewer::AutoReview;
         let expected_permission_profile = PermissionProfile::workspace_write();
+        let expected_active_permission_profile =
+            ActivePermissionProfile::new(BUILT_IN_PERMISSION_PROFILE_WORKSPACE);
         app.chat_widget.handle_thread_session(main_session.clone());
         app.chat_widget
-            .set_permission_profile(expected_permission_profile.clone())
+            .set_permission_profile_from_session_snapshot(PermissionProfileSnapshot::active(
+                expected_permission_profile.clone(),
+                expected_active_permission_profile.clone(),
+            ))
             .expect("set widget permission profile");
         app.config
             .permissions
@@ -209,6 +244,7 @@ mod tests {
             approval_policy: AskForApproval::OnRequest,
             approvals_reviewer: ApprovalsReviewer::AutoReview,
             permission_profile: expected_permission_profile,
+            active_permission_profile: Some(expected_active_permission_profile),
             ..main_session
         };
         assert_eq!(
@@ -244,9 +280,9 @@ mod tests {
         let mut app = make_test_app().await;
         let thread_id =
             ThreadId::from_string("00000000-0000-0000-0000-000000000403").expect("valid thread");
-        let profile: PermissionProfile = AppServerPermissionProfile::Managed {
-            network: PermissionProfileNetworkPermissions { enabled: false },
-            file_system: PermissionProfileFileSystemPermissions::Restricted {
+        let profile: PermissionProfile = PermissionProfile::Managed {
+            network: NetworkSandboxPolicy::Restricted,
+            file_system: ManagedFileSystemPermissions::Restricted {
                 entries: vec![
                     FileSystemSandboxEntry {
                         path: FileSystemPath::Special {
@@ -258,13 +294,12 @@ mod tests {
                         path: FileSystemPath::GlobPattern {
                             pattern: "**/.env".to_string(),
                         },
-                        access: FileSystemAccessMode::None,
+                        access: FileSystemAccessMode::Deny,
                     },
                 ],
                 glob_scan_max_depth: None,
             },
-        }
-        .into();
+        };
         let session = ThreadSessionState {
             permission_profile: profile.clone(),
             ..test_thread_session(thread_id, test_path_buf("/tmp/main"))
@@ -306,6 +341,50 @@ mod tests {
         assert_eq!(store_session, Some(expected_session));
     }
 
+    #[tokio::test]
+    async fn service_tier_sync_updates_active_cached_session() {
+        let mut app = make_test_app().await;
+        let thread_id =
+            ThreadId::from_string("00000000-0000-0000-0000-000000000406").expect("valid thread");
+        let session = ThreadSessionState {
+            service_tier: Some(ServiceTier::Fast.request_value().to_string()),
+            ..test_thread_session(thread_id, test_path_buf("/tmp/main"))
+        };
+
+        app.primary_thread_id = Some(thread_id);
+        app.active_thread_id = Some(thread_id);
+        app.primary_session_configured = Some(session.clone());
+        app.thread_event_channels.insert(
+            thread_id,
+            ThreadEventChannel::new_with_session(/*capacity*/ 4, session.clone(), Vec::new()),
+        );
+        app.chat_widget.handle_thread_session(session);
+        app.chat_widget.set_service_tier(/*service_tier*/ None);
+
+        app.sync_active_thread_service_tier_to_cached_session()
+            .await;
+
+        let expected_session = ThreadSessionState {
+            service_tier: None,
+            ..test_thread_session(thread_id, test_path_buf("/tmp/main"))
+        };
+        assert_eq!(
+            app.primary_session_configured,
+            Some(expected_session.clone())
+        );
+
+        let store_session = app
+            .thread_event_channels
+            .get(&thread_id)
+            .expect("thread channel")
+            .store
+            .lock()
+            .await
+            .session
+            .clone();
+        assert_eq!(store_session, Some(expected_session));
+    }
+
     #[tokio::test]
     async fn thread_read_fallback_uses_active_permission_settings() {
         let mut app = make_test_app().await;
@@ -350,11 +429,12 @@ mod tests {
             .chat_widget
             .config_ref()
             .permissions
-            .permission_profile();
+            .permission_profile()
+            .clone();
         assert_eq!(session.permission_profile, expected_permission_profile);
         assert_ne!(
             session.permission_profile,
-            app.config.permissions.permission_profile(),
+            app.config.permissions.permission_profile().clone(),
             "thread/read fallback must use the active widget permissions rather than stale app \
              config defaults"
         );
diff --git a/codex-rs/tui/src/app_command.rs b/codex-rs/tui/src/app_command.rs
index 89fd2600f8..0b6484d015 100644
--- a/codex-rs/tui/src/app_command.rs
+++ b/codex-rs/tui/src/app_command.rs
@@ -16,7 +16,7 @@ use codex_protocol::config_types::CollaborationMode;
 use codex_protocol::config_types::Personality;
 use codex_protocol::config_types::ReasoningSummary as ReasoningSummaryConfig;
 use codex_protocol::config_types::WindowsSandboxLevel;
-use codex_protocol::models::PermissionProfile;
+use codex_protocol::models::ActivePermissionProfile;
 use codex_protocol::openai_models::ReasoningEffort as ReasoningEffortConfig;
 use codex_protocol::request_permissions::RequestPermissionsResponse;
 use serde::Serialize;
@@ -41,7 +41,7 @@ pub(crate) enum AppCommand {
         cwd: PathBuf,
         approval_policy: AskForApproval,
         approvals_reviewer: Option<ApprovalsReviewer>,
-        permission_profile: PermissionProfile,
+        active_permission_profile: Option<ActivePermissionProfile>,
         model: String,
         effort: Option<ReasoningEffortConfig>,
         summary: Option<ReasoningSummaryConfig>,
@@ -54,7 +54,7 @@ pub(crate) enum AppCommand {
         cwd: Option<PathBuf>,
         approval_policy: Option<AskForApproval>,
         approvals_reviewer: Option<ApprovalsReviewer>,
-        permission_profile: Option<PermissionProfile>,
+        active_permission_profile: Option<ActivePermissionProfile>,
         windows_sandbox_level: Option<WindowsSandboxLevel>,
         model: Option<String>,
         effort: Option<Option<ReasoningEffortConfig>>,
@@ -142,7 +142,7 @@ impl AppCommand {
         items: Vec<UserInput>,
         cwd: PathBuf,
         approval_policy: AskForApproval,
-        permission_profile: PermissionProfile,
+        active_permission_profile: Option<ActivePermissionProfile>,
         model: String,
         effort: Option<ReasoningEffortConfig>,
         summary: Option<ReasoningSummaryConfig>,
@@ -156,7 +156,7 @@ impl AppCommand {
             cwd,
             approval_policy,
             approvals_reviewer: None,
-            permission_profile,
+            active_permission_profile,
             model,
             effort,
             summary,
@@ -172,7 +172,7 @@ impl AppCommand {
         cwd: Option<PathBuf>,
         approval_policy: Option<AskForApproval>,
         approvals_reviewer: Option<ApprovalsReviewer>,
-        permission_profile: Option<PermissionProfile>,
+        active_permission_profile: Option<ActivePermissionProfile>,
         windows_sandbox_level: Option<WindowsSandboxLevel>,
         model: Option<String>,
         effort: Option<Option<ReasoningEffortConfig>>,
@@ -185,7 +185,7 @@ impl AppCommand {
             cwd,
             approval_policy,
             approvals_reviewer,
-            permission_profile,
+            active_permission_profile,
             windows_sandbox_level,
             model,
             effort,
diff --git a/codex-rs/tui/src/app_event.rs b/codex-rs/tui/src/app_event.rs
index 530e8876a7..07a5b51175 100644
--- a/codex-rs/tui/src/app_event.rs
+++ b/codex-rs/tui/src/app_event.rs
@@ -43,7 +43,7 @@ use codex_features::Feature;
 use codex_plugin::PluginCapabilitySummary;
 use codex_protocol::config_types::CollaborationModeMask;
 use codex_protocol::config_types::Personality;
-use codex_protocol::models::PermissionProfile;
+use codex_protocol::models::ActivePermissionProfile;
 use codex_protocol::openai_models::ReasoningEffort;
 use codex_realtime_webrtc::RealtimeWebrtcEvent;
 use codex_realtime_webrtc::RealtimeWebrtcSessionHandle;
@@ -355,6 +355,11 @@ pub(crate) enum AppEvent {
         force_refetch: bool,
     },
 
+    /// Fetch app connector state from the app server after the widget accepts a refresh request.
+    FetchConnectorsList {
+        force_refetch: bool,
+    },
+
     /// Fetch plugin marketplace state for the provided working directory.
     FetchPluginsList {
         cwd: PathBuf,
@@ -608,9 +613,6 @@ pub(crate) enum AppEvent {
     /// Update the current model slug in the running app and widget.
     UpdateModel(String),
 
-    /// Update the active collaboration mask in the running app and widget.
-    UpdateCollaborationMode(CollaborationModeMask),
-
     /// Update the current personality in the running app and widget.
     UpdatePersonality(Personality),
 
@@ -745,8 +747,8 @@ pub(crate) enum AppEvent {
     /// Update the current approval policy in the running app and widget.
     UpdateAskForApprovalPolicy(AskForApproval),
 
-    /// Update the current permission profile in the running app and widget.
-    UpdatePermissionProfile(PermissionProfile),
+    /// Update the current built-in active permission profile in the running app and widget.
+    UpdateActivePermissionProfile(ActivePermissionProfile),
 
     /// Update the current approvals reviewer in the running app and widget.
     UpdateApprovalsReviewer(ApprovalsReviewer),
diff --git a/codex-rs/tui/src/app_server_session.rs b/codex-rs/tui/src/app_server_session.rs
index ba228c4d57..5ea7bccf97 100644
--- a/codex-rs/tui/src/app_server_session.rs
+++ b/codex-rs/tui/src/app_server_session.rs
@@ -34,8 +34,6 @@ use codex_app_server_protocol::MemoryResetResponse;
 use codex_app_server_protocol::Model as ApiModel;
 use codex_app_server_protocol::ModelListParams;
 use codex_app_server_protocol::ModelListResponse;
-use codex_app_server_protocol::PermissionProfileModificationParams;
-use codex_app_server_protocol::PermissionProfileSelectionParams;
 use codex_app_server_protocol::RateLimitSnapshot;
 use codex_app_server_protocol::RequestId;
 use codex_app_server_protocol::ReviewDelivery;
@@ -108,7 +106,6 @@ use codex_otel::TelemetryAuthMode;
 use codex_protocol::ThreadId;
 use codex_protocol::approvals::GuardianAssessmentEvent;
 use codex_protocol::models::ActivePermissionProfile;
-use codex_protocol::models::ActivePermissionProfileModification;
 use codex_protocol::models::PermissionProfile;
 use codex_protocol::models::ResponseItem;
 use codex_protocol::openai_models::ModelAvailabilityNux;
@@ -174,6 +171,16 @@ pub(crate) struct AppServerStartedThread {
     pub(crate) turns: Vec<Turn>,
 }
 
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) enum TurnPermissionsOverride {
+    /// Leave the app-server thread's sticky permission profile unchanged.
+    Preserve,
+    /// Select a named or built-in profile by id.
+    ActiveProfile(ActivePermissionProfile),
+    /// Apply a user-selected legacy/custom permission profile.
+    LegacySandbox(PermissionProfile),
+}
+
 impl AppServerSession {
     pub(crate) fn new(client: AppServerClient) -> Self {
         Self {
@@ -550,8 +557,8 @@ impl AppServerSession {
         cwd: PathBuf,
         approval_policy: AskForApproval,
         approvals_reviewer: codex_protocol::config_types::ApprovalsReviewer,
-        permission_profile: PermissionProfile,
-        active_permission_profile: Option<ActivePermissionProfile>,
+        permissions_override: TurnPermissionsOverride,
+        workspace_roots: &[AbsolutePathBuf],
         model: String,
         effort: Option<codex_protocol::openai_models::ReasoningEffort>,
         summary: Option<codex_protocol::config_types::ReasoningSummary>,
@@ -561,12 +568,8 @@ impl AppServerSession {
         output_schema: Option<serde_json::Value>,
     ) -> Result<TurnStartResponse> {
         let request_id = self.next_request_id();
-        let (sandbox_policy, permissions) = turn_permissions_overrides(
-            &permission_profile,
-            active_permission_profile,
-            cwd.as_path(),
-            self.thread_params_mode(),
-        );
+        let (sandbox_policy, permissions) =
+            turn_permissions_overrides(permissions_override, cwd.as_path());
         self.client
             .request_typed(ClientRequest::TurnStart {
                 request_id,
@@ -576,6 +579,12 @@ impl AppServerSession {
                     responsesapi_client_metadata: None,
                     environments: None,
                     cwd: Some(cwd),
+                    runtime_workspace_roots: Some(
+                        workspace_roots
+                            .iter()
+                            .map(AbsolutePathBuf::to_path_buf)
+                            .collect(),
+                    ),
                     approval_policy: Some(approval_policy),
                     approvals_reviewer: Some(approvals_reviewer.into()),
                     sandbox_policy,
@@ -1172,56 +1181,43 @@ fn sandbox_mode_from_permission_profile(
     }
 }
 
-fn permissions_selection_from_active_profile(
-    active: ActivePermissionProfile,
-) -> PermissionProfileSelectionParams {
-    let modifications = active
-        .modifications
-        .into_iter()
-        .map(|modification| match modification {
-            ActivePermissionProfileModification::AdditionalWritableRoot { path } => {
-                PermissionProfileModificationParams::AdditionalWritableRoot { path }
-            }
-        })
-        .collect::<Vec<_>>();
-    PermissionProfileSelectionParams::Profile {
-        id: active.id,
-        modifications: (!modifications.is_empty()).then_some(modifications),
-    }
+fn permission_profile_id_from_active_profile(active: ActivePermissionProfile) -> String {
+    active.id
 }
 
 fn turn_permissions_overrides(
-    permission_profile: &PermissionProfile,
-    active_permission_profile: Option<ActivePermissionProfile>,
+    permissions_override: TurnPermissionsOverride,
     cwd: &std::path::Path,
-    thread_params_mode: ThreadParamsMode,
 ) -> (
     Option<codex_app_server_protocol::SandboxPolicy>,
-    Option<PermissionProfileSelectionParams>,
+    Option<String>,
 ) {
-    let permissions = if matches!(thread_params_mode, ThreadParamsMode::Embedded) {
-        active_permission_profile.map(permissions_selection_from_active_profile)
-    } else {
-        None
-    };
-    let sandbox_policy = (matches!(thread_params_mode, ThreadParamsMode::Remote)
-        || permissions.is_none())
-    .then(|| {
-        let legacy_profile = legacy_compatible_permission_profile(permission_profile, cwd);
-        let policy = legacy_profile
-            .to_legacy_sandbox_policy(cwd)
-            .unwrap_or_else(|err| {
-                unreachable!("legacy-compatible permissions must project to legacy policy: {err}")
-            });
-        policy.into()
-    });
-    (sandbox_policy, permissions)
+    match permissions_override {
+        TurnPermissionsOverride::Preserve => (None, None),
+        TurnPermissionsOverride::ActiveProfile(active_permission_profile) => (
+            None,
+            Some(permission_profile_id_from_active_profile(
+                active_permission_profile,
+            )),
+        ),
+        TurnPermissionsOverride::LegacySandbox(permission_profile) => {
+            let legacy_profile = legacy_compatible_permission_profile(&permission_profile, cwd);
+            let policy = legacy_profile
+                .to_legacy_sandbox_policy(cwd)
+                .unwrap_or_else(|err| {
+                    unreachable!(
+                        "legacy-compatible permissions must project to legacy policy: {err}"
+                    )
+                });
+            (Some(policy.into()), None)
+        }
+    }
 }
 
 fn permissions_selection_from_config(
     config: &Config,
     thread_params_mode: ThreadParamsMode,
-) -> Option<PermissionProfileSelectionParams> {
+) -> Option<String> {
     if matches!(thread_params_mode, ThreadParamsMode::Remote) {
         return None;
     }
@@ -1229,7 +1225,7 @@ fn permissions_selection_from_config(
     config
         .permissions
         .active_permission_profile()
-        .map(permissions_selection_from_active_profile)
+        .map(permission_profile_id_from_active_profile)
 }
 
 fn thread_start_params_from_config(
@@ -1243,7 +1239,7 @@ fn thread_start_params_from_config(
         .is_none()
         .then(|| {
             sandbox_mode_from_permission_profile(
-                &config.permissions.permission_profile(),
+                &config.permissions.effective_permission_profile(),
                 config.cwd.as_path(),
             )
         })
@@ -1253,6 +1249,13 @@ fn thread_start_params_from_config(
         model_provider: thread_params_mode.model_provider_from_config(config),
         service_tier: service_tier_override_from_config(config),
         cwd: thread_cwd_from_config(config, thread_params_mode, remote_cwd_override),
+        runtime_workspace_roots: Some(
+            config
+                .workspace_roots
+                .iter()
+                .map(AbsolutePathBuf::to_path_buf)
+                .collect(),
+        ),
         approval_policy: Some(config.permissions.approval_policy.value().into()),
         approvals_reviewer: approvals_reviewer_override_from_config(config),
         sandbox,
@@ -1277,7 +1280,7 @@ fn thread_resume_params_from_config(
         .is_none()
         .then(|| {
             sandbox_mode_from_permission_profile(
-                &config.permissions.permission_profile(),
+                &config.permissions.effective_permission_profile(),
                 config.cwd.as_path(),
             )
         })
@@ -1288,6 +1291,13 @@ fn thread_resume_params_from_config(
         model_provider: thread_params_mode.model_provider_from_config(&config),
         service_tier: service_tier_override_from_config(&config),
         cwd: thread_cwd_from_config(&config, thread_params_mode, remote_cwd_override),
+        runtime_workspace_roots: Some(
+            config
+                .workspace_roots
+                .iter()
+                .map(AbsolutePathBuf::to_path_buf)
+                .collect(),
+        ),
         approval_policy: Some(config.permissions.approval_policy.value().into()),
         approvals_reviewer: approvals_reviewer_override_from_config(&config),
         sandbox,
@@ -1309,7 +1319,7 @@ fn thread_fork_params_from_config(
         .is_none()
         .then(|| {
             sandbox_mode_from_permission_profile(
-                &config.permissions.permission_profile(),
+                &config.permissions.effective_permission_profile(),
                 config.cwd.as_path(),
             )
         })
@@ -1320,6 +1330,13 @@ fn thread_fork_params_from_config(
         model_provider: thread_params_mode.model_provider_from_config(&config),
         service_tier: service_tier_override_from_config(&config),
         cwd: thread_cwd_from_config(&config, thread_params_mode, remote_cwd_override),
+        runtime_workspace_roots: Some(
+            config
+                .workspace_roots
+                .iter()
+                .map(AbsolutePathBuf::to_path_buf)
+                .collect(),
+        ),
         approval_policy: Some(config.permissions.approval_policy.value().into()),
         approvals_reviewer: approvals_reviewer_override_from_config(&config),
         sandbox,
@@ -1397,9 +1414,8 @@ async fn thread_session_state_from_thread_start_response(
     config: &Config,
     thread_params_mode: ThreadParamsMode,
 ) -> Result<ThreadSessionState, String> {
-    let permission_profile = permission_profile_from_thread_response(
+    let permission_profile = display_permission_profile_from_thread_response(
         &response.sandbox,
-        response.permission_profile.as_ref(),
         response.cwd.as_path(),
         config,
         thread_params_mode,
@@ -1417,6 +1433,7 @@ async fn thread_session_state_from_thread_start_response(
         permission_profile,
         response.active_permission_profile.clone().map(Into::into),
         response.cwd.clone(),
+        response.runtime_workspace_roots.clone(),
         response.instruction_sources.clone(),
         response.reasoning_effort,
         config,
@@ -1429,13 +1446,21 @@ async fn thread_session_state_from_thread_resume_response(
     config: &Config,
     thread_params_mode: ThreadParamsMode,
 ) -> Result<ThreadSessionState, String> {
-    let permission_profile = permission_profile_from_thread_response(
-        &response.sandbox,
-        response.permission_profile.as_ref(),
-        response.cwd.as_path(),
-        config,
-        thread_params_mode,
-    );
+    let permission_profile = if matches!(thread_params_mode, ThreadParamsMode::Embedded)
+        && response.active_permission_profile.is_none()
+    {
+        PermissionProfile::from_legacy_sandbox_policy_for_cwd(
+            &response.sandbox.to_core(),
+            response.cwd.as_path(),
+        )
+    } else {
+        display_permission_profile_from_thread_response(
+            &response.sandbox,
+            response.cwd.as_path(),
+            config,
+            thread_params_mode,
+        )
+    };
     thread_session_state_from_thread_response(
         &response.thread.id,
         response.thread.forked_from_id.clone(),
@@ -1449,6 +1474,7 @@ async fn thread_session_state_from_thread_resume_response(
         permission_profile,
         response.active_permission_profile.clone().map(Into::into),
         response.cwd.clone(),
+        response.runtime_workspace_roots.clone(),
         response.instruction_sources.clone(),
         response.reasoning_effort,
         config,
@@ -1461,9 +1487,8 @@ async fn thread_session_state_from_thread_fork_response(
     config: &Config,
     thread_params_mode: ThreadParamsMode,
 ) -> Result<ThreadSessionState, String> {
-    let permission_profile = permission_profile_from_thread_response(
+    let permission_profile = display_permission_profile_from_thread_response(
         &response.sandbox,
-        response.permission_profile.as_ref(),
         response.cwd.as_path(),
         config,
         thread_params_mode,
@@ -1481,6 +1506,7 @@ async fn thread_session_state_from_thread_fork_response(
         permission_profile,
         response.active_permission_profile.clone().map(Into::into),
         response.cwd.clone(),
+        response.runtime_workspace_roots.clone(),
         response.instruction_sources.clone(),
         response.reasoning_effort,
         config,
@@ -1488,18 +1514,14 @@ async fn thread_session_state_from_thread_fork_response(
     .await
 }
 
-fn permission_profile_from_thread_response(
+fn display_permission_profile_from_thread_response(
     sandbox: &codex_app_server_protocol::SandboxPolicy,
-    permission_profile: Option<&codex_app_server_protocol::PermissionProfile>,
     cwd: &std::path::Path,
     config: &Config,
     thread_params_mode: ThreadParamsMode,
 ) -> PermissionProfile {
-    if let Some(permission_profile) = permission_profile {
-        return permission_profile.clone().into();
-    }
     match thread_params_mode {
-        ThreadParamsMode::Embedded => config.permissions.permission_profile(),
+        ThreadParamsMode::Embedded => config.permissions.effective_permission_profile(),
         ThreadParamsMode::Remote => {
             PermissionProfile::from_legacy_sandbox_policy_for_cwd(&sandbox.to_core(), cwd)
         }
@@ -1523,6 +1545,7 @@ async fn thread_session_state_from_thread_response(
     permission_profile: PermissionProfile,
     active_permission_profile: Option<ActivePermissionProfile>,
     cwd: AbsolutePathBuf,
+    runtime_workspace_roots: Vec<AbsolutePathBuf>,
     instruction_source_paths: Vec<AbsolutePathBuf>,
     reasoning_effort: Option<codex_protocol::openai_models::ReasoningEffort>,
     config: &Config,
@@ -1550,6 +1573,7 @@ async fn thread_session_state_from_thread_response(
         permission_profile,
         active_permission_profile,
         cwd,
+        runtime_workspace_roots,
         instruction_source_paths,
         reasoning_effort,
         message_history: Some(MessageHistoryMetadata {
@@ -1564,10 +1588,19 @@ async fn thread_session_state_from_thread_response(
 pub(crate) fn app_server_rate_limit_snapshots(
     response: GetAccountRateLimitsResponse,
 ) -> Vec<RateLimitSnapshot> {
-    let mut snapshots = Vec::new();
-    snapshots.push(response.rate_limits);
+    let primary_limit_id = response.rate_limits.limit_id.clone();
+    let mut snapshots = vec![response.rate_limits];
     if let Some(by_limit_id) = response.rate_limits_by_limit_id {
-        snapshots.extend(by_limit_id.into_values());
+        snapshots.extend(by_limit_id.into_iter().filter_map(|(limit_id, snapshot)| {
+            if primary_limit_id.as_deref().is_some_and(|primary_limit_id| {
+                primary_limit_id == limit_id
+                    || Some(primary_limit_id) == snapshot.limit_id.as_deref()
+            }) {
+                None
+            } else {
+                Some(snapshot)
+            }
+        }));
     }
     snapshots
 }
@@ -1577,13 +1610,6 @@ mod tests {
     use super::*;
     use crate::legacy_core::config::ConfigBuilder;
     use crate::legacy_core::config::ConfigOverrides;
-    use codex_app_server_protocol::FileSystemAccessMode;
-    use codex_app_server_protocol::FileSystemPath;
-    use codex_app_server_protocol::FileSystemSandboxEntry;
-    use codex_app_server_protocol::FileSystemSpecialPath;
-    use codex_app_server_protocol::PermissionProfile as AppServerPermissionProfile;
-    use codex_app_server_protocol::PermissionProfileFileSystemPermissions;
-    use codex_app_server_protocol::PermissionProfileNetworkPermissions;
     use codex_app_server_protocol::ThreadStatus;
     use codex_app_server_protocol::Turn;
     use codex_app_server_protocol::TurnStatus;
@@ -1592,7 +1618,15 @@ mod tests {
     use codex_protocol::config_types::ServiceTier;
     use codex_protocol::config_types::Verbosity;
     use codex_protocol::config_types::WebSearchMode;
+    use codex_protocol::models::BUILT_IN_PERMISSION_PROFILE_READ_ONLY;
+    use codex_protocol::models::BUILT_IN_PERMISSION_PROFILE_WORKSPACE;
+    use codex_protocol::models::ManagedFileSystemPermissions;
     use codex_protocol::openai_models::ReasoningEffort;
+    use codex_protocol::permissions::FileSystemAccessMode;
+    use codex_protocol::permissions::FileSystemPath;
+    use codex_protocol::permissions::FileSystemSandboxEntry;
+    use codex_protocol::permissions::FileSystemSpecialPath;
+    use codex_protocol::permissions::NetworkSandboxPolicy;
     use codex_utils_absolute_path::test_support::PathBufExt;
     use codex_utils_absolute_path::test_support::test_path_buf;
     use pretty_assertions::assert_eq;
@@ -1606,13 +1640,50 @@ mod tests {
             .expect("config should build")
     }
 
+    fn rate_limit_snapshot(limit_id: &str) -> RateLimitSnapshot {
+        RateLimitSnapshot {
+            limit_id: Some(limit_id.to_string()),
+            limit_name: None,
+            primary: Some(codex_app_server_protocol::RateLimitWindow {
+                used_percent: 0,
+                window_duration_mins: Some(10_080),
+                resets_at: None,
+            }),
+            secondary: None,
+            credits: None,
+            plan_type: None,
+            rate_limit_reached_type: None,
+        }
+    }
+
+    #[test]
+    fn app_server_rate_limit_snapshots_deduplicates_top_level_limit_from_map() {
+        let response = GetAccountRateLimitsResponse {
+            rate_limits: rate_limit_snapshot("codex"),
+            rate_limits_by_limit_id: Some(HashMap::from([
+                ("codex".to_string(), rate_limit_snapshot("codex")),
+                ("other".to_string(), rate_limit_snapshot("other")),
+            ])),
+        };
+
+        let snapshots = app_server_rate_limit_snapshots(response);
+
+        assert_eq!(
+            snapshots
+                .iter()
+                .map(|snapshot| snapshot.limit_id.as_deref())
+                .collect::<Vec<_>>(),
+            vec![Some("codex"), Some("other")]
+        );
+    }
+
     #[tokio::test]
     async fn thread_start_params_include_cwd_for_embedded_sessions() {
         let temp_dir = tempfile::tempdir().expect("tempdir");
         let config = ConfigBuilder::default()
             .codex_home(temp_dir.path().to_path_buf())
             .harness_overrides(ConfigOverrides {
-                default_permissions: Some(":workspace".to_string()),
+                default_permissions: Some(BUILT_IN_PERMISSION_PROFILE_WORKSPACE.to_string()),
                 ..ConfigOverrides::default()
             })
             .build()
@@ -1627,13 +1698,23 @@ mod tests {
         );
 
         assert_eq!(params.cwd, Some(config.cwd.to_string_lossy().to_string()));
+        assert_eq!(
+            params.runtime_workspace_roots,
+            Some(
+                config
+                    .workspace_roots
+                    .iter()
+                    .map(AbsolutePathBuf::to_path_buf)
+                    .collect()
+            )
+        );
         assert_eq!(params.sandbox, None);
         assert_eq!(
             params.permissions,
             config
                 .permissions
                 .active_permission_profile()
-                .map(permissions_selection_from_active_profile)
+                .map(permission_profile_id_from_active_profile)
         );
         assert_eq!(params.model_provider, Some(config.model_provider_id));
         assert_eq!(params.thread_source, Some(ThreadSource::User));
@@ -1657,15 +1738,14 @@ mod tests {
     #[test]
     fn embedded_turn_permissions_use_active_profile_selection() {
         let cwd = test_path_buf("/workspace/project").abs();
-        let active_permission_profile = ActivePermissionProfile::new(":workspace");
+        let active_permission_profile =
+            ActivePermissionProfile::new(BUILT_IN_PERMISSION_PROFILE_WORKSPACE);
         let expected_permissions =
-            permissions_selection_from_active_profile(active_permission_profile.clone());
+            permission_profile_id_from_active_profile(active_permission_profile.clone());
 
         let (sandbox_policy, permissions) = turn_permissions_overrides(
-            &PermissionProfile::workspace_write(),
-            Some(active_permission_profile),
+            TurnPermissionsOverride::ActiveProfile(active_permission_profile),
             cwd.as_path(),
-            ThreadParamsMode::Embedded,
         );
 
         assert_eq!(sandbox_policy, None);
@@ -1673,14 +1753,41 @@ mod tests {
     }
 
     #[test]
-    fn embedded_turn_permissions_fall_back_to_sandbox_without_active_profile() {
+    fn embedded_turn_permissions_select_profile_id_only() {
+        let cwd = test_path_buf("/workspace/project").abs();
+        let active_permission_profile =
+            ActivePermissionProfile::new(BUILT_IN_PERMISSION_PROFILE_WORKSPACE);
+
+        let (sandbox_policy, permissions) = turn_permissions_overrides(
+            TurnPermissionsOverride::ActiveProfile(active_permission_profile),
+            cwd.as_path(),
+        );
+
+        assert_eq!(sandbox_policy, None);
+        assert_eq!(
+            permissions,
+            Some(BUILT_IN_PERMISSION_PROFILE_WORKSPACE.to_string())
+        );
+    }
+
+    #[test]
+    fn turn_permissions_preserve_thread_permissions_without_override() {
+        let cwd = test_path_buf("/workspace/project").abs();
+
+        let (sandbox_policy, permissions) =
+            turn_permissions_overrides(TurnPermissionsOverride::Preserve, cwd.as_path());
+
+        assert_eq!(sandbox_policy, None);
+        assert_eq!(permissions, None);
+    }
+
+    #[test]
+    fn legacy_turn_permissions_project_to_sandbox_when_explicitly_overridden() {
         let cwd = test_path_buf("/workspace/project").abs();
 
         let (sandbox_policy, permissions) = turn_permissions_overrides(
-            &PermissionProfile::read_only(),
-            /*active_permission_profile*/ None,
+            TurnPermissionsOverride::LegacySandbox(PermissionProfile::read_only()),
             cwd.as_path(),
-            ThreadParamsMode::Embedded,
         );
 
         assert_eq!(
@@ -1693,23 +1800,19 @@ mod tests {
     }
 
     #[test]
-    fn remote_turn_permissions_use_sandbox_even_with_active_profile() {
+    fn remote_turn_permissions_preserve_active_profile_selection() {
         let cwd = test_path_buf("/workspace/project").abs();
+        let active_permission_profile = ActivePermissionProfile::new("strict");
+        let expected_permissions =
+            permission_profile_id_from_active_profile(active_permission_profile.clone());
 
         let (sandbox_policy, permissions) = turn_permissions_overrides(
-            &PermissionProfile::read_only(),
-            Some(ActivePermissionProfile::new(":read-only")),
+            TurnPermissionsOverride::ActiveProfile(active_permission_profile),
             cwd.as_path(),
-            ThreadParamsMode::Remote,
         );
 
-        assert_eq!(
-            sandbox_policy,
-            Some(codex_app_server_protocol::SandboxPolicy::ReadOnly {
-                network_access: false
-            })
-        );
-        assert_eq!(permissions, None);
+        assert_eq!(sandbox_policy, None);
+        assert_eq!(permissions, Some(expected_permissions));
     }
 
     #[tokio::test]
@@ -1718,9 +1821,16 @@ mod tests {
         let config = build_config(&temp_dir).await;
         let thread_id = ThreadId::new();
         let expected_sandbox = sandbox_mode_from_permission_profile(
-            &config.permissions.permission_profile(),
+            &config.permissions.effective_permission_profile(),
             config.cwd.as_path(),
         );
+        let expected_runtime_workspace_roots = Some(
+            config
+                .workspace_roots
+                .iter()
+                .map(AbsolutePathBuf::to_path_buf)
+                .collect::<Vec<_>>(),
+        );
 
         let start = thread_start_params_from_config(
             &config,
@@ -1744,6 +1854,18 @@ mod tests {
         assert_eq!(start.cwd, None);
         assert_eq!(resume.cwd, None);
         assert_eq!(fork.cwd, None);
+        assert_eq!(
+            start.runtime_workspace_roots,
+            expected_runtime_workspace_roots
+        );
+        assert_eq!(
+            resume.runtime_workspace_roots,
+            expected_runtime_workspace_roots
+        );
+        assert_eq!(
+            fork.runtime_workspace_roots,
+            expected_runtime_workspace_roots
+        );
         assert_eq!(start.model_provider, None);
         assert_eq!(resume.model_provider, None);
         assert_eq!(fork.model_provider, None);
@@ -1761,9 +1883,9 @@ mod tests {
     fn sandbox_mode_does_not_project_non_cwd_write_roots_for_remote_sessions() {
         let cwd = test_path_buf("/workspace/project").abs();
         let extra_root = test_path_buf("/workspace/cache").abs();
-        let permission_profile: PermissionProfile = AppServerPermissionProfile::Managed {
-            network: PermissionProfileNetworkPermissions { enabled: false },
-            file_system: PermissionProfileFileSystemPermissions::Restricted {
+        let permission_profile: PermissionProfile = PermissionProfile::Managed {
+            network: NetworkSandboxPolicy::Restricted,
+            file_system: ManagedFileSystemPermissions::Restricted {
                 entries: vec![
                     FileSystemSandboxEntry {
                         path: FileSystemPath::Special {
@@ -1778,8 +1900,7 @@ mod tests {
                 ],
                 glob_scan_max_depth: None,
             },
-        }
-        .into();
+        };
 
         assert_eq!(
             sandbox_mode_from_permission_profile(&permission_profile, cwd.as_path()),
@@ -1790,9 +1911,9 @@ mod tests {
     #[test]
     fn sandbox_mode_projects_cwd_write_for_remote_sessions() {
         let cwd = test_path_buf("/workspace/project").abs();
-        let permission_profile: PermissionProfile = AppServerPermissionProfile::Managed {
-            network: PermissionProfileNetworkPermissions { enabled: false },
-            file_system: PermissionProfileFileSystemPermissions::Restricted {
+        let permission_profile: PermissionProfile = PermissionProfile::Managed {
+            network: NetworkSandboxPolicy::Restricted,
+            file_system: ManagedFileSystemPermissions::Restricted {
                 entries: vec![
                     FileSystemSandboxEntry {
                         path: FileSystemPath::Special {
@@ -1809,8 +1930,7 @@ mod tests {
                 ],
                 glob_scan_max_depth: None,
             },
-        }
-        .into();
+        };
 
         assert_eq!(
             sandbox_mode_from_permission_profile(&permission_profile, cwd.as_path()),
@@ -1825,7 +1945,7 @@ mod tests {
         let thread_id = ThreadId::new();
         let remote_cwd = PathBuf::from("repo/on/server");
         let expected_sandbox = sandbox_mode_from_permission_profile(
-            &config.permissions.permission_profile(),
+            &config.permissions.effective_permission_profile(),
             config.cwd.as_path(),
         );
 
@@ -2014,6 +2134,10 @@ mod tests {
             model_provider: "openai".to_string(),
             service_tier: None,
             cwd: test_path_buf("/tmp/project").abs(),
+            runtime_workspace_roots: vec![
+                test_path_buf("/tmp/project").abs(),
+                test_path_buf("/tmp/project/extra").abs(),
+            ],
             instruction_sources: vec![test_path_buf("/tmp/project/AGENTS.md").abs()],
             approval_policy: codex_app_server_protocol::AskForApproval::Never,
             approvals_reviewer: codex_app_server_protocol::ApprovalsReviewer::User,
@@ -2021,7 +2145,6 @@ mod tests {
                 .to_legacy_sandbox_policy(test_path_buf("/tmp/project").as_path())
                 .expect("read-only profile must be legacy-compatible")
                 .into(),
-            permission_profile: Some(read_only_profile.clone().into()),
             active_permission_profile: None,
             reasoning_effort: None,
         };
@@ -2034,6 +2157,10 @@ mod tests {
         .await
         .expect("resume response should map");
         assert_eq!(started.session.forked_from_id, Some(forked_from_id));
+        assert_eq!(
+            started.session.runtime_workspace_roots,
+            response.runtime_workspace_roots
+        );
         assert_eq!(
             started.session.instruction_source_paths,
             response.instruction_sources
@@ -2041,64 +2168,75 @@ mod tests {
         assert_eq!(started.session.permission_profile, read_only_profile);
         assert_eq!(started.turns.len(), 1);
         assert_eq!(started.turns[0], response.thread.turns[0]);
+
+        let embedded_config = ConfigBuilder::default()
+            .codex_home(temp_dir.path().join("embedded-codex-home"))
+            .harness_overrides(ConfigOverrides {
+                default_permissions: Some(BUILT_IN_PERMISSION_PROFILE_WORKSPACE.to_string()),
+                ..ConfigOverrides::default()
+            })
+            .build()
+            .await
+            .expect("config should build");
+        let started = started_thread_from_resume_response(
+            response.clone(),
+            &embedded_config,
+            ThreadParamsMode::Embedded,
+        )
+        .await
+        .expect("embedded resume response should map");
+        assert_eq!(started.session.permission_profile, read_only_profile);
+
+        let mut empty_roots_response = response;
+        empty_roots_response.runtime_workspace_roots = Vec::new();
+        let started = started_thread_from_resume_response(
+            empty_roots_response,
+            &config,
+            ThreadParamsMode::Remote,
+        )
+        .await
+        .expect("resume response should map");
+        assert_eq!(started.session.runtime_workspace_roots, Vec::new());
     }
 
     #[tokio::test]
-    async fn remote_thread_response_prefers_permission_profile_over_legacy_sandbox() {
+    async fn remote_thread_response_uses_legacy_sandbox_fallback() {
         let temp_dir = tempfile::tempdir().expect("tempdir");
         let config = build_config(&temp_dir).await;
         let cwd = test_path_buf("/tmp/project").abs();
-        let fallback_sandbox = PermissionProfile::read_only()
+        let sandbox = PermissionProfile::read_only()
             .to_legacy_sandbox_policy(cwd.as_path())
             .expect("read-only profile must be legacy-compatible")
             .into();
-        let response_profile = AppServerPermissionProfile::Managed {
-            file_system: PermissionProfileFileSystemPermissions::Restricted {
-                entries: vec![
-                    FileSystemSandboxEntry {
-                        path: FileSystemPath::Special {
-                            value: FileSystemSpecialPath::Root,
-                        },
-                        access: FileSystemAccessMode::Read,
-                    },
-                    FileSystemSandboxEntry {
-                        path: FileSystemPath::Special {
-                            value: FileSystemSpecialPath::ProjectRoots {
-                                subpath: Some(".env".into()),
-                            },
-                        },
-                        access: FileSystemAccessMode::None,
-                    },
-                ],
-                glob_scan_max_depth: None,
-            },
-            network: PermissionProfileNetworkPermissions { enabled: false },
-        };
-        let split_profile: PermissionProfile = response_profile.clone().into();
 
         assert_eq!(
-            permission_profile_from_thread_response(
-                &fallback_sandbox,
-                Some(&response_profile),
+            display_permission_profile_from_thread_response(
+                &sandbox,
                 cwd.as_path(),
                 &config,
                 ThreadParamsMode::Remote,
             ),
-            split_profile
+            PermissionProfile::read_only()
         );
     }
 
     #[tokio::test]
-    async fn embedded_thread_response_prefers_permission_profile_when_present() {
+    async fn embedded_thread_response_uses_local_config_profile() {
         let temp_dir = tempfile::tempdir().expect("tempdir");
-        let config = build_config(&temp_dir).await;
+        let config = ConfigBuilder::default()
+            .codex_home(temp_dir.path().to_path_buf())
+            .harness_overrides(ConfigOverrides {
+                default_permissions: Some(BUILT_IN_PERMISSION_PROFILE_READ_ONLY.to_string()),
+                ..ConfigOverrides::default()
+            })
+            .build()
+            .await
+            .expect("config should build");
         let cwd = test_path_buf("/tmp/project").abs();
-        let response_profile = PermissionProfile::read_only().into();
 
         assert_eq!(
-            permission_profile_from_thread_response(
+            display_permission_profile_from_thread_response(
                 &codex_app_server_protocol::SandboxPolicy::DangerFullAccess,
-                Some(&response_profile),
                 cwd.as_path(),
                 &config,
                 ThreadParamsMode::Embedded,
@@ -2137,6 +2275,7 @@ mod tests {
             /*active_permission_profile*/ None,
             test_path_buf("/tmp/project").abs(),
             Vec::new(),
+            Vec::new(),
             /*reasoning_effort*/ None,
             &config,
         )
@@ -2171,6 +2310,7 @@ mod tests {
             /*active_permission_profile*/ None,
             test_path_buf("/tmp/project").abs(),
             Vec::new(),
+            Vec::new(),
             /*reasoning_effort*/ None,
             &config,
         )
diff --git a/codex-rs/tui/src/bottom_pane/approval_overlay.rs b/codex-rs/tui/src/bottom_pane/approval_overlay.rs
index 1089d3668e..17b17f3598 100644
--- a/codex-rs/tui/src/bottom_pane/approval_overlay.rs
+++ b/codex-rs/tui/src/bottom_pane/approval_overlay.rs
@@ -47,6 +47,7 @@ use codex_app_server_protocol::FileSystemSandboxEntry;
 use codex_app_server_protocol::FileSystemSpecialPath;
 use codex_app_server_protocol::McpServerElicitationAction;
 use codex_app_server_protocol::NetworkApprovalContext;
+use codex_app_server_protocol::NetworkApprovalProtocol;
 use codex_app_server_protocol::NetworkPolicyRuleAction;
 use codex_app_server_protocol::RequestId;
 use codex_features::Features;
@@ -354,8 +355,25 @@ impl ApprovalOverlay {
             return;
         };
         if request.thread_label().is_none() {
+            let subject = match request {
+                ApprovalRequest::Exec {
+                    network_approval_context: Some(network_approval_context),
+                    ..
+                } => history_cell::ApprovalDecisionSubject::NetworkAccess {
+                    target: network_approval_target(network_approval_context, command),
+                },
+                _ => {
+                    if let Some(target) = network_approval_command_target(command) {
+                        history_cell::ApprovalDecisionSubject::NetworkAccess {
+                            target: target.to_string(),
+                        }
+                    } else {
+                        history_cell::ApprovalDecisionSubject::Command(command.to_vec())
+                    }
+                }
+            };
             let cell = history_cell::new_approval_decision_cell(
-                command.to_vec(),
+                subject,
                 command_decision_to_review_decision(&decision),
                 history_cell::ApprovalDecisionActor::User,
             );
@@ -623,6 +641,35 @@ fn approval_footer_hint(
     Line::from(spans)
 }
 
+fn network_approval_target(
+    network_approval_context: &NetworkApprovalContext,
+    command: &[String],
+) -> String {
+    if let Some(target) = network_approval_command_target(command) {
+        return target.to_string();
+    }
+
+    let scheme = match network_approval_context.protocol {
+        NetworkApprovalProtocol::Http => "http",
+        NetworkApprovalProtocol::Https => "https",
+        NetworkApprovalProtocol::Socks5Tcp => "socks5-tcp",
+        NetworkApprovalProtocol::Socks5Udp => "socks5-udp",
+    };
+    format!("{scheme}://{}", network_approval_context.host)
+}
+
+fn network_approval_command_target(command: &[String]) -> Option<&str> {
+    match command {
+        [program, target] if program == "network-access" && !target.is_empty() => {
+            Some(target.as_str())
+        }
+        [command] => command
+            .strip_prefix("network-access ")
+            .filter(|target| !target.is_empty()),
+        _ => None,
+    }
+}
+
 fn build_header(request: &ApprovalRequest) -> Box<dyn Renderable> {
     match request {
         ApprovalRequest::Exec {
@@ -913,7 +960,7 @@ pub(crate) fn format_additional_permissions_rule(
                 .entries
                 .iter()
                 .flatten()
-                .filter(|entry| entry.access == FileSystemAccessMode::None),
+                .filter(|entry| entry.access == FileSystemAccessMode::Deny),
         );
         if !denied_reads.is_empty() {
             parts.push(format!("deny read {denied_reads}"));
@@ -956,7 +1003,7 @@ fn special_path_label(value: &FileSystemSpecialPath) -> String {
     match value {
         FileSystemSpecialPath::Root => ":root".to_string(),
         FileSystemSpecialPath::Minimal => ":minimal".to_string(),
-        FileSystemSpecialPath::ProjectRoots { subpath } => path_label(":project_roots", subpath),
+        FileSystemSpecialPath::ProjectRoots { subpath } => path_label(":workspace_roots", subpath),
         FileSystemSpecialPath::Tmpdir => ":tmpdir".to_string(),
         FileSystemSpecialPath::SlashTmp => "/tmp".to_string(),
         FileSystemSpecialPath::Unknown { path, subpath } => path_label(path, subpath),
@@ -1102,6 +1149,21 @@ mod tests {
             .join("\n")
     }
 
+    fn render_history_cell_lines(
+        cell: &dyn crate::history_cell::HistoryCell,
+        width: u16,
+    ) -> Vec<String> {
+        cell.display_lines(width)
+            .iter()
+            .map(|line| {
+                line.spans
+                    .iter()
+                    .map(|span| span.content.as_ref())
+                    .collect::<String>()
+            })
+            .collect()
+    }
+
     fn normalize_snapshot_paths(rendered: String) -> String {
         [
             (absolute_path("/tmp/readme.txt"), "/tmp/readme.txt"),
@@ -1758,7 +1820,7 @@ mod tests {
                         path: FileSystemPath::GlobPattern {
                             pattern: "**/*.env".to_string(),
                         },
-                        access: FileSystemAccessMode::None,
+                        access: FileSystemAccessMode::Deny,
                     },
                 ]),
                 glob_scan_max_depth: None,
@@ -1771,6 +1833,31 @@ mod tests {
         );
     }
 
+    #[test]
+    fn additional_permissions_rule_uses_workspace_roots_label() {
+        let additional_permissions = AdditionalPermissionProfile {
+            network: None,
+            file_system: Some(AdditionalFileSystemPermissions {
+                read: None,
+                write: None,
+                entries: Some(vec![FileSystemSandboxEntry {
+                    path: FileSystemPath::Special {
+                        value: FileSystemSpecialPath::ProjectRoots {
+                            subpath: Some(".git".into()),
+                        },
+                    },
+                    access: FileSystemAccessMode::Read,
+                }]),
+                glob_scan_max_depth: None,
+            }),
+        };
+
+        assert_eq!(
+            format_additional_permissions_rule(&additional_permissions),
+            Some("read `:workspace_roots/.git`".to_string())
+        );
+    }
+
     #[test]
     fn permissions_session_shortcut_submits_session_scope() {
         let (tx, mut rx) = unbounded_channel::<AppEvent>();
@@ -2086,7 +2173,7 @@ mod tests {
             "git add tui/src/render/mod.rs tui/src/render/renderable.rs".into(),
         ];
         let cell = history_cell::new_approval_decision_cell(
-            command,
+            history_cell::ApprovalDecisionSubject::Command(command),
             ReviewDecision::Approved,
             history_cell::ApprovalDecisionActor::User,
         );
@@ -2109,6 +2196,73 @@ mod tests {
         assert_eq!(rendered, expected);
     }
 
+    #[test]
+    fn exec_history_cell_does_not_render_blank_action_for_empty_command() {
+        let approved = history_cell::new_approval_decision_cell(
+            history_cell::ApprovalDecisionSubject::Command(Vec::new()),
+            ReviewDecision::Approved,
+            history_cell::ApprovalDecisionActor::User,
+        );
+        assert_eq!(
+            render_history_cell_lines(approved.as_ref(), /*width*/ 80),
+            vec!["✔ You approved this request this time".to_string()]
+        );
+
+        let approved_for_session = history_cell::new_approval_decision_cell(
+            history_cell::ApprovalDecisionSubject::Command(Vec::new()),
+            ReviewDecision::ApprovedForSession,
+            history_cell::ApprovalDecisionActor::User,
+        );
+        assert_eq!(
+            render_history_cell_lines(approved_for_session.as_ref(), /*width*/ 80),
+            vec!["✔ You approved this request every time this session".to_string()]
+        );
+    }
+
+    #[test]
+    fn network_access_command_history_uses_target_without_structured_context() {
+        let (tx_raw, mut rx) = unbounded_channel::<AppEvent>();
+        let tx = AppEventSender::new(tx_raw);
+        let mut view = make_overlay(
+            ApprovalRequest::Exec {
+                thread_id: ThreadId::new(),
+                thread_label: None,
+                id: "test".into(),
+                command: vec![
+                    "network-access".to_string(),
+                    "https://example.com:8443".to_string(),
+                ],
+                reason: None,
+                available_decisions: vec![
+                    CommandExecutionApprovalDecision::Accept,
+                    CommandExecutionApprovalDecision::Cancel,
+                ],
+                network_approval_context: None,
+                additional_permissions: None,
+            },
+            tx,
+            Features::with_defaults(),
+        );
+
+        view.handle_key_event(KeyEvent::new(KeyCode::Char('y'), KeyModifiers::NONE));
+
+        let mut decision = None;
+        while let Ok(event) = rx.try_recv() {
+            if let AppEvent::InsertHistoryCell(cell) = event {
+                decision = Some(cell);
+                break;
+            }
+        }
+        let decision = decision.expect("expected decision cell in history");
+        assert_eq!(
+            render_history_cell_lines(decision.as_ref(), /*width*/ 80),
+            vec![
+                "✔ You approved codex network access to https://example.com:8443 this time"
+                    .to_string(),
+            ]
+        );
+    }
+
     #[test]
     fn esc_cancels_mcp_elicitation() {
         let (tx_raw, mut rx) = unbounded_channel::<AppEvent>();
diff --git a/codex-rs/tui/src/bottom_pane/chat_composer.rs b/codex-rs/tui/src/bottom_pane/chat_composer.rs
index 0f97b7f6c9..2176e7762e 100644
--- a/codex-rs/tui/src/bottom_pane/chat_composer.rs
+++ b/codex-rs/tui/src/bottom_pane/chat_composer.rs
@@ -213,21 +213,29 @@ use crate::render::renderable::Renderable;
 use crate::slash_command::SlashCommand;
 use crate::style::user_message_style;
 use codex_protocol::ThreadId;
-use codex_protocol::models::local_image_label_text;
 use codex_protocol::user_input::ByteRange;
 use codex_protocol::user_input::MAX_USER_INPUT_TEXT_CHARS;
 use codex_protocol::user_input::TextElement;
 
+mod attachment_state;
+mod draft_state;
+mod footer_state;
 mod history_search;
+mod popup_state;
 
+use self::attachment_state::AttachmentState;
+use self::draft_state::ComposerMentionBinding;
+use self::draft_state::DraftState;
+use self::footer_state::FooterState;
 use self::history_search::HistorySearchSession;
+use self::popup_state::ActivePopup;
+use self::popup_state::PopupState;
 use crate::app_event::AppEvent;
 use crate::app_event::ConnectorsSnapshot;
 use crate::app_event_sender::AppEventSender;
 use crate::bottom_pane::LocalImageAttachment;
 use crate::bottom_pane::MentionBinding;
 use crate::bottom_pane::textarea::TextArea;
-use crate::bottom_pane::textarea::TextAreaState;
 use crate::clipboard_paste::normalize_pasted_path;
 use crate::clipboard_paste::pasted_image_format;
 use crate::history_cell;
@@ -242,7 +250,6 @@ use codex_file_search::FileMatch;
 #[cfg(test)]
 use codex_plugin::AppConnectorId;
 use codex_plugin::PluginCapabilitySummary;
-use std::cell::RefCell;
 use std::collections::HashMap;
 use std::collections::HashSet;
 use std::collections::VecDeque;
@@ -299,12 +306,6 @@ pub enum QueuedInputAction {
     RunShell,
 }
 
-#[derive(Clone, Debug, PartialEq)]
-struct AttachedImage {
-    placeholder: String,
-    path: PathBuf,
-}
-
 /// Feature flags for reusing the chat composer in other bottom-pane surfaces.
 ///
 /// The default keeps today's behavior intact. Other call sites can opt out of
@@ -344,66 +345,29 @@ impl ChatComposerConfig {
 }
 
 pub(crate) struct ChatComposer {
-    textarea: TextArea,
-    textarea_state: RefCell<TextAreaState>,
-    is_bash_mode: bool,
-    active_popup: ActivePopup,
+    draft: DraftState,
+    popups: PopupState,
     app_event_tx: AppEventSender,
     history: ChatComposerHistory,
-    quit_shortcut_expires_at: Option<Instant>,
-    quit_shortcut_key: KeyBinding,
-    esc_backtrack_hint: bool,
-    use_shift_enter_hint: bool,
-    dismissed_file_popup_token: Option<String>,
-    current_file_query: Option<String>,
-    pending_pastes: Vec<(String, String)>,
+    footer: FooterState,
     has_focus: bool,
     frame_requester: Option<FrameRequester>,
-    /// Invariant: attached images are labeled in vec order as
-    /// `[Image #M+1]..[Image #N]`, where `M` is the number of remote images.
-    attached_images: Vec<AttachedImage>,
+    attachments: AttachmentState,
     placeholder_text: String,
     is_task_running: bool,
-    /// When false, the composer is temporarily read-only (e.g. during sandbox setup).
-    input_enabled: bool,
-    input_disabled_placeholder: Option<String>,
-    /// Non-bracketed paste burst tracker (see `bottom_pane/paste_burst.rs`).
-    paste_burst: PasteBurst,
-    // When true, disables paste-burst logic and inserts characters immediately.
-    disable_paste_burst: bool,
-    footer_mode: FooterMode,
-    footer_hint_override: Option<Vec<(String, String)>>,
-    /// Whether the ambient footer row is currently replaced by the Plan-mode nudge.
-    ///
-    /// Eligibility is decided by `ChatWidget`; the composer only owns presentation so enabling
-    /// the nudge never changes layout height or reimplements mode-selection policy here.
-    plan_mode_nudge_visible: bool,
-    remote_image_urls: Vec<String>,
-    /// Tracks keyboard selection for the remote-image rows so Up/Down + Delete/Backspace
-    /// can highlight and remove remote attachments from the composer UI.
-    selected_remote_image_index: Option<usize>,
     /// Slash-command draft staged for local recall after application-level dispatch.
     ///
     /// This slot is intentionally separate from `ChatComposerHistory` so inline slash commands can
     /// prepare their argument text without also double-recording the full command invocation.
     pending_slash_command_history: Option<HistoryEntry>,
-    footer_flash: Option<FooterFlash>,
-    context_window_percent: Option<i64>,
     // Monotonically increasing identifier for textarea elements we insert.
     #[cfg(not(target_os = "linux"))]
     next_element_id: u64,
-    context_window_used_tokens: Option<i64>,
     skills: Option<Vec<SkillMetadata>>,
     plugins: Option<Vec<PluginCapabilitySummary>>,
     connectors_snapshot: Option<ConnectorsSnapshot>,
-    dismissed_mention_popup_token: Option<String>,
-    mention_bindings: HashMap<u64, ComposerMentionBinding>,
-    recent_submission_mention_bindings: Vec<MentionBinding>,
     collaboration_modes_enabled: bool,
     config: ChatComposerConfig,
-    collaboration_mode_indicator: Option<CollaborationModeIndicator>,
-    goal_status_indicator: Option<GoalStatusIndicator>,
-    ide_context_active: bool,
     connectors_enabled: bool,
     plugins_command_enabled: bool,
     service_tier_commands_enabled: bool,
@@ -415,12 +379,6 @@ pub(crate) struct ChatComposer {
     audio_device_selection_enabled: bool,
     windows_degraded_sandbox_active: bool,
     side_conversation_active: bool,
-    status_line_value: Option<Line<'static>>,
-    status_line_hyperlink_url: Option<String>,
-    status_line_enabled: bool,
-    side_conversation_context_label: Option<String>,
-    // Agent label injected into the footer's contextual row when multi-agent mode is active.
-    active_agent_label: Option<String>,
     history_search: Option<HistorySearchSession>,
     submit_keys: Vec<KeyBinding>,
     queue_keys: Vec<KeyBinding>,
@@ -429,20 +387,6 @@ pub(crate) struct ChatComposer {
     history_search_next_keys: Vec<KeyBinding>,
     editor_keymap: EditorKeymap,
     vim_normal_keymap: VimNormalKeymap,
-    footer_external_editor_key: Option<KeyBinding>,
-    footer_show_transcript_key: Option<KeyBinding>,
-    footer_insert_newline_key: Option<KeyBinding>,
-    footer_queue_key: Option<KeyBinding>,
-    footer_toggle_shortcuts_key: Option<KeyBinding>,
-    footer_history_search_key: Option<KeyBinding>,
-    footer_reasoning_down_key: Option<KeyBinding>,
-    footer_reasoning_up_key: Option<KeyBinding>,
-}
-
-#[derive(Clone, Debug)]
-struct FooterFlash {
-    line: Line<'static>,
-    expires_at: Instant,
 }
 
 #[derive(Clone, Debug)]
@@ -457,18 +401,13 @@ struct ComposerDraft {
 }
 
 #[derive(Clone, Debug)]
-struct ComposerMentionBinding {
-    mention: String,
-    path: String,
-}
-
-/// Popup state – at most one can be visible at any time.
-enum ActivePopup {
-    None,
-    Command(CommandPopup),
-    File(FileSearchPopup),
-    Skill(SkillPopup),
-    MentionV2(MentionV2Popup),
+pub(crate) struct ComposerDraftSnapshot {
+    pub(crate) text: String,
+    pub(crate) text_elements: Vec<TextElement>,
+    pub(crate) local_images: Vec<LocalImageAttachment>,
+    pub(crate) remote_image_urls: Vec<String>,
+    pub(crate) mention_bindings: Vec<MentionBinding>,
+    pub(crate) pending_pastes: Vec<(String, String)>,
 }
 
 #[derive(Clone, Copy, Debug, PartialEq, Eq)]
@@ -543,50 +482,56 @@ impl ChatComposer {
         let default_vim_normal_keymap = default_keymap.vim_normal.clone();
 
         let mut this = Self {
-            textarea: TextArea::new(),
-            textarea_state: RefCell::new(TextAreaState::default()),
-            is_bash_mode: false,
-            active_popup: ActivePopup::None,
+            draft: DraftState::new(),
+            popups: PopupState::default(),
             app_event_tx,
             history: ChatComposerHistory::new(),
-            quit_shortcut_expires_at: None,
-            quit_shortcut_key: key_hint::ctrl(KeyCode::Char('c')),
-            esc_backtrack_hint: false,
-            use_shift_enter_hint,
-            dismissed_file_popup_token: None,
-            current_file_query: None,
-            pending_pastes: Vec::new(),
+            footer: FooterState {
+                quit_shortcut_expires_at: None,
+                quit_shortcut_key: key_hint::ctrl(KeyCode::Char('c')),
+                esc_backtrack_hint: false,
+                use_shift_enter_hint,
+                mode: FooterMode::ComposerEmpty,
+                hint_override: None,
+                plan_mode_nudge_visible: false,
+                flash: None,
+                context_window_percent: None,
+                context_window_used_tokens: None,
+                collaboration_mode_indicator: None,
+                goal_status_indicator: None,
+                ide_context_active: false,
+                status_line_value: None,
+                status_line_hyperlink_url: None,
+                status_line_enabled: false,
+                side_conversation_context_label: None,
+                active_agent_label: None,
+                external_editor_key: Some(key_hint::ctrl(KeyCode::Char('g'))),
+                show_transcript_key: Some(key_hint::ctrl(KeyCode::Char('t'))),
+                insert_newline_key: footer_insert_newline_key(
+                    &default_keymap.editor.insert_newline,
+                    use_shift_enter_hint,
+                ),
+                queue_key: Some(key_hint::plain(KeyCode::Tab)),
+                toggle_shortcuts_key: Some(key_hint::plain(KeyCode::Char('?'))),
+                history_search_key: primary_binding(
+                    &default_keymap.composer.history_search_previous,
+                ),
+                reasoning_down_key: primary_binding(&default_keymap.chat.decrease_reasoning_effort),
+                reasoning_up_key: primary_binding(&default_keymap.chat.increase_reasoning_effort),
+            },
             has_focus: has_input_focus,
             frame_requester: None,
-            attached_images: Vec::new(),
+            attachments: AttachmentState::default(),
             placeholder_text,
             is_task_running: false,
-            input_enabled: true,
-            input_disabled_placeholder: None,
-            paste_burst: PasteBurst::default(),
-            disable_paste_burst: false,
-            footer_mode: FooterMode::ComposerEmpty,
-            footer_hint_override: None,
-            plan_mode_nudge_visible: false,
-            remote_image_urls: Vec::new(),
-            selected_remote_image_index: None,
             pending_slash_command_history: None,
-            footer_flash: None,
-            context_window_percent: None,
             #[cfg(not(target_os = "linux"))]
             next_element_id: 0,
-            context_window_used_tokens: None,
             skills: None,
             plugins: None,
             connectors_snapshot: None,
-            dismissed_mention_popup_token: None,
-            mention_bindings: HashMap::new(),
-            recent_submission_mention_bindings: Vec::new(),
             collaboration_modes_enabled: false,
             config,
-            collaboration_mode_indicator: None,
-            goal_status_indicator: None,
-            ide_context_active: false,
             connectors_enabled: false,
             plugins_command_enabled: false,
             service_tier_commands_enabled: false,
@@ -598,11 +543,6 @@ impl ChatComposer {
             audio_device_selection_enabled: false,
             windows_degraded_sandbox_active: false,
             side_conversation_active: false,
-            status_line_value: None,
-            status_line_hyperlink_url: None,
-            status_line_enabled: false,
-            side_conversation_context_label: None,
-            active_agent_label: None,
             history_search: None,
             submit_keys: vec![key_hint::plain(KeyCode::Enter)],
             queue_keys: vec![key_hint::plain(KeyCode::Tab)],
@@ -614,23 +554,6 @@ impl ChatComposer {
             history_search_next_keys: default_keymap.composer.history_search_next.clone(),
             editor_keymap: default_editor_keymap,
             vim_normal_keymap: default_vim_normal_keymap,
-            footer_external_editor_key: Some(key_hint::ctrl(KeyCode::Char('g'))),
-            footer_show_transcript_key: Some(key_hint::ctrl(KeyCode::Char('t'))),
-            footer_insert_newline_key: footer_insert_newline_key(
-                &default_keymap.editor.insert_newline,
-                use_shift_enter_hint,
-            ),
-            footer_queue_key: Some(key_hint::plain(KeyCode::Tab)),
-            footer_toggle_shortcuts_key: Some(key_hint::plain(KeyCode::Char('?'))),
-            footer_history_search_key: primary_binding(
-                &default_keymap.composer.history_search_previous,
-            ),
-            footer_reasoning_down_key: primary_binding(
-                &default_keymap.chat.decrease_reasoning_effort,
-            ),
-            footer_reasoning_up_key: primary_binding(
-                &default_keymap.chat.increase_reasoning_effort,
-            ),
         };
         // Apply configuration via the setter to keep side-effects centralized.
         this.set_disable_paste_burst(disable_paste_burst);
@@ -684,7 +607,7 @@ impl ChatComposer {
         let elements = self.current_mention_elements();
         let mut ordered = Vec::new();
         for (id, mention) in elements {
-            if let Some(binding) = self.mention_bindings.remove(&id)
+            if let Some(binding) = self.draft.mention_bindings.remove(&id)
                 && binding.mention == mention
             {
                 ordered.push(MentionBinding {
@@ -693,7 +616,7 @@ impl ChatComposer {
                 });
             }
         }
-        self.mention_bindings.clear();
+        self.draft.mention_bindings.clear();
         ordered
     }
 
@@ -732,31 +655,33 @@ impl ChatComposer {
         self.history_search_next_keys = keymap.composer.history_search_next.clone();
         self.editor_keymap = keymap.editor.clone();
         self.vim_normal_keymap = keymap.vim_normal.clone();
-        self.textarea.set_keymap_bindings(keymap);
-        self.footer_external_editor_key = primary_binding(&keymap.app.open_external_editor);
-        self.footer_show_transcript_key = primary_binding(&keymap.app.open_transcript);
-        self.footer_insert_newline_key =
-            footer_insert_newline_key(&keymap.editor.insert_newline, self.use_shift_enter_hint);
-        self.footer_queue_key = primary_binding(&keymap.composer.queue);
-        self.footer_toggle_shortcuts_key = primary_binding(&keymap.composer.toggle_shortcuts);
-        self.footer_history_search_key = primary_binding(&keymap.composer.history_search_previous);
-        self.footer_reasoning_down_key = primary_binding(&keymap.chat.decrease_reasoning_effort);
-        self.footer_reasoning_up_key = primary_binding(&keymap.chat.increase_reasoning_effort);
+        self.draft.textarea.set_keymap_bindings(keymap);
+        self.footer.external_editor_key = primary_binding(&keymap.app.open_external_editor);
+        self.footer.show_transcript_key = primary_binding(&keymap.app.open_transcript);
+        self.footer.insert_newline_key = footer_insert_newline_key(
+            &keymap.editor.insert_newline,
+            self.footer.use_shift_enter_hint,
+        );
+        self.footer.queue_key = primary_binding(&keymap.composer.queue);
+        self.footer.toggle_shortcuts_key = primary_binding(&keymap.composer.toggle_shortcuts);
+        self.footer.history_search_key = primary_binding(&keymap.composer.history_search_previous);
+        self.footer.reasoning_down_key = primary_binding(&keymap.chat.decrease_reasoning_effort);
+        self.footer.reasoning_up_key = primary_binding(&keymap.chat.increase_reasoning_effort);
     }
 
     pub fn set_collaboration_mode_indicator(
         &mut self,
         indicator: Option<CollaborationModeIndicator>,
     ) {
-        self.collaboration_mode_indicator = indicator;
+        self.footer.collaboration_mode_indicator = indicator;
     }
 
     pub fn set_goal_status_indicator(&mut self, indicator: Option<GoalStatusIndicator>) {
-        self.goal_status_indicator = indicator;
+        self.footer.goal_status_indicator = indicator;
     }
 
     pub fn set_ide_context_active(&mut self, active: bool) {
-        self.ide_context_active = active;
+        self.footer.ide_context_active = active;
     }
 
     pub fn set_personality_command_enabled(&mut self, enabled: bool) {
@@ -809,7 +734,7 @@ impl ChatComposer {
             .unwrap_or_else(|| footer_height(&footer_props));
         let footer_spacing = Self::footer_spacing(footer_hint_height);
         let footer_total_height = footer_hint_height + footer_spacing;
-        let popup_constraint = match &self.active_popup {
+        let popup_constraint = match &self.popups.active {
             ActivePopup::Command(popup) => {
                 Constraint::Max(popup.calculate_required_height(area.width))
             }
@@ -831,7 +756,8 @@ impl ChatComposer {
             /*right*/ 1u16.saturating_add(textarea_right_reserve),
         ));
         let remote_images_height = self
-            .remote_images_lines(textarea_rect.width)
+            .attachments
+            .remote_image_lines()
             .len()
             .try_into()
             .unwrap_or(u16::MAX)
@@ -866,7 +792,7 @@ impl ChatComposer {
         area: Rect,
         textarea_right_reserve: u16,
     ) -> Option<(u16, u16)> {
-        if !self.input_enabled || self.selected_remote_image_index.is_some() {
+        if !self.draft.input_enabled || self.attachments.selected_remote_image_index.is_some() {
             return None;
         }
 
@@ -876,15 +802,14 @@ impl ChatComposer {
 
         let [_, _, textarea_rect, _] =
             self.layout_areas_with_textarea_right_reserve(area, textarea_right_reserve);
-        let state = *self.textarea_state.borrow();
-        self.textarea.cursor_pos_with_state(textarea_rect, state)
+        let state = *self.draft.textarea_state.borrow();
+        self.draft
+            .textarea
+            .cursor_pos_with_state(textarea_rect, state)
     }
     /// Returns true if the composer currently contains no user-entered input.
     pub(crate) fn is_empty(&self) -> bool {
-        self.textarea.is_empty()
-            && !self.is_bash_mode
-            && self.attached_images.is_empty()
-            && self.remote_image_urls.is_empty()
+        self.draft.textarea.is_empty() && !self.draft.is_bash_mode && self.attachments.is_empty()
     }
 
     /// Record local persistent-history metadata so the composer can navigate
@@ -951,17 +876,17 @@ impl ChatComposer {
         let char_count = pasted.chars().count();
         if char_count > LARGE_PASTE_CHAR_THRESHOLD {
             let placeholder = self.next_large_paste_placeholder(char_count);
-            self.textarea.insert_element(&placeholder);
-            self.pending_pastes.push((placeholder, pasted));
+            self.draft.textarea.insert_element(&placeholder);
+            self.draft.pending_pastes.push((placeholder, pasted));
         } else if char_count > 1
             && self.image_paste_enabled()
             && self.handle_paste_image_path(pasted.clone())
         {
-            self.textarea.insert_str(" ");
+            self.draft.textarea.insert_str(" ");
         } else {
             self.insert_str(&pasted);
         }
-        self.paste_burst.clear_after_explicit_paste();
+        self.draft.paste_burst.clear_after_explicit_paste();
         self.sync_popups();
         true
     }
@@ -1008,13 +933,13 @@ impl ChatComposer {
     /// without emitting any buffered text, which can leave a non-empty buffer unable to flush
     /// later (because `flush_if_due()` relies on `last_plain_char_time` to time out).
     pub(crate) fn set_disable_paste_burst(&mut self, disabled: bool) {
-        let was_disabled = self.disable_paste_burst;
-        self.disable_paste_burst = disabled;
+        let was_disabled = self.draft.disable_paste_burst;
+        self.draft.disable_paste_burst = disabled;
         if disabled && !was_disabled {
-            if let Some(pasted) = self.paste_burst.flush_before_modified_input() {
+            if let Some(pasted) = self.draft.paste_burst.flush_before_modified_input() {
                 self.handle_paste(pasted);
             }
-            self.paste_burst.clear_after_explicit_paste();
+            self.draft.paste_burst.clear_after_explicit_paste();
         }
     }
 
@@ -1024,12 +949,17 @@ impl ChatComposer {
     /// are renumbered to `[Image #M+1]..[Image #N]` (where `M` is the number of
     /// remote images). Cursor is placed at the end after rebuilding elements.
     pub(crate) fn apply_external_edit(&mut self, text: String) {
-        self.pending_pastes.clear();
+        self.draft.pending_pastes.clear();
         let (text, _) = self.imported_text_for_textarea(text, Vec::new());
 
         // Count placeholder occurrences in the new text.
         let mut placeholder_counts: HashMap<String, usize> = HashMap::new();
-        for placeholder in self.attached_images.iter().map(|img| &img.placeholder) {
+        for placeholder in self
+            .attachments
+            .local_images
+            .iter()
+            .map(|image| &image.placeholder)
+        {
             if placeholder_counts.contains_key(placeholder) {
                 continue;
             }
@@ -1041,7 +971,7 @@ impl ChatComposer {
 
         // Keep attachments only while we have matching occurrences left.
         let mut kept_images = Vec::new();
-        for img in self.attached_images.drain(..) {
+        for img in self.attachments.local_images.drain(..) {
             if let Some(count) = placeholder_counts.get_mut(&img.placeholder)
                 && *count > 0
             {
@@ -1049,12 +979,12 @@ impl ChatComposer {
                 kept_images.push(img);
             }
         }
-        self.attached_images = kept_images;
+        self.attachments.local_images = kept_images;
 
         // Rebuild textarea so placeholders become elements again.
-        self.textarea.set_text_clearing_elements("");
+        self.draft.textarea.set_text_clearing_elements("");
         let mut remaining: HashMap<&str, usize> = HashMap::new();
-        for img in &self.attached_images {
+        for img in &self.attachments.local_images {
             *remaining.entry(img.placeholder.as_str()).or_insert(0) += 1;
         }
 
@@ -1075,20 +1005,23 @@ impl ChatComposer {
                 continue;
             }
             if pos > idx {
-                self.textarea.insert_str(&text[idx..pos]);
+                self.draft.textarea.insert_str(&text[idx..pos]);
             }
-            self.textarea.insert_element(ph);
+            self.draft.textarea.insert_element(ph);
             *count -= 1;
             idx = pos + ph.len();
         }
         if idx < text.len() {
-            self.textarea.insert_str(&text[idx..]);
+            self.draft.textarea.insert_str(&text[idx..]);
         }
 
         // Keep local image placeholders normalized in attachment order after the
         // remote-image prefix.
-        self.relabel_attached_images_and_update_placeholders();
-        self.textarea.set_cursor(self.textarea.text().len());
+        self.attachments
+            .relabel_local_images(&mut self.draft.textarea);
+        self.draft
+            .textarea
+            .set_cursor(self.draft.textarea.text().len());
         self.sync_popups();
     }
 
@@ -1099,9 +1032,9 @@ impl ChatComposer {
     /// commands, not as candidate literal paste text. It also resets transient
     /// footer mode so the visible hints match the new editing surface.
     pub(crate) fn set_vim_enabled(&mut self, enabled: bool) {
-        self.textarea.set_vim_enabled(enabled);
-        self.paste_burst.clear_after_explicit_paste();
-        self.footer_mode = reset_mode_after_activity(self.footer_mode);
+        self.draft.textarea.set_vim_enabled(enabled);
+        self.draft.paste_burst.clear_after_explicit_paste();
+        self.footer.mode = reset_mode_after_activity(self.footer.mode);
     }
 
     /// Toggle Vim editing and return the new enabled state.
@@ -1110,7 +1043,7 @@ impl ChatComposer {
     /// keybinding; callers should use the returned value for status messages
     /// instead of rereading state after additional composer mutations.
     pub(crate) fn toggle_vim_enabled(&mut self) -> bool {
-        let enabled = !self.textarea.is_vim_enabled();
+        let enabled = !self.draft.textarea.is_vim_enabled();
         self.set_vim_enabled(enabled);
         enabled
     }
@@ -1118,7 +1051,7 @@ impl ChatComposer {
     /// Return whether Vim editing is enabled for tests that assert mode transitions.
     #[cfg(test)]
     pub(crate) fn is_vim_enabled(&self) -> bool {
-        self.textarea.is_vim_enabled()
+        self.draft.textarea.is_vim_enabled()
     }
 
     /// Return whether Escape should be routed to the textarea before popups.
@@ -1127,15 +1060,20 @@ impl ChatComposer {
     /// event layer asks this before running generic Escape behavior so the same
     /// key does not both leave insert mode and dismiss unrelated UI.
     pub(crate) fn should_handle_vim_insert_escape(&self, key_event: KeyEvent) -> bool {
-        self.textarea.should_handle_vim_insert_escape(key_event)
+        self.draft
+            .textarea
+            .should_handle_vim_insert_escape(key_event)
     }
 
     fn vim_mode_indicator_span(&self) -> Option<Span<'static>> {
-        self.textarea.vim_mode_label().map(|label| match label {
-            "Normal" => "Vim: Normal".magenta(),
-            "Insert" => "Vim: Insert".green(),
-            _ => unreachable!(),
-        })
+        self.draft
+            .textarea
+            .vim_mode_label()
+            .map(|label| match label {
+                "Normal" => "Vim: Normal".magenta(),
+                "Insert" => "Vim: Insert".green(),
+                _ => unreachable!(),
+            })
     }
 
     fn mode_indicator_line(&self, show_cycle_hint: bool) -> Option<Line<'static>> {
@@ -1144,9 +1082,9 @@ impl ChatComposer {
             spans.push(vim_mode);
         }
         if let Some(indicators) = status_line_right_indicator_line(
-            self.collaboration_mode_indicator,
-            self.goal_status_indicator.as_ref(),
-            self.ide_context_active,
+            self.footer.collaboration_mode_indicator,
+            self.footer.goal_status_indicator.as_ref(),
+            self.footer.ide_context_active,
             show_cycle_hint,
         ) {
             if !spans.is_empty() {
@@ -1162,8 +1100,10 @@ impl ChatComposer {
     }
 
     fn right_footer_line_with_context(&self) -> Line<'static> {
-        let mut line =
-            context_window_line(self.context_window_percent, self.context_window_used_tokens);
+        let mut line = context_window_line(
+            self.footer.context_window_percent,
+            self.footer.context_window_used_tokens,
+        );
         if let Some(vim_mode) = self.vim_mode_indicator_span() {
             line.spans.push(" | ".dim());
             line.spans.push(vim_mode);
@@ -1173,27 +1113,30 @@ impl ChatComposer {
 
     pub(crate) fn current_text_with_pending(&self) -> String {
         let text = self.current_text();
-        if self.pending_pastes.is_empty() {
+        if self.draft.pending_pastes.is_empty() {
             return text;
         }
 
-        let (text, _) =
-            Self::expand_pending_pastes(&text, self.current_text_elements(), &self.pending_pastes);
+        let (text, _) = Self::expand_pending_pastes(
+            &text,
+            self.current_text_elements(),
+            &self.draft.pending_pastes,
+        );
         text
     }
 
     /// Returns whether the composer currently accepts interactive draft edits.
     pub(crate) fn input_enabled(&self) -> bool {
-        self.input_enabled
+        self.draft.input_enabled
     }
 
     pub(crate) fn pending_pastes(&self) -> Vec<(String, String)> {
-        self.pending_pastes.clone()
+        self.draft.pending_pastes.clone()
     }
 
     pub(crate) fn set_pending_pastes(&mut self, pending_pastes: Vec<(String, String)>) {
         let text = self.current_text();
-        self.pending_pastes = pending_pastes
+        self.draft.pending_pastes = pending_pastes
             .into_iter()
             .filter(|(placeholder, _)| text.contains(placeholder))
             .collect();
@@ -1202,7 +1145,7 @@ impl ChatComposer {
     /// Override the footer hint items displayed beneath the composer. Passing
     /// `None` restores the default shortcut footer.
     pub(crate) fn set_footer_hint_override(&mut self, items: Option<Vec<(String, String)>>) {
-        self.footer_hint_override = items;
+        self.footer.hint_override = items;
     }
 
     /// Updates whether the Plan-mode nudge replaces the ambient footer row.
@@ -1210,49 +1153,39 @@ impl ChatComposer {
     /// Returns `true` only when the rendered footer can change so callers can avoid scheduling
     /// redundant redraws while reevaluating nudge policy on routine composer updates.
     pub(crate) fn set_plan_mode_nudge_visible(&mut self, visible: bool) -> bool {
-        if self.plan_mode_nudge_visible == visible {
+        if self.footer.plan_mode_nudge_visible == visible {
             return false;
         }
-        self.plan_mode_nudge_visible = visible;
+        self.footer.plan_mode_nudge_visible = visible;
         true
     }
 
     #[cfg(test)]
     pub(crate) fn plan_mode_nudge_visible(&self) -> bool {
-        self.plan_mode_nudge_visible
+        self.footer.plan_mode_nudge_visible
     }
 
     pub(crate) fn set_remote_image_urls(&mut self, urls: Vec<String>) {
-        self.remote_image_urls = urls;
-        self.selected_remote_image_index = None;
-        self.relabel_attached_images_and_update_placeholders();
+        self.attachments
+            .set_remote_image_urls(urls, &mut self.draft.textarea);
         self.sync_popups();
     }
 
     pub(crate) fn remote_image_urls(&self) -> Vec<String> {
-        self.remote_image_urls.clone()
+        self.attachments.remote_image_urls()
     }
 
     pub(crate) fn take_remote_image_urls(&mut self) -> Vec<String> {
-        let urls = std::mem::take(&mut self.remote_image_urls);
-        self.selected_remote_image_index = None;
-        self.relabel_attached_images_and_update_placeholders();
+        let urls = self
+            .attachments
+            .take_remote_image_urls(&mut self.draft.textarea);
         self.sync_popups();
         urls
     }
 
     #[cfg(test)]
     pub(crate) fn show_footer_flash(&mut self, line: Line<'static>, duration: Duration) {
-        let expires_at = Instant::now()
-            .checked_add(duration)
-            .unwrap_or_else(Instant::now);
-        self.footer_flash = Some(FooterFlash { line, expires_at });
-    }
-
-    pub(crate) fn footer_flash_visible(&self) -> bool {
-        self.footer_flash
-            .as_ref()
-            .is_some_and(|flash| Instant::now() < flash.expires_at)
+        self.footer.show_flash(line, duration);
     }
 
     /// Replace the entire composer content with `text` and reset cursor.
@@ -1295,38 +1228,33 @@ impl ChatComposer {
         mention_bindings: Vec<MentionBinding>,
     ) {
         // Clear any existing content, placeholders, and attachments first.
-        self.textarea.set_text_clearing_elements("");
-        self.is_bash_mode = false;
-        self.pending_pastes.clear();
-        self.attached_images.clear();
-        self.mention_bindings.clear();
+        self.draft.textarea.set_text_clearing_elements("");
+        self.draft.is_bash_mode = false;
+        self.draft.pending_pastes.clear();
+        self.draft.mention_bindings.clear();
 
         let (text, text_elements) = self.imported_text_for_textarea(text, text_elements);
-        self.textarea.set_text_with_elements(&text, &text_elements);
-
-        for (idx, path) in local_image_paths.into_iter().enumerate() {
-            let placeholder = local_image_label_text(self.remote_image_urls.len() + idx + 1);
-            self.attached_images
-                .push(AttachedImage { placeholder, path });
-        }
+        self.draft
+            .textarea
+            .set_text_with_elements(&text, &text_elements);
+        self.attachments
+            .reset_local_images(local_image_paths, &mut self.draft.textarea);
 
         self.bind_mentions_from_snapshot(mention_bindings);
-        self.relabel_attached_images_and_update_placeholders();
-        self.selected_remote_image_index = None;
-        self.textarea.set_cursor(/*pos*/ 0);
+        self.draft.textarea.set_cursor(/*pos*/ 0);
         self.sync_popups();
     }
 
     fn current_cursor(&self) -> usize {
-        self.textarea.cursor() + if self.is_bash_mode { 1 } else { 0 }
+        self.draft.textarea.cursor() + if self.draft.is_bash_mode { 1 } else { 0 }
     }
 
     fn history_navigation_cursor(&self) -> usize {
-        if self.is_bash_mode && self.textarea.cursor() == 0 {
+        if self.draft.is_bash_mode && self.draft.textarea.cursor() == 0 {
             0
-        } else if self.textarea.is_vim_normal_mode()
-            && !self.textarea.text().is_empty()
-            && self.textarea.cursor() == self.textarea.vim_normal_end_cursor()
+        } else if self.draft.textarea.is_vim_normal_mode()
+            && !self.draft.textarea.text().is_empty()
+            && self.draft.textarea.cursor() == self.draft.textarea.vim_normal_end_cursor()
         {
             self.current_text().len()
         } else {
@@ -1335,18 +1263,20 @@ impl ChatComposer {
     }
 
     fn set_current_cursor(&mut self, cursor: usize) {
-        let visible_cursor = if self.is_bash_mode {
+        let visible_cursor = if self.draft.is_bash_mode {
             cursor.saturating_sub(1)
         } else {
             cursor
         };
-        self.textarea
-            .set_cursor(visible_cursor.min(self.textarea.text().len()));
+        self.draft
+            .textarea
+            .set_cursor(visible_cursor.min(self.draft.textarea.text().len()));
     }
 
     fn current_text_elements(&self) -> Vec<TextElement> {
-        let shift = if self.is_bash_mode { 1 } else { 0 };
-        self.textarea
+        let shift = if self.draft.is_bash_mode { 1 } else { 0 };
+        self.draft
+            .textarea
             .text_elements()
             .into_iter()
             .filter_map(|element| Self::shift_text_element(element, shift))
@@ -1367,14 +1297,10 @@ impl ChatComposer {
         ComposerDraft {
             text: self.current_text(),
             text_elements: self.current_text_elements(),
-            local_image_paths: self
-                .attached_images
-                .iter()
-                .map(|img| img.path.clone())
-                .collect(),
-            remote_image_urls: self.remote_image_urls.clone(),
+            local_image_paths: self.attachments.local_image_paths(),
+            remote_image_urls: self.attachments.remote_image_urls(),
             mention_bindings: self.snapshot_mention_bindings(),
-            pending_pastes: self.pending_pastes.clone(),
+            pending_pastes: self.draft.pending_pastes.clone(),
             cursor: self.current_cursor(),
         }
     }
@@ -1408,17 +1334,19 @@ impl ChatComposer {
 
     /// Move the cursor to the end of the current text buffer.
     pub(crate) fn move_cursor_to_end(&mut self) {
-        self.textarea.set_cursor(self.textarea.text().len());
+        self.draft
+            .textarea
+            .set_cursor(self.draft.textarea.text().len());
         self.sync_popups();
     }
 
     fn move_cursor_to_history_entry_end(&mut self) {
-        let cursor = if self.textarea.is_vim_normal_mode() {
-            self.textarea.vim_normal_end_cursor()
+        let cursor = if self.draft.textarea.is_vim_normal_mode() {
+            self.draft.textarea.vim_normal_end_cursor()
         } else {
-            self.textarea.text().len()
+            self.draft.textarea.text().len()
         };
-        self.textarea.set_cursor(cursor);
+        self.draft.textarea.set_cursor(cursor);
         self.sync_popups();
     }
 
@@ -1432,7 +1360,7 @@ impl ChatComposer {
         text_elements: Vec<TextElement>,
     ) -> (String, Vec<TextElement>) {
         if let Some(stripped) = text.strip_prefix('!') {
-            self.is_bash_mode = true;
+            self.draft.is_bash_mode = true;
             (
                 stripped.to_string(),
                 text_elements
@@ -1441,7 +1369,7 @@ impl ChatComposer {
                     .collect(),
             )
         } else {
-            self.is_bash_mode = false;
+            self.draft.is_bash_mode = false;
             (text, text_elements)
         }
     }
@@ -1452,17 +1380,12 @@ impl ChatComposer {
         }
         let previous = self.current_text();
         let text_elements = self.current_text_elements();
-        let local_image_paths = self
-            .attached_images
-            .iter()
-            .map(|img| img.path.clone())
-            .collect();
-        let pending_pastes = std::mem::take(&mut self.pending_pastes);
-        let remote_image_urls = self.remote_image_urls.clone();
+        let local_image_paths = self.attachments.local_image_paths();
+        let pending_pastes = std::mem::take(&mut self.draft.pending_pastes);
+        let remote_image_urls = self.attachments.remote_image_urls();
         let mention_bindings = self.snapshot_mention_bindings();
         self.set_text_content(String::new(), Vec::new(), Vec::new());
-        self.remote_image_urls.clear();
-        self.selected_remote_image_index = None;
+        self.attachments.clear_remote_image_urls();
         self.history.reset_navigation();
         self.history.record_local_submission(HistoryEntry {
             text: previous.clone(),
@@ -1477,10 +1400,10 @@ impl ChatComposer {
 
     /// Get the current composer text.
     pub(crate) fn current_text(&self) -> String {
-        if self.is_bash_mode {
-            format!("!{}", self.textarea.text())
+        if self.draft.is_bash_mode {
+            format!("!{}", self.draft.textarea.text())
         } else {
-            self.textarea.text().to_string()
+            self.draft.textarea.text().to_string()
         }
     }
 
@@ -1515,32 +1438,29 @@ impl ChatComposer {
         self.current_text_elements()
     }
 
+    pub(crate) fn draft_snapshot(&self) -> ComposerDraftSnapshot {
+        ComposerDraftSnapshot {
+            text: self.current_text(),
+            text_elements: self.text_elements(),
+            local_images: self.local_images(),
+            remote_image_urls: self.remote_image_urls(),
+            mention_bindings: self.mention_bindings(),
+            pending_pastes: self.pending_pastes(),
+        }
+    }
+
     #[cfg(test)]
     pub(crate) fn local_image_paths(&self) -> Vec<PathBuf> {
-        self.attached_images
-            .iter()
-            .map(|img| img.path.clone())
-            .collect()
+        self.attachments.local_image_paths()
     }
 
     #[cfg(test)]
     pub(crate) fn status_line_text(&self) -> Option<String> {
-        self.status_line_value.as_ref().map(|line| {
-            line.spans
-                .iter()
-                .map(|span| span.content.as_ref())
-                .collect::<String>()
-        })
+        self.footer.status_line_text()
     }
 
     pub(crate) fn local_images(&self) -> Vec<LocalImageAttachment> {
-        self.attached_images
-            .iter()
-            .map(|img| LocalImageAttachment {
-                placeholder: img.placeholder.clone(),
-                path: img.path.clone(),
-            })
-            .collect()
+        self.attachments.local_images()
     }
 
     pub(crate) fn mention_bindings(&self) -> Vec<MentionBinding> {
@@ -1548,7 +1468,7 @@ impl ChatComposer {
     }
 
     pub(crate) fn take_recent_submission_mention_bindings(&mut self) -> Vec<MentionBinding> {
-        std::mem::take(&mut self.recent_submission_mention_bindings)
+        std::mem::take(&mut self.draft.recent_submission_mention_bindings)
     }
 
     /// Commit the staged slash-command draft to local Up-arrow recall.
@@ -1561,44 +1481,20 @@ impl ChatComposer {
         }
     }
 
-    fn prune_attached_images_for_submission(&mut self, text: &str, text_elements: &[TextElement]) {
-        if self.attached_images.is_empty() {
-            return;
-        }
-        let image_placeholders: HashSet<&str> = text_elements
-            .iter()
-            .filter_map(|elem| elem.placeholder(text))
-            .collect();
-        self.attached_images
-            .retain(|img| image_placeholders.contains(img.placeholder.as_str()));
-    }
-
     /// Insert an attachment placeholder and track it for the next submission.
     pub fn attach_image(&mut self, path: PathBuf) {
-        let image_number = self.remote_image_urls.len() + self.attached_images.len() + 1;
-        let placeholder = local_image_label_text(image_number);
-        // Insert as an element to match large paste placeholder behavior:
-        // styled distinctly and treated atomically for cursor/mutations.
-        self.textarea.insert_element(&placeholder);
-        self.attached_images
-            .push(AttachedImage { placeholder, path });
+        self.attachments
+            .attach_image(&mut self.draft.textarea, path);
     }
 
     #[cfg(test)]
     pub fn take_recent_submission_images(&mut self) -> Vec<PathBuf> {
-        let images = std::mem::take(&mut self.attached_images);
-        images.into_iter().map(|img| img.path).collect()
+        self.attachments.take_recent_submission_images()
     }
 
     pub fn take_recent_submission_images_with_placeholders(&mut self) -> Vec<LocalImageAttachment> {
-        let images = std::mem::take(&mut self.attached_images);
-        images
-            .into_iter()
-            .map(|img| LocalImageAttachment {
-                placeholder: img.placeholder,
-                path: img.path,
-            })
-            .collect()
+        self.attachments
+            .take_recent_submission_images_with_placeholders()
     }
 
     /// Flushes any due paste-burst state.
@@ -1620,7 +1516,7 @@ impl ChatComposer {
     /// This includes actively buffering, having a non-empty burst buffer, or holding the first
     /// ASCII char for flicker suppression.
     pub(crate) fn is_in_paste_burst(&self) -> bool {
-        self.paste_burst.is_active()
+        self.draft.paste_burst.is_active()
     }
 
     /// Returns a delay that reliably exceeds the paste-burst timing threshold.
@@ -1636,7 +1532,7 @@ impl ChatComposer {
         let current_opt = if self.mentions_v2_enabled {
             self.current_mentions_v2_token()
         } else {
-            Self::current_at_token(&self.textarea)
+            Self::current_at_token(&self.draft.textarea)
         };
         let Some(current_token) = current_opt else {
             return;
@@ -1646,7 +1542,7 @@ impl ChatComposer {
             return;
         }
 
-        match &mut self.active_popup {
+        match &mut self.popups.active {
             ActivePopup::File(popup) => {
                 popup.set_matches(&query, matches);
             }
@@ -1663,18 +1559,18 @@ impl ChatComposer {
     /// redraw after [`super::QUIT_SHORTCUT_TIMEOUT`] so the hint can disappear
     /// even when the UI is otherwise idle.
     pub fn show_quit_shortcut_hint(&mut self, key: KeyBinding, has_focus: bool) {
-        self.quit_shortcut_expires_at = Instant::now()
+        self.footer.quit_shortcut_expires_at = Instant::now()
             .checked_add(super::QUIT_SHORTCUT_TIMEOUT)
             .or_else(|| Some(Instant::now()));
-        self.quit_shortcut_key = key;
-        self.footer_mode = FooterMode::QuitShortcutReminder;
+        self.footer.quit_shortcut_key = key;
+        self.footer.mode = FooterMode::QuitShortcutReminder;
         self.set_has_focus(has_focus);
     }
 
     /// Clear the "press again to quit" hint immediately.
     pub fn clear_quit_shortcut_hint(&mut self, has_focus: bool) {
-        self.quit_shortcut_expires_at = None;
-        self.footer_mode = reset_mode_after_activity(self.footer_mode);
+        self.footer.quit_shortcut_expires_at = None;
+        self.footer.mode = reset_mode_after_activity(self.footer.mode);
         self.set_has_focus(has_focus);
     }
 
@@ -1684,7 +1580,8 @@ impl ChatComposer {
     /// any additional user input, so the UI schedules a redraw when the hint
     /// expires.
     pub(crate) fn quit_shortcut_hint_visible(&self) -> bool {
-        self.quit_shortcut_expires_at
+        self.footer
+            .quit_shortcut_expires_at
             .is_some_and(|expires_at| Instant::now() < expires_at)
     }
 
@@ -1693,7 +1590,7 @@ impl ChatComposer {
         let prefix = format!("{base} #");
         let mut max_suffix = 0usize;
 
-        for (placeholder, _) in &self.pending_pastes {
+        for (placeholder, _) in &self.draft.pending_pastes {
             if placeholder == &base {
                 max_suffix = max_suffix.max(1);
                 continue;
@@ -1713,14 +1610,14 @@ impl ChatComposer {
     }
 
     pub(crate) fn insert_str(&mut self, text: &str) {
-        self.textarea.insert_str(text);
+        self.draft.textarea.insert_str(text);
         self.sync_bash_mode_from_text();
         self.sync_popups();
     }
 
     /// Handle a key event coming from the main UI.
     pub fn handle_key_event(&mut self, key_event: KeyEvent) -> (InputResult, bool) {
-        if !self.input_enabled {
+        if !self.draft.input_enabled {
             return (InputResult::None, false);
         }
 
@@ -1736,7 +1633,7 @@ impl ChatComposer {
             return self.begin_history_search();
         }
 
-        let result = match &mut self.active_popup {
+        let result = match &mut self.popups.active {
             ActivePopup::Command(_) => self.handle_key_event_with_slash_popup(key_event),
             ActivePopup::File(_) => self.handle_key_event_with_file_popup(key_event),
             ActivePopup::Skill(_) => self.handle_key_event_with_skill_popup(key_event),
@@ -1751,7 +1648,7 @@ impl ChatComposer {
 
     /// Return true if either the slash-command popup or the file-search popup is active.
     pub(crate) fn popup_active(&self) -> bool {
-        self.history_search.is_some() || !matches!(self.active_popup, ActivePopup::None)
+        self.history_search.is_some() || self.popups.active()
     }
 
     /// Handle key event when the slash-command popup is visible.
@@ -1760,15 +1657,15 @@ impl ChatComposer {
             return (InputResult::None, true);
         }
         if key_event.code == KeyCode::Esc {
-            let next_mode = esc_hint_mode(self.footer_mode, self.is_task_running);
-            if next_mode != self.footer_mode {
-                self.footer_mode = next_mode;
+            let next_mode = esc_hint_mode(self.footer.mode, self.is_task_running);
+            if next_mode != self.footer.mode {
+                self.footer.mode = next_mode;
                 return (InputResult::None, true);
             }
         } else {
-            self.footer_mode = reset_mode_after_activity(self.footer_mode);
+            self.footer.mode = reset_mode_after_activity(self.footer.mode);
         }
-        let ActivePopup::Command(popup) = &mut self.active_popup else {
+        let ActivePopup::Command(popup) = &mut self.popups.active else {
             unreachable!();
         };
 
@@ -1800,7 +1697,7 @@ impl ChatComposer {
                 code: KeyCode::Esc, ..
             } => {
                 // Dismiss the slash popup; keep the current input untouched.
-                self.active_popup = ActivePopup::None;
+                self.popups.active = ActivePopup::None;
                 (InputResult::None, true)
             }
             KeyEvent {
@@ -1808,7 +1705,7 @@ impl ChatComposer {
             } => {
                 // Ensure popup filtering/selection reflects the latest composer text
                 // before applying completion.
-                let first_line = self.textarea.text().lines().next().unwrap_or("");
+                let first_line = self.draft.textarea.text().lines().next().unwrap_or("");
                 popup.on_composer_text_change(first_line.to_string());
                 if let Some(selected_cmd) = popup.selected_item() {
                     let selected_command_text = format!("/{}", selected_cmd.command());
@@ -1816,18 +1713,21 @@ impl ChatComposer {
                         && cmd == SlashCommand::Skills
                     {
                         self.stage_selected_slash_command_history(&CommandItem::Builtin(cmd));
-                        self.textarea.set_text_clearing_elements("");
-                        self.is_bash_mode = false;
+                        self.draft.textarea.set_text_clearing_elements("");
+                        self.draft.is_bash_mode = false;
                         return (InputResult::Command(cmd), true);
                     }
 
                     let starts_with_cmd =
                         first_line.trim_start().starts_with(&selected_command_text);
                     if !starts_with_cmd {
-                        self.textarea
+                        self.draft
+                            .textarea
                             .set_text_clearing_elements(&format!("{selected_command_text} "));
-                        if !self.textarea.text().is_empty() {
-                            self.textarea.set_cursor(self.textarea.text().len());
+                        if !self.draft.textarea.text().is_empty() {
+                            self.draft
+                                .textarea
+                                .set_cursor(self.draft.textarea.text().len());
                         }
                         return (InputResult::None, true);
                     }
@@ -1844,19 +1744,22 @@ impl ChatComposer {
             } => {
                 // Treat "/" as accepting the highlighted command as text completion
                 // while the slash-command popup is active.
-                let first_line = self.textarea.text().lines().next().unwrap_or("");
+                let first_line = self.draft.textarea.text().lines().next().unwrap_or("");
                 popup.on_composer_text_change(first_line.to_string());
                 if let Some(selected_cmd) = popup.selected_item() {
                     let selected_command_text = format!("/{}", selected_cmd.command());
                     let starts_with_cmd =
                         first_line.trim_start().starts_with(&selected_command_text);
                     if !starts_with_cmd {
-                        self.textarea
+                        self.draft
+                            .textarea
                             .set_text_clearing_elements(&format!("{selected_command_text} "));
-                        self.is_bash_mode = false;
+                        self.draft.is_bash_mode = false;
                     }
-                    if !self.textarea.text().is_empty() {
-                        self.textarea.set_cursor(self.textarea.text().len());
+                    if !self.draft.textarea.text().is_empty() {
+                        self.draft
+                            .textarea
+                            .set_cursor(self.draft.textarea.text().len());
                     }
                 }
                 (InputResult::None, true)
@@ -1868,8 +1771,8 @@ impl ChatComposer {
             } => {
                 if let Some(sel) = popup.selected_item() {
                     self.stage_selected_slash_command_history(&sel);
-                    self.textarea.set_text_clearing_elements("");
-                    self.is_bash_mode = false;
+                    self.draft.textarea.set_text_clearing_elements("");
+                    self.draft.is_bash_mode = false;
                     return (
                         match sel {
                             CommandItem::Builtin(cmd) => InputResult::Command(cmd),
@@ -1917,12 +1820,13 @@ impl ChatComposer {
     /// the cursor to a UTF-8 char boundary before slicing `textarea.text()`.
     #[inline]
     fn handle_non_ascii_char(&mut self, input: KeyEvent, now: Instant) -> (InputResult, bool) {
-        if self.disable_paste_burst {
+        if self.draft.disable_paste_burst {
             // When burst detection is disabled, treat IME/non-ASCII input as normal typing.
             // In particular, do not retro-capture or buffer already-inserted prefix text.
-            self.textarea.input(input);
-            let text_after = self.textarea.text();
-            self.pending_pastes
+            self.draft.textarea.input(input);
+            let text_after = self.draft.textarea.text();
+            self.draft
+                .pending_pastes
                 .retain(|(placeholder, _)| text_after.contains(placeholder));
             return (InputResult::None, true);
         }
@@ -1931,7 +1835,7 @@ impl ChatComposer {
             ..
         } = input
         {
-            if self.paste_burst.try_append_char_if_active(ch, now) {
+            if self.draft.paste_burst.try_append_char_if_active(ch, now) {
                 return (InputResult::None, true);
             }
             // Non-ASCII input often comes from IMEs and can arrive in quick bursts.
@@ -1939,32 +1843,35 @@ impl ChatComposer {
             // still want to detect paste-like bursts. Before applying any non-ASCII input, flush
             // any existing burst buffer (including a pending first char from the ASCII path) so
             // we don't carry that transient state forward.
-            if let Some(pasted) = self.paste_burst.flush_before_modified_input() {
+            if let Some(pasted) = self.draft.paste_burst.flush_before_modified_input() {
                 self.handle_paste(pasted);
             }
-            if let Some(decision) = self.paste_burst.on_plain_char_no_hold(now) {
+            if let Some(decision) = self.draft.paste_burst.on_plain_char_no_hold(now) {
                 match decision {
                     CharDecision::BufferAppend => {
-                        self.paste_burst.append_char_to_buffer(ch, now);
+                        self.draft.paste_burst.append_char_to_buffer(ch, now);
                         return (InputResult::None, true);
                     }
                     CharDecision::BeginBuffer { retro_chars } => {
                         // For non-ASCII we inserted prior chars immediately, so if this turns out
                         // to be paste-like we need to retroactively grab & remove the already-
                         // inserted prefix from the textarea before buffering the burst.
-                        let cur = self.textarea.cursor();
-                        let txt = self.textarea.text();
+                        let cur = self.draft.textarea.cursor();
+                        let txt = self.draft.textarea.text();
                         let safe_cur = Self::clamp_to_char_boundary(txt, cur);
                         let before = &txt[..safe_cur];
-                        if let Some(grab) =
-                            self.paste_burst
-                                .decide_begin_buffer(now, before, retro_chars as usize)
-                        {
+                        if let Some(grab) = self.draft.paste_burst.decide_begin_buffer(
+                            now,
+                            before,
+                            retro_chars as usize,
+                        ) {
                             if !grab.grabbed.is_empty() {
-                                self.textarea.replace_range(grab.start_byte..safe_cur, "");
+                                self.draft
+                                    .textarea
+                                    .replace_range(grab.start_byte..safe_cur, "");
                             }
                             // seed the paste burst buffer with everything (grabbed + new)
-                            self.paste_burst.append_char_to_buffer(ch, now);
+                            self.draft.paste_burst.append_char_to_buffer(ch, now);
                             return (InputResult::None, true);
                         }
                         // If decide_begin_buffer opted not to start buffering,
@@ -1974,13 +1881,14 @@ impl ChatComposer {
                 }
             }
         }
-        if let Some(pasted) = self.paste_burst.flush_before_modified_input() {
+        if let Some(pasted) = self.draft.paste_burst.flush_before_modified_input() {
             self.handle_paste(pasted);
         }
-        self.textarea.input(input);
+        self.draft.textarea.input(input);
 
-        let text_after = self.textarea.text();
-        self.pending_pastes
+        let text_after = self.draft.textarea.text();
+        self.draft
+            .pending_pastes
             .retain(|(placeholder, _)| text_after.contains(placeholder));
         (InputResult::None, true)
     }
@@ -1991,15 +1899,15 @@ impl ChatComposer {
             return (InputResult::None, true);
         }
         if key_event.code == KeyCode::Esc {
-            let next_mode = esc_hint_mode(self.footer_mode, self.is_task_running);
-            if next_mode != self.footer_mode {
-                self.footer_mode = next_mode;
+            let next_mode = esc_hint_mode(self.footer.mode, self.is_task_running);
+            if next_mode != self.footer.mode {
+                self.footer.mode = next_mode;
                 return (InputResult::None, true);
             }
         } else {
-            self.footer_mode = reset_mode_after_activity(self.footer_mode);
+            self.footer.mode = reset_mode_after_activity(self.footer.mode);
         }
-        let ActivePopup::File(popup) = &mut self.active_popup else {
+        let ActivePopup::File(popup) = &mut self.popups.active else {
             unreachable!();
         };
 
@@ -2031,10 +1939,10 @@ impl ChatComposer {
                 code: KeyCode::Esc, ..
             } => {
                 // Hide popup without modifying text, remember token to avoid immediate reopen.
-                if let Some(tok) = Self::current_at_token(&self.textarea) {
-                    self.dismissed_file_popup_token = Some(tok);
+                if let Some(tok) = Self::current_at_token(&self.draft.textarea) {
+                    self.popups.dismissed_file_token = Some(tok);
                 }
-                self.active_popup = ActivePopup::None;
+                self.popups.active = ActivePopup::None;
                 (InputResult::None, true)
             }
             KeyEvent {
@@ -2046,7 +1954,7 @@ impl ChatComposer {
                 ..
             } => {
                 let Some(sel) = popup.selected_match() else {
-                    self.active_popup = ActivePopup::None;
+                    self.popups.active = ActivePopup::None;
                     return if key_event.code == KeyCode::Enter {
                         self.handle_key_event_without_popup(key_event)
                     } else {
@@ -2065,8 +1973,8 @@ impl ChatComposer {
                             tracing::debug!("selected image dimensions={}x{}", width, height);
                             // Remove the current @token (mirror logic from insert_selected_path without inserting text)
                             // using the flat text and byte-offset cursor API.
-                            let cursor_offset = self.textarea.cursor();
-                            let text = self.textarea.text();
+                            let cursor_offset = self.draft.textarea.cursor();
+                            let text = self.draft.textarea.text();
                             // Clamp to a valid char boundary to avoid panics when slicing.
                             let safe_cursor = Self::clamp_to_char_boundary(text, cursor_offset);
                             let before_cursor = &text[..safe_cursor];
@@ -2085,12 +1993,12 @@ impl ChatComposer {
                                 .unwrap_or(after_cursor.len());
                             let end_idx = safe_cursor + end_rel_idx;
 
-                            self.textarea.replace_range(start_idx..end_idx, "");
-                            self.textarea.set_cursor(start_idx);
+                            self.draft.textarea.replace_range(start_idx..end_idx, "");
+                            self.draft.textarea.set_cursor(start_idx);
 
                             self.attach_image(path_buf);
                             // Add a trailing space to keep typing fluid.
-                            self.textarea.insert_str(" ");
+                            self.draft.textarea.insert_str(" ");
                         }
                         Err(err) => {
                             tracing::trace!("image dimensions lookup failed: {err}");
@@ -2102,7 +2010,7 @@ impl ChatComposer {
                     // Non-image: inserting file path.
                     self.insert_selected_path(&sel_path);
                 }
-                self.active_popup = ActivePopup::None;
+                self.popups.active = ActivePopup::None;
                 (InputResult::None, true)
             }
             input => self.handle_input_basic(input),
@@ -2113,9 +2021,9 @@ impl ChatComposer {
         if self.handle_shortcut_overlay_key(&key_event) {
             return (InputResult::None, true);
         }
-        self.footer_mode = reset_mode_after_activity(self.footer_mode);
+        self.footer.mode = reset_mode_after_activity(self.footer.mode);
 
-        let ActivePopup::Skill(popup) = &mut self.active_popup else {
+        let ActivePopup::Skill(popup) = &mut self.popups.active else {
             unreachable!();
         };
 
@@ -2150,9 +2058,9 @@ impl ChatComposer {
                 code: KeyCode::Esc, ..
             } => {
                 if let Some(tok) = self.current_mention_token() {
-                    self.dismissed_mention_popup_token = Some(tok);
+                    self.popups.dismissed_mention_token = Some(tok);
                 }
-                self.active_popup = ActivePopup::None;
+                self.popups.active = ActivePopup::None;
                 (InputResult::None, true)
             }
             KeyEvent {
@@ -2176,7 +2084,7 @@ impl ChatComposer {
             if let Some((insert_text, path)) = selected_mention {
                 self.insert_selected_mention(&insert_text, path.as_deref());
             }
-            self.active_popup = ActivePopup::None;
+            self.popups.active = ActivePopup::None;
         }
 
         result
@@ -2189,9 +2097,9 @@ impl ChatComposer {
         if self.handle_shortcut_overlay_key(&key_event) {
             return (InputResult::None, true);
         }
-        self.footer_mode = reset_mode_after_activity(self.footer_mode);
+        self.footer.mode = reset_mode_after_activity(self.footer.mode);
 
-        let ActivePopup::MentionV2(popup) = &mut self.active_popup else {
+        let ActivePopup::MentionV2(popup) = &mut self.popups.active else {
             unreachable!();
         };
 
@@ -2242,9 +2150,9 @@ impl ChatComposer {
                 code: KeyCode::Esc, ..
             } => {
                 if let Some(tok) = self.current_mentions_v2_token() {
-                    self.dismissed_mention_popup_token = Some(tok);
+                    self.popups.dismissed_mention_token = Some(tok);
                 }
-                self.active_popup = ActivePopup::None;
+                self.popups.active = ActivePopup::None;
                 (InputResult::None, true)
             }
             KeyEvent {
@@ -2273,7 +2181,7 @@ impl ChatComposer {
                     }
                 }
             }
-            self.active_popup = ActivePopup::None;
+            self.popups.active = ActivePopup::None;
         }
 
         result
@@ -2294,8 +2202,8 @@ impl ChatComposer {
             match image::image_dimensions(&path_buf) {
                 Ok((width, height)) => {
                     tracing::debug!("selected image dimensions={}x{}", width, height);
-                    let cursor_offset = self.textarea.cursor();
-                    let text = self.textarea.text();
+                    let cursor_offset = self.draft.textarea.cursor();
+                    let text = self.draft.textarea.text();
                     let safe_cursor = Self::clamp_to_char_boundary(text, cursor_offset);
                     let before_cursor = &text[..safe_cursor];
                     let after_cursor = &text[safe_cursor..];
@@ -2312,10 +2220,10 @@ impl ChatComposer {
                         .unwrap_or(after_cursor.len());
                     let end_idx = safe_cursor + end_rel_idx;
 
-                    self.textarea.replace_range(start_idx..end_idx, "");
-                    self.textarea.set_cursor(start_idx);
+                    self.draft.textarea.replace_range(start_idx..end_idx, "");
+                    self.draft.textarea.set_cursor(start_idx);
                     self.attach_image(path_buf);
-                    self.textarea.insert_str(" ");
+                    self.draft.textarea.insert_str(" ");
                 }
                 Err(err) => {
                     tracing::trace!("image dimensions lookup failed: {err}");
@@ -2586,14 +2494,14 @@ impl ChatComposer {
         if !self.mentions_v2_enabled {
             return None;
         }
-        Self::current_prefixed_token(&self.textarea, '@', /*allow_empty*/ true)
+        Self::current_prefixed_token(&self.draft.textarea, '@', /*allow_empty*/ true)
     }
 
     fn current_mention_token(&self) -> Option<String> {
         if !self.mentions_enabled() {
             return None;
         }
-        Self::current_prefixed_token(&self.textarea, '$', /*allow_empty*/ true)
+        Self::current_prefixed_token(&self.draft.textarea, '$', /*allow_empty*/ true)
     }
 
     /// Replace the active `@token` (the one under the cursor) with `path`.
@@ -2602,8 +2510,8 @@ impl ChatComposer {
     /// where the cursor is within the token and regardless of how many
     /// `@tokens` exist in the line.
     fn insert_selected_path(&mut self, path: &str) {
-        let cursor_offset = self.textarea.cursor();
-        let text = self.textarea.text();
+        let cursor_offset = self.draft.textarea.cursor();
+        let text = self.draft.textarea.text();
         // Clamp to a valid char boundary to avoid panics when slicing.
         let safe_cursor = Self::clamp_to_char_boundary(text, cursor_offset);
 
@@ -2636,15 +2544,16 @@ impl ChatComposer {
 
         // Replace just the active `@token` so unrelated text elements, such as
         // large-paste placeholders, remain atomic and can still expand on submit.
-        self.textarea
+        self.draft
+            .textarea
             .replace_range(start_idx..end_idx, &format!("{inserted} "));
         let new_cursor = start_idx.saturating_add(inserted.len()).saturating_add(1);
-        self.textarea.set_cursor(new_cursor);
+        self.draft.textarea.set_cursor(new_cursor);
     }
 
     fn insert_selected_mention(&mut self, insert_text: &str, path: Option<&str>) {
-        let cursor_offset = self.textarea.cursor();
-        let text = self.textarea.text();
+        let cursor_offset = self.draft.textarea.cursor();
+        let text = self.draft.textarea.text();
         let safe_cursor = Self::clamp_to_char_boundary(text, cursor_offset);
 
         let before_cursor = &text[..safe_cursor];
@@ -2664,14 +2573,14 @@ impl ChatComposer {
         let end_idx = safe_cursor + end_rel_idx;
 
         // Remove the active token and insert the selected mention as an atomic element.
-        self.textarea.replace_range(start_idx..end_idx, "");
-        self.textarea.set_cursor(start_idx);
-        let id = self.textarea.insert_element(insert_text);
+        self.draft.textarea.replace_range(start_idx..end_idx, "");
+        self.draft.textarea.set_cursor(start_idx);
+        let id = self.draft.textarea.insert_element(insert_text);
 
         if let (Some(path), Some(mention)) =
             (path, Self::mention_name_from_insert_text(insert_text))
         {
-            self.mention_bindings.insert(
+            self.draft.mention_bindings.insert(
                 id,
                 ComposerMentionBinding {
                     mention,
@@ -2680,11 +2589,11 @@ impl ChatComposer {
             );
         }
 
-        self.textarea.insert_str(" ");
+        self.draft.textarea.insert_str(" ");
         let new_cursor = start_idx
             .saturating_add(insert_text.len())
             .saturating_add(1);
-        self.textarea.set_cursor(new_cursor);
+        self.draft.textarea.set_cursor(new_cursor);
     }
 
     fn mention_name_from_insert_text(insert_text: &str) -> Option<String> {
@@ -2704,7 +2613,8 @@ impl ChatComposer {
     }
 
     fn current_mention_elements(&self) -> Vec<(u64, String)> {
-        self.textarea
+        self.draft
+            .textarea
             .text_element_snapshots()
             .into_iter()
             .filter_map(|snapshot| {
@@ -2717,7 +2627,7 @@ impl ChatComposer {
     fn snapshot_mention_bindings(&self) -> Vec<MentionBinding> {
         let mut ordered = Vec::new();
         for (id, mention) in self.current_mention_elements() {
-            if let Some(binding) = self.mention_bindings.get(&id)
+            if let Some(binding) = self.draft.mention_bindings.get(&id)
                 && binding.mention == mention
             {
                 ordered.push(MentionBinding {
@@ -2730,12 +2640,12 @@ impl ChatComposer {
     }
 
     fn bind_mentions_from_snapshot(&mut self, mention_bindings: Vec<MentionBinding>) {
-        self.mention_bindings.clear();
+        self.draft.mention_bindings.clear();
         if mention_bindings.is_empty() {
             return;
         }
 
-        let text = self.textarea.text().to_string();
+        let text = self.draft.textarea.text().to_string();
         let mut scan_from = 0usize;
         for binding in mention_bindings {
             let token = format!("${}", binding.mention);
@@ -2745,14 +2655,16 @@ impl ChatComposer {
                 continue;
             };
 
-            let id = if let Some(id) = self.textarea.add_element_range(range.clone()) {
+            let id = if let Some(id) = self.draft.textarea.add_element_range(range.clone()) {
                 Some(id)
             } else {
-                self.textarea.element_id_for_exact_range(range.clone())
+                self.draft
+                    .textarea
+                    .element_id_for_exact_range(range.clone())
             };
 
             if let Some(id) = id {
-                self.mention_bindings.insert(
+                self.draft.mention_bindings.insert(
                     id,
                     ComposerMentionBinding {
                         mention: binding.mention,
@@ -2784,22 +2696,18 @@ impl ChatComposer {
         let original_input = text.clone();
         let original_text_elements = self.current_text_elements();
         let original_mention_bindings = self.snapshot_mention_bindings();
-        let original_local_image_paths = self
-            .attached_images
-            .iter()
-            .map(|img| img.path.clone())
-            .collect::<Vec<_>>();
-        let original_pending_pastes = self.pending_pastes.clone();
+        let original_local_image_paths = self.attachments.local_image_paths();
+        let original_pending_pastes = self.draft.pending_pastes.clone();
         let mut text_elements = original_text_elements.clone();
         let input_starts_with_space = original_input.starts_with(' ');
-        self.recent_submission_mention_bindings.clear();
-        self.textarea.set_text_clearing_elements("");
-        self.is_bash_mode = false;
+        self.draft.recent_submission_mention_bindings.clear();
+        self.draft.textarea.set_text_clearing_elements("");
+        self.draft.is_bash_mode = false;
 
-        if !self.pending_pastes.is_empty() {
+        if !self.draft.pending_pastes.is_empty() {
             // Expand placeholders so element byte ranges stay aligned.
             let (expanded, expanded_elements) =
-                Self::expand_pending_pastes(&text, text_elements, &self.pending_pastes);
+                Self::expand_pending_pastes(&text, text_elements, &self.draft.pending_pastes);
             text = expanded;
             text_elements = expanded_elements;
         }
@@ -2835,8 +2743,10 @@ impl ChatComposer {
                         original_local_image_paths,
                         original_mention_bindings,
                     );
-                    self.pending_pastes.clone_from(&original_pending_pastes);
-                    self.textarea.set_cursor(original_input.len());
+                    self.draft
+                        .pending_pastes
+                        .clone_from(&original_pending_pastes);
+                    self.draft.textarea.set_cursor(original_input.len());
                     return None;
                 }
             }
@@ -2854,35 +2764,29 @@ impl ChatComposer {
                 original_local_image_paths,
                 original_mention_bindings,
             );
-            self.pending_pastes.clone_from(&original_pending_pastes);
-            self.textarea.set_cursor(original_input.len());
+            self.draft
+                .pending_pastes
+                .clone_from(&original_pending_pastes);
+            self.draft.textarea.set_cursor(original_input.len());
             return None;
         }
-        self.prune_attached_images_for_submission(&text, &text_elements);
-        if text.is_empty() && self.attached_images.is_empty() && self.remote_image_urls.is_empty() {
+        self.attachments
+            .prune_local_images_for_submission(&text, &text_elements);
+        if text.is_empty() && self.attachments.is_empty() {
             return None;
         }
-        self.recent_submission_mention_bindings = original_mention_bindings.clone();
-        if record_history
-            && (!text.is_empty()
-                || !self.attached_images.is_empty()
-                || !self.remote_image_urls.is_empty())
-        {
-            let local_image_paths = self
-                .attached_images
-                .iter()
-                .map(|img| img.path.clone())
-                .collect();
+        self.draft.recent_submission_mention_bindings = original_mention_bindings.clone();
+        if record_history && (!text.is_empty() || !self.attachments.is_empty()) {
             self.history.record_local_submission(HistoryEntry {
                 text: text.clone(),
                 text_elements: text_elements.clone(),
-                local_image_paths,
-                remote_image_urls: self.remote_image_urls.clone(),
+                local_image_paths: self.attachments.local_image_paths(),
+                remote_image_urls: self.attachments.remote_image_urls(),
                 mention_bindings: original_mention_bindings,
                 pending_pastes: Vec::new(),
             });
         }
-        self.pending_pastes.clear();
+        self.draft.pending_pastes.clear();
         Some((text, text_elements))
     }
 
@@ -2903,7 +2807,7 @@ impl ChatComposer {
                 | InputResult::ServiceTierCommand(_)
                 | InputResult::CommandWithArgs(_, _, _)
         ) {
-            self.textarea.enter_vim_normal_mode();
+            self.draft.textarea.enter_vim_normal_mode();
         }
     }
 
@@ -2913,7 +2817,7 @@ impl ChatComposer {
         now: Instant,
     ) -> (InputResult, bool) {
         if should_queue {
-            let raw_text = self.textarea.text();
+            let raw_text = self.draft.textarea.text();
             let defer_slash_validation =
                 self.should_parse_as_slash_on_dequeue_from_raw_text(raw_text);
             if let Some((text, text_elements)) = self.prepare_submission_text_with_options(
@@ -2952,44 +2856,42 @@ impl ChatComposer {
         // and accumulate it rather than submitting or inserting immediately.
         // Do not treat as paste inside a slash-command context.
         let in_slash_context = self.slash_commands_enabled()
-            && !self.is_bash_mode
-            && (matches!(self.active_popup, ActivePopup::Command(_))
+            && !self.draft.is_bash_mode
+            && (matches!(self.popups.active, ActivePopup::Command(_))
                 || self
+                    .draft
                     .textarea
                     .text()
                     .lines()
                     .next()
                     .unwrap_or("")
                     .starts_with('/'));
-        if !self.disable_paste_burst
-            && self.paste_burst.is_active()
+        if !self.draft.disable_paste_burst
+            && self.draft.paste_burst.is_active()
             && !in_slash_context
-            && self.paste_burst.append_newline_if_active(now)
+            && self.draft.paste_burst.append_newline_if_active(now)
         {
             return (InputResult::None, true);
         }
 
         // During a paste-like burst, treat Enter/Ctrl+Shift+Q as a newline instead of submit.
         if !in_slash_context
-            && !self.disable_paste_burst
+            && !self.draft.disable_paste_burst
             && self
+                .draft
                 .paste_burst
                 .newline_should_insert_instead_of_submit(now)
         {
-            self.textarea.insert_str("\n");
-            self.paste_burst.extend_window(now);
+            self.draft.textarea.insert_str("\n");
+            self.draft.paste_burst.extend_window(now);
             return (InputResult::None, true);
         }
 
         let original_input = self.current_text();
         let original_text_elements = self.current_text_elements();
         let original_mention_bindings = self.snapshot_mention_bindings();
-        let original_local_image_paths = self
-            .attached_images
-            .iter()
-            .map(|img| img.path.clone())
-            .collect::<Vec<_>>();
-        let original_pending_pastes = self.pending_pastes.clone();
+        let original_local_image_paths = self.attachments.local_image_paths();
+        let original_pending_pastes = self.draft.pending_pastes.clone();
         if let Some(result) = self.try_dispatch_slash_command_with_args() {
             return (result, true);
         }
@@ -3007,7 +2909,8 @@ impl ChatComposer {
                     true,
                 )
             } else {
-                // Do not clear attached_images here; ChatWidget drains them via take_recent_submission_images().
+                // Do not clear local attachments here; ChatWidget drains them via
+                // take_recent_submission_images().
                 (
                     InputResult::Submitted {
                         text,
@@ -3024,7 +2927,7 @@ impl ChatComposer {
                 original_local_image_paths,
                 original_mention_bindings,
             );
-            self.pending_pastes = original_pending_pastes;
+            self.draft.pending_pastes = original_pending_pastes;
             (InputResult::None, true)
         }
     }
@@ -3032,10 +2935,10 @@ impl ChatComposer {
     /// Check if the first line is a bare slash command (no args) and dispatch it.
     /// Returns Some(InputResult) if a command was dispatched, None otherwise.
     fn try_dispatch_bare_slash_command(&mut self) -> Option<InputResult> {
-        if !self.slash_commands_enabled() || self.is_bash_mode {
+        if !self.slash_commands_enabled() || self.draft.is_bash_mode {
             return None;
         }
-        let text = self.textarea.text();
+        let text = self.draft.textarea.text();
         let first_line = text.lines().next().unwrap_or("");
         let (name, rest, _rest_offset) = parse_slash_name(first_line)?;
         if !rest.is_empty() {
@@ -3057,8 +2960,8 @@ impl ChatComposer {
             return Some(InputResult::None);
         }
         self.stage_slash_command_history(&command);
-        self.textarea.set_text_clearing_elements("");
-        self.is_bash_mode = false;
+        self.draft.textarea.set_text_clearing_elements("");
+        self.draft.is_bash_mode = false;
         Some(match command {
             SlashCommandItem::Builtin(cmd) => InputResult::Command(cmd),
             SlashCommandItem::ServiceTier(command) => InputResult::ServiceTierCommand(command),
@@ -3068,10 +2971,10 @@ impl ChatComposer {
     /// Check if the input is a slash command with args (e.g., /review args) and dispatch it.
     /// Returns Some(InputResult) if a command was dispatched, None otherwise.
     fn try_dispatch_slash_command_with_args(&mut self) -> Option<InputResult> {
-        if !self.slash_commands_enabled() || self.is_bash_mode {
+        if !self.slash_commands_enabled() || self.draft.is_bash_mode {
             return None;
         }
-        let text = self.textarea.text().to_string();
+        let text = self.draft.textarea.text().to_string();
         if text.starts_with(' ') {
             return None;
         }
@@ -3098,8 +3001,11 @@ impl ChatComposer {
 
         self.stage_slash_command_history(&command);
 
-        let mut args_elements =
-            Self::slash_command_args_elements(rest, rest_offset, &self.textarea.text_elements());
+        let mut args_elements = Self::slash_command_args_elements(
+            rest,
+            rest_offset,
+            &self.draft.textarea.text_elements(),
+        );
         let trimmed_rest = rest.trim();
         args_elements = Self::trim_text_elements(rest, trimmed_rest, args_elements);
         let SlashCommandItem::Builtin(cmd) = command else {
@@ -3179,7 +3085,7 @@ impl ChatComposer {
         if matches!(command, SlashCommandItem::Builtin(SlashCommand::Clear)) {
             return;
         }
-        self.stage_slash_command_history_text(self.textarea.text().trim().to_string());
+        self.stage_slash_command_history_text(self.draft.textarea.text().trim().to_string());
     }
 
     /// Stage a popup-selected command using its canonical command text.
@@ -3201,15 +3107,11 @@ impl ChatComposer {
     fn stage_slash_command_history_text(&mut self, text: String) {
         self.pending_slash_command_history = Some(HistoryEntry {
             text,
-            text_elements: self.textarea.text_elements(),
-            local_image_paths: self
-                .attached_images
-                .iter()
-                .map(|img| img.path.clone())
-                .collect(),
-            remote_image_urls: self.remote_image_urls.clone(),
+            text_elements: self.draft.textarea.text_elements(),
+            local_image_paths: self.attachments.local_image_paths(),
+            remote_image_urls: self.attachments.remote_image_urls(),
             mention_bindings: self.snapshot_mention_bindings(),
-            pending_pastes: self.pending_pastes.clone(),
+            pending_pastes: self.draft.pending_pastes.clone(),
         });
     }
 
@@ -3241,85 +3143,12 @@ impl ChatComposer {
             .collect()
     }
 
-    fn remote_images_lines(&self, _width: u16) -> Vec<Line<'static>> {
-        self.remote_image_urls
-            .iter()
-            .enumerate()
-            .map(|(idx, _)| {
-                let label = local_image_label_text(idx + 1);
-                if self.selected_remote_image_index == Some(idx) {
-                    label.cyan().reversed().into()
-                } else {
-                    label.cyan().into()
-                }
-            })
-            .collect()
-    }
-
-    fn clear_remote_image_selection(&mut self) {
-        self.selected_remote_image_index = None;
-    }
-
-    fn remove_selected_remote_image(&mut self, selected_index: usize) {
-        if selected_index >= self.remote_image_urls.len() {
-            self.clear_remote_image_selection();
-            return;
-        }
-        self.remote_image_urls.remove(selected_index);
-        self.selected_remote_image_index = if self.remote_image_urls.is_empty() {
-            None
-        } else {
-            Some(selected_index.min(self.remote_image_urls.len() - 1))
-        };
-        self.relabel_attached_images_and_update_placeholders();
-        self.sync_popups();
-    }
-
     fn handle_remote_image_selection_key(
         &mut self,
         key_event: &KeyEvent,
     ) -> Option<(InputResult, bool)> {
-        if self.remote_image_urls.is_empty()
-            || key_event.modifiers != KeyModifiers::NONE
-            || key_event.kind != KeyEventKind::Press
-        {
-            return None;
-        }
-
-        match key_event.code {
-            KeyCode::Up => {
-                if let Some(selected) = self.selected_remote_image_index {
-                    self.selected_remote_image_index = Some(selected.saturating_sub(1));
-                    Some((InputResult::None, true))
-                } else if self.textarea.cursor() == 0 {
-                    self.selected_remote_image_index = Some(self.remote_image_urls.len() - 1);
-                    Some((InputResult::None, true))
-                } else {
-                    None
-                }
-            }
-            KeyCode::Down => {
-                if let Some(selected) = self.selected_remote_image_index {
-                    if selected + 1 < self.remote_image_urls.len() {
-                        self.selected_remote_image_index = Some(selected + 1);
-                    } else {
-                        self.clear_remote_image_selection();
-                    }
-                    Some((InputResult::None, true))
-                } else {
-                    None
-                }
-            }
-            KeyCode::Delete | KeyCode::Backspace => {
-                if let Some(selected) = self.selected_remote_image_index {
-                    self.remove_selected_remote_image(selected);
-                    Some((InputResult::None, true))
-                } else {
-                    None
-                }
-            }
-            _ => None,
-        }
+        self.attachments
+            .handle_remote_image_selection_key(key_event, &mut self.draft.textarea)
     }
 
     /// Handle key event when no popup is visible.
@@ -3327,28 +3156,29 @@ impl ChatComposer {
         if let Some((result, redraw)) = self.handle_remote_image_selection_key(&key_event) {
             return (result, redraw);
         }
-        if self.selected_remote_image_index.is_some() {
-            self.clear_remote_image_selection();
+        if self.attachments.selected_remote_image_index.is_some() {
+            self.attachments.clear_remote_image_selection();
         }
         if self.handle_shortcut_overlay_key(&key_event) {
             return (InputResult::None, true);
         }
-        if self.is_bash_mode && key_event.code == KeyCode::Esc {
-            if let Some(pasted) = self.paste_burst.flush_before_modified_input() {
+        if self.draft.is_bash_mode && key_event.code == KeyCode::Esc {
+            if let Some(pasted) = self.draft.paste_burst.flush_before_modified_input() {
                 self.handle_paste(pasted);
             }
-            if self.textarea.is_empty() {
-                self.is_bash_mode = false;
+            if self.draft.textarea.is_empty() {
+                self.draft.is_bash_mode = false;
                 return (InputResult::None, true);
             }
         }
         if self.should_handle_vim_insert_escape(key_event) {
             return self.handle_input_basic(key_event);
         }
-        if self.textarea.is_vim_normal_mode() && self.textarea.is_vim_operator_pending() {
+        if self.draft.textarea.is_vim_normal_mode() && self.draft.textarea.is_vim_operator_pending()
+        {
             return self.handle_input_basic(key_event);
         }
-        if self.textarea.is_vim_normal_mode()
+        if self.draft.textarea.is_vim_normal_mode()
             && self.is_empty()
             && matches!(
                 key_event,
@@ -3360,13 +3190,15 @@ impl ChatComposer {
                 }
             )
         {
-            self.footer_mode = reset_mode_after_activity(self.footer_mode);
-            self.textarea.set_text_clearing_elements("/");
-            self.textarea.set_cursor(self.textarea.text().len());
-            self.textarea.enter_vim_insert_mode();
+            self.footer.mode = reset_mode_after_activity(self.footer.mode);
+            self.draft.textarea.set_text_clearing_elements("/");
+            self.draft
+                .textarea
+                .set_cursor(self.draft.textarea.text().len());
+            self.draft.textarea.enter_vim_insert_mode();
             return (InputResult::None, true);
         }
-        if self.textarea.is_vim_normal_mode()
+        if self.draft.textarea.is_vim_normal_mode()
             && self.is_empty()
             && matches!(
                 key_event,
@@ -3378,21 +3210,21 @@ impl ChatComposer {
                 }
             )
         {
-            self.footer_mode = reset_mode_after_activity(self.footer_mode);
-            self.is_bash_mode = true;
-            self.textarea.enter_vim_insert_mode();
+            self.footer.mode = reset_mode_after_activity(self.footer.mode);
+            self.draft.is_bash_mode = true;
+            self.draft.textarea.enter_vim_insert_mode();
             return (InputResult::None, true);
         }
         if key_event.code == KeyCode::Esc {
             if self.is_empty() {
-                let next_mode = esc_hint_mode(self.footer_mode, self.is_task_running);
-                if next_mode != self.footer_mode {
-                    self.footer_mode = next_mode;
+                let next_mode = esc_hint_mode(self.footer.mode, self.is_task_running);
+                if next_mode != self.footer.mode {
+                    self.footer.mode = next_mode;
                     return (InputResult::None, true);
                 }
             }
         } else {
-            self.footer_mode = reset_mode_after_activity(self.footer_mode);
+            self.footer.mode = reset_mode_after_activity(self.footer.mode);
         }
         if self.queue_keys.is_pressed(key_event)
             && (self.is_task_running || !self.is_bang_shell_command())
@@ -3415,8 +3247,9 @@ impl ChatComposer {
             return (InputResult::None, false);
         }
 
-        let (history_up_pressed, history_down_pressed) = if self.textarea.is_vim_normal_mode() {
-            if self.textarea.is_vim_operator_pending() {
+        let (history_up_pressed, history_down_pressed) = if self.draft.textarea.is_vim_normal_mode()
+        {
+            if self.draft.textarea.is_vim_operator_pending() {
                 (false, false)
             } else {
                 (
@@ -3470,7 +3303,7 @@ impl ChatComposer {
     /// - UI ticks via [`ChatComposer::flush_paste_burst_if_due`], so held first-chars can render.
     /// - Input handling via [`ChatComposer::handle_input_basic`], so a due burst does not lag.
     fn handle_paste_burst_flush(&mut self, now: Instant) -> bool {
-        match self.paste_burst.flush_if_due(now) {
+        match self.draft.paste_burst.flush_if_due(now) {
             FlushResult::Paste(pasted) => {
                 self.handle_paste(pasted);
                 true
@@ -3517,14 +3350,14 @@ impl ChatComposer {
         self.handle_paste_burst_flush(now);
 
         if !matches!(input.code, KeyCode::Esc) {
-            self.footer_mode = reset_mode_after_activity(self.footer_mode);
+            self.footer.mode = reset_mode_after_activity(self.footer.mode);
         }
 
         // If we're capturing a burst and receive Enter, accumulate it instead of inserting.
         if matches!(input.code, KeyCode::Enter)
-            && !self.disable_paste_burst
-            && self.paste_burst.is_active()
-            && self.paste_burst.append_newline_if_active(now)
+            && !self.draft.disable_paste_burst
+            && self.draft.paste_burst.is_active()
+            && self.draft.paste_burst.append_newline_if_active(now)
         {
             return (InputResult::None, true);
         }
@@ -3541,31 +3374,37 @@ impl ChatComposer {
         } = input
         {
             let has_ctrl_or_alt = has_ctrl_or_alt(modifiers);
-            if !has_ctrl_or_alt && !self.disable_paste_burst && self.textarea.allows_paste_burst() {
+            if !has_ctrl_or_alt
+                && !self.draft.disable_paste_burst
+                && self.draft.textarea.allows_paste_burst()
+            {
                 // Non-ASCII characters (e.g., from IMEs) can arrive in quick bursts, so avoid
                 // holding the first char while still allowing burst detection for paste input.
                 if !ch.is_ascii() {
                     return self.handle_non_ascii_char(input, now);
                 }
 
-                match self.paste_burst.on_plain_char(ch, now) {
+                match self.draft.paste_burst.on_plain_char(ch, now) {
                     CharDecision::BufferAppend => {
-                        self.paste_burst.append_char_to_buffer(ch, now);
+                        self.draft.paste_burst.append_char_to_buffer(ch, now);
                         return (InputResult::None, true);
                     }
                     CharDecision::BeginBuffer { retro_chars } => {
-                        let cur = self.textarea.cursor();
-                        let txt = self.textarea.text();
+                        let cur = self.draft.textarea.cursor();
+                        let txt = self.draft.textarea.text();
                         let safe_cur = Self::clamp_to_char_boundary(txt, cur);
                         let before = &txt[..safe_cur];
-                        if let Some(grab) =
-                            self.paste_burst
-                                .decide_begin_buffer(now, before, retro_chars as usize)
-                        {
+                        if let Some(grab) = self.draft.paste_burst.decide_begin_buffer(
+                            now,
+                            before,
+                            retro_chars as usize,
+                        ) {
                             if !grab.grabbed.is_empty() {
-                                self.textarea.replace_range(grab.start_byte..safe_cur, "");
+                                self.draft
+                                    .textarea
+                                    .replace_range(grab.start_byte..safe_cur, "");
                             }
-                            self.paste_burst.append_char_to_buffer(ch, now);
+                            self.draft.paste_burst.append_char_to_buffer(ch, now);
                             return (InputResult::None, true);
                         }
                         // If decide_begin_buffer opted not to start buffering,
@@ -3573,7 +3412,7 @@ impl ChatComposer {
                     }
                     CharDecision::BeginBufferFromPending => {
                         // First char was held; now append the current one.
-                        self.paste_burst.append_char_to_buffer(ch, now);
+                        self.draft.paste_burst.append_char_to_buffer(ch, now);
                         return (InputResult::None, true);
                     }
                     CharDecision::RetainFirstChar => {
@@ -3582,7 +3421,7 @@ impl ChatComposer {
                     }
                 }
             }
-            if let Some(pasted) = self.paste_burst.flush_before_modified_input() {
+            if let Some(pasted) = self.draft.paste_burst.flush_before_modified_input() {
                 self.handle_paste(pasted);
             }
         }
@@ -3594,31 +3433,29 @@ impl ChatComposer {
         // time out against, and the buffered paste could remain stuck until another plain char
         // arrives.
         if !matches!(input.code, KeyCode::Char(_) | KeyCode::Enter)
-            && let Some(pasted) = self.paste_burst.flush_before_modified_input()
+            && let Some(pasted) = self.draft.paste_burst.flush_before_modified_input()
         {
             self.handle_paste(pasted);
         }
         // For non-char inputs (or after flushing), handle normally.
         // Track element removals so we can drop any corresponding placeholders without scanning
         // the full text. (Placeholders are atomic elements; when deleted, the element disappears.)
-        let elements_before = if self.pending_pastes.is_empty()
-            && self.attached_images.is_empty()
-            && self.remote_image_urls.is_empty()
+        let elements_before = if self.draft.pending_pastes.is_empty() && self.attachments.is_empty()
         {
             None
         } else {
-            Some(self.textarea.element_payloads())
+            Some(self.draft.textarea.element_payloads())
         };
 
-        if self.is_bash_mode
+        if self.draft.is_bash_mode
             && matches!(input.code, KeyCode::Backspace)
-            && self.textarea.cursor() == 0
+            && self.draft.textarea.cursor() == 0
         {
-            self.is_bash_mode = false;
+            self.draft.is_bash_mode = false;
             return (InputResult::None, true);
         }
 
-        self.textarea.input(input);
+        self.draft.textarea.input(input);
         self.sync_bash_mode_from_text();
 
         if let Some(elements_before) = elements_before {
@@ -3633,7 +3470,7 @@ impl ChatComposer {
             KeyCode::Char(_) => {
                 let has_ctrl_or_alt = has_ctrl_or_alt(modifiers);
                 if has_ctrl_or_alt {
-                    self.paste_burst.clear_window_after_non_char();
+                    self.draft.paste_burst.clear_window_after_non_char();
                 }
             }
             KeyCode::Enter => {
@@ -3641,7 +3478,7 @@ impl ChatComposer {
             }
             _ => {
                 // Other keys: clear burst window (buffer should have been flushed above if needed).
-                self.paste_burst.clear_window_after_non_char();
+                self.draft.paste_burst.clear_window_after_non_char();
             }
         }
 
@@ -3649,49 +3486,25 @@ impl ChatComposer {
     }
 
     fn sync_bash_mode_from_text(&mut self) {
-        if !self.is_bash_mode && self.textarea.text().starts_with('!') {
-            self.textarea.replace_range(0..1, "");
-            self.is_bash_mode = true;
+        if !self.draft.is_bash_mode && self.draft.textarea.text().starts_with('!') {
+            self.draft.textarea.replace_range(0..1, "");
+            self.draft.is_bash_mode = true;
         }
     }
 
     fn reconcile_deleted_elements(&mut self, elements_before: Vec<String>) {
         let elements_after: HashSet<String> =
-            self.textarea.element_payloads().into_iter().collect();
+            self.draft.textarea.element_payloads().into_iter().collect();
 
-        let mut removed_any_image = false;
-        for removed in elements_before
+        let removed_payloads = elements_before
             .into_iter()
             .filter(|payload| !elements_after.contains(payload))
-        {
-            self.pending_pastes.retain(|(ph, _)| ph != &removed);
-
-            if let Some(idx) = self
-                .attached_images
-                .iter()
-                .position(|img| img.placeholder == removed)
-            {
-                self.attached_images.remove(idx);
-                removed_any_image = true;
-            }
-        }
-
-        if removed_any_image {
-            self.relabel_attached_images_and_update_placeholders();
-        }
-    }
-
-    fn relabel_attached_images_and_update_placeholders(&mut self) {
-        for idx in 0..self.attached_images.len() {
-            let expected = local_image_label_text(self.remote_image_urls.len() + idx + 1);
-            let current = self.attached_images[idx].placeholder.clone();
-            if current == expected {
-                continue;
-            }
-
-            self.attached_images[idx].placeholder = expected.clone();
-            let _renamed = self.textarea.replace_element_payload(&current, &expected);
+            .collect::<Vec<_>>();
+        for removed in &removed_payloads {
+            self.draft.pending_pastes.retain(|(ph, _)| ph != removed);
         }
+        self.attachments
+            .remove_deleted_local_placeholders(&removed_payloads, &mut self.draft.textarea);
     }
 
     /// Handle the dedicated shortcut-overlay toggle key(s).
@@ -3714,12 +3527,12 @@ impl ChatComposer {
         }
 
         let next = toggle_shortcut_mode(
-            self.footer_mode,
+            self.footer.mode,
             self.quit_shortcut_hint_visible(),
             self.is_empty(),
         );
-        let changed = next != self.footer_mode;
-        self.footer_mode = next;
+        let changed = next != self.footer.mode;
+        self.footer.mode = next;
         changed
     }
 
@@ -3738,26 +3551,26 @@ impl ChatComposer {
 
         FooterProps {
             mode,
-            esc_backtrack_hint: self.esc_backtrack_hint,
-            use_shift_enter_hint: self.use_shift_enter_hint,
+            esc_backtrack_hint: self.footer.esc_backtrack_hint,
+            use_shift_enter_hint: self.footer.use_shift_enter_hint,
             is_task_running: self.is_task_running,
-            quit_shortcut_key: self.quit_shortcut_key,
+            quit_shortcut_key: self.footer.quit_shortcut_key,
             collaboration_modes_enabled: self.collaboration_modes_enabled,
             is_wsl,
-            status_line_value: self.status_line_value.clone(),
-            status_line_enabled: self.status_line_enabled,
+            status_line_value: self.footer.status_line_value.clone(),
+            status_line_enabled: self.footer.status_line_enabled,
             key_hints: FooterKeyHints {
-                toggle_shortcuts: self.footer_toggle_shortcuts_key,
-                queue: self.footer_queue_key,
-                insert_newline: self.footer_insert_newline_key,
-                external_editor: self.footer_external_editor_key,
+                toggle_shortcuts: self.footer.toggle_shortcuts_key,
+                queue: self.footer.queue_key,
+                insert_newline: self.footer.insert_newline_key,
+                external_editor: self.footer.external_editor_key,
                 edit_previous: Some(key_hint::plain(KeyCode::Esc)),
-                show_transcript: self.footer_show_transcript_key,
-                history_search: self.footer_history_search_key,
-                reasoning_down: self.footer_reasoning_down_key,
-                reasoning_up: self.footer_reasoning_up_key,
+                show_transcript: self.footer.show_transcript_key,
+                history_search: self.footer.history_search_key,
+                reasoning_down: self.footer.reasoning_down_key,
+                reasoning_up: self.footer.reasoning_up_key,
             },
-            active_agent_label: self.active_agent_label.clone(),
+            active_agent_label: self.footer.active_agent_label.clone(),
         }
     }
 
@@ -3778,7 +3591,7 @@ impl ChatComposer {
             FooterMode::ComposerHasDraft
         };
 
-        match self.footer_mode {
+        match self.footer.mode {
             FooterMode::HistorySearch => FooterMode::HistorySearch,
             FooterMode::EscHint => FooterMode::EscHint,
             FooterMode::ShortcutOverlay => FooterMode::ShortcutOverlay,
@@ -3796,10 +3609,11 @@ impl ChatComposer {
     }
 
     fn custom_footer_height(&self) -> Option<u16> {
-        if self.footer_flash_visible() {
+        if self.footer.flash_visible() {
             return Some(1);
         }
-        self.footer_hint_override
+        self.footer
+            .hint_override
             .as_ref()
             .map(|items| if items.is_empty() { 0 } else { 1 })
     }
@@ -3807,25 +3621,25 @@ impl ChatComposer {
     pub(crate) fn sync_popups(&mut self) {
         self.sync_slash_command_elements();
         if self.history_search.is_some() {
-            if self.current_file_query.is_some() {
+            if self.popups.current_file_query.is_some() {
                 self.app_event_tx
                     .send(AppEvent::StartFileSearch(String::new()));
-                self.current_file_query = None;
+                self.popups.current_file_query = None;
             }
-            self.active_popup = ActivePopup::None;
-            self.dismissed_file_popup_token = None;
-            self.dismissed_mention_popup_token = None;
+            self.popups.active = ActivePopup::None;
+            self.popups.dismissed_file_token = None;
+            self.popups.dismissed_mention_token = None;
             return;
         }
         if !self.popups_enabled() {
-            self.active_popup = ActivePopup::None;
+            self.popups.active = ActivePopup::None;
             return;
         }
         let mentions_v2_token = self.current_mentions_v2_token();
         let file_token = if self.mentions_v2_enabled {
             None
         } else {
-            Self::current_at_token(&self.textarea)
+            Self::current_at_token(&self.draft.textarea)
         };
         let browsing_history = self
             .history
@@ -3833,31 +3647,31 @@ impl ChatComposer {
         // When browsing input history (shell-style Up/Down recall), skip all popup
         // synchronization so nothing steals focus from continued history navigation.
         if browsing_history {
-            if self.current_file_query.is_some() {
+            if self.popups.current_file_query.is_some() {
                 self.app_event_tx
                     .send(AppEvent::StartFileSearch(String::new()));
-                self.current_file_query = None;
+                self.popups.current_file_query = None;
             }
-            self.active_popup = ActivePopup::None;
+            self.popups.active = ActivePopup::None;
             return;
         }
         let mention_token = self.current_mention_token();
 
         let allow_command_popup = self.slash_commands_enabled()
-            && !self.is_bash_mode
+            && !self.draft.is_bash_mode
             && file_token.is_none()
             && mentions_v2_token.is_none()
             && mention_token.is_none();
         self.sync_command_popup(allow_command_popup);
 
-        if matches!(self.active_popup, ActivePopup::Command(_)) {
-            if self.current_file_query.is_some() {
+        if matches!(self.popups.active, ActivePopup::Command(_)) {
+            if self.popups.current_file_query.is_some() {
                 self.app_event_tx
                     .send(AppEvent::StartFileSearch(String::new()));
-                self.current_file_query = None;
+                self.popups.current_file_query = None;
             }
-            self.dismissed_file_popup_token = None;
-            self.dismissed_mention_popup_token = None;
+            self.popups.dismissed_file_token = None;
+            self.popups.dismissed_mention_token = None;
             return;
         }
 
@@ -3867,32 +3681,32 @@ impl ChatComposer {
         }
 
         if let Some(token) = mention_token {
-            if self.current_file_query.is_some() {
+            if self.popups.current_file_query.is_some() {
                 self.app_event_tx
                     .send(AppEvent::StartFileSearch(String::new()));
-                self.current_file_query = None;
+                self.popups.current_file_query = None;
             }
             self.sync_mention_popup(token);
             return;
         }
-        self.dismissed_mention_popup_token = None;
+        self.popups.dismissed_mention_token = None;
 
         if let Some(token) = file_token {
             self.sync_file_search_popup(token);
             return;
         }
 
-        if self.current_file_query.is_some() {
+        if self.popups.current_file_query.is_some() {
             self.app_event_tx
                 .send(AppEvent::StartFileSearch(String::new()));
-            self.current_file_query = None;
+            self.popups.current_file_query = None;
         }
-        self.dismissed_file_popup_token = None;
+        self.popups.dismissed_file_token = None;
         if matches!(
-            self.active_popup,
+            self.popups.active,
             ActivePopup::File(_) | ActivePopup::Skill(_) | ActivePopup::MentionV2(_)
         ) {
-            self.active_popup = ActivePopup::None;
+            self.popups.active = ActivePopup::None;
         }
     }
 
@@ -3901,7 +3715,7 @@ impl ChatComposer {
         if !self.slash_commands_enabled() {
             return;
         }
-        let text = self.textarea.text();
+        let text = self.draft.textarea.text();
         let first_line_end = text.find('\n').unwrap_or(text.len());
         let first_line = &text[..first_line_end];
         let desired_range = self.slash_command_element_range(first_line);
@@ -3909,7 +3723,7 @@ impl ChatComposer {
         // Any slash-shaped element not matching the current desired prefix is stale.
         let mut has_desired = false;
         let mut stale_ranges = Vec::new();
-        for elem in self.textarea.text_elements() {
+        for elem in self.draft.textarea.text_elements() {
             let Some(payload) = elem.placeholder(text) else {
                 continue;
             };
@@ -3925,18 +3739,18 @@ impl ChatComposer {
         }
 
         for range in stale_ranges {
-            self.textarea.remove_element_range(range);
+            self.draft.textarea.remove_element_range(range);
         }
 
         if let Some(range) = desired_range
             && !has_desired
         {
-            self.textarea.add_element_range(range);
+            self.draft.textarea.add_element_range(range);
         }
     }
 
     fn slash_command_element_range(&self, first_line: &str) -> Option<Range<usize>> {
-        if self.is_bash_mode {
+        if self.draft.is_bash_mode {
             return None;
         }
         let (name, _rest, _rest_offset) = parse_slash_name(first_line)?;
@@ -4018,16 +3832,16 @@ impl ChatComposer {
     /// the text so the popup is shown/updated/hidden as appropriate.
     fn sync_command_popup(&mut self, allow: bool) {
         if !allow {
-            if matches!(self.active_popup, ActivePopup::Command(_)) {
-                self.active_popup = ActivePopup::None;
+            if matches!(self.popups.active, ActivePopup::Command(_)) {
+                self.popups.active = ActivePopup::None;
             }
             return;
         }
         // Determine whether the caret is inside the initial '/name' token on the first line.
-        let text = self.textarea.text();
+        let text = self.draft.textarea.text();
         let first_line_end = text.find('\n').unwrap_or(text.len());
         let first_line = &text[..first_line_end];
-        let cursor = self.textarea.cursor();
+        let cursor = self.draft.textarea.cursor();
         let caret_on_first_line = cursor <= first_line_end;
 
         let is_editing_slash_command_name = caret_on_first_line
@@ -4037,18 +3851,18 @@ impl ChatComposer {
         // If the cursor is currently positioned within an `@token`, prefer the
         // file-search popup over the slash popup so users can insert a file path
         // as an argument to the command (e.g., "/review @docs/...").
-        if Self::current_at_token(&self.textarea).is_some() {
-            if matches!(self.active_popup, ActivePopup::Command(_)) {
-                self.active_popup = ActivePopup::None;
+        if Self::current_at_token(&self.draft.textarea).is_some() {
+            if matches!(self.popups.active, ActivePopup::Command(_)) {
+                self.popups.active = ActivePopup::None;
             }
             return;
         }
-        match &mut self.active_popup {
+        match &mut self.popups.active {
             ActivePopup::Command(popup) => {
                 if is_editing_slash_command_name {
                     popup.on_composer_text_change(first_line.to_string());
                 } else {
-                    self.active_popup = ActivePopup::None;
+                    self.popups.active = ActivePopup::None;
                 }
             }
             _ => {
@@ -4077,17 +3891,17 @@ impl ChatComposer {
                         self.service_tier_commands.clone(),
                     );
                     command_popup.on_composer_text_change(first_line.to_string());
-                    self.active_popup = ActivePopup::Command(command_popup);
+                    self.popups.active = ActivePopup::Command(command_popup);
                 }
             }
         }
     }
 
     /// Synchronize `self.file_search_popup` with the current text in the textarea.
-    /// Note this is only called when self.active_popup is NOT Command.
+    /// Note this is only called when the active popup is NOT Command.
     fn sync_file_search_popup(&mut self, query: String) {
         // If user dismissed popup for this exact query, don't reopen until text changes.
-        if self.dismissed_file_popup_token.as_ref() == Some(&query) {
+        if self.popups.dismissed_file_token.as_ref() == Some(&query) {
             return;
         }
 
@@ -4099,7 +3913,7 @@ impl ChatComposer {
                 .send(AppEvent::StartFileSearch(query.clone()));
         }
 
-        match &mut self.active_popup {
+        match &mut self.popups.active {
             ActivePopup::File(popup) => {
                 if query.is_empty() {
                     popup.set_empty_prompt();
@@ -4114,30 +3928,30 @@ impl ChatComposer {
                 } else {
                     popup.set_query(&query);
                 }
-                self.active_popup = ActivePopup::File(popup);
+                self.popups.active = ActivePopup::File(popup);
             }
         }
 
         if query.is_empty() {
-            self.current_file_query = None;
+            self.popups.current_file_query = None;
         } else {
-            self.current_file_query = Some(query);
+            self.popups.current_file_query = Some(query);
         }
-        self.dismissed_file_popup_token = None;
+        self.popups.dismissed_file_token = None;
     }
 
     fn sync_mention_popup(&mut self, query: String) {
-        if self.dismissed_mention_popup_token.as_ref() == Some(&query) {
+        if self.popups.dismissed_mention_token.as_ref() == Some(&query) {
             return;
         }
 
         let mentions = self.mention_items();
         if mentions.is_empty() {
-            self.active_popup = ActivePopup::None;
+            self.popups.active = ActivePopup::None;
             return;
         }
 
-        match &mut self.active_popup {
+        match &mut self.popups.active {
             ActivePopup::Skill(popup) => {
                 popup.set_query(&query);
                 popup.set_mentions(mentions);
@@ -4145,24 +3959,24 @@ impl ChatComposer {
             _ => {
                 let mut popup = SkillPopup::new(mentions);
                 popup.set_query(&query);
-                self.active_popup = ActivePopup::Skill(popup);
+                self.popups.active = ActivePopup::Skill(popup);
             }
         }
     }
 
     fn sync_mentions_v2_popup(&mut self, query: String) {
-        if self.dismissed_mention_popup_token.as_ref() == Some(&query) {
+        if self.popups.dismissed_mention_token.as_ref() == Some(&query) {
             return;
         }
 
         if query.is_empty() {
             self.app_event_tx
                 .send(AppEvent::StartFileSearch(String::new()));
-            self.current_file_query = None;
+            self.popups.current_file_query = None;
         } else {
             self.app_event_tx
                 .send(AppEvent::StartFileSearch(query.clone()));
-            self.current_file_query = Some(query.clone());
+            self.popups.current_file_query = Some(query.clone());
         }
 
         let candidates = super::mentions_v2::build_search_catalog(
@@ -4170,7 +3984,7 @@ impl ChatComposer {
             self.plugins.as_deref(),
         );
 
-        match &mut self.active_popup {
+        match &mut self.popups.active {
             ActivePopup::MentionV2(popup) => {
                 popup.set_query(&query);
                 popup.set_candidates(candidates);
@@ -4178,11 +3992,11 @@ impl ChatComposer {
             _ => {
                 let mut popup = MentionV2Popup::new(candidates);
                 popup.set_query(&query);
-                self.active_popup = ActivePopup::MentionV2(popup);
+                self.popups.active = ActivePopup::MentionV2(popup);
             }
         }
 
-        self.dismissed_mention_popup_token = None;
+        self.popups.dismissed_mention_token = None;
     }
 
     fn mention_items(&self) -> Vec<MentionItem> {
@@ -4307,66 +4121,76 @@ impl ChatComposer {
 
     #[allow(dead_code)]
     pub(crate) fn set_input_enabled(&mut self, enabled: bool, placeholder: Option<String>) {
-        self.input_enabled = enabled;
-        self.input_disabled_placeholder = if enabled { None } else { placeholder };
+        self.draft.input_enabled = enabled;
+        self.draft.input_disabled_placeholder = if enabled { None } else { placeholder };
 
         // Avoid leaving interactive popups open while input is blocked.
-        if !enabled && !matches!(self.active_popup, ActivePopup::None) {
-            self.active_popup = ActivePopup::None;
+        if !enabled && self.popups.active() {
+            self.popups.active = ActivePopup::None;
         }
     }
 
+    pub(crate) fn show_shutdown_in_progress(&mut self) {
+        self.set_input_enabled(/*enabled*/ false, Some("Shutting down...".to_string()));
+        self.footer.quit_shortcut_expires_at = None;
+        self.footer.mode = FooterMode::ComposerEmpty;
+        self.footer.hint_override = Some(Vec::new());
+        self.footer.plan_mode_nudge_visible = false;
+        self.footer.flash = None;
+    }
+
     pub fn set_task_running(&mut self, running: bool) {
         self.is_task_running = running;
     }
 
     pub(crate) fn set_context_window(&mut self, percent: Option<i64>, used_tokens: Option<i64>) {
-        if self.context_window_percent == percent && self.context_window_used_tokens == used_tokens
+        if self.footer.context_window_percent == percent
+            && self.footer.context_window_used_tokens == used_tokens
         {
             return;
         }
-        self.context_window_percent = percent;
-        self.context_window_used_tokens = used_tokens;
+        self.footer.context_window_percent = percent;
+        self.footer.context_window_used_tokens = used_tokens;
     }
 
     pub(crate) fn set_esc_backtrack_hint(&mut self, show: bool) {
-        self.esc_backtrack_hint = show;
+        self.footer.esc_backtrack_hint = show;
         if show {
-            self.footer_mode = esc_hint_mode(self.footer_mode, self.is_task_running);
+            self.footer.mode = esc_hint_mode(self.footer.mode, self.is_task_running);
         } else {
-            self.footer_mode = reset_mode_after_activity(self.footer_mode);
+            self.footer.mode = reset_mode_after_activity(self.footer.mode);
         }
     }
 
     pub(crate) fn set_status_line(&mut self, status_line: Option<Line<'static>>) -> bool {
-        if self.status_line_value == status_line {
+        if self.footer.status_line_value == status_line {
             return false;
         }
-        self.status_line_value = status_line;
+        self.footer.status_line_value = status_line;
         true
     }
 
     pub(crate) fn set_status_line_hyperlink(&mut self, url: Option<String>) -> bool {
-        if self.status_line_hyperlink_url == url {
+        if self.footer.status_line_hyperlink_url == url {
             return false;
         }
-        self.status_line_hyperlink_url = url;
+        self.footer.status_line_hyperlink_url = url;
         true
     }
 
     pub(crate) fn set_status_line_enabled(&mut self, enabled: bool) -> bool {
-        if self.status_line_enabled == enabled {
+        if self.footer.status_line_enabled == enabled {
             return false;
         }
-        self.status_line_enabled = enabled;
+        self.footer.status_line_enabled = enabled;
         true
     }
 
     pub(crate) fn set_side_conversation_context_label(&mut self, label: Option<String>) -> bool {
-        if self.side_conversation_context_label == label {
+        if self.footer.side_conversation_context_label == label {
             return false;
         }
-        self.side_conversation_context_label = label;
+        self.footer.side_conversation_context_label = label;
         true
     }
 
@@ -4376,10 +4200,10 @@ impl ChatComposer {
     /// field is intentionally just cached presentation state; `ChatComposer` does not infer which
     /// thread is active on its own.
     pub(crate) fn set_active_agent_label(&mut self, active_agent_label: Option<String>) -> bool {
-        if self.active_agent_label == active_agent_label {
+        if self.footer.active_agent_label == active_agent_label {
             return false;
         }
-        self.active_agent_label = active_agent_label;
+        self.footer.active_agent_label = active_agent_label;
         true
     }
 }
@@ -4404,17 +4228,17 @@ fn footer_insert_newline_key(
 #[cfg(not(target_os = "linux"))]
 impl ChatComposer {
     pub fn update_recording_meter_in_place(&mut self, id: &str, text: &str) -> bool {
-        self.textarea.update_named_element_by_id(id, text)
+        self.draft.textarea.update_named_element_by_id(id, text)
     }
 
     pub fn insert_recording_meter_placeholder(&mut self, text: &str) -> String {
         let id = self.next_id();
-        self.textarea.insert_named_element(text, id.clone());
+        self.draft.textarea.insert_named_element(text, id.clone());
         id
     }
 
     pub fn remove_recording_meter_placeholder(&mut self, id: &str) {
-        let _ = self.textarea.replace_element_by_id(id, "");
+        let _ = self.draft.textarea.replace_element_by_id(id, "");
     }
 }
 
@@ -4475,7 +4299,7 @@ impl Renderable for ChatComposer {
     }
 
     fn cursor_style(&self, _area: Rect) -> crossterm::cursor::SetCursorStyle {
-        if self.textarea.uses_vim_insert_cursor() {
+        if self.draft.textarea.uses_vim_insert_cursor() {
             crossterm::cursor::SetCursorStyle::SteadyBar
         } else {
             crossterm::cursor::SetCursorStyle::DefaultUserShape
@@ -4507,16 +4331,17 @@ impl ChatComposer {
         let inner_width =
             width.saturating_sub(COLS_WITH_MARGIN.saturating_add(textarea_right_reserve));
         let remote_images_height: u16 = self
-            .remote_images_lines(inner_width)
+            .attachments
+            .remote_image_lines()
             .len()
             .try_into()
             .unwrap_or(u16::MAX);
         let remote_images_separator = u16::from(remote_images_height > 0);
-        self.textarea.desired_height(inner_width)
+        self.draft.textarea.desired_height(inner_width)
             + remote_images_height
             + remote_images_separator
             + 2
-            + match &self.active_popup {
+            + match &self.popups.active {
                 ActivePopup::None => footer_total_height,
                 ActivePopup::Command(c) => c.calculate_required_height(width),
                 ActivePopup::File(c) => c.calculate_required_height(),
@@ -4542,7 +4367,7 @@ impl ChatComposer {
     ) {
         let [composer_rect, remote_images_rect, textarea_rect, popup_rect] =
             self.layout_areas_with_textarea_right_reserve(area, textarea_right_reserve);
-        match &self.active_popup {
+        match &self.popups.active {
             ActivePopup::Command(popup) => {
                 popup.render_ref(popup_rect, buf);
             }
@@ -4557,8 +4382,8 @@ impl ChatComposer {
             }
             ActivePopup::None => {
                 let footer_props = self.footer_props();
-                let show_cycle_hint =
-                    !footer_props.is_task_running && self.collaboration_mode_indicator.is_some();
+                let show_cycle_hint = !footer_props.is_task_running
+                    && self.footer.collaboration_mode_indicator.is_some();
                 let show_shortcuts_hint = match footer_props.mode {
                     FooterMode::ComposerEmpty => !self.is_in_paste_burst(),
                     FooterMode::ComposerHasDraft => false,
@@ -4591,7 +4416,7 @@ impl ChatComposer {
                 };
                 if let Some(line) = self.history_search_footer_line() {
                     render_footer_line(hint_rect, buf, line);
-                } else if self.plan_mode_nudge_visible {
+                } else if self.footer.plan_mode_nudge_visible {
                     let available_width =
                         hint_rect.width.saturating_sub(FOOTER_INDENT_COLS as u16) as usize;
                     render_footer_line(
@@ -4621,11 +4446,12 @@ impl ChatComposer {
                     let left_mode_indicator = if status_line_active {
                         None
                     } else {
-                        self.collaboration_mode_indicator
+                        self.footer.collaboration_mode_indicator
                     };
-                    let active_footer_hint_override = self.footer_hint_override.as_ref();
-                    let mut left_width = if self.footer_flash_visible() {
-                        self.footer_flash
+                    let active_footer_hint_override = self.footer.hint_override.as_ref();
+                    let mut left_width = if self.footer.flash_visible() {
+                        self.footer
+                            .flash
                             .as_ref()
                             .map(|flash| flash.line.width() as u16)
                             .unwrap_or(0)
@@ -4646,7 +4472,7 @@ impl ChatComposer {
                         )
                     };
                     let right_line =
-                        if let Some(label) = self.side_conversation_context_label.as_ref() {
+                        if let Some(label) = self.footer.side_conversation_context_label.as_ref() {
                             Some(side_conversation_context_line(label))
                         } else if let Some(line) = self.shell_mode_footer_line() {
                             Some(line)
@@ -4676,7 +4502,7 @@ impl ChatComposer {
                     let can_show_left_and_context =
                         can_show_left_with_context(hint_rect, left_width, right_width);
                     let has_override =
-                        self.footer_flash_visible() || active_footer_hint_override.is_some();
+                        self.footer.flash_visible() || active_footer_hint_override.is_some();
                     let single_line_layout = if has_override || status_line_active {
                         None
                     } else {
@@ -4751,8 +4577,8 @@ impl ChatComposer {
                             }
                             SummaryLeft::None => {}
                         }
-                    } else if self.footer_flash_visible() {
-                        if let Some(flash) = self.footer_flash.as_ref() {
+                    } else if self.footer.flash_visible() {
+                        if let Some(flash) = self.footer.flash.as_ref() {
                             flash.line.render(inset_footer_hint_area(hint_rect), buf);
                         }
                     } else if let Some(items) = active_footer_hint_override {
@@ -4766,7 +4592,7 @@ impl ChatComposer {
                             hint_rect,
                             buf,
                             &footer_props,
-                            self.collaboration_mode_indicator,
+                            self.footer.collaboration_mode_indicator,
                             show_cycle_hint,
                             show_shortcuts_hint,
                             show_queue_hint,
@@ -4776,7 +4602,7 @@ impl ChatComposer {
                         render_context_right(hint_rect, buf, line);
                     }
                     if status_line_active
-                        && let Some(url) = self.status_line_hyperlink_url.as_deref()
+                        && let Some(url) = self.footer.status_line_hyperlink_url.as_deref()
                     {
                         mark_underlined_hyperlink(buf, hint_rect, url);
                     }
@@ -4786,13 +4612,13 @@ impl ChatComposer {
         let style = user_message_style();
         Block::default().style(style).render_ref(composer_rect, buf);
         if !remote_images_rect.is_empty() {
-            Paragraph::new(self.remote_images_lines(remote_images_rect.width))
+            Paragraph::new(self.attachments.remote_image_lines())
                 .style(style)
                 .render_ref(remote_images_rect, buf);
         }
         if !textarea_rect.is_empty() {
-            let prompt = if self.input_enabled {
-                if self.is_bash_mode {
+            let prompt = if self.draft.input_enabled {
+                if self.draft.is_bash_mode {
                     Span::from("!").light_red().bold()
                 } else {
                     "›".bold()
@@ -4808,36 +4634,45 @@ impl ChatComposer {
             );
         }
 
-        let mut state = self.textarea_state.borrow_mut();
-        let textarea_is_empty = self.textarea.text().is_empty() && !self.is_bash_mode;
-        if let Some(mask_char) = mask_char {
-            self.textarea
-                .render_ref_masked(textarea_rect, buf, &mut state, mask_char);
-        } else {
-            let highlight_ranges = self.history_search_highlight_ranges();
-            if highlight_ranges.is_empty() {
-                StatefulWidgetRef::render_ref(&(&self.textarea), textarea_rect, buf, &mut state);
+        let mut state = self.draft.textarea_state.borrow_mut();
+        let textarea_is_empty = self.draft.textarea.text().is_empty() && !self.draft.is_bash_mode;
+        if self.draft.input_enabled {
+            if let Some(mask_char) = mask_char {
+                self.draft
+                    .textarea
+                    .render_ref_masked(textarea_rect, buf, &mut state, mask_char);
             } else {
-                let highlight_style =
-                    Style::default().add_modifier(Modifier::REVERSED | Modifier::BOLD);
-                let highlights = highlight_ranges
-                    .into_iter()
-                    .map(|range| (range, highlight_style))
-                    .collect::<Vec<_>>();
-                self.textarea.render_ref_styled_with_highlights(
-                    textarea_rect,
-                    buf,
-                    &mut state,
-                    Style::default(),
-                    &highlights,
-                );
+                let highlight_ranges = self.history_search_highlight_ranges();
+                if highlight_ranges.is_empty() {
+                    StatefulWidgetRef::render_ref(
+                        &(&self.draft.textarea),
+                        textarea_rect,
+                        buf,
+                        &mut state,
+                    );
+                } else {
+                    let highlight_style =
+                        Style::default().add_modifier(Modifier::REVERSED | Modifier::BOLD);
+                    let highlights = highlight_ranges
+                        .into_iter()
+                        .map(|range| (range, highlight_style))
+                        .collect::<Vec<_>>();
+                    self.draft.textarea.render_ref_styled_with_highlights(
+                        textarea_rect,
+                        buf,
+                        &mut state,
+                        Style::default(),
+                        &highlights,
+                    );
+                }
             }
         }
-        if textarea_is_empty {
-            let text = if self.input_enabled {
+        if !self.draft.input_enabled || textarea_is_empty {
+            let text = if self.draft.input_enabled {
                 self.placeholder_text.as_str().to_string()
             } else {
-                self.input_disabled_placeholder
+                self.draft
+                    .input_disabled_placeholder
                     .as_deref()
                     .unwrap_or("Input disabled.")
                     .to_string()
@@ -4853,6 +4688,7 @@ impl ChatComposer {
 
 #[cfg(test)]
 mod tests {
+    use super::attachment_state::AttachedImage;
     use super::*;
     use crate::test_support::PathBufExt;
     use crate::test_support::test_path_buf;
@@ -4867,9 +4703,9 @@ mod tests {
     use crate::bottom_pane::AppEventSender;
     use crate::bottom_pane::ChatComposer;
     use crate::bottom_pane::InputResult;
-    use crate::bottom_pane::chat_composer::AttachedImage;
     use crate::bottom_pane::chat_composer::LARGE_PASTE_CHAR_THRESHOLD;
     use crate::bottom_pane::textarea::TextArea;
+    use codex_protocol::models::local_image_label_text;
     use tokio::sync::mpsc::unbounded_channel;
 
     #[test]
@@ -4980,8 +4816,8 @@ mod tests {
         let id = composer.insert_recording_meter_placeholder("⠤⠤⠤⠤");
         composer.remove_recording_meter_placeholder(&id);
 
-        assert_eq!(composer.textarea.text(), "");
-        assert!(composer.textarea.named_element_range(&id).is_none());
+        assert_eq!(composer.draft.textarea.text(), "");
+        assert!(composer.draft.textarea.named_element_range(&id).is_none());
     }
 
     #[test]
@@ -4997,7 +4833,7 @@ mod tests {
         );
         composer.set_footer_hint_override(Some(vec![("K".to_string(), "label".to_string())]));
         composer.show_footer_flash(Line::from("FLASH"), Duration::from_secs(10));
-        composer.footer_flash.as_mut().unwrap().expires_at =
+        composer.footer.flash.as_mut().unwrap().expires_at =
             Instant::now() - Duration::from_secs(1);
 
         let area = Rect::new(0, 0, 60, 6);
@@ -5306,7 +5142,7 @@ mod tests {
         );
 
         type_chars_humanlike(&mut composer, &['!']);
-        assert!(composer.is_bash_mode);
+        assert!(composer.draft.is_bash_mode);
         assert_eq!(composer.current_text(), "!");
 
         let (result, needs_redraw) =
@@ -5314,7 +5150,7 @@ mod tests {
 
         assert!(matches!(result, InputResult::None));
         assert!(needs_redraw);
-        assert!(!composer.is_bash_mode);
+        assert!(!composer.draft.is_bash_mode);
         assert_eq!(composer.current_text(), "");
     }
 
@@ -5344,7 +5180,7 @@ mod tests {
 
         assert!(matches!(result, InputResult::None));
         assert!(needs_redraw);
-        assert!(composer.is_bash_mode);
+        assert!(composer.draft.is_bash_mode);
         assert_eq!(composer.current_text(), "!g");
     }
 
@@ -5607,13 +5443,13 @@ mod tests {
 
         assert!(!composer.is_empty());
         assert_eq!(composer.current_text(), "d");
-        assert_eq!(composer.footer_mode, FooterMode::ComposerEmpty);
-        assert!(matches!(composer.active_popup, ActivePopup::None));
+        assert_eq!(composer.footer.mode, FooterMode::ComposerEmpty);
+        assert!(matches!(composer.popups.active, ActivePopup::None));
 
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Esc, KeyModifiers::NONE));
 
-        assert_eq!(composer.footer_mode, FooterMode::ComposerEmpty);
-        assert!(!composer.esc_backtrack_hint);
+        assert_eq!(composer.footer.mode, FooterMode::ComposerEmpty);
+        assert!(!composer.footer.esc_backtrack_hint);
     }
 
     #[test]
@@ -5650,8 +5486,8 @@ mod tests {
             composer.vim_mode_indicator_span(),
             Some("Vim: Normal".magenta())
         );
-        assert_eq!(composer.footer_mode, FooterMode::ComposerEmpty);
-        assert!(!composer.esc_backtrack_hint);
+        assert_eq!(composer.footer.mode, FooterMode::ComposerEmpty);
+        assert!(!composer.footer.esc_backtrack_hint);
     }
 
     #[test]
@@ -5676,9 +5512,9 @@ mod tests {
 
         assert!(matches!(result, InputResult::None));
         assert!(needs_redraw);
-        assert_eq!(composer.textarea.text(), "/");
-        assert_eq!(composer.textarea.cursor(), "/".len());
-        assert!(matches!(composer.active_popup, ActivePopup::Command(_)));
+        assert_eq!(composer.draft.textarea.text(), "/");
+        assert_eq!(composer.draft.textarea.cursor(), "/".len());
+        assert!(matches!(composer.popups.active, ActivePopup::Command(_)));
         assert_eq!(
             composer.vim_mode_indicator_span(),
             Some("Vim: Insert".green())
@@ -5705,8 +5541,8 @@ mod tests {
         for ch in ['/', 'd', 'i', 'f', 'f'] {
             let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Char(ch), KeyModifiers::NONE));
         }
-        assert_eq!(composer.textarea.text(), "/diff");
-        assert!(matches!(composer.active_popup, ActivePopup::Command(_)));
+        assert_eq!(composer.draft.textarea.text(), "/diff");
+        assert!(matches!(composer.popups.active, ActivePopup::Command(_)));
 
         let (result, needs_redraw) =
             composer.handle_key_event(KeyEvent::new(KeyCode::Enter, KeyModifiers::NONE));
@@ -5740,7 +5576,7 @@ mod tests {
 
         composer.handle_key_event(KeyEvent::new(KeyCode::Char('i'), KeyModifiers::NONE));
         composer.set_text_content("/plan investigate this".to_string(), Vec::new(), Vec::new());
-        composer.active_popup = ActivePopup::None;
+        composer.popups.active = ActivePopup::None;
         let (result, needs_redraw) =
             composer.handle_key_event(KeyEvent::new(KeyCode::Enter, KeyModifiers::NONE));
 
@@ -5781,9 +5617,9 @@ mod tests {
 
         assert!(matches!(result, InputResult::None));
         assert!(needs_redraw);
-        assert!(composer.is_bash_mode);
+        assert!(composer.draft.is_bash_mode);
         assert_eq!(composer.current_text(), "!");
-        assert_eq!(composer.textarea.text(), "");
+        assert_eq!(composer.draft.textarea.text(), "");
         assert_eq!(
             composer.vim_mode_indicator_span(),
             Some("Vim: Insert".green())
@@ -5811,10 +5647,10 @@ mod tests {
             let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Char(ch), KeyModifiers::NONE));
         }
 
-        assert!(composer.is_bash_mode);
+        assert!(composer.draft.is_bash_mode);
         assert_eq!(composer.current_text(), "!echo");
-        assert_eq!(composer.textarea.text(), "echo");
-        assert!(matches!(composer.active_popup, ActivePopup::None));
+        assert_eq!(composer.draft.textarea.text(), "echo");
+        assert!(matches!(composer.popups.active, ActivePopup::None));
     }
 
     #[test]
@@ -5834,7 +5670,7 @@ mod tests {
         type_chars_humanlike(&mut composer, &['d']);
         composer
             .show_quit_shortcut_hint(key_hint::ctrl(KeyCode::Char('c')), /*has_focus*/ true);
-        composer.quit_shortcut_expires_at =
+        composer.footer.quit_shortcut_expires_at =
             Some(Instant::now() - std::time::Duration::from_secs(1));
 
         assert_eq!(composer.footer_mode(), FooterMode::ComposerHasDraft);
@@ -5885,9 +5721,9 @@ mod tests {
         composer.handle_paste(large.clone());
         let char_count = large.chars().count();
         let placeholder = format!("[Pasted Content {char_count} chars]");
-        assert_eq!(composer.textarea.text(), placeholder);
+        assert_eq!(composer.draft.textarea.text(), placeholder);
         assert_eq!(
-            composer.pending_pastes,
+            composer.draft.pending_pastes,
             vec![(placeholder.clone(), large.clone())]
         );
 
@@ -5913,9 +5749,15 @@ mod tests {
         );
 
         composer.apply_history_entry(history_entry);
-        assert_eq!(composer.textarea.text(), placeholder);
-        assert_eq!(composer.pending_pastes, vec![(placeholder.clone(), large)]);
-        assert_eq!(composer.textarea.element_payloads(), vec![placeholder]);
+        assert_eq!(composer.draft.textarea.text(), placeholder);
+        assert_eq!(
+            composer.draft.pending_pastes,
+            vec![(placeholder.clone(), large)]
+        );
+        assert_eq!(
+            composer.draft.textarea.element_payloads(),
+            vec![placeholder]
+        );
 
         let (result, _needs_redraw) =
             composer.handle_key_event(KeyEvent::new(KeyCode::Enter, KeyModifiers::NONE));
@@ -5947,17 +5789,17 @@ mod tests {
         let base = format!("[Pasted Content {} chars]", paste.chars().count());
 
         composer.handle_paste(paste.clone());
-        assert_eq!(composer.textarea.text(), base);
-        assert_eq!(composer.pending_pastes.len(), 1);
+        assert_eq!(composer.draft.textarea.text(), base);
+        assert_eq!(composer.draft.pending_pastes.len(), 1);
 
         assert_eq!(composer.clear_for_ctrl_c(), Some(base.clone()));
-        assert!(composer.textarea.text().is_empty());
-        assert!(composer.pending_pastes.is_empty());
+        assert!(composer.draft.textarea.text().is_empty());
+        assert!(composer.draft.pending_pastes.is_empty());
 
         composer.handle_paste(paste);
-        assert_eq!(composer.textarea.text(), base);
-        assert_eq!(composer.pending_pastes.len(), 1);
-        assert_eq!(composer.pending_pastes[0].0, base);
+        assert_eq!(composer.draft.textarea.text(), base);
+        assert_eq!(composer.draft.pending_pastes.len(), 1);
+        assert_eq!(composer.draft.pending_pastes[0].0, base);
     }
 
     #[test]
@@ -5978,7 +5820,7 @@ mod tests {
         composer.set_steer_enabled(/*enabled*/ true);
         composer.set_vim_enabled(/*enabled*/ true);
 
-        assert!(composer.textarea.is_vim_enabled());
+        assert!(composer.draft.textarea.is_vim_enabled());
         assert_eq!(
             composer.vim_mode_indicator_span(),
             Some("Vim: Normal".magenta())
@@ -5989,7 +5831,7 @@ mod tests {
         let (result, _) =
             composer.handle_key_event(KeyEvent::new(KeyCode::Enter, KeyModifiers::NONE));
 
-        assert!(composer.textarea.is_vim_enabled());
+        assert!(composer.draft.textarea.is_vim_enabled());
         assert_eq!(
             composer.vim_mode_indicator_span(),
             Some("Vim: Normal".magenta())
@@ -6059,7 +5901,7 @@ mod tests {
             composer.handle_key_event(KeyEvent::new(KeyCode::Enter, KeyModifiers::NONE));
 
         assert!(matches!(result, InputResult::None));
-        assert_eq!(composer.textarea.text(), "/not-a-command");
+        assert_eq!(composer.draft.textarea.text(), "/not-a-command");
         assert_eq!(
             composer.vim_mode_indicator_span(),
             Some("Vim: Insert".green())
@@ -6085,19 +5927,22 @@ mod tests {
 
         composer.handle_key_event(KeyEvent::new(KeyCode::Char('i'), KeyModifiers::NONE));
         composer.set_text_content("hey".to_string(), Vec::new(), Vec::new());
-        composer.textarea.set_cursor(composer.textarea.text().len());
+        composer
+            .draft
+            .textarea
+            .set_cursor(composer.draft.textarea.text().len());
         assert_eq!(
             composer.vim_mode_indicator_span(),
             Some("Vim: Insert".green())
         );
-        assert_eq!(composer.textarea.cursor(), "hey".len());
+        assert_eq!(composer.draft.textarea.cursor(), "hey".len());
 
         composer.handle_key_event(KeyEvent::new(KeyCode::Esc, KeyModifiers::NONE));
         assert_eq!(
             composer.vim_mode_indicator_span(),
             Some("Vim: Normal".magenta())
         );
-        assert_eq!(composer.textarea.cursor(), "he".len());
+        assert_eq!(composer.draft.textarea.cursor(), "he".len());
     }
 
     #[test]
@@ -6178,9 +6023,12 @@ mod tests {
         );
 
         composer.apply_history_entry(history_entry);
-        assert_eq!(composer.textarea.text(), placeholder);
+        assert_eq!(composer.draft.textarea.text(), placeholder);
         assert_eq!(composer.local_image_paths(), vec![path]);
-        assert_eq!(composer.textarea.element_payloads(), vec![placeholder]);
+        assert_eq!(
+            composer.draft.textarea.element_payloads(),
+            vec![placeholder]
+        );
     }
 
     #[test]
@@ -6284,14 +6132,14 @@ mod tests {
             composer.handle_key_event(KeyEvent::new(KeyCode::Char('?'), KeyModifiers::NONE));
         assert_eq!(result, InputResult::None);
         assert!(needs_redraw, "toggling overlay should request redraw");
-        assert_eq!(composer.footer_mode, FooterMode::ShortcutOverlay);
+        assert_eq!(composer.footer.mode, FooterMode::ShortcutOverlay);
 
         // Toggle back to prompt mode so subsequent typing captures characters.
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Char('?'), KeyModifiers::NONE));
-        assert_eq!(composer.footer_mode, FooterMode::ComposerEmpty);
+        assert_eq!(composer.footer.mode, FooterMode::ComposerEmpty);
 
         type_chars_humanlike(&mut composer, &['h']);
-        assert_eq!(composer.textarea.text(), "h");
+        assert_eq!(composer.draft.textarea.text(), "h");
         assert_eq!(composer.footer_mode(), FooterMode::ComposerHasDraft);
 
         let (result, needs_redraw) =
@@ -6299,8 +6147,8 @@ mod tests {
         assert_eq!(result, InputResult::None);
         assert!(needs_redraw, "typing should still mark the view dirty");
         let _ = flush_after_paste_burst(&mut composer);
-        assert_eq!(composer.textarea.text(), "h?");
-        assert_eq!(composer.footer_mode, FooterMode::ComposerEmpty);
+        assert_eq!(composer.draft.textarea.text(), "h?");
+        assert_eq!(composer.footer.mode, FooterMode::ComposerEmpty);
         assert_eq!(composer.footer_mode(), FooterMode::ComposerHasDraft);
     }
 
@@ -6325,7 +6173,7 @@ mod tests {
             composer.handle_key_event(KeyEvent::new(KeyCode::Char('?'), KeyModifiers::SHIFT));
         assert_eq!(result, InputResult::None);
         assert!(needs_redraw, "toggling overlay should request redraw");
-        assert_eq!(composer.footer_mode, FooterMode::ShortcutOverlay);
+        assert_eq!(composer.footer.mode, FooterMode::ShortcutOverlay);
     }
 
     /// Behavior: while a paste-like burst is being captured, `?` must not toggle the shortcut
@@ -6348,6 +6196,7 @@ mod tests {
 
         // Force an active paste burst so this test doesn't depend on tight timing.
         composer
+            .draft
             .paste_burst
             .begin_with_retro_grabbed(String::new(), Instant::now());
 
@@ -6355,12 +6204,12 @@ mod tests {
             let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Char(ch), KeyModifiers::NONE));
         }
         assert!(composer.is_in_paste_burst());
-        assert_eq!(composer.textarea.text(), "");
+        assert_eq!(composer.draft.textarea.text(), "");
 
         let _ = flush_after_paste_burst(&mut composer);
 
-        assert_eq!(composer.textarea.text(), "hi?there");
-        assert_ne!(composer.footer_mode, FooterMode::ShortcutOverlay);
+        assert_eq!(composer.draft.textarea.text(), "hi?there");
+        assert_ne!(composer.footer.mode, FooterMode::ShortcutOverlay);
     }
 
     #[test]
@@ -6376,7 +6225,7 @@ mod tests {
         );
         composer.set_connectors_enabled(/*enabled*/ true);
         composer.set_text_content("$".to_string(), Vec::new(), Vec::new());
-        assert!(matches!(composer.active_popup, ActivePopup::None));
+        assert!(matches!(composer.popups.active, ActivePopup::None));
 
         let connectors = vec![AppInfo {
             id: "connector_1".to_string(),
@@ -6395,7 +6244,7 @@ mod tests {
         }];
         composer.set_connector_mentions(Some(ConnectorsSnapshot { connectors }));
 
-        let ActivePopup::Skill(popup) = &composer.active_popup else {
+        let ActivePopup::Skill(popup) = &composer.popups.active else {
             panic!("expected mention popup to open after connectors update");
         };
         let mention = popup
@@ -6418,7 +6267,7 @@ mod tests {
         );
         composer.set_connectors_enabled(/*enabled*/ true);
         composer.set_text_content("$".to_string(), Vec::new(), Vec::new());
-        assert!(matches!(composer.active_popup, ActivePopup::None));
+        assert!(matches!(composer.popups.active, ActivePopup::None));
 
         let connectors = vec![AppInfo {
             id: "connector_1".to_string(),
@@ -6438,7 +6287,7 @@ mod tests {
         composer.set_connector_mentions(Some(ConnectorsSnapshot { connectors }));
 
         assert!(
-            matches!(composer.active_popup, ActivePopup::None),
+            matches!(composer.popups.active, ActivePopup::None),
             "disabled connectors should not appear in the mention popup"
         );
     }
@@ -6455,7 +6304,7 @@ mod tests {
             /*disable_paste_burst*/ false,
         );
         composer.set_text_content("$".to_string(), Vec::new(), Vec::new());
-        assert!(matches!(composer.active_popup, ActivePopup::None));
+        assert!(matches!(composer.popups.active, ActivePopup::None));
 
         composer.set_plugin_mentions(Some(vec![PluginCapabilitySummary {
             config_name: "sample@test".to_string(),
@@ -6466,7 +6315,7 @@ mod tests {
             app_connector_ids: Vec::new(),
         }]));
 
-        let ActivePopup::Skill(popup) = &composer.active_popup else {
+        let ActivePopup::Skill(popup) = &composer.popups.active else {
             panic!("expected mention popup to open after plugin update");
         };
         let mention = popup
@@ -6488,7 +6337,7 @@ mod tests {
             /*disable_paste_burst*/ false,
         );
         composer.set_text_content("$".to_string(), Vec::new(), Vec::new());
-        assert!(matches!(composer.active_popup, ActivePopup::None));
+        assert!(matches!(composer.popups.active, ActivePopup::None));
 
         let skill_path = test_path_buf("/tmp/skill/SKILL.md").abs();
         composer.set_skill_mentions(Some(vec![SkillMetadata {
@@ -6503,7 +6352,7 @@ mod tests {
             plugin_id: None,
         }]));
 
-        let ActivePopup::Skill(popup) = &composer.active_popup else {
+        let ActivePopup::Skill(popup) = &composer.popups.active else {
             panic!("expected mention popup to open after skills update");
         };
         let mention = popup
@@ -6700,7 +6549,7 @@ mod tests {
         }];
         composer.set_connector_mentions(Some(ConnectorsSnapshot { connectors }));
 
-        assert!(matches!(composer.active_popup, ActivePopup::None));
+        assert!(matches!(composer.popups.active, ActivePopup::None));
     }
 
     #[test]
@@ -6720,11 +6569,11 @@ mod tests {
         );
 
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Char('?'), KeyModifiers::NONE));
-        assert_eq!(composer.footer_mode, FooterMode::ShortcutOverlay);
+        assert_eq!(composer.footer.mode, FooterMode::ShortcutOverlay);
 
         composer.set_task_running(/*running*/ true);
 
-        assert_eq!(composer.footer_mode, FooterMode::ShortcutOverlay);
+        assert_eq!(composer.footer.mode, FooterMode::ShortcutOverlay);
         assert_eq!(composer.footer_mode(), FooterMode::ShortcutOverlay);
     }
 
@@ -6970,11 +6819,11 @@ mod tests {
         );
 
         let input = "npx -y @kaeawc/auto-mobile@latest";
-        composer.textarea.insert_str(input);
-        composer.textarea.set_cursor(input.len());
+        composer.draft.textarea.insert_str(input);
+        composer.draft.textarea.set_cursor(input.len());
         composer.sync_popups();
 
-        assert!(matches!(composer.active_popup, ActivePopup::File(_)));
+        assert!(matches!(composer.popups.active, ActivePopup::File(_)));
 
         let (result, consumed) =
             composer.handle_key_event(KeyEvent::new(KeyCode::Enter, KeyModifiers::NONE));
@@ -7037,7 +6886,7 @@ mod tests {
 
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Char('あ'), KeyModifiers::NONE));
 
-        assert_eq!(composer.textarea.text(), "あ");
+        assert_eq!(composer.draft.textarea.text(), "あ");
         assert!(!composer.is_in_paste_burst());
     }
 
@@ -7060,6 +6909,7 @@ mod tests {
         );
 
         composer
+            .draft
             .paste_burst
             .begin_with_retro_grabbed(String::new(), Instant::now());
 
@@ -7069,9 +6919,9 @@ mod tests {
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Char('h'), KeyModifiers::NONE));
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Char('i'), KeyModifiers::NONE));
 
-        assert!(composer.textarea.text().is_empty());
+        assert!(composer.draft.textarea.text().is_empty());
         let _ = flush_after_paste_burst(&mut composer);
-        assert_eq!(composer.textarea.text(), "你好\nhi");
+        assert_eq!(composer.draft.textarea.text(), "你好\nhi");
     }
 
     /// Behavior: a paste-like burst may include a full-width/ideographic space (U+3000). It should
@@ -7093,6 +6943,7 @@ mod tests {
         );
 
         composer
+            .draft
             .paste_burst
             .begin_with_retro_grabbed(String::new(), Instant::now());
 
@@ -7104,9 +6955,9 @@ mod tests {
             let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Char(ch), KeyModifiers::NONE));
         }
 
-        assert!(composer.textarea.text().is_empty());
+        assert!(composer.draft.textarea.text().is_empty());
         let _ = flush_after_paste_burst(&mut composer);
-        assert_eq!(composer.textarea.text(), "你　好\nhi");
+        assert_eq!(composer.draft.textarea.text(), "你　好\nhi");
     }
 
     /// Behavior: a large multi-line payload containing both non-ASCII and ASCII (e.g. "UTF-8",
@@ -7142,6 +6993,7 @@ mod tests {
 
         // Force an active burst so the test doesn't depend on timing heuristics.
         composer
+            .draft
             .paste_burst
             .begin_with_retro_grabbed(String::new(), Instant::now());
 
@@ -7154,9 +7006,9 @@ mod tests {
             let _ = composer.handle_key_event(KeyEvent::new(code, KeyModifiers::NONE));
         }
 
-        assert!(composer.textarea.text().is_empty());
+        assert!(composer.draft.textarea.text().is_empty());
         let _ = flush_after_paste_burst(&mut composer);
-        assert_eq!(composer.textarea.text(), LARGE_MIXED_PAYLOAD);
+        assert_eq!(composer.draft.textarea.text(), LARGE_MIXED_PAYLOAD);
     }
 
     /// Behavior: while a paste-like burst is active, Enter should not submit; it should insert a
@@ -7205,11 +7057,11 @@ mod tests {
             );
         }
 
-        assert!(composer.textarea.text().is_empty());
+        assert!(composer.draft.textarea.text().is_empty());
         let flush_time = now + PasteBurst::recommended_active_flush_delay() + step;
         let flushed = composer.handle_paste_burst_flush(flush_time);
         assert!(flushed, "expected paste burst to flush");
-        assert_eq!(composer.textarea.text(), "hi\nthere");
+        assert_eq!(composer.draft.textarea.text(), "hi\nthere");
     }
 
     /// Behavior: even if Enter suppression would normally be active for a burst, Enter should
@@ -7231,9 +7083,10 @@ mod tests {
             /*disable_paste_burst*/ false,
         );
 
-        composer.textarea.set_text_clearing_elements("/diff");
-        composer.textarea.set_cursor("/diff".len());
+        composer.draft.textarea.set_text_clearing_elements("/diff");
+        composer.draft.textarea.set_cursor("/diff".len());
         composer
+            .draft
             .paste_burst
             .begin_with_retro_grabbed(String::new(), Instant::now());
 
@@ -7263,17 +7116,18 @@ mod tests {
         // Force an active burst so we can deterministically buffer characters without relying on
         // timing.
         composer
+            .draft
             .paste_burst
             .begin_with_retro_grabbed(String::new(), Instant::now());
 
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Char('h'), KeyModifiers::NONE));
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Char('i'), KeyModifiers::NONE));
-        assert!(composer.textarea.text().is_empty());
+        assert!(composer.draft.textarea.text().is_empty());
         assert!(composer.is_in_paste_burst());
 
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Left, KeyModifiers::NONE));
-        assert_eq!(composer.textarea.text(), "hi");
-        assert_eq!(composer.textarea.cursor(), 1);
+        assert_eq!(composer.draft.textarea.text(), "hi");
+        assert_eq!(composer.draft.textarea.cursor(), 1);
         assert!(!composer.is_in_paste_burst());
     }
 
@@ -7299,14 +7153,14 @@ mod tests {
         // held char is not dropped.
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Char('a'), KeyModifiers::NONE));
         assert!(composer.is_in_paste_burst());
-        assert!(composer.textarea.text().is_empty());
+        assert!(composer.draft.textarea.text().is_empty());
 
         composer.set_disable_paste_burst(/*disabled*/ true);
-        assert_eq!(composer.textarea.text(), "a");
+        assert_eq!(composer.draft.textarea.text(), "a");
         assert!(!composer.is_in_paste_burst());
 
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Char('b'), KeyModifiers::NONE));
-        assert_eq!(composer.textarea.text(), "ab");
+        assert_eq!(composer.draft.textarea.text(), "ab");
         assert!(!composer.is_in_paste_burst());
     }
 
@@ -7330,8 +7184,8 @@ mod tests {
 
         let needs_redraw = composer.handle_paste("hello".to_string());
         assert!(needs_redraw);
-        assert_eq!(composer.textarea.text(), "hello");
-        assert!(composer.pending_pastes.is_empty());
+        assert_eq!(composer.draft.textarea.text(), "hello");
+        assert!(composer.draft.pending_pastes.is_empty());
 
         let (result, _) =
             composer.handle_key_event(KeyEvent::new(KeyCode::Enter, KeyModifiers::NONE));
@@ -7358,7 +7212,7 @@ mod tests {
         );
 
         // Ensure composer is empty and press Enter.
-        assert!(composer.textarea.text().is_empty());
+        assert!(composer.draft.textarea.text().is_empty());
         let (result, _needs_redraw) =
             composer.handle_key_event(KeyEvent::new(KeyCode::Enter, KeyModifiers::NONE));
 
@@ -7390,10 +7244,10 @@ mod tests {
         let needs_redraw = composer.handle_paste(large.clone());
         assert!(needs_redraw);
         let placeholder = format!("[Pasted Content {} chars]", large.chars().count());
-        assert_eq!(composer.textarea.text(), placeholder);
-        assert_eq!(composer.pending_pastes.len(), 1);
-        assert_eq!(composer.pending_pastes[0].0, placeholder);
-        assert_eq!(composer.pending_pastes[0].1, large);
+        assert_eq!(composer.draft.textarea.text(), placeholder);
+        assert_eq!(composer.draft.pending_pastes.len(), 1);
+        assert_eq!(composer.draft.pending_pastes[0].0, placeholder);
+        assert_eq!(composer.draft.pending_pastes[0].1, large);
 
         let (result, _) =
             composer.handle_key_event(KeyEvent::new(KeyCode::Enter, KeyModifiers::NONE));
@@ -7401,7 +7255,7 @@ mod tests {
             InputResult::Submitted { text, .. } => assert_eq!(text, large),
             _ => panic!("expected Submitted"),
         }
-        assert!(composer.pending_pastes.is_empty());
+        assert!(composer.draft.pending_pastes.is_empty());
     }
 
     #[test]
@@ -7421,7 +7275,7 @@ mod tests {
         );
         composer.set_steer_enabled(true);
         let input = "x".repeat(MAX_USER_INPUT_TEXT_CHARS);
-        composer.textarea.set_text_clearing_elements(&input);
+        composer.draft.textarea.set_text_clearing_elements(&input);
 
         let (result, _needs_redraw) =
             composer.handle_key_event(KeyEvent::new(KeyCode::Enter, KeyModifiers::NONE));
@@ -7449,13 +7303,13 @@ mod tests {
         );
         composer.set_steer_enabled(true);
         let input = "x".repeat(MAX_USER_INPUT_TEXT_CHARS + 1);
-        composer.textarea.set_text_clearing_elements(&input);
+        composer.draft.textarea.set_text_clearing_elements(&input);
 
         let (result, _needs_redraw) =
             composer.handle_key_event(KeyEvent::new(KeyCode::Enter, KeyModifiers::NONE));
 
         assert_eq!(InputResult::None, result);
-        assert_eq!(composer.textarea.text(), input);
+        assert_eq!(composer.draft.textarea.text(), input);
 
         let mut found_error = false;
         while let Ok(event) = rx.try_recv() {
@@ -7491,13 +7345,13 @@ mod tests {
         );
         composer.set_steer_enabled(false);
         let input = "x".repeat(MAX_USER_INPUT_TEXT_CHARS + 1);
-        composer.textarea.set_text_clearing_elements(&input);
+        composer.draft.textarea.set_text_clearing_elements(&input);
 
         let (result, _needs_redraw) =
             composer.handle_key_event(KeyEvent::new(KeyCode::Enter, KeyModifiers::NONE));
 
         assert_eq!(InputResult::None, result);
-        assert_eq!(composer.textarea.text(), input);
+        assert_eq!(composer.draft.textarea.text(), input);
 
         let mut found_error = false;
         while let Ok(event) = rx.try_recv() {
@@ -7536,11 +7390,11 @@ mod tests {
         );
 
         composer.handle_paste(large);
-        assert_eq!(composer.pending_pastes.len(), 1);
+        assert_eq!(composer.draft.pending_pastes.len(), 1);
 
         // Any edit that removes the placeholder should clear pending_paste
         composer.handle_key_event(KeyEvent::new(KeyCode::Backspace, KeyModifiers::NONE));
-        assert!(composer.pending_pastes.is_empty());
+        assert!(composer.draft.pending_pastes.is_empty());
     }
 
     #[test]
@@ -7591,7 +7445,10 @@ mod tests {
                 composer.handle_paste("b".repeat(LARGE_PASTE_CHAR_THRESHOLD + 4));
                 composer.handle_paste("c".repeat(LARGE_PASTE_CHAR_THRESHOLD + 6));
                 // Move cursor to end and press backspace
-                composer.textarea.set_cursor(composer.textarea.text().len());
+                composer
+                    .draft
+                    .textarea
+                    .set_cursor(composer.draft.textarea.text().len());
                 composer.handle_key_event(KeyEvent::new(KeyCode::Backspace, KeyModifiers::NONE));
             }
 
@@ -7650,7 +7507,7 @@ mod tests {
                     "https://example.com/two.png".to_string(),
                 ]);
                 composer.set_text_content("describe these".to_string(), Vec::new(), Vec::new());
-                composer.textarea.set_cursor(/*pos*/ 0);
+                composer.draft.textarea.set_cursor(/*pos*/ 0);
                 let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Up, KeyModifiers::NONE));
             },
         );
@@ -7664,7 +7521,7 @@ mod tests {
                     "https://example.com/two.png".to_string(),
                 ]);
                 composer.set_text_content("describe these".to_string(), Vec::new(), Vec::new());
-                composer.textarea.set_cursor(/*pos*/ 0);
+                composer.draft.textarea.set_cursor(/*pos*/ 0);
                 let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Up, KeyModifiers::NONE));
                 let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Up, KeyModifiers::NONE));
                 let _ =
@@ -7718,7 +7575,7 @@ mod tests {
         );
         type_chars_humanlike(&mut composer, &['/', 'm', 'o']);
 
-        match &composer.active_popup {
+        match &composer.popups.active {
             ActivePopup::Command(popup) => match popup.selected_item() {
                 Some(CommandItem::Builtin(cmd)) => {
                     assert_eq!(cmd.command(), "model")
@@ -7774,7 +7631,7 @@ mod tests {
         );
         type_chars_humanlike(&mut composer, &['/', 'r', 'e', 's']);
 
-        match &composer.active_popup {
+        match &composer.popups.active {
             ActivePopup::Command(popup) => match popup.selected_item() {
                 Some(CommandItem::Builtin(cmd)) => {
                     assert_eq!(cmd.command(), "resume")
@@ -7828,7 +7685,7 @@ mod tests {
         );
         type_chars_humanlike(&mut composer, &['/', 'p', 'e', 't']);
 
-        match &composer.active_popup {
+        match &composer.popups.active {
             ActivePopup::Command(popup) => match popup.selected_item() {
                 Some(CommandItem::Builtin(cmd)) => {
                     assert_eq!(cmd.command(), "pets")
@@ -7942,7 +7799,10 @@ mod tests {
             }
             InputResult::None => panic!("expected Command result for '/init'"),
         }
-        assert!(composer.textarea.is_empty(), "composer should be cleared");
+        assert!(
+            composer.draft.textarea.is_empty(),
+            "composer should be cleared"
+        );
     }
 
     #[test]
@@ -7961,22 +7821,22 @@ mod tests {
             /*disable_paste_burst*/ false,
         );
         composer.set_steer_enabled(true);
-        composer.textarea.insert_str("restore me");
-        composer.textarea.set_cursor(/*pos*/ 0);
+        composer.draft.textarea.insert_str("restore me");
+        composer.draft.textarea.set_cursor(/*pos*/ 0);
 
         let (_result, _needs_redraw) =
             composer.handle_key_event(KeyEvent::new(KeyCode::Char('k'), KeyModifiers::CONTROL));
-        assert!(composer.textarea.is_empty());
+        assert!(composer.draft.textarea.is_empty());
 
-        composer.textarea.insert_str("hello");
+        composer.draft.textarea.insert_str("hello");
         let (result, _needs_redraw) =
             composer.handle_key_event(KeyEvent::new(KeyCode::Enter, KeyModifiers::NONE));
         assert!(matches!(result, InputResult::Submitted { .. }));
-        assert!(composer.textarea.is_empty());
+        assert!(composer.draft.textarea.is_empty());
 
         let (_result, _needs_redraw) =
             composer.handle_key_event(KeyEvent::new(KeyCode::Char('y'), KeyModifiers::CONTROL));
-        assert_eq!(composer.textarea.text(), "restore me");
+        assert_eq!(composer.draft.textarea.text(), "restore me");
     }
 
     #[test]
@@ -7994,14 +7854,14 @@ mod tests {
             "Ask Codex to do anything".to_string(),
             /*disable_paste_burst*/ false,
         );
-        composer.textarea.insert_str("restore me");
-        composer.textarea.set_cursor(/*pos*/ 0);
+        composer.draft.textarea.insert_str("restore me");
+        composer.draft.textarea.set_cursor(/*pos*/ 0);
 
         let (_result, _needs_redraw) =
             composer.handle_key_event(KeyEvent::new(KeyCode::Char('k'), KeyModifiers::CONTROL));
-        assert!(composer.textarea.is_empty());
+        assert!(composer.draft.textarea.is_empty());
 
-        composer.textarea.insert_str("/diff");
+        composer.draft.textarea.insert_str("/diff");
         let (result, _needs_redraw) =
             composer.handle_key_event(KeyEvent::new(KeyCode::Enter, KeyModifiers::NONE));
         match result {
@@ -8010,11 +7870,11 @@ mod tests {
             }
             _ => panic!("expected Command result for '/diff'"),
         }
-        assert!(composer.textarea.is_empty());
+        assert!(composer.draft.textarea.is_empty());
 
         let (_result, _needs_redraw) =
             composer.handle_key_event(KeyEvent::new(KeyCode::Char('y'), KeyModifiers::CONTROL));
-        assert_eq!(composer.textarea.text(), "restore me");
+        assert_eq!(composer.draft.textarea.text(), "restore me");
     }
 
     #[test]
@@ -8034,6 +7894,7 @@ mod tests {
         );
         composer.set_task_running(/*running*/ true);
         composer
+            .draft
             .textarea
             .set_text_clearing_elements("/review these changes");
 
@@ -8041,7 +7902,7 @@ mod tests {
             composer.handle_key_event(KeyEvent::new(KeyCode::Enter, KeyModifiers::NONE));
 
         assert_eq!(InputResult::None, result);
-        assert_eq!("/review these changes", composer.textarea.text());
+        assert_eq!("/review these changes", composer.draft.textarea.text());
 
         let mut found_error = false;
         while let Ok(event) = rx.try_recv() {
@@ -8077,7 +7938,7 @@ mod tests {
                 /*disable_paste_burst*/ false,
             );
             composer.set_task_running(/*running*/ true);
-            composer.textarea.set_text_clearing_elements(input);
+            composer.draft.textarea.set_text_clearing_elements(input);
 
             let (result, _needs_redraw) =
                 composer.handle_key_event(KeyEvent::new(KeyCode::Tab, KeyModifiers::NONE));
@@ -8094,7 +7955,7 @@ mod tests {
                 }
                 other => panic!("expected slash-led input to queue, got {other:?}"),
             }
-            assert!(composer.textarea.is_empty());
+            assert!(composer.draft.textarea.is_empty());
             assert!(
                 rx.try_recv().is_err(),
                 "queueing should not report slash errors"
@@ -8125,9 +7986,13 @@ mod tests {
             /*disable_paste_burst*/ false,
         );
         composer
+            .draft
             .textarea
             .set_text_clearing_elements("explain the change");
-        composer.textarea.set_cursor(composer.textarea.text().len());
+        composer
+            .draft
+            .textarea
+            .set_cursor(composer.draft.textarea.text().len());
         let mut keymap = RuntimeKeymap::defaults();
         keymap.composer.submit = vec![key_hint::ctrl(KeyCode::Char('j'))];
         composer.set_keymap_bindings(&keymap);
@@ -8136,7 +8001,7 @@ mod tests {
             composer.handle_key_event(KeyEvent::new(KeyCode::Enter, KeyModifiers::NONE));
 
         assert_eq!(InputResult::None, result);
-        assert_eq!("explain the change\n", composer.textarea.text());
+        assert_eq!("explain the change\n", composer.draft.textarea.text());
     }
 
     #[test]
@@ -8157,7 +8022,10 @@ mod tests {
             /*disable_paste_burst*/ false,
         );
         composer.set_task_running(/*running*/ true);
-        composer.textarea.set_text_clearing_elements("queue me");
+        composer
+            .draft
+            .textarea
+            .set_text_clearing_elements("queue me");
         let mut keymap = RuntimeKeymap::defaults();
         keymap.composer.queue = vec![key_hint::ctrl(KeyCode::Char('q'))];
         composer.set_keymap_bindings(&keymap);
@@ -8166,7 +8034,7 @@ mod tests {
             composer.handle_key_event(KeyEvent::new(KeyCode::Tab, KeyModifiers::NONE));
 
         assert_eq!(InputResult::None, result);
-        assert_eq!("queue me", composer.textarea.text());
+        assert_eq!("queue me", composer.draft.textarea.text());
     }
 
     #[test]
@@ -8214,6 +8082,7 @@ mod tests {
         );
         composer.set_task_running(/*running*/ true);
         composer
+            .draft
             .textarea
             .set_text_clearing_elements(" /does-not-exist");
 
@@ -8246,7 +8115,7 @@ mod tests {
                 /*disable_paste_burst*/ false,
             );
             composer.set_task_running(/*running*/ true);
-            composer.textarea.set_text_clearing_elements(input);
+            composer.draft.textarea.set_text_clearing_elements(input);
 
             let (result, _needs_redraw) =
                 composer.handle_key_event(KeyEvent::new(KeyCode::Tab, KeyModifiers::NONE));
@@ -8263,7 +8132,7 @@ mod tests {
                 }
                 other => panic!("expected bang shell input to queue, got {other:?}"),
             }
-            assert!(composer.textarea.is_empty());
+            assert!(composer.draft.textarea.is_empty());
             assert!(
                 rx.try_recv().is_err(),
                 "queueing should not show shell help immediately"
@@ -8296,8 +8165,11 @@ mod tests {
         let (_result, _needs_redraw) =
             composer.handle_key_event(KeyEvent::new(KeyCode::Tab, KeyModifiers::NONE));
 
-        assert_eq!(composer.textarea.text(), "/compact ");
-        assert_eq!(composer.textarea.cursor(), composer.textarea.text().len());
+        assert_eq!(composer.draft.textarea.text(), "/compact ");
+        assert_eq!(
+            composer.draft.textarea.cursor(),
+            composer.draft.textarea.text().len()
+        );
     }
 
     #[test]
@@ -8323,8 +8195,11 @@ mod tests {
             composer.handle_key_event(KeyEvent::new(KeyCode::Tab, KeyModifiers::NONE));
 
         assert_eq!(result, InputResult::None);
-        assert_eq!(composer.textarea.text(), "/model ");
-        assert_eq!(composer.textarea.cursor(), composer.textarea.text().len());
+        assert_eq!(composer.draft.textarea.text(), "/model ");
+        assert_eq!(
+            composer.draft.textarea.cursor(),
+            composer.draft.textarea.text().len()
+        );
     }
 
     #[test]
@@ -8349,8 +8224,11 @@ mod tests {
             composer.handle_key_event(KeyEvent::new(KeyCode::Char('/'), KeyModifiers::NONE));
 
         assert_eq!(result, InputResult::None);
-        assert_eq!(composer.textarea.text(), "/model ");
-        assert_eq!(composer.textarea.cursor(), composer.textarea.text().len());
+        assert_eq!(composer.draft.textarea.text(), "/model ");
+        assert_eq!(
+            composer.draft.textarea.cursor(),
+            composer.draft.textarea.text().len()
+        );
     }
 
     #[test]
@@ -8370,7 +8248,7 @@ mod tests {
         type_chars_humanlike(&mut composer, &['/', 'd', 'i']);
         let (_res, _redraw) =
             composer.handle_key_event(KeyEvent::new(KeyCode::Tab, KeyModifiers::NONE));
-        assert_eq!(composer.textarea.text(), "/diff ");
+        assert_eq!(composer.draft.textarea.text(), "/diff ");
 
         // Press Enter: should dispatch the command, not submit literal text.
         let (result, _needs_redraw) =
@@ -8391,7 +8269,7 @@ mod tests {
             }
             InputResult::None => panic!("expected Command result for '/diff'"),
         }
-        assert!(composer.textarea.is_empty());
+        assert!(composer.draft.textarea.is_empty());
     }
 
     #[test]
@@ -8409,8 +8287,8 @@ mod tests {
 
         type_chars_humanlike(&mut composer, &['/', 'p', 'l', 'a', 'n', ' ']);
 
-        let text = composer.textarea.text().to_string();
-        let elements = composer.textarea.text_elements();
+        let text = composer.draft.textarea.text().to_string();
+        let elements = composer.draft.textarea.text_elements();
         assert_eq!(text, "/plan ");
         assert_eq!(elements.len(), 1);
         assert_eq!(elements[0].placeholder(&text), Some("/plan"));
@@ -8431,8 +8309,8 @@ mod tests {
 
         type_chars_humanlike(&mut composer, &['/', 'U', 's', 'e', 'r', 's', ' ']);
 
-        let text = composer.textarea.text().to_string();
-        let elements = composer.textarea.text_elements();
+        let text = composer.draft.textarea.text().to_string();
+        let elements = composer.draft.textarea.text_elements();
         assert_eq!(text, "/Users ");
         assert!(elements.is_empty());
     }
@@ -8451,16 +8329,16 @@ mod tests {
 
         type_chars_humanlike(&mut composer, &['/', 'r', 'e', 'v', 'i', 'e', 'w', ' ']);
 
-        let text = composer.textarea.text().to_string();
-        let elements = composer.textarea.text_elements();
+        let text = composer.draft.textarea.text().to_string();
+        let elements = composer.draft.textarea.text_elements();
         assert_eq!(text, "/review ");
         assert_eq!(elements.len(), 1);
 
-        composer.textarea.set_cursor(/*pos*/ 0);
+        composer.draft.textarea.set_cursor(/*pos*/ 0);
         type_chars_humanlike(&mut composer, &['x']);
 
-        let text = composer.textarea.text().to_string();
-        let elements = composer.textarea.text_elements();
+        let text = composer.draft.textarea.text().to_string();
+        let elements = composer.draft.textarea.text_elements();
         assert_eq!(text, "x/review ");
         assert!(elements.is_empty());
     }
@@ -8490,7 +8368,7 @@ mod tests {
             result,
             InputResult::Submitted { ref text, .. } if text == "hi"
         ));
-        assert!(composer.textarea.is_empty());
+        assert!(composer.draft.textarea.is_empty());
     }
 
     #[test]
@@ -8588,9 +8466,12 @@ mod tests {
             }
             InputResult::None => panic!("expected Command result for '/mention'"),
         }
-        assert!(composer.textarea.is_empty(), "composer should be cleared");
+        assert!(
+            composer.draft.textarea.is_empty(),
+            "composer should be cleared"
+        );
         composer.insert_str("@");
-        assert_eq!(composer.textarea.text(), "@");
+        assert_eq!(composer.draft.textarea.text(), "@");
     }
 
     #[test]
@@ -8666,9 +8547,9 @@ mod tests {
         let (_result, _needs_redraw) =
             composer.handle_key_event(KeyEvent::new(KeyCode::Tab, KeyModifiers::NONE));
 
-        let text = composer.textarea.text().to_string();
+        let text = composer.draft.textarea.text().to_string();
         assert_eq!(text, format!("{placeholder} src/main.rs "));
-        let elements = composer.textarea.text_elements();
+        let elements = composer.draft.textarea.text_elements();
         assert_eq!(elements.len(), 1);
         assert_eq!(elements[0].placeholder(&text), Some(placeholder.as_str()));
 
@@ -8804,8 +8685,8 @@ mod tests {
                     current_pos += content.len();
                 }
                 (
-                    composer.textarea.text().to_string(),
-                    composer.pending_pastes.len(),
+                    composer.draft.textarea.text().to_string(),
+                    composer.draft.pending_pastes.len(),
                     current_pos,
                 )
             })
@@ -8815,19 +8696,22 @@ mod tests {
         let mut deletion_states = vec![];
 
         // First deletion
-        composer.textarea.set_cursor(states[0].2);
+        composer.draft.textarea.set_cursor(states[0].2);
         composer.handle_key_event(KeyEvent::new(KeyCode::Backspace, KeyModifiers::NONE));
         deletion_states.push((
-            composer.textarea.text().to_string(),
-            composer.pending_pastes.len(),
+            composer.draft.textarea.text().to_string(),
+            composer.draft.pending_pastes.len(),
         ));
 
         // Second deletion
-        composer.textarea.set_cursor(composer.textarea.text().len());
+        composer
+            .draft
+            .textarea
+            .set_cursor(composer.draft.textarea.text().len());
         composer.handle_key_event(KeyEvent::new(KeyCode::Backspace, KeyModifiers::NONE));
         deletion_states.push((
-            composer.textarea.text().to_string(),
-            composer.pending_pastes.len(),
+            composer.draft.textarea.text().to_string(),
+            composer.draft.pending_pastes.len(),
         ));
 
         // Verify all states
@@ -8865,18 +8749,21 @@ mod tests {
         composer.handle_paste(paste.clone());
         composer.handle_paste(paste.clone());
         assert_eq!(
-            composer.textarea.text(),
+            composer.draft.textarea.text(),
             format!("{placeholder_base}{placeholder_second}")
         );
-        assert_eq!(composer.pending_pastes.len(), 2);
+        assert_eq!(composer.draft.pending_pastes.len(), 2);
 
-        composer.textarea.set_cursor(composer.textarea.text().len());
+        composer
+            .draft
+            .textarea
+            .set_cursor(composer.draft.textarea.text().len());
         composer.handle_key_event(KeyEvent::new(KeyCode::Backspace, KeyModifiers::NONE));
 
-        assert_eq!(composer.textarea.text(), placeholder_base);
-        assert_eq!(composer.pending_pastes.len(), 1);
-        assert_eq!(composer.pending_pastes[0].0, placeholder_base);
-        assert_eq!(composer.pending_pastes[0].1, paste);
+        assert_eq!(composer.draft.textarea.text(), placeholder_base);
+        assert_eq!(composer.draft.pending_pastes.len(), 1);
+        assert_eq!(composer.draft.pending_pastes[0].0, placeholder_base);
+        assert_eq!(composer.draft.pending_pastes[0].1, paste);
     }
 
     /// Behavior: large-paste placeholder numbering continues when another placeholder of the
@@ -8904,21 +8791,24 @@ mod tests {
 
         composer.handle_paste(paste.clone());
         composer.handle_paste(paste.clone());
-        assert_eq!(composer.textarea.text(), format!("{base}{second}"));
+        assert_eq!(composer.draft.textarea.text(), format!("{base}{second}"));
 
-        composer.textarea.set_cursor(base.len());
+        composer.draft.textarea.set_cursor(base.len());
         composer.handle_key_event(KeyEvent::new(KeyCode::Backspace, KeyModifiers::NONE));
-        assert_eq!(composer.textarea.text(), second);
-        assert_eq!(composer.pending_pastes.len(), 1);
-        assert_eq!(composer.pending_pastes[0].0, second);
+        assert_eq!(composer.draft.textarea.text(), second);
+        assert_eq!(composer.draft.pending_pastes.len(), 1);
+        assert_eq!(composer.draft.pending_pastes[0].0, second);
 
-        composer.textarea.set_cursor(composer.textarea.text().len());
+        composer
+            .draft
+            .textarea
+            .set_cursor(composer.draft.textarea.text().len());
         composer.handle_paste(paste);
 
-        assert_eq!(composer.textarea.text(), format!("{second}{third}"));
-        assert_eq!(composer.pending_pastes.len(), 2);
-        assert_eq!(composer.pending_pastes[0].0, second);
-        assert_eq!(composer.pending_pastes[1].0, third);
+        assert_eq!(composer.draft.textarea.text(), format!("{second}{third}"));
+        assert_eq!(composer.draft.pending_pastes.len(), 2);
+        assert_eq!(composer.draft.pending_pastes[0].0, second);
+        assert_eq!(composer.draft.pending_pastes[1].0, third);
     }
 
     /// Behavior: if all placeholders of a given length are removed, numbering resets to the
@@ -8943,18 +8833,21 @@ mod tests {
         let base = format!("[Pasted Content {} chars]", paste.chars().count());
 
         composer.handle_paste(paste.clone());
-        assert_eq!(composer.textarea.text(), base);
-        assert_eq!(composer.pending_pastes.len(), 1);
+        assert_eq!(composer.draft.textarea.text(), base);
+        assert_eq!(composer.draft.pending_pastes.len(), 1);
 
-        composer.textarea.set_cursor(composer.textarea.text().len());
+        composer
+            .draft
+            .textarea
+            .set_cursor(composer.draft.textarea.text().len());
         composer.handle_key_event(KeyEvent::new(KeyCode::Backspace, KeyModifiers::NONE));
-        assert!(composer.textarea.text().is_empty());
-        assert!(composer.pending_pastes.is_empty());
+        assert!(composer.draft.textarea.text().is_empty());
+        assert!(composer.draft.pending_pastes.is_empty());
 
         composer.handle_paste(paste);
-        assert_eq!(composer.textarea.text(), base);
-        assert_eq!(composer.pending_pastes.len(), 1);
-        assert_eq!(composer.pending_pastes[0].0, base);
+        assert_eq!(composer.draft.textarea.text(), base);
+        assert_eq!(composer.draft.pending_pastes.len(), 1);
+        assert_eq!(composer.draft.pending_pastes[0].0, base);
     }
 
     #[test]
@@ -8987,14 +8880,15 @@ mod tests {
             .map(|pos_from_end| {
                 composer.handle_paste(paste.clone());
                 composer
+                    .draft
                     .textarea
                     .set_cursor(placeholder.len() - pos_from_end);
                 composer.handle_key_event(KeyEvent::new(KeyCode::Backspace, KeyModifiers::NONE));
                 let result = (
-                    composer.textarea.text().contains(&placeholder),
-                    composer.pending_pastes.len(),
+                    composer.draft.textarea.text().contains(&placeholder),
+                    composer.draft.pending_pastes.len(),
                 );
-                composer.textarea.set_text_clearing_elements("");
+                composer.draft.textarea.set_text_clearing_elements("");
                 result
             })
             .collect();
@@ -9170,23 +9064,35 @@ mod tests {
 
         let (_result, _needs_redraw) =
             composer.handle_key_event(KeyEvent::new(KeyCode::Up, KeyModifiers::NONE));
-        assert_eq!(composer.textarea.text(), "second");
-        assert_eq!(composer.textarea.cursor(), composer.textarea.text().len());
+        assert_eq!(composer.draft.textarea.text(), "second");
+        assert_eq!(
+            composer.draft.textarea.cursor(),
+            composer.draft.textarea.text().len()
+        );
 
         let (_result, _needs_redraw) =
             composer.handle_key_event(KeyEvent::new(KeyCode::Up, KeyModifiers::NONE));
-        assert_eq!(composer.textarea.text(), "first");
-        assert_eq!(composer.textarea.cursor(), composer.textarea.text().len());
+        assert_eq!(composer.draft.textarea.text(), "first");
+        assert_eq!(
+            composer.draft.textarea.cursor(),
+            composer.draft.textarea.text().len()
+        );
 
         let (_result, _needs_redraw) =
             composer.handle_key_event(KeyEvent::new(KeyCode::Down, KeyModifiers::NONE));
-        assert_eq!(composer.textarea.text(), "second");
-        assert_eq!(composer.textarea.cursor(), composer.textarea.text().len());
+        assert_eq!(composer.draft.textarea.text(), "second");
+        assert_eq!(
+            composer.draft.textarea.cursor(),
+            composer.draft.textarea.text().len()
+        );
 
         let (_result, _needs_redraw) =
             composer.handle_key_event(KeyEvent::new(KeyCode::Down, KeyModifiers::NONE));
-        assert!(composer.textarea.is_empty());
-        assert_eq!(composer.textarea.cursor(), composer.textarea.text().len());
+        assert!(composer.draft.textarea.is_empty());
+        assert_eq!(
+            composer.draft.textarea.cursor(),
+            composer.draft.textarea.text().len()
+        );
     }
 
     #[test]
@@ -9215,23 +9121,26 @@ mod tests {
 
         let (_result, _needs_redraw) =
             composer.handle_key_event(KeyEvent::new(KeyCode::Char('k'), KeyModifiers::NONE));
-        assert_eq!(composer.textarea.text(), "second");
-        assert_eq!(composer.textarea.cursor(), "second".len() - 1);
+        assert_eq!(composer.draft.textarea.text(), "second");
+        assert_eq!(composer.draft.textarea.cursor(), "second".len() - 1);
 
         let (_result, _needs_redraw) =
             composer.handle_key_event(KeyEvent::new(KeyCode::Char('k'), KeyModifiers::NONE));
-        assert_eq!(composer.textarea.text(), "first");
-        assert_eq!(composer.textarea.cursor(), "first".len() - 1);
+        assert_eq!(composer.draft.textarea.text(), "first");
+        assert_eq!(composer.draft.textarea.cursor(), "first".len() - 1);
 
         let (_result, _needs_redraw) =
             composer.handle_key_event(KeyEvent::new(KeyCode::Char('j'), KeyModifiers::NONE));
-        assert_eq!(composer.textarea.text(), "second");
-        assert_eq!(composer.textarea.cursor(), "second".len() - 1);
+        assert_eq!(composer.draft.textarea.text(), "second");
+        assert_eq!(composer.draft.textarea.cursor(), "second".len() - 1);
 
         let (_result, _needs_redraw) =
             composer.handle_key_event(KeyEvent::new(KeyCode::Char('j'), KeyModifiers::NONE));
-        assert!(composer.textarea.is_empty());
-        assert_eq!(composer.textarea.cursor(), composer.textarea.text().len());
+        assert!(composer.draft.textarea.is_empty());
+        assert_eq!(
+            composer.draft.textarea.cursor(),
+            composer.draft.textarea.text().len()
+        );
     }
 
     #[test]
@@ -9261,13 +9170,13 @@ mod tests {
         composer.set_vim_enabled(/*enabled*/ true);
 
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Char('k'), KeyModifiers::NONE));
-        assert!(composer.textarea.is_empty());
+        assert!(composer.draft.textarea.is_empty());
 
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::F(2), KeyModifiers::NONE));
-        assert_eq!(composer.textarea.text(), "first");
+        assert_eq!(composer.draft.textarea.text(), "first");
 
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::F(3), KeyModifiers::NONE));
-        assert!(composer.textarea.is_empty());
+        assert!(composer.draft.textarea.is_empty());
     }
 
     #[test]
@@ -9281,15 +9190,18 @@ mod tests {
             "Ask Codex to do anything".to_string(),
             /*disable_paste_burst*/ false,
         );
-        composer.textarea.set_text_clearing_elements("one\ntwo");
-        composer.textarea.set_cursor(/*pos*/ 0);
+        composer
+            .draft
+            .textarea
+            .set_text_clearing_elements("one\ntwo");
+        composer.draft.textarea.set_cursor(/*pos*/ 0);
         composer.set_vim_enabled(/*enabled*/ true);
 
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Char('j'), KeyModifiers::NONE));
-        assert_eq!(composer.textarea.cursor(), "one\n".len());
+        assert_eq!(composer.draft.textarea.cursor(), "one\n".len());
 
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Char('k'), KeyModifiers::NONE));
-        assert_eq!(composer.textarea.cursor(), 0);
+        assert_eq!(composer.draft.textarea.cursor(), 0);
     }
 
     #[test]
@@ -9317,11 +9229,11 @@ mod tests {
         composer.set_vim_enabled(/*enabled*/ true);
 
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Char('k'), KeyModifiers::NONE));
-        assert_eq!(composer.textarea.text(), "second");
+        assert_eq!(composer.draft.textarea.text(), "second");
 
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Char('d'), KeyModifiers::NONE));
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Char('k'), KeyModifiers::NONE));
-        assert!(composer.textarea.is_empty());
+        assert!(composer.draft.textarea.is_empty());
         assert_eq!(composer.current_text(), "");
     }
 
@@ -9340,18 +9252,18 @@ mod tests {
         composer.set_vim_enabled(/*enabled*/ true);
 
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Char('d'), KeyModifiers::NONE));
-        assert!(composer.textarea.is_vim_operator_pending());
+        assert!(composer.draft.textarea.is_vim_operator_pending());
 
         let (result, _needs_redraw) =
             composer.handle_key_event(KeyEvent::new(KeyCode::Enter, KeyModifiers::NONE));
 
         assert!(matches!(result, InputResult::None));
-        assert_eq!(composer.textarea.text(), "hello");
+        assert_eq!(composer.draft.textarea.text(), "hello");
         assert_eq!(
             composer.vim_mode_indicator_span(),
             Some("Vim: Normal".magenta())
         );
-        assert!(!composer.textarea.is_vim_operator_pending());
+        assert!(!composer.draft.textarea.is_vim_operator_pending());
     }
 
     #[test]
@@ -9379,10 +9291,10 @@ mod tests {
         composer.set_keymap_bindings(&keymap);
 
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Up, KeyModifiers::NONE));
-        assert!(composer.textarea.is_empty());
+        assert!(composer.draft.textarea.is_empty());
 
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::F(2), KeyModifiers::NONE));
-        assert_eq!(composer.textarea.text(), "first");
+        assert_eq!(composer.draft.textarea.text(), "first");
     }
 
     #[test]
@@ -9415,7 +9327,7 @@ mod tests {
             composer.handle_key_event(KeyEvent::new(KeyCode::Up, KeyModifiers::NONE));
         assert_eq!(composer.current_text(), "!git");
 
-        composer.textarea.set_cursor(/*pos*/ 0);
+        composer.draft.textarea.set_cursor(/*pos*/ 0);
         let (_result, _needs_redraw) =
             composer.handle_key_event(KeyEvent::new(KeyCode::Up, KeyModifiers::NONE));
         assert_eq!(composer.current_text(), "first");
@@ -9448,12 +9360,12 @@ mod tests {
         let (_result, _needs_redraw) =
             composer.handle_key_event(KeyEvent::new(KeyCode::Char('k'), KeyModifiers::NONE));
         assert_eq!(composer.current_text(), "!git");
-        assert_eq!(composer.textarea.cursor(), "git".len() - 1);
+        assert_eq!(composer.draft.textarea.cursor(), "git".len() - 1);
 
         let (_result, _needs_redraw) =
             composer.handle_key_event(KeyEvent::new(KeyCode::Char('k'), KeyModifiers::NONE));
         assert_eq!(composer.current_text(), "first");
-        assert_eq!(composer.textarea.cursor(), "first".len() - 1);
+        assert_eq!(composer.draft.textarea.cursor(), "first".len() - 1);
     }
 
     #[test]
@@ -9622,11 +9534,15 @@ mod tests {
             /*disable_paste_burst*/ false,
         );
 
-        composer.textarea.set_text_clearing_elements("/unknown ");
-        composer.textarea.set_cursor("/unknown ".len());
+        composer
+            .draft
+            .textarea
+            .set_text_clearing_elements("/unknown ");
+        composer.draft.textarea.set_cursor("/unknown ".len());
         let large_content = "x".repeat(LARGE_PASTE_CHAR_THRESHOLD + 5);
         composer.handle_paste(large_content.clone());
         let placeholder = composer
+            .draft
             .pending_pastes
             .first()
             .expect("expected pending paste")
@@ -9636,11 +9552,14 @@ mod tests {
         let (result, _) =
             composer.handle_key_event(KeyEvent::new(KeyCode::Enter, KeyModifiers::NONE));
         assert!(matches!(result, InputResult::None));
-        assert_eq!(composer.pending_pastes.len(), 1);
-        assert_eq!(composer.textarea.text(), format!("/unknown {placeholder}"));
+        assert_eq!(composer.draft.pending_pastes.len(), 1);
+        assert_eq!(
+            composer.draft.textarea.text(),
+            format!("/unknown {placeholder}")
+        );
 
-        composer.textarea.set_cursor(/*pos*/ 0);
-        composer.textarea.insert_str(" ");
+        composer.draft.textarea.set_cursor(/*pos*/ 0);
+        composer.draft.textarea.insert_str(" ");
         let (result, _) =
             composer.handle_key_event(KeyEvent::new(KeyCode::Enter, KeyModifiers::NONE));
         match result {
@@ -9653,7 +9572,7 @@ mod tests {
             }
             _ => panic!("expected Submitted"),
         }
-        assert!(composer.pending_pastes.is_empty());
+        assert!(composer.draft.pending_pastes.is_empty());
     }
 
     #[test]
@@ -9692,7 +9611,7 @@ mod tests {
         let imgs = composer.take_recent_submission_images();
         assert_eq!(imgs.len(), 1);
         assert_eq!(imgs[0], path);
-        assert!(composer.attached_images.is_empty());
+        assert!(composer.attachments.local_images.is_empty());
     }
 
     #[test]
@@ -9711,11 +9630,17 @@ mod tests {
         composer.handle_paste(" ".into());
         composer.attach_image(path);
 
-        let text = composer.textarea.text().to_string();
+        let text = composer.draft.textarea.text().to_string();
         assert!(text.contains("[Image #1]"));
         assert!(text.contains("[Image #2]"));
-        assert_eq!(composer.attached_images[0].placeholder, "[Image #1]");
-        assert_eq!(composer.attached_images[1].placeholder, "[Image #2]");
+        assert_eq!(
+            composer.attachments.local_images[0].placeholder,
+            "[Image #1]"
+        );
+        assert_eq!(
+            composer.attachments.local_images[1].placeholder,
+            "[Image #2]"
+        );
     }
 
     #[test]
@@ -9731,26 +9656,27 @@ mod tests {
         );
         let path = PathBuf::from("/tmp/image3.png");
         composer.attach_image(path.clone());
-        let placeholder = composer.attached_images[0].placeholder.clone();
+        let placeholder = composer.attachments.local_images[0].placeholder.clone();
 
         // Case 1: backspace at end
         composer
+            .draft
             .textarea
             .move_cursor_to_end_of_line(/*move_down_at_eol*/ false);
         composer.handle_key_event(KeyEvent::new(KeyCode::Backspace, KeyModifiers::NONE));
-        assert!(!composer.textarea.text().contains(&placeholder));
-        assert!(composer.attached_images.is_empty());
+        assert!(!composer.draft.textarea.text().contains(&placeholder));
+        assert!(composer.attachments.local_images.is_empty());
 
         // Re-add and ensure backspace at element start does not delete the placeholder.
         composer.attach_image(path);
-        let placeholder2 = composer.attached_images[0].placeholder.clone();
+        let placeholder2 = composer.attachments.local_images[0].placeholder.clone();
         // Move cursor to roughly middle of placeholder
-        if let Some(start_pos) = composer.textarea.text().find(&placeholder2) {
+        if let Some(start_pos) = composer.draft.textarea.text().find(&placeholder2) {
             let mid_pos = start_pos + (placeholder2.len() / 2);
-            composer.textarea.set_cursor(mid_pos);
+            composer.draft.textarea.set_cursor(mid_pos);
             composer.handle_key_event(KeyEvent::new(KeyCode::Backspace, KeyModifiers::NONE));
-            assert!(composer.textarea.text().contains(&placeholder2));
-            assert_eq!(composer.attached_images.len(), 1);
+            assert!(composer.draft.textarea.text().contains(&placeholder2));
+            assert_eq!(composer.attachments.local_images.len(), 1);
         } else {
             panic!("Placeholder not found in textarea");
         }
@@ -9776,14 +9702,14 @@ mod tests {
         let path = PathBuf::from("/tmp/image_multibyte.png");
         composer.attach_image(path);
         // Add multibyte text after the placeholder
-        composer.textarea.insert_str("日本語");
+        composer.draft.textarea.insert_str("日本語");
 
         // Cursor is at end; pressing backspace should delete the last character
         // without panicking and leave the placeholder intact.
         composer.handle_key_event(KeyEvent::new(KeyCode::Backspace, KeyModifiers::NONE));
 
-        assert_eq!(composer.attached_images.len(), 1);
-        assert!(composer.textarea.text().starts_with("[Image #1]"));
+        assert_eq!(composer.attachments.local_images.len(), 1);
+        assert!(composer.draft.textarea.text().starts_with("[Image #1]"));
     }
 
     #[test]
@@ -9806,17 +9732,17 @@ mod tests {
         composer.handle_paste(" ".into());
         composer.attach_image(path2.clone());
 
-        let placeholder1 = composer.attached_images[0].placeholder.clone();
-        let placeholder2 = composer.attached_images[1].placeholder.clone();
-        let text = composer.textarea.text().to_string();
+        let placeholder1 = composer.attachments.local_images[0].placeholder.clone();
+        let placeholder2 = composer.attachments.local_images[1].placeholder.clone();
+        let text = composer.draft.textarea.text().to_string();
         let start1 = text.find(&placeholder1).expect("first placeholder present");
         let end1 = start1 + placeholder1.len();
-        composer.textarea.set_cursor(end1);
+        composer.draft.textarea.set_cursor(end1);
 
         // Backspace should delete the first placeholder and its mapping.
         composer.handle_key_event(KeyEvent::new(KeyCode::Backspace, KeyModifiers::NONE));
 
-        let new_text = composer.textarea.text().to_string();
+        let new_text = composer.draft.textarea.text().to_string();
         assert_eq!(
             1,
             new_text.matches(&placeholder1).count(),
@@ -9837,7 +9763,7 @@ mod tests {
                 path: path2,
                 placeholder: "[Image #1]".to_string()
             }],
-            composer.attached_images,
+            composer.attachments.local_images,
             "one image mapping remains"
         );
     }
@@ -9887,12 +9813,12 @@ mod tests {
         composer.set_text_content(text, text_elements, vec![path1, path2.clone()]);
 
         let end1 = start1 + placeholder1.len();
-        composer.textarea.set_cursor(end1);
+        composer.draft.textarea.set_cursor(end1);
 
         composer.handle_key_event(KeyEvent::new(KeyCode::Backspace, KeyModifiers::NONE));
 
         assert_eq!(
-            composer.textarea.text(),
+            composer.draft.textarea.text(),
             format!("Test {placeholder1} test ")
         );
         assert_eq!(
@@ -9900,7 +9826,7 @@ mod tests {
                 path: path2,
                 placeholder: placeholder1
             }],
-            composer.attached_images,
+            composer.attachments.local_images,
             "attachment renumbered after deletion"
         );
     }
@@ -9927,18 +9853,21 @@ mod tests {
         // Insert two adjacent atomic elements.
         composer.attach_image(path1);
         composer.attach_image(path2.clone());
-        assert_eq!(composer.textarea.text(), "[Image #1][Image #2]");
-        assert_eq!(composer.attached_images.len(), 2);
+        assert_eq!(composer.draft.textarea.text(), "[Image #1][Image #2]");
+        assert_eq!(composer.attachments.local_images.len(), 2);
 
         // Delete the first element using normal textarea editing (forward Delete at cursor start).
-        composer.textarea.set_cursor(/*pos*/ 0);
+        composer.draft.textarea.set_cursor(/*pos*/ 0);
         composer.handle_key_event(KeyEvent::new(KeyCode::Delete, KeyModifiers::NONE));
 
         // Remaining image should be renumbered and the textarea element updated.
-        assert_eq!(composer.attached_images.len(), 1);
-        assert_eq!(composer.attached_images[0].path, path2);
-        assert_eq!(composer.attached_images[0].placeholder, "[Image #1]");
-        assert_eq!(composer.textarea.text(), "[Image #1]");
+        assert_eq!(composer.attachments.local_images.len(), 1);
+        assert_eq!(composer.attachments.local_images[0].path, path2);
+        assert_eq!(
+            composer.attachments.local_images[0].placeholder,
+            "[Image #1]"
+        );
+        assert_eq!(composer.draft.textarea.text(), "[Image #1]");
     }
 
     #[test]
@@ -9961,7 +9890,7 @@ mod tests {
 
         let needs_redraw = composer.handle_paste(tmp_path.to_string_lossy().to_string());
         assert!(needs_redraw);
-        assert!(composer.textarea.text().starts_with("[Image #1] "));
+        assert!(composer.draft.textarea.text().starts_with("[Image #1] "));
 
         let imgs = composer.take_recent_submission_images();
         assert_eq!(imgs, vec![tmp_path]);
@@ -9984,6 +9913,7 @@ mod tests {
         );
 
         composer
+            .draft
             .textarea
             .set_text_clearing_elements("/Users/example/project/src/main.rs");
 
@@ -9995,7 +9925,7 @@ mod tests {
         } else {
             panic!("expected Submitted");
         }
-        assert!(composer.textarea.is_empty());
+        assert!(composer.draft.textarea.is_empty());
         match rx.try_recv() {
             Ok(event) => panic!("unexpected event: {event:?}"),
             Err(tokio::sync::mpsc::error::TryRecvError::Empty) => {}
@@ -10020,6 +9950,7 @@ mod tests {
         );
 
         composer
+            .draft
             .textarea
             .set_text_clearing_elements(" /this-looks-like-a-command");
 
@@ -10031,7 +9962,7 @@ mod tests {
         } else {
             panic!("expected Submitted");
         }
-        assert!(composer.textarea.is_empty());
+        assert!(composer.draft.textarea.is_empty());
         match rx.try_recv() {
             Ok(event) => panic!("unexpected event: {event:?}"),
             Err(tokio::sync::mpsc::error::TryRecvError::Empty) => {}
@@ -10059,12 +9990,12 @@ mod tests {
 
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Char('h'), KeyModifiers::NONE));
         assert!(composer.is_in_paste_burst());
-        assert!(composer.textarea.text().is_empty());
+        assert!(composer.draft.textarea.text().is_empty());
 
         std::thread::sleep(ChatComposer::recommended_paste_flush_delay());
         let flushed = composer.flush_paste_burst_if_due();
         assert!(flushed, "expected pending first char to flush");
-        assert_eq!(composer.textarea.text(), "h");
+        assert_eq!(composer.draft.textarea.text(), "h");
         assert!(!composer.is_in_paste_burst());
     }
 
@@ -10099,22 +10030,22 @@ mod tests {
                 "expected active paste burst during fast typing"
             );
             assert!(
-                composer.textarea.text().is_empty(),
+                composer.draft.textarea.text().is_empty(),
                 "text should not appear during burst"
             );
             now += step;
         }
 
         assert!(
-            composer.textarea.text().is_empty(),
+            composer.draft.textarea.text().is_empty(),
             "text should remain empty until flush"
         );
         let flush_time = now + PasteBurst::recommended_active_flush_delay() + step;
         let flushed = composer.handle_paste_burst_flush(flush_time);
         assert!(flushed, "expected buffered text to flush after stop");
-        assert_eq!(composer.textarea.text(), "a".repeat(count));
+        assert_eq!(composer.draft.textarea.text(), "a".repeat(count));
         assert!(
-            composer.pending_pastes.is_empty(),
+            composer.draft.pending_pastes.is_empty(),
             "no placeholder for small burst"
         );
     }
@@ -10145,17 +10076,17 @@ mod tests {
         }
 
         // Nothing should appear until we stop and flush
-        assert!(composer.textarea.text().is_empty());
+        assert!(composer.draft.textarea.text().is_empty());
         let flush_time = now + PasteBurst::recommended_active_flush_delay() + step;
         let flushed = composer.handle_paste_burst_flush(flush_time);
         assert!(flushed, "expected flush after stopping fast input");
 
         let expected_placeholder = format!("[Pasted Content {count} chars]");
-        assert_eq!(composer.textarea.text(), expected_placeholder);
-        assert_eq!(composer.pending_pastes.len(), 1);
-        assert_eq!(composer.pending_pastes[0].0, expected_placeholder);
-        assert_eq!(composer.pending_pastes[0].1.len(), count);
-        assert!(composer.pending_pastes[0].1.chars().all(|c| c == 'x'));
+        assert_eq!(composer.draft.textarea.text(), expected_placeholder);
+        assert_eq!(composer.draft.pending_pastes.len(), 1);
+        assert_eq!(composer.draft.pending_pastes[0].0, expected_placeholder);
+        assert_eq!(composer.draft.pending_pastes[0].1.len(), count);
+        assert!(composer.draft.pending_pastes[0].1.chars().all(|c| c == 'x'));
     }
 
     /// Behavior: human-like typing (with delays between chars) should not be classified as a paste
@@ -10176,8 +10107,8 @@ mod tests {
         let chars: Vec<char> = vec!['z'; count];
         type_chars_humanlike(&mut composer, &chars);
 
-        assert_eq!(composer.textarea.text(), "z".repeat(count));
-        assert!(composer.pending_pastes.is_empty());
+        assert_eq!(composer.draft.textarea.text(), "z".repeat(count));
+        assert!(composer.draft.pending_pastes.is_empty());
     }
 
     #[test]
@@ -10202,7 +10133,7 @@ mod tests {
 
         // After set_text_content -> sync_popups is called; popup should NOT be Command.
         assert!(
-            matches!(composer.active_popup, ActivePopup::None),
+            matches!(composer.popups.active, ActivePopup::None),
             "expected no slash popup for '/ test'"
         );
 
@@ -10230,21 +10161,21 @@ mod tests {
         // Case 1: bare "/"
         composer.set_text_content("/".to_string(), Vec::new(), Vec::new());
         assert!(
-            matches!(composer.active_popup, ActivePopup::Command(_)),
+            matches!(composer.popups.active, ActivePopup::Command(_)),
             "bare '/' should activate slash popup"
         );
 
         // Case 2: valid prefix "/re" (matches /review, /resume, etc.)
         composer.set_text_content("/re".to_string(), Vec::new(), Vec::new());
         assert!(
-            matches!(composer.active_popup, ActivePopup::Command(_)),
+            matches!(composer.popups.active, ActivePopup::Command(_)),
             "'/re' should activate slash popup via prefix match"
         );
 
         // Case 3: fuzzy match "/ac" (subsequence of /compact and /feedback)
         composer.set_text_content("/ac".to_string(), Vec::new(), Vec::new());
         assert!(
-            matches!(composer.active_popup, ActivePopup::Command(_)),
+            matches!(composer.popups.active, ActivePopup::Command(_)),
             "'/ac' should activate slash popup via fuzzy match"
         );
 
@@ -10253,7 +10184,7 @@ mod tests {
         // Verify that explicitly.
         composer.set_text_content("/zzz".to_string(), Vec::new(), Vec::new());
         assert!(
-            matches!(composer.active_popup, ActivePopup::None),
+            matches!(composer.popups.active, ActivePopup::None),
             "'/zzz' should not activate slash popup because it is not a prefix of any built-in command"
         );
     }
@@ -10322,7 +10253,7 @@ mod tests {
         composer.set_collaboration_modes_enabled(/*enabled*/ true);
 
         composer.set_text_content("/plan investigate this".to_string(), Vec::new(), Vec::new());
-        composer.active_popup = ActivePopup::None;
+        composer.popups.active = ActivePopup::None;
         let (result, _needs_redraw) =
             composer.handle_key_event(KeyEvent::new(KeyCode::Enter, KeyModifiers::NONE));
 
@@ -10355,12 +10286,13 @@ mod tests {
         );
 
         let placeholder = local_image_label_text(/*label_number*/ 1);
-        composer.textarea.insert_element(&placeholder);
-        composer.attached_images.push(AttachedImage {
+        composer.draft.textarea.insert_element(&placeholder);
+        composer.attachments.local_images.push(AttachedImage {
             placeholder: placeholder.clone(),
             path: PathBuf::from("img.png"),
         });
         composer
+            .draft
             .pending_pastes
             .push(("[Pasted]".to_string(), "data".to_string()));
 
@@ -10370,10 +10302,16 @@ mod tests {
             composer.current_text(),
             format!("Edited {placeholder} text")
         );
-        assert!(composer.pending_pastes.is_empty());
-        assert_eq!(composer.attached_images.len(), 1);
-        assert_eq!(composer.attached_images[0].placeholder, placeholder);
-        assert_eq!(composer.textarea.cursor(), composer.current_text().len());
+        assert!(composer.draft.pending_pastes.is_empty());
+        assert_eq!(composer.attachments.local_images.len(), 1);
+        assert_eq!(
+            composer.attachments.local_images[0].placeholder,
+            placeholder
+        );
+        assert_eq!(
+            composer.draft.textarea.cursor(),
+            composer.current_text().len()
+        );
     }
 
     #[test]
@@ -10391,8 +10329,8 @@ mod tests {
 
         composer.apply_external_edit("!git status".to_string());
 
-        assert!(composer.is_bash_mode);
-        assert_eq!(composer.textarea.text(), "git status");
+        assert!(composer.draft.is_bash_mode);
+        assert_eq!(composer.draft.textarea.text(), "git status");
         assert_eq!(composer.current_text(), "!git status");
     }
 
@@ -10411,8 +10349,8 @@ mod tests {
 
         composer.apply_external_edit("git status".to_string());
 
-        assert!(!composer.is_bash_mode);
-        assert_eq!(composer.textarea.text(), "git status");
+        assert!(!composer.draft.is_bash_mode);
+        assert_eq!(composer.draft.textarea.text(), "git status");
         assert_eq!(composer.current_text(), "git status");
     }
 
@@ -10431,8 +10369,8 @@ mod tests {
 
         composer.apply_external_edit("!git status".to_string());
 
-        assert!(composer.is_bash_mode);
-        assert_eq!(composer.textarea.text(), "git status");
+        assert!(composer.draft.is_bash_mode);
+        assert_eq!(composer.draft.textarea.text(), "git status");
         assert_eq!(composer.current_text(), "!git status");
     }
 
@@ -10449,8 +10387,8 @@ mod tests {
         );
 
         let placeholder = local_image_label_text(/*label_number*/ 1);
-        composer.textarea.insert_element(&placeholder);
-        composer.attached_images.push(AttachedImage {
+        composer.draft.textarea.insert_element(&placeholder);
+        composer.attachments.local_images.push(AttachedImage {
             placeholder: placeholder.clone(),
             path: PathBuf::from("img.png"),
         });
@@ -10458,7 +10396,7 @@ mod tests {
         composer.apply_external_edit("No images here".to_string());
 
         assert_eq!(composer.current_text(), "No images here".to_string());
-        assert!(composer.attached_images.is_empty());
+        assert!(composer.attachments.local_images.is_empty());
     }
 
     #[test]
@@ -10483,10 +10421,16 @@ mod tests {
 
         let placeholder1 = local_image_label_text(/*label_number*/ 1);
         assert_eq!(composer.current_text(), format!("Keep {placeholder1}"));
-        assert_eq!(composer.attached_images.len(), 1);
-        assert_eq!(composer.attached_images[0].placeholder, placeholder1);
+        assert_eq!(composer.attachments.local_images.len(), 1);
+        assert_eq!(
+            composer.attachments.local_images[0].placeholder,
+            placeholder1
+        );
         assert_eq!(composer.local_image_paths(), vec![second_path]);
-        assert_eq!(composer.textarea.element_payloads(), vec![placeholder1]);
+        assert_eq!(
+            composer.draft.textarea.element_payloads(),
+            vec![placeholder1]
+        );
     }
 
     #[test]
@@ -10502,8 +10446,9 @@ mod tests {
         );
 
         let placeholder = "[Pasted Content 5 chars]".to_string();
-        composer.textarea.insert_element(&placeholder);
+        composer.draft.textarea.insert_element(&placeholder);
         composer
+            .draft
             .pending_pastes
             .push((placeholder.clone(), "hello".to_string()));
 
@@ -10554,8 +10499,8 @@ mod tests {
         );
 
         let placeholder = local_image_label_text(/*label_number*/ 1);
-        composer.textarea.insert_element(&placeholder);
-        composer.attached_images.push(AttachedImage {
+        composer.draft.textarea.insert_element(&placeholder);
+        composer.attachments.local_images.push(AttachedImage {
             placeholder: placeholder.clone(),
             path: PathBuf::from("img.png"),
         });
@@ -10566,7 +10511,7 @@ mod tests {
             composer.current_text(),
             format!("{placeholder} extra {placeholder}")
         );
-        assert_eq!(composer.attached_images.len(), 1);
+        assert_eq!(composer.attachments.local_images.len(), 1);
     }
 
     #[test]
@@ -10608,7 +10553,10 @@ mod tests {
         ]);
         composer.attach_image(PathBuf::from("/tmp/local.png"));
 
-        assert_eq!(composer.attached_images[0].placeholder, "[Image #3]");
+        assert_eq!(
+            composer.attachments.local_images[0].placeholder,
+            "[Image #3]"
+        );
         assert_eq!(composer.current_text(), "[Image #3]");
     }
 
@@ -10686,7 +10634,7 @@ mod tests {
             "https://example.com/two.png".to_string(),
         ]);
         composer.attach_image(PathBuf::from("/tmp/local.png"));
-        composer.textarea.set_cursor(/*pos*/ 0);
+        composer.draft.textarea.set_cursor(/*pos*/ 0);
 
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Up, KeyModifiers::NONE));
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Delete, KeyModifiers::NONE));
@@ -10695,13 +10643,19 @@ mod tests {
             vec!["https://example.com/one.png".to_string()]
         );
         assert_eq!(composer.current_text(), "[Image #2]");
-        assert_eq!(composer.attached_images[0].placeholder, "[Image #2]");
+        assert_eq!(
+            composer.attachments.local_images[0].placeholder,
+            "[Image #2]"
+        );
 
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Up, KeyModifiers::NONE));
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Delete, KeyModifiers::NONE));
         assert_eq!(composer.remote_image_urls(), Vec::<String>::new());
         assert_eq!(composer.current_text(), "[Image #1]");
-        assert_eq!(composer.attached_images[0].placeholder, "[Image #1]");
+        assert_eq!(
+            composer.attachments.local_images[0].placeholder,
+            "[Image #1]"
+        );
     }
 
     #[test]
@@ -10741,4 +10695,41 @@ mod tests {
         };
         assert_eq!(composer.cursor_pos(area), None);
     }
+
+    #[test]
+    fn shutdown_in_progress_disables_input_and_uses_hint_without_footer() {
+        use ratatui::Terminal;
+        use ratatui::backend::TestBackend;
+
+        let (tx, _rx) = unbounded_channel::<AppEvent>();
+        let sender = AppEventSender::new(tx);
+        let mut composer = ChatComposer::new(
+            /*has_input_focus*/ true,
+            sender,
+            /*enhanced_keys_supported*/ false,
+            "Ask Codex to do anything".to_string(),
+            /*disable_paste_burst*/ false,
+        );
+
+        composer.set_text_content("hello".to_string(), Vec::new(), Vec::new());
+        composer.show_shutdown_in_progress();
+
+        assert!(!composer.input_enabled());
+        assert_eq!(composer.current_text(), "hello");
+        assert_eq!(composer.custom_footer_height(), Some(0));
+
+        let area = Rect {
+            x: 0,
+            y: 0,
+            width: 40,
+            height: 5,
+        };
+        assert_eq!(composer.cursor_pos(area), None);
+
+        let mut terminal = Terminal::new(TestBackend::new(40, 5)).expect("terminal");
+        terminal
+            .draw(|f| composer.render(f.area(), f.buffer_mut()))
+            .unwrap();
+        insta::assert_snapshot!("shutdown_in_progress", terminal.backend());
+    }
 }
diff --git a/codex-rs/tui/src/bottom_pane/chat_composer/attachment_state.rs b/codex-rs/tui/src/bottom_pane/chat_composer/attachment_state.rs
new file mode 100644
index 0000000000..8744fe8b0a
--- /dev/null
+++ b/codex-rs/tui/src/bottom_pane/chat_composer/attachment_state.rs
@@ -0,0 +1,251 @@
+//! Attachment bookkeeping for the chat composer, including local image placeholders,
+//! remote-image rows, and keyboard selection over those rows.
+
+use std::collections::HashSet;
+use std::path::PathBuf;
+
+use crossterm::event::KeyCode;
+use crossterm::event::KeyEvent;
+use crossterm::event::KeyEventKind;
+use crossterm::event::KeyModifiers;
+use ratatui::style::Stylize;
+use ratatui::text::Line;
+
+use super::InputResult;
+use crate::bottom_pane::LocalImageAttachment;
+use crate::bottom_pane::textarea::TextArea;
+use codex_protocol::models::local_image_label_text;
+use codex_protocol::user_input::TextElement;
+
+#[derive(Clone, Debug, PartialEq)]
+pub(super) struct AttachedImage {
+    pub(super) placeholder: String,
+    pub(super) path: PathBuf,
+}
+
+#[derive(Debug, Default)]
+pub(super) struct AttachmentState {
+    pub(super) local_images: Vec<AttachedImage>,
+    pub(super) remote_image_urls: Vec<String>,
+    pub(super) selected_remote_image_index: Option<usize>,
+}
+
+impl AttachmentState {
+    pub(super) fn is_empty(&self) -> bool {
+        self.local_images.is_empty() && self.remote_image_urls.is_empty()
+    }
+
+    pub(super) fn local_image_paths(&self) -> Vec<PathBuf> {
+        self.local_images
+            .iter()
+            .map(|image| image.path.clone())
+            .collect()
+    }
+
+    pub(super) fn local_images(&self) -> Vec<LocalImageAttachment> {
+        self.local_images
+            .iter()
+            .map(|image| LocalImageAttachment {
+                placeholder: image.placeholder.clone(),
+                path: image.path.clone(),
+            })
+            .collect()
+    }
+
+    pub(super) fn set_remote_image_urls(&mut self, urls: Vec<String>, textarea: &mut TextArea) {
+        self.remote_image_urls = urls;
+        self.selected_remote_image_index = None;
+        self.relabel_local_images(textarea);
+    }
+
+    pub(super) fn remote_image_urls(&self) -> Vec<String> {
+        self.remote_image_urls.clone()
+    }
+
+    pub(super) fn take_remote_image_urls(&mut self, textarea: &mut TextArea) -> Vec<String> {
+        let urls = std::mem::take(&mut self.remote_image_urls);
+        self.selected_remote_image_index = None;
+        self.relabel_local_images(textarea);
+        urls
+    }
+
+    pub(super) fn clear_remote_image_urls(&mut self) {
+        self.remote_image_urls.clear();
+        self.selected_remote_image_index = None;
+    }
+
+    pub(super) fn reset_local_images(
+        &mut self,
+        local_image_paths: Vec<PathBuf>,
+        textarea: &mut TextArea,
+    ) {
+        self.local_images.clear();
+        self.local_images.extend(
+            local_image_paths
+                .into_iter()
+                .enumerate()
+                .map(|(index, path)| AttachedImage {
+                    placeholder: local_image_label_text(self.remote_image_urls.len() + index + 1),
+                    path,
+                }),
+        );
+        self.selected_remote_image_index = None;
+        self.relabel_local_images(textarea);
+    }
+
+    pub(super) fn attach_image(&mut self, textarea: &mut TextArea, path: PathBuf) {
+        let image_number = self.remote_image_urls.len() + self.local_images.len() + 1;
+        let placeholder = local_image_label_text(image_number);
+        textarea.insert_element(&placeholder);
+        self.local_images.push(AttachedImage { placeholder, path });
+    }
+
+    pub(super) fn prune_local_images_for_submission(
+        &mut self,
+        text: &str,
+        text_elements: &[TextElement],
+    ) {
+        if self.local_images.is_empty() {
+            return;
+        }
+
+        let image_placeholders: HashSet<&str> = text_elements
+            .iter()
+            .filter_map(|element| element.placeholder(text))
+            .collect();
+        self.local_images
+            .retain(|image| image_placeholders.contains(image.placeholder.as_str()));
+    }
+
+    #[cfg(test)]
+    pub(super) fn take_recent_submission_images(&mut self) -> Vec<PathBuf> {
+        std::mem::take(&mut self.local_images)
+            .into_iter()
+            .map(|image| image.path)
+            .collect()
+    }
+
+    pub(super) fn take_recent_submission_images_with_placeholders(
+        &mut self,
+    ) -> Vec<LocalImageAttachment> {
+        std::mem::take(&mut self.local_images)
+            .into_iter()
+            .map(|image| LocalImageAttachment {
+                placeholder: image.placeholder,
+                path: image.path,
+            })
+            .collect()
+    }
+
+    pub(super) fn remote_image_lines(&self) -> Vec<Line<'static>> {
+        self.remote_image_urls
+            .iter()
+            .enumerate()
+            .map(|(index, _)| {
+                let label = local_image_label_text(index + 1);
+                if self.selected_remote_image_index == Some(index) {
+                    label.cyan().reversed().into()
+                } else {
+                    label.cyan().into()
+                }
+            })
+            .collect()
+    }
+
+    pub(super) fn clear_remote_image_selection(&mut self) {
+        self.selected_remote_image_index = None;
+    }
+
+    pub(super) fn handle_remote_image_selection_key(
+        &mut self,
+        key_event: &KeyEvent,
+        textarea: &mut TextArea,
+    ) -> Option<(InputResult, bool)> {
+        if self.remote_image_urls.is_empty()
+            || key_event.modifiers != KeyModifiers::NONE
+            || key_event.kind != KeyEventKind::Press
+        {
+            return None;
+        }
+
+        match key_event.code {
+            KeyCode::Up => {
+                if let Some(selected) = self.selected_remote_image_index {
+                    self.selected_remote_image_index = Some(selected.saturating_sub(1));
+                    Some((InputResult::None, true))
+                } else if textarea.cursor() == 0 {
+                    self.selected_remote_image_index = Some(self.remote_image_urls.len() - 1);
+                    Some((InputResult::None, true))
+                } else {
+                    None
+                }
+            }
+            KeyCode::Down => {
+                if let Some(selected) = self.selected_remote_image_index {
+                    if selected + 1 < self.remote_image_urls.len() {
+                        self.selected_remote_image_index = Some(selected + 1);
+                    } else {
+                        self.clear_remote_image_selection();
+                    }
+                    Some((InputResult::None, true))
+                } else {
+                    None
+                }
+            }
+            KeyCode::Delete | KeyCode::Backspace => {
+                if let Some(selected) = self.selected_remote_image_index {
+                    self.remove_selected_remote_image(selected, textarea);
+                    Some((InputResult::None, true))
+                } else {
+                    None
+                }
+            }
+            _ => None,
+        }
+    }
+
+    pub(super) fn remove_deleted_local_placeholders(
+        &mut self,
+        removed_payloads: &[String],
+        textarea: &mut TextArea,
+    ) -> bool {
+        let previous_len = self.local_images.len();
+        self.local_images.retain(|image| {
+            !removed_payloads
+                .iter()
+                .any(|payload| payload == &image.placeholder)
+        });
+        let removed_any = self.local_images.len() != previous_len;
+        if removed_any {
+            self.relabel_local_images(textarea);
+        }
+        removed_any
+    }
+
+    pub(super) fn relabel_local_images(&mut self, textarea: &mut TextArea) {
+        for (index, image) in self.local_images.iter_mut().enumerate() {
+            let expected = local_image_label_text(self.remote_image_urls.len() + index + 1);
+            if image.placeholder == expected {
+                continue;
+            }
+
+            let current = std::mem::replace(&mut image.placeholder, expected.clone());
+            let _renamed = textarea.replace_element_payload(&current, &expected);
+        }
+    }
+
+    fn remove_selected_remote_image(&mut self, selected_index: usize, textarea: &mut TextArea) {
+        if selected_index >= self.remote_image_urls.len() {
+            self.clear_remote_image_selection();
+            return;
+        }
+
+        self.remote_image_urls.remove(selected_index);
+        self.selected_remote_image_index = if self.remote_image_urls.is_empty() {
+            None
+        } else {
+            Some(selected_index.min(self.remote_image_urls.len() - 1))
+        };
+        self.relabel_local_images(textarea);
+    }
+}
diff --git a/codex-rs/tui/src/bottom_pane/chat_composer/draft_state.rs b/codex-rs/tui/src/bottom_pane/chat_composer/draft_state.rs
new file mode 100644
index 0000000000..f739f10ec9
--- /dev/null
+++ b/codex-rs/tui/src/bottom_pane/chat_composer/draft_state.rs
@@ -0,0 +1,45 @@
+//! Editable composer draft state kept separate from composer control flow.
+
+use std::cell::RefCell;
+use std::collections::HashMap;
+
+use crate::bottom_pane::MentionBinding;
+use crate::bottom_pane::paste_burst::PasteBurst;
+use crate::bottom_pane::textarea::TextArea;
+use crate::bottom_pane::textarea::TextAreaState;
+
+pub(super) struct DraftState {
+    pub(super) textarea: TextArea,
+    pub(super) textarea_state: RefCell<TextAreaState>,
+    pub(super) is_bash_mode: bool,
+    pub(super) pending_pastes: Vec<(String, String)>,
+    pub(super) input_enabled: bool,
+    pub(super) input_disabled_placeholder: Option<String>,
+    pub(super) paste_burst: PasteBurst,
+    pub(super) disable_paste_burst: bool,
+    pub(super) mention_bindings: HashMap<u64, ComposerMentionBinding>,
+    pub(super) recent_submission_mention_bindings: Vec<MentionBinding>,
+}
+
+impl DraftState {
+    pub(super) fn new() -> Self {
+        Self {
+            textarea: TextArea::new(),
+            textarea_state: RefCell::new(TextAreaState::default()),
+            is_bash_mode: false,
+            pending_pastes: Vec::new(),
+            input_enabled: true,
+            input_disabled_placeholder: None,
+            paste_burst: PasteBurst::default(),
+            disable_paste_burst: false,
+            mention_bindings: HashMap::new(),
+            recent_submission_mention_bindings: Vec::new(),
+        }
+    }
+}
+
+#[derive(Clone, Debug)]
+pub(super) struct ComposerMentionBinding {
+    pub(super) mention: String,
+    pub(super) path: String,
+}
diff --git a/codex-rs/tui/src/bottom_pane/chat_composer/footer_state.rs b/codex-rs/tui/src/bottom_pane/chat_composer/footer_state.rs
new file mode 100644
index 0000000000..113385ff72
--- /dev/null
+++ b/codex-rs/tui/src/bottom_pane/chat_composer/footer_state.rs
@@ -0,0 +1,73 @@
+//! Footer and status-row presentation state for the chat composer.
+
+use std::time::Instant;
+
+use ratatui::text::Line;
+
+use crate::bottom_pane::footer::CollaborationModeIndicator;
+use crate::bottom_pane::footer::FooterMode;
+use crate::bottom_pane::footer::GoalStatusIndicator;
+use crate::key_hint::KeyBinding;
+#[cfg(test)]
+use std::time::Duration;
+
+pub(super) struct FooterState {
+    pub(super) quit_shortcut_expires_at: Option<Instant>,
+    pub(super) quit_shortcut_key: KeyBinding,
+    pub(super) esc_backtrack_hint: bool,
+    pub(super) use_shift_enter_hint: bool,
+    pub(super) mode: FooterMode,
+    pub(super) hint_override: Option<Vec<(String, String)>>,
+    pub(super) plan_mode_nudge_visible: bool,
+    pub(super) flash: Option<FooterFlash>,
+    pub(super) context_window_percent: Option<i64>,
+    pub(super) context_window_used_tokens: Option<i64>,
+    pub(super) collaboration_mode_indicator: Option<CollaborationModeIndicator>,
+    pub(super) goal_status_indicator: Option<GoalStatusIndicator>,
+    pub(super) ide_context_active: bool,
+    pub(super) status_line_value: Option<Line<'static>>,
+    pub(super) status_line_hyperlink_url: Option<String>,
+    pub(super) status_line_enabled: bool,
+    pub(super) side_conversation_context_label: Option<String>,
+    pub(super) active_agent_label: Option<String>,
+    pub(super) external_editor_key: Option<KeyBinding>,
+    pub(super) show_transcript_key: Option<KeyBinding>,
+    pub(super) insert_newline_key: Option<KeyBinding>,
+    pub(super) queue_key: Option<KeyBinding>,
+    pub(super) toggle_shortcuts_key: Option<KeyBinding>,
+    pub(super) history_search_key: Option<KeyBinding>,
+    pub(super) reasoning_down_key: Option<KeyBinding>,
+    pub(super) reasoning_up_key: Option<KeyBinding>,
+}
+
+#[derive(Clone, Debug)]
+pub(super) struct FooterFlash {
+    pub(super) line: Line<'static>,
+    pub(super) expires_at: Instant,
+}
+
+impl FooterState {
+    pub(super) fn flash_visible(&self) -> bool {
+        self.flash
+            .as_ref()
+            .is_some_and(|flash| Instant::now() < flash.expires_at)
+    }
+
+    #[cfg(test)]
+    pub(super) fn show_flash(&mut self, line: Line<'static>, duration: Duration) {
+        let expires_at = Instant::now()
+            .checked_add(duration)
+            .unwrap_or_else(Instant::now);
+        self.flash = Some(FooterFlash { line, expires_at });
+    }
+
+    #[cfg(test)]
+    pub(super) fn status_line_text(&self) -> Option<String> {
+        self.status_line_value.as_ref().map(|line| {
+            line.spans
+                .iter()
+                .map(|span| span.content.as_ref())
+                .collect::<String>()
+        })
+    }
+}
diff --git a/codex-rs/tui/src/bottom_pane/chat_composer/history_search.rs b/codex-rs/tui/src/bottom_pane/chat_composer/history_search.rs
index 20657a2540..3c2663a659 100644
--- a/codex-rs/tui/src/bottom_pane/chat_composer/history_search.rs
+++ b/codex-rs/tui/src/bottom_pane/chat_composer/history_search.rs
@@ -102,18 +102,18 @@ impl ChatComposer {
     /// from replacing an empty composer with the latest prompt before the user has searched for
     /// anything.
     pub(super) fn begin_history_search(&mut self) -> (InputResult, bool) {
-        if let Some(pasted) = self.paste_burst.flush_before_modified_input() {
+        if let Some(pasted) = self.draft.paste_burst.flush_before_modified_input() {
             self.handle_paste(pasted);
         }
-        self.paste_burst.clear_window_after_non_char();
+        self.draft.paste_burst.clear_window_after_non_char();
 
-        if self.current_file_query.is_some() {
+        if self.popups.current_file_query.is_some() {
             self.app_event_tx
                 .send(AppEvent::StartFileSearch(String::new()));
-            self.current_file_query = None;
+            self.popups.current_file_query = None;
         }
-        self.active_popup = ActivePopup::None;
-        self.selected_remote_image_index = None;
+        self.popups.active = ActivePopup::None;
+        self.attachments.clear_remote_image_selection();
         self.history_search = Some(HistorySearchSession {
             original_draft: self.snapshot_draft(),
             query: String::new(),
@@ -185,7 +185,7 @@ impl ChatComposer {
                 {
                     self.history_search = None;
                     self.history.reset_search();
-                    self.footer_mode = reset_mode_after_activity(self.footer_mode);
+                    self.footer.mode = reset_mode_after_activity(self.footer.mode);
                     self.move_cursor_to_end();
                 }
                 (InputResult::None, true)
@@ -296,7 +296,7 @@ impl ChatComposer {
             return false;
         };
         self.history.reset_navigation();
-        self.footer_mode = reset_mode_after_activity(self.footer_mode);
+        self.footer.mode = reset_mode_after_activity(self.footer.mode);
         self.restore_draft(search.original_draft);
         true
     }
@@ -385,7 +385,7 @@ impl ChatComposer {
         if !matches!(search.status, HistorySearchStatus::Match) || search.query.is_empty() {
             return Vec::new();
         }
-        Self::case_insensitive_match_ranges(self.textarea.text(), &search.query)
+        Self::case_insensitive_match_ranges(self.draft.textarea.text(), &search.query)
     }
 
     fn case_insensitive_match_ranges(text: &str, query: &str) -> Vec<Range<usize>> {
@@ -520,7 +520,7 @@ mod tests {
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Char('r'), KeyModifiers::CONTROL));
 
         assert!(composer.history_search_active());
-        assert!(composer.textarea.is_empty());
+        assert!(composer.draft.textarea.is_empty());
         assert_eq!(composer.footer_mode(), FooterMode::HistorySearch);
     }
 
@@ -558,18 +558,21 @@ mod tests {
 
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Char('r'), KeyModifiers::CONTROL));
         assert!(composer.history_search_active());
-        assert_eq!(composer.textarea.text(), "draft");
+        assert_eq!(composer.draft.textarea.text(), "draft");
 
         for ch in ['g', 'i', 't'] {
             let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Char(ch), KeyModifiers::NONE));
         }
-        assert_eq!(composer.textarea.text(), "git status");
+        assert_eq!(composer.draft.textarea.text(), "git status");
         assert_eq!(composer.footer_mode(), FooterMode::HistorySearch);
 
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Enter, KeyModifiers::NONE));
         assert!(!composer.history_search_active());
-        assert_eq!(composer.textarea.text(), "git status");
-        assert_eq!(composer.textarea.cursor(), composer.textarea.text().len());
+        assert_eq!(composer.draft.textarea.text(), "git status");
+        assert_eq!(
+            composer.draft.textarea.cursor(),
+            composer.draft.textarea.text().len()
+        );
     }
 
     #[test]
@@ -593,8 +596,8 @@ mod tests {
             let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Char(ch), KeyModifiers::NONE));
         }
 
-        assert_eq!(composer.textarea.text(), "git status");
-        assert_eq!(composer.textarea.cursor(), "git status".len() - 1);
+        assert_eq!(composer.draft.textarea.text(), "git status");
+        assert_eq!(composer.draft.textarea.cursor(), "git status".len() - 1);
         assert_eq!(composer.footer_mode(), FooterMode::HistorySearch);
     }
 
@@ -618,13 +621,19 @@ mod tests {
         for ch in ['b', 'u', 'g'] {
             let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Char(ch), KeyModifiers::NONE));
         }
-        assert_eq!(composer.textarea.text(), "Find and fix a bug in @filename");
+        assert_eq!(
+            composer.draft.textarea.text(),
+            "Find and fix a bug in @filename"
+        );
 
         for _ in 0..3 {
             let _ =
                 composer.handle_key_event(KeyEvent::new(KeyCode::Char('r'), KeyModifiers::CONTROL));
         }
-        assert_eq!(composer.textarea.text(), "Find and fix a bug in @filename");
+        assert_eq!(
+            composer.draft.textarea.text(),
+            "Find and fix a bug in @filename"
+        );
         assert!(
             composer
                 .history_search
@@ -635,7 +644,10 @@ mod tests {
         for _ in 0..3 {
             let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Down, KeyModifiers::NONE));
         }
-        assert_eq!(composer.textarea.text(), "Find and fix a bug in @filename");
+        assert_eq!(
+            composer.draft.textarea.text(),
+            "Find and fix a bug in @filename"
+        );
         assert!(
             composer
                 .history_search
@@ -776,17 +788,17 @@ mod tests {
             .history
             .record_local_submission(HistoryEntry::new("remembered command".to_string()));
         composer.set_text_content("draft".to_string(), Vec::new(), Vec::new());
-        composer.textarea.set_cursor(/*pos*/ 2);
+        composer.draft.textarea.set_cursor(/*pos*/ 2);
 
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Char('r'), KeyModifiers::CONTROL));
-        assert_eq!(composer.textarea.text(), "draft");
+        assert_eq!(composer.draft.textarea.text(), "draft");
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Char('r'), KeyModifiers::NONE));
-        assert_eq!(composer.textarea.text(), "remembered command");
+        assert_eq!(composer.draft.textarea.text(), "remembered command");
 
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Esc, KeyModifiers::NONE));
         assert!(!composer.history_search_active());
-        assert_eq!(composer.textarea.text(), "draft");
-        assert_eq!(composer.textarea.cursor(), 2);
+        assert_eq!(composer.draft.textarea.text(), "draft");
+        assert_eq!(composer.draft.textarea.cursor(), 2);
     }
 
     #[test]
@@ -805,13 +817,13 @@ mod tests {
                 .history
                 .record_local_submission(HistoryEntry::new("remembered command".to_string()));
             composer.set_text_content("draft".to_string(), Vec::new(), Vec::new());
-            composer.textarea.set_cursor(/*pos*/ 2);
+            composer.draft.textarea.set_cursor(/*pos*/ 2);
 
             let _ =
                 composer.handle_key_event(KeyEvent::new(KeyCode::Char('r'), KeyModifiers::CONTROL));
             let _ =
                 composer.handle_key_event(KeyEvent::new(KeyCode::Char('r'), KeyModifiers::NONE));
-            assert_eq!(composer.textarea.text(), "remembered command");
+            assert_eq!(composer.draft.textarea.text(), "remembered command");
             composer
         }
 
@@ -824,8 +836,8 @@ mod tests {
             let _ = composer.handle_key_event(cancel_key);
 
             assert!(!composer.history_search_active());
-            assert_eq!(composer.textarea.text(), "draft");
-            assert_eq!(composer.textarea.cursor(), 2);
+            assert_eq!(composer.draft.textarea.text(), "draft");
+            assert_eq!(composer.draft.textarea.cursor(), 2);
         }
     }
 
@@ -843,18 +855,18 @@ mod tests {
 
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Char('h'), KeyModifiers::NONE));
         assert!(composer.is_in_paste_burst());
-        assert_eq!(composer.textarea.text(), "");
+        assert_eq!(composer.draft.textarea.text(), "");
 
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Char('r'), KeyModifiers::CONTROL));
 
         assert!(composer.history_search_active());
         assert!(!composer.is_in_paste_burst());
-        assert_eq!(composer.textarea.text(), "h");
+        assert_eq!(composer.draft.textarea.text(), "h");
 
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Esc, KeyModifiers::NONE));
 
         assert!(!composer.history_search_active());
-        assert_eq!(composer.textarea.text(), "h");
+        assert_eq!(composer.draft.textarea.text(), "h");
     }
 
     #[test]
@@ -881,18 +893,18 @@ mod tests {
             now += Duration::from_millis(1);
         }
         assert!(composer.is_in_paste_burst());
-        assert_eq!(composer.textarea.text(), "");
+        assert_eq!(composer.draft.textarea.text(), "");
 
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Char('r'), KeyModifiers::CONTROL));
 
         assert!(composer.history_search_active());
         assert!(!composer.is_in_paste_burst());
-        assert_eq!(composer.textarea.text(), "paste");
+        assert_eq!(composer.draft.textarea.text(), "paste");
 
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Esc, KeyModifiers::NONE));
 
         assert!(!composer.history_search_active());
-        assert_eq!(composer.textarea.text(), "paste");
+        assert_eq!(composer.draft.textarea.text(), "paste");
     }
 
     #[test]
@@ -918,14 +930,14 @@ mod tests {
         for ch in ['m', 'a', 't', 'c', 'h'] {
             let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Char(ch), KeyModifiers::NONE));
         }
-        assert_eq!(composer.textarea.text(), "oldest matching entry");
+        assert_eq!(composer.draft.textarea.text(), "oldest matching entry");
 
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Esc, KeyModifiers::NONE));
         assert!(!composer.history_search_active());
-        assert!(composer.textarea.is_empty());
+        assert!(composer.draft.textarea.is_empty());
 
         let _ = composer.handle_key_event(KeyEvent::new(KeyCode::Up, KeyModifiers::NONE));
-        assert_eq!(composer.textarea.text(), "newest entry");
+        assert_eq!(composer.draft.textarea.text(), "newest entry");
     }
 
     #[test]
@@ -950,7 +962,7 @@ mod tests {
         }
 
         assert!(composer.history_search_active());
-        assert_eq!(composer.textarea.text(), "draft");
+        assert_eq!(composer.draft.textarea.text(), "draft");
         assert_eq!(composer.footer_mode(), FooterMode::HistorySearch);
     }
 }
diff --git a/codex-rs/tui/src/bottom_pane/chat_composer/popup_state.rs b/codex-rs/tui/src/bottom_pane/chat_composer/popup_state.rs
new file mode 100644
index 0000000000..fbc06303e5
--- /dev/null
+++ b/codex-rs/tui/src/bottom_pane/chat_composer/popup_state.rs
@@ -0,0 +1,32 @@
+//! Popup lifecycle state for the chat composer.
+//! Tracks the single active popup plus dismissal/query state used to synchronize it.
+
+use crate::bottom_pane::command_popup::CommandPopup;
+use crate::bottom_pane::file_search_popup::FileSearchPopup;
+use crate::bottom_pane::mentions_v2::MentionV2Popup;
+use crate::bottom_pane::skill_popup::SkillPopup;
+
+#[derive(Default)]
+pub(super) struct PopupState {
+    pub(super) active: ActivePopup,
+    pub(super) dismissed_file_token: Option<String>,
+    pub(super) current_file_query: Option<String>,
+    pub(super) dismissed_mention_token: Option<String>,
+}
+
+impl PopupState {
+    pub(super) fn active(&self) -> bool {
+        !matches!(self.active, ActivePopup::None)
+    }
+}
+
+/// Popup state - at most one can be visible at any time.
+#[derive(Default)]
+pub(super) enum ActivePopup {
+    #[default]
+    None,
+    Command(CommandPopup),
+    File(FileSearchPopup),
+    Skill(SkillPopup),
+    MentionV2(MentionV2Popup),
+}
diff --git a/codex-rs/tui/src/bottom_pane/command_popup.rs b/codex-rs/tui/src/bottom_pane/command_popup.rs
index 714fe9dd44..080f320f5e 100644
--- a/codex-rs/tui/src/bottom_pane/command_popup.rs
+++ b/codex-rs/tui/src/bottom_pane/command_popup.rs
@@ -419,7 +419,7 @@ mod tests {
     }
 
     #[test]
-    fn collab_command_hidden_when_collaboration_modes_disabled() {
+    fn plan_command_hidden_when_collaboration_modes_disabled() {
         let mut popup = CommandPopup::new(CommandPopupFlags::default(), Vec::new());
         popup.on_composer_text_change("/".to_string());
 
@@ -431,44 +431,12 @@ mod tests {
                 CommandItem::ServiceTier(command) => command.name,
             })
             .collect();
-        assert!(
-            !cmds.iter().any(|cmd| cmd == "collab"),
-            "expected '/collab' to be hidden when collaboration modes are disabled, got {cmds:?}"
-        );
         assert!(
             !cmds.iter().any(|cmd| cmd == "plan"),
             "expected '/plan' to be hidden when collaboration modes are disabled, got {cmds:?}"
         );
     }
 
-    #[test]
-    fn collab_command_visible_when_collaboration_modes_enabled() {
-        let mut popup = CommandPopup::new(
-            CommandPopupFlags {
-                collaboration_modes_enabled: true,
-                connectors_enabled: false,
-                plugins_command_enabled: false,
-                service_tier_commands_enabled: false,
-                goal_command_enabled: false,
-                personality_command_enabled: true,
-                realtime_conversation_enabled: false,
-                audio_device_selection_enabled: false,
-                windows_degraded_sandbox_active: false,
-                side_conversation_active: false,
-            },
-            Vec::new(),
-        );
-        popup.on_composer_text_change("/collab".to_string());
-
-        match popup.selected_item() {
-            Some(CommandItem::Builtin(cmd)) => assert_eq!(cmd.command(), "collab"),
-            Some(CommandItem::ServiceTier(command)) => {
-                panic!("expected collab command, got service tier {command:?}")
-            }
-            other => panic!("expected collab to be selected for exact match, got {other:?}"),
-        }
-    }
-
     #[test]
     fn plan_command_visible_when_collaboration_modes_enabled() {
         let mut popup = CommandPopup::new(
diff --git a/codex-rs/tui/src/bottom_pane/feedback_view.rs b/codex-rs/tui/src/bottom_pane/feedback_view.rs
index 59e30aba7b..04bcbd0b00 100644
--- a/codex-rs/tui/src/bottom_pane/feedback_view.rs
+++ b/codex-rs/tui/src/bottom_pane/feedback_view.rs
@@ -1,3 +1,4 @@
+use codex_feedback::DOCTOR_REPORT_ATTACHMENT_FILENAME;
 use codex_feedback::FEEDBACK_DIAGNOSTICS_ATTACHMENT_FILENAME;
 use codex_feedback::FeedbackDiagnostics;
 use crossterm::event::KeyCode;
@@ -502,6 +503,11 @@ pub(crate) fn feedback_upload_consent_params(
         Line::from("").into(),
         Line::from("The following files will be sent:".dim()).into(),
         Line::from(vec!["  • ".into(), "codex-logs.log".into()]).into(),
+        Line::from(vec![
+            "  • ".into(),
+            DOCTOR_REPORT_ATTACHMENT_FILENAME.into(),
+        ])
+        .into(),
     ];
     if let Some(path) = rollout_path.as_deref()
         && let Some(name) = path.file_name().map(|s| s.to_string_lossy().to_string())
@@ -538,7 +544,7 @@ pub(crate) fn feedback_upload_consent_params(
             super::SelectionItem {
                 name: "Yes".to_string(),
                 description: Some(
-                    "Share the current Codex session logs with the team for troubleshooting."
+                    "Share the current Codex session logs and diagnostics with the team for troubleshooting."
                         .to_string(),
                 ),
                 actions: vec![yes_action],
@@ -572,7 +578,18 @@ mod tests {
         let area = Rect::new(0, 0, width, height);
         let mut buf = Buffer::empty(area);
         view.render(area, &mut buf);
+        render_buffer(area, &buf)
+    }
 
+    fn render_renderable(renderable: &dyn Renderable, width: u16) -> String {
+        let height = renderable.desired_height(width);
+        let area = Rect::new(0, 0, width, height);
+        let mut buf = Buffer::empty(area);
+        renderable.render(area, &mut buf);
+        render_buffer(area, &buf)
+    }
+
+    fn render_buffer(area: Rect, buf: &Buffer) -> String {
         let mut lines: Vec<String> = (0..area.height)
             .map(|row| {
                 let mut line = String::new();
@@ -670,6 +687,23 @@ mod tests {
         insta::assert_snapshot!("feedback_view_with_connectivity_diagnostics", rendered);
     }
 
+    #[test]
+    fn feedback_upload_consent_lists_doctor_report() {
+        let (tx_raw, _rx) = tokio::sync::mpsc::unbounded_channel::<AppEvent>();
+        let tx = AppEventSender::new(tx_raw);
+        let params = feedback_upload_consent_params(
+            tx,
+            FeedbackCategory::Bug,
+            Some(std::path::PathBuf::from("rollout.jsonl")),
+            Some("auto-review-rollout.jsonl".to_string()),
+            &FeedbackDiagnostics::default(),
+        );
+
+        let rendered = render_renderable(params.header.as_ref(), /*width*/ 60);
+
+        insta::assert_snapshot!("feedback_upload_consent_lists_doctor_report", rendered);
+    }
+
     #[test]
     fn submit_feedback_emits_submit_event_with_trimmed_note() {
         let (tx_raw, mut rx) = tokio::sync::mpsc::unbounded_channel::<AppEvent>();
diff --git a/codex-rs/tui/src/bottom_pane/footer.rs b/codex-rs/tui/src/bottom_pane/footer.rs
index 0b6aabf5a9..8035881e8e 100644
--- a/codex-rs/tui/src/bottom_pane/footer.rs
+++ b/codex-rs/tui/src/bottom_pane/footer.rs
@@ -98,6 +98,8 @@ pub(crate) enum CollaborationModeIndicator {
 pub(crate) enum GoalStatusIndicator {
     Active { usage: Option<String> },
     Paused,
+    Blocked,
+    UsageLimited,
     BudgetLimited { usage: Option<String> },
     Complete { usage: Option<String> },
 }
@@ -547,6 +549,8 @@ pub(crate) fn goal_status_indicator_line(
             }
         }
         GoalStatusIndicator::Paused => "Goal paused (/goal resume)".to_string(),
+        GoalStatusIndicator::Blocked => "Goal blocked (/goal resume)".to_string(),
+        GoalStatusIndicator::UsageLimited => "Goal hit usage limits (/goal resume)".to_string(),
         GoalStatusIndicator::BudgetLimited { usage } => {
             if let Some(usage) = usage {
                 format!("Goal unmet ({usage})")
diff --git a/codex-rs/tui/src/bottom_pane/hooks_browser_view.rs b/codex-rs/tui/src/bottom_pane/hooks_browser_view.rs
index 462e9b286e..1202265aa2 100644
--- a/codex-rs/tui/src/bottom_pane/hooks_browser_view.rs
+++ b/codex-rs/tui/src/bottom_pane/hooks_browser_view.rs
@@ -736,6 +736,7 @@ fn event_label(event_name: HookEventName) -> &'static str {
         HookEventName::PostCompact => "PostCompact",
         HookEventName::SessionStart => "SessionStart",
         HookEventName::UserPromptSubmit => "UserPromptSubmit",
+        HookEventName::SubagentStart => "SubagentStart",
         HookEventName::Stop => "Stop",
     }
 }
@@ -749,6 +750,7 @@ fn event_description(event_name: HookEventName) -> &'static str {
         HookEventName::PostCompact => "After context compaction",
         HookEventName::SessionStart => "When a new session starts",
         HookEventName::UserPromptSubmit => "When the user submits a prompt",
+        HookEventName::SubagentStart => "When a subagent is created",
         HookEventName::Stop => "Right before Codex ends its turn",
     }
 }
diff --git a/codex-rs/tui/src/bottom_pane/mod.rs b/codex-rs/tui/src/bottom_pane/mod.rs
index 3faea3f81c..5aeb2a4cfd 100644
--- a/codex-rs/tui/src/bottom_pane/mod.rs
+++ b/codex-rs/tui/src/bottom_pane/mod.rs
@@ -711,7 +711,6 @@ impl BottomPane {
             if has_pasted_text {
                 self.record_composer_activity_at(Instant::now());
             }
-            self.composer.sync_popups();
             if needs_redraw {
                 self.request_redraw();
             }
@@ -720,7 +719,6 @@ impl BottomPane {
 
     pub(crate) fn insert_str(&mut self, text: &str) {
         self.composer.insert_str(text);
-        self.composer.sync_popups();
         self.request_redraw();
     }
 
@@ -791,6 +789,12 @@ impl BottomPane {
         self.request_redraw();
     }
 
+    pub(crate) fn show_shutdown_in_progress(&mut self) {
+        self.view_stack.clear();
+        self.composer.show_shutdown_in_progress();
+        self.request_redraw();
+    }
+
     pub(crate) fn clear_composer_for_ctrl_c(&mut self) {
         if let Some(text) = self.composer.clear_for_ctrl_c() {
             if let Some(thread_id) = self.thread_id {
@@ -810,18 +814,20 @@ impl BottomPane {
         self.composer.current_text()
     }
 
+    pub(crate) fn composer_draft_snapshot(&self) -> chat_composer::ComposerDraftSnapshot {
+        self.composer.draft_snapshot()
+    }
+
+    #[cfg(test)]
     pub(crate) fn composer_text_elements(&self) -> Vec<TextElement> {
         self.composer.text_elements()
     }
 
+    #[cfg(test)]
     pub(crate) fn composer_local_images(&self) -> Vec<LocalImageAttachment> {
         self.composer.local_images()
     }
 
-    pub(crate) fn composer_mention_bindings(&self) -> Vec<MentionBinding> {
-        self.composer.mention_bindings()
-    }
-
     #[cfg(test)]
     pub(crate) fn composer_local_image_paths(&self) -> Vec<PathBuf> {
         self.composer.local_image_paths()
@@ -867,6 +873,7 @@ impl BottomPane {
         self.request_redraw();
     }
 
+    #[cfg(test)]
     pub(crate) fn remote_image_urls(&self) -> Vec<String> {
         self.composer.remote_image_urls()
     }
@@ -1308,7 +1315,7 @@ impl BottomPane {
             self.has_input_focus,
             self.enhanced_keys_supported,
             self.disable_paste_burst,
-            self.keymap.list.clone(),
+            self.keymap.clone(),
         );
         self.pause_status_timer_for_modal();
         self.set_composer_input_enabled(
diff --git a/codex-rs/tui/src/bottom_pane/request_user_input/mod.rs b/codex-rs/tui/src/bottom_pane/request_user_input/mod.rs
index 68c6755e45..13cbc34daa 100644
--- a/codex-rs/tui/src/bottom_pane/request_user_input/mod.rs
+++ b/codex-rs/tui/src/bottom_pane/request_user_input/mod.rs
@@ -4,7 +4,7 @@
 //! - Each question can be answered by selecting one option and/or providing notes.
 //! - Notes are stored per question and appended as extra answers.
 //! - Typing while focused on options jumps into notes to keep freeform input fast.
-//! - Enter advances to the next question; the last question submits all answers.
+//! - The composer submit binding advances to the next question; the last question submits all answers.
 //! - Freeform-only questions submit an empty answer list when empty.
 use std::collections::HashMap;
 use std::collections::VecDeque;
@@ -29,8 +29,10 @@ use crate::bottom_pane::scroll_state::ScrollState;
 use crate::bottom_pane::selection_popup_common::GenericDisplayRow;
 use crate::bottom_pane::selection_popup_common::measure_rows_height;
 use crate::history_cell;
+use crate::key_hint::KeyBinding;
 use crate::key_hint::KeyBindingListExt;
 use crate::keymap::ListKeymap;
+use crate::keymap::RuntimeKeymap;
 use crate::render::renderable::Renderable;
 
 #[cfg(test)]
@@ -140,6 +142,7 @@ pub(crate) struct RequestUserInputOverlay {
     done: bool,
     pending_submission_draft: Option<ComposerDraft>,
     confirm_unanswered: Option<ScrollState>,
+    composer_submit_keys: Vec<KeyBinding>,
     list_keymap: ListKeymap,
 }
 
@@ -158,7 +161,7 @@ impl RequestUserInputOverlay {
             has_input_focus,
             enhanced_keys_supported,
             disable_paste_burst,
-            crate::keymap::RuntimeKeymap::defaults().list,
+            RuntimeKeymap::defaults(),
         )
     }
 
@@ -168,7 +171,7 @@ impl RequestUserInputOverlay {
         has_input_focus: bool,
         enhanced_keys_supported: bool,
         disable_paste_burst: bool,
-        list_keymap: ListKeymap,
+        keymap: RuntimeKeymap,
     ) -> Self {
         // Use the same composer widget, but disable popups/slash-commands and
         // image-path attachment so it behaves like a focused notes field.
@@ -180,6 +183,7 @@ impl RequestUserInputOverlay {
             disable_paste_burst,
             ChatComposerConfig::plain_text(),
         );
+        composer.set_keymap_bindings(&keymap);
         // The overlay renders its own footer hints, so keep the composer footer empty.
         composer.set_footer_hint_override(Some(Vec::new()));
         let mut overlay = Self {
@@ -193,7 +197,8 @@ impl RequestUserInputOverlay {
             done: false,
             pending_submission_draft: None,
             confirm_unanswered: None,
-            list_keymap,
+            composer_submit_keys: keymap.composer.submit.clone(),
+            list_keymap: keymap.list,
         };
         overlay.reset_for_request();
         overlay.ensure_focus_available();
@@ -477,14 +482,23 @@ impl RequestUserInputOverlay {
 
         let question_count = self.question_count();
         let is_last_question = self.current_index().saturating_add(1) >= question_count;
-        let enter_tip = if question_count == 1 {
-            FooterTip::highlighted("enter to submit answer")
-        } else if is_last_question {
-            FooterTip::highlighted("enter to submit all")
+        let submit_key = if self.focus_is_notes() || !self.has_options() {
+            self.composer_submit_keys
+                .first()
+                .map(KeyBinding::display_label)
         } else {
-            FooterTip::new("enter to submit answer")
+            Some("enter".to_string())
         };
-        tips.push(enter_tip);
+        if let Some(submit_key) = submit_key {
+            let submit_tip = if question_count == 1 {
+                FooterTip::highlighted(format!("{submit_key} to submit answer"))
+            } else if is_last_question {
+                FooterTip::highlighted(format!("{submit_key} to submit all"))
+            } else {
+                FooterTip::new(format!("{submit_key} to submit answer"))
+            };
+            tips.push(submit_tip);
+        }
         if question_count > 1 {
             if self.has_options() && !self.focus_is_notes() {
                 tips.push(FooterTip::new("←/→ to navigate questions"));
@@ -1054,6 +1068,20 @@ impl BottomPaneView for RequestUserInputOverlay {
             return;
         }
 
+        if self.focus_is_notes() && self.composer_submit_keys.is_pressed(key_event) {
+            self.ensure_selected_for_notes();
+            self.pending_submission_draft = Some(self.capture_composer_draft());
+            let (result, _) = self.composer.handle_key_event(key_event);
+            if !self.handle_composer_input_result(result) {
+                self.pending_submission_draft = None;
+                if self.has_options() {
+                    self.select_current_option(/*committed*/ true);
+                }
+                self.go_next_or_submit();
+            }
+            return;
+        }
+
         // Question navigation is always available.
         match key_event {
             KeyEvent {
@@ -1201,19 +1229,6 @@ impl BottomPaneView for RequestUserInputOverlay {
                     self.sync_composer_placeholder();
                     return;
                 }
-                if matches!(key_event.code, KeyCode::Enter) {
-                    self.ensure_selected_for_notes();
-                    self.pending_submission_draft = Some(self.capture_composer_draft());
-                    let (result, _) = self.composer.handle_key_event(key_event);
-                    if !self.handle_composer_input_result(result) {
-                        self.pending_submission_draft = None;
-                        if self.has_options() {
-                            self.select_current_option(/*committed*/ true);
-                        }
-                        self.go_next_or_submit();
-                    }
-                    return;
-                }
                 if self.has_options() && matches!(key_event.code, KeyCode::Up | KeyCode::Down) {
                     let options_len = self.options_len();
                     match key_event.code {
@@ -2008,6 +2023,28 @@ mod tests {
         );
     }
 
+    #[test]
+    fn freeform_footer_shows_configured_submit_binding() {
+        let (tx, _rx) = test_sender();
+        let mut keymap = RuntimeKeymap::defaults();
+        keymap.composer.submit = vec![crate::key_hint::ctrl(KeyCode::Char('j'))];
+        let overlay = RequestUserInputOverlay::new_with_keymap(
+            request_event("turn-1", vec![question_without_options("q1", "Notes")]),
+            tx,
+            /*has_input_focus*/ true,
+            /*enhanced_keys_supported*/ false,
+            /*disable_paste_burst*/ false,
+            keymap,
+        );
+
+        let tips = overlay.footer_tips();
+        let tip_texts = tips.iter().map(|tip| tip.text.as_str()).collect::<Vec<_>>();
+        assert_eq!(
+            tip_texts,
+            vec!["ctrl + j to submit answer", "esc to interrupt"]
+        );
+    }
+
     #[test]
     fn tab_opens_notes_when_option_selected() {
         let (tx, _rx) = test_sender();
@@ -2374,6 +2411,97 @@ mod tests {
         assert_eq!(overlay.unanswered_count(), 2);
     }
 
+    #[test]
+    fn freeform_shift_enter_inserts_newline_without_advancing() {
+        let (tx, _rx) = test_sender();
+        let mut overlay = RequestUserInputOverlay::new(
+            request_event(
+                "turn-1",
+                vec![
+                    question_without_options("q1", "Notes"),
+                    question_without_options("q2", "More"),
+                ],
+            ),
+            tx,
+            /*has_input_focus*/ true,
+            /*enhanced_keys_supported*/ true,
+            /*disable_paste_burst*/ false,
+        );
+
+        overlay
+            .composer
+            .set_text_content("Draft".to_string(), Vec::new(), Vec::new());
+        overlay.composer.move_cursor_to_end();
+
+        overlay.handle_key_event(KeyEvent::new(KeyCode::Enter, KeyModifiers::SHIFT));
+
+        assert_eq!(overlay.current_index(), 0);
+        assert_eq!(overlay.composer.current_text_with_pending(), "Draft\n");
+        assert_eq!(overlay.answers[0].answer_committed, false);
+    }
+
+    #[test]
+    fn freeform_uses_configured_composer_submit_binding() {
+        let (tx, _rx) = test_sender();
+        let mut keymap = RuntimeKeymap::defaults();
+        keymap.composer.submit = vec![crate::key_hint::ctrl(KeyCode::Char('j'))];
+        let mut overlay = RequestUserInputOverlay::new_with_keymap(
+            request_event(
+                "turn-1",
+                vec![
+                    question_without_options("q1", "Notes"),
+                    question_without_options("q2", "More"),
+                ],
+            ),
+            tx,
+            /*has_input_focus*/ true,
+            /*enhanced_keys_supported*/ false,
+            /*disable_paste_burst*/ false,
+            keymap,
+        );
+
+        overlay
+            .composer
+            .set_text_content("Draft".to_string(), Vec::new(), Vec::new());
+        overlay.composer.move_cursor_to_end();
+
+        overlay.handle_key_event(KeyEvent::new(KeyCode::Char('j'), KeyModifiers::CONTROL));
+
+        assert_eq!(overlay.current_index(), 1);
+        assert_eq!(overlay.answers[0].answer_committed, true);
+    }
+
+    #[test]
+    fn freeform_submit_binding_wins_over_question_navigation() {
+        let (tx, _rx) = test_sender();
+        let mut keymap = RuntimeKeymap::defaults();
+        keymap.composer.submit = vec![crate::key_hint::ctrl(KeyCode::Char('n'))];
+        let mut overlay = RequestUserInputOverlay::new_with_keymap(
+            request_event(
+                "turn-1",
+                vec![
+                    question_without_options("q1", "Notes"),
+                    question_without_options("q2", "More"),
+                ],
+            ),
+            tx,
+            /*has_input_focus*/ true,
+            /*enhanced_keys_supported*/ false,
+            /*disable_paste_burst*/ false,
+            keymap,
+        );
+
+        overlay
+            .composer
+            .set_text_content("Draft".to_string(), Vec::new(), Vec::new());
+        overlay.composer.move_cursor_to_end();
+
+        overlay.handle_key_event(KeyEvent::new(KeyCode::Char('n'), KeyModifiers::CONTROL));
+
+        assert_eq!(overlay.current_index(), 1);
+        assert_eq!(overlay.answers[0].answer_committed, true);
+    }
+
     #[test]
     fn freeform_questions_submit_empty_when_empty() {
         let (tx, mut rx) = test_sender();
@@ -3025,6 +3153,26 @@ mod tests {
         );
     }
 
+    #[test]
+    fn request_user_input_freeform_remapped_submit_snapshot() {
+        let (tx, _rx) = test_sender();
+        let mut keymap = RuntimeKeymap::defaults();
+        keymap.composer.submit = vec![crate::key_hint::ctrl(KeyCode::Char('j'))];
+        let overlay = RequestUserInputOverlay::new_with_keymap(
+            request_event("turn-1", vec![question_without_options("q1", "Goal")]),
+            tx,
+            /*has_input_focus*/ true,
+            /*enhanced_keys_supported*/ false,
+            /*disable_paste_burst*/ false,
+            keymap,
+        );
+        let area = Rect::new(0, 0, 120, 10);
+        insta::assert_snapshot!(
+            "request_user_input_freeform_remapped_submit",
+            render_snapshot(&overlay, area)
+        );
+    }
+
     #[test]
     fn request_user_input_multi_question_first_snapshot() {
         let (tx, _rx) = test_sender();
diff --git a/codex-rs/tui/src/bottom_pane/request_user_input/snapshots/codex_tui__bottom_pane__request_user_input__tests__request_user_input_freeform_remapped_submit.snap b/codex-rs/tui/src/bottom_pane/request_user_input/snapshots/codex_tui__bottom_pane__request_user_input__tests__request_user_input_freeform_remapped_submit.snap
new file mode 100644
index 0000000000..a2aeaa4d3e
--- /dev/null
+++ b/codex-rs/tui/src/bottom_pane/request_user_input/snapshots/codex_tui__bottom_pane__request_user_input__tests__request_user_input_freeform_remapped_submit.snap
@@ -0,0 +1,13 @@
+---
+source: tui/src/bottom_pane/request_user_input/mod.rs
+expression: "render_snapshot(&overlay, area)"
+---
+                                                                                                                        
+  Question 1/1 (1 unanswered)                                                                                           
+  Share details.                                                                                                        
+                                                                                                                        
+  › Type your answer (optional)                                                                                         
+                                                                                                                        
+                                                                                                                        
+                                                                                                                        
+  ctrl + j to submit answer | esc to interrupt
diff --git a/codex-rs/tui/src/bottom_pane/slash_commands.rs b/codex-rs/tui/src/bottom_pane/slash_commands.rs
index 6966b28b81..e907b6c5e5 100644
--- a/codex-rs/tui/src/bottom_pane/slash_commands.rs
+++ b/codex-rs/tui/src/bottom_pane/slash_commands.rs
@@ -72,10 +72,7 @@ pub(crate) fn builtins_for_input(flags: BuiltinCommandFlags) -> Vec<(&'static st
     built_in_slash_commands()
         .into_iter()
         .filter(|(_, cmd)| flags.allow_elevate_sandbox || *cmd != SlashCommand::ElevateSandbox)
-        .filter(|(_, cmd)| {
-            flags.collaboration_modes_enabled
-                || !matches!(*cmd, SlashCommand::Collab | SlashCommand::Plan)
-        })
+        .filter(|(_, cmd)| flags.collaboration_modes_enabled || *cmd != SlashCommand::Plan)
         .filter(|(_, cmd)| flags.connectors_enabled || *cmd != SlashCommand::Apps)
         .filter(|(_, cmd)| flags.plugins_command_enabled || *cmd != SlashCommand::Plugins)
         .filter(|(_, cmd)| flags.goal_command_enabled || *cmd != SlashCommand::Goal)
diff --git a/codex-rs/tui/src/bottom_pane/snapshots/codex_tui__bottom_pane__chat_composer__tests__shutdown_in_progress.snap b/codex-rs/tui/src/bottom_pane/snapshots/codex_tui__bottom_pane__chat_composer__tests__shutdown_in_progress.snap
new file mode 100644
index 0000000000..15703f0ade
--- /dev/null
+++ b/codex-rs/tui/src/bottom_pane/snapshots/codex_tui__bottom_pane__chat_composer__tests__shutdown_in_progress.snap
@@ -0,0 +1,9 @@
+---
+source: tui/src/bottom_pane/chat_composer.rs
+expression: terminal.backend()
+---
+"                                        "
+"› Shutting down...                      "
+"                                        "
+"                                        "
+"                                        "
diff --git a/codex-rs/tui/src/bottom_pane/snapshots/codex_tui__bottom_pane__feedback_view__tests__feedback_upload_consent_lists_doctor_report.snap b/codex-rs/tui/src/bottom_pane/snapshots/codex_tui__bottom_pane__feedback_view__tests__feedback_upload_consent_lists_doctor_report.snap
new file mode 100644
index 0000000000..6cca54542d
--- /dev/null
+++ b/codex-rs/tui/src/bottom_pane/snapshots/codex_tui__bottom_pane__feedback_view__tests__feedback_upload_consent_lists_doctor_report.snap
@@ -0,0 +1,12 @@
+---
+source: tui/src/bottom_pane/feedback_view.rs
+assertion_line: 704
+expression: rendered
+---
+Upload logs?
+
+The following files will be sent:
+  • codex-logs.log
+  • codex-doctor-report.json
+  • rollout.jsonl
+  • auto-review-rollout.jsonl
diff --git a/codex-rs/tui/src/bottom_pane/snapshots/codex_tui__bottom_pane__feedback_view__tests__feedback_view_render.snap b/codex-rs/tui/src/bottom_pane/snapshots/codex_tui__bottom_pane__feedback_view__tests__feedback_view_render.snap
index bafa94b09d..98fabc8444 100644
--- a/codex-rs/tui/src/bottom_pane/snapshots/codex_tui__bottom_pane__feedback_view__tests__feedback_view_render.snap
+++ b/codex-rs/tui/src/bottom_pane/snapshots/codex_tui__bottom_pane__feedback_view__tests__feedback_view_render.snap
@@ -11,7 +11,7 @@ expression: rendered
   <LOG_PATH>
 
 
-› 1. Yes     Share the current Codex session logs with the team for
-             troubleshooting.
+› 1. Yes     Share the current Codex session logs and diagnostics with the team
+             for troubleshooting.
   2. No
   3. Cancel
diff --git a/codex-rs/tui/src/bottom_pane/snapshots/codex_tui__bottom_pane__hooks_browser_view__tests__hooks_browser_events.snap b/codex-rs/tui/src/bottom_pane/snapshots/codex_tui__bottom_pane__hooks_browser_view__tests__hooks_browser_events.snap
index 34c1d8ceec..836a65c3f1 100644
--- a/codex-rs/tui/src/bottom_pane/snapshots/codex_tui__bottom_pane__hooks_browser_view__tests__hooks_browser_events.snap
+++ b/codex-rs/tui/src/bottom_pane/snapshots/codex_tui__bottom_pane__hooks_browser_view__tests__hooks_browser_events.snap
@@ -14,6 +14,7 @@ expression: "render_lines(&view, 112)"
   PostCompact           0           0           After context compaction                                        
   SessionStart          0           0           When a new session starts                                       
   UserPromptSubmit      0           0           When the user submits a prompt                                  
+  SubagentStart         0           0           When a subagent is created                                      
   Stop                  0           0           Right before Codex ends its turn                                
                                                                                                                 
   Press enter to view hooks; esc to close
diff --git a/codex-rs/tui/src/bottom_pane/snapshots/codex_tui__bottom_pane__hooks_browser_view__tests__hooks_browser_events_with_issues.snap b/codex-rs/tui/src/bottom_pane/snapshots/codex_tui__bottom_pane__hooks_browser_view__tests__hooks_browser_events_with_issues.snap
index 511f173813..fabd9c1707 100644
--- a/codex-rs/tui/src/bottom_pane/snapshots/codex_tui__bottom_pane__hooks_browser_view__tests__hooks_browser_events_with_issues.snap
+++ b/codex-rs/tui/src/bottom_pane/snapshots/codex_tui__bottom_pane__hooks_browser_view__tests__hooks_browser_events_with_issues.snap
@@ -18,6 +18,7 @@ expression: "render_lines(&view, 112)"
   PostCompact           0           0           After context compaction                                        
   SessionStart          0           0           When a new session starts                                       
   UserPromptSubmit      0           0           When the user submits a prompt                                  
+  SubagentStart         0           0           When a subagent is created                                      
   Stop                  0           0           Right before Codex ends its turn                                
                                                                                                                 
   Press enter to view hooks; esc to close
diff --git a/codex-rs/tui/src/bottom_pane/snapshots/codex_tui__bottom_pane__hooks_browser_view__tests__hooks_browser_events_with_review_column.snap b/codex-rs/tui/src/bottom_pane/snapshots/codex_tui__bottom_pane__hooks_browser_view__tests__hooks_browser_events_with_review_column.snap
index 07a39ebc9c..dd4e5e33b5 100644
--- a/codex-rs/tui/src/bottom_pane/snapshots/codex_tui__bottom_pane__hooks_browser_view__tests__hooks_browser_events_with_review_column.snap
+++ b/codex-rs/tui/src/bottom_pane/snapshots/codex_tui__bottom_pane__hooks_browser_view__tests__hooks_browser_events_with_review_column.snap
@@ -16,6 +16,7 @@ expression: "render_lines(&view, 112)"
   PostCompact           0           0           0           After context compaction                            
   SessionStart          0           0           0           When a new session starts                           
   UserPromptSubmit      0           0           0           When the user submits a prompt                      
+  SubagentStart         0           0           0           When a subagent is created                          
   Stop                  0           0           0           Right before Codex ends its turn                    
                                                                                                                 
   Press t to trust all; enter to review hooks; esc to close
diff --git a/codex-rs/tui/src/bottom_pane/status_line_setup.rs b/codex-rs/tui/src/bottom_pane/status_line_setup.rs
index 5ce13cd214..a44919c216 100644
--- a/codex-rs/tui/src/bottom_pane/status_line_setup.rs
+++ b/codex-rs/tui/src/bottom_pane/status_line_setup.rs
@@ -15,7 +15,7 @@
 //! - Permissions profile
 //! - Approval mode
 //! - Context usage (remaining %, used %, window size)
-//! - Usage limits (5-hour, weekly)
+//! - Usage limits (primary, secondary)
 //! - Session info (thread title, thread ID, tokens used)
 //! - Application version
 
@@ -100,10 +100,10 @@ pub(crate) enum StatusLineItem {
     #[strum(to_string = "context-used", serialize = "context-usage")]
     ContextUsed,
 
-    /// Remaining usage on the 5-hour rate limit.
+    /// Remaining usage on the primary rate limit.
     FiveHourLimit,
 
-    /// Remaining usage on the weekly rate limit.
+    /// Remaining usage on the secondary rate limit.
     WeeklyLimit,
 
     /// Codex application version.
@@ -163,10 +163,10 @@ impl StatusLineItem {
                 "Percentage of context window used (omitted when unknown)"
             }
             StatusLineItem::FiveHourLimit => {
-                "Remaining usage on 5-hour usage limit (omitted when unavailable)"
+                "Remaining usage on the primary usage limit (omitted when unavailable)"
             }
             StatusLineItem::WeeklyLimit => {
-                "Remaining usage on weekly usage limit (omitted when unavailable)"
+                "Remaining usage on the secondary usage limit (omitted when unavailable)"
             }
             StatusLineItem::CodexVersion => "Codex application version",
             StatusLineItem::ContextWindowSize => {
@@ -268,7 +268,11 @@ impl StatusLineSetupView {
                 if !used_ids.insert(item_id.clone()) {
                     continue;
                 }
-                items.push(Self::status_line_select_item(item, /*enabled*/ true));
+                items.push(Self::status_line_select_item(
+                    item,
+                    /*enabled*/ true,
+                    &preview_data,
+                ));
             }
         }
 
@@ -277,7 +281,11 @@ impl StatusLineSetupView {
             if used_ids.contains(&item_id) {
                 continue;
             }
-            items.push(Self::status_line_select_item(item, /*enabled*/ false));
+            items.push(Self::status_line_select_item(
+                item,
+                /*enabled*/ false,
+                &preview_data,
+            ));
         }
 
         Self {
@@ -324,11 +332,25 @@ impl StatusLineSetupView {
     }
 
     /// Converts a [`StatusLineItem`] into a [`MultiSelectItem`] for the picker.
-    fn status_line_select_item(item: StatusLineItem, enabled: bool) -> MultiSelectItem {
+    fn status_line_select_item(
+        item: StatusLineItem,
+        enabled: bool,
+        preview_data: &StatusSurfacePreviewData,
+    ) -> MultiSelectItem {
+        let default_name = item.to_string();
+        let default_description = item.description();
+        let (name, description) = match item {
+            StatusLineItem::FiveHourLimit | StatusLineItem::WeeklyLimit => (
+                preview_data.rate_limit_item_name(item.preview_item(), &default_name),
+                preview_data.rate_limit_item_description(item.preview_item(), default_description),
+            ),
+            _ => (default_name, default_description.to_string()),
+        };
+
         MultiSelectItem {
             id: item.to_string(),
-            name: item.to_string(),
-            description: Some(item.description().to_string()),
+            name,
+            description: Some(description),
             enabled,
             orderable: true,
             section_break_after: false,
diff --git a/codex-rs/tui/src/bottom_pane/status_surface_preview.rs b/codex-rs/tui/src/bottom_pane/status_surface_preview.rs
index 9f0f8ed5fb..71353c298a 100644
--- a/codex-rs/tui/src/bottom_pane/status_surface_preview.rs
+++ b/codex-rs/tui/src/bottom_pane/status_surface_preview.rs
@@ -51,8 +51,8 @@ impl StatusSurfacePreviewItem {
             StatusSurfacePreviewItem::ApprovalMode => "on-request",
             StatusSurfacePreviewItem::ContextRemaining => "Context 0% left",
             StatusSurfacePreviewItem::ContextUsed => "Context 0% used",
-            StatusSurfacePreviewItem::FiveHourLimit => "5h 0%",
-            StatusSurfacePreviewItem::WeeklyLimit => "weekly 0%",
+            StatusSurfacePreviewItem::FiveHourLimit => "primary 0%",
+            StatusSurfacePreviewItem::WeeklyLimit => "secondary 0%",
             StatusSurfacePreviewItem::CodexVersion => "0.0.0",
             StatusSurfacePreviewItem::ContextWindowSize => "0 window",
             StatusSurfacePreviewItem::UsedTokens => "0 used",
@@ -169,10 +169,49 @@ impl StatusSurfacePreviewData {
         );
     }
 
+    pub(crate) fn suppress_placeholder(&mut self, item: StatusSurfacePreviewItem) {
+        if self
+            .values
+            .get(&item)
+            .is_some_and(|value| value.is_placeholder)
+        {
+            self.values.remove(&item);
+        }
+    }
+
+    pub(crate) fn rate_limit_item_name(
+        &self,
+        item: StatusSurfacePreviewItem,
+        fallback: &str,
+    ) -> String {
+        self.live_value_for(item)
+            .and_then(rate_limit_preview_copy)
+            .map(|copy| copy.name.to_string())
+            .unwrap_or_else(|| fallback.to_string())
+    }
+
+    pub(crate) fn rate_limit_item_description(
+        &self,
+        item: StatusSurfacePreviewItem,
+        fallback: &str,
+    ) -> String {
+        self.live_value_for(item)
+            .and_then(rate_limit_preview_copy)
+            .map(|copy| copy.description.to_string())
+            .unwrap_or_else(|| fallback.to_string())
+    }
+
     pub(crate) fn value_for(&self, item: StatusSurfacePreviewItem) -> Option<&str> {
         self.values.get(&item).map(|value| value.text.as_str())
     }
 
+    fn live_value_for(&self, item: StatusSurfacePreviewItem) -> Option<&str> {
+        self.values
+            .get(&item)
+            .filter(|value| !value.is_placeholder)
+            .map(|value| value.text.as_str())
+    }
+
     pub(crate) fn status_line_for_items<I>(
         &self,
         items: I,
@@ -188,3 +227,50 @@ impl StatusSurfacePreviewData {
         status_line_from_segments(segments, use_theme_colors)
     }
 }
+
+struct RateLimitPreviewCopy {
+    name: &'static str,
+    description: &'static str,
+}
+
+fn rate_limit_preview_copy(value: &str) -> Option<RateLimitPreviewCopy> {
+    let value = value.trim_start();
+    if value.starts_with("secondary usage ") {
+        Some(RateLimitPreviewCopy {
+            name: "secondary-usage-limit",
+            description: "Remaining usage on the secondary usage limit (omitted when unavailable)",
+        })
+    } else if value.starts_with("usage ") {
+        Some(RateLimitPreviewCopy {
+            name: "usage-limit",
+            description: "Remaining usage on the primary usage limit (omitted when unavailable)",
+        })
+    } else if value.starts_with("5h ") {
+        Some(RateLimitPreviewCopy {
+            name: "five-hour-limit",
+            description: "Remaining usage on the 5-hour usage limit (omitted when unavailable)",
+        })
+    } else if value.starts_with("daily ") {
+        Some(RateLimitPreviewCopy {
+            name: "daily-limit",
+            description: "Remaining usage on the daily usage limit (omitted when unavailable)",
+        })
+    } else if value.starts_with("weekly ") {
+        Some(RateLimitPreviewCopy {
+            name: "weekly-limit",
+            description: "Remaining usage on the weekly usage limit (omitted when unavailable)",
+        })
+    } else if value.starts_with("monthly ") {
+        Some(RateLimitPreviewCopy {
+            name: "monthly-limit",
+            description: "Remaining usage on the monthly usage limit (omitted when unavailable)",
+        })
+    } else if value.starts_with("annual ") {
+        Some(RateLimitPreviewCopy {
+            name: "annual-limit",
+            description: "Remaining usage on the annual usage limit (omitted when unavailable)",
+        })
+    } else {
+        None
+    }
+}
diff --git a/codex-rs/tui/src/bottom_pane/title_setup.rs b/codex-rs/tui/src/bottom_pane/title_setup.rs
index f37991bc00..b9ab39054e 100644
--- a/codex-rs/tui/src/bottom_pane/title_setup.rs
+++ b/codex-rs/tui/src/bottom_pane/title_setup.rs
@@ -60,9 +60,9 @@ pub(crate) enum TerminalTitleItem {
     /// Percentage of context window used.
     #[strum(to_string = "context-used", serialize = "context-usage")]
     ContextUsed,
-    /// Remaining usage on the 5-hour rate limit.
+    /// Remaining usage on the primary rate limit.
     FiveHourLimit,
-    /// Remaining usage on the weekly rate limit.
+    /// Remaining usage on the secondary rate limit.
     WeeklyLimit,
     /// Codex application version.
     CodexVersion,
@@ -107,10 +107,10 @@ impl TerminalTitleItem {
                 "Percentage of context window used (omitted when unknown)"
             }
             TerminalTitleItem::FiveHourLimit => {
-                "Remaining usage on 5-hour usage limit (omitted when unavailable)"
+                "Remaining usage on the primary usage limit (omitted when unavailable)"
             }
             TerminalTitleItem::WeeklyLimit => {
-                "Remaining usage on weekly usage limit (omitted when unavailable)"
+                "Remaining usage on the secondary usage limit (omitted when unavailable)"
             }
             TerminalTitleItem::CodexVersion => "Codex application version",
             TerminalTitleItem::UsedTokens => "Total tokens used in session (omitted when zero)",
@@ -259,11 +259,13 @@ impl TerminalTitleSetupView {
             .collect::<std::collections::HashSet<_>>();
         let items = selected_items
             .into_iter()
-            .map(|item| Self::title_select_item(item, /*enabled*/ true))
+            .map(|item| Self::title_select_item(item, /*enabled*/ true, &preview_data))
             .chain(
                 TerminalTitleItem::iter()
                     .filter(|item| !selected_set.contains(item))
-                    .map(|item| Self::title_select_item(item, /*enabled*/ false)),
+                    .map(|item| {
+                        Self::title_select_item(item, /*enabled*/ false, &preview_data)
+                    }),
             )
             .collect();
 
@@ -309,11 +311,28 @@ impl TerminalTitleSetupView {
         }
     }
 
-    fn title_select_item(item: TerminalTitleItem, enabled: bool) -> MultiSelectItem {
+    fn title_select_item(
+        item: TerminalTitleItem,
+        enabled: bool,
+        preview_data: &StatusSurfacePreviewData,
+    ) -> MultiSelectItem {
+        let default_name = item.to_string();
+        let default_description = item.description();
+        let (name, description) = match item.preview_item() {
+            Some(
+                preview_item @ (StatusSurfacePreviewItem::FiveHourLimit
+                | StatusSurfacePreviewItem::WeeklyLimit),
+            ) => (
+                preview_data.rate_limit_item_name(preview_item, &default_name),
+                preview_data.rate_limit_item_description(preview_item, default_description),
+            ),
+            _ => (default_name, default_description.to_string()),
+        };
+
         MultiSelectItem {
             id: item.to_string(),
-            name: item.to_string(),
-            description: Some(item.description().to_string()),
+            name,
+            description: Some(description),
             enabled,
             orderable: true,
             section_break_after: false,
diff --git a/codex-rs/tui/src/chatwidget.rs b/codex-rs/tui/src/chatwidget.rs
index 6723577754..240b72ab9d 100644
--- a/codex-rs/tui/src/chatwidget.rs
+++ b/codex-rs/tui/src/chatwidget.rs
@@ -61,6 +61,7 @@ use crate::legacy_core::DEFAULT_AGENTS_MD_FILENAME;
 use crate::legacy_core::config::Config;
 use crate::legacy_core::config::Constrained;
 use crate::legacy_core::config::ConstraintResult;
+use crate::legacy_core::config::PermissionProfileSnapshot;
 #[cfg(target_os = "windows")]
 use crate::legacy_core::windows_sandbox::WindowsSandboxLevelExt;
 use crate::mention_codec::LinkedMention;
@@ -127,7 +128,6 @@ use codex_config::types::ApprovalsReviewer;
 use codex_config::types::Notifications;
 use codex_config::types::WindowsSandboxModeToml;
 use codex_core_skills::model::SkillMetadata;
-use codex_exec_server::EnvironmentManager;
 use codex_features::FEATURES;
 use codex_features::Feature;
 #[cfg(test)]
@@ -165,6 +165,7 @@ use codex_terminal_detection::TerminalInfo;
 use codex_terminal_detection::TerminalName;
 use codex_terminal_detection::terminal_info;
 use codex_utils_absolute_path::AbsolutePathBuf;
+use codex_utils_cli::resume_hint;
 use crossterm::event::KeyCode;
 use crossterm::event::KeyEvent;
 use crossterm::event::KeyEventKind;
@@ -252,7 +253,6 @@ fn queued_message_edit_hint_binding(
 }
 
 use crate::app_event::AppEvent;
-use crate::app_event::ConnectorsSnapshot;
 use crate::app_event::ExitMode;
 use crate::app_event::RateLimitRefreshOrigin;
 #[cfg(target_os = "windows")]
@@ -318,7 +318,7 @@ use crate::text_formatting::truncate_text;
 use crate::tui::FrameRequester;
 mod command_lifecycle;
 mod connectors;
-use self::connectors::ConnectorsCacheState;
+mod constructor;
 use self::connectors::ConnectorsState;
 mod exec_state;
 use self::exec_state::RunningCommand;
@@ -347,10 +347,12 @@ mod keymap_picker;
 mod mcp_startup;
 use self::mcp_startup::McpStartupStatus;
 mod pets;
+mod session_flow;
 mod session_header;
 use self::session_header::SessionHeader;
 mod hook_lifecycle;
 mod hooks;
+mod interaction;
 mod skills;
 mod slash_dispatch;
 use self::skills::collect_tool_mentions;
@@ -362,29 +364,40 @@ use self::plugins::PluginListFetchState;
 use self::plugins::PluginsCacheState;
 mod plan_implementation;
 use self::plan_implementation::PLAN_IMPLEMENTATION_TITLE;
+mod model_popups;
+mod notifications;
+use self::notifications::Notification;
+mod permission_popups;
 mod protocol;
 mod protocol_requests;
 mod rate_limits;
-use self::rate_limits::NUDGE_MODEL_SLUG;
-use self::rate_limits::RATE_LIMIT_SWITCH_PROMPT_THRESHOLD;
 use self::rate_limits::RateLimitErrorKind;
 use self::rate_limits::RateLimitSwitchPromptState;
 use self::rate_limits::RateLimitWarningState;
 use self::rate_limits::app_server_rate_limit_error_kind;
-pub(crate) use self::rate_limits::get_limits_duration;
+pub(crate) use self::rate_limits::fallback_limit_label;
 use self::rate_limits::is_app_server_cyber_policy_error;
+pub(crate) use self::rate_limits::limit_label_for_window;
 mod realtime;
+mod rendering;
 mod replay;
 use self::realtime::RealtimeConversationUiState;
 mod reasoning_shortcuts;
 mod review;
+mod review_popups;
 use self::review::ReviewState;
+#[cfg(test)]
+pub(crate) use self::review_popups::show_review_commit_picker_with_entries;
 mod service_tiers;
+mod settings;
+mod settings_popups;
 mod side;
 mod status_state;
+mod windows_sandbox_prompts;
 use self::status_state::StatusIndicatorState;
 use self::status_state::StatusState;
 use self::status_state::TerminalTitleStatusKind;
+mod status_controls;
 mod status_surfaces;
 mod streaming;
 use self::status_surfaces::CachedProjectRootName;
@@ -430,6 +443,7 @@ use crate::workspace_command::WorkspaceCommandRunner;
 use chrono::Local;
 use codex_app_server_protocol::AskForApproval;
 use codex_file_search::FileMatch;
+use codex_protocol::models::ActivePermissionProfile;
 use codex_protocol::models::PermissionProfile;
 use codex_protocol::openai_models::InputModality;
 use codex_protocol::openai_models::ModelPreset;
@@ -450,7 +464,6 @@ const MAX_AGENT_COPY_HISTORY: usize = 32;
 /// Common initialization parameters shared by all `ChatWidget` constructors.
 pub(crate) struct ChatWidgetInit {
     pub(crate) config: Config,
-    pub(crate) environment_manager: Arc<EnvironmentManager>,
     pub(crate) frame_requester: FrameRequester,
     pub(crate) app_event_tx: AppEventSender,
     /// App-server-backed runner used by status surfaces for workspace metadata probes.
@@ -502,7 +515,6 @@ pub(crate) struct ChatWidget {
     bottom_pane: BottomPane,
     transcript: TranscriptState,
     config: Config,
-    environment_manager: Arc<EnvironmentManager>,
     raw_output_mode: bool,
     /// Runtime value resolved by core. `config.service_tier` remains the explicit user choice.
     effective_service_tier: Option<String>,
@@ -896,187 +908,6 @@ impl ChatWidget {
         self.realtime_conversation_enabled()
     }
 
-    /// Update the status indicator header and details.
-    ///
-    /// Passing `None` clears any existing details.
-    fn set_status(
-        &mut self,
-        header: String,
-        details: Option<String>,
-        details_capitalization: StatusDetailsCapitalization,
-        details_max_lines: usize,
-    ) {
-        let details = details
-            .filter(|details| !details.is_empty())
-            .map(|details| {
-                let trimmed = details.trim_start();
-                match details_capitalization {
-                    StatusDetailsCapitalization::CapitalizeFirst => {
-                        crate::text_formatting::capitalize_first(trimmed)
-                    }
-                    StatusDetailsCapitalization::Preserve => trimmed.to_string(),
-                }
-            });
-        self.status_state.set_status(StatusIndicatorState {
-            header: header.clone(),
-            details: details.clone(),
-            details_max_lines,
-        });
-        self.bottom_pane.update_status(
-            header,
-            details,
-            StatusDetailsCapitalization::Preserve,
-            details_max_lines,
-        );
-        let title_uses_status = self
-            .config
-            .tui_terminal_title
-            .as_ref()
-            .is_some_and(|items| {
-                items
-                    .iter()
-                    .any(|item| item == "run-state" || item == "status")
-            });
-        if title_uses_status {
-            self.refresh_status_surfaces();
-        }
-    }
-
-    /// Convenience wrapper around [`Self::set_status`];
-    /// updates the status indicator header and clears any existing details.
-    fn set_status_header(&mut self, header: String) {
-        self.set_status(
-            header,
-            /*details*/ None,
-            StatusDetailsCapitalization::CapitalizeFirst,
-            STATUS_DETAILS_DEFAULT_MAX_LINES,
-        );
-    }
-
-    /// Sets the currently rendered footer status-line value.
-    pub(crate) fn set_status_line(&mut self, status_line: Option<Line<'static>>) {
-        self.bottom_pane.set_status_line(status_line);
-    }
-
-    /// Sets the terminal hyperlink target for the currently rendered footer status line.
-    pub(crate) fn set_status_line_hyperlink(&mut self, url: Option<String>) {
-        self.bottom_pane.set_status_line_hyperlink(url);
-    }
-
-    /// Forwards the contextual active-agent label into the bottom-pane footer pipeline.
-    ///
-    /// `ChatWidget` stays a pass-through here so `App` remains the owner of "which thread is the
-    /// user actually looking at?" and the footer stack remains a pure renderer of that decision.
-    pub(crate) fn set_active_agent_label(&mut self, active_agent_label: Option<String>) {
-        self.bottom_pane.set_active_agent_label(active_agent_label);
-    }
-
-    /// Recomputes footer status-line content from config and current runtime state.
-    ///
-    /// This method is the status-line orchestrator: it parses configured item identifiers,
-    /// warns once per session about invalid items, updates whether status-line mode is enabled,
-    /// schedules async git-branch lookup when needed, and renders only values that are currently
-    /// available.
-    ///
-    /// The omission behavior is intentional. If selected items are unavailable (for example before
-    /// a session id exists or before branch lookup completes), those items are skipped without
-    /// placeholders so the line remains compact and stable.
-    pub(crate) fn refresh_status_line(&mut self) {
-        self.refresh_status_surfaces();
-    }
-
-    /// Records that status-line setup was canceled.
-    ///
-    /// Cancellation is intentionally side-effect free for config state; the existing configuration
-    /// remains active and no persistence is attempted.
-    pub(crate) fn cancel_status_line_setup(&self) {
-        tracing::info!("Status line setup canceled by user");
-    }
-
-    /// Applies status-line item selection from the setup view to in-memory config.
-    ///
-    /// An empty selection persists as an explicit empty list.
-    pub(crate) fn setup_status_line(&mut self, items: Vec<StatusLineItem>, use_theme_colors: bool) {
-        tracing::info!(
-            "status line setup confirmed with items: {items:#?}, use_theme_colors: {use_theme_colors}"
-        );
-        let ids = items.iter().map(ToString::to_string).collect::<Vec<_>>();
-        self.config.tui_status_line = Some(ids);
-        self.config.tui_status_line_use_colors = use_theme_colors;
-        self.refresh_status_line();
-    }
-
-    /// Applies a temporary terminal-title selection while the setup UI is open.
-    pub(crate) fn preview_terminal_title(&mut self, items: Vec<TerminalTitleItem>) {
-        if self.terminal_title_setup_original_items.is_none() {
-            self.terminal_title_setup_original_items = Some(self.config.tui_terminal_title.clone());
-        }
-
-        let ids = items.iter().map(ToString::to_string).collect::<Vec<_>>();
-        self.config.tui_terminal_title = Some(ids);
-        self.refresh_terminal_title();
-    }
-
-    /// Restores the terminal-title config that was active before the setup UI
-    /// opened, undoing any preview changes. No-op if no setup session is active.
-    pub(crate) fn revert_terminal_title_setup_preview(&mut self) {
-        let Some(original_items) = self.terminal_title_setup_original_items.take() else {
-            return;
-        };
-
-        self.config.tui_terminal_title = original_items;
-        self.refresh_terminal_title();
-    }
-
-    /// Dismisses the terminal-title setup UI and reverts to the pre-setup config.
-    pub(crate) fn cancel_terminal_title_setup(&mut self) {
-        tracing::info!("Terminal title setup canceled by user");
-        self.revert_terminal_title_setup_preview();
-    }
-
-    /// Commits a confirmed terminal-title selection, ending the setup session.
-    ///
-    /// After this call, `revert_terminal_title_setup_preview` becomes a no-op
-    /// because the original config snapshot is discarded.
-    pub(crate) fn setup_terminal_title(&mut self, items: Vec<TerminalTitleItem>) {
-        tracing::info!("terminal title setup confirmed with items: {items:#?}");
-        let ids = items.iter().map(ToString::to_string).collect::<Vec<_>>();
-        self.terminal_title_setup_original_items = None;
-        self.config.tui_terminal_title = Some(ids);
-        self.refresh_terminal_title();
-    }
-
-    /// Stores async git-branch lookup results for the current status-line cwd.
-    ///
-    /// Results are dropped when they target an out-of-date cwd to avoid rendering stale branch
-    /// names after directory changes.
-    pub(crate) fn set_status_line_branch(&mut self, cwd: PathBuf, branch: Option<String>) {
-        if self.status_line_branch_cwd.as_ref() != Some(&cwd) {
-            self.status_line_branch_pending = false;
-            return;
-        }
-        self.status_line_branch = branch;
-        self.status_line_branch_pending = false;
-        self.status_line_branch_lookup_complete = true;
-        self.refresh_status_surfaces();
-    }
-
-    /// Stores async Git summary lookup results for the current status-line cwd.
-    pub(crate) fn set_status_line_git_summary(
-        &mut self,
-        cwd: PathBuf,
-        summary: StatusLineGitSummary,
-    ) {
-        if self.status_line_git_summary_cwd.as_ref() != Some(&cwd) {
-            self.status_line_git_summary_pending = false;
-            return;
-        }
-        self.status_line_git_summary = Some(summary);
-        self.status_line_git_summary_pending = false;
-        self.status_line_git_summary_lookup_complete = true;
-        self.refresh_status_surfaces();
-    }
-
     fn restore_retry_status_header_if_present(&mut self) {
         if let Some(header) = self.status_state.take_retry_status_header() {
             self.set_status_header(header);
@@ -1094,205 +925,6 @@ impl ChatWidget {
         self.transcript.record_visible_user_turn();
     }
 
-    // --- Small event handlers ---
-    fn on_session_configured_with_display_and_fork_parent_title(
-        &mut self,
-        session: ThreadSessionState,
-        display: SessionConfiguredDisplay,
-        fork_parent_title: Option<String>,
-    ) {
-        self.transcript.reset_copy_history();
-        let history_metadata = session.message_history.unwrap_or_default();
-        self.bottom_pane.set_history_metadata(
-            session.thread_id,
-            history_metadata.log_id,
-            history_metadata.entry_count,
-        );
-        self.set_skills(/*skills*/ None);
-        self.session_network_proxy = session.network_proxy.clone();
-        let previous_thread_id = self.thread_id;
-        self.thread_id = Some(session.thread_id);
-        if previous_thread_id != self.thread_id {
-            self.review.recent_auto_review_denials = RecentAutoReviewDenials::default();
-        }
-        self.refresh_plan_mode_nudge();
-        self.turn_lifecycle.reset_thread();
-        self.thread_name = session.thread_name.clone();
-        self.current_goal_status_indicator = None;
-        self.current_goal_status = None;
-        self.update_collaboration_mode_indicator();
-        self.forked_from = session.forked_from_id;
-        self.current_rollout_path = session.rollout_path.clone();
-        self.current_cwd = Some(session.cwd.to_path_buf());
-        self.config.cwd = session.cwd.clone();
-        self.effective_service_tier = session.service_tier.clone();
-        if let Err(err) = self
-            .config
-            .permissions
-            .approval_policy
-            .set(session.approval_policy.to_core())
-        {
-            tracing::warn!(%err, "failed to sync approval_policy from SessionConfigured");
-            self.config.permissions.approval_policy =
-                Constrained::allow_only(session.approval_policy.to_core());
-        }
-        let permission_sync = self
-            .config
-            .permissions
-            .set_permission_profile_with_active_profile(
-                session.permission_profile.clone(),
-                session.active_permission_profile.clone(),
-            );
-        if let Err(err) = permission_sync {
-            tracing::warn!(%err, "failed to sync permissions from SessionConfigured");
-            self.config.permissions.permission_profile =
-                Constrained::allow_only(session.permission_profile.clone());
-            self.config.permissions.active_permission_profile =
-                session.active_permission_profile.clone();
-        }
-        self.config.approvals_reviewer = session.approvals_reviewer;
-        self.status_line_project_root_name_cache = None;
-        let forked_from_id = session.forked_from_id;
-        let model_for_header = session.model.clone();
-        self.session_header.set_model(&model_for_header);
-        self.current_collaboration_mode = self.current_collaboration_mode.with_updates(
-            Some(model_for_header.clone()),
-            Some(session.reasoning_effort),
-            /*developer_instructions*/ None,
-        );
-        if let Some(mask) = self.active_collaboration_mask.as_mut() {
-            mask.model = Some(model_for_header.clone());
-            mask.reasoning_effort = Some(session.reasoning_effort);
-        }
-        self.refresh_model_display();
-        self.refresh_status_surfaces();
-        self.sync_service_tier_commands();
-        self.sync_personality_command_enabled();
-        self.sync_plugins_command_enabled();
-        self.sync_goal_command_enabled();
-        self.refresh_plugin_mentions();
-        if display == SessionConfiguredDisplay::Normal {
-            let startup_tooltip_override = self.startup_tooltip_override.take();
-            let show_fast_status = self
-                .should_show_fast_status(&model_for_header, self.effective_service_tier.as_deref());
-            let session_info_cell = history_cell::new_session_info(
-                &self.config,
-                &model_for_header,
-                &session,
-                self.show_welcome_banner,
-                startup_tooltip_override,
-                self.plan_type,
-                show_fast_status,
-            );
-            self.apply_session_info_cell(session_info_cell);
-        } else if self
-            .transcript
-            .active_cell
-            .as_ref()
-            .is_some_and(|cell| cell.as_any().is::<history_cell::SessionHeaderHistoryCell>())
-        {
-            self.transcript.active_cell = None;
-            self.bump_active_cell_revision();
-        }
-        self.transcript.saw_copy_source_this_turn = false;
-        self.refresh_skills_for_current_cwd(/*force_reload*/ true);
-        if self.connectors_enabled() {
-            self.prefetch_connectors();
-        }
-        if let Some(user_message) = self.initial_user_message.take() {
-            if self.suppress_initial_user_message_submit {
-                self.initial_user_message = Some(user_message);
-            } else {
-                self.submit_user_message(user_message);
-            }
-        }
-        if display == SessionConfiguredDisplay::Normal
-            && let Some(forked_from_id) = forked_from_id
-        {
-            self.emit_forked_thread_event(forked_from_id, fork_parent_title);
-        }
-        if !self.suppress_session_configured_redraw {
-            self.request_redraw();
-        }
-    }
-
-    pub(crate) fn handle_thread_session(&mut self, session: ThreadSessionState) {
-        self.instruction_source_paths = session.instruction_source_paths.clone();
-        let fork_parent_title = session.fork_parent_title.clone();
-        self.on_session_configured_with_display_and_fork_parent_title(
-            session,
-            SessionConfiguredDisplay::Normal,
-            fork_parent_title,
-        );
-    }
-
-    pub(crate) fn handle_thread_session_quiet(&mut self, session: ThreadSessionState) {
-        self.instruction_source_paths = session.instruction_source_paths.clone();
-        self.on_session_configured_with_display_and_fork_parent_title(
-            session,
-            SessionConfiguredDisplay::Quiet,
-            /*fork_parent_title*/ None,
-        );
-    }
-
-    pub(crate) fn handle_side_thread_session(&mut self, session: ThreadSessionState) {
-        self.instruction_source_paths = session.instruction_source_paths.clone();
-        let fork_parent_title = session.fork_parent_title.clone();
-        self.on_session_configured_with_display_and_fork_parent_title(
-            session,
-            SessionConfiguredDisplay::SideConversation,
-            fork_parent_title,
-        );
-    }
-
-    fn emit_forked_thread_event(
-        &mut self,
-        forked_from_id: ThreadId,
-        fork_parent_title: Option<String>,
-    ) {
-        let forked_from_id_text = forked_from_id.to_string();
-        let line: Line<'static> = if let Some(name) = fork_parent_title
-            && !name.trim().is_empty()
-        {
-            vec![
-                "• ".dim(),
-                "Thread forked from ".into(),
-                name.cyan(),
-                " (".into(),
-                forked_from_id_text.cyan(),
-                ")".into(),
-            ]
-            .into()
-        } else {
-            vec![
-                "• ".dim(),
-                "Thread forked from ".into(),
-                forked_from_id_text.cyan(),
-            ]
-            .into()
-        };
-        self.app_event_tx.send(AppEvent::InsertHistoryCell(Box::new(
-            PlainHistoryCell::new(vec![line]),
-        )));
-    }
-
-    fn on_thread_name_updated(&mut self, thread_id: ThreadId, thread_name: Option<String>) {
-        if self.thread_id == Some(thread_id) {
-            if let Some(name) = thread_name.as_deref() {
-                let cell = Self::rename_confirmation_cell(name, self.thread_id);
-                self.add_boxed_history(Box::new(cell));
-            }
-            self.thread_name = thread_name;
-            self.refresh_status_surfaces();
-            self.request_redraw();
-            self.maybe_send_next_queued_input();
-        }
-    }
-
-    fn set_skills(&mut self, skills: Option<Vec<SkillMetadata>>) {
-        self.bottom_pane.set_skills(skills);
-    }
-
     pub(crate) fn open_feedback_note(
         &mut self,
         category: crate::app_event::FeedbackCategory,
@@ -1487,107 +1119,6 @@ impl ChatWidget {
         }
     }
 
-    pub(crate) fn on_rate_limit_snapshot(&mut self, snapshot: Option<RateLimitSnapshot>) {
-        if let Some(mut snapshot) = snapshot {
-            let limit_id = snapshot
-                .limit_id
-                .clone()
-                .unwrap_or_else(|| "codex".to_string());
-            let limit_label = snapshot
-                .limit_name
-                .clone()
-                .unwrap_or_else(|| limit_id.clone());
-            if snapshot.credits.is_none() {
-                snapshot.credits = self
-                    .rate_limit_snapshots_by_limit_id
-                    .get(&limit_id)
-                    .and_then(|display| display.credits.as_ref())
-                    .map(|credits| CreditsSnapshot {
-                        has_credits: credits.has_credits,
-                        unlimited: credits.unlimited,
-                        balance: credits.balance.clone(),
-                    });
-            }
-
-            self.plan_type = snapshot.plan_type.or(self.plan_type);
-
-            let is_codex_limit = limit_id.eq_ignore_ascii_case("codex");
-            if is_codex_limit
-                && let Some(rate_limit_reached_type) = snapshot.rate_limit_reached_type
-            {
-                self.codex_rate_limit_reached_type = Some(rate_limit_reached_type);
-            }
-            let warnings = if is_codex_limit {
-                self.rate_limit_warnings.take_warnings(
-                    snapshot
-                        .secondary
-                        .as_ref()
-                        .map(|window| f64::from(window.used_percent)),
-                    snapshot
-                        .secondary
-                        .as_ref()
-                        .and_then(|window| window.window_duration_mins),
-                    snapshot
-                        .primary
-                        .as_ref()
-                        .map(|window| f64::from(window.used_percent)),
-                    snapshot
-                        .primary
-                        .as_ref()
-                        .and_then(|window| window.window_duration_mins),
-                )
-            } else {
-                vec![]
-            };
-
-            let high_usage = is_codex_limit
-                && (snapshot
-                    .secondary
-                    .as_ref()
-                    .map(|w| f64::from(w.used_percent) >= RATE_LIMIT_SWITCH_PROMPT_THRESHOLD)
-                    .unwrap_or(false)
-                    || snapshot
-                        .primary
-                        .as_ref()
-                        .map(|w| f64::from(w.used_percent) >= RATE_LIMIT_SWITCH_PROMPT_THRESHOLD)
-                        .unwrap_or(false));
-
-            let has_workspace_credits = snapshot
-                .credits
-                .as_ref()
-                .map(|credits| credits.has_credits)
-                .unwrap_or(false);
-
-            if high_usage
-                && !has_workspace_credits
-                && !self.rate_limit_switch_prompt_hidden()
-                && self.current_model() != NUDGE_MODEL_SLUG
-                && !matches!(
-                    self.rate_limit_switch_prompt,
-                    RateLimitSwitchPromptState::Shown
-                )
-            {
-                self.rate_limit_switch_prompt = RateLimitSwitchPromptState::Pending;
-            }
-
-            let display =
-                rate_limit_snapshot_display_for_limit(&snapshot, limit_label, Local::now());
-            self.rate_limit_snapshots_by_limit_id
-                .insert(limit_id, display);
-
-            if !warnings.is_empty() {
-                for warning in warnings {
-                    self.add_to_history(history_cell::new_warning_event(warning));
-                }
-                self.request_redraw();
-            }
-        } else {
-            self.rate_limit_snapshots_by_limit_id.clear();
-            self.codex_rate_limit_reached_type = None;
-        }
-        self.refresh_status_line();
-    }
-
     pub(crate) fn handle_history_entry_response(&mut self, event: HistoryLookupResponse) {
         let HistoryLookupResponse {
             offset,
@@ -1617,597 +1148,6 @@ impl ChatWidget {
         }
     }
 
-    pub(crate) fn new_with_app_event(common: ChatWidgetInit) -> Self {
-        Self::new_with_op_target(common, CodexOpTarget::AppEvent)
-    }
-
-    fn new_with_op_target(common: ChatWidgetInit, codex_op_target: CodexOpTarget) -> Self {
-        let ChatWidgetInit {
-            config,
-            environment_manager,
-            frame_requester,
-            app_event_tx,
-            workspace_command_runner,
-            initial_user_message,
-            enhanced_keys_supported,
-            has_chatgpt_account,
-            model_catalog,
-            feedback,
-            is_first_run,
-            status_account_display,
-            runtime_model_provider_base_url,
-            initial_plan_type,
-            model,
-            startup_tooltip_override,
-            status_line_invalid_items_warned,
-            terminal_title_invalid_items_warned,
-            session_telemetry,
-        } = common;
-        let model = model.filter(|m| !m.trim().is_empty());
-        let mut config = config;
-        config.model = model.clone();
-        let prevent_idle_sleep = config.features.enabled(Feature::PreventIdleSleep);
-        let mut rng = rand::rng();
-        let placeholder = PLACEHOLDERS[rng.random_range(0..PLACEHOLDERS.len())].to_string();
-        let side_placeholder =
-            SIDE_PLACEHOLDERS[rng.random_range(0..SIDE_PLACEHOLDERS.len())].to_string();
-
-        let model_override = model.as_deref();
-        let model_for_header = model
-            .clone()
-            .unwrap_or_else(|| DEFAULT_MODEL_DISPLAY_NAME.to_string());
-        let active_collaboration_mask =
-            Self::initial_collaboration_mask(&config, model_catalog.as_ref(), model_override);
-        let header_model = active_collaboration_mask
-            .as_ref()
-            .and_then(|mask| mask.model.clone())
-            .unwrap_or_else(|| model_for_header.clone());
-        let fallback_default = Settings {
-            model: header_model.clone(),
-            reasoning_effort: None,
-            developer_instructions: None,
-        };
-        // Collaboration modes start in Default mode.
-        let current_collaboration_mode = CollaborationMode {
-            mode: ModeKind::Default,
-            settings: fallback_default,
-        };
-
-        let active_cell = Some(Self::placeholder_session_header_cell(&config));
-
-        let current_cwd = Some(config.cwd.to_path_buf());
-        let effective_service_tier = config.service_tier.clone();
-        let current_terminal_info = terminal_info();
-        let runtime_keymap = RuntimeKeymap::from_config(&config.tui_keymap).ok();
-        let default_keymap = RuntimeKeymap::defaults();
-        let copy_last_response_binding = runtime_keymap
-            .as_ref()
-            .map(|keymap| keymap.app.copy.clone())
-            .unwrap_or_else(|| default_keymap.app.copy.clone());
-        let chat_keymap = runtime_keymap
-            .as_ref()
-            .map(|keymap| keymap.chat.clone())
-            .unwrap_or_else(|| default_keymap.chat.clone());
-        let queued_message_edit_hint_binding = queued_message_edit_hint_binding(
-            &chat_keymap.edit_queued_message,
-            current_terminal_info,
-        );
-        pets::start_configured_pet_load_if_needed(
-            &config,
-            /*ambient_pet_missing*/ true,
-            frame_requester.clone(),
-            app_event_tx.clone(),
-        );
-        let mut widget = Self {
-            app_event_tx: app_event_tx.clone(),
-            frame_requester: frame_requester.clone(),
-            codex_op_target,
-            bottom_pane: BottomPane::new(BottomPaneParams {
-                frame_requester,
-                app_event_tx,
-                has_input_focus: true,
-                enhanced_keys_supported,
-                placeholder_text: placeholder.clone(),
-                disable_paste_burst: config.disable_paste_burst,
-                animations_enabled: config.animations,
-                skills: None,
-            }),
-            transcript: TranscriptState::new(active_cell),
-            raw_output_mode: config.tui_raw_output_mode,
-            config,
-            environment_manager,
-            effective_service_tier,
-            skills_all: Vec::new(),
-            skills_initial_state: None,
-            current_collaboration_mode,
-            active_collaboration_mask,
-            has_chatgpt_account,
-            model_catalog,
-            session_telemetry,
-            session_header: SessionHeader::new(header_model),
-            initial_user_message,
-            status_account_display,
-            runtime_model_provider_base_url,
-            token_info: None,
-            rate_limit_snapshots_by_limit_id: BTreeMap::new(),
-            refreshing_status_outputs: Vec::new(),
-            next_status_refresh_request_id: 0,
-            plan_type: initial_plan_type,
-            codex_rate_limit_reached_type: None,
-            rate_limit_warnings: RateLimitWarningState::default(),
-            warning_display_state: WarningDisplayState::default(),
-            rate_limit_switch_prompt: RateLimitSwitchPromptState::default(),
-            add_credits_nudge_email_in_flight: None,
-            adaptive_chunking: AdaptiveChunkingPolicy::default(),
-            stream_controller: None,
-            plan_stream_controller: None,
-            clipboard_lease: None,
-            copy_last_response_binding,
-            running_commands: HashMap::new(),
-            collab_agent_metadata: HashMap::new(),
-            pending_collab_spawn_requests: HashMap::new(),
-            suppressed_exec_calls: HashSet::new(),
-            last_unified_wait: None,
-            unified_exec_wait_streak: None,
-            turn_lifecycle: TurnLifecycleState::new(prevent_idle_sleep),
-            task_complete_pending: false,
-            unified_exec_processes: Vec::new(),
-            mcp_startup_status: None,
-            mcp_startup_expected_servers: None,
-            mcp_startup_ignore_updates_until_next_start: false,
-            mcp_startup_allow_terminal_only_next_round: false,
-            mcp_startup_pending_next_round: HashMap::new(),
-            mcp_startup_pending_next_round_saw_starting: false,
-            connectors: ConnectorsState::default(),
-            ide_context: IdeContextState::default(),
-            plugins_cache: PluginsCacheState::default(),
-            plugins_fetch_state: PluginListFetchState::default(),
-            plugin_install_apps_needing_auth: Vec::new(),
-            plugin_install_auth_flow: None,
-            plugins_active_tab_id: None,
-            newly_installed_marketplace_tab_id: None,
-            interrupts: InterruptManager::new(),
-            reasoning_buffer: String::new(),
-            full_reasoning_buffer: String::new(),
-            status_state: StatusState::default(),
-            review: ReviewState::default(),
-            active_hook_cell: None,
-            ambient_pet: None,
-            pet_picker_preview_state: crate::pets::PetPickerPreviewState::default(),
-            pet_picker_preview_pet: None,
-            pet_picker_preview_request_id: 0,
-            pet_picker_preview_image_visible: std::cell::Cell::new(/*value*/ false),
-            pet_selection_load_request_id: 0,
-            #[cfg(test)]
-            pet_image_support_override: None,
-            thread_id: None,
-            dismissed_plan_mode_nudge_scopes: HashSet::new(),
-            thread_name: None,
-            thread_rename_block_message: None,
-            active_side_conversation: false,
-            normal_placeholder_text: placeholder,
-            side_placeholder_text: side_placeholder,
-            forked_from: None,
-            interrupted_turn_notice_mode: InterruptedTurnNoticeMode::Default,
-            input_queue: InputQueueState::default(),
-            chat_keymap,
-            queued_message_edit_hint_binding,
-            show_welcome_banner: is_first_run,
-            startup_tooltip_override,
-            suppress_session_configured_redraw: false,
-            suppress_initial_user_message_submit: false,
-            pending_notification: None,
-            quit_shortcut_expires_at: None,
-            quit_shortcut_key: None,
-            turn_runtime_metrics: RuntimeMetricsSummary::default(),
-            last_rendered_width: std::cell::Cell::new(None),
-            feedback,
-            current_rollout_path: None,
-            current_cwd,
-            workspace_command_runner,
-            instruction_source_paths: Vec::new(),
-            session_network_proxy: None,
-            status_line_invalid_items_warned,
-            terminal_title_invalid_items_warned,
-            last_terminal_title: None,
-            last_terminal_title_requires_action: false,
-            terminal_title_setup_original_items: None,
-            terminal_title_animation_origin: Instant::now(),
-            status_line_project_root_name_cache: None,
-            status_line_branch: None,
-            status_line_branch_cwd: None,
-            status_line_branch_pending: false,
-            status_line_branch_lookup_complete: false,
-            status_line_git_summary: None,
-            status_line_git_summary_cwd: None,
-            status_line_git_summary_pending: false,
-            status_line_git_summary_lookup_complete: false,
-            current_goal_status_indicator: None,
-            current_goal_status: None,
-            external_editor_state: ExternalEditorState::Closed,
-            realtime_conversation: RealtimeConversationUiState::default(),
-            last_rendered_user_message_display: None,
-            last_non_retry_error: None,
-        };
-
-        widget.prefetch_rate_limits();
-        if let Some(keymap) = runtime_keymap {
-            widget.bottom_pane.set_keymap_bindings(&keymap);
-        }
-        widget
-            .bottom_pane
-            .set_vim_enabled(widget.config.tui_vim_mode_default);
-        widget
-            .bottom_pane
-            .set_realtime_conversation_enabled(widget.realtime_conversation_enabled());
-        widget
-            .bottom_pane
-            .set_audio_device_selection_enabled(widget.realtime_audio_device_selection_enabled());
-        widget
-            .bottom_pane
-            .set_status_line_enabled(!widget.configured_status_line_items().is_empty());
-        widget
-            .bottom_pane
-            .set_collaboration_modes_enabled(/*enabled*/ true);
-        widget.sync_service_tier_commands();
-        widget.sync_personality_command_enabled();
-        widget.sync_plugins_command_enabled();
-        widget.sync_goal_command_enabled();
-        widget.sync_mentions_v2_enabled();
-        widget
-            .bottom_pane
-            .set_queued_message_edit_binding(widget.queued_message_edit_hint_binding);
-        #[cfg(target_os = "windows")]
-        widget.bottom_pane.set_windows_degraded_sandbox_active(
-            crate::legacy_core::windows_sandbox::ELEVATED_SANDBOX_NUX_ENABLED
-                && matches!(
-                    WindowsSandboxLevel::from_config(&widget.config),
-                    WindowsSandboxLevel::RestrictedToken
-                ),
-        );
-        widget.update_collaboration_mode_indicator();
-
-        widget
-            .bottom_pane
-            .set_connectors_enabled(widget.connectors_enabled());
-        widget.refresh_status_surfaces();
-
-        widget
-    }
-
-    pub(crate) fn handle_key_event(&mut self, key_event: KeyEvent) {
-        if self.bottom_pane.has_active_view()
-            && !matches!(
-                key_event,
-                KeyEvent {
-                    code: KeyCode::Char(c),
-                    modifiers,
-                    kind: KeyEventKind::Press,
-                    ..
-                } if modifiers.contains(KeyModifiers::CONTROL) && c.eq_ignore_ascii_case(&'c')
-            )
-            && !key_hint::ctrl(KeyCode::Char('r')).is_press(key_event)
-            && !key_hint::ctrl(KeyCode::Char('u')).is_press(key_event)
-        {
-            self.bottom_pane.handle_key_event(key_event);
-            if self.bottom_pane.no_modal_or_popup_active() {
-                self.maybe_send_next_queued_input();
-            }
-            return;
-        }
-
-        if self.handle_reasoning_shortcut(key_event) {
-            self.bottom_pane.clear_quit_shortcut_hint();
-            self.quit_shortcut_expires_at = None;
-            self.quit_shortcut_key = None;
-            return;
-        }
-
-        if key_event.kind == KeyEventKind::Press
-            && self.copy_last_response_binding.is_pressed(key_event)
-        {
-            self.bottom_pane.clear_quit_shortcut_hint();
-            self.quit_shortcut_expires_at = None;
-            self.quit_shortcut_key = None;
-            self.copy_last_agent_markdown();
-            return;
-        }
-
-        match key_event {
-            KeyEvent {
-                code: KeyCode::Char(c),
-                modifiers,
-                kind: KeyEventKind::Press,
-                ..
-            } if modifiers.contains(KeyModifiers::CONTROL) && c.eq_ignore_ascii_case(&'c') => {
-                self.on_ctrl_c();
-                return;
-            }
-            KeyEvent {
-                code: KeyCode::Char(c),
-                modifiers,
-                kind: KeyEventKind::Press,
-                ..
-            } if modifiers.contains(KeyModifiers::CONTROL) && c.eq_ignore_ascii_case(&'d') => {
-                if self.on_ctrl_d() {
-                    return;
-                }
-                self.bottom_pane.clear_quit_shortcut_hint();
-                self.quit_shortcut_expires_at = None;
-                self.quit_shortcut_key = None;
-            }
-            KeyEvent {
-                code: KeyCode::Char(c),
-                modifiers,
-                kind: KeyEventKind::Press,
-                ..
-            } if modifiers.intersects(KeyModifiers::CONTROL | KeyModifiers::ALT)
-                && c.eq_ignore_ascii_case(&'v') =>
-            {
-                match paste_image_to_temp_png() {
-                    Ok((path, info)) => {
-                        tracing::debug!(
-                            "pasted image size={}x{} format={}",
-                            info.width,
-                            info.height,
-                            info.encoded_format.label()
-                        );
-                        self.attach_image(path);
-                    }
-                    Err(err) => {
-                        tracing::warn!("failed to paste image: {err}");
-                        self.add_to_history(history_cell::new_error_event(format!(
-                            "Failed to paste image: {err}",
-                        )));
-                    }
-                }
-                return;
-            }
-            other if other.kind == KeyEventKind::Press => {
-                self.bottom_pane.clear_quit_shortcut_hint();
-                self.quit_shortcut_expires_at = None;
-                self.quit_shortcut_key = None;
-            }
-            _ => {}
-        }
-
-        if key_event.kind == KeyEventKind::Press
-            && self.chat_keymap.edit_queued_message.is_pressed(key_event)
-            && self.has_queued_follow_up_messages()
-            && self.bottom_pane.no_modal_or_popup_active()
-        {
-            if let Some(user_message) = self.pop_latest_queued_user_message() {
-                self.restore_user_message_to_composer(user_message);
-                self.refresh_pending_input_preview();
-                self.request_redraw();
-            }
-            return;
-        }
-
-        if matches!(key_event.code, KeyCode::Esc)
-            && matches!(key_event.kind, KeyEventKind::Press | KeyEventKind::Repeat)
-            && !self.input_queue.pending_steers.is_empty()
-            && self.bottom_pane.is_task_running()
-            && self.bottom_pane.no_modal_or_popup_active()
-            && !self.should_handle_vim_insert_escape(key_event)
-        {
-            self.input_queue.submit_pending_steers_after_interrupt = true;
-            if !self.submit_op(AppCommand::interrupt()) {
-                self.input_queue.submit_pending_steers_after_interrupt = false;
-            }
-            return;
-        }
-
-        if matches!(key_event.code, KeyCode::Esc)
-            && key_event.kind == KeyEventKind::Press
-            && self.should_show_plan_mode_nudge()
-        {
-            self.dismiss_plan_mode_nudge();
-            return;
-        }
-
-        if self.handle_plugins_popup_key_event(key_event) {
-            return;
-        }
-
-        match key_event {
-            KeyEvent {
-                code: KeyCode::BackTab,
-                kind: KeyEventKind::Press,
-                ..
-            } if self.collaboration_modes_enabled()
-                && !self.bottom_pane.is_task_running()
-                && self.bottom_pane.no_modal_or_popup_active() =>
-            {
-                self.cycle_collaboration_mode();
-                self.refresh_plan_mode_nudge();
-            }
-            _ => {
-                let had_modal_or_popup = !self.bottom_pane.no_modal_or_popup_active();
-                let input_result = self.bottom_pane.handle_key_event(key_event);
-                self.handle_composer_input_result(input_result, had_modal_or_popup);
-            }
-        }
-    }
-
-    /// Attach a local image to the composer when the active model supports image inputs.
-    ///
-    /// When the model does not advertise image support, we keep the draft unchanged and surface a
-    /// warning event so users can switch models or remove attachments.
-    pub(crate) fn attach_image(&mut self, path: PathBuf) {
-        if !self.current_model_supports_images() {
-            self.add_to_history(history_cell::new_warning_event(
-                self.image_inputs_not_supported_message(),
-            ));
-            self.request_redraw();
-            return;
-        }
-        tracing::info!("attach_image path={path:?}");
-        self.bottom_pane.attach_image(path);
-        self.request_redraw();
-    }
-
-    pub(crate) fn composer_text_with_pending(&self) -> String {
-        self.bottom_pane.composer_text_with_pending()
-    }
-
-    pub(crate) fn apply_external_edit(&mut self, text: String) {
-        self.bottom_pane.apply_external_edit(text);
-        self.refresh_plan_mode_nudge();
-        self.request_redraw();
-    }
-
-    pub(crate) fn external_editor_state(&self) -> ExternalEditorState {
-        self.external_editor_state
-    }
-
-    pub(crate) fn set_external_editor_state(&mut self, state: ExternalEditorState) {
-        self.external_editor_state = state;
-    }
-
-    pub(crate) fn set_footer_hint_override(&mut self, items: Option<Vec<(String, String)>>) {
-        self.bottom_pane.set_footer_hint_override(items);
-    }
-
-    pub(crate) fn show_selection_view(&mut self, params: SelectionViewParams) {
-        self.bottom_pane.show_selection_view(params);
-        self.refresh_plan_mode_nudge();
-        self.request_redraw();
-    }
-
-    pub(crate) fn no_modal_or_popup_active(&self) -> bool {
-        self.bottom_pane.no_modal_or_popup_active()
-    }
-
-    pub(crate) fn can_launch_external_editor(&self) -> bool {
-        self.bottom_pane.can_launch_external_editor()
-    }
-
-    pub(crate) fn can_run_ctrl_l_clear_now(&mut self) -> bool {
-        // Ctrl+L is not a slash command, but it follows /clear's current rule:
-        // block while a task is running.
-        if !self.bottom_pane.is_task_running() {
-            return true;
-        }
-
-        let message = "Ctrl+L is disabled while a task is in progress.".to_string();
-        self.add_to_history(history_cell::new_error_event(message));
-        self.request_redraw();
-        false
-    }
-
-    /// Copy the last agent response (raw markdown) to the system clipboard.
-    pub(crate) fn copy_last_agent_markdown(&mut self) {
-        self.copy_last_agent_markdown_with(crate::clipboard_copy::copy_to_clipboard);
-    }
-
-    pub(crate) fn truncate_agent_copy_history_to_user_turn_count(
-        &mut self,
-        user_turn_count: usize,
-    ) {
-        self.transcript
-            .truncate_copy_history_to_user_turn_count(user_turn_count);
-    }
-
-    /// Inner implementation with an injectable clipboard backend for testing.
-    fn copy_last_agent_markdown_with(
-        &mut self,
-        copy_fn: impl FnOnce(&str) -> Result<Option<crate::clipboard_copy::ClipboardLease>, String>,
-    ) {
-        match self.transcript.last_agent_markdown.clone() {
-            Some(markdown) if !markdown.is_empty() => match copy_fn(&markdown) {
-                Ok(lease) => {
-                    self.clipboard_lease = lease;
-                    self.add_to_history(history_cell::new_info_event(
-                        "Copied last message to clipboard".into(),
-                        /*hint*/ None,
-                    ));
-                }
-                Err(error) => self.add_to_history(history_cell::new_error_event(format!(
-                    "Copy failed: {error}"
-                ))),
-            },
-            _ if self.transcript.copy_history_evicted_by_rollback => {
-                self.add_to_history(history_cell::new_error_event(format!(
-                    "Cannot copy that response after rewinding. Only the most recent {MAX_AGENT_COPY_HISTORY} responses are available to /copy."
-                )));
-            }
-            _ => self.add_to_history(history_cell::new_error_event(
-                "No agent response to copy".into(),
-            )),
-        }
-        self.request_redraw();
-    }
-
-    #[cfg(test)]
-    pub(crate) fn last_agent_markdown_text(&self) -> Option<&str> {
-        self.transcript.last_agent_markdown.as_deref()
-    }
-
-    fn show_rename_prompt(&mut self) {
-        if !self.ensure_thread_rename_allowed() {
-            return;
-        }
-        let tx = self.app_event_tx.clone();
-        let existing_name = self.thread_name.as_deref().filter(|name| !name.is_empty());
-        let title = if existing_name.is_some() {
-            "Rename thread"
-        } else {
-            "Name thread"
-        };
-        let view = CustomPromptView::new(
-            title.to_string(),
-            "Type a name and press Enter".to_string(),
-            /*initial_text*/ existing_name.unwrap_or_default().to_string(),
-            /*context_label*/ None,
-            Box::new(move |name: String| {
-                let Some(name) = crate::legacy_core::util::normalize_thread_name(&name) else {
-                    tx.send(AppEvent::InsertHistoryCell(Box::new(
-                        history_cell::new_error_event("Thread name cannot be empty.".to_string()),
-                    )));
-                    return;
-                };
-                tx.set_thread_name(name);
-            }),
-        );
-
-        self.bottom_pane.show_view(Box::new(view));
-    }
-
-    fn ensure_thread_rename_allowed(&mut self) -> bool {
-        match self.thread_rename_block_message.clone() {
-            Some(message) => {
-                self.add_error_message(message);
-                false
-            }
-            None => true,
-        }
-    }
-
-    pub(crate) fn handle_paste(&mut self, text: String) {
-        self.bottom_pane.handle_paste(text);
-        self.refresh_plan_mode_nudge();
-    }
-
-    // Returns true if caller should skip rendering this frame (a future frame is scheduled).
-    pub(crate) fn handle_paste_burst_tick(&mut self, frame_requester: FrameRequester) -> bool {
-        if self.bottom_pane.flush_paste_burst_if_due() {
-            self.refresh_plan_mode_nudge();
-            // A paste just flushed; request an immediate redraw and skip this frame.
-            self.request_redraw();
-            true
-        } else if self.bottom_pane.is_in_paste_burst() {
-            // While capturing a burst, schedule a follow-up tick and skip this frame
-            // to avoid redundant renders between ticks.
-            frame_requester.schedule_frame_in(
-                crate::bottom_pane::ChatComposer::recommended_paste_flush_delay(),
-            );
-            true
-        } else {
-            false
-        }
-    }
-
     fn flush_active_cell(&mut self) {
         if let Some(active) = self.transcript.active_cell.take() {
             self.transcript.needs_final_message_separator = true;
@@ -2335,6 +1275,10 @@ impl ChatWidget {
             .send(AppEvent::Exit(ExitMode::ShutdownFirst));
     }
 
+    pub(crate) fn show_shutdown_in_progress(&mut self) {
+        self.bottom_pane.show_shutdown_in_progress();
+    }
+
     fn request_redraw(&mut self) {
         self.frame_requester.schedule_frame();
     }
@@ -2343,25 +1287,6 @@ impl ChatWidget {
         self.transcript.bump_active_cell_revision();
     }
 
-    fn notify(&mut self, notification: Notification) {
-        if !notification.allowed_for(&self.config.tui_notifications.notifications) {
-            return;
-        }
-        if let Some(existing) = self.pending_notification.as_ref()
-            && existing.priority() > notification.priority()
-        {
-            return;
-        }
-        self.pending_notification = Some(notification);
-        self.request_redraw();
-    }
-
-    pub(crate) fn maybe_post_pending_notification(&mut self, tui: &mut crate::tui::Tui) {
-        if let Some(notif) = self.pending_notification.take() {
-            tui.notify(notif.display());
-        }
-    }
-
     /// Mark the active cell as failed (✗) and flush it into history.
     fn finalize_active_cell_as_failed(&mut self) {
         if let Some(mut cell) = self.transcript.active_cell.take() {
@@ -2399,91 +1324,6 @@ impl ChatWidget {
         self.request_redraw();
     }
 
-    pub(crate) fn add_status_output(
-        &mut self,
-        refreshing_rate_limits: bool,
-        request_id: Option<u64>,
-    ) {
-        let default_usage = TokenUsage::default();
-        let token_info = self.token_info.as_ref();
-        let total_usage = token_info
-            .map(|ti| &ti.total_token_usage)
-            .unwrap_or(&default_usage);
-        let collaboration_mode = self.collaboration_mode_label();
-        let model = self.current_model().to_string();
-        let model_default_reasoning_effort =
-            self.model_catalog
-                .try_list_models()
-                .ok()
-                .and_then(|models| {
-                    models
-                        .into_iter()
-                        .find(|preset| preset.model == model)
-                        .map(|preset| preset.default_reasoning_effort)
-                });
-        let reasoning_effort_override = Some(
-            self.effective_reasoning_effort()
-                .or(self.config.model_reasoning_effort)
-                .or(model_default_reasoning_effort),
-        );
-        let rate_limit_snapshots: Vec<RateLimitSnapshotDisplay> = self
-            .rate_limit_snapshots_by_limit_id
-            .values()
-            .cloned()
-            .collect();
-        let agents_summary =
-            crate::status::compose_agents_summary(&self.config, &self.instruction_source_paths);
-        let (cell, handle) = crate::status::new_status_output_with_rate_limits_handle(
-            &self.config,
-            self.runtime_model_provider_base_url.as_deref(),
-            self.status_account_display.as_ref(),
-            token_info,
-            total_usage,
-            &self.thread_id,
-            self.thread_name.clone(),
-            self.forked_from,
-            rate_limit_snapshots.as_slice(),
-            self.plan_type,
-            Local::now(),
-            self.model_display_name(),
-            collaboration_mode,
-            reasoning_effort_override,
-            agents_summary,
-            refreshing_rate_limits,
-        );
-        if let Some(request_id) = request_id {
-            self.refreshing_status_outputs.push((request_id, handle));
-        }
-        self.add_to_history(cell);
-    }
-
-    pub(crate) fn finish_status_rate_limit_refresh(&mut self, request_id: u64) {
-        if self.refreshing_status_outputs.is_empty() {
-            return;
-        }
-
-        let rate_limit_snapshots: Vec<RateLimitSnapshotDisplay> = self
-            .rate_limit_snapshots_by_limit_id
-            .values()
-            .cloned()
-            .collect();
-        let now = Local::now();
-        let mut remaining = Vec::with_capacity(self.refreshing_status_outputs.len());
-        let mut updated_any = false;
-        for (pending_request_id, handle) in self.refreshing_status_outputs.drain(..) {
-            if pending_request_id == request_id {
-                updated_any = true;
-                handle.finish_rate_limit_refresh(rate_limit_snapshots.as_slice(), now);
-            } else {
-                remaining.push((pending_request_id, handle));
-            }
-        }
-        self.refreshing_status_outputs = remaining;
-        if updated_any {
-            self.request_redraw();
-        }
-    }
-
     pub(crate) fn add_debug_config_output(&mut self) {
         self.add_to_history(crate::debug_config::new_debug_config_output(
             &self.config,
@@ -2491,122 +1331,6 @@ impl ChatWidget {
         ));
     }
 
-    fn open_status_line_setup(&mut self) {
-        let configured_status_line_items = self.configured_status_line_items();
-        let view = StatusLineSetupView::new(
-            Some(configured_status_line_items.as_slice()),
-            self.config.tui_status_line_use_colors,
-            self.status_surface_preview_data(),
-            self.app_event_tx.clone(),
-            self.bottom_pane.list_keymap(),
-        );
-        self.bottom_pane.show_view(Box::new(view));
-    }
-
-    fn open_terminal_title_setup(&mut self) {
-        let configured_terminal_title_items = self.configured_terminal_title_items();
-        self.terminal_title_setup_original_items = Some(self.config.tui_terminal_title.clone());
-        let view = TerminalTitleSetupView::new(
-            Some(configured_terminal_title_items.as_slice()),
-            self.terminal_title_preview_data(),
-            self.app_event_tx.clone(),
-            self.bottom_pane.list_keymap(),
-        );
-        self.bottom_pane.show_view(Box::new(view));
-    }
-
-    fn status_surface_preview_data(&mut self) -> StatusSurfacePreviewData {
-        StatusSurfacePreviewData::from_iter(StatusSurfacePreviewItem::iter().filter_map(|item| {
-            self.status_surface_preview_value_for_item(item)
-                .map(|value| (item, value))
-        }))
-    }
-
-    fn terminal_title_preview_data(&mut self) -> StatusSurfacePreviewData {
-        let mut preview_data = self.status_surface_preview_data();
-        let now = Instant::now();
-        for item in TerminalTitleItem::iter() {
-            let Some(preview_item) = item.preview_item() else {
-                continue;
-            };
-            let Some(value) = self.terminal_title_value_for_item(item, now) else {
-                continue;
-            };
-            preview_data.set_live(preview_item, value);
-        }
-        preview_data
-    }
-    fn open_theme_picker(&mut self) {
-        let codex_home = crate::legacy_core::config::find_codex_home().ok();
-        let terminal_width = self
-            .last_rendered_width
-            .get()
-            .and_then(|width| u16::try_from(width).ok());
-        let params = crate::theme_picker::build_theme_picker_params(
-            self.config.tui_theme.as_deref(),
-            codex_home.as_deref(),
-            terminal_width,
-        );
-        self.bottom_pane.show_selection_view(params);
-    }
-
-    fn status_line_context_window_size(&self) -> Option<i64> {
-        self.token_info
-            .as_ref()
-            .and_then(|info| info.model_context_window)
-            .or(self.config.model_context_window)
-    }
-
-    fn status_line_context_remaining_percent(&self) -> Option<i64> {
-        let Some(context_window) = self.status_line_context_window_size() else {
-            return Some(100);
-        };
-        let default_usage = TokenUsage::default();
-        let usage = self
-            .token_info
-            .as_ref()
-            .map(|info| &info.last_token_usage)
-            .unwrap_or(&default_usage);
-        Some(
-            usage
-                .percent_of_context_window_remaining(context_window)
-                .clamp(0, 100),
-        )
-    }
-
-    fn status_line_context_used_percent(&self) -> Option<i64> {
-        let remaining = self.status_line_context_remaining_percent().unwrap_or(100);
-        Some((100 - remaining).clamp(0, 100))
-    }
-
-    fn status_line_total_usage(&self) -> TokenUsage {
-        self.token_info
-            .as_ref()
-            .map(|info| info.total_token_usage.clone())
-            .unwrap_or_default()
-    }
-
-    fn status_line_limit_display(
-        &self,
-        window: Option<&RateLimitWindowDisplay>,
-        label: &str,
-    ) -> Option<String> {
-        let window = window?;
-        let remaining = (100.0f64 - window.used_percent).clamp(0.0f64, 100.0f64);
-        Some(format!("{label} {remaining:.0}%"))
-    }
-
-    fn status_line_reasoning_effort_label(effort: Option<ReasoningEffortConfig>) -> &'static str {
-        match effort {
-            Some(ReasoningEffortConfig::Minimal) => "minimal",
-            Some(ReasoningEffortConfig::Low) => "low",
-            Some(ReasoningEffortConfig::Medium) => "medium",
-            Some(ReasoningEffortConfig::High) => "high",
-            Some(ReasoningEffortConfig::XHigh) => "xhigh",
-            None | Some(ReasoningEffortConfig::None) => "default",
-        }
-    }
-
     pub(crate) fn add_ps_output(&mut self) {
         let processes = self
             .unified_exec_processes
@@ -2629,2659 +1353,6 @@ impl ChatWidget {
         );
     }
 
-    fn stop_rate_limit_poller(&mut self) {}
-
-    pub(crate) fn refresh_connectors(&mut self, force_refetch: bool) {
-        self.prefetch_connectors_with_options(force_refetch);
-    }
-
-    fn prefetch_connectors(&mut self) {
-        self.prefetch_connectors_with_options(/*force_refetch*/ false);
-    }
-
-    fn prefetch_connectors_with_options(&mut self, force_refetch: bool) {
-        if !self.connectors_enabled() {
-            return;
-        }
-        if self.connectors.prefetch_in_flight {
-            if force_refetch {
-                self.connectors.force_refetch_pending = true;
-            }
-            return;
-        }
-
-        self.connectors.prefetch_in_flight = true;
-        if !matches!(self.connectors.cache, ConnectorsCacheState::Ready(_)) {
-            self.connectors.cache = ConnectorsCacheState::Loading;
-        }
-
-        let config = self.config.clone();
-        let environment_manager = Arc::clone(&self.environment_manager);
-        let app_event_tx = self.app_event_tx.clone();
-        tokio::spawn(async move {
-            let accessible_result =
-                match chatgpt_connectors::list_accessible_connectors_from_mcp_tools_with_environment_manager(
-                    &config,
-                    force_refetch,
-                    &environment_manager,
-                )
-                .await
-                {
-                    Ok(connectors) => connectors,
-                    Err(err) => {
-                        app_event_tx.send(AppEvent::ConnectorsLoaded {
-                            result: Err(format!("Failed to load apps: {err}")),
-                            is_final: true,
-                        });
-                        return;
-                    }
-                };
-            let should_schedule_force_refetch =
-                !force_refetch && !accessible_result.codex_apps_ready;
-            let accessible_connectors = accessible_result.connectors;
-
-            app_event_tx.send(AppEvent::ConnectorsLoaded {
-                result: Ok(ConnectorsSnapshot {
-                    connectors: accessible_connectors.clone(),
-                }),
-                is_final: false,
-            });
-
-            let result: Result<ConnectorsSnapshot, String> = async {
-                let all_connectors =
-                    chatgpt_connectors::list_all_connectors_with_options(&config, force_refetch)
-                        .await?;
-                let connectors = chatgpt_connectors::merge_connectors_with_accessible(
-                    all_connectors,
-                    accessible_connectors,
-                    /*all_connectors_loaded*/ true,
-                );
-                Ok(ConnectorsSnapshot { connectors })
-            }
-            .await
-            .map_err(|err: anyhow::Error| format!("Failed to load apps: {err}"));
-
-            app_event_tx.send(AppEvent::ConnectorsLoaded {
-                result,
-                is_final: true,
-            });
-
-            if should_schedule_force_refetch {
-                app_event_tx.send(AppEvent::RefreshConnectors {
-                    force_refetch: true,
-                });
-            }
-        });
-    }
-
-    #[cfg_attr(not(test), allow(dead_code))]
-    fn prefetch_rate_limits(&mut self) {
-        self.stop_rate_limit_poller();
-    }
-
-    #[cfg_attr(not(test), allow(dead_code))]
-    fn should_prefetch_rate_limits(&self) -> bool {
-        self.config.model_provider.requires_openai_auth && self.has_chatgpt_account
-    }
-
-    fn lower_cost_preset(&self) -> Option<ModelPreset> {
-        let models = self.model_catalog.try_list_models().ok()?;
-        models
-            .iter()
-            .find(|preset| preset.show_in_picker && preset.model == NUDGE_MODEL_SLUG)
-            .cloned()
-    }
-
-    fn rate_limit_switch_prompt_hidden(&self) -> bool {
-        self.config
-            .notices
-            .hide_rate_limit_model_nudge
-            .unwrap_or(false)
-    }
-
-    fn maybe_show_pending_rate_limit_prompt(&mut self) {
-        if self.rate_limit_switch_prompt_hidden() {
-            self.rate_limit_switch_prompt = RateLimitSwitchPromptState::Idle;
-            return;
-        }
-        if !matches!(
-            self.rate_limit_switch_prompt,
-            RateLimitSwitchPromptState::Pending
-        ) {
-            return;
-        }
-        if let Some(preset) = self.lower_cost_preset() {
-            self.open_rate_limit_switch_prompt(preset);
-            self.rate_limit_switch_prompt = RateLimitSwitchPromptState::Shown;
-        } else {
-            self.rate_limit_switch_prompt = RateLimitSwitchPromptState::Idle;
-        }
-    }
-
-    fn open_rate_limit_switch_prompt(&mut self, preset: ModelPreset) {
-        let switch_model = preset.model;
-        let switch_model_for_events = switch_model.clone();
-        let default_effort: ReasoningEffortConfig = preset.default_reasoning_effort;
-
-        let switch_actions: Vec<SelectionAction> = vec![Box::new(move |tx| {
-            tx.send(AppEvent::CodexOp(AppCommand::override_turn_context(
-                /*cwd*/ None,
-                /*approval_policy*/ None,
-                /*approvals_reviewer*/ None,
-                /*permission_profile*/ None,
-                /*windows_sandbox_level*/ None,
-                Some(switch_model_for_events.clone()),
-                Some(Some(default_effort)),
-                /*summary*/ None,
-                /*service_tier*/ None,
-                /*collaboration_mode*/ None,
-                /*personality*/ None,
-            )));
-            tx.send(AppEvent::UpdateModel(switch_model_for_events.clone()));
-            tx.send(AppEvent::UpdateReasoningEffort(Some(default_effort)));
-        })];
-
-        let keep_actions: Vec<SelectionAction> = Vec::new();
-        let never_actions: Vec<SelectionAction> = vec![Box::new(|tx| {
-            tx.send(AppEvent::UpdateRateLimitSwitchPromptHidden(true));
-            tx.send(AppEvent::PersistRateLimitSwitchPromptHidden);
-        })];
-        let description = if preset.description.is_empty() {
-            Some("Uses fewer credits for upcoming turns.".to_string())
-        } else {
-            Some(preset.description)
-        };
-
-        let items = vec![
-            SelectionItem {
-                name: format!("Switch to {switch_model}"),
-                description,
-                selected_description: None,
-                is_current: false,
-                actions: switch_actions,
-                dismiss_on_select: true,
-                ..Default::default()
-            },
-            SelectionItem {
-                name: "Keep current model".to_string(),
-                description: None,
-                selected_description: None,
-                is_current: false,
-                actions: keep_actions,
-                dismiss_on_select: true,
-                ..Default::default()
-            },
-            SelectionItem {
-                name: "Keep current model (never show again)".to_string(),
-                description: Some(
-                    "Hide future rate limit reminders about switching models.".to_string(),
-                ),
-                selected_description: None,
-                is_current: false,
-                actions: never_actions,
-                dismiss_on_select: true,
-                ..Default::default()
-            },
-        ];
-
-        self.bottom_pane.show_selection_view(SelectionViewParams {
-            title: Some("Approaching rate limits".to_string()),
-            subtitle: Some(format!("Switch to {switch_model} for lower credit usage?")),
-            footer_hint: Some(standard_popup_hint_line()),
-            items,
-            ..Default::default()
-        });
-    }
-
-    fn open_workspace_owner_nudge_prompt(&mut self, credit_type: AddCreditsNudgeCreditType) {
-        if self.add_credits_nudge_email_in_flight.is_some() {
-            return;
-        }
-
-        let (title, prompt) = match credit_type {
-            AddCreditsNudgeCreditType::Credits => (
-                "You've reached your workspace credit limit",
-                "Your workspace is out of credits. Ask your workspace owner to add more. Notify owner?",
-            ),
-            AddCreditsNudgeCreditType::UsageLimit => (
-                "Usage limit reached",
-                "Request a limit increase from your owner to continue using codex. Request increase?",
-            ),
-        };
-        let send_actions: Vec<SelectionAction> = vec![Box::new(move |tx| {
-            tx.send(AppEvent::SendAddCreditsNudgeEmail { credit_type });
-        })];
-        let items = vec![
-            SelectionItem {
-                name: "Yes".to_string(),
-                display_shortcut: Some(key_hint::plain(KeyCode::Char('y'))),
-                actions: send_actions,
-                dismiss_on_select: true,
-                ..Default::default()
-            },
-            SelectionItem {
-                name: "No".to_string(),
-                display_shortcut: Some(key_hint::plain(KeyCode::Char('n'))),
-                is_default: true,
-                dismiss_on_select: true,
-                ..Default::default()
-            },
-        ];
-
-        self.bottom_pane.show_selection_view(SelectionViewParams {
-            title: Some(title.to_string()),
-            subtitle: Some(prompt.to_string()),
-            footer_hint: Some(standard_popup_hint_line()),
-            items,
-            initial_selected_idx: Some(1),
-            ..Default::default()
-        });
-    }
-
-    pub(crate) fn start_add_credits_nudge_email_request(
-        &mut self,
-        credit_type: AddCreditsNudgeCreditType,
-    ) -> bool {
-        self.add_credits_nudge_email_in_flight = Some(credit_type);
-        true
-    }
-
-    pub(crate) fn finish_add_credits_nudge_email_request(
-        &mut self,
-        result: Result<AddCreditsNudgeEmailStatus, String>,
-    ) {
-        let credit_type = self
-            .add_credits_nudge_email_in_flight
-            .take()
-            .unwrap_or(AddCreditsNudgeCreditType::Credits);
-        let message = match (credit_type, result) {
-            (AddCreditsNudgeCreditType::Credits, Ok(AddCreditsNudgeEmailStatus::Sent)) => {
-                "Workspace owner notified."
-            }
-            (
-                AddCreditsNudgeCreditType::Credits,
-                Ok(AddCreditsNudgeEmailStatus::CooldownActive),
-            ) => "Workspace owner was already notified recently.",
-            (AddCreditsNudgeCreditType::Credits, Err(_)) => {
-                "Could not notify your workspace owner. Please try again."
-            }
-            (AddCreditsNudgeCreditType::UsageLimit, Ok(AddCreditsNudgeEmailStatus::Sent)) => {
-                "Limit increase requested."
-            }
-            (
-                AddCreditsNudgeCreditType::UsageLimit,
-                Ok(AddCreditsNudgeEmailStatus::CooldownActive),
-            ) => "A limit increase was already requested recently.",
-            (AddCreditsNudgeCreditType::UsageLimit, Err(_)) => {
-                "Could not request a limit increase. Please try again."
-            }
-        };
-        self.add_to_history(history_cell::new_info_event(
-            message.to_string(),
-            /*hint*/ None,
-        ));
-        self.request_redraw();
-    }
-
-    /// Open a popup to choose a quick auto model. Selecting "All models"
-    /// opens the full picker with every available preset.
-    pub(crate) fn open_model_popup(&mut self) {
-        if !self.is_session_configured() {
-            self.add_info_message(
-                "Model selection is disabled until startup completes.".to_string(),
-                /*hint*/ None,
-            );
-            return;
-        }
-
-        let presets: Vec<ModelPreset> = match self.model_catalog.try_list_models() {
-            Ok(models) => models,
-            Err(_) => {
-                self.add_info_message(
-                    "Models are being updated; please try /model again in a moment.".to_string(),
-                    /*hint*/ None,
-                );
-                return;
-            }
-        };
-        self.open_model_popup_with_presets(presets);
-    }
-
-    pub(crate) fn open_personality_popup(&mut self) {
-        if !self.is_session_configured() {
-            self.add_info_message(
-                "Personality selection is disabled until startup completes.".to_string(),
-                /*hint*/ None,
-            );
-            return;
-        }
-        if !self.current_model_supports_personality() {
-            let current_model = self.current_model();
-            self.add_error_message(format!(
-                "Current model ({current_model}) doesn't support personalities. Try /model to pick a different model."
-            ));
-            return;
-        }
-        self.open_personality_popup_for_current_model();
-    }
-
-    fn open_personality_popup_for_current_model(&mut self) {
-        let current_personality = self.config.personality.unwrap_or(Personality::Friendly);
-        let personalities = [Personality::Friendly, Personality::Pragmatic];
-        let supports_personality = self.current_model_supports_personality();
-
-        let items: Vec<SelectionItem> = personalities
-            .into_iter()
-            .map(|personality| {
-                let name = Self::personality_label(personality).to_string();
-                let description = Some(Self::personality_description(personality).to_string());
-                let actions: Vec<SelectionAction> = vec![Box::new(move |tx| {
-                    tx.send(AppEvent::CodexOp(AppCommand::override_turn_context(
-                        /*cwd*/ None,
-                        /*approval_policy*/ None,
-                        /*approvals_reviewer*/ None,
-                        /*permission_profile*/ None,
-                        /*windows_sandbox_level*/ None,
-                        /*model*/ None,
-                        /*effort*/ None,
-                        /*summary*/ None,
-                        /*service_tier*/ None,
-                        /*collaboration_mode*/ None,
-                        Some(personality),
-                    )));
-                    tx.send(AppEvent::UpdatePersonality(personality));
-                    tx.send(AppEvent::PersistPersonalitySelection { personality });
-                })];
-                SelectionItem {
-                    name,
-                    description,
-                    is_current: current_personality == personality,
-                    is_disabled: !supports_personality,
-                    actions,
-                    dismiss_on_select: true,
-                    ..Default::default()
-                }
-            })
-            .collect();
-
-        let mut header = ColumnRenderable::new();
-        header.push(Line::from("Select Personality".bold()));
-        header.push(Line::from("Choose a communication style for Codex.".dim()));
-
-        self.bottom_pane.show_selection_view(SelectionViewParams {
-            header: Box::new(header),
-            footer_hint: Some(standard_popup_hint_line()),
-            items,
-            ..Default::default()
-        });
-    }
-
-    pub(crate) fn open_realtime_audio_popup(&mut self) {
-        let items = [
-            RealtimeAudioDeviceKind::Microphone,
-            RealtimeAudioDeviceKind::Speaker,
-        ]
-        .into_iter()
-        .map(|kind| {
-            let description = Some(format!(
-                "Current: {}",
-                self.current_realtime_audio_selection_label(kind)
-            ));
-            let actions: Vec<SelectionAction> = vec![Box::new(move |tx| {
-                tx.send(AppEvent::OpenRealtimeAudioDeviceSelection { kind });
-            })];
-            SelectionItem {
-                name: kind.title().to_string(),
-                description,
-                actions,
-                dismiss_on_select: true,
-                ..Default::default()
-            }
-        })
-        .collect();
-
-        self.bottom_pane.show_selection_view(SelectionViewParams {
-            title: Some("Settings".to_string()),
-            subtitle: Some("Configure settings for Codex.".to_string()),
-            footer_hint: Some(standard_popup_hint_line()),
-            items,
-            ..Default::default()
-        });
-    }
-
-    #[cfg(not(target_os = "linux"))]
-    pub(crate) fn open_realtime_audio_device_selection(&mut self, kind: RealtimeAudioDeviceKind) {
-        match list_realtime_audio_device_names(kind) {
-            Ok(device_names) => {
-                self.open_realtime_audio_device_selection_with_names(kind, device_names);
-            }
-            Err(err) => {
-                self.add_error_message(format!(
-                    "Failed to load realtime {} devices: {err}",
-                    kind.noun()
-                ));
-            }
-        }
-    }
-
-    #[cfg(target_os = "linux")]
-    pub(crate) fn open_realtime_audio_device_selection(&mut self, kind: RealtimeAudioDeviceKind) {
-        let _ = kind;
-    }
-
-    #[cfg(not(target_os = "linux"))]
-    fn open_realtime_audio_device_selection_with_names(
-        &mut self,
-        kind: RealtimeAudioDeviceKind,
-        device_names: Vec<String>,
-    ) {
-        let current_selection = self.current_realtime_audio_device_name(kind);
-        let current_available = current_selection
-            .as_deref()
-            .is_some_and(|name| device_names.iter().any(|device_name| device_name == name));
-        let mut items = vec![SelectionItem {
-            name: "System default".to_string(),
-            description: Some("Use your operating system default device.".to_string()),
-            is_current: current_selection.is_none(),
-            actions: vec![Box::new(move |tx| {
-                tx.send(AppEvent::PersistRealtimeAudioDeviceSelection { kind, name: None });
-            })],
-            dismiss_on_select: true,
-            ..Default::default()
-        }];
-
-        if let Some(selection) = current_selection.as_deref()
-            && !current_available
-        {
-            items.push(SelectionItem {
-                name: format!("Unavailable: {selection}"),
-                description: Some("Configured device is not currently available.".to_string()),
-                is_current: true,
-                is_disabled: true,
-                disabled_reason: Some("Reconnect the device or choose another one.".to_string()),
-                ..Default::default()
-            });
-        }
-
-        items.extend(device_names.into_iter().map(|device_name| {
-            let persisted_name = device_name.clone();
-            let actions: Vec<SelectionAction> = vec![Box::new(move |tx| {
-                tx.send(AppEvent::PersistRealtimeAudioDeviceSelection {
-                    kind,
-                    name: Some(persisted_name.clone()),
-                });
-            })];
-            SelectionItem {
-                is_current: current_selection.as_deref() == Some(device_name.as_str()),
-                name: device_name,
-                actions,
-                dismiss_on_select: true,
-                ..Default::default()
-            }
-        }));
-
-        let mut header = ColumnRenderable::new();
-        header.push(Line::from(format!("Select {}", kind.title()).bold()));
-        header.push(Line::from(
-            "Saved devices apply to realtime voice only.".dim(),
-        ));
-
-        self.bottom_pane.show_selection_view(SelectionViewParams {
-            header: Box::new(header),
-            footer_hint: Some(standard_popup_hint_line()),
-            items,
-            ..Default::default()
-        });
-    }
-
-    pub(crate) fn open_realtime_audio_restart_prompt(&mut self, kind: RealtimeAudioDeviceKind) {
-        let restart_actions: Vec<SelectionAction> = vec![Box::new(move |tx| {
-            tx.send(AppEvent::RestartRealtimeAudioDevice { kind });
-        })];
-        let items = vec![
-            SelectionItem {
-                name: "Restart now".to_string(),
-                description: Some(format!("Restart local {} audio now.", kind.noun())),
-                actions: restart_actions,
-                dismiss_on_select: true,
-                ..Default::default()
-            },
-            SelectionItem {
-                name: "Apply later".to_string(),
-                description: Some(format!(
-                    "Keep the current {} until local audio starts again.",
-                    kind.noun()
-                )),
-                dismiss_on_select: true,
-                ..Default::default()
-            },
-        ];
-
-        let mut header = ColumnRenderable::new();
-        header.push(Line::from(format!("Restart {} now?", kind.title()).bold()));
-        header.push(Line::from(
-            "Configuration is saved. Restart local audio to use it immediately.".dim(),
-        ));
-
-        self.bottom_pane.show_selection_view(SelectionViewParams {
-            header: Box::new(header),
-            footer_hint: Some(standard_popup_hint_line()),
-            items,
-            ..Default::default()
-        });
-    }
-
-    fn model_menu_header(&self, title: &str, subtitle: &str) -> Box<dyn Renderable> {
-        let title = title.to_string();
-        let subtitle = subtitle.to_string();
-        let mut header = ColumnRenderable::new();
-        header.push(Line::from(title.bold()));
-        header.push(Line::from(subtitle.dim()));
-        if let Some(warning) = self.model_menu_warning_line() {
-            header.push(warning);
-        }
-        Box::new(header)
-    }
-
-    fn model_menu_warning_line(&self) -> Option<Line<'static>> {
-        let base_url = self.custom_openai_base_url()?;
-        let warning = format!(
-            "Warning: OpenAI base URL is overridden to {base_url}. Selecting models may not be supported or work properly."
-        );
-        Some(Line::from(warning.red()))
-    }
-
-    fn custom_openai_base_url(&self) -> Option<String> {
-        if !self.config.model_provider.is_openai() {
-            return None;
-        }
-
-        let base_url = self.config.model_provider.base_url.as_ref()?;
-        let trimmed = base_url.trim();
-        if trimmed.is_empty() {
-            return None;
-        }
-
-        let normalized = trimmed.trim_end_matches('/');
-        if normalized == DEFAULT_OPENAI_BASE_URL {
-            return None;
-        }
-
-        Some(trimmed.to_string())
-    }
-
-    pub(crate) fn open_model_popup_with_presets(&mut self, presets: Vec<ModelPreset>) {
-        let presets: Vec<ModelPreset> = presets
-            .into_iter()
-            .filter(|preset| preset.show_in_picker)
-            .collect();
-
-        let current_model = self.current_model();
-        let current_label = presets
-            .iter()
-            .find(|preset| preset.model.as_str() == current_model)
-            .map(|preset| preset.model.to_string())
-            .unwrap_or_else(|| self.model_display_name().to_string());
-
-        let (mut auto_presets, other_presets): (Vec<ModelPreset>, Vec<ModelPreset>) = presets
-            .into_iter()
-            .partition(|preset| Self::is_auto_model(&preset.model));
-
-        if auto_presets.is_empty() {
-            self.open_all_models_popup(other_presets);
-            return;
-        }
-
-        auto_presets.sort_by_key(|preset| Self::auto_model_order(&preset.model));
-        let mut items: Vec<SelectionItem> = auto_presets
-            .into_iter()
-            .map(|preset| {
-                let description =
-                    (!preset.description.is_empty()).then_some(preset.description.clone());
-                let model = preset.model.clone();
-                let should_prompt_plan_mode_scope = self.should_prompt_plan_mode_reasoning_scope(
-                    model.as_str(),
-                    Some(preset.default_reasoning_effort),
-                );
-                let actions = Self::model_selection_actions(
-                    model.clone(),
-                    Some(preset.default_reasoning_effort),
-                    should_prompt_plan_mode_scope,
-                );
-                SelectionItem {
-                    name: model.clone(),
-                    description,
-                    is_current: model.as_str() == current_model,
-                    is_default: preset.is_default,
-                    actions,
-                    dismiss_on_select: true,
-                    ..Default::default()
-                }
-            })
-            .collect();
-
-        if !other_presets.is_empty() {
-            let all_models = other_presets;
-            let actions: Vec<SelectionAction> = vec![Box::new(move |tx| {
-                tx.send(AppEvent::OpenAllModelsPopup {
-                    models: all_models.clone(),
-                });
-            })];
-
-            let is_current = !items.iter().any(|item| item.is_current);
-            let description = Some(format!(
-                "Choose a specific model and reasoning level (current: {current_label})"
-            ));
-
-            items.push(SelectionItem {
-                name: "All models".to_string(),
-                description,
-                is_current,
-                actions,
-                dismiss_on_select: true,
-                ..Default::default()
-            });
-        }
-
-        let header = self.model_menu_header(
-            "Select Model",
-            "Pick a quick auto mode or browse all models.",
-        );
-        self.bottom_pane.show_selection_view(SelectionViewParams {
-            footer_hint: Some(standard_popup_hint_line()),
-            items,
-            header,
-            ..Default::default()
-        });
-    }
-
-    fn is_auto_model(model: &str) -> bool {
-        model.starts_with("codex-auto-")
-    }
-
-    fn auto_model_order(model: &str) -> usize {
-        match model {
-            "codex-auto-fast" => 0,
-            "codex-auto-balanced" => 1,
-            "codex-auto-thorough" => 2,
-            _ => 3,
-        }
-    }
-
-    pub(crate) fn open_all_models_popup(&mut self, presets: Vec<ModelPreset>) {
-        if presets.is_empty() {
-            self.add_info_message(
-                "No additional models are available right now.".to_string(),
-                /*hint*/ None,
-            );
-            return;
-        }
-
-        let mut items: Vec<SelectionItem> = Vec::new();
-        for preset in presets.into_iter() {
-            let description =
-                (!preset.description.is_empty()).then_some(preset.description.to_string());
-            let is_current = preset.model.as_str() == self.current_model();
-            let single_supported_effort = preset.supported_reasoning_efforts.len() == 1;
-            let preset_for_action = preset.clone();
-            let actions: Vec<SelectionAction> = vec![Box::new(move |tx| {
-                let preset_for_event = preset_for_action.clone();
-                tx.send(AppEvent::OpenReasoningPopup {
-                    model: preset_for_event,
-                });
-            })];
-            items.push(SelectionItem {
-                name: preset.model.clone(),
-                description,
-                is_current,
-                is_default: preset.is_default,
-                actions,
-                dismiss_on_select: single_supported_effort,
-                dismiss_parent_on_child_accept: !single_supported_effort,
-                ..Default::default()
-            });
-        }
-
-        let header = self.model_menu_header(
-            "Select Model and Effort",
-            "Access legacy models by running codex -m <model_name> or in your config.toml",
-        );
-        self.bottom_pane.show_selection_view(SelectionViewParams {
-            footer_hint: Some(self.bottom_pane.standard_popup_hint_line()),
-            items,
-            header,
-            ..Default::default()
-        });
-    }
-
-    pub(crate) fn open_collaboration_modes_popup(&mut self) {
-        let presets = collaboration_modes::presets_for_tui(self.model_catalog.as_ref());
-        if presets.is_empty() {
-            self.add_info_message(
-                "No collaboration modes are available right now.".to_string(),
-                /*hint*/ None,
-            );
-            return;
-        }
-
-        let current_kind = self
-            .active_collaboration_mask
-            .as_ref()
-            .and_then(|mask| mask.mode)
-            .or_else(|| {
-                collaboration_modes::default_mask(self.model_catalog.as_ref())
-                    .and_then(|mask| mask.mode)
-            });
-        let items: Vec<SelectionItem> = presets
-            .into_iter()
-            .map(|mask| {
-                let name = mask.name.clone();
-                let is_current = current_kind == mask.mode;
-                let actions: Vec<SelectionAction> = vec![Box::new(move |tx| {
-                    tx.send(AppEvent::UpdateCollaborationMode(mask.clone()));
-                })];
-                SelectionItem {
-                    name,
-                    is_current,
-                    actions,
-                    dismiss_on_select: true,
-                    ..Default::default()
-                }
-            })
-            .collect();
-
-        self.bottom_pane.show_selection_view(SelectionViewParams {
-            title: Some("Select Collaboration Mode".to_string()),
-            subtitle: Some("Pick a collaboration preset.".to_string()),
-            footer_hint: Some(standard_popup_hint_line()),
-            items,
-            ..Default::default()
-        });
-    }
-
-    fn model_selection_actions(
-        model_for_action: String,
-        effort_for_action: Option<ReasoningEffortConfig>,
-        should_prompt_plan_mode_scope: bool,
-    ) -> Vec<SelectionAction> {
-        vec![Box::new(move |tx| {
-            if should_prompt_plan_mode_scope {
-                tx.send(AppEvent::OpenPlanReasoningScopePrompt {
-                    model: model_for_action.clone(),
-                    effort: effort_for_action,
-                });
-                return;
-            }
-
-            tx.send(AppEvent::UpdateModel(model_for_action.clone()));
-            tx.send(AppEvent::UpdateReasoningEffort(effort_for_action));
-            tx.send(AppEvent::PersistModelSelection {
-                model: model_for_action.clone(),
-                effort: effort_for_action,
-            });
-        })]
-    }
-
-    fn should_prompt_plan_mode_reasoning_scope(
-        &self,
-        selected_model: &str,
-        selected_effort: Option<ReasoningEffortConfig>,
-    ) -> bool {
-        if !self.collaboration_modes_enabled()
-            || self.active_mode_kind() != ModeKind::Plan
-            || selected_model != self.current_model()
-        {
-            return false;
-        }
-
-        // Prompt whenever the selection is not a true no-op for both:
-        // 1) the active Plan-mode effective reasoning, and
-        // 2) the stored global defaults that would be updated by the fallback path.
-        selected_effort != self.effective_reasoning_effort()
-            || selected_model != self.current_collaboration_mode.model()
-            || selected_effort != self.current_collaboration_mode.reasoning_effort()
-    }
-
-    pub(crate) fn open_plan_reasoning_scope_prompt(
-        &mut self,
-        model: String,
-        effort: Option<ReasoningEffortConfig>,
-    ) {
-        let reasoning_phrase = match effort {
-            Some(ReasoningEffortConfig::None) => "no reasoning".to_string(),
-            Some(selected_effort) => {
-                format!(
-                    "{} reasoning",
-                    Self::reasoning_effort_label(selected_effort).to_lowercase()
-                )
-            }
-            None => "the selected reasoning".to_string(),
-        };
-        let plan_only_description = format!("Always use {reasoning_phrase} in Plan mode.");
-        let plan_reasoning_source = if let Some(plan_override) =
-            self.config.plan_mode_reasoning_effort
-        {
-            format!(
-                "user-chosen Plan override ({})",
-                Self::reasoning_effort_label(plan_override).to_lowercase()
-            )
-        } else if let Some(plan_mask) = collaboration_modes::plan_mask(self.model_catalog.as_ref())
-        {
-            match plan_mask.reasoning_effort.flatten() {
-                Some(plan_effort) => format!(
-                    "built-in Plan default ({})",
-                    Self::reasoning_effort_label(plan_effort).to_lowercase()
-                ),
-                None => "built-in Plan default (no reasoning)".to_string(),
-            }
-        } else {
-            "built-in Plan default".to_string()
-        };
-        let all_modes_description = format!(
-            "Set the global default reasoning level and the Plan mode override. This replaces the current {plan_reasoning_source}."
-        );
-        let subtitle = format!("Choose where to apply {reasoning_phrase}.");
-
-        let plan_only_actions: Vec<SelectionAction> = vec![Box::new({
-            let model = model.clone();
-            move |tx| {
-                tx.send(AppEvent::UpdateModel(model.clone()));
-                tx.send(AppEvent::UpdatePlanModeReasoningEffort(effort));
-                tx.send(AppEvent::PersistPlanModeReasoningEffort(effort));
-            }
-        })];
-        let all_modes_actions: Vec<SelectionAction> = vec![Box::new(move |tx| {
-            tx.send(AppEvent::UpdateModel(model.clone()));
-            tx.send(AppEvent::UpdateReasoningEffort(effort));
-            tx.send(AppEvent::UpdatePlanModeReasoningEffort(effort));
-            tx.send(AppEvent::PersistPlanModeReasoningEffort(effort));
-            tx.send(AppEvent::PersistModelSelection {
-                model: model.clone(),
-                effort,
-            });
-        })];
-
-        self.bottom_pane.show_selection_view(SelectionViewParams {
-            title: Some(PLAN_MODE_REASONING_SCOPE_TITLE.to_string()),
-            subtitle: Some(subtitle),
-            footer_hint: Some(standard_popup_hint_line()),
-            items: vec![
-                SelectionItem {
-                    name: PLAN_MODE_REASONING_SCOPE_PLAN_ONLY.to_string(),
-                    description: Some(plan_only_description),
-                    actions: plan_only_actions,
-                    dismiss_on_select: true,
-                    ..Default::default()
-                },
-                SelectionItem {
-                    name: PLAN_MODE_REASONING_SCOPE_ALL_MODES.to_string(),
-                    description: Some(all_modes_description),
-                    actions: all_modes_actions,
-                    dismiss_on_select: true,
-                    ..Default::default()
-                },
-            ],
-            ..Default::default()
-        });
-        self.notify(Notification::PlanModePrompt {
-            title: PLAN_MODE_REASONING_SCOPE_TITLE.to_string(),
-        });
-    }
-
-    /// Open a popup to choose the reasoning effort (stage 2) for the given model.
-    pub(crate) fn open_reasoning_popup(&mut self, preset: ModelPreset) {
-        let default_effort: ReasoningEffortConfig = preset.default_reasoning_effort;
-        let supported = preset.supported_reasoning_efforts;
-        let in_plan_mode =
-            self.collaboration_modes_enabled() && self.active_mode_kind() == ModeKind::Plan;
-
-        let warn_effort = if supported
-            .iter()
-            .any(|option| option.effort == ReasoningEffortConfig::XHigh)
-        {
-            Some(ReasoningEffortConfig::XHigh)
-        } else if supported
-            .iter()
-            .any(|option| option.effort == ReasoningEffortConfig::High)
-        {
-            Some(ReasoningEffortConfig::High)
-        } else {
-            None
-        };
-        let warning_text = warn_effort.map(|effort| {
-            let effort_label = Self::reasoning_effort_label(effort);
-            format!("⚠ {effort_label} reasoning effort can quickly consume Plus plan rate limits.")
-        });
-        let warn_for_model = preset.model.starts_with("gpt-5.1-codex")
-            || preset.model.starts_with("gpt-5.1-codex-max")
-            || preset.model.starts_with("gpt-5.2");
-
-        struct EffortChoice {
-            stored: Option<ReasoningEffortConfig>,
-            display: ReasoningEffortConfig,
-        }
-        let mut choices: Vec<EffortChoice> = Vec::new();
-        for effort in ReasoningEffortConfig::iter() {
-            if supported.iter().any(|option| option.effort == effort) {
-                choices.push(EffortChoice {
-                    stored: Some(effort),
-                    display: effort,
-                });
-            }
-        }
-        if choices.is_empty() {
-            choices.push(EffortChoice {
-                stored: Some(default_effort),
-                display: default_effort,
-            });
-        }
-
-        if choices.len() == 1 {
-            let selected_effort = choices.first().and_then(|c| c.stored);
-            let selected_model = preset.model;
-            if self.should_prompt_plan_mode_reasoning_scope(&selected_model, selected_effort) {
-                self.app_event_tx
-                    .send(AppEvent::OpenPlanReasoningScopePrompt {
-                        model: selected_model,
-                        effort: selected_effort,
-                    });
-            } else {
-                self.apply_model_and_effort(selected_model, selected_effort);
-            }
-            return;
-        }
-
-        let default_choice: Option<ReasoningEffortConfig> = choices
-            .iter()
-            .any(|choice| choice.stored == Some(default_effort))
-            .then_some(Some(default_effort))
-            .flatten()
-            .or_else(|| choices.iter().find_map(|choice| choice.stored))
-            .or(Some(default_effort));
-
-        let model_slug = preset.model.to_string();
-        let is_current_model = self.current_model() == preset.model.as_str();
-        let highlight_choice = if is_current_model {
-            if in_plan_mode {
-                self.config
-                    .plan_mode_reasoning_effort
-                    .or(self.effective_reasoning_effort())
-            } else {
-                self.effective_reasoning_effort()
-            }
-        } else {
-            default_choice
-        };
-        let selection_choice = highlight_choice.or(default_choice);
-        let initial_selected_idx = choices
-            .iter()
-            .position(|choice| choice.stored == selection_choice)
-            .or_else(|| {
-                selection_choice
-                    .and_then(|effort| choices.iter().position(|choice| choice.display == effort))
-            });
-        let mut items: Vec<SelectionItem> = Vec::new();
-        for choice in choices.iter() {
-            let effort = choice.display;
-            let mut effort_label = Self::reasoning_effort_label(effort).to_string();
-            if choice.stored == default_choice {
-                effort_label.push_str(" (default)");
-            }
-
-            let description = choice
-                .stored
-                .and_then(|effort| {
-                    supported
-                        .iter()
-                        .find(|option| option.effort == effort)
-                        .map(|option| option.description.to_string())
-                })
-                .filter(|text| !text.is_empty());
-
-            let show_warning = warn_for_model && warn_effort == Some(effort);
-            let selected_description = if show_warning {
-                warning_text.as_ref().map(|warning_message| {
-                    description.as_ref().map_or_else(
-                        || warning_message.clone(),
-                        |d| format!("{d}\n{warning_message}"),
-                    )
-                })
-            } else {
-                None
-            };
-
-            let model_for_action = model_slug.clone();
-            let choice_effort = choice.stored;
-            let should_prompt_plan_mode_scope =
-                self.should_prompt_plan_mode_reasoning_scope(model_slug.as_str(), choice_effort);
-            let actions: Vec<SelectionAction> = vec![Box::new(move |tx| {
-                if should_prompt_plan_mode_scope {
-                    tx.send(AppEvent::OpenPlanReasoningScopePrompt {
-                        model: model_for_action.clone(),
-                        effort: choice_effort,
-                    });
-                } else {
-                    tx.send(AppEvent::UpdateModel(model_for_action.clone()));
-                    tx.send(AppEvent::UpdateReasoningEffort(choice_effort));
-                    tx.send(AppEvent::PersistModelSelection {
-                        model: model_for_action.clone(),
-                        effort: choice_effort,
-                    });
-                }
-            })];
-
-            items.push(SelectionItem {
-                name: effort_label,
-                description,
-                selected_description,
-                is_current: is_current_model && choice.stored == highlight_choice,
-                actions,
-                dismiss_on_select: true,
-                ..Default::default()
-            });
-        }
-
-        let mut header = ColumnRenderable::new();
-        header.push(Line::from(
-            format!("Select Reasoning Level for {model_slug}").bold(),
-        ));
-
-        self.bottom_pane.show_selection_view(SelectionViewParams {
-            header: Box::new(header),
-            footer_hint: Some(standard_popup_hint_line()),
-            items,
-            initial_selected_idx,
-            ..Default::default()
-        });
-    }
-
-    fn reasoning_effort_label(effort: ReasoningEffortConfig) -> &'static str {
-        match effort {
-            ReasoningEffortConfig::None => "None",
-            ReasoningEffortConfig::Minimal => "Minimal",
-            ReasoningEffortConfig::Low => "Low",
-            ReasoningEffortConfig::Medium => "Medium",
-            ReasoningEffortConfig::High => "High",
-            ReasoningEffortConfig::XHigh => "Extra high",
-        }
-    }
-
-    fn apply_model_and_effort_without_persist(
-        &self,
-        model: String,
-        effort: Option<ReasoningEffortConfig>,
-    ) {
-        self.app_event_tx.send(AppEvent::UpdateModel(model));
-        self.app_event_tx
-            .send(AppEvent::UpdateReasoningEffort(effort));
-    }
-
-    fn apply_model_and_effort(&self, model: String, effort: Option<ReasoningEffortConfig>) {
-        self.apply_model_and_effort_without_persist(model.clone(), effort);
-        self.app_event_tx
-            .send(AppEvent::PersistModelSelection { model, effort });
-    }
-
-    /// Open the permissions popup.
-    pub(crate) fn open_approvals_popup(&mut self) {
-        self.open_permissions_popup();
-    }
-
-    /// Open a popup to choose the permissions mode.
-    pub(crate) fn open_permissions_popup(&mut self) {
-        let include_read_only = cfg!(target_os = "windows");
-        let current_approval =
-            AskForApproval::from(self.config.permissions.approval_policy.value());
-        let current_permission_profile = self.config.permissions.permission_profile();
-        let guardian_approval_enabled = self.config.features.enabled(Feature::GuardianApproval);
-        let current_review_policy = self.config.approvals_reviewer;
-        let mut items: Vec<SelectionItem> = Vec::new();
-        let presets: Vec<ApprovalPreset> = builtin_approval_presets();
-
-        #[cfg(target_os = "windows")]
-        let windows_sandbox_level = WindowsSandboxLevel::from_config(&self.config);
-        #[cfg(target_os = "windows")]
-        let windows_degraded_sandbox_enabled =
-            matches!(windows_sandbox_level, WindowsSandboxLevel::RestrictedToken);
-        #[cfg(not(target_os = "windows"))]
-        let windows_degraded_sandbox_enabled = false;
-
-        let show_elevate_sandbox_hint =
-            crate::legacy_core::windows_sandbox::ELEVATED_SANDBOX_NUX_ENABLED
-                && windows_degraded_sandbox_enabled
-                && presets.iter().any(|preset| preset.id == "auto");
-
-        let guardian_disabled_reason = |enabled: bool| {
-            let mut next_features = self.config.features.get().clone();
-            next_features.set_enabled(Feature::GuardianApproval, enabled);
-            self.config
-                .features
-                .can_set(&next_features)
-                .err()
-                .map(|err| err.to_string())
-        };
-
-        for preset in presets.into_iter() {
-            if !include_read_only && preset.id == "read-only" {
-                continue;
-            }
-            let base_name = if preset.id == "auto" && windows_degraded_sandbox_enabled {
-                "Default (non-admin sandbox)".to_string()
-            } else {
-                preset.label.to_string()
-            };
-            let preset_approval = AskForApproval::from(preset.approval);
-            let base_description =
-                Some(preset.description.replace(" (Identical to Agent mode)", ""));
-            let approval_disabled_reason = match self
-                .config
-                .permissions
-                .approval_policy
-                .can_set(&preset.approval)
-            {
-                Ok(()) => None,
-                Err(err) => Some(err.to_string()),
-            };
-            let default_disabled_reason = approval_disabled_reason
-                .clone()
-                .or_else(|| guardian_disabled_reason(false));
-            let requires_confirmation = preset.id == "full-access"
-                && !self
-                    .config
-                    .notices
-                    .hide_full_access_warning
-                    .unwrap_or(false);
-            let default_actions: Vec<SelectionAction> = if requires_confirmation {
-                let preset_clone = preset.clone();
-                vec![Box::new(move |tx| {
-                    tx.send(AppEvent::OpenFullAccessConfirmation {
-                        preset: preset_clone.clone(),
-                        return_to_permissions: !include_read_only,
-                    });
-                })]
-            } else if preset.id == "auto" {
-                #[cfg(target_os = "windows")]
-                {
-                    if WindowsSandboxLevel::from_config(&self.config)
-                        == WindowsSandboxLevel::Disabled
-                    {
-                        let preset_clone = preset.clone();
-                        if crate::legacy_core::windows_sandbox::ELEVATED_SANDBOX_NUX_ENABLED
-                            && crate::legacy_core::windows_sandbox::sandbox_setup_is_complete(
-                                self.config.codex_home.as_path(),
-                            )
-                        {
-                            vec![Box::new(move |tx| {
-                                tx.send(AppEvent::EnableWindowsSandboxForAgentMode {
-                                    preset: preset_clone.clone(),
-                                    mode: WindowsSandboxEnableMode::Elevated,
-                                });
-                            })]
-                        } else {
-                            vec![Box::new(move |tx| {
-                                tx.send(AppEvent::OpenWindowsSandboxEnablePrompt {
-                                    preset: preset_clone.clone(),
-                                });
-                            })]
-                        }
-                    } else if let Some((sample_paths, extra_count, failed_scan)) =
-                        self.world_writable_warning_details()
-                    {
-                        let preset_clone = preset.clone();
-                        vec![Box::new(move |tx| {
-                            tx.send(AppEvent::OpenWorldWritableWarningConfirmation {
-                                preset: Some(preset_clone.clone()),
-                                sample_paths: sample_paths.clone(),
-                                extra_count,
-                                failed_scan,
-                            });
-                        })]
-                    } else {
-                        Self::approval_preset_actions(
-                            preset_approval,
-                            preset.permission_profile.clone(),
-                            base_name.clone(),
-                            ApprovalsReviewer::User,
-                        )
-                    }
-                }
-                #[cfg(not(target_os = "windows"))]
-                {
-                    Self::approval_preset_actions(
-                        preset_approval,
-                        preset.permission_profile.clone(),
-                        base_name.clone(),
-                        ApprovalsReviewer::User,
-                    )
-                }
-            } else {
-                Self::approval_preset_actions(
-                    preset_approval,
-                    preset.permission_profile.clone(),
-                    base_name.clone(),
-                    ApprovalsReviewer::User,
-                )
-            };
-            if preset.id == "auto" {
-                items.push(SelectionItem {
-                    name: base_name.clone(),
-                    description: base_description.clone(),
-                    is_current: current_review_policy == ApprovalsReviewer::User
-                        && Self::preset_matches_current(
-                            current_approval,
-                            &current_permission_profile,
-                            self.config.cwd.as_path(),
-                            &preset,
-                        ),
-                    actions: default_actions,
-                    dismiss_on_select: true,
-                    disabled_reason: default_disabled_reason,
-                    ..Default::default()
-                });
-
-                if guardian_approval_enabled {
-                    items.push(SelectionItem {
-                        name: "Auto-review".to_string(),
-                        description: Some(
-                            "Same workspace-write permissions as Default, but eligible `on-request` approvals are routed through the auto-reviewer subagent."
-                                .to_string(),
-                        ),
-                        is_current: current_review_policy == ApprovalsReviewer::AutoReview
-                            && Self::preset_matches_current(
-                                current_approval,
-                                &current_permission_profile,
-                                self.config.cwd.as_path(),
-                                &preset,
-                            ),
-                        actions: Self::approval_preset_actions(
-                            preset_approval,
-                            preset.permission_profile.clone(),
-                            "Auto-review".to_string(),
-                            ApprovalsReviewer::AutoReview,
-                        ),
-                        dismiss_on_select: true,
-                        disabled_reason: approval_disabled_reason
-                            .or_else(|| guardian_disabled_reason(true)),
-                        ..Default::default()
-                    });
-                }
-            } else {
-                items.push(SelectionItem {
-                    name: base_name,
-                    description: base_description,
-                    is_current: Self::preset_matches_current(
-                        current_approval,
-                        &current_permission_profile,
-                        self.config.cwd.as_path(),
-                        &preset,
-                    ),
-                    actions: default_actions,
-                    dismiss_on_select: true,
-                    disabled_reason: default_disabled_reason,
-                    ..Default::default()
-                });
-            }
-        }
-
-        let footer_note = show_elevate_sandbox_hint.then(|| {
-            vec![
-                "The non-admin sandbox protects your files and prevents network access under most circumstances. However, it carries greater risk if prompt injected. To upgrade to the default sandbox, run ".dim(),
-                "/setup-default-sandbox".cyan(),
-                ".".dim(),
-            ]
-            .into()
-        });
-
-        self.bottom_pane.show_selection_view(SelectionViewParams {
-            title: Some("Update Model Permissions".to_string()),
-            footer_note,
-            footer_hint: Some(standard_popup_hint_line()),
-            items,
-            header: Box::new(()),
-            ..Default::default()
-        });
-    }
-
-    pub(crate) fn open_auto_review_denials_popup(&mut self) {
-        if self.review.recent_auto_review_denials.is_empty() {
-            self.add_info_message(
-                "No recent auto-review denials in this thread.".to_string(),
-                Some("Denials are recorded after auto-review rejects an action.".to_string()),
-            );
-            return;
-        }
-        let Some(thread_id) = self.thread_id() else {
-            self.add_error_message("That thread is no longer available.".to_string());
-            return;
-        };
-
-        let mut items = vec![SelectionItem {
-            name: "Command".to_string(),
-            description: Some("Rationale".to_string()),
-            is_disabled: true,
-            search_value: Some(String::new()),
-            ..Default::default()
-        }];
-        items.extend(
-            self.review
-                .recent_auto_review_denials
-                .entries()
-                .map(|event| {
-                    let id = event.id.clone();
-                    let summary = auto_review_denials::action_summary(&event.action);
-                    let rationale = event
-                        .rationale
-                        .as_deref()
-                        .unwrap_or("Auto-review did not include a rationale.");
-                    SelectionItem {
-                        name: summary.clone(),
-                        description: Some(rationale.to_string()),
-                        selected_description: Some(rationale.to_string()),
-                        search_value: Some(format!("{summary} {rationale}")),
-                        actions: vec![Box::new(move |tx| {
-                            tx.send(AppEvent::ApproveRecentAutoReviewDenial {
-                                thread_id,
-                                id: id.clone(),
-                            });
-                        })],
-                        dismiss_on_select: true,
-                        ..Default::default()
-                    }
-                }),
-        );
-
-        self.bottom_pane.show_selection_view(SelectionViewParams {
-            title: Some("Auto-review Denials".to_string()),
-            subtitle: Some("Select a denied action to approve.".to_string()),
-            footer_hint: Some(standard_popup_hint_line()),
-            items,
-            is_searchable: true,
-            col_width_mode: ColumnWidthMode::AutoAllRows,
-            ..Default::default()
-        });
-        self.request_redraw();
-    }
-
-    pub(crate) fn approve_recent_auto_review_denial(&mut self, thread_id: ThreadId, id: String) {
-        let Some(event) = self.review.recent_auto_review_denials.take(&id) else {
-            self.add_error_message("That auto-review denial is no longer available.".to_string());
-            return;
-        };
-
-        self.app_event_tx.send(AppEvent::SubmitThreadOp {
-            thread_id,
-            op: AppCommand::approve_guardian_denied_action(event),
-        });
-        self.add_info_message(
-            "Approval recorded for one retry of the selected auto-review denial.".to_string(),
-            Some(
-                "The model will see the approval context; the retry still goes through auto-review."
-                    .to_string(),
-            ),
-        );
-    }
-
-    pub(crate) fn open_experimental_popup(&mut self) {
-        let features: Vec<ExperimentalFeatureItem> = FEATURES
-            .iter()
-            .filter_map(|spec| {
-                let name = spec.stage.experimental_menu_name()?;
-                let description = spec.stage.experimental_menu_description()?;
-                Some(ExperimentalFeatureItem {
-                    feature: spec.id,
-                    name: name.to_string(),
-                    description: description.to_string(),
-                    enabled: self.config.features.enabled(spec.id),
-                })
-            })
-            .collect();
-
-        let view = ExperimentalFeaturesView::new(
-            features,
-            self.app_event_tx.clone(),
-            self.bottom_pane.list_keymap(),
-        );
-        self.bottom_pane.show_view(Box::new(view));
-    }
-
-    fn approval_preset_actions(
-        approval: AskForApproval,
-        permission_profile: PermissionProfile,
-        label: String,
-        approvals_reviewer: ApprovalsReviewer,
-    ) -> Vec<SelectionAction> {
-        vec![Box::new(move |tx| {
-            let permission_profile_clone = permission_profile.clone();
-            tx.send(AppEvent::CodexOp(AppCommand::override_turn_context(
-                /*cwd*/ None,
-                Some(approval),
-                Some(approvals_reviewer),
-                Some(permission_profile_clone.clone()),
-                /*windows_sandbox_level*/ None,
-                /*model*/ None,
-                /*effort*/ None,
-                /*summary*/ None,
-                /*service_tier*/ None,
-                /*collaboration_mode*/ None,
-                /*personality*/ None,
-            )));
-            tx.send(AppEvent::UpdateAskForApprovalPolicy(approval));
-            tx.send(AppEvent::UpdatePermissionProfile(permission_profile_clone));
-            tx.send(AppEvent::UpdateApprovalsReviewer(approvals_reviewer));
-            tx.send(AppEvent::InsertHistoryCell(Box::new(
-                history_cell::new_info_event(
-                    format!("Permissions updated to {label}"),
-                    /*hint*/ None,
-                ),
-            )));
-        })]
-    }
-
-    fn preset_matches_current(
-        current_approval: AskForApproval,
-        current_permission_profile: &PermissionProfile,
-        cwd: &std::path::Path,
-        preset: &ApprovalPreset,
-    ) -> bool {
-        let preset_approval = AskForApproval::from(preset.approval);
-        if current_approval != preset_approval {
-            return false;
-        }
-
-        match preset.id {
-            "full-access" => matches!(current_permission_profile, PermissionProfile::Disabled),
-            "read-only" => {
-                let file_system_policy = current_permission_profile.file_system_sandbox_policy();
-                matches!(
-                    current_permission_profile,
-                    PermissionProfile::Managed { .. }
-                ) && !file_system_policy.has_full_disk_write_access()
-                    && file_system_policy
-                        .get_writable_roots_with_cwd(cwd)
-                        .is_empty()
-                    && current_permission_profile.network_sandbox_policy()
-                        == preset.permission_profile.network_sandbox_policy()
-            }
-            "auto" => {
-                let file_system_policy = current_permission_profile.file_system_sandbox_policy();
-                matches!(
-                    current_permission_profile,
-                    PermissionProfile::Managed { .. }
-                ) && file_system_policy.can_write_path_with_cwd(cwd, cwd)
-                    && !file_system_policy.has_full_disk_write_access()
-                    && current_permission_profile.network_sandbox_policy()
-                        == preset.permission_profile.network_sandbox_policy()
-            }
-            _ => current_permission_profile == &preset.permission_profile,
-        }
-    }
-
-    #[cfg(target_os = "windows")]
-    pub(crate) fn world_writable_warning_details(&self) -> Option<(Vec<String>, usize, bool)> {
-        if self
-            .config
-            .notices
-            .hide_world_writable_warning
-            .unwrap_or(false)
-        {
-            return None;
-        }
-        let cwd = self.config.cwd.clone();
-        let env_map: std::collections::HashMap<String, String> = std::env::vars().collect();
-        let Ok(policy) = self
-            .config
-            .permissions
-            .permission_profile()
-            .to_legacy_sandbox_policy(self.config.cwd.as_path())
-        else {
-            return Some((Vec::new(), 0, true));
-        };
-        match codex_windows_sandbox::apply_world_writable_scan_and_denies(
-            self.config.codex_home.as_path(),
-            cwd.as_path(),
-            &env_map,
-            &policy,
-            Some(self.config.codex_home.as_path()),
-        ) {
-            Ok(_) => None,
-            Err(_) => Some((Vec::new(), 0, true)),
-        }
-    }
-
-    #[cfg(not(target_os = "windows"))]
-    #[allow(dead_code)]
-    pub(crate) fn world_writable_warning_details(&self) -> Option<(Vec<String>, usize, bool)> {
-        None
-    }
-
-    pub(crate) fn open_full_access_confirmation(
-        &mut self,
-        preset: ApprovalPreset,
-        return_to_permissions: bool,
-    ) {
-        let selected_name = preset.label.to_string();
-        let approval = AskForApproval::from(preset.approval);
-        let permission_profile = preset.permission_profile;
-        let mut header_children: Vec<Box<dyn Renderable>> = Vec::new();
-        let title_line = Line::from("Enable full access?").bold();
-        let info_line = Line::from(vec![
-            "When Codex runs with full access, it can edit any file on your computer and run commands with network, without your approval. "
-                .into(),
-            "Exercise caution when enabling full access. This significantly increases the risk of data loss, leaks, or unexpected behavior."
-                .fg(Color::Red),
-        ]);
-        header_children.push(Box::new(title_line));
-        header_children.push(Box::new(
-            Paragraph::new(vec![info_line]).wrap(Wrap { trim: false }),
-        ));
-        let header = ColumnRenderable::with(header_children);
-
-        let mut accept_actions = Self::approval_preset_actions(
-            approval,
-            permission_profile.clone(),
-            selected_name.clone(),
-            ApprovalsReviewer::User,
-        );
-        accept_actions.push(Box::new(|tx| {
-            tx.send(AppEvent::UpdateFullAccessWarningAcknowledged(true));
-        }));
-
-        let mut accept_and_remember_actions = Self::approval_preset_actions(
-            approval,
-            permission_profile,
-            selected_name,
-            ApprovalsReviewer::User,
-        );
-        accept_and_remember_actions.push(Box::new(|tx| {
-            tx.send(AppEvent::UpdateFullAccessWarningAcknowledged(true));
-            tx.send(AppEvent::PersistFullAccessWarningAcknowledged);
-        }));
-
-        let deny_actions: Vec<SelectionAction> = vec![Box::new(move |tx| {
-            if return_to_permissions {
-                tx.send(AppEvent::OpenPermissionsPopup);
-            } else {
-                tx.send(AppEvent::OpenApprovalsPopup);
-            }
-        })];
-
-        let items = vec![
-            SelectionItem {
-                name: "Yes, continue anyway".to_string(),
-                description: Some("Apply full access for this session".to_string()),
-                actions: accept_actions,
-                dismiss_on_select: true,
-                ..Default::default()
-            },
-            SelectionItem {
-                name: "Yes, and don't ask again".to_string(),
-                description: Some("Enable full access and remember this choice".to_string()),
-                actions: accept_and_remember_actions,
-                dismiss_on_select: true,
-                ..Default::default()
-            },
-            SelectionItem {
-                name: "Cancel".to_string(),
-                description: Some("Go back without enabling full access".to_string()),
-                actions: deny_actions,
-                dismiss_on_select: true,
-                ..Default::default()
-            },
-        ];
-
-        self.bottom_pane.show_selection_view(SelectionViewParams {
-            footer_hint: Some(standard_popup_hint_line()),
-            items,
-            header: Box::new(header),
-            ..Default::default()
-        });
-    }
-
-    #[cfg(target_os = "windows")]
-    pub(crate) fn open_world_writable_warning_confirmation(
-        &mut self,
-        preset: Option<ApprovalPreset>,
-        sample_paths: Vec<String>,
-        extra_count: usize,
-        failed_scan: bool,
-    ) {
-        let (approval, permission_profile) = match &preset {
-            Some(p) => (
-                Some(AskForApproval::from(p.approval)),
-                Some(p.permission_profile.clone()),
-            ),
-            None => (None, None),
-        };
-        let mut header_children: Vec<Box<dyn Renderable>> = Vec::new();
-        let describe_profile = |profile: &PermissionProfile| {
-            if matches!(profile, PermissionProfile::Disabled) {
-                "Full Access mode"
-            } else if profile
-                .file_system_sandbox_policy()
-                .can_write_path_with_cwd(self.config.cwd.as_path(), self.config.cwd.as_path())
-            {
-                "Agent mode"
-            } else {
-                "Read-Only mode"
-            }
-        };
-        let mode_label = preset
-            .as_ref()
-            .map(|p| describe_profile(&p.permission_profile))
-            .unwrap_or_else(|| describe_profile(&self.config.permissions.permission_profile()));
-        let info_line = if failed_scan {
-            Line::from(vec![
-                "We couldn't complete the world-writable scan, so protections cannot be verified. "
-                    .into(),
-                format!("The Windows sandbox cannot guarantee protection in {mode_label}.")
-                    .fg(Color::Red),
-            ])
-        } else {
-            Line::from(vec![
-                "The Windows sandbox cannot protect writes to folders that are writable by Everyone.".into(),
-                " Consider removing write access for Everyone from the following folders:".into(),
-            ])
-        };
-        header_children.push(Box::new(
-            Paragraph::new(vec![info_line]).wrap(Wrap { trim: false }),
-        ));
-
-        if !sample_paths.is_empty() {
-            // Show up to three examples and optionally an "and X more" line.
-            let mut lines: Vec<Line> = Vec::new();
-            lines.push(Line::from(""));
-            for p in &sample_paths {
-                lines.push(Line::from(format!("  - {p}")));
-            }
-            if extra_count > 0 {
-                lines.push(Line::from(format!("and {extra_count} more")));
-            }
-            header_children.push(Box::new(Paragraph::new(lines).wrap(Wrap { trim: false })));
-        }
-        let header = ColumnRenderable::with(header_children);
-
-        // Build actions ensuring acknowledgement happens before applying the
-        // new permission profile, so downstream policy-change hooks don't
-        // re-trigger the warning.
-        let mut accept_actions: Vec<SelectionAction> = Vec::new();
-        // Suppress the immediate re-scan only when a preset will be applied via
-        // /permissions, to avoid duplicate warnings from the ensuing policy change.
-        if preset.is_some() {
-            accept_actions.push(Box::new(|tx| {
-                tx.send(AppEvent::SkipNextWorldWritableScan);
-            }));
-        }
-        if let (Some(approval), Some(permission_profile)) = (approval, permission_profile.clone()) {
-            accept_actions.extend(Self::approval_preset_actions(
-                approval,
-                permission_profile,
-                mode_label.to_string(),
-                ApprovalsReviewer::User,
-            ));
-        }
-
-        let mut accept_and_remember_actions: Vec<SelectionAction> = Vec::new();
-        accept_and_remember_actions.push(Box::new(|tx| {
-            tx.send(AppEvent::UpdateWorldWritableWarningAcknowledged(true));
-            tx.send(AppEvent::PersistWorldWritableWarningAcknowledged);
-        }));
-        if let (Some(approval), Some(permission_profile)) = (approval, permission_profile) {
-            accept_and_remember_actions.extend(Self::approval_preset_actions(
-                approval,
-                permission_profile,
-                mode_label.to_string(),
-                ApprovalsReviewer::User,
-            ));
-        }
-
-        let items = vec![
-            SelectionItem {
-                name: "Continue".to_string(),
-                description: Some(format!("Apply {mode_label} for this session")),
-                actions: accept_actions,
-                dismiss_on_select: true,
-                ..Default::default()
-            },
-            SelectionItem {
-                name: "Continue and don't warn again".to_string(),
-                description: Some(format!("Enable {mode_label} and remember this choice")),
-                actions: accept_and_remember_actions,
-                dismiss_on_select: true,
-                ..Default::default()
-            },
-        ];
-
-        self.bottom_pane.show_selection_view(SelectionViewParams {
-            footer_hint: Some(standard_popup_hint_line()),
-            items,
-            header: Box::new(header),
-            ..Default::default()
-        });
-    }
-
-    #[cfg(not(target_os = "windows"))]
-    pub(crate) fn open_world_writable_warning_confirmation(
-        &mut self,
-        _preset: Option<ApprovalPreset>,
-        _sample_paths: Vec<String>,
-        _extra_count: usize,
-        _failed_scan: bool,
-    ) {
-    }
-
-    #[cfg(target_os = "windows")]
-    pub(crate) fn open_windows_sandbox_enable_prompt(&mut self, preset: ApprovalPreset) {
-        use ratatui_macros::line;
-
-        if !crate::legacy_core::windows_sandbox::ELEVATED_SANDBOX_NUX_ENABLED {
-            // Legacy flow (pre-NUX): explain the experimental sandbox and let the user enable it
-            // directly (no elevation prompts).
-            let mut header = ColumnRenderable::new();
-            header.push(*Box::new(
-                Paragraph::new(vec![
-                    line!["Agent mode on Windows uses an experimental sandbox to limit network and filesystem access.".bold()],
-                    line!["Learn more: https://developers.openai.com/codex/windows"],
-                ])
-                .wrap(Wrap { trim: false }),
-            ));
-
-            let preset_clone = preset;
-            let items = vec![
-                SelectionItem {
-                    name: "Enable experimental sandbox".to_string(),
-                    description: None,
-                    actions: vec![Box::new(move |tx| {
-                        tx.send(AppEvent::EnableWindowsSandboxForAgentMode {
-                            preset: preset_clone.clone(),
-                            mode: WindowsSandboxEnableMode::Legacy,
-                        });
-                    })],
-                    dismiss_on_select: true,
-                    ..Default::default()
-                },
-                SelectionItem {
-                    name: "Go back".to_string(),
-                    description: None,
-                    actions: vec![Box::new(|tx| {
-                        tx.send(AppEvent::OpenApprovalsPopup);
-                    })],
-                    dismiss_on_select: true,
-                    ..Default::default()
-                },
-            ];
-
-            self.bottom_pane.show_selection_view(SelectionViewParams {
-                title: None,
-                footer_hint: Some(standard_popup_hint_line()),
-                items,
-                header: Box::new(header),
-                ..Default::default()
-            });
-            return;
-        }
-
-        self.session_telemetry.counter(
-            "codex.windows_sandbox.elevated_prompt_shown",
-            /*inc*/ 1,
-            &[],
-        );
-
-        let mut header = ColumnRenderable::new();
-        header.push(*Box::new(
-            Paragraph::new(vec![
-                line!["Set up the Codex agent sandbox to protect your files and control network access. Learn more <https://developers.openai.com/codex/windows>"],
-            ])
-            .wrap(Wrap { trim: false }),
-        ));
-
-        let accept_otel = self.session_telemetry.clone();
-        let legacy_otel = self.session_telemetry.clone();
-        let legacy_preset = preset.clone();
-        let quit_otel = self.session_telemetry.clone();
-        let items = vec![
-            SelectionItem {
-                name: "Set up default sandbox (requires Administrator permissions)".to_string(),
-                description: None,
-                actions: vec![Box::new(move |tx| {
-                    accept_otel.counter(
-                        "codex.windows_sandbox.elevated_prompt_accept",
-                        /*inc*/ 1,
-                        &[],
-                    );
-                    tx.send(AppEvent::BeginWindowsSandboxElevatedSetup {
-                        preset: preset.clone(),
-                    });
-                })],
-                dismiss_on_select: true,
-                ..Default::default()
-            },
-            SelectionItem {
-                name: "Use non-admin sandbox (higher risk if prompt injected)".to_string(),
-                description: None,
-                actions: vec![Box::new(move |tx| {
-                    legacy_otel.counter(
-                        "codex.windows_sandbox.elevated_prompt_use_legacy",
-                        /*inc*/ 1,
-                        &[],
-                    );
-                    tx.send(AppEvent::BeginWindowsSandboxLegacySetup {
-                        preset: legacy_preset.clone(),
-                    });
-                })],
-                dismiss_on_select: true,
-                ..Default::default()
-            },
-            SelectionItem {
-                name: "Quit".to_string(),
-                description: None,
-                actions: vec![Box::new(move |tx| {
-                    quit_otel.counter(
-                        "codex.windows_sandbox.elevated_prompt_quit",
-                        /*inc*/ 1,
-                        &[],
-                    );
-                    tx.send(AppEvent::Exit(ExitMode::ShutdownFirst));
-                })],
-                dismiss_on_select: true,
-                ..Default::default()
-            },
-        ];
-
-        self.bottom_pane.show_selection_view(SelectionViewParams {
-            title: None,
-            footer_hint: Some(standard_popup_hint_line()),
-            items,
-            header: Box::new(header),
-            ..Default::default()
-        });
-    }
-
-    #[cfg(not(target_os = "windows"))]
-    pub(crate) fn open_windows_sandbox_enable_prompt(&mut self, _preset: ApprovalPreset) {}
-
-    #[cfg(target_os = "windows")]
-    pub(crate) fn open_windows_sandbox_fallback_prompt(&mut self, preset: ApprovalPreset) {
-        use ratatui_macros::line;
-
-        let mut lines = Vec::new();
-        lines.push(line![
-            "Couldn't set up your sandbox with Administrator permissions".bold()
-        ]);
-        lines.push(line![""]);
-        lines.push(line![
-            "You can still use Codex in a non-admin sandbox. It carries greater risk if prompt injected."
-        ]);
-        lines.push(line![
-            "Learn more <https://developers.openai.com/codex/windows>"
-        ]);
-
-        let mut header = ColumnRenderable::new();
-        header.push(*Box::new(Paragraph::new(lines).wrap(Wrap { trim: false })));
-
-        let elevated_preset = preset.clone();
-        let legacy_preset = preset;
-        let quit_otel = self.session_telemetry.clone();
-        let items = vec![
-            SelectionItem {
-                name: "Try setting up admin sandbox again".to_string(),
-                description: None,
-                actions: vec![Box::new({
-                    let otel = self.session_telemetry.clone();
-                    let preset = elevated_preset;
-                    move |tx| {
-                        otel.counter(
-                            "codex.windows_sandbox.fallback_retry_elevated",
-                            /*inc*/ 1,
-                            &[],
-                        );
-                        tx.send(AppEvent::BeginWindowsSandboxElevatedSetup {
-                            preset: preset.clone(),
-                        });
-                    }
-                })],
-                dismiss_on_select: true,
-                ..Default::default()
-            },
-            SelectionItem {
-                name: "Use Codex with non-admin sandbox".to_string(),
-                description: None,
-                actions: vec![Box::new({
-                    let otel = self.session_telemetry.clone();
-                    let preset = legacy_preset;
-                    move |tx| {
-                        otel.counter(
-                            "codex.windows_sandbox.fallback_use_legacy",
-                            /*inc*/ 1,
-                            &[],
-                        );
-                        tx.send(AppEvent::BeginWindowsSandboxLegacySetup {
-                            preset: preset.clone(),
-                        });
-                    }
-                })],
-                dismiss_on_select: true,
-                ..Default::default()
-            },
-            SelectionItem {
-                name: "Quit".to_string(),
-                description: None,
-                actions: vec![Box::new(move |tx| {
-                    quit_otel.counter(
-                        "codex.windows_sandbox.fallback_prompt_quit",
-                        /*inc*/ 1,
-                        &[],
-                    );
-                    tx.send(AppEvent::Exit(ExitMode::ShutdownFirst));
-                })],
-                dismiss_on_select: true,
-                ..Default::default()
-            },
-        ];
-
-        self.bottom_pane.show_selection_view(SelectionViewParams {
-            title: None,
-            footer_hint: Some(standard_popup_hint_line()),
-            items,
-            header: Box::new(header),
-            ..Default::default()
-        });
-    }
-
-    #[cfg(not(target_os = "windows"))]
-    pub(crate) fn open_windows_sandbox_fallback_prompt(&mut self, _preset: ApprovalPreset) {}
-
-    #[cfg(target_os = "windows")]
-    pub(crate) fn maybe_prompt_windows_sandbox_enable(&mut self, show_now: bool) {
-        if show_now
-            && WindowsSandboxLevel::from_config(&self.config) == WindowsSandboxLevel::Disabled
-            && let Some(preset) = builtin_approval_presets()
-                .into_iter()
-                .find(|preset| preset.id == "auto")
-        {
-            self.open_windows_sandbox_enable_prompt(preset);
-        }
-    }
-
-    #[cfg(not(target_os = "windows"))]
-    pub(crate) fn maybe_prompt_windows_sandbox_enable(&mut self, _show_now: bool) {}
-
-    #[cfg(target_os = "windows")]
-    pub(crate) fn show_windows_sandbox_setup_status(&mut self) {
-        // While elevated sandbox setup runs, prevent typing so the user doesn't
-        // accidentally queue messages that will run under an unexpected mode.
-        self.bottom_pane.set_composer_input_enabled(
-            /*enabled*/ false,
-            Some("Input disabled until setup completes.".to_string()),
-        );
-        self.bottom_pane.ensure_status_indicator();
-        self.bottom_pane
-            .set_interrupt_hint_visible(/*visible*/ false);
-        self.set_status(
-            "Setting up sandbox...".to_string(),
-            Some("Hang tight, this may take a few minutes".to_string()),
-            StatusDetailsCapitalization::CapitalizeFirst,
-            STATUS_DETAILS_DEFAULT_MAX_LINES,
-        );
-        self.request_redraw();
-    }
-
-    #[cfg(not(target_os = "windows"))]
-    #[allow(dead_code)]
-    pub(crate) fn show_windows_sandbox_setup_status(&mut self) {}
-
-    #[cfg(target_os = "windows")]
-    pub(crate) fn clear_windows_sandbox_setup_status(&mut self) {
-        self.bottom_pane
-            .set_composer_input_enabled(/*enabled*/ true, /*placeholder*/ None);
-        self.bottom_pane.hide_status_indicator();
-        self.request_redraw();
-    }
-
-    #[cfg(not(target_os = "windows"))]
-    pub(crate) fn clear_windows_sandbox_setup_status(&mut self) {}
-
-    /// Set the approval policy in the widget's config copy.
-    pub(crate) fn set_approval_policy(&mut self, policy: AskForApproval) {
-        if let Err(err) = self
-            .config
-            .permissions
-            .approval_policy
-            .set(policy.to_core())
-        {
-            tracing::warn!(%err, "failed to set approval_policy on chat config");
-        } else {
-            self.refresh_status_surfaces();
-        }
-    }
-
-    /// Set the permission profile in the widget's config copy.
-    #[cfg_attr(not(target_os = "windows"), allow(dead_code))]
-    pub(crate) fn set_permission_profile(
-        &mut self,
-        profile: PermissionProfile,
-    ) -> ConstraintResult<()> {
-        self.config.permissions.set_permission_profile(profile)?;
-        self.refresh_status_surfaces();
-        Ok(())
-    }
-
-    #[cfg_attr(not(target_os = "windows"), allow(dead_code))]
-    pub(crate) fn set_windows_sandbox_mode(&mut self, mode: Option<WindowsSandboxModeToml>) {
-        self.config.permissions.windows_sandbox_mode = mode;
-        #[cfg(target_os = "windows")]
-        self.bottom_pane.set_windows_degraded_sandbox_active(
-            crate::legacy_core::windows_sandbox::ELEVATED_SANDBOX_NUX_ENABLED
-                && matches!(
-                    WindowsSandboxLevel::from_config(&self.config),
-                    WindowsSandboxLevel::RestrictedToken
-                ),
-        );
-    }
-
-    #[cfg_attr(not(target_os = "windows"), allow(dead_code))]
-    pub(crate) fn set_feature_enabled(&mut self, feature: Feature, enabled: bool) -> bool {
-        if let Err(err) = self.config.features.set_enabled(feature, enabled) {
-            tracing::warn!(
-                error = %err,
-                feature = feature.key(),
-                "failed to update constrained chat widget feature state"
-            );
-        }
-        let enabled = self.config.features.enabled(feature);
-        if feature == Feature::RealtimeConversation {
-            let realtime_conversation_enabled = self.realtime_conversation_enabled();
-            self.bottom_pane
-                .set_realtime_conversation_enabled(realtime_conversation_enabled);
-            self.bottom_pane
-                .set_audio_device_selection_enabled(self.realtime_audio_device_selection_enabled());
-            if !realtime_conversation_enabled && self.realtime_conversation.is_live() {
-                self.request_realtime_conversation_close(Some(
-                    "Realtime voice mode was closed because the feature was disabled.".to_string(),
-                ));
-            }
-        }
-        if feature == Feature::FastMode {
-            self.sync_service_tier_commands();
-        }
-        if feature == Feature::Personality {
-            self.sync_personality_command_enabled();
-        }
-        if feature == Feature::Plugins {
-            self.sync_plugins_command_enabled();
-            self.refresh_plugin_mentions();
-        }
-        if feature == Feature::Goals {
-            self.sync_goal_command_enabled();
-            if !enabled {
-                self.current_goal_status_indicator = None;
-                self.current_goal_status = None;
-                self.turn_lifecycle.goal_status_active_turn_started_at = None;
-                self.turn_lifecycle.budget_limited_turn_ids.clear();
-                self.update_collaboration_mode_indicator();
-            }
-        }
-        if feature == Feature::MentionsV2 {
-            self.sync_mentions_v2_enabled();
-        }
-        if feature == Feature::PreventIdleSleep {
-            self.turn_lifecycle.set_prevent_idle_sleep(enabled);
-        }
-        #[cfg(target_os = "windows")]
-        if matches!(
-            feature,
-            Feature::WindowsSandbox | Feature::WindowsSandboxElevated
-        ) {
-            self.bottom_pane.set_windows_degraded_sandbox_active(
-                crate::legacy_core::windows_sandbox::ELEVATED_SANDBOX_NUX_ENABLED
-                    && matches!(
-                        WindowsSandboxLevel::from_config(&self.config),
-                        WindowsSandboxLevel::RestrictedToken
-                    ),
-            );
-        }
-        enabled
-    }
-
-    pub(crate) fn set_approvals_reviewer(&mut self, policy: ApprovalsReviewer) {
-        self.config.approvals_reviewer = policy;
-        self.refresh_status_surfaces();
-    }
-
-    pub(crate) fn set_full_access_warning_acknowledged(&mut self, acknowledged: bool) {
-        self.config.notices.hide_full_access_warning = Some(acknowledged);
-    }
-
-    pub(crate) fn set_world_writable_warning_acknowledged(&mut self, acknowledged: bool) {
-        self.config.notices.hide_world_writable_warning = Some(acknowledged);
-    }
-
-    pub(crate) fn set_rate_limit_switch_prompt_hidden(&mut self, hidden: bool) {
-        self.config.notices.hide_rate_limit_model_nudge = Some(hidden);
-        if hidden {
-            self.rate_limit_switch_prompt = RateLimitSwitchPromptState::Idle;
-        }
-    }
-
-    #[cfg_attr(not(target_os = "windows"), allow(dead_code))]
-    pub(crate) fn world_writable_warning_hidden(&self) -> bool {
-        self.config
-            .notices
-            .hide_world_writable_warning
-            .unwrap_or(false)
-    }
-
-    /// Override the reasoning effort used when Plan mode is active.
-    ///
-    /// When the active mask is already Plan, the override is applied immediately
-    /// so the footer reflects it without waiting for the next mode switch.
-    /// Passing `None` resets to the Plan-mode preset default.
-    pub(crate) fn set_plan_mode_reasoning_effort(&mut self, effort: Option<ReasoningEffortConfig>) {
-        self.config.plan_mode_reasoning_effort = effort;
-        if self.collaboration_modes_enabled()
-            && let Some(mask) = self.active_collaboration_mask.as_mut()
-            && mask.mode == Some(ModeKind::Plan)
-        {
-            if let Some(effort) = effort {
-                mask.reasoning_effort = Some(Some(effort));
-            } else if let Some(plan_mask) =
-                collaboration_modes::plan_mask(self.model_catalog.as_ref())
-            {
-                mask.reasoning_effort = plan_mask.reasoning_effort;
-            }
-        }
-        self.refresh_model_dependent_surfaces();
-    }
-
-    /// Set the reasoning effort for the non-Plan collaboration mode.
-    ///
-    /// Does not touch the active Plan mask — Plan reasoning is controlled
-    /// exclusively by the Plan preset and `set_plan_mode_reasoning_effort`.
-    pub(crate) fn set_reasoning_effort(&mut self, effort: Option<ReasoningEffortConfig>) {
-        self.current_collaboration_mode = self.current_collaboration_mode.with_updates(
-            /*model*/ None,
-            Some(effort),
-            /*developer_instructions*/ None,
-        );
-        if self.collaboration_modes_enabled()
-            && let Some(mask) = self.active_collaboration_mask.as_mut()
-            && mask.mode != Some(ModeKind::Plan)
-        {
-            // Generic "global default" updates should not mutate the active Plan mask.
-            // Plan reasoning is controlled by the Plan preset and Plan-only override updates.
-            mask.reasoning_effort = Some(effort);
-        }
-        self.refresh_model_dependent_surfaces();
-    }
-
-    /// Set the personality in the widget's config copy.
-    pub(crate) fn set_personality(&mut self, personality: Personality) {
-        self.config.personality = Some(personality);
-    }
-
-    pub(crate) fn status_account_display(&self) -> Option<&StatusAccountDisplay> {
-        self.status_account_display.as_ref()
-    }
-
-    pub(crate) fn runtime_model_provider_base_url(&self) -> Option<&str> {
-        self.runtime_model_provider_base_url.as_deref()
-    }
-
-    #[cfg_attr(not(test), allow(dead_code))]
-    pub(crate) fn model_catalog(&self) -> Arc<ModelCatalog> {
-        self.model_catalog.clone()
-    }
-
-    pub(crate) fn current_plan_type(&self) -> Option<PlanType> {
-        self.plan_type
-    }
-
-    pub(crate) fn has_chatgpt_account(&self) -> bool {
-        self.has_chatgpt_account
-    }
-
-    pub(crate) fn update_account_state(
-        &mut self,
-        status_account_display: Option<StatusAccountDisplay>,
-        plan_type: Option<PlanType>,
-        has_chatgpt_account: bool,
-    ) {
-        self.status_account_display = status_account_display;
-        self.plan_type = plan_type;
-        self.has_chatgpt_account = has_chatgpt_account;
-        self.bottom_pane
-            .set_connectors_enabled(self.connectors_enabled());
-    }
-
-    pub(crate) fn set_realtime_audio_device(
-        &mut self,
-        kind: RealtimeAudioDeviceKind,
-        name: Option<String>,
-    ) {
-        match kind {
-            RealtimeAudioDeviceKind::Microphone => self.config.realtime_audio.microphone = name,
-            RealtimeAudioDeviceKind::Speaker => self.config.realtime_audio.speaker = name,
-        }
-    }
-
-    /// Set the syntax theme override in the widget's config copy.
-    pub(crate) fn set_tui_theme(&mut self, theme: Option<String>) {
-        self.config.tui_theme = theme;
-    }
-
-    /// Set the model in the widget's config copy and stored collaboration mode.
-    pub(crate) fn set_model(&mut self, model: &str) {
-        self.current_collaboration_mode = self.current_collaboration_mode.with_updates(
-            Some(model.to_string()),
-            /*effort*/ None,
-            /*developer_instructions*/ None,
-        );
-        if self.collaboration_modes_enabled()
-            && let Some(mask) = self.active_collaboration_mask.as_mut()
-        {
-            mask.model = Some(model.to_string());
-        }
-        self.refresh_model_dependent_surfaces();
-    }
-
-    pub(crate) fn current_model(&self) -> &str {
-        if !self.collaboration_modes_enabled() {
-            return self.current_collaboration_mode.model();
-        }
-        self.active_collaboration_mask
-            .as_ref()
-            .and_then(|mask| mask.model.as_deref())
-            .unwrap_or_else(|| self.current_collaboration_mode.model())
-    }
-
-    pub(crate) fn realtime_conversation_is_live(&self) -> bool {
-        self.realtime_conversation.is_live()
-    }
-
-    fn current_realtime_audio_device_name(&self, kind: RealtimeAudioDeviceKind) -> Option<String> {
-        match kind {
-            RealtimeAudioDeviceKind::Microphone => self.config.realtime_audio.microphone.clone(),
-            RealtimeAudioDeviceKind::Speaker => self.config.realtime_audio.speaker.clone(),
-        }
-    }
-
-    fn current_realtime_audio_selection_label(&self, kind: RealtimeAudioDeviceKind) -> String {
-        self.current_realtime_audio_device_name(kind)
-            .unwrap_or_else(|| "System default".to_string())
-    }
-
-    fn sync_personality_command_enabled(&mut self) {
-        self.bottom_pane
-            .set_personality_command_enabled(self.config.features.enabled(Feature::Personality));
-    }
-
-    fn sync_plugins_command_enabled(&mut self) {
-        self.bottom_pane
-            .set_plugins_command_enabled(self.config.features.enabled(Feature::Plugins));
-    }
-
-    fn sync_goal_command_enabled(&mut self) {
-        self.bottom_pane
-            .set_goal_command_enabled(self.config.features.enabled(Feature::Goals));
-    }
-
-    fn sync_mentions_v2_enabled(&mut self) {
-        self.bottom_pane
-            .set_mentions_v2_enabled(self.config.features.enabled(Feature::MentionsV2));
-    }
-
-    fn current_model_supports_personality(&self) -> bool {
-        let model = self.current_model();
-        self.model_catalog
-            .try_list_models()
-            .ok()
-            .and_then(|models| {
-                models
-                    .into_iter()
-                    .find(|preset| preset.model == model)
-                    .map(|preset| preset.supports_personality)
-            })
-            .unwrap_or(false)
-    }
-
-    /// Return whether the effective model currently advertises image-input support.
-    ///
-    /// We intentionally default to `true` when model metadata cannot be read so transient catalog
-    /// failures do not hard-block user input in the UI.
-    fn current_model_supports_images(&self) -> bool {
-        let model = self.current_model();
-        self.model_catalog
-            .try_list_models()
-            .ok()
-            .and_then(|models| {
-                models
-                    .into_iter()
-                    .find(|preset| preset.model == model)
-                    .map(|preset| preset.input_modalities.contains(&InputModality::Image))
-            })
-            .unwrap_or(true)
-    }
-
-    fn sync_image_paste_enabled(&mut self) {
-        let enabled = self.current_model_supports_images();
-        self.bottom_pane.set_image_paste_enabled(enabled);
-    }
-
-    fn image_inputs_not_supported_message(&self) -> String {
-        format!(
-            "Model {} does not support image inputs. Remove images or switch models.",
-            self.current_model()
-        )
-    }
-
-    #[allow(dead_code)] // Used in tests
-    pub(crate) fn current_collaboration_mode(&self) -> &CollaborationMode {
-        &self.current_collaboration_mode
-    }
-
-    pub(crate) fn current_reasoning_effort(&self) -> Option<ReasoningEffortConfig> {
-        self.effective_reasoning_effort()
-    }
-
-    #[cfg(test)]
-    pub(crate) fn active_collaboration_mode_kind(&self) -> ModeKind {
-        self.active_mode_kind()
-    }
-
-    fn is_session_configured(&self) -> bool {
-        self.thread_id.is_some()
-    }
-
-    fn collaboration_modes_enabled(&self) -> bool {
-        true
-    }
-
-    /// Returns the dismissal scope that applies to the currently visible draft.
-    fn plan_mode_nudge_scope(&self) -> PlanModeNudgeScope {
-        self.thread_id
-            .map_or(PlanModeNudgeScope::NewThread, PlanModeNudgeScope::Thread)
-    }
-
-    /// Returns whether the current draft should replace the normal footer with the Plan-mode nudge.
-    ///
-    /// `ChatWidget` owns this policy because it can combine lexical draft matching with mode
-    /// availability, interaction state, and thread-scoped dismissal. `ChatComposer` only renders
-    /// the resulting visibility bit. Keeping slash and shell drafts out here avoids advertising a
-    /// mode switch while the user is intentionally composing another local command.
-    fn should_show_plan_mode_nudge(&self) -> bool {
-        let text = self.bottom_pane.composer_text();
-        let trimmed = text.trim_start();
-        self.collaboration_modes_enabled()
-            && collaboration_modes::plan_mask(self.model_catalog.as_ref()).is_some()
-            && self.active_mode_kind() != ModeKind::Plan
-            && self.bottom_pane.composer_input_enabled()
-            && !self.bottom_pane.is_task_running()
-            && self.bottom_pane.no_modal_or_popup_active()
-            && !trimmed.starts_with('/')
-            && !trimmed.starts_with('!')
-            && contains_plan_keyword(&text)
-            && !self
-                .dismissed_plan_mode_nudge_scopes
-                .contains(&self.plan_mode_nudge_scope())
-    }
-
-    /// Synchronizes the footer presentation with the current Plan-mode nudge policy.
-    fn refresh_plan_mode_nudge(&mut self) {
-        self.bottom_pane
-            .set_plan_mode_nudge_visible(self.should_show_plan_mode_nudge());
-    }
-
-    /// Hides the nudge for the current thread scope until the user changes conversation context.
-    fn dismiss_plan_mode_nudge(&mut self) {
-        self.dismissed_plan_mode_nudge_scopes
-            .insert(self.plan_mode_nudge_scope());
-        self.refresh_plan_mode_nudge();
-    }
-
-    fn initial_collaboration_mask(
-        _config: &Config,
-        model_catalog: &ModelCatalog,
-        model_override: Option<&str>,
-    ) -> Option<CollaborationModeMask> {
-        let mut mask = collaboration_modes::default_mask(model_catalog)?;
-        if let Some(model_override) = model_override {
-            mask.model = Some(model_override.to_string());
-        }
-        Some(mask)
-    }
-
-    fn active_mode_kind(&self) -> ModeKind {
-        self.active_collaboration_mask
-            .as_ref()
-            .and_then(|mask| mask.mode)
-            .unwrap_or(ModeKind::Default)
-    }
-
-    fn effective_reasoning_effort(&self) -> Option<ReasoningEffortConfig> {
-        if !self.collaboration_modes_enabled() {
-            return self.current_collaboration_mode.reasoning_effort();
-        }
-        let current_effort = self.current_collaboration_mode.reasoning_effort();
-        self.active_collaboration_mask
-            .as_ref()
-            .and_then(|mask| mask.reasoning_effort)
-            .unwrap_or(current_effort)
-    }
-
-    fn effective_collaboration_mode(&self) -> CollaborationMode {
-        if !self.collaboration_modes_enabled() {
-            return self.current_collaboration_mode.clone();
-        }
-        self.active_collaboration_mask.as_ref().map_or_else(
-            || self.current_collaboration_mode.clone(),
-            |mask| self.current_collaboration_mode.apply_mask(mask),
-        )
-    }
-
-    fn refresh_model_display(&mut self) {
-        let effective = self.effective_collaboration_mode();
-        self.session_header.set_model(effective.model());
-        // Keep composer paste affordances aligned with the currently effective model.
-        self.sync_image_paste_enabled();
-        self.sync_service_tier_commands();
-        self.refresh_terminal_title();
-    }
-
-    /// Refresh every UI surface that depends on the effective model, reasoning
-    /// effort, or collaboration mode.
-    ///
-    /// Call this at the end of any setter that mutates `current_collaboration_mode`,
-    /// `active_collaboration_mask`, or per-mode reasoning-effort overrides.
-    /// Consolidating both refreshes here prevents the bug where callers update the
-    /// header/title (`refresh_model_display`) but forget the footer status line
-    /// (`refresh_status_line`).
-    fn refresh_model_dependent_surfaces(&mut self) {
-        self.refresh_model_display();
-        self.refresh_status_line();
-    }
-
-    fn model_display_name(&self) -> &str {
-        let model = self.current_model();
-        if model.is_empty() {
-            DEFAULT_MODEL_DISPLAY_NAME
-        } else {
-            model
-        }
-    }
-
-    /// Get the label for the current collaboration mode.
-    fn collaboration_mode_label(&self) -> Option<&'static str> {
-        if !self.collaboration_modes_enabled() {
-            return None;
-        }
-        let active_mode = self.active_mode_kind();
-        active_mode
-            .is_tui_visible()
-            .then_some(active_mode.display_name())
-    }
-
-    fn collaboration_mode_indicator(&self) -> Option<CollaborationModeIndicator> {
-        if !self.collaboration_modes_enabled() {
-            return None;
-        }
-        match self.active_mode_kind() {
-            ModeKind::Plan => Some(CollaborationModeIndicator::Plan),
-            ModeKind::Default | ModeKind::PairProgramming | ModeKind::Execute => None,
-        }
-    }
-
-    fn update_collaboration_mode_indicator(&mut self) {
-        let indicator = self.collaboration_mode_indicator();
-        let goal_indicator = if indicator.is_none() {
-            self.goal_status_indicator(Instant::now())
-        } else {
-            None
-        };
-        self.current_goal_status_indicator = goal_indicator.clone();
-        self.bottom_pane.set_collaboration_mode_indicator(indicator);
-        self.bottom_pane.set_goal_status_indicator(goal_indicator);
-    }
-
-    fn refresh_goal_status_indicator_for_time_tick(&mut self) {
-        if self.collaboration_mode_indicator().is_some() {
-            return;
-        }
-        let goal_indicator = self.goal_status_indicator(Instant::now());
-        if goal_indicator != self.current_goal_status_indicator {
-            self.current_goal_status_indicator = goal_indicator.clone();
-            self.bottom_pane.set_goal_status_indicator(goal_indicator);
-        }
-    }
-
-    fn goal_status_indicator(&self, now: Instant) -> Option<GoalStatusIndicator> {
-        if !self.config.features.enabled(Feature::Goals) {
-            return None;
-        }
-        self.current_goal_status.as_ref().and_then(|state| {
-            state.indicator(now, self.turn_lifecycle.goal_status_active_turn_started_at)
-        })
-    }
-
-    fn on_thread_goal_updated(&mut self, goal: AppThreadGoal, turn_id: Option<String>) {
-        if let Some(active_thread_id) = self.thread_id
-            && active_thread_id.to_string() != goal.thread_id
-        {
-            return;
-        }
-        if !self.config.features.enabled(Feature::Goals) {
-            self.current_goal_status_indicator = None;
-            self.current_goal_status = None;
-            self.update_collaboration_mode_indicator();
-            return;
-        }
-        if goal.status == AppThreadGoalStatus::BudgetLimited
-            && let Some(turn_id) = turn_id
-        {
-            self.turn_lifecycle.mark_budget_limited(turn_id);
-        }
-        self.current_goal_status = Some(GoalStatusState::new(goal, Instant::now()));
-        self.update_collaboration_mode_indicator();
-    }
-
-    fn personality_label(personality: Personality) -> &'static str {
-        match personality {
-            Personality::None => "None",
-            Personality::Friendly => "Friendly",
-            Personality::Pragmatic => "Pragmatic",
-        }
-    }
-
-    fn personality_description(personality: Personality) -> &'static str {
-        match personality {
-            Personality::None => "No personality instructions.",
-            Personality::Friendly => "Warm, collaborative, and helpful.",
-            Personality::Pragmatic => "Concise, task-focused, and direct.",
-        }
-    }
-
-    /// Cycle to the next collaboration mode variant (Plan -> Default -> Plan).
-    fn cycle_collaboration_mode(&mut self) {
-        if !self.collaboration_modes_enabled() {
-            return;
-        }
-
-        if let Some(next_mask) = collaboration_modes::next_mask(
-            self.model_catalog.as_ref(),
-            self.active_collaboration_mask.as_ref(),
-        ) {
-            self.set_collaboration_mask(next_mask);
-        }
-    }
-
-    /// Update the active collaboration mask.
-    ///
-    /// When collaboration modes are enabled and a preset is selected,
-    /// the current mode is attached to submissions as `Op::UserTurn { collaboration_mode: Some(...) }`.
-    pub(crate) fn set_collaboration_mask(&mut self, mut mask: CollaborationModeMask) {
-        if !self.collaboration_modes_enabled() {
-            return;
-        }
-        let previous_mode = self.active_mode_kind();
-        let previous_model = self.current_model().to_string();
-        let previous_effort = self.effective_reasoning_effort();
-        if mask.mode == Some(ModeKind::Plan)
-            && let Some(effort) = self.config.plan_mode_reasoning_effort
-        {
-            mask.reasoning_effort = Some(Some(effort));
-        }
-        if mask.mode == Some(ModeKind::Plan) {
-            self.dismissed_plan_mode_nudge_scopes
-                .insert(self.plan_mode_nudge_scope());
-        }
-        self.active_collaboration_mask = Some(mask);
-        self.update_collaboration_mode_indicator();
-        self.refresh_plan_mode_nudge();
-        self.refresh_model_dependent_surfaces();
-        let next_mode = self.active_mode_kind();
-        let next_model = self.current_model();
-        let next_effort = self.effective_reasoning_effort();
-        if previous_mode != next_mode
-            && (previous_model != next_model || previous_effort != next_effort)
-        {
-            let mut message = format!("Model changed to {next_model}");
-            if !next_model.starts_with("codex-auto-") {
-                let reasoning_label = match next_effort {
-                    Some(ReasoningEffortConfig::Minimal) => "minimal",
-                    Some(ReasoningEffortConfig::Low) => "low",
-                    Some(ReasoningEffortConfig::Medium) => "medium",
-                    Some(ReasoningEffortConfig::High) => "high",
-                    Some(ReasoningEffortConfig::XHigh) => "xhigh",
-                    None | Some(ReasoningEffortConfig::None) => "default",
-                };
-                message.push(' ');
-                message.push_str(reasoning_label);
-            }
-            message.push_str(" for ");
-            message.push_str(next_mode.display_name());
-            message.push_str(" mode.");
-            self.add_info_message(message, /*hint*/ None);
-        }
-        self.request_redraw();
-    }
-
-    fn connectors_enabled(&self) -> bool {
-        self.config.features.enabled(Feature::Apps) && self.has_chatgpt_account
-    }
-
-    fn connectors_for_mentions(&self) -> Option<&[AppInfo]> {
-        if !self.connectors_enabled() {
-            return None;
-        }
-
-        if let Some(snapshot) = &self.connectors.partial_snapshot {
-            return Some(snapshot.connectors.as_slice());
-        }
-
-        match &self.connectors.cache {
-            ConnectorsCacheState::Ready(snapshot) => Some(snapshot.connectors.as_slice()),
-            _ => None,
-        }
-    }
-
     fn plugins_for_mentions(&self) -> Option<&[PluginCapabilitySummary]> {
         if !self.config.features.enabled(Feature::Plugins) {
             return None;
@@ -5367,16 +1438,14 @@ impl ChatWidget {
     }
 
     fn rename_confirmation_cell(name: &str, thread_id: Option<ThreadId>) -> PlainHistoryCell {
-        let resume_cmd = crate::legacy_core::util::resume_command(Some(name), thread_id)
-            .unwrap_or_else(|| format!("codex resume {name}"));
-        let name = name.to_string();
-        let line = vec![
+        let mut line = vec![
             "• ".into(),
             "Thread renamed to ".into(),
-            name.cyan(),
-            ", to resume this thread run ".into(),
-            resume_cmd.cyan(),
+            name.to_string().cyan(),
         ];
+        if let Some(hint) = resume_hint(Some(name), thread_id) {
+            line.extend([". To resume this thread run ".into(), hint.cyan()]);
+        }
         PlainHistoryCell::new(vec![line.into()])
     }
 
@@ -5416,342 +1485,11 @@ impl ChatWidget {
         self.request_redraw();
     }
 
-    pub(crate) fn add_connectors_output(&mut self) {
-        if !self.connectors_enabled() {
-            self.add_info_message(
-                "Apps are disabled.".to_string(),
-                Some("Enable the apps feature to use $ or /apps.".to_string()),
-            );
-            return;
-        }
-
-        let connectors_cache = self.connectors.cache.clone();
-        let should_force_refetch = !self.connectors.prefetch_in_flight
-            || matches!(connectors_cache, ConnectorsCacheState::Ready(_));
-        self.prefetch_connectors_with_options(should_force_refetch);
-
-        match connectors_cache {
-            ConnectorsCacheState::Ready(snapshot) => {
-                if snapshot.connectors.is_empty() {
-                    self.add_info_message("No apps available.".to_string(), /*hint*/ None);
-                } else {
-                    self.open_connectors_popup(&snapshot.connectors);
-                }
-            }
-            ConnectorsCacheState::Failed(err) => {
-                self.add_to_history(history_cell::new_error_event(err));
-            }
-            ConnectorsCacheState::Loading | ConnectorsCacheState::Uninitialized => {
-                self.open_connectors_loading_popup();
-            }
-        }
-        self.request_redraw();
-    }
-
-    fn open_connectors_loading_popup(&mut self) {
-        if !self.bottom_pane.replace_selection_view_if_active(
-            CONNECTORS_SELECTION_VIEW_ID,
-            self.connectors_loading_popup_params(),
-        ) {
-            self.bottom_pane
-                .show_selection_view(self.connectors_loading_popup_params());
-        }
-    }
-
-    fn open_connectors_popup(&mut self, connectors: &[AppInfo]) {
-        self.bottom_pane.show_selection_view(
-            self.connectors_popup_params(connectors, /*selected_connector_id*/ None),
-        );
-    }
-
-    fn connectors_loading_popup_params(&self) -> SelectionViewParams {
-        let mut header = ColumnRenderable::new();
-        header.push(Line::from("Apps".bold()));
-        header.push(Line::from("Loading installed and available apps...".dim()));
-
-        SelectionViewParams {
-            view_id: Some(CONNECTORS_SELECTION_VIEW_ID),
-            header: Box::new(header),
-            items: vec![SelectionItem {
-                name: "Loading apps...".to_string(),
-                description: Some("This updates when the full list is ready.".to_string()),
-                is_disabled: true,
-                ..Default::default()
-            }],
-            ..Default::default()
-        }
-    }
-
-    fn connectors_popup_params(
-        &self,
-        connectors: &[AppInfo],
-        selected_connector_id: Option<&str>,
-    ) -> SelectionViewParams {
-        let total = connectors.len();
-        let installed = connectors
-            .iter()
-            .filter(|connector| connector.is_accessible)
-            .count();
-        let mut header = ColumnRenderable::new();
-        header.push(Line::from("Apps".bold()));
-        header.push(Line::from(
-            "Use $ to insert an installed app into your prompt.".dim(),
-        ));
-        header.push(Line::from(
-            format!("Installed {installed} of {total} available apps.").dim(),
-        ));
-        let initial_selected_idx = selected_connector_id.and_then(|selected_connector_id| {
-            connectors
-                .iter()
-                .position(|connector| connector.id == selected_connector_id)
-        });
-        let mut items: Vec<SelectionItem> = Vec::with_capacity(connectors.len());
-        for connector in connectors {
-            let connector_label = codex_connectors::metadata::connector_display_label(connector);
-            let connector_title = connector_label.clone();
-            let link_description = Self::connector_description(connector);
-            let description = Self::connector_brief_description(connector);
-            let status_label = Self::connector_status_label(connector);
-            let search_value = format!("{connector_label} {}", connector.id);
-            let mut item = SelectionItem {
-                name: connector_label,
-                description: Some(description),
-                search_value: Some(search_value),
-                ..Default::default()
-            };
-            let is_installed = connector.is_accessible;
-            let selected_label = if is_installed {
-                format!(
-                    "{status_label}. Press Enter to open the app page to install, manage, or enable/disable this app."
-                )
-            } else {
-                format!("{status_label}. Press Enter to open the app page to install this app.")
-            };
-            let missing_label = format!("{status_label}. App link unavailable.");
-            let instructions = if connector.is_accessible {
-                "Manage this app in your browser."
-            } else {
-                "Install this app in your browser, then reload Codex."
-            };
-            if let Some(install_url) = connector.install_url.clone() {
-                let app_id = connector.id.clone();
-                let is_enabled = connector.is_enabled;
-                let title = connector_title.clone();
-                let instructions = instructions.to_string();
-                let description = link_description.clone();
-                item.actions = vec![Box::new(move |tx| {
-                    tx.send(AppEvent::OpenAppLink {
-                        app_id: app_id.clone(),
-                        title: title.clone(),
-                        description: description.clone(),
-                        instructions: instructions.clone(),
-                        url: install_url.clone(),
-                        is_installed,
-                        is_enabled,
-                    });
-                })];
-                item.dismiss_on_select = true;
-                item.selected_description = Some(selected_label);
-            } else {
-                let missing_label_for_action = missing_label.clone();
-                item.actions = vec![Box::new(move |tx| {
-                    tx.send(AppEvent::InsertHistoryCell(Box::new(
-                        history_cell::new_info_event(
-                            missing_label_for_action.clone(),
-                            /*hint*/ None,
-                        ),
-                    )));
-                })];
-                item.dismiss_on_select = true;
-                item.selected_description = Some(missing_label);
-            }
-            items.push(item);
-        }
-
-        SelectionViewParams {
-            view_id: Some(CONNECTORS_SELECTION_VIEW_ID),
-            header: Box::new(header),
-            footer_hint: Some(self.bottom_pane.standard_popup_hint_line()),
-            items,
-            is_searchable: true,
-            search_placeholder: Some("Type to search apps".to_string()),
-            col_width_mode: ColumnWidthMode::AutoAllRows,
-            initial_selected_idx,
-            ..Default::default()
-        }
-    }
-
-    fn refresh_connectors_popup_if_open(&mut self, connectors: &[AppInfo]) {
-        let selected_connector_id =
-            if let (Some(selected_index), ConnectorsCacheState::Ready(snapshot)) = (
-                self.bottom_pane
-                    .selected_index_for_active_view(CONNECTORS_SELECTION_VIEW_ID),
-                &self.connectors.cache,
-            ) {
-                snapshot
-                    .connectors
-                    .get(selected_index)
-                    .map(|connector| connector.id.as_str())
-            } else {
-                None
-            };
-        let _ = self.bottom_pane.replace_selection_view_if_active(
-            CONNECTORS_SELECTION_VIEW_ID,
-            self.connectors_popup_params(connectors, selected_connector_id),
-        );
-    }
-
-    fn connector_brief_description(connector: &AppInfo) -> String {
-        let status_label = Self::connector_status_label(connector);
-        match Self::connector_description(connector) {
-            Some(description) => format!("{status_label} · {description}"),
-            None => status_label.to_string(),
-        }
-    }
-
-    fn connector_status_label(connector: &AppInfo) -> &'static str {
-        if connector.is_accessible {
-            if connector.is_enabled {
-                "Installed"
-            } else {
-                "Installed · Disabled"
-            }
-        } else {
-            "Can be installed"
-        }
-    }
-
-    fn connector_description(connector: &AppInfo) -> Option<String> {
-        connector
-            .description
-            .as_deref()
-            .map(str::trim)
-            .filter(|description| !description.is_empty())
-            .map(str::to_string)
-    }
-
     /// Forward file-search results to the bottom pane.
     pub(crate) fn apply_file_search_result(&mut self, query: String, matches: Vec<FileMatch>) {
         self.bottom_pane.on_file_search_result(query, matches);
     }
 
-    /// Handles a Ctrl+C press at the chat-widget layer.
-    ///
-    /// The first press arms a time-bounded quit shortcut and shows a footer hint via the bottom
-    /// pane. If cancellable work is active, Ctrl+C also submits `Op::Interrupt` after the shortcut
-    /// is armed.
-    ///
-    /// Active realtime conversations take precedence over bottom-pane Ctrl+C handling so the
-    /// first press always stops live voice, even when the composer contains the recording meter.
-    ///
-    /// When the double-press quit shortcut is enabled, pressing the same shortcut again before
-    /// expiry requests a shutdown-first quit.
-    fn on_ctrl_c(&mut self) {
-        let key = key_hint::ctrl(KeyCode::Char('c'));
-        if self.realtime_conversation.is_live() {
-            self.bottom_pane.clear_quit_shortcut_hint();
-            self.quit_shortcut_expires_at = None;
-            self.quit_shortcut_key = None;
-            self.stop_realtime_conversation_from_ui();
-            return;
-        }
-        let modal_or_popup_active = !self.bottom_pane.no_modal_or_popup_active();
-        if self.bottom_pane.on_ctrl_c() == CancellationEvent::Handled {
-            if DOUBLE_PRESS_QUIT_SHORTCUT_ENABLED {
-                if modal_or_popup_active {
-                    self.quit_shortcut_expires_at = None;
-                    self.quit_shortcut_key = None;
-                    self.bottom_pane.clear_quit_shortcut_hint();
-                } else {
-                    self.arm_quit_shortcut(key);
-                }
-            }
-            return;
-        }
-
-        if !DOUBLE_PRESS_QUIT_SHORTCUT_ENABLED {
-            if self.is_cancellable_work_active() {
-                self.quit_shortcut_expires_at = None;
-                self.quit_shortcut_key = None;
-                self.bottom_pane.clear_quit_shortcut_hint();
-                self.submit_op(AppCommand::interrupt());
-            } else {
-                self.request_quit_without_confirmation();
-            }
-            return;
-        }
-
-        if self.quit_shortcut_active_for(key) {
-            self.quit_shortcut_expires_at = None;
-            self.quit_shortcut_key = None;
-            self.request_quit_without_confirmation();
-            return;
-        }
-
-        self.arm_quit_shortcut(key);
-
-        if self.is_cancellable_work_active() {
-            self.submit_op(AppCommand::interrupt());
-        }
-    }
-
-    /// Handles a Ctrl+D press at the chat-widget layer.
-    ///
-    /// Ctrl-D only participates in quit when the composer is empty and no modal/popup is active.
-    /// Otherwise it should be routed to the active view and not attempt to quit.
-    fn on_ctrl_d(&mut self) -> bool {
-        let key = key_hint::ctrl(KeyCode::Char('d'));
-        if !DOUBLE_PRESS_QUIT_SHORTCUT_ENABLED {
-            if !self.bottom_pane.composer_is_empty() || !self.bottom_pane.no_modal_or_popup_active()
-            {
-                return false;
-            }
-
-            self.request_quit_without_confirmation();
-            return true;
-        }
-
-        if self.quit_shortcut_active_for(key) {
-            self.quit_shortcut_expires_at = None;
-            self.quit_shortcut_key = None;
-            self.request_quit_without_confirmation();
-            return true;
-        }
-
-        if !self.bottom_pane.composer_is_empty() || !self.bottom_pane.no_modal_or_popup_active() {
-            return false;
-        }
-
-        self.arm_quit_shortcut(key);
-        true
-    }
-
-    /// True if `key` matches the armed quit shortcut and the window has not expired.
-    fn quit_shortcut_active_for(&self, key: KeyBinding) -> bool {
-        self.quit_shortcut_key == Some(key)
-            && self
-                .quit_shortcut_expires_at
-                .is_some_and(|expires_at| Instant::now() < expires_at)
-    }
-
-    /// Arm the double-press quit shortcut and show the footer hint.
-    ///
-    /// This keeps the state machine (`quit_shortcut_*`) in `ChatWidget`, since
-    /// it is the component that interprets Ctrl+C vs Ctrl+D and decides whether
-    /// quitting is currently allowed, while delegating rendering to `BottomPane`.
-    fn arm_quit_shortcut(&mut self, key: KeyBinding) {
-        self.quit_shortcut_expires_at = Instant::now()
-            .checked_add(QUIT_SHORTCUT_TIMEOUT)
-            .or_else(|| Some(Instant::now()));
-        self.quit_shortcut_key = Some(key);
-        self.bottom_pane.show_quit_shortcut_hint(key);
-    }
-
-    // Review mode counts as cancellable work so Ctrl+C interrupts instead of quitting.
-    fn is_cancellable_work_active(&self) -> bool {
-        self.bottom_pane.is_task_running() || self.review.is_review_mode
-    }
-
     /// Return the markdown body width available to an active stream.
     ///
     /// Streaming controllers render only the message body, while history cells add bullets,
@@ -5989,100 +1727,6 @@ impl ChatWidget {
         self.refresh_plugin_mentions();
     }
 
-    pub(crate) fn on_connectors_loaded(
-        &mut self,
-        result: Result<ConnectorsSnapshot, String>,
-        is_final: bool,
-    ) {
-        let mut trigger_pending_force_refetch = false;
-        if is_final {
-            self.connectors.prefetch_in_flight = false;
-            if self.connectors.force_refetch_pending {
-                self.connectors.force_refetch_pending = false;
-                trigger_pending_force_refetch = true;
-            }
-        }
-
-        match result {
-            Ok(mut snapshot) => {
-                if !is_final {
-                    snapshot.connectors = chatgpt_connectors::merge_connectors_with_accessible(
-                        Vec::new(),
-                        snapshot.connectors,
-                        /*all_connectors_loaded*/ false,
-                    );
-                }
-                snapshot.connectors =
-                    chatgpt_connectors::with_app_enabled_state(snapshot.connectors, &self.config);
-                if let ConnectorsCacheState::Ready(existing_snapshot) = &self.connectors.cache {
-                    let enabled_by_id: HashMap<&str, bool> = existing_snapshot
-                        .connectors
-                        .iter()
-                        .map(|connector| (connector.id.as_str(), connector.is_enabled))
-                        .collect();
-                    for connector in &mut snapshot.connectors {
-                        if let Some(is_enabled) = enabled_by_id.get(connector.id.as_str()) {
-                            connector.is_enabled = *is_enabled;
-                        }
-                    }
-                }
-                if is_final {
-                    self.connectors.partial_snapshot = None;
-                    self.refresh_connectors_popup_if_open(&snapshot.connectors);
-                    self.connectors.cache = ConnectorsCacheState::Ready(snapshot.clone());
-                } else {
-                    self.connectors.partial_snapshot = Some(snapshot.clone());
-                }
-                self.bottom_pane.set_connectors_snapshot(Some(snapshot));
-            }
-            Err(err) => {
-                let partial_snapshot = self.connectors.partial_snapshot.take();
-                if let ConnectorsCacheState::Ready(snapshot) = &self.connectors.cache {
-                    warn!("failed to refresh apps list; retaining current apps snapshot: {err}");
-                    self.bottom_pane
-                        .set_connectors_snapshot(Some(snapshot.clone()));
-                } else if let Some(snapshot) = partial_snapshot {
-                    warn!(
-                        "failed to load full apps list; falling back to installed apps snapshot: {err}"
-                    );
-                    self.refresh_connectors_popup_if_open(&snapshot.connectors);
-                    self.connectors.cache = ConnectorsCacheState::Ready(snapshot.clone());
-                    self.bottom_pane.set_connectors_snapshot(Some(snapshot));
-                } else {
-                    self.connectors.cache = ConnectorsCacheState::Failed(err);
-                    self.bottom_pane.set_connectors_snapshot(/*snapshot*/ None);
-                }
-            }
-        }
-
-        if trigger_pending_force_refetch {
-            self.prefetch_connectors_with_options(/*force_refetch*/ true);
-        }
-    }
-
-    pub(crate) fn update_connector_enabled(&mut self, connector_id: &str, enabled: bool) {
-        let ConnectorsCacheState::Ready(mut snapshot) = self.connectors.cache.clone() else {
-            return;
-        };
-
-        let mut changed = false;
-        for connector in &mut snapshot.connectors {
-            if connector.id == connector_id {
-                changed = connector.is_enabled != enabled;
-                connector.is_enabled = enabled;
-                break;
-            }
-        }
-
-        if !changed {
-            return;
-        }
-
-        self.refresh_connectors_popup_if_open(&snapshot.connectors);
-        self.connectors.cache = ConnectorsCacheState::Ready(snapshot.clone());
-        self.bottom_pane.set_connectors_snapshot(Some(snapshot));
-    }
-
     pub(crate) fn refresh_plugin_mentions(&mut self) {
         if !self.config.features.enabled(Feature::Plugins) {
             self.bottom_pane.set_plugin_mentions(/*plugins*/ None);
@@ -6111,149 +1755,6 @@ impl ChatWidget {
         self.sync_mentions_v2_enabled();
     }
 
-    pub(crate) fn open_review_popup(&mut self) {
-        let mut items: Vec<SelectionItem> = Vec::new();
-
-        items.push(SelectionItem {
-            name: "Review against a base branch".to_string(),
-            description: Some("(PR Style)".into()),
-            actions: vec![Box::new({
-                let cwd = self.config.cwd.to_path_buf();
-                move |tx| {
-                    tx.send(AppEvent::OpenReviewBranchPicker(cwd.clone()));
-                }
-            })],
-            dismiss_on_select: false,
-            dismiss_parent_on_child_accept: true,
-            ..Default::default()
-        });
-
-        items.push(SelectionItem {
-            name: "Review uncommitted changes".to_string(),
-            actions: vec![Box::new(move |tx: &AppEventSender| {
-                tx.review(ReviewTarget::UncommittedChanges);
-            })],
-            dismiss_on_select: true,
-            ..Default::default()
-        });
-
-        // New: Review a specific commit (opens commit picker)
-        items.push(SelectionItem {
-            name: "Review a commit".to_string(),
-            actions: vec![Box::new({
-                let cwd = self.config.cwd.to_path_buf();
-                move |tx| {
-                    tx.send(AppEvent::OpenReviewCommitPicker(cwd.clone()));
-                }
-            })],
-            dismiss_on_select: false,
-            dismiss_parent_on_child_accept: true,
-            ..Default::default()
-        });
-
-        items.push(SelectionItem {
-            name: "Custom review instructions".to_string(),
-            actions: vec![Box::new(move |tx| {
-                tx.send(AppEvent::OpenReviewCustomPrompt);
-            })],
-            dismiss_on_select: false,
-            dismiss_parent_on_child_accept: true,
-            ..Default::default()
-        });
-
-        self.bottom_pane.show_selection_view(SelectionViewParams {
-            title: Some("Select a review preset".into()),
-            footer_hint: Some(standard_popup_hint_line()),
-            items,
-            ..Default::default()
-        });
-    }
-
-    pub(crate) async fn show_review_branch_picker(&mut self, cwd: &Path) {
-        let branches = local_git_branches(cwd).await;
-        let current_branch = current_branch_name(cwd)
-            .await
-            .unwrap_or_else(|| "(detached HEAD)".to_string());
-        let mut items: Vec<SelectionItem> = Vec::with_capacity(branches.len());
-
-        for option in branches {
-            let branch = option.clone();
-            items.push(SelectionItem {
-                name: format!("{current_branch} -> {branch}"),
-                actions: vec![Box::new(move |tx3: &AppEventSender| {
-                    tx3.review(ReviewTarget::BaseBranch {
-                        branch: branch.clone(),
-                    });
-                })],
-                dismiss_on_select: true,
-                search_value: Some(option),
-                ..Default::default()
-            });
-        }
-
-        self.bottom_pane.show_selection_view(SelectionViewParams {
-            title: Some("Select a base branch".to_string()),
-            footer_hint: Some(standard_popup_hint_line()),
-            items,
-            is_searchable: true,
-            search_placeholder: Some("Type to search branches".to_string()),
-            ..Default::default()
-        });
-    }
-
-    pub(crate) async fn show_review_commit_picker(&mut self, cwd: &Path) {
-        let commits = recent_commits(cwd, /*limit*/ 100).await;
-
-        let mut items: Vec<SelectionItem> = Vec::with_capacity(commits.len());
-        for entry in commits {
-            let subject = entry.subject.clone();
-            let sha = entry.sha.clone();
-            let search_val = format!("{subject} {sha}");
-
-            items.push(SelectionItem {
-                name: subject.clone(),
-                actions: vec![Box::new(move |tx3: &AppEventSender| {
-                    tx3.review(ReviewTarget::Commit {
-                        sha: sha.clone(),
-                        title: Some(subject.clone()),
-                    });
-                })],
-                dismiss_on_select: true,
-                search_value: Some(search_val),
-                ..Default::default()
-            });
-        }
-
-        self.bottom_pane.show_selection_view(SelectionViewParams {
-            title: Some("Select a commit to review".to_string()),
-            footer_hint: Some(standard_popup_hint_line()),
-            items,
-            is_searchable: true,
-            search_placeholder: Some("Type to search commits".to_string()),
-            ..Default::default()
-        });
-    }
-
-    pub(crate) fn show_review_custom_prompt(&mut self) {
-        let tx = self.app_event_tx.clone();
-        let view = CustomPromptView::new(
-            "Custom review instructions".to_string(),
-            "Type instructions and press Enter".to_string(),
-            /*initial_text*/ String::new(),
-            /*context_label*/ None,
-            Box::new(move |prompt: String| {
-                let trimmed = prompt.trim().to_string();
-                if trimmed.is_empty() {
-                    return;
-                }
-                tx.review(ReviewTarget::Custom {
-                    instructions: trimmed,
-                });
-            }),
-        );
-        self.bottom_pane.show_view(Box::new(view));
-    }
-
     pub(crate) fn token_usage(&self) -> TokenUsage {
         self.token_info
             .as_ref()
@@ -6343,111 +1844,6 @@ impl ChatWidget {
     pub(crate) fn clear_token_usage(&mut self) {
         self.token_info = None;
     }
-
-    fn as_renderable(&self) -> RenderableItem<'_> {
-        let active_cell_right_reserve = self.ambient_pet_wrap_reserved_cols();
-        let active_cell_renderable = match &self.transcript.active_cell {
-            Some(cell) => RenderableItem::Owned(Box::new(TranscriptAreaRenderable {
-                child: cell.as_ref(),
-                top: 1,
-                right: active_cell_right_reserve,
-            })),
-            None => RenderableItem::Owned(Box::new(())),
-        };
-        let active_hook_cell_renderable = match &self.active_hook_cell {
-            Some(cell) if cell.should_render() => {
-                RenderableItem::Owned(Box::new(TranscriptAreaRenderable {
-                    child: cell,
-                    top: 1,
-                    right: active_cell_right_reserve,
-                }))
-            }
-            _ => RenderableItem::Owned(Box::new(())),
-        };
-        let mut flex = FlexRenderable::new();
-        flex.push(/*flex*/ 1, active_cell_renderable);
-        flex.push(/*flex*/ 0, active_hook_cell_renderable);
-        flex.push(
-            /*flex*/ 0,
-            RenderableItem::Owned(Box::new(BottomPaneComposerReserveRenderable {
-                bottom_pane: &self.bottom_pane,
-                right_reserve: active_cell_right_reserve,
-            }))
-            .inset(Insets::tlbr(
-                /*top*/ 1, /*left*/ 0, /*bottom*/ 0, /*right*/ 0,
-            )),
-        );
-        RenderableItem::Owned(Box::new(flex))
-    }
-}
-
-struct BottomPaneComposerReserveRenderable<'a> {
-    bottom_pane: &'a BottomPane,
-    right_reserve: u16,
-}
-
-impl Renderable for BottomPaneComposerReserveRenderable<'_> {
-    fn render(&self, area: Rect, buf: &mut Buffer) {
-        self.bottom_pane
-            .render_with_composer_right_reserve(area, buf, self.right_reserve);
-    }
-
-    fn desired_height(&self, width: u16) -> u16 {
-        self.bottom_pane
-            .desired_height_with_composer_right_reserve(width, self.right_reserve)
-    }
-
-    fn cursor_pos(&self, area: Rect) -> Option<(u16, u16)> {
-        self.bottom_pane
-            .cursor_pos_with_composer_right_reserve(area, self.right_reserve)
-    }
-
-    fn cursor_style(&self, area: Rect) -> crossterm::cursor::SetCursorStyle {
-        self.bottom_pane
-            .cursor_style_with_composer_right_reserve(area, self.right_reserve)
-    }
-}
-
-struct TranscriptAreaRenderable<'a> {
-    child: &'a dyn HistoryCell,
-    top: u16,
-    right: u16,
-}
-
-impl Renderable for TranscriptAreaRenderable<'_> {
-    fn render(&self, area: Rect, buf: &mut Buffer) {
-        let area = self.child_area(area);
-        let lines = self.child.display_lines(area.width);
-        let paragraph = Paragraph::new(Text::from(lines)).wrap(Wrap { trim: false });
-        let y = if area.height == 0 {
-            0
-        } else {
-            let overflow = paragraph
-                .line_count(area.width)
-                .saturating_sub(usize::from(area.height));
-            u16::try_from(overflow).unwrap_or(u16::MAX)
-        };
-        Clear.render(area, buf);
-        paragraph.scroll((y, 0)).render(area, buf);
-    }
-
-    fn desired_height(&self, width: u16) -> u16 {
-        let child_width = width.saturating_sub(self.right).max(1);
-        HistoryCell::desired_height(self.child, child_width) + self.top
-    }
-}
-
-impl TranscriptAreaRenderable<'_> {
-    fn child_area(&self, area: Rect) -> Rect {
-        let y = area.y.saturating_add(self.top);
-        let height = area.height.saturating_sub(self.top);
-        Rect::new(
-            area.x,
-            y,
-            area.width.saturating_sub(self.right).max(1),
-            height,
-        )
-    }
 }
 
 #[cfg(not(target_os = "linux"))]
@@ -6483,129 +1879,6 @@ impl Drop for ChatWidget {
     }
 }
 
-impl Renderable for ChatWidget {
-    fn render(&self, area: Rect, buf: &mut Buffer) {
-        self.as_renderable().render(area, buf);
-        self.last_rendered_width.set(Some(area.width as usize));
-    }
-
-    fn desired_height(&self, width: u16) -> u16 {
-        self.as_renderable().desired_height(width)
-    }
-
-    fn cursor_pos(&self, area: Rect) -> Option<(u16, u16)> {
-        self.as_renderable().cursor_pos(area)
-    }
-
-    fn cursor_style(&self, area: Rect) -> crossterm::cursor::SetCursorStyle {
-        self.as_renderable().cursor_style(area)
-    }
-}
-
-#[derive(Debug)]
-enum Notification {
-    AgentTurnComplete { response: String },
-    ExecApprovalRequested { command: String },
-    EditApprovalRequested { cwd: PathBuf, changes: Vec<PathBuf> },
-    ElicitationRequested { server_name: String },
-    PlanModePrompt { title: String },
-}
-
-impl Notification {
-    fn display(&self) -> String {
-        match self {
-            Notification::AgentTurnComplete { response } => {
-                Notification::agent_turn_preview(response)
-                    .unwrap_or_else(|| "Agent turn complete".to_string())
-            }
-            Notification::ExecApprovalRequested { command } => {
-                format!(
-                    "Approval requested: {}",
-                    truncate_text(command, /*max_graphemes*/ 30)
-                )
-            }
-            Notification::EditApprovalRequested { cwd, changes } => {
-                format!(
-                    "Codex wants to edit {}",
-                    if changes.len() == 1 {
-                        #[allow(clippy::unwrap_used)]
-                        display_path_for(changes.first().unwrap(), cwd)
-                    } else {
-                        format!("{} files", changes.len())
-                    }
-                )
-            }
-            Notification::ElicitationRequested { server_name } => {
-                format!("Approval requested by {server_name}")
-            }
-            Notification::PlanModePrompt { title } => {
-                format!("Plan mode prompt: {title}")
-            }
-        }
-    }
-
-    fn type_name(&self) -> &str {
-        match self {
-            Notification::AgentTurnComplete { .. } => "agent-turn-complete",
-            Notification::ExecApprovalRequested { .. }
-            | Notification::EditApprovalRequested { .. }
-            | Notification::ElicitationRequested { .. } => "approval-requested",
-            Notification::PlanModePrompt { .. } => "plan-mode-prompt",
-        }
-    }
-
-    fn priority(&self) -> u8 {
-        match self {
-            Notification::AgentTurnComplete { .. } => 0,
-            Notification::ExecApprovalRequested { .. }
-            | Notification::EditApprovalRequested { .. }
-            | Notification::ElicitationRequested { .. }
-            | Notification::PlanModePrompt { .. } => 1,
-        }
-    }
-
-    fn allowed_for(&self, settings: &Notifications) -> bool {
-        match settings {
-            Notifications::Enabled(enabled) => *enabled,
-            Notifications::Custom(allowed) => allowed.iter().any(|a| a == self.type_name()),
-        }
-    }
-
-    fn agent_turn_preview(response: &str) -> Option<String> {
-        let mut normalized = String::new();
-        for part in response.split_whitespace() {
-            if !normalized.is_empty() {
-                normalized.push(' ');
-            }
-            normalized.push_str(part);
-        }
-        let trimmed = normalized.trim();
-        if trimmed.is_empty() {
-            None
-        } else {
-            Some(truncate_text(trimmed, AGENT_NOTIFICATION_PREVIEW_GRAPHEMES))
-        }
-    }
-
-    fn user_input_request_summary(
-        questions: &[codex_app_server_protocol::ToolRequestUserInputQuestion],
-    ) -> Option<String> {
-        let first_question = questions.first()?;
-        let summary = if first_question.header.trim().is_empty() {
-            first_question.question.trim()
-        } else {
-            first_question.header.trim()
-        };
-        if summary.is_empty() {
-            None
-        } else {
-            Some(truncate_text(summary, /*max_graphemes*/ 30))
-        }
-    }
-}
-
-const AGENT_NOTIFICATION_PREVIEW_GRAPHEMES: usize = 200;
-
 const PLACEHOLDERS: [&str; 8] = [
     "Explain this codebase",
     "Summarize recent commits",
@@ -6653,40 +1926,5 @@ fn extract_first_bold(s: &str) -> Option<String> {
     None
 }
 
-#[cfg(test)]
-pub(crate) fn show_review_commit_picker_with_entries(
-    chat: &mut ChatWidget,
-    entries: Vec<CommitLogEntry>,
-) {
-    let mut items: Vec<SelectionItem> = Vec::with_capacity(entries.len());
-    for entry in entries {
-        let subject = entry.subject.clone();
-        let sha = entry.sha.clone();
-        let search_val = format!("{subject} {sha}");
-
-        items.push(SelectionItem {
-            name: subject.clone(),
-            actions: vec![Box::new(move |tx3: &AppEventSender| {
-                tx3.review(ReviewTarget::Commit {
-                    sha: sha.clone(),
-                    title: Some(subject.clone()),
-                });
-            })],
-            dismiss_on_select: true,
-            search_value: Some(search_val),
-            ..Default::default()
-        });
-    }
-
-    chat.bottom_pane.show_selection_view(SelectionViewParams {
-        title: Some("Select a commit to review".to_string()),
-        footer_hint: Some(standard_popup_hint_line()),
-        items,
-        is_searchable: true,
-        search_placeholder: Some("Type to search commits".to_string()),
-        ..Default::default()
-    });
-}
-
 #[cfg(test)]
 pub(crate) mod tests;
diff --git a/codex-rs/tui/src/chatwidget/connectors.rs b/codex-rs/tui/src/chatwidget/connectors.rs
index 0cd5429baf..2df64df7d7 100644
--- a/codex-rs/tui/src/chatwidget/connectors.rs
+++ b/codex-rs/tui/src/chatwidget/connectors.rs
@@ -1,5 +1,6 @@
-//! Connector list cache state for `ChatWidget`.
+//! Connector cache, popup, and refresh handling for `ChatWidget`.
 
+use super::*;
 use crate::app_event::ConnectorsSnapshot;
 
 #[derive(Debug, Clone, Default)]
@@ -18,3 +19,363 @@ pub(super) struct ConnectorsState {
     pub(super) prefetch_in_flight: bool,
     pub(super) force_refetch_pending: bool,
 }
+
+impl ChatWidget {
+    pub(crate) fn refresh_connectors(&mut self, force_refetch: bool) {
+        self.queue_connectors_refresh(force_refetch);
+    }
+
+    pub(super) fn prefetch_connectors(&mut self) {
+        self.queue_connectors_refresh(/*force_refetch*/ false);
+    }
+
+    fn queue_connectors_refresh(&mut self, force_refetch: bool) {
+        if self.begin_connectors_refresh(force_refetch) {
+            self.app_event_tx
+                .send(AppEvent::FetchConnectorsList { force_refetch });
+        }
+    }
+
+    fn begin_connectors_refresh(&mut self, force_refetch: bool) -> bool {
+        if !self.connectors_enabled() {
+            return false;
+        }
+        if self.connectors.prefetch_in_flight {
+            if force_refetch {
+                self.connectors.force_refetch_pending = true;
+            }
+            return false;
+        }
+
+        self.connectors.prefetch_in_flight = true;
+        if !matches!(self.connectors.cache, ConnectorsCacheState::Ready(_)) {
+            self.connectors.cache = ConnectorsCacheState::Loading;
+        }
+        true
+    }
+
+    pub(super) fn connectors_enabled(&self) -> bool {
+        self.config.features.enabled(Feature::Apps) && self.has_chatgpt_account
+    }
+
+    pub(super) fn connectors_for_mentions(&self) -> Option<&[AppInfo]> {
+        if !self.connectors_enabled() {
+            return None;
+        }
+
+        if let Some(snapshot) = &self.connectors.partial_snapshot {
+            return Some(snapshot.connectors.as_slice());
+        }
+
+        match &self.connectors.cache {
+            ConnectorsCacheState::Ready(snapshot) => Some(snapshot.connectors.as_slice()),
+            _ => None,
+        }
+    }
+
+    pub(crate) fn add_connectors_output(&mut self) {
+        if !self.connectors_enabled() {
+            self.add_info_message(
+                "Apps are disabled.".to_string(),
+                Some("Enable the apps feature to use $ or /apps.".to_string()),
+            );
+            return;
+        }
+
+        let connectors_cache = self.connectors.cache.clone();
+        let should_force_refetch = !self.connectors.prefetch_in_flight
+            || matches!(connectors_cache, ConnectorsCacheState::Ready(_));
+        self.queue_connectors_refresh(should_force_refetch);
+
+        match connectors_cache {
+            ConnectorsCacheState::Ready(snapshot) => {
+                if snapshot.connectors.is_empty() {
+                    self.add_info_message("No apps available.".to_string(), /*hint*/ None);
+                } else {
+                    self.open_connectors_popup(&snapshot.connectors);
+                }
+            }
+            ConnectorsCacheState::Failed(err) => {
+                self.add_to_history(history_cell::new_error_event(err));
+            }
+            ConnectorsCacheState::Loading | ConnectorsCacheState::Uninitialized => {
+                self.open_connectors_loading_popup();
+            }
+        }
+        self.request_redraw();
+    }
+
+    fn open_connectors_loading_popup(&mut self) {
+        if !self.bottom_pane.replace_selection_view_if_active(
+            CONNECTORS_SELECTION_VIEW_ID,
+            self.connectors_loading_popup_params(),
+        ) {
+            self.bottom_pane
+                .show_selection_view(self.connectors_loading_popup_params());
+        }
+    }
+
+    fn open_connectors_popup(&mut self, connectors: &[AppInfo]) {
+        self.bottom_pane.show_selection_view(
+            self.connectors_popup_params(connectors, /*selected_connector_id*/ None),
+        );
+    }
+
+    fn connectors_loading_popup_params(&self) -> SelectionViewParams {
+        let mut header = ColumnRenderable::new();
+        header.push(Line::from("Apps".bold()));
+        header.push(Line::from("Loading installed and available apps...".dim()));
+
+        SelectionViewParams {
+            view_id: Some(CONNECTORS_SELECTION_VIEW_ID),
+            header: Box::new(header),
+            items: vec![SelectionItem {
+                name: "Loading apps...".to_string(),
+                description: Some("This updates when the full list is ready.".to_string()),
+                is_disabled: true,
+                ..Default::default()
+            }],
+            ..Default::default()
+        }
+    }
+
+    fn connectors_popup_params(
+        &self,
+        connectors: &[AppInfo],
+        selected_connector_id: Option<&str>,
+    ) -> SelectionViewParams {
+        let total = connectors.len();
+        let installed = connectors
+            .iter()
+            .filter(|connector| connector.is_accessible)
+            .count();
+        let mut header = ColumnRenderable::new();
+        header.push(Line::from("Apps".bold()));
+        header.push(Line::from(
+            "Use $ to insert an installed app into your prompt.".dim(),
+        ));
+        header.push(Line::from(
+            format!("Installed {installed} of {total} available apps.").dim(),
+        ));
+        let initial_selected_idx = selected_connector_id.and_then(|selected_connector_id| {
+            connectors
+                .iter()
+                .position(|connector| connector.id == selected_connector_id)
+        });
+        let mut items: Vec<SelectionItem> = Vec::with_capacity(connectors.len());
+        for connector in connectors {
+            let connector_label = codex_connectors::metadata::connector_display_label(connector);
+            let connector_title = connector_label.clone();
+            let link_description = Self::connector_description(connector);
+            let description = Self::connector_brief_description(connector);
+            let status_label = Self::connector_status_label(connector);
+            let search_value = format!("{connector_label} {}", connector.id);
+            let mut item = SelectionItem {
+                name: connector_label,
+                description: Some(description),
+                search_value: Some(search_value),
+                ..Default::default()
+            };
+            let is_installed = connector.is_accessible;
+            let selected_label = if is_installed {
+                format!(
+                    "{status_label}. Press Enter to open the app page to install, manage, or enable/disable this app."
+                )
+            } else {
+                format!("{status_label}. Press Enter to open the app page to install this app.")
+            };
+            let missing_label = format!("{status_label}. App link unavailable.");
+            let instructions = if connector.is_accessible {
+                "Manage this app in your browser."
+            } else {
+                "Install this app in your browser, then reload Codex."
+            };
+            if let Some(install_url) = connector.install_url.clone() {
+                let app_id = connector.id.clone();
+                let is_enabled = connector.is_enabled;
+                let title = connector_title.clone();
+                let instructions = instructions.to_string();
+                let description = link_description.clone();
+                item.actions = vec![Box::new(move |tx| {
+                    tx.send(AppEvent::OpenAppLink {
+                        app_id: app_id.clone(),
+                        title: title.clone(),
+                        description: description.clone(),
+                        instructions: instructions.clone(),
+                        url: install_url.clone(),
+                        is_installed,
+                        is_enabled,
+                    });
+                })];
+                item.dismiss_on_select = true;
+                item.selected_description = Some(selected_label);
+            } else {
+                let missing_label_for_action = missing_label.clone();
+                item.actions = vec![Box::new(move |tx| {
+                    tx.send(AppEvent::InsertHistoryCell(Box::new(
+                        history_cell::new_info_event(
+                            missing_label_for_action.clone(),
+                            /*hint*/ None,
+                        ),
+                    )));
+                })];
+                item.dismiss_on_select = true;
+                item.selected_description = Some(missing_label);
+            }
+            items.push(item);
+        }
+
+        SelectionViewParams {
+            view_id: Some(CONNECTORS_SELECTION_VIEW_ID),
+            header: Box::new(header),
+            footer_hint: Some(self.bottom_pane.standard_popup_hint_line()),
+            items,
+            is_searchable: true,
+            search_placeholder: Some("Type to search apps".to_string()),
+            col_width_mode: ColumnWidthMode::AutoAllRows,
+            initial_selected_idx,
+            ..Default::default()
+        }
+    }
+
+    fn refresh_connectors_popup_if_open(&mut self, connectors: &[AppInfo]) {
+        let selected_connector_id =
+            if let (Some(selected_index), ConnectorsCacheState::Ready(snapshot)) = (
+                self.bottom_pane
+                    .selected_index_for_active_view(CONNECTORS_SELECTION_VIEW_ID),
+                &self.connectors.cache,
+            ) {
+                snapshot
+                    .connectors
+                    .get(selected_index)
+                    .map(|connector| connector.id.as_str())
+            } else {
+                None
+            };
+        let _ = self.bottom_pane.replace_selection_view_if_active(
+            CONNECTORS_SELECTION_VIEW_ID,
+            self.connectors_popup_params(connectors, selected_connector_id),
+        );
+    }
+
+    fn connector_brief_description(connector: &AppInfo) -> String {
+        let status_label = Self::connector_status_label(connector);
+        match Self::connector_description(connector) {
+            Some(description) => format!("{status_label} · {description}"),
+            None => status_label.to_string(),
+        }
+    }
+
+    fn connector_status_label(connector: &AppInfo) -> &'static str {
+        if connector.is_accessible {
+            if connector.is_enabled {
+                "Installed"
+            } else {
+                "Installed · Disabled"
+            }
+        } else {
+            "Can be installed"
+        }
+    }
+
+    fn connector_description(connector: &AppInfo) -> Option<String> {
+        connector
+            .description
+            .as_deref()
+            .map(str::trim)
+            .filter(|description| !description.is_empty())
+            .map(str::to_string)
+    }
+
+    pub(crate) fn on_connectors_loaded(
+        &mut self,
+        result: Result<ConnectorsSnapshot, String>,
+        is_final: bool,
+    ) {
+        let mut trigger_pending_force_refetch = false;
+        if is_final {
+            self.connectors.prefetch_in_flight = false;
+            if self.connectors.force_refetch_pending {
+                self.connectors.force_refetch_pending = false;
+                trigger_pending_force_refetch = true;
+            }
+        }
+
+        match result {
+            Ok(mut snapshot) => {
+                if !is_final {
+                    snapshot.connectors = chatgpt_connectors::merge_connectors_with_accessible(
+                        Vec::new(),
+                        snapshot.connectors,
+                        /*all_connectors_loaded*/ false,
+                    );
+                }
+                if let ConnectorsCacheState::Ready(existing_snapshot) = &self.connectors.cache {
+                    let enabled_by_id: HashMap<&str, bool> = existing_snapshot
+                        .connectors
+                        .iter()
+                        .map(|connector| (connector.id.as_str(), connector.is_enabled))
+                        .collect();
+                    for connector in &mut snapshot.connectors {
+                        if let Some(is_enabled) = enabled_by_id.get(connector.id.as_str()) {
+                            connector.is_enabled = *is_enabled;
+                        }
+                    }
+                }
+                if is_final {
+                    self.connectors.partial_snapshot = None;
+                    self.refresh_connectors_popup_if_open(&snapshot.connectors);
+                    self.connectors.cache = ConnectorsCacheState::Ready(snapshot.clone());
+                } else {
+                    self.connectors.partial_snapshot = Some(snapshot.clone());
+                }
+                self.bottom_pane.set_connectors_snapshot(Some(snapshot));
+            }
+            Err(err) => {
+                let partial_snapshot = self.connectors.partial_snapshot.take();
+                if let ConnectorsCacheState::Ready(snapshot) = &self.connectors.cache {
+                    warn!("failed to refresh apps list; retaining current apps snapshot: {err}");
+                    self.bottom_pane
+                        .set_connectors_snapshot(Some(snapshot.clone()));
+                } else if let Some(snapshot) = partial_snapshot {
+                    warn!(
+                        "failed to load full apps list; falling back to installed apps snapshot: {err}"
+                    );
+                    self.refresh_connectors_popup_if_open(&snapshot.connectors);
+                    self.connectors.cache = ConnectorsCacheState::Ready(snapshot.clone());
+                    self.bottom_pane.set_connectors_snapshot(Some(snapshot));
+                } else {
+                    self.connectors.cache = ConnectorsCacheState::Failed(err);
+                    self.bottom_pane.set_connectors_snapshot(/*snapshot*/ None);
+                }
+            }
+        }
+
+        if trigger_pending_force_refetch {
+            self.queue_connectors_refresh(/*force_refetch*/ true);
+        }
+    }
+
+    pub(crate) fn update_connector_enabled(&mut self, connector_id: &str, enabled: bool) {
+        let ConnectorsCacheState::Ready(mut snapshot) = self.connectors.cache.clone() else {
+            return;
+        };
+
+        let mut changed = false;
+        for connector in &mut snapshot.connectors {
+            if connector.id == connector_id {
+                changed = connector.is_enabled != enabled;
+                connector.is_enabled = enabled;
+                break;
+            }
+        }
+
+        if !changed {
+            return;
+        }
+
+        self.refresh_connectors_popup_if_open(&snapshot.connectors);
+        self.connectors.cache = ConnectorsCacheState::Ready(snapshot.clone());
+        self.bottom_pane.set_connectors_snapshot(Some(snapshot));
+    }
+}
diff --git a/codex-rs/tui/src/chatwidget/constructor.rs b/codex-rs/tui/src/chatwidget/constructor.rs
new file mode 100644
index 0000000000..56bdc6bf68
--- /dev/null
+++ b/codex-rs/tui/src/chatwidget/constructor.rs
@@ -0,0 +1,264 @@
+//! Construction and initial wiring for `ChatWidget`.
+
+use super::*;
+
+impl ChatWidget {
+    pub(crate) fn new_with_app_event(common: ChatWidgetInit) -> Self {
+        Self::new_with_op_target(common, CodexOpTarget::AppEvent)
+    }
+
+    pub(super) fn new_with_op_target(
+        common: ChatWidgetInit,
+        codex_op_target: CodexOpTarget,
+    ) -> Self {
+        let ChatWidgetInit {
+            config,
+            frame_requester,
+            app_event_tx,
+            workspace_command_runner,
+            initial_user_message,
+            enhanced_keys_supported,
+            has_chatgpt_account,
+            model_catalog,
+            feedback,
+            is_first_run,
+            status_account_display,
+            runtime_model_provider_base_url,
+            initial_plan_type,
+            model,
+            startup_tooltip_override,
+            status_line_invalid_items_warned,
+            terminal_title_invalid_items_warned,
+            session_telemetry,
+        } = common;
+        let model = model.filter(|m| !m.trim().is_empty());
+        let mut config = config;
+        config.model = model.clone();
+        let prevent_idle_sleep = config.features.enabled(Feature::PreventIdleSleep);
+        let mut rng = rand::rng();
+        let placeholder = PLACEHOLDERS[rng.random_range(0..PLACEHOLDERS.len())].to_string();
+        let side_placeholder =
+            SIDE_PLACEHOLDERS[rng.random_range(0..SIDE_PLACEHOLDERS.len())].to_string();
+
+        let model_override = model.as_deref();
+        let model_for_header = model
+            .clone()
+            .unwrap_or_else(|| DEFAULT_MODEL_DISPLAY_NAME.to_string());
+        let active_collaboration_mask =
+            Self::initial_collaboration_mask(&config, model_catalog.as_ref(), model_override);
+        let header_model = active_collaboration_mask
+            .as_ref()
+            .and_then(|mask| mask.model.clone())
+            .unwrap_or_else(|| model_for_header.clone());
+        let fallback_default = Settings {
+            model: header_model.clone(),
+            reasoning_effort: None,
+            developer_instructions: None,
+        };
+        // Collaboration modes start in Default mode.
+        let current_collaboration_mode = CollaborationMode {
+            mode: ModeKind::Default,
+            settings: fallback_default,
+        };
+
+        let active_cell = Some(Self::placeholder_session_header_cell(&config));
+
+        let current_cwd = Some(config.cwd.to_path_buf());
+        let effective_service_tier = config.service_tier.clone();
+        let current_terminal_info = terminal_info();
+        let runtime_keymap = RuntimeKeymap::from_config(&config.tui_keymap).ok();
+        let default_keymap = RuntimeKeymap::defaults();
+        let copy_last_response_binding = runtime_keymap
+            .as_ref()
+            .map(|keymap| keymap.app.copy.clone())
+            .unwrap_or_else(|| default_keymap.app.copy.clone());
+        let chat_keymap = runtime_keymap
+            .as_ref()
+            .map(|keymap| keymap.chat.clone())
+            .unwrap_or_else(|| default_keymap.chat.clone());
+        let queued_message_edit_hint_binding = queued_message_edit_hint_binding(
+            &chat_keymap.edit_queued_message,
+            current_terminal_info,
+        );
+        pets::start_configured_pet_load_if_needed(
+            &config,
+            /*ambient_pet_missing*/ true,
+            frame_requester.clone(),
+            app_event_tx.clone(),
+        );
+        let mut widget = Self {
+            app_event_tx: app_event_tx.clone(),
+            frame_requester: frame_requester.clone(),
+            codex_op_target,
+            bottom_pane: BottomPane::new(BottomPaneParams {
+                frame_requester,
+                app_event_tx,
+                has_input_focus: true,
+                enhanced_keys_supported,
+                placeholder_text: placeholder.clone(),
+                disable_paste_burst: config.disable_paste_burst,
+                animations_enabled: config.animations,
+                skills: None,
+            }),
+            transcript: TranscriptState::new(active_cell),
+            raw_output_mode: config.tui_raw_output_mode,
+            config,
+            effective_service_tier,
+            skills_all: Vec::new(),
+            skills_initial_state: None,
+            current_collaboration_mode,
+            active_collaboration_mask,
+            has_chatgpt_account,
+            model_catalog,
+            session_telemetry,
+            session_header: SessionHeader::new(header_model),
+            initial_user_message,
+            status_account_display,
+            runtime_model_provider_base_url,
+            token_info: None,
+            rate_limit_snapshots_by_limit_id: BTreeMap::new(),
+            refreshing_status_outputs: Vec::new(),
+            next_status_refresh_request_id: 0,
+            plan_type: initial_plan_type,
+            codex_rate_limit_reached_type: None,
+            rate_limit_warnings: RateLimitWarningState::default(),
+            warning_display_state: WarningDisplayState::default(),
+            rate_limit_switch_prompt: RateLimitSwitchPromptState::default(),
+            add_credits_nudge_email_in_flight: None,
+            adaptive_chunking: AdaptiveChunkingPolicy::default(),
+            stream_controller: None,
+            plan_stream_controller: None,
+            clipboard_lease: None,
+            copy_last_response_binding,
+            running_commands: HashMap::new(),
+            collab_agent_metadata: HashMap::new(),
+            pending_collab_spawn_requests: HashMap::new(),
+            suppressed_exec_calls: HashSet::new(),
+            last_unified_wait: None,
+            unified_exec_wait_streak: None,
+            turn_lifecycle: TurnLifecycleState::new(prevent_idle_sleep),
+            task_complete_pending: false,
+            unified_exec_processes: Vec::new(),
+            mcp_startup_status: None,
+            mcp_startup_expected_servers: None,
+            mcp_startup_ignore_updates_until_next_start: false,
+            mcp_startup_allow_terminal_only_next_round: false,
+            mcp_startup_pending_next_round: HashMap::new(),
+            mcp_startup_pending_next_round_saw_starting: false,
+            connectors: ConnectorsState::default(),
+            ide_context: IdeContextState::default(),
+            plugins_cache: PluginsCacheState::default(),
+            plugins_fetch_state: PluginListFetchState::default(),
+            plugin_install_apps_needing_auth: Vec::new(),
+            plugin_install_auth_flow: None,
+            plugins_active_tab_id: None,
+            newly_installed_marketplace_tab_id: None,
+            interrupts: InterruptManager::new(),
+            reasoning_buffer: String::new(),
+            full_reasoning_buffer: String::new(),
+            status_state: StatusState::default(),
+            review: ReviewState::default(),
+            active_hook_cell: None,
+            ambient_pet: None,
+            pet_picker_preview_state: crate::pets::PetPickerPreviewState::default(),
+            pet_picker_preview_pet: None,
+            pet_picker_preview_request_id: 0,
+            pet_picker_preview_image_visible: std::cell::Cell::new(/*value*/ false),
+            pet_selection_load_request_id: 0,
+            #[cfg(test)]
+            pet_image_support_override: None,
+            thread_id: None,
+            dismissed_plan_mode_nudge_scopes: HashSet::new(),
+            thread_name: None,
+            thread_rename_block_message: None,
+            active_side_conversation: false,
+            normal_placeholder_text: placeholder,
+            side_placeholder_text: side_placeholder,
+            forked_from: None,
+            interrupted_turn_notice_mode: InterruptedTurnNoticeMode::Default,
+            input_queue: InputQueueState::default(),
+            chat_keymap,
+            queued_message_edit_hint_binding,
+            show_welcome_banner: is_first_run,
+            startup_tooltip_override,
+            suppress_session_configured_redraw: false,
+            suppress_initial_user_message_submit: false,
+            pending_notification: None,
+            quit_shortcut_expires_at: None,
+            quit_shortcut_key: None,
+            turn_runtime_metrics: RuntimeMetricsSummary::default(),
+            last_rendered_width: std::cell::Cell::new(None),
+            feedback,
+            current_rollout_path: None,
+            current_cwd,
+            workspace_command_runner,
+            instruction_source_paths: Vec::new(),
+            session_network_proxy: None,
+            status_line_invalid_items_warned,
+            terminal_title_invalid_items_warned,
+            last_terminal_title: None,
+            last_terminal_title_requires_action: false,
+            terminal_title_setup_original_items: None,
+            terminal_title_animation_origin: Instant::now(),
+            status_line_project_root_name_cache: None,
+            status_line_branch: None,
+            status_line_branch_cwd: None,
+            status_line_branch_pending: false,
+            status_line_branch_lookup_complete: false,
+            status_line_git_summary: None,
+            status_line_git_summary_cwd: None,
+            status_line_git_summary_pending: false,
+            status_line_git_summary_lookup_complete: false,
+            current_goal_status_indicator: None,
+            current_goal_status: None,
+            external_editor_state: ExternalEditorState::Closed,
+            realtime_conversation: RealtimeConversationUiState::default(),
+            last_rendered_user_message_display: None,
+            last_non_retry_error: None,
+        };
+
+        widget.prefetch_rate_limits();
+        if let Some(keymap) = runtime_keymap {
+            widget.bottom_pane.set_keymap_bindings(&keymap);
+        }
+        widget
+            .bottom_pane
+            .set_vim_enabled(widget.config.tui_vim_mode_default);
+        widget
+            .bottom_pane
+            .set_realtime_conversation_enabled(widget.realtime_conversation_enabled());
+        widget
+            .bottom_pane
+            .set_audio_device_selection_enabled(widget.realtime_audio_device_selection_enabled());
+        widget
+            .bottom_pane
+            .set_status_line_enabled(!widget.configured_status_line_items().is_empty());
+        widget
+            .bottom_pane
+            .set_collaboration_modes_enabled(/*enabled*/ true);
+        widget.sync_service_tier_commands();
+        widget.sync_personality_command_enabled();
+        widget.sync_plugins_command_enabled();
+        widget.sync_goal_command_enabled();
+        widget.sync_mentions_v2_enabled();
+        widget
+            .bottom_pane
+            .set_queued_message_edit_binding(widget.queued_message_edit_hint_binding);
+        #[cfg(target_os = "windows")]
+        widget.bottom_pane.set_windows_degraded_sandbox_active(
+            crate::legacy_core::windows_sandbox::ELEVATED_SANDBOX_NUX_ENABLED
+                && matches!(
+                    WindowsSandboxLevel::from_config(&widget.config),
+                    WindowsSandboxLevel::RestrictedToken
+                ),
+        );
+        widget.update_collaboration_mode_indicator();
+
+        widget
+            .bottom_pane
+            .set_connectors_enabled(widget.connectors_enabled());
+        widget.refresh_status_surfaces();
+
+        widget
+    }
+}
diff --git a/codex-rs/tui/src/chatwidget/goal_menu.rs b/codex-rs/tui/src/chatwidget/goal_menu.rs
index 19966d325f..ed48b5840d 100644
--- a/codex-rs/tui/src/chatwidget/goal_menu.rs
+++ b/codex-rs/tui/src/chatwidget/goal_menu.rs
@@ -103,7 +103,9 @@ fn goal_summary_lines(goal: &AppThreadGoal) -> Vec<Line<'static>> {
     }
     let command_hint = match goal.status {
         AppThreadGoalStatus::Active => "Commands: /goal edit, /goal pause, /goal clear",
-        AppThreadGoalStatus::Paused => "Commands: /goal edit, /goal resume, /goal clear",
+        AppThreadGoalStatus::Paused
+        | AppThreadGoalStatus::Blocked
+        | AppThreadGoalStatus::UsageLimited => "Commands: /goal edit, /goal resume, /goal clear",
         AppThreadGoalStatus::BudgetLimited | AppThreadGoalStatus::Complete => {
             "Commands: /goal edit, /goal clear"
         }
@@ -117,6 +119,8 @@ fn goal_status_label(status: AppThreadGoalStatus) -> &'static str {
     match status {
         AppThreadGoalStatus::Active => "active",
         AppThreadGoalStatus::Paused => "paused",
+        AppThreadGoalStatus::Blocked => "blocked",
+        AppThreadGoalStatus::UsageLimited => "usage limited",
         AppThreadGoalStatus::BudgetLimited => "limited by budget",
         AppThreadGoalStatus::Complete => "complete",
     }
@@ -125,7 +129,9 @@ fn goal_status_label(status: AppThreadGoalStatus) -> &'static str {
 fn edited_goal_status(status: AppThreadGoalStatus) -> AppThreadGoalStatus {
     match status {
         AppThreadGoalStatus::Active => AppThreadGoalStatus::Active,
-        AppThreadGoalStatus::Paused => AppThreadGoalStatus::Paused,
+        AppThreadGoalStatus::Paused
+        | AppThreadGoalStatus::Blocked
+        | AppThreadGoalStatus::UsageLimited => status,
         AppThreadGoalStatus::BudgetLimited | AppThreadGoalStatus::Complete => {
             AppThreadGoalStatus::Active
         }
diff --git a/codex-rs/tui/src/chatwidget/goal_status.rs b/codex-rs/tui/src/chatwidget/goal_status.rs
index e641159a3b..e64c5be376 100644
--- a/codex-rs/tui/src/chatwidget/goal_status.rs
+++ b/codex-rs/tui/src/chatwidget/goal_status.rs
@@ -50,6 +50,8 @@ pub(super) fn goal_status_indicator_from_app_goal(
             usage: active_goal_usage(goal.token_budget, goal.tokens_used, goal.time_used_seconds),
         }),
         AppThreadGoalStatus::Paused => Some(GoalStatusIndicator::Paused),
+        AppThreadGoalStatus::Blocked => Some(GoalStatusIndicator::Blocked),
+        AppThreadGoalStatus::UsageLimited => Some(GoalStatusIndicator::UsageLimited),
         AppThreadGoalStatus::BudgetLimited => Some(GoalStatusIndicator::BudgetLimited {
             usage: stopped_goal_budget_usage(goal.token_budget, goal.tokens_used),
         }),
diff --git a/codex-rs/tui/src/chatwidget/input_restore.rs b/codex-rs/tui/src/chatwidget/input_restore.rs
index ca15f1cdf7..b7e8ee72e0 100644
--- a/codex-rs/tui/src/chatwidget/input_restore.rs
+++ b/codex-rs/tui/src/chatwidget/input_restore.rs
@@ -152,12 +152,13 @@ impl ChatWidget {
             return None;
         }
 
+        let composer = self.bottom_pane.composer_draft_snapshot();
         let existing_message = UserMessage {
-            text: self.bottom_pane.composer_text(),
-            text_elements: self.bottom_pane.composer_text_elements(),
-            local_images: self.bottom_pane.composer_local_images(),
-            remote_image_urls: self.bottom_pane.remote_image_urls(),
-            mention_bindings: self.bottom_pane.composer_mention_bindings(),
+            text: composer.text,
+            text_elements: composer.text_elements,
+            local_images: composer.local_images,
+            remote_image_urls: composer.remote_image_urls,
+            mention_bindings: composer.mention_bindings,
         };
 
         let rejected_messages = self
@@ -236,13 +237,14 @@ impl ChatWidget {
     }
 
     pub(crate) fn capture_thread_input_state(&self) -> Option<ThreadInputState> {
+        let draft = self.bottom_pane.composer_draft_snapshot();
         let composer = ThreadComposerState {
-            text: self.bottom_pane.composer_text(),
-            text_elements: self.bottom_pane.composer_text_elements(),
-            local_images: self.bottom_pane.composer_local_images(),
-            remote_image_urls: self.bottom_pane.remote_image_urls(),
-            mention_bindings: self.bottom_pane.composer_mention_bindings(),
-            pending_pastes: self.bottom_pane.composer_pending_pastes(),
+            text: draft.text,
+            text_elements: draft.text_elements,
+            local_images: draft.local_images,
+            remote_image_urls: draft.remote_image_urls,
+            mention_bindings: draft.mention_bindings,
+            pending_pastes: draft.pending_pastes,
         };
         Some(ThreadInputState {
             composer: composer.has_content().then_some(composer),
diff --git a/codex-rs/tui/src/chatwidget/input_submission.rs b/codex-rs/tui/src/chatwidget/input_submission.rs
index 9043cb3d9d..2fd376f139 100644
--- a/codex-rs/tui/src/chatwidget/input_submission.rs
+++ b/codex-rs/tui/src/chatwidget/input_submission.rs
@@ -164,12 +164,14 @@ impl ChatWidget {
         for image_url in &remote_image_urls {
             items.push(UserInput::Image {
                 url: image_url.clone(),
+                detail: None,
             });
         }
 
         for image in &local_images {
             items.push(UserInput::LocalImage {
                 path: image.path.clone(),
+                detail: None,
             });
         }
 
@@ -334,12 +336,12 @@ impl ChatWidget {
             None if self.config.notices.fast_default_opt_out == Some(true) => Some(None),
             None => None,
         };
-        let permission_profile = self.config.permissions.permission_profile();
+        let active_permission_profile = self.config.permissions.active_permission_profile();
         let op = AppCommand::user_turn(
             items,
             self.config.cwd.to_path_buf(),
             AskForApproval::from(self.config.permissions.approval_policy.value()),
-            permission_profile,
+            active_permission_profile,
             effective_mode.model().to_string(),
             effective_mode.reasoning_effort(),
             /*summary*/ None,
diff --git a/codex-rs/tui/src/chatwidget/interaction.rs b/codex-rs/tui/src/chatwidget/interaction.rs
new file mode 100644
index 0000000000..0819bd6c03
--- /dev/null
+++ b/codex-rs/tui/src/chatwidget/interaction.rs
@@ -0,0 +1,477 @@
+//! Key routing and composer-adjacent UI interaction for `ChatWidget`.
+
+use super::*;
+
+impl ChatWidget {
+    pub(crate) fn handle_key_event(&mut self, key_event: KeyEvent) {
+        if self.bottom_pane.has_active_view()
+            && !matches!(
+                key_event,
+                KeyEvent {
+                    code: KeyCode::Char(c),
+                    modifiers,
+                    kind: KeyEventKind::Press,
+                    ..
+                } if modifiers.contains(KeyModifiers::CONTROL) && c.eq_ignore_ascii_case(&'c')
+            )
+            && !key_hint::ctrl(KeyCode::Char('r')).is_press(key_event)
+            && !key_hint::ctrl(KeyCode::Char('u')).is_press(key_event)
+        {
+            self.bottom_pane.handle_key_event(key_event);
+            if self.bottom_pane.no_modal_or_popup_active() {
+                self.maybe_send_next_queued_input();
+            }
+            return;
+        }
+
+        if self.handle_reasoning_shortcut(key_event) {
+            self.bottom_pane.clear_quit_shortcut_hint();
+            self.quit_shortcut_expires_at = None;
+            self.quit_shortcut_key = None;
+            return;
+        }
+
+        if key_event.kind == KeyEventKind::Press
+            && self.copy_last_response_binding.is_pressed(key_event)
+        {
+            self.bottom_pane.clear_quit_shortcut_hint();
+            self.quit_shortcut_expires_at = None;
+            self.quit_shortcut_key = None;
+            self.copy_last_agent_markdown();
+            return;
+        }
+
+        match key_event {
+            KeyEvent {
+                code: KeyCode::Char(c),
+                modifiers,
+                kind: KeyEventKind::Press,
+                ..
+            } if modifiers.contains(KeyModifiers::CONTROL) && c.eq_ignore_ascii_case(&'c') => {
+                self.on_ctrl_c();
+                return;
+            }
+            KeyEvent {
+                code: KeyCode::Char(c),
+                modifiers,
+                kind: KeyEventKind::Press,
+                ..
+            } if modifiers.contains(KeyModifiers::CONTROL) && c.eq_ignore_ascii_case(&'d') => {
+                if self.on_ctrl_d() {
+                    return;
+                }
+                self.bottom_pane.clear_quit_shortcut_hint();
+                self.quit_shortcut_expires_at = None;
+                self.quit_shortcut_key = None;
+            }
+            KeyEvent {
+                code: KeyCode::Char(c),
+                modifiers,
+                kind: KeyEventKind::Press,
+                ..
+            } if modifiers.intersects(KeyModifiers::CONTROL | KeyModifiers::ALT)
+                && c.eq_ignore_ascii_case(&'v') =>
+            {
+                match paste_image_to_temp_png() {
+                    Ok((path, info)) => {
+                        tracing::debug!(
+                            "pasted image size={}x{} format={}",
+                            info.width,
+                            info.height,
+                            info.encoded_format.label()
+                        );
+                        self.attach_image(path);
+                    }
+                    Err(err) => {
+                        tracing::warn!("failed to paste image: {err}");
+                        self.add_to_history(history_cell::new_error_event(format!(
+                            "Failed to paste image: {err}",
+                        )));
+                    }
+                }
+                return;
+            }
+            other if other.kind == KeyEventKind::Press => {
+                self.bottom_pane.clear_quit_shortcut_hint();
+                self.quit_shortcut_expires_at = None;
+                self.quit_shortcut_key = None;
+            }
+            _ => {}
+        }
+
+        if key_event.kind == KeyEventKind::Press
+            && self.chat_keymap.edit_queued_message.is_pressed(key_event)
+            && self.has_queued_follow_up_messages()
+            && self.bottom_pane.no_modal_or_popup_active()
+        {
+            if let Some(user_message) = self.pop_latest_queued_user_message() {
+                self.restore_user_message_to_composer(user_message);
+                self.refresh_pending_input_preview();
+                self.request_redraw();
+            }
+            return;
+        }
+
+        if matches!(key_event.code, KeyCode::Esc)
+            && matches!(key_event.kind, KeyEventKind::Press | KeyEventKind::Repeat)
+            && !self.input_queue.pending_steers.is_empty()
+            && self.bottom_pane.is_task_running()
+            && self.bottom_pane.no_modal_or_popup_active()
+            && !self.should_handle_vim_insert_escape(key_event)
+        {
+            self.input_queue.submit_pending_steers_after_interrupt = true;
+            if !self.submit_op(AppCommand::interrupt()) {
+                self.input_queue.submit_pending_steers_after_interrupt = false;
+            }
+            return;
+        }
+
+        if matches!(key_event.code, KeyCode::Esc)
+            && key_event.kind == KeyEventKind::Press
+            && self.should_show_plan_mode_nudge()
+        {
+            self.dismiss_plan_mode_nudge();
+            return;
+        }
+
+        if self.handle_plugins_popup_key_event(key_event) {
+            return;
+        }
+
+        match key_event {
+            KeyEvent {
+                code: KeyCode::BackTab,
+                kind: KeyEventKind::Press,
+                ..
+            } if self.collaboration_modes_enabled()
+                && !self.bottom_pane.is_task_running()
+                && self.bottom_pane.no_modal_or_popup_active() =>
+            {
+                self.cycle_collaboration_mode();
+                self.refresh_plan_mode_nudge();
+            }
+            _ => {
+                let had_modal_or_popup = !self.bottom_pane.no_modal_or_popup_active();
+                let input_result = self.bottom_pane.handle_key_event(key_event);
+                self.handle_composer_input_result(input_result, had_modal_or_popup);
+            }
+        }
+    }
+
+    /// Attach a local image to the composer when the active model supports image inputs.
+    ///
+    /// When the model does not advertise image support, we keep the draft unchanged and surface a
+    /// warning event so users can switch models or remove attachments.
+    pub(crate) fn attach_image(&mut self, path: PathBuf) {
+        if !self.current_model_supports_images() {
+            self.add_to_history(history_cell::new_warning_event(
+                self.image_inputs_not_supported_message(),
+            ));
+            self.request_redraw();
+            return;
+        }
+        tracing::info!("attach_image path={path:?}");
+        self.bottom_pane.attach_image(path);
+        self.request_redraw();
+    }
+
+    pub(crate) fn composer_text_with_pending(&self) -> String {
+        self.bottom_pane.composer_text_with_pending()
+    }
+
+    pub(crate) fn apply_external_edit(&mut self, text: String) {
+        self.bottom_pane.apply_external_edit(text);
+        self.refresh_plan_mode_nudge();
+        self.request_redraw();
+    }
+
+    pub(crate) fn external_editor_state(&self) -> ExternalEditorState {
+        self.external_editor_state
+    }
+
+    pub(crate) fn set_external_editor_state(&mut self, state: ExternalEditorState) {
+        self.external_editor_state = state;
+    }
+
+    pub(crate) fn set_footer_hint_override(&mut self, items: Option<Vec<(String, String)>>) {
+        self.bottom_pane.set_footer_hint_override(items);
+    }
+
+    pub(crate) fn show_selection_view(&mut self, params: SelectionViewParams) {
+        self.bottom_pane.show_selection_view(params);
+        self.refresh_plan_mode_nudge();
+        self.request_redraw();
+    }
+
+    pub(crate) fn no_modal_or_popup_active(&self) -> bool {
+        self.bottom_pane.no_modal_or_popup_active()
+    }
+
+    pub(crate) fn can_launch_external_editor(&self) -> bool {
+        self.bottom_pane.can_launch_external_editor()
+    }
+
+    pub(crate) fn can_run_ctrl_l_clear_now(&mut self) -> bool {
+        // Ctrl+L is not a slash command, but it follows /clear's current rule:
+        // block while a task is running.
+        if !self.bottom_pane.is_task_running() {
+            return true;
+        }
+
+        let message = "Ctrl+L is disabled while a task is in progress.".to_string();
+        self.add_to_history(history_cell::new_error_event(message));
+        self.request_redraw();
+        false
+    }
+
+    /// Copy the last agent response (raw markdown) to the system clipboard.
+    pub(crate) fn copy_last_agent_markdown(&mut self) {
+        self.copy_last_agent_markdown_with(crate::clipboard_copy::copy_to_clipboard);
+    }
+
+    pub(crate) fn truncate_agent_copy_history_to_user_turn_count(
+        &mut self,
+        user_turn_count: usize,
+    ) {
+        self.transcript
+            .truncate_copy_history_to_user_turn_count(user_turn_count);
+    }
+
+    /// Inner implementation with an injectable clipboard backend for testing.
+    pub(super) fn copy_last_agent_markdown_with(
+        &mut self,
+        copy_fn: impl FnOnce(&str) -> Result<Option<crate::clipboard_copy::ClipboardLease>, String>,
+    ) {
+        match self.transcript.last_agent_markdown.clone() {
+            Some(markdown) if !markdown.is_empty() => match copy_fn(&markdown) {
+                Ok(lease) => {
+                    self.clipboard_lease = lease;
+                    self.add_to_history(history_cell::new_info_event(
+                        "Copied last message to clipboard".into(),
+                        /*hint*/ None,
+                    ));
+                }
+                Err(error) => self.add_to_history(history_cell::new_error_event(format!(
+                    "Copy failed: {error}"
+                ))),
+            },
+            _ if self.transcript.copy_history_evicted_by_rollback => {
+                self.add_to_history(history_cell::new_error_event(format!(
+                    "Cannot copy that response after rewinding. Only the most recent {MAX_AGENT_COPY_HISTORY} responses are available to /copy."
+                )));
+            }
+            _ => self.add_to_history(history_cell::new_error_event(
+                "No agent response to copy".into(),
+            )),
+        }
+        self.request_redraw();
+    }
+
+    #[cfg(test)]
+    pub(crate) fn last_agent_markdown_text(&self) -> Option<&str> {
+        self.transcript.last_agent_markdown.as_deref()
+    }
+
+    pub(super) fn show_rename_prompt(&mut self) {
+        if !self.ensure_thread_rename_allowed() {
+            return;
+        }
+        let tx = self.app_event_tx.clone();
+        let existing_name = self.thread_name.as_deref().filter(|name| !name.is_empty());
+        let title = if existing_name.is_some() {
+            "Rename thread"
+        } else {
+            "Name thread"
+        };
+        let view = CustomPromptView::new(
+            title.to_string(),
+            "Type a name and press Enter".to_string(),
+            /*initial_text*/ existing_name.unwrap_or_default().to_string(),
+            /*context_label*/ None,
+            Box::new(move |name: String| {
+                let Some(name) = crate::legacy_core::util::normalize_thread_name(&name) else {
+                    tx.send(AppEvent::InsertHistoryCell(Box::new(
+                        history_cell::new_error_event("Thread name cannot be empty.".to_string()),
+                    )));
+                    return;
+                };
+                tx.set_thread_name(name);
+            }),
+        );
+
+        self.bottom_pane.show_view(Box::new(view));
+    }
+
+    pub(super) fn ensure_thread_rename_allowed(&mut self) -> bool {
+        match self.thread_rename_block_message.clone() {
+            Some(message) => {
+                self.add_error_message(message);
+                false
+            }
+            None => true,
+        }
+    }
+
+    pub(crate) fn handle_paste(&mut self, text: String) {
+        self.bottom_pane.handle_paste(text);
+        self.refresh_plan_mode_nudge();
+    }
+
+    // Returns true if caller should skip rendering this frame (a future frame is scheduled).
+    pub(crate) fn handle_paste_burst_tick(&mut self, frame_requester: FrameRequester) -> bool {
+        if self.bottom_pane.flush_paste_burst_if_due() {
+            self.refresh_plan_mode_nudge();
+            // A paste just flushed; request an immediate redraw and skip this frame.
+            self.request_redraw();
+            true
+        } else if self.bottom_pane.is_in_paste_burst() {
+            // While capturing a burst, schedule a follow-up tick and skip this frame
+            // to avoid redundant renders between ticks.
+            frame_requester.schedule_frame_in(
+                crate::bottom_pane::ChatComposer::recommended_paste_flush_delay(),
+            );
+            true
+        } else {
+            false
+        }
+    }
+
+    /// Handles a Ctrl+C press at the chat-widget layer.
+    ///
+    /// The first press arms a time-bounded quit shortcut and shows a footer hint via the bottom
+    /// pane. If cancellable work is active, Ctrl+C also submits `Op::Interrupt` after the shortcut
+    /// is armed.
+    ///
+    /// Active realtime conversations take precedence over bottom-pane Ctrl+C handling so the
+    /// first press always stops live voice, even when the composer contains the recording meter.
+    ///
+    /// When the double-press quit shortcut is enabled, pressing the same shortcut again before
+    /// expiry requests a shutdown-first quit.
+    fn on_ctrl_c(&mut self) {
+        let key = key_hint::ctrl(KeyCode::Char('c'));
+        if self.realtime_conversation.is_live() {
+            self.bottom_pane.clear_quit_shortcut_hint();
+            self.quit_shortcut_expires_at = None;
+            self.quit_shortcut_key = None;
+            self.stop_realtime_conversation_from_ui();
+            return;
+        }
+        let modal_or_popup_active = !self.bottom_pane.no_modal_or_popup_active();
+        if self.bottom_pane.on_ctrl_c() == CancellationEvent::Handled {
+            if DOUBLE_PRESS_QUIT_SHORTCUT_ENABLED {
+                if modal_or_popup_active {
+                    self.quit_shortcut_expires_at = None;
+                    self.quit_shortcut_key = None;
+                    self.bottom_pane.clear_quit_shortcut_hint();
+                } else {
+                    self.arm_quit_shortcut(key);
+                }
+            }
+            return;
+        }
+
+        if !DOUBLE_PRESS_QUIT_SHORTCUT_ENABLED {
+            if self.is_cancellable_work_active() {
+                self.quit_shortcut_expires_at = None;
+                self.quit_shortcut_key = None;
+                self.bottom_pane.clear_quit_shortcut_hint();
+                self.pause_active_goal_for_interrupt();
+                self.submit_op(AppCommand::interrupt());
+            } else {
+                self.request_quit_without_confirmation();
+            }
+            return;
+        }
+
+        if self.quit_shortcut_active_for(key) {
+            self.quit_shortcut_expires_at = None;
+            self.quit_shortcut_key = None;
+            self.request_quit_without_confirmation();
+            return;
+        }
+
+        self.arm_quit_shortcut(key);
+
+        if self.is_cancellable_work_active() {
+            self.pause_active_goal_for_interrupt();
+            self.submit_op(AppCommand::interrupt());
+        }
+    }
+
+    /// Handles a Ctrl+D press at the chat-widget layer.
+    ///
+    /// Ctrl-D only participates in quit when the composer is empty and no modal/popup is active.
+    /// Otherwise it should be routed to the active view and not attempt to quit.
+    fn on_ctrl_d(&mut self) -> bool {
+        let key = key_hint::ctrl(KeyCode::Char('d'));
+        if !DOUBLE_PRESS_QUIT_SHORTCUT_ENABLED {
+            if !self.bottom_pane.composer_is_empty() || !self.bottom_pane.no_modal_or_popup_active()
+            {
+                return false;
+            }
+
+            self.request_quit_without_confirmation();
+            return true;
+        }
+
+        if self.quit_shortcut_active_for(key) {
+            self.quit_shortcut_expires_at = None;
+            self.quit_shortcut_key = None;
+            self.request_quit_without_confirmation();
+            return true;
+        }
+
+        if !self.bottom_pane.composer_is_empty() || !self.bottom_pane.no_modal_or_popup_active() {
+            return false;
+        }
+
+        self.arm_quit_shortcut(key);
+        true
+    }
+
+    /// True if `key` matches the armed quit shortcut and the window has not expired.
+    fn quit_shortcut_active_for(&self, key: KeyBinding) -> bool {
+        self.quit_shortcut_key == Some(key)
+            && self
+                .quit_shortcut_expires_at
+                .is_some_and(|expires_at| Instant::now() < expires_at)
+    }
+
+    /// Arm the double-press quit shortcut and show the footer hint.
+    ///
+    /// This keeps the state machine (`quit_shortcut_*`) in `ChatWidget`, since
+    /// it is the component that interprets Ctrl+C vs Ctrl+D and decides whether
+    /// quitting is currently allowed, while delegating rendering to `BottomPane`.
+    pub(super) fn arm_quit_shortcut(&mut self, key: KeyBinding) {
+        self.quit_shortcut_expires_at = Instant::now()
+            .checked_add(QUIT_SHORTCUT_TIMEOUT)
+            .or_else(|| Some(Instant::now()));
+        self.quit_shortcut_key = Some(key);
+        self.bottom_pane.show_quit_shortcut_hint(key);
+    }
+
+    // Review mode counts as cancellable work so Ctrl+C interrupts instead of quitting.
+    fn is_cancellable_work_active(&self) -> bool {
+        self.bottom_pane.is_task_running() || self.review.is_review_mode
+    }
+
+    fn pause_active_goal_for_interrupt(&self) {
+        if !self.turn_lifecycle.agent_turn_running {
+            return;
+        }
+        if !self
+            .current_goal_status
+            .as_ref()
+            .is_some_and(GoalStatusState::is_active)
+        {
+            return;
+        }
+        let Some(thread_id) = self.thread_id else {
+            return;
+        };
+        self.app_event_tx.send(AppEvent::SetThreadGoalStatus {
+            thread_id,
+            status: AppThreadGoalStatus::Paused,
+        });
+    }
+}
diff --git a/codex-rs/tui/src/chatwidget/mcp_startup.rs b/codex-rs/tui/src/chatwidget/mcp_startup.rs
index cf499a455b..05d3def329 100644
--- a/codex-rs/tui/src/chatwidget/mcp_startup.rs
+++ b/codex-rs/tui/src/chatwidget/mcp_startup.rs
@@ -11,6 +11,9 @@ use codex_app_server_protocol::McpServerStatusUpdatedNotification;
 
 use super::ChatWidget;
 
+const MCP_STARTUP_SINGLE_HEADER_PREFIX: &str = "Booting MCP server:";
+const MCP_STARTUP_MULTI_HEADER_PREFIX: &str = "Starting MCP servers";
+
 #[derive(Debug, Clone)]
 pub(crate) enum McpStartupStatus {
     Starting,
@@ -153,11 +156,11 @@ impl ChatWidget {
                 }
                 let header = if total > 1 {
                     format!(
-                        "Starting MCP servers ({completed}/{total}): {}",
+                        "{MCP_STARTUP_MULTI_HEADER_PREFIX} ({completed}/{total}): {}",
                         to_show.join(", ")
                     )
                 } else {
-                    format!("Booting MCP server: {first}")
+                    format!("{MCP_STARTUP_SINGLE_HEADER_PREFIX} {first}")
                 };
                 self.set_status_header(header);
             }
@@ -187,12 +190,16 @@ impl ChatWidget {
             self.on_warning(format!("MCP startup incomplete ({})", parts.join("; ")));
         }
 
+        let mcp_startup_owned_status = self.status_header_is_mcp_startup_owned();
         self.mcp_startup_status = None;
         self.mcp_startup_ignore_updates_until_next_start = true;
         self.mcp_startup_allow_terminal_only_next_round = false;
         self.mcp_startup_pending_next_round.clear();
         self.mcp_startup_pending_next_round_saw_starting = false;
         self.update_task_running_state();
+        if self.bottom_pane.is_task_running() && mcp_startup_owned_status {
+            self.restore_reasoning_status_header();
+        }
         self.maybe_send_next_queued_input();
         self.request_redraw();
     }
@@ -234,6 +241,18 @@ impl ChatWidget {
         self.finish_mcp_startup(failed, cancelled);
     }
 
+    pub(super) fn status_header_is_mcp_startup_owned(&self) -> bool {
+        self.status_state
+            .current_status
+            .header
+            .starts_with(MCP_STARTUP_SINGLE_HEADER_PREFIX)
+            || self
+                .status_state
+                .current_status
+                .header
+                .starts_with(MCP_STARTUP_MULTI_HEADER_PREFIX)
+    }
+
     pub(super) fn on_mcp_server_status_updated(
         &mut self,
         notification: McpServerStatusUpdatedNotification,
diff --git a/codex-rs/tui/src/chatwidget/model_popups.rs b/codex-rs/tui/src/chatwidget/model_popups.rs
new file mode 100644
index 0000000000..2c0d5aba95
--- /dev/null
+++ b/codex-rs/tui/src/chatwidget/model_popups.rs
@@ -0,0 +1,538 @@
+//! Model, collaboration, and reasoning popups for `ChatWidget`.
+//!
+//! These surfaces are tightly related because changing one often redirects
+//! into another, especially while Plan mode is active.
+
+use super::*;
+
+impl ChatWidget {
+    /// Open a popup to choose a quick auto model. Selecting "All models"
+    /// opens the full picker with every available preset.
+    pub(crate) fn open_model_popup(&mut self) {
+        if !self.is_session_configured() {
+            self.add_info_message(
+                "Model selection is disabled until startup completes.".to_string(),
+                /*hint*/ None,
+            );
+            return;
+        }
+
+        let presets: Vec<ModelPreset> = match self.model_catalog.try_list_models() {
+            Ok(models) => models,
+            Err(_) => {
+                self.add_info_message(
+                    "Models are being updated; please try /model again in a moment.".to_string(),
+                    /*hint*/ None,
+                );
+                return;
+            }
+        };
+        self.open_model_popup_with_presets(presets);
+    }
+
+    fn model_menu_header(&self, title: &str, subtitle: &str) -> Box<dyn Renderable> {
+        let title = title.to_string();
+        let subtitle = subtitle.to_string();
+        let mut header = ColumnRenderable::new();
+        header.push(Line::from(title.bold()));
+        header.push(Line::from(subtitle.dim()));
+        if let Some(warning) = self.model_menu_warning_line() {
+            header.push(warning);
+        }
+        Box::new(header)
+    }
+
+    fn model_menu_warning_line(&self) -> Option<Line<'static>> {
+        let base_url = self.custom_openai_base_url()?;
+        let warning = format!(
+            "Warning: OpenAI base URL is overridden to {base_url}. Selecting models may not be supported or work properly."
+        );
+        Some(Line::from(warning.red()))
+    }
+
+    fn custom_openai_base_url(&self) -> Option<String> {
+        if !self.config.model_provider.is_openai() {
+            return None;
+        }
+
+        let base_url = self.config.model_provider.base_url.as_ref()?;
+        let trimmed = base_url.trim();
+        if trimmed.is_empty() {
+            return None;
+        }
+
+        let normalized = trimmed.trim_end_matches('/');
+        if normalized == DEFAULT_OPENAI_BASE_URL {
+            return None;
+        }
+
+        Some(trimmed.to_string())
+    }
+
+    pub(crate) fn open_model_popup_with_presets(&mut self, presets: Vec<ModelPreset>) {
+        let presets: Vec<ModelPreset> = presets
+            .into_iter()
+            .filter(|preset| preset.show_in_picker)
+            .collect();
+
+        let current_model = self.current_model();
+        let current_label = presets
+            .iter()
+            .find(|preset| preset.model.as_str() == current_model)
+            .map(|preset| preset.model.to_string())
+            .unwrap_or_else(|| self.model_display_name().to_string());
+
+        let (mut auto_presets, other_presets): (Vec<ModelPreset>, Vec<ModelPreset>) = presets
+            .into_iter()
+            .partition(|preset| Self::is_auto_model(&preset.model));
+
+        if auto_presets.is_empty() {
+            self.open_all_models_popup(other_presets);
+            return;
+        }
+
+        auto_presets.sort_by_key(|preset| Self::auto_model_order(&preset.model));
+        let mut items: Vec<SelectionItem> = auto_presets
+            .into_iter()
+            .map(|preset| {
+                let description =
+                    (!preset.description.is_empty()).then_some(preset.description.clone());
+                let model = preset.model.clone();
+                let should_prompt_plan_mode_scope = self.should_prompt_plan_mode_reasoning_scope(
+                    model.as_str(),
+                    Some(preset.default_reasoning_effort),
+                );
+                let actions = Self::model_selection_actions(
+                    model.clone(),
+                    Some(preset.default_reasoning_effort),
+                    should_prompt_plan_mode_scope,
+                );
+                SelectionItem {
+                    name: model.clone(),
+                    description,
+                    is_current: model.as_str() == current_model,
+                    is_default: preset.is_default,
+                    actions,
+                    dismiss_on_select: true,
+                    ..Default::default()
+                }
+            })
+            .collect();
+
+        if !other_presets.is_empty() {
+            let all_models = other_presets;
+            let actions: Vec<SelectionAction> = vec![Box::new(move |tx| {
+                tx.send(AppEvent::OpenAllModelsPopup {
+                    models: all_models.clone(),
+                });
+            })];
+
+            let is_current = !items.iter().any(|item| item.is_current);
+            let description = Some(format!(
+                "Choose a specific model and reasoning level (current: {current_label})"
+            ));
+
+            items.push(SelectionItem {
+                name: "All models".to_string(),
+                description,
+                is_current,
+                actions,
+                dismiss_on_select: true,
+                ..Default::default()
+            });
+        }
+
+        let header = self.model_menu_header(
+            "Select Model",
+            "Pick a quick auto mode or browse all models.",
+        );
+        self.bottom_pane.show_selection_view(SelectionViewParams {
+            footer_hint: Some(standard_popup_hint_line()),
+            items,
+            header,
+            ..Default::default()
+        });
+    }
+
+    fn is_auto_model(model: &str) -> bool {
+        model.starts_with("codex-auto-")
+    }
+
+    fn auto_model_order(model: &str) -> usize {
+        match model {
+            "codex-auto-fast" => 0,
+            "codex-auto-balanced" => 1,
+            "codex-auto-thorough" => 2,
+            _ => 3,
+        }
+    }
+
+    pub(crate) fn open_all_models_popup(&mut self, presets: Vec<ModelPreset>) {
+        if presets.is_empty() {
+            self.add_info_message(
+                "No additional models are available right now.".to_string(),
+                /*hint*/ None,
+            );
+            return;
+        }
+
+        let mut items: Vec<SelectionItem> = Vec::new();
+        for preset in presets.into_iter() {
+            let description =
+                (!preset.description.is_empty()).then_some(preset.description.to_string());
+            let is_current = preset.model.as_str() == self.current_model();
+            let single_supported_effort = preset.supported_reasoning_efforts.len() == 1;
+            let preset_for_action = preset.clone();
+            let actions: Vec<SelectionAction> = vec![Box::new(move |tx| {
+                let preset_for_event = preset_for_action.clone();
+                tx.send(AppEvent::OpenReasoningPopup {
+                    model: preset_for_event,
+                });
+            })];
+            items.push(SelectionItem {
+                name: preset.model.clone(),
+                description,
+                is_current,
+                is_default: preset.is_default,
+                actions,
+                dismiss_on_select: single_supported_effort,
+                dismiss_parent_on_child_accept: !single_supported_effort,
+                ..Default::default()
+            });
+        }
+
+        let header = self.model_menu_header(
+            "Select Model and Effort",
+            "Access legacy models by running codex -m <model_name> or in your config.toml",
+        );
+        self.bottom_pane.show_selection_view(SelectionViewParams {
+            footer_hint: Some(self.bottom_pane.standard_popup_hint_line()),
+            items,
+            header,
+            ..Default::default()
+        });
+    }
+
+    fn model_selection_actions(
+        model_for_action: String,
+        effort_for_action: Option<ReasoningEffortConfig>,
+        should_prompt_plan_mode_scope: bool,
+    ) -> Vec<SelectionAction> {
+        vec![Box::new(move |tx| {
+            if should_prompt_plan_mode_scope {
+                tx.send(AppEvent::OpenPlanReasoningScopePrompt {
+                    model: model_for_action.clone(),
+                    effort: effort_for_action,
+                });
+                return;
+            }
+
+            tx.send(AppEvent::UpdateModel(model_for_action.clone()));
+            tx.send(AppEvent::UpdateReasoningEffort(effort_for_action));
+            tx.send(AppEvent::PersistModelSelection {
+                model: model_for_action.clone(),
+                effort: effort_for_action,
+            });
+        })]
+    }
+
+    fn should_prompt_plan_mode_reasoning_scope(
+        &self,
+        selected_model: &str,
+        selected_effort: Option<ReasoningEffortConfig>,
+    ) -> bool {
+        if !self.collaboration_modes_enabled()
+            || self.active_mode_kind() != ModeKind::Plan
+            || selected_model != self.current_model()
+        {
+            return false;
+        }
+
+        // Prompt whenever the selection is not a true no-op for both:
+        // 1) the active Plan-mode effective reasoning, and
+        // 2) the stored global defaults that would be updated by the fallback path.
+        selected_effort != self.effective_reasoning_effort()
+            || selected_model != self.current_collaboration_mode.model()
+            || selected_effort != self.current_collaboration_mode.reasoning_effort()
+    }
+
+    pub(crate) fn open_plan_reasoning_scope_prompt(
+        &mut self,
+        model: String,
+        effort: Option<ReasoningEffortConfig>,
+    ) {
+        let reasoning_phrase = match effort {
+            Some(ReasoningEffortConfig::None) => "no reasoning".to_string(),
+            Some(selected_effort) => {
+                format!(
+                    "{} reasoning",
+                    Self::reasoning_effort_label(selected_effort).to_lowercase()
+                )
+            }
+            None => "the selected reasoning".to_string(),
+        };
+        let plan_only_description = format!("Always use {reasoning_phrase} in Plan mode.");
+        let plan_reasoning_source = if let Some(plan_override) =
+            self.config.plan_mode_reasoning_effort
+        {
+            format!(
+                "user-chosen Plan override ({})",
+                Self::reasoning_effort_label(plan_override).to_lowercase()
+            )
+        } else if let Some(plan_mask) = collaboration_modes::plan_mask(self.model_catalog.as_ref())
+        {
+            match plan_mask.reasoning_effort.flatten() {
+                Some(plan_effort) => format!(
+                    "built-in Plan default ({})",
+                    Self::reasoning_effort_label(plan_effort).to_lowercase()
+                ),
+                None => "built-in Plan default (no reasoning)".to_string(),
+            }
+        } else {
+            "built-in Plan default".to_string()
+        };
+        let all_modes_description = format!(
+            "Set the global default reasoning level and the Plan mode override. This replaces the current {plan_reasoning_source}."
+        );
+        let subtitle = format!("Choose where to apply {reasoning_phrase}.");
+
+        let plan_only_actions: Vec<SelectionAction> = vec![Box::new({
+            let model = model.clone();
+            move |tx| {
+                tx.send(AppEvent::UpdateModel(model.clone()));
+                tx.send(AppEvent::UpdatePlanModeReasoningEffort(effort));
+                tx.send(AppEvent::PersistPlanModeReasoningEffort(effort));
+            }
+        })];
+        let all_modes_actions: Vec<SelectionAction> = vec![Box::new(move |tx| {
+            tx.send(AppEvent::UpdateModel(model.clone()));
+            tx.send(AppEvent::UpdateReasoningEffort(effort));
+            tx.send(AppEvent::UpdatePlanModeReasoningEffort(effort));
+            tx.send(AppEvent::PersistPlanModeReasoningEffort(effort));
+            tx.send(AppEvent::PersistModelSelection {
+                model: model.clone(),
+                effort,
+            });
+        })];
+
+        self.bottom_pane.show_selection_view(SelectionViewParams {
+            title: Some(PLAN_MODE_REASONING_SCOPE_TITLE.to_string()),
+            subtitle: Some(subtitle),
+            footer_hint: Some(standard_popup_hint_line()),
+            items: vec![
+                SelectionItem {
+                    name: PLAN_MODE_REASONING_SCOPE_PLAN_ONLY.to_string(),
+                    description: Some(plan_only_description),
+                    actions: plan_only_actions,
+                    dismiss_on_select: true,
+                    ..Default::default()
+                },
+                SelectionItem {
+                    name: PLAN_MODE_REASONING_SCOPE_ALL_MODES.to_string(),
+                    description: Some(all_modes_description),
+                    actions: all_modes_actions,
+                    dismiss_on_select: true,
+                    ..Default::default()
+                },
+            ],
+            ..Default::default()
+        });
+        self.notify(Notification::PlanModePrompt {
+            title: PLAN_MODE_REASONING_SCOPE_TITLE.to_string(),
+        });
+    }
+
+    /// Open a popup to choose the reasoning effort (stage 2) for the given model.
+    pub(crate) fn open_reasoning_popup(&mut self, preset: ModelPreset) {
+        let default_effort: ReasoningEffortConfig = preset.default_reasoning_effort;
+        let supported = preset.supported_reasoning_efforts;
+        let in_plan_mode =
+            self.collaboration_modes_enabled() && self.active_mode_kind() == ModeKind::Plan;
+
+        let warn_effort = if supported
+            .iter()
+            .any(|option| option.effort == ReasoningEffortConfig::XHigh)
+        {
+            Some(ReasoningEffortConfig::XHigh)
+        } else if supported
+            .iter()
+            .any(|option| option.effort == ReasoningEffortConfig::High)
+        {
+            Some(ReasoningEffortConfig::High)
+        } else {
+            None
+        };
+        let warning_text = warn_effort.map(|effort| {
+            let effort_label = Self::reasoning_effort_label(effort);
+            format!("⚠ {effort_label} reasoning effort can quickly consume Plus plan rate limits.")
+        });
+        let warn_for_model = preset.model.starts_with("gpt-5.1-codex")
+            || preset.model.starts_with("gpt-5.1-codex-max")
+            || preset.model.starts_with("gpt-5.2");
+
+        struct EffortChoice {
+            stored: Option<ReasoningEffortConfig>,
+            display: ReasoningEffortConfig,
+        }
+        let mut choices: Vec<EffortChoice> = Vec::new();
+        for effort in ReasoningEffortConfig::iter() {
+            if supported.iter().any(|option| option.effort == effort) {
+                choices.push(EffortChoice {
+                    stored: Some(effort),
+                    display: effort,
+                });
+            }
+        }
+        if choices.is_empty() {
+            choices.push(EffortChoice {
+                stored: Some(default_effort),
+                display: default_effort,
+            });
+        }
+
+        if choices.len() == 1 {
+            let selected_effort = choices.first().and_then(|c| c.stored);
+            let selected_model = preset.model;
+            if self.should_prompt_plan_mode_reasoning_scope(&selected_model, selected_effort) {
+                self.app_event_tx
+                    .send(AppEvent::OpenPlanReasoningScopePrompt {
+                        model: selected_model,
+                        effort: selected_effort,
+                    });
+            } else {
+                self.apply_model_and_effort(selected_model, selected_effort);
+            }
+            return;
+        }
+
+        let default_choice: Option<ReasoningEffortConfig> = choices
+            .iter()
+            .any(|choice| choice.stored == Some(default_effort))
+            .then_some(Some(default_effort))
+            .flatten()
+            .or_else(|| choices.iter().find_map(|choice| choice.stored))
+            .or(Some(default_effort));
+
+        let model_slug = preset.model.to_string();
+        let is_current_model = self.current_model() == preset.model.as_str();
+        let highlight_choice = if is_current_model {
+            if in_plan_mode {
+                self.config
+                    .plan_mode_reasoning_effort
+                    .or(self.effective_reasoning_effort())
+            } else {
+                self.effective_reasoning_effort()
+            }
+        } else {
+            default_choice
+        };
+        let selection_choice = highlight_choice.or(default_choice);
+        let initial_selected_idx = choices
+            .iter()
+            .position(|choice| choice.stored == selection_choice)
+            .or_else(|| {
+                selection_choice
+                    .and_then(|effort| choices.iter().position(|choice| choice.display == effort))
+            });
+        let mut items: Vec<SelectionItem> = Vec::new();
+        for choice in choices.iter() {
+            let effort = choice.display;
+            let mut effort_label = Self::reasoning_effort_label(effort).to_string();
+            if choice.stored == default_choice {
+                effort_label.push_str(" (default)");
+            }
+
+            let description = choice
+                .stored
+                .and_then(|effort| {
+                    supported
+                        .iter()
+                        .find(|option| option.effort == effort)
+                        .map(|option| option.description.to_string())
+                })
+                .filter(|text| !text.is_empty());
+
+            let show_warning = warn_for_model && warn_effort == Some(effort);
+            let selected_description = if show_warning {
+                warning_text.as_ref().map(|warning_message| {
+                    description.as_ref().map_or_else(
+                        || warning_message.clone(),
+                        |d| format!("{d}\n{warning_message}"),
+                    )
+                })
+            } else {
+                None
+            };
+
+            let model_for_action = model_slug.clone();
+            let choice_effort = choice.stored;
+            let should_prompt_plan_mode_scope =
+                self.should_prompt_plan_mode_reasoning_scope(model_slug.as_str(), choice_effort);
+            let actions: Vec<SelectionAction> = vec![Box::new(move |tx| {
+                if should_prompt_plan_mode_scope {
+                    tx.send(AppEvent::OpenPlanReasoningScopePrompt {
+                        model: model_for_action.clone(),
+                        effort: choice_effort,
+                    });
+                } else {
+                    tx.send(AppEvent::UpdateModel(model_for_action.clone()));
+                    tx.send(AppEvent::UpdateReasoningEffort(choice_effort));
+                    tx.send(AppEvent::PersistModelSelection {
+                        model: model_for_action.clone(),
+                        effort: choice_effort,
+                    });
+                }
+            })];
+
+            items.push(SelectionItem {
+                name: effort_label,
+                description,
+                selected_description,
+                is_current: is_current_model && choice.stored == highlight_choice,
+                actions,
+                dismiss_on_select: true,
+                ..Default::default()
+            });
+        }
+
+        let mut header = ColumnRenderable::new();
+        header.push(Line::from(
+            format!("Select Reasoning Level for {model_slug}").bold(),
+        ));
+
+        self.bottom_pane.show_selection_view(SelectionViewParams {
+            header: Box::new(header),
+            footer_hint: Some(standard_popup_hint_line()),
+            items,
+            initial_selected_idx,
+            ..Default::default()
+        });
+    }
+
+    pub(super) fn reasoning_effort_label(effort: ReasoningEffortConfig) -> &'static str {
+        match effort {
+            ReasoningEffortConfig::None => "None",
+            ReasoningEffortConfig::Minimal => "Minimal",
+            ReasoningEffortConfig::Low => "Low",
+            ReasoningEffortConfig::Medium => "Medium",
+            ReasoningEffortConfig::High => "High",
+            ReasoningEffortConfig::XHigh => "Extra high",
+        }
+    }
+
+    pub(super) fn apply_model_and_effort_without_persist(
+        &self,
+        model: String,
+        effort: Option<ReasoningEffortConfig>,
+    ) {
+        self.app_event_tx.send(AppEvent::UpdateModel(model));
+        self.app_event_tx
+            .send(AppEvent::UpdateReasoningEffort(effort));
+    }
+
+    fn apply_model_and_effort(&self, model: String, effort: Option<ReasoningEffortConfig>) {
+        self.apply_model_and_effort_without_persist(model.clone(), effort);
+        self.app_event_tx
+            .send(AppEvent::PersistModelSelection { model, effort });
+    }
+}
diff --git a/codex-rs/tui/src/chatwidget/notifications.rs b/codex-rs/tui/src/chatwidget/notifications.rs
new file mode 100644
index 0000000000..2084956b2c
--- /dev/null
+++ b/codex-rs/tui/src/chatwidget/notifications.rs
@@ -0,0 +1,128 @@
+//! Desktop notification coalescing for `ChatWidget`.
+
+use super::*;
+
+impl ChatWidget {
+    pub(super) fn notify(&mut self, notification: Notification) {
+        if !notification.allowed_for(&self.config.tui_notifications.notifications) {
+            return;
+        }
+        if let Some(existing) = self.pending_notification.as_ref()
+            && existing.priority() > notification.priority()
+        {
+            return;
+        }
+        self.pending_notification = Some(notification);
+        self.request_redraw();
+    }
+
+    pub(crate) fn maybe_post_pending_notification(&mut self, tui: &mut crate::tui::Tui) {
+        if let Some(notif) = self.pending_notification.take() {
+            tui.notify(notif.display());
+        }
+    }
+}
+
+#[derive(Debug)]
+pub(super) enum Notification {
+    AgentTurnComplete { response: String },
+    ExecApprovalRequested { command: String },
+    EditApprovalRequested { cwd: PathBuf, changes: Vec<PathBuf> },
+    ElicitationRequested { server_name: String },
+    PlanModePrompt { title: String },
+}
+
+impl Notification {
+    pub(super) fn display(&self) -> String {
+        match self {
+            Notification::AgentTurnComplete { response } => {
+                Notification::agent_turn_preview(response)
+                    .unwrap_or_else(|| "Agent turn complete".to_string())
+            }
+            Notification::ExecApprovalRequested { command } => {
+                format!(
+                    "Approval requested: {}",
+                    truncate_text(command, /*max_graphemes*/ 30)
+                )
+            }
+            Notification::EditApprovalRequested { cwd, changes } => {
+                format!(
+                    "Codex wants to edit {}",
+                    if changes.len() == 1 {
+                        #[allow(clippy::unwrap_used)]
+                        display_path_for(changes.first().unwrap(), cwd)
+                    } else {
+                        format!("{} files", changes.len())
+                    }
+                )
+            }
+            Notification::ElicitationRequested { server_name } => {
+                format!("Approval requested by {server_name}")
+            }
+            Notification::PlanModePrompt { title } => {
+                format!("Plan mode prompt: {title}")
+            }
+        }
+    }
+
+    fn type_name(&self) -> &str {
+        match self {
+            Notification::AgentTurnComplete { .. } => "agent-turn-complete",
+            Notification::ExecApprovalRequested { .. }
+            | Notification::EditApprovalRequested { .. }
+            | Notification::ElicitationRequested { .. } => "approval-requested",
+            Notification::PlanModePrompt { .. } => "plan-mode-prompt",
+        }
+    }
+
+    fn priority(&self) -> u8 {
+        match self {
+            Notification::AgentTurnComplete { .. } => 0,
+            Notification::ExecApprovalRequested { .. }
+            | Notification::EditApprovalRequested { .. }
+            | Notification::ElicitationRequested { .. }
+            | Notification::PlanModePrompt { .. } => 1,
+        }
+    }
+
+    pub(super) fn allowed_for(&self, settings: &Notifications) -> bool {
+        match settings {
+            Notifications::Enabled(enabled) => *enabled,
+            Notifications::Custom(allowed) => allowed.iter().any(|a| a == self.type_name()),
+        }
+    }
+
+    pub(super) fn agent_turn_preview(response: &str) -> Option<String> {
+        let mut normalized = String::new();
+        for part in response.split_whitespace() {
+            if !normalized.is_empty() {
+                normalized.push(' ');
+            }
+            normalized.push_str(part);
+        }
+        let trimmed = normalized.trim();
+        if trimmed.is_empty() {
+            None
+        } else {
+            Some(truncate_text(trimmed, AGENT_NOTIFICATION_PREVIEW_GRAPHEMES))
+        }
+    }
+
+    pub(super) fn user_input_request_summary(
+        questions: &[codex_app_server_protocol::ToolRequestUserInputQuestion],
+    ) -> Option<String> {
+        let first_question = questions.first()?;
+        let summary = if first_question.header.trim().is_empty() {
+            first_question.question.trim()
+        } else {
+            first_question.header.trim()
+        };
+        if summary.is_empty() {
+            None
+        } else {
+            Some(truncate_text(summary, /*max_graphemes*/ 30))
+        }
+    }
+}
+
+const AGENT_NOTIFICATION_PREVIEW_GRAPHEMES: usize = 200;
diff --git a/codex-rs/tui/src/chatwidget/permission_popups.rs b/codex-rs/tui/src/chatwidget/permission_popups.rs
new file mode 100644
index 0000000000..a82f3a6cdb
--- /dev/null
+++ b/codex-rs/tui/src/chatwidget/permission_popups.rs
@@ -0,0 +1,463 @@
+//! Permission and approval popup flows for `ChatWidget`.
+//!
+//! This module owns the generic permission pickers and confirmation surfaces;
+//! Windows-specific sandbox prompting lives beside it in
+//! `windows_sandbox_prompts`.
+
+use super::*;
+
+impl ChatWidget {
+    /// Open the permissions popup.
+    pub(crate) fn open_approvals_popup(&mut self) {
+        self.open_permissions_popup();
+    }
+
+    /// Open a popup to choose the permissions mode.
+    pub(crate) fn open_permissions_popup(&mut self) {
+        let include_read_only = cfg!(target_os = "windows");
+        let current_approval =
+            AskForApproval::from(self.config.permissions.approval_policy.value());
+        let current_permission_profile = self.config.permissions.permission_profile().clone();
+        let guardian_approval_enabled = self.config.features.enabled(Feature::GuardianApproval);
+        let current_review_policy = self.config.approvals_reviewer;
+        let mut items: Vec<SelectionItem> = Vec::new();
+        let presets: Vec<ApprovalPreset> = builtin_approval_presets();
+
+        #[cfg(target_os = "windows")]
+        let windows_sandbox_level = WindowsSandboxLevel::from_config(&self.config);
+        #[cfg(target_os = "windows")]
+        let windows_degraded_sandbox_enabled =
+            matches!(windows_sandbox_level, WindowsSandboxLevel::RestrictedToken);
+        #[cfg(not(target_os = "windows"))]
+        let windows_degraded_sandbox_enabled = false;
+
+        let show_elevate_sandbox_hint =
+            crate::legacy_core::windows_sandbox::ELEVATED_SANDBOX_NUX_ENABLED
+                && windows_degraded_sandbox_enabled
+                && presets.iter().any(|preset| preset.id == "auto");
+
+        let guardian_disabled_reason = |enabled: bool| {
+            let mut next_features = self.config.features.get().clone();
+            next_features.set_enabled(Feature::GuardianApproval, enabled);
+            self.config
+                .features
+                .can_set(&next_features)
+                .err()
+                .map(|err| err.to_string())
+        };
+
+        for preset in presets.into_iter() {
+            if !include_read_only && preset.id == "read-only" {
+                continue;
+            }
+            let base_name = if preset.id == "auto" && windows_degraded_sandbox_enabled {
+                "Default (non-admin sandbox)".to_string()
+            } else {
+                preset.label.to_string()
+            };
+            let preset_approval = AskForApproval::from(preset.approval);
+            let base_description =
+                Some(preset.description.replace(" (Identical to Agent mode)", ""));
+            let approval_disabled_reason = match self
+                .config
+                .permissions
+                .approval_policy
+                .can_set(&preset.approval)
+            {
+                Ok(()) => None,
+                Err(err) => Some(err.to_string()),
+            };
+            let default_disabled_reason = approval_disabled_reason
+                .clone()
+                .or_else(|| guardian_disabled_reason(false));
+            let requires_confirmation = preset.id == "full-access"
+                && !self
+                    .config
+                    .notices
+                    .hide_full_access_warning
+                    .unwrap_or(false);
+            let default_actions: Vec<SelectionAction> = if requires_confirmation {
+                let preset_clone = preset.clone();
+                vec![Box::new(move |tx| {
+                    tx.send(AppEvent::OpenFullAccessConfirmation {
+                        preset: preset_clone.clone(),
+                        return_to_permissions: !include_read_only,
+                    });
+                })]
+            } else if preset.id == "auto" {
+                #[cfg(target_os = "windows")]
+                {
+                    if WindowsSandboxLevel::from_config(&self.config)
+                        == WindowsSandboxLevel::Disabled
+                    {
+                        let preset_clone = preset.clone();
+                        if crate::legacy_core::windows_sandbox::ELEVATED_SANDBOX_NUX_ENABLED
+                            && crate::legacy_core::windows_sandbox::sandbox_setup_is_complete(
+                                self.config.codex_home.as_path(),
+                            )
+                        {
+                            vec![Box::new(move |tx| {
+                                tx.send(AppEvent::EnableWindowsSandboxForAgentMode {
+                                    preset: preset_clone.clone(),
+                                    mode: WindowsSandboxEnableMode::Elevated,
+                                });
+                            })]
+                        } else {
+                            vec![Box::new(move |tx| {
+                                tx.send(AppEvent::OpenWindowsSandboxEnablePrompt {
+                                    preset: preset_clone.clone(),
+                                });
+                            })]
+                        }
+                    } else if let Some((sample_paths, extra_count, failed_scan)) =
+                        self.world_writable_warning_details()
+                    {
+                        let preset_clone = preset.clone();
+                        vec![Box::new(move |tx| {
+                            tx.send(AppEvent::OpenWorldWritableWarningConfirmation {
+                                preset: Some(preset_clone.clone()),
+                                sample_paths: sample_paths.clone(),
+                                extra_count,
+                                failed_scan,
+                            });
+                        })]
+                    } else {
+                        Self::approval_preset_actions(
+                            preset_approval,
+                            preset.active_permission_profile.clone(),
+                            base_name.clone(),
+                            ApprovalsReviewer::User,
+                        )
+                    }
+                }
+                #[cfg(not(target_os = "windows"))]
+                {
+                    Self::approval_preset_actions(
+                        preset_approval,
+                        preset.active_permission_profile.clone(),
+                        base_name.clone(),
+                        ApprovalsReviewer::User,
+                    )
+                }
+            } else {
+                Self::approval_preset_actions(
+                    preset_approval,
+                    preset.active_permission_profile.clone(),
+                    base_name.clone(),
+                    ApprovalsReviewer::User,
+                )
+            };
+            if preset.id == "auto" {
+                items.push(SelectionItem {
+                    name: base_name.clone(),
+                    description: base_description.clone(),
+                    is_current: current_review_policy == ApprovalsReviewer::User
+                        && Self::preset_matches_current(
+                            current_approval,
+                            &current_permission_profile,
+                            self.config.cwd.as_path(),
+                            &preset,
+                        ),
+                    actions: default_actions,
+                    dismiss_on_select: true,
+                    disabled_reason: default_disabled_reason,
+                    ..Default::default()
+                });
+
+                if guardian_approval_enabled {
+                    items.push(SelectionItem {
+                        name: "Auto-review".to_string(),
+                        description: Some(
+                            "Same workspace-write permissions as Default, but eligible `on-request` approvals are routed through the auto-reviewer subagent."
+                                .to_string(),
+                        ),
+                        is_current: current_review_policy == ApprovalsReviewer::AutoReview
+                            && Self::preset_matches_current(
+                                current_approval,
+                                &current_permission_profile,
+                                self.config.cwd.as_path(),
+                                &preset,
+                            ),
+                        actions: Self::approval_preset_actions(
+                            preset_approval,
+                            preset.active_permission_profile.clone(),
+                            "Auto-review".to_string(),
+                            ApprovalsReviewer::AutoReview,
+                        ),
+                        dismiss_on_select: true,
+                        disabled_reason: approval_disabled_reason
+                            .or_else(|| guardian_disabled_reason(true)),
+                        ..Default::default()
+                    });
+                }
+            } else {
+                items.push(SelectionItem {
+                    name: base_name,
+                    description: base_description,
+                    is_current: Self::preset_matches_current(
+                        current_approval,
+                        &current_permission_profile,
+                        self.config.cwd.as_path(),
+                        &preset,
+                    ),
+                    actions: default_actions,
+                    dismiss_on_select: true,
+                    disabled_reason: default_disabled_reason,
+                    ..Default::default()
+                });
+            }
+        }
+
+        let footer_note = show_elevate_sandbox_hint.then(|| {
+            vec![
+                "The non-admin sandbox protects your files and prevents network access under most circumstances. However, it carries greater risk if prompt injected. To upgrade to the default sandbox, run ".dim(),
+                "/setup-default-sandbox".cyan(),
+                ".".dim(),
+            ]
+            .into()
+        });
+
+        self.bottom_pane.show_selection_view(SelectionViewParams {
+            title: Some("Update Model Permissions".to_string()),
+            footer_note,
+            footer_hint: Some(standard_popup_hint_line()),
+            items,
+            header: Box::new(()),
+            ..Default::default()
+        });
+    }
+
+    pub(crate) fn open_auto_review_denials_popup(&mut self) {
+        if self.review.recent_auto_review_denials.is_empty() {
+            self.add_info_message(
+                "No recent auto-review denials in this thread.".to_string(),
+                Some("Denials are recorded after auto-review rejects an action.".to_string()),
+            );
+            return;
+        }
+        let Some(thread_id) = self.thread_id() else {
+            self.add_error_message("That thread is no longer available.".to_string());
+            return;
+        };
+
+        let mut items = vec![SelectionItem {
+            name: "Command".to_string(),
+            description: Some("Rationale".to_string()),
+            is_disabled: true,
+            search_value: Some(String::new()),
+            ..Default::default()
+        }];
+        items.extend(
+            self.review
+                .recent_auto_review_denials
+                .entries()
+                .map(|event| {
+                    let id = event.id.clone();
+                    let summary = auto_review_denials::action_summary(&event.action);
+                    let rationale = event
+                        .rationale
+                        .as_deref()
+                        .unwrap_or("Auto-review did not include a rationale.");
+                    SelectionItem {
+                        name: summary.clone(),
+                        description: Some(rationale.to_string()),
+                        selected_description: Some(rationale.to_string()),
+                        search_value: Some(format!("{summary} {rationale}")),
+                        actions: vec![Box::new(move |tx| {
+                            tx.send(AppEvent::ApproveRecentAutoReviewDenial {
+                                thread_id,
+                                id: id.clone(),
+                            });
+                        })],
+                        dismiss_on_select: true,
+                        ..Default::default()
+                    }
+                }),
+        );
+
+        self.bottom_pane.show_selection_view(SelectionViewParams {
+            title: Some("Auto-review Denials".to_string()),
+            subtitle: Some("Select a denied action to approve.".to_string()),
+            footer_hint: Some(standard_popup_hint_line()),
+            items,
+            is_searchable: true,
+            col_width_mode: ColumnWidthMode::AutoAllRows,
+            ..Default::default()
+        });
+        self.request_redraw();
+    }
+
+    pub(crate) fn approve_recent_auto_review_denial(&mut self, thread_id: ThreadId, id: String) {
+        let Some(event) = self.review.recent_auto_review_denials.take(&id) else {
+            self.add_error_message("That auto-review denial is no longer available.".to_string());
+            return;
+        };
+
+        self.app_event_tx.send(AppEvent::SubmitThreadOp {
+            thread_id,
+            op: AppCommand::approve_guardian_denied_action(event),
+        });
+        self.add_info_message(
+            "Approval recorded for one retry of the selected auto-review denial.".to_string(),
+            Some(
+                "The model will see the approval context; the retry still goes through auto-review."
+                    .to_string(),
+            ),
+        );
+    }
+
+    pub(super) fn approval_preset_actions(
+        approval: AskForApproval,
+        active_permission_profile: ActivePermissionProfile,
+        label: String,
+        approvals_reviewer: ApprovalsReviewer,
+    ) -> Vec<SelectionAction> {
+        vec![Box::new(move |tx| {
+            tx.send(AppEvent::CodexOp(AppCommand::override_turn_context(
+                /*cwd*/ None,
+                Some(approval),
+                Some(approvals_reviewer),
+                Some(active_permission_profile.clone()),
+                /*windows_sandbox_level*/ None,
+                /*model*/ None,
+                /*effort*/ None,
+                /*summary*/ None,
+                /*service_tier*/ None,
+                /*collaboration_mode*/ None,
+                /*personality*/ None,
+            )));
+            tx.send(AppEvent::UpdateAskForApprovalPolicy(approval));
+            tx.send(AppEvent::UpdateActivePermissionProfile(
+                active_permission_profile.clone(),
+            ));
+            tx.send(AppEvent::UpdateApprovalsReviewer(approvals_reviewer));
+            tx.send(AppEvent::InsertHistoryCell(Box::new(
+                history_cell::new_info_event(
+                    format!("Permissions updated to {label}"),
+                    /*hint*/ None,
+                ),
+            )));
+        })]
+    }
+
+    pub(super) fn preset_matches_current(
+        current_approval: AskForApproval,
+        current_permission_profile: &PermissionProfile,
+        cwd: &std::path::Path,
+        preset: &ApprovalPreset,
+    ) -> bool {
+        let preset_approval = AskForApproval::from(preset.approval);
+        if current_approval != preset_approval {
+            return false;
+        }
+
+        match preset.id {
+            "full-access" => matches!(current_permission_profile, PermissionProfile::Disabled),
+            "read-only" => {
+                let file_system_policy = current_permission_profile.file_system_sandbox_policy();
+                matches!(
+                    current_permission_profile,
+                    PermissionProfile::Managed { .. }
+                ) && !file_system_policy.has_full_disk_write_access()
+                    && file_system_policy
+                        .get_writable_roots_with_cwd(cwd)
+                        .is_empty()
+                    && current_permission_profile.network_sandbox_policy()
+                        == preset.permission_profile.network_sandbox_policy()
+            }
+            "auto" => {
+                let file_system_policy = current_permission_profile.file_system_sandbox_policy();
+                matches!(
+                    current_permission_profile,
+                    PermissionProfile::Managed { .. }
+                ) && file_system_policy.can_write_path_with_cwd(cwd, cwd)
+                    && !file_system_policy.has_full_disk_write_access()
+                    && current_permission_profile.network_sandbox_policy()
+                        == preset.permission_profile.network_sandbox_policy()
+            }
+            _ => current_permission_profile == &preset.permission_profile,
+        }
+    }
+
+    pub(crate) fn open_full_access_confirmation(
+        &mut self,
+        preset: ApprovalPreset,
+        return_to_permissions: bool,
+    ) {
+        let selected_name = preset.label.to_string();
+        let approval = AskForApproval::from(preset.approval);
+        let mut header_children: Vec<Box<dyn Renderable>> = Vec::new();
+        let title_line = Line::from("Enable full access?").bold();
+        let info_line = Line::from(vec![
+            "When Codex runs with full access, it can edit any file on your computer and run commands with network, without your approval. "
+                .into(),
+            "Exercise caution when enabling full access. This significantly increases the risk of data loss, leaks, or unexpected behavior."
+                .fg(Color::Red),
+        ]);
+        header_children.push(Box::new(title_line));
+        header_children.push(Box::new(
+            Paragraph::new(vec![info_line]).wrap(Wrap { trim: false }),
+        ));
+        let header = ColumnRenderable::with(header_children);
+
+        let mut accept_actions = Self::approval_preset_actions(
+            approval,
+            preset.active_permission_profile.clone(),
+            selected_name.clone(),
+            ApprovalsReviewer::User,
+        );
+        accept_actions.push(Box::new(|tx| {
+            tx.send(AppEvent::UpdateFullAccessWarningAcknowledged(true));
+        }));
+
+        let mut accept_and_remember_actions = Self::approval_preset_actions(
+            approval,
+            preset.active_permission_profile,
+            selected_name,
+            ApprovalsReviewer::User,
+        );
+        accept_and_remember_actions.push(Box::new(|tx| {
+            tx.send(AppEvent::UpdateFullAccessWarningAcknowledged(true));
+            tx.send(AppEvent::PersistFullAccessWarningAcknowledged);
+        }));
+
+        let deny_actions: Vec<SelectionAction> = vec![Box::new(move |tx| {
+            if return_to_permissions {
+                tx.send(AppEvent::OpenPermissionsPopup);
+            } else {
+                tx.send(AppEvent::OpenApprovalsPopup);
+            }
+        })];
+
+        let items = vec![
+            SelectionItem {
+                name: "Yes, continue anyway".to_string(),
+                description: Some("Apply full access for this session".to_string()),
+                actions: accept_actions,
+                dismiss_on_select: true,
+                ..Default::default()
+            },
+            SelectionItem {
+                name: "Yes, and don't ask again".to_string(),
+                description: Some("Enable full access and remember this choice".to_string()),
+                actions: accept_and_remember_actions,
+                dismiss_on_select: true,
+                ..Default::default()
+            },
+            SelectionItem {
+                name: "Cancel".to_string(),
+                description: Some("Go back without enabling full access".to_string()),
+                actions: deny_actions,
+                dismiss_on_select: true,
+                ..Default::default()
+            },
+        ];
+
+        self.bottom_pane.show_selection_view(SelectionViewParams {
+            footer_hint: Some(standard_popup_hint_line()),
+            items,
+            header: Box::new(header),
+            ..Default::default()
+        });
+    }
+}
diff --git a/codex-rs/tui/src/chatwidget/plugins.rs b/codex-rs/tui/src/chatwidget/plugins.rs
index 401f9217b6..746f42fce9 100644
--- a/codex-rs/tui/src/chatwidget/plugins.rs
+++ b/codex-rs/tui/src/chatwidget/plugins.rs
@@ -2023,10 +2023,11 @@ fn marketplace_display_name(marketplace: &PluginMarketplaceEntry) -> String {
 }
 
 fn marketplace_is_user_configured(config: &Config, marketplace_name: &str) -> bool {
-    config
-        .config_layer_stack
-        .get_user_layer()
-        .and_then(|user_layer| user_layer.config.get("marketplaces"))
+    let Some(user_config) = config.config_layer_stack.effective_user_config() else {
+        return false;
+    };
+    user_config
+        .get("marketplaces")
         .and_then(toml::Value::as_table)
         .is_some_and(|marketplaces| marketplaces.contains_key(marketplace_name))
 }
@@ -2034,7 +2035,7 @@ fn marketplace_is_user_configured(config: &Config, marketplace_name: &str) -> bo
 fn marketplace_is_user_configured_git(config: &Config, marketplace_name: &str) -> bool {
     config
         .config_layer_stack
-        .get_user_layer()
+        .get_active_user_layer()
         .and_then(|user_layer| user_layer.config.get("marketplaces"))
         .and_then(toml::Value::as_table)
         .and_then(|marketplaces| marketplaces.get(marketplace_name))
diff --git a/codex-rs/tui/src/chatwidget/rate_limits.rs b/codex-rs/tui/src/chatwidget/rate_limits.rs
index 8d5bd89aee..544611f4f0 100644
--- a/codex-rs/tui/src/chatwidget/rate_limits.rs
+++ b/codex-rs/tui/src/chatwidget/rate_limits.rs
@@ -1,11 +1,14 @@
-//! Rate-limit warning and prompt state for `ChatWidget`.
+//! Rate-limit warning, prompt, and notice surfaces for `ChatWidget`.
 
+use super::*;
 use codex_app_server_protocol::CodexErrorInfo as AppServerCodexErrorInfo;
 
 pub(super) const NUDGE_MODEL_SLUG: &str = "gpt-5.4-mini";
 pub(super) const RATE_LIMIT_SWITCH_PROMPT_THRESHOLD: f64 = 90.0;
 
 const RATE_LIMIT_WARNING_THRESHOLDS: [f64; 3] = [75.0, 90.0, 95.0];
+const PRIMARY_LIMIT_FALLBACK_LABEL: &str = "usage";
+const SECONDARY_LIMIT_FALLBACK_LABEL: &str = "secondary usage";
 
 #[derive(Default)]
 pub(super) struct RateLimitWarningState {
@@ -39,9 +42,8 @@ impl RateLimitWarningState {
                 self.secondary_index += 1;
             }
             if let Some(threshold) = highest_secondary {
-                let limit_label = secondary_window_minutes
-                    .map(get_limits_duration)
-                    .unwrap_or_else(|| "weekly".to_string());
+                let limit_label =
+                    limit_label_for_window(secondary_window_minutes, /*is_secondary*/ true);
                 let remaining_percent = 100.0 - threshold;
                 warnings.push(format!(
                     "Heads up, you have less than {remaining_percent:.0}% of your {limit_label} limit left. Run /status for a breakdown."
@@ -58,9 +60,8 @@ impl RateLimitWarningState {
                 self.primary_index += 1;
             }
             if let Some(threshold) = highest_primary {
-                let limit_label = primary_window_minutes
-                    .map(get_limits_duration)
-                    .unwrap_or_else(|| "5h".to_string());
+                let limit_label =
+                    limit_label_for_window(primary_window_minutes, /*is_secondary*/ false);
                 let remaining_percent = 100.0 - threshold;
                 warnings.push(format!(
                     "Heads up, you have less than {remaining_percent:.0}% of your {limit_label} limit left. Run /status for a breakdown."
@@ -72,28 +73,51 @@ impl RateLimitWarningState {
     }
 }
 
-pub(crate) fn get_limits_duration(windows_minutes: i64) -> String {
+pub(crate) fn limit_label_for_window(window_minutes: Option<i64>, is_secondary: bool) -> String {
+    window_minutes
+        .and_then(get_limits_duration)
+        .unwrap_or_else(|| fallback_limit_label(is_secondary).to_string())
+}
+
+pub(crate) fn get_limits_duration(windows_minutes: i64) -> Option<String> {
     const MINUTES_PER_HOUR: i64 = 60;
+    const MINUTES_PER_5_HOURS: i64 = 5 * MINUTES_PER_HOUR;
     const MINUTES_PER_DAY: i64 = 24 * MINUTES_PER_HOUR;
     const MINUTES_PER_WEEK: i64 = 7 * MINUTES_PER_DAY;
     const MINUTES_PER_MONTH: i64 = 30 * MINUTES_PER_DAY;
-    const ROUNDING_BIAS_MINUTES: i64 = 3;
+    const MINUTES_PER_YEAR: i64 = 365 * MINUTES_PER_DAY;
 
     let windows_minutes = windows_minutes.max(0);
 
-    if windows_minutes <= MINUTES_PER_DAY.saturating_add(ROUNDING_BIAS_MINUTES) {
-        let adjusted = windows_minutes.saturating_add(ROUNDING_BIAS_MINUTES);
-        let hours = std::cmp::max(1, adjusted / MINUTES_PER_HOUR);
-        format!("{hours}h")
-    } else if windows_minutes <= MINUTES_PER_WEEK.saturating_add(ROUNDING_BIAS_MINUTES) {
-        "weekly".to_string()
-    } else if windows_minutes <= MINUTES_PER_MONTH.saturating_add(ROUNDING_BIAS_MINUTES) {
-        "monthly".to_string()
+    if is_approximate_window(windows_minutes, MINUTES_PER_5_HOURS) {
+        Some("5h".to_string())
+    } else if is_approximate_window(windows_minutes, MINUTES_PER_DAY) {
+        Some("daily".to_string())
+    } else if is_approximate_window(windows_minutes, MINUTES_PER_WEEK) {
+        Some("weekly".to_string())
+    } else if is_approximate_window(windows_minutes, MINUTES_PER_MONTH) {
+        Some("monthly".to_string())
+    } else if is_approximate_window(windows_minutes, MINUTES_PER_YEAR) {
+        Some("annual".to_string())
     } else {
-        "annual".to_string()
+        None
     }
 }
 
+pub(crate) fn fallback_limit_label(is_secondary: bool) -> &'static str {
+    if is_secondary {
+        SECONDARY_LIMIT_FALLBACK_LABEL
+    } else {
+        PRIMARY_LIMIT_FALLBACK_LABEL
+    }
+}
+
+fn is_approximate_window(minutes: i64, expected_minutes: i64) -> bool {
+    let minutes = minutes as f64;
+    let expected_minutes = expected_minutes as f64;
+    minutes >= expected_minutes * 0.95 && minutes <= expected_minutes * 1.05
+}
+
 #[derive(Default)]
 pub(super) enum RateLimitSwitchPromptState {
     #[default]
@@ -125,3 +149,327 @@ pub(super) fn app_server_rate_limit_error_kind(
 pub(super) fn is_app_server_cyber_policy_error(info: &AppServerCodexErrorInfo) -> bool {
     matches!(info, AppServerCodexErrorInfo::CyberPolicy)
 }
+
+impl ChatWidget {
+    pub(crate) fn on_rate_limit_snapshot(&mut self, snapshot: Option<RateLimitSnapshot>) {
+        if let Some(mut snapshot) = snapshot {
+            let limit_id = snapshot
+                .limit_id
+                .clone()
+                .unwrap_or_else(|| "codex".to_string());
+            let limit_label = snapshot
+                .limit_name
+                .clone()
+                .unwrap_or_else(|| limit_id.clone());
+            if snapshot.credits.is_none() {
+                snapshot.credits = self
+                    .rate_limit_snapshots_by_limit_id
+                    .get(&limit_id)
+                    .and_then(|display| display.credits.as_ref())
+                    .map(|credits| CreditsSnapshot {
+                        has_credits: credits.has_credits,
+                        unlimited: credits.unlimited,
+                        balance: credits.balance.clone(),
+                    });
+            }
+
+            self.plan_type = snapshot.plan_type.or(self.plan_type);
+
+            let is_codex_limit = limit_id.eq_ignore_ascii_case("codex");
+            if is_codex_limit
+                && let Some(rate_limit_reached_type) = snapshot.rate_limit_reached_type
+            {
+                self.codex_rate_limit_reached_type = Some(rate_limit_reached_type);
+            }
+            let warnings = if is_codex_limit {
+                self.rate_limit_warnings.take_warnings(
+                    snapshot
+                        .secondary
+                        .as_ref()
+                        .map(|window| f64::from(window.used_percent)),
+                    snapshot
+                        .secondary
+                        .as_ref()
+                        .and_then(|window| window.window_duration_mins),
+                    snapshot
+                        .primary
+                        .as_ref()
+                        .map(|window| f64::from(window.used_percent)),
+                    snapshot
+                        .primary
+                        .as_ref()
+                        .and_then(|window| window.window_duration_mins),
+                )
+            } else {
+                vec![]
+            };
+
+            let high_usage = is_codex_limit
+                && (snapshot
+                    .secondary
+                    .as_ref()
+                    .map(|w| f64::from(w.used_percent) >= RATE_LIMIT_SWITCH_PROMPT_THRESHOLD)
+                    .unwrap_or(false)
+                    || snapshot
+                        .primary
+                        .as_ref()
+                        .map(|w| f64::from(w.used_percent) >= RATE_LIMIT_SWITCH_PROMPT_THRESHOLD)
+                        .unwrap_or(false));
+
+            let has_workspace_credits = snapshot
+                .credits
+                .as_ref()
+                .map(|credits| credits.has_credits)
+                .unwrap_or(false);
+
+            if high_usage
+                && !has_workspace_credits
+                && !self.rate_limit_switch_prompt_hidden()
+                && self.current_model() != NUDGE_MODEL_SLUG
+                && !matches!(
+                    self.rate_limit_switch_prompt,
+                    RateLimitSwitchPromptState::Shown
+                )
+            {
+                self.rate_limit_switch_prompt = RateLimitSwitchPromptState::Pending;
+            }
+
+            let display =
+                rate_limit_snapshot_display_for_limit(&snapshot, limit_label, Local::now());
+            self.rate_limit_snapshots_by_limit_id
+                .insert(limit_id, display);
+
+            if !warnings.is_empty() {
+                for warning in warnings {
+                    self.add_to_history(history_cell::new_warning_event(warning));
+                }
+                self.request_redraw();
+            }
+        } else {
+            self.rate_limit_snapshots_by_limit_id.clear();
+            self.codex_rate_limit_reached_type = None;
+        }
+        self.refresh_status_line();
+    }
+
+    pub(super) fn stop_rate_limit_poller(&mut self) {}
+
+    #[cfg_attr(not(test), allow(dead_code))]
+    pub(super) fn prefetch_rate_limits(&mut self) {
+        self.stop_rate_limit_poller();
+    }
+
+    #[cfg_attr(not(test), allow(dead_code))]
+    pub(super) fn should_prefetch_rate_limits(&self) -> bool {
+        self.config.model_provider.requires_openai_auth && self.has_chatgpt_account
+    }
+
+    fn lower_cost_preset(&self) -> Option<ModelPreset> {
+        let models = self.model_catalog.try_list_models().ok()?;
+        models
+            .iter()
+            .find(|preset| preset.show_in_picker && preset.model == NUDGE_MODEL_SLUG)
+            .cloned()
+    }
+
+    fn rate_limit_switch_prompt_hidden(&self) -> bool {
+        self.config
+            .notices
+            .hide_rate_limit_model_nudge
+            .unwrap_or(false)
+    }
+
+    pub(super) fn maybe_show_pending_rate_limit_prompt(&mut self) {
+        if self.rate_limit_switch_prompt_hidden() {
+            self.rate_limit_switch_prompt = RateLimitSwitchPromptState::Idle;
+            return;
+        }
+        if !matches!(
+            self.rate_limit_switch_prompt,
+            RateLimitSwitchPromptState::Pending
+        ) {
+            return;
+        }
+        if let Some(preset) = self.lower_cost_preset() {
+            self.open_rate_limit_switch_prompt(preset);
+            self.rate_limit_switch_prompt = RateLimitSwitchPromptState::Shown;
+        } else {
+            self.rate_limit_switch_prompt = RateLimitSwitchPromptState::Idle;
+        }
+    }
+
+    fn open_rate_limit_switch_prompt(&mut self, preset: ModelPreset) {
+        let switch_model = preset.model;
+        let switch_model_for_events = switch_model.clone();
+        let default_effort: ReasoningEffortConfig = preset.default_reasoning_effort;
+
+        let switch_actions: Vec<SelectionAction> = vec![Box::new(move |tx| {
+            tx.send(AppEvent::CodexOp(AppCommand::override_turn_context(
+                /*cwd*/ None,
+                /*approval_policy*/ None,
+                /*approvals_reviewer*/ None,
+                /*active_permission_profile*/ None,
+                /*windows_sandbox_level*/ None,
+                Some(switch_model_for_events.clone()),
+                Some(Some(default_effort)),
+                /*summary*/ None,
+                /*service_tier*/ None,
+                /*collaboration_mode*/ None,
+                /*personality*/ None,
+            )));
+            tx.send(AppEvent::UpdateModel(switch_model_for_events.clone()));
+            tx.send(AppEvent::UpdateReasoningEffort(Some(default_effort)));
+        })];
+
+        let keep_actions: Vec<SelectionAction> = Vec::new();
+        let never_actions: Vec<SelectionAction> = vec![Box::new(|tx| {
+            tx.send(AppEvent::UpdateRateLimitSwitchPromptHidden(true));
+            tx.send(AppEvent::PersistRateLimitSwitchPromptHidden);
+        })];
+        let description = if preset.description.is_empty() {
+            Some("Uses fewer credits for upcoming turns.".to_string())
+        } else {
+            Some(preset.description)
+        };
+
+        let items = vec![
+            SelectionItem {
+                name: format!("Switch to {switch_model}"),
+                description,
+                selected_description: None,
+                is_current: false,
+                actions: switch_actions,
+                dismiss_on_select: true,
+                ..Default::default()
+            },
+            SelectionItem {
+                name: "Keep current model".to_string(),
+                description: None,
+                selected_description: None,
+                is_current: false,
+                actions: keep_actions,
+                dismiss_on_select: true,
+                ..Default::default()
+            },
+            SelectionItem {
+                name: "Keep current model (never show again)".to_string(),
+                description: Some(
+                    "Hide future rate limit reminders about switching models.".to_string(),
+                ),
+                selected_description: None,
+                is_current: false,
+                actions: never_actions,
+                dismiss_on_select: true,
+                ..Default::default()
+            },
+        ];
+
+        self.bottom_pane.show_selection_view(SelectionViewParams {
+            title: Some("Approaching rate limits".to_string()),
+            subtitle: Some(format!("Switch to {switch_model} for lower credit usage?")),
+            footer_hint: Some(standard_popup_hint_line()),
+            items,
+            ..Default::default()
+        });
+    }
+
+    pub(super) fn open_workspace_owner_nudge_prompt(
+        &mut self,
+        credit_type: AddCreditsNudgeCreditType,
+    ) {
+        if self.add_credits_nudge_email_in_flight.is_some() {
+            return;
+        }
+
+        let (title, prompt) = match credit_type {
+            AddCreditsNudgeCreditType::Credits => (
+                "You've reached your workspace credit limit",
+                "Your workspace is out of credits. Ask your workspace owner to add more. Notify owner?",
+            ),
+            AddCreditsNudgeCreditType::UsageLimit => (
+                "Usage limit reached",
+                "Request a limit increase from your owner to continue using codex. Request increase?",
+            ),
+        };
+        let send_actions: Vec<SelectionAction> = vec![Box::new(move |tx| {
+            tx.send(AppEvent::SendAddCreditsNudgeEmail { credit_type });
+        })];
+        let items = vec![
+            SelectionItem {
+                name: "Yes".to_string(),
+                display_shortcut: Some(key_hint::plain(KeyCode::Char('y'))),
+                actions: send_actions,
+                dismiss_on_select: true,
+                ..Default::default()
+            },
+            SelectionItem {
+                name: "No".to_string(),
+                display_shortcut: Some(key_hint::plain(KeyCode::Char('n'))),
+                is_default: true,
+                dismiss_on_select: true,
+                ..Default::default()
+            },
+        ];
+
+        self.bottom_pane.show_selection_view(SelectionViewParams {
+            title: Some(title.to_string()),
+            subtitle: Some(prompt.to_string()),
+            footer_hint: Some(standard_popup_hint_line()),
+            items,
+            initial_selected_idx: Some(1),
+            ..Default::default()
+        });
+    }
+
+    pub(crate) fn start_add_credits_nudge_email_request(
+        &mut self,
+        credit_type: AddCreditsNudgeCreditType,
+    ) -> bool {
+        self.add_credits_nudge_email_in_flight = Some(credit_type);
+        true
+    }
+
+    pub(crate) fn finish_add_credits_nudge_email_request(
+        &mut self,
+        result: Result<AddCreditsNudgeEmailStatus, String>,
+    ) {
+        let credit_type = self
+            .add_credits_nudge_email_in_flight
+            .take()
+            .unwrap_or(AddCreditsNudgeCreditType::Credits);
+        let message = match (credit_type, result) {
+            (AddCreditsNudgeCreditType::Credits, Ok(AddCreditsNudgeEmailStatus::Sent)) => {
+                "Workspace owner notified."
+            }
+            (
+                AddCreditsNudgeCreditType::Credits,
+                Ok(AddCreditsNudgeEmailStatus::CooldownActive),
+            ) => "Workspace owner was already notified recently.",
+            (AddCreditsNudgeCreditType::Credits, Err(_)) => {
+                "Could not notify your workspace owner. Please try again."
+            }
+            (AddCreditsNudgeCreditType::UsageLimit, Ok(AddCreditsNudgeEmailStatus::Sent)) => {
+                "Limit increase requested."
+            }
+            (
+                AddCreditsNudgeCreditType::UsageLimit,
+                Ok(AddCreditsNudgeEmailStatus::CooldownActive),
+            ) => "A limit increase was already requested recently.",
+            (AddCreditsNudgeCreditType::UsageLimit, Err(_)) => {
+                "Could not request a limit increase. Please try again."
+            }
+        };
+        self.add_to_history(history_cell::new_info_event(
+            message.to_string(),
+            /*hint*/ None,
+        ));
+        self.request_redraw();
+    }
+
+    pub(crate) fn set_rate_limit_switch_prompt_hidden(&mut self, hidden: bool) {
+        self.config.notices.hide_rate_limit_model_nudge = Some(hidden);
+        if hidden {
+            self.rate_limit_switch_prompt = RateLimitSwitchPromptState::Idle;
+        }
+    }
+}
diff --git a/codex-rs/tui/src/chatwidget/rendering.rs b/codex-rs/tui/src/chatwidget/rendering.rs
new file mode 100644
index 0000000000..31c2d1dbf0
--- /dev/null
+++ b/codex-rs/tui/src/chatwidget/rendering.rs
@@ -0,0 +1,129 @@
+//! Render composition for the main chat widget surface.
+
+use super::*;
+
+impl ChatWidget {
+    pub(super) fn as_renderable(&self) -> RenderableItem<'_> {
+        let active_cell_right_reserve = self.ambient_pet_wrap_reserved_cols();
+        let active_cell_renderable = match &self.transcript.active_cell {
+            Some(cell) => RenderableItem::Owned(Box::new(TranscriptAreaRenderable {
+                child: cell.as_ref(),
+                top: 1,
+                right: active_cell_right_reserve,
+            })),
+            None => RenderableItem::Owned(Box::new(())),
+        };
+        let active_hook_cell_renderable = match &self.active_hook_cell {
+            Some(cell) if cell.should_render() => {
+                RenderableItem::Owned(Box::new(TranscriptAreaRenderable {
+                    child: cell,
+                    top: 1,
+                    right: active_cell_right_reserve,
+                }))
+            }
+            _ => RenderableItem::Owned(Box::new(())),
+        };
+        let mut flex = FlexRenderable::new();
+        flex.push(/*flex*/ 1, active_cell_renderable);
+        flex.push(/*flex*/ 0, active_hook_cell_renderable);
+        flex.push(
+            /*flex*/ 0,
+            RenderableItem::Owned(Box::new(BottomPaneComposerReserveRenderable {
+                bottom_pane: &self.bottom_pane,
+                right_reserve: active_cell_right_reserve,
+            }))
+            .inset(Insets::tlbr(
+                /*top*/ 1, /*left*/ 0, /*bottom*/ 0, /*right*/ 0,
+            )),
+        );
+        RenderableItem::Owned(Box::new(flex))
+    }
+}
+
+struct BottomPaneComposerReserveRenderable<'a> {
+    bottom_pane: &'a BottomPane,
+    right_reserve: u16,
+}
+
+impl Renderable for BottomPaneComposerReserveRenderable<'_> {
+    fn render(&self, area: Rect, buf: &mut Buffer) {
+        self.bottom_pane
+            .render_with_composer_right_reserve(area, buf, self.right_reserve);
+    }
+
+    fn desired_height(&self, width: u16) -> u16 {
+        self.bottom_pane
+            .desired_height_with_composer_right_reserve(width, self.right_reserve)
+    }
+
+    fn cursor_pos(&self, area: Rect) -> Option<(u16, u16)> {
+        self.bottom_pane
+            .cursor_pos_with_composer_right_reserve(area, self.right_reserve)
+    }
+
+    fn cursor_style(&self, area: Rect) -> crossterm::cursor::SetCursorStyle {
+        self.bottom_pane
+            .cursor_style_with_composer_right_reserve(area, self.right_reserve)
+    }
+}
+
+struct TranscriptAreaRenderable<'a> {
+    child: &'a dyn HistoryCell,
+    top: u16,
+    right: u16,
+}
+
+impl Renderable for TranscriptAreaRenderable<'_> {
+    fn render(&self, area: Rect, buf: &mut Buffer) {
+        let area = self.child_area(area);
+        let lines = self.child.display_lines(area.width);
+        let paragraph = Paragraph::new(Text::from(lines)).wrap(Wrap { trim: false });
+        let y = if area.height == 0 {
+            0
+        } else {
+            let overflow = paragraph
+                .line_count(area.width)
+                .saturating_sub(usize::from(area.height));
+            u16::try_from(overflow).unwrap_or(u16::MAX)
+        };
+        Clear.render(area, buf);
+        paragraph.scroll((y, 0)).render(area, buf);
+    }
+
+    fn desired_height(&self, width: u16) -> u16 {
+        let child_width = width.saturating_sub(self.right).max(1);
+        HistoryCell::desired_height(self.child, child_width) + self.top
+    }
+}
+
+impl TranscriptAreaRenderable<'_> {
+    fn child_area(&self, area: Rect) -> Rect {
+        let y = area.y.saturating_add(self.top);
+        let height = area.height.saturating_sub(self.top);
+        Rect::new(
+            area.x,
+            y,
+            area.width.saturating_sub(self.right).max(1),
+            height,
+        )
+    }
+}
+
+impl Renderable for ChatWidget {
+    fn render(&self, area: Rect, buf: &mut Buffer) {
+        self.as_renderable().render(area, buf);
+        self.last_rendered_width.set(Some(area.width as usize));
+    }
+
+    fn desired_height(&self, width: u16) -> u16 {
+        self.as_renderable().desired_height(width)
+    }
+
+    fn cursor_pos(&self, area: Rect) -> Option<(u16, u16)> {
+        self.as_renderable().cursor_pos(area)
+    }
+
+    fn cursor_style(&self, area: Rect) -> crossterm::cursor::SetCursorStyle {
+        self.as_renderable().cursor_style(area)
+    }
+}
diff --git a/codex-rs/tui/src/chatwidget/replay.rs b/codex-rs/tui/src/chatwidget/replay.rs
index 294e07e33a..f0211aaca1 100644
--- a/codex-rs/tui/src/chatwidget/replay.rs
+++ b/codex-rs/tui/src/chatwidget/replay.rs
@@ -133,6 +133,10 @@ impl ChatWidget {
                 ..
             } => {}
             item @ ThreadItem::FileChange { .. } => self.on_file_change_completed(item),
+            item @ ThreadItem::McpToolCall {
+                status: codex_app_server_protocol::McpToolCallStatus::InProgress,
+                ..
+            } => self.on_mcp_tool_call_started(item),
             item @ ThreadItem::McpToolCall { .. } => self.on_mcp_tool_call_completed(item),
             ThreadItem::WebSearch { id, query, action } => {
                 self.on_web_search_begin(id.clone());
diff --git a/codex-rs/tui/src/chatwidget/review_popups.rs b/codex-rs/tui/src/chatwidget/review_popups.rs
new file mode 100644
index 0000000000..b069649ef3
--- /dev/null
+++ b/codex-rs/tui/src/chatwidget/review_popups.rs
@@ -0,0 +1,182 @@
+//! Review preset selection and custom review prompt surfaces.
+
+use super::*;
+
+impl ChatWidget {
+    pub(crate) fn open_review_popup(&mut self) {
+        let mut items: Vec<SelectionItem> = Vec::new();
+
+        items.push(SelectionItem {
+            name: "Review against a base branch".to_string(),
+            description: Some("(PR Style)".into()),
+            actions: vec![Box::new({
+                let cwd = self.config.cwd.to_path_buf();
+                move |tx| {
+                    tx.send(AppEvent::OpenReviewBranchPicker(cwd.clone()));
+                }
+            })],
+            dismiss_on_select: false,
+            dismiss_parent_on_child_accept: true,
+            ..Default::default()
+        });
+
+        items.push(SelectionItem {
+            name: "Review uncommitted changes".to_string(),
+            actions: vec![Box::new(move |tx: &AppEventSender| {
+                tx.review(ReviewTarget::UncommittedChanges);
+            })],
+            dismiss_on_select: true,
+            ..Default::default()
+        });
+
+        items.push(SelectionItem {
+            name: "Review a commit".to_string(),
+            actions: vec![Box::new({
+                let cwd = self.config.cwd.to_path_buf();
+                move |tx| {
+                    tx.send(AppEvent::OpenReviewCommitPicker(cwd.clone()));
+                }
+            })],
+            dismiss_on_select: false,
+            dismiss_parent_on_child_accept: true,
+            ..Default::default()
+        });
+
+        items.push(SelectionItem {
+            name: "Custom review instructions".to_string(),
+            actions: vec![Box::new(move |tx| {
+                tx.send(AppEvent::OpenReviewCustomPrompt);
+            })],
+            dismiss_on_select: false,
+            dismiss_parent_on_child_accept: true,
+            ..Default::default()
+        });
+
+        self.bottom_pane.show_selection_view(SelectionViewParams {
+            title: Some("Select a review preset".into()),
+            footer_hint: Some(standard_popup_hint_line()),
+            items,
+            ..Default::default()
+        });
+    }
+
+    pub(crate) async fn show_review_branch_picker(&mut self, cwd: &Path) {
+        let branches = local_git_branches(cwd).await;
+        let current_branch = current_branch_name(cwd)
+            .await
+            .unwrap_or_else(|| "(detached HEAD)".to_string());
+        let mut items: Vec<SelectionItem> = Vec::with_capacity(branches.len());
+
+        for option in branches {
+            let branch = option.clone();
+            items.push(SelectionItem {
+                name: format!("{current_branch} -> {branch}"),
+                actions: vec![Box::new(move |tx3: &AppEventSender| {
+                    tx3.review(ReviewTarget::BaseBranch {
+                        branch: branch.clone(),
+                    });
+                })],
+                dismiss_on_select: true,
+                search_value: Some(option),
+                ..Default::default()
+            });
+        }
+
+        self.bottom_pane.show_selection_view(SelectionViewParams {
+            title: Some("Select a base branch".to_string()),
+            footer_hint: Some(standard_popup_hint_line()),
+            items,
+            is_searchable: true,
+            search_placeholder: Some("Type to search branches".to_string()),
+            ..Default::default()
+        });
+    }
+
+    pub(crate) async fn show_review_commit_picker(&mut self, cwd: &Path) {
+        let commits = recent_commits(cwd, /*limit*/ 100).await;
+
+        let mut items: Vec<SelectionItem> = Vec::with_capacity(commits.len());
+        for entry in commits {
+            let subject = entry.subject.clone();
+            let sha = entry.sha.clone();
+            let search_val = format!("{subject} {sha}");
+
+            items.push(SelectionItem {
+                name: subject.clone(),
+                actions: vec![Box::new(move |tx3: &AppEventSender| {
+                    tx3.review(ReviewTarget::Commit {
+                        sha: sha.clone(),
+                        title: Some(subject.clone()),
+                    });
+                })],
+                dismiss_on_select: true,
+                search_value: Some(search_val),
+                ..Default::default()
+            });
+        }
+
+        self.bottom_pane.show_selection_view(SelectionViewParams {
+            title: Some("Select a commit to review".to_string()),
+            footer_hint: Some(standard_popup_hint_line()),
+            items,
+            is_searchable: true,
+            search_placeholder: Some("Type to search commits".to_string()),
+            ..Default::default()
+        });
+    }
+
+    pub(crate) fn show_review_custom_prompt(&mut self) {
+        let tx = self.app_event_tx.clone();
+        let view = CustomPromptView::new(
+            "Custom review instructions".to_string(),
+            "Type instructions and press Enter".to_string(),
+            /*initial_text*/ String::new(),
+            /*context_label*/ None,
+            Box::new(move |prompt: String| {
+                let trimmed = prompt.trim().to_string();
+                if trimmed.is_empty() {
+                    return;
+                }
+                tx.review(ReviewTarget::Custom {
+                    instructions: trimmed,
+                });
+            }),
+        );
+        self.bottom_pane.show_view(Box::new(view));
+    }
+}
+
+#[cfg(test)]
+pub(crate) fn show_review_commit_picker_with_entries(
+    chat: &mut ChatWidget,
+    entries: Vec<CommitLogEntry>,
+) {
+    let mut items: Vec<SelectionItem> = Vec::with_capacity(entries.len());
+    for entry in entries {
+        let subject = entry.subject.clone();
+        let sha = entry.sha.clone();
+        let search_val = format!("{subject} {sha}");
+
+        items.push(SelectionItem {
+            name: subject.clone(),
+            actions: vec![Box::new(move |tx3: &AppEventSender| {
+                tx3.review(ReviewTarget::Commit {
+                    sha: sha.clone(),
+                    title: Some(subject.clone()),
+                });
+            })],
+            dismiss_on_select: true,
+            search_value: Some(search_val),
+            ..Default::default()
+        });
+    }
+
+    chat.bottom_pane.show_selection_view(SelectionViewParams {
+        title: Some("Select a commit to review".to_string()),
+        footer_hint: Some(standard_popup_hint_line()),
+        items,
+        is_searchable: true,
+        search_placeholder: Some("Type to search commits".to_string()),
+        ..Default::default()
+    });
+}
diff --git a/codex-rs/tui/src/chatwidget/service_tiers.rs b/codex-rs/tui/src/chatwidget/service_tiers.rs
index 1cdb52f224..a60af0a69e 100644
--- a/codex-rs/tui/src/chatwidget/service_tiers.rs
+++ b/codex-rs/tui/src/chatwidget/service_tiers.rs
@@ -107,7 +107,7 @@ impl ChatWidget {
                 /*cwd*/ None,
                 /*approval_policy*/ None,
                 /*approvals_reviewer*/ None,
-                /*permission_profile*/ None,
+                /*active_permission_profile*/ None,
                 /*windows_sandbox_level*/ None,
                 /*model*/ None,
                 /*effort*/ None,
diff --git a/codex-rs/tui/src/chatwidget/session_flow.rs b/codex-rs/tui/src/chatwidget/session_flow.rs
new file mode 100644
index 0000000000..2b8beefdf8
--- /dev/null
+++ b/codex-rs/tui/src/chatwidget/session_flow.rs
@@ -0,0 +1,219 @@
+//! Session configuration and thread-header orchestration for `ChatWidget`.
+
+use super::*;
+
+impl ChatWidget {
+    fn on_session_configured_with_display_and_fork_parent_title(
+        &mut self,
+        session: ThreadSessionState,
+        display: SessionConfiguredDisplay,
+        fork_parent_title: Option<String>,
+    ) {
+        self.transcript.reset_copy_history();
+        let history_metadata = session.message_history.unwrap_or_default();
+        self.bottom_pane.set_history_metadata(
+            session.thread_id,
+            history_metadata.log_id,
+            history_metadata.entry_count,
+        );
+        self.set_skills(/*skills*/ None);
+        self.session_network_proxy = session.network_proxy.clone();
+        let previous_thread_id = self.thread_id;
+        self.thread_id = Some(session.thread_id);
+        if previous_thread_id != self.thread_id {
+            self.review.recent_auto_review_denials = RecentAutoReviewDenials::default();
+        }
+        self.refresh_plan_mode_nudge();
+        self.turn_lifecycle.reset_thread();
+        self.thread_name = session.thread_name.clone();
+        self.current_goal_status_indicator = None;
+        self.current_goal_status = None;
+        self.update_collaboration_mode_indicator();
+        self.forked_from = session.forked_from_id;
+        self.current_rollout_path = session.rollout_path.clone();
+        self.current_cwd = Some(session.cwd.to_path_buf());
+        self.config.cwd = session.cwd.clone();
+        let runtime_workspace_roots = session.runtime_workspace_roots.clone();
+        self.config.workspace_roots = runtime_workspace_roots.clone();
+        self.config
+            .permissions
+            .set_workspace_roots(runtime_workspace_roots);
+        self.effective_service_tier = session.service_tier.clone();
+        if let Err(err) = self
+            .config
+            .permissions
+            .approval_policy
+            .set(session.approval_policy.to_core())
+        {
+            tracing::warn!(%err, "failed to sync approval_policy from SessionConfigured");
+            self.config.permissions.approval_policy =
+                Constrained::allow_only(session.approval_policy.to_core());
+        }
+        let permission_snapshot = PermissionProfileSnapshot::from_session_snapshot(
+            session.permission_profile.clone(),
+            session.active_permission_profile.clone(),
+        );
+        let permission_sync = self
+            .config
+            .permissions
+            .set_permission_profile_from_session_snapshot(permission_snapshot.clone());
+        if let Err(err) = permission_sync {
+            tracing::warn!(%err, "failed to sync permissions from SessionConfigured");
+            if let Err(replace_err) = self
+                .config
+                .permissions
+                .replace_permission_profile_from_session_snapshot(permission_snapshot)
+            {
+                tracing::error!(
+                    %replace_err,
+                    "failed to replace permissions from SessionConfigured after constraint fallback"
+                );
+            }
+        }
+        self.config.approvals_reviewer = session.approvals_reviewer;
+        self.status_line_project_root_name_cache = None;
+        let forked_from_id = session.forked_from_id;
+        let model_for_header = session.model.clone();
+        self.session_header.set_model(&model_for_header);
+        self.current_collaboration_mode = self.current_collaboration_mode.with_updates(
+            Some(model_for_header.clone()),
+            Some(session.reasoning_effort),
+            /*developer_instructions*/ None,
+        );
+        if let Some(mask) = self.active_collaboration_mask.as_mut() {
+            mask.model = Some(model_for_header.clone());
+            mask.reasoning_effort = Some(session.reasoning_effort);
+        }
+        self.refresh_model_display();
+        self.refresh_status_surfaces();
+        self.sync_service_tier_commands();
+        self.sync_personality_command_enabled();
+        self.sync_plugins_command_enabled();
+        self.sync_goal_command_enabled();
+        self.refresh_plugin_mentions();
+        if display == SessionConfiguredDisplay::Normal {
+            let startup_tooltip_override = self.startup_tooltip_override.take();
+            let show_fast_status = self
+                .should_show_fast_status(&model_for_header, self.effective_service_tier.as_deref());
+            let session_info_cell = history_cell::new_session_info(
+                &self.config,
+                &model_for_header,
+                &session,
+                self.show_welcome_banner,
+                startup_tooltip_override,
+                self.plan_type,
+                show_fast_status,
+            );
+            self.apply_session_info_cell(session_info_cell);
+        } else if self
+            .transcript
+            .active_cell
+            .as_ref()
+            .is_some_and(|cell| cell.as_any().is::<history_cell::SessionHeaderHistoryCell>())
+        {
+            self.transcript.active_cell = None;
+            self.bump_active_cell_revision();
+        }
+        self.transcript.saw_copy_source_this_turn = false;
+        self.refresh_skills_for_current_cwd(/*force_reload*/ true);
+        if self.connectors_enabled() {
+            self.prefetch_connectors();
+        }
+        if let Some(user_message) = self.initial_user_message.take() {
+            if self.suppress_initial_user_message_submit {
+                self.initial_user_message = Some(user_message);
+            } else {
+                self.submit_user_message(user_message);
+            }
+        }
+        if display == SessionConfiguredDisplay::Normal
+            && let Some(forked_from_id) = forked_from_id
+        {
+            self.emit_forked_thread_event(forked_from_id, fork_parent_title);
+        }
+        if !self.suppress_session_configured_redraw {
+            self.request_redraw();
+        }
+    }
+
+    pub(crate) fn handle_thread_session(&mut self, session: ThreadSessionState) {
+        self.instruction_source_paths = session.instruction_source_paths.clone();
+        let fork_parent_title = session.fork_parent_title.clone();
+        self.on_session_configured_with_display_and_fork_parent_title(
+            session,
+            SessionConfiguredDisplay::Normal,
+            fork_parent_title,
+        );
+    }
+
+    pub(crate) fn handle_thread_session_quiet(&mut self, session: ThreadSessionState) {
+        self.instruction_source_paths = session.instruction_source_paths.clone();
+        self.on_session_configured_with_display_and_fork_parent_title(
+            session,
+            SessionConfiguredDisplay::Quiet,
+            /*fork_parent_title*/ None,
+        );
+    }
+
+    pub(crate) fn handle_side_thread_session(&mut self, session: ThreadSessionState) {
+        self.instruction_source_paths = session.instruction_source_paths.clone();
+        let fork_parent_title = session.fork_parent_title.clone();
+        self.on_session_configured_with_display_and_fork_parent_title(
+            session,
+            SessionConfiguredDisplay::SideConversation,
+            fork_parent_title,
+        );
+    }
+
+    pub(super) fn emit_forked_thread_event(
+        &mut self,
+        forked_from_id: ThreadId,
+        fork_parent_title: Option<String>,
+    ) {
+        let forked_from_id_text = forked_from_id.to_string();
+        let line: Line<'static> = if let Some(name) = fork_parent_title
+            && !name.trim().is_empty()
+        {
+            vec![
+                "• ".dim(),
+                "Thread forked from ".into(),
+                name.cyan(),
+                " (".into(),
+                forked_from_id_text.cyan(),
+                ")".into(),
+            ]
+            .into()
+        } else {
+            vec![
+                "• ".dim(),
+                "Thread forked from ".into(),
+                forked_from_id_text.cyan(),
+            ]
+            .into()
+        };
+        self.app_event_tx.send(AppEvent::InsertHistoryCell(Box::new(
+            PlainHistoryCell::new(vec![line]),
+        )));
+    }
+
+    pub(super) fn on_thread_name_updated(
+        &mut self,
+        thread_id: ThreadId,
+        thread_name: Option<String>,
+    ) {
+        if self.thread_id == Some(thread_id) {
+            if let Some(name) = thread_name.as_deref() {
+                let cell = Self::rename_confirmation_cell(name, self.thread_id);
+                self.add_boxed_history(Box::new(cell));
+            }
+            self.thread_name = thread_name;
+            self.refresh_status_surfaces();
+            self.request_redraw();
+            self.maybe_send_next_queued_input();
+        }
+    }
+
+    pub(super) fn set_skills(&mut self, skills: Option<Vec<SkillMetadata>>) {
+        self.bottom_pane.set_skills(skills);
+    }
+}
diff --git a/codex-rs/tui/src/chatwidget/settings.rs b/codex-rs/tui/src/chatwidget/settings.rs
new file mode 100644
index 0000000000..91abc728db
--- /dev/null
+++ b/codex-rs/tui/src/chatwidget/settings.rs
@@ -0,0 +1,612 @@
+//! Runtime settings state and model/collaboration coordination for `ChatWidget`.
+
+use super::*;
+
+impl ChatWidget {
+    /// Set the approval policy in the widget's config copy.
+    pub(crate) fn set_approval_policy(&mut self, policy: AskForApproval) {
+        if let Err(err) = self
+            .config
+            .permissions
+            .approval_policy
+            .set(policy.to_core())
+        {
+            tracing::warn!(%err, "failed to set approval_policy on chat config");
+        } else {
+            self.refresh_status_surfaces();
+        }
+    }
+
+    #[cfg_attr(not(target_os = "windows"), allow(dead_code))]
+    pub(crate) fn set_permission_profile_from_session_snapshot(
+        &mut self,
+        snapshot: PermissionProfileSnapshot,
+    ) -> ConstraintResult<()> {
+        self.config
+            .permissions
+            .set_permission_profile_from_session_snapshot(snapshot)?;
+        self.refresh_status_surfaces();
+        Ok(())
+    }
+
+    #[cfg_attr(not(target_os = "windows"), allow(dead_code))]
+    pub(crate) fn set_windows_sandbox_mode(&mut self, mode: Option<WindowsSandboxModeToml>) {
+        self.config.permissions.windows_sandbox_mode = mode;
+        #[cfg(target_os = "windows")]
+        self.bottom_pane.set_windows_degraded_sandbox_active(
+            crate::legacy_core::windows_sandbox::ELEVATED_SANDBOX_NUX_ENABLED
+                && matches!(
+                    WindowsSandboxLevel::from_config(&self.config),
+                    WindowsSandboxLevel::RestrictedToken
+                ),
+        );
+    }
+
+    #[cfg_attr(not(target_os = "windows"), allow(dead_code))]
+    pub(crate) fn set_feature_enabled(&mut self, feature: Feature, enabled: bool) -> bool {
+        if let Err(err) = self.config.features.set_enabled(feature, enabled) {
+            tracing::warn!(
+                error = %err,
+                feature = feature.key(),
+                "failed to update constrained chat widget feature state"
+            );
+        }
+        let enabled = self.config.features.enabled(feature);
+        if feature == Feature::RealtimeConversation {
+            let realtime_conversation_enabled = self.realtime_conversation_enabled();
+            self.bottom_pane
+                .set_realtime_conversation_enabled(realtime_conversation_enabled);
+            self.bottom_pane
+                .set_audio_device_selection_enabled(self.realtime_audio_device_selection_enabled());
+            if !realtime_conversation_enabled && self.realtime_conversation.is_live() {
+                self.request_realtime_conversation_close(Some(
+                    "Realtime voice mode was closed because the feature was disabled.".to_string(),
+                ));
+            }
+        }
+        if feature == Feature::FastMode {
+            self.sync_service_tier_commands();
+        }
+        if feature == Feature::Personality {
+            self.sync_personality_command_enabled();
+        }
+        if feature == Feature::Plugins {
+            self.sync_plugins_command_enabled();
+            self.refresh_plugin_mentions();
+        }
+        if feature == Feature::Goals {
+            self.sync_goal_command_enabled();
+            if !enabled {
+                self.current_goal_status_indicator = None;
+                self.current_goal_status = None;
+                self.turn_lifecycle.goal_status_active_turn_started_at = None;
+                self.turn_lifecycle.budget_limited_turn_ids.clear();
+                self.update_collaboration_mode_indicator();
+            }
+        }
+        if feature == Feature::MentionsV2 {
+            self.sync_mentions_v2_enabled();
+        }
+        if feature == Feature::PreventIdleSleep {
+            self.turn_lifecycle.set_prevent_idle_sleep(enabled);
+        }
+        #[cfg(target_os = "windows")]
+        if matches!(
+            feature,
+            Feature::WindowsSandbox | Feature::WindowsSandboxElevated
+        ) {
+            self.bottom_pane.set_windows_degraded_sandbox_active(
+                crate::legacy_core::windows_sandbox::ELEVATED_SANDBOX_NUX_ENABLED
+                    && matches!(
+                        WindowsSandboxLevel::from_config(&self.config),
+                        WindowsSandboxLevel::RestrictedToken
+                    ),
+            );
+        }
+        enabled
+    }
+
+    pub(crate) fn set_approvals_reviewer(&mut self, policy: ApprovalsReviewer) {
+        self.config.approvals_reviewer = policy;
+        self.refresh_status_surfaces();
+    }
+
+    pub(crate) fn set_full_access_warning_acknowledged(&mut self, acknowledged: bool) {
+        self.config.notices.hide_full_access_warning = Some(acknowledged);
+    }
+
+    pub(crate) fn set_world_writable_warning_acknowledged(&mut self, acknowledged: bool) {
+        self.config.notices.hide_world_writable_warning = Some(acknowledged);
+    }
+
+    #[cfg_attr(not(target_os = "windows"), allow(dead_code))]
+    pub(crate) fn world_writable_warning_hidden(&self) -> bool {
+        self.config
+            .notices
+            .hide_world_writable_warning
+            .unwrap_or(false)
+    }
+
+    /// Override the reasoning effort used when Plan mode is active.
+    ///
+    /// When the active mask is already Plan, the override is applied immediately
+    /// so the footer reflects it without waiting for the next mode switch.
+    /// Passing `None` resets to the Plan-mode preset default.
+    pub(crate) fn set_plan_mode_reasoning_effort(&mut self, effort: Option<ReasoningEffortConfig>) {
+        self.config.plan_mode_reasoning_effort = effort;
+        if self.collaboration_modes_enabled()
+            && let Some(mask) = self.active_collaboration_mask.as_mut()
+            && mask.mode == Some(ModeKind::Plan)
+        {
+            if let Some(effort) = effort {
+                mask.reasoning_effort = Some(Some(effort));
+            } else if let Some(plan_mask) =
+                collaboration_modes::plan_mask(self.model_catalog.as_ref())
+            {
+                mask.reasoning_effort = plan_mask.reasoning_effort;
+            }
+        }
+        self.refresh_model_dependent_surfaces();
+    }
+
+    /// Set the reasoning effort for the non-Plan collaboration mode.
+    ///
+    /// Does not touch the active Plan mask — Plan reasoning is controlled
+    /// exclusively by the Plan preset and `set_plan_mode_reasoning_effort`.
+    pub(crate) fn set_reasoning_effort(&mut self, effort: Option<ReasoningEffortConfig>) {
+        self.current_collaboration_mode = self.current_collaboration_mode.with_updates(
+            /*model*/ None,
+            Some(effort),
+            /*developer_instructions*/ None,
+        );
+        if self.collaboration_modes_enabled()
+            && let Some(mask) = self.active_collaboration_mask.as_mut()
+            && mask.mode != Some(ModeKind::Plan)
+        {
+            // Generic "global default" updates should not mutate the active Plan mask.
+            // Plan reasoning is controlled by the Plan preset and Plan-only override updates.
+            mask.reasoning_effort = Some(effort);
+        }
+        self.refresh_model_dependent_surfaces();
+    }
+
+    /// Set the personality in the widget's config copy.
+    pub(crate) fn set_personality(&mut self, personality: Personality) {
+        self.config.personality = Some(personality);
+    }
+
+    pub(crate) fn status_account_display(&self) -> Option<&StatusAccountDisplay> {
+        self.status_account_display.as_ref()
+    }
+
+    pub(crate) fn runtime_model_provider_base_url(&self) -> Option<&str> {
+        self.runtime_model_provider_base_url.as_deref()
+    }
+
+    #[cfg_attr(not(test), allow(dead_code))]
+    pub(crate) fn model_catalog(&self) -> Arc<ModelCatalog> {
+        self.model_catalog.clone()
+    }
+
+    pub(crate) fn current_plan_type(&self) -> Option<PlanType> {
+        self.plan_type
+    }
+
+    pub(crate) fn has_chatgpt_account(&self) -> bool {
+        self.has_chatgpt_account
+    }
+
+    pub(crate) fn update_account_state(
+        &mut self,
+        status_account_display: Option<StatusAccountDisplay>,
+        plan_type: Option<PlanType>,
+        has_chatgpt_account: bool,
+    ) {
+        self.status_account_display = status_account_display;
+        self.plan_type = plan_type;
+        self.has_chatgpt_account = has_chatgpt_account;
+        self.bottom_pane
+            .set_connectors_enabled(self.connectors_enabled());
+    }
+
+    pub(crate) fn set_realtime_audio_device(
+        &mut self,
+        kind: RealtimeAudioDeviceKind,
+        name: Option<String>,
+    ) {
+        match kind {
+            RealtimeAudioDeviceKind::Microphone => self.config.realtime_audio.microphone = name,
+            RealtimeAudioDeviceKind::Speaker => self.config.realtime_audio.speaker = name,
+        }
+    }
+
+    /// Set the syntax theme override in the widget's config copy.
+    pub(crate) fn set_tui_theme(&mut self, theme: Option<String>) {
+        self.config.tui_theme = theme;
+    }
+
+    /// Set the model in the widget's config copy and stored collaboration mode.
+    pub(crate) fn set_model(&mut self, model: &str) {
+        self.current_collaboration_mode = self.current_collaboration_mode.with_updates(
+            Some(model.to_string()),
+            /*effort*/ None,
+            /*developer_instructions*/ None,
+        );
+        if self.collaboration_modes_enabled()
+            && let Some(mask) = self.active_collaboration_mask.as_mut()
+        {
+            mask.model = Some(model.to_string());
+        }
+        self.refresh_model_dependent_surfaces();
+    }
+
+    pub(crate) fn current_model(&self) -> &str {
+        if !self.collaboration_modes_enabled() {
+            return self.current_collaboration_mode.model();
+        }
+        self.active_collaboration_mask
+            .as_ref()
+            .and_then(|mask| mask.model.as_deref())
+            .unwrap_or_else(|| self.current_collaboration_mode.model())
+    }
+
+    pub(crate) fn realtime_conversation_is_live(&self) -> bool {
+        self.realtime_conversation.is_live()
+    }
+
+    pub(super) fn current_realtime_audio_device_name(
+        &self,
+        kind: RealtimeAudioDeviceKind,
+    ) -> Option<String> {
+        match kind {
+            RealtimeAudioDeviceKind::Microphone => self.config.realtime_audio.microphone.clone(),
+            RealtimeAudioDeviceKind::Speaker => self.config.realtime_audio.speaker.clone(),
+        }
+    }
+
+    pub(super) fn current_realtime_audio_selection_label(
+        &self,
+        kind: RealtimeAudioDeviceKind,
+    ) -> String {
+        self.current_realtime_audio_device_name(kind)
+            .unwrap_or_else(|| "System default".to_string())
+    }
+
+    pub(super) fn sync_personality_command_enabled(&mut self) {
+        self.bottom_pane
+            .set_personality_command_enabled(self.config.features.enabled(Feature::Personality));
+    }
+
+    pub(super) fn sync_plugins_command_enabled(&mut self) {
+        self.bottom_pane
+            .set_plugins_command_enabled(self.config.features.enabled(Feature::Plugins));
+    }
+
+    pub(super) fn sync_goal_command_enabled(&mut self) {
+        self.bottom_pane
+            .set_goal_command_enabled(self.config.features.enabled(Feature::Goals));
+    }
+
+    pub(super) fn sync_mentions_v2_enabled(&mut self) {
+        self.bottom_pane
+            .set_mentions_v2_enabled(self.config.features.enabled(Feature::MentionsV2));
+    }
+
+    pub(super) fn current_model_supports_personality(&self) -> bool {
+        let model = self.current_model();
+        self.model_catalog
+            .try_list_models()
+            .ok()
+            .and_then(|models| {
+                models
+                    .into_iter()
+                    .find(|preset| preset.model == model)
+                    .map(|preset| preset.supports_personality)
+            })
+            .unwrap_or(false)
+    }
+
+    /// Return whether the effective model currently advertises image-input support.
+    ///
+    /// We intentionally default to `true` when model metadata cannot be read so transient catalog
+    /// failures do not hard-block user input in the UI.
+    pub(super) fn current_model_supports_images(&self) -> bool {
+        let model = self.current_model();
+        self.model_catalog
+            .try_list_models()
+            .ok()
+            .and_then(|models| {
+                models
+                    .into_iter()
+                    .find(|preset| preset.model == model)
+                    .map(|preset| preset.input_modalities.contains(&InputModality::Image))
+            })
+            .unwrap_or(true)
+    }
+
+    pub(super) fn sync_image_paste_enabled(&mut self) {
+        let enabled = self.current_model_supports_images();
+        self.bottom_pane.set_image_paste_enabled(enabled);
+    }
+
+    pub(super) fn image_inputs_not_supported_message(&self) -> String {
+        format!(
+            "Model {} does not support image inputs. Remove images or switch models.",
+            self.current_model()
+        )
+    }
+
+    #[allow(dead_code)] // Used in tests
+    pub(crate) fn current_collaboration_mode(&self) -> &CollaborationMode {
+        &self.current_collaboration_mode
+    }
+
+    pub(crate) fn current_reasoning_effort(&self) -> Option<ReasoningEffortConfig> {
+        self.effective_reasoning_effort()
+    }
+
+    #[cfg(test)]
+    pub(crate) fn active_collaboration_mode_kind(&self) -> ModeKind {
+        self.active_mode_kind()
+    }
+
+    pub(super) fn is_session_configured(&self) -> bool {
+        self.thread_id.is_some()
+    }
+
+    pub(super) fn collaboration_modes_enabled(&self) -> bool {
+        true
+    }
+
+    /// Returns the dismissal scope that applies to the currently visible draft.
+    fn plan_mode_nudge_scope(&self) -> PlanModeNudgeScope {
+        self.thread_id
+            .map_or(PlanModeNudgeScope::NewThread, PlanModeNudgeScope::Thread)
+    }
+
+    /// Returns whether the current draft should replace the normal footer with the Plan-mode nudge.
+    ///
+    /// `ChatWidget` owns this policy because it can combine lexical draft matching with mode
+    /// availability, interaction state, and thread-scoped dismissal. `ChatComposer` only renders
+    /// the resulting visibility bit. Keeping slash and shell drafts out here avoids advertising a
+    /// mode switch while the user is intentionally composing another local command.
+    pub(super) fn should_show_plan_mode_nudge(&self) -> bool {
+        let text = self.bottom_pane.composer_text();
+        let trimmed = text.trim_start();
+        self.collaboration_modes_enabled()
+            && collaboration_modes::plan_mask(self.model_catalog.as_ref()).is_some()
+            && self.active_mode_kind() != ModeKind::Plan
+            && self.bottom_pane.composer_input_enabled()
+            && !self.bottom_pane.is_task_running()
+            && self.bottom_pane.no_modal_or_popup_active()
+            && !trimmed.starts_with('/')
+            && !trimmed.starts_with('!')
+            && contains_plan_keyword(&text)
+            && !self
+                .dismissed_plan_mode_nudge_scopes
+                .contains(&self.plan_mode_nudge_scope())
+    }
+
+    /// Synchronizes the footer presentation with the current Plan-mode nudge policy.
+    pub(super) fn refresh_plan_mode_nudge(&mut self) {
+        self.bottom_pane
+            .set_plan_mode_nudge_visible(self.should_show_plan_mode_nudge());
+    }
+
+    /// Hides the nudge for the current thread scope until the user changes conversation context.
+    pub(super) fn dismiss_plan_mode_nudge(&mut self) {
+        self.dismissed_plan_mode_nudge_scopes
+            .insert(self.plan_mode_nudge_scope());
+        self.refresh_plan_mode_nudge();
+    }
+
+    pub(super) fn initial_collaboration_mask(
+        _config: &Config,
+        model_catalog: &ModelCatalog,
+        model_override: Option<&str>,
+    ) -> Option<CollaborationModeMask> {
+        let mut mask = collaboration_modes::default_mask(model_catalog)?;
+        if let Some(model_override) = model_override {
+            mask.model = Some(model_override.to_string());
+        }
+        Some(mask)
+    }
+
+    pub(super) fn active_mode_kind(&self) -> ModeKind {
+        self.active_collaboration_mask
+            .as_ref()
+            .and_then(|mask| mask.mode)
+            .unwrap_or(ModeKind::Default)
+    }
+
+    pub(super) fn effective_reasoning_effort(&self) -> Option<ReasoningEffortConfig> {
+        if !self.collaboration_modes_enabled() {
+            return self.current_collaboration_mode.reasoning_effort();
+        }
+        let current_effort = self.current_collaboration_mode.reasoning_effort();
+        self.active_collaboration_mask
+            .as_ref()
+            .and_then(|mask| mask.reasoning_effort)
+            .unwrap_or(current_effort)
+    }
+
+    pub(super) fn effective_collaboration_mode(&self) -> CollaborationMode {
+        if !self.collaboration_modes_enabled() {
+            return self.current_collaboration_mode.clone();
+        }
+        self.active_collaboration_mask.as_ref().map_or_else(
+            || self.current_collaboration_mode.clone(),
+            |mask| self.current_collaboration_mode.apply_mask(mask),
+        )
+    }
+
+    pub(super) fn refresh_model_display(&mut self) {
+        let effective = self.effective_collaboration_mode();
+        self.session_header.set_model(effective.model());
+        // Keep composer paste affordances aligned with the currently effective model.
+        self.sync_image_paste_enabled();
+        self.sync_service_tier_commands();
+        self.refresh_terminal_title();
+    }
+
+    /// Refresh every UI surface that depends on the effective model, reasoning
+    /// effort, or collaboration mode.
+    ///
+    /// Call this at the end of any setter that mutates `current_collaboration_mode`,
+    /// `active_collaboration_mask`, or per-mode reasoning-effort overrides.
+    /// Consolidating both refreshes here prevents the bug where callers update the
+    /// header/title (`refresh_model_display`) but forget the footer status line
+    /// (`refresh_status_line`).
+    pub(super) fn refresh_model_dependent_surfaces(&mut self) {
+        self.refresh_model_display();
+        self.refresh_status_line();
+    }
+
+    pub(super) fn model_display_name(&self) -> &str {
+        let model = self.current_model();
+        if model.is_empty() {
+            DEFAULT_MODEL_DISPLAY_NAME
+        } else {
+            model
+        }
+    }
+
+    /// Get the label for the current collaboration mode.
+    pub(super) fn collaboration_mode_label(&self) -> Option<&'static str> {
+        if !self.collaboration_modes_enabled() {
+            return None;
+        }
+        let active_mode = self.active_mode_kind();
+        active_mode
+            .is_tui_visible()
+            .then_some(active_mode.display_name())
+    }
+
+    fn collaboration_mode_indicator(&self) -> Option<CollaborationModeIndicator> {
+        if !self.collaboration_modes_enabled() {
+            return None;
+        }
+        match self.active_mode_kind() {
+            ModeKind::Plan => Some(CollaborationModeIndicator::Plan),
+            ModeKind::Default | ModeKind::PairProgramming | ModeKind::Execute => None,
+        }
+    }
+
+    pub(super) fn update_collaboration_mode_indicator(&mut self) {
+        let indicator = self.collaboration_mode_indicator();
+        let goal_indicator = if indicator.is_none() {
+            self.goal_status_indicator(Instant::now())
+        } else {
+            None
+        };
+        self.current_goal_status_indicator = goal_indicator.clone();
+        self.bottom_pane.set_collaboration_mode_indicator(indicator);
+        self.bottom_pane.set_goal_status_indicator(goal_indicator);
+    }
+
+    pub(super) fn refresh_goal_status_indicator_for_time_tick(&mut self) {
+        if self.collaboration_mode_indicator().is_some() {
+            return;
+        }
+        let goal_indicator = self.goal_status_indicator(Instant::now());
+        if goal_indicator != self.current_goal_status_indicator {
+            self.current_goal_status_indicator = goal_indicator.clone();
+            self.bottom_pane.set_goal_status_indicator(goal_indicator);
+        }
+    }
+
+    fn goal_status_indicator(&self, now: Instant) -> Option<GoalStatusIndicator> {
+        if !self.config.features.enabled(Feature::Goals) {
+            return None;
+        }
+        self.current_goal_status.as_ref().and_then(|state| {
+            state.indicator(now, self.turn_lifecycle.goal_status_active_turn_started_at)
+        })
+    }
+
+    pub(super) fn on_thread_goal_updated(&mut self, goal: AppThreadGoal, turn_id: Option<String>) {
+        if let Some(active_thread_id) = self.thread_id
+            && active_thread_id.to_string() != goal.thread_id
+        {
+            return;
+        }
+        if !self.config.features.enabled(Feature::Goals) {
+            self.current_goal_status_indicator = None;
+            self.current_goal_status = None;
+            self.update_collaboration_mode_indicator();
+            return;
+        }
+        if goal.status == AppThreadGoalStatus::BudgetLimited
+            && let Some(turn_id) = turn_id
+        {
+            self.turn_lifecycle.mark_budget_limited(turn_id);
+        }
+        self.current_goal_status = Some(GoalStatusState::new(goal, Instant::now()));
+        self.update_collaboration_mode_indicator();
+    }
+
+    /// Cycle to the next collaboration mode variant (Plan -> Default -> Plan).
+    pub(super) fn cycle_collaboration_mode(&mut self) {
+        if !self.collaboration_modes_enabled() {
+            return;
+        }
+
+        if let Some(next_mask) = collaboration_modes::next_mask(
+            self.model_catalog.as_ref(),
+            self.active_collaboration_mask.as_ref(),
+        ) {
+            self.set_collaboration_mask(next_mask);
+        }
+    }
+
+    /// Update the active collaboration mask.
+    ///
+    /// When collaboration modes are enabled and a preset is selected,
+    /// the current mode is attached to submissions as `Op::UserTurn { collaboration_mode: Some(...) }`.
+    pub(crate) fn set_collaboration_mask(&mut self, mut mask: CollaborationModeMask) {
+        if !self.collaboration_modes_enabled() {
+            return;
+        }
+        let previous_mode = self.active_mode_kind();
+        let previous_model = self.current_model().to_string();
+        let previous_effort = self.effective_reasoning_effort();
+        if mask.mode == Some(ModeKind::Plan)
+            && let Some(effort) = self.config.plan_mode_reasoning_effort
+        {
+            mask.reasoning_effort = Some(Some(effort));
+        }
+        if mask.mode == Some(ModeKind::Plan) {
+            self.dismissed_plan_mode_nudge_scopes
+                .insert(self.plan_mode_nudge_scope());
+        }
+        self.active_collaboration_mask = Some(mask);
+        self.update_collaboration_mode_indicator();
+        self.refresh_plan_mode_nudge();
+        self.refresh_model_dependent_surfaces();
+        let next_mode = self.active_mode_kind();
+        let next_model = self.current_model();
+        let next_effort = self.effective_reasoning_effort();
+        if previous_mode != next_mode
+            && (previous_model != next_model || previous_effort != next_effort)
+        {
+            let mut message = format!("Model changed to {next_model}");
+            if !next_model.starts_with("codex-auto-") {
+                let reasoning_label = match next_effort {
+                    Some(ReasoningEffortConfig::Minimal) => "minimal",
+                    Some(ReasoningEffortConfig::Low) => "low",
+                    Some(ReasoningEffortConfig::Medium) => "medium",
+                    Some(ReasoningEffortConfig::High) => "high",
+                    Some(ReasoningEffortConfig::XHigh) => "xhigh",
+                    None | Some(ReasoningEffortConfig::None) => "default",
+                };
+                message.push(' ');
+                message.push_str(reasoning_label);
+            }
+            message.push_str(" for ");
+            message.push_str(next_mode.display_name());
+            message.push_str(" mode.");
+            self.add_info_message(message, /*hint*/ None);
+        }
+        self.request_redraw();
+    }
+}
diff --git a/codex-rs/tui/src/chatwidget/settings_popups.rs b/codex-rs/tui/src/chatwidget/settings_popups.rs
new file mode 100644
index 0000000000..2dcfefb73a
--- /dev/null
+++ b/codex-rs/tui/src/chatwidget/settings_popups.rs
@@ -0,0 +1,285 @@
+//! Settings-adjacent popup surfaces for `ChatWidget`.
+//!
+//! This keeps theme, personality, audio-device, and experimental-feature UI
+//! out of the main orchestration module without changing their event wiring.
+
+use super::*;
+
+impl ChatWidget {
+    pub(super) fn open_theme_picker(&mut self) {
+        let codex_home = codex_utils_home_dir::find_codex_home().ok();
+        let terminal_width = self
+            .last_rendered_width
+            .get()
+            .and_then(|width| u16::try_from(width).ok());
+        let params = crate::theme_picker::build_theme_picker_params(
+            self.config.tui_theme.as_deref(),
+            codex_home.as_deref(),
+            terminal_width,
+        );
+        self.bottom_pane.show_selection_view(params);
+    }
+
+    pub(crate) fn open_personality_popup(&mut self) {
+        if !self.is_session_configured() {
+            self.add_info_message(
+                "Personality selection is disabled until startup completes.".to_string(),
+                /*hint*/ None,
+            );
+            return;
+        }
+        if !self.current_model_supports_personality() {
+            let current_model = self.current_model();
+            self.add_error_message(format!(
+                "Current model ({current_model}) doesn't support personalities. Try /model to pick a different model."
+            ));
+            return;
+        }
+        self.open_personality_popup_for_current_model();
+    }
+
+    fn open_personality_popup_for_current_model(&mut self) {
+        let current_personality = self.config.personality.unwrap_or(Personality::Friendly);
+        let personalities = [Personality::Friendly, Personality::Pragmatic];
+        let supports_personality = self.current_model_supports_personality();
+
+        let items: Vec<SelectionItem> = personalities
+            .into_iter()
+            .map(|personality| {
+                let name = Self::personality_label(personality).to_string();
+                let description = Some(Self::personality_description(personality).to_string());
+                let actions: Vec<SelectionAction> = vec![Box::new(move |tx| {
+                    tx.send(AppEvent::CodexOp(AppCommand::override_turn_context(
+                        /*cwd*/ None,
+                        /*approval_policy*/ None,
+                        /*approvals_reviewer*/ None,
+                        /*active_permission_profile*/ None,
+                        /*windows_sandbox_level*/ None,
+                        /*model*/ None,
+                        /*effort*/ None,
+                        /*summary*/ None,
+                        /*service_tier*/ None,
+                        /*collaboration_mode*/ None,
+                        Some(personality),
+                    )));
+                    tx.send(AppEvent::UpdatePersonality(personality));
+                    tx.send(AppEvent::PersistPersonalitySelection { personality });
+                })];
+                SelectionItem {
+                    name,
+                    description,
+                    is_current: current_personality == personality,
+                    is_disabled: !supports_personality,
+                    actions,
+                    dismiss_on_select: true,
+                    ..Default::default()
+                }
+            })
+            .collect();
+
+        let mut header = ColumnRenderable::new();
+        header.push(Line::from("Select Personality".bold()));
+        header.push(Line::from("Choose a communication style for Codex.".dim()));
+
+        self.bottom_pane.show_selection_view(SelectionViewParams {
+            header: Box::new(header),
+            footer_hint: Some(standard_popup_hint_line()),
+            items,
+            ..Default::default()
+        });
+    }
+
+    pub(crate) fn open_realtime_audio_popup(&mut self) {
+        let items = [
+            RealtimeAudioDeviceKind::Microphone,
+            RealtimeAudioDeviceKind::Speaker,
+        ]
+        .into_iter()
+        .map(|kind| {
+            let description = Some(format!(
+                "Current: {}",
+                self.current_realtime_audio_selection_label(kind)
+            ));
+            let actions: Vec<SelectionAction> = vec![Box::new(move |tx| {
+                tx.send(AppEvent::OpenRealtimeAudioDeviceSelection { kind });
+            })];
+            SelectionItem {
+                name: kind.title().to_string(),
+                description,
+                actions,
+                dismiss_on_select: true,
+                ..Default::default()
+            }
+        })
+        .collect();
+
+        self.bottom_pane.show_selection_view(SelectionViewParams {
+            title: Some("Settings".to_string()),
+            subtitle: Some("Configure settings for Codex.".to_string()),
+            footer_hint: Some(standard_popup_hint_line()),
+            items,
+            ..Default::default()
+        });
+    }
+
+    #[cfg(not(target_os = "linux"))]
+    pub(crate) fn open_realtime_audio_device_selection(&mut self, kind: RealtimeAudioDeviceKind) {
+        match list_realtime_audio_device_names(kind) {
+            Ok(device_names) => {
+                self.open_realtime_audio_device_selection_with_names(kind, device_names);
+            }
+            Err(err) => {
+                self.add_error_message(format!(
+                    "Failed to load realtime {} devices: {err}",
+                    kind.noun()
+                ));
+            }
+        }
+    }
+
+    #[cfg(target_os = "linux")]
+    pub(crate) fn open_realtime_audio_device_selection(&mut self, kind: RealtimeAudioDeviceKind) {
+        let _ = kind;
+    }
+
+    #[cfg(not(target_os = "linux"))]
+    pub(super) fn open_realtime_audio_device_selection_with_names(
+        &mut self,
+        kind: RealtimeAudioDeviceKind,
+        device_names: Vec<String>,
+    ) {
+        let current_selection = self.current_realtime_audio_device_name(kind);
+        let current_available = current_selection
+            .as_deref()
+            .is_some_and(|name| device_names.iter().any(|device_name| device_name == name));
+        let mut items = vec![SelectionItem {
+            name: "System default".to_string(),
+            description: Some("Use your operating system default device.".to_string()),
+            is_current: current_selection.is_none(),
+            actions: vec![Box::new(move |tx| {
+                tx.send(AppEvent::PersistRealtimeAudioDeviceSelection { kind, name: None });
+            })],
+            dismiss_on_select: true,
+            ..Default::default()
+        }];
+
+        if let Some(selection) = current_selection.as_deref()
+            && !current_available
+        {
+            items.push(SelectionItem {
+                name: format!("Unavailable: {selection}"),
+                description: Some("Configured device is not currently available.".to_string()),
+                is_current: true,
+                is_disabled: true,
+                disabled_reason: Some("Reconnect the device or choose another one.".to_string()),
+                ..Default::default()
+            });
+        }
+
+        items.extend(device_names.into_iter().map(|device_name| {
+            let persisted_name = device_name.clone();
+            let actions: Vec<SelectionAction> = vec![Box::new(move |tx| {
+                tx.send(AppEvent::PersistRealtimeAudioDeviceSelection {
+                    kind,
+                    name: Some(persisted_name.clone()),
+                });
+            })];
+            SelectionItem {
+                is_current: current_selection.as_deref() == Some(device_name.as_str()),
+                name: device_name,
+                actions,
+                dismiss_on_select: true,
+                ..Default::default()
+            }
+        }));
+
+        let mut header = ColumnRenderable::new();
+        header.push(Line::from(format!("Select {}", kind.title()).bold()));
+        header.push(Line::from(
+            "Saved devices apply to realtime voice only.".dim(),
+        ));
+
+        self.bottom_pane.show_selection_view(SelectionViewParams {
+            header: Box::new(header),
+            footer_hint: Some(standard_popup_hint_line()),
+            items,
+            ..Default::default()
+        });
+    }
+
+    pub(crate) fn open_realtime_audio_restart_prompt(&mut self, kind: RealtimeAudioDeviceKind) {
+        let restart_actions: Vec<SelectionAction> = vec![Box::new(move |tx| {
+            tx.send(AppEvent::RestartRealtimeAudioDevice { kind });
+        })];
+        let items = vec![
+            SelectionItem {
+                name: "Restart now".to_string(),
+                description: Some(format!("Restart local {} audio now.", kind.noun())),
+                actions: restart_actions,
+                dismiss_on_select: true,
+                ..Default::default()
+            },
+            SelectionItem {
+                name: "Apply later".to_string(),
+                description: Some(format!(
+                    "Keep the current {} until local audio starts again.",
+                    kind.noun()
+                )),
+                dismiss_on_select: true,
+                ..Default::default()
+            },
+        ];
+
+        let mut header = ColumnRenderable::new();
+        header.push(Line::from(format!("Restart {} now?", kind.title()).bold()));
+        header.push(Line::from(
+            "Configuration is saved. Restart local audio to use it immediately.".dim(),
+        ));
+
+        self.bottom_pane.show_selection_view(SelectionViewParams {
+            header: Box::new(header),
+            footer_hint: Some(standard_popup_hint_line()),
+            items,
+            ..Default::default()
+        });
+    }
+
+    pub(crate) fn open_experimental_popup(&mut self) {
+        let features: Vec<ExperimentalFeatureItem> = FEATURES
+            .iter()
+            .filter_map(|spec| {
+                let name = spec.stage.experimental_menu_name()?;
+                let description = spec.stage.experimental_menu_description()?;
+                Some(ExperimentalFeatureItem {
+                    feature: spec.id,
+                    name: name.to_string(),
+                    description: description.to_string(),
+                    enabled: self.config.features.enabled(spec.id),
+                })
+            })
+            .collect();
+
+        let view = ExperimentalFeaturesView::new(
+            features,
+            self.app_event_tx.clone(),
+            self.bottom_pane.list_keymap(),
+        );
+        self.bottom_pane.show_view(Box::new(view));
+    }
+
+    fn personality_label(personality: Personality) -> &'static str {
+        match personality {
+            Personality::None => "None",
+            Personality::Friendly => "Friendly",
+            Personality::Pragmatic => "Pragmatic",
+        }
+    }
+
+    fn personality_description(personality: Personality) -> &'static str {
+        match personality {
+            Personality::None => "No personality instructions.",
+            Personality::Friendly => "Warm, collaborative, and helpful.",
+            Personality::Pragmatic => "Concise, task-focused, and direct.",
+        }
+    }
+}
diff --git a/codex-rs/tui/src/chatwidget/side.rs b/codex-rs/tui/src/chatwidget/side.rs
index 0d6c2f5a8e..e379fe3606 100644
--- a/codex-rs/tui/src/chatwidget/side.rs
+++ b/codex-rs/tui/src/chatwidget/side.rs
@@ -25,6 +25,10 @@ impl ChatWidget {
         self.bottom_pane.set_side_conversation_active(active);
     }
 
+    pub(crate) fn side_conversation_active(&self) -> bool {
+        self.active_side_conversation
+    }
+
     pub(crate) fn set_side_conversation_context_label(&mut self, label: Option<String>) {
         self.bottom_pane.set_side_conversation_context_label(label);
     }
diff --git a/codex-rs/tui/src/chatwidget/slash_dispatch.rs b/codex-rs/tui/src/chatwidget/slash_dispatch.rs
index 14a2dffb12..9d8d49a77c 100644
--- a/codex-rs/tui/src/chatwidget/slash_dispatch.rs
+++ b/codex-rs/tui/src/chatwidget/slash_dispatch.rs
@@ -32,7 +32,8 @@ struct PreparedSlashCommandArgs {
 const SIDE_STARTING_CONTEXT_LABEL: &str = "Side starting...";
 const SIDE_REVIEW_UNAVAILABLE_MESSAGE: &str =
     "'/side' is unavailable while code review is running.";
-const SIDE_SLASH_COMMAND_UNAVAILABLE_HINT: &str = "Press Esc to return to the main thread first.";
+const SIDE_SLASH_COMMAND_UNAVAILABLE_HINT: &str =
+    "Press Ctrl+C to return to the main thread first.";
 const GOAL_USAGE: &str = "Usage: /goal <objective>";
 const GOAL_USAGE_HINT: &str = "Example: /goal improve benchmark coverage";
 const RAW_USAGE: &str = "Usage: /raw [on|off]";
@@ -238,16 +239,6 @@ impl ChatWidget {
                     );
                 }
             }
-            SlashCommand::Collab => {
-                if !self.collaboration_modes_enabled() {
-                    self.add_info_message(
-                        "Collaboration modes are disabled.".to_string(),
-                        Some("Enable collaboration modes to use /collab.".to_string()),
-                    );
-                    return;
-                }
-                self.open_collaboration_modes_popup();
-            }
             SlashCommand::Side => {
                 self.request_empty_side_conversation();
             }
@@ -965,7 +956,6 @@ impl ChatWidget {
             | SlashCommand::Personality
             | SlashCommand::Plan
             | SlashCommand::Goal
-            | SlashCommand::Collab
             | SlashCommand::Side
             | SlashCommand::Keymap
             | SlashCommand::Agent
diff --git a/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__feedback_good_result_consent_popup.snap b/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__feedback_good_result_consent_popup.snap
index 2ba27d409f..cdeedc7b78 100644
--- a/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__feedback_good_result_consent_popup.snap
+++ b/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__feedback_good_result_consent_popup.snap
@@ -6,11 +6,12 @@ expression: popup
 
   The following files will be sent:
     • codex-logs.log
+    • codex-doctor-report.json
     • auto-review-rollout-thread-1.jsonl
     • codex-connectivity-diagnostics.txt
 
-› 1. Yes  Share the current Codex session logs with the team for
-          troubleshooting.
+› 1. Yes  Share the current Codex session logs and diagnostics with the team
+          for troubleshooting.
   2. No
 
   Press enter to confirm or esc to go back
diff --git a/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__feedback_upload_consent_popup.snap b/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__feedback_upload_consent_popup.snap
index b027333ad7..354e473a18 100644
--- a/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__feedback_upload_consent_popup.snap
+++ b/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__feedback_upload_consent_popup.snap
@@ -6,6 +6,7 @@ expression: popup
 
   The following files will be sent:
     • codex-logs.log
+    • codex-doctor-report.json
     • auto-review-rollout-thread-1.jsonl
     • codex-connectivity-diagnostics.txt
 
@@ -13,8 +14,8 @@ expression: popup
     - Proxy environment variables are set and may affect connectivity.
       - HTTPS_PROXY = hello
 
-› 1. Yes  Share the current Codex session logs with the team for
-          troubleshooting.
+› 1. Yes  Share the current Codex session logs and diagnostics with the team
+          for troubleshooting.
   2. No
 
   Press enter to confirm or esc to go back
diff --git a/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__goal_menu_blocked.snap b/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__goal_menu_blocked.snap
new file mode 100644
index 0000000000..40de732645
--- /dev/null
+++ b/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__goal_menu_blocked.snap
@@ -0,0 +1,11 @@
+---
+source: tui/src/chatwidget/tests/goal_menu.rs
+expression: rendered_goal_summary(&mut rx)
+---
+Goal
+Status: blocked
+Objective: Keep improving the bare goal command until it feels calm and useful.
+Time used: 1m
+Tokens used: 12.5K
+
+Commands: /goal edit, /goal resume, /goal clear
diff --git a/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__goal_menu_usage_limited.snap b/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__goal_menu_usage_limited.snap
new file mode 100644
index 0000000000..747ed25d27
--- /dev/null
+++ b/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__goal_menu_usage_limited.snap
@@ -0,0 +1,11 @@
+---
+source: tui/src/chatwidget/tests/goal_menu.rs
+expression: rendered_goal_summary(&mut rx)
+---
+Goal
+Status: usage limited
+Objective: Keep improving the bare goal command until it feels calm and useful.
+Time used: 1m
+Tokens used: 12.5K
+
+Commands: /goal edit, /goal resume, /goal clear
diff --git a/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__goal_slash_command_oversized_objective_error.snap b/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__goal_slash_command_oversized_objective_error.snap
deleted file mode 100644
index 470beccf0e..0000000000
--- a/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__goal_slash_command_oversized_objective_error.snap
+++ /dev/null
@@ -1,5 +0,0 @@
----
-source: tui/src/chatwidget/tests/goal_validation.rs
-expression: rendered
----
-■ Goal objective is too long: 4,001 characters. Limit: 4,000 characters. Put longer instructions in a file and refer to that file in the goal, for example: /goal follow the instructions in docs/goal.md.
diff --git a/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__hooks_popup_shows_list_diagnostics.snap b/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__hooks_popup_shows_list_diagnostics.snap
index 5224197d2f..9a532f563d 100644
--- a/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__hooks_popup_shows_list_diagnostics.snap
+++ b/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__hooks_popup_shows_list_diagnostics.snap
@@ -17,6 +17,7 @@ expression: popup
   PostCompact           0           0           After context compaction
   SessionStart          0           0           When a new session starts
   UserPromptSubmit      0           0           When the user submits a prompt
+  SubagentStart         0           0           When a subagent is created
   Stop                  0           0           Right before Codex ends its turn
 
   Press enter to view hooks; esc to close
diff --git a/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__side_context_label_preserves_status_line.snap b/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__side_context_label_preserves_status_line.snap
index 168dca8091..5757bf8dac 100644
--- a/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__side_context_label_preserves_status_line.snap
+++ b/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__side_context_label_preserves_status_line.snap
@@ -6,4 +6,4 @@ expression: terminal.backend()
 "                                                                                "
 "› Check recently modified functions for compatibility                           "
 "                                                                                "
-"  gpt-5.5                                Side from main thread · Esc to return  "
+"  gpt-5.5                             Side from main thread · Ctrl+C to return  "
diff --git a/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__side_context_label_shows_parent_status.snap b/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__side_context_label_shows_parent_status.snap
index 1f14076573..a1b8af6052 100644
--- a/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__side_context_label_shows_parent_status.snap
+++ b/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__side_context_label_shows_parent_status.snap
@@ -6,4 +6,4 @@ expression: terminal.backend()
 "                                                                                "
 "› Check recently modified functions for compatibility                           "
 "                                                                                "
-"  gpt-5.5 default · … Side from main thread · main needs input · Esc to return  "
+"  gpt-5.5 default… Side from main thread · main needs input · Ctrl+C to return  "
diff --git a/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__status_line_setup_popup_rate_limits.snap b/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__status_line_setup_popup_rate_limits.snap
new file mode 100644
index 0000000000..58d5065ff3
--- /dev/null
+++ b/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__status_line_setup_popup_rate_limits.snap
@@ -0,0 +1,20 @@
+---
+source: tui/src/chatwidget/tests/status_surface_previews.rs
+expression: status_line_popup_snapshot(&mut chat)
+---
+  Configure Status Line
+  Select which items to display in the status line.
+
+  Type to search
+  >
+› [x] Use theme colors      Apply colors from the active /theme
+  ───────────────────────
+  [x] monthly-limit         Remaining usage on the monthly usage limit (omitted when unavailable)
+  [x] weekly-limit          Remaining usage on the weekly usage limit (omitted when unavailable)
+  [ ] model                 Current model name
+  [ ] model-with-reasoning  Current model name with reasoning level
+  [ ] current-dir           Current working directory
+  [ ] project-name          Project name (omitted when unavailable)
+
+  monthly 65% · weekly 50%
+  Press space to toggle; ←/→ to move; enter to confirm and close; esc to close
diff --git a/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__status_surface_previews_rate_limits.snap b/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__status_surface_previews_rate_limits.snap
new file mode 100644
index 0000000000..eb6ec60729
--- /dev/null
+++ b/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__status_surface_previews_rate_limits.snap
@@ -0,0 +1,6 @@
+---
+source: tui/src/chatwidget/tests/status_surface_previews.rs
+expression: snapshot
+---
+status line: monthly 65% · weekly 50%
+terminal title: monthly 65% | weekly 50%
diff --git a/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__terminal_title_setup_popup_rate_limits.snap b/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__terminal_title_setup_popup_rate_limits.snap
new file mode 100644
index 0000000000..e05b295554
--- /dev/null
+++ b/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__terminal_title_setup_popup_rate_limits.snap
@@ -0,0 +1,20 @@
+---
+source: tui/src/chatwidget/tests/status_surface_previews.rs
+expression: terminal_title_popup_snapshot(&mut chat)
+---
+  Configure Terminal Title
+  Select which items to display in the terminal title.
+
+  Type to search
+  >
+› [x] monthly-limit  Remaining usage on the monthly usage limit (omitted when unavailable)
+  [x] weekly-limit   Remaining usage on the weekly usage limit (omitted when unavailable)
+  [ ] app-name       Codex app name
+  [ ] project-name   Project name (falls back to current directory name)
+  [ ] current-dir    Current working directory
+  [ ] activity       Spinner while working, action-required message while blocked.
+  [ ] run-state      Compact session run-state text (Ready, Working, Thinking)
+  [ ] thread-title   Current thread title, or thread identifier when unnamed
+
+  monthly 65% | weekly 50%
+  Press space to toggle; ←/→ to move; enter to confirm and close; esc to close
diff --git a/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__thread_name_update_resume_hint.snap b/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__thread_name_update_resume_hint.snap
new file mode 100644
index 0000000000..b3cdf89da3
--- /dev/null
+++ b/codex-rs/tui/src/chatwidget/snapshots/codex_tui__chatwidget__tests__thread_name_update_resume_hint.snap
@@ -0,0 +1,5 @@
+---
+source: tui/src/chatwidget/tests/app_server.rs
+expression: rendered
+---
+• Thread renamed to review-fix. To resume this thread run codex resume, then select review-fix (123e4567-e89b-12d3-a456-426614174000)
diff --git a/codex-rs/tui/src/chatwidget/status_controls.rs b/codex-rs/tui/src/chatwidget/status_controls.rs
new file mode 100644
index 0000000000..b1970d48dd
--- /dev/null
+++ b/codex-rs/tui/src/chatwidget/status_controls.rs
@@ -0,0 +1,395 @@
+//! Status output and setup controls for `ChatWidget`.
+//!
+//! Rendering details live in `status_surfaces`; this module owns the mutable
+//! widget entrypoints that apply status state, open setup views, and update the
+//! history-facing `/status` surface.
+
+use super::*;
+
+impl ChatWidget {
+    /// Update the status indicator header and details.
+    ///
+    /// Passing `None` clears any existing details.
+    pub(super) fn set_status(
+        &mut self,
+        header: String,
+        details: Option<String>,
+        details_capitalization: StatusDetailsCapitalization,
+        details_max_lines: usize,
+    ) {
+        let details = details
+            .filter(|details| !details.is_empty())
+            .map(|details| {
+                let trimmed = details.trim_start();
+                match details_capitalization {
+                    StatusDetailsCapitalization::CapitalizeFirst => {
+                        crate::text_formatting::capitalize_first(trimmed)
+                    }
+                    StatusDetailsCapitalization::Preserve => trimmed.to_string(),
+                }
+            });
+        self.status_state.set_status(StatusIndicatorState {
+            header: header.clone(),
+            details: details.clone(),
+            details_max_lines,
+        });
+        self.bottom_pane.update_status(
+            header,
+            details,
+            StatusDetailsCapitalization::Preserve,
+            details_max_lines,
+        );
+        let title_uses_status = self
+            .config
+            .tui_terminal_title
+            .as_ref()
+            .is_some_and(|items| {
+                items
+                    .iter()
+                    .any(|item| item == "run-state" || item == "status")
+            });
+        if title_uses_status {
+            self.refresh_status_surfaces();
+        }
+    }
+
+    /// Convenience wrapper around [`Self::set_status`];
+    /// updates the status indicator header and clears any existing details.
+    pub(super) fn set_status_header(&mut self, header: String) {
+        self.set_status(
+            header,
+            /*details*/ None,
+            StatusDetailsCapitalization::CapitalizeFirst,
+            STATUS_DETAILS_DEFAULT_MAX_LINES,
+        );
+    }
+
+    /// Sets the currently rendered footer status-line value.
+    pub(crate) fn set_status_line(&mut self, status_line: Option<Line<'static>>) {
+        self.bottom_pane.set_status_line(status_line);
+    }
+
+    /// Sets the terminal hyperlink target for the currently rendered footer status line.
+    pub(crate) fn set_status_line_hyperlink(&mut self, url: Option<String>) {
+        self.bottom_pane.set_status_line_hyperlink(url);
+    }
+
+    /// Forwards the contextual active-agent label into the bottom-pane footer pipeline.
+    ///
+    /// `ChatWidget` stays a pass-through here so `App` remains the owner of "which thread is the
+    /// user actually looking at?" and the footer stack remains a pure renderer of that decision.
+    pub(crate) fn set_active_agent_label(&mut self, active_agent_label: Option<String>) {
+        self.bottom_pane.set_active_agent_label(active_agent_label);
+    }
+
+    /// Recomputes footer status-line content from config and current runtime state.
+    ///
+    /// This method is the status-line orchestrator: it parses configured item identifiers,
+    /// warns once per session about invalid items, updates whether status-line mode is enabled,
+    /// schedules async git-branch lookup when needed, and renders only values that are currently
+    /// available.
+    ///
+    /// The omission behavior is intentional. If selected items are unavailable (for example before
+    /// a session id exists or before branch lookup completes), those items are skipped without
+    /// placeholders so the line remains compact and stable.
+    pub(crate) fn refresh_status_line(&mut self) {
+        self.refresh_status_surfaces();
+    }
+
+    /// Records that status-line setup was canceled.
+    ///
+    /// Cancellation is intentionally side-effect free for config state; the existing configuration
+    /// remains active and no persistence is attempted.
+    pub(crate) fn cancel_status_line_setup(&self) {
+        tracing::info!("Status line setup canceled by user");
+    }
+
+    /// Applies status-line item selection from the setup view to in-memory config.
+    ///
+    /// An empty selection persists as an explicit empty list.
+    pub(crate) fn setup_status_line(&mut self, items: Vec<StatusLineItem>, use_theme_colors: bool) {
+        tracing::info!(
+            "status line setup confirmed with items: {items:#?}, use_theme_colors: {use_theme_colors}"
+        );
+        let ids = items.iter().map(ToString::to_string).collect::<Vec<_>>();
+        self.config.tui_status_line = Some(ids);
+        self.config.tui_status_line_use_colors = use_theme_colors;
+        self.refresh_status_line();
+    }
+
+    /// Applies a temporary terminal-title selection while the setup UI is open.
+    pub(crate) fn preview_terminal_title(&mut self, items: Vec<TerminalTitleItem>) {
+        if self.terminal_title_setup_original_items.is_none() {
+            self.terminal_title_setup_original_items = Some(self.config.tui_terminal_title.clone());
+        }
+
+        let ids = items.iter().map(ToString::to_string).collect::<Vec<_>>();
+        self.config.tui_terminal_title = Some(ids);
+        self.refresh_terminal_title();
+    }
+
+    /// Restores the terminal-title config that was active before the setup UI
+    /// opened, undoing any preview changes. No-op if no setup session is active.
+    pub(crate) fn revert_terminal_title_setup_preview(&mut self) {
+        let Some(original_items) = self.terminal_title_setup_original_items.take() else {
+            return;
+        };
+
+        self.config.tui_terminal_title = original_items;
+        self.refresh_terminal_title();
+    }
+
+    /// Dismisses the terminal-title setup UI and reverts to the pre-setup config.
+    pub(crate) fn cancel_terminal_title_setup(&mut self) {
+        tracing::info!("Terminal title setup canceled by user");
+        self.revert_terminal_title_setup_preview();
+    }
+
+    /// Commits a confirmed terminal-title selection, ending the setup session.
+    ///
+    /// After this call, `revert_terminal_title_setup_preview` becomes a no-op
+    /// because the original config snapshot is discarded.
+    pub(crate) fn setup_terminal_title(&mut self, items: Vec<TerminalTitleItem>) {
+        tracing::info!("terminal title setup confirmed with items: {items:#?}");
+        let ids = items.iter().map(ToString::to_string).collect::<Vec<_>>();
+        self.terminal_title_setup_original_items = None;
+        self.config.tui_terminal_title = Some(ids);
+        self.refresh_terminal_title();
+    }
+
+    /// Stores async git-branch lookup results for the current status-line cwd.
+    ///
+    /// Results are dropped when they target an out-of-date cwd to avoid rendering stale branch
+    /// names after directory changes.
+    pub(crate) fn set_status_line_branch(&mut self, cwd: PathBuf, branch: Option<String>) {
+        if self.status_line_branch_cwd.as_ref() != Some(&cwd) {
+            self.status_line_branch_pending = false;
+            return;
+        }
+        self.status_line_branch = branch;
+        self.status_line_branch_pending = false;
+        self.status_line_branch_lookup_complete = true;
+        self.refresh_status_surfaces();
+    }
+
+    /// Stores async Git summary lookup results for the current status-line cwd.
+    pub(crate) fn set_status_line_git_summary(
+        &mut self,
+        cwd: PathBuf,
+        summary: StatusLineGitSummary,
+    ) {
+        if self.status_line_git_summary_cwd.as_ref() != Some(&cwd) {
+            self.status_line_git_summary_pending = false;
+            return;
+        }
+        self.status_line_git_summary = Some(summary);
+        self.status_line_git_summary_pending = false;
+        self.status_line_git_summary_lookup_complete = true;
+        self.refresh_status_surfaces();
+    }
+
+    pub(crate) fn add_status_output(
+        &mut self,
+        refreshing_rate_limits: bool,
+        request_id: Option<u64>,
+    ) {
+        let default_usage = TokenUsage::default();
+        let token_info = self.token_info.as_ref();
+        let total_usage = token_info
+            .map(|ti| &ti.total_token_usage)
+            .unwrap_or(&default_usage);
+        let collaboration_mode = self.collaboration_mode_label();
+        let model = self.current_model().to_string();
+        let model_default_reasoning_effort =
+            self.model_catalog
+                .try_list_models()
+                .ok()
+                .and_then(|models| {
+                    models
+                        .into_iter()
+                        .find(|preset| preset.model == model)
+                        .map(|preset| preset.default_reasoning_effort)
+                });
+        let reasoning_effort_override = Some(
+            self.effective_reasoning_effort()
+                .or(self.config.model_reasoning_effort)
+                .or(model_default_reasoning_effort),
+        );
+        let rate_limit_snapshots: Vec<RateLimitSnapshotDisplay> = self
+            .rate_limit_snapshots_by_limit_id
+            .values()
+            .cloned()
+            .collect();
+        let agents_summary =
+            crate::status::compose_agents_summary(&self.config, &self.instruction_source_paths);
+        let (cell, handle) = crate::status::new_status_output_with_rate_limits_handle(
+            &self.config,
+            self.runtime_model_provider_base_url.as_deref(),
+            self.status_account_display.as_ref(),
+            token_info,
+            total_usage,
+            &self.thread_id,
+            self.thread_name.clone(),
+            self.forked_from,
+            rate_limit_snapshots.as_slice(),
+            self.plan_type,
+            Local::now(),
+            self.model_display_name(),
+            collaboration_mode,
+            reasoning_effort_override,
+            agents_summary,
+            refreshing_rate_limits,
+        );
+        if let Some(request_id) = request_id {
+            self.refreshing_status_outputs.push((request_id, handle));
+        }
+        self.add_to_history(cell);
+    }
+
+    pub(crate) fn finish_status_rate_limit_refresh(&mut self, request_id: u64) {
+        if self.refreshing_status_outputs.is_empty() {
+            return;
+        }
+
+        let rate_limit_snapshots: Vec<RateLimitSnapshotDisplay> = self
+            .rate_limit_snapshots_by_limit_id
+            .values()
+            .cloned()
+            .collect();
+        let now = Local::now();
+        let mut remaining = Vec::with_capacity(self.refreshing_status_outputs.len());
+        let mut updated_any = false;
+        for (pending_request_id, handle) in self.refreshing_status_outputs.drain(..) {
+            if pending_request_id == request_id {
+                updated_any = true;
+                handle.finish_rate_limit_refresh(rate_limit_snapshots.as_slice(), now);
+            } else {
+                remaining.push((pending_request_id, handle));
+            }
+        }
+        self.refreshing_status_outputs = remaining;
+        if updated_any {
+            self.request_redraw();
+        }
+    }
+
+    pub(super) fn open_status_line_setup(&mut self) {
+        let configured_status_line_items = self.configured_status_line_items();
+        let view = StatusLineSetupView::new(
+            Some(configured_status_line_items.as_slice()),
+            self.config.tui_status_line_use_colors,
+            self.status_surface_preview_data(),
+            self.app_event_tx.clone(),
+            self.bottom_pane.list_keymap(),
+        );
+        self.bottom_pane.show_view(Box::new(view));
+    }
+
+    pub(super) fn open_terminal_title_setup(&mut self) {
+        let configured_terminal_title_items = self.configured_terminal_title_items();
+        self.terminal_title_setup_original_items = Some(self.config.tui_terminal_title.clone());
+        let view = TerminalTitleSetupView::new(
+            Some(configured_terminal_title_items.as_slice()),
+            self.terminal_title_preview_data(),
+            self.app_event_tx.clone(),
+            self.bottom_pane.list_keymap(),
+        );
+        self.bottom_pane.show_view(Box::new(view));
+    }
+
+    pub(super) fn status_surface_preview_data(&mut self) -> StatusSurfacePreviewData {
+        let mut preview_data = StatusSurfacePreviewData::from_iter(
+            StatusSurfacePreviewItem::iter().filter_map(|item| {
+                self.status_surface_preview_value_for_item(item)
+                    .map(|value| (item, value))
+            }),
+        );
+
+        if self.rate_limit_snapshots_by_limit_id.contains_key("codex") {
+            for item in [
+                StatusSurfacePreviewItem::FiveHourLimit,
+                StatusSurfacePreviewItem::WeeklyLimit,
+            ] {
+                if self.status_surface_preview_value_for_item(item).is_none() {
+                    preview_data.suppress_placeholder(item);
+                }
+            }
+        }
+
+        preview_data
+    }
+
+    pub(super) fn terminal_title_preview_data(&mut self) -> StatusSurfacePreviewData {
+        let mut preview_data = self.status_surface_preview_data();
+        let now = Instant::now();
+        for item in TerminalTitleItem::iter() {
+            let Some(preview_item) = item.preview_item() else {
+                continue;
+            };
+            let Some(value) = self.terminal_title_value_for_item(item, now) else {
+                continue;
+            };
+            preview_data.set_live(preview_item, value);
+        }
+        preview_data
+    }
+
+    pub(super) fn status_line_context_window_size(&self) -> Option<i64> {
+        self.token_info
+            .as_ref()
+            .and_then(|info| info.model_context_window)
+            .or(self.config.model_context_window)
+    }
+
+    pub(super) fn status_line_context_remaining_percent(&self) -> Option<i64> {
+        let Some(context_window) = self.status_line_context_window_size() else {
+            return Some(100);
+        };
+        let default_usage = TokenUsage::default();
+        let usage = self
+            .token_info
+            .as_ref()
+            .map(|info| &info.last_token_usage)
+            .unwrap_or(&default_usage);
+        Some(
+            usage
+                .percent_of_context_window_remaining(context_window)
+                .clamp(0, 100),
+        )
+    }
+
+    pub(super) fn status_line_context_used_percent(&self) -> Option<i64> {
+        let remaining = self.status_line_context_remaining_percent().unwrap_or(100);
+        Some((100 - remaining).clamp(0, 100))
+    }
+
+    pub(super) fn status_line_total_usage(&self) -> TokenUsage {
+        self.token_info
+            .as_ref()
+            .map(|info| info.total_token_usage.clone())
+            .unwrap_or_default()
+    }
+
+    pub(super) fn status_line_limit_display(
+        &self,
+        window: Option<&RateLimitWindowDisplay>,
+        label: &str,
+    ) -> Option<String> {
+        let window = window?;
+        let remaining = (100.0f64 - window.used_percent).clamp(0.0f64, 100.0f64);
+        Some(format!("{label} {remaining:.0}%"))
+    }
+
+    pub(super) fn status_line_reasoning_effort_label(
+        effort: Option<ReasoningEffortConfig>,
+    ) -> &'static str {
+        match effort {
+            Some(ReasoningEffortConfig::Minimal) => "minimal",
+            Some(ReasoningEffortConfig::Low) => "low",
+            Some(ReasoningEffortConfig::Medium) => "medium",
+            Some(ReasoningEffortConfig::High) => "high",
+            Some(ReasoningEffortConfig::XHigh) => "xhigh",
+            None | Some(ReasoningEffortConfig::None) => "default",
+        }
+    }
+}
diff --git a/codex-rs/tui/src/chatwidget/status_surfaces.rs b/codex-rs/tui/src/chatwidget/status_surfaces.rs
index 12ed07cf98..2b2b7d52df 100644
--- a/codex-rs/tui/src/chatwidget/status_surfaces.rs
+++ b/codex-rs/tui/src/chatwidget/status_surfaces.rs
@@ -6,6 +6,8 @@
 use super::*;
 use crate::bottom_pane::status_line_from_segments;
 use crate::branch_summary;
+use crate::chatwidget::limit_label_for_window;
+use crate::chatwidget::rate_limits::get_limits_duration;
 use crate::legacy_core::config::Config;
 use crate::status::format_tokens_compact;
 use codex_app_server_protocol::AskForApproval;
@@ -603,26 +605,20 @@ impl ChatWidget {
                 .status_line_context_used_percent()
                 .map(|used| format!("Context {used}% used")),
             StatusLineItem::FiveHourLimit => {
-                let window = self
+                let (window, is_secondary) = self
                     .rate_limit_snapshots_by_limit_id
                     .get("codex")
-                    .and_then(|s| s.primary.as_ref());
-                let label = window
-                    .and_then(|window| window.window_minutes)
-                    .map(get_limits_duration)
-                    .unwrap_or_else(|| "5h".to_string());
-                self.status_line_limit_display(window, &label)
+                    .and_then(five_hour_status_window)?;
+                let label = limit_label_for_window(window.window_minutes, is_secondary);
+                self.status_line_limit_display(Some(window), &label)
             }
             StatusLineItem::WeeklyLimit => {
-                let window = self
+                let (window, is_secondary) = self
                     .rate_limit_snapshots_by_limit_id
                     .get("codex")
-                    .and_then(|s| s.secondary.as_ref());
-                let label = window
-                    .and_then(|window| window.window_minutes)
-                    .map(get_limits_duration)
-                    .unwrap_or_else(|| "weekly".to_string());
-                self.status_line_limit_display(window, &label)
+                    .and_then(weekly_status_window)?;
+                let label = limit_label_for_window(window.window_minutes, is_secondary);
+                self.status_line_limit_display(Some(window), &label)
             }
             StatusLineItem::CodexVersion => Some(CODEX_CLI_VERSION.to_string()),
             StatusLineItem::ContextWindowSize => self
@@ -893,6 +889,102 @@ impl ChatWidget {
     }
 }
 
+fn five_hour_status_window(
+    snapshot: &RateLimitSnapshotDisplay,
+) -> Option<(&RateLimitWindowDisplay, bool)> {
+    find_primary_codex_window(snapshot, "5h")
+        .or_else(|| secondary_window_with_label_when_weekly_is_available(snapshot, "5h"))
+        .or_else(|| non_weekly_primary_window(snapshot))
+        .or_else(|| non_weekly_secondary_window_when_primary_is_weekly(snapshot))
+}
+
+fn weekly_status_window(
+    snapshot: &RateLimitSnapshotDisplay,
+) -> Option<(&RateLimitWindowDisplay, bool)> {
+    find_codex_window(snapshot, "weekly")
+        .or_else(|| snapshot.secondary.as_ref().map(|window| (window, true)))
+}
+
+fn find_codex_window<'a>(
+    snapshot: &'a RateLimitSnapshotDisplay,
+    label: &str,
+) -> Option<(&'a RateLimitWindowDisplay, bool)> {
+    if let Some(primary) = snapshot.primary.as_ref()
+        && matches_window_label(primary, label)
+    {
+        return Some((primary, false));
+    }
+
+    if let Some(secondary) = snapshot.secondary.as_ref()
+        && matches_window_label(secondary, label)
+    {
+        return Some((secondary, true));
+    }
+
+    None
+}
+
+fn find_primary_codex_window<'a>(
+    snapshot: &'a RateLimitSnapshotDisplay,
+    label: &str,
+) -> Option<(&'a RateLimitWindowDisplay, bool)> {
+    let primary = snapshot.primary.as_ref()?;
+    if matches_window_label(primary, label) {
+        Some((primary, false))
+    } else {
+        None
+    }
+}
+
+fn secondary_window_with_label_when_weekly_is_available<'a>(
+    snapshot: &'a RateLimitSnapshotDisplay,
+    label: &str,
+) -> Option<(&'a RateLimitWindowDisplay, bool)> {
+    find_codex_window(snapshot, "weekly")?;
+
+    let secondary = snapshot.secondary.as_ref()?;
+    if matches_window_label(secondary, label) {
+        Some((secondary, true))
+    } else {
+        None
+    }
+}
+
+fn non_weekly_primary_window(
+    snapshot: &RateLimitSnapshotDisplay,
+) -> Option<(&RateLimitWindowDisplay, bool)> {
+    let primary = snapshot.primary.as_ref()?;
+    if matches_window_label(primary, "weekly") {
+        None
+    } else {
+        Some((primary, false))
+    }
+}
+
+fn non_weekly_secondary_window_when_primary_is_weekly(
+    snapshot: &RateLimitSnapshotDisplay,
+) -> Option<(&RateLimitWindowDisplay, bool)> {
+    let primary = snapshot.primary.as_ref()?;
+    if !matches_window_label(primary, "weekly") {
+        return None;
+    }
+
+    let secondary = snapshot.secondary.as_ref()?;
+    if matches_window_label(secondary, "weekly") {
+        None
+    } else {
+        Some((secondary, true))
+    }
+}
+
+fn matches_window_label(window: &RateLimitWindowDisplay, label: &str) -> bool {
+    window
+        .window_minutes
+        .and_then(get_limits_duration)
+        .as_deref()
+        == Some(label)
+}
+
 fn permissions_display(config: &Config) -> String {
     let active_permission_profile = config.permissions.active_permission_profile();
     if let Some(active_permission_profile) = active_permission_profile.as_ref()
@@ -901,8 +993,10 @@ fn permissions_display(config: &Config) -> String {
         return active_permission_profile.id.clone();
     }
 
-    let permission_profile = config.permissions.permission_profile();
-    let summary = summarize_permission_profile(&permission_profile, config.cwd.as_path());
+    let permission_profile = config.permissions.effective_permission_profile();
+    let workspace_roots = config.effective_workspace_roots();
+    let summary =
+        summarize_permission_profile(&permission_profile, &config.cwd, workspace_roots.as_slice());
     if let Some(details) = summary.strip_prefix("read-only")
         && !details.contains("(network access enabled)")
     {
diff --git a/codex-rs/tui/src/chatwidget/tests.rs b/codex-rs/tui/src/chatwidget/tests.rs
index f86b896e5b..77aa742c01 100644
--- a/codex-rs/tui/src/chatwidget/tests.rs
+++ b/codex-rs/tui/src/chatwidget/tests.rs
@@ -119,11 +119,7 @@ pub(super) use codex_app_server_protocol::TurnStatus as AppServerTurnStatus;
 pub(super) use codex_app_server_protocol::UserInput;
 pub(super) use codex_app_server_protocol::UserInput as AppServerUserInput;
 pub(super) use codex_app_server_protocol::WarningNotification;
-pub(super) use codex_config::AppRequirementToml;
-pub(super) use codex_config::AppsRequirementsToml;
 pub(super) use codex_config::ConfigLayerStack;
-pub(super) use codex_config::ConfigRequirements;
-pub(super) use codex_config::ConfigRequirementsToml;
 pub(super) use codex_config::RequirementSource;
 pub(super) use codex_config::types::ApprovalsReviewer;
 pub(super) use codex_config::types::Notifications;
@@ -149,6 +145,8 @@ pub(super) use codex_protocol::config_types::CollaborationMode;
 pub(super) use codex_protocol::config_types::ModeKind;
 pub(super) use codex_protocol::config_types::Personality;
 pub(super) use codex_protocol::config_types::ServiceTier;
+pub(super) use codex_protocol::models::ActivePermissionProfile;
+pub(super) use codex_protocol::models::BUILT_IN_PERMISSION_PROFILE_WORKSPACE;
 pub(super) use codex_protocol::models::FileSystemPermissions;
 pub(super) use codex_protocol::models::MessagePhase;
 pub(super) use codex_protocol::models::NetworkPermissions;
@@ -176,7 +174,6 @@ pub(super) use insta::assert_snapshot;
 pub(super) use serde_json::json;
 #[cfg(target_os = "windows")]
 pub(super) use serial_test::serial;
-pub(super) use std::collections::BTreeMap;
 pub(super) use std::collections::HashMap;
 pub(super) use std::path::PathBuf;
 pub(super) use tempfile::NamedTempFile;
diff --git a/codex-rs/tui/src/chatwidget/tests/app_server.rs b/codex-rs/tui/src/chatwidget/tests/app_server.rs
index 26e38900ce..0b5f989141 100644
--- a/codex-rs/tui/src/chatwidget/tests/app_server.rs
+++ b/codex-rs/tui/src/chatwidget/tests/app_server.rs
@@ -4,13 +4,14 @@ use pretty_assertions::assert_eq;
 #[tokio::test]
 async fn invalid_url_elicitation_is_declined() {
     let (mut chat, _app_event_tx, mut rx, _op_rx) = make_chatwidget_manual_with_sender().await;
-    let thread_id = ThreadId::new();
-    chat.thread_id = Some(thread_id);
+    let visible_thread_id = ThreadId::new();
+    let request_thread_id = ThreadId::new();
+    chat.thread_id = Some(visible_thread_id);
 
     chat.handle_elicitation_request_now(
         codex_app_server_protocol::RequestId::Integer(9),
         codex_app_server_protocol::McpServerElicitationRequestParams {
-            thread_id: thread_id.to_string(),
+            thread_id: request_thread_id.to_string(),
             turn_id: Some("turn-auth".to_string()),
             server_name: "payments".to_string(),
             request: codex_app_server_protocol::McpServerElicitationRequest::Url {
@@ -33,7 +34,7 @@ async fn invalid_url_elicitation_is_declined() {
                 content: None,
                 meta: None,
             },
-        }) if op_thread_id == thread_id && server_name == "payments"
+        }) if op_thread_id == request_thread_id && server_name == "payments"
     );
 }
 
@@ -636,6 +637,40 @@ async fn live_app_server_failed_turn_does_not_duplicate_error_history() {
     assert!(!chat.bottom_pane.is_task_running());
 }
 
+#[tokio::test]
+async fn live_app_server_failed_turn_consolidates_streamed_answer() {
+    let (mut chat, mut rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
+
+    handle_turn_started(&mut chat, "turn-1");
+    while rx.try_recv().is_ok() {}
+
+    handle_agent_message_delta(&mut chat, "```diff\n+ streamed patch\n```\n");
+    chat.run_commit_tick();
+    while rx.try_recv().is_ok() {}
+
+    handle_error(
+        &mut chat,
+        "stream disconnected before completion",
+        /*codex_error_info*/ None,
+    );
+
+    let mut saw_consolidate = false;
+    while let Ok(event) = rx.try_recv() {
+        if let AppEvent::ConsolidateAgentMessage { source, .. } = event {
+            saw_consolidate = true;
+            assert!(
+                source.contains("streamed patch"),
+                "expected partial stream source to be consolidated, got {source:?}"
+            );
+        }
+    }
+
+    assert!(
+        saw_consolidate,
+        "failed turn should consolidate streamed cells before clearing the stream controller"
+    );
+}
+
 #[tokio::test]
 async fn live_app_server_stream_recovery_restores_previous_status_header() {
     let (mut chat, mut rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
@@ -827,7 +862,8 @@ async fn live_app_server_invalid_thread_name_update_is_ignored() {
 #[tokio::test]
 async fn live_app_server_thread_name_update_shows_resume_hint() {
     let (mut chat, mut rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
-    let thread_id = ThreadId::new();
+    let thread_id =
+        ThreadId::from_string("123e4567-e89b-12d3-a456-426614174000").expect("thread id");
     chat.thread_id = Some(thread_id);
 
     chat.handle_server_notification(
@@ -844,8 +880,7 @@ async fn live_app_server_thread_name_update_shows_resume_hint() {
     let cells = drain_insert_history(&mut rx);
     assert_eq!(cells.len(), 1);
     let rendered = lines_to_single_string(&cells[0]);
-    assert!(rendered.contains("Thread renamed to review-fix"));
-    assert!(rendered.contains("codex resume review-fix"));
+    assert_chatwidget_snapshot!("thread_name_update_resume_hint", rendered);
 }
 
 #[tokio::test]
diff --git a/codex-rs/tui/src/chatwidget/tests/approval_requests.rs b/codex-rs/tui/src/chatwidget/tests/approval_requests.rs
index 85c8fc6c03..d732177ce4 100644
--- a/codex-rs/tui/src/chatwidget/tests/approval_requests.rs
+++ b/codex-rs/tui/src/chatwidget/tests/approval_requests.rs
@@ -145,6 +145,129 @@ fn app_server_exec_approval_request_preserves_permissions_context() {
     );
 }
 
+#[tokio::test]
+async fn network_exec_approval_history_describes_session_host_allowance() {
+    let (mut chat, mut rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
+    let request = exec_approval_request_from_params(
+        AppServerCommandExecutionRequestApprovalParams {
+            thread_id: "thread-1".to_string(),
+            turn_id: "turn-1".to_string(),
+            item_id: "item-1".to_string(),
+            started_at_ms: 0,
+            approval_id: Some("approval-1".to_string()),
+            reason: None,
+            network_approval_context: Some(codex_app_server_protocol::NetworkApprovalContext {
+                host: "example.com".to_string(),
+                protocol: codex_app_server_protocol::NetworkApprovalProtocol::Https,
+            }),
+            command: Some("network-access https://example.com:8443".to_string()),
+            cwd: None,
+            command_actions: None,
+            additional_permissions: None,
+            proposed_execpolicy_amendment: None,
+            proposed_network_policy_amendments: None,
+            available_decisions: Some(vec![
+                codex_app_server_protocol::CommandExecutionApprovalDecision::AcceptForSession,
+                codex_app_server_protocol::CommandExecutionApprovalDecision::Cancel,
+            ]),
+        },
+        &test_path_buf("/tmp").abs(),
+    );
+
+    handle_exec_approval_request(&mut chat, "sub-network", request);
+    chat.handle_key_event(KeyEvent::new(KeyCode::Char('a'), KeyModifiers::NONE));
+
+    let decision = drain_insert_history(&mut rx)
+        .pop()
+        .expect("expected decision cell in history");
+    assert_snapshot!(
+        "network_exec_approval_history_session_host_allowance",
+        lines_to_single_string(&decision)
+    );
+}
+
+#[tokio::test]
+async fn network_exec_approval_history_describes_one_time_host_allowance() {
+    let (mut chat, mut rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
+    let request = exec_approval_request_from_params(
+        AppServerCommandExecutionRequestApprovalParams {
+            thread_id: "thread-1".to_string(),
+            turn_id: "turn-1".to_string(),
+            item_id: "item-1".to_string(),
+            started_at_ms: 0,
+            approval_id: Some("approval-1".to_string()),
+            reason: None,
+            network_approval_context: Some(codex_app_server_protocol::NetworkApprovalContext {
+                host: "example.com".to_string(),
+                protocol: codex_app_server_protocol::NetworkApprovalProtocol::Http,
+            }),
+            command: None,
+            cwd: None,
+            command_actions: None,
+            additional_permissions: None,
+            proposed_execpolicy_amendment: None,
+            proposed_network_policy_amendments: None,
+            available_decisions: Some(vec![
+                codex_app_server_protocol::CommandExecutionApprovalDecision::Accept,
+                codex_app_server_protocol::CommandExecutionApprovalDecision::Cancel,
+            ]),
+        },
+        &test_path_buf("/tmp").abs(),
+    );
+
+    handle_exec_approval_request(&mut chat, "sub-network", request);
+    chat.handle_key_event(KeyEvent::new(KeyCode::Char('y'), KeyModifiers::NONE));
+
+    let decision = drain_insert_history(&mut rx)
+        .pop()
+        .expect("expected decision cell in history");
+    assert_snapshot!(
+        "network_exec_approval_history_one_time_host_allowance",
+        lines_to_single_string(&decision)
+    );
+}
+
+#[tokio::test]
+async fn network_exec_approval_history_describes_canceled_host_request() {
+    let (mut chat, mut rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
+    let request = exec_approval_request_from_params(
+        AppServerCommandExecutionRequestApprovalParams {
+            thread_id: "thread-1".to_string(),
+            turn_id: "turn-1".to_string(),
+            item_id: "item-1".to_string(),
+            started_at_ms: 0,
+            approval_id: Some("approval-1".to_string()),
+            reason: None,
+            network_approval_context: Some(codex_app_server_protocol::NetworkApprovalContext {
+                host: "example.com".to_string(),
+                protocol: codex_app_server_protocol::NetworkApprovalProtocol::Socks5Tcp,
+            }),
+            command: Some("network-access socks5-tcp://example.com:1080".to_string()),
+            cwd: None,
+            command_actions: None,
+            additional_permissions: None,
+            proposed_execpolicy_amendment: None,
+            proposed_network_policy_amendments: None,
+            available_decisions: Some(vec![
+                codex_app_server_protocol::CommandExecutionApprovalDecision::Accept,
+                codex_app_server_protocol::CommandExecutionApprovalDecision::Cancel,
+            ]),
+        },
+        &test_path_buf("/tmp").abs(),
+    );
+
+    handle_exec_approval_request(&mut chat, "sub-network", request);
+    chat.handle_key_event(KeyEvent::new(KeyCode::Char('n'), KeyModifiers::NONE));
+
+    let decision = drain_insert_history(&mut rx)
+        .pop()
+        .expect("expected decision cell in history");
+    assert_snapshot!(
+        "network_exec_approval_history_canceled_host_request",
+        lines_to_single_string(&decision)
+    );
+}
+
 #[test]
 fn app_server_request_permissions_preserves_file_system_permissions() {
     let read_path = AbsolutePathBuf::try_from(PathBuf::from(test_path_display("/tmp/read-only")))
diff --git a/codex-rs/tui/src/chatwidget/tests/composer_submission.rs b/codex-rs/tui/src/chatwidget/tests/composer_submission.rs
index 95e8317e9c..4cd4cf4509 100644
--- a/codex-rs/tui/src/chatwidget/tests/composer_submission.rs
+++ b/codex-rs/tui/src/chatwidget/tests/composer_submission.rs
@@ -1,11 +1,10 @@
 use super::*;
-use codex_app_server_protocol::FileSystemAccessMode;
-use codex_app_server_protocol::FileSystemPath;
-use codex_app_server_protocol::FileSystemSandboxEntry;
-use codex_app_server_protocol::FileSystemSpecialPath;
-use codex_app_server_protocol::PermissionProfile as AppServerPermissionProfile;
-use codex_app_server_protocol::PermissionProfileFileSystemPermissions;
-use codex_app_server_protocol::PermissionProfileNetworkPermissions;
+use codex_protocol::models::ManagedFileSystemPermissions;
+use codex_protocol::permissions::FileSystemAccessMode;
+use codex_protocol::permissions::FileSystemPath;
+use codex_protocol::permissions::FileSystemSandboxEntry;
+use codex_protocol::permissions::FileSystemSpecialPath;
+use codex_protocol::permissions::NetworkSandboxPolicy;
 use pretty_assertions::assert_eq;
 use std::collections::VecDeque;
 
@@ -28,6 +27,7 @@ async fn submission_preserves_text_elements_and_local_images() {
         permission_profile: PermissionProfile::read_only(),
         active_permission_profile: None,
         cwd: test_path_buf("/home/user/project").abs(),
+        runtime_workspace_roots: Vec::new(),
         instruction_source_paths: Vec::new(),
         reasoning_effort: Some(ReasoningEffortConfig::default()),
         message_history: None,
@@ -57,7 +57,8 @@ async fn submission_preserves_text_elements_and_local_images() {
     assert_eq!(
         items[0],
         UserInput::LocalImage {
-            path: local_images[0].clone()
+            path: local_images[0].clone(),
+            detail: None,
         }
     );
     assert_eq!(
@@ -92,14 +93,14 @@ async fn submission_preserves_text_elements_and_local_images() {
 }
 
 #[tokio::test]
-async fn submission_includes_configured_permission_profile() {
+async fn submission_includes_configured_active_permission_profile() {
     let (mut chat, mut rx, mut op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
 
     let thread_id = ThreadId::new();
     let rollout_file = NamedTempFile::new().unwrap();
-    let expected_permission_profile: PermissionProfile = AppServerPermissionProfile::Managed {
-        network: PermissionProfileNetworkPermissions { enabled: false },
-        file_system: PermissionProfileFileSystemPermissions::Restricted {
+    let expected_permission_profile: PermissionProfile = PermissionProfile::Managed {
+        network: NetworkSandboxPolicy::Restricted,
+        file_system: ManagedFileSystemPermissions::Restricted {
             entries: vec![
                 FileSystemSandboxEntry {
                     path: FileSystemPath::Special {
@@ -111,13 +112,13 @@ async fn submission_includes_configured_permission_profile() {
                     path: FileSystemPath::GlobPattern {
                         pattern: "/home/user/project/secrets/**".to_string(),
                     },
-                    access: FileSystemAccessMode::None,
+                    access: FileSystemAccessMode::Deny,
                 },
             ],
             glob_scan_max_depth: None,
         },
-    }
-    .into();
+    };
+    let expected_active_permission_profile = ActivePermissionProfile::new("custom");
     let configured = crate::session_state::ThreadSessionState {
         thread_id,
         forked_from_id: None,
@@ -128,9 +129,10 @@ async fn submission_includes_configured_permission_profile() {
         service_tier: None,
         approval_policy: AskForApproval::Never,
         approvals_reviewer: ApprovalsReviewer::User,
-        permission_profile: expected_permission_profile.clone(),
-        active_permission_profile: None,
+        permission_profile: expected_permission_profile,
+        active_permission_profile: Some(expected_active_permission_profile.clone()),
         cwd: test_path_buf("/home/user/project").abs(),
+        runtime_workspace_roots: Vec::new(),
         instruction_source_paths: Vec::new(),
         reasoning_effort: Some(ReasoningEffortConfig::default()),
         message_history: None,
@@ -147,26 +149,29 @@ async fn submission_includes_configured_permission_profile() {
     );
     chat.handle_key_event(KeyEvent::new(KeyCode::Enter, KeyModifiers::NONE));
 
-    let permission_profile = match next_submit_op(&mut op_rx) {
+    let active_permission_profile = match next_submit_op(&mut op_rx) {
         Op::UserTurn {
-            permission_profile, ..
-        } => permission_profile,
+            active_permission_profile,
+            ..
+        } => active_permission_profile,
         other => panic!("expected Op::UserTurn, got {other:?}"),
     };
-    assert_eq!(permission_profile, expected_permission_profile);
+    assert_eq!(
+        active_permission_profile,
+        Some(expected_active_permission_profile)
+    );
 }
 
 #[tokio::test]
-async fn submission_keeps_profile_when_legacy_projection_is_external() {
+async fn submission_omits_active_permission_profile_for_legacy_snapshot() {
     let (mut chat, mut rx, mut op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
 
     let thread_id = ThreadId::new();
     let rollout_file = NamedTempFile::new().unwrap();
-    let expected_permission_profile: PermissionProfile = AppServerPermissionProfile::Managed {
-        network: PermissionProfileNetworkPermissions { enabled: false },
-        file_system: PermissionProfileFileSystemPermissions::Unrestricted,
-    }
-    .into();
+    let expected_permission_profile: PermissionProfile = PermissionProfile::Managed {
+        network: NetworkSandboxPolicy::Restricted,
+        file_system: ManagedFileSystemPermissions::Unrestricted,
+    };
     let configured = crate::session_state::ThreadSessionState {
         thread_id,
         forked_from_id: None,
@@ -177,9 +182,10 @@ async fn submission_keeps_profile_when_legacy_projection_is_external() {
         service_tier: None,
         approval_policy: AskForApproval::Never,
         approvals_reviewer: ApprovalsReviewer::User,
-        permission_profile: expected_permission_profile.clone(),
+        permission_profile: expected_permission_profile,
         active_permission_profile: None,
         cwd: test_path_buf("/home/user/project").abs(),
+        runtime_workspace_roots: Vec::new(),
         instruction_source_paths: Vec::new(),
         reasoning_effort: Some(ReasoningEffortConfig::default()),
         message_history: None,
@@ -193,13 +199,14 @@ async fn submission_keeps_profile_when_legacy_projection_is_external() {
         .set_composer_text("submit".to_string(), Vec::new(), Vec::new());
     chat.handle_key_event(KeyEvent::new(KeyCode::Enter, KeyModifiers::NONE));
 
-    let permission_profile = match next_submit_op(&mut op_rx) {
+    let active_permission_profile = match next_submit_op(&mut op_rx) {
         Op::UserTurn {
-            permission_profile, ..
-        } => permission_profile,
+            active_permission_profile,
+            ..
+        } => active_permission_profile,
         other => panic!("expected Op::UserTurn, got {other:?}"),
     };
-    assert_eq!(permission_profile, expected_permission_profile);
+    assert_eq!(active_permission_profile, None);
 }
 
 #[tokio::test]
@@ -221,6 +228,7 @@ async fn submission_with_remote_and_local_images_keeps_local_placeholder_numberi
         permission_profile: PermissionProfile::read_only(),
         active_permission_profile: None,
         cwd: test_path_buf("/home/user/project").abs(),
+        runtime_workspace_roots: Vec::new(),
         instruction_source_paths: Vec::new(),
         reasoning_effort: Some(ReasoningEffortConfig::default()),
         message_history: None,
@@ -255,12 +263,14 @@ async fn submission_with_remote_and_local_images_keeps_local_placeholder_numberi
         items[0],
         UserInput::Image {
             url: remote_url.clone(),
+            detail: None,
         }
     );
     assert_eq!(
         items[1],
         UserInput::LocalImage {
             path: local_images[0].clone(),
+            detail: None,
         }
     );
     assert_eq!(
@@ -314,6 +324,7 @@ async fn enter_with_only_remote_images_submits_user_turn() {
         permission_profile: PermissionProfile::read_only(),
         active_permission_profile: None,
         cwd: test_path_buf("/home/user/project").abs(),
+        runtime_workspace_roots: Vec::new(),
         instruction_source_paths: Vec::new(),
         reasoning_effort: Some(ReasoningEffortConfig::default()),
         message_history: None,
@@ -337,6 +348,7 @@ async fn enter_with_only_remote_images_submits_user_turn() {
         items,
         vec![UserInput::Image {
             url: remote_url.clone(),
+            detail: None,
         }]
     );
     assert_eq!(summary, None);
@@ -377,6 +389,7 @@ async fn shift_enter_with_only_remote_images_does_not_submit_user_turn() {
         permission_profile: PermissionProfile::read_only(),
         active_permission_profile: None,
         cwd: test_path_buf("/home/user/project").abs(),
+        runtime_workspace_roots: Vec::new(),
         instruction_source_paths: Vec::new(),
         reasoning_effort: Some(ReasoningEffortConfig::default()),
         message_history: None,
@@ -415,6 +428,7 @@ async fn enter_with_only_remote_images_does_not_submit_when_modal_is_active() {
         permission_profile: PermissionProfile::read_only(),
         active_permission_profile: None,
         cwd: test_path_buf("/home/user/project").abs(),
+        runtime_workspace_roots: Vec::new(),
         instruction_source_paths: Vec::new(),
         reasoning_effort: Some(ReasoningEffortConfig::default()),
         message_history: None,
@@ -453,6 +467,7 @@ async fn enter_with_only_remote_images_does_not_submit_when_input_disabled() {
         permission_profile: PermissionProfile::read_only(),
         active_permission_profile: None,
         cwd: test_path_buf("/home/user/project").abs(),
+        runtime_workspace_roots: Vec::new(),
         instruction_source_paths: Vec::new(),
         reasoning_effort: Some(ReasoningEffortConfig::default()),
         message_history: None,
@@ -494,6 +509,7 @@ async fn submission_prefers_selected_duplicate_skill_path() {
         permission_profile: PermissionProfile::read_only(),
         active_permission_profile: None,
         cwd: test_path_buf("/home/user/project").abs(),
+        runtime_workspace_roots: Vec::new(),
         instruction_source_paths: Vec::new(),
         reasoning_effort: Some(ReasoningEffortConfig::default()),
         message_history: None,
@@ -1148,9 +1164,11 @@ fn user_message_display_from_inputs_matches_flattened_user_message_shape() {
         },
         UserInput::Image {
             url: "https://example.com/remote.png".to_string(),
+            detail: None,
         },
         UserInput::LocalImage {
             path: local_image.clone(),
+            detail: None,
         },
         UserInput::Skill {
             name: "demo".to_string(),
@@ -1223,6 +1241,7 @@ async fn committed_user_message_with_hidden_prompt_context_renders_local_images(
             },
             UserInput::LocalImage {
                 path: local_image.clone(),
+                detail: None,
             },
         ],
     );
diff --git a/codex-rs/tui/src/chatwidget/tests/exec_flow.rs b/codex-rs/tui/src/chatwidget/tests/exec_flow.rs
index 2655c8cf95..d54783615c 100644
--- a/codex-rs/tui/src/chatwidget/tests/exec_flow.rs
+++ b/codex-rs/tui/src/chatwidget/tests/exec_flow.rs
@@ -957,6 +957,7 @@ async fn bang_shell_enter_while_task_running_submits_run_user_shell_command() {
         permission_profile: PermissionProfile::read_only(),
         active_permission_profile: None,
         cwd: test_path_buf("/home/user/project").abs(),
+        runtime_workspace_roots: Vec::new(),
         instruction_source_paths: Vec::new(),
         reasoning_effort: Some(ReasoningEffortConfig::default()),
         message_history: None,
diff --git a/codex-rs/tui/src/chatwidget/tests/goal_menu.rs b/codex-rs/tui/src/chatwidget/tests/goal_menu.rs
index e7f3077513..6ccc0220bf 100644
--- a/codex-rs/tui/src/chatwidget/tests/goal_menu.rs
+++ b/codex-rs/tui/src/chatwidget/tests/goal_menu.rs
@@ -28,6 +28,34 @@ async fn goal_menu_paused_snapshot() {
     assert_chatwidget_snapshot!("goal_menu_paused", rendered_goal_summary(&mut rx));
 }
 
+#[tokio::test]
+async fn goal_menu_blocked_snapshot() {
+    let (mut chat, mut rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
+    let thread_id = ThreadId::new();
+
+    chat.show_goal_summary(test_goal(
+        thread_id,
+        AppThreadGoalStatus::Blocked,
+        /*token_budget*/ None,
+    ));
+
+    assert_chatwidget_snapshot!("goal_menu_blocked", rendered_goal_summary(&mut rx));
+}
+
+#[tokio::test]
+async fn goal_menu_usage_limited_snapshot() {
+    let (mut chat, mut rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
+    let thread_id = ThreadId::new();
+
+    chat.show_goal_summary(test_goal(
+        thread_id,
+        AppThreadGoalStatus::UsageLimited,
+        /*token_budget*/ None,
+    ));
+
+    assert_chatwidget_snapshot!("goal_menu_usage_limited", rendered_goal_summary(&mut rx));
+}
+
 #[tokio::test]
 async fn goal_menu_budget_limited_snapshot() {
     let (mut chat, mut rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
@@ -117,6 +145,42 @@ async fn goal_edit_prompt_submits_preserved_status_and_budget() {
     assert!(chat.no_modal_or_popup_active());
 }
 
+#[tokio::test]
+async fn goal_edit_prompt_preserves_resumable_stopped_statuses() {
+    for stopped_status in [
+        AppThreadGoalStatus::Blocked,
+        AppThreadGoalStatus::UsageLimited,
+    ] {
+        let (mut chat, mut rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
+        let thread_id = ThreadId::new();
+
+        chat.show_goal_edit_prompt(
+            thread_id,
+            test_goal(
+                thread_id,
+                stopped_status,
+                /*token_budget*/ Some(80_000),
+            ),
+        );
+        chat.handle_key_event(KeyEvent::from(KeyCode::Enter));
+
+        match rx.try_recv() {
+            Ok(AppEvent::SetThreadGoalObjective {
+                mode:
+                    crate::app_event::ThreadGoalSetMode::UpdateExisting {
+                        status,
+                        token_budget,
+                    },
+                ..
+            }) => {
+                assert_eq!(status, stopped_status);
+                assert_eq!(token_budget, Some(80_000));
+            }
+            other => panic!("expected SetThreadGoalObjective event, got {other:?}"),
+        }
+    }
+}
+
 #[tokio::test]
 async fn goal_edit_prompt_resets_terminal_status_to_active() {
     let cases = [
diff --git a/codex-rs/tui/src/chatwidget/tests/goal_validation.rs b/codex-rs/tui/src/chatwidget/tests/goal_validation.rs
index b18b433923..b186cdf7ff 100644
--- a/codex-rs/tui/src/chatwidget/tests/goal_validation.rs
+++ b/codex-rs/tui/src/chatwidget/tests/goal_validation.rs
@@ -120,7 +120,12 @@ async fn goal_slash_command_rejects_oversized_objective() {
         "oversized goal should not emit a SetThreadGoalObjective event: {events:?}"
     );
     let rendered = rendered_insert_history(&events);
-    assert_chatwidget_snapshot!("goal_slash_command_oversized_objective_error", rendered);
+    assert!(rendered.contains("Goal objective is too long"));
+    assert!(rendered.contains("Put longer instructions in a file"));
+    assert!(
+        !rendered.contains("Message exceeds the maximum length"),
+        "expected goal-specific length error, got {rendered:?}"
+    );
     assert_no_submit_op(&mut op_rx);
 }
 
diff --git a/codex-rs/tui/src/chatwidget/tests/helpers.rs b/codex-rs/tui/src/chatwidget/tests/helpers.rs
index 0d72a2b8c5..74dea6d3d0 100644
--- a/codex-rs/tui/src/chatwidget/tests/helpers.rs
+++ b/codex-rs/tui/src/chatwidget/tests/helpers.rs
@@ -161,7 +161,6 @@ pub(super) async fn make_chatwidget_manual(
     let model_catalog = test_model_catalog(&cfg);
     let common = ChatWidgetInit {
         config: cfg,
-        environment_manager: Arc::new(codex_exec_server::EnvironmentManager::default_for_tests()),
         frame_requester: FrameRequester::test_dummy(),
         app_event_tx,
         workspace_command_runner: None,
@@ -1573,6 +1572,7 @@ fn hook_event_label(event_name: codex_app_server_protocol::HookEventName) -> &'s
         codex_app_server_protocol::HookEventName::PostCompact => "PostCompact",
         codex_app_server_protocol::HookEventName::SessionStart => "SessionStart",
         codex_app_server_protocol::HookEventName::UserPromptSubmit => "UserPromptSubmit",
+        codex_app_server_protocol::HookEventName::SubagentStart => "SubagentStart",
         codex_app_server_protocol::HookEventName::Stop => "Stop",
     }
 }
diff --git a/codex-rs/tui/src/chatwidget/tests/history_replay.rs b/codex-rs/tui/src/chatwidget/tests/history_replay.rs
index d77823c3cd..5ba32ead56 100644
--- a/codex-rs/tui/src/chatwidget/tests/history_replay.rs
+++ b/codex-rs/tui/src/chatwidget/tests/history_replay.rs
@@ -1,13 +1,12 @@
 use super::*;
-use codex_app_server_protocol::FileSystemAccessMode;
-use codex_app_server_protocol::FileSystemPath;
-use codex_app_server_protocol::FileSystemSandboxEntry;
-use codex_app_server_protocol::FileSystemSpecialPath;
 use codex_app_server_protocol::NetworkAccess;
-use codex_app_server_protocol::PermissionProfile as AppServerPermissionProfile;
-use codex_app_server_protocol::PermissionProfileFileSystemPermissions;
-use codex_app_server_protocol::PermissionProfileNetworkPermissions;
 use codex_app_server_protocol::SandboxPolicy;
+use codex_protocol::models::ManagedFileSystemPermissions;
+use codex_protocol::permissions::FileSystemAccessMode;
+use codex_protocol::permissions::FileSystemPath;
+use codex_protocol::permissions::FileSystemSandboxEntry;
+use codex_protocol::permissions::FileSystemSpecialPath;
+use codex_protocol::permissions::NetworkSandboxPolicy;
 use pretty_assertions::assert_eq;
 
 #[tokio::test]
@@ -29,6 +28,7 @@ async fn resumed_initial_messages_render_history() {
         permission_profile: PermissionProfile::read_only(),
         active_permission_profile: None,
         cwd: test_path_buf("/home/user/project").abs(),
+        runtime_workspace_roots: Vec::new(),
         instruction_source_paths: Vec::new(),
         reasoning_effort: Some(ReasoningEffortConfig::default()),
         message_history: None,
@@ -99,6 +99,7 @@ async fn replayed_user_message_preserves_text_elements_and_local_images() {
         permission_profile: PermissionProfile::read_only(),
         active_permission_profile: None,
         cwd: test_path_buf("/home/user/project").abs(),
+        runtime_workspace_roots: Vec::new(),
         instruction_source_paths: Vec::new(),
         reasoning_effort: Some(ReasoningEffortConfig::default()),
         message_history: None,
@@ -117,6 +118,7 @@ async fn replayed_user_message_preserves_text_elements_and_local_images() {
             },
             AppServerUserInput::LocalImage {
                 path: local_images[0].clone(),
+                detail: None,
             },
         ],
         ReplayKind::ResumeInitialMessages,
@@ -167,6 +169,7 @@ async fn replayed_user_message_preserves_remote_image_urls() {
         permission_profile: PermissionProfile::read_only(),
         active_permission_profile: None,
         cwd: test_path_buf("/home/user/project").abs(),
+        runtime_workspace_roots: Vec::new(),
         instruction_source_paths: Vec::new(),
         reasoning_effort: Some(ReasoningEffortConfig::default()),
         message_history: None,
@@ -185,6 +188,7 @@ async fn replayed_user_message_preserves_remote_image_urls() {
             },
             AppServerUserInput::Image {
                 url: remote_image_urls[0].clone(),
+                detail: None,
             },
         ],
         ReplayKind::ResumeInitialMessages,
@@ -227,9 +231,9 @@ async fn session_configured_syncs_widget_config_permissions_and_cwd() {
     chat.config.cwd = test_path_buf("/home/user/main").abs();
 
     let expected_cwd = test_path_buf("/home/user/sub-agent").abs();
-    let expected_app_server_permission_profile = AppServerPermissionProfile::Managed {
-        network: PermissionProfileNetworkPermissions { enabled: false },
-        file_system: PermissionProfileFileSystemPermissions::Restricted {
+    let expected_app_server_permission_profile = PermissionProfile::Managed {
+        network: NetworkSandboxPolicy::Restricted,
+        file_system: ManagedFileSystemPermissions::Restricted {
             entries: vec![
                 FileSystemSandboxEntry {
                     path: FileSystemPath::Special {
@@ -241,14 +245,13 @@ async fn session_configured_syncs_widget_config_permissions_and_cwd() {
                     path: FileSystemPath::GlobPattern {
                         pattern: "**/.secret".to_string(),
                     },
-                    access: FileSystemAccessMode::None,
+                    access: FileSystemAccessMode::Deny,
                 },
             ],
             glob_scan_max_depth: None,
         },
     };
-    let expected_permission_profile: PermissionProfile =
-        expected_app_server_permission_profile.clone().into();
+    let expected_permission_profile = expected_app_server_permission_profile.clone();
     let expected_core_sandbox = expected_permission_profile
         .to_legacy_sandbox_policy(expected_cwd.as_path())
         .expect("permission profile should project to legacy sandbox policy");
@@ -266,6 +269,7 @@ async fn session_configured_syncs_widget_config_permissions_and_cwd() {
         permission_profile: expected_permission_profile,
         active_permission_profile: None,
         cwd: expected_cwd.clone(),
+        runtime_workspace_roots: vec![expected_cwd.clone()],
         instruction_source_paths: Vec::new(),
         reasoning_effort: Some(ReasoningEffortConfig::default()),
         message_history: None,
@@ -282,18 +286,78 @@ async fn session_configured_syncs_widget_config_permissions_and_cwd() {
     let actual_sandbox = SandboxPolicy::from(chat.config_ref().legacy_sandbox_policy());
     assert_eq!(&actual_sandbox, &expected_sandbox);
     assert_eq!(
-        AppServerPermissionProfile::from(chat.config_ref().permissions.permission_profile()),
+        chat.config_ref().permissions.effective_permission_profile(),
         expected_app_server_permission_profile
     );
     assert_eq!(&chat.config_ref().cwd, &expected_cwd);
 
     let updated_profile = PermissionProfile::workspace_write();
-    chat.set_permission_profile(updated_profile.clone())
-        .expect("set permission profile");
+    chat.set_permission_profile_from_session_snapshot(PermissionProfileSnapshot::legacy(
+        updated_profile.clone(),
+    ))
+    .expect("set permission profile");
     assert_eq!(
         chat.config_ref().permissions.permission_profile(),
-        updated_profile,
-        "local permission changes should replace SessionConfigured profile-derived runtime permissions"
+        &updated_profile,
+        "local permission changes should replace SessionConfigured canonical permissions"
+    );
+    assert_eq!(
+        chat.config_ref().permissions.effective_permission_profile(),
+        updated_profile
+            .materialize_project_roots_with_workspace_roots(std::slice::from_ref(&expected_cwd,)),
+        "effective permissions should still use the current thread runtime workspace roots"
+    );
+}
+
+#[tokio::test]
+async fn session_configured_preserves_profile_workspace_roots() {
+    let (mut chat, _rx, _ops) = make_chatwidget_manual(/*model_override*/ None).await;
+
+    let previous_cwd = test_path_buf("/home/user/main").abs();
+    let profile_root = test_path_buf("/home/user/shared").abs();
+    chat.config.cwd = previous_cwd.clone();
+    chat.config.workspace_roots = vec![previous_cwd, profile_root.clone()];
+    chat.config.workspace_roots_explicit = false;
+    chat.config
+        .permissions
+        .set_workspace_roots(chat.config.workspace_roots.clone());
+
+    let session_cwd = test_path_buf("/home/user/sub-agent").abs();
+    let session_runtime_workspace_roots = vec![session_cwd.clone()];
+    let session_effective_workspace_roots = vec![session_cwd.clone(), profile_root];
+    let session_permission_profile = PermissionProfile::workspace_write()
+        .materialize_project_roots_with_workspace_roots(&session_effective_workspace_roots);
+    let configured = crate::session_state::ThreadSessionState {
+        thread_id: ThreadId::new(),
+        forked_from_id: None,
+        fork_parent_title: None,
+        thread_name: None,
+        model: "test-model".to_string(),
+        model_provider_id: "test-provider".to_string(),
+        service_tier: None,
+        approval_policy: AskForApproval::Never,
+        approvals_reviewer: ApprovalsReviewer::User,
+        permission_profile: session_permission_profile.clone(),
+        active_permission_profile: None,
+        cwd: session_cwd.clone(),
+        runtime_workspace_roots: session_runtime_workspace_roots.clone(),
+        instruction_source_paths: Vec::new(),
+        reasoning_effort: Some(ReasoningEffortConfig::default()),
+        message_history: None,
+        network_proxy: None,
+        rollout_path: None,
+    };
+
+    chat.handle_thread_session(configured);
+
+    assert_eq!(&chat.config_ref().cwd, &session_cwd);
+    assert_eq!(
+        chat.config_ref().permissions.user_visible_workspace_roots(),
+        session_runtime_workspace_roots.as_slice()
+    );
+    assert_eq!(
+        chat.config_ref().permissions.effective_permission_profile(),
+        session_permission_profile
     );
 }
 
@@ -301,11 +365,10 @@ async fn session_configured_syncs_widget_config_permissions_and_cwd() {
 async fn session_configured_external_sandbox_keeps_external_runtime_policy() {
     let (mut chat, _rx, _ops) = make_chatwidget_manual(/*model_override*/ None).await;
 
-    let expected_app_server_permission_profile = AppServerPermissionProfile::External {
-        network: PermissionProfileNetworkPermissions { enabled: false },
+    let expected_app_server_permission_profile = PermissionProfile::External {
+        network: NetworkSandboxPolicy::Restricted,
     };
-    let expected_permission_profile: PermissionProfile =
-        expected_app_server_permission_profile.clone().into();
+    let expected_permission_profile = expected_app_server_permission_profile.clone();
     let expected_sandbox = SandboxPolicy::ExternalSandbox {
         network_access: NetworkAccess::Restricted,
     };
@@ -322,6 +385,7 @@ async fn session_configured_external_sandbox_keeps_external_runtime_policy() {
         permission_profile: expected_permission_profile,
         active_permission_profile: None,
         cwd: test_path_buf("/home/user/external").abs(),
+        runtime_workspace_roots: Vec::new(),
         instruction_source_paths: Vec::new(),
         reasoning_effort: Some(ReasoningEffortConfig::default()),
         message_history: None,
@@ -334,7 +398,7 @@ async fn session_configured_external_sandbox_keeps_external_runtime_policy() {
     let actual_sandbox = SandboxPolicy::from(chat.config_ref().legacy_sandbox_policy());
     assert_eq!(&actual_sandbox, &expected_sandbox);
     assert_eq!(
-        AppServerPermissionProfile::from(chat.config_ref().permissions.permission_profile()),
+        chat.config_ref().permissions.effective_permission_profile(),
         expected_app_server_permission_profile
     );
 }
@@ -360,6 +424,7 @@ async fn replayed_user_message_with_only_remote_images_renders_history_cell() {
         permission_profile: PermissionProfile::read_only(),
         active_permission_profile: None,
         cwd: test_path_buf("/home/user/project").abs(),
+        runtime_workspace_roots: Vec::new(),
         instruction_source_paths: Vec::new(),
         reasoning_effort: Some(ReasoningEffortConfig::default()),
         message_history: None,
@@ -373,6 +438,7 @@ async fn replayed_user_message_with_only_remote_images_renders_history_cell() {
         "user-1",
         vec![AppServerUserInput::Image {
             url: remote_image_urls[0].clone(),
+            detail: None,
         }],
         ReplayKind::ResumeInitialMessages,
     );
@@ -414,6 +480,7 @@ async fn replayed_user_message_with_only_local_images_renders_history_cell() {
         permission_profile: PermissionProfile::read_only(),
         active_permission_profile: None,
         cwd: test_path_buf("/home/user/project").abs(),
+        runtime_workspace_roots: Vec::new(),
         instruction_source_paths: Vec::new(),
         reasoning_effort: Some(ReasoningEffortConfig::default()),
         message_history: None,
@@ -427,6 +494,7 @@ async fn replayed_user_message_with_only_local_images_renders_history_cell() {
         "user-1",
         vec![AppServerUserInput::LocalImage {
             path: local_images[0].clone(),
+            detail: None,
         }],
         ReplayKind::ResumeInitialMessages,
     );
@@ -684,6 +752,7 @@ async fn replayed_reasoning_item_hides_raw_reasoning_when_disabled() {
         permission_profile: PermissionProfile::read_only(),
         active_permission_profile: None,
         cwd: test_project_path().abs(),
+        runtime_workspace_roots: Vec::new(),
         instruction_source_paths: Vec::new(),
         reasoning_effort: None,
         message_history: None,
@@ -729,6 +798,7 @@ async fn replayed_reasoning_item_shows_raw_reasoning_when_enabled() {
         permission_profile: PermissionProfile::read_only(),
         active_permission_profile: None,
         cwd: test_project_path().abs(),
+        runtime_workspace_roots: Vec::new(),
         instruction_source_paths: Vec::new(),
         reasoning_effort: None,
         message_history: None,
@@ -756,6 +826,33 @@ async fn replayed_reasoning_item_shows_raw_reasoning_when_enabled() {
     assert!(rendered.contains("Raw reasoning"));
 }
 
+#[tokio::test]
+async fn replayed_in_progress_mcp_tool_call_stays_active() {
+    let (mut chat, mut rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
+    let _ = drain_insert_history(&mut rx);
+
+    chat.replay_thread_item(
+        AppServerThreadItem::McpToolCall {
+            id: "mcp-1".to_string(),
+            server: "copilot-bridge".to_string(),
+            tool: "copilot".to_string(),
+            status: codex_app_server_protocol::McpToolCallStatus::InProgress,
+            arguments: json!({"action": "wait"}),
+            mcp_app_resource_uri: None,
+            result: None,
+            error: None,
+            duration_ms: None,
+        },
+        "turn-1".to_string(),
+        ReplayKind::ThreadSnapshot,
+    );
+
+    assert!(drain_insert_history(&mut rx).is_empty());
+    let active = active_blob(&chat);
+    assert!(active.contains("Calling"));
+    assert!(!active.contains("MCP tool call completed without a result"));
+}
+
 #[tokio::test]
 async fn live_reasoning_summary_is_not_rendered_twice_when_item_completes() {
     let (mut chat, mut rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
diff --git a/codex-rs/tui/src/chatwidget/tests/mcp_startup.rs b/codex-rs/tui/src/chatwidget/tests/mcp_startup.rs
index da4777bfb1..ba862a5293 100644
--- a/codex-rs/tui/src/chatwidget/tests/mcp_startup.rs
+++ b/codex-rs/tui/src/chatwidget/tests/mcp_startup.rs
@@ -57,6 +57,46 @@ async fn mcp_startup_complete_does_not_clear_running_task() {
 
     assert!(chat.bottom_pane.is_task_running());
     assert!(chat.bottom_pane.status_indicator_visible());
+    assert_eq!(chat.status_state.current_status.header, "Working");
+}
+
+#[tokio::test]
+async fn turn_start_preserves_active_mcp_startup_header() {
+    let (mut chat, _rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
+    chat.set_mcp_startup_expected_servers(["schaltwerk".to_string()]);
+
+    notify_mcp_status(&mut chat, "schaltwerk", McpServerStartupState::Starting);
+    handle_turn_started(&mut chat, "turn-1");
+
+    assert!(chat.bottom_pane.is_task_running());
+    assert_eq!(
+        chat.status_state.current_status.header,
+        "Booting MCP server: schaltwerk"
+    );
+
+    notify_mcp_status(&mut chat, "schaltwerk", McpServerStartupState::Ready);
+
+    assert_eq!(chat.status_state.current_status.header, "Working");
+}
+
+#[tokio::test]
+async fn turn_start_replaces_idle_completed_mcp_startup_header() {
+    let (mut chat, _rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
+    chat.set_mcp_startup_expected_servers(["schaltwerk".to_string()]);
+
+    notify_mcp_status(&mut chat, "schaltwerk", McpServerStartupState::Starting);
+    notify_mcp_status(&mut chat, "schaltwerk", McpServerStartupState::Ready);
+
+    assert!(!chat.bottom_pane.is_task_running());
+    assert_eq!(
+        chat.status_state.current_status.header,
+        "Booting MCP server: schaltwerk"
+    );
+
+    handle_turn_started(&mut chat, "turn-1");
+
+    assert!(chat.bottom_pane.is_task_running());
+    assert_eq!(chat.status_state.current_status.header, "Working");
 }
 
 #[tokio::test]
@@ -125,6 +165,82 @@ async fn app_server_mcp_startup_failure_renders_warning_history() {
     );
 }
 
+#[tokio::test]
+async fn mcp_startup_failure_restores_running_status_header() {
+    let (mut chat, mut rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
+    chat.show_welcome_banner = false;
+    chat.set_mcp_startup_expected_servers(["alpha".to_string(), "beta".to_string()]);
+    handle_turn_started(&mut chat, "turn-1");
+
+    notify_mcp_status(&mut chat, "alpha", McpServerStartupState::Starting);
+    notify_mcp_status(&mut chat, "beta", McpServerStartupState::Starting);
+    assert!(
+        chat.status_state
+            .current_status
+            .header
+            .starts_with("Starting MCP servers")
+    );
+
+    notify_mcp_status_error(
+        &mut chat,
+        "alpha",
+        "MCP client for `alpha` failed to start: handshake failed",
+    );
+    notify_mcp_status(&mut chat, "beta", McpServerStartupState::Ready);
+    let _ = drain_insert_history(&mut rx);
+
+    assert!(chat.bottom_pane.is_task_running());
+    assert!(chat.bottom_pane.status_indicator_visible());
+    assert_eq!(chat.status_state.current_status.header, "Working");
+}
+
+#[tokio::test]
+async fn mcp_startup_complete_preserves_review_status() {
+    let (mut chat, _rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
+    chat.show_welcome_banner = false;
+    chat.set_mcp_startup_expected_servers(["alpha".to_string()]);
+    handle_turn_started(&mut chat, "turn-1");
+
+    notify_mcp_status(&mut chat, "alpha", McpServerStartupState::Starting);
+    assert!(
+        chat.status_state
+            .current_status
+            .header
+            .starts_with("Booting MCP server")
+    );
+
+    chat.on_guardian_assessment(GuardianAssessmentEvent {
+        id: "guardian-1".to_string(),
+        target_item_id: Some("guardian-target-1".to_string()),
+        turn_id: "turn-1".to_string(),
+        started_at_ms: 0,
+        completed_at_ms: None,
+        status: GuardianAssessmentStatus::InProgress,
+        risk_level: None,
+        user_authorization: None,
+        rationale: None,
+        decision_source: None,
+        action: GuardianAssessmentAction::Command {
+            source: GuardianCommandSource::Shell,
+            command: "rm -rf '/tmp/guardian target'".to_string(),
+            cwd: test_path_buf("/tmp").abs(),
+        },
+    });
+
+    notify_mcp_status(&mut chat, "alpha", McpServerStartupState::Ready);
+
+    assert!(chat.bottom_pane.is_task_running());
+    assert!(chat.bottom_pane.status_indicator_visible());
+    assert_eq!(
+        chat.status_state.current_status.header,
+        "Reviewing approval request"
+    );
+    assert_eq!(
+        chat.status_state.current_status.details,
+        Some("rm -rf '/tmp/guardian target'".to_string())
+    );
+}
+
 #[tokio::test]
 async fn app_server_mcp_startup_lag_settles_startup_and_ignores_late_updates() {
     let (mut chat, mut rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
diff --git a/codex-rs/tui/src/chatwidget/tests/permissions.rs b/codex-rs/tui/src/chatwidget/tests/permissions.rs
index df3615c0fd..d682d24d66 100644
--- a/codex-rs/tui/src/chatwidget/tests/permissions.rs
+++ b/codex-rs/tui/src/chatwidget/tests/permissions.rs
@@ -1,17 +1,16 @@
 use super::*;
-use codex_app_server_protocol::FileSystemAccessMode;
-use codex_app_server_protocol::FileSystemPath;
-use codex_app_server_protocol::FileSystemSandboxEntry;
-use codex_app_server_protocol::FileSystemSpecialPath;
-use codex_app_server_protocol::PermissionProfile as AppServerPermissionProfile;
-use codex_app_server_protocol::PermissionProfileFileSystemPermissions;
-use codex_app_server_protocol::PermissionProfileNetworkPermissions;
+use codex_protocol::models::ManagedFileSystemPermissions;
+use codex_protocol::permissions::FileSystemAccessMode;
+use codex_protocol::permissions::FileSystemPath;
+use codex_protocol::permissions::FileSystemSandboxEntry;
+use codex_protocol::permissions::FileSystemSpecialPath;
+use codex_protocol::permissions::NetworkSandboxPolicy;
 use pretty_assertions::assert_eq;
 
 fn app_server_workspace_write_profile(extra_root: AbsolutePathBuf) -> PermissionProfile {
-    AppServerPermissionProfile::Managed {
-        network: PermissionProfileNetworkPermissions { enabled: false },
-        file_system: PermissionProfileFileSystemPermissions::Restricted {
+    PermissionProfile::Managed {
+        network: NetworkSandboxPolicy::Restricted,
+        file_system: ManagedFileSystemPermissions::Restricted {
             entries: vec![
                 FileSystemSandboxEntry {
                     path: FileSystemPath::Special {
@@ -45,7 +44,6 @@ fn app_server_workspace_write_profile(extra_root: AbsolutePathBuf) -> Permission
             glob_scan_max_depth: None,
         },
     }
-    .into()
 }
 
 #[tokio::test]
@@ -127,9 +125,9 @@ async fn preset_matching_does_not_treat_non_cwd_writable_profile_as_read_only()
         .into_iter()
         .find(|p| p.id == "read-only")
         .expect("read-only preset exists");
-    let current_profile: PermissionProfile = AppServerPermissionProfile::Managed {
-        network: PermissionProfileNetworkPermissions { enabled: false },
-        file_system: PermissionProfileFileSystemPermissions::Restricted {
+    let current_profile: PermissionProfile = PermissionProfile::Managed {
+        network: NetworkSandboxPolicy::Restricted,
+        file_system: ManagedFileSystemPermissions::Restricted {
             entries: vec![
                 FileSystemSandboxEntry {
                     path: FileSystemPath::Special {
@@ -146,8 +144,7 @@ async fn preset_matching_does_not_treat_non_cwd_writable_profile_as_read_only()
             ],
             glob_scan_max_depth: None,
         },
-    }
-    .into();
+    };
     let cwd = test_path_buf("/tmp/project").abs();
 
     assert!(
@@ -584,6 +581,7 @@ async fn permissions_selection_marks_auto_review_current_after_session_configure
         permission_profile: PermissionProfile::workspace_write(),
         active_permission_profile: None,
         cwd: test_project_path().abs(),
+        runtime_workspace_roots: Vec::new(),
         instruction_source_paths: Vec::new(),
         reasoning_effort: None,
         message_history: None,
@@ -631,6 +629,7 @@ async fn permissions_selection_marks_auto_review_current_with_custom_workspace_w
         permission_profile,
         active_permission_profile: None,
         cwd,
+        runtime_workspace_roots: Vec::new(),
         instruction_source_paths: Vec::new(),
         reasoning_effort: None,
         message_history: None,
@@ -740,7 +739,9 @@ async fn permissions_selection_sends_approvals_reviewer_in_override_turn_context
             cwd: None,
             approval_policy: Some(AskForApproval::OnRequest),
             approvals_reviewer: Some(ApprovalsReviewer::AutoReview),
-            permission_profile: Some(PermissionProfile::workspace_write()),
+            active_permission_profile: Some(ActivePermissionProfile::new(
+                BUILT_IN_PERMISSION_PROFILE_WORKSPACE,
+            )),
             windows_sandbox_level: None,
             model: None,
             effort: None,
@@ -750,6 +751,20 @@ async fn permissions_selection_sends_approvals_reviewer_in_override_turn_context
             personality: None,
         }
     );
+
+    let active_permission_profile_update = std::iter::from_fn(|| rx.try_recv().ok())
+        .find_map(|event| match event {
+            AppEvent::UpdateActivePermissionProfile(active_permission_profile) => {
+                Some(active_permission_profile)
+            }
+            _ => None,
+        })
+        .expect("expected UpdateActivePermissionProfile event");
+
+    assert_eq!(
+        active_permission_profile_update,
+        ActivePermissionProfile::new(BUILT_IN_PERMISSION_PROFILE_WORKSPACE)
+    );
 }
 
 #[tokio::test]
diff --git a/codex-rs/tui/src/chatwidget/tests/plan_mode.rs b/codex-rs/tui/src/chatwidget/tests/plan_mode.rs
index 9b8540e5aa..091f92c3fd 100644
--- a/codex-rs/tui/src/chatwidget/tests/plan_mode.rs
+++ b/codex-rs/tui/src/chatwidget/tests/plan_mode.rs
@@ -1217,6 +1217,7 @@ async fn submit_user_message_emits_structured_plugin_mentions_from_bindings() {
         permission_profile: PermissionProfile::read_only(),
         active_permission_profile: None,
         cwd: test_path_buf("/home/user/project").abs(),
+        runtime_workspace_roots: Vec::new(),
         instruction_source_paths: Vec::new(),
         reasoning_effort: Some(ReasoningEffortConfig::default()),
         message_history: None,
@@ -1367,63 +1368,6 @@ async fn mode_switch_surfaces_reasoning_change_notification_when_model_stays_sam
     );
 }
 
-#[tokio::test]
-async fn collab_slash_command_opens_picker_and_updates_mode() {
-    let (mut chat, mut rx, mut op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
-    chat.thread_id = Some(ThreadId::new());
-    chat.set_feature_enabled(Feature::CollaborationModes, /*enabled*/ true);
-
-    chat.dispatch_command(SlashCommand::Collab);
-    let popup = render_bottom_popup(&chat, /*width*/ 80);
-    assert!(
-        popup.contains("Select Collaboration Mode"),
-        "expected collaboration picker: {popup}"
-    );
-
-    chat.handle_key_event(KeyEvent::from(KeyCode::Enter));
-    let selected_mask = match rx.try_recv() {
-        Ok(AppEvent::UpdateCollaborationMode(mask)) => mask,
-        other => panic!("expected UpdateCollaborationMode event, got {other:?}"),
-    };
-    chat.set_collaboration_mask(selected_mask);
-
-    chat.bottom_pane
-        .set_composer_text("hello".to_string(), Vec::new(), Vec::new());
-    chat.handle_key_event(KeyEvent::from(KeyCode::Enter));
-    match next_submit_op(&mut op_rx) {
-        Op::UserTurn {
-            collaboration_mode:
-                Some(CollaborationMode {
-                    mode: ModeKind::Default,
-                    ..
-                }),
-            personality: Some(Personality::Pragmatic),
-            ..
-        } => {}
-        other => {
-            panic!("expected Op::UserTurn with code collab mode, got {other:?}")
-        }
-    }
-
-    chat.bottom_pane
-        .set_composer_text("follow up".to_string(), Vec::new(), Vec::new());
-    chat.handle_key_event(KeyEvent::from(KeyCode::Enter));
-    match next_submit_op(&mut op_rx) {
-        Op::UserTurn {
-            collaboration_mode:
-                Some(CollaborationMode {
-                    mode: ModeKind::Default,
-                    ..
-                }),
-            personality: Some(Personality::Pragmatic),
-            ..
-        } => {}
-        other => {
-            panic!("expected Op::UserTurn with code collab mode, got {other:?}")
-        }
-    }
-}
-
 #[tokio::test]
 async fn plan_slash_command_switches_to_plan_mode() {
     let (mut chat, mut rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
@@ -1460,6 +1404,7 @@ async fn plan_slash_command_with_args_submits_prompt_in_plan_mode() {
         permission_profile: PermissionProfile::read_only(),
         active_permission_profile: None,
         cwd: test_path_buf("/home/user/project").abs(),
+        runtime_workspace_roots: Vec::new(),
         instruction_source_paths: Vec::new(),
         reasoning_effort: Some(ReasoningEffortConfig::default()),
         message_history: None,
@@ -1536,7 +1481,6 @@ async fn make_startup_chat_with_cli_overrides(
     let session_telemetry = test_session_telemetry(&cfg, resolved_model.as_str());
     let init = ChatWidgetInit {
         config: cfg.clone(),
-        environment_manager: Arc::new(codex_exec_server::EnvironmentManager::default_for_tests()),
         frame_requester: FrameRequester::test_dummy(),
         app_event_tx: AppEventSender::new(unbounded_channel::<AppEvent>().0),
         workspace_command_runner: None,
diff --git a/codex-rs/tui/src/chatwidget/tests/popups_and_settings.rs b/codex-rs/tui/src/chatwidget/tests/popups_and_settings.rs
index 4f4398d349..2a25415c03 100644
--- a/codex-rs/tui/src/chatwidget/tests/popups_and_settings.rs
+++ b/codex-rs/tui/src/chatwidget/tests/popups_and_settings.rs
@@ -1,4 +1,6 @@
 use super::*;
+use crate::app_event::ConnectorsSnapshot;
+use crate::chatwidget::connectors::ConnectorsCacheState;
 use codex_app_server_protocol::AppInfo;
 use codex_app_server_protocol::HookErrorInfo;
 use codex_app_server_protocol::HooksListEntry;
@@ -70,7 +72,6 @@ async fn experimental_mode_plan_is_ignored_on_startup() {
     let session_telemetry = test_session_telemetry(&cfg, resolved_model.as_str());
     let init = ChatWidgetInit {
         config: cfg.clone(),
-        environment_manager: Arc::new(codex_exec_server::EnvironmentManager::default_for_tests()),
         frame_requester: FrameRequester::test_dummy(),
         app_event_tx: AppEventSender::new(unbounded_channel::<AppEvent>().0),
         workspace_command_runner: None,
@@ -1857,198 +1858,6 @@ async fn apps_popup_shows_disabled_status_for_installed_but_disabled_apps() {
     );
 }
 
-#[tokio::test]
-async fn apps_initial_load_applies_enabled_state_from_config() {
-    let (mut chat, _rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
-    set_chatgpt_auth(&mut chat);
-    chat.config
-        .features
-        .enable(Feature::Apps)
-        .expect("test config should allow feature update");
-    chat.bottom_pane.set_connectors_enabled(/*enabled*/ true);
-
-    let temp = tempdir().expect("tempdir");
-    let config_toml_path = temp.path().join("config.toml").abs();
-    let user_config = toml::from_str::<TomlValue>(
-        "[apps.connector_1]\nenabled = false\ndisabled_reason = \"user\"\n",
-    )
-    .expect("apps config");
-    chat.config.config_layer_stack = chat
-        .config
-        .config_layer_stack
-        .with_user_config(&config_toml_path, user_config);
-
-    chat.on_connectors_loaded(
-        Ok(ConnectorsSnapshot {
-            connectors: vec![AppInfo {
-                id: "connector_1".to_string(),
-                name: "Notion".to_string(),
-                description: Some("Workspace docs".to_string()),
-                logo_url: None,
-                logo_url_dark: None,
-                distribution_channel: None,
-                branding: None,
-                app_metadata: None,
-                labels: None,
-                install_url: Some("https://example.test/notion".to_string()),
-                is_accessible: true,
-                is_enabled: true,
-                plugin_display_names: Vec::new(),
-            }],
-        }),
-        /*is_final*/ true,
-    );
-
-    assert_matches!(
-        &chat.connectors.cache,
-        ConnectorsCacheState::Ready(snapshot)
-            if snapshot
-                .connectors
-                .iter()
-                .find(|connector| connector.id == "connector_1")
-                .is_some_and(|connector| !connector.is_enabled)
-    );
-}
-
-#[tokio::test]
-async fn apps_initial_load_applies_enabled_state_from_requirements_with_user_override() {
-    let (mut chat, _rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
-    set_chatgpt_auth(&mut chat);
-    chat.config
-        .features
-        .enable(Feature::Apps)
-        .expect("test config should allow feature update");
-    chat.bottom_pane.set_connectors_enabled(/*enabled*/ true);
-
-    let requirements = ConfigRequirementsToml {
-        apps: Some(AppsRequirementsToml {
-            apps: BTreeMap::from([(
-                "connector_1".to_string(),
-                AppRequirementToml {
-                    enabled: Some(false),
-                    tools: None,
-                },
-            )]),
-        }),
-        ..Default::default()
-    };
-    let temp = tempdir().expect("tempdir");
-    let config_toml_path = temp.path().join("config.toml").abs();
-    chat.config.config_layer_stack =
-        ConfigLayerStack::new(Vec::new(), ConfigRequirements::default(), requirements)
-            .expect("requirements stack")
-            .with_user_config(
-                &config_toml_path,
-                toml::from_str::<TomlValue>(
-                    "[apps.connector_1]\nenabled = true\ndisabled_reason = \"user\"\n",
-                )
-                .expect("apps config"),
-            );
-
-    chat.on_connectors_loaded(
-        Ok(ConnectorsSnapshot {
-            connectors: vec![AppInfo {
-                id: "connector_1".to_string(),
-                name: "Notion".to_string(),
-                description: Some("Workspace docs".to_string()),
-                logo_url: None,
-                logo_url_dark: None,
-                distribution_channel: None,
-                branding: None,
-                app_metadata: None,
-                labels: None,
-                install_url: Some("https://example.test/notion".to_string()),
-                is_accessible: true,
-                is_enabled: true,
-                plugin_display_names: Vec::new(),
-            }],
-        }),
-        /*is_final*/ true,
-    );
-
-    assert_matches!(
-        &chat.connectors.cache,
-        ConnectorsCacheState::Ready(snapshot)
-            if snapshot
-                .connectors
-                .iter()
-                .find(|connector| connector.id == "connector_1")
-                .is_some_and(|connector| !connector.is_enabled)
-    );
-
-    chat.add_connectors_output();
-    let popup = render_bottom_popup(&chat, /*width*/ 80);
-    assert!(
-        popup.contains("Installed · Disabled. Press Enter to open the app page"),
-        "expected requirements-disabled connector to render as disabled, got:\n{popup}"
-    );
-}
-
-#[tokio::test]
-async fn apps_initial_load_applies_enabled_state_from_requirements_without_user_entry() {
-    let (mut chat, _rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
-    set_chatgpt_auth(&mut chat);
-    chat.config
-        .features
-        .enable(Feature::Apps)
-        .expect("test config should allow feature update");
-    chat.bottom_pane.set_connectors_enabled(/*enabled*/ true);
-
-    let requirements = ConfigRequirementsToml {
-        apps: Some(AppsRequirementsToml {
-            apps: BTreeMap::from([(
-                "connector_1".to_string(),
-                AppRequirementToml {
-                    enabled: Some(false),
-                    tools: None,
-                },
-            )]),
-        }),
-        ..Default::default()
-    };
-    chat.config.config_layer_stack =
-        ConfigLayerStack::new(Vec::new(), ConfigRequirements::default(), requirements)
-            .expect("requirements stack");
-
-    chat.on_connectors_loaded(
-        Ok(ConnectorsSnapshot {
-            connectors: vec![AppInfo {
-                id: "connector_1".to_string(),
-                name: "Notion".to_string(),
-                description: Some("Workspace docs".to_string()),
-                logo_url: None,
-                logo_url_dark: None,
-                distribution_channel: None,
-                branding: None,
-                app_metadata: None,
-                labels: None,
-                install_url: Some("https://example.test/notion".to_string()),
-                is_accessible: true,
-                is_enabled: true,
-                plugin_display_names: Vec::new(),
-            }],
-        }),
-        /*is_final*/ true,
-    );
-
-    assert_matches!(
-        &chat.connectors.cache,
-        ConnectorsCacheState::Ready(snapshot)
-            if snapshot
-                .connectors
-                .iter()
-                .find(|connector| connector.id == "connector_1")
-                .is_some_and(|connector| !connector.is_enabled)
-    );
-
-    chat.add_connectors_output();
-    let popup = render_bottom_popup(&chat, /*width*/ 80);
-    assert!(
-        popup.contains("Installed · Disabled. Press Enter to open the app page"),
-        "expected requirements-disabled connector to render as disabled, got:\n{popup}"
-    );
-}
-
 #[tokio::test]
 async fn apps_refresh_preserves_toggled_enabled_state() {
     let (mut chat, _rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
diff --git a/codex-rs/tui/src/chatwidget/tests/review_mode.rs b/codex-rs/tui/src/chatwidget/tests/review_mode.rs
index 8c16e0b929..48bc341f6b 100644
--- a/codex-rs/tui/src/chatwidget/tests/review_mode.rs
+++ b/codex-rs/tui/src/chatwidget/tests/review_mode.rs
@@ -597,6 +597,7 @@ async fn item_completed_pops_pending_steer_with_local_image_and_text_elements()
         vec![
             UserInput::Image {
                 url: "data:image/png;base64,placeholder".to_string(),
+                detail: None,
             },
             UserInput::Text {
                 text,
diff --git a/codex-rs/tui/src/chatwidget/tests/side.rs b/codex-rs/tui/src/chatwidget/tests/side.rs
index 2f2a6d3356..906deb3b56 100644
--- a/codex-rs/tui/src/chatwidget/tests/side.rs
+++ b/codex-rs/tui/src/chatwidget/tests/side.rs
@@ -106,7 +106,7 @@ async fn slash_commands_without_side_flag_are_rejected_for_side_threads() {
             let rendered = lines_to_single_string(&cell.display_lines(/*width*/ 80));
             assert!(
                 rendered.contains(
-                    "'/review' is unavailable in side conversations. Press Esc to return to the main thread first."
+                    "'/review' is unavailable in side conversations. Press Ctrl+C to return to the main thread first."
                 ),
                 "expected side conversation slash command error, got {rendered:?}"
             );
@@ -132,7 +132,7 @@ async fn slash_side_is_rejected_for_side_threads() {
             let rendered = lines_to_single_string(&cell.display_lines(/*width*/ 80));
             assert!(
                 rendered.contains(
-                    "'/side' is unavailable in side conversations. Press Esc to return to the main thread first."
+                    "'/side' is unavailable in side conversations. Press Ctrl+C to return to the main thread first."
                 ),
                 "expected side conversation slash command error, got {rendered:?}"
             );
@@ -276,7 +276,7 @@ async fn side_context_label_preserves_status_line_snapshot() {
     chat.refresh_status_line();
     chat.set_side_conversation_active(/*active*/ true);
     chat.set_side_conversation_context_label(Some(
-        "Side from main thread · Esc to return".to_string(),
+        "Side from main thread · Ctrl+C to return".to_string(),
     ));
 
     let width = 80;
@@ -297,7 +297,7 @@ async fn side_context_label_shows_parent_status_snapshot() {
     chat.show_welcome_banner = false;
     chat.set_side_conversation_active(/*active*/ true);
     chat.set_side_conversation_context_label(Some(
-        "Side from main thread · main needs input · Esc to return".to_string(),
+        "Side from main thread · main needs input · Ctrl+C to return".to_string(),
     ));
 
     let width = 80;
diff --git a/codex-rs/tui/src/chatwidget/tests/slash_commands.rs b/codex-rs/tui/src/chatwidget/tests/slash_commands.rs
index e4865e64f3..c8c0f60584 100644
--- a/codex-rs/tui/src/chatwidget/tests/slash_commands.rs
+++ b/codex-rs/tui/src/chatwidget/tests/slash_commands.rs
@@ -15,6 +15,18 @@ fn force_tmux_pet_image_unsupported(chat: &mut ChatWidget) {
     ));
 }
 
+fn force_terminal_pet_image_unsupported(chat: &mut ChatWidget) {
+    chat.set_pet_image_support_for_tests(crate::pets::PetImageSupport::Unsupported(
+        crate::pets::PetImageUnsupportedReason::Terminal,
+    ));
+}
+
+fn force_old_iterm2_pet_image_unsupported(chat: &mut ChatWidget) {
+    chat.set_pet_image_support_for_tests(crate::pets::PetImageSupport::Unsupported(
+        crate::pets::PetImageUnsupportedReason::Iterm2TooOld,
+    ));
+}
+
 fn fast_tier_command() -> ServiceTierCommand {
     ServiceTierCommand {
         id: ServiceTier::Fast.request_value().to_string(),
@@ -1934,6 +1946,44 @@ async fn slash_pets_with_arg_on_unsupported_terminal_warns_without_selection() {
     assert_matches!(op_rx.try_recv(), Err(TryRecvError::Empty));
 }
 
+#[tokio::test]
+#[serial]
+async fn slash_pets_on_unsupported_terminal_shows_terminal_warning() {
+    let (mut chat, mut rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
+    force_terminal_pet_image_unsupported(&mut chat);
+
+    chat.dispatch_command(SlashCommand::Pets);
+
+    assert!(!chat.bottom_pane.has_active_view());
+    let cells = drain_insert_history(&mut rx);
+    let rendered = cells
+        .iter()
+        .map(|lines| lines_to_single_string(lines))
+        .collect::<Vec<_>>()
+        .join("\n");
+    assert!(rendered.contains("Pets aren’t available in this terminal."));
+    assert!(rendered.contains("Kitty graphics or Sixel support"));
+}
+
+#[tokio::test]
+#[serial]
+async fn slash_pets_on_old_iterm2_shows_upgrade_warning() {
+    let (mut chat, mut rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
+    force_old_iterm2_pet_image_unsupported(&mut chat);
+
+    chat.dispatch_command(SlashCommand::Pets);
+
+    assert!(!chat.bottom_pane.has_active_view());
+    let cells = drain_insert_history(&mut rx);
+    let rendered = cells
+        .iter()
+        .map(|lines| lines_to_single_string(lines))
+        .collect::<Vec<_>>()
+        .join("\n");
+    assert!(rendered.contains("Pets require iTerm2 3.6 or newer."));
+    assert!(rendered.contains("Upgrade iTerm2 to use terminal pets."));
+}
+
 #[tokio::test]
 async fn slash_fork_requests_current_fork() {
     let (mut chat, mut rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
diff --git a/codex-rs/tui/src/chatwidget/tests/snapshots/codex_tui__chatwidget__tests__approval_requests__network_exec_approval_history_canceled_host_request.snap b/codex-rs/tui/src/chatwidget/tests/snapshots/codex_tui__chatwidget__tests__approval_requests__network_exec_approval_history_canceled_host_request.snap
new file mode 100644
index 0000000000..3d09cd7087
--- /dev/null
+++ b/codex-rs/tui/src/chatwidget/tests/snapshots/codex_tui__chatwidget__tests__approval_requests__network_exec_approval_history_canceled_host_request.snap
@@ -0,0 +1,6 @@
+---
+source: tui/src/chatwidget/tests/approval_requests.rs
+expression: lines_to_single_string(&decision)
+---
+✗ You canceled the request for codex network access to
+  socks5-tcp://example.com:1080
diff --git a/codex-rs/tui/src/chatwidget/tests/snapshots/codex_tui__chatwidget__tests__approval_requests__network_exec_approval_history_one_time_host_allowance.snap b/codex-rs/tui/src/chatwidget/tests/snapshots/codex_tui__chatwidget__tests__approval_requests__network_exec_approval_history_one_time_host_allowance.snap
new file mode 100644
index 0000000000..4b56b187aa
--- /dev/null
+++ b/codex-rs/tui/src/chatwidget/tests/snapshots/codex_tui__chatwidget__tests__approval_requests__network_exec_approval_history_one_time_host_allowance.snap
@@ -0,0 +1,5 @@
+---
+source: tui/src/chatwidget/tests/approval_requests.rs
+expression: lines_to_single_string(&decision)
+---
+✔ You approved codex network access to http://example.com this time
diff --git a/codex-rs/tui/src/chatwidget/tests/snapshots/codex_tui__chatwidget__tests__approval_requests__network_exec_approval_history_session_host_allowance.snap b/codex-rs/tui/src/chatwidget/tests/snapshots/codex_tui__chatwidget__tests__approval_requests__network_exec_approval_history_session_host_allowance.snap
new file mode 100644
index 0000000000..e5197e9e71
--- /dev/null
+++ b/codex-rs/tui/src/chatwidget/tests/snapshots/codex_tui__chatwidget__tests__approval_requests__network_exec_approval_history_session_host_allowance.snap
@@ -0,0 +1,6 @@
+---
+source: tui/src/chatwidget/tests/approval_requests.rs
+expression: lines_to_single_string(&decision)
+---
+✔ You approved codex network access to https://example.com:8443 every time this
+  session
diff --git a/codex-rs/tui/src/chatwidget/tests/status_and_layout.rs b/codex-rs/tui/src/chatwidget/tests/status_and_layout.rs
index 521fd644eb..f49d4ac0d4 100644
--- a/codex-rs/tui/src/chatwidget/tests/status_and_layout.rs
+++ b/codex-rs/tui/src/chatwidget/tests/status_and_layout.rs
@@ -1,5 +1,7 @@
 use super::*;
 use crate::bottom_pane::goal_status_indicator_line;
+use crate::chatwidget::rate_limits::NUDGE_MODEL_SLUG;
+use crate::chatwidget::rate_limits::get_limits_duration;
 use pretty_assertions::assert_eq;
 use ratatui::backend::TestBackend;
 use serial_test::serial;
@@ -412,7 +414,6 @@ async fn configured_pet_load_is_deferred_until_after_construction() {
     let session_telemetry = test_session_telemetry(&cfg, resolved_model.as_str());
     let init = ChatWidgetInit {
         config: cfg.clone(),
-        environment_manager: Arc::new(codex_exec_server::EnvironmentManager::default_for_tests()),
         frame_requester: FrameRequester::test_dummy(),
         app_event_tx: tx,
         workspace_command_runner: None,
@@ -516,6 +517,227 @@ async fn test_rate_limit_warnings_monthly() {
     );
 }
 
+#[test]
+fn rate_limit_duration_labels_only_render_supported_windows() {
+    assert_eq!(get_limits_duration(2 * 60), None);
+    assert_eq!(get_limits_duration(24 * 60).as_deref(), Some("daily"));
+    assert_eq!(
+        get_limits_duration(365 * 24 * 60).as_deref(),
+        Some("annual")
+    );
+}
+
+#[tokio::test]
+async fn test_rate_limit_warnings_use_generic_fallback_labels() {
+    let mut state = RateLimitWarningState::default();
+
+    assert_eq!(
+        state.take_warnings(
+            /*secondary_used_percent*/ Some(75.0),
+            /*secondary_window_minutes*/ None,
+            /*primary_used_percent*/ Some(75.0),
+            /*primary_window_minutes*/ None,
+        ),
+        vec![
+            String::from(
+                "Heads up, you have less than 25% of your secondary usage limit left. Run /status for a breakdown.",
+            ),
+            String::from(
+                "Heads up, you have less than 25% of your usage limit left. Run /status for a breakdown.",
+            ),
+        ],
+    );
+}
+
+#[tokio::test]
+async fn test_rate_limit_warnings_use_secondary_fallback_for_unsupported_window() {
+    let mut state = RateLimitWarningState::default();
+
+    assert_eq!(
+        state.take_warnings(
+            /*secondary_used_percent*/ Some(75.0),
+            /*secondary_window_minutes*/ Some(2 * 60),
+            /*primary_used_percent*/ None,
+            /*primary_window_minutes*/ None,
+        ),
+        vec![String::from(
+            "Heads up, you have less than 25% of your secondary usage limit left. Run /status for a breakdown.",
+        )],
+    );
+}
+
+#[tokio::test]
+async fn status_line_uses_secondary_fallback_for_unsupported_window() {
+    let (mut chat, _rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
+
+    chat.on_rate_limit_snapshot(Some(RateLimitSnapshot {
+        limit_id: None,
+        limit_name: None,
+        primary: None,
+        secondary: Some(RateLimitWindow {
+            used_percent: 50,
+            window_duration_mins: Some(2 * 60),
+            resets_at: None,
+        }),
+        credits: None,
+        plan_type: None,
+        rate_limit_reached_type: None,
+    }));
+
+    assert_eq!(
+        chat.status_line_value_for_item(crate::bottom_pane::StatusLineItem::WeeklyLimit),
+        Some("secondary usage 50%".to_string())
+    );
+}
+
+#[tokio::test]
+async fn status_line_legacy_limit_items_prefer_matching_windows() {
+    let (mut chat, _rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
+
+    chat.on_rate_limit_snapshot(Some(RateLimitSnapshot {
+        limit_id: None,
+        limit_name: None,
+        primary: Some(RateLimitWindow {
+            used_percent: 94,
+            window_duration_mins: Some(7 * 24 * 60),
+            resets_at: None,
+        }),
+        secondary: Some(RateLimitWindow {
+            used_percent: 40,
+            window_duration_mins: Some(5 * 60),
+            resets_at: None,
+        }),
+        credits: None,
+        plan_type: None,
+        rate_limit_reached_type: None,
+    }));
+
+    assert_eq!(
+        chat.status_line_value_for_item(crate::bottom_pane::StatusLineItem::FiveHourLimit),
+        Some("5h 60%".to_string())
+    );
+    assert_eq!(
+        chat.status_line_value_for_item(crate::bottom_pane::StatusLineItem::WeeklyLimit),
+        Some("weekly 6%".to_string())
+    );
+}
+
+#[tokio::test]
+async fn status_line_shows_secondary_non_weekly_when_primary_is_weekly() {
+    let (mut chat, _rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
+
+    chat.on_rate_limit_snapshot(Some(RateLimitSnapshot {
+        limit_id: None,
+        limit_name: None,
+        primary: Some(RateLimitWindow {
+            used_percent: 94,
+            window_duration_mins: Some(7 * 24 * 60),
+            resets_at: None,
+        }),
+        secondary: Some(RateLimitWindow {
+            used_percent: 35,
+            window_duration_mins: Some(30 * 24 * 60),
+            resets_at: None,
+        }),
+        credits: None,
+        plan_type: None,
+        rate_limit_reached_type: None,
+    }));
+
+    assert_eq!(
+        chat.status_line_value_for_item(crate::bottom_pane::StatusLineItem::FiveHourLimit),
+        Some("monthly 65%".to_string())
+    );
+    assert_eq!(
+        chat.status_line_value_for_item(crate::bottom_pane::StatusLineItem::WeeklyLimit),
+        Some("weekly 6%".to_string())
+    );
+}
+
+#[tokio::test]
+async fn status_line_five_hour_item_omits_weekly_only_limit() {
+    let (mut chat, _rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
+
+    chat.on_rate_limit_snapshot(Some(RateLimitSnapshot {
+        limit_id: None,
+        limit_name: None,
+        primary: Some(RateLimitWindow {
+            used_percent: 9,
+            window_duration_mins: Some(7 * 24 * 60),
+            resets_at: None,
+        }),
+        secondary: None,
+        credits: None,
+        plan_type: None,
+        rate_limit_reached_type: None,
+    }));
+
+    assert_eq!(
+        chat.status_line_value_for_item(crate::bottom_pane::StatusLineItem::FiveHourLimit),
+        None
+    );
+    assert_eq!(
+        chat.status_line_value_for_item(crate::bottom_pane::StatusLineItem::WeeklyLimit),
+        Some("weekly 91%".to_string())
+    );
+}
+
+#[tokio::test]
+async fn status_line_single_monthly_primary_omits_weekly_limit_item() {
+    let (mut chat, _rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
+
+    chat.on_rate_limit_snapshot(Some(RateLimitSnapshot {
+        limit_id: None,
+        limit_name: None,
+        primary: Some(RateLimitWindow {
+            used_percent: 35,
+            window_duration_mins: Some(30 * 24 * 60),
+            resets_at: None,
+        }),
+        secondary: None,
+        credits: None,
+        plan_type: None,
+        rate_limit_reached_type: None,
+    }));
+
+    assert_eq!(
+        chat.status_line_value_for_item(crate::bottom_pane::StatusLineItem::FiveHourLimit),
+        Some("monthly 65%".to_string())
+    );
+    assert_eq!(
+        chat.status_line_value_for_item(crate::bottom_pane::StatusLineItem::WeeklyLimit),
+        None
+    );
+}
+
+#[tokio::test]
+async fn status_line_secondary_only_non_weekly_limit_omits_primary_limit_item() {
+    let (mut chat, _rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
+
+    chat.on_rate_limit_snapshot(Some(RateLimitSnapshot {
+        limit_id: None,
+        limit_name: None,
+        primary: None,
+        secondary: Some(RateLimitWindow {
+            used_percent: 35,
+            window_duration_mins: Some(30 * 24 * 60),
+            resets_at: None,
+        }),
+        credits: None,
+        plan_type: None,
+        rate_limit_reached_type: None,
+    }));
+
+    assert_eq!(
+        chat.status_line_value_for_item(crate::bottom_pane::StatusLineItem::FiveHourLimit),
+        None
+    );
+    assert_eq!(
+        chat.status_line_value_for_item(crate::bottom_pane::StatusLineItem::WeeklyLimit),
+        Some("monthly 65%".to_string())
+    );
+}
+
 #[tokio::test]
 async fn rate_limit_snapshot_keeps_prior_credits_when_missing_from_headers() {
     let (mut chat, _rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
@@ -1135,6 +1357,45 @@ async fn streaming_final_answer_keeps_task_running_state() {
     assert!(!chat.bottom_pane.quit_shortcut_hint_visible());
 }
 
+#[tokio::test]
+async fn ctrl_c_interrupt_pauses_active_goal_turn() {
+    let (mut chat, mut rx, mut op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
+    let thread_id = ThreadId::new();
+    chat.set_feature_enabled(Feature::Goals, /*enabled*/ true);
+    chat.thread_id = Some(thread_id);
+    let mut goal = test_thread_goal(
+        codex_app_server_protocol::ThreadGoalStatus::Active,
+        /*token_budget*/ Some(50_000),
+        /*tokens_used*/ 40_000,
+    );
+    goal.thread_id = thread_id.to_string();
+    chat.handle_server_notification(
+        ServerNotification::ThreadGoalUpdated(
+            codex_app_server_protocol::ThreadGoalUpdatedNotification {
+                thread_id: thread_id.to_string(),
+                turn_id: None,
+                goal,
+            },
+        ),
+        /*replay_kind*/ None,
+    );
+    chat.on_task_started();
+
+    chat.handle_key_event(KeyEvent::new(KeyCode::Char('c'), KeyModifiers::CONTROL));
+
+    match op_rx.try_recv() {
+        Ok(Op::Interrupt) => {}
+        other => panic!("expected Op::Interrupt, got {other:?}"),
+    }
+    assert_matches!(
+        rx.try_recv(),
+        Ok(AppEvent::SetThreadGoalStatus {
+            thread_id: event_thread_id,
+            status: AppThreadGoalStatus::Paused,
+        }) if event_thread_id == thread_id
+    );
+}
+
 #[tokio::test]
 async fn idle_commit_ticks_do_not_restore_status_without_commentary_completion() {
     let (mut chat, mut rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
@@ -2229,6 +2490,7 @@ async fn session_configured_clears_goal_status_footer() {
         permission_profile: PermissionProfile::read_only(),
         active_permission_profile: None,
         cwd: test_path_buf("/home/user/project").abs(),
+        runtime_workspace_roots: Vec::new(),
         instruction_source_paths: Vec::new(),
         reasoning_effort: Some(ReasoningEffortConfig::default()),
         message_history: None,
@@ -2291,6 +2553,22 @@ fn goal_status_indicator_formats_statuses_and_budgets() {
             usage: Some("30m".to_string()),
         })
     );
+    assert_eq!(
+        goal_status_indicator_from_app_goal(&test_thread_goal(
+            codex_app_server_protocol::ThreadGoalStatus::Blocked,
+            /*token_budget*/ None,
+            /*tokens_used*/ 0,
+        )),
+        Some(GoalStatusIndicator::Blocked)
+    );
+    assert_eq!(
+        goal_status_indicator_from_app_goal(&test_thread_goal(
+            codex_app_server_protocol::ThreadGoalStatus::UsageLimited,
+            /*token_budget*/ None,
+            /*tokens_used*/ 0,
+        )),
+        Some(GoalStatusIndicator::UsageLimited)
+    );
     assert_eq!(
         goal_status_indicator_from_app_goal(&test_thread_goal(
             codex_app_server_protocol::ThreadGoalStatus::BudgetLimited,
@@ -2337,6 +2615,11 @@ fn goal_status_indicator_line_formats_goal_text() {
             "Goal unmet (4K / 5K tokens)",
         ),
         (GoalStatusIndicator::Paused, "Goal paused (/goal resume)"),
+        (GoalStatusIndicator::Blocked, "Goal blocked (/goal resume)"),
+        (
+            GoalStatusIndicator::UsageLimited,
+            "Goal hit usage limits (/goal resume)",
+        ),
         (
             GoalStatusIndicator::BudgetLimited { usage: None },
             "Goal abandoned",
diff --git a/codex-rs/tui/src/chatwidget/tests/status_surface_previews.rs b/codex-rs/tui/src/chatwidget/tests/status_surface_previews.rs
index 8837f04d8d..b9433ace84 100644
--- a/codex-rs/tui/src/chatwidget/tests/status_surface_previews.rs
+++ b/codex-rs/tui/src/chatwidget/tests/status_surface_previews.rs
@@ -10,12 +10,15 @@ fn line_text(line: Line<'static>) -> String {
         .collect()
 }
 
-fn status_preview_line(chat: &mut ChatWidget, items: &[StatusLineItem]) -> String {
+fn status_preview_line_option(chat: &mut ChatWidget, items: &[StatusLineItem]) -> Option<String> {
     let preview_data = chat.status_surface_preview_data();
-    let preview = preview_data
+    preview_data
         .status_line_for_items(items.iter().copied(), /*use_theme_colors*/ true)
-        .expect("status preview line");
-    line_text(preview)
+        .map(line_text)
+}
+
+fn status_preview_line(chat: &mut ChatWidget, items: &[StatusLineItem]) -> String {
+    status_preview_line_option(chat, items).expect("status preview line")
 }
 
 fn title_preview_line(chat: &mut ChatWidget, items: &[TerminalTitleItem]) -> String {
@@ -58,6 +61,26 @@ fn cache_project_root(chat: &mut ChatWidget, root_name: &str) {
     });
 }
 
+fn cache_rate_limit_snapshot(chat: &mut ChatWidget) {
+    chat.on_rate_limit_snapshot(Some(RateLimitSnapshot {
+        limit_id: None,
+        limit_name: None,
+        primary: Some(RateLimitWindow {
+            used_percent: 35,
+            window_duration_mins: Some(30 * 24 * 60),
+            resets_at: None,
+        }),
+        secondary: Some(RateLimitWindow {
+            used_percent: 50,
+            window_duration_mins: Some(7 * 24 * 60),
+            resets_at: None,
+        }),
+        credits: None,
+        plan_type: None,
+        rate_limit_reached_type: None,
+    }));
+}
+
 #[tokio::test]
 async fn status_surface_preview_lines_live_only_snapshot() {
     let (mut chat, _rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
@@ -179,6 +202,79 @@ async fn status_surface_preview_lines_mixed_snapshot() {
     assert_chatwidget_snapshot!("status_surface_previews_mixed", snapshot);
 }
 
+#[tokio::test]
+async fn status_surface_preview_lines_rate_limits_snapshot() {
+    let (mut chat, _rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
+    cache_rate_limit_snapshot(&mut chat);
+
+    let snapshot = combined_preview_snapshot(
+        &mut chat,
+        &[StatusLineItem::FiveHourLimit, StatusLineItem::WeeklyLimit],
+        &[
+            TerminalTitleItem::FiveHourLimit,
+            TerminalTitleItem::WeeklyLimit,
+        ],
+    );
+
+    assert_chatwidget_snapshot!("status_surface_previews_rate_limits", snapshot);
+}
+
+#[tokio::test]
+async fn status_surface_preview_omits_unavailable_rate_limit_items() {
+    let (mut chat, _rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
+
+    chat.on_rate_limit_snapshot(Some(RateLimitSnapshot {
+        limit_id: None,
+        limit_name: None,
+        primary: Some(RateLimitWindow {
+            used_percent: 9,
+            window_duration_mins: Some(7 * 24 * 60),
+            resets_at: None,
+        }),
+        secondary: None,
+        credits: None,
+        plan_type: None,
+        rate_limit_reached_type: None,
+    }));
+
+    assert_eq!(
+        status_preview_line_option(&mut chat, &[StatusLineItem::FiveHourLimit]),
+        None
+    );
+    assert_eq!(
+        status_preview_line(
+            &mut chat,
+            &[StatusLineItem::FiveHourLimit, StatusLineItem::WeeklyLimit]
+        ),
+        "weekly 91%"
+    );
+    assert_eq!(
+        title_preview_line(
+            &mut chat,
+            &[
+                TerminalTitleItem::FiveHourLimit,
+                TerminalTitleItem::WeeklyLimit
+            ],
+        ),
+        "weekly 91%"
+    );
+}
+
+#[tokio::test]
+async fn status_line_setup_popup_rate_limits_snapshot() {
+    let (mut chat, _rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
+    cache_rate_limit_snapshot(&mut chat);
+    chat.config.tui_status_line = Some(vec![
+        "five-hour-limit".to_string(),
+        "weekly-limit".to_string(),
+    ]);
+
+    assert_chatwidget_snapshot!(
+        "status_line_setup_popup_rate_limits",
+        status_line_popup_snapshot(&mut chat)
+    );
+}
+
 #[tokio::test]
 async fn status_line_setup_popup_mixed_snapshot() {
     let (mut chat, _rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
@@ -247,6 +343,21 @@ async fn terminal_title_setup_popup_mixed_snapshot() {
     );
 }
 
+#[tokio::test]
+async fn terminal_title_setup_popup_rate_limits_snapshot() {
+    let (mut chat, _rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
+    cache_rate_limit_snapshot(&mut chat);
+    chat.config.tui_terminal_title = Some(vec![
+        "five-hour-limit".to_string(),
+        "weekly-limit".to_string(),
+    ]);
+
+    assert_chatwidget_snapshot!(
+        "terminal_title_setup_popup_rate_limits",
+        terminal_title_popup_snapshot(&mut chat)
+    );
+}
+
 #[tokio::test]
 async fn missing_project_root_uses_different_status_and_title_preview_sources() {
     let (mut chat, _rx, _op_rx) = make_chatwidget_manual(/*model_override*/ None).await;
diff --git a/codex-rs/tui/src/chatwidget/tool_requests.rs b/codex-rs/tui/src/chatwidget/tool_requests.rs
index 7ec567325b..c5c425b64f 100644
--- a/codex-rs/tui/src/chatwidget/tool_requests.rs
+++ b/codex-rs/tui/src/chatwidget/tool_requests.rs
@@ -149,7 +149,7 @@ impl ChatWidget {
         if ev.status == GuardianAssessmentStatus::Approved {
             let cell = if let Some(command) = guardian_command(&ev.action) {
                 history_cell::new_approval_decision_cell(
-                    command,
+                    history_cell::ApprovalDecisionSubject::Command(command),
                     crate::history_cell::ReviewDecision::Approved,
                     history_cell::ApprovalDecisionActor::Guardian,
                 )
@@ -169,7 +169,7 @@ impl ChatWidget {
         if ev.status == GuardianAssessmentStatus::TimedOut {
             let cell = if let Some(command) = guardian_command(&ev.action) {
                 history_cell::new_approval_decision_cell(
-                    command,
+                    history_cell::ApprovalDecisionSubject::Command(command),
                     crate::history_cell::ReviewDecision::TimedOut,
                     history_cell::ApprovalDecisionActor::Guardian,
                 )
@@ -213,7 +213,7 @@ impl ChatWidget {
         self.review.recent_auto_review_denials.push(ev.clone());
         let cell = if let Some(command) = guardian_command(&ev.action) {
             history_cell::new_approval_decision_cell(
-                command,
+                history_cell::ApprovalDecisionSubject::Command(command),
                 crate::history_cell::ReviewDecision::Denied,
                 history_cell::ApprovalDecisionActor::Guardian,
             )
@@ -341,7 +341,8 @@ impl ChatWidget {
             server_name: params.server_name.clone(),
         });
 
-        let thread_id = self.thread_id.unwrap_or_default();
+        let thread_id = ThreadId::from_string(&params.thread_id)
+            .unwrap_or_else(|_| self.thread_id.unwrap_or_default());
         if let Some(params) = crate::bottom_pane::AppLinkViewParams::from_url_app_server_request(
             thread_id,
             &params.server_name,
diff --git a/codex-rs/tui/src/chatwidget/turn_runtime.rs b/codex-rs/tui/src/chatwidget/turn_runtime.rs
index 077c33606d..4868d6a25c 100644
--- a/codex-rs/tui/src/chatwidget/turn_runtime.rs
+++ b/codex-rs/tui/src/chatwidget/turn_runtime.rs
@@ -66,7 +66,9 @@ impl ChatWidget {
         self.bottom_pane
             .set_interrupt_hint_visible(/*visible*/ true);
         self.status_state.terminal_title_status_kind = TerminalTitleStatusKind::Working;
-        self.set_status_header(String::from("Working"));
+        if self.mcp_startup_status.is_none() || !self.status_header_is_mcp_startup_owned() {
+            self.set_status_header(String::from("Working"));
+        }
         self.full_reasoning_buffer.clear();
         self.reasoning_buffer.clear();
         self.set_ambient_pet_notification(
@@ -337,6 +339,7 @@ impl ChatWidget {
 
     pub(super) fn on_error(&mut self, message: String) {
         self.input_queue.submit_pending_steers_after_interrupt = false;
+        self.flush_answer_stream_with_separator();
         self.finalize_turn();
         self.add_to_history(history_cell::new_error_event(message));
         self.set_ambient_pet_notification(
diff --git a/codex-rs/tui/src/chatwidget/user_messages.rs b/codex-rs/tui/src/chatwidget/user_messages.rs
index bf3f9e8fe6..cdcf650cb1 100644
--- a/codex-rs/tui/src/chatwidget/user_messages.rs
+++ b/codex-rs/tui/src/chatwidget/user_messages.rs
@@ -593,8 +593,8 @@ impl ChatWidget {
                         )
                     }),
                 ),
-                UserInput::Image { url } => remote_image_urls.push(url.clone()),
-                UserInput::LocalImage { path } => local_images.push(path.clone()),
+                UserInput::Image { url, .. } => remote_image_urls.push(url.clone()),
+                UserInput::LocalImage { path, .. } => local_images.push(path.clone()),
                 UserInput::Skill { .. } | UserInput::Mention { .. } => {}
             }
         }
diff --git a/codex-rs/tui/src/chatwidget/windows_sandbox_prompts.rs b/codex-rs/tui/src/chatwidget/windows_sandbox_prompts.rs
new file mode 100644
index 0000000000..d8ff59da48
--- /dev/null
+++ b/codex-rs/tui/src/chatwidget/windows_sandbox_prompts.rs
@@ -0,0 +1,445 @@
+//! Windows sandbox prompts and warning surfaces for `ChatWidget`.
+
+use super::*;
+
+impl ChatWidget {
+    #[cfg(target_os = "windows")]
+    pub(crate) fn world_writable_warning_details(&self) -> Option<(Vec<String>, usize, bool)> {
+        if self
+            .config
+            .notices
+            .hide_world_writable_warning
+            .unwrap_or(false)
+        {
+            return None;
+        }
+        let cwd = self.config.cwd.clone();
+        let env_map: std::collections::HashMap<String, String> = std::env::vars().collect();
+        let policy = self.config.legacy_sandbox_policy();
+        match codex_windows_sandbox::apply_world_writable_scan_and_denies(
+            self.config.codex_home.as_path(),
+            cwd.as_path(),
+            &env_map,
+            &policy,
+            Some(self.config.codex_home.as_path()),
+        ) {
+            Ok(_) => None,
+            Err(_) => Some((Vec::new(), 0, true)),
+        }
+    }
+
+    #[cfg(not(target_os = "windows"))]
+    #[allow(dead_code)]
+    pub(crate) fn world_writable_warning_details(&self) -> Option<(Vec<String>, usize, bool)> {
+        None
+    }
+
+    #[cfg(target_os = "windows")]
+    pub(crate) fn open_world_writable_warning_confirmation(
+        &mut self,
+        preset: Option<ApprovalPreset>,
+        sample_paths: Vec<String>,
+        extra_count: usize,
+        failed_scan: bool,
+    ) {
+        let (approval, active_permission_profile) = match &preset {
+            Some(p) => (
+                Some(AskForApproval::from(p.approval)),
+                Some(p.active_permission_profile.clone()),
+            ),
+            None => (None, None),
+        };
+        let mut header_children: Vec<Box<dyn Renderable>> = Vec::new();
+        let describe_profile = |profile: &PermissionProfile| {
+            if matches!(profile, PermissionProfile::Disabled) {
+                "Full Access mode"
+            } else if profile
+                .file_system_sandbox_policy()
+                .can_write_path_with_cwd(self.config.cwd.as_path(), self.config.cwd.as_path())
+            {
+                "Agent mode"
+            } else {
+                "Read-Only mode"
+            }
+        };
+        let mode_label = preset
+            .as_ref()
+            .map(|p| describe_profile(&p.permission_profile))
+            .unwrap_or_else(|| {
+                describe_profile(&self.config.permissions.effective_permission_profile())
+            });
+        let info_line = if failed_scan {
+            Line::from(vec![
+                "We couldn't complete the world-writable scan, so protections cannot be verified. "
+                    .into(),
+                format!("The Windows sandbox cannot guarantee protection in {mode_label}.")
+                    .fg(Color::Red),
+            ])
+        } else {
+            Line::from(vec![
+                "The Windows sandbox cannot protect writes to folders that are writable by Everyone.".into(),
+                " Consider removing write access for Everyone from the following folders:".into(),
+            ])
+        };
+        header_children.push(Box::new(
+            Paragraph::new(vec![info_line]).wrap(Wrap { trim: false }),
+        ));
+
+        if !sample_paths.is_empty() {
+            // Show up to three examples and optionally an "and X more" line.
+            let mut lines: Vec<Line> = Vec::new();
+            lines.push(Line::from(""));
+            for p in &sample_paths {
+                lines.push(Line::from(format!("  - {p}")));
+            }
+            if extra_count > 0 {
+                lines.push(Line::from(format!("and {extra_count} more")));
+            }
+            header_children.push(Box::new(Paragraph::new(lines).wrap(Wrap { trim: false })));
+        }
+        let header = ColumnRenderable::with(header_children);
+
+        // Build actions ensuring acknowledgement happens before applying the
+        // new permission profile, so downstream policy-change hooks don't
+        // re-trigger the warning.
+        let mut accept_actions: Vec<SelectionAction> = Vec::new();
+        // Suppress the immediate re-scan only when a preset will be applied via
+        // /permissions, to avoid duplicate warnings from the ensuing policy change.
+        if preset.is_some() {
+            accept_actions.push(Box::new(|tx| {
+                tx.send(AppEvent::SkipNextWorldWritableScan);
+            }));
+        }
+        if let (Some(approval), Some(active_permission_profile)) =
+            (approval, active_permission_profile.clone())
+        {
+            accept_actions.extend(Self::approval_preset_actions(
+                approval,
+                active_permission_profile,
+                mode_label.to_string(),
+                ApprovalsReviewer::User,
+            ));
+        }
+
+        let mut accept_and_remember_actions: Vec<SelectionAction> = Vec::new();
+        accept_and_remember_actions.push(Box::new(|tx| {
+            tx.send(AppEvent::UpdateWorldWritableWarningAcknowledged(true));
+            tx.send(AppEvent::PersistWorldWritableWarningAcknowledged);
+        }));
+        if let (Some(approval), Some(active_permission_profile)) =
+            (approval, active_permission_profile)
+        {
+            accept_and_remember_actions.extend(Self::approval_preset_actions(
+                approval,
+                active_permission_profile,
+                mode_label.to_string(),
+                ApprovalsReviewer::User,
+            ));
+        }
+
+        let items = vec![
+            SelectionItem {
+                name: "Continue".to_string(),
+                description: Some(format!("Apply {mode_label} for this session")),
+                actions: accept_actions,
+                dismiss_on_select: true,
+                ..Default::default()
+            },
+            SelectionItem {
+                name: "Continue and don't warn again".to_string(),
+                description: Some(format!("Enable {mode_label} and remember this choice")),
+                actions: accept_and_remember_actions,
+                dismiss_on_select: true,
+                ..Default::default()
+            },
+        ];
+
+        self.bottom_pane.show_selection_view(SelectionViewParams {
+            footer_hint: Some(standard_popup_hint_line()),
+            items,
+            header: Box::new(header),
+            ..Default::default()
+        });
+    }
+
+    #[cfg(not(target_os = "windows"))]
+    pub(crate) fn open_world_writable_warning_confirmation(
+        &mut self,
+        _preset: Option<ApprovalPreset>,
+        _sample_paths: Vec<String>,
+        _extra_count: usize,
+        _failed_scan: bool,
+    ) {
+    }
+
+    #[cfg(target_os = "windows")]
+    pub(crate) fn open_windows_sandbox_enable_prompt(&mut self, preset: ApprovalPreset) {
+        use ratatui_macros::line;
+
+        if !crate::legacy_core::windows_sandbox::ELEVATED_SANDBOX_NUX_ENABLED {
+            // Legacy flow (pre-NUX): explain the experimental sandbox and let the user enable it
+            // directly (no elevation prompts).
+            let mut header = ColumnRenderable::new();
+            header.push(*Box::new(
+                Paragraph::new(vec![
+                    line!["Agent mode on Windows uses an experimental sandbox to limit network and filesystem access.".bold()],
+                    line!["Learn more: https://developers.openai.com/codex/windows"],
+                ])
+                .wrap(Wrap { trim: false }),
+            ));
+
+            let preset_clone = preset;
+            let items = vec![
+                SelectionItem {
+                    name: "Enable experimental sandbox".to_string(),
+                    description: None,
+                    actions: vec![Box::new(move |tx| {
+                        tx.send(AppEvent::EnableWindowsSandboxForAgentMode {
+                            preset: preset_clone.clone(),
+                            mode: WindowsSandboxEnableMode::Legacy,
+                        });
+                    })],
+                    dismiss_on_select: true,
+                    ..Default::default()
+                },
+                SelectionItem {
+                    name: "Go back".to_string(),
+                    description: None,
+                    actions: vec![Box::new(|tx| {
+                        tx.send(AppEvent::OpenApprovalsPopup);
+                    })],
+                    dismiss_on_select: true,
+                    ..Default::default()
+                },
+            ];
+
+            self.bottom_pane.show_selection_view(SelectionViewParams {
+                title: None,
+                footer_hint: Some(standard_popup_hint_line()),
+                items,
+                header: Box::new(header),
+                ..Default::default()
+            });
+            return;
+        }
+
+        self.session_telemetry.counter(
+            "codex.windows_sandbox.elevated_prompt_shown",
+            /*inc*/ 1,
+            &[],
+        );
+
+        let mut header = ColumnRenderable::new();
+        header.push(*Box::new(
+            Paragraph::new(vec![
+                line!["Set up the Codex agent sandbox to protect your files and control network access. Learn more <https://developers.openai.com/codex/windows>"],
+            ])
+            .wrap(Wrap { trim: false }),
+        ));
+
+        let accept_otel = self.session_telemetry.clone();
+        let legacy_otel = self.session_telemetry.clone();
+        let legacy_preset = preset.clone();
+        let quit_otel = self.session_telemetry.clone();
+        let items = vec![
+            SelectionItem {
+                name: "Set up default sandbox (requires Administrator permissions)".to_string(),
+                description: None,
+                actions: vec![Box::new(move |tx| {
+                    accept_otel.counter(
+                        "codex.windows_sandbox.elevated_prompt_accept",
+                        /*inc*/ 1,
+                        &[],
+                    );
+                    tx.send(AppEvent::BeginWindowsSandboxElevatedSetup {
+                        preset: preset.clone(),
+                    });
+                })],
+                dismiss_on_select: true,
+                ..Default::default()
+            },
+            SelectionItem {
+                name: "Use non-admin sandbox (higher risk if prompt injected)".to_string(),
+                description: None,
+                actions: vec![Box::new(move |tx| {
+                    legacy_otel.counter(
+                        "codex.windows_sandbox.elevated_prompt_use_legacy",
+                        /*inc*/ 1,
+                        &[],
+                    );
+                    tx.send(AppEvent::BeginWindowsSandboxLegacySetup {
+                        preset: legacy_preset.clone(),
+                    });
+                })],
+                dismiss_on_select: true,
+                ..Default::default()
+            },
+            SelectionItem {
+                name: "Quit".to_string(),
+                description: None,
+                actions: vec![Box::new(move |tx| {
+                    quit_otel.counter(
+                        "codex.windows_sandbox.elevated_prompt_quit",
+                        /*inc*/ 1,
+                        &[],
+                    );
+                    tx.send(AppEvent::Exit(ExitMode::ShutdownFirst));
+                })],
+                dismiss_on_select: true,
+                ..Default::default()
+            },
+        ];
+
+        self.bottom_pane.show_selection_view(SelectionViewParams {
+            title: None,
+            footer_hint: Some(standard_popup_hint_line()),
+            items,
+            header: Box::new(header),
+            ..Default::default()
+        });
+    }
+
+    #[cfg(not(target_os = "windows"))]
+    pub(crate) fn open_windows_sandbox_enable_prompt(&mut self, _preset: ApprovalPreset) {}
+
+    #[cfg(target_os = "windows")]
+    pub(crate) fn open_windows_sandbox_fallback_prompt(&mut self, preset: ApprovalPreset) {
+        use ratatui_macros::line;
+
+        let mut lines = Vec::new();
+        lines.push(line![
+            "Couldn't set up your sandbox with Administrator permissions".bold()
+        ]);
+        lines.push(line![""]);
+        lines.push(line![
+            "You can still use Codex in a non-admin sandbox. It carries greater risk if prompt injected."
+        ]);
+        lines.push(line![
+            "Learn more <https://developers.openai.com/codex/windows>"
+        ]);
+
+        let mut header = ColumnRenderable::new();
+        header.push(*Box::new(Paragraph::new(lines).wrap(Wrap { trim: false })));
+
+        let elevated_preset = preset.clone();
+        let legacy_preset = preset;
+        let quit_otel = self.session_telemetry.clone();
+        let items = vec![
+            SelectionItem {
+                name: "Try setting up admin sandbox again".to_string(),
+                description: None,
+                actions: vec![Box::new({
+                    let otel = self.session_telemetry.clone();
+                    let preset = elevated_preset;
+                    move |tx| {
+                        otel.counter(
+                            "codex.windows_sandbox.fallback_retry_elevated",
+                            /*inc*/ 1,
+                            &[],
+                        );
+                        tx.send(AppEvent::BeginWindowsSandboxElevatedSetup {
+                            preset: preset.clone(),
+                        });
+                    }
+                })],
+                dismiss_on_select: true,
+                ..Default::default()
+            },
+            SelectionItem {
+                name: "Use Codex with non-admin sandbox".to_string(),
+                description: None,
+                actions: vec![Box::new({
+                    let otel = self.session_telemetry.clone();
+                    let preset = legacy_preset;
+                    move |tx| {
+                        otel.counter(
+                            "codex.windows_sandbox.fallback_use_legacy",
+                            /*inc*/ 1,
+                            &[],
+                        );
+                        tx.send(AppEvent::BeginWindowsSandboxLegacySetup {
+                            preset: preset.clone(),
+                        });
+                    }
+                })],
+                dismiss_on_select: true,
+                ..Default::default()
+            },
+            SelectionItem {
+                name: "Quit".to_string(),
+                description: None,
+                actions: vec![Box::new(move |tx| {
+                    quit_otel.counter(
+                        "codex.windows_sandbox.fallback_prompt_quit",
+                        /*inc*/ 1,
+                        &[],
+                    );
+                    tx.send(AppEvent::Exit(ExitMode::ShutdownFirst));
+                })],
+                dismiss_on_select: true,
+                ..Default::default()
+            },
+        ];
+
+        self.bottom_pane.show_selection_view(SelectionViewParams {
+            title: None,
+            footer_hint: Some(standard_popup_hint_line()),
+            items,
+            header: Box::new(header),
+            ..Default::default()
+        });
+    }
+
+    #[cfg(not(target_os = "windows"))]
+    pub(crate) fn open_windows_sandbox_fallback_prompt(&mut self, _preset: ApprovalPreset) {}
+
+    #[cfg(target_os = "windows")]
+    pub(crate) fn maybe_prompt_windows_sandbox_enable(&mut self, show_now: bool) {
+        if show_now
+            && WindowsSandboxLevel::from_config(&self.config) == WindowsSandboxLevel::Disabled
+            && let Some(preset) = builtin_approval_presets()
+                .into_iter()
+                .find(|preset| preset.id == "auto")
+        {
+            self.open_windows_sandbox_enable_prompt(preset);
+        }
+    }
+
+    #[cfg(not(target_os = "windows"))]
+    pub(crate) fn maybe_prompt_windows_sandbox_enable(&mut self, _show_now: bool) {}
+
+    #[cfg(target_os = "windows")]
+    pub(crate) fn show_windows_sandbox_setup_status(&mut self) {
+        // While elevated sandbox setup runs, prevent typing so the user doesn't
+        // accidentally queue messages that will run under an unexpected mode.
+        self.bottom_pane.set_composer_input_enabled(
+            /*enabled*/ false,
+            Some("Input disabled until setup completes.".to_string()),
+        );
+        self.bottom_pane.ensure_status_indicator();
+        self.bottom_pane
+            .set_interrupt_hint_visible(/*visible*/ false);
+        self.set_status(
+            "Setting up sandbox...".to_string(),
+            Some("Hang tight, this may take a few minutes".to_string()),
+            StatusDetailsCapitalization::CapitalizeFirst,
+            STATUS_DETAILS_DEFAULT_MAX_LINES,
+        );
+        self.request_redraw();
+    }
+
+    #[cfg(not(target_os = "windows"))]
+    #[allow(dead_code)]
+    pub(crate) fn show_windows_sandbox_setup_status(&mut self) {}
+
+    #[cfg(target_os = "windows")]
+    pub(crate) fn clear_windows_sandbox_setup_status(&mut self) {
+        self.bottom_pane
+            .set_composer_input_enabled(/*enabled*/ true, /*placeholder*/ None);
+        self.bottom_pane.hide_status_indicator();
+        self.request_redraw();
+    }
+
+    #[cfg(not(target_os = "windows"))]
+    pub(crate) fn clear_windows_sandbox_setup_status(&mut self) {}
+}
diff --git a/codex-rs/tui/src/cli.rs b/codex-rs/tui/src/cli.rs
index d6001c60d8..13ddffb14a 100644
--- a/codex-rs/tui/src/cli.rs
+++ b/codex-rs/tui/src/cli.rs
@@ -5,13 +5,17 @@ use codex_utils_cli::ApprovalModeCliArg;
 use codex_utils_cli::CliConfigOverrides;
 use codex_utils_cli::SharedCliOptions;
 
-#[derive(Parser, Debug)]
+#[derive(Parser, Clone, Debug)]
 #[command(version)]
 pub struct Cli {
     /// Optional user prompt to start the session.
     #[arg(value_name = "PROMPT", value_hint = clap::ValueHint::Other)]
     pub prompt: Option<String>,
 
+    /// Error out when config.toml contains fields that are not recognized by this version of Codex.
+    #[arg(long = "strict-config", default_value_t = false)]
+    pub strict_config: bool,
+
     // Internal controls set by the top-level `codex resume` subcommand.
     // These are not exposed as user flags on the base `codex` command.
     #[clap(skip)]
@@ -85,7 +89,7 @@ impl std::ops::DerefMut for Cli {
     }
 }
 
-#[derive(Debug, Default)]
+#[derive(Clone, Debug, Default)]
 pub struct TuiSharedCliOptions(SharedCliOptions);
 
 impl TuiSharedCliOptions {
diff --git a/codex-rs/tui/src/collaboration_modes.rs b/codex-rs/tui/src/collaboration_modes.rs
index e0881bc9cf..b81f4bf4dc 100644
--- a/codex-rs/tui/src/collaboration_modes.rs
+++ b/codex-rs/tui/src/collaboration_modes.rs
@@ -11,10 +11,6 @@ fn filtered_presets(_model_catalog: &ModelCatalog) -> Vec<CollaborationModeMask>
         .collect()
 }
 
-pub(crate) fn presets_for_tui(model_catalog: &ModelCatalog) -> Vec<CollaborationModeMask> {
-    filtered_presets(model_catalog)
-}
-
 pub(crate) fn default_mask(model_catalog: &ModelCatalog) -> Option<CollaborationModeMask> {
     let presets = filtered_presets(model_catalog);
     presets
diff --git a/codex-rs/tui/src/config_update.rs b/codex-rs/tui/src/config_update.rs
new file mode 100644
index 0000000000..cac79f648e
--- /dev/null
+++ b/codex-rs/tui/src/config_update.rs
@@ -0,0 +1,160 @@
+//! App-server-backed config update helpers for the TUI.
+//!
+//! This module centralizes the small typed update helpers the TUI uses
+//! when a config mutation must be owned by the app server rather than written
+//! to the local `config.toml` directly.
+
+use codex_app_server_client::AppServerRequestHandle;
+use codex_app_server_protocol::ClientRequest;
+use codex_app_server_protocol::ConfigBatchWriteParams;
+use codex_app_server_protocol::ConfigEdit;
+use codex_app_server_protocol::ConfigWriteResponse;
+use codex_app_server_protocol::MergeStrategy;
+use codex_app_server_protocol::RequestId;
+use codex_app_server_protocol::SkillsConfigWriteParams;
+use codex_app_server_protocol::SkillsConfigWriteResponse;
+use codex_utils_absolute_path::AbsolutePathBuf;
+use color_eyre::eyre::Result;
+use color_eyre::eyre::WrapErr;
+use serde_json::Value as JsonValue;
+use uuid::Uuid;
+
+pub(crate) fn replace_config_value(key_path: impl Into<String>, value: JsonValue) -> ConfigEdit {
+    ConfigEdit {
+        key_path: key_path.into(),
+        value,
+        merge_strategy: MergeStrategy::Replace,
+    }
+}
+
+pub(crate) fn clear_config_value(key_path: impl Into<String>) -> ConfigEdit {
+    replace_config_value(key_path, JsonValue::Null)
+}
+
+pub(crate) fn profile_scoped_key_path(profile: Option<&str>, key_path: &str) -> String {
+    if let Some(profile) = profile {
+        let profile = serde_json::Value::String(profile.to_string()).to_string();
+        format!("profiles.{profile}.{key_path}")
+    } else {
+        key_path.to_string()
+    }
+}
+
+pub(crate) fn app_scoped_key_path(app_id: &str, key_path: &str) -> String {
+    let app_id = serde_json::Value::String(app_id.to_string()).to_string();
+    format!("apps.{app_id}.{key_path}")
+}
+
+pub(crate) fn build_model_selection_edits(
+    profile: Option<&str>,
+    model: &str,
+    effort: Option<impl ToString>,
+) -> Vec<ConfigEdit> {
+    let effort_edit = effort.map_or_else(
+        || clear_config_value(profile_scoped_key_path(profile, "model_reasoning_effort")),
+        |effort| {
+            replace_config_value(
+                profile_scoped_key_path(profile, "model_reasoning_effort"),
+                serde_json::json!(effort.to_string()),
+            )
+        },
+    );
+    vec![
+        replace_config_value(
+            profile_scoped_key_path(profile, "model"),
+            serde_json::json!(model),
+        ),
+        effort_edit,
+    ]
+}
+
+pub(crate) fn build_service_tier_selection_edits(
+    profile: Option<&str>,
+    service_tier: Option<&str>,
+) -> Vec<ConfigEdit> {
+    let service_tier_edit = service_tier.map_or_else(
+        || clear_config_value(profile_scoped_key_path(profile, "service_tier")),
+        |service_tier| {
+            let config_value =
+                match codex_protocol::config_types::ServiceTier::from_request_value(service_tier) {
+                    Some(codex_protocol::config_types::ServiceTier::Fast) => "fast",
+                    Some(codex_protocol::config_types::ServiceTier::Flex) => "flex",
+                    None => service_tier,
+                };
+            replace_config_value(
+                profile_scoped_key_path(profile, "service_tier"),
+                serde_json::json!(config_value),
+            )
+        },
+    );
+    let mut edits = vec![service_tier_edit];
+    if service_tier.is_none() {
+        edits.push(replace_config_value(
+            "notice.fast_default_opt_out",
+            serde_json::json!(true),
+        ));
+    }
+    edits
+}
+
+pub(crate) async fn write_config_batch(
+    request_handle: AppServerRequestHandle,
+    edits: Vec<ConfigEdit>,
+) -> Result<()> {
+    let request_id = RequestId::String(format!("tui-config-write-{}", Uuid::new_v4()));
+    let _: ConfigWriteResponse = request_handle
+        .request_typed(ClientRequest::ConfigBatchWrite {
+            request_id,
+            params: ConfigBatchWriteParams {
+                edits,
+                file_path: None,
+                expected_version: None,
+                reload_user_config: true,
+            },
+        })
+        .await
+        .wrap_err("config/batchWrite failed in TUI")?;
+    Ok(())
+}
+
+pub(crate) async fn write_skill_enabled(
+    request_handle: AppServerRequestHandle,
+    path: AbsolutePathBuf,
+    enabled: bool,
+) -> Result<()> {
+    let request_id = RequestId::String(format!("tui-skill-config-write-{}", Uuid::new_v4()));
+    let _: SkillsConfigWriteResponse = request_handle
+        .request_typed(ClientRequest::SkillsConfigWrite {
+            request_id,
+            params: SkillsConfigWriteParams {
+                path: Some(path),
+                name: None,
+                enabled,
+            },
+        })
+        .await
+        .wrap_err("skills/config/write failed in TUI")?;
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use pretty_assertions::assert_eq;
+
+    #[test]
+    fn profile_scoped_key_path_quotes_dotted_profile_names() {
+        assert_eq!(
+            profile_scoped_key_path(Some("team.prod"), "model"),
+            "profiles.\"team.prod\".model"
+        );
+    }
+
+    #[test]
+    fn app_scoped_key_path_quotes_dotted_app_ids() {
+        assert_eq!(
+            app_scoped_key_path("plugin.linear", "enabled"),
+            "apps.\"plugin.linear\".enabled"
+        );
+    }
+}
diff --git a/codex-rs/tui/src/debug_config.rs b/codex-rs/tui/src/debug_config.rs
index d007986131..2c44544079 100644
--- a/codex-rs/tui/src/debug_config.rs
+++ b/codex-rs/tui/src/debug_config.rs
@@ -385,7 +385,7 @@ fn format_config_layer_source(source: &ConfigLayerSource) -> String {
         ConfigLayerSource::System { file } => {
             format!("system ({})", file.as_path().display())
         }
-        ConfigLayerSource::User { file } => {
+        ConfigLayerSource::User { file, .. } => {
             format!("user ({})", file.as_path().display())
         }
         ConfigLayerSource::Project { dot_codex_folder } => {
@@ -728,7 +728,10 @@ mod tests {
         };
         let stack = ConfigLayerStack::new(
             vec![ConfigLayerEntry::new(
-                ConfigLayerSource::User { file: user_file },
+                ConfigLayerSource::User {
+                    file: user_file,
+                    profile: None,
+                },
                 empty_toml_table(),
             )],
             requirements,
diff --git a/codex-rs/tui/src/external_agent_config_migration_startup.rs b/codex-rs/tui/src/external_agent_config_migration_startup.rs
index 93f2302535..3ec2ca3903 100644
--- a/codex-rs/tui/src/external_agent_config_migration_startup.rs
+++ b/codex-rs/tui/src/external_agent_config_migration_startup.rs
@@ -148,7 +148,7 @@ async fn persist_external_agent_config_migration_prompt_shown(
         return Ok(());
     }
 
-    ConfigEditsBuilder::new(&config.codex_home)
+    ConfigEditsBuilder::for_config(config)
         .with_edits(edits)
         .apply()
         .await
@@ -221,7 +221,7 @@ async fn persist_external_agent_config_migration_prompt_dismissal(
         return Ok(());
     }
 
-    ConfigEditsBuilder::new(&config.codex_home)
+    ConfigEditsBuilder::for_config(config)
         .with_edits(edits)
         .apply()
         .await
diff --git a/codex-rs/tui/src/goal_display.rs b/codex-rs/tui/src/goal_display.rs
index d0455054b7..961b87f16e 100644
--- a/codex-rs/tui/src/goal_display.rs
+++ b/codex-rs/tui/src/goal_display.rs
@@ -32,6 +32,8 @@ pub(crate) fn goal_status_label(status: ThreadGoalStatus) -> &'static str {
     match status {
         ThreadGoalStatus::Active => "active",
         ThreadGoalStatus::Paused => "paused",
+        ThreadGoalStatus::Blocked => "blocked",
+        ThreadGoalStatus::UsageLimited => "usage limited",
         ThreadGoalStatus::BudgetLimited => "limited by budget",
         ThreadGoalStatus::Complete => "complete",
     }
diff --git a/codex-rs/tui/src/history_cell.rs b/codex-rs/tui/src/history_cell.rs
deleted file mode 100644
index c37afc12f2..0000000000
--- a/codex-rs/tui/src/history_cell.rs
+++ /dev/null
@@ -1,6027 +0,0 @@
-//! Transcript/history cells for the Codex TUI.
-//!
-//! A `HistoryCell` is the unit of display in the conversation UI, representing both committed
-//! transcript entries and, transiently, an in-flight active cell that can mutate in place while
-//! streaming.
-//!
-//! The transcript overlay (`Ctrl+T`) appends a cached live tail derived from the active cell, and
-//! that cached tail is refreshed based on an active-cell cache key. Cells that change based on
-//! elapsed time expose `transcript_animation_tick()`, and code that mutates the active cell in place
-//! bumps the active-cell revision tracked by `ChatWidget`, so the cache key changes whenever the
-//! rendered transcript output can change.
-
-use crate::diff_model::FileChange;
-use crate::diff_render::create_diff_summary;
-use crate::diff_render::display_path_for;
-use crate::exec_cell::CommandOutput;
-use crate::exec_cell::OutputLinesParams;
-use crate::exec_cell::TOOL_CALL_MAX_LINES;
-use crate::exec_cell::output_lines;
-use crate::exec_command::relativize_to_home;
-use crate::exec_command::strip_bash_lc_and_escape;
-use crate::legacy_core::config::Config;
-use crate::live_wrap::take_prefix_by_width;
-use crate::markdown::append_markdown;
-use crate::markdown::append_markdown_agent_with_cwd;
-use crate::motion::MotionMode;
-use crate::motion::ReducedMotionIndicator;
-use crate::motion::activity_indicator;
-use crate::render::line_utils::line_to_static;
-use crate::render::line_utils::prefix_lines;
-use crate::render::line_utils::push_owned_lines;
-use crate::render::renderable::Renderable;
-use crate::session_state::ThreadSessionState;
-use crate::style::proposed_plan_style;
-use crate::style::user_message_style;
-#[cfg(test)]
-use crate::test_support::PathBufExt;
-#[cfg(test)]
-use crate::test_support::test_path_buf;
-use crate::text_formatting::format_and_truncate_tool_result;
-use crate::text_formatting::truncate_text;
-use crate::tooltips;
-use crate::ui_consts::LIVE_PREFIX_COLS;
-use crate::update_action::UpdateAction;
-use crate::version::CODEX_CLI_VERSION;
-use crate::wrapping::RtOptions;
-use crate::wrapping::adaptive_wrap_line;
-use crate::wrapping::adaptive_wrap_lines;
-use base64::Engine;
-use codex_app_server_protocol::AskForApproval;
-use codex_app_server_protocol::McpAuthStatus;
-use codex_app_server_protocol::McpServerStatus;
-use codex_app_server_protocol::McpServerStatusDetail;
-use codex_app_server_protocol::PermissionProfile as AppServerPermissionProfile;
-use codex_app_server_protocol::PermissionProfileFileSystemPermissions;
-use codex_app_server_protocol::PermissionProfileNetworkPermissions;
-use codex_app_server_protocol::ToolRequestUserInputAnswer;
-use codex_app_server_protocol::ToolRequestUserInputQuestion;
-use codex_app_server_protocol::WebSearchAction;
-use codex_config::types::McpServerTransportConfig;
-#[cfg(test)]
-use codex_mcp::qualified_mcp_tool_name_prefix;
-use codex_otel::RuntimeMetricsSummary;
-use codex_protocol::account::PlanType;
-use codex_protocol::approvals::ExecPolicyAmendment;
-use codex_protocol::approvals::NetworkPolicyAmendment;
-#[cfg(test)]
-use codex_protocol::mcp::Resource;
-#[cfg(test)]
-use codex_protocol::mcp::ResourceTemplate;
-use codex_protocol::models::PermissionProfile;
-use codex_protocol::models::local_image_label_text;
-use codex_protocol::openai_models::ReasoningEffort as ReasoningEffortConfig;
-use codex_protocol::plan_tool::PlanItemArg;
-use codex_protocol::plan_tool::StepStatus;
-use codex_protocol::plan_tool::UpdatePlanArgs;
-use codex_protocol::user_input::TextElement;
-use codex_utils_absolute_path::AbsolutePathBuf;
-use codex_utils_cli::format_env_display;
-use image::DynamicImage;
-use image::ImageReader;
-use ratatui::prelude::*;
-use ratatui::style::Color;
-use ratatui::style::Modifier;
-use ratatui::style::Style;
-use ratatui::style::Styled;
-use ratatui::style::Stylize;
-use ratatui::widgets::Clear;
-use ratatui::widgets::Paragraph;
-use ratatui::widgets::Wrap;
-use std::any::Any;
-use std::collections::HashMap;
-use std::io::Cursor;
-use std::path::Path;
-use std::path::PathBuf;
-use std::time::Duration;
-use std::time::Instant;
-use tracing::error;
-use unicode_segmentation::UnicodeSegmentation;
-use unicode_width::UnicodeWidthStr;
-use url::Url;
-
-const RAW_DIFF_SUMMARY_WIDTH: usize = 10_000;
-const RAW_TOOL_OUTPUT_WIDTH: usize = 10_000;
-
-mod hook_cell;
-
-pub(crate) use hook_cell::HookCell;
-pub(crate) use hook_cell::hook_run_should_skip_render;
-pub(crate) use hook_cell::new_active_hook_cell;
-pub(crate) use hook_cell::new_completed_hook_cell;
-
-#[derive(Clone, Copy, Debug, Eq, PartialEq)]
-pub(crate) enum HistoryRenderMode {
-    Rich,
-    Raw,
-}
-
-pub(crate) fn raw_lines_from_source(source: &str) -> Vec<Line<'static>> {
-    if source.is_empty() {
-        return Vec::new();
-    }
-
-    let mut parts = source.split('\n').collect::<Vec<_>>();
-    if source.ends_with('\n') {
-        parts.pop();
-    }
-
-    parts
-        .into_iter()
-        .map(|line| Line::from(line.to_string()))
-        .collect()
-}
-
-pub(crate) fn plain_lines(lines: impl IntoIterator<Item = Line<'static>>) -> Vec<Line<'static>> {
-    lines
-        .into_iter()
-        .map(|line| {
-            let text = line
-                .spans
-                .into_iter()
-                .map(|span| span.content.into_owned())
-                .collect::<String>();
-            Line::from(text)
-        })
-        .collect()
-}
-
-/// A single renderable unit of conversation history.
-///
-/// Each cell produces logical `Line`s and reports how many viewport
-/// rows those lines occupy at a given terminal width. The default
-/// height implementations use `Paragraph::wrap` to account for lines
-/// that overflow the viewport width (e.g. long URLs that are kept
-/// intact by adaptive wrapping). Concrete types only need to override
-/// heights when they apply additional layout logic beyond what
-/// `Paragraph::line_count` captures.
-pub(crate) trait HistoryCell: std::fmt::Debug + Send + Sync + Any {
-    /// Returns the logical lines for the main chat viewport.
-    fn display_lines(&self, width: u16) -> Vec<Line<'static>>;
-
-    /// Returns copy-friendly plain logical lines for raw scrollback mode.
-    fn raw_lines(&self) -> Vec<Line<'static>>;
-
-    fn display_lines_for_mode(&self, width: u16, mode: HistoryRenderMode) -> Vec<Line<'static>> {
-        match mode {
-            HistoryRenderMode::Rich => self.display_lines(width),
-            HistoryRenderMode::Raw => self.raw_lines(),
-        }
-    }
-
-    /// Returns the number of viewport rows needed to render this cell.
-    ///
-    /// The default delegates to `Paragraph::line_count` with
-    /// `Wrap { trim: false }`, which measures the actual row count after
-    /// ratatui's viewport-level character wrapping. This is critical
-    /// for lines containing URL-like tokens that are wider than the
-    /// terminal — the logical line count would undercount.
-    fn desired_height(&self, width: u16) -> u16 {
-        self.desired_height_for_mode(width, HistoryRenderMode::Rich)
-    }
-
-    fn desired_height_for_mode(&self, width: u16, mode: HistoryRenderMode) -> u16 {
-        Paragraph::new(Text::from(self.display_lines_for_mode(width, mode)))
-            .wrap(Wrap { trim: false })
-            .line_count(width)
-            .try_into()
-            .unwrap_or(0)
-    }
-
-    /// Returns lines for the transcript overlay (`Ctrl+T`).
-    ///
-    /// Defaults to `display_lines`. Override when the transcript
-    /// representation differs (e.g. `ExecCell` shows all calls with
-    /// `$`-prefixed commands and exit status).
-    fn transcript_lines(&self, width: u16) -> Vec<Line<'static>> {
-        self.display_lines(width)
-    }
-
-    /// Returns the number of viewport rows for the transcript overlay.
-    ///
-    /// Uses the same `Paragraph::line_count` measurement as
-    /// `desired_height`. Contains a workaround for a ratatui bug where
-    /// a single whitespace-only line reports 2 rows instead of 1.
-    fn desired_transcript_height(&self, width: u16) -> u16 {
-        let lines = self.transcript_lines(width);
-        // Workaround: ratatui's line_count returns 2 for a single
-        // whitespace-only line. Clamp to 1 in that case.
-        if let [line] = &lines[..]
-            && line
-                .spans
-                .iter()
-                .all(|s| s.content.chars().all(char::is_whitespace))
-        {
-            return 1;
-        }
-
-        Paragraph::new(Text::from(lines))
-            .wrap(Wrap { trim: false })
-            .line_count(width)
-            .try_into()
-            .unwrap_or(0)
-    }
-
-    fn is_stream_continuation(&self) -> bool {
-        false
-    }
-
-    /// Returns a coarse "animation tick" when transcript output is time-dependent.
-    ///
-    /// The transcript overlay caches the rendered output of the in-flight active cell, so cells
-    /// that include time-based UI (spinner, shimmer, etc.) should return a tick that changes over
-    /// time to signal that the cached tail should be recomputed. Returning `None` means the
-    /// transcript lines are stable, while returning `Some(tick)` during an in-flight animation
-    /// allows the overlay to keep up with the main viewport.
-    ///
-    /// If a cell uses time-based visuals but always returns `None`, `Ctrl+T` can appear "frozen" on
-    /// the first rendered frame even though the main viewport is animating.
-    fn transcript_animation_tick(&self) -> Option<u64> {
-        None
-    }
-}
-
-impl Renderable for Box<dyn HistoryCell> {
-    fn render(&self, area: Rect, buf: &mut Buffer) {
-        let lines = self.display_lines(area.width);
-        let paragraph = Paragraph::new(Text::from(lines)).wrap(Wrap { trim: false });
-        let y = if area.height == 0 {
-            0
-        } else {
-            let overflow = paragraph
-                .line_count(area.width)
-                .saturating_sub(usize::from(area.height));
-            u16::try_from(overflow).unwrap_or(u16::MAX)
-        };
-        // Active-cell content can reflow dramatically during resize/stream updates. Clear the
-        // entire draw area first so stale glyphs from previous frames never linger.
-        Clear.render(area, buf);
-        paragraph.scroll((y, 0)).render(area, buf);
-    }
-    fn desired_height(&self, width: u16) -> u16 {
-        HistoryCell::desired_height(self.as_ref(), width)
-    }
-}
-
-impl dyn HistoryCell {
-    pub(crate) fn as_any(&self) -> &dyn Any {
-        self
-    }
-
-    pub(crate) fn as_any_mut(&mut self) -> &mut dyn Any {
-        self
-    }
-}
-
-#[derive(Debug)]
-pub(crate) struct UserHistoryCell {
-    pub message: String,
-    pub text_elements: Vec<TextElement>,
-    #[allow(dead_code)]
-    pub local_image_paths: Vec<PathBuf>,
-    pub remote_image_urls: Vec<String>,
-}
-
-/// Build logical lines for a user message with styled text elements.
-///
-/// This preserves explicit newlines while interleaving element spans and skips
-/// malformed byte ranges instead of panicking during history rendering.
-fn build_user_message_lines_with_elements(
-    message: &str,
-    elements: &[TextElement],
-    style: Style,
-    element_style: Style,
-) -> Vec<Line<'static>> {
-    let mut elements = elements.to_vec();
-    elements.sort_by_key(|e| e.byte_range.start);
-    let mut offset = 0usize;
-    let mut raw_lines: Vec<Line<'static>> = Vec::new();
-    for line_text in message.split('\n') {
-        let line_start = offset;
-        let line_end = line_start + line_text.len();
-        let mut spans: Vec<Span<'static>> = Vec::new();
-        // Track how much of the line we've emitted to interleave plain and styled spans.
-        let mut cursor = line_start;
-        for elem in &elements {
-            let start = elem.byte_range.start.max(line_start);
-            let end = elem.byte_range.end.min(line_end);
-            if start >= end {
-                continue;
-            }
-            let rel_start = start - line_start;
-            let rel_end = end - line_start;
-            // Guard against malformed UTF-8 byte ranges from upstream data; skip
-            // invalid elements rather than panicking while rendering history.
-            if !line_text.is_char_boundary(rel_start) || !line_text.is_char_boundary(rel_end) {
-                continue;
-            }
-            let rel_cursor = cursor - line_start;
-            if cursor < start
-                && line_text.is_char_boundary(rel_cursor)
-                && let Some(segment) = line_text.get(rel_cursor..rel_start)
-            {
-                spans.push(Span::from(segment.to_string()));
-            }
-            if let Some(segment) = line_text.get(rel_start..rel_end) {
-                spans.push(Span::styled(segment.to_string(), element_style));
-                cursor = end;
-            }
-        }
-        let rel_cursor = cursor - line_start;
-        if cursor < line_end
-            && line_text.is_char_boundary(rel_cursor)
-            && let Some(segment) = line_text.get(rel_cursor..)
-        {
-            spans.push(Span::from(segment.to_string()));
-        }
-        let line = if spans.is_empty() {
-            Line::from(line_text.to_string()).style(style)
-        } else {
-            Line::from(spans).style(style)
-        };
-        raw_lines.push(line);
-        // Split on '\n' so any '\r' stays in the line; advancing by 1 accounts
-        // for the separator byte.
-        offset = line_end + 1;
-    }
-
-    raw_lines
-}
-
-fn remote_image_display_line(style: Style, index: usize) -> Line<'static> {
-    Line::from(local_image_label_text(index)).style(style)
-}
-
-fn trim_trailing_blank_lines(mut lines: Vec<Line<'static>>) -> Vec<Line<'static>> {
-    while lines
-        .last()
-        .is_some_and(|line| line.spans.iter().all(|span| span.content.trim().is_empty()))
-    {
-        lines.pop();
-    }
-    lines
-}
-
-impl HistoryCell for UserHistoryCell {
-    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
-        let wrap_width = width
-            .saturating_sub(
-                LIVE_PREFIX_COLS + 1, /* keep a one-column right margin for wrapping */
-            )
-            .max(1);
-
-        let style = user_message_style();
-        let element_style = style.fg(Color::Cyan);
-
-        let wrapped_remote_images = if self.remote_image_urls.is_empty() {
-            None
-        } else {
-            Some(adaptive_wrap_lines(
-                self.remote_image_urls
-                    .iter()
-                    .enumerate()
-                    .map(|(idx, _url)| {
-                        remote_image_display_line(element_style, idx.saturating_add(1))
-                    }),
-                RtOptions::new(usize::from(wrap_width))
-                    .wrap_algorithm(textwrap::WrapAlgorithm::FirstFit),
-            ))
-        };
-
-        let wrapped_message = if self.message.is_empty() && self.text_elements.is_empty() {
-            None
-        } else if self.text_elements.is_empty() {
-            let message_without_trailing_newlines = self.message.trim_end_matches(['\r', '\n']);
-            let wrapped = adaptive_wrap_lines(
-                message_without_trailing_newlines
-                    .split('\n')
-                    .map(|line| Line::from(line).style(style)),
-                // Wrap algorithm matches textarea.rs.
-                RtOptions::new(usize::from(wrap_width))
-                    .wrap_algorithm(textwrap::WrapAlgorithm::FirstFit),
-            );
-            let wrapped = trim_trailing_blank_lines(wrapped);
-            (!wrapped.is_empty()).then_some(wrapped)
-        } else {
-            let raw_lines = build_user_message_lines_with_elements(
-                &self.message,
-                &self.text_elements,
-                style,
-                element_style,
-            );
-            let wrapped = adaptive_wrap_lines(
-                raw_lines,
-                RtOptions::new(usize::from(wrap_width))
-                    .wrap_algorithm(textwrap::WrapAlgorithm::FirstFit),
-            );
-            let wrapped = trim_trailing_blank_lines(wrapped);
-            (!wrapped.is_empty()).then_some(wrapped)
-        };
-
-        if wrapped_remote_images.is_none() && wrapped_message.is_none() {
-            return Vec::new();
-        }
-
-        let mut lines: Vec<Line<'static>> = vec![Line::from("").style(style)];
-
-        if let Some(wrapped_remote_images) = wrapped_remote_images {
-            lines.extend(prefix_lines(
-                wrapped_remote_images,
-                "  ".into(),
-                "  ".into(),
-            ));
-            if wrapped_message.is_some() {
-                lines.push(Line::from("").style(style));
-            }
-        }
-
-        if let Some(wrapped_message) = wrapped_message {
-            lines.extend(prefix_lines(
-                wrapped_message,
-                "› ".bold().dim(),
-                "  ".into(),
-            ));
-        }
-
-        lines.push(Line::from("").style(style));
-        lines
-    }
-
-    fn raw_lines(&self) -> Vec<Line<'static>> {
-        let mut lines = raw_lines_from_source(self.message.trim_end_matches(['\r', '\n']));
-        if !self.remote_image_urls.is_empty() {
-            if !lines.is_empty() {
-                lines.push(Line::from(""));
-            }
-            lines.extend(
-                self.remote_image_urls
-                    .iter()
-                    .enumerate()
-                    .map(|(idx, _url)| Line::from(local_image_label_text(idx.saturating_add(1)))),
-            );
-        }
-        lines
-    }
-}
-
-#[derive(Debug)]
-pub(crate) struct ReasoningSummaryCell {
-    _header: String,
-    content: String,
-    /// Session cwd used to render local file links inside the reasoning body.
-    cwd: PathBuf,
-    transcript_only: bool,
-}
-
-impl ReasoningSummaryCell {
-    /// Create a reasoning summary cell that will render local file links relative to the session
-    /// cwd active when the summary was recorded.
-    pub(crate) fn new(header: String, content: String, cwd: &Path, transcript_only: bool) -> Self {
-        Self {
-            _header: header,
-            content,
-            cwd: cwd.to_path_buf(),
-            transcript_only,
-        }
-    }
-
-    fn lines(&self, width: u16) -> Vec<Line<'static>> {
-        let mut lines: Vec<Line<'static>> = Vec::new();
-        append_markdown(
-            &self.content,
-            crate::width::usable_content_width_u16(width, /*reserved_cols*/ 2),
-            Some(self.cwd.as_path()),
-            &mut lines,
-        );
-        let summary_style = Style::default().dim().italic();
-        let summary_lines = lines
-            .into_iter()
-            .map(|mut line| {
-                line.spans = line
-                    .spans
-                    .into_iter()
-                    .map(|span| span.patch_style(summary_style))
-                    .collect();
-                line
-            })
-            .collect::<Vec<_>>();
-
-        adaptive_wrap_lines(
-            &summary_lines,
-            RtOptions::new(width as usize)
-                .initial_indent("• ".dim().into())
-                .subsequent_indent("  ".into()),
-        )
-    }
-}
-
-impl HistoryCell for ReasoningSummaryCell {
-    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
-        if self.transcript_only {
-            Vec::new()
-        } else {
-            self.lines(width)
-        }
-    }
-
-    fn transcript_lines(&self, width: u16) -> Vec<Line<'static>> {
-        self.lines(width)
-    }
-
-    fn raw_lines(&self) -> Vec<Line<'static>> {
-        if self.transcript_only {
-            Vec::new()
-        } else {
-            raw_lines_from_source(self.content.trim())
-        }
-    }
-}
-
-#[derive(Debug)]
-pub(crate) struct AgentMessageCell {
-    lines: Vec<Line<'static>>,
-    is_first_line: bool,
-}
-
-impl AgentMessageCell {
-    pub(crate) fn new(lines: Vec<Line<'static>>, is_first_line: bool) -> Self {
-        Self {
-            lines,
-            is_first_line,
-        }
-    }
-}
-
-impl HistoryCell for AgentMessageCell {
-    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
-        adaptive_wrap_lines(
-            &self.lines,
-            RtOptions::new(width as usize)
-                .initial_indent(if self.is_first_line {
-                    "• ".dim().into()
-                } else {
-                    "  ".into()
-                })
-                .subsequent_indent("  ".into()),
-        )
-    }
-
-    fn raw_lines(&self) -> Vec<Line<'static>> {
-        plain_lines(self.lines.clone())
-    }
-
-    fn is_stream_continuation(&self) -> bool {
-        !self.is_first_line
-    }
-}
-
-/// A consolidated agent message cell that stores raw markdown source and re-renders from it.
-///
-/// After a stream finalizes, the `ConsolidateAgentMessage` handler in `App`
-/// replaces the contiguous run of `AgentMessageCell`s with a single
-/// `AgentMarkdownCell`. On terminal resize, `display_lines(width)` re-renders
-/// from source via `append_markdown_agent`, producing correctly-sized tables
-/// with box-drawing borders.
-///
-/// The cell snapshots `cwd` at construction so local file-link display remains aligned with the
-/// session that produced the message. Reusing the current process cwd during reflow would make old
-/// transcript content change meaning after a later `/cd` or resumed session.
-#[derive(Debug)]
-pub(crate) struct AgentMarkdownCell {
-    markdown_source: String,
-    cwd: PathBuf,
-}
-
-impl AgentMarkdownCell {
-    /// Create a finalized source-backed assistant message cell.
-    ///
-    /// `markdown_source` must be the raw source accumulated by the stream controller, not already
-    /// wrapped terminal lines. Passing rendered lines here would make future resize reflow preserve
-    /// stale wrapping instead of repairing it.
-    pub(crate) fn new(markdown_source: String, cwd: &Path) -> Self {
-        Self {
-            markdown_source,
-            cwd: cwd.to_path_buf(),
-        }
-    }
-}
-
-impl HistoryCell for AgentMarkdownCell {
-    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
-        let Some(wrap_width) =
-            crate::width::usable_content_width_u16(width, /*reserved_cols*/ 2)
-        else {
-            return prefix_lines(vec![Line::default()], "• ".dim(), "  ".into());
-        };
-
-        let mut lines: Vec<Line<'static>> = Vec::new();
-        // Re-render markdown from source at the current width. Reserve 2 columns for the "• " /
-        // " " prefix prepended below.
-        crate::markdown::append_markdown_agent_with_cwd(
-            &self.markdown_source,
-            Some(wrap_width),
-            Some(self.cwd.as_path()),
-            &mut lines,
-        );
-        prefix_lines(lines, "• ".dim(), "  ".into())
-    }
-
-    fn raw_lines(&self) -> Vec<Line<'static>> {
-        raw_lines_from_source(&self.markdown_source)
-    }
-}
-
-/// Transient active-cell representation of the mutable tail of an agent stream.
-///
-/// During streaming, lines that have not yet been committed to scrollback because they belong to
-/// an in-progress table are displayed via this cell in the `active_cell` slot. It is replaced on
-/// every delta and cleared when the stream finalizes.
-#[derive(Debug)]
-pub(crate) struct StreamingAgentTailCell {
-    lines: Vec<Line<'static>>,
-    is_first_line: bool,
-}
-
-impl StreamingAgentTailCell {
-    pub(crate) fn new(lines: Vec<Line<'static>>, is_first_line: bool) -> Self {
-        Self {
-            lines,
-            is_first_line,
-        }
-    }
-}
-
-impl HistoryCell for StreamingAgentTailCell {
-    fn display_lines(&self, _width: u16) -> Vec<Line<'static>> {
-        // Tail lines are already rendered at the controller's current stream width.
-        // Re-wrapping them here can split table borders and produce malformed in-flight rows.
-        prefix_lines(
-            self.lines.clone(),
-            if self.is_first_line {
-                "• ".dim()
-            } else {
-                "  ".into()
-            },
-            "  ".into(),
-        )
-    }
-
-    fn raw_lines(&self) -> Vec<Line<'static>> {
-        plain_lines(self.display_lines(u16::MAX))
-    }
-
-    fn is_stream_continuation(&self) -> bool {
-        !self.is_first_line
-    }
-}
-
-/// Transient active-cell representation of the mutable tail of a proposed-plan stream.
-///
-/// The controller prepares the full styled plan lines because plan tails need the same header,
-/// padding, and background treatment as committed `ProposedPlanStreamCell`s while remaining
-/// preview-only during streaming.
-#[derive(Debug)]
-pub(crate) struct StreamingPlanTailCell {
-    lines: Vec<Line<'static>>,
-    is_stream_continuation: bool,
-}
-
-impl StreamingPlanTailCell {
-    pub(crate) fn new(lines: Vec<Line<'static>>, is_stream_continuation: bool) -> Self {
-        Self {
-            lines,
-            is_stream_continuation,
-        }
-    }
-}
-
-impl HistoryCell for StreamingPlanTailCell {
-    fn display_lines(&self, _width: u16) -> Vec<Line<'static>> {
-        self.lines.clone()
-    }
-
-    fn raw_lines(&self) -> Vec<Line<'static>> {
-        plain_lines(self.lines.clone())
-    }
-
-    fn is_stream_continuation(&self) -> bool {
-        self.is_stream_continuation
-    }
-}
-
-#[derive(Debug)]
-pub(crate) struct PlainHistoryCell {
-    lines: Vec<Line<'static>>,
-}
-
-impl PlainHistoryCell {
-    pub(crate) fn new(lines: Vec<Line<'static>>) -> Self {
-        Self { lines }
-    }
-}
-
-impl HistoryCell for PlainHistoryCell {
-    fn display_lines(&self, _width: u16) -> Vec<Line<'static>> {
-        self.lines.clone()
-    }
-
-    fn raw_lines(&self) -> Vec<Line<'static>> {
-        plain_lines(self.lines.clone())
-    }
-}
-
-#[cfg_attr(debug_assertions, allow(dead_code))]
-#[derive(Debug)]
-pub(crate) struct UpdateAvailableHistoryCell {
-    latest_version: String,
-    update_action: Option<UpdateAction>,
-}
-
-#[cfg_attr(debug_assertions, allow(dead_code))]
-impl UpdateAvailableHistoryCell {
-    pub(crate) fn new(latest_version: String, update_action: Option<UpdateAction>) -> Self {
-        Self {
-            latest_version,
-            update_action,
-        }
-    }
-}
-
-impl HistoryCell for UpdateAvailableHistoryCell {
-    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
-        use ratatui_macros::line;
-        use ratatui_macros::text;
-        let update_instruction = if let Some(update_action) = self.update_action {
-            line!["Run ", update_action.command_str().cyan(), " to update."]
-        } else {
-            line![
-                "See ",
-                "https://github.com/openai/codex".cyan().underlined(),
-                " for installation options."
-            ]
-        };
-
-        let content = text![
-            line![
-                padded_emoji("✨").bold().cyan(),
-                "Update available!".bold().cyan(),
-                " ",
-                format!("{CODEX_CLI_VERSION} -> {}", self.latest_version).bold(),
-            ],
-            update_instruction,
-            "",
-            "See full release notes:",
-            "https://github.com/openai/codex/releases/latest"
-                .cyan()
-                .underlined(),
-        ];
-
-        let inner_width = content
-            .width()
-            .min(usize::from(width.saturating_sub(4)))
-            .max(1);
-        with_border_with_inner_width(content.lines, inner_width)
-    }
-
-    fn raw_lines(&self) -> Vec<Line<'static>> {
-        let update_instruction = if let Some(update_action) = self.update_action {
-            format!("Run {} to update.", update_action.command_str())
-        } else {
-            "See https://github.com/openai/codex for installation options.".to_string()
-        };
-        vec![
-            Line::from("Update available!"),
-            Line::from(format!("{CODEX_CLI_VERSION} -> {}", self.latest_version)),
-            Line::from(update_instruction),
-            Line::from(""),
-            Line::from("See full release notes:"),
-            Line::from("https://github.com/openai/codex/releases/latest"),
-        ]
-    }
-}
-
-#[derive(Debug)]
-pub(crate) struct PrefixedWrappedHistoryCell {
-    text: Text<'static>,
-    initial_prefix: Line<'static>,
-    subsequent_prefix: Line<'static>,
-}
-
-impl PrefixedWrappedHistoryCell {
-    pub(crate) fn new(
-        text: impl Into<Text<'static>>,
-        initial_prefix: impl Into<Line<'static>>,
-        subsequent_prefix: impl Into<Line<'static>>,
-    ) -> Self {
-        Self {
-            text: text.into(),
-            initial_prefix: initial_prefix.into(),
-            subsequent_prefix: subsequent_prefix.into(),
-        }
-    }
-}
-
-impl HistoryCell for PrefixedWrappedHistoryCell {
-    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
-        if width == 0 {
-            return Vec::new();
-        }
-        let opts = RtOptions::new(width.max(1) as usize)
-            .initial_indent(self.initial_prefix.clone())
-            .subsequent_indent(self.subsequent_prefix.clone());
-        adaptive_wrap_lines(&self.text, opts)
-    }
-
-    fn raw_lines(&self) -> Vec<Line<'static>> {
-        plain_lines(self.text.clone().lines)
-    }
-}
-
-#[derive(Debug)]
-pub(crate) struct UnifiedExecInteractionCell {
-    command_display: Option<String>,
-    stdin: String,
-}
-
-impl UnifiedExecInteractionCell {
-    pub(crate) fn new(command_display: Option<String>, stdin: String) -> Self {
-        Self {
-            command_display,
-            stdin,
-        }
-    }
-}
-
-impl HistoryCell for UnifiedExecInteractionCell {
-    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
-        if width == 0 {
-            return Vec::new();
-        }
-        let wrap_width = width as usize;
-        let waited_only = self.stdin.is_empty();
-
-        let mut header_spans = if waited_only {
-            vec!["• Waited for background terminal".bold()]
-        } else {
-            vec!["↳ ".dim(), "Interacted with background terminal".bold()]
-        };
-        if let Some(command) = &self.command_display
-            && !command.is_empty()
-        {
-            header_spans.push(" · ".dim());
-            header_spans.push(command.clone().dim());
-        }
-        let header = Line::from(header_spans);
-
-        let mut out: Vec<Line<'static>> = Vec::new();
-        let header_wrapped = adaptive_wrap_line(&header, RtOptions::new(wrap_width));
-        push_owned_lines(&header_wrapped, &mut out);
-
-        if waited_only {
-            return out;
-        }
-
-        let input_lines: Vec<Line<'static>> = self
-            .stdin
-            .lines()
-            .map(|line| Line::from(line.to_string()))
-            .collect();
-
-        let input_wrapped = adaptive_wrap_lines(
-            input_lines,
-            RtOptions::new(wrap_width)
-                .initial_indent(Line::from("  └ ".dim()))
-                .subsequent_indent(Line::from("    ".dim())),
-        );
-        out.extend(input_wrapped);
-        out
-    }
-
-    fn raw_lines(&self) -> Vec<Line<'static>> {
-        let mut out = Vec::new();
-        if self.stdin.is_empty() {
-            if let Some(command) = self
-                .command_display
-                .as_ref()
-                .filter(|command| !command.is_empty())
-            {
-                out.push(Line::from(format!(
-                    "Waited for background terminal: {command}"
-                )));
-            } else {
-                out.push(Line::from("Waited for background terminal"));
-            }
-            return out;
-        }
-
-        if let Some(command) = self
-            .command_display
-            .as_ref()
-            .filter(|command| !command.is_empty())
-        {
-            out.push(Line::from(format!(
-                "Interacted with background terminal: {command}"
-            )));
-        } else {
-            out.push(Line::from("Interacted with background terminal"));
-        }
-        out.extend(raw_lines_from_source(&self.stdin));
-        out
-    }
-}
-
-pub(crate) fn new_unified_exec_interaction(
-    command_display: Option<String>,
-    stdin: String,
-) -> UnifiedExecInteractionCell {
-    UnifiedExecInteractionCell::new(command_display, stdin)
-}
-
-#[derive(Debug)]
-struct UnifiedExecProcessesCell {
-    processes: Vec<UnifiedExecProcessDetails>,
-}
-
-impl UnifiedExecProcessesCell {
-    fn new(processes: Vec<UnifiedExecProcessDetails>) -> Self {
-        Self { processes }
-    }
-}
-
-#[derive(Debug, Clone)]
-pub(crate) struct UnifiedExecProcessDetails {
-    pub(crate) command_display: String,
-    pub(crate) recent_chunks: Vec<String>,
-}
-
-impl HistoryCell for UnifiedExecProcessesCell {
-    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
-        if width == 0 {
-            return Vec::new();
-        }
-
-        let wrap_width = width as usize;
-        let max_processes = 16usize;
-        let mut out: Vec<Line<'static>> = Vec::new();
-        out.push(vec!["Background terminals".bold()].into());
-        out.push("".into());
-
-        if self.processes.is_empty() {
-            out.push("  • No background terminals running.".italic().into());
-            return out;
-        }
-
-        let prefix = "  • ";
-        let prefix_width = UnicodeWidthStr::width(prefix);
-        let truncation_suffix = " [...]";
-        let truncation_suffix_width = UnicodeWidthStr::width(truncation_suffix);
-        let mut shown = 0usize;
-        for process in &self.processes {
-            if shown >= max_processes {
-                break;
-            }
-            let command = &process.command_display;
-            let (snippet, snippet_truncated) = {
-                let (first_line, has_more_lines) = match command.split_once('\n') {
-                    Some((first, _)) => (first, true),
-                    None => (command.as_str(), false),
-                };
-                let max_graphemes = 80;
-                let mut graphemes = first_line.grapheme_indices(true);
-                if let Some((byte_index, _)) = graphemes.nth(max_graphemes) {
-                    (first_line[..byte_index].to_string(), true)
-                } else {
-                    (first_line.to_string(), has_more_lines)
-                }
-            };
-            if wrap_width <= prefix_width {
-                out.push(Line::from(prefix.dim()));
-                shown += 1;
-                continue;
-            }
-            let budget = wrap_width.saturating_sub(prefix_width);
-            let mut needs_suffix = snippet_truncated;
-            if !needs_suffix {
-                let (_, remainder, _) = take_prefix_by_width(&snippet, budget);
-                if !remainder.is_empty() {
-                    needs_suffix = true;
-                }
-            }
-            if needs_suffix && budget > truncation_suffix_width {
-                let available = budget.saturating_sub(truncation_suffix_width);
-                let (truncated, _, _) = take_prefix_by_width(&snippet, available);
-                out.push(vec![prefix.dim(), truncated.cyan(), truncation_suffix.dim()].into());
-            } else {
-                let (truncated, _, _) = take_prefix_by_width(&snippet, budget);
-                out.push(vec![prefix.dim(), truncated.cyan()].into());
-            }
-
-            let chunk_prefix_first = "    ↳ ";
-            let chunk_prefix_next = "      ";
-            for (idx, chunk) in process.recent_chunks.iter().enumerate() {
-                let chunk_prefix = if idx == 0 {
-                    chunk_prefix_first
-                } else {
-                    chunk_prefix_next
-                };
-                let chunk_prefix_width = UnicodeWidthStr::width(chunk_prefix);
-                if wrap_width <= chunk_prefix_width {
-                    out.push(Line::from(chunk_prefix.dim()));
-                    continue;
-                }
-                let budget = wrap_width.saturating_sub(chunk_prefix_width);
-                let (truncated, remainder, _) = take_prefix_by_width(chunk, budget);
-                if !remainder.is_empty() && budget > truncation_suffix_width {
-                    let available = budget.saturating_sub(truncation_suffix_width);
-                    let (shorter, _, _) = take_prefix_by_width(chunk, available);
-                    out.push(
-                        vec![chunk_prefix.dim(), shorter.dim(), truncation_suffix.dim()].into(),
-                    );
-                } else {
-                    out.push(vec![chunk_prefix.dim(), truncated.dim()].into());
-                }
-            }
-            shown += 1;
-        }
-
-        let remaining = self.processes.len().saturating_sub(shown);
-        if remaining > 0 {
-            let more_text = format!("... and {remaining} more running");
-            if wrap_width <= prefix_width {
-                out.push(Line::from(prefix.dim()));
-            } else {
-                let budget = wrap_width.saturating_sub(prefix_width);
-                let (truncated, _, _) = take_prefix_by_width(&more_text, budget);
-                out.push(vec![prefix.dim(), truncated.dim()].into());
-            }
-        }
-
-        out
-    }
-
-    fn raw_lines(&self) -> Vec<Line<'static>> {
-        plain_lines(self.display_lines(u16::MAX))
-    }
-
-    fn desired_height(&self, width: u16) -> u16 {
-        self.display_lines(width).len() as u16
-    }
-}
-
-pub(crate) fn new_unified_exec_processes_output(
-    processes: Vec<UnifiedExecProcessDetails>,
-) -> CompositeHistoryCell {
-    let command = PlainHistoryCell::new(vec!["/ps".magenta().into()]);
-    let summary = UnifiedExecProcessesCell::new(processes);
-    CompositeHistoryCell::new(vec![Box::new(command), Box::new(summary)])
-}
-
-fn truncate_exec_snippet(full_cmd: &str) -> String {
-    let mut snippet = match full_cmd.split_once('\n') {
-        Some((first, _)) => format!("{first} ..."),
-        None => full_cmd.to_string(),
-    };
-    snippet = truncate_text(&snippet, /*max_graphemes*/ 80);
-    snippet
-}
-
-fn exec_snippet(command: &[String]) -> String {
-    let full_cmd = strip_bash_lc_and_escape(command);
-    truncate_exec_snippet(&full_cmd)
-}
-
-#[derive(Debug, Clone, PartialEq, Eq)]
-pub(crate) enum ReviewDecision {
-    Approved,
-    ApprovedExecpolicyAmendment {
-        proposed_execpolicy_amendment: ExecPolicyAmendment,
-    },
-    ApprovedForSession,
-    NetworkPolicyAmendment {
-        network_policy_amendment: NetworkPolicyAmendment,
-    },
-    Denied,
-    TimedOut,
-    Abort,
-}
-
-pub fn new_approval_decision_cell(
-    command: Vec<String>,
-    decision: ReviewDecision,
-    actor: ApprovalDecisionActor,
-) -> Box<dyn HistoryCell> {
-    use ReviewDecision::*;
-    use codex_protocol::approvals::NetworkPolicyRuleAction;
-
-    let (symbol, summary): (Span<'static>, Vec<Span<'static>>) = match decision {
-        Approved => {
-            let snippet = Span::from(exec_snippet(&command)).dim();
-            (
-                "✔ ".green(),
-                vec![
-                    actor.subject().into(),
-                    "approved".bold(),
-                    " codex to run ".into(),
-                    snippet,
-                    " this time".bold(),
-                ],
-            )
-        }
-        ApprovedExecpolicyAmendment {
-            proposed_execpolicy_amendment,
-        } => {
-            let snippet = Span::from(exec_snippet(&proposed_execpolicy_amendment.command)).dim();
-            (
-                "✔ ".green(),
-                vec![
-                    actor.subject().into(),
-                    "approved".bold(),
-                    " codex to always run commands that start with ".into(),
-                    snippet,
-                ],
-            )
-        }
-        ApprovedForSession => {
-            let snippet = Span::from(exec_snippet(&command)).dim();
-            (
-                "✔ ".green(),
-                vec![
-                    actor.subject().into(),
-                    "approved".bold(),
-                    " codex to run ".into(),
-                    snippet,
-                    " every time this session".bold(),
-                ],
-            )
-        }
-        NetworkPolicyAmendment {
-            network_policy_amendment,
-        } => match network_policy_amendment.action {
-            NetworkPolicyRuleAction::Allow => (
-                "✔ ".green(),
-                vec![
-                    actor.subject().into(),
-                    "persisted".bold(),
-                    " Codex network access to ".into(),
-                    Span::from(network_policy_amendment.host).dim(),
-                ],
-            ),
-            NetworkPolicyRuleAction::Deny => (
-                "✗ ".red(),
-                vec![
-                    actor.subject().into(),
-                    "denied".bold(),
-                    " codex network access to ".into(),
-                    Span::from(network_policy_amendment.host).dim(),
-                    " and saved that rule".into(),
-                ],
-            ),
-        },
-        Denied => {
-            let snippet = Span::from(exec_snippet(&command)).dim();
-            let summary = match actor {
-                ApprovalDecisionActor::User => vec![
-                    actor.subject().into(),
-                    "did not approve".bold(),
-                    " codex to run ".into(),
-                    snippet,
-                ],
-                ApprovalDecisionActor::Guardian => vec![
-                    "Request ".into(),
-                    "denied".bold(),
-                    " for codex to run ".into(),
-                    snippet,
-                ],
-            };
-            ("✗ ".red(), summary)
-        }
-        TimedOut => {
-            let snippet = Span::from(exec_snippet(&command)).dim();
-            (
-                "✗ ".red(),
-                vec![
-                    "Review ".into(),
-                    "timed out".bold(),
-                    " before codex could run ".into(),
-                    snippet,
-                ],
-            )
-        }
-        Abort => {
-            let snippet = Span::from(exec_snippet(&command)).dim();
-            (
-                "✗ ".red(),
-                vec![
-                    actor.subject().into(),
-                    "canceled".bold(),
-                    " the request to run ".into(),
-                    snippet,
-                ],
-            )
-        }
-    };
-
-    Box::new(PrefixedWrappedHistoryCell::new(
-        Line::from(summary),
-        symbol,
-        "  ",
-    ))
-}
-
-#[derive(Debug, Clone, Copy, PartialEq, Eq)]
-pub enum ApprovalDecisionActor {
-    User,
-    Guardian,
-}
-
-impl ApprovalDecisionActor {
-    fn subject(self) -> &'static str {
-        match self {
-            Self::User => "You ",
-            Self::Guardian => "Auto-reviewer ",
-        }
-    }
-}
-
-pub fn new_guardian_denied_patch_request(files: Vec<String>) -> Box<dyn HistoryCell> {
-    let mut summary = vec![
-        "Request ".into(),
-        "denied".bold(),
-        " for codex to apply ".into(),
-    ];
-    if files.len() == 1 {
-        summary.push("a patch touching ".into());
-        summary.push(Span::from(files[0].clone()).dim());
-    } else {
-        summary.push("a patch touching ".into());
-        summary.push(Span::from(files.len().to_string()).dim());
-        summary.push(" files".into());
-    }
-
-    Box::new(PrefixedWrappedHistoryCell::new(
-        Line::from(summary),
-        "✗ ".red(),
-        "  ",
-    ))
-}
-
-pub fn new_guardian_denied_action_request(summary: String) -> Box<dyn HistoryCell> {
-    let line = Line::from(vec![
-        "Request ".into(),
-        "denied".bold(),
-        " for ".into(),
-        Span::from(summary).dim(),
-    ]);
-    Box::new(PrefixedWrappedHistoryCell::new(line, "✗ ".red(), "  "))
-}
-
-pub fn new_guardian_approved_action_request(summary: String) -> Box<dyn HistoryCell> {
-    let line = Line::from(vec![
-        "Request ".into(),
-        "approved".bold(),
-        " for ".into(),
-        Span::from(summary).dim(),
-    ]);
-    Box::new(PrefixedWrappedHistoryCell::new(line, "✔ ".green(), "  "))
-}
-
-pub fn new_guardian_timed_out_patch_request(files: Vec<String>) -> Box<dyn HistoryCell> {
-    let mut summary = vec![
-        "Review ".into(),
-        "timed out".bold(),
-        " before codex could apply ".into(),
-    ];
-    if files.len() == 1 {
-        summary.push("a patch touching ".into());
-        summary.push(Span::from(files[0].clone()).dim());
-    } else {
-        summary.push("a patch touching ".into());
-        summary.push(Span::from(files.len().to_string()).dim());
-        summary.push(" files".into());
-    }
-
-    Box::new(PrefixedWrappedHistoryCell::new(
-        Line::from(summary),
-        "✗ ".red(),
-        "  ",
-    ))
-}
-
-pub fn new_guardian_timed_out_action_request(summary: String) -> Box<dyn HistoryCell> {
-    let line = Line::from(vec![
-        "Review ".into(),
-        "timed out".bold(),
-        " before ".into(),
-        Span::from(summary).dim(),
-    ]);
-    Box::new(PrefixedWrappedHistoryCell::new(line, "✗ ".red(), "  "))
-}
-
-/// Cyan history cell line showing the current review status.
-pub(crate) fn new_review_status_line(message: String) -> PlainHistoryCell {
-    PlainHistoryCell {
-        lines: vec![Line::from(message.cyan())],
-    }
-}
-
-#[derive(Debug)]
-pub(crate) struct PatchHistoryCell {
-    changes: HashMap<PathBuf, FileChange>,
-    cwd: PathBuf,
-}
-
-impl HistoryCell for PatchHistoryCell {
-    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
-        create_diff_summary(&self.changes, &self.cwd, width as usize)
-    }
-
-    fn raw_lines(&self) -> Vec<Line<'static>> {
-        plain_lines(create_diff_summary(
-            &self.changes,
-            &self.cwd,
-            RAW_DIFF_SUMMARY_WIDTH,
-        ))
-    }
-}
-
-#[derive(Debug)]
-struct CompletedMcpToolCallWithImageOutput {
-    _image: DynamicImage,
-}
-impl HistoryCell for CompletedMcpToolCallWithImageOutput {
-    fn display_lines(&self, _width: u16) -> Vec<Line<'static>> {
-        vec!["tool result (image output)".into()]
-    }
-
-    fn raw_lines(&self) -> Vec<Line<'static>> {
-        vec![Line::from("tool result (image output)")]
-    }
-}
-
-pub(crate) const SESSION_HEADER_MAX_INNER_WIDTH: usize = 56; // Just an eyeballed value
-
-pub(crate) fn card_inner_width(width: u16, max_inner_width: usize) -> Option<usize> {
-    if width < 4 {
-        return None;
-    }
-    let inner_width = std::cmp::min(width.saturating_sub(4) as usize, max_inner_width);
-    Some(inner_width)
-}
-
-/// Render `lines` inside a border sized to the widest span in the content.
-pub(crate) fn with_border(lines: Vec<Line<'static>>) -> Vec<Line<'static>> {
-    with_border_internal(lines, /*forced_inner_width*/ None)
-}
-
-/// Render `lines` inside a border whose inner width is at least `inner_width`.
-///
-/// This is useful when callers have already clamped their content to a
-/// specific width and want the border math centralized here instead of
-/// duplicating padding logic in the TUI widgets themselves.
-pub(crate) fn with_border_with_inner_width(
-    lines: Vec<Line<'static>>,
-    inner_width: usize,
-) -> Vec<Line<'static>> {
-    with_border_internal(lines, Some(inner_width))
-}
-
-fn with_border_internal(
-    lines: Vec<Line<'static>>,
-    forced_inner_width: Option<usize>,
-) -> Vec<Line<'static>> {
-    let max_line_width = lines
-        .iter()
-        .map(|line| {
-            line.iter()
-                .map(|span| UnicodeWidthStr::width(span.content.as_ref()))
-                .sum::<usize>()
-        })
-        .max()
-        .unwrap_or(0);
-    let content_width = forced_inner_width
-        .unwrap_or(max_line_width)
-        .max(max_line_width);
-
-    let mut out = Vec::with_capacity(lines.len() + 2);
-    let border_inner_width = content_width + 2;
-    out.push(vec![format!("╭{}╮", "─".repeat(border_inner_width)).dim()].into());
-
-    for line in lines.into_iter() {
-        let used_width: usize = line
-            .iter()
-            .map(|span| UnicodeWidthStr::width(span.content.as_ref()))
-            .sum();
-        let span_count = line.spans.len();
-        let mut spans: Vec<Span<'static>> = Vec::with_capacity(span_count + 4);
-        spans.push(Span::from("│ ").dim());
-        spans.extend(line.into_iter());
-        if used_width < content_width {
-            spans.push(Span::from(" ".repeat(content_width - used_width)).dim());
-        }
-        spans.push(Span::from(" │").dim());
-        out.push(Line::from(spans));
-    }
-
-    out.push(vec![format!("╰{}╯", "─".repeat(border_inner_width)).dim()].into());
-
-    out
-}
-
-/// Return the emoji followed by a hair space (U+200A).
-/// Using only the hair space avoids excessive padding after the emoji while
-/// still providing a small visual gap across terminals.
-pub(crate) fn padded_emoji(emoji: &str) -> String {
-    format!("{emoji}\u{200A}")
-}
-
-#[derive(Debug)]
-struct TooltipHistoryCell {
-    tip: String,
-    cwd: PathBuf,
-}
-
-impl TooltipHistoryCell {
-    fn new(tip: String, cwd: &Path) -> Self {
-        Self {
-            tip,
-            cwd: cwd.to_path_buf(),
-        }
-    }
-}
-
-impl HistoryCell for TooltipHistoryCell {
-    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
-        let indent = "  ";
-        let indent_width = UnicodeWidthStr::width(indent);
-        let wrap_width = usize::from(width.max(1))
-            .saturating_sub(indent_width)
-            .max(1);
-        let mut lines: Vec<Line<'static>> = Vec::new();
-        append_markdown(
-            &format!("**Tip:** {}", self.tip),
-            Some(wrap_width),
-            Some(self.cwd.as_path()),
-            &mut lines,
-        );
-
-        prefix_lines(lines, indent.into(), indent.into())
-    }
-
-    fn raw_lines(&self) -> Vec<Line<'static>> {
-        vec![Line::from(format!("Tip: {}", self.tip))]
-    }
-}
-
-#[derive(Debug)]
-pub struct SessionInfoCell(CompositeHistoryCell);
-
-impl HistoryCell for SessionInfoCell {
-    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
-        self.0.display_lines(width)
-    }
-
-    fn desired_height(&self, width: u16) -> u16 {
-        self.0.desired_height(width)
-    }
-
-    fn transcript_lines(&self, width: u16) -> Vec<Line<'static>> {
-        self.0.transcript_lines(width)
-    }
-
-    fn raw_lines(&self) -> Vec<Line<'static>> {
-        self.0.raw_lines()
-    }
-}
-
-pub(crate) fn new_session_info(
-    config: &Config,
-    requested_model: &str,
-    session: &ThreadSessionState,
-    is_first_event: bool,
-    tooltip_override: Option<String>,
-    auth_plan: Option<PlanType>,
-    show_fast_status: bool,
-) -> SessionInfoCell {
-    // Header box rendered as history (so it appears at the very top)
-    let header = SessionHeaderHistoryCell::new(
-        session.model.clone(),
-        session.reasoning_effort,
-        show_fast_status,
-        config.cwd.to_path_buf(),
-        CODEX_CLI_VERSION,
-    )
-    .with_yolo_mode(has_yolo_permissions(
-        session.approval_policy,
-        &session.permission_profile,
-    ));
-    let mut parts: Vec<Box<dyn HistoryCell>> = vec![Box::new(header)];
-
-    if is_first_event {
-        // Help lines below the header (new copy and list)
-        let help_lines: Vec<Line<'static>> = vec![
-            "  To get started, describe a task or try one of these commands:"
-                .dim()
-                .into(),
-            Line::from(""),
-            Line::from(vec![
-                "  ".into(),
-                "/init".into(),
-                " - create an AGENTS.md file with instructions for Codex".dim(),
-            ]),
-            Line::from(vec![
-                "  ".into(),
-                "/status".into(),
-                " - show current session configuration".dim(),
-            ]),
-            Line::from(vec![
-                "  ".into(),
-                "/permissions".into(),
-                " - choose what Codex is allowed to do".dim(),
-            ]),
-            Line::from(vec![
-                "  ".into(),
-                "/model".into(),
-                " - choose what model and reasoning effort to use".dim(),
-            ]),
-            Line::from(vec![
-                "  ".into(),
-                "/review".into(),
-                " - review any changes and find issues".dim(),
-            ]),
-        ];
-
-        parts.push(Box::new(PlainHistoryCell { lines: help_lines }));
-    } else {
-        if config.show_tooltips
-            && let Some(tooltips) = tooltip_override
-                .or_else(|| tooltips::get_tooltip(auth_plan, show_fast_status))
-                .map(|tip| TooltipHistoryCell::new(tip, &config.cwd))
-        {
-            parts.push(Box::new(tooltips));
-        }
-        if requested_model != session.model.as_str() {
-            let lines = vec![
-                "model changed:".magenta().bold().into(),
-                format!("requested: {requested_model}").into(),
-                format!("used: {}", session.model).into(),
-            ];
-            parts.push(Box::new(PlainHistoryCell { lines }));
-        }
-    }
-
-    SessionInfoCell(CompositeHistoryCell { parts })
-}
-
-pub(crate) fn is_yolo_mode(config: &Config) -> bool {
-    has_yolo_permissions(
-        AskForApproval::from(config.permissions.approval_policy.value()),
-        &config.permissions.permission_profile(),
-    )
-}
-
-fn has_yolo_permissions(
-    approval_policy: AskForApproval,
-    permission_profile: &PermissionProfile,
-) -> bool {
-    let permission_profile = AppServerPermissionProfile::from(permission_profile.clone());
-    approval_policy == AskForApproval::Never
-        && matches!(
-            permission_profile,
-            AppServerPermissionProfile::Disabled
-                | AppServerPermissionProfile::Managed {
-                    file_system: PermissionProfileFileSystemPermissions::Unrestricted,
-                    network: PermissionProfileNetworkPermissions { enabled: true },
-                }
-        )
-}
-
-fn mcp_auth_status_label(status: McpAuthStatus) -> &'static str {
-    match status {
-        McpAuthStatus::Unsupported => "Unsupported",
-        McpAuthStatus::NotLoggedIn => "Not logged in",
-        McpAuthStatus::BearerToken => "Bearer token",
-        McpAuthStatus::OAuth => "OAuth",
-    }
-}
-
-pub(crate) fn new_user_prompt(
-    message: String,
-    text_elements: Vec<TextElement>,
-    local_image_paths: Vec<PathBuf>,
-    remote_image_urls: Vec<String>,
-) -> UserHistoryCell {
-    UserHistoryCell {
-        message,
-        text_elements,
-        local_image_paths,
-        remote_image_urls,
-    }
-}
-
-#[derive(Debug)]
-pub(crate) struct SessionHeaderHistoryCell {
-    version: &'static str,
-    model: String,
-    model_style: Style,
-    reasoning_effort: Option<ReasoningEffortConfig>,
-    show_fast_status: bool,
-    directory: PathBuf,
-    yolo_mode: bool,
-}
-
-impl SessionHeaderHistoryCell {
-    pub(crate) fn new(
-        model: String,
-        reasoning_effort: Option<ReasoningEffortConfig>,
-        show_fast_status: bool,
-        directory: PathBuf,
-        version: &'static str,
-    ) -> Self {
-        Self::new_with_style(
-            model,
-            Style::default(),
-            reasoning_effort,
-            show_fast_status,
-            directory,
-            version,
-        )
-    }
-
-    pub(crate) fn new_with_style(
-        model: String,
-        model_style: Style,
-        reasoning_effort: Option<ReasoningEffortConfig>,
-        show_fast_status: bool,
-        directory: PathBuf,
-        version: &'static str,
-    ) -> Self {
-        Self {
-            version,
-            model,
-            model_style,
-            reasoning_effort,
-            show_fast_status,
-            directory,
-            yolo_mode: false,
-        }
-    }
-
-    pub(crate) fn with_yolo_mode(mut self, yolo_mode: bool) -> Self {
-        self.yolo_mode = yolo_mode;
-        self
-    }
-
-    fn format_directory(&self, max_width: Option<usize>) -> String {
-        Self::format_directory_inner(&self.directory, max_width)
-    }
-
-    fn format_directory_inner(directory: &Path, max_width: Option<usize>) -> String {
-        let formatted = if let Some(rel) = relativize_to_home(directory) {
-            if rel.as_os_str().is_empty() {
-                "~".to_string()
-            } else {
-                format!("~{}{}", std::path::MAIN_SEPARATOR, rel.display())
-            }
-        } else {
-            directory.display().to_string()
-        };
-
-        if let Some(max_width) = max_width {
-            if max_width == 0 {
-                return String::new();
-            }
-            if UnicodeWidthStr::width(formatted.as_str()) > max_width {
-                return crate::text_formatting::center_truncate_path(&formatted, max_width);
-            }
-        }
-
-        formatted
-    }
-
-    fn reasoning_label(&self) -> Option<&'static str> {
-        self.reasoning_effort.map(|effort| match effort {
-            ReasoningEffortConfig::Minimal => "minimal",
-            ReasoningEffortConfig::Low => "low",
-            ReasoningEffortConfig::Medium => "medium",
-            ReasoningEffortConfig::High => "high",
-            ReasoningEffortConfig::XHigh => "xhigh",
-            ReasoningEffortConfig::None => "none",
-        })
-    }
-}
-
-impl HistoryCell for SessionHeaderHistoryCell {
-    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
-        let Some(inner_width) = card_inner_width(width, SESSION_HEADER_MAX_INNER_WIDTH) else {
-            return Vec::new();
-        };
-
-        let make_row = |spans: Vec<Span<'static>>| Line::from(spans);
-
-        // Title line rendered inside the box: ">_ OpenAI Codex (vX)"
-        let title_spans: Vec<Span<'static>> = vec![
-            Span::from(">_ ").dim(),
-            Span::from("OpenAI Codex").bold(),
-            Span::from(" ").dim(),
-            Span::from(format!("(v{})", self.version)).dim(),
-        ];
-
-        const CHANGE_MODEL_HINT_COMMAND: &str = "/model";
-        const CHANGE_MODEL_HINT_EXPLANATION: &str = " to change";
-        const DIR_LABEL: &str = "directory:";
-        const PERMISSIONS_LABEL: &str = "permissions:";
-        let label_width = if self.yolo_mode {
-            DIR_LABEL.len().max(PERMISSIONS_LABEL.len())
-        } else {
-            DIR_LABEL.len()
-        };
-
-        let model_label = format!(
-            "{model_label:<label_width$}",
-            model_label = "model:",
-            label_width = label_width
-        );
-        let reasoning_label = self.reasoning_label();
-        let model_spans: Vec<Span<'static>> = {
-            let mut spans = vec![
-                Span::from(format!("{model_label} ")).dim(),
-                Span::styled(self.model.clone(), self.model_style),
-            ];
-            if let Some(reasoning) = reasoning_label {
-                spans.push(Span::from(" "));
-                spans.push(Span::from(reasoning));
-            }
-            if self.show_fast_status {
-                spans.push("   ".into());
-                spans.push(Span::styled("fast", self.model_style.magenta()));
-            }
-            spans.push("   ".dim());
-            spans.push(CHANGE_MODEL_HINT_COMMAND.cyan());
-            spans.push(CHANGE_MODEL_HINT_EXPLANATION.dim());
-            spans
-        };
-
-        let dir_label = format!("{DIR_LABEL:<label_width$}");
-        let dir_prefix = format!("{dir_label} ");
-        let dir_prefix_width = UnicodeWidthStr::width(dir_prefix.as_str());
-        let dir_max_width = inner_width.saturating_sub(dir_prefix_width);
-        let dir = self.format_directory(Some(dir_max_width));
-        let dir_spans = vec![Span::from(dir_prefix).dim(), Span::from(dir)];
-
-        let mut lines = vec![
-            make_row(title_spans),
-            make_row(Vec::new()),
-            make_row(model_spans),
-            make_row(dir_spans),
-        ];
-
-        if self.yolo_mode {
-            let permissions_label = format!("{PERMISSIONS_LABEL:<label_width$}");
-            lines.push(make_row(vec![
-                Span::from(format!("{permissions_label} ")).dim(),
-                "YOLO mode".magenta().bold(),
-            ]));
-        }
-
-        with_border(lines)
-    }
-
-    fn raw_lines(&self) -> Vec<Line<'static>> {
-        let mut lines = vec![
-            Line::from(format!("OpenAI Codex (v{})", self.version)),
-            Line::from(format!(
-                "model: {}{}",
-                self.model,
-                self.reasoning_label()
-                    .map(|reasoning| format!(" {reasoning}"))
-                    .unwrap_or_default()
-            )),
-            Line::from(format!(
-                "directory: {}",
-                self.format_directory(/*max_width*/ None)
-            )),
-        ];
-        if self.yolo_mode {
-            lines.push(Line::from("permissions: YOLO mode"));
-        }
-        lines
-    }
-}
-
-#[derive(Debug)]
-pub(crate) struct CompositeHistoryCell {
-    parts: Vec<Box<dyn HistoryCell>>,
-}
-
-impl CompositeHistoryCell {
-    pub(crate) fn new(parts: Vec<Box<dyn HistoryCell>>) -> Self {
-        Self { parts }
-    }
-}
-
-impl HistoryCell for CompositeHistoryCell {
-    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
-        let mut out: Vec<Line<'static>> = Vec::new();
-        let mut first = true;
-        for part in &self.parts {
-            let mut lines = part.display_lines(width);
-            if !lines.is_empty() {
-                if !first {
-                    out.push(Line::from(""));
-                }
-                out.append(&mut lines);
-                first = false;
-            }
-        }
-        out
-    }
-
-    fn raw_lines(&self) -> Vec<Line<'static>> {
-        let mut out: Vec<Line<'static>> = Vec::new();
-        let mut first = true;
-        for part in &self.parts {
-            let mut lines = part.raw_lines();
-            if !lines.is_empty() {
-                if !first {
-                    out.push(Line::from(""));
-                }
-                out.append(&mut lines);
-                first = false;
-            }
-        }
-        out
-    }
-}
-
-#[derive(Debug)]
-pub(crate) struct McpToolCallCell {
-    call_id: String,
-    invocation: McpInvocation,
-    start_time: Instant,
-    duration: Option<Duration>,
-    result: Option<Result<codex_protocol::mcp::CallToolResult, String>>,
-    animations_enabled: bool,
-}
-
-#[derive(Debug, Clone)]
-pub(crate) struct McpInvocation {
-    pub(crate) server: String,
-    pub(crate) tool: String,
-    pub(crate) arguments: Option<serde_json::Value>,
-}
-
-impl McpToolCallCell {
-    pub(crate) fn new(
-        call_id: String,
-        invocation: McpInvocation,
-        animations_enabled: bool,
-    ) -> Self {
-        Self {
-            call_id,
-            invocation,
-            start_time: Instant::now(),
-            duration: None,
-            result: None,
-            animations_enabled,
-        }
-    }
-
-    pub(crate) fn call_id(&self) -> &str {
-        &self.call_id
-    }
-
-    pub(crate) fn complete(
-        &mut self,
-        duration: Duration,
-        result: Result<codex_protocol::mcp::CallToolResult, String>,
-    ) -> Option<Box<dyn HistoryCell>> {
-        let image_cell = try_new_completed_mcp_tool_call_with_image_output(&result)
-            .map(|cell| Box::new(cell) as Box<dyn HistoryCell>);
-        self.duration = Some(duration);
-        self.result = Some(result);
-        image_cell
-    }
-
-    fn success(&self) -> Option<bool> {
-        match self.result.as_ref() {
-            Some(Ok(result)) => Some(!result.is_error.unwrap_or(false)),
-            Some(Err(_)) => Some(false),
-            None => None,
-        }
-    }
-
-    pub(crate) fn mark_failed(&mut self) {
-        let elapsed = self.start_time.elapsed();
-        self.duration = Some(elapsed);
-        self.result = Some(Err("interrupted".to_string()));
-    }
-
-    fn render_content_block(block: &serde_json::Value, width: usize) -> String {
-        let content = match serde_json::from_value::<rmcp::model::Content>(block.clone()) {
-            Ok(content) => content,
-            Err(_) => {
-                return format_and_truncate_tool_result(
-                    &block.to_string(),
-                    TOOL_CALL_MAX_LINES,
-                    width,
-                );
-            }
-        };
-
-        match content.raw {
-            rmcp::model::RawContent::Text(text) => {
-                format_and_truncate_tool_result(&text.text, TOOL_CALL_MAX_LINES, width)
-            }
-            rmcp::model::RawContent::Image(_) => "<image content>".to_string(),
-            rmcp::model::RawContent::Audio(_) => "<audio content>".to_string(),
-            rmcp::model::RawContent::Resource(resource) => {
-                let uri = match resource.resource {
-                    rmcp::model::ResourceContents::TextResourceContents { uri, .. } => uri,
-                    rmcp::model::ResourceContents::BlobResourceContents { uri, .. } => uri,
-                };
-                format!("embedded resource: {uri}")
-            }
-            rmcp::model::RawContent::ResourceLink(link) => format!("link: {}", link.uri),
-        }
-    }
-}
-
-impl HistoryCell for McpToolCallCell {
-    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
-        let mut lines: Vec<Line<'static>> = Vec::new();
-        let status = self.success();
-        let bullet = match status {
-            Some(true) => "•".green().bold(),
-            Some(false) => "•".red().bold(),
-            None => activity_indicator(
-                Some(self.start_time),
-                MotionMode::from_animations_enabled(self.animations_enabled),
-                ReducedMotionIndicator::StaticBullet,
-            )
-            .unwrap_or_else(|| "•".dim()),
-        };
-        let header_text = if status.is_some() {
-            "Called"
-        } else {
-            "Calling"
-        };
-
-        let invocation_line = line_to_static(&format_mcp_invocation(self.invocation.clone()));
-        let mut compact_spans = vec![bullet.clone(), " ".into(), header_text.bold(), " ".into()];
-        let mut compact_header = Line::from(compact_spans.clone());
-        let reserved = compact_header.width();
-
-        let inline_invocation =
-            invocation_line.width() <= (width as usize).saturating_sub(reserved);
-
-        if inline_invocation {
-            compact_header.extend(invocation_line.spans.clone());
-            lines.push(compact_header);
-        } else {
-            compact_spans.pop(); // drop trailing space for standalone header
-            lines.push(Line::from(compact_spans));
-
-            let opts = RtOptions::new((width as usize).saturating_sub(4))
-                .initial_indent("".into())
-                .subsequent_indent("    ".into());
-            let wrapped = adaptive_wrap_line(&invocation_line, opts);
-            let body_lines: Vec<Line<'static>> = wrapped.iter().map(line_to_static).collect();
-            lines.extend(prefix_lines(body_lines, "  └ ".dim(), "    ".into()));
-        }
-
-        let mut detail_lines: Vec<Line<'static>> = Vec::new();
-        // Reserve four columns for the tree prefix ("  └ "/"    ") and ensure the wrapper still has at least one cell to work with.
-        let detail_wrap_width = (width as usize).saturating_sub(4).max(1);
-
-        if let Some(result) = &self.result {
-            match result {
-                Ok(codex_protocol::mcp::CallToolResult { content, .. }) => {
-                    if !content.is_empty() {
-                        for block in content {
-                            let text = Self::render_content_block(block, detail_wrap_width);
-                            for segment in text.split('\n') {
-                                let line = Line::from(segment.to_string().dim());
-                                let wrapped = adaptive_wrap_line(
-                                    &line,
-                                    RtOptions::new(detail_wrap_width)
-                                        .initial_indent("".into())
-                                        .subsequent_indent("    ".into()),
-                                );
-                                detail_lines.extend(wrapped.iter().map(line_to_static));
-                            }
-                        }
-                    }
-                }
-                Err(err) => {
-                    let err_text = format_and_truncate_tool_result(
-                        &format!("Error: {err}"),
-                        TOOL_CALL_MAX_LINES,
-                        width as usize,
-                    );
-                    let err_line = Line::from(err_text.dim());
-                    let wrapped = adaptive_wrap_line(
-                        &err_line,
-                        RtOptions::new(detail_wrap_width)
-                            .initial_indent("".into())
-                            .subsequent_indent("    ".into()),
-                    );
-                    detail_lines.extend(wrapped.iter().map(line_to_static));
-                }
-            }
-        }
-
-        if !detail_lines.is_empty() {
-            let initial_prefix: Span<'static> = if inline_invocation {
-                "  └ ".dim()
-            } else {
-                "    ".into()
-            };
-            lines.extend(prefix_lines(detail_lines, initial_prefix, "    ".into()));
-        }
-
-        lines
-    }
-
-    fn raw_lines(&self) -> Vec<Line<'static>> {
-        let header_text = if self.success().is_some() {
-            "Called"
-        } else {
-            "Calling"
-        };
-        let mut lines = vec![Line::from(format!(
-            "{header_text} {}",
-            format_mcp_invocation(self.invocation.clone())
-        ))];
-
-        if let Some(result) = &self.result {
-            match result {
-                Ok(codex_protocol::mcp::CallToolResult { content, .. }) => {
-                    for block in content {
-                        let text = Self::render_content_block(block, RAW_TOOL_OUTPUT_WIDTH);
-                        lines.extend(raw_lines_from_source(&text));
-                    }
-                }
-                Err(err) => lines.push(Line::from(format!("Error: {err}"))),
-            }
-        }
-
-        lines
-    }
-
-    fn transcript_animation_tick(&self) -> Option<u64> {
-        if !self.animations_enabled || self.result.is_some() {
-            return None;
-        }
-        Some((self.start_time.elapsed().as_millis() / 50) as u64)
-    }
-}
-
-pub(crate) fn new_active_mcp_tool_call(
-    call_id: String,
-    invocation: McpInvocation,
-    animations_enabled: bool,
-) -> McpToolCallCell {
-    McpToolCallCell::new(call_id, invocation, animations_enabled)
-}
-
-fn web_search_header(completed: bool) -> &'static str {
-    if completed {
-        "Searched"
-    } else {
-        "Searching the web"
-    }
-}
-
-fn web_search_action_detail(action: &WebSearchAction) -> String {
-    match action {
-        WebSearchAction::Search { query, queries } => {
-            query.clone().filter(|q| !q.is_empty()).unwrap_or_else(|| {
-                let items = queries.as_ref();
-                let first = items
-                    .and_then(|queries| queries.first())
-                    .cloned()
-                    .unwrap_or_default();
-                if items.is_some_and(|queries| queries.len() > 1) && !first.is_empty() {
-                    format!("{first} ...")
-                } else {
-                    first
-                }
-            })
-        }
-        WebSearchAction::OpenPage { url } => url.clone().unwrap_or_default(),
-        WebSearchAction::FindInPage { url, pattern } => match (pattern, url) {
-            (Some(pattern), Some(url)) => format!("'{pattern}' in {url}"),
-            (Some(pattern), None) => format!("'{pattern}'"),
-            (None, Some(url)) => url.clone(),
-            (None, None) => String::new(),
-        },
-        WebSearchAction::Other => String::new(),
-    }
-}
-
-fn web_search_detail(action: Option<&WebSearchAction>, query: &str) -> String {
-    let detail = action.map(web_search_action_detail).unwrap_or_default();
-    if detail.is_empty() {
-        query.to_string()
-    } else {
-        detail
-    }
-}
-
-#[derive(Debug)]
-pub(crate) struct WebSearchCell {
-    call_id: String,
-    query: String,
-    action: Option<WebSearchAction>,
-    start_time: Instant,
-    completed: bool,
-    animations_enabled: bool,
-}
-
-impl WebSearchCell {
-    pub(crate) fn new(
-        call_id: String,
-        query: String,
-        action: Option<WebSearchAction>,
-        animations_enabled: bool,
-    ) -> Self {
-        Self {
-            call_id,
-            query,
-            action,
-            start_time: Instant::now(),
-            completed: false,
-            animations_enabled,
-        }
-    }
-
-    pub(crate) fn call_id(&self) -> &str {
-        &self.call_id
-    }
-
-    pub(crate) fn update(&mut self, action: WebSearchAction, query: String) {
-        self.action = Some(action);
-        self.query = query;
-    }
-
-    pub(crate) fn complete(&mut self) {
-        self.completed = true;
-    }
-}
-
-impl HistoryCell for WebSearchCell {
-    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
-        let bullet = if self.completed {
-            "•".dim()
-        } else {
-            activity_indicator(
-                Some(self.start_time),
-                MotionMode::from_animations_enabled(self.animations_enabled),
-                ReducedMotionIndicator::StaticBullet,
-            )
-            .unwrap_or_else(|| "•".dim())
-        };
-        let header = web_search_header(self.completed);
-        let detail = web_search_detail(self.action.as_ref(), &self.query);
-        let text: Text<'static> = if detail.is_empty() {
-            Line::from(vec![header.bold()]).into()
-        } else {
-            Line::from(vec![header.bold(), " ".into(), detail.into()]).into()
-        };
-        PrefixedWrappedHistoryCell::new(text, vec![bullet, " ".into()], "  ").display_lines(width)
-    }
-
-    fn raw_lines(&self) -> Vec<Line<'static>> {
-        let header = web_search_header(self.completed);
-        let detail = web_search_detail(self.action.as_ref(), &self.query);
-        if detail.is_empty() {
-            vec![Line::from(header)]
-        } else {
-            vec![Line::from(format!("{header} {detail}"))]
-        }
-    }
-}
-
-pub(crate) fn new_active_web_search_call(
-    call_id: String,
-    query: String,
-    animations_enabled: bool,
-) -> WebSearchCell {
-    WebSearchCell::new(call_id, query, /*action*/ None, animations_enabled)
-}
-
-pub(crate) fn new_web_search_call(
-    call_id: String,
-    query: String,
-    action: WebSearchAction,
-) -> WebSearchCell {
-    let mut cell = WebSearchCell::new(
-        call_id,
-        query,
-        Some(action),
-        /*animations_enabled*/ false,
-    );
-    cell.complete();
-    cell
-}
-
-/// Returns an additional history cell if an MCP tool result includes a decodable image.
-///
-/// This intentionally returns at most one cell: the first image in `CallToolResult.content` that
-/// successfully base64-decodes and parses as an image. This is used as a lightweight “image output
-/// exists” affordance separate from the main MCP tool call cell.
-///
-/// Manual testing tip:
-/// - Run the rmcp stdio test server (`codex-rs/rmcp-client/src/bin/test_stdio_server.rs`) and
-///   register it as an MCP server via `codex mcp add`.
-/// - Use its `image_scenario` tool with cases like `text_then_image`,
-///   `invalid_base64_then_image`, or `invalid_image_bytes_then_image` to ensure this path triggers
-///   even when the first block is not a valid image.
-fn try_new_completed_mcp_tool_call_with_image_output(
-    result: &Result<codex_protocol::mcp::CallToolResult, String>,
-) -> Option<CompletedMcpToolCallWithImageOutput> {
-    let image = result
-        .as_ref()
-        .ok()?
-        .content
-        .iter()
-        .find_map(decode_mcp_image)?;
-
-    Some(CompletedMcpToolCallWithImageOutput { _image: image })
-}
-
-/// Decodes an MCP `ImageContent` block into an in-memory image.
-///
-/// Returns `None` when the block is not an image, when base64 decoding fails, when the format
-/// cannot be inferred, or when the image decoder rejects the bytes.
-fn decode_mcp_image(block: &serde_json::Value) -> Option<DynamicImage> {
-    let content = serde_json::from_value::<rmcp::model::Content>(block.clone()).ok()?;
-    let rmcp::model::RawContent::Image(image) = content.raw else {
-        return None;
-    };
-    let base64_data = if let Some(data_url) = image.data.strip_prefix("data:") {
-        data_url.split_once(',')?.1
-    } else {
-        image.data.as_str()
-    };
-    let raw_data = base64::engine::general_purpose::STANDARD
-        .decode(base64_data)
-        .map_err(|e| {
-            error!("Failed to decode image data: {e}");
-            e
-        })
-        .ok()?;
-    let reader = ImageReader::new(Cursor::new(raw_data))
-        .with_guessed_format()
-        .map_err(|e| {
-            error!("Failed to guess image format: {e}");
-            e
-        })
-        .ok()?;
-
-    reader
-        .decode()
-        .map_err(|e| {
-            error!("Image decoding failed: {e}");
-            e
-        })
-        .ok()
-}
-
-#[allow(clippy::disallowed_methods)]
-pub(crate) fn new_warning_event(message: String) -> PrefixedWrappedHistoryCell {
-    PrefixedWrappedHistoryCell::new(message.yellow(), "⚠ ".yellow(), "  ")
-}
-
-const TRUSTED_ACCESS_FOR_CYBER_URL: &str = "https://chatgpt.com/cyber";
-
-#[derive(Debug)]
-pub(crate) struct CyberPolicyNoticeCell;
-
-pub(crate) fn new_cyber_policy_error_event() -> CyberPolicyNoticeCell {
-    CyberPolicyNoticeCell
-}
-
-impl HistoryCell for CyberPolicyNoticeCell {
-    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
-        let mut lines: Vec<Line<'static>> = Vec::new();
-        lines.push(
-            vec![
-                "ⓘ ".cyan(),
-                "This chat was flagged for possible cybersecurity risk".bold(),
-            ]
-            .into(),
-        );
-
-        let wrap_width = width.saturating_sub(2).max(1) as usize;
-        let body = Line::from(vec![
-            "  If this seems wrong, try rephrasing your request. To get authorized for security work, join the "
-                .dim(),
-            "Trusted Access for Cyber".cyan().underlined(),
-            " program.".dim(),
-        ]);
-        let wrapped = adaptive_wrap_line(
-            &body,
-            RtOptions::new(wrap_width).subsequent_indent("  ".into()),
-        );
-        push_owned_lines(&wrapped, &mut lines);
-        lines.push(
-            vec![
-                "  ".into(),
-                TRUSTED_ACCESS_FOR_CYBER_URL.cyan().underlined(),
-            ]
-            .into(),
-        );
-
-        lines
-    }
-
-    fn raw_lines(&self) -> Vec<Line<'static>> {
-        vec![
-            Line::from("This chat was flagged for possible cybersecurity risk"),
-            Line::from(
-                "If this seems wrong, try rephrasing your request. To get authorized for security work, join the Trusted Access for Cyber program.",
-            ),
-            Line::from(TRUSTED_ACCESS_FOR_CYBER_URL),
-        ]
-    }
-}
-
-#[derive(Debug)]
-pub(crate) struct DeprecationNoticeCell {
-    summary: String,
-    details: Option<String>,
-}
-
-pub(crate) fn new_deprecation_notice(
-    summary: String,
-    details: Option<String>,
-) -> DeprecationNoticeCell {
-    DeprecationNoticeCell { summary, details }
-}
-
-impl HistoryCell for DeprecationNoticeCell {
-    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
-        let mut lines: Vec<Line<'static>> = Vec::new();
-        lines.push(vec!["⚠ ".red().bold(), self.summary.clone().red()].into());
-
-        let wrap_width = width.saturating_sub(4).max(1) as usize;
-
-        if let Some(details) = &self.details {
-            let detail_line = Line::from(details.clone().dim());
-            let wrapped = adaptive_wrap_line(&detail_line, RtOptions::new(wrap_width));
-            push_owned_lines(&wrapped, &mut lines);
-        }
-
-        lines
-    }
-
-    fn raw_lines(&self) -> Vec<Line<'static>> {
-        let mut lines = vec![Line::from(self.summary.clone())];
-        if let Some(details) = &self.details {
-            lines.extend(raw_lines_from_source(details));
-        }
-        lines
-    }
-}
-
-/// Render a summary of configured MCP servers from the current `Config`.
-pub(crate) fn empty_mcp_output() -> PlainHistoryCell {
-    let lines: Vec<Line<'static>> = vec![
-        "/mcp".magenta().into(),
-        "".into(),
-        vec!["🔌  ".into(), "MCP Tools".bold()].into(),
-        "".into(),
-        "  • No MCP servers configured.".italic().into(),
-        Line::from(vec![
-            "    See the ".into(),
-            "\u{1b}]8;;https://developers.openai.com/codex/mcp\u{7}MCP docs\u{1b}]8;;\u{7}"
-                .underlined(),
-            " to configure them.".into(),
-        ])
-        .style(Style::default().add_modifier(Modifier::DIM)),
-    ];
-
-    PlainHistoryCell { lines }
-}
-
-#[cfg(test)]
-/// Render MCP tools grouped by connection using the fully-qualified tool names.
-pub(crate) fn new_mcp_tools_output(
-    config: &Config,
-    tools: HashMap<String, codex_protocol::mcp::Tool>,
-    resources: HashMap<String, Vec<Resource>>,
-    resource_templates: HashMap<String, Vec<ResourceTemplate>>,
-    auth_statuses: &HashMap<String, McpAuthStatus>,
-) -> PlainHistoryCell {
-    let mut lines: Vec<Line<'static>> = vec![
-        "/mcp".magenta().into(),
-        "".into(),
-        vec!["🔌  ".into(), "MCP Tools".bold()].into(),
-        "".into(),
-    ];
-
-    if tools.is_empty() {
-        lines.push("  • No MCP tools available.".italic().into());
-        lines.push("".into());
-    }
-
-    let effective_servers = config.mcp_servers.get().clone();
-    let mut servers: Vec<_> = effective_servers.iter().collect();
-    servers.sort_by(|(a, _), (b, _)| a.cmp(b));
-
-    for (server, cfg) in servers {
-        let prefix = qualified_mcp_tool_name_prefix(server);
-        let mut names: Vec<String> = tools
-            .keys()
-            .filter(|k| k.starts_with(&prefix))
-            .map(|k| k[prefix.len()..].to_string())
-            .collect();
-        names.sort();
-
-        let auth_status = auth_statuses
-            .get(server.as_str())
-            .copied()
-            .unwrap_or(McpAuthStatus::Unsupported);
-        let mut header: Vec<Span<'static>> = vec!["  • ".into(), server.clone().into()];
-        if !cfg.enabled {
-            header.push(" ".into());
-            header.push("(disabled)".red());
-            lines.push(header.into());
-            if let Some(reason) = cfg.disabled_reason.as_ref().map(ToString::to_string) {
-                lines.push(vec!["    • Reason: ".into(), reason.dim()].into());
-            }
-            lines.push(Line::from(""));
-            continue;
-        }
-        lines.push(header.into());
-        lines.push(vec!["    • Status: ".into(), "enabled".green()].into());
-        lines.push(
-            vec![
-                "    • Auth: ".into(),
-                mcp_auth_status_label(auth_status).into(),
-            ]
-            .into(),
-        );
-
-        match &cfg.transport {
-            McpServerTransportConfig::Stdio {
-                command,
-                args,
-                env,
-                env_vars,
-                cwd,
-            } => {
-                let args_suffix = if args.is_empty() {
-                    String::new()
-                } else {
-                    format!(" {}", args.join(" "))
-                };
-                let cmd_display = format!("{command}{args_suffix}");
-                lines.push(vec!["    • Command: ".into(), cmd_display.into()].into());
-
-                if let Some(cwd) = cwd.as_ref() {
-                    lines.push(vec!["    • Cwd: ".into(), cwd.display().to_string().into()].into());
-                }
-
-                let env_display = format_env_display(env.as_ref(), env_vars);
-                if env_display != "-" {
-                    lines.push(vec!["    • Env: ".into(), env_display.into()].into());
-                }
-            }
-            McpServerTransportConfig::StreamableHttp {
-                url,
-                http_headers,
-                env_http_headers,
-                ..
-            } => {
-                lines.push(vec!["    • URL: ".into(), url.clone().into()].into());
-                if let Some(headers) = http_headers.as_ref()
-                    && !headers.is_empty()
-                {
-                    let mut pairs: Vec<_> = headers.iter().collect();
-                    pairs.sort_by(|(a, _), (b, _)| a.cmp(b));
-                    let display = pairs
-                        .into_iter()
-                        .map(|(name, _)| format!("{name}=*****"))
-                        .collect::<Vec<_>>()
-                        .join(", ");
-                    lines.push(vec!["    • HTTP headers: ".into(), display.into()].into());
-                }
-                if let Some(headers) = env_http_headers.as_ref()
-                    && !headers.is_empty()
-                {
-                    let mut pairs: Vec<_> = headers.iter().collect();
-                    pairs.sort_by(|(a, _), (b, _)| a.cmp(b));
-                    let display = pairs
-                        .into_iter()
-                        .map(|(name, var)| format!("{name}={var}"))
-                        .collect::<Vec<_>>()
-                        .join(", ");
-                    lines.push(vec!["    • Env HTTP headers: ".into(), display.into()].into());
-                }
-            }
-        }
-
-        if names.is_empty() {
-            lines.push("    • Tools: (none)".into());
-        } else {
-            lines.push(vec!["    • Tools: ".into(), names.join(", ").into()].into());
-        }
-
-        let server_resources: Vec<Resource> =
-            resources.get(server.as_str()).cloned().unwrap_or_default();
-        if server_resources.is_empty() {
-            lines.push("    • Resources: (none)".into());
-        } else {
-            let mut spans: Vec<Span<'static>> = vec!["    • Resources: ".into()];
-
-            for (idx, resource) in server_resources.iter().enumerate() {
-                if idx > 0 {
-                    spans.push(", ".into());
-                }
-
-                let label = resource.title.as_ref().unwrap_or(&resource.name);
-                spans.push(label.clone().into());
-                spans.push(" ".into());
-                spans.push(format!("({})", resource.uri).dim());
-            }
-
-            lines.push(spans.into());
-        }
-
-        let server_templates: Vec<ResourceTemplate> = resource_templates
-            .get(server.as_str())
-            .cloned()
-            .unwrap_or_default();
-        if server_templates.is_empty() {
-            lines.push("    • Resource templates: (none)".into());
-        } else {
-            let mut spans: Vec<Span<'static>> = vec!["    • Resource templates: ".into()];
-
-            for (idx, template) in server_templates.iter().enumerate() {
-                if idx > 0 {
-                    spans.push(", ".into());
-                }
-
-                let label = template.title.as_ref().unwrap_or(&template.name);
-                spans.push(label.clone().into());
-                spans.push(" ".into());
-                spans.push(format!("({})", template.uri_template).dim());
-            }
-
-            lines.push(spans.into());
-        }
-
-        lines.push(Line::from(""));
-    }
-
-    PlainHistoryCell { lines }
-}
-
-/// Build the `/mcp` history cell from app-server `McpServerStatus` responses.
-///
-/// The server list comes directly from the app-server status response, sorted
-/// alphabetically. Local config is only used to enrich returned servers with
-/// transport details such as command, URL, cwd, and environment display.
-///
-/// This mirrors the layout of [`new_mcp_tools_output`] but sources data from
-/// the paginated RPC response rather than the in-process `McpManager`. The
-/// `detail` flag controls whether resources and resource templates are rendered.
-pub(crate) fn new_mcp_tools_output_from_statuses(
-    config: &Config,
-    statuses: &[McpServerStatus],
-    detail: McpServerStatusDetail,
-) -> PlainHistoryCell {
-    let mut lines: Vec<Line<'static>> = vec![
-        "/mcp".magenta().into(),
-        "".into(),
-        vec!["🔌  ".into(), "MCP Tools".bold()].into(),
-        "".into(),
-    ];
-
-    let mut statuses_by_name = HashMap::new();
-    for status in statuses {
-        statuses_by_name.insert(status.name.as_str(), status);
-    }
-
-    let mut server_names: Vec<String> = statuses.iter().map(|status| status.name.clone()).collect();
-    server_names.sort();
-
-    let has_any_tools = statuses.iter().any(|status| !status.tools.is_empty());
-    if !has_any_tools {
-        lines.push("  • No MCP tools available.".italic().into());
-        lines.push("".into());
-    }
-
-    for server in server_names {
-        let cfg = config.mcp_servers.get().get(server.as_str());
-        let status = statuses_by_name.get(server.as_str()).copied();
-        let header: Vec<Span<'static>> = vec!["  • ".into(), server.clone().into()];
-
-        lines.push(header.into());
-        if matches!(detail, McpServerStatusDetail::Full) {
-            let enabled = cfg.map(|cfg| cfg.enabled).unwrap_or(true);
-            let status_text = if enabled {
-                "enabled".green()
-            } else {
-                "disabled".red()
-            };
-            lines.push(vec!["    • Status: ".into(), status_text].into());
-            if let Some(reason) = cfg.and_then(|cfg| cfg.disabled_reason.as_ref()) {
-                lines.push(vec!["    • Reason: ".into(), reason.to_string().dim()].into());
-            }
-        }
-        let auth_status = status
-            .map(|status| match status.auth_status {
-                codex_app_server_protocol::McpAuthStatus::Unsupported => McpAuthStatus::Unsupported,
-                codex_app_server_protocol::McpAuthStatus::NotLoggedIn => McpAuthStatus::NotLoggedIn,
-                codex_app_server_protocol::McpAuthStatus::BearerToken => McpAuthStatus::BearerToken,
-                codex_app_server_protocol::McpAuthStatus::OAuth => McpAuthStatus::OAuth,
-            })
-            .unwrap_or(McpAuthStatus::Unsupported);
-        lines.push(
-            vec![
-                "    • Auth: ".into(),
-                mcp_auth_status_label(auth_status).into(),
-            ]
-            .into(),
-        );
-
-        if let Some(cfg) = cfg {
-            match &cfg.transport {
-                McpServerTransportConfig::Stdio {
-                    command,
-                    args,
-                    env,
-                    env_vars,
-                    cwd,
-                } => {
-                    let args_suffix = if args.is_empty() {
-                        String::new()
-                    } else {
-                        format!(" {}", args.join(" "))
-                    };
-                    let cmd_display = format!("{command}{args_suffix}");
-                    lines.push(vec!["    • Command: ".into(), cmd_display.into()].into());
-
-                    if let Some(cwd) = cwd.as_ref() {
-                        lines.push(
-                            vec!["    • Cwd: ".into(), cwd.display().to_string().into()].into(),
-                        );
-                    }
-
-                    let env_display = format_env_display(env.as_ref(), env_vars.as_slice());
-                    if env_display != "-" {
-                        lines.push(vec!["    • Env: ".into(), env_display.into()].into());
-                    }
-                }
-                McpServerTransportConfig::StreamableHttp {
-                    url,
-                    http_headers,
-                    env_http_headers,
-                    ..
-                } => {
-                    lines.push(vec!["    • URL: ".into(), url.clone().into()].into());
-                    if let Some(headers) = http_headers.as_ref()
-                        && !headers.is_empty()
-                    {
-                        let mut pairs: Vec<_> = headers.iter().collect();
-                        pairs.sort_by(|(a, _), (b, _)| a.cmp(b));
-                        let display = pairs
-                            .into_iter()
-                            .map(|(name, _)| format!("{name}=*****"))
-                            .collect::<Vec<_>>()
-                            .join(", ");
-                        lines.push(vec!["    • HTTP headers: ".into(), display.into()].into());
-                    }
-                    if let Some(headers) = env_http_headers.as_ref()
-                        && !headers.is_empty()
-                    {
-                        let mut pairs: Vec<_> = headers.iter().collect();
-                        pairs.sort_by(|(a, _), (b, _)| a.cmp(b));
-                        let display = pairs
-                            .into_iter()
-                            .map(|(name, var)| format!("{name}={var}"))
-                            .collect::<Vec<_>>()
-                            .join(", ");
-                        lines.push(vec!["    • Env HTTP headers: ".into(), display.into()].into());
-                    }
-                }
-            }
-        }
-
-        let mut names = status
-            .map(|status| status.tools.keys().cloned().collect::<Vec<_>>())
-            .unwrap_or_default();
-        names.sort();
-        if names.is_empty() {
-            lines.push("    • Tools: (none)".into());
-        } else {
-            lines.push(vec!["    • Tools: ".into(), names.join(", ").into()].into());
-        }
-
-        if matches!(detail, McpServerStatusDetail::Full) {
-            let server_resources = status
-                .map(|status| status.resources.clone())
-                .unwrap_or_default();
-            if server_resources.is_empty() {
-                lines.push("    • Resources: (none)".into());
-            } else {
-                let mut spans: Vec<Span<'static>> = vec!["    • Resources: ".into()];
-
-                for (idx, resource) in server_resources.iter().enumerate() {
-                    if idx > 0 {
-                        spans.push(", ".into());
-                    }
-
-                    let label = resource.title.as_ref().unwrap_or(&resource.name);
-                    spans.push(label.clone().into());
-                    spans.push(" ".into());
-                    spans.push(format!("({})", resource.uri).dim());
-                }
-
-                lines.push(spans.into());
-            }
-
-            let server_templates = status
-                .map(|status| status.resource_templates.clone())
-                .unwrap_or_default();
-            if server_templates.is_empty() {
-                lines.push("    • Resource templates: (none)".into());
-            } else {
-                let mut spans: Vec<Span<'static>> = vec!["    • Resource templates: ".into()];
-
-                for (idx, template) in server_templates.iter().enumerate() {
-                    if idx > 0 {
-                        spans.push(", ".into());
-                    }
-
-                    let label = template.title.as_ref().unwrap_or(&template.name);
-                    spans.push(label.clone().into());
-                    spans.push(" ".into());
-                    spans.push(format!("({})", template.uri_template).dim());
-                }
-
-                lines.push(spans.into());
-            }
-        }
-
-        lines.push(Line::from(""));
-    }
-
-    PlainHistoryCell { lines }
-}
-
-pub(crate) fn new_info_event(message: String, hint: Option<String>) -> PlainHistoryCell {
-    let mut line = vec!["• ".dim(), message.into()];
-    if let Some(hint) = hint {
-        line.push(" ".into());
-        line.push(hint.dark_gray());
-    }
-    let lines: Vec<Line<'static>> = vec![line.into()];
-    PlainHistoryCell { lines }
-}
-
-pub(crate) fn new_error_event(message: String) -> PlainHistoryCell {
-    // Use a hair space (U+200A) to create a subtle, near-invisible separation
-    // before the text. VS16 is intentionally omitted to keep spacing tighter
-    // in terminals like Ghostty.
-    let lines: Vec<Line<'static>> = vec![vec![format!("■ {message}").red()].into()];
-    PlainHistoryCell { lines }
-}
-
-/// A transient history cell that shows an animated spinner while the MCP
-/// inventory RPC is in flight.
-///
-/// Inserted as the `active_cell` by `ChatWidget::add_mcp_output()` and removed
-/// once the fetch completes. The app removes committed copies from transcript
-/// history, while `ChatWidget::clear_mcp_inventory_loading()` only clears the
-/// in-flight `active_cell`.
-#[derive(Debug)]
-pub(crate) struct McpInventoryLoadingCell {
-    start_time: Instant,
-    animations_enabled: bool,
-}
-
-impl McpInventoryLoadingCell {
-    pub(crate) fn new(animations_enabled: bool) -> Self {
-        Self {
-            start_time: Instant::now(),
-            animations_enabled,
-        }
-    }
-}
-
-impl HistoryCell for McpInventoryLoadingCell {
-    fn display_lines(&self, _width: u16) -> Vec<Line<'static>> {
-        vec![
-            vec![
-                activity_indicator(
-                    Some(self.start_time),
-                    MotionMode::from_animations_enabled(self.animations_enabled),
-                    ReducedMotionIndicator::StaticBullet,
-                )
-                .unwrap_or_else(|| "•".dim()),
-                " ".into(),
-                "Loading MCP inventory".bold(),
-                "…".dim(),
-            ]
-            .into(),
-        ]
-    }
-
-    fn raw_lines(&self) -> Vec<Line<'static>> {
-        vec![Line::from("Loading MCP inventory...")]
-    }
-
-    fn transcript_animation_tick(&self) -> Option<u64> {
-        if !self.animations_enabled {
-            return None;
-        }
-        Some((self.start_time.elapsed().as_millis() / 50) as u64)
-    }
-}
-
-/// Convenience constructor for [`McpInventoryLoadingCell`].
-pub(crate) fn new_mcp_inventory_loading(animations_enabled: bool) -> McpInventoryLoadingCell {
-    McpInventoryLoadingCell::new(animations_enabled)
-}
-
-/// Renders a completed (or interrupted) request_user_input exchange in history.
-#[derive(Debug)]
-pub(crate) struct RequestUserInputResultCell {
-    pub(crate) questions: Vec<ToolRequestUserInputQuestion>,
-    pub(crate) answers: HashMap<String, ToolRequestUserInputAnswer>,
-    pub(crate) interrupted: bool,
-}
-
-impl HistoryCell for RequestUserInputResultCell {
-    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
-        let width = width.max(1) as usize;
-        let total = self.questions.len();
-        let answered = self
-            .questions
-            .iter()
-            .filter(|question| {
-                self.answers
-                    .get(&question.id)
-                    .is_some_and(|answer| !answer.answers.is_empty())
-            })
-            .count();
-        let unanswered = total.saturating_sub(answered);
-
-        let mut header = vec!["•".dim(), " ".into(), "Questions".bold()];
-        header.push(format!(" {answered}/{total} answered").dim());
-        if self.interrupted {
-            header.push(" (interrupted)".cyan());
-        }
-
-        let mut lines: Vec<Line<'static>> = vec![header.into()];
-
-        for question in &self.questions {
-            let answer = self.answers.get(&question.id);
-            let answer_missing = match answer {
-                Some(answer) => answer.answers.is_empty(),
-                None => true,
-            };
-            let mut question_lines = wrap_with_prefix(
-                &question.question,
-                width,
-                "  • ".into(),
-                "    ".into(),
-                Style::default(),
-            );
-            if answer_missing && let Some(last) = question_lines.last_mut() {
-                last.spans.push(" (unanswered)".dim());
-            }
-            lines.extend(question_lines);
-
-            let Some(answer) = answer.filter(|answer| !answer.answers.is_empty()) else {
-                continue;
-            };
-            if question.is_secret {
-                lines.extend(wrap_with_prefix(
-                    "••••••",
-                    width,
-                    "    answer: ".dim(),
-                    "            ".dim(),
-                    Style::default().fg(Color::Cyan),
-                ));
-                continue;
-            }
-
-            let (options, note) = split_request_user_input_answer(answer);
-
-            for option in options {
-                lines.extend(wrap_with_prefix(
-                    &option,
-                    width,
-                    "    answer: ".dim(),
-                    "            ".dim(),
-                    Style::default().fg(Color::Cyan),
-                ));
-            }
-            if let Some(note) = note {
-                let (label, continuation, style) = if question.options.is_some() {
-                    (
-                        "    note: ".dim(),
-                        "          ".dim(),
-                        Style::default().fg(Color::Cyan),
-                    )
-                } else {
-                    (
-                        "    answer: ".dim(),
-                        "            ".dim(),
-                        Style::default().fg(Color::Cyan),
-                    )
-                };
-                lines.extend(wrap_with_prefix(&note, width, label, continuation, style));
-            }
-        }
-
-        if self.interrupted && unanswered > 0 {
-            let summary = format!("interrupted with {unanswered} unanswered");
-            lines.extend(wrap_with_prefix(
-                &summary,
-                width,
-                "  ↳ ".cyan().dim(),
-                "    ".dim(),
-                Style::default().fg(Color::Cyan).add_modifier(Modifier::DIM),
-            ));
-        }
-
-        lines
-    }
-
-    fn raw_lines(&self) -> Vec<Line<'static>> {
-        let total = self.questions.len();
-        let answered = self
-            .questions
-            .iter()
-            .filter(|question| {
-                self.answers
-                    .get(&question.id)
-                    .is_some_and(|answer| !answer.answers.is_empty())
-            })
-            .count();
-        let mut lines = vec![Line::from(format!("Questions {answered}/{total} answered"))];
-        if self.interrupted {
-            lines.push(Line::from("(interrupted)"));
-        }
-        for question in &self.questions {
-            lines.push(Line::from(question.question.clone()));
-            if let Some(answer) = self
-                .answers
-                .get(&question.id)
-                .filter(|answer| !answer.answers.is_empty())
-            {
-                if question.is_secret {
-                    lines.push(Line::from("answer: ******"));
-                } else {
-                    let (options, note) = split_request_user_input_answer(answer);
-                    lines.extend(
-                        options
-                            .into_iter()
-                            .map(|option| Line::from(format!("answer: {option}"))),
-                    );
-                    if let Some(note) = note {
-                        lines.push(Line::from(format!("note: {note}")));
-                    }
-                }
-            } else {
-                lines.push(Line::from("(unanswered)"));
-            }
-        }
-        lines
-    }
-}
-
-/// Wrap a plain string with textwrap and prefix each line, while applying a style to the content.
-fn wrap_with_prefix(
-    text: &str,
-    width: usize,
-    initial_prefix: Span<'static>,
-    subsequent_prefix: Span<'static>,
-    style: Style,
-) -> Vec<Line<'static>> {
-    let line = Line::from(vec![Span::from(text.to_string()).set_style(style)]);
-    let opts = RtOptions::new(width.max(1))
-        .initial_indent(Line::from(vec![initial_prefix]))
-        .subsequent_indent(Line::from(vec![subsequent_prefix]));
-    let wrapped = adaptive_wrap_line(&line, opts);
-    let mut out = Vec::new();
-    push_owned_lines(&wrapped, &mut out);
-    out
-}
-
-/// Split a request_user_input answer into option labels and an optional freeform note.
-/// Notes are encoded as "user_note: <text>" entries in the answers list.
-fn split_request_user_input_answer(
-    answer: &ToolRequestUserInputAnswer,
-) -> (Vec<String>, Option<String>) {
-    let mut options = Vec::new();
-    let mut note = None;
-    for entry in &answer.answers {
-        if let Some(note_text) = entry.strip_prefix("user_note: ") {
-            note = Some(note_text.to_string());
-        } else {
-            options.push(entry.clone());
-        }
-    }
-    (options, note)
-}
-
-/// Render a user‑friendly plan update styled like a checkbox todo list.
-pub(crate) fn new_plan_update(update: UpdatePlanArgs) -> PlanUpdateCell {
-    let UpdatePlanArgs { explanation, plan } = update;
-    PlanUpdateCell { explanation, plan }
-}
-
-/// Create a proposed-plan cell that snapshots the session cwd for later markdown rendering.
-///
-/// The plan body is stored as raw markdown so terminal resize reflow can render it again at the
-/// current width. Callers should use `new_proposed_plan_stream` only for transient live streaming
-/// cells, then consolidate to this source-backed cell when the plan is complete.
-pub(crate) fn new_proposed_plan(plan_markdown: String, cwd: &Path) -> ProposedPlanCell {
-    ProposedPlanCell {
-        plan_markdown,
-        cwd: cwd.to_path_buf(),
-    }
-}
-
-/// Create a transient proposed-plan stream cell from already rendered lines.
-///
-/// Stream cells are display fragments, not source-backed history. They should be replaced by
-/// `ProposedPlanCell` during consolidation before relying on resize reflow for finalized history.
-pub(crate) fn new_proposed_plan_stream(
-    lines: Vec<Line<'static>>,
-    is_stream_continuation: bool,
-) -> ProposedPlanStreamCell {
-    ProposedPlanStreamCell {
-        lines,
-        is_stream_continuation,
-    }
-}
-
-/// Finalized proposed-plan history that can render itself again for a new width.
-///
-/// This is the source-backed counterpart to `ProposedPlanStreamCell`. It owns raw markdown and the
-/// session cwd needed for stable local-link rendering during later transcript reflow.
-#[derive(Debug)]
-pub(crate) struct ProposedPlanCell {
-    plan_markdown: String,
-    /// Session cwd used to keep local file-link display aligned with live streamed plan rendering.
-    cwd: PathBuf,
-}
-
-/// Transient proposed-plan history emitted while a plan is still streaming.
-///
-/// The lines are already rendered for the stream's current width. A finalized transcript should not
-/// keep these cells after consolidation, because they cannot re-render their source on a later
-/// terminal resize.
-#[derive(Debug)]
-pub(crate) struct ProposedPlanStreamCell {
-    lines: Vec<Line<'static>>,
-    is_stream_continuation: bool,
-}
-
-impl HistoryCell for ProposedPlanCell {
-    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
-        let mut lines: Vec<Line<'static>> = Vec::new();
-        lines.push(vec!["• ".dim(), "Proposed Plan".bold()].into());
-        lines.push(Line::from(" "));
-
-        let mut plan_lines: Vec<Line<'static>> = vec![Line::from(" ")];
-        let plan_style = proposed_plan_style();
-        let wrap_width = width.saturating_sub(4).max(1) as usize;
-        let mut body: Vec<Line<'static>> = Vec::new();
-        append_markdown_agent_with_cwd(
-            &self.plan_markdown,
-            Some(wrap_width),
-            Some(self.cwd.as_path()),
-            &mut body,
-        );
-        if body.is_empty() {
-            body.push(Line::from("(empty)".dim().italic()));
-        }
-        plan_lines.extend(prefix_lines(body, "  ".into(), "  ".into()));
-        plan_lines.push(Line::from(" "));
-
-        lines.extend(plan_lines.into_iter().map(|line| line.style(plan_style)));
-        lines
-    }
-
-    fn raw_lines(&self) -> Vec<Line<'static>> {
-        raw_lines_from_source(&self.plan_markdown)
-    }
-}
-
-impl HistoryCell for ProposedPlanStreamCell {
-    fn display_lines(&self, _width: u16) -> Vec<Line<'static>> {
-        self.lines.clone()
-    }
-
-    fn raw_lines(&self) -> Vec<Line<'static>> {
-        plain_lines(self.lines.clone())
-    }
-
-    fn is_stream_continuation(&self) -> bool {
-        self.is_stream_continuation
-    }
-}
-
-#[derive(Debug)]
-pub(crate) struct PlanUpdateCell {
-    explanation: Option<String>,
-    plan: Vec<PlanItemArg>,
-}
-
-impl HistoryCell for PlanUpdateCell {
-    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
-        let render_note = |text: &str| -> Vec<Line<'static>> {
-            let wrap_width = width.saturating_sub(4).max(1) as usize;
-            let note = Line::from(text.to_string().dim().italic());
-            let wrapped = adaptive_wrap_line(&note, RtOptions::new(wrap_width));
-            let mut out = Vec::new();
-            push_owned_lines(&wrapped, &mut out);
-            out
-        };
-
-        let render_step = |status: &StepStatus, text: &str| -> Vec<Line<'static>> {
-            let (box_str, step_style) = match status {
-                StepStatus::Completed => ("✔ ", Style::default().crossed_out().dim()),
-                StepStatus::InProgress => ("□ ", Style::default().cyan().bold()),
-                StepStatus::Pending => ("□ ", Style::default().dim()),
-            };
-
-            let opts = RtOptions::new(width.saturating_sub(4).max(1) as usize)
-                .initial_indent(box_str.into())
-                .subsequent_indent("  ".into());
-            let step = Line::from(text.to_string().set_style(step_style));
-            let wrapped = adaptive_wrap_line(&step, opts);
-            let mut out = Vec::new();
-            push_owned_lines(&wrapped, &mut out);
-            out
-        };
-
-        let mut lines: Vec<Line<'static>> = vec![];
-        lines.push(vec!["• ".dim(), "Updated Plan".bold()].into());
-
-        let mut indented_lines = vec![];
-        let note = self
-            .explanation
-            .as_ref()
-            .map(|s| s.trim())
-            .filter(|t| !t.is_empty());
-        if let Some(expl) = note {
-            indented_lines.extend(render_note(expl));
-        };
-
-        if self.plan.is_empty() {
-            indented_lines.push(Line::from("(no steps provided)".dim().italic()));
-        } else {
-            for PlanItemArg { step, status } in self.plan.iter() {
-                indented_lines.extend(render_step(status, step));
-            }
-        }
-        lines.extend(prefix_lines(indented_lines, "  └ ".dim(), "    ".into()));
-
-        lines
-    }
-
-    fn raw_lines(&self) -> Vec<Line<'static>> {
-        let mut lines = vec![Line::from("Updated Plan")];
-        if let Some(explanation) = self
-            .explanation
-            .as_ref()
-            .map(|s| s.trim())
-            .filter(|s| !s.is_empty())
-        {
-            lines.extend(raw_lines_from_source(explanation));
-        }
-        if self.plan.is_empty() {
-            lines.push(Line::from("(no steps provided)"));
-        } else {
-            for PlanItemArg { step, status } in &self.plan {
-                lines.push(Line::from(format!("{status:?}: {step}")));
-            }
-        }
-        lines
-    }
-}
-
-/// Create a new `PendingPatch` cell that lists the file‑level summary of
-/// a proposed patch. The summary lines should already be formatted (e.g.
-/// "A path/to/file.rs").
-pub(crate) fn new_patch_event(
-    changes: HashMap<PathBuf, FileChange>,
-    cwd: &Path,
-) -> PatchHistoryCell {
-    PatchHistoryCell {
-        changes,
-        cwd: cwd.to_path_buf(),
-    }
-}
-
-pub(crate) fn new_patch_apply_failure(stderr: String) -> PlainHistoryCell {
-    let mut lines: Vec<Line<'static>> = Vec::new();
-
-    // Failure title
-    lines.push(Line::from("✘ Failed to apply patch".magenta().bold()));
-
-    if !stderr.trim().is_empty() {
-        let output = output_lines(
-            Some(&CommandOutput {
-                exit_code: 1,
-                formatted_output: String::new(),
-                aggregated_output: stderr,
-            }),
-            OutputLinesParams {
-                line_limit: TOOL_CALL_MAX_LINES,
-                only_err: true,
-                include_angle_pipe: true,
-                include_prefix: true,
-            },
-        );
-        lines.extend(output.lines);
-    }
-
-    PlainHistoryCell { lines }
-}
-
-pub(crate) fn new_view_image_tool_call(path: AbsolutePathBuf, cwd: &Path) -> PlainHistoryCell {
-    let display_path = display_path_for(path.as_path(), cwd);
-
-    let lines: Vec<Line<'static>> = vec![
-        vec!["• ".dim(), "Viewed Image".bold()].into(),
-        vec!["  └ ".dim(), display_path.dim()].into(),
-    ];
-
-    PlainHistoryCell { lines }
-}
-
-pub(crate) fn new_image_generation_call(
-    call_id: String,
-    revised_prompt: Option<String>,
-    saved_path: Option<AbsolutePathBuf>,
-) -> PlainHistoryCell {
-    let detail = revised_prompt.unwrap_or_else(|| call_id.clone());
-
-    let mut lines: Vec<Line<'static>> = vec![
-        vec!["• ".dim(), "Generated Image:".bold()].into(),
-        vec!["  └ ".dim(), detail.dim()].into(),
-    ];
-    if let Some(saved_path) = saved_path {
-        let saved_path = Url::from_file_path(saved_path.as_path())
-            .map(|url| url.to_string())
-            .unwrap_or_else(|_| saved_path.display().to_string());
-        lines.push(vec!["  └ ".dim(), "Saved to: ".dim(), saved_path.into()].into());
-    }
-
-    PlainHistoryCell { lines }
-}
-
-/// Create the reasoning history cell emitted at the end of a reasoning block.
-///
-/// The helper snapshots `cwd` into the returned cell so local file links render the same way they
-/// did while the turn was live, even if rendering happens after other app state has advanced.
-pub(crate) fn new_reasoning_summary_block(
-    full_reasoning_buffer: String,
-    cwd: &Path,
-) -> Box<dyn HistoryCell> {
-    let cwd = cwd.to_path_buf();
-    let full_reasoning_buffer = full_reasoning_buffer.trim();
-    if let Some(open) = full_reasoning_buffer.find("**") {
-        let after_open = &full_reasoning_buffer[(open + 2)..];
-        if let Some(close) = after_open.find("**") {
-            let after_close_idx = open + 2 + close + 2;
-            // if we don't have anything beyond `after_close_idx`
-            // then we don't have a summary to inject into history
-            if after_close_idx < full_reasoning_buffer.len() {
-                let header_buffer = full_reasoning_buffer[..after_close_idx].to_string();
-                let summary_buffer = full_reasoning_buffer[after_close_idx..].to_string();
-                // Preserve the session cwd so local file links render the same way in the
-                // collapsed reasoning block as they did while streaming live content.
-                return Box::new(ReasoningSummaryCell::new(
-                    header_buffer,
-                    summary_buffer,
-                    &cwd,
-                    /*transcript_only*/ false,
-                ));
-            }
-        }
-    }
-    Box::new(ReasoningSummaryCell::new(
-        "".to_string(),
-        full_reasoning_buffer.to_string(),
-        &cwd,
-        /*transcript_only*/ true,
-    ))
-}
-
-#[derive(Debug)]
-/// A visual divider between turns, optionally showing how long the assistant "worked for".
-///
-/// This separator is only emitted for turns that performed concrete work (e.g., running commands,
-/// applying patches, making MCP tool calls), so purely conversational turns do not show an empty
-/// divider.
-pub struct FinalMessageSeparator {
-    elapsed_seconds: Option<u64>,
-    runtime_metrics: Option<RuntimeMetricsSummary>,
-}
-impl FinalMessageSeparator {
-    /// Creates a separator; completed turns should pass protocol turn duration when available.
-    pub(crate) fn new(
-        elapsed_seconds: Option<u64>,
-        runtime_metrics: Option<RuntimeMetricsSummary>,
-    ) -> Self {
-        Self {
-            elapsed_seconds,
-            runtime_metrics,
-        }
-    }
-}
-impl HistoryCell for FinalMessageSeparator {
-    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
-        let mut label_parts = Vec::new();
-        if let Some(elapsed_seconds) = self
-            .elapsed_seconds
-            .filter(|seconds| *seconds > 60)
-            .map(super::status_indicator_widget::fmt_elapsed_compact)
-        {
-            label_parts.push(format!("Worked for {elapsed_seconds}"));
-        }
-        if let Some(metrics_label) = self.runtime_metrics.and_then(runtime_metrics_label) {
-            label_parts.push(metrics_label);
-        }
-
-        if label_parts.is_empty() {
-            return vec![Line::from_iter(["─".repeat(width as usize).dim()])];
-        }
-
-        let label = format!("─ {} ─", label_parts.join(" • "));
-        let (label, _suffix, label_width) = take_prefix_by_width(&label, width as usize);
-        vec![
-            Line::from_iter([
-                label,
-                "─".repeat((width as usize).saturating_sub(label_width)),
-            ])
-            .dim(),
-        ]
-    }
-
-    fn raw_lines(&self) -> Vec<Line<'static>> {
-        let mut label_parts = Vec::new();
-        if let Some(elapsed_seconds) = self
-            .elapsed_seconds
-            .filter(|seconds| *seconds > 60)
-            .map(super::status_indicator_widget::fmt_elapsed_compact)
-        {
-            label_parts.push(format!("Worked for {elapsed_seconds}"));
-        }
-        if let Some(metrics_label) = self.runtime_metrics.and_then(runtime_metrics_label) {
-            label_parts.push(metrics_label);
-        }
-        if label_parts.is_empty() {
-            Vec::new()
-        } else {
-            vec![Line::from(label_parts.join(" • "))]
-        }
-    }
-}
-
-pub(crate) fn runtime_metrics_label(summary: RuntimeMetricsSummary) -> Option<String> {
-    let mut parts = Vec::new();
-    if summary.tool_calls.count > 0 {
-        let duration = format_duration_ms(summary.tool_calls.duration_ms);
-        let calls = pluralize(summary.tool_calls.count, "call", "calls");
-        parts.push(format!(
-            "Local tools: {} {calls} ({duration})",
-            summary.tool_calls.count
-        ));
-    }
-    if summary.api_calls.count > 0 {
-        let duration = format_duration_ms(summary.api_calls.duration_ms);
-        let calls = pluralize(summary.api_calls.count, "call", "calls");
-        parts.push(format!(
-            "Inference: {} {calls} ({duration})",
-            summary.api_calls.count
-        ));
-    }
-    if summary.websocket_calls.count > 0 {
-        let duration = format_duration_ms(summary.websocket_calls.duration_ms);
-        parts.push(format!(
-            "WebSocket: {} events send ({duration})",
-            summary.websocket_calls.count
-        ));
-    }
-    if summary.streaming_events.count > 0 {
-        let duration = format_duration_ms(summary.streaming_events.duration_ms);
-        let stream_label = pluralize(summary.streaming_events.count, "Stream", "Streams");
-        let events = pluralize(summary.streaming_events.count, "event", "events");
-        parts.push(format!(
-            "{stream_label}: {} {events} ({duration})",
-            summary.streaming_events.count
-        ));
-    }
-    if summary.websocket_events.count > 0 {
-        let duration = format_duration_ms(summary.websocket_events.duration_ms);
-        parts.push(format!(
-            "{} events received ({duration})",
-            summary.websocket_events.count
-        ));
-    }
-    if summary.responses_api_overhead_ms > 0 {
-        let duration = format_duration_ms(summary.responses_api_overhead_ms);
-        parts.push(format!("Responses API overhead: {duration}"));
-    }
-    if summary.responses_api_inference_time_ms > 0 {
-        let duration = format_duration_ms(summary.responses_api_inference_time_ms);
-        parts.push(format!("Responses API inference: {duration}"));
-    }
-    if summary.responses_api_engine_iapi_ttft_ms > 0
-        || summary.responses_api_engine_service_ttft_ms > 0
-    {
-        let mut ttft_parts = Vec::new();
-        if summary.responses_api_engine_iapi_ttft_ms > 0 {
-            let duration = format_duration_ms(summary.responses_api_engine_iapi_ttft_ms);
-            ttft_parts.push(format!("{duration} (iapi)"));
-        }
-        if summary.responses_api_engine_service_ttft_ms > 0 {
-            let duration = format_duration_ms(summary.responses_api_engine_service_ttft_ms);
-            ttft_parts.push(format!("{duration} (service)"));
-        }
-        parts.push(format!("TTFT: {}", ttft_parts.join(" ")));
-    }
-    if summary.responses_api_engine_iapi_tbt_ms > 0
-        || summary.responses_api_engine_service_tbt_ms > 0
-    {
-        let mut tbt_parts = Vec::new();
-        if summary.responses_api_engine_iapi_tbt_ms > 0 {
-            let duration = format_duration_ms(summary.responses_api_engine_iapi_tbt_ms);
-            tbt_parts.push(format!("{duration} (iapi)"));
-        }
-        if summary.responses_api_engine_service_tbt_ms > 0 {
-            let duration = format_duration_ms(summary.responses_api_engine_service_tbt_ms);
-            tbt_parts.push(format!("{duration} (service)"));
-        }
-        parts.push(format!("TBT: {}", tbt_parts.join(" ")));
-    }
-    if parts.is_empty() {
-        None
-    } else {
-        Some(parts.join(" • "))
-    }
-}
-
-fn format_duration_ms(duration_ms: u64) -> String {
-    if duration_ms >= 1_000 {
-        let seconds = duration_ms as f64 / 1_000.0;
-        format!("{seconds:.1}s")
-    } else {
-        format!("{duration_ms}ms")
-    }
-}
-
-fn pluralize(count: u64, singular: &'static str, plural: &'static str) -> &'static str {
-    if count == 1 { singular } else { plural }
-}
-
-fn format_mcp_invocation<'a>(invocation: McpInvocation) -> Line<'a> {
-    let args_str = invocation
-        .arguments
-        .as_ref()
-        .map(|v: &serde_json::Value| {
-            // Use compact form to keep things short but readable.
-            serde_json::to_string(v).unwrap_or_else(|_| v.to_string())
-        })
-        .unwrap_or_default();
-
-    let invocation_spans = vec![
-        invocation.server.clone().cyan(),
-        ".".into(),
-        invocation.tool.cyan(),
-        "(".into(),
-        args_str.dim(),
-        ")".into(),
-    ];
-    invocation_spans.into()
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::exec_cell::CommandOutput;
-    use crate::exec_cell::ExecCall;
-    use crate::exec_cell::ExecCell;
-    use crate::legacy_core::config::Config;
-    use crate::legacy_core::config::ConfigBuilder;
-    use crate::session_state::ThreadSessionState;
-    use crate::wrapping::word_wrap_lines;
-    use codex_app_server_protocol::AskForApproval;
-    use codex_app_server_protocol::McpAuthStatus;
-    use codex_config::types::McpServerConfig;
-    use codex_config::types::McpServerDisabledReason;
-    use codex_otel::RuntimeMetricTotals;
-    use codex_otel::RuntimeMetricsSummary;
-    use codex_protocol::ThreadId;
-    use codex_protocol::account::PlanType;
-    use codex_protocol::parse_command::ParsedCommand;
-    use dirs::home_dir;
-    use pretty_assertions::assert_eq;
-    use ratatui::buffer::Buffer;
-    use ratatui::layout::Rect;
-    use serde_json::json;
-    use std::collections::HashMap;
-    use std::path::PathBuf;
-
-    use codex_app_server_protocol::CommandExecutionSource as ExecCommandSource;
-    use codex_protocol::mcp::CallToolResult;
-    use codex_protocol::mcp::Tool;
-    use rmcp::model::Content;
-
-    const SMALL_PNG_BASE64: &str = "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR4nGP4z8DwHwAFAAH/iZk9HQAAAABJRU5ErkJggg==";
-    async fn test_config() -> Config {
-        let codex_home = std::env::temp_dir();
-        ConfigBuilder::default()
-            .codex_home(codex_home.clone())
-            .build()
-            .await
-            .expect("config")
-    }
-
-    fn test_cwd() -> PathBuf {
-        // These tests only need a stable absolute cwd; using temp_dir() avoids baking Unix- or
-        // Windows-specific root semantics into the fixtures.
-        std::env::temp_dir()
-    }
-
-    fn stdio_server_config(
-        command: &str,
-        args: Vec<&str>,
-        env: Option<HashMap<String, String>>,
-        env_vars: Vec<&str>,
-    ) -> McpServerConfig {
-        let mut table = toml::Table::new();
-        table.insert(
-            "command".to_string(),
-            toml::Value::String(command.to_string()),
-        );
-        if !args.is_empty() {
-            table.insert(
-                "args".to_string(),
-                toml::Value::Array(
-                    args.into_iter()
-                        .map(|arg| toml::Value::String(arg.to_string()))
-                        .collect(),
-                ),
-            );
-        }
-        if let Some(env) = env {
-            table.insert("env".to_string(), string_map_to_toml_value(env));
-        }
-        if !env_vars.is_empty() {
-            table.insert(
-                "env_vars".to_string(),
-                toml::Value::Array(
-                    env_vars
-                        .into_iter()
-                        .map(|name| toml::Value::String(name.to_string()))
-                        .collect(),
-                ),
-            );
-        }
-
-        toml::Value::Table(table)
-            .try_into()
-            .expect("test stdio MCP config should deserialize")
-    }
-
-    fn streamable_http_server_config(
-        url: &str,
-        bearer_token_env_var: Option<&str>,
-        http_headers: Option<HashMap<String, String>>,
-        env_http_headers: Option<HashMap<String, String>>,
-    ) -> McpServerConfig {
-        let mut table = toml::Table::new();
-        table.insert("url".to_string(), toml::Value::String(url.to_string()));
-        if let Some(bearer_token_env_var) = bearer_token_env_var {
-            table.insert(
-                "bearer_token_env_var".to_string(),
-                toml::Value::String(bearer_token_env_var.to_string()),
-            );
-        }
-        if let Some(http_headers) = http_headers {
-            table.insert(
-                "http_headers".to_string(),
-                string_map_to_toml_value(http_headers),
-            );
-        }
-        if let Some(env_http_headers) = env_http_headers {
-            table.insert(
-                "env_http_headers".to_string(),
-                string_map_to_toml_value(env_http_headers),
-            );
-        }
-
-        toml::Value::Table(table)
-            .try_into()
-            .expect("test streamable_http MCP config should deserialize")
-    }
-
-    fn string_map_to_toml_value(entries: HashMap<String, String>) -> toml::Value {
-        toml::Value::Table(
-            entries
-                .into_iter()
-                .map(|(key, value)| (key, toml::Value::String(value)))
-                .collect(),
-        )
-    }
-
-    fn render_lines(lines: &[Line<'static>]) -> Vec<String> {
-        lines
-            .iter()
-            .map(|line| {
-                line.spans
-                    .iter()
-                    .map(|span| span.content.as_ref())
-                    .collect::<String>()
-            })
-            .collect()
-    }
-
-    fn render_transcript(cell: &dyn HistoryCell) -> Vec<String> {
-        render_lines(&cell.transcript_lines(u16::MAX))
-    }
-
-    fn assert_unstyled_lines(lines: &[Line<'static>]) {
-        for line in lines {
-            assert_eq!(line.style, Style::default());
-            for span in &line.spans {
-                assert_eq!(span.style, Style::default());
-            }
-        }
-    }
-
-    fn image_block(data: &str) -> serde_json::Value {
-        serde_json::to_value(Content::image(data.to_string(), "image/png"))
-            .expect("image content should serialize")
-    }
-
-    fn text_block(text: &str) -> serde_json::Value {
-        serde_json::to_value(Content::text(text)).expect("text content should serialize")
-    }
-
-    fn resource_link_block(
-        uri: &str,
-        name: &str,
-        title: Option<&str>,
-        description: Option<&str>,
-    ) -> serde_json::Value {
-        serde_json::to_value(Content::resource_link(rmcp::model::RawResource {
-            uri: uri.to_string(),
-            name: name.to_string(),
-            title: title.map(str::to_string),
-            description: description.map(str::to_string),
-            mime_type: None,
-            size: None,
-            icons: None,
-            meta: None,
-        }))
-        .expect("resource link content should serialize")
-    }
-
-    #[test]
-    fn raw_lines_from_source_preserves_explicit_blank_lines() {
-        let lines = raw_lines_from_source("alpha\n\nbeta\n");
-
-        assert_eq!(
-            render_lines(&lines),
-            vec!["alpha".to_string(), String::new(), "beta".to_string()]
-        );
-        assert_unstyled_lines(&lines);
-    }
-
-    #[test]
-    fn raw_lines_from_source_preserves_trailing_blank_but_not_trailing_newline() {
-        assert_eq!(
-            render_lines(&raw_lines_from_source("alpha\n\n")),
-            vec!["alpha".to_string(), String::new()]
-        );
-        assert_eq!(raw_lines_from_source(""), Vec::<Line<'static>>::new());
-    }
-
-    #[test]
-    fn source_backed_cells_render_raw_source_without_prefix_or_style() {
-        let user = new_user_prompt(
-            "hello\n\nworld\n".to_string(),
-            Vec::new(),
-            Vec::new(),
-            Vec::new(),
-        );
-        let assistant = AgentMarkdownCell::new(
-            "- item\n\n| A | B |\n| - | - |\n| x | y |\n".to_string(),
-            &test_cwd(),
-        );
-        let reasoning = ReasoningSummaryCell::new(
-            "thinking".to_string(),
-            "first thought\n\nsecond thought".to_string(),
-            &test_cwd(),
-            /*transcript_only*/ false,
-        );
-        let plan = new_proposed_plan(
-            "1. Inspect\n\n```sh\ncargo test\n```".to_string(),
-            &test_cwd(),
-        );
-
-        let user_lines = user.raw_lines();
-        assert_eq!(
-            render_lines(&user_lines),
-            vec!["hello".to_string(), String::new(), "world".to_string()]
-        );
-        assert_unstyled_lines(&user_lines);
-
-        let assistant_lines = assistant.raw_lines();
-        assert_eq!(
-            render_lines(&assistant_lines),
-            vec![
-                "- item".to_string(),
-                String::new(),
-                "| A | B |".to_string(),
-                "| - | - |".to_string(),
-                "| x | y |".to_string(),
-            ]
-        );
-        assert_unstyled_lines(&assistant_lines);
-
-        let reasoning_lines = reasoning.raw_lines();
-        assert_eq!(
-            render_lines(&reasoning_lines),
-            vec![
-                "first thought".to_string(),
-                String::new(),
-                "second thought".to_string(),
-            ]
-        );
-        assert_unstyled_lines(&reasoning_lines);
-
-        let plan_lines = plan.raw_lines();
-        assert_eq!(
-            render_lines(&plan_lines),
-            vec![
-                "1. Inspect".to_string(),
-                String::new(),
-                "```sh".to_string(),
-                "cargo test".to_string(),
-                "```".to_string(),
-            ]
-        );
-        assert_unstyled_lines(&plan_lines);
-    }
-
-    #[test]
-    fn proposed_plan_cell_renders_markdown_table() {
-        let plan = new_proposed_plan(
-            "## Plan\n\n| Step | Owner |\n| --- | --- |\n| Verify | Codex |\n".to_string(),
-            &test_cwd(),
-        );
-
-        let rendered = render_lines(&plan.display_lines(/*width*/ 80));
-
-        assert!(
-            rendered
-                .iter()
-                .any(|line| line.contains('│') || line.contains('┌')),
-            "expected boxed table in proposed plan output: {rendered:?}"
-        );
-        assert!(
-            !rendered
-                .iter()
-                .any(|line| line.trim() == "| Step | Owner |"),
-            "did not expect raw table header in rich proposed plan output: {rendered:?}"
-        );
-
-        let raw = render_lines(&plan.raw_lines());
-        assert!(
-            raw.iter().any(|line| line == "| Step | Owner |"),
-            "expected raw mode to preserve table markdown source: {raw:?}"
-        );
-    }
-
-    #[test]
-    fn proposed_plan_cell_unwraps_markdown_fenced_table() {
-        let plan = new_proposed_plan(
-            "## Plan\n\n```markdown\n| Step | Owner |\n| --- | --- |\n| Verify | Codex |\n```\n"
-                .to_string(),
-            &test_cwd(),
-        );
-
-        let rendered = render_lines(&plan.display_lines(/*width*/ 80));
-
-        assert!(
-            rendered
-                .iter()
-                .any(|line| line.contains('│') || line.contains('┌')),
-            "expected boxed table for markdown-fenced proposed plan output: {rendered:?}"
-        );
-        assert!(
-            !rendered.iter().any(|line| line.trim() == "```markdown"),
-            "did not expect markdown fence to render as code block: {rendered:?}"
-        );
-    }
-
-    #[test]
-    fn structured_tool_cell_renders_raw_plain_text_without_prefix_or_style() {
-        let invocation = McpInvocation {
-            server: "search".into(),
-            tool: "find_docs".into(),
-            arguments: Some(json!({"query": "raw mode"})),
-        };
-        let result = CallToolResult {
-            content: vec![text_block("alpha\nbeta")],
-            is_error: None,
-            structured_content: None,
-            meta: None,
-        };
-        let mut cell = new_active_mcp_tool_call(
-            "call-raw".to_string(),
-            invocation,
-            /*animations_enabled*/ false,
-        );
-        assert!(
-            cell.complete(Duration::from_millis(1), Ok(result))
-                .is_none()
-        );
-
-        let lines = cell.raw_lines();
-        let rendered = render_lines(&lines);
-        assert!(rendered[0].starts_with("Called search.find_docs("));
-        assert_eq!(rendered[1..], ["alpha".to_string(), "beta".to_string()]);
-        assert_unstyled_lines(&lines);
-    }
-
-    #[test]
-    fn raw_mode_toggle_transcript_snapshot() {
-        let mut tool_cell = new_active_mcp_tool_call(
-            "call-snapshot".to_string(),
-            McpInvocation {
-                server: "workspace".to_string(),
-                tool: "inspect".to_string(),
-                arguments: Some(json!({"path": "README.md"})),
-            },
-            /*animations_enabled*/ false,
-        );
-        assert!(
-            tool_cell
-                .complete(
-                    Duration::from_millis(5),
-                    Ok(CallToolResult {
-                        content: vec![text_block("structured output\nsecond line")],
-                        is_error: None,
-                        structured_content: None,
-                        meta: None,
-                    }),
-                )
-                .is_none()
-        );
-        let cells: Vec<Box<dyn HistoryCell>> = vec![
-            Box::new(new_user_prompt(
-                "Please format this\nfor copying".to_string(),
-                Vec::new(),
-                Vec::new(),
-                Vec::new(),
-            )),
-            Box::new(AgentMarkdownCell::new(
-                "- first item\n- second item\n\n| Col | Value |\n| --- | --- |\n| code | `x = 1` |\n\n```text\ncopy me\n```".to_string(),
-                &test_cwd(),
-            )),
-            Box::new(tool_cell),
-        ];
-
-        let render = |mode| {
-            cells
-                .iter()
-                .flat_map(|cell| cell.display_lines_for_mode(/*width*/ 40, mode))
-                .map(|line| {
-                    line.spans
-                        .into_iter()
-                        .map(|span| span.content.into_owned())
-                        .collect::<String>()
-                })
-                .collect::<Vec<_>>()
-                .join("\n")
-        };
-        let rendered = format!(
-            "rich before:\n{}\n\nraw on:\n{}\n\nrich after:\n{}",
-            render(HistoryRenderMode::Rich),
-            render(HistoryRenderMode::Raw),
-            render(HistoryRenderMode::Rich)
-        );
-
-        insta::assert_snapshot!("raw_mode_toggle_transcript", rendered);
-    }
-
-    #[test]
-    fn image_generation_call_renders_saved_path() {
-        let saved_path = test_path_buf("/tmp/generated-image.png").abs();
-        let expected_saved_path = format!(
-            "  └ Saved to: {}",
-            Url::from_file_path(saved_path.as_path())
-                .expect("test path should convert to file URL")
-        );
-        let cell = new_image_generation_call(
-            "call-image-generation".to_string(),
-            Some("A tiny blue square".to_string()),
-            Some(saved_path),
-        );
-
-        assert_eq!(
-            render_lines(&cell.display_lines(/*width*/ 80)),
-            vec![
-                "• Generated Image:".to_string(),
-                "  └ A tiny blue square".to_string(),
-                expected_saved_path,
-            ],
-        );
-    }
-
-    fn session_configured_event(model: &str) -> ThreadSessionState {
-        ThreadSessionState {
-            thread_id: ThreadId::new(),
-            forked_from_id: None,
-            fork_parent_title: None,
-            thread_name: None,
-            model: model.to_string(),
-            model_provider_id: "test-provider".to_string(),
-            service_tier: None,
-            approval_policy: AskForApproval::Never,
-            approvals_reviewer: codex_protocol::config_types::ApprovalsReviewer::User,
-            permission_profile: PermissionProfile::read_only(),
-            active_permission_profile: None,
-            cwd: test_path_buf("/tmp/project").abs(),
-            instruction_source_paths: Vec::new(),
-            reasoning_effort: None,
-            message_history: None,
-            network_proxy: None,
-            rollout_path: Some(PathBuf::new()),
-        }
-    }
-
-    #[test]
-    fn unified_exec_interaction_cell_renders_input() {
-        let cell =
-            new_unified_exec_interaction(Some("echo hello".to_string()), "ls\npwd".to_string());
-        let lines = render_transcript(&cell);
-        assert_eq!(
-            lines,
-            vec![
-                "↳ Interacted with background terminal · echo hello",
-                "  └ ls",
-                "    pwd",
-            ],
-        );
-    }
-
-    #[test]
-    fn unified_exec_interaction_cell_renders_wait() {
-        let cell = new_unified_exec_interaction(/*command_display*/ None, String::new());
-        let lines = render_transcript(&cell);
-        assert_eq!(lines, vec!["• Waited for background terminal"]);
-    }
-
-    #[test]
-    fn final_message_separator_hides_short_worked_label_and_includes_runtime_metrics() {
-        let summary = RuntimeMetricsSummary {
-            tool_calls: RuntimeMetricTotals {
-                count: 3,
-                duration_ms: 2_450,
-            },
-            api_calls: RuntimeMetricTotals {
-                count: 2,
-                duration_ms: 1_200,
-            },
-            streaming_events: RuntimeMetricTotals {
-                count: 6,
-                duration_ms: 900,
-            },
-            websocket_calls: RuntimeMetricTotals {
-                count: 1,
-                duration_ms: 700,
-            },
-            websocket_events: RuntimeMetricTotals {
-                count: 4,
-                duration_ms: 1_200,
-            },
-            responses_api_overhead_ms: 650,
-            responses_api_inference_time_ms: 1_940,
-            responses_api_engine_iapi_ttft_ms: 410,
-            responses_api_engine_service_ttft_ms: 460,
-            responses_api_engine_iapi_tbt_ms: 1_180,
-            responses_api_engine_service_tbt_ms: 1_240,
-            turn_ttft_ms: 0,
-            turn_ttfm_ms: 0,
-        };
-        let cell = FinalMessageSeparator::new(Some(12), Some(summary));
-        let rendered = render_lines(&cell.display_lines(/*width*/ 600));
-
-        assert_eq!(rendered.len(), 1);
-        assert!(!rendered[0].contains("Worked for"));
-        assert!(rendered[0].contains("Local tools: 3 calls (2.5s)"));
-        assert!(rendered[0].contains("Inference: 2 calls (1.2s)"));
-        assert!(rendered[0].contains("WebSocket: 1 events send (700ms)"));
-        assert!(rendered[0].contains("Streams: 6 events (900ms)"));
-        assert!(rendered[0].contains("4 events received (1.2s)"));
-        assert!(rendered[0].contains("Responses API overhead: 650ms"));
-        assert!(rendered[0].contains("Responses API inference: 1.9s"));
-        assert!(rendered[0].contains("TTFT: 410ms (iapi) 460ms (service)"));
-        assert!(rendered[0].contains("TBT: 1.2s (iapi) 1.2s (service)"));
-    }
-
-    #[test]
-    fn final_message_separator_includes_worked_label_after_one_minute() {
-        let cell = FinalMessageSeparator::new(Some(61), /*runtime_metrics*/ None);
-        let rendered = render_lines(&cell.display_lines(/*width*/ 200));
-
-        assert_eq!(rendered.len(), 1);
-        assert!(rendered[0].contains("Worked for"));
-    }
-
-    #[test]
-    fn ps_output_empty_snapshot() {
-        let cell = new_unified_exec_processes_output(Vec::new());
-        let rendered = render_lines(&cell.display_lines(/*width*/ 60)).join("\n");
-        insta::assert_snapshot!(rendered);
-    }
-
-    #[tokio::test]
-    async fn session_info_uses_availability_nux_tooltip_override() {
-        let config = test_config().await;
-        let cell = new_session_info(
-            &config,
-            "gpt-5",
-            &session_configured_event("gpt-5"),
-            /*is_first_event*/ false,
-            Some("Model just became available".to_string()),
-            Some(PlanType::Free),
-            /*show_fast_status*/ false,
-        );
-
-        let rendered = render_transcript(&cell).join("\n");
-        assert!(rendered.contains("Model just became available"));
-    }
-
-    #[tokio::test]
-    #[cfg_attr(
-        target_os = "windows",
-        ignore = "snapshot path rendering differs on Windows"
-    )]
-    async fn session_info_availability_nux_tooltip_snapshot() {
-        let mut config = test_config().await;
-        config.cwd = test_path_buf("/tmp/project").abs();
-        let cell = new_session_info(
-            &config,
-            "gpt-5",
-            &session_configured_event("gpt-5"),
-            /*is_first_event*/ false,
-            Some("Model just became available".to_string()),
-            Some(PlanType::Free),
-            /*show_fast_status*/ false,
-        );
-
-        let rendered = render_transcript(&cell).join("\n");
-        insta::assert_snapshot!(rendered);
-    }
-
-    #[tokio::test]
-    async fn session_info_first_event_suppresses_tooltips_and_nux() {
-        let config = test_config().await;
-        let cell = new_session_info(
-            &config,
-            "gpt-5",
-            &session_configured_event("gpt-5"),
-            /*is_first_event*/ true,
-            Some("Model just became available".to_string()),
-            Some(PlanType::Free),
-            /*show_fast_status*/ false,
-        );
-
-        let rendered = render_transcript(&cell).join("\n");
-        assert!(!rendered.contains("Model just became available"));
-        assert!(rendered.contains("To get started"));
-    }
-
-    #[tokio::test]
-    async fn session_info_hides_tooltips_when_disabled() {
-        let mut config = test_config().await;
-        config.show_tooltips = false;
-        let cell = new_session_info(
-            &config,
-            "gpt-5",
-            &session_configured_event("gpt-5"),
-            /*is_first_event*/ false,
-            Some("Model just became available".to_string()),
-            Some(PlanType::Free),
-            /*show_fast_status*/ false,
-        );
-
-        let rendered = render_transcript(&cell).join("\n");
-        assert!(!rendered.contains("Model just became available"));
-    }
-
-    #[test]
-    fn ps_output_multiline_snapshot() {
-        let cell = new_unified_exec_processes_output(vec![
-            UnifiedExecProcessDetails {
-                command_display: "echo hello\nand then some extra text".to_string(),
-                recent_chunks: vec!["hello".to_string(), "done".to_string()],
-            },
-            UnifiedExecProcessDetails {
-                command_display: "rg \"foo\" src".to_string(),
-                recent_chunks: vec!["src/main.rs:12:foo".to_string()],
-            },
-        ]);
-        let rendered = render_lines(&cell.display_lines(/*width*/ 40)).join("\n");
-        insta::assert_snapshot!(rendered);
-    }
-
-    #[test]
-    fn cyber_policy_error_event_snapshot() {
-        let cell = new_cyber_policy_error_event();
-        let rendered = render_lines(&cell.display_lines(/*width*/ 80)).join("\n");
-        insta::assert_snapshot!(rendered);
-    }
-
-    #[test]
-    fn cyber_policy_error_event_narrow_snapshot() {
-        let cell = new_cyber_policy_error_event();
-        let rendered = render_lines(&cell.display_lines(/*width*/ 36)).join("\n");
-        insta::assert_snapshot!(rendered);
-    }
-
-    #[test]
-    fn ps_output_long_command_snapshot() {
-        let cell = new_unified_exec_processes_output(vec![UnifiedExecProcessDetails {
-            command_display: String::from(
-                "rg \"foo\" src --glob '**/*.rs' --max-count 1000 --no-ignore --hidden --follow --glob '!target/**'",
-            ),
-            recent_chunks: vec!["searching...".to_string()],
-        }]);
-        let rendered = render_lines(&cell.display_lines(/*width*/ 36)).join("\n");
-        insta::assert_snapshot!(rendered);
-    }
-
-    #[test]
-    fn ps_output_many_sessions_snapshot() {
-        let cell = new_unified_exec_processes_output(
-            (0..20)
-                .map(|idx| UnifiedExecProcessDetails {
-                    command_display: format!("command {idx}"),
-                    recent_chunks: Vec::new(),
-                })
-                .collect(),
-        );
-        let rendered = render_lines(&cell.display_lines(/*width*/ 32)).join("\n");
-        insta::assert_snapshot!(rendered);
-    }
-
-    #[test]
-    fn ps_output_chunk_leading_whitespace_snapshot() {
-        let cell = new_unified_exec_processes_output(vec![UnifiedExecProcessDetails {
-            command_display: "just fix".to_string(),
-            recent_chunks: vec![
-                "  indented first".to_string(),
-                "    more indented".to_string(),
-            ],
-        }]);
-        let rendered = render_lines(&cell.display_lines(/*width*/ 60)).join("\n");
-        insta::assert_snapshot!(rendered);
-    }
-
-    #[test]
-    fn error_event_oversized_input_snapshot() {
-        let cell = new_error_event(
-            "Message exceeds the maximum length of 1048576 characters (1048577 provided)."
-                .to_string(),
-        );
-        let rendered = render_lines(&cell.display_lines(/*width*/ 120)).join("\n");
-        insta::assert_snapshot!(rendered);
-    }
-
-    #[tokio::test]
-    async fn mcp_tools_output_masks_sensitive_values() {
-        let mut config = test_config().await;
-        let mut env = HashMap::new();
-        env.insert("TOKEN".to_string(), "secret".to_string());
-        let stdio_config = stdio_server_config("docs-server", vec![], Some(env), vec!["APP_TOKEN"]);
-        let mut servers = config.mcp_servers.get().clone();
-        servers.insert("docs".to_string(), stdio_config);
-
-        let mut headers = HashMap::new();
-        headers.insert("Authorization".to_string(), "Bearer secret".to_string());
-        let mut env_headers = HashMap::new();
-        env_headers.insert("X-API-Key".to_string(), "API_KEY_ENV".to_string());
-        let http_config = streamable_http_server_config(
-            "https://example.com/mcp",
-            Some("MCP_TOKEN"),
-            Some(headers),
-            Some(env_headers),
-        );
-        servers.insert("http".to_string(), http_config);
-        config
-            .mcp_servers
-            .set(servers)
-            .expect("test mcp servers should accept any configuration");
-
-        let mut tools: HashMap<String, Tool> = HashMap::new();
-        tools.insert(
-            "mcp__docs__list".to_string(),
-            Tool {
-                description: None,
-                name: "list".to_string(),
-                title: None,
-                input_schema: serde_json::json!({"type": "object", "properties": {}}),
-                output_schema: None,
-                annotations: None,
-                icons: None,
-                meta: None,
-            },
-        );
-        tools.insert(
-            "mcp__http__ping".to_string(),
-            Tool {
-                description: None,
-                name: "ping".to_string(),
-                title: None,
-                input_schema: serde_json::json!({"type": "object", "properties": {}}),
-                output_schema: None,
-                annotations: None,
-                icons: None,
-                meta: None,
-            },
-        );
-
-        let auth_statuses: HashMap<String, McpAuthStatus> = HashMap::new();
-        let cell = new_mcp_tools_output(
-            &config,
-            tools,
-            HashMap::new(),
-            HashMap::new(),
-            &auth_statuses,
-        );
-        let rendered = render_lines(&cell.display_lines(/*width*/ 120)).join("\n");
-
-        insta::assert_snapshot!(rendered);
-    }
-
-    #[tokio::test]
-    async fn mcp_tools_output_lists_tools_for_hyphenated_server_names() {
-        let mut config = test_config().await;
-        let mut servers = config.mcp_servers.get().clone();
-        servers.insert(
-            "some-server".to_string(),
-            stdio_server_config("docs-server", vec!["--stdio"], /*env*/ None, vec![]),
-        );
-        config
-            .mcp_servers
-            .set(servers)
-            .expect("test mcp servers should accept any configuration");
-
-        let tools = HashMap::from([(
-            "mcp__some_server__lookup".to_string(),
-            Tool {
-                description: None,
-                name: "lookup".to_string(),
-                title: None,
-                input_schema: serde_json::json!({"type": "object", "properties": {}}),
-                output_schema: None,
-                annotations: None,
-                icons: None,
-                meta: None,
-            },
-        )]);
-
-        let auth_statuses: HashMap<String, McpAuthStatus> = HashMap::new();
-        let cell = new_mcp_tools_output(
-            &config,
-            tools,
-            HashMap::new(),
-            HashMap::new(),
-            &auth_statuses,
-        );
-        let rendered = render_lines(&cell.display_lines(/*width*/ 120)).join("\n");
-
-        insta::assert_snapshot!(rendered);
-    }
-
-    #[tokio::test]
-    async fn mcp_tools_output_from_statuses_renders_status_only_servers() {
-        let mut config = test_config().await;
-        let mut plugin_docs =
-            stdio_server_config("docs-server", vec!["--stdio"], /*env*/ None, vec![]);
-        plugin_docs.enabled = false;
-        plugin_docs.disabled_reason = Some(McpServerDisabledReason::Unknown);
-        let servers = HashMap::from([("plugin_docs".to_string(), plugin_docs)]);
-        config
-            .mcp_servers
-            .set(servers)
-            .expect("test mcp servers should accept any configuration");
-
-        let statuses = vec![McpServerStatus {
-            name: "plugin_docs".to_string(),
-            tools: HashMap::from([(
-                "lookup".to_string(),
-                Tool {
-                    description: None,
-                    name: "lookup".to_string(),
-                    title: None,
-                    input_schema: serde_json::json!({"type": "object", "properties": {}}),
-                    output_schema: None,
-                    annotations: None,
-                    icons: None,
-                    meta: None,
-                },
-            )]),
-            resources: Vec::new(),
-            resource_templates: Vec::new(),
-            auth_status: codex_app_server_protocol::McpAuthStatus::Unsupported,
-        }];
-
-        let cell = new_mcp_tools_output_from_statuses(
-            &config,
-            &statuses,
-            McpServerStatusDetail::ToolsAndAuthOnly,
-        );
-        let rendered = render_lines(&cell.display_lines(/*width*/ 120)).join("\n");
-
-        insta::assert_snapshot!(rendered);
-    }
-
-    #[tokio::test]
-    async fn mcp_tools_output_from_statuses_renders_verbose_inventory() {
-        let mut config = test_config().await;
-        let plugin_docs =
-            stdio_server_config("docs-server", vec!["--stdio"], /*env*/ None, vec![]);
-        let servers = HashMap::from([("plugin_docs".to_string(), plugin_docs)]);
-        config
-            .mcp_servers
-            .set(servers)
-            .expect("test mcp servers should accept any configuration");
-
-        let statuses = vec![McpServerStatus {
-            name: "plugin_docs".to_string(),
-            tools: HashMap::from([(
-                "lookup".to_string(),
-                Tool {
-                    description: None,
-                    name: "lookup".to_string(),
-                    title: None,
-                    input_schema: serde_json::json!({"type": "object", "properties": {}}),
-                    output_schema: None,
-                    annotations: None,
-                    icons: None,
-                    meta: None,
-                },
-            )]),
-            resources: vec![Resource {
-                annotations: None,
-                description: None,
-                mime_type: None,
-                name: "docs".to_string(),
-                size: None,
-                title: Some("Docs".to_string()),
-                uri: "file:///docs".to_string(),
-                icons: None,
-                meta: None,
-            }],
-            resource_templates: vec![ResourceTemplate {
-                annotations: None,
-                uri_template: "file:///docs/{id}".to_string(),
-                name: "doc-template".to_string(),
-                title: Some("Doc Template".to_string()),
-                description: None,
-                mime_type: None,
-            }],
-            auth_status: codex_app_server_protocol::McpAuthStatus::Unsupported,
-        }];
-
-        let cell =
-            new_mcp_tools_output_from_statuses(&config, &statuses, McpServerStatusDetail::Full);
-        let rendered = render_lines(&cell.display_lines(/*width*/ 120)).join("\n");
-
-        insta::assert_snapshot!(rendered);
-    }
-
-    #[test]
-    fn empty_agent_message_cell_transcript() {
-        let cell = AgentMessageCell::new(vec![Line::default()], /*is_first_line*/ false);
-        assert_eq!(cell.transcript_lines(/*width*/ 80), vec![Line::from("  ")]);
-        assert_eq!(cell.desired_transcript_height(/*width*/ 80), 1);
-    }
-
-    #[test]
-    fn prefixed_wrapped_history_cell_indents_wrapped_lines() {
-        let summary = Line::from(vec![
-            "You ".into(),
-            "approved".bold(),
-            " codex to run ".into(),
-            "echo something really long to ensure wrapping happens".dim(),
-            " this time".bold(),
-        ]);
-        let cell = PrefixedWrappedHistoryCell::new(summary, "✔ ".green(), "  ");
-        let rendered = render_lines(&cell.display_lines(/*width*/ 24));
-        assert_eq!(
-            rendered,
-            vec![
-                "✔ You approved codex to".to_string(),
-                "  run echo something".to_string(),
-                "  really long to ensure".to_string(),
-                "  wrapping happens this".to_string(),
-                "  time".to_string(),
-            ]
-        );
-    }
-
-    #[test]
-    fn prefixed_wrapped_history_cell_does_not_split_url_like_token() {
-        let url_like =
-            "example.test/api/v1/projects/alpha-team/releases/2026-02-17/builds/1234567890";
-        let cell = PrefixedWrappedHistoryCell::new(Line::from(url_like), "✔ ".green(), "  ");
-        let rendered = render_lines(&cell.display_lines(/*width*/ 24));
-
-        assert_eq!(
-            rendered
-                .iter()
-                .filter(|line| line.contains(url_like))
-                .count(),
-            1,
-            "expected full URL-like token in one rendered line, got: {rendered:?}"
-        );
-    }
-
-    #[test]
-    fn unified_exec_interaction_cell_does_not_split_url_like_stdin_token() {
-        let url_like =
-            "example.test/api/v1/projects/alpha-team/releases/2026-02-17/builds/1234567890";
-        let cell = UnifiedExecInteractionCell::new(Some("true".to_string()), url_like.to_string());
-        let rendered = render_lines(&cell.display_lines(/*width*/ 24));
-
-        assert_eq!(
-            rendered
-                .iter()
-                .filter(|line| line.contains(url_like))
-                .count(),
-            1,
-            "expected full URL-like token in one rendered line, got: {rendered:?}"
-        );
-    }
-
-    #[test]
-    fn prefixed_wrapped_history_cell_height_matches_wrapped_rendering() {
-        let url_like = "example.test/api/v1/projects/alpha-team/releases/2026-02-17/builds/1234567890/artifacts/reports/performance/summary/detail/with/a/very/long/path";
-        let cell: Box<dyn HistoryCell> = Box::new(PrefixedWrappedHistoryCell::new(
-            Line::from(url_like),
-            "✔ ".green(),
-            "  ",
-        ));
-
-        let width: u16 = 24;
-        let logical_height = cell.display_lines(width).len() as u16;
-        let wrapped_height = cell.desired_height(width);
-        assert!(
-            wrapped_height > logical_height,
-            "expected wrapped height to exceed logical line count ({logical_height}), got {wrapped_height}"
-        );
-
-        let area = Rect::new(0, 0, width, wrapped_height);
-        let mut buf = ratatui::buffer::Buffer::empty(area);
-        cell.render(area, &mut buf);
-
-        let first_row = (0..area.width)
-            .map(|x| {
-                let symbol = buf[(x, 0)].symbol();
-                if symbol.is_empty() {
-                    ' '
-                } else {
-                    symbol.chars().next().unwrap_or(' ')
-                }
-            })
-            .collect::<String>();
-        assert!(
-            first_row.contains("✔"),
-            "expected first rendered row to keep the prefix visible, got: {first_row:?}"
-        );
-    }
-
-    #[test]
-    fn unified_exec_interaction_cell_height_matches_wrapped_rendering() {
-        let url_like = "example.test/api/v1/projects/alpha-team/releases/2026-02-17/builds/1234567890/artifacts/reports/performance/summary/detail/with/a/very/long/path";
-        let cell: Box<dyn HistoryCell> = Box::new(UnifiedExecInteractionCell::new(
-            Some("true".to_string()),
-            url_like.to_string(),
-        ));
-
-        let width: u16 = 24;
-        let logical_height = cell.display_lines(width).len() as u16;
-        let wrapped_height = cell.desired_height(width);
-        assert!(
-            wrapped_height > logical_height,
-            "expected wrapped height to exceed logical line count ({logical_height}), got {wrapped_height}"
-        );
-
-        let area = Rect::new(0, 0, width, wrapped_height);
-        let mut buf = ratatui::buffer::Buffer::empty(area);
-        cell.render(area, &mut buf);
-
-        let first_row = (0..area.width)
-            .map(|x| {
-                let symbol = buf[(x, 0)].symbol();
-                if symbol.is_empty() {
-                    ' '
-                } else {
-                    symbol.chars().next().unwrap_or(' ')
-                }
-            })
-            .collect::<String>();
-        assert!(
-            first_row.contains("Interacted with"),
-            "expected first rendered row to keep the header visible, got: {first_row:?}"
-        );
-    }
-
-    #[test]
-    fn web_search_history_cell_snapshot() {
-        let query =
-            "example search query with several generic words to exercise wrapping".to_string();
-        let cell = new_web_search_call(
-            "call-1".to_string(),
-            query.clone(),
-            WebSearchAction::Search {
-                query: Some(query),
-                queries: None,
-            },
-        );
-        let rendered = render_lines(&cell.display_lines(/*width*/ 64)).join("\n");
-
-        insta::assert_snapshot!(rendered);
-    }
-
-    #[test]
-    fn web_search_history_cell_wraps_with_indented_continuation() {
-        let query =
-            "example search query with several generic words to exercise wrapping".to_string();
-        let cell = new_web_search_call(
-            "call-1".to_string(),
-            query.clone(),
-            WebSearchAction::Search {
-                query: Some(query),
-                queries: None,
-            },
-        );
-        let rendered = render_lines(&cell.display_lines(/*width*/ 64));
-
-        assert_eq!(
-            rendered,
-            vec![
-                "• Searched example search query with several generic words to".to_string(),
-                "  exercise wrapping".to_string(),
-            ]
-        );
-    }
-
-    #[test]
-    fn web_search_history_cell_short_query_does_not_wrap() {
-        let query = "short query".to_string();
-        let cell = new_web_search_call(
-            "call-1".to_string(),
-            query.clone(),
-            WebSearchAction::Search {
-                query: Some(query),
-                queries: None,
-            },
-        );
-        let rendered = render_lines(&cell.display_lines(/*width*/ 64));
-
-        assert_eq!(rendered, vec!["• Searched short query".to_string()]);
-    }
-
-    #[test]
-    fn web_search_history_cell_transcript_snapshot() {
-        let query =
-            "example search query with several generic words to exercise wrapping".to_string();
-        let cell = new_web_search_call(
-            "call-1".to_string(),
-            query.clone(),
-            WebSearchAction::Search {
-                query: Some(query),
-                queries: None,
-            },
-        );
-        let rendered = render_lines(&cell.transcript_lines(/*width*/ 64)).join("\n");
-
-        insta::assert_snapshot!(rendered);
-    }
-
-    #[test]
-    fn active_mcp_tool_call_snapshot() {
-        let invocation = McpInvocation {
-            server: "search".into(),
-            tool: "find_docs".into(),
-            arguments: Some(json!({
-                "query": "ratatui styling",
-                "limit": 3,
-            })),
-        };
-
-        let cell = new_active_mcp_tool_call(
-            "call-1".into(),
-            invocation,
-            /*animations_enabled*/ true,
-        );
-        let rendered = render_lines(&cell.display_lines(/*width*/ 80)).join("\n");
-
-        insta::assert_snapshot!(rendered);
-    }
-
-    #[test]
-    fn mcp_inventory_loading_snapshot() {
-        let cell = new_mcp_inventory_loading(/*animations_enabled*/ true);
-        let rendered = render_lines(&cell.display_lines(/*width*/ 80)).join("\n");
-
-        insta::assert_snapshot!(rendered);
-    }
-
-    #[test]
-    fn mcp_inventory_loading_without_animations_is_stable() {
-        let cell = new_mcp_inventory_loading(/*animations_enabled*/ false);
-        let first = render_lines(&cell.display_lines(/*width*/ 80));
-        let second = render_lines(&cell.display_lines(/*width*/ 80));
-
-        assert_eq!(first, second);
-        assert_eq!(first, vec!["• Loading MCP inventory…".to_string()]);
-    }
-
-    #[test]
-    fn completed_mcp_tool_call_success_snapshot() {
-        let invocation = McpInvocation {
-            server: "search".into(),
-            tool: "find_docs".into(),
-            arguments: Some(json!({
-                "query": "ratatui styling",
-                "limit": 3,
-            })),
-        };
-
-        let result = CallToolResult {
-            content: vec![text_block("Found styling guidance in styles.md")],
-            is_error: None,
-            structured_content: None,
-            meta: None,
-        };
-
-        let mut cell = new_active_mcp_tool_call(
-            "call-2".into(),
-            invocation,
-            /*animations_enabled*/ true,
-        );
-        assert!(
-            cell.complete(Duration::from_millis(1420), Ok(result))
-                .is_none()
-        );
-
-        let rendered = render_lines(&cell.display_lines(/*width*/ 80)).join("\n");
-
-        insta::assert_snapshot!(rendered);
-    }
-
-    #[test]
-    fn completed_mcp_tool_call_image_after_text_returns_extra_cell() {
-        let invocation = McpInvocation {
-            server: "image".into(),
-            tool: "generate".into(),
-            arguments: Some(json!({
-                "prompt": "tiny image",
-            })),
-        };
-
-        let result = CallToolResult {
-            content: vec![
-                text_block("Here is the image:"),
-                image_block(SMALL_PNG_BASE64),
-            ],
-            is_error: None,
-            structured_content: None,
-            meta: None,
-        };
-
-        let mut cell = new_active_mcp_tool_call(
-            "call-image".into(),
-            invocation,
-            /*animations_enabled*/ true,
-        );
-        let extra_cell = cell
-            .complete(Duration::from_millis(25), Ok(result))
-            .expect("expected image cell");
-
-        let rendered = render_lines(&extra_cell.display_lines(/*width*/ 80));
-        assert_eq!(rendered, vec!["tool result (image output)"]);
-    }
-
-    #[test]
-    fn completed_mcp_tool_call_accepts_data_url_image_blocks() {
-        let invocation = McpInvocation {
-            server: "image".into(),
-            tool: "generate".into(),
-            arguments: Some(json!({
-                "prompt": "tiny image",
-            })),
-        };
-
-        let data_url = format!("data:image/png;base64,{SMALL_PNG_BASE64}");
-        let result = CallToolResult {
-            content: vec![image_block(&data_url)],
-            is_error: None,
-            structured_content: None,
-            meta: None,
-        };
-
-        let mut cell = new_active_mcp_tool_call(
-            "call-image-data-url".into(),
-            invocation,
-            /*animations_enabled*/ true,
-        );
-        let extra_cell = cell
-            .complete(Duration::from_millis(25), Ok(result))
-            .expect("expected image cell");
-
-        let rendered = render_lines(&extra_cell.display_lines(/*width*/ 80));
-        assert_eq!(rendered, vec!["tool result (image output)"]);
-    }
-
-    #[test]
-    fn completed_mcp_tool_call_skips_invalid_image_blocks() {
-        let invocation = McpInvocation {
-            server: "image".into(),
-            tool: "generate".into(),
-            arguments: Some(json!({
-                "prompt": "tiny image",
-            })),
-        };
-
-        let result = CallToolResult {
-            content: vec![image_block("not-base64"), image_block(SMALL_PNG_BASE64)],
-            is_error: None,
-            structured_content: None,
-            meta: None,
-        };
-
-        let mut cell = new_active_mcp_tool_call(
-            "call-image-2".into(),
-            invocation,
-            /*animations_enabled*/ true,
-        );
-        let extra_cell = cell
-            .complete(Duration::from_millis(25), Ok(result))
-            .expect("expected image cell");
-
-        let rendered = render_lines(&extra_cell.display_lines(/*width*/ 80));
-        assert_eq!(rendered, vec!["tool result (image output)"]);
-    }
-
-    #[test]
-    fn completed_mcp_tool_call_error_snapshot() {
-        let invocation = McpInvocation {
-            server: "search".into(),
-            tool: "find_docs".into(),
-            arguments: Some(json!({
-                "query": "ratatui styling",
-                "limit": 3,
-            })),
-        };
-
-        let mut cell = new_active_mcp_tool_call(
-            "call-3".into(),
-            invocation,
-            /*animations_enabled*/ true,
-        );
-        assert!(
-            cell.complete(Duration::from_secs(2), Err("network timeout".into()))
-                .is_none()
-        );
-
-        let rendered = render_lines(&cell.display_lines(/*width*/ 80)).join("\n");
-
-        insta::assert_snapshot!(rendered);
-    }
-
-    #[test]
-    fn completed_mcp_tool_call_multiple_outputs_snapshot() {
-        let invocation = McpInvocation {
-            server: "search".into(),
-            tool: "find_docs".into(),
-            arguments: Some(json!({
-                "query": "ratatui styling",
-                "limit": 3,
-            })),
-        };
-
-        let result = CallToolResult {
-            content: vec![
-                text_block(
-                    "Found styling guidance in styles.md and additional notes in CONTRIBUTING.md.",
-                ),
-                resource_link_block(
-                    "file:///docs/styles.md",
-                    "styles.md",
-                    Some("Styles"),
-                    Some("Link to styles documentation"),
-                ),
-            ],
-            is_error: None,
-            structured_content: None,
-            meta: None,
-        };
-
-        let mut cell = new_active_mcp_tool_call(
-            "call-4".into(),
-            invocation,
-            /*animations_enabled*/ true,
-        );
-        assert!(
-            cell.complete(Duration::from_millis(640), Ok(result))
-                .is_none()
-        );
-
-        let rendered = render_lines(&cell.display_lines(/*width*/ 48)).join("\n");
-
-        insta::assert_snapshot!(rendered);
-    }
-
-    #[test]
-    fn completed_mcp_tool_call_wrapped_outputs_snapshot() {
-        let invocation = McpInvocation {
-            server: "metrics".into(),
-            tool: "get_nearby_metric".into(),
-            arguments: Some(json!({
-                "query": "very_long_query_that_needs_wrapping_to_display_properly_in_the_history",
-                "limit": 1,
-            })),
-        };
-
-        let result = CallToolResult {
-            content: vec![text_block(
-                "Line one of the response, which is quite long and needs wrapping.\nLine two continues the response with more detail.",
-            )],
-            is_error: None,
-            structured_content: None,
-            meta: None,
-        };
-
-        let mut cell = new_active_mcp_tool_call(
-            "call-5".into(),
-            invocation,
-            /*animations_enabled*/ true,
-        );
-        assert!(
-            cell.complete(Duration::from_millis(1280), Ok(result))
-                .is_none()
-        );
-
-        let rendered = render_lines(&cell.display_lines(/*width*/ 40)).join("\n");
-
-        insta::assert_snapshot!(rendered);
-    }
-
-    #[test]
-    fn completed_mcp_tool_call_multiple_outputs_inline_snapshot() {
-        let invocation = McpInvocation {
-            server: "metrics".into(),
-            tool: "summary".into(),
-            arguments: Some(json!({
-                "metric": "trace.latency",
-                "window": "15m",
-            })),
-        };
-
-        let result = CallToolResult {
-            content: vec![
-                text_block("Latency summary: p50=120ms, p95=480ms."),
-                text_block("No anomalies detected."),
-            ],
-            is_error: None,
-            structured_content: None,
-            meta: None,
-        };
-
-        let mut cell = new_active_mcp_tool_call(
-            "call-6".into(),
-            invocation,
-            /*animations_enabled*/ true,
-        );
-        assert!(
-            cell.complete(Duration::from_millis(320), Ok(result))
-                .is_none()
-        );
-
-        let rendered = render_lines(&cell.display_lines(/*width*/ 120)).join("\n");
-
-        insta::assert_snapshot!(rendered);
-    }
-
-    #[test]
-    fn session_header_includes_reasoning_level_when_present() {
-        let cell = SessionHeaderHistoryCell::new(
-            "gpt-4o".to_string(),
-            Some(ReasoningEffortConfig::High),
-            /*show_fast_status*/ true,
-            std::env::temp_dir(),
-            "test",
-        );
-
-        let lines = render_lines(&cell.display_lines(/*width*/ 80));
-        let model_line = lines
-            .iter()
-            .find(|line| line.contains("model:"))
-            .expect("model line");
-
-        assert!(model_line.contains("gpt-4o high   fast"));
-        assert!(model_line.contains("/model to change"));
-    }
-
-    #[test]
-    fn session_header_hides_fast_status_when_disabled() {
-        let cell = SessionHeaderHistoryCell::new(
-            "gpt-4o".to_string(),
-            Some(ReasoningEffortConfig::High),
-            /*show_fast_status*/ false,
-            std::env::temp_dir(),
-            "test",
-        );
-
-        let lines = render_lines(&cell.display_lines(/*width*/ 80));
-        let model_line = lines
-            .iter()
-            .find(|line| line.contains("model:"))
-            .expect("model line");
-
-        assert!(model_line.contains("gpt-4o high"));
-        assert!(!model_line.contains("fast"));
-    }
-
-    #[test]
-    #[cfg_attr(
-        target_os = "windows",
-        ignore = "snapshot path rendering differs on Windows"
-    )]
-    fn session_header_indicates_yolo_mode() {
-        let cell = SessionHeaderHistoryCell::new(
-            "gpt-5".to_string(),
-            /*reasoning_effort*/ None,
-            /*show_fast_status*/ false,
-            test_path_buf("/tmp/project").abs().to_path_buf(),
-            "test",
-        )
-        .with_yolo_mode(/*yolo_mode*/ true);
-
-        let rendered = render_lines(&cell.display_lines(/*width*/ 80)).join("\n");
-        insta::assert_snapshot!(rendered);
-    }
-
-    #[test]
-    fn yolo_mode_includes_managed_full_access_profiles() {
-        let permission_profile: PermissionProfile = AppServerPermissionProfile::Managed {
-            network: PermissionProfileNetworkPermissions { enabled: true },
-            file_system: PermissionProfileFileSystemPermissions::Unrestricted,
-        }
-        .into();
-
-        assert!(has_yolo_permissions(
-            AskForApproval::Never,
-            &permission_profile
-        ));
-    }
-
-    #[test]
-    fn yolo_mode_excludes_external_sandbox_profiles() {
-        let permission_profile: PermissionProfile = AppServerPermissionProfile::External {
-            network: PermissionProfileNetworkPermissions { enabled: true },
-        }
-        .into();
-
-        assert!(!has_yolo_permissions(
-            AskForApproval::Never,
-            &permission_profile
-        ));
-    }
-
-    #[test]
-    fn session_header_directory_center_truncates() {
-        let mut dir = home_dir().expect("home directory");
-        for part in ["hello", "the", "fox", "is", "very", "fast"] {
-            dir.push(part);
-        }
-
-        let formatted = SessionHeaderHistoryCell::format_directory_inner(&dir, Some(24));
-        let sep = std::path::MAIN_SEPARATOR;
-        let expected = format!("~{sep}hello{sep}the{sep}…{sep}very{sep}fast");
-        assert_eq!(formatted, expected);
-    }
-
-    #[test]
-    fn session_header_directory_front_truncates_long_segment() {
-        let mut dir = home_dir().expect("home directory");
-        dir.push("supercalifragilisticexpialidocious");
-
-        let formatted = SessionHeaderHistoryCell::format_directory_inner(&dir, Some(18));
-        let sep = std::path::MAIN_SEPARATOR;
-        let expected = format!("~{sep}…cexpialidocious");
-        assert_eq!(formatted, expected);
-    }
-
-    #[test]
-    fn coalesces_sequential_reads_within_one_call() {
-        // Build one exec cell with a Search followed by two Reads
-        let call_id = "c1".to_string();
-        let mut cell = ExecCell::new(
-            ExecCall {
-                call_id: call_id.clone(),
-                command: vec!["bash".into(), "-lc".into(), "echo".into()],
-                parsed: vec![
-                    ParsedCommand::Search {
-                        query: Some("shimmer_spans".into()),
-                        path: None,
-                        cmd: "rg shimmer_spans".into(),
-                    },
-                    ParsedCommand::Read {
-                        name: "shimmer.rs".into(),
-                        cmd: "cat shimmer.rs".into(),
-                        path: "shimmer.rs".into(),
-                    },
-                    ParsedCommand::Read {
-                        name: "status_indicator_widget.rs".into(),
-                        cmd: "cat status_indicator_widget.rs".into(),
-                        path: "status_indicator_widget.rs".into(),
-                    },
-                ],
-                output: None,
-                source: ExecCommandSource::Agent,
-                start_time: Some(Instant::now()),
-                duration: None,
-                interaction_input: None,
-            },
-            /*animations_enabled*/ true,
-        );
-        // Mark call complete so markers are ✓
-        cell.complete_call(&call_id, CommandOutput::default(), Duration::from_millis(1));
-
-        let lines = cell.display_lines(/*width*/ 80);
-        let rendered = render_lines(&lines).join("\n");
-        insta::assert_snapshot!(rendered);
-    }
-
-    #[test]
-    fn coalesces_reads_across_multiple_calls() {
-        let mut cell = ExecCell::new(
-            ExecCall {
-                call_id: "c1".to_string(),
-                command: vec!["bash".into(), "-lc".into(), "echo".into()],
-                parsed: vec![ParsedCommand::Search {
-                    query: Some("shimmer_spans".into()),
-                    path: None,
-                    cmd: "rg shimmer_spans".into(),
-                }],
-                output: None,
-                source: ExecCommandSource::Agent,
-                start_time: Some(Instant::now()),
-                duration: None,
-                interaction_input: None,
-            },
-            /*animations_enabled*/ true,
-        );
-        // Call 1: Search only
-        cell.complete_call("c1", CommandOutput::default(), Duration::from_millis(1));
-        // Call 2: Read A
-        cell = cell
-            .with_added_call(
-                "c2".into(),
-                vec!["bash".into(), "-lc".into(), "echo".into()],
-                vec![ParsedCommand::Read {
-                    name: "shimmer.rs".into(),
-                    cmd: "cat shimmer.rs".into(),
-                    path: "shimmer.rs".into(),
-                }],
-                ExecCommandSource::Agent,
-                /*interaction_input*/ None,
-            )
-            .unwrap();
-        cell.complete_call("c2", CommandOutput::default(), Duration::from_millis(1));
-        // Call 3: Read B
-        cell = cell
-            .with_added_call(
-                "c3".into(),
-                vec!["bash".into(), "-lc".into(), "echo".into()],
-                vec![ParsedCommand::Read {
-                    name: "status_indicator_widget.rs".into(),
-                    cmd: "cat status_indicator_widget.rs".into(),
-                    path: "status_indicator_widget.rs".into(),
-                }],
-                ExecCommandSource::Agent,
-                /*interaction_input*/ None,
-            )
-            .unwrap();
-        cell.complete_call("c3", CommandOutput::default(), Duration::from_millis(1));
-
-        let lines = cell.display_lines(/*width*/ 80);
-        let rendered = render_lines(&lines).join("\n");
-        insta::assert_snapshot!(rendered);
-    }
-
-    #[test]
-    fn coalesced_reads_dedupe_names() {
-        let mut cell = ExecCell::new(
-            ExecCall {
-                call_id: "c1".to_string(),
-                command: vec!["bash".into(), "-lc".into(), "echo".into()],
-                parsed: vec![
-                    ParsedCommand::Read {
-                        name: "auth.rs".into(),
-                        cmd: "cat auth.rs".into(),
-                        path: "auth.rs".into(),
-                    },
-                    ParsedCommand::Read {
-                        name: "auth.rs".into(),
-                        cmd: "cat auth.rs".into(),
-                        path: "auth.rs".into(),
-                    },
-                    ParsedCommand::Read {
-                        name: "shimmer.rs".into(),
-                        cmd: "cat shimmer.rs".into(),
-                        path: "shimmer.rs".into(),
-                    },
-                ],
-                output: None,
-                source: ExecCommandSource::Agent,
-                start_time: Some(Instant::now()),
-                duration: None,
-                interaction_input: None,
-            },
-            /*animations_enabled*/ true,
-        );
-        cell.complete_call("c1", CommandOutput::default(), Duration::from_millis(1));
-        let lines = cell.display_lines(/*width*/ 80);
-        let rendered = render_lines(&lines).join("\n");
-        insta::assert_snapshot!(rendered);
-    }
-
-    #[test]
-    fn multiline_command_wraps_with_extra_indent_on_subsequent_lines() {
-        // Create a completed exec cell with a multiline command
-        let cmd = "set -o pipefail\ncargo test -p codex-tui --quiet".to_string();
-        let call_id = "c1".to_string();
-        let mut cell = ExecCell::new(
-            ExecCall {
-                call_id: call_id.clone(),
-                command: vec!["bash".into(), "-lc".into(), cmd],
-                parsed: Vec::new(),
-                output: None,
-                source: ExecCommandSource::Agent,
-                start_time: Some(Instant::now()),
-                duration: None,
-                interaction_input: None,
-            },
-            /*animations_enabled*/ true,
-        );
-        // Mark call complete so it renders as "Ran"
-        cell.complete_call(&call_id, CommandOutput::default(), Duration::from_millis(1));
-
-        // Small width to keep the wrapped continuation-indent path covered.
-        let width: u16 = 28;
-        let lines = cell.display_lines(width);
-        let rendered = render_lines(&lines).join("\n");
-        insta::assert_snapshot!(rendered);
-    }
-
-    #[test]
-    fn single_line_command_compact_when_fits() {
-        let call_id = "c1".to_string();
-        let mut cell = ExecCell::new(
-            ExecCall {
-                call_id: call_id.clone(),
-                command: vec!["echo".into(), "ok".into()],
-                parsed: Vec::new(),
-                output: None,
-                source: ExecCommandSource::Agent,
-                start_time: Some(Instant::now()),
-                duration: None,
-                interaction_input: None,
-            },
-            /*animations_enabled*/ true,
-        );
-        cell.complete_call(&call_id, CommandOutput::default(), Duration::from_millis(1));
-        // Wide enough that it fits inline
-        let lines = cell.display_lines(/*width*/ 80);
-        let rendered = render_lines(&lines).join("\n");
-        insta::assert_snapshot!(rendered);
-    }
-
-    #[test]
-    fn single_line_command_wraps_with_four_space_continuation() {
-        let call_id = "c1".to_string();
-        let long = "a_very_long_token_without_spaces_to_force_wrapping".to_string();
-        let mut cell = ExecCell::new(
-            ExecCall {
-                call_id: call_id.clone(),
-                command: vec!["bash".into(), "-lc".into(), long],
-                parsed: Vec::new(),
-                output: None,
-                source: ExecCommandSource::Agent,
-                start_time: Some(Instant::now()),
-                duration: None,
-                interaction_input: None,
-            },
-            /*animations_enabled*/ true,
-        );
-        cell.complete_call(&call_id, CommandOutput::default(), Duration::from_millis(1));
-        let lines = cell.display_lines(/*width*/ 24);
-        let rendered = render_lines(&lines).join("\n");
-        insta::assert_snapshot!(rendered);
-    }
-
-    #[test]
-    fn multiline_command_without_wrap_uses_branch_then_eight_spaces() {
-        let call_id = "c1".to_string();
-        let cmd = "echo one\necho two".to_string();
-        let mut cell = ExecCell::new(
-            ExecCall {
-                call_id: call_id.clone(),
-                command: vec!["bash".into(), "-lc".into(), cmd],
-                parsed: Vec::new(),
-                output: None,
-                source: ExecCommandSource::Agent,
-                start_time: Some(Instant::now()),
-                duration: None,
-                interaction_input: None,
-            },
-            /*animations_enabled*/ true,
-        );
-        cell.complete_call(&call_id, CommandOutput::default(), Duration::from_millis(1));
-        let lines = cell.display_lines(/*width*/ 80);
-        let rendered = render_lines(&lines).join("\n");
-        insta::assert_snapshot!(rendered);
-    }
-
-    #[test]
-    fn multiline_command_both_lines_wrap_with_correct_prefixes() {
-        let call_id = "c1".to_string();
-        let cmd = "first_token_is_long_enough_to_wrap\nsecond_token_is_also_long_enough_to_wrap"
-            .to_string();
-        let mut cell = ExecCell::new(
-            ExecCall {
-                call_id: call_id.clone(),
-                command: vec!["bash".into(), "-lc".into(), cmd],
-                parsed: Vec::new(),
-                output: None,
-                source: ExecCommandSource::Agent,
-                start_time: Some(Instant::now()),
-                duration: None,
-                interaction_input: None,
-            },
-            /*animations_enabled*/ true,
-        );
-        cell.complete_call(&call_id, CommandOutput::default(), Duration::from_millis(1));
-        let lines = cell.display_lines(/*width*/ 28);
-        let rendered = render_lines(&lines).join("\n");
-        insta::assert_snapshot!(rendered);
-    }
-
-    #[test]
-    fn stderr_tail_more_than_five_lines_snapshot() {
-        // Build an exec cell with a non-zero exit and 10 lines on stderr to exercise
-        // the head/tail rendering and gutter prefixes.
-        let call_id = "c_err".to_string();
-        let mut cell = ExecCell::new(
-            ExecCall {
-                call_id: call_id.clone(),
-                command: vec!["bash".into(), "-lc".into(), "seq 1 10 1>&2 && false".into()],
-                parsed: Vec::new(),
-                output: None,
-                source: ExecCommandSource::Agent,
-                start_time: Some(Instant::now()),
-                duration: None,
-                interaction_input: None,
-            },
-            /*animations_enabled*/ true,
-        );
-        let stderr: String = (1..=10)
-            .map(|n| n.to_string())
-            .collect::<Vec<_>>()
-            .join("\n");
-        cell.complete_call(
-            &call_id,
-            CommandOutput {
-                exit_code: 1,
-                formatted_output: String::new(),
-                aggregated_output: stderr,
-            },
-            Duration::from_millis(1),
-        );
-
-        let rendered = cell
-            .display_lines(/*width*/ 80)
-            .iter()
-            .map(|l| {
-                l.spans
-                    .iter()
-                    .map(|s| s.content.as_ref())
-                    .collect::<String>()
-            })
-            .collect::<Vec<_>>()
-            .join("\n");
-        insta::assert_snapshot!(rendered);
-    }
-
-    #[test]
-    fn ran_cell_multiline_with_stderr_snapshot() {
-        // Build an exec cell that completes (so it renders as "Ran") with a
-        // command long enough that it must render on its own line under the
-        // header, and include a couple of stderr lines to verify the output
-        // block prefixes and wrapping.
-        let call_id = "c_wrap_err".to_string();
-        let long_cmd =
-            "echo this_is_a_very_long_single_token_that_will_wrap_across_the_available_width";
-        let mut cell = ExecCell::new(
-            ExecCall {
-                call_id: call_id.clone(),
-                command: vec!["bash".into(), "-lc".into(), long_cmd.to_string()],
-                parsed: Vec::new(),
-                output: None,
-                source: ExecCommandSource::Agent,
-                start_time: Some(Instant::now()),
-                duration: None,
-                interaction_input: None,
-            },
-            /*animations_enabled*/ true,
-        );
-
-        let stderr = "error: first line on stderr\nerror: second line on stderr".to_string();
-        cell.complete_call(
-            &call_id,
-            CommandOutput {
-                exit_code: 1,
-                formatted_output: String::new(),
-                aggregated_output: stderr,
-            },
-            Duration::from_millis(5),
-        );
-
-        // Narrow width to force the command to render under the header line.
-        let width: u16 = 28;
-        let rendered = cell
-            .display_lines(width)
-            .iter()
-            .map(|l| {
-                l.spans
-                    .iter()
-                    .map(|s| s.content.as_ref())
-                    .collect::<String>()
-            })
-            .collect::<Vec<_>>()
-            .join("\n");
-        insta::assert_snapshot!(rendered);
-    }
-    #[test]
-    fn user_history_cell_wraps_and_prefixes_each_line_snapshot() {
-        let msg = "one two three four five six seven";
-        let cell = UserHistoryCell {
-            message: msg.to_string(),
-            text_elements: Vec::new(),
-            local_image_paths: Vec::new(),
-            remote_image_urls: Vec::new(),
-        };
-
-        // Small width to force wrapping more clearly. Effective wrap width is width-2 due to the ▌ prefix and trailing space.
-        let width: u16 = 12;
-        let lines = cell.display_lines(width);
-        let rendered = render_lines(&lines).join("\n");
-
-        insta::assert_snapshot!(rendered);
-    }
-
-    #[test]
-    fn user_history_cell_renders_remote_image_urls() {
-        let cell = UserHistoryCell {
-            message: "describe these".to_string(),
-            text_elements: Vec::new(),
-            local_image_paths: Vec::new(),
-            remote_image_urls: vec!["https://example.com/example.png".to_string()],
-        };
-
-        let rendered = render_lines(&cell.display_lines(/*width*/ 80)).join("\n");
-
-        assert!(rendered.contains("[Image #1]"));
-        assert!(rendered.contains("describe these"));
-        insta::assert_snapshot!(rendered);
-    }
-
-    #[test]
-    fn user_history_cell_summarizes_inline_data_urls() {
-        let cell = UserHistoryCell {
-            message: "describe inline image".to_string(),
-            text_elements: Vec::new(),
-            local_image_paths: Vec::new(),
-            remote_image_urls: vec!["data:image/png;base64,aGVsbG8=".to_string()],
-        };
-
-        let rendered = render_lines(&cell.display_lines(/*width*/ 80)).join("\n");
-
-        assert!(rendered.contains("[Image #1]"));
-        assert!(rendered.contains("describe inline image"));
-    }
-
-    #[test]
-    fn user_history_cell_numbers_multiple_remote_images() {
-        let cell = UserHistoryCell {
-            message: "describe both".to_string(),
-            text_elements: Vec::new(),
-            local_image_paths: Vec::new(),
-            remote_image_urls: vec![
-                "https://example.com/one.png".to_string(),
-                "https://example.com/two.png".to_string(),
-            ],
-        };
-
-        let rendered = render_lines(&cell.display_lines(/*width*/ 80)).join("\n");
-
-        assert!(rendered.contains("[Image #1]"));
-        assert!(rendered.contains("[Image #2]"));
-        insta::assert_snapshot!(rendered);
-    }
-
-    #[test]
-    fn user_history_cell_height_matches_rendered_lines_with_remote_images() {
-        let cell = UserHistoryCell {
-            message: "line one\nline two".to_string(),
-            text_elements: Vec::new(),
-            local_image_paths: Vec::new(),
-            remote_image_urls: vec![
-                "https://example.com/one.png".to_string(),
-                "https://example.com/two.png".to_string(),
-            ],
-        };
-
-        let width = 80;
-        let rendered_len: u16 = cell
-            .display_lines(width)
-            .len()
-            .try_into()
-            .unwrap_or(u16::MAX);
-        assert_eq!(cell.desired_height(width), rendered_len);
-        assert_eq!(cell.desired_transcript_height(width), rendered_len);
-    }
-
-    #[test]
-    fn user_history_cell_trims_trailing_blank_message_lines() {
-        let cell = UserHistoryCell {
-            message: "line one\n\n   \n\t \n".to_string(),
-            text_elements: Vec::new(),
-            local_image_paths: Vec::new(),
-            remote_image_urls: vec!["https://example.com/one.png".to_string()],
-        };
-
-        let rendered = render_lines(&cell.display_lines(/*width*/ 80));
-        let trailing_blank_count = rendered
-            .iter()
-            .rev()
-            .take_while(|line| line.trim().is_empty())
-            .count();
-        assert_eq!(trailing_blank_count, 1);
-        assert!(rendered.iter().any(|line| line.contains("line one")));
-    }
-
-    #[test]
-    fn user_history_cell_trims_trailing_blank_message_lines_with_text_elements() {
-        let message = "tokenized\n\n\n".to_string();
-        let cell = UserHistoryCell {
-            message,
-            text_elements: vec![TextElement::new(
-                (0..8).into(),
-                Some("tokenized".to_string()),
-            )],
-            local_image_paths: Vec::new(),
-            remote_image_urls: vec!["https://example.com/one.png".to_string()],
-        };
-
-        let rendered = render_lines(&cell.display_lines(/*width*/ 80));
-        let trailing_blank_count = rendered
-            .iter()
-            .rev()
-            .take_while(|line| line.trim().is_empty())
-            .count();
-        assert_eq!(trailing_blank_count, 1);
-        assert!(rendered.iter().any(|line| line.contains("tokenized")));
-    }
-
-    #[test]
-    fn render_uses_wrapping_for_long_url_like_line() {
-        let url = "https://example.test/api/v1/projects/alpha-team/releases/2026-02-17/builds/1234567890/artifacts/reports/performance/summary/detail/with/a/very/long/path/that/keeps/going/for/testing/purposes-only-and-does/not/need/to/resolve/index.html?session_id=abc123def456ghi789jkl012mno345pqr678stu901vwx234yz";
-        let cell: Box<dyn HistoryCell> = Box::new(UserHistoryCell {
-            message: url.to_string(),
-            text_elements: Vec::new(),
-            local_image_paths: Vec::new(),
-            remote_image_urls: Vec::new(),
-        });
-
-        let width: u16 = 52;
-        let height = cell.desired_height(width);
-        assert!(
-            height > 1,
-            "expected wrapped height for long URL, got {height}"
-        );
-
-        let area = Rect::new(0, 0, width, height);
-        let mut buf = ratatui::buffer::Buffer::empty(area);
-        cell.render(area, &mut buf);
-
-        let rendered = (0..area.height)
-            .map(|y| {
-                (0..area.width)
-                    .map(|x| {
-                        let symbol = buf[(x, y)].symbol();
-                        if symbol.is_empty() {
-                            ' '
-                        } else {
-                            symbol.chars().next().unwrap_or(' ')
-                        }
-                    })
-                    .collect::<String>()
-            })
-            .collect::<Vec<_>>();
-        let rendered_blob = rendered.join("\n");
-
-        assert!(
-            rendered_blob.contains("session_id=abc123"),
-            "expected URL tail to be visible after wrapping, got:\n{rendered_blob}"
-        );
-
-        let non_empty_rows = rendered.iter().filter(|row| !row.trim().is_empty()).count() as u16;
-        assert!(
-            non_empty_rows > 3,
-            "expected long URL to span multiple visible rows, got:\n{rendered_blob}"
-        );
-    }
-
-    #[test]
-    fn plan_update_with_note_and_wrapping_snapshot() {
-        // Long explanation forces wrapping; include long step text to verify step wrapping and alignment.
-        let update = UpdatePlanArgs {
-            explanation: Some(
-                "I’ll update Grafana call error handling by adding retries and clearer messages when the backend is unreachable."
-                    .to_string(),
-            ),
-            plan: vec![
-                PlanItemArg {
-                    step: "Investigate existing error paths and logging around HTTP timeouts".into(),
-                    status: StepStatus::Completed,
-                },
-                PlanItemArg {
-                    step: "Harden Grafana client error handling with retry/backoff and user‑friendly messages".into(),
-                    status: StepStatus::InProgress,
-                },
-                PlanItemArg {
-                    step: "Add tests for transient failure scenarios and surfacing to the UI".into(),
-                    status: StepStatus::Pending,
-                },
-            ],
-        };
-
-        let cell = new_plan_update(update);
-        // Narrow width to force wrapping for both the note and steps
-        let lines = cell.display_lines(/*width*/ 32);
-        let rendered = render_lines(&lines).join("\n");
-        insta::assert_snapshot!(rendered);
-    }
-
-    #[test]
-    fn plan_update_without_note_snapshot() {
-        let update = UpdatePlanArgs {
-            explanation: None,
-            plan: vec![
-                PlanItemArg {
-                    step: "Define error taxonomy".into(),
-                    status: StepStatus::InProgress,
-                },
-                PlanItemArg {
-                    step: "Implement mapping to user messages".into(),
-                    status: StepStatus::Pending,
-                },
-            ],
-        };
-
-        let cell = new_plan_update(update);
-        let lines = cell.display_lines(/*width*/ 40);
-        let rendered = render_lines(&lines).join("\n");
-        insta::assert_snapshot!(rendered);
-    }
-
-    #[test]
-    fn plan_update_does_not_split_url_like_tokens_in_note_or_step() {
-        let note_url =
-            "example.test/api/v1/projects/alpha-team/releases/2026-02-17/builds/1234567890";
-        let step_url = "example.test/api/v1/projects/beta-team/releases/2026-02-17/builds/0987654321/artifacts/reports/performance";
-        let update = UpdatePlanArgs {
-            explanation: Some(format!(
-                "Investigate failures under {note_url} immediately."
-            )),
-            plan: vec![PlanItemArg {
-                step: format!("Validate callbacks under {step_url} before rollout."),
-                status: StepStatus::InProgress,
-            }],
-        };
-
-        let cell = new_plan_update(update);
-        let rendered = render_lines(&cell.display_lines(/*width*/ 30));
-
-        assert_eq!(
-            rendered
-                .iter()
-                .filter(|line| line.contains(note_url))
-                .count(),
-            1,
-            "expected full note URL-like token in one rendered line, got: {rendered:?}"
-        );
-        assert_eq!(
-            rendered
-                .iter()
-                .filter(|line| line.contains(step_url))
-                .count(),
-            1,
-            "expected full step URL-like token in one rendered line, got: {rendered:?}"
-        );
-    }
-
-    #[test]
-    fn reasoning_summary_block() {
-        let cell = new_reasoning_summary_block(
-            "**High level reasoning**\n\nDetailed reasoning goes here.".to_string(),
-            &test_cwd(),
-        );
-
-        let rendered_display = render_lines(&cell.display_lines(/*width*/ 80));
-        assert_eq!(rendered_display, vec!["• Detailed reasoning goes here."]);
-
-        let rendered_transcript = render_transcript(cell.as_ref());
-        assert_eq!(rendered_transcript, vec!["• Detailed reasoning goes here."]);
-    }
-
-    #[test]
-    fn reasoning_summary_height_matches_wrapped_rendering_for_url_like_content() {
-        let summary = "example.test/api/v1/projects/alpha-team/releases/2026-02-17/builds/1234567890/artifacts/reports/performance/summary/detail/with/a/very/long/path/that/keeps/going";
-        let cell: Box<dyn HistoryCell> = Box::new(ReasoningSummaryCell::new(
-            "High level reasoning".to_string(),
-            summary.to_string(),
-            &test_cwd(),
-            /*transcript_only*/ false,
-        ));
-        let width: u16 = 24;
-
-        let logical_height = cell.display_lines(width).len() as u16;
-        let wrapped_height = cell.desired_height(width);
-        let expected_wrapped_height = Paragraph::new(Text::from(cell.display_lines(width)))
-            .wrap(Wrap { trim: false })
-            .line_count(width) as u16;
-        assert_eq!(wrapped_height, expected_wrapped_height);
-        assert!(
-            wrapped_height >= logical_height,
-            "expected wrapped height to be at least logical line count ({logical_height}), got {wrapped_height}"
-        );
-
-        let wrapped_transcript_height = cell.desired_transcript_height(width);
-        assert_eq!(wrapped_transcript_height, wrapped_height);
-
-        let area = Rect::new(0, 0, width, wrapped_height);
-        let mut buf = ratatui::buffer::Buffer::empty(area);
-        cell.render(area, &mut buf);
-
-        let first_row = (0..area.width)
-            .map(|x| {
-                let symbol = buf[(x, 0)].symbol();
-                if symbol.is_empty() {
-                    ' '
-                } else {
-                    symbol.chars().next().unwrap_or(' ')
-                }
-            })
-            .collect::<String>();
-        assert!(
-            first_row.contains("•"),
-            "expected first rendered row to keep summary bullet visible, got: {first_row:?}"
-        );
-    }
-
-    #[test]
-    fn reasoning_summary_block_returns_reasoning_cell_when_feature_disabled() {
-        let cell =
-            new_reasoning_summary_block("Detailed reasoning goes here.".to_string(), &test_cwd());
-
-        let rendered = render_transcript(cell.as_ref());
-        assert_eq!(rendered, vec!["• Detailed reasoning goes here."]);
-    }
-
-    #[tokio::test]
-    async fn reasoning_summary_block_respects_config_overrides() {
-        let mut config = test_config().await;
-        config.model = Some("gpt-3.5-turbo".to_string());
-        config.model_supports_reasoning_summaries = Some(true);
-        let cell = new_reasoning_summary_block(
-            "**High level reasoning**\n\nDetailed reasoning goes here.".to_string(),
-            &test_cwd(),
-        );
-
-        let rendered_display = render_lines(&cell.display_lines(/*width*/ 80));
-        assert_eq!(rendered_display, vec!["• Detailed reasoning goes here."]);
-    }
-
-    #[test]
-    fn reasoning_summary_block_falls_back_when_header_is_missing() {
-        let cell = new_reasoning_summary_block(
-            "**High level reasoning without closing".to_string(),
-            &test_cwd(),
-        );
-
-        let rendered = render_transcript(cell.as_ref());
-        assert_eq!(rendered, vec!["• **High level reasoning without closing"]);
-    }
-
-    #[test]
-    fn reasoning_summary_block_falls_back_when_summary_is_missing() {
-        let cell = new_reasoning_summary_block(
-            "**High level reasoning without closing**".to_string(),
-            &test_cwd(),
-        );
-
-        let rendered = render_transcript(cell.as_ref());
-        assert_eq!(rendered, vec!["• High level reasoning without closing"]);
-
-        let cell = new_reasoning_summary_block(
-            "**High level reasoning without closing**\n\n  ".to_string(),
-            &test_cwd(),
-        );
-
-        let rendered = render_transcript(cell.as_ref());
-        assert_eq!(rendered, vec!["• High level reasoning without closing"]);
-    }
-
-    #[test]
-    fn reasoning_summary_block_splits_header_and_summary_when_present() {
-        let cell = new_reasoning_summary_block(
-            "**High level plan**\n\nWe should fix the bug next.".to_string(),
-            &test_cwd(),
-        );
-
-        let rendered_display = render_lines(&cell.display_lines(/*width*/ 80));
-        assert_eq!(rendered_display, vec!["• We should fix the bug next."]);
-
-        let rendered_transcript = render_transcript(cell.as_ref());
-        assert_eq!(rendered_transcript, vec!["• We should fix the bug next."]);
-    }
-
-    #[test]
-    fn deprecation_notice_renders_summary_with_details() {
-        let cell = new_deprecation_notice(
-            "Feature flag `foo`".to_string(),
-            Some("Use flag `bar` instead.".to_string()),
-        );
-        let lines = cell.display_lines(/*width*/ 80);
-        let rendered = render_lines(&lines);
-        assert_eq!(
-            rendered,
-            vec![
-                "⚠ Feature flag `foo`".to_string(),
-                "Use flag `bar` instead.".to_string(),
-            ]
-        );
-    }
-
-    #[test]
-    fn agent_markdown_cell_renders_source_at_different_widths() {
-        let source =
-            "A long agent message that should wrap differently when the terminal width changes.\n";
-        let cell = AgentMarkdownCell::new(source.to_string(), &test_cwd());
-
-        let lines_80 = render_lines(&cell.display_lines(/*width*/ 80));
-        assert!(
-            lines_80.first().is_some_and(|line| line.starts_with("• ")),
-            "first line should start with bullet prefix: {:?}",
-            lines_80[0]
-        );
-
-        let lines_32 = render_lines(&cell.display_lines(/*width*/ 32));
-        assert!(
-            lines_32.len() > lines_80.len(),
-            "narrower width should produce more wrapped lines: {lines_32:?}",
-        );
-    }
-
-    #[test]
-    fn agent_markdown_cell_does_not_split_words_after_inline_markdown() {
-        let source = "This paragraph is intentionally long so you can inspect soft wrapping behavior while also checking inline formatting like **bold text**, *italic text*, ***bold italic text***, `inline code`, ~~strikethrough~~, a [link to example.com](https://example.com), and a literal path like [README.md](/Users/felipe.coury/code/codex.fcoury-worktrees/README.md) without introducing manual line breaks.\n";
-        let cell = AgentMarkdownCell::new(source.to_string(), &test_cwd());
-
-        let lines = render_lines(&cell.display_lines(/*width*/ 190));
-        assert!(
-            lines[0].ends_with("inline code,"),
-            "expected wrapping to stop before 'strikethrough': {lines:?}",
-        );
-        assert!(
-            lines[1].starts_with("  strikethrough,"),
-            "expected the next line to resume with the full word: {lines:?}",
-        );
-    }
-
-    #[test]
-    fn agent_markdown_cell_narrow_width_shows_prefix_only() {
-        let source = "narrow width coverage\n";
-        let cell = AgentMarkdownCell::new(source.to_string(), &test_cwd());
-
-        let lines = render_lines(&cell.display_lines(/*width*/ 2));
-        assert_eq!(lines, vec!["• ".to_string()]);
-    }
-
-    #[test]
-    fn wrapped_and_prefixed_cells_handle_tiny_widths() {
-        let user_cell = UserHistoryCell {
-            message: "tiny width coverage for wrapped user history".to_string(),
-            text_elements: Vec::new(),
-            local_image_paths: Vec::new(),
-            remote_image_urls: Vec::new(),
-        };
-        let agent_message_cell = AgentMessageCell::new(
-            vec!["tiny width agent line".into()],
-            /*is_first_line*/ true,
-        );
-        let reasoning_cell = ReasoningSummaryCell::new(
-            "Plan".to_string(),
-            "Reasoning summary content for tiny widths.".to_string(),
-            &test_cwd(),
-            /*transcript_only*/ false,
-        );
-        let agent_markdown_cell =
-            AgentMarkdownCell::new("tiny width agent markdown line\n".to_string(), &test_cwd());
-
-        for width in 1..=4 {
-            assert!(
-                !user_cell.display_lines(width).is_empty(),
-                "user cell should render at width {width}",
-            );
-            assert!(
-                !agent_message_cell.display_lines(width).is_empty(),
-                "agent message cell should render at width {width}",
-            );
-            assert!(
-                !reasoning_cell.display_lines(width).is_empty(),
-                "reasoning cell should render at width {width}",
-            );
-            assert!(
-                !agent_markdown_cell.display_lines(width).is_empty(),
-                "agent markdown cell should render at width {width}",
-            );
-        }
-    }
-
-    #[test]
-    fn render_clears_area_when_cell_content_shrinks() {
-        let area = Rect::new(0, 0, 40, 6);
-        let mut buf = Buffer::empty(area);
-
-        let first: Box<dyn HistoryCell> = Box::new(PlainHistoryCell::new(vec![
-            Line::from("STALE ROW 1"),
-            Line::from("STALE ROW 2"),
-            Line::from("STALE ROW 3"),
-            Line::from("STALE ROW 4"),
-        ]));
-        first.render(area, &mut buf);
-
-        let second: Box<dyn HistoryCell> =
-            Box::new(PlainHistoryCell::new(vec![Line::from("fresh")]));
-        second.render(area, &mut buf);
-
-        let mut rendered_rows: Vec<String> = Vec::new();
-        for y in 0..area.height {
-            let mut row = String::new();
-            for x in 0..area.width {
-                row.push_str(buf.cell((x, y)).expect("cell should exist").symbol());
-            }
-            rendered_rows.push(row);
-        }
-
-        assert!(
-            rendered_rows.iter().all(|row| !row.contains("STALE")),
-            "rendered buffer should not retain stale glyphs: {rendered_rows:?}",
-        );
-        assert!(
-            rendered_rows
-                .first()
-                .is_some_and(|row| row.contains("fresh")),
-            "expected fresh content in first row: {rendered_rows:?}",
-        );
-    }
-
-    #[test]
-    fn agent_markdown_cell_survives_insert_history_rewrap() {
-        let source = "\
-  Canary rollout remained at limited traffic longer than planned because p95
-  latency briefly regressed during cold-cache periods.
-  Regional expansion succeeded with stable error rates, though internal
-  analytics lagged temporarily.
-  ";
-        let cell = AgentMarkdownCell::new(source.to_string(), &test_cwd());
-        let width: u16 = 80;
-        let lines = cell.display_lines(width);
-
-        // Simulate what insert_history_lines does: word_wrap_lines with
-        // the terminal width and no indent.
-        let rewrapped = word_wrap_lines(&lines, width as usize);
-        let before = render_lines(&lines);
-        let after = render_lines(&rewrapped);
-        assert_eq!(
-            before, after,
-            "word_wrap_lines should not alter lines that already fit within width"
-        );
-    }
-
-    /// Simulate the consolidation backward-walk logic from `App::handle_event`
-    /// to verify it correctly identifies and replaces `AgentMessageCell` runs.
-    #[test]
-    fn consolidation_walker_replaces_agent_message_cells() {
-        use std::sync::Arc;
-
-        // Build a transcript with: [UserCell, AgentMsg(head), AgentMsg(cont), AgentMsg(cont)]
-        let user = Arc::new(UserHistoryCell {
-            message: "hello".to_string(),
-            text_elements: Vec::new(),
-            local_image_paths: Vec::new(),
-            remote_image_urls: Vec::new(),
-        }) as Arc<dyn HistoryCell>;
-        let head = Arc::new(AgentMessageCell::new(
-            vec![Line::from("line 1")],
-            /*is_first_line*/ true,
-        )) as Arc<dyn HistoryCell>;
-        let cont1 = Arc::new(AgentMessageCell::new(
-            vec![Line::from("line 2")],
-            /*is_first_line*/ false,
-        )) as Arc<dyn HistoryCell>;
-        let cont2 = Arc::new(AgentMessageCell::new(
-            vec![Line::from("line 3")],
-            /*is_first_line*/ false,
-        )) as Arc<dyn HistoryCell>;
-
-        let mut transcript_cells: Vec<Arc<dyn HistoryCell>> =
-            vec![user.clone(), head, cont1, cont2];
-
-        // Run the same consolidation logic as the handler.
-        let source = "line 1\nline 2\nline 3\n".to_string();
-        let end = transcript_cells.len();
-        let mut start = end;
-        while start > 0
-            && transcript_cells[start - 1].is_stream_continuation()
-            && transcript_cells[start - 1]
-                .as_any()
-                .is::<AgentMessageCell>()
-        {
-            start -= 1;
-        }
-        if start > 0
-            && transcript_cells[start - 1]
-                .as_any()
-                .is::<AgentMessageCell>()
-            && !transcript_cells[start - 1].is_stream_continuation()
-        {
-            start -= 1;
-        }
-
-        assert_eq!(
-            start, 1,
-            "should find all 3 agent cells starting at index 1"
-        );
-        assert_eq!(end, 4);
-
-        // Splice.
-        let consolidated: Arc<dyn HistoryCell> =
-            Arc::new(AgentMarkdownCell::new(source, &test_cwd()));
-        transcript_cells.splice(start..end, std::iter::once(consolidated));
-
-        assert_eq!(transcript_cells.len(), 2, "should be [user, consolidated]");
-
-        // Verify first cell is still the user cell.
-        assert!(
-            transcript_cells[0].as_any().is::<UserHistoryCell>(),
-            "first cell should be UserHistoryCell"
-        );
-
-        // Verify second cell is AgentMarkdownCell.
-        assert!(
-            transcript_cells[1].as_any().is::<AgentMarkdownCell>(),
-            "second cell should be AgentMarkdownCell"
-        );
-    }
-}
diff --git a/codex-rs/tui/src/history_cell/approvals.rs b/codex-rs/tui/src/history_cell/approvals.rs
new file mode 100644
index 0000000000..14c5ad24a8
--- /dev/null
+++ b/codex-rs/tui/src/history_cell/approvals.rs
@@ -0,0 +1,360 @@
+//! Approval, denial, and review-status transcript cells.
+
+use super::*;
+
+fn truncate_exec_snippet(full_cmd: &str) -> String {
+    let mut snippet = match full_cmd.split_once('\n') {
+        Some((first, _)) => format!("{first} ..."),
+        None => full_cmd.to_string(),
+    };
+    snippet = truncate_text(&snippet, /*max_graphemes*/ 80);
+    snippet
+}
+
+fn exec_snippet(command: &[String]) -> String {
+    let full_cmd = strip_bash_lc_and_escape(command);
+    truncate_exec_snippet(&full_cmd)
+}
+
+fn non_empty_exec_snippet(command: &[String]) -> Option<String> {
+    let snippet = exec_snippet(command);
+    (!snippet.is_empty()).then_some(snippet)
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) enum ReviewDecision {
+    Approved,
+    ApprovedExecpolicyAmendment {
+        proposed_execpolicy_amendment: ExecPolicyAmendment,
+    },
+    ApprovedForSession,
+    NetworkPolicyAmendment {
+        network_policy_amendment: NetworkPolicyAmendment,
+    },
+    Denied,
+    TimedOut,
+    Abort,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub(crate) enum ApprovalDecisionSubject {
+    Command(Vec<String>),
+    NetworkAccess { target: String },
+}
+
+pub fn new_approval_decision_cell(
+    subject: ApprovalDecisionSubject,
+    decision: ReviewDecision,
+    actor: ApprovalDecisionActor,
+) -> Box<dyn HistoryCell> {
+    use ReviewDecision::*;
+    use codex_protocol::approvals::NetworkPolicyRuleAction;
+
+    let (symbol, summary): (Span<'static>, Vec<Span<'static>>) = match decision {
+        Approved => match subject {
+            ApprovalDecisionSubject::Command(command) => {
+                let summary = if let Some(snippet) = non_empty_exec_snippet(&command) {
+                    vec![
+                        actor.subject().into(),
+                        "approved".bold(),
+                        " codex to run ".into(),
+                        Span::from(snippet).dim(),
+                        " this time".bold(),
+                    ]
+                } else {
+                    vec![
+                        actor.subject().into(),
+                        "approved".bold(),
+                        " this request".into(),
+                        " this time".bold(),
+                    ]
+                };
+                ("✔ ".green(), summary)
+            }
+            ApprovalDecisionSubject::NetworkAccess { target } => (
+                "✔ ".green(),
+                vec![
+                    actor.subject().into(),
+                    "approved".bold(),
+                    " codex network access to ".into(),
+                    Span::from(target).dim(),
+                    " this time".bold(),
+                ],
+            ),
+        },
+        ApprovedExecpolicyAmendment {
+            proposed_execpolicy_amendment,
+        } => {
+            let snippet = Span::from(exec_snippet(&proposed_execpolicy_amendment.command)).dim();
+            (
+                "✔ ".green(),
+                vec![
+                    actor.subject().into(),
+                    "approved".bold(),
+                    " codex to always run commands that start with ".into(),
+                    snippet,
+                ],
+            )
+        }
+        ApprovedForSession => match subject {
+            ApprovalDecisionSubject::Command(command) => {
+                let summary = if let Some(snippet) = non_empty_exec_snippet(&command) {
+                    vec![
+                        actor.subject().into(),
+                        "approved".bold(),
+                        " codex to run ".into(),
+                        Span::from(snippet).dim(),
+                        " every time this session".bold(),
+                    ]
+                } else {
+                    vec![
+                        actor.subject().into(),
+                        "approved".bold(),
+                        " this request".into(),
+                        " every time this session".bold(),
+                    ]
+                };
+                ("✔ ".green(), summary)
+            }
+            ApprovalDecisionSubject::NetworkAccess { target } => (
+                "✔ ".green(),
+                vec![
+                    actor.subject().into(),
+                    "approved".bold(),
+                    " codex network access to ".into(),
+                    Span::from(target).dim(),
+                    " every time this session".bold(),
+                ],
+            ),
+        },
+        NetworkPolicyAmendment {
+            network_policy_amendment,
+        } => {
+            let target = match subject {
+                ApprovalDecisionSubject::NetworkAccess { target } => target,
+                ApprovalDecisionSubject::Command(_) => network_policy_amendment.host,
+            };
+            match network_policy_amendment.action {
+                NetworkPolicyRuleAction::Allow => (
+                    "✔ ".green(),
+                    vec![
+                        actor.subject().into(),
+                        "persisted".bold(),
+                        " Codex network access to ".into(),
+                        Span::from(target).dim(),
+                    ],
+                ),
+                NetworkPolicyRuleAction::Deny => (
+                    "✗ ".red(),
+                    vec![
+                        actor.subject().into(),
+                        "denied".bold(),
+                        " codex network access to ".into(),
+                        Span::from(target).dim(),
+                        " and saved that rule".into(),
+                    ],
+                ),
+            }
+        }
+        Denied => match subject {
+            ApprovalDecisionSubject::Command(command) => {
+                let summary = if let Some(snippet) = non_empty_exec_snippet(&command) {
+                    let snippet = Span::from(snippet).dim();
+                    match actor {
+                        ApprovalDecisionActor::User => vec![
+                            actor.subject().into(),
+                            "did not approve".bold(),
+                            " codex to run ".into(),
+                            snippet,
+                        ],
+                        ApprovalDecisionActor::Guardian => vec![
+                            "Request ".into(),
+                            "denied".bold(),
+                            " for codex to run ".into(),
+                            snippet,
+                        ],
+                    }
+                } else {
+                    match actor {
+                        ApprovalDecisionActor::User => vec![
+                            actor.subject().into(),
+                            "did not approve".bold(),
+                            " this request".into(),
+                        ],
+                        ApprovalDecisionActor::Guardian => {
+                            vec!["Request ".into(), "denied".bold()]
+                        }
+                    }
+                };
+                ("✗ ".red(), summary)
+            }
+            ApprovalDecisionSubject::NetworkAccess { target } => (
+                "✗ ".red(),
+                vec![
+                    actor.subject().into(),
+                    "did not approve".bold(),
+                    " codex network access to ".into(),
+                    Span::from(target).dim(),
+                ],
+            ),
+        },
+        TimedOut => match subject {
+            ApprovalDecisionSubject::Command(command) => {
+                let summary = if let Some(snippet) = non_empty_exec_snippet(&command) {
+                    vec![
+                        "Review ".into(),
+                        "timed out".bold(),
+                        " before codex could run ".into(),
+                        Span::from(snippet).dim(),
+                    ]
+                } else {
+                    vec![
+                        "Review ".into(),
+                        "timed out".bold(),
+                        " before this request could be approved".into(),
+                    ]
+                };
+                ("✗ ".red(), summary)
+            }
+            ApprovalDecisionSubject::NetworkAccess { target } => (
+                "✗ ".red(),
+                vec![
+                    "Review ".into(),
+                    "timed out".bold(),
+                    " before codex could access ".into(),
+                    Span::from(target).dim(),
+                ],
+            ),
+        },
+        Abort => match subject {
+            ApprovalDecisionSubject::Command(command) => {
+                let summary = if let Some(snippet) = non_empty_exec_snippet(&command) {
+                    vec![
+                        actor.subject().into(),
+                        "canceled".bold(),
+                        " the request to run ".into(),
+                        Span::from(snippet).dim(),
+                    ]
+                } else {
+                    vec![
+                        actor.subject().into(),
+                        "canceled".bold(),
+                        " this request".into(),
+                    ]
+                };
+                ("✗ ".red(), summary)
+            }
+            ApprovalDecisionSubject::NetworkAccess { target } => (
+                "✗ ".red(),
+                vec![
+                    actor.subject().into(),
+                    "canceled".bold(),
+                    " the request for codex network access to ".into(),
+                    Span::from(target).dim(),
+                ],
+            ),
+        },
+    };
+
+    Box::new(PrefixedWrappedHistoryCell::new(
+        Line::from(summary),
+        symbol,
+        "  ",
+    ))
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ApprovalDecisionActor {
+    User,
+    Guardian,
+}
+
+impl ApprovalDecisionActor {
+    fn subject(self) -> &'static str {
+        match self {
+            Self::User => "You ",
+            Self::Guardian => "Auto-reviewer ",
+        }
+    }
+}
+
+pub fn new_guardian_denied_patch_request(files: Vec<String>) -> Box<dyn HistoryCell> {
+    let mut summary = vec![
+        "Request ".into(),
+        "denied".bold(),
+        " for codex to apply ".into(),
+    ];
+    if files.len() == 1 {
+        summary.push("a patch touching ".into());
+        summary.push(Span::from(files[0].clone()).dim());
+    } else {
+        summary.push("a patch touching ".into());
+        summary.push(Span::from(files.len().to_string()).dim());
+        summary.push(" files".into());
+    }
+
+    Box::new(PrefixedWrappedHistoryCell::new(
+        Line::from(summary),
+        "✗ ".red(),
+        "  ",
+    ))
+}
+
+pub fn new_guardian_denied_action_request(summary: String) -> Box<dyn HistoryCell> {
+    let line = Line::from(vec![
+        "Request ".into(),
+        "denied".bold(),
+        " for ".into(),
+        Span::from(summary).dim(),
+    ]);
+    Box::new(PrefixedWrappedHistoryCell::new(line, "✗ ".red(), "  "))
+}
+
+pub fn new_guardian_approved_action_request(summary: String) -> Box<dyn HistoryCell> {
+    let line = Line::from(vec![
+        "Request ".into(),
+        "approved".bold(),
+        " for ".into(),
+        Span::from(summary).dim(),
+    ]);
+    Box::new(PrefixedWrappedHistoryCell::new(line, "✔ ".green(), "  "))
+}
+
+pub fn new_guardian_timed_out_patch_request(files: Vec<String>) -> Box<dyn HistoryCell> {
+    let mut summary = vec![
+        "Review ".into(),
+        "timed out".bold(),
+        " before codex could apply ".into(),
+    ];
+    if files.len() == 1 {
+        summary.push("a patch touching ".into());
+        summary.push(Span::from(files[0].clone()).dim());
+    } else {
+        summary.push("a patch touching ".into());
+        summary.push(Span::from(files.len().to_string()).dim());
+        summary.push(" files".into());
+    }
+
+    Box::new(PrefixedWrappedHistoryCell::new(
+        Line::from(summary),
+        "✗ ".red(),
+        "  ",
+    ))
+}
+
+pub fn new_guardian_timed_out_action_request(summary: String) -> Box<dyn HistoryCell> {
+    let line = Line::from(vec![
+        "Review ".into(),
+        "timed out".bold(),
+        " before ".into(),
+        Span::from(summary).dim(),
+    ]);
+    Box::new(PrefixedWrappedHistoryCell::new(line, "✗ ".red(), "  "))
+}
+
+/// Cyan history cell line showing the current review status.
+pub(crate) fn new_review_status_line(message: String) -> PlainHistoryCell {
+    PlainHistoryCell {
+        lines: vec![Line::from(message.cyan())],
+    }
+}
diff --git a/codex-rs/tui/src/history_cell/base.rs b/codex-rs/tui/src/history_cell/base.rs
new file mode 100644
index 0000000000..e3b33aa9d1
--- /dev/null
+++ b/codex-rs/tui/src/history_cell/base.rs
@@ -0,0 +1,104 @@
+//! Shared history-cell building blocks reused across transcript concerns.
+
+use super::*;
+
+#[derive(Debug)]
+pub(crate) struct PlainHistoryCell {
+    pub(super) lines: Vec<Line<'static>>,
+}
+
+impl PlainHistoryCell {
+    pub(crate) fn new(lines: Vec<Line<'static>>) -> Self {
+        Self { lines }
+    }
+}
+
+impl HistoryCell for PlainHistoryCell {
+    fn display_lines(&self, _width: u16) -> Vec<Line<'static>> {
+        self.lines.clone()
+    }
+
+    fn raw_lines(&self) -> Vec<Line<'static>> {
+        plain_lines(self.lines.clone())
+    }
+}
+#[derive(Debug)]
+pub(crate) struct PrefixedWrappedHistoryCell {
+    text: Text<'static>,
+    initial_prefix: Line<'static>,
+    subsequent_prefix: Line<'static>,
+}
+
+impl PrefixedWrappedHistoryCell {
+    pub(crate) fn new(
+        text: impl Into<Text<'static>>,
+        initial_prefix: impl Into<Line<'static>>,
+        subsequent_prefix: impl Into<Line<'static>>,
+    ) -> Self {
+        Self {
+            text: text.into(),
+            initial_prefix: initial_prefix.into(),
+            subsequent_prefix: subsequent_prefix.into(),
+        }
+    }
+}
+
+impl HistoryCell for PrefixedWrappedHistoryCell {
+    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
+        if width == 0 {
+            return Vec::new();
+        }
+        let opts = RtOptions::new(width.max(1) as usize)
+            .initial_indent(self.initial_prefix.clone())
+            .subsequent_indent(self.subsequent_prefix.clone());
+        adaptive_wrap_lines(&self.text, opts)
+    }
+
+    fn raw_lines(&self) -> Vec<Line<'static>> {
+        plain_lines(self.text.clone().lines)
+    }
+}
+#[derive(Debug)]
+pub(crate) struct CompositeHistoryCell {
+    pub(super) parts: Vec<Box<dyn HistoryCell>>,
+}
+
+impl CompositeHistoryCell {
+    pub(crate) fn new(parts: Vec<Box<dyn HistoryCell>>) -> Self {
+        Self { parts }
+    }
+}
+
+impl HistoryCell for CompositeHistoryCell {
+    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
+        let mut out: Vec<Line<'static>> = Vec::new();
+        let mut first = true;
+        for part in &self.parts {
+            let mut lines = part.display_lines(width);
+            if !lines.is_empty() {
+                if !first {
+                    out.push(Line::from(""));
+                }
+                out.append(&mut lines);
+                first = false;
+            }
+        }
+        out
+    }
+
+    fn raw_lines(&self) -> Vec<Line<'static>> {
+        let mut out: Vec<Line<'static>> = Vec::new();
+        let mut first = true;
+        for part in &self.parts {
+            let mut lines = part.raw_lines();
+            if !lines.is_empty() {
+                if !first {
+                    out.push(Line::from(""));
+                }
+                out.append(&mut lines);
+                first = false;
+            }
+        }
+        out
+    }
+}
diff --git a/codex-rs/tui/src/history_cell/exec.rs b/codex-rs/tui/src/history_cell/exec.rs
new file mode 100644
index 0000000000..b1a3a52508
--- /dev/null
+++ b/codex-rs/tui/src/history_cell/exec.rs
@@ -0,0 +1,242 @@
+//! Background terminal interaction and process-summary history cells.
+
+use super::*;
+
+#[derive(Debug)]
+pub(crate) struct UnifiedExecInteractionCell {
+    command_display: Option<String>,
+    stdin: String,
+}
+
+impl UnifiedExecInteractionCell {
+    pub(crate) fn new(command_display: Option<String>, stdin: String) -> Self {
+        Self {
+            command_display,
+            stdin,
+        }
+    }
+}
+
+impl HistoryCell for UnifiedExecInteractionCell {
+    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
+        if width == 0 {
+            return Vec::new();
+        }
+        let wrap_width = width as usize;
+        let waited_only = self.stdin.is_empty();
+
+        let mut header_spans = if waited_only {
+            vec!["• Waited for background terminal".bold()]
+        } else {
+            vec!["↳ ".dim(), "Interacted with background terminal".bold()]
+        };
+        if let Some(command) = &self.command_display
+            && !command.is_empty()
+        {
+            header_spans.push(" · ".dim());
+            header_spans.push(command.clone().dim());
+        }
+        let header = Line::from(header_spans);
+
+        let mut out: Vec<Line<'static>> = Vec::new();
+        let header_wrapped = adaptive_wrap_line(&header, RtOptions::new(wrap_width));
+        push_owned_lines(&header_wrapped, &mut out);
+
+        if waited_only {
+            return out;
+        }
+
+        let input_lines: Vec<Line<'static>> = self
+            .stdin
+            .lines()
+            .map(|line| Line::from(line.to_string()))
+            .collect();
+
+        let input_wrapped = adaptive_wrap_lines(
+            input_lines,
+            RtOptions::new(wrap_width)
+                .initial_indent(Line::from("  └ ".dim()))
+                .subsequent_indent(Line::from("    ".dim())),
+        );
+        out.extend(input_wrapped);
+        out
+    }
+
+    fn raw_lines(&self) -> Vec<Line<'static>> {
+        let mut out = Vec::new();
+        if self.stdin.is_empty() {
+            if let Some(command) = self
+                .command_display
+                .as_ref()
+                .filter(|command| !command.is_empty())
+            {
+                out.push(Line::from(format!(
+                    "Waited for background terminal: {command}"
+                )));
+            } else {
+                out.push(Line::from("Waited for background terminal"));
+            }
+            return out;
+        }
+
+        if let Some(command) = self
+            .command_display
+            .as_ref()
+            .filter(|command| !command.is_empty())
+        {
+            out.push(Line::from(format!(
+                "Interacted with background terminal: {command}"
+            )));
+        } else {
+            out.push(Line::from("Interacted with background terminal"));
+        }
+        out.extend(raw_lines_from_source(&self.stdin));
+        out
+    }
+}
+
+pub(crate) fn new_unified_exec_interaction(
+    command_display: Option<String>,
+    stdin: String,
+) -> UnifiedExecInteractionCell {
+    UnifiedExecInteractionCell::new(command_display, stdin)
+}
+
+#[derive(Debug)]
+struct UnifiedExecProcessesCell {
+    processes: Vec<UnifiedExecProcessDetails>,
+}
+
+impl UnifiedExecProcessesCell {
+    fn new(processes: Vec<UnifiedExecProcessDetails>) -> Self {
+        Self { processes }
+    }
+}
+
+#[derive(Debug, Clone)]
+pub(crate) struct UnifiedExecProcessDetails {
+    pub(crate) command_display: String,
+    pub(crate) recent_chunks: Vec<String>,
+}
+
+impl HistoryCell for UnifiedExecProcessesCell {
+    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
+        if width == 0 {
+            return Vec::new();
+        }
+
+        let wrap_width = width as usize;
+        let max_processes = 16usize;
+        let mut out: Vec<Line<'static>> = Vec::new();
+        out.push(vec!["Background terminals".bold()].into());
+        out.push("".into());
+
+        if self.processes.is_empty() {
+            out.push("  • No background terminals running.".italic().into());
+            return out;
+        }
+
+        let prefix = "  • ";
+        let prefix_width = UnicodeWidthStr::width(prefix);
+        let truncation_suffix = " [...]";
+        let truncation_suffix_width = UnicodeWidthStr::width(truncation_suffix);
+        let mut shown = 0usize;
+        for process in &self.processes {
+            if shown >= max_processes {
+                break;
+            }
+            let command = &process.command_display;
+            let (snippet, snippet_truncated) = {
+                let (first_line, has_more_lines) = match command.split_once('\n') {
+                    Some((first, _)) => (first, true),
+                    None => (command.as_str(), false),
+                };
+                let max_graphemes = 80;
+                let mut graphemes = first_line.grapheme_indices(true);
+                if let Some((byte_index, _)) = graphemes.nth(max_graphemes) {
+                    (first_line[..byte_index].to_string(), true)
+                } else {
+                    (first_line.to_string(), has_more_lines)
+                }
+            };
+            if wrap_width <= prefix_width {
+                out.push(Line::from(prefix.dim()));
+                shown += 1;
+                continue;
+            }
+            let budget = wrap_width.saturating_sub(prefix_width);
+            let mut needs_suffix = snippet_truncated;
+            if !needs_suffix {
+                let (_, remainder, _) = take_prefix_by_width(&snippet, budget);
+                if !remainder.is_empty() {
+                    needs_suffix = true;
+                }
+            }
+            if needs_suffix && budget > truncation_suffix_width {
+                let available = budget.saturating_sub(truncation_suffix_width);
+                let (truncated, _, _) = take_prefix_by_width(&snippet, available);
+                out.push(vec![prefix.dim(), truncated.cyan(), truncation_suffix.dim()].into());
+            } else {
+                let (truncated, _, _) = take_prefix_by_width(&snippet, budget);
+                out.push(vec![prefix.dim(), truncated.cyan()].into());
+            }
+
+            let chunk_prefix_first = "    ↳ ";
+            let chunk_prefix_next = "      ";
+            for (idx, chunk) in process.recent_chunks.iter().enumerate() {
+                let chunk_prefix = if idx == 0 {
+                    chunk_prefix_first
+                } else {
+                    chunk_prefix_next
+                };
+                let chunk_prefix_width = UnicodeWidthStr::width(chunk_prefix);
+                if wrap_width <= chunk_prefix_width {
+                    out.push(Line::from(chunk_prefix.dim()));
+                    continue;
+                }
+                let budget = wrap_width.saturating_sub(chunk_prefix_width);
+                let (truncated, remainder, _) = take_prefix_by_width(chunk, budget);
+                if !remainder.is_empty() && budget > truncation_suffix_width {
+                    let available = budget.saturating_sub(truncation_suffix_width);
+                    let (shorter, _, _) = take_prefix_by_width(chunk, available);
+                    out.push(
+                        vec![chunk_prefix.dim(), shorter.dim(), truncation_suffix.dim()].into(),
+                    );
+                } else {
+                    out.push(vec![chunk_prefix.dim(), truncated.dim()].into());
+                }
+            }
+            shown += 1;
+        }
+
+        let remaining = self.processes.len().saturating_sub(shown);
+        if remaining > 0 {
+            let more_text = format!("... and {remaining} more running");
+            if wrap_width <= prefix_width {
+                out.push(Line::from(prefix.dim()));
+            } else {
+                let budget = wrap_width.saturating_sub(prefix_width);
+                let (truncated, _, _) = take_prefix_by_width(&more_text, budget);
+                out.push(vec![prefix.dim(), truncated.dim()].into());
+            }
+        }
+
+        out
+    }
+
+    fn raw_lines(&self) -> Vec<Line<'static>> {
+        plain_lines(self.display_lines(u16::MAX))
+    }
+
+    fn desired_height(&self, width: u16) -> u16 {
+        self.display_lines(width).len() as u16
+    }
+}
+
+pub(crate) fn new_unified_exec_processes_output(
+    processes: Vec<UnifiedExecProcessDetails>,
+) -> CompositeHistoryCell {
+    let command = PlainHistoryCell::new(vec!["/ps".magenta().into()]);
+    let summary = UnifiedExecProcessesCell::new(processes);
+    CompositeHistoryCell::new(vec![Box::new(command), Box::new(summary)])
+}
diff --git a/codex-rs/tui/src/history_cell/hook_cell.rs b/codex-rs/tui/src/history_cell/hook_cell.rs
index 0115f9a83d..bb32435e37 100644
--- a/codex-rs/tui/src/history_cell/hook_cell.rs
+++ b/codex-rs/tui/src/history_cell/hook_cell.rs
@@ -773,6 +773,7 @@ fn hook_event_label(event_name: HookEventName) -> &'static str {
         HookEventName::PostCompact => "PostCompact",
         HookEventName::SessionStart => "SessionStart",
         HookEventName::UserPromptSubmit => "UserPromptSubmit",
+        HookEventName::SubagentStart => "SubagentStart",
         HookEventName::Stop => "Stop",
     }
 }
diff --git a/codex-rs/tui/src/history_cell/mcp.rs b/codex-rs/tui/src/history_cell/mcp.rs
new file mode 100644
index 0000000000..435cc6164f
--- /dev/null
+++ b/codex-rs/tui/src/history_cell/mcp.rs
@@ -0,0 +1,780 @@
+//! MCP tool-call, inventory, and output history cells.
+
+use super::*;
+
+#[derive(Debug)]
+struct CompletedMcpToolCallWithImageOutput {
+    _image: DynamicImage,
+}
+impl HistoryCell for CompletedMcpToolCallWithImageOutput {
+    fn display_lines(&self, _width: u16) -> Vec<Line<'static>> {
+        vec!["tool result (image output)".into()]
+    }
+
+    fn raw_lines(&self) -> Vec<Line<'static>> {
+        vec![Line::from("tool result (image output)")]
+    }
+}
+fn mcp_auth_status_label(status: McpAuthStatus) -> &'static str {
+    match status {
+        McpAuthStatus::Unsupported => "Unsupported",
+        McpAuthStatus::NotLoggedIn => "Not logged in",
+        McpAuthStatus::BearerToken => "Bearer token",
+        McpAuthStatus::OAuth => "OAuth",
+    }
+}
+#[derive(Debug)]
+pub(crate) struct McpToolCallCell {
+    call_id: String,
+    invocation: McpInvocation,
+    start_time: Instant,
+    duration: Option<Duration>,
+    result: Option<Result<codex_protocol::mcp::CallToolResult, String>>,
+    animations_enabled: bool,
+}
+
+#[derive(Debug, Clone)]
+pub(crate) struct McpInvocation {
+    pub(crate) server: String,
+    pub(crate) tool: String,
+    pub(crate) arguments: Option<serde_json::Value>,
+}
+
+impl McpToolCallCell {
+    pub(crate) fn new(
+        call_id: String,
+        invocation: McpInvocation,
+        animations_enabled: bool,
+    ) -> Self {
+        Self {
+            call_id,
+            invocation,
+            start_time: Instant::now(),
+            duration: None,
+            result: None,
+            animations_enabled,
+        }
+    }
+
+    pub(crate) fn call_id(&self) -> &str {
+        &self.call_id
+    }
+
+    pub(crate) fn complete(
+        &mut self,
+        duration: Duration,
+        result: Result<codex_protocol::mcp::CallToolResult, String>,
+    ) -> Option<Box<dyn HistoryCell>> {
+        let image_cell = try_new_completed_mcp_tool_call_with_image_output(&result)
+            .map(|cell| Box::new(cell) as Box<dyn HistoryCell>);
+        self.duration = Some(duration);
+        self.result = Some(result);
+        image_cell
+    }
+
+    fn success(&self) -> Option<bool> {
+        match self.result.as_ref() {
+            Some(Ok(result)) => Some(!result.is_error.unwrap_or(false)),
+            Some(Err(_)) => Some(false),
+            None => None,
+        }
+    }
+
+    pub(crate) fn mark_failed(&mut self) {
+        let elapsed = self.start_time.elapsed();
+        self.duration = Some(elapsed);
+        self.result = Some(Err("interrupted".to_string()));
+    }
+
+    fn render_content_block(block: &serde_json::Value, width: usize) -> String {
+        let content = match serde_json::from_value::<rmcp::model::Content>(block.clone()) {
+            Ok(content) => content,
+            Err(_) => {
+                return format_and_truncate_tool_result(
+                    &block.to_string(),
+                    TOOL_CALL_MAX_LINES,
+                    width,
+                );
+            }
+        };
+
+        match content.raw {
+            rmcp::model::RawContent::Text(text) => {
+                format_and_truncate_tool_result(&text.text, TOOL_CALL_MAX_LINES, width)
+            }
+            rmcp::model::RawContent::Image(_) => "<image content>".to_string(),
+            rmcp::model::RawContent::Audio(_) => "<audio content>".to_string(),
+            rmcp::model::RawContent::Resource(resource) => {
+                let uri = match resource.resource {
+                    rmcp::model::ResourceContents::TextResourceContents { uri, .. } => uri,
+                    rmcp::model::ResourceContents::BlobResourceContents { uri, .. } => uri,
+                };
+                format!("embedded resource: {uri}")
+            }
+            rmcp::model::RawContent::ResourceLink(link) => format!("link: {}", link.uri),
+        }
+    }
+}
+
+impl HistoryCell for McpToolCallCell {
+    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
+        let mut lines: Vec<Line<'static>> = Vec::new();
+        let status = self.success();
+        let bullet = match status {
+            Some(true) => "•".green().bold(),
+            Some(false) => "•".red().bold(),
+            None => activity_indicator(
+                Some(self.start_time),
+                MotionMode::from_animations_enabled(self.animations_enabled),
+                ReducedMotionIndicator::StaticBullet,
+            )
+            .unwrap_or_else(|| "•".dim()),
+        };
+        let header_text = if status.is_some() {
+            "Called"
+        } else {
+            "Calling"
+        };
+
+        let invocation_line = line_to_static(&format_mcp_invocation(self.invocation.clone()));
+        let mut compact_spans = vec![bullet.clone(), " ".into(), header_text.bold(), " ".into()];
+        let mut compact_header = Line::from(compact_spans.clone());
+        let reserved = compact_header.width();
+
+        let inline_invocation =
+            invocation_line.width() <= (width as usize).saturating_sub(reserved);
+
+        if inline_invocation {
+            compact_header.extend(invocation_line.spans.clone());
+            lines.push(compact_header);
+        } else {
+            compact_spans.pop(); // drop trailing space for standalone header
+            lines.push(Line::from(compact_spans));
+
+            let opts = RtOptions::new((width as usize).saturating_sub(4))
+                .initial_indent("".into())
+                .subsequent_indent("    ".into());
+            let wrapped = adaptive_wrap_line(&invocation_line, opts);
+            let body_lines: Vec<Line<'static>> = wrapped.iter().map(line_to_static).collect();
+            lines.extend(prefix_lines(body_lines, "  └ ".dim(), "    ".into()));
+        }
+
+        let mut detail_lines: Vec<Line<'static>> = Vec::new();
+        // Reserve four columns for the tree prefix ("  └ "/"    ") and ensure the wrapper still has at least one cell to work with.
+        let detail_wrap_width = (width as usize).saturating_sub(4).max(1);
+
+        if let Some(result) = &self.result {
+            match result {
+                Ok(codex_protocol::mcp::CallToolResult { content, .. }) => {
+                    if !content.is_empty() {
+                        for block in content {
+                            let text = Self::render_content_block(block, detail_wrap_width);
+                            for segment in text.split('\n') {
+                                let line = Line::from(segment.to_string().dim());
+                                let wrapped = adaptive_wrap_line(
+                                    &line,
+                                    RtOptions::new(detail_wrap_width)
+                                        .initial_indent("".into())
+                                        .subsequent_indent("    ".into()),
+                                );
+                                detail_lines.extend(wrapped.iter().map(line_to_static));
+                            }
+                        }
+                    }
+                }
+                Err(err) => {
+                    let err_text = format_and_truncate_tool_result(
+                        &format!("Error: {err}"),
+                        TOOL_CALL_MAX_LINES,
+                        width as usize,
+                    );
+                    let err_line = Line::from(err_text.dim());
+                    let wrapped = adaptive_wrap_line(
+                        &err_line,
+                        RtOptions::new(detail_wrap_width)
+                            .initial_indent("".into())
+                            .subsequent_indent("    ".into()),
+                    );
+                    detail_lines.extend(wrapped.iter().map(line_to_static));
+                }
+            }
+        }
+
+        if !detail_lines.is_empty() {
+            let initial_prefix: Span<'static> = if inline_invocation {
+                "  └ ".dim()
+            } else {
+                "    ".into()
+            };
+            lines.extend(prefix_lines(detail_lines, initial_prefix, "    ".into()));
+        }
+
+        lines
+    }
+
+    fn raw_lines(&self) -> Vec<Line<'static>> {
+        let header_text = if self.success().is_some() {
+            "Called"
+        } else {
+            "Calling"
+        };
+        let mut lines = vec![Line::from(format!(
+            "{header_text} {}",
+            format_mcp_invocation(self.invocation.clone())
+        ))];
+
+        if let Some(result) = &self.result {
+            match result {
+                Ok(codex_protocol::mcp::CallToolResult { content, .. }) => {
+                    for block in content {
+                        let text = Self::render_content_block(block, RAW_TOOL_OUTPUT_WIDTH);
+                        lines.extend(raw_lines_from_source(&text));
+                    }
+                }
+                Err(err) => lines.push(Line::from(format!("Error: {err}"))),
+            }
+        }
+
+        lines
+    }
+
+    fn transcript_animation_tick(&self) -> Option<u64> {
+        if !self.animations_enabled || self.result.is_some() {
+            return None;
+        }
+        Some((self.start_time.elapsed().as_millis() / 50) as u64)
+    }
+}
+
+pub(crate) fn new_active_mcp_tool_call(
+    call_id: String,
+    invocation: McpInvocation,
+    animations_enabled: bool,
+) -> McpToolCallCell {
+    McpToolCallCell::new(call_id, invocation, animations_enabled)
+}
+/// Returns an additional history cell if an MCP tool result includes a decodable image.
+///
+/// This intentionally returns at most one cell: the first image in `CallToolResult.content` that
+/// successfully base64-decodes and parses as an image. This is used as a lightweight “image output
+/// exists” affordance separate from the main MCP tool call cell.
+///
+/// Manual testing tip:
+/// - Run the rmcp stdio test server (`codex-rs/rmcp-client/src/bin/test_stdio_server.rs`) and
+///   register it as an MCP server via `codex mcp add`.
+/// - Use its `image_scenario` tool with cases like `text_then_image`,
+///   `invalid_base64_then_image`, or `invalid_image_bytes_then_image` to ensure this path triggers
+///   even when the first block is not a valid image.
+fn try_new_completed_mcp_tool_call_with_image_output(
+    result: &Result<codex_protocol::mcp::CallToolResult, String>,
+) -> Option<CompletedMcpToolCallWithImageOutput> {
+    let image = result
+        .as_ref()
+        .ok()?
+        .content
+        .iter()
+        .find_map(decode_mcp_image)?;
+
+    Some(CompletedMcpToolCallWithImageOutput { _image: image })
+}
+
+/// Decodes an MCP `ImageContent` block into an in-memory image.
+///
+/// Returns `None` when the block is not an image, when base64 decoding fails, when the format
+/// cannot be inferred, or when the image decoder rejects the bytes.
+fn decode_mcp_image(block: &serde_json::Value) -> Option<DynamicImage> {
+    let content = serde_json::from_value::<rmcp::model::Content>(block.clone()).ok()?;
+    let rmcp::model::RawContent::Image(image) = content.raw else {
+        return None;
+    };
+    let base64_data = if let Some(data_url) = image.data.strip_prefix("data:") {
+        data_url.split_once(',')?.1
+    } else {
+        image.data.as_str()
+    };
+    let raw_data = base64::engine::general_purpose::STANDARD
+        .decode(base64_data)
+        .map_err(|e| {
+            error!("Failed to decode image data: {e}");
+            e
+        })
+        .ok()?;
+    let reader = ImageReader::new(Cursor::new(raw_data))
+        .with_guessed_format()
+        .map_err(|e| {
+            error!("Failed to guess image format: {e}");
+            e
+        })
+        .ok()?;
+
+    reader
+        .decode()
+        .map_err(|e| {
+            error!("Image decoding failed: {e}");
+            e
+        })
+        .ok()
+}
+/// Render a summary of configured MCP servers from the current `Config`.
+pub(crate) fn empty_mcp_output() -> PlainHistoryCell {
+    let lines: Vec<Line<'static>> = vec![
+        "/mcp".magenta().into(),
+        "".into(),
+        vec!["🔌  ".into(), "MCP Tools".bold()].into(),
+        "".into(),
+        "  • No MCP servers configured.".italic().into(),
+        Line::from(vec![
+            "    See the ".into(),
+            "\u{1b}]8;;https://developers.openai.com/codex/mcp\u{7}MCP docs\u{1b}]8;;\u{7}"
+                .underlined(),
+            " to configure them.".into(),
+        ])
+        .style(Style::default().add_modifier(Modifier::DIM)),
+    ];
+
+    PlainHistoryCell { lines }
+}
+
+#[cfg(test)]
+/// Render MCP tools grouped by connection using the fully-qualified tool names.
+pub(crate) fn new_mcp_tools_output(
+    config: &Config,
+    tools: HashMap<String, codex_protocol::mcp::Tool>,
+    resources: HashMap<String, Vec<Resource>>,
+    resource_templates: HashMap<String, Vec<ResourceTemplate>>,
+    auth_statuses: &HashMap<String, McpAuthStatus>,
+) -> PlainHistoryCell {
+    let mut lines: Vec<Line<'static>> = vec![
+        "/mcp".magenta().into(),
+        "".into(),
+        vec!["🔌  ".into(), "MCP Tools".bold()].into(),
+        "".into(),
+    ];
+
+    if tools.is_empty() {
+        lines.push("  • No MCP tools available.".italic().into());
+        lines.push("".into());
+    }
+
+    let effective_servers = config.mcp_servers.get().clone();
+    let mut servers: Vec<_> = effective_servers.iter().collect();
+    servers.sort_by(|(a, _), (b, _)| a.cmp(b));
+
+    for (server, cfg) in servers {
+        let prefix = qualified_mcp_tool_name_prefix(server);
+        let mut names: Vec<String> = tools
+            .keys()
+            .filter(|k| k.starts_with(&prefix))
+            .map(|k| k[prefix.len()..].to_string())
+            .collect();
+        names.sort();
+
+        let auth_status = auth_statuses
+            .get(server.as_str())
+            .copied()
+            .unwrap_or(McpAuthStatus::Unsupported);
+        let mut header: Vec<Span<'static>> = vec!["  • ".into(), server.clone().into()];
+        if !cfg.enabled {
+            header.push(" ".into());
+            header.push("(disabled)".red());
+            lines.push(header.into());
+            if let Some(reason) = cfg.disabled_reason.as_ref().map(ToString::to_string) {
+                lines.push(vec!["    • Reason: ".into(), reason.dim()].into());
+            }
+            lines.push(Line::from(""));
+            continue;
+        }
+        lines.push(header.into());
+        lines.push(vec!["    • Status: ".into(), "enabled".green()].into());
+        lines.push(
+            vec![
+                "    • Auth: ".into(),
+                mcp_auth_status_label(auth_status).into(),
+            ]
+            .into(),
+        );
+
+        match &cfg.transport {
+            McpServerTransportConfig::Stdio {
+                command,
+                args,
+                env,
+                env_vars,
+                cwd,
+            } => {
+                let args_suffix = if args.is_empty() {
+                    String::new()
+                } else {
+                    format!(" {}", args.join(" "))
+                };
+                let cmd_display = format!("{command}{args_suffix}");
+                lines.push(vec!["    • Command: ".into(), cmd_display.into()].into());
+
+                if let Some(cwd) = cwd.as_ref() {
+                    lines.push(vec!["    • Cwd: ".into(), cwd.display().to_string().into()].into());
+                }
+
+                let env_display = format_env_display(env.as_ref(), env_vars);
+                if env_display != "-" {
+                    lines.push(vec!["    • Env: ".into(), env_display.into()].into());
+                }
+            }
+            McpServerTransportConfig::StreamableHttp {
+                url,
+                http_headers,
+                env_http_headers,
+                ..
+            } => {
+                lines.push(vec!["    • URL: ".into(), url.clone().into()].into());
+                if let Some(headers) = http_headers.as_ref()
+                    && !headers.is_empty()
+                {
+                    let mut pairs: Vec<_> = headers.iter().collect();
+                    pairs.sort_by(|(a, _), (b, _)| a.cmp(b));
+                    let display = pairs
+                        .into_iter()
+                        .map(|(name, _)| format!("{name}=*****"))
+                        .collect::<Vec<_>>()
+                        .join(", ");
+                    lines.push(vec!["    • HTTP headers: ".into(), display.into()].into());
+                }
+                if let Some(headers) = env_http_headers.as_ref()
+                    && !headers.is_empty()
+                {
+                    let mut pairs: Vec<_> = headers.iter().collect();
+                    pairs.sort_by(|(a, _), (b, _)| a.cmp(b));
+                    let display = pairs
+                        .into_iter()
+                        .map(|(name, var)| format!("{name}={var}"))
+                        .collect::<Vec<_>>()
+                        .join(", ");
+                    lines.push(vec!["    • Env HTTP headers: ".into(), display.into()].into());
+                }
+            }
+        }
+
+        if names.is_empty() {
+            lines.push("    • Tools: (none)".into());
+        } else {
+            lines.push(vec!["    • Tools: ".into(), names.join(", ").into()].into());
+        }
+
+        let server_resources: Vec<Resource> =
+            resources.get(server.as_str()).cloned().unwrap_or_default();
+        if server_resources.is_empty() {
+            lines.push("    • Resources: (none)".into());
+        } else {
+            let mut spans: Vec<Span<'static>> = vec!["    • Resources: ".into()];
+
+            for (idx, resource) in server_resources.iter().enumerate() {
+                if idx > 0 {
+                    spans.push(", ".into());
+                }
+
+                let label = resource.title.as_ref().unwrap_or(&resource.name);
+                spans.push(label.clone().into());
+                spans.push(" ".into());
+                spans.push(format!("({})", resource.uri).dim());
+            }
+
+            lines.push(spans.into());
+        }
+
+        let server_templates: Vec<ResourceTemplate> = resource_templates
+            .get(server.as_str())
+            .cloned()
+            .unwrap_or_default();
+        if server_templates.is_empty() {
+            lines.push("    • Resource templates: (none)".into());
+        } else {
+            let mut spans: Vec<Span<'static>> = vec!["    • Resource templates: ".into()];
+
+            for (idx, template) in server_templates.iter().enumerate() {
+                if idx > 0 {
+                    spans.push(", ".into());
+                }
+
+                let label = template.title.as_ref().unwrap_or(&template.name);
+                spans.push(label.clone().into());
+                spans.push(" ".into());
+                spans.push(format!("({})", template.uri_template).dim());
+            }
+
+            lines.push(spans.into());
+        }
+
+        lines.push(Line::from(""));
+    }
+
+    PlainHistoryCell { lines }
+}
+
+/// Build the `/mcp` history cell from app-server `McpServerStatus` responses.
+///
+/// The server list comes directly from the app-server status response, sorted
+/// alphabetically. Local config is only used to enrich returned servers with
+/// transport details such as command, URL, cwd, and environment display.
+///
+/// This mirrors the layout of [`new_mcp_tools_output`] but sources data from
+/// the paginated RPC response rather than the in-process `McpManager`. The
+/// `detail` flag controls whether resources and resource templates are rendered.
+pub(crate) fn new_mcp_tools_output_from_statuses(
+    config: &Config,
+    statuses: &[McpServerStatus],
+    detail: McpServerStatusDetail,
+) -> PlainHistoryCell {
+    let mut lines: Vec<Line<'static>> = vec![
+        "/mcp".magenta().into(),
+        "".into(),
+        vec!["🔌  ".into(), "MCP Tools".bold()].into(),
+        "".into(),
+    ];
+
+    let mut statuses_by_name = HashMap::new();
+    for status in statuses {
+        statuses_by_name.insert(status.name.as_str(), status);
+    }
+
+    let mut server_names: Vec<String> = statuses.iter().map(|status| status.name.clone()).collect();
+    server_names.sort();
+
+    let has_any_tools = statuses.iter().any(|status| !status.tools.is_empty());
+    if !has_any_tools {
+        lines.push("  • No MCP tools available.".italic().into());
+        lines.push("".into());
+    }
+
+    for server in server_names {
+        let cfg = config.mcp_servers.get().get(server.as_str());
+        let status = statuses_by_name.get(server.as_str()).copied();
+        let header: Vec<Span<'static>> = vec!["  • ".into(), server.clone().into()];
+
+        lines.push(header.into());
+        if matches!(detail, McpServerStatusDetail::Full) {
+            let enabled = cfg.map(|cfg| cfg.enabled).unwrap_or(true);
+            let status_text = if enabled {
+                "enabled".green()
+            } else {
+                "disabled".red()
+            };
+            lines.push(vec!["    • Status: ".into(), status_text].into());
+            if let Some(reason) = cfg.and_then(|cfg| cfg.disabled_reason.as_ref()) {
+                lines.push(vec!["    • Reason: ".into(), reason.to_string().dim()].into());
+            }
+        }
+        let auth_status = status
+            .map(|status| match status.auth_status {
+                codex_app_server_protocol::McpAuthStatus::Unsupported => McpAuthStatus::Unsupported,
+                codex_app_server_protocol::McpAuthStatus::NotLoggedIn => McpAuthStatus::NotLoggedIn,
+                codex_app_server_protocol::McpAuthStatus::BearerToken => McpAuthStatus::BearerToken,
+                codex_app_server_protocol::McpAuthStatus::OAuth => McpAuthStatus::OAuth,
+            })
+            .unwrap_or(McpAuthStatus::Unsupported);
+        lines.push(
+            vec![
+                "    • Auth: ".into(),
+                mcp_auth_status_label(auth_status).into(),
+            ]
+            .into(),
+        );
+
+        if let Some(cfg) = cfg {
+            match &cfg.transport {
+                McpServerTransportConfig::Stdio {
+                    command,
+                    args,
+                    env,
+                    env_vars,
+                    cwd,
+                } => {
+                    let args_suffix = if args.is_empty() {
+                        String::new()
+                    } else {
+                        format!(" {}", args.join(" "))
+                    };
+                    let cmd_display = format!("{command}{args_suffix}");
+                    lines.push(vec!["    • Command: ".into(), cmd_display.into()].into());
+
+                    if let Some(cwd) = cwd.as_ref() {
+                        lines.push(
+                            vec!["    • Cwd: ".into(), cwd.display().to_string().into()].into(),
+                        );
+                    }
+
+                    let env_display = format_env_display(env.as_ref(), env_vars.as_slice());
+                    if env_display != "-" {
+                        lines.push(vec!["    • Env: ".into(), env_display.into()].into());
+                    }
+                }
+                McpServerTransportConfig::StreamableHttp {
+                    url,
+                    http_headers,
+                    env_http_headers,
+                    ..
+                } => {
+                    lines.push(vec!["    • URL: ".into(), url.clone().into()].into());
+                    if let Some(headers) = http_headers.as_ref()
+                        && !headers.is_empty()
+                    {
+                        let mut pairs: Vec<_> = headers.iter().collect();
+                        pairs.sort_by(|(a, _), (b, _)| a.cmp(b));
+                        let display = pairs
+                            .into_iter()
+                            .map(|(name, _)| format!("{name}=*****"))
+                            .collect::<Vec<_>>()
+                            .join(", ");
+                        lines.push(vec!["    • HTTP headers: ".into(), display.into()].into());
+                    }
+                    if let Some(headers) = env_http_headers.as_ref()
+                        && !headers.is_empty()
+                    {
+                        let mut pairs: Vec<_> = headers.iter().collect();
+                        pairs.sort_by(|(a, _), (b, _)| a.cmp(b));
+                        let display = pairs
+                            .into_iter()
+                            .map(|(name, var)| format!("{name}={var}"))
+                            .collect::<Vec<_>>()
+                            .join(", ");
+                        lines.push(vec!["    • Env HTTP headers: ".into(), display.into()].into());
+                    }
+                }
+            }
+        }
+
+        let mut names = status
+            .map(|status| status.tools.keys().cloned().collect::<Vec<_>>())
+            .unwrap_or_default();
+        names.sort();
+        if names.is_empty() {
+            lines.push("    • Tools: (none)".into());
+        } else {
+            lines.push(vec!["    • Tools: ".into(), names.join(", ").into()].into());
+        }
+
+        if matches!(detail, McpServerStatusDetail::Full) {
+            let server_resources = status
+                .map(|status| status.resources.clone())
+                .unwrap_or_default();
+            if server_resources.is_empty() {
+                lines.push("    • Resources: (none)".into());
+            } else {
+                let mut spans: Vec<Span<'static>> = vec!["    • Resources: ".into()];
+
+                for (idx, resource) in server_resources.iter().enumerate() {
+                    if idx > 0 {
+                        spans.push(", ".into());
+                    }
+
+                    let label = resource.title.as_ref().unwrap_or(&resource.name);
+                    spans.push(label.clone().into());
+                    spans.push(" ".into());
+                    spans.push(format!("({})", resource.uri).dim());
+                }
+
+                lines.push(spans.into());
+            }
+
+            let server_templates = status
+                .map(|status| status.resource_templates.clone())
+                .unwrap_or_default();
+            if server_templates.is_empty() {
+                lines.push("    • Resource templates: (none)".into());
+            } else {
+                let mut spans: Vec<Span<'static>> = vec!["    • Resource templates: ".into()];
+
+                for (idx, template) in server_templates.iter().enumerate() {
+                    if idx > 0 {
+                        spans.push(", ".into());
+                    }
+
+                    let label = template.title.as_ref().unwrap_or(&template.name);
+                    spans.push(label.clone().into());
+                    spans.push(" ".into());
+                    spans.push(format!("({})", template.uri_template).dim());
+                }
+
+                lines.push(spans.into());
+            }
+        }
+
+        lines.push(Line::from(""));
+    }
+
+    PlainHistoryCell { lines }
+}
+/// A transient history cell that shows an animated spinner while the MCP
+/// inventory RPC is in flight.
+///
+/// Inserted as the `active_cell` by `ChatWidget::add_mcp_output()` and removed
+/// once the fetch completes. The app removes committed copies from transcript
+/// history, while `ChatWidget::clear_mcp_inventory_loading()` only clears the
+/// in-flight `active_cell`.
+#[derive(Debug)]
+pub(crate) struct McpInventoryLoadingCell {
+    start_time: Instant,
+    animations_enabled: bool,
+}
+
+impl McpInventoryLoadingCell {
+    pub(crate) fn new(animations_enabled: bool) -> Self {
+        Self {
+            start_time: Instant::now(),
+            animations_enabled,
+        }
+    }
+}
+
+impl HistoryCell for McpInventoryLoadingCell {
+    fn display_lines(&self, _width: u16) -> Vec<Line<'static>> {
+        vec![
+            vec![
+                activity_indicator(
+                    Some(self.start_time),
+                    MotionMode::from_animations_enabled(self.animations_enabled),
+                    ReducedMotionIndicator::StaticBullet,
+                )
+                .unwrap_or_else(|| "•".dim()),
+                " ".into(),
+                "Loading MCP inventory".bold(),
+                "…".dim(),
+            ]
+            .into(),
+        ]
+    }
+
+    fn raw_lines(&self) -> Vec<Line<'static>> {
+        vec![Line::from("Loading MCP inventory...")]
+    }
+
+    fn transcript_animation_tick(&self) -> Option<u64> {
+        if !self.animations_enabled {
+            return None;
+        }
+        Some((self.start_time.elapsed().as_millis() / 50) as u64)
+    }
+}
+
+/// Convenience constructor for [`McpInventoryLoadingCell`].
+pub(crate) fn new_mcp_inventory_loading(animations_enabled: bool) -> McpInventoryLoadingCell {
+    McpInventoryLoadingCell::new(animations_enabled)
+}
+fn format_mcp_invocation<'a>(invocation: McpInvocation) -> Line<'a> {
+    let args_str = invocation
+        .arguments
+        .as_ref()
+        .map(|v: &serde_json::Value| {
+            // Use compact form to keep things short but readable.
+            serde_json::to_string(v).unwrap_or_else(|_| v.to_string())
+        })
+        .unwrap_or_default();
+
+    let invocation_spans = vec![
+        invocation.server.clone().cyan(),
+        ".".into(),
+        invocation.tool.cyan(),
+        "(".into(),
+        args_str.dim(),
+        ")".into(),
+    ];
+    invocation_spans.into()
+}
diff --git a/codex-rs/tui/src/history_cell/messages.rs b/codex-rs/tui/src/history_cell/messages.rs
new file mode 100644
index 0000000000..046d190434
--- /dev/null
+++ b/codex-rs/tui/src/history_cell/messages.rs
@@ -0,0 +1,455 @@
+//! User, assistant, reasoning, and streaming message history cells.
+
+use super::*;
+
+#[derive(Debug)]
+pub(crate) struct UserHistoryCell {
+    pub message: String,
+    pub text_elements: Vec<TextElement>,
+    #[allow(dead_code)]
+    pub local_image_paths: Vec<PathBuf>,
+    pub remote_image_urls: Vec<String>,
+}
+
+/// Build logical lines for a user message with styled text elements.
+///
+/// This preserves explicit newlines while interleaving element spans and skips
+/// malformed byte ranges instead of panicking during history rendering.
+fn build_user_message_lines_with_elements(
+    message: &str,
+    elements: &[TextElement],
+    style: Style,
+    element_style: Style,
+) -> Vec<Line<'static>> {
+    let mut elements = elements.to_vec();
+    elements.sort_by_key(|e| e.byte_range.start);
+    let mut offset = 0usize;
+    let mut raw_lines: Vec<Line<'static>> = Vec::new();
+    for line_text in message.split('\n') {
+        let line_start = offset;
+        let line_end = line_start + line_text.len();
+        let mut spans: Vec<Span<'static>> = Vec::new();
+        // Track how much of the line we've emitted to interleave plain and styled spans.
+        let mut cursor = line_start;
+        for elem in &elements {
+            let start = elem.byte_range.start.max(line_start);
+            let end = elem.byte_range.end.min(line_end);
+            if start >= end {
+                continue;
+            }
+            let rel_start = start - line_start;
+            let rel_end = end - line_start;
+            // Guard against malformed UTF-8 byte ranges from upstream data; skip
+            // invalid elements rather than panicking while rendering history.
+            if !line_text.is_char_boundary(rel_start) || !line_text.is_char_boundary(rel_end) {
+                continue;
+            }
+            let rel_cursor = cursor - line_start;
+            if cursor < start
+                && line_text.is_char_boundary(rel_cursor)
+                && let Some(segment) = line_text.get(rel_cursor..rel_start)
+            {
+                spans.push(Span::from(segment.to_string()));
+            }
+            if let Some(segment) = line_text.get(rel_start..rel_end) {
+                spans.push(Span::styled(segment.to_string(), element_style));
+                cursor = end;
+            }
+        }
+        let rel_cursor = cursor - line_start;
+        if cursor < line_end
+            && line_text.is_char_boundary(rel_cursor)
+            && let Some(segment) = line_text.get(rel_cursor..)
+        {
+            spans.push(Span::from(segment.to_string()));
+        }
+        let line = if spans.is_empty() {
+            Line::from(line_text.to_string()).style(style)
+        } else {
+            Line::from(spans).style(style)
+        };
+        raw_lines.push(line);
+        // Split on '\n' so any '\r' stays in the line; advancing by 1 accounts
+        // for the separator byte.
+        offset = line_end + 1;
+    }
+
+    raw_lines
+}
+
+fn remote_image_display_line(style: Style, index: usize) -> Line<'static> {
+    Line::from(local_image_label_text(index)).style(style)
+}
+
+fn trim_trailing_blank_lines(mut lines: Vec<Line<'static>>) -> Vec<Line<'static>> {
+    while lines
+        .last()
+        .is_some_and(|line| line.spans.iter().all(|span| span.content.trim().is_empty()))
+    {
+        lines.pop();
+    }
+    lines
+}
+
+impl HistoryCell for UserHistoryCell {
+    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
+        let wrap_width = width
+            .saturating_sub(
+                LIVE_PREFIX_COLS + 1, /* keep a one-column right margin for wrapping */
+            )
+            .max(1);
+
+        let style = user_message_style();
+        let element_style = style.fg(Color::Cyan);
+
+        let wrapped_remote_images = if self.remote_image_urls.is_empty() {
+            None
+        } else {
+            Some(adaptive_wrap_lines(
+                self.remote_image_urls
+                    .iter()
+                    .enumerate()
+                    .map(|(idx, _url)| {
+                        remote_image_display_line(element_style, idx.saturating_add(1))
+                    }),
+                RtOptions::new(usize::from(wrap_width))
+                    .wrap_algorithm(textwrap::WrapAlgorithm::FirstFit),
+            ))
+        };
+
+        let wrapped_message = if self.message.is_empty() && self.text_elements.is_empty() {
+            None
+        } else if self.text_elements.is_empty() {
+            let message_without_trailing_newlines = self.message.trim_end_matches(['\r', '\n']);
+            let wrapped = adaptive_wrap_lines(
+                message_without_trailing_newlines
+                    .split('\n')
+                    .map(|line| Line::from(line).style(style)),
+                // Wrap algorithm matches textarea.rs.
+                RtOptions::new(usize::from(wrap_width))
+                    .wrap_algorithm(textwrap::WrapAlgorithm::FirstFit),
+            );
+            let wrapped = trim_trailing_blank_lines(wrapped);
+            (!wrapped.is_empty()).then_some(wrapped)
+        } else {
+            let raw_lines = build_user_message_lines_with_elements(
+                &self.message,
+                &self.text_elements,
+                style,
+                element_style,
+            );
+            let wrapped = adaptive_wrap_lines(
+                raw_lines,
+                RtOptions::new(usize::from(wrap_width))
+                    .wrap_algorithm(textwrap::WrapAlgorithm::FirstFit),
+            );
+            let wrapped = trim_trailing_blank_lines(wrapped);
+            (!wrapped.is_empty()).then_some(wrapped)
+        };
+
+        if wrapped_remote_images.is_none() && wrapped_message.is_none() {
+            return Vec::new();
+        }
+
+        let mut lines: Vec<Line<'static>> = vec![Line::from("").style(style)];
+
+        if let Some(wrapped_remote_images) = wrapped_remote_images {
+            lines.extend(prefix_lines(
+                wrapped_remote_images,
+                "  ".into(),
+                "  ".into(),
+            ));
+            if wrapped_message.is_some() {
+                lines.push(Line::from("").style(style));
+            }
+        }
+
+        if let Some(wrapped_message) = wrapped_message {
+            lines.extend(prefix_lines(
+                wrapped_message,
+                "› ".bold().dim(),
+                "  ".into(),
+            ));
+        }
+
+        lines.push(Line::from("").style(style));
+        lines
+    }
+
+    fn raw_lines(&self) -> Vec<Line<'static>> {
+        let mut lines = raw_lines_from_source(self.message.trim_end_matches(['\r', '\n']));
+        if !self.remote_image_urls.is_empty() {
+            if !lines.is_empty() {
+                lines.push(Line::from(""));
+            }
+            lines.extend(
+                self.remote_image_urls
+                    .iter()
+                    .enumerate()
+                    .map(|(idx, _url)| Line::from(local_image_label_text(idx.saturating_add(1)))),
+            );
+        }
+        lines
+    }
+}
+
+#[derive(Debug)]
+pub(crate) struct ReasoningSummaryCell {
+    _header: String,
+    content: String,
+    /// Session cwd used to render local file links inside the reasoning body.
+    cwd: PathBuf,
+    transcript_only: bool,
+}
+
+impl ReasoningSummaryCell {
+    /// Create a reasoning summary cell that will render local file links relative to the session
+    /// cwd active when the summary was recorded.
+    pub(crate) fn new(header: String, content: String, cwd: &Path, transcript_only: bool) -> Self {
+        Self {
+            _header: header,
+            content,
+            cwd: cwd.to_path_buf(),
+            transcript_only,
+        }
+    }
+
+    fn lines(&self, width: u16) -> Vec<Line<'static>> {
+        let mut lines: Vec<Line<'static>> = Vec::new();
+        append_markdown(
+            &self.content,
+            crate::width::usable_content_width_u16(width, /*reserved_cols*/ 2),
+            Some(self.cwd.as_path()),
+            &mut lines,
+        );
+        let summary_style = Style::default().dim().italic();
+        let summary_lines = lines
+            .into_iter()
+            .map(|mut line| {
+                line.spans = line
+                    .spans
+                    .into_iter()
+                    .map(|span| span.patch_style(summary_style))
+                    .collect();
+                line
+            })
+            .collect::<Vec<_>>();
+
+        adaptive_wrap_lines(
+            &summary_lines,
+            RtOptions::new(width as usize)
+                .initial_indent("• ".dim().into())
+                .subsequent_indent("  ".into()),
+        )
+    }
+}
+
+impl HistoryCell for ReasoningSummaryCell {
+    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
+        if self.transcript_only {
+            Vec::new()
+        } else {
+            self.lines(width)
+        }
+    }
+
+    fn transcript_lines(&self, width: u16) -> Vec<Line<'static>> {
+        self.lines(width)
+    }
+
+    fn raw_lines(&self) -> Vec<Line<'static>> {
+        if self.transcript_only {
+            Vec::new()
+        } else {
+            raw_lines_from_source(self.content.trim())
+        }
+    }
+}
+
+#[derive(Debug)]
+pub(crate) struct AgentMessageCell {
+    lines: Vec<Line<'static>>,
+    is_first_line: bool,
+}
+
+impl AgentMessageCell {
+    pub(crate) fn new(lines: Vec<Line<'static>>, is_first_line: bool) -> Self {
+        Self {
+            lines,
+            is_first_line,
+        }
+    }
+}
+
+impl HistoryCell for AgentMessageCell {
+    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
+        adaptive_wrap_lines(
+            &self.lines,
+            RtOptions::new(width as usize)
+                .initial_indent(if self.is_first_line {
+                    "• ".dim().into()
+                } else {
+                    "  ".into()
+                })
+                .subsequent_indent("  ".into()),
+        )
+    }
+
+    fn raw_lines(&self) -> Vec<Line<'static>> {
+        plain_lines(self.lines.clone())
+    }
+
+    fn is_stream_continuation(&self) -> bool {
+        !self.is_first_line
+    }
+}
+
+/// A consolidated agent message cell that stores raw markdown source and re-renders from it.
+///
+/// After a stream finalizes, the `ConsolidateAgentMessage` handler in `App`
+/// replaces the contiguous run of `AgentMessageCell`s with a single
+/// `AgentMarkdownCell`. On terminal resize, `display_lines(width)` re-renders
+/// from source via `append_markdown_agent`, producing correctly-sized tables
+/// with box-drawing borders.
+///
+/// The cell snapshots `cwd` at construction so local file-link display remains aligned with the
+/// session that produced the message. Reusing the current process cwd during reflow would make old
+/// transcript content change meaning after a later `/cd` or resumed session.
+#[derive(Debug)]
+pub(crate) struct AgentMarkdownCell {
+    markdown_source: String,
+    cwd: PathBuf,
+}
+
+impl AgentMarkdownCell {
+    /// Create a finalized source-backed assistant message cell.
+    ///
+    /// `markdown_source` must be the raw source accumulated by the stream controller, not already
+    /// wrapped terminal lines. Passing rendered lines here would make future resize reflow preserve
+    /// stale wrapping instead of repairing it.
+    pub(crate) fn new(markdown_source: String, cwd: &Path) -> Self {
+        Self {
+            markdown_source,
+            cwd: cwd.to_path_buf(),
+        }
+    }
+}
+
+impl HistoryCell for AgentMarkdownCell {
+    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
+        let Some(wrap_width) =
+            crate::width::usable_content_width_u16(width, /*reserved_cols*/ 2)
+        else {
+            return prefix_lines(vec![Line::default()], "• ".dim(), "  ".into());
+        };
+
+        let mut lines: Vec<Line<'static>> = Vec::new();
+        // Re-render markdown from source at the current width. Reserve 2 columns for the "• " /
+        // " " prefix prepended below.
+        crate::markdown::append_markdown_agent_with_cwd(
+            &self.markdown_source,
+            Some(wrap_width),
+            Some(self.cwd.as_path()),
+            &mut lines,
+        );
+        prefix_lines(lines, "• ".dim(), "  ".into())
+    }
+
+    fn raw_lines(&self) -> Vec<Line<'static>> {
+        raw_lines_from_source(&self.markdown_source)
+    }
+}
+
+/// Transient active-cell representation of the mutable tail of an agent stream.
+///
+/// During streaming, lines that have not yet been committed to scrollback because they belong to
+/// an in-progress table are displayed via this cell in the `active_cell` slot. It is replaced on
+/// every delta and cleared when the stream finalizes.
+#[derive(Debug)]
+pub(crate) struct StreamingAgentTailCell {
+    lines: Vec<Line<'static>>,
+    is_first_line: bool,
+}
+
+impl StreamingAgentTailCell {
+    pub(crate) fn new(lines: Vec<Line<'static>>, is_first_line: bool) -> Self {
+        Self {
+            lines,
+            is_first_line,
+        }
+    }
+}
+
+impl HistoryCell for StreamingAgentTailCell {
+    fn display_lines(&self, _width: u16) -> Vec<Line<'static>> {
+        // Tail lines are already rendered at the controller's current stream width.
+        // Re-wrapping them here can split table borders and produce malformed in-flight rows.
+        prefix_lines(
+            self.lines.clone(),
+            if self.is_first_line {
+                "• ".dim()
+            } else {
+                "  ".into()
+            },
+            "  ".into(),
+        )
+    }
+
+    fn raw_lines(&self) -> Vec<Line<'static>> {
+        plain_lines(self.display_lines(u16::MAX))
+    }
+
+    fn is_stream_continuation(&self) -> bool {
+        !self.is_first_line
+    }
+}
+pub(crate) fn new_user_prompt(
+    message: String,
+    text_elements: Vec<TextElement>,
+    local_image_paths: Vec<PathBuf>,
+    remote_image_urls: Vec<String>,
+) -> UserHistoryCell {
+    UserHistoryCell {
+        message,
+        text_elements,
+        local_image_paths,
+        remote_image_urls,
+    }
+}
+/// Create the reasoning history cell emitted at the end of a reasoning block.
+///
+/// The helper snapshots `cwd` into the returned cell so local file links render the same way they
+/// did while the turn was live, even if rendering happens after other app state has advanced.
+pub(crate) fn new_reasoning_summary_block(
+    full_reasoning_buffer: String,
+    cwd: &Path,
+) -> Box<dyn HistoryCell> {
+    let cwd = cwd.to_path_buf();
+    let full_reasoning_buffer = full_reasoning_buffer.trim();
+    if let Some(open) = full_reasoning_buffer.find("**") {
+        let after_open = &full_reasoning_buffer[(open + 2)..];
+        if let Some(close) = after_open.find("**") {
+            let after_close_idx = open + 2 + close + 2;
+            // if we don't have anything beyond `after_close_idx`
+            // then we don't have a summary to inject into history
+            if after_close_idx < full_reasoning_buffer.len() {
+                let header_buffer = full_reasoning_buffer[..after_close_idx].to_string();
+                let summary_buffer = full_reasoning_buffer[after_close_idx..].to_string();
+                // Preserve the session cwd so local file links render the same way in the
+                // collapsed reasoning block as they did while streaming live content.
+                return Box::new(ReasoningSummaryCell::new(
+                    header_buffer,
+                    summary_buffer,
+                    &cwd,
+                    /*transcript_only*/ false,
+                ));
+            }
+        }
+    }
+    Box::new(ReasoningSummaryCell::new(
+        "".to_string(),
+        full_reasoning_buffer.to_string(),
+        &cwd,
+        /*transcript_only*/ true,
+    ))
+}
diff --git a/codex-rs/tui/src/history_cell/mod.rs b/codex-rs/tui/src/history_cell/mod.rs
new file mode 100644
index 0000000000..c2d1a027c5
--- /dev/null
+++ b/codex-rs/tui/src/history_cell/mod.rs
@@ -0,0 +1,300 @@
+//! Transcript/history cells for the Codex TUI.
+//!
+//! A `HistoryCell` is the unit of display in the conversation UI, representing both committed
+//! transcript entries and, transiently, an in-flight active cell that can mutate in place while
+//! streaming.
+//!
+//! The transcript overlay (`Ctrl+T`) appends a cached live tail derived from the active cell, and
+//! that cached tail is refreshed based on an active-cell cache key. Cells that change based on
+//! elapsed time expose `transcript_animation_tick()`, and code that mutates the active cell in place
+//! bumps the active-cell revision tracked by `ChatWidget`, so the cache key changes whenever the
+//! rendered transcript output can change.
+
+use crate::diff_model::FileChange;
+use crate::diff_render::create_diff_summary;
+use crate::diff_render::display_path_for;
+use crate::exec_cell::CommandOutput;
+use crate::exec_cell::OutputLinesParams;
+use crate::exec_cell::TOOL_CALL_MAX_LINES;
+use crate::exec_cell::output_lines;
+use crate::exec_command::relativize_to_home;
+use crate::exec_command::strip_bash_lc_and_escape;
+use crate::legacy_core::config::Config;
+use crate::live_wrap::take_prefix_by_width;
+use crate::markdown::append_markdown;
+use crate::markdown::append_markdown_agent_with_cwd;
+use crate::motion::MotionMode;
+use crate::motion::ReducedMotionIndicator;
+use crate::motion::activity_indicator;
+use crate::render::line_utils::line_to_static;
+use crate::render::line_utils::prefix_lines;
+use crate::render::line_utils::push_owned_lines;
+use crate::render::renderable::Renderable;
+use crate::session_state::ThreadSessionState;
+use crate::style::proposed_plan_style;
+use crate::style::user_message_style;
+#[cfg(test)]
+use crate::test_support::PathBufExt;
+#[cfg(test)]
+use crate::test_support::test_path_buf;
+use crate::text_formatting::format_and_truncate_tool_result;
+use crate::text_formatting::truncate_text;
+use crate::tooltips;
+use crate::ui_consts::LIVE_PREFIX_COLS;
+use crate::update_action::UpdateAction;
+use crate::version::CODEX_CLI_VERSION;
+use crate::wrapping::RtOptions;
+use crate::wrapping::adaptive_wrap_line;
+use crate::wrapping::adaptive_wrap_lines;
+use base64::Engine;
+use codex_app_server_protocol::AskForApproval;
+use codex_app_server_protocol::McpAuthStatus;
+use codex_app_server_protocol::McpServerStatus;
+use codex_app_server_protocol::McpServerStatusDetail;
+use codex_app_server_protocol::ToolRequestUserInputAnswer;
+use codex_app_server_protocol::ToolRequestUserInputQuestion;
+use codex_app_server_protocol::WebSearchAction;
+use codex_config::types::McpServerTransportConfig;
+#[cfg(test)]
+use codex_mcp::qualified_mcp_tool_name_prefix;
+use codex_otel::RuntimeMetricsSummary;
+use codex_protocol::account::PlanType;
+use codex_protocol::approvals::ExecPolicyAmendment;
+use codex_protocol::approvals::NetworkPolicyAmendment;
+#[cfg(test)]
+use codex_protocol::mcp::Resource;
+#[cfg(test)]
+use codex_protocol::mcp::ResourceTemplate;
+use codex_protocol::models::ManagedFileSystemPermissions;
+use codex_protocol::models::PermissionProfile;
+use codex_protocol::models::local_image_label_text;
+use codex_protocol::openai_models::ReasoningEffort as ReasoningEffortConfig;
+use codex_protocol::permissions::NetworkSandboxPolicy;
+use codex_protocol::plan_tool::PlanItemArg;
+use codex_protocol::plan_tool::StepStatus;
+use codex_protocol::plan_tool::UpdatePlanArgs;
+use codex_protocol::user_input::TextElement;
+use codex_utils_absolute_path::AbsolutePathBuf;
+use codex_utils_cli::format_env_display;
+use image::DynamicImage;
+use image::ImageReader;
+use ratatui::prelude::*;
+use ratatui::style::Color;
+use ratatui::style::Modifier;
+use ratatui::style::Style;
+use ratatui::style::Styled;
+use ratatui::style::Stylize;
+use ratatui::widgets::Clear;
+use ratatui::widgets::Paragraph;
+use ratatui::widgets::Wrap;
+use std::any::Any;
+use std::collections::HashMap;
+use std::io::Cursor;
+use std::path::Path;
+use std::path::PathBuf;
+use std::time::Duration;
+use std::time::Instant;
+use tracing::error;
+use unicode_segmentation::UnicodeSegmentation;
+use unicode_width::UnicodeWidthStr;
+use url::Url;
+
+const RAW_DIFF_SUMMARY_WIDTH: usize = 10_000;
+const RAW_TOOL_OUTPUT_WIDTH: usize = 10_000;
+
+mod approvals;
+mod base;
+mod exec;
+mod hook_cell;
+mod mcp;
+mod messages;
+mod notices;
+mod patches;
+mod plans;
+mod request_user_input;
+mod search;
+mod separators;
+mod session;
+
+pub(crate) use approvals::*;
+pub(crate) use base::*;
+pub(crate) use exec::*;
+pub(crate) use hook_cell::HookCell;
+pub(crate) use hook_cell::hook_run_should_skip_render;
+pub(crate) use hook_cell::new_active_hook_cell;
+pub(crate) use hook_cell::new_completed_hook_cell;
+pub(crate) use mcp::*;
+pub(crate) use messages::*;
+pub(crate) use notices::*;
+pub(crate) use patches::*;
+pub(crate) use plans::*;
+pub(crate) use request_user_input::*;
+pub(crate) use search::*;
+pub(crate) use separators::*;
+pub(crate) use session::*;
+
+#[cfg(test)]
+mod tests;
+
+#[derive(Clone, Copy, Debug, Eq, PartialEq)]
+pub(crate) enum HistoryRenderMode {
+    Rich,
+    Raw,
+}
+
+pub(crate) fn raw_lines_from_source(source: &str) -> Vec<Line<'static>> {
+    if source.is_empty() {
+        return Vec::new();
+    }
+
+    let mut parts = source.split('\n').collect::<Vec<_>>();
+    if source.ends_with('\n') {
+        parts.pop();
+    }
+
+    parts
+        .into_iter()
+        .map(|line| Line::from(line.to_string()))
+        .collect()
+}
+
+pub(crate) fn plain_lines(lines: impl IntoIterator<Item = Line<'static>>) -> Vec<Line<'static>> {
+    lines
+        .into_iter()
+        .map(|line| {
+            let text = line
+                .spans
+                .into_iter()
+                .map(|span| span.content.into_owned())
+                .collect::<String>();
+            Line::from(text)
+        })
+        .collect()
+}
+
+/// A single renderable unit of conversation history.
+///
+/// Each cell produces logical `Line`s and reports how many viewport
+/// rows those lines occupy at a given terminal width. The default
+/// height implementations use `Paragraph::wrap` to account for lines
+/// that overflow the viewport width (e.g. long URLs that are kept
+/// intact by adaptive wrapping). Concrete types only need to override
+/// heights when they apply additional layout logic beyond what
+/// `Paragraph::line_count` captures.
+pub(crate) trait HistoryCell: std::fmt::Debug + Send + Sync + Any {
+    /// Returns the logical lines for the main chat viewport.
+    fn display_lines(&self, width: u16) -> Vec<Line<'static>>;
+
+    /// Returns copy-friendly plain logical lines for raw scrollback mode.
+    fn raw_lines(&self) -> Vec<Line<'static>>;
+
+    fn display_lines_for_mode(&self, width: u16, mode: HistoryRenderMode) -> Vec<Line<'static>> {
+        match mode {
+            HistoryRenderMode::Rich => self.display_lines(width),
+            HistoryRenderMode::Raw => self.raw_lines(),
+        }
+    }
+
+    /// Returns the number of viewport rows needed to render this cell.
+    ///
+    /// The default delegates to `Paragraph::line_count` with
+    /// `Wrap { trim: false }`, which measures the actual row count after
+    /// ratatui's viewport-level character wrapping. This is critical
+    /// for lines containing URL-like tokens that are wider than the
+    /// terminal — the logical line count would undercount.
+    fn desired_height(&self, width: u16) -> u16 {
+        self.desired_height_for_mode(width, HistoryRenderMode::Rich)
+    }
+
+    fn desired_height_for_mode(&self, width: u16, mode: HistoryRenderMode) -> u16 {
+        Paragraph::new(Text::from(self.display_lines_for_mode(width, mode)))
+            .wrap(Wrap { trim: false })
+            .line_count(width)
+            .try_into()
+            .unwrap_or(0)
+    }
+
+    /// Returns lines for the transcript overlay (`Ctrl+T`).
+    ///
+    /// Defaults to `display_lines`. Override when the transcript
+    /// representation differs (e.g. `ExecCell` shows all calls with
+    /// `$`-prefixed commands and exit status).
+    fn transcript_lines(&self, width: u16) -> Vec<Line<'static>> {
+        self.display_lines(width)
+    }
+
+    /// Returns the number of viewport rows for the transcript overlay.
+    ///
+    /// Uses the same `Paragraph::line_count` measurement as
+    /// `desired_height`. Contains a workaround for a ratatui bug where
+    /// a single whitespace-only line reports 2 rows instead of 1.
+    fn desired_transcript_height(&self, width: u16) -> u16 {
+        let lines = self.transcript_lines(width);
+        // Workaround: ratatui's line_count returns 2 for a single
+        // whitespace-only line. Clamp to 1 in that case.
+        if let [line] = &lines[..]
+            && line
+                .spans
+                .iter()
+                .all(|s| s.content.chars().all(char::is_whitespace))
+        {
+            return 1;
+        }
+
+        Paragraph::new(Text::from(lines))
+            .wrap(Wrap { trim: false })
+            .line_count(width)
+            .try_into()
+            .unwrap_or(0)
+    }
+
+    fn is_stream_continuation(&self) -> bool {
+        false
+    }
+
+    /// Returns a coarse "animation tick" when transcript output is time-dependent.
+    ///
+    /// The transcript overlay caches the rendered output of the in-flight active cell, so cells
+    /// that include time-based UI (spinner, shimmer, etc.) should return a tick that changes over
+    /// time to signal that the cached tail should be recomputed. Returning `None` means the
+    /// transcript lines are stable, while returning `Some(tick)` during an in-flight animation
+    /// allows the overlay to keep up with the main viewport.
+    ///
+    /// If a cell uses time-based visuals but always returns `None`, `Ctrl+T` can appear "frozen" on
+    /// the first rendered frame even though the main viewport is animating.
+    fn transcript_animation_tick(&self) -> Option<u64> {
+        None
+    }
+}
+
+impl Renderable for Box<dyn HistoryCell> {
+    fn render(&self, area: Rect, buf: &mut Buffer) {
+        let lines = self.display_lines(area.width);
+        let paragraph = Paragraph::new(Text::from(lines)).wrap(Wrap { trim: false });
+        let y = if area.height == 0 {
+            0
+        } else {
+            let overflow = paragraph
+                .line_count(area.width)
+                .saturating_sub(usize::from(area.height));
+            u16::try_from(overflow).unwrap_or(u16::MAX)
+        };
+        // Active-cell content can reflow dramatically during resize/stream updates. Clear the
+        // entire draw area first so stale glyphs from previous frames never linger.
+        Clear.render(area, buf);
+        paragraph.scroll((y, 0)).render(area, buf);
+    }
+    fn desired_height(&self, width: u16) -> u16 {
+        HistoryCell::desired_height(self.as_ref(), width)
+    }
+}
+
+impl dyn HistoryCell {
+    pub(crate) fn as_any(&self) -> &dyn Any {
+        self
+    }
+
+    pub(crate) fn as_any_mut(&mut self) -> &mut dyn Any {
+        self
+    }
+}
diff --git a/codex-rs/tui/src/history_cell/notices.rs b/codex-rs/tui/src/history_cell/notices.rs
new file mode 100644
index 0000000000..3344dc45cd
--- /dev/null
+++ b/codex-rs/tui/src/history_cell/notices.rs
@@ -0,0 +1,186 @@
+//! Informational, warning, update, and policy notice history cells.
+
+use super::*;
+
+#[cfg_attr(debug_assertions, allow(dead_code))]
+#[derive(Debug)]
+pub(crate) struct UpdateAvailableHistoryCell {
+    latest_version: String,
+    update_action: Option<UpdateAction>,
+}
+
+#[cfg_attr(debug_assertions, allow(dead_code))]
+impl UpdateAvailableHistoryCell {
+    pub(crate) fn new(latest_version: String, update_action: Option<UpdateAction>) -> Self {
+        Self {
+            latest_version,
+            update_action,
+        }
+    }
+}
+
+impl HistoryCell for UpdateAvailableHistoryCell {
+    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
+        use ratatui_macros::line;
+        use ratatui_macros::text;
+        let update_instruction = if let Some(update_action) = self.update_action {
+            line!["Run ", update_action.command_str().cyan(), " to update."]
+        } else {
+            line![
+                "See ",
+                "https://github.com/openai/codex".cyan().underlined(),
+                " for installation options."
+            ]
+        };
+
+        let content = text![
+            line![
+                padded_emoji("✨").bold().cyan(),
+                "Update available!".bold().cyan(),
+                " ",
+                format!("{CODEX_CLI_VERSION} -> {}", self.latest_version).bold(),
+            ],
+            update_instruction,
+            "",
+            "See full release notes:",
+            "https://github.com/openai/codex/releases/latest"
+                .cyan()
+                .underlined(),
+        ];
+
+        let inner_width = content
+            .width()
+            .min(usize::from(width.saturating_sub(4)))
+            .max(1);
+        with_border_with_inner_width(content.lines, inner_width)
+    }
+
+    fn raw_lines(&self) -> Vec<Line<'static>> {
+        let update_instruction = if let Some(update_action) = self.update_action {
+            format!("Run {} to update.", update_action.command_str())
+        } else {
+            "See https://github.com/openai/codex for installation options.".to_string()
+        };
+        vec![
+            Line::from("Update available!"),
+            Line::from(format!("{CODEX_CLI_VERSION} -> {}", self.latest_version)),
+            Line::from(update_instruction),
+            Line::from(""),
+            Line::from("See full release notes:"),
+            Line::from("https://github.com/openai/codex/releases/latest"),
+        ]
+    }
+}
+#[allow(clippy::disallowed_methods)]
+pub(crate) fn new_warning_event(message: String) -> PrefixedWrappedHistoryCell {
+    PrefixedWrappedHistoryCell::new(message.yellow(), "⚠ ".yellow(), "  ")
+}
+
+const TRUSTED_ACCESS_FOR_CYBER_URL: &str = "https://chatgpt.com/cyber";
+
+#[derive(Debug)]
+pub(crate) struct CyberPolicyNoticeCell;
+
+pub(crate) fn new_cyber_policy_error_event() -> CyberPolicyNoticeCell {
+    CyberPolicyNoticeCell
+}
+
+impl HistoryCell for CyberPolicyNoticeCell {
+    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
+        let mut lines: Vec<Line<'static>> = Vec::new();
+        lines.push(
+            vec![
+                "ⓘ ".cyan(),
+                "This chat was flagged for possible cybersecurity risk".bold(),
+            ]
+            .into(),
+        );
+
+        let wrap_width = width.saturating_sub(2).max(1) as usize;
+        let body = Line::from(vec![
+            "  If this seems wrong, try rephrasing your request. To get authorized for security work, join the "
+                .dim(),
+            "Trusted Access for Cyber".cyan().underlined(),
+            " program.".dim(),
+        ]);
+        let wrapped = adaptive_wrap_line(
+            &body,
+            RtOptions::new(wrap_width).subsequent_indent("  ".into()),
+        );
+        push_owned_lines(&wrapped, &mut lines);
+        lines.push(
+            vec![
+                "  ".into(),
+                TRUSTED_ACCESS_FOR_CYBER_URL.cyan().underlined(),
+            ]
+            .into(),
+        );
+
+        lines
+    }
+
+    fn raw_lines(&self) -> Vec<Line<'static>> {
+        vec![
+            Line::from("This chat was flagged for possible cybersecurity risk"),
+            Line::from(
+                "If this seems wrong, try rephrasing your request. To get authorized for security work, join the Trusted Access for Cyber program.",
+            ),
+            Line::from(TRUSTED_ACCESS_FOR_CYBER_URL),
+        ]
+    }
+}
+
+#[derive(Debug)]
+pub(crate) struct DeprecationNoticeCell {
+    summary: String,
+    details: Option<String>,
+}
+
+pub(crate) fn new_deprecation_notice(
+    summary: String,
+    details: Option<String>,
+) -> DeprecationNoticeCell {
+    DeprecationNoticeCell { summary, details }
+}
+
+impl HistoryCell for DeprecationNoticeCell {
+    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
+        let mut lines: Vec<Line<'static>> = Vec::new();
+        lines.push(vec!["⚠ ".red().bold(), self.summary.clone().red()].into());
+
+        let wrap_width = width.saturating_sub(4).max(1) as usize;
+
+        if let Some(details) = &self.details {
+            let detail_line = Line::from(details.clone().dim());
+            let wrapped = adaptive_wrap_line(&detail_line, RtOptions::new(wrap_width));
+            push_owned_lines(&wrapped, &mut lines);
+        }
+
+        lines
+    }
+
+    fn raw_lines(&self) -> Vec<Line<'static>> {
+        let mut lines = vec![Line::from(self.summary.clone())];
+        if let Some(details) = &self.details {
+            lines.extend(raw_lines_from_source(details));
+        }
+        lines
+    }
+}
+pub(crate) fn new_info_event(message: String, hint: Option<String>) -> PlainHistoryCell {
+    let mut line = vec!["• ".dim(), message.into()];
+    if let Some(hint) = hint {
+        line.push(" ".into());
+        line.push(hint.dark_gray());
+    }
+    let lines: Vec<Line<'static>> = vec![line.into()];
+    PlainHistoryCell { lines }
+}
+
+pub(crate) fn new_error_event(message: String) -> PlainHistoryCell {
+    // Use a hair space (U+200A) to create a subtle, near-invisible separation
+    // before the text. VS16 is intentionally omitted to keep spacing tighter
+    // in terminals like Ghostty.
+    let lines: Vec<Line<'static>> = vec![vec![format!("■ {message}").red()].into()];
+    PlainHistoryCell { lines }
+}
diff --git a/codex-rs/tui/src/history_cell/patches.rs b/codex-rs/tui/src/history_cell/patches.rs
new file mode 100644
index 0000000000..00d36fdedc
--- /dev/null
+++ b/codex-rs/tui/src/history_cell/patches.rs
@@ -0,0 +1,93 @@
+//! Patch summaries and image-tool transcript helpers.
+
+use super::*;
+
+#[derive(Debug)]
+pub(crate) struct PatchHistoryCell {
+    changes: HashMap<PathBuf, FileChange>,
+    cwd: PathBuf,
+}
+
+impl HistoryCell for PatchHistoryCell {
+    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
+        create_diff_summary(&self.changes, &self.cwd, width as usize)
+    }
+
+    fn raw_lines(&self) -> Vec<Line<'static>> {
+        plain_lines(create_diff_summary(
+            &self.changes,
+            &self.cwd,
+            RAW_DIFF_SUMMARY_WIDTH,
+        ))
+    }
+}
+/// Create a new `PendingPatch` cell that lists the file‑level summary of
+/// a proposed patch. The summary lines should already be formatted (e.g.
+/// "A path/to/file.rs").
+pub(crate) fn new_patch_event(
+    changes: HashMap<PathBuf, FileChange>,
+    cwd: &Path,
+) -> PatchHistoryCell {
+    PatchHistoryCell {
+        changes,
+        cwd: cwd.to_path_buf(),
+    }
+}
+
+pub(crate) fn new_patch_apply_failure(stderr: String) -> PlainHistoryCell {
+    let mut lines: Vec<Line<'static>> = Vec::new();
+
+    // Failure title
+    lines.push(Line::from("✘ Failed to apply patch".magenta().bold()));
+
+    if !stderr.trim().is_empty() {
+        let output = output_lines(
+            Some(&CommandOutput {
+                exit_code: 1,
+                formatted_output: String::new(),
+                aggregated_output: stderr,
+            }),
+            OutputLinesParams {
+                line_limit: TOOL_CALL_MAX_LINES,
+                only_err: true,
+                include_angle_pipe: true,
+                include_prefix: true,
+            },
+        );
+        lines.extend(output.lines);
+    }
+
+    PlainHistoryCell { lines }
+}
+
+pub(crate) fn new_view_image_tool_call(path: AbsolutePathBuf, cwd: &Path) -> PlainHistoryCell {
+    let display_path = display_path_for(path.as_path(), cwd);
+
+    let lines: Vec<Line<'static>> = vec![
+        vec!["• ".dim(), "Viewed Image".bold()].into(),
+        vec!["  └ ".dim(), display_path.dim()].into(),
+    ];
+
+    PlainHistoryCell { lines }
+}
+
+pub(crate) fn new_image_generation_call(
+    call_id: String,
+    revised_prompt: Option<String>,
+    saved_path: Option<AbsolutePathBuf>,
+) -> PlainHistoryCell {
+    let detail = revised_prompt.unwrap_or_else(|| call_id.clone());
+
+    let mut lines: Vec<Line<'static>> = vec![
+        vec!["• ".dim(), "Generated Image:".bold()].into(),
+        vec!["  └ ".dim(), detail.dim()].into(),
+    ];
+    if let Some(saved_path) = saved_path {
+        let saved_path = Url::from_file_path(saved_path.as_path())
+            .map(|url| url.to_string())
+            .unwrap_or_else(|_| saved_path.display().to_string());
+        lines.push(vec!["  └ ".dim(), "Saved to: ".dim(), saved_path.into()].into());
+    }
+
+    PlainHistoryCell { lines }
+}
diff --git a/codex-rs/tui/src/history_cell/plans.rs b/codex-rs/tui/src/history_cell/plans.rs
new file mode 100644
index 0000000000..6ea56195da
--- /dev/null
+++ b/codex-rs/tui/src/history_cell/plans.rs
@@ -0,0 +1,215 @@
+//! Proposed-plan and plan-update history cells.
+
+use super::*;
+
+/// Transient active-cell representation of the mutable tail of a proposed-plan stream.
+///
+/// The controller prepares the full styled plan lines because plan tails need the same header,
+/// padding, and background treatment as committed `ProposedPlanStreamCell`s while remaining
+/// preview-only during streaming.
+#[derive(Debug)]
+pub(crate) struct StreamingPlanTailCell {
+    lines: Vec<Line<'static>>,
+    is_stream_continuation: bool,
+}
+
+impl StreamingPlanTailCell {
+    pub(crate) fn new(lines: Vec<Line<'static>>, is_stream_continuation: bool) -> Self {
+        Self {
+            lines,
+            is_stream_continuation,
+        }
+    }
+}
+
+impl HistoryCell for StreamingPlanTailCell {
+    fn display_lines(&self, _width: u16) -> Vec<Line<'static>> {
+        self.lines.clone()
+    }
+
+    fn raw_lines(&self) -> Vec<Line<'static>> {
+        plain_lines(self.lines.clone())
+    }
+
+    fn is_stream_continuation(&self) -> bool {
+        self.is_stream_continuation
+    }
+}
+/// Render a user‑friendly plan update styled like a checkbox todo list.
+pub(crate) fn new_plan_update(update: UpdatePlanArgs) -> PlanUpdateCell {
+    let UpdatePlanArgs { explanation, plan } = update;
+    PlanUpdateCell { explanation, plan }
+}
+
+/// Create a proposed-plan cell that snapshots the session cwd for later markdown rendering.
+///
+/// The plan body is stored as raw markdown so terminal resize reflow can render it again at the
+/// current width. Callers should use `new_proposed_plan_stream` only for transient live streaming
+/// cells, then consolidate to this source-backed cell when the plan is complete.
+pub(crate) fn new_proposed_plan(plan_markdown: String, cwd: &Path) -> ProposedPlanCell {
+    ProposedPlanCell {
+        plan_markdown,
+        cwd: cwd.to_path_buf(),
+    }
+}
+
+/// Create a transient proposed-plan stream cell from already rendered lines.
+///
+/// Stream cells are display fragments, not source-backed history. They should be replaced by
+/// `ProposedPlanCell` during consolidation before relying on resize reflow for finalized history.
+pub(crate) fn new_proposed_plan_stream(
+    lines: Vec<Line<'static>>,
+    is_stream_continuation: bool,
+) -> ProposedPlanStreamCell {
+    ProposedPlanStreamCell {
+        lines,
+        is_stream_continuation,
+    }
+}
+
+/// Finalized proposed-plan history that can render itself again for a new width.
+///
+/// This is the source-backed counterpart to `ProposedPlanStreamCell`. It owns raw markdown and the
+/// session cwd needed for stable local-link rendering during later transcript reflow.
+#[derive(Debug)]
+pub(crate) struct ProposedPlanCell {
+    plan_markdown: String,
+    /// Session cwd used to keep local file-link display aligned with live streamed plan rendering.
+    cwd: PathBuf,
+}
+
+/// Transient proposed-plan history emitted while a plan is still streaming.
+///
+/// The lines are already rendered for the stream's current width. A finalized transcript should not
+/// keep these cells after consolidation, because they cannot re-render their source on a later
+/// terminal resize.
+#[derive(Debug)]
+pub(crate) struct ProposedPlanStreamCell {
+    lines: Vec<Line<'static>>,
+    is_stream_continuation: bool,
+}
+
+impl HistoryCell for ProposedPlanCell {
+    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
+        let mut lines: Vec<Line<'static>> = Vec::new();
+        lines.push(vec!["• ".dim(), "Proposed Plan".bold()].into());
+        lines.push(Line::from(" "));
+
+        let mut plan_lines: Vec<Line<'static>> = vec![Line::from(" ")];
+        let plan_style = proposed_plan_style();
+        let wrap_width = width.saturating_sub(4).max(1) as usize;
+        let mut body: Vec<Line<'static>> = Vec::new();
+        append_markdown_agent_with_cwd(
+            &self.plan_markdown,
+            Some(wrap_width),
+            Some(self.cwd.as_path()),
+            &mut body,
+        );
+        if body.is_empty() {
+            body.push(Line::from("(empty)".dim().italic()));
+        }
+        plan_lines.extend(prefix_lines(body, "  ".into(), "  ".into()));
+        plan_lines.push(Line::from(" "));
+
+        lines.extend(plan_lines.into_iter().map(|line| line.style(plan_style)));
+        lines
+    }
+
+    fn raw_lines(&self) -> Vec<Line<'static>> {
+        raw_lines_from_source(&self.plan_markdown)
+    }
+}
+
+impl HistoryCell for ProposedPlanStreamCell {
+    fn display_lines(&self, _width: u16) -> Vec<Line<'static>> {
+        self.lines.clone()
+    }
+
+    fn raw_lines(&self) -> Vec<Line<'static>> {
+        plain_lines(self.lines.clone())
+    }
+
+    fn is_stream_continuation(&self) -> bool {
+        self.is_stream_continuation
+    }
+}
+
+#[derive(Debug)]
+pub(crate) struct PlanUpdateCell {
+    explanation: Option<String>,
+    plan: Vec<PlanItemArg>,
+}
+
+impl HistoryCell for PlanUpdateCell {
+    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
+        let render_note = |text: &str| -> Vec<Line<'static>> {
+            let wrap_width = width.saturating_sub(4).max(1) as usize;
+            let note = Line::from(text.to_string().dim().italic());
+            let wrapped = adaptive_wrap_line(&note, RtOptions::new(wrap_width));
+            let mut out = Vec::new();
+            push_owned_lines(&wrapped, &mut out);
+            out
+        };
+
+        let render_step = |status: &StepStatus, text: &str| -> Vec<Line<'static>> {
+            let (box_str, step_style) = match status {
+                StepStatus::Completed => ("✔ ", Style::default().crossed_out().dim()),
+                StepStatus::InProgress => ("□ ", Style::default().cyan().bold()),
+                StepStatus::Pending => ("□ ", Style::default().dim()),
+            };
+
+            let opts = RtOptions::new(width.saturating_sub(4).max(1) as usize)
+                .initial_indent(box_str.into())
+                .subsequent_indent("  ".into());
+            let step = Line::from(text.to_string().set_style(step_style));
+            let wrapped = adaptive_wrap_line(&step, opts);
+            let mut out = Vec::new();
+            push_owned_lines(&wrapped, &mut out);
+            out
+        };
+
+        let mut lines: Vec<Line<'static>> = vec![];
+        lines.push(vec!["• ".dim(), "Updated Plan".bold()].into());
+
+        let mut indented_lines = vec![];
+        let note = self
+            .explanation
+            .as_ref()
+            .map(|s| s.trim())
+            .filter(|t| !t.is_empty());
+        if let Some(expl) = note {
+            indented_lines.extend(render_note(expl));
+        };
+
+        if self.plan.is_empty() {
+            indented_lines.push(Line::from("(no steps provided)".dim().italic()));
+        } else {
+            for PlanItemArg { step, status } in self.plan.iter() {
+                indented_lines.extend(render_step(status, step));
+            }
+        }
+        lines.extend(prefix_lines(indented_lines, "  └ ".dim(), "    ".into()));
+
+        lines
+    }
+
+    fn raw_lines(&self) -> Vec<Line<'static>> {
+        let mut lines = vec![Line::from("Updated Plan")];
+        if let Some(explanation) = self
+            .explanation
+            .as_ref()
+            .map(|s| s.trim())
+            .filter(|s| !s.is_empty())
+        {
+            lines.extend(raw_lines_from_source(explanation));
+        }
+        if self.plan.is_empty() {
+            lines.push(Line::from("(no steps provided)"));
+        } else {
+            for PlanItemArg { step, status } in &self.plan {
+                lines.push(Line::from(format!("{status:?}: {step}")));
+            }
+        }
+        lines
+    }
+}
diff --git a/codex-rs/tui/src/history_cell/request_user_input.rs b/codex-rs/tui/src/history_cell/request_user_input.rs
new file mode 100644
index 0000000000..1452791594
--- /dev/null
+++ b/codex-rs/tui/src/history_cell/request_user_input.rs
@@ -0,0 +1,187 @@
+//! Completed request-user-input transcript rendering.
+
+use super::*;
+
+/// Renders a completed (or interrupted) request_user_input exchange in history.
+#[derive(Debug)]
+pub(crate) struct RequestUserInputResultCell {
+    pub(crate) questions: Vec<ToolRequestUserInputQuestion>,
+    pub(crate) answers: HashMap<String, ToolRequestUserInputAnswer>,
+    pub(crate) interrupted: bool,
+}
+
+impl HistoryCell for RequestUserInputResultCell {
+    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
+        let width = width.max(1) as usize;
+        let total = self.questions.len();
+        let answered = self
+            .questions
+            .iter()
+            .filter(|question| {
+                self.answers
+                    .get(&question.id)
+                    .is_some_and(|answer| !answer.answers.is_empty())
+            })
+            .count();
+        let unanswered = total.saturating_sub(answered);
+
+        let mut header = vec!["•".dim(), " ".into(), "Questions".bold()];
+        header.push(format!(" {answered}/{total} answered").dim());
+        if self.interrupted {
+            header.push(" (interrupted)".cyan());
+        }
+
+        let mut lines: Vec<Line<'static>> = vec![header.into()];
+
+        for question in &self.questions {
+            let answer = self.answers.get(&question.id);
+            let answer_missing = match answer {
+                Some(answer) => answer.answers.is_empty(),
+                None => true,
+            };
+            let mut question_lines = wrap_with_prefix(
+                &question.question,
+                width,
+                "  • ".into(),
+                "    ".into(),
+                Style::default(),
+            );
+            if answer_missing && let Some(last) = question_lines.last_mut() {
+                last.spans.push(" (unanswered)".dim());
+            }
+            lines.extend(question_lines);
+
+            let Some(answer) = answer.filter(|answer| !answer.answers.is_empty()) else {
+                continue;
+            };
+            if question.is_secret {
+                lines.extend(wrap_with_prefix(
+                    "••••••",
+                    width,
+                    "    answer: ".dim(),
+                    "            ".dim(),
+                    Style::default().fg(Color::Cyan),
+                ));
+                continue;
+            }
+
+            let (options, note) = split_request_user_input_answer(answer);
+
+            for option in options {
+                lines.extend(wrap_with_prefix(
+                    &option,
+                    width,
+                    "    answer: ".dim(),
+                    "            ".dim(),
+                    Style::default().fg(Color::Cyan),
+                ));
+            }
+            if let Some(note) = note {
+                let (label, continuation, style) = if question.options.is_some() {
+                    (
+                        "    note: ".dim(),
+                        "          ".dim(),
+                        Style::default().fg(Color::Cyan),
+                    )
+                } else {
+                    (
+                        "    answer: ".dim(),
+                        "            ".dim(),
+                        Style::default().fg(Color::Cyan),
+                    )
+                };
+                lines.extend(wrap_with_prefix(&note, width, label, continuation, style));
+            }
+        }
+
+        if self.interrupted && unanswered > 0 {
+            let summary = format!("interrupted with {unanswered} unanswered");
+            lines.extend(wrap_with_prefix(
+                &summary,
+                width,
+                "  ↳ ".cyan().dim(),
+                "    ".dim(),
+                Style::default().fg(Color::Cyan).add_modifier(Modifier::DIM),
+            ));
+        }
+
+        lines
+    }
+
+    fn raw_lines(&self) -> Vec<Line<'static>> {
+        let total = self.questions.len();
+        let answered = self
+            .questions
+            .iter()
+            .filter(|question| {
+                self.answers
+                    .get(&question.id)
+                    .is_some_and(|answer| !answer.answers.is_empty())
+            })
+            .count();
+        let mut lines = vec![Line::from(format!("Questions {answered}/{total} answered"))];
+        if self.interrupted {
+            lines.push(Line::from("(interrupted)"));
+        }
+        for question in &self.questions {
+            lines.push(Line::from(question.question.clone()));
+            if let Some(answer) = self
+                .answers
+                .get(&question.id)
+                .filter(|answer| !answer.answers.is_empty())
+            {
+                if question.is_secret {
+                    lines.push(Line::from("answer: ******"));
+                } else {
+                    let (options, note) = split_request_user_input_answer(answer);
+                    lines.extend(
+                        options
+                            .into_iter()
+                            .map(|option| Line::from(format!("answer: {option}"))),
+                    );
+                    if let Some(note) = note {
+                        lines.push(Line::from(format!("note: {note}")));
+                    }
+                }
+            } else {
+                lines.push(Line::from("(unanswered)"));
+            }
+        }
+        lines
+    }
+}
+
+/// Wrap a plain string with textwrap and prefix each line, while applying a style to the content.
+fn wrap_with_prefix(
+    text: &str,
+    width: usize,
+    initial_prefix: Span<'static>,
+    subsequent_prefix: Span<'static>,
+    style: Style,
+) -> Vec<Line<'static>> {
+    let line = Line::from(vec![Span::from(text.to_string()).set_style(style)]);
+    let opts = RtOptions::new(width.max(1))
+        .initial_indent(Line::from(vec![initial_prefix]))
+        .subsequent_indent(Line::from(vec![subsequent_prefix]));
+    let wrapped = adaptive_wrap_line(&line, opts);
+    let mut out = Vec::new();
+    push_owned_lines(&wrapped, &mut out);
+    out
+}
+
+/// Split a request_user_input answer into option labels and an optional freeform note.
+/// Notes are encoded as "user_note: <text>" entries in the answers list.
+fn split_request_user_input_answer(
+    answer: &ToolRequestUserInputAnswer,
+) -> (Vec<String>, Option<String>) {
+    let mut options = Vec::new();
+    let mut note = None;
+    for entry in &answer.answers {
+        if let Some(note_text) = entry.strip_prefix("user_note: ") {
+            note = Some(note_text.to_string());
+        } else {
+            options.push(entry.clone());
+        }
+    }
+    (options, note)
+}
diff --git a/codex-rs/tui/src/history_cell/search.rs b/codex-rs/tui/src/history_cell/search.rs
new file mode 100644
index 0000000000..d75ac50fdc
--- /dev/null
+++ b/codex-rs/tui/src/history_cell/search.rs
@@ -0,0 +1,144 @@
+//! Web-search activity history cells.
+
+use super::*;
+
+fn web_search_header(completed: bool) -> &'static str {
+    if completed {
+        "Searched"
+    } else {
+        "Searching the web"
+    }
+}
+
+fn web_search_action_detail(action: &WebSearchAction) -> String {
+    match action {
+        WebSearchAction::Search { query, queries } => {
+            query.clone().filter(|q| !q.is_empty()).unwrap_or_else(|| {
+                let items = queries.as_ref();
+                let first = items
+                    .and_then(|queries| queries.first())
+                    .cloned()
+                    .unwrap_or_default();
+                if items.is_some_and(|queries| queries.len() > 1) && !first.is_empty() {
+                    format!("{first} ...")
+                } else {
+                    first
+                }
+            })
+        }
+        WebSearchAction::OpenPage { url } => url.clone().unwrap_or_default(),
+        WebSearchAction::FindInPage { url, pattern } => match (pattern, url) {
+            (Some(pattern), Some(url)) => format!("'{pattern}' in {url}"),
+            (Some(pattern), None) => format!("'{pattern}'"),
+            (None, Some(url)) => url.clone(),
+            (None, None) => String::new(),
+        },
+        WebSearchAction::Other => String::new(),
+    }
+}
+
+fn web_search_detail(action: Option<&WebSearchAction>, query: &str) -> String {
+    let detail = action.map(web_search_action_detail).unwrap_or_default();
+    if detail.is_empty() {
+        query.to_string()
+    } else {
+        detail
+    }
+}
+
+#[derive(Debug)]
+pub(crate) struct WebSearchCell {
+    call_id: String,
+    query: String,
+    action: Option<WebSearchAction>,
+    start_time: Instant,
+    completed: bool,
+    animations_enabled: bool,
+}
+
+impl WebSearchCell {
+    pub(crate) fn new(
+        call_id: String,
+        query: String,
+        action: Option<WebSearchAction>,
+        animations_enabled: bool,
+    ) -> Self {
+        Self {
+            call_id,
+            query,
+            action,
+            start_time: Instant::now(),
+            completed: false,
+            animations_enabled,
+        }
+    }
+
+    pub(crate) fn call_id(&self) -> &str {
+        &self.call_id
+    }
+
+    pub(crate) fn update(&mut self, action: WebSearchAction, query: String) {
+        self.action = Some(action);
+        self.query = query;
+    }
+
+    pub(crate) fn complete(&mut self) {
+        self.completed = true;
+    }
+}
+
+impl HistoryCell for WebSearchCell {
+    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
+        let bullet = if self.completed {
+            "•".dim()
+        } else {
+            activity_indicator(
+                Some(self.start_time),
+                MotionMode::from_animations_enabled(self.animations_enabled),
+                ReducedMotionIndicator::StaticBullet,
+            )
+            .unwrap_or_else(|| "•".dim())
+        };
+        let header = web_search_header(self.completed);
+        let detail = web_search_detail(self.action.as_ref(), &self.query);
+        let text: Text<'static> = if detail.is_empty() {
+            Line::from(vec![header.bold()]).into()
+        } else {
+            Line::from(vec![header.bold(), " ".into(), detail.into()]).into()
+        };
+        PrefixedWrappedHistoryCell::new(text, vec![bullet, " ".into()], "  ").display_lines(width)
+    }
+
+    fn raw_lines(&self) -> Vec<Line<'static>> {
+        let header = web_search_header(self.completed);
+        let detail = web_search_detail(self.action.as_ref(), &self.query);
+        if detail.is_empty() {
+            vec![Line::from(header)]
+        } else {
+            vec![Line::from(format!("{header} {detail}"))]
+        }
+    }
+}
+
+pub(crate) fn new_active_web_search_call(
+    call_id: String,
+    query: String,
+    animations_enabled: bool,
+) -> WebSearchCell {
+    WebSearchCell::new(call_id, query, /*action*/ None, animations_enabled)
+}
+
+pub(crate) fn new_web_search_call(
+    call_id: String,
+    query: String,
+    action: WebSearchAction,
+) -> WebSearchCell {
+    let mut cell = WebSearchCell::new(
+        call_id,
+        query,
+        Some(action),
+        /*animations_enabled*/ false,
+    );
+    cell.complete();
+    cell
+}
diff --git a/codex-rs/tui/src/history_cell/separators.rs b/codex-rs/tui/src/history_cell/separators.rs
new file mode 100644
index 0000000000..0a74680638
--- /dev/null
+++ b/codex-rs/tui/src/history_cell/separators.rs
@@ -0,0 +1,171 @@
+//! Turn separators and runtime-metrics labels for transcript history.
+
+use super::*;
+
+#[derive(Debug)]
+/// A visual divider between turns, optionally showing how long the assistant "worked for".
+///
+/// This separator is only emitted for turns that performed concrete work (e.g., running commands,
+/// applying patches, making MCP tool calls), so purely conversational turns do not show an empty
+/// divider.
+pub struct FinalMessageSeparator {
+    elapsed_seconds: Option<u64>,
+    runtime_metrics: Option<RuntimeMetricsSummary>,
+}
+impl FinalMessageSeparator {
+    /// Creates a separator; completed turns should pass protocol turn duration when available.
+    pub(crate) fn new(
+        elapsed_seconds: Option<u64>,
+        runtime_metrics: Option<RuntimeMetricsSummary>,
+    ) -> Self {
+        Self {
+            elapsed_seconds,
+            runtime_metrics,
+        }
+    }
+}
+impl HistoryCell for FinalMessageSeparator {
+    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
+        let mut label_parts = Vec::new();
+        if let Some(elapsed_seconds) = self
+            .elapsed_seconds
+            .filter(|seconds| *seconds > 60)
+            .map(crate::status_indicator_widget::fmt_elapsed_compact)
+        {
+            label_parts.push(format!("Worked for {elapsed_seconds}"));
+        }
+        if let Some(metrics_label) = self.runtime_metrics.and_then(runtime_metrics_label) {
+            label_parts.push(metrics_label);
+        }
+
+        if label_parts.is_empty() {
+            return vec![Line::from_iter(["─".repeat(width as usize).dim()])];
+        }
+
+        let label = format!("─ {} ─", label_parts.join(" • "));
+        let (label, _suffix, label_width) = take_prefix_by_width(&label, width as usize);
+        vec![
+            Line::from_iter([
+                label,
+                "─".repeat((width as usize).saturating_sub(label_width)),
+            ])
+            .dim(),
+        ]
+    }
+
+    fn raw_lines(&self) -> Vec<Line<'static>> {
+        let mut label_parts = Vec::new();
+        if let Some(elapsed_seconds) = self
+            .elapsed_seconds
+            .filter(|seconds| *seconds > 60)
+            .map(crate::status_indicator_widget::fmt_elapsed_compact)
+        {
+            label_parts.push(format!("Worked for {elapsed_seconds}"));
+        }
+        if let Some(metrics_label) = self.runtime_metrics.and_then(runtime_metrics_label) {
+            label_parts.push(metrics_label);
+        }
+        if label_parts.is_empty() {
+            Vec::new()
+        } else {
+            vec![Line::from(label_parts.join(" • "))]
+        }
+    }
+}
+
+pub(crate) fn runtime_metrics_label(summary: RuntimeMetricsSummary) -> Option<String> {
+    let mut parts = Vec::new();
+    if summary.tool_calls.count > 0 {
+        let duration = format_duration_ms(summary.tool_calls.duration_ms);
+        let calls = pluralize(summary.tool_calls.count, "call", "calls");
+        parts.push(format!(
+            "Local tools: {} {calls} ({duration})",
+            summary.tool_calls.count
+        ));
+    }
+    if summary.api_calls.count > 0 {
+        let duration = format_duration_ms(summary.api_calls.duration_ms);
+        let calls = pluralize(summary.api_calls.count, "call", "calls");
+        parts.push(format!(
+            "Inference: {} {calls} ({duration})",
+            summary.api_calls.count
+        ));
+    }
+    if summary.websocket_calls.count > 0 {
+        let duration = format_duration_ms(summary.websocket_calls.duration_ms);
+        parts.push(format!(
+            "WebSocket: {} events send ({duration})",
+            summary.websocket_calls.count
+        ));
+    }
+    if summary.streaming_events.count > 0 {
+        let duration = format_duration_ms(summary.streaming_events.duration_ms);
+        let stream_label = pluralize(summary.streaming_events.count, "Stream", "Streams");
+        let events = pluralize(summary.streaming_events.count, "event", "events");
+        parts.push(format!(
+            "{stream_label}: {} {events} ({duration})",
+            summary.streaming_events.count
+        ));
+    }
+    if summary.websocket_events.count > 0 {
+        let duration = format_duration_ms(summary.websocket_events.duration_ms);
+        parts.push(format!(
+            "{} events received ({duration})",
+            summary.websocket_events.count
+        ));
+    }
+    if summary.responses_api_overhead_ms > 0 {
+        let duration = format_duration_ms(summary.responses_api_overhead_ms);
+        parts.push(format!("Responses API overhead: {duration}"));
+    }
+    if summary.responses_api_inference_time_ms > 0 {
+        let duration = format_duration_ms(summary.responses_api_inference_time_ms);
+        parts.push(format!("Responses API inference: {duration}"));
+    }
+    if summary.responses_api_engine_iapi_ttft_ms > 0
+        || summary.responses_api_engine_service_ttft_ms > 0
+    {
+        let mut ttft_parts = Vec::new();
+        if summary.responses_api_engine_iapi_ttft_ms > 0 {
+            let duration = format_duration_ms(summary.responses_api_engine_iapi_ttft_ms);
+            ttft_parts.push(format!("{duration} (iapi)"));
+        }
+        if summary.responses_api_engine_service_ttft_ms > 0 {
+            let duration = format_duration_ms(summary.responses_api_engine_service_ttft_ms);
+            ttft_parts.push(format!("{duration} (service)"));
+        }
+        parts.push(format!("TTFT: {}", ttft_parts.join(" ")));
+    }
+    if summary.responses_api_engine_iapi_tbt_ms > 0
+        || summary.responses_api_engine_service_tbt_ms > 0
+    {
+        let mut tbt_parts = Vec::new();
+        if summary.responses_api_engine_iapi_tbt_ms > 0 {
+            let duration = format_duration_ms(summary.responses_api_engine_iapi_tbt_ms);
+            tbt_parts.push(format!("{duration} (iapi)"));
+        }
+        if summary.responses_api_engine_service_tbt_ms > 0 {
+            let duration = format_duration_ms(summary.responses_api_engine_service_tbt_ms);
+            tbt_parts.push(format!("{duration} (service)"));
+        }
+        parts.push(format!("TBT: {}", tbt_parts.join(" ")));
+    }
+    if parts.is_empty() {
+        None
+    } else {
+        Some(parts.join(" • "))
+    }
+}
+
+fn format_duration_ms(duration_ms: u64) -> String {
+    if duration_ms >= 1_000 {
+        let seconds = duration_ms as f64 / 1_000.0;
+        format!("{seconds:.1}s")
+    } else {
+        format!("{duration_ms}ms")
+    }
+}
+
+fn pluralize(count: u64, singular: &'static str, plural: &'static str) -> &'static str {
+    if count == 1 { singular } else { plural }
+}
diff --git a/codex-rs/tui/src/history_cell/session.rs b/codex-rs/tui/src/history_cell/session.rs
new file mode 100644
index 0000000000..46bbb35eed
--- /dev/null
+++ b/codex-rs/tui/src/history_cell/session.rs
@@ -0,0 +1,428 @@
+//! Session headers, onboarding guidance, and transcript cards.
+
+use super::*;
+
+pub(crate) const SESSION_HEADER_MAX_INNER_WIDTH: usize = 56; // Just an eyeballed value
+
+pub(crate) fn card_inner_width(width: u16, max_inner_width: usize) -> Option<usize> {
+    if width < 4 {
+        return None;
+    }
+    let inner_width = std::cmp::min(width.saturating_sub(4) as usize, max_inner_width);
+    Some(inner_width)
+}
+
+/// Render `lines` inside a border sized to the widest span in the content.
+pub(crate) fn with_border(lines: Vec<Line<'static>>) -> Vec<Line<'static>> {
+    with_border_internal(lines, /*forced_inner_width*/ None)
+}
+
+/// Render `lines` inside a border whose inner width is at least `inner_width`.
+///
+/// This is useful when callers have already clamped their content to a
+/// specific width and want the border math centralized here instead of
+/// duplicating padding logic in the TUI widgets themselves.
+pub(crate) fn with_border_with_inner_width(
+    lines: Vec<Line<'static>>,
+    inner_width: usize,
+) -> Vec<Line<'static>> {
+    with_border_internal(lines, Some(inner_width))
+}
+
+fn with_border_internal(
+    lines: Vec<Line<'static>>,
+    forced_inner_width: Option<usize>,
+) -> Vec<Line<'static>> {
+    let max_line_width = lines
+        .iter()
+        .map(|line| {
+            line.iter()
+                .map(|span| UnicodeWidthStr::width(span.content.as_ref()))
+                .sum::<usize>()
+        })
+        .max()
+        .unwrap_or(0);
+    let content_width = forced_inner_width
+        .unwrap_or(max_line_width)
+        .max(max_line_width);
+
+    let mut out = Vec::with_capacity(lines.len() + 2);
+    let border_inner_width = content_width + 2;
+    out.push(vec![format!("╭{}╮", "─".repeat(border_inner_width)).dim()].into());
+
+    for line in lines.into_iter() {
+        let used_width: usize = line
+            .iter()
+            .map(|span| UnicodeWidthStr::width(span.content.as_ref()))
+            .sum();
+        let span_count = line.spans.len();
+        let mut spans: Vec<Span<'static>> = Vec::with_capacity(span_count + 4);
+        spans.push(Span::from("│ ").dim());
+        spans.extend(line.into_iter());
+        if used_width < content_width {
+            spans.push(Span::from(" ".repeat(content_width - used_width)).dim());
+        }
+        spans.push(Span::from(" │").dim());
+        out.push(Line::from(spans));
+    }
+
+    out.push(vec![format!("╰{}╯", "─".repeat(border_inner_width)).dim()].into());
+
+    out
+}
+
+/// Return the emoji followed by a hair space (U+200A).
+/// Using only the hair space avoids excessive padding after the emoji while
+/// still providing a small visual gap across terminals.
+pub(crate) fn padded_emoji(emoji: &str) -> String {
+    format!("{emoji}\u{200A}")
+}
+
+#[derive(Debug)]
+struct TooltipHistoryCell {
+    tip: String,
+    cwd: PathBuf,
+}
+
+impl TooltipHistoryCell {
+    fn new(tip: String, cwd: &Path) -> Self {
+        Self {
+            tip,
+            cwd: cwd.to_path_buf(),
+        }
+    }
+}
+
+impl HistoryCell for TooltipHistoryCell {
+    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
+        let indent = "  ";
+        let indent_width = UnicodeWidthStr::width(indent);
+        let wrap_width = usize::from(width.max(1))
+            .saturating_sub(indent_width)
+            .max(1);
+        let mut lines: Vec<Line<'static>> = Vec::new();
+        append_markdown(
+            &format!("**Tip:** {}", self.tip),
+            Some(wrap_width),
+            Some(self.cwd.as_path()),
+            &mut lines,
+        );
+
+        prefix_lines(lines, indent.into(), indent.into())
+    }
+
+    fn raw_lines(&self) -> Vec<Line<'static>> {
+        vec![Line::from(format!("Tip: {}", self.tip))]
+    }
+}
+
+#[derive(Debug)]
+pub struct SessionInfoCell(CompositeHistoryCell);
+
+impl HistoryCell for SessionInfoCell {
+    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
+        self.0.display_lines(width)
+    }
+
+    fn desired_height(&self, width: u16) -> u16 {
+        self.0.desired_height(width)
+    }
+
+    fn transcript_lines(&self, width: u16) -> Vec<Line<'static>> {
+        self.0.transcript_lines(width)
+    }
+
+    fn raw_lines(&self) -> Vec<Line<'static>> {
+        self.0.raw_lines()
+    }
+}
+
+pub(crate) fn new_session_info(
+    config: &Config,
+    requested_model: &str,
+    session: &ThreadSessionState,
+    is_first_event: bool,
+    tooltip_override: Option<String>,
+    auth_plan: Option<PlanType>,
+    show_fast_status: bool,
+) -> SessionInfoCell {
+    // Header box rendered as history (so it appears at the very top)
+    let header = SessionHeaderHistoryCell::new(
+        session.model.clone(),
+        session.reasoning_effort,
+        show_fast_status,
+        config.cwd.to_path_buf(),
+        CODEX_CLI_VERSION,
+    )
+    .with_yolo_mode(has_yolo_permissions(
+        session.approval_policy,
+        &session.permission_profile,
+    ));
+    let mut parts: Vec<Box<dyn HistoryCell>> = vec![Box::new(header)];
+
+    if is_first_event {
+        // Help lines below the header (new copy and list)
+        let help_lines: Vec<Line<'static>> = vec![
+            "  To get started, describe a task or try one of these commands:"
+                .dim()
+                .into(),
+            Line::from(""),
+            Line::from(vec![
+                "  ".into(),
+                "/init".into(),
+                " - create an AGENTS.md file with instructions for Codex".dim(),
+            ]),
+            Line::from(vec![
+                "  ".into(),
+                "/status".into(),
+                " - show current session configuration".dim(),
+            ]),
+            Line::from(vec![
+                "  ".into(),
+                "/permissions".into(),
+                " - choose what Codex is allowed to do".dim(),
+            ]),
+            Line::from(vec![
+                "  ".into(),
+                "/model".into(),
+                " - choose what model and reasoning effort to use".dim(),
+            ]),
+            Line::from(vec![
+                "  ".into(),
+                "/review".into(),
+                " - review any changes and find issues".dim(),
+            ]),
+        ];
+
+        parts.push(Box::new(PlainHistoryCell { lines: help_lines }));
+    } else {
+        if config.show_tooltips
+            && let Some(tooltips) = tooltip_override
+                .or_else(|| tooltips::get_tooltip(auth_plan, show_fast_status))
+                .map(|tip| TooltipHistoryCell::new(tip, &config.cwd))
+        {
+            parts.push(Box::new(tooltips));
+        }
+        if requested_model != session.model.as_str() {
+            let lines = vec![
+                "model changed:".magenta().bold().into(),
+                format!("requested: {requested_model}").into(),
+                format!("used: {}", session.model).into(),
+            ];
+            parts.push(Box::new(PlainHistoryCell { lines }));
+        }
+    }
+
+    SessionInfoCell(CompositeHistoryCell { parts })
+}
+
+pub(crate) fn is_yolo_mode(config: &Config) -> bool {
+    has_yolo_permissions(
+        AskForApproval::from(config.permissions.approval_policy.value()),
+        &config.permissions.effective_permission_profile(),
+    )
+}
+
+pub(crate) fn has_yolo_permissions(
+    approval_policy: AskForApproval,
+    permission_profile: &PermissionProfile,
+) -> bool {
+    approval_policy == AskForApproval::Never
+        && matches!(
+            permission_profile,
+            PermissionProfile::Disabled
+                | PermissionProfile::Managed {
+                    file_system: ManagedFileSystemPermissions::Unrestricted,
+                    network: NetworkSandboxPolicy::Enabled,
+                }
+        )
+}
+#[derive(Debug)]
+pub(crate) struct SessionHeaderHistoryCell {
+    version: &'static str,
+    model: String,
+    model_style: Style,
+    reasoning_effort: Option<ReasoningEffortConfig>,
+    show_fast_status: bool,
+    directory: PathBuf,
+    yolo_mode: bool,
+}
+
+impl SessionHeaderHistoryCell {
+    pub(crate) fn new(
+        model: String,
+        reasoning_effort: Option<ReasoningEffortConfig>,
+        show_fast_status: bool,
+        directory: PathBuf,
+        version: &'static str,
+    ) -> Self {
+        Self::new_with_style(
+            model,
+            Style::default(),
+            reasoning_effort,
+            show_fast_status,
+            directory,
+            version,
+        )
+    }
+
+    pub(crate) fn new_with_style(
+        model: String,
+        model_style: Style,
+        reasoning_effort: Option<ReasoningEffortConfig>,
+        show_fast_status: bool,
+        directory: PathBuf,
+        version: &'static str,
+    ) -> Self {
+        Self {
+            version,
+            model,
+            model_style,
+            reasoning_effort,
+            show_fast_status,
+            directory,
+            yolo_mode: false,
+        }
+    }
+
+    pub(crate) fn with_yolo_mode(mut self, yolo_mode: bool) -> Self {
+        self.yolo_mode = yolo_mode;
+        self
+    }
+
+    fn format_directory(&self, max_width: Option<usize>) -> String {
+        Self::format_directory_inner(&self.directory, max_width)
+    }
+
+    pub(crate) fn format_directory_inner(directory: &Path, max_width: Option<usize>) -> String {
+        let formatted = if let Some(rel) = relativize_to_home(directory) {
+            if rel.as_os_str().is_empty() {
+                "~".to_string()
+            } else {
+                format!("~{}{}", std::path::MAIN_SEPARATOR, rel.display())
+            }
+        } else {
+            directory.display().to_string()
+        };
+
+        if let Some(max_width) = max_width {
+            if max_width == 0 {
+                return String::new();
+            }
+            if UnicodeWidthStr::width(formatted.as_str()) > max_width {
+                return crate::text_formatting::center_truncate_path(&formatted, max_width);
+            }
+        }
+
+        formatted
+    }
+
+    fn reasoning_label(&self) -> Option<&'static str> {
+        self.reasoning_effort.map(|effort| match effort {
+            ReasoningEffortConfig::Minimal => "minimal",
+            ReasoningEffortConfig::Low => "low",
+            ReasoningEffortConfig::Medium => "medium",
+            ReasoningEffortConfig::High => "high",
+            ReasoningEffortConfig::XHigh => "xhigh",
+            ReasoningEffortConfig::None => "none",
+        })
+    }
+}
+
+impl HistoryCell for SessionHeaderHistoryCell {
+    fn display_lines(&self, width: u16) -> Vec<Line<'static>> {
+        let Some(inner_width) = card_inner_width(width, SESSION_HEADER_MAX_INNER_WIDTH) else {
+            return Vec::new();
+        };
+
+        let make_row = |spans: Vec<Span<'static>>| Line::from(spans);
+
+        // Title line rendered inside the box: ">_ OpenAI Codex (vX)"
+        let title_spans: Vec<Span<'static>> = vec![
+            Span::from(">_ ").dim(),
+            Span::from("OpenAI Codex").bold(),
+            Span::from(" ").dim(),
+            Span::from(format!("(v{})", self.version)).dim(),
+        ];
+
+        const CHANGE_MODEL_HINT_COMMAND: &str = "/model";
+        const CHANGE_MODEL_HINT_EXPLANATION: &str = " to change";
+        const DIR_LABEL: &str = "directory:";
+        const PERMISSIONS_LABEL: &str = "permissions:";
+        let label_width = if self.yolo_mode {
+            DIR_LABEL.len().max(PERMISSIONS_LABEL.len())
+        } else {
+            DIR_LABEL.len()
+        };
+
+        let model_label = format!(
+            "{model_label:<label_width$}",
+            model_label = "model:",
+            label_width = label_width
+        );
+        let reasoning_label = self.reasoning_label();
+        let model_spans: Vec<Span<'static>> = {
+            let mut spans = vec![
+                Span::from(format!("{model_label} ")).dim(),
+                Span::styled(self.model.clone(), self.model_style),
+            ];
+            if let Some(reasoning) = reasoning_label {
+                spans.push(Span::from(" "));
+                spans.push(Span::from(reasoning));
+            }
+            if self.show_fast_status {
+                spans.push("   ".into());
+                spans.push(Span::styled("fast", self.model_style.magenta()));
+            }
+            spans.push("   ".dim());
+            spans.push(CHANGE_MODEL_HINT_COMMAND.cyan());
+            spans.push(CHANGE_MODEL_HINT_EXPLANATION.dim());
+            spans
+        };
+
+        let dir_label = format!("{DIR_LABEL:<label_width$}");
+        let dir_prefix = format!("{dir_label} ");
+        let dir_prefix_width = UnicodeWidthStr::width(dir_prefix.as_str());
+        let dir_max_width = inner_width.saturating_sub(dir_prefix_width);
+        let dir = self.format_directory(Some(dir_max_width));
+        let dir_spans = vec![Span::from(dir_prefix).dim(), Span::from(dir)];
+
+        let mut lines = vec![
+            make_row(title_spans),
+            make_row(Vec::new()),
+            make_row(model_spans),
+            make_row(dir_spans),
+        ];
+
+        if self.yolo_mode {
+            let permissions_label = format!("{PERMISSIONS_LABEL:<label_width$}");
+            lines.push(make_row(vec![
+                Span::from(format!("{permissions_label} ")).dim(),
+                "YOLO mode".magenta().bold(),
+            ]));
+        }
+
+        with_border(lines)
+    }
+
+    fn raw_lines(&self) -> Vec<Line<'static>> {
+        let mut lines = vec![
+            Line::from(format!("OpenAI Codex (v{})", self.version)),
+            Line::from(format!(
+                "model: {}{}",
+                self.model,
+                self.reasoning_label()
+                    .map(|reasoning| format!(" {reasoning}"))
+                    .unwrap_or_default()
+            )),
+            Line::from(format!(
+                "directory: {}",
+                self.format_directory(/*max_width*/ None)
+            )),
+        ];
+        if self.yolo_mode {
+            lines.push(Line::from("permissions: YOLO mode"));
+        }
+        lines
+    }
+}
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__active_mcp_tool_call_snapshot.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__active_mcp_tool_call_snapshot.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__active_mcp_tool_call_snapshot.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__active_mcp_tool_call_snapshot.snap
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__coalesced_reads_dedupe_names.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__coalesced_reads_dedupe_names.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__coalesced_reads_dedupe_names.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__coalesced_reads_dedupe_names.snap
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__coalesces_reads_across_multiple_calls.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__coalesces_reads_across_multiple_calls.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__coalesces_reads_across_multiple_calls.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__coalesces_reads_across_multiple_calls.snap
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__coalesces_sequential_reads_within_one_call.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__coalesces_sequential_reads_within_one_call.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__coalesces_sequential_reads_within_one_call.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__coalesces_sequential_reads_within_one_call.snap
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__completed_mcp_tool_call_error_snapshot.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__completed_mcp_tool_call_error_snapshot.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__completed_mcp_tool_call_error_snapshot.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__completed_mcp_tool_call_error_snapshot.snap
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__completed_mcp_tool_call_multiple_outputs_inline_snapshot.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__completed_mcp_tool_call_multiple_outputs_inline_snapshot.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__completed_mcp_tool_call_multiple_outputs_inline_snapshot.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__completed_mcp_tool_call_multiple_outputs_inline_snapshot.snap
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__completed_mcp_tool_call_multiple_outputs_snapshot.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__completed_mcp_tool_call_multiple_outputs_snapshot.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__completed_mcp_tool_call_multiple_outputs_snapshot.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__completed_mcp_tool_call_multiple_outputs_snapshot.snap
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__completed_mcp_tool_call_success_snapshot.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__completed_mcp_tool_call_success_snapshot.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__completed_mcp_tool_call_success_snapshot.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__completed_mcp_tool_call_success_snapshot.snap
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__completed_mcp_tool_call_wrapped_outputs_snapshot.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__completed_mcp_tool_call_wrapped_outputs_snapshot.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__completed_mcp_tool_call_wrapped_outputs_snapshot.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__completed_mcp_tool_call_wrapped_outputs_snapshot.snap
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__cyber_policy_error_event_narrow_snapshot.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__cyber_policy_error_event_narrow_snapshot.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__cyber_policy_error_event_narrow_snapshot.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__cyber_policy_error_event_narrow_snapshot.snap
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__cyber_policy_error_event_snapshot.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__cyber_policy_error_event_snapshot.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__cyber_policy_error_event_snapshot.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__cyber_policy_error_event_snapshot.snap
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__error_event_oversized_input_snapshot.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__error_event_oversized_input_snapshot.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__error_event_oversized_input_snapshot.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__error_event_oversized_input_snapshot.snap
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__mcp_inventory_loading_snapshot.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__mcp_inventory_loading_snapshot.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__mcp_inventory_loading_snapshot.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__mcp_inventory_loading_snapshot.snap
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__mcp_tools_output_from_statuses_renders_status_only_servers.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__mcp_tools_output_from_statuses_renders_status_only_servers.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__mcp_tools_output_from_statuses_renders_status_only_servers.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__mcp_tools_output_from_statuses_renders_status_only_servers.snap
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__mcp_tools_output_from_statuses_renders_verbose_inventory.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__mcp_tools_output_from_statuses_renders_verbose_inventory.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__mcp_tools_output_from_statuses_renders_verbose_inventory.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__mcp_tools_output_from_statuses_renders_verbose_inventory.snap
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__mcp_tools_output_lists_tools_for_hyphenated_server_names.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__mcp_tools_output_lists_tools_for_hyphenated_server_names.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__mcp_tools_output_lists_tools_for_hyphenated_server_names.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__mcp_tools_output_lists_tools_for_hyphenated_server_names.snap
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__mcp_tools_output_masks_sensitive_values.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__mcp_tools_output_masks_sensitive_values.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__mcp_tools_output_masks_sensitive_values.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__mcp_tools_output_masks_sensitive_values.snap
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__multiline_command_both_lines_wrap_with_correct_prefixes.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__multiline_command_both_lines_wrap_with_correct_prefixes.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__multiline_command_both_lines_wrap_with_correct_prefixes.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__multiline_command_both_lines_wrap_with_correct_prefixes.snap
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__multiline_command_without_wrap_uses_branch_then_eight_spaces.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__multiline_command_without_wrap_uses_branch_then_eight_spaces.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__multiline_command_without_wrap_uses_branch_then_eight_spaces.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__multiline_command_without_wrap_uses_branch_then_eight_spaces.snap
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__multiline_command_wraps_with_extra_indent_on_subsequent_lines.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__multiline_command_wraps_with_extra_indent_on_subsequent_lines.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__multiline_command_wraps_with_extra_indent_on_subsequent_lines.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__multiline_command_wraps_with_extra_indent_on_subsequent_lines.snap
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__plan_update_with_note_and_wrapping_snapshot.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__plan_update_with_note_and_wrapping_snapshot.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__plan_update_with_note_and_wrapping_snapshot.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__plan_update_with_note_and_wrapping_snapshot.snap
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__plan_update_without_note_snapshot.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__plan_update_without_note_snapshot.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__plan_update_without_note_snapshot.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__plan_update_without_note_snapshot.snap
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__ps_output_chunk_leading_whitespace_snapshot.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__ps_output_chunk_leading_whitespace_snapshot.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__ps_output_chunk_leading_whitespace_snapshot.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__ps_output_chunk_leading_whitespace_snapshot.snap
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__ps_output_empty_snapshot.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__ps_output_empty_snapshot.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__ps_output_empty_snapshot.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__ps_output_empty_snapshot.snap
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__ps_output_long_command_snapshot.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__ps_output_long_command_snapshot.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__ps_output_long_command_snapshot.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__ps_output_long_command_snapshot.snap
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__ps_output_many_sessions_snapshot.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__ps_output_many_sessions_snapshot.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__ps_output_many_sessions_snapshot.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__ps_output_many_sessions_snapshot.snap
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__ps_output_multiline_snapshot.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__ps_output_multiline_snapshot.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__ps_output_multiline_snapshot.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__ps_output_multiline_snapshot.snap
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__ran_cell_multiline_with_stderr_snapshot.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__ran_cell_multiline_with_stderr_snapshot.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__ran_cell_multiline_with_stderr_snapshot.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__ran_cell_multiline_with_stderr_snapshot.snap
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__raw_mode_toggle_transcript.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__raw_mode_toggle_transcript.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__raw_mode_toggle_transcript.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__raw_mode_toggle_transcript.snap
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__session_header_indicates_yolo_mode.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__session_header_indicates_yolo_mode.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__session_header_indicates_yolo_mode.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__session_header_indicates_yolo_mode.snap
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__session_info_availability_nux_tooltip_snapshot.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__session_info_availability_nux_tooltip_snapshot.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__session_info_availability_nux_tooltip_snapshot.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__session_info_availability_nux_tooltip_snapshot.snap
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__single_line_command_compact_when_fits.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__single_line_command_compact_when_fits.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__single_line_command_compact_when_fits.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__single_line_command_compact_when_fits.snap
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__single_line_command_wraps_with_four_space_continuation.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__single_line_command_wraps_with_four_space_continuation.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__single_line_command_wraps_with_four_space_continuation.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__single_line_command_wraps_with_four_space_continuation.snap
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__stderr_tail_more_than_five_lines_snapshot.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__stderr_tail_more_than_five_lines_snapshot.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__stderr_tail_more_than_five_lines_snapshot.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__stderr_tail_more_than_five_lines_snapshot.snap
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__user_history_cell_numbers_multiple_remote_images.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__user_history_cell_numbers_multiple_remote_images.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__user_history_cell_numbers_multiple_remote_images.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__user_history_cell_numbers_multiple_remote_images.snap
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__user_history_cell_renders_remote_image_urls.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__user_history_cell_renders_remote_image_urls.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__user_history_cell_renders_remote_image_urls.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__user_history_cell_renders_remote_image_urls.snap
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__user_history_cell_wraps_and_prefixes_each_line_snapshot.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__user_history_cell_wraps_and_prefixes_each_line_snapshot.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__user_history_cell_wraps_and_prefixes_each_line_snapshot.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__user_history_cell_wraps_and_prefixes_each_line_snapshot.snap
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__web_search_history_cell_snapshot.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__web_search_history_cell_snapshot.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__web_search_history_cell_snapshot.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__web_search_history_cell_snapshot.snap
diff --git a/codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__web_search_history_cell_transcript_snapshot.snap b/codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__web_search_history_cell_transcript_snapshot.snap
similarity index 100%
rename from codex-rs/tui/src/snapshots/codex_tui__history_cell__tests__web_search_history_cell_transcript_snapshot.snap
rename to codex-rs/tui/src/history_cell/snapshots/codex_tui__history_cell__tests__web_search_history_cell_transcript_snapshot.snap
diff --git a/codex-rs/tui/src/history_cell/tests.rs b/codex-rs/tui/src/history_cell/tests.rs
new file mode 100644
index 0000000000..b0b87cdd00
--- /dev/null
+++ b/codex-rs/tui/src/history_cell/tests.rs
@@ -0,0 +1,2501 @@
+//! Coverage for history-cell rendering, wrapping, and transcript behavior.
+
+use super::*;
+use crate::exec_cell::CommandOutput;
+use crate::exec_cell::ExecCall;
+use crate::exec_cell::ExecCell;
+use crate::legacy_core::config::Config;
+use crate::legacy_core::config::ConfigBuilder;
+use crate::session_state::ThreadSessionState;
+use crate::wrapping::word_wrap_lines;
+use codex_app_server_protocol::AskForApproval;
+use codex_app_server_protocol::McpAuthStatus;
+use codex_config::types::McpServerConfig;
+use codex_config::types::McpServerDisabledReason;
+use codex_otel::RuntimeMetricTotals;
+use codex_otel::RuntimeMetricsSummary;
+use codex_protocol::ThreadId;
+use codex_protocol::account::PlanType;
+use codex_protocol::parse_command::ParsedCommand;
+use dirs::home_dir;
+use pretty_assertions::assert_eq;
+use ratatui::buffer::Buffer;
+use ratatui::layout::Rect;
+use serde_json::json;
+use std::collections::HashMap;
+use std::path::PathBuf;
+
+use codex_app_server_protocol::CommandExecutionSource as ExecCommandSource;
+use codex_protocol::mcp::CallToolResult;
+use codex_protocol::mcp::Tool;
+use rmcp::model::Content;
+
+const SMALL_PNG_BASE64: &str = "iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAADUlEQVR4nGP4z8DwHwAFAAH/iZk9HQAAAABJRU5ErkJggg==";
+async fn test_config() -> Config {
+    let codex_home = std::env::temp_dir();
+    ConfigBuilder::default()
+        .codex_home(codex_home.clone())
+        .build()
+        .await
+        .expect("config")
+}
+
+fn test_cwd() -> PathBuf {
+    // These tests only need a stable absolute cwd; using temp_dir() avoids baking Unix- or
+    // Windows-specific root semantics into the fixtures.
+    std::env::temp_dir()
+}
+
+fn stdio_server_config(
+    command: &str,
+    args: Vec<&str>,
+    env: Option<HashMap<String, String>>,
+    env_vars: Vec<&str>,
+) -> McpServerConfig {
+    let mut table = toml::Table::new();
+    table.insert(
+        "command".to_string(),
+        toml::Value::String(command.to_string()),
+    );
+    if !args.is_empty() {
+        table.insert(
+            "args".to_string(),
+            toml::Value::Array(
+                args.into_iter()
+                    .map(|arg| toml::Value::String(arg.to_string()))
+                    .collect(),
+            ),
+        );
+    }
+    if let Some(env) = env {
+        table.insert("env".to_string(), string_map_to_toml_value(env));
+    }
+    if !env_vars.is_empty() {
+        table.insert(
+            "env_vars".to_string(),
+            toml::Value::Array(
+                env_vars
+                    .into_iter()
+                    .map(|name| toml::Value::String(name.to_string()))
+                    .collect(),
+            ),
+        );
+    }
+
+    toml::Value::Table(table)
+        .try_into()
+        .expect("test stdio MCP config should deserialize")
+}
+
+fn streamable_http_server_config(
+    url: &str,
+    bearer_token_env_var: Option<&str>,
+    http_headers: Option<HashMap<String, String>>,
+    env_http_headers: Option<HashMap<String, String>>,
+) -> McpServerConfig {
+    let mut table = toml::Table::new();
+    table.insert("url".to_string(), toml::Value::String(url.to_string()));
+    if let Some(bearer_token_env_var) = bearer_token_env_var {
+        table.insert(
+            "bearer_token_env_var".to_string(),
+            toml::Value::String(bearer_token_env_var.to_string()),
+        );
+    }
+    if let Some(http_headers) = http_headers {
+        table.insert(
+            "http_headers".to_string(),
+            string_map_to_toml_value(http_headers),
+        );
+    }
+    if let Some(env_http_headers) = env_http_headers {
+        table.insert(
+            "env_http_headers".to_string(),
+            string_map_to_toml_value(env_http_headers),
+        );
+    }
+
+    toml::Value::Table(table)
+        .try_into()
+        .expect("test streamable_http MCP config should deserialize")
+}
+
+fn string_map_to_toml_value(entries: HashMap<String, String>) -> toml::Value {
+    toml::Value::Table(
+        entries
+            .into_iter()
+            .map(|(key, value)| (key, toml::Value::String(value)))
+            .collect(),
+    )
+}
+
+fn render_lines(lines: &[Line<'static>]) -> Vec<String> {
+    lines
+        .iter()
+        .map(|line| {
+            line.spans
+                .iter()
+                .map(|span| span.content.as_ref())
+                .collect::<String>()
+        })
+        .collect()
+}
+
+fn render_transcript(cell: &dyn HistoryCell) -> Vec<String> {
+    render_lines(&cell.transcript_lines(u16::MAX))
+}
+
+fn assert_unstyled_lines(lines: &[Line<'static>]) {
+    for line in lines {
+        assert_eq!(line.style, Style::default());
+        for span in &line.spans {
+            assert_eq!(span.style, Style::default());
+        }
+    }
+}
+
+fn image_block(data: &str) -> serde_json::Value {
+    serde_json::to_value(Content::image(data.to_string(), "image/png"))
+        .expect("image content should serialize")
+}
+
+fn text_block(text: &str) -> serde_json::Value {
+    serde_json::to_value(Content::text(text)).expect("text content should serialize")
+}
+
+fn resource_link_block(
+    uri: &str,
+    name: &str,
+    title: Option<&str>,
+    description: Option<&str>,
+) -> serde_json::Value {
+    serde_json::to_value(Content::resource_link(rmcp::model::RawResource {
+        uri: uri.to_string(),
+        name: name.to_string(),
+        title: title.map(str::to_string),
+        description: description.map(str::to_string),
+        mime_type: None,
+        size: None,
+        icons: None,
+        meta: None,
+    }))
+    .expect("resource link content should serialize")
+}
+
+#[test]
+fn raw_lines_from_source_preserves_explicit_blank_lines() {
+    let lines = raw_lines_from_source("alpha\n\nbeta\n");
+
+    assert_eq!(
+        render_lines(&lines),
+        vec!["alpha".to_string(), String::new(), "beta".to_string()]
+    );
+    assert_unstyled_lines(&lines);
+}
+
+#[test]
+fn raw_lines_from_source_preserves_trailing_blank_but_not_trailing_newline() {
+    assert_eq!(
+        render_lines(&raw_lines_from_source("alpha\n\n")),
+        vec!["alpha".to_string(), String::new()]
+    );
+    assert_eq!(raw_lines_from_source(""), Vec::<Line<'static>>::new());
+}
+
+#[test]
+fn source_backed_cells_render_raw_source_without_prefix_or_style() {
+    let user = new_user_prompt(
+        "hello\n\nworld\n".to_string(),
+        Vec::new(),
+        Vec::new(),
+        Vec::new(),
+    );
+    let assistant = AgentMarkdownCell::new(
+        "- item\n\n| A | B |\n| - | - |\n| x | y |\n".to_string(),
+        &test_cwd(),
+    );
+    let reasoning = ReasoningSummaryCell::new(
+        "thinking".to_string(),
+        "first thought\n\nsecond thought".to_string(),
+        &test_cwd(),
+        /*transcript_only*/ false,
+    );
+    let plan = new_proposed_plan(
+        "1. Inspect\n\n```sh\ncargo test\n```".to_string(),
+        &test_cwd(),
+    );
+
+    let user_lines = user.raw_lines();
+    assert_eq!(
+        render_lines(&user_lines),
+        vec!["hello".to_string(), String::new(), "world".to_string()]
+    );
+    assert_unstyled_lines(&user_lines);
+
+    let assistant_lines = assistant.raw_lines();
+    assert_eq!(
+        render_lines(&assistant_lines),
+        vec![
+            "- item".to_string(),
+            String::new(),
+            "| A | B |".to_string(),
+            "| - | - |".to_string(),
+            "| x | y |".to_string(),
+        ]
+    );
+    assert_unstyled_lines(&assistant_lines);
+
+    let reasoning_lines = reasoning.raw_lines();
+    assert_eq!(
+        render_lines(&reasoning_lines),
+        vec![
+            "first thought".to_string(),
+            String::new(),
+            "second thought".to_string(),
+        ]
+    );
+    assert_unstyled_lines(&reasoning_lines);
+
+    let plan_lines = plan.raw_lines();
+    assert_eq!(
+        render_lines(&plan_lines),
+        vec![
+            "1. Inspect".to_string(),
+            String::new(),
+            "```sh".to_string(),
+            "cargo test".to_string(),
+            "```".to_string(),
+        ]
+    );
+    assert_unstyled_lines(&plan_lines);
+}
+
+#[test]
+fn proposed_plan_cell_renders_markdown_table() {
+    let plan = new_proposed_plan(
+        "## Plan\n\n| Step | Owner |\n| --- | --- |\n| Verify | Codex |\n".to_string(),
+        &test_cwd(),
+    );
+
+    let rendered = render_lines(&plan.display_lines(/*width*/ 80));
+
+    assert!(
+        rendered
+            .iter()
+            .any(|line| line.contains('│') || line.contains('┌')),
+        "expected boxed table in proposed plan output: {rendered:?}"
+    );
+    assert!(
+        !rendered
+            .iter()
+            .any(|line| line.trim() == "| Step | Owner |"),
+        "did not expect raw table header in rich proposed plan output: {rendered:?}"
+    );
+
+    let raw = render_lines(&plan.raw_lines());
+    assert!(
+        raw.iter().any(|line| line == "| Step | Owner |"),
+        "expected raw mode to preserve table markdown source: {raw:?}"
+    );
+}
+
+#[test]
+fn proposed_plan_cell_unwraps_markdown_fenced_table() {
+    let plan = new_proposed_plan(
+        "## Plan\n\n```markdown\n| Step | Owner |\n| --- | --- |\n| Verify | Codex |\n```\n"
+            .to_string(),
+        &test_cwd(),
+    );
+
+    let rendered = render_lines(&plan.display_lines(/*width*/ 80));
+
+    assert!(
+        rendered
+            .iter()
+            .any(|line| line.contains('│') || line.contains('┌')),
+        "expected boxed table for markdown-fenced proposed plan output: {rendered:?}"
+    );
+    assert!(
+        !rendered.iter().any(|line| line.trim() == "```markdown"),
+        "did not expect markdown fence to render as code block: {rendered:?}"
+    );
+}
+
+#[test]
+fn structured_tool_cell_renders_raw_plain_text_without_prefix_or_style() {
+    let invocation = McpInvocation {
+        server: "search".into(),
+        tool: "find_docs".into(),
+        arguments: Some(json!({"query": "raw mode"})),
+    };
+    let result = CallToolResult {
+        content: vec![text_block("alpha\nbeta")],
+        is_error: None,
+        structured_content: None,
+        meta: None,
+    };
+    let mut cell = new_active_mcp_tool_call(
+        "call-raw".to_string(),
+        invocation,
+        /*animations_enabled*/ false,
+    );
+    assert!(
+        cell.complete(Duration::from_millis(1), Ok(result))
+            .is_none()
+    );
+
+    let lines = cell.raw_lines();
+    let rendered = render_lines(&lines);
+    assert!(rendered[0].starts_with("Called search.find_docs("));
+    assert_eq!(rendered[1..], ["alpha".to_string(), "beta".to_string()]);
+    assert_unstyled_lines(&lines);
+}
+
+#[test]
+fn raw_mode_toggle_transcript_snapshot() {
+    let mut tool_cell = new_active_mcp_tool_call(
+        "call-snapshot".to_string(),
+        McpInvocation {
+            server: "workspace".to_string(),
+            tool: "inspect".to_string(),
+            arguments: Some(json!({"path": "README.md"})),
+        },
+        /*animations_enabled*/ false,
+    );
+    assert!(
+        tool_cell
+            .complete(
+                Duration::from_millis(5),
+                Ok(CallToolResult {
+                    content: vec![text_block("structured output\nsecond line")],
+                    is_error: None,
+                    structured_content: None,
+                    meta: None,
+                }),
+            )
+            .is_none()
+    );
+    let cells: Vec<Box<dyn HistoryCell>> = vec![
+            Box::new(new_user_prompt(
+                "Please format this\nfor copying".to_string(),
+                Vec::new(),
+                Vec::new(),
+                Vec::new(),
+            )),
+            Box::new(AgentMarkdownCell::new(
+                "- first item\n- second item\n\n| Col | Value |\n| --- | --- |\n| code | `x = 1` |\n\n```text\ncopy me\n```".to_string(),
+                &test_cwd(),
+            )),
+            Box::new(tool_cell),
+        ];
+
+    let render = |mode| {
+        cells
+            .iter()
+            .flat_map(|cell| cell.display_lines_for_mode(/*width*/ 40, mode))
+            .map(|line| {
+                line.spans
+                    .into_iter()
+                    .map(|span| span.content.into_owned())
+                    .collect::<String>()
+            })
+            .collect::<Vec<_>>()
+            .join("\n")
+    };
+    let rendered = format!(
+        "rich before:\n{}\n\nraw on:\n{}\n\nrich after:\n{}",
+        render(HistoryRenderMode::Rich),
+        render(HistoryRenderMode::Raw),
+        render(HistoryRenderMode::Rich)
+    );
+
+    insta::assert_snapshot!("raw_mode_toggle_transcript", rendered);
+}
+
+#[test]
+fn image_generation_call_renders_saved_path() {
+    let saved_path = test_path_buf("/tmp/generated-image.png").abs();
+    let expected_saved_path = format!(
+        "  └ Saved to: {}",
+        Url::from_file_path(saved_path.as_path()).expect("test path should convert to file URL")
+    );
+    let cell = new_image_generation_call(
+        "call-image-generation".to_string(),
+        Some("A tiny blue square".to_string()),
+        Some(saved_path),
+    );
+
+    assert_eq!(
+        render_lines(&cell.display_lines(/*width*/ 80)),
+        vec![
+            "• Generated Image:".to_string(),
+            "  └ A tiny blue square".to_string(),
+            expected_saved_path,
+        ],
+    );
+}
+
+fn session_configured_event(model: &str) -> ThreadSessionState {
+    ThreadSessionState {
+        thread_id: ThreadId::new(),
+        forked_from_id: None,
+        fork_parent_title: None,
+        thread_name: None,
+        model: model.to_string(),
+        model_provider_id: "test-provider".to_string(),
+        service_tier: None,
+        approval_policy: AskForApproval::Never,
+        approvals_reviewer: codex_protocol::config_types::ApprovalsReviewer::User,
+        permission_profile: PermissionProfile::read_only(),
+        active_permission_profile: None,
+        cwd: test_path_buf("/tmp/project").abs(),
+        runtime_workspace_roots: Vec::new(),
+        instruction_source_paths: Vec::new(),
+        reasoning_effort: None,
+        message_history: None,
+        network_proxy: None,
+        rollout_path: Some(PathBuf::new()),
+    }
+}
+
+#[test]
+fn unified_exec_interaction_cell_renders_input() {
+    let cell = new_unified_exec_interaction(Some("echo hello".to_string()), "ls\npwd".to_string());
+    let lines = render_transcript(&cell);
+    assert_eq!(
+        lines,
+        vec![
+            "↳ Interacted with background terminal · echo hello",
+            "  └ ls",
+            "    pwd",
+        ],
+    );
+}
+
+#[test]
+fn unified_exec_interaction_cell_renders_wait() {
+    let cell = new_unified_exec_interaction(/*command_display*/ None, String::new());
+    let lines = render_transcript(&cell);
+    assert_eq!(lines, vec!["• Waited for background terminal"]);
+}
+
+#[test]
+fn final_message_separator_hides_short_worked_label_and_includes_runtime_metrics() {
+    let summary = RuntimeMetricsSummary {
+        tool_calls: RuntimeMetricTotals {
+            count: 3,
+            duration_ms: 2_450,
+        },
+        api_calls: RuntimeMetricTotals {
+            count: 2,
+            duration_ms: 1_200,
+        },
+        streaming_events: RuntimeMetricTotals {
+            count: 6,
+            duration_ms: 900,
+        },
+        websocket_calls: RuntimeMetricTotals {
+            count: 1,
+            duration_ms: 700,
+        },
+        websocket_events: RuntimeMetricTotals {
+            count: 4,
+            duration_ms: 1_200,
+        },
+        responses_api_overhead_ms: 650,
+        responses_api_inference_time_ms: 1_940,
+        responses_api_engine_iapi_ttft_ms: 410,
+        responses_api_engine_service_ttft_ms: 460,
+        responses_api_engine_iapi_tbt_ms: 1_180,
+        responses_api_engine_service_tbt_ms: 1_240,
+        turn_ttft_ms: 0,
+        turn_ttfm_ms: 0,
+    };
+    let cell = FinalMessageSeparator::new(Some(12), Some(summary));
+    let rendered = render_lines(&cell.display_lines(/*width*/ 600));
+
+    assert_eq!(rendered.len(), 1);
+    assert!(!rendered[0].contains("Worked for"));
+    assert!(rendered[0].contains("Local tools: 3 calls (2.5s)"));
+    assert!(rendered[0].contains("Inference: 2 calls (1.2s)"));
+    assert!(rendered[0].contains("WebSocket: 1 events send (700ms)"));
+    assert!(rendered[0].contains("Streams: 6 events (900ms)"));
+    assert!(rendered[0].contains("4 events received (1.2s)"));
+    assert!(rendered[0].contains("Responses API overhead: 650ms"));
+    assert!(rendered[0].contains("Responses API inference: 1.9s"));
+    assert!(rendered[0].contains("TTFT: 410ms (iapi) 460ms (service)"));
+    assert!(rendered[0].contains("TBT: 1.2s (iapi) 1.2s (service)"));
+}
+
+#[test]
+fn final_message_separator_includes_worked_label_after_one_minute() {
+    let cell = FinalMessageSeparator::new(Some(61), /*runtime_metrics*/ None);
+    let rendered = render_lines(&cell.display_lines(/*width*/ 200));
+
+    assert_eq!(rendered.len(), 1);
+    assert!(rendered[0].contains("Worked for"));
+}
+
+#[test]
+fn ps_output_empty_snapshot() {
+    let cell = new_unified_exec_processes_output(Vec::new());
+    let rendered = render_lines(&cell.display_lines(/*width*/ 60)).join("\n");
+    insta::assert_snapshot!(rendered);
+}
+
+#[tokio::test]
+async fn session_info_uses_availability_nux_tooltip_override() {
+    let config = test_config().await;
+    let cell = new_session_info(
+        &config,
+        "gpt-5",
+        &session_configured_event("gpt-5"),
+        /*is_first_event*/ false,
+        Some("Model just became available".to_string()),
+        Some(PlanType::Free),
+        /*show_fast_status*/ false,
+    );
+
+    let rendered = render_transcript(&cell).join("\n");
+    assert!(rendered.contains("Model just became available"));
+}
+
+#[tokio::test]
+#[cfg_attr(
+    target_os = "windows",
+    ignore = "snapshot path rendering differs on Windows"
+)]
+async fn session_info_availability_nux_tooltip_snapshot() {
+    let mut config = test_config().await;
+    config.cwd = test_path_buf("/tmp/project").abs();
+    let cell = new_session_info(
+        &config,
+        "gpt-5",
+        &session_configured_event("gpt-5"),
+        /*is_first_event*/ false,
+        Some("Model just became available".to_string()),
+        Some(PlanType::Free),
+        /*show_fast_status*/ false,
+    );
+
+    let rendered = render_transcript(&cell).join("\n");
+    insta::assert_snapshot!(rendered);
+}
+
+#[tokio::test]
+async fn session_info_first_event_suppresses_tooltips_and_nux() {
+    let config = test_config().await;
+    let cell = new_session_info(
+        &config,
+        "gpt-5",
+        &session_configured_event("gpt-5"),
+        /*is_first_event*/ true,
+        Some("Model just became available".to_string()),
+        Some(PlanType::Free),
+        /*show_fast_status*/ false,
+    );
+
+    let rendered = render_transcript(&cell).join("\n");
+    assert!(!rendered.contains("Model just became available"));
+    assert!(rendered.contains("To get started"));
+}
+
+#[tokio::test]
+async fn session_info_hides_tooltips_when_disabled() {
+    let mut config = test_config().await;
+    config.show_tooltips = false;
+    let cell = new_session_info(
+        &config,
+        "gpt-5",
+        &session_configured_event("gpt-5"),
+        /*is_first_event*/ false,
+        Some("Model just became available".to_string()),
+        Some(PlanType::Free),
+        /*show_fast_status*/ false,
+    );
+
+    let rendered = render_transcript(&cell).join("\n");
+    assert!(!rendered.contains("Model just became available"));
+}
+
+#[test]
+fn ps_output_multiline_snapshot() {
+    let cell = new_unified_exec_processes_output(vec![
+        UnifiedExecProcessDetails {
+            command_display: "echo hello\nand then some extra text".to_string(),
+            recent_chunks: vec!["hello".to_string(), "done".to_string()],
+        },
+        UnifiedExecProcessDetails {
+            command_display: "rg \"foo\" src".to_string(),
+            recent_chunks: vec!["src/main.rs:12:foo".to_string()],
+        },
+    ]);
+    let rendered = render_lines(&cell.display_lines(/*width*/ 40)).join("\n");
+    insta::assert_snapshot!(rendered);
+}
+
+#[test]
+fn cyber_policy_error_event_snapshot() {
+    let cell = new_cyber_policy_error_event();
+    let rendered = render_lines(&cell.display_lines(/*width*/ 80)).join("\n");
+    insta::assert_snapshot!(rendered);
+}
+
+#[test]
+fn cyber_policy_error_event_narrow_snapshot() {
+    let cell = new_cyber_policy_error_event();
+    let rendered = render_lines(&cell.display_lines(/*width*/ 36)).join("\n");
+    insta::assert_snapshot!(rendered);
+}
+
+#[test]
+fn ps_output_long_command_snapshot() {
+    let cell = new_unified_exec_processes_output(vec![UnifiedExecProcessDetails {
+        command_display: String::from(
+            "rg \"foo\" src --glob '**/*.rs' --max-count 1000 --no-ignore --hidden --follow --glob '!target/**'",
+        ),
+        recent_chunks: vec!["searching...".to_string()],
+    }]);
+    let rendered = render_lines(&cell.display_lines(/*width*/ 36)).join("\n");
+    insta::assert_snapshot!(rendered);
+}
+
+#[test]
+fn ps_output_many_sessions_snapshot() {
+    let cell = new_unified_exec_processes_output(
+        (0..20)
+            .map(|idx| UnifiedExecProcessDetails {
+                command_display: format!("command {idx}"),
+                recent_chunks: Vec::new(),
+            })
+            .collect(),
+    );
+    let rendered = render_lines(&cell.display_lines(/*width*/ 32)).join("\n");
+    insta::assert_snapshot!(rendered);
+}
+
+#[test]
+fn ps_output_chunk_leading_whitespace_snapshot() {
+    let cell = new_unified_exec_processes_output(vec![UnifiedExecProcessDetails {
+        command_display: "just fix".to_string(),
+        recent_chunks: vec![
+            "  indented first".to_string(),
+            "    more indented".to_string(),
+        ],
+    }]);
+    let rendered = render_lines(&cell.display_lines(/*width*/ 60)).join("\n");
+    insta::assert_snapshot!(rendered);
+}
+
+#[test]
+fn error_event_oversized_input_snapshot() {
+    let cell = new_error_event(
+        "Message exceeds the maximum length of 1048576 characters (1048577 provided).".to_string(),
+    );
+    let rendered = render_lines(&cell.display_lines(/*width*/ 120)).join("\n");
+    insta::assert_snapshot!(rendered);
+}
+
+#[tokio::test]
+async fn mcp_tools_output_masks_sensitive_values() {
+    let mut config = test_config().await;
+    let mut env = HashMap::new();
+    env.insert("TOKEN".to_string(), "secret".to_string());
+    let stdio_config = stdio_server_config("docs-server", vec![], Some(env), vec!["APP_TOKEN"]);
+    let mut servers = config.mcp_servers.get().clone();
+    servers.insert("docs".to_string(), stdio_config);
+
+    let mut headers = HashMap::new();
+    headers.insert("Authorization".to_string(), "Bearer secret".to_string());
+    let mut env_headers = HashMap::new();
+    env_headers.insert("X-API-Key".to_string(), "API_KEY_ENV".to_string());
+    let http_config = streamable_http_server_config(
+        "https://example.com/mcp",
+        Some("MCP_TOKEN"),
+        Some(headers),
+        Some(env_headers),
+    );
+    servers.insert("http".to_string(), http_config);
+    config
+        .mcp_servers
+        .set(servers)
+        .expect("test mcp servers should accept any configuration");
+
+    let mut tools: HashMap<String, Tool> = HashMap::new();
+    tools.insert(
+        "mcp__docs__list".to_string(),
+        Tool {
+            description: None,
+            name: "list".to_string(),
+            title: None,
+            input_schema: serde_json::json!({"type": "object", "properties": {}}),
+            output_schema: None,
+            annotations: None,
+            icons: None,
+            meta: None,
+        },
+    );
+    tools.insert(
+        "mcp__http__ping".to_string(),
+        Tool {
+            description: None,
+            name: "ping".to_string(),
+            title: None,
+            input_schema: serde_json::json!({"type": "object", "properties": {}}),
+            output_schema: None,
+            annotations: None,
+            icons: None,
+            meta: None,
+        },
+    );
+
+    let auth_statuses: HashMap<String, McpAuthStatus> = HashMap::new();
+    let cell = new_mcp_tools_output(
+        &config,
+        tools,
+        HashMap::new(),
+        HashMap::new(),
+        &auth_statuses,
+    );
+    let rendered = render_lines(&cell.display_lines(/*width*/ 120)).join("\n");
+
+    insta::assert_snapshot!(rendered);
+}
+
+#[tokio::test]
+async fn mcp_tools_output_lists_tools_for_hyphenated_server_names() {
+    let mut config = test_config().await;
+    let mut servers = config.mcp_servers.get().clone();
+    servers.insert(
+        "some-server".to_string(),
+        stdio_server_config("docs-server", vec!["--stdio"], /*env*/ None, vec![]),
+    );
+    config
+        .mcp_servers
+        .set(servers)
+        .expect("test mcp servers should accept any configuration");
+
+    let tools = HashMap::from([(
+        "mcp__some_server__lookup".to_string(),
+        Tool {
+            description: None,
+            name: "lookup".to_string(),
+            title: None,
+            input_schema: serde_json::json!({"type": "object", "properties": {}}),
+            output_schema: None,
+            annotations: None,
+            icons: None,
+            meta: None,
+        },
+    )]);
+
+    let auth_statuses: HashMap<String, McpAuthStatus> = HashMap::new();
+    let cell = new_mcp_tools_output(
+        &config,
+        tools,
+        HashMap::new(),
+        HashMap::new(),
+        &auth_statuses,
+    );
+    let rendered = render_lines(&cell.display_lines(/*width*/ 120)).join("\n");
+
+    insta::assert_snapshot!(rendered);
+}
+
+#[tokio::test]
+async fn mcp_tools_output_from_statuses_renders_status_only_servers() {
+    let mut config = test_config().await;
+    let mut plugin_docs =
+        stdio_server_config("docs-server", vec!["--stdio"], /*env*/ None, vec![]);
+    plugin_docs.enabled = false;
+    plugin_docs.disabled_reason = Some(McpServerDisabledReason::Unknown);
+    let servers = HashMap::from([("plugin_docs".to_string(), plugin_docs)]);
+    config
+        .mcp_servers
+        .set(servers)
+        .expect("test mcp servers should accept any configuration");
+
+    let statuses = vec![McpServerStatus {
+        name: "plugin_docs".to_string(),
+        tools: HashMap::from([(
+            "lookup".to_string(),
+            Tool {
+                description: None,
+                name: "lookup".to_string(),
+                title: None,
+                input_schema: serde_json::json!({"type": "object", "properties": {}}),
+                output_schema: None,
+                annotations: None,
+                icons: None,
+                meta: None,
+            },
+        )]),
+        resources: Vec::new(),
+        resource_templates: Vec::new(),
+        auth_status: codex_app_server_protocol::McpAuthStatus::Unsupported,
+    }];
+
+    let cell = new_mcp_tools_output_from_statuses(
+        &config,
+        &statuses,
+        McpServerStatusDetail::ToolsAndAuthOnly,
+    );
+    let rendered = render_lines(&cell.display_lines(/*width*/ 120)).join("\n");
+
+    insta::assert_snapshot!(rendered);
+}
+
+#[tokio::test]
+async fn mcp_tools_output_from_statuses_renders_verbose_inventory() {
+    let mut config = test_config().await;
+    let plugin_docs =
+        stdio_server_config("docs-server", vec!["--stdio"], /*env*/ None, vec![]);
+    let servers = HashMap::from([("plugin_docs".to_string(), plugin_docs)]);
+    config
+        .mcp_servers
+        .set(servers)
+        .expect("test mcp servers should accept any configuration");
+
+    let statuses = vec![McpServerStatus {
+        name: "plugin_docs".to_string(),
+        tools: HashMap::from([(
+            "lookup".to_string(),
+            Tool {
+                description: None,
+                name: "lookup".to_string(),
+                title: None,
+                input_schema: serde_json::json!({"type": "object", "properties": {}}),
+                output_schema: None,
+                annotations: None,
+                icons: None,
+                meta: None,
+            },
+        )]),
+        resources: vec![Resource {
+            annotations: None,
+            description: None,
+            mime_type: None,
+            name: "docs".to_string(),
+            size: None,
+            title: Some("Docs".to_string()),
+            uri: "file:///docs".to_string(),
+            icons: None,
+            meta: None,
+        }],
+        resource_templates: vec![ResourceTemplate {
+            annotations: None,
+            uri_template: "file:///docs/{id}".to_string(),
+            name: "doc-template".to_string(),
+            title: Some("Doc Template".to_string()),
+            description: None,
+            mime_type: None,
+        }],
+        auth_status: codex_app_server_protocol::McpAuthStatus::Unsupported,
+    }];
+
+    let cell = new_mcp_tools_output_from_statuses(&config, &statuses, McpServerStatusDetail::Full);
+    let rendered = render_lines(&cell.display_lines(/*width*/ 120)).join("\n");
+
+    insta::assert_snapshot!(rendered);
+}
+
+#[test]
+fn empty_agent_message_cell_transcript() {
+    let cell = AgentMessageCell::new(vec![Line::default()], /*is_first_line*/ false);
+    assert_eq!(cell.transcript_lines(/*width*/ 80), vec![Line::from("  ")]);
+    assert_eq!(cell.desired_transcript_height(/*width*/ 80), 1);
+}
+
+#[test]
+fn prefixed_wrapped_history_cell_indents_wrapped_lines() {
+    let summary = Line::from(vec![
+        "You ".into(),
+        "approved".bold(),
+        " codex to run ".into(),
+        "echo something really long to ensure wrapping happens".dim(),
+        " this time".bold(),
+    ]);
+    let cell = PrefixedWrappedHistoryCell::new(summary, "✔ ".green(), "  ");
+    let rendered = render_lines(&cell.display_lines(/*width*/ 24));
+    assert_eq!(
+        rendered,
+        vec![
+            "✔ You approved codex to".to_string(),
+            "  run echo something".to_string(),
+            "  really long to ensure".to_string(),
+            "  wrapping happens this".to_string(),
+            "  time".to_string(),
+        ]
+    );
+}
+
+#[test]
+fn prefixed_wrapped_history_cell_does_not_split_url_like_token() {
+    let url_like = "example.test/api/v1/projects/alpha-team/releases/2026-02-17/builds/1234567890";
+    let cell = PrefixedWrappedHistoryCell::new(Line::from(url_like), "✔ ".green(), "  ");
+    let rendered = render_lines(&cell.display_lines(/*width*/ 24));
+
+    assert_eq!(
+        rendered
+            .iter()
+            .filter(|line| line.contains(url_like))
+            .count(),
+        1,
+        "expected full URL-like token in one rendered line, got: {rendered:?}"
+    );
+}
+
+#[test]
+fn unified_exec_interaction_cell_does_not_split_url_like_stdin_token() {
+    let url_like = "example.test/api/v1/projects/alpha-team/releases/2026-02-17/builds/1234567890";
+    let cell = UnifiedExecInteractionCell::new(Some("true".to_string()), url_like.to_string());
+    let rendered = render_lines(&cell.display_lines(/*width*/ 24));
+
+    assert_eq!(
+        rendered
+            .iter()
+            .filter(|line| line.contains(url_like))
+            .count(),
+        1,
+        "expected full URL-like token in one rendered line, got: {rendered:?}"
+    );
+}
+
+#[test]
+fn prefixed_wrapped_history_cell_height_matches_wrapped_rendering() {
+    let url_like = "example.test/api/v1/projects/alpha-team/releases/2026-02-17/builds/1234567890/artifacts/reports/performance/summary/detail/with/a/very/long/path";
+    let cell: Box<dyn HistoryCell> = Box::new(PrefixedWrappedHistoryCell::new(
+        Line::from(url_like),
+        "✔ ".green(),
+        "  ",
+    ));
+
+    let width: u16 = 24;
+    let logical_height = cell.display_lines(width).len() as u16;
+    let wrapped_height = cell.desired_height(width);
+    assert!(
+        wrapped_height > logical_height,
+        "expected wrapped height to exceed logical line count ({logical_height}), got {wrapped_height}"
+    );
+
+    let area = Rect::new(0, 0, width, wrapped_height);
+    let mut buf = ratatui::buffer::Buffer::empty(area);
+    cell.render(area, &mut buf);
+
+    let first_row = (0..area.width)
+        .map(|x| {
+            let symbol = buf[(x, 0)].symbol();
+            if symbol.is_empty() {
+                ' '
+            } else {
+                symbol.chars().next().unwrap_or(' ')
+            }
+        })
+        .collect::<String>();
+    assert!(
+        first_row.contains("✔"),
+        "expected first rendered row to keep the prefix visible, got: {first_row:?}"
+    );
+}
+
+#[test]
+fn unified_exec_interaction_cell_height_matches_wrapped_rendering() {
+    let url_like = "example.test/api/v1/projects/alpha-team/releases/2026-02-17/builds/1234567890/artifacts/reports/performance/summary/detail/with/a/very/long/path";
+    let cell: Box<dyn HistoryCell> = Box::new(UnifiedExecInteractionCell::new(
+        Some("true".to_string()),
+        url_like.to_string(),
+    ));
+
+    let width: u16 = 24;
+    let logical_height = cell.display_lines(width).len() as u16;
+    let wrapped_height = cell.desired_height(width);
+    assert!(
+        wrapped_height > logical_height,
+        "expected wrapped height to exceed logical line count ({logical_height}), got {wrapped_height}"
+    );
+
+    let area = Rect::new(0, 0, width, wrapped_height);
+    let mut buf = ratatui::buffer::Buffer::empty(area);
+    cell.render(area, &mut buf);
+
+    let first_row = (0..area.width)
+        .map(|x| {
+            let symbol = buf[(x, 0)].symbol();
+            if symbol.is_empty() {
+                ' '
+            } else {
+                symbol.chars().next().unwrap_or(' ')
+            }
+        })
+        .collect::<String>();
+    assert!(
+        first_row.contains("Interacted with"),
+        "expected first rendered row to keep the header visible, got: {first_row:?}"
+    );
+}
+
+#[test]
+fn web_search_history_cell_snapshot() {
+    let query = "example search query with several generic words to exercise wrapping".to_string();
+    let cell = new_web_search_call(
+        "call-1".to_string(),
+        query.clone(),
+        WebSearchAction::Search {
+            query: Some(query),
+            queries: None,
+        },
+    );
+    let rendered = render_lines(&cell.display_lines(/*width*/ 64)).join("\n");
+
+    insta::assert_snapshot!(rendered);
+}
+
+#[test]
+fn web_search_history_cell_wraps_with_indented_continuation() {
+    let query = "example search query with several generic words to exercise wrapping".to_string();
+    let cell = new_web_search_call(
+        "call-1".to_string(),
+        query.clone(),
+        WebSearchAction::Search {
+            query: Some(query),
+            queries: None,
+        },
+    );
+    let rendered = render_lines(&cell.display_lines(/*width*/ 64));
+
+    assert_eq!(
+        rendered,
+        vec![
+            "• Searched example search query with several generic words to".to_string(),
+            "  exercise wrapping".to_string(),
+        ]
+    );
+}
+
+#[test]
+fn web_search_history_cell_short_query_does_not_wrap() {
+    let query = "short query".to_string();
+    let cell = new_web_search_call(
+        "call-1".to_string(),
+        query.clone(),
+        WebSearchAction::Search {
+            query: Some(query),
+            queries: None,
+        },
+    );
+    let rendered = render_lines(&cell.display_lines(/*width*/ 64));
+
+    assert_eq!(rendered, vec!["• Searched short query".to_string()]);
+}
+
+#[test]
+fn web_search_history_cell_transcript_snapshot() {
+    let query = "example search query with several generic words to exercise wrapping".to_string();
+    let cell = new_web_search_call(
+        "call-1".to_string(),
+        query.clone(),
+        WebSearchAction::Search {
+            query: Some(query),
+            queries: None,
+        },
+    );
+    let rendered = render_lines(&cell.transcript_lines(/*width*/ 64)).join("\n");
+
+    insta::assert_snapshot!(rendered);
+}
+
+#[test]
+fn active_mcp_tool_call_snapshot() {
+    let invocation = McpInvocation {
+        server: "search".into(),
+        tool: "find_docs".into(),
+        arguments: Some(json!({
+            "query": "ratatui styling",
+            "limit": 3,
+        })),
+    };
+
+    let cell = new_active_mcp_tool_call(
+        "call-1".into(),
+        invocation,
+        /*animations_enabled*/ true,
+    );
+    let rendered = render_lines(&cell.display_lines(/*width*/ 80)).join("\n");
+
+    insta::assert_snapshot!(rendered);
+}
+
+#[test]
+fn mcp_inventory_loading_snapshot() {
+    let cell = new_mcp_inventory_loading(/*animations_enabled*/ true);
+    let rendered = render_lines(&cell.display_lines(/*width*/ 80)).join("\n");
+
+    insta::assert_snapshot!(rendered);
+}
+
+#[test]
+fn mcp_inventory_loading_without_animations_is_stable() {
+    let cell = new_mcp_inventory_loading(/*animations_enabled*/ false);
+    let first = render_lines(&cell.display_lines(/*width*/ 80));
+    let second = render_lines(&cell.display_lines(/*width*/ 80));
+
+    assert_eq!(first, second);
+    assert_eq!(first, vec!["• Loading MCP inventory…".to_string()]);
+}
+
+#[test]
+fn completed_mcp_tool_call_success_snapshot() {
+    let invocation = McpInvocation {
+        server: "search".into(),
+        tool: "find_docs".into(),
+        arguments: Some(json!({
+            "query": "ratatui styling",
+            "limit": 3,
+        })),
+    };
+
+    let result = CallToolResult {
+        content: vec![text_block("Found styling guidance in styles.md")],
+        is_error: None,
+        structured_content: None,
+        meta: None,
+    };
+
+    let mut cell = new_active_mcp_tool_call(
+        "call-2".into(),
+        invocation,
+        /*animations_enabled*/ true,
+    );
+    assert!(
+        cell.complete(Duration::from_millis(1420), Ok(result))
+            .is_none()
+    );
+
+    let rendered = render_lines(&cell.display_lines(/*width*/ 80)).join("\n");
+
+    insta::assert_snapshot!(rendered);
+}
+
+#[test]
+fn completed_mcp_tool_call_image_after_text_returns_extra_cell() {
+    let invocation = McpInvocation {
+        server: "image".into(),
+        tool: "generate".into(),
+        arguments: Some(json!({
+            "prompt": "tiny image",
+        })),
+    };
+
+    let result = CallToolResult {
+        content: vec![
+            text_block("Here is the image:"),
+            image_block(SMALL_PNG_BASE64),
+        ],
+        is_error: None,
+        structured_content: None,
+        meta: None,
+    };
+
+    let mut cell = new_active_mcp_tool_call(
+        "call-image".into(),
+        invocation,
+        /*animations_enabled*/ true,
+    );
+    let extra_cell = cell
+        .complete(Duration::from_millis(25), Ok(result))
+        .expect("expected image cell");
+
+    let rendered = render_lines(&extra_cell.display_lines(/*width*/ 80));
+    assert_eq!(rendered, vec!["tool result (image output)"]);
+}
+
+#[test]
+fn completed_mcp_tool_call_accepts_data_url_image_blocks() {
+    let invocation = McpInvocation {
+        server: "image".into(),
+        tool: "generate".into(),
+        arguments: Some(json!({
+            "prompt": "tiny image",
+        })),
+    };
+
+    let data_url = format!("data:image/png;base64,{SMALL_PNG_BASE64}");
+    let result = CallToolResult {
+        content: vec![image_block(&data_url)],
+        is_error: None,
+        structured_content: None,
+        meta: None,
+    };
+
+    let mut cell = new_active_mcp_tool_call(
+        "call-image-data-url".into(),
+        invocation,
+        /*animations_enabled*/ true,
+    );
+    let extra_cell = cell
+        .complete(Duration::from_millis(25), Ok(result))
+        .expect("expected image cell");
+
+    let rendered = render_lines(&extra_cell.display_lines(/*width*/ 80));
+    assert_eq!(rendered, vec!["tool result (image output)"]);
+}
+
+#[test]
+fn completed_mcp_tool_call_skips_invalid_image_blocks() {
+    let invocation = McpInvocation {
+        server: "image".into(),
+        tool: "generate".into(),
+        arguments: Some(json!({
+            "prompt": "tiny image",
+        })),
+    };
+
+    let result = CallToolResult {
+        content: vec![image_block("not-base64"), image_block(SMALL_PNG_BASE64)],
+        is_error: None,
+        structured_content: None,
+        meta: None,
+    };
+
+    let mut cell = new_active_mcp_tool_call(
+        "call-image-2".into(),
+        invocation,
+        /*animations_enabled*/ true,
+    );
+    let extra_cell = cell
+        .complete(Duration::from_millis(25), Ok(result))
+        .expect("expected image cell");
+
+    let rendered = render_lines(&extra_cell.display_lines(/*width*/ 80));
+    assert_eq!(rendered, vec!["tool result (image output)"]);
+}
+
+#[test]
+fn completed_mcp_tool_call_error_snapshot() {
+    let invocation = McpInvocation {
+        server: "search".into(),
+        tool: "find_docs".into(),
+        arguments: Some(json!({
+            "query": "ratatui styling",
+            "limit": 3,
+        })),
+    };
+
+    let mut cell = new_active_mcp_tool_call(
+        "call-3".into(),
+        invocation,
+        /*animations_enabled*/ true,
+    );
+    assert!(
+        cell.complete(Duration::from_secs(2), Err("network timeout".into()))
+            .is_none()
+    );
+
+    let rendered = render_lines(&cell.display_lines(/*width*/ 80)).join("\n");
+
+    insta::assert_snapshot!(rendered);
+}
+
+#[test]
+fn completed_mcp_tool_call_multiple_outputs_snapshot() {
+    let invocation = McpInvocation {
+        server: "search".into(),
+        tool: "find_docs".into(),
+        arguments: Some(json!({
+            "query": "ratatui styling",
+            "limit": 3,
+        })),
+    };
+
+    let result = CallToolResult {
+        content: vec![
+            text_block(
+                "Found styling guidance in styles.md and additional notes in CONTRIBUTING.md.",
+            ),
+            resource_link_block(
+                "file:///docs/styles.md",
+                "styles.md",
+                Some("Styles"),
+                Some("Link to styles documentation"),
+            ),
+        ],
+        is_error: None,
+        structured_content: None,
+        meta: None,
+    };
+
+    let mut cell = new_active_mcp_tool_call(
+        "call-4".into(),
+        invocation,
+        /*animations_enabled*/ true,
+    );
+    assert!(
+        cell.complete(Duration::from_millis(640), Ok(result))
+            .is_none()
+    );
+
+    let rendered = render_lines(&cell.display_lines(/*width*/ 48)).join("\n");
+
+    insta::assert_snapshot!(rendered);
+}
+
+#[test]
+fn completed_mcp_tool_call_wrapped_outputs_snapshot() {
+    let invocation = McpInvocation {
+        server: "metrics".into(),
+        tool: "get_nearby_metric".into(),
+        arguments: Some(json!({
+            "query": "very_long_query_that_needs_wrapping_to_display_properly_in_the_history",
+            "limit": 1,
+        })),
+    };
+
+    let result = CallToolResult {
+        content: vec![text_block(
+            "Line one of the response, which is quite long and needs wrapping.\nLine two continues the response with more detail.",
+        )],
+        is_error: None,
+        structured_content: None,
+        meta: None,
+    };
+
+    let mut cell = new_active_mcp_tool_call(
+        "call-5".into(),
+        invocation,
+        /*animations_enabled*/ true,
+    );
+    assert!(
+        cell.complete(Duration::from_millis(1280), Ok(result))
+            .is_none()
+    );
+
+    let rendered = render_lines(&cell.display_lines(/*width*/ 40)).join("\n");
+
+    insta::assert_snapshot!(rendered);
+}
+
+#[test]
+fn completed_mcp_tool_call_multiple_outputs_inline_snapshot() {
+    let invocation = McpInvocation {
+        server: "metrics".into(),
+        tool: "summary".into(),
+        arguments: Some(json!({
+            "metric": "trace.latency",
+            "window": "15m",
+        })),
+    };
+
+    let result = CallToolResult {
+        content: vec![
+            text_block("Latency summary: p50=120ms, p95=480ms."),
+            text_block("No anomalies detected."),
+        ],
+        is_error: None,
+        structured_content: None,
+        meta: None,
+    };
+
+    let mut cell = new_active_mcp_tool_call(
+        "call-6".into(),
+        invocation,
+        /*animations_enabled*/ true,
+    );
+    assert!(
+        cell.complete(Duration::from_millis(320), Ok(result))
+            .is_none()
+    );
+
+    let rendered = render_lines(&cell.display_lines(/*width*/ 120)).join("\n");
+
+    insta::assert_snapshot!(rendered);
+}
+
+#[test]
+fn session_header_includes_reasoning_level_when_present() {
+    let cell = SessionHeaderHistoryCell::new(
+        "gpt-4o".to_string(),
+        Some(ReasoningEffortConfig::High),
+        /*show_fast_status*/ true,
+        std::env::temp_dir(),
+        "test",
+    );
+
+    let lines = render_lines(&cell.display_lines(/*width*/ 80));
+    let model_line = lines
+        .iter()
+        .find(|line| line.contains("model:"))
+        .expect("model line");
+
+    assert!(model_line.contains("gpt-4o high   fast"));
+    assert!(model_line.contains("/model to change"));
+}
+
+#[test]
+fn session_header_hides_fast_status_when_disabled() {
+    let cell = SessionHeaderHistoryCell::new(
+        "gpt-4o".to_string(),
+        Some(ReasoningEffortConfig::High),
+        /*show_fast_status*/ false,
+        std::env::temp_dir(),
+        "test",
+    );
+
+    let lines = render_lines(&cell.display_lines(/*width*/ 80));
+    let model_line = lines
+        .iter()
+        .find(|line| line.contains("model:"))
+        .expect("model line");
+
+    assert!(model_line.contains("gpt-4o high"));
+    assert!(!model_line.contains("fast"));
+}
+
+#[test]
+#[cfg_attr(
+    target_os = "windows",
+    ignore = "snapshot path rendering differs on Windows"
+)]
+fn session_header_indicates_yolo_mode() {
+    let cell = SessionHeaderHistoryCell::new(
+        "gpt-5".to_string(),
+        /*reasoning_effort*/ None,
+        /*show_fast_status*/ false,
+        test_path_buf("/tmp/project").abs().to_path_buf(),
+        "test",
+    )
+    .with_yolo_mode(/*yolo_mode*/ true);
+
+    let rendered = render_lines(&cell.display_lines(/*width*/ 80)).join("\n");
+    insta::assert_snapshot!(rendered);
+}
+
+#[test]
+fn yolo_mode_includes_managed_full_access_profiles() {
+    let permission_profile: PermissionProfile = PermissionProfile::Managed {
+        network: NetworkSandboxPolicy::Enabled,
+        file_system: ManagedFileSystemPermissions::Unrestricted,
+    };
+
+    assert!(has_yolo_permissions(
+        AskForApproval::Never,
+        &permission_profile
+    ));
+}
+
+#[test]
+fn yolo_mode_excludes_external_sandbox_profiles() {
+    let permission_profile: PermissionProfile = PermissionProfile::External {
+        network: NetworkSandboxPolicy::Enabled,
+    };
+
+    assert!(!has_yolo_permissions(
+        AskForApproval::Never,
+        &permission_profile
+    ));
+}
+
+#[test]
+fn session_header_directory_center_truncates() {
+    let mut dir = home_dir().expect("home directory");
+    for part in ["hello", "the", "fox", "is", "very", "fast"] {
+        dir.push(part);
+    }
+
+    let formatted = SessionHeaderHistoryCell::format_directory_inner(&dir, Some(24));
+    let sep = std::path::MAIN_SEPARATOR;
+    let expected = format!("~{sep}hello{sep}the{sep}…{sep}very{sep}fast");
+    assert_eq!(formatted, expected);
+}
+
+#[test]
+fn session_header_directory_front_truncates_long_segment() {
+    let mut dir = home_dir().expect("home directory");
+    dir.push("supercalifragilisticexpialidocious");
+
+    let formatted = SessionHeaderHistoryCell::format_directory_inner(&dir, Some(18));
+    let sep = std::path::MAIN_SEPARATOR;
+    let expected = format!("~{sep}…cexpialidocious");
+    assert_eq!(formatted, expected);
+}
+
+#[test]
+fn coalesces_sequential_reads_within_one_call() {
+    // Build one exec cell with a Search followed by two Reads
+    let call_id = "c1".to_string();
+    let mut cell = ExecCell::new(
+        ExecCall {
+            call_id: call_id.clone(),
+            command: vec!["bash".into(), "-lc".into(), "echo".into()],
+            parsed: vec![
+                ParsedCommand::Search {
+                    query: Some("shimmer_spans".into()),
+                    path: None,
+                    cmd: "rg shimmer_spans".into(),
+                },
+                ParsedCommand::Read {
+                    name: "shimmer.rs".into(),
+                    cmd: "cat shimmer.rs".into(),
+                    path: "shimmer.rs".into(),
+                },
+                ParsedCommand::Read {
+                    name: "status_indicator_widget.rs".into(),
+                    cmd: "cat status_indicator_widget.rs".into(),
+                    path: "status_indicator_widget.rs".into(),
+                },
+            ],
+            output: None,
+            source: ExecCommandSource::Agent,
+            start_time: Some(Instant::now()),
+            duration: None,
+            interaction_input: None,
+        },
+        /*animations_enabled*/ true,
+    );
+    // Mark call complete so markers are ✓
+    cell.complete_call(&call_id, CommandOutput::default(), Duration::from_millis(1));
+
+    let lines = cell.display_lines(/*width*/ 80);
+    let rendered = render_lines(&lines).join("\n");
+    insta::assert_snapshot!(rendered);
+}
+
+#[test]
+fn coalesces_reads_across_multiple_calls() {
+    let mut cell = ExecCell::new(
+        ExecCall {
+            call_id: "c1".to_string(),
+            command: vec!["bash".into(), "-lc".into(), "echo".into()],
+            parsed: vec![ParsedCommand::Search {
+                query: Some("shimmer_spans".into()),
+                path: None,
+                cmd: "rg shimmer_spans".into(),
+            }],
+            output: None,
+            source: ExecCommandSource::Agent,
+            start_time: Some(Instant::now()),
+            duration: None,
+            interaction_input: None,
+        },
+        /*animations_enabled*/ true,
+    );
+    // Call 1: Search only
+    cell.complete_call("c1", CommandOutput::default(), Duration::from_millis(1));
+    // Call 2: Read A
+    cell = cell
+        .with_added_call(
+            "c2".into(),
+            vec!["bash".into(), "-lc".into(), "echo".into()],
+            vec![ParsedCommand::Read {
+                name: "shimmer.rs".into(),
+                cmd: "cat shimmer.rs".into(),
+                path: "shimmer.rs".into(),
+            }],
+            ExecCommandSource::Agent,
+            /*interaction_input*/ None,
+        )
+        .unwrap();
+    cell.complete_call("c2", CommandOutput::default(), Duration::from_millis(1));
+    // Call 3: Read B
+    cell = cell
+        .with_added_call(
+            "c3".into(),
+            vec!["bash".into(), "-lc".into(), "echo".into()],
+            vec![ParsedCommand::Read {
+                name: "status_indicator_widget.rs".into(),
+                cmd: "cat status_indicator_widget.rs".into(),
+                path: "status_indicator_widget.rs".into(),
+            }],
+            ExecCommandSource::Agent,
+            /*interaction_input*/ None,
+        )
+        .unwrap();
+    cell.complete_call("c3", CommandOutput::default(), Duration::from_millis(1));
+
+    let lines = cell.display_lines(/*width*/ 80);
+    let rendered = render_lines(&lines).join("\n");
+    insta::assert_snapshot!(rendered);
+}
+
+#[test]
+fn coalesced_reads_dedupe_names() {
+    let mut cell = ExecCell::new(
+        ExecCall {
+            call_id: "c1".to_string(),
+            command: vec!["bash".into(), "-lc".into(), "echo".into()],
+            parsed: vec![
+                ParsedCommand::Read {
+                    name: "auth.rs".into(),
+                    cmd: "cat auth.rs".into(),
+                    path: "auth.rs".into(),
+                },
+                ParsedCommand::Read {
+                    name: "auth.rs".into(),
+                    cmd: "cat auth.rs".into(),
+                    path: "auth.rs".into(),
+                },
+                ParsedCommand::Read {
+                    name: "shimmer.rs".into(),
+                    cmd: "cat shimmer.rs".into(),
+                    path: "shimmer.rs".into(),
+                },
+            ],
+            output: None,
+            source: ExecCommandSource::Agent,
+            start_time: Some(Instant::now()),
+            duration: None,
+            interaction_input: None,
+        },
+        /*animations_enabled*/ true,
+    );
+    cell.complete_call("c1", CommandOutput::default(), Duration::from_millis(1));
+    let lines = cell.display_lines(/*width*/ 80);
+    let rendered = render_lines(&lines).join("\n");
+    insta::assert_snapshot!(rendered);
+}
+
+#[test]
+fn multiline_command_wraps_with_extra_indent_on_subsequent_lines() {
+    // Create a completed exec cell with a multiline command
+    let cmd = "set -o pipefail\ncargo test -p codex-tui --quiet".to_string();
+    let call_id = "c1".to_string();
+    let mut cell = ExecCell::new(
+        ExecCall {
+            call_id: call_id.clone(),
+            command: vec!["bash".into(), "-lc".into(), cmd],
+            parsed: Vec::new(),
+            output: None,
+            source: ExecCommandSource::Agent,
+            start_time: Some(Instant::now()),
+            duration: None,
+            interaction_input: None,
+        },
+        /*animations_enabled*/ true,
+    );
+    // Mark call complete so it renders as "Ran"
+    cell.complete_call(&call_id, CommandOutput::default(), Duration::from_millis(1));
+
+    // Small width to keep the wrapped continuation-indent path covered.
+    let width: u16 = 28;
+    let lines = cell.display_lines(width);
+    let rendered = render_lines(&lines).join("\n");
+    insta::assert_snapshot!(rendered);
+}
+
+#[test]
+fn single_line_command_compact_when_fits() {
+    let call_id = "c1".to_string();
+    let mut cell = ExecCell::new(
+        ExecCall {
+            call_id: call_id.clone(),
+            command: vec!["echo".into(), "ok".into()],
+            parsed: Vec::new(),
+            output: None,
+            source: ExecCommandSource::Agent,
+            start_time: Some(Instant::now()),
+            duration: None,
+            interaction_input: None,
+        },
+        /*animations_enabled*/ true,
+    );
+    cell.complete_call(&call_id, CommandOutput::default(), Duration::from_millis(1));
+    // Wide enough that it fits inline
+    let lines = cell.display_lines(/*width*/ 80);
+    let rendered = render_lines(&lines).join("\n");
+    insta::assert_snapshot!(rendered);
+}
+
+#[test]
+fn single_line_command_wraps_with_four_space_continuation() {
+    let call_id = "c1".to_string();
+    let long = "a_very_long_token_without_spaces_to_force_wrapping".to_string();
+    let mut cell = ExecCell::new(
+        ExecCall {
+            call_id: call_id.clone(),
+            command: vec!["bash".into(), "-lc".into(), long],
+            parsed: Vec::new(),
+            output: None,
+            source: ExecCommandSource::Agent,
+            start_time: Some(Instant::now()),
+            duration: None,
+            interaction_input: None,
+        },
+        /*animations_enabled*/ true,
+    );
+    cell.complete_call(&call_id, CommandOutput::default(), Duration::from_millis(1));
+    let lines = cell.display_lines(/*width*/ 24);
+    let rendered = render_lines(&lines).join("\n");
+    insta::assert_snapshot!(rendered);
+}
+
+#[test]
+fn multiline_command_without_wrap_uses_branch_then_eight_spaces() {
+    let call_id = "c1".to_string();
+    let cmd = "echo one\necho two".to_string();
+    let mut cell = ExecCell::new(
+        ExecCall {
+            call_id: call_id.clone(),
+            command: vec!["bash".into(), "-lc".into(), cmd],
+            parsed: Vec::new(),
+            output: None,
+            source: ExecCommandSource::Agent,
+            start_time: Some(Instant::now()),
+            duration: None,
+            interaction_input: None,
+        },
+        /*animations_enabled*/ true,
+    );
+    cell.complete_call(&call_id, CommandOutput::default(), Duration::from_millis(1));
+    let lines = cell.display_lines(/*width*/ 80);
+    let rendered = render_lines(&lines).join("\n");
+    insta::assert_snapshot!(rendered);
+}
+
+#[test]
+fn multiline_command_both_lines_wrap_with_correct_prefixes() {
+    let call_id = "c1".to_string();
+    let cmd =
+        "first_token_is_long_enough_to_wrap\nsecond_token_is_also_long_enough_to_wrap".to_string();
+    let mut cell = ExecCell::new(
+        ExecCall {
+            call_id: call_id.clone(),
+            command: vec!["bash".into(), "-lc".into(), cmd],
+            parsed: Vec::new(),
+            output: None,
+            source: ExecCommandSource::Agent,
+            start_time: Some(Instant::now()),
+            duration: None,
+            interaction_input: None,
+        },
+        /*animations_enabled*/ true,
+    );
+    cell.complete_call(&call_id, CommandOutput::default(), Duration::from_millis(1));
+    let lines = cell.display_lines(/*width*/ 28);
+    let rendered = render_lines(&lines).join("\n");
+    insta::assert_snapshot!(rendered);
+}
+
+#[test]
+fn stderr_tail_more_than_five_lines_snapshot() {
+    // Build an exec cell with a non-zero exit and 10 lines on stderr to exercise
+    // the head/tail rendering and gutter prefixes.
+    let call_id = "c_err".to_string();
+    let mut cell = ExecCell::new(
+        ExecCall {
+            call_id: call_id.clone(),
+            command: vec!["bash".into(), "-lc".into(), "seq 1 10 1>&2 && false".into()],
+            parsed: Vec::new(),
+            output: None,
+            source: ExecCommandSource::Agent,
+            start_time: Some(Instant::now()),
+            duration: None,
+            interaction_input: None,
+        },
+        /*animations_enabled*/ true,
+    );
+    let stderr: String = (1..=10)
+        .map(|n| n.to_string())
+        .collect::<Vec<_>>()
+        .join("\n");
+    cell.complete_call(
+        &call_id,
+        CommandOutput {
+            exit_code: 1,
+            formatted_output: String::new(),
+            aggregated_output: stderr,
+        },
+        Duration::from_millis(1),
+    );
+
+    let rendered = cell
+        .display_lines(/*width*/ 80)
+        .iter()
+        .map(|l| {
+            l.spans
+                .iter()
+                .map(|s| s.content.as_ref())
+                .collect::<String>()
+        })
+        .collect::<Vec<_>>()
+        .join("\n");
+    insta::assert_snapshot!(rendered);
+}
+
+#[test]
+fn ran_cell_multiline_with_stderr_snapshot() {
+    // Build an exec cell that completes (so it renders as "Ran") with a
+    // command long enough that it must render on its own line under the
+    // header, and include a couple of stderr lines to verify the output
+    // block prefixes and wrapping.
+    let call_id = "c_wrap_err".to_string();
+    let long_cmd =
+        "echo this_is_a_very_long_single_token_that_will_wrap_across_the_available_width";
+    let mut cell = ExecCell::new(
+        ExecCall {
+            call_id: call_id.clone(),
+            command: vec!["bash".into(), "-lc".into(), long_cmd.to_string()],
+            parsed: Vec::new(),
+            output: None,
+            source: ExecCommandSource::Agent,
+            start_time: Some(Instant::now()),
+            duration: None,
+            interaction_input: None,
+        },
+        /*animations_enabled*/ true,
+    );
+
+    let stderr = "error: first line on stderr\nerror: second line on stderr".to_string();
+    cell.complete_call(
+        &call_id,
+        CommandOutput {
+            exit_code: 1,
+            formatted_output: String::new(),
+            aggregated_output: stderr,
+        },
+        Duration::from_millis(5),
+    );
+
+    // Narrow width to force the command to render under the header line.
+    let width: u16 = 28;
+    let rendered = cell
+        .display_lines(width)
+        .iter()
+        .map(|l| {
+            l.spans
+                .iter()
+                .map(|s| s.content.as_ref())
+                .collect::<String>()
+        })
+        .collect::<Vec<_>>()
+        .join("\n");
+    insta::assert_snapshot!(rendered);
+}
+#[test]
+fn user_history_cell_wraps_and_prefixes_each_line_snapshot() {
+    let msg = "one two three four five six seven";
+    let cell = UserHistoryCell {
+        message: msg.to_string(),
+        text_elements: Vec::new(),
+        local_image_paths: Vec::new(),
+        remote_image_urls: Vec::new(),
+    };
+
+    // Small width to force wrapping more clearly. Effective wrap width is width-2 due to the ▌ prefix and trailing space.
+    let width: u16 = 12;
+    let lines = cell.display_lines(width);
+    let rendered = render_lines(&lines).join("\n");
+
+    insta::assert_snapshot!(rendered);
+}
+
+#[test]
+fn user_history_cell_renders_remote_image_urls() {
+    let cell = UserHistoryCell {
+        message: "describe these".to_string(),
+        text_elements: Vec::new(),
+        local_image_paths: Vec::new(),
+        remote_image_urls: vec!["https://example.com/example.png".to_string()],
+    };
+
+    let rendered = render_lines(&cell.display_lines(/*width*/ 80)).join("\n");
+
+    assert!(rendered.contains("[Image #1]"));
+    assert!(rendered.contains("describe these"));
+    insta::assert_snapshot!(rendered);
+}
+
+#[test]
+fn user_history_cell_summarizes_inline_data_urls() {
+    let cell = UserHistoryCell {
+        message: "describe inline image".to_string(),
+        text_elements: Vec::new(),
+        local_image_paths: Vec::new(),
+        remote_image_urls: vec!["data:image/png;base64,aGVsbG8=".to_string()],
+    };
+
+    let rendered = render_lines(&cell.display_lines(/*width*/ 80)).join("\n");
+
+    assert!(rendered.contains("[Image #1]"));
+    assert!(rendered.contains("describe inline image"));
+}
+
+#[test]
+fn user_history_cell_numbers_multiple_remote_images() {
+    let cell = UserHistoryCell {
+        message: "describe both".to_string(),
+        text_elements: Vec::new(),
+        local_image_paths: Vec::new(),
+        remote_image_urls: vec![
+            "https://example.com/one.png".to_string(),
+            "https://example.com/two.png".to_string(),
+        ],
+    };
+
+    let rendered = render_lines(&cell.display_lines(/*width*/ 80)).join("\n");
+
+    assert!(rendered.contains("[Image #1]"));
+    assert!(rendered.contains("[Image #2]"));
+    insta::assert_snapshot!(rendered);
+}
+
+#[test]
+fn user_history_cell_height_matches_rendered_lines_with_remote_images() {
+    let cell = UserHistoryCell {
+        message: "line one\nline two".to_string(),
+        text_elements: Vec::new(),
+        local_image_paths: Vec::new(),
+        remote_image_urls: vec![
+            "https://example.com/one.png".to_string(),
+            "https://example.com/two.png".to_string(),
+        ],
+    };
+
+    let width = 80;
+    let rendered_len: u16 = cell
+        .display_lines(width)
+        .len()
+        .try_into()
+        .unwrap_or(u16::MAX);
+    assert_eq!(cell.desired_height(width), rendered_len);
+    assert_eq!(cell.desired_transcript_height(width), rendered_len);
+}
+
+#[test]
+fn user_history_cell_trims_trailing_blank_message_lines() {
+    let cell = UserHistoryCell {
+        message: "line one\n\n   \n\t \n".to_string(),
+        text_elements: Vec::new(),
+        local_image_paths: Vec::new(),
+        remote_image_urls: vec!["https://example.com/one.png".to_string()],
+    };
+
+    let rendered = render_lines(&cell.display_lines(/*width*/ 80));
+    let trailing_blank_count = rendered
+        .iter()
+        .rev()
+        .take_while(|line| line.trim().is_empty())
+        .count();
+    assert_eq!(trailing_blank_count, 1);
+    assert!(rendered.iter().any(|line| line.contains("line one")));
+}
+
+#[test]
+fn user_history_cell_trims_trailing_blank_message_lines_with_text_elements() {
+    let message = "tokenized\n\n\n".to_string();
+    let cell = UserHistoryCell {
+        message,
+        text_elements: vec![TextElement::new(
+            (0..8).into(),
+            Some("tokenized".to_string()),
+        )],
+        local_image_paths: Vec::new(),
+        remote_image_urls: vec!["https://example.com/one.png".to_string()],
+    };
+
+    let rendered = render_lines(&cell.display_lines(/*width*/ 80));
+    let trailing_blank_count = rendered
+        .iter()
+        .rev()
+        .take_while(|line| line.trim().is_empty())
+        .count();
+    assert_eq!(trailing_blank_count, 1);
+    assert!(rendered.iter().any(|line| line.contains("tokenized")));
+}
+
+#[test]
+fn render_uses_wrapping_for_long_url_like_line() {
+    let url = "https://example.test/api/v1/projects/alpha-team/releases/2026-02-17/builds/1234567890/artifacts/reports/performance/summary/detail/with/a/very/long/path/that/keeps/going/for/testing/purposes-only-and-does/not/need/to/resolve/index.html?session_id=abc123def456ghi789jkl012mno345pqr678stu901vwx234yz";
+    let cell: Box<dyn HistoryCell> = Box::new(UserHistoryCell {
+        message: url.to_string(),
+        text_elements: Vec::new(),
+        local_image_paths: Vec::new(),
+        remote_image_urls: Vec::new(),
+    });
+
+    let width: u16 = 52;
+    let height = cell.desired_height(width);
+    assert!(
+        height > 1,
+        "expected wrapped height for long URL, got {height}"
+    );
+
+    let area = Rect::new(0, 0, width, height);
+    let mut buf = ratatui::buffer::Buffer::empty(area);
+    cell.render(area, &mut buf);
+
+    let rendered = (0..area.height)
+        .map(|y| {
+            (0..area.width)
+                .map(|x| {
+                    let symbol = buf[(x, y)].symbol();
+                    if symbol.is_empty() {
+                        ' '
+                    } else {
+                        symbol.chars().next().unwrap_or(' ')
+                    }
+                })
+                .collect::<String>()
+        })
+        .collect::<Vec<_>>();
+    let rendered_blob = rendered.join("\n");
+
+    assert!(
+        rendered_blob.contains("session_id=abc123"),
+        "expected URL tail to be visible after wrapping, got:\n{rendered_blob}"
+    );
+
+    let non_empty_rows = rendered.iter().filter(|row| !row.trim().is_empty()).count() as u16;
+    assert!(
+        non_empty_rows > 3,
+        "expected long URL to span multiple visible rows, got:\n{rendered_blob}"
+    );
+}
+
+#[test]
+fn plan_update_with_note_and_wrapping_snapshot() {
+    // Long explanation forces wrapping; include long step text to verify step wrapping and alignment.
+    let update = UpdatePlanArgs {
+            explanation: Some(
+                "I’ll update Grafana call error handling by adding retries and clearer messages when the backend is unreachable."
+                    .to_string(),
+            ),
+            plan: vec![
+                PlanItemArg {
+                    step: "Investigate existing error paths and logging around HTTP timeouts".into(),
+                    status: StepStatus::Completed,
+                },
+                PlanItemArg {
+                    step: "Harden Grafana client error handling with retry/backoff and user‑friendly messages".into(),
+                    status: StepStatus::InProgress,
+                },
+                PlanItemArg {
+                    step: "Add tests for transient failure scenarios and surfacing to the UI".into(),
+                    status: StepStatus::Pending,
+                },
+            ],
+        };
+
+    let cell = new_plan_update(update);
+    // Narrow width to force wrapping for both the note and steps
+    let lines = cell.display_lines(/*width*/ 32);
+    let rendered = render_lines(&lines).join("\n");
+    insta::assert_snapshot!(rendered);
+}
+
+#[test]
+fn plan_update_without_note_snapshot() {
+    let update = UpdatePlanArgs {
+        explanation: None,
+        plan: vec![
+            PlanItemArg {
+                step: "Define error taxonomy".into(),
+                status: StepStatus::InProgress,
+            },
+            PlanItemArg {
+                step: "Implement mapping to user messages".into(),
+                status: StepStatus::Pending,
+            },
+        ],
+    };
+
+    let cell = new_plan_update(update);
+    let lines = cell.display_lines(/*width*/ 40);
+    let rendered = render_lines(&lines).join("\n");
+    insta::assert_snapshot!(rendered);
+}
+
+#[test]
+fn plan_update_does_not_split_url_like_tokens_in_note_or_step() {
+    let note_url = "example.test/api/v1/projects/alpha-team/releases/2026-02-17/builds/1234567890";
+    let step_url = "example.test/api/v1/projects/beta-team/releases/2026-02-17/builds/0987654321/artifacts/reports/performance";
+    let update = UpdatePlanArgs {
+        explanation: Some(format!(
+            "Investigate failures under {note_url} immediately."
+        )),
+        plan: vec![PlanItemArg {
+            step: format!("Validate callbacks under {step_url} before rollout."),
+            status: StepStatus::InProgress,
+        }],
+    };
+
+    let cell = new_plan_update(update);
+    let rendered = render_lines(&cell.display_lines(/*width*/ 30));
+
+    assert_eq!(
+        rendered
+            .iter()
+            .filter(|line| line.contains(note_url))
+            .count(),
+        1,
+        "expected full note URL-like token in one rendered line, got: {rendered:?}"
+    );
+    assert_eq!(
+        rendered
+            .iter()
+            .filter(|line| line.contains(step_url))
+            .count(),
+        1,
+        "expected full step URL-like token in one rendered line, got: {rendered:?}"
+    );
+}
+
+#[test]
+fn reasoning_summary_block() {
+    let cell = new_reasoning_summary_block(
+        "**High level reasoning**\n\nDetailed reasoning goes here.".to_string(),
+        &test_cwd(),
+    );
+
+    let rendered_display = render_lines(&cell.display_lines(/*width*/ 80));
+    assert_eq!(rendered_display, vec!["• Detailed reasoning goes here."]);
+
+    let rendered_transcript = render_transcript(cell.as_ref());
+    assert_eq!(rendered_transcript, vec!["• Detailed reasoning goes here."]);
+}
+
+#[test]
+fn reasoning_summary_height_matches_wrapped_rendering_for_url_like_content() {
+    let summary = "example.test/api/v1/projects/alpha-team/releases/2026-02-17/builds/1234567890/artifacts/reports/performance/summary/detail/with/a/very/long/path/that/keeps/going";
+    let cell: Box<dyn HistoryCell> = Box::new(ReasoningSummaryCell::new(
+        "High level reasoning".to_string(),
+        summary.to_string(),
+        &test_cwd(),
+        /*transcript_only*/ false,
+    ));
+    let width: u16 = 24;
+
+    let logical_height = cell.display_lines(width).len() as u16;
+    let wrapped_height = cell.desired_height(width);
+    let expected_wrapped_height = Paragraph::new(Text::from(cell.display_lines(width)))
+        .wrap(Wrap { trim: false })
+        .line_count(width) as u16;
+    assert_eq!(wrapped_height, expected_wrapped_height);
+    assert!(
+        wrapped_height >= logical_height,
+        "expected wrapped height to be at least logical line count ({logical_height}), got {wrapped_height}"
+    );
+
+    let wrapped_transcript_height = cell.desired_transcript_height(width);
+    assert_eq!(wrapped_transcript_height, wrapped_height);
+
+    let area = Rect::new(0, 0, width, wrapped_height);
+    let mut buf = ratatui::buffer::Buffer::empty(area);
+    cell.render(area, &mut buf);
+
+    let first_row = (0..area.width)
+        .map(|x| {
+            let symbol = buf[(x, 0)].symbol();
+            if symbol.is_empty() {
+                ' '
+            } else {
+                symbol.chars().next().unwrap_or(' ')
+            }
+        })
+        .collect::<String>();
+    assert!(
+        first_row.contains("•"),
+        "expected first rendered row to keep summary bullet visible, got: {first_row:?}"
+    );
+}
+
+#[test]
+fn reasoning_summary_block_returns_reasoning_cell_when_feature_disabled() {
+    let cell =
+        new_reasoning_summary_block("Detailed reasoning goes here.".to_string(), &test_cwd());
+
+    let rendered = render_transcript(cell.as_ref());
+    assert_eq!(rendered, vec!["• Detailed reasoning goes here."]);
+}
+
+#[tokio::test]
+async fn reasoning_summary_block_respects_config_overrides() {
+    let mut config = test_config().await;
+    config.model = Some("gpt-3.5-turbo".to_string());
+    config.model_supports_reasoning_summaries = Some(true);
+    let cell = new_reasoning_summary_block(
+        "**High level reasoning**\n\nDetailed reasoning goes here.".to_string(),
+        &test_cwd(),
+    );
+
+    let rendered_display = render_lines(&cell.display_lines(/*width*/ 80));
+    assert_eq!(rendered_display, vec!["• Detailed reasoning goes here."]);
+}
+
+#[test]
+fn reasoning_summary_block_falls_back_when_header_is_missing() {
+    let cell = new_reasoning_summary_block(
+        "**High level reasoning without closing".to_string(),
+        &test_cwd(),
+    );
+
+    let rendered = render_transcript(cell.as_ref());
+    assert_eq!(rendered, vec!["• **High level reasoning without closing"]);
+}
+
+#[test]
+fn reasoning_summary_block_falls_back_when_summary_is_missing() {
+    let cell = new_reasoning_summary_block(
+        "**High level reasoning without closing**".to_string(),
+        &test_cwd(),
+    );
+
+    let rendered = render_transcript(cell.as_ref());
+    assert_eq!(rendered, vec!["• High level reasoning without closing"]);
+
+    let cell = new_reasoning_summary_block(
+        "**High level reasoning without closing**\n\n  ".to_string(),
+        &test_cwd(),
+    );
+
+    let rendered = render_transcript(cell.as_ref());
+    assert_eq!(rendered, vec!["• High level reasoning without closing"]);
+}
+
+#[test]
+fn reasoning_summary_block_splits_header_and_summary_when_present() {
+    let cell = new_reasoning_summary_block(
+        "**High level plan**\n\nWe should fix the bug next.".to_string(),
+        &test_cwd(),
+    );
+
+    let rendered_display = render_lines(&cell.display_lines(/*width*/ 80));
+    assert_eq!(rendered_display, vec!["• We should fix the bug next."]);
+
+    let rendered_transcript = render_transcript(cell.as_ref());
+    assert_eq!(rendered_transcript, vec!["• We should fix the bug next."]);
+}
+
+#[test]
+fn deprecation_notice_renders_summary_with_details() {
+    let cell = new_deprecation_notice(
+        "Feature flag `foo`".to_string(),
+        Some("Use flag `bar` instead.".to_string()),
+    );
+    let lines = cell.display_lines(/*width*/ 80);
+    let rendered = render_lines(&lines);
+    assert_eq!(
+        rendered,
+        vec![
+            "⚠ Feature flag `foo`".to_string(),
+            "Use flag `bar` instead.".to_string(),
+        ]
+    );
+}
+
+#[test]
+fn agent_markdown_cell_renders_source_at_different_widths() {
+    let source =
+        "A long agent message that should wrap differently when the terminal width changes.\n";
+    let cell = AgentMarkdownCell::new(source.to_string(), &test_cwd());
+
+    let lines_80 = render_lines(&cell.display_lines(/*width*/ 80));
+    assert!(
+        lines_80.first().is_some_and(|line| line.starts_with("• ")),
+        "first line should start with bullet prefix: {:?}",
+        lines_80[0]
+    );
+
+    let lines_32 = render_lines(&cell.display_lines(/*width*/ 32));
+    assert!(
+        lines_32.len() > lines_80.len(),
+        "narrower width should produce more wrapped lines: {lines_32:?}",
+    );
+}
+
+#[test]
+fn agent_markdown_cell_does_not_split_words_after_inline_markdown() {
+    let source = "This paragraph is intentionally long so you can inspect soft wrapping behavior while also checking inline formatting like **bold text**, *italic text*, ***bold italic text***, `inline code`, ~~strikethrough~~, a [link to example.com](https://example.com), and a literal path like [README.md](/Users/felipe.coury/code/codex.fcoury-worktrees/README.md) without introducing manual line breaks.\n";
+    let cell = AgentMarkdownCell::new(source.to_string(), &test_cwd());
+
+    let lines = render_lines(&cell.display_lines(/*width*/ 190));
+    assert!(
+        lines[0].ends_with("inline code,"),
+        "expected wrapping to stop before 'strikethrough': {lines:?}",
+    );
+    assert!(
+        lines[1].starts_with("  strikethrough,"),
+        "expected the next line to resume with the full word: {lines:?}",
+    );
+}
+
+#[test]
+fn agent_markdown_cell_narrow_width_shows_prefix_only() {
+    let source = "narrow width coverage\n";
+    let cell = AgentMarkdownCell::new(source.to_string(), &test_cwd());
+
+    let lines = render_lines(&cell.display_lines(/*width*/ 2));
+    assert_eq!(lines, vec!["• ".to_string()]);
+}
+
+#[test]
+fn wrapped_and_prefixed_cells_handle_tiny_widths() {
+    let user_cell = UserHistoryCell {
+        message: "tiny width coverage for wrapped user history".to_string(),
+        text_elements: Vec::new(),
+        local_image_paths: Vec::new(),
+        remote_image_urls: Vec::new(),
+    };
+    let agent_message_cell = AgentMessageCell::new(
+        vec!["tiny width agent line".into()],
+        /*is_first_line*/ true,
+    );
+    let reasoning_cell = ReasoningSummaryCell::new(
+        "Plan".to_string(),
+        "Reasoning summary content for tiny widths.".to_string(),
+        &test_cwd(),
+        /*transcript_only*/ false,
+    );
+    let agent_markdown_cell =
+        AgentMarkdownCell::new("tiny width agent markdown line\n".to_string(), &test_cwd());
+
+    for width in 1..=4 {
+        assert!(
+            !user_cell.display_lines(width).is_empty(),
+            "user cell should render at width {width}",
+        );
+        assert!(
+            !agent_message_cell.display_lines(width).is_empty(),
+            "agent message cell should render at width {width}",
+        );
+        assert!(
+            !reasoning_cell.display_lines(width).is_empty(),
+            "reasoning cell should render at width {width}",
+        );
+        assert!(
+            !agent_markdown_cell.display_lines(width).is_empty(),
+            "agent markdown cell should render at width {width}",
+        );
+    }
+}
+
+#[test]
+fn render_clears_area_when_cell_content_shrinks() {
+    let area = Rect::new(0, 0, 40, 6);
+    let mut buf = Buffer::empty(area);
+
+    let first: Box<dyn HistoryCell> = Box::new(PlainHistoryCell::new(vec![
+        Line::from("STALE ROW 1"),
+        Line::from("STALE ROW 2"),
+        Line::from("STALE ROW 3"),
+        Line::from("STALE ROW 4"),
+    ]));
+    first.render(area, &mut buf);
+
+    let second: Box<dyn HistoryCell> = Box::new(PlainHistoryCell::new(vec![Line::from("fresh")]));
+    second.render(area, &mut buf);
+
+    let mut rendered_rows: Vec<String> = Vec::new();
+    for y in 0..area.height {
+        let mut row = String::new();
+        for x in 0..area.width {
+            row.push_str(buf.cell((x, y)).expect("cell should exist").symbol());
+        }
+        rendered_rows.push(row);
+    }
+
+    assert!(
+        rendered_rows.iter().all(|row| !row.contains("STALE")),
+        "rendered buffer should not retain stale glyphs: {rendered_rows:?}",
+    );
+    assert!(
+        rendered_rows
+            .first()
+            .is_some_and(|row| row.contains("fresh")),
+        "expected fresh content in first row: {rendered_rows:?}",
+    );
+}
+
+#[test]
+fn agent_markdown_cell_survives_insert_history_rewrap() {
+    let source = "\
+  Canary rollout remained at limited traffic longer than planned because p95
+  latency briefly regressed during cold-cache periods.
+  Regional expansion succeeded with stable error rates, though internal
+  analytics lagged temporarily.
+  ";
+    let cell = AgentMarkdownCell::new(source.to_string(), &test_cwd());
+    let width: u16 = 80;
+    let lines = cell.display_lines(width);
+
+    // Simulate what insert_history_lines does: word_wrap_lines with
+    // the terminal width and no indent.
+    let rewrapped = word_wrap_lines(&lines, width as usize);
+    let before = render_lines(&lines);
+    let after = render_lines(&rewrapped);
+    assert_eq!(
+        before, after,
+        "word_wrap_lines should not alter lines that already fit within width"
+    );
+}
+
+/// Simulate the consolidation backward-walk logic from `App::handle_event`
+/// to verify it correctly identifies and replaces `AgentMessageCell` runs.
+#[test]
+fn consolidation_walker_replaces_agent_message_cells() {
+    use std::sync::Arc;
+
+    // Build a transcript with: [UserCell, AgentMsg(head), AgentMsg(cont), AgentMsg(cont)]
+    let user = Arc::new(UserHistoryCell {
+        message: "hello".to_string(),
+        text_elements: Vec::new(),
+        local_image_paths: Vec::new(),
+        remote_image_urls: Vec::new(),
+    }) as Arc<dyn HistoryCell>;
+    let head = Arc::new(AgentMessageCell::new(
+        vec![Line::from("line 1")],
+        /*is_first_line*/ true,
+    )) as Arc<dyn HistoryCell>;
+    let cont1 = Arc::new(AgentMessageCell::new(
+        vec![Line::from("line 2")],
+        /*is_first_line*/ false,
+    )) as Arc<dyn HistoryCell>;
+    let cont2 = Arc::new(AgentMessageCell::new(
+        vec![Line::from("line 3")],
+        /*is_first_line*/ false,
+    )) as Arc<dyn HistoryCell>;
+
+    let mut transcript_cells: Vec<Arc<dyn HistoryCell>> = vec![user.clone(), head, cont1, cont2];
+
+    // Run the same consolidation logic as the handler.
+    let source = "line 1\nline 2\nline 3\n".to_string();
+    let end = transcript_cells.len();
+    let mut start = end;
+    while start > 0
+        && transcript_cells[start - 1].is_stream_continuation()
+        && transcript_cells[start - 1]
+            .as_any()
+            .is::<AgentMessageCell>()
+    {
+        start -= 1;
+    }
+    if start > 0
+        && transcript_cells[start - 1]
+            .as_any()
+            .is::<AgentMessageCell>()
+        && !transcript_cells[start - 1].is_stream_continuation()
+    {
+        start -= 1;
+    }
+
+    assert_eq!(
+        start, 1,
+        "should find all 3 agent cells starting at index 1"
+    );
+    assert_eq!(end, 4);
+
+    // Splice.
+    let consolidated: Arc<dyn HistoryCell> = Arc::new(AgentMarkdownCell::new(source, &test_cwd()));
+    transcript_cells.splice(start..end, std::iter::once(consolidated));
+
+    assert_eq!(transcript_cells.len(), 2, "should be [user, consolidated]");
+
+    // Verify first cell is still the user cell.
+    assert!(
+        transcript_cells[0].as_any().is::<UserHistoryCell>(),
+        "first cell should be UserHistoryCell"
+    );
+
+    // Verify second cell is AgentMarkdownCell.
+    assert!(
+        transcript_cells[1].as_any().is::<AgentMarkdownCell>(),
+        "second cell should be AgentMarkdownCell"
+    );
+}
diff --git a/codex-rs/tui/src/ide_context/prompt.rs b/codex-rs/tui/src/ide_context/prompt.rs
index ec7e165ba8..884ebfb646 100644
--- a/codex-rs/tui/src/ide_context/prompt.rs
+++ b/codex-rs/tui/src/ide_context/prompt.rs
@@ -269,6 +269,7 @@ mod tests {
         let mut items = vec![
             UserInput::LocalImage {
                 path: PathBuf::from("/tmp/screenshot.png"),
+                detail: None,
             },
             UserInput::Text {
                 text,
@@ -288,6 +289,7 @@ mod tests {
             vec![
                 UserInput::LocalImage {
                     path: PathBuf::from("/tmp/screenshot.png"),
+                    detail: None,
                 },
                 UserInput::Text {
                     text: format!("{expected_prefix}Ask $figma"),
diff --git a/codex-rs/tui/src/keymap.rs b/codex-rs/tui/src/keymap.rs
index fbac160967..533e28f3a2 100644
--- a/codex-rs/tui/src/keymap.rs
+++ b/codex-rs/tui/src/keymap.rs
@@ -1445,10 +1445,7 @@ const MAIN_RESERVED_BINDINGS: &[(&str, KeyBinding)] = &[
         "fixed.cycle_collaboration_mode",
         key_hint::shift(KeyCode::Tab),
     ),
-    (
-        "fixed.return_from_side_or_backtrack",
-        key_hint::plain(KeyCode::Esc),
-    ),
+    ("fixed.backtrack", key_hint::plain(KeyCode::Esc)),
     ("fixed.previous_agent", key_hint::alt(KeyCode::Left)),
     ("fixed.next_agent", key_hint::alt(KeyCode::Right)),
     ("fixed.slash_command", key_hint::plain(KeyCode::Char('/'))),
diff --git a/codex-rs/tui/src/lib.rs b/codex-rs/tui/src/lib.rs
index 97c7d023f5..4281ad2923 100644
--- a/codex-rs/tui/src/lib.rs
+++ b/codex-rs/tui/src/lib.rs
@@ -7,13 +7,14 @@ use crate::legacy_core::check_execpolicy_for_warnings;
 use crate::legacy_core::config::Config;
 use crate::legacy_core::config::ConfigBuilder;
 use crate::legacy_core::config::ConfigOverrides;
-use crate::legacy_core::config::find_codex_home;
-use crate::legacy_core::config::load_config_as_toml_with_cli_and_loader_overrides;
+use crate::legacy_core::config::load_config_as_toml_with_cli_and_load_options;
 use crate::legacy_core::config::resolve_oss_provider;
+use crate::legacy_core::config::resolve_profile_v2_config_path;
 use crate::legacy_core::format_exec_policy_error_with_source;
 use crate::legacy_core::windows_sandbox::WindowsSandboxLevelExt;
 use crate::session_resume::ResolveCwdOutcome;
 use crate::session_resume::resolve_cwd_for_resume_or_fork;
+pub use crate::startup_error::LocalStateDbStartupError;
 use additional_dirs::add_dir_warning_message;
 use app::App;
 pub use app::AppExitInfo;
@@ -55,6 +56,7 @@ use codex_rollout::state_db;
 use codex_state::log_db;
 use codex_utils_absolute_path::AbsolutePathBuf;
 use codex_utils_absolute_path::canonicalize_existing_preserving_symlinks;
+use codex_utils_home_dir::find_codex_home;
 use codex_utils_oss::ensure_oss_provider_ready;
 use codex_utils_oss::get_default_model_for_oss_provider;
 use color_eyre::eyre::WrapErr;
@@ -110,6 +112,7 @@ mod clipboard_copy;
 mod clipboard_paste;
 mod collaboration_modes;
 mod color;
+mod config_update;
 pub(crate) mod custom_terminal;
 mod pets;
 pub use custom_terminal::Terminal;
@@ -166,6 +169,7 @@ mod session_state;
 mod shimmer;
 mod skills_helpers;
 mod slash_command;
+mod startup_error;
 mod startup_hooks_review;
 mod status;
 mod status_indicator_widget;
@@ -282,6 +286,7 @@ async fn start_embedded_app_server(
     config: Config,
     cli_kv_overrides: Vec<(String, toml::Value)>,
     loader_overrides: LoaderOverrides,
+    strict_config: bool,
     cloud_requirements: CloudRequirementsLoader,
     feedback: codex_feedback::CodexFeedback,
     log_db: Option<log_db::LogDbLayer>,
@@ -293,6 +298,7 @@ async fn start_embedded_app_server(
         config,
         cli_kv_overrides,
         loader_overrides,
+        strict_config,
         cloud_requirements,
         feedback,
         log_db,
@@ -309,6 +315,21 @@ pub(crate) enum AppServerTarget {
     Remote { endpoint: RemoteAppServerEndpoint },
 }
 
+async fn init_state_db_for_app_server_target(
+    config: &Config,
+    app_server_target: &AppServerTarget,
+) -> std::io::Result<Option<StateDbHandle>> {
+    match app_server_target {
+        AppServerTarget::Embedded => state_db::try_init(config).await.map(Some).map_err(|err| {
+            std::io::Error::other(LocalStateDbStartupError::new(
+                codex_state::state_db_path(config.sqlite_home.as_path()),
+                err.to_string(),
+            ))
+        }),
+        AppServerTarget::Remote { .. } => Ok(state_db::get_state_db(config).await),
+    }
+}
+
 fn remote_addr_has_explicit_port(addr: &str, parsed: &Url) -> bool {
     let Some(host) = parsed.host_str() else {
         return false;
@@ -453,6 +474,7 @@ async fn start_app_server(
     config: Config,
     cli_kv_overrides: Vec<(String, toml::Value)>,
     loader_overrides: LoaderOverrides,
+    strict_config: bool,
     cloud_requirements: CloudRequirementsLoader,
     feedback: codex_feedback::CodexFeedback,
     log_db: Option<log_db::LogDbLayer>,
@@ -465,6 +487,7 @@ async fn start_app_server(
             config,
             cli_kv_overrides,
             loader_overrides,
+            strict_config,
             cloud_requirements,
             feedback,
             log_db,
@@ -489,6 +512,7 @@ pub(crate) async fn start_app_server_for_picker(
         config.clone(),
         Vec::new(),
         LoaderOverrides::default(),
+        /*strict_config*/ false,
         CloudRequirementsLoader::default(),
         codex_feedback::CodexFeedback::new(),
         /*log_db*/ None,
@@ -503,7 +527,7 @@ pub(crate) async fn start_app_server_for_picker(
 pub(crate) async fn start_embedded_app_server_for_picker(
     config: &Config,
 ) -> color_eyre::Result<AppServerSession> {
-    let state_db = state_db::init(config).await;
+    let state_db = init_state_db_for_app_server_target(config, &AppServerTarget::Embedded).await?;
     start_app_server_for_picker(
         config,
         &AppServerTarget::Embedded,
@@ -519,6 +543,7 @@ async fn start_embedded_app_server_with<F, Fut>(
     config: Config,
     cli_kv_overrides: Vec<(String, toml::Value)>,
     loader_overrides: LoaderOverrides,
+    strict_config: bool,
     cloud_requirements: CloudRequirementsLoader,
     feedback: codex_feedback::CodexFeedback,
     log_db: Option<log_db::LogDbLayer>,
@@ -545,6 +570,7 @@ where
         config: Arc::new(config),
         cli_overrides: cli_kv_overrides,
         loader_overrides,
+        strict_config,
         cloud_requirements,
         feedback,
         log_db,
@@ -759,6 +785,7 @@ pub async fn run_main(
     loader_overrides: LoaderOverrides,
     explicit_remote_endpoint: Option<RemoteAppServerEndpoint>,
 ) -> std::io::Result<AppExitInfo> {
+    let strict_config = cli.strict_config;
     let (sandbox_mode, approval_policy) = if cli.dangerously_bypass_approvals_and_sandbox {
         (
             Some(SandboxMode::DangerFullAccess),
@@ -825,22 +852,31 @@ pub async fn run_main(
     )?;
     let environment_manager =
         if should_load_configured_environments(&loader_overrides, &app_server_target) {
-            EnvironmentManager::from_codex_home(codex_home.clone(), local_runtime_paths).await
+            EnvironmentManager::from_codex_home(codex_home.clone(), Some(local_runtime_paths)).await
         } else {
-            EnvironmentManager::from_env(local_runtime_paths).await
+            EnvironmentManager::from_env(Some(local_runtime_paths)).await
         }
         .map(Arc::new)
         .map_err(std::io::Error::other)?;
     let cwd = cli.cwd.clone();
     let config_cwd =
         config_cwd_for_app_server_target(cwd.as_deref(), &app_server_target, &environment_manager)?;
+    let mut loader_overrides = loader_overrides;
+    if let Some(profile_v2) = cli.config_profile_v2.as_ref() {
+        let user_config_path = resolve_profile_v2_config_path(&codex_home, profile_v2);
+        loader_overrides.user_config_path = Some(user_config_path);
+        loader_overrides.user_config_profile = Some(profile_v2.clone());
+    }
 
     #[allow(clippy::print_stderr)]
-    let config_toml = match load_config_as_toml_with_cli_and_loader_overrides(
+    let config_toml = match load_config_as_toml_with_cli_and_load_options(
         &codex_home,
         config_cwd.as_ref(),
         cli_kv_overrides.clone(),
-        loader_overrides.clone(),
+        codex_config::ConfigLoadOptions {
+            loader_overrides: loader_overrides.clone(),
+            strict_config,
+        },
     )
     .await
     {
@@ -935,7 +971,9 @@ pub async fn run_main(
     let mut config = load_config_or_exit(
         cli_kv_overrides.clone(),
         overrides.clone(),
+        loader_overrides.clone(),
         cloud_requirements.clone(),
+        strict_config,
     )
     .await;
 
@@ -969,10 +1007,7 @@ pub async fn run_main(
         otel.as_ref(),
         otel_originator.as_str(),
     );
-    let state_db = match &app_server_target {
-        AppServerTarget::Embedded => state_db::init(&config).await,
-        AppServerTarget::Remote { .. } => state_db::get_state_db(&config).await,
-    };
+    let state_db = init_state_db_for_app_server_target(&config, &app_server_target).await?;
 
     let effective_toml = config.config_layer_stack.effective_config();
     match effective_toml.try_into() {
@@ -990,7 +1025,9 @@ pub async fn run_main(
                     config = load_config_or_exit(
                         cli_kv_overrides.clone(),
                         overrides.clone(),
+                        loader_overrides.clone(),
                         cloud_requirements.clone(),
+                        strict_config,
                     )
                     .await;
                 }
@@ -1025,7 +1062,7 @@ pub async fn run_main(
 
     if let Some(warning) = add_dir_warning_message(
         &cli.add_dir,
-        &config.permissions.permission_profile(),
+        &config.permissions.effective_permission_profile(),
         config.cwd.as_path(),
     ) {
         #[allow(clippy::print_stderr)]
@@ -1051,7 +1088,7 @@ pub async fn run_main(
         }
     }
 
-    let log_dir = crate::legacy_core::config::log_dir(&config)?;
+    let log_dir = config.log_dir.clone();
     std::fs::create_dir_all(&log_dir)?;
     // Open (or create) your log file, appending to it.
     let mut log_file_opts = OpenOptions::new();
@@ -1133,6 +1170,7 @@ pub async fn run_main(
         cli,
         arg0_paths,
         loader_overrides,
+        strict_config,
         app_server_target,
         remote_cwd_override,
         config,
@@ -1154,6 +1192,7 @@ async fn run_ratatui_app(
     cli: Cli,
     arg0_paths: Arg0DispatchPaths,
     loader_overrides: LoaderOverrides,
+    strict_config: bool,
     app_server_target: AppServerTarget,
     remote_cwd_override: Option<PathBuf>,
     initial_config: Config,
@@ -1180,10 +1219,13 @@ async fn run_ratatui_app(
         tracing::error!("panic: {info}");
         prev_hook(info);
     }));
-    let mut terminal = tui::init()?;
-    terminal.clear()?;
+    let mut initialized_terminal = tui::init()?;
+    initialized_terminal.terminal.clear()?;
 
-    let mut tui = Tui::new(terminal);
+    let mut tui = Tui::new(
+        initialized_terminal.terminal,
+        initialized_terminal.enhanced_keys_supported,
+    );
     let mut terminal_restore_guard = TerminalRestoreGuard::new();
 
     #[cfg(not(debug_assertions))]
@@ -1217,6 +1259,7 @@ async fn run_ratatui_app(
         initial_config.clone(),
         cli_kv_overrides.clone(),
         loader_overrides.clone(),
+        strict_config,
         cloud_requirements.clone(),
         feedback.clone(),
         log_db.clone(),
@@ -1303,7 +1346,9 @@ async fn run_ratatui_app(
             load_config_or_exit(
                 cli_kv_overrides.clone(),
                 overrides.clone(),
+                loader_overrides.clone(),
                 cloud_requirements.clone(),
+                strict_config,
             )
             .await
         } else {
@@ -1505,7 +1550,9 @@ async fn run_ratatui_app(
             load_config_or_exit_with_fallback_cwd(
                 cli_kv_overrides.clone(),
                 overrides.clone(),
+                loader_overrides.clone(),
                 cloud_requirements.clone(),
+                strict_config,
                 fallback_cwd,
             )
             .await
@@ -1514,7 +1561,9 @@ async fn run_ratatui_app(
             load_config_or_exit(
                 cli_kv_overrides.clone(),
                 overrides.clone(),
+                loader_overrides.clone(),
                 cloud_requirements.clone(),
+                strict_config,
             )
             .await
         }
@@ -1555,7 +1604,8 @@ async fn run_ratatui_app(
             arg0_paths,
             config.clone(),
             cli_kv_overrides.clone(),
-            loader_overrides,
+            loader_overrides.clone(),
+            strict_config,
             cloud_requirements.clone(),
             feedback.clone(),
             log_db.clone(),
@@ -1586,6 +1636,7 @@ async fn run_ratatui_app(
         config,
         cli_kv_overrides.clone(),
         overrides.clone(),
+        loader_overrides.clone(),
         active_profile,
         prompt,
         images,
@@ -1696,12 +1747,16 @@ async fn get_login_status(
 async fn load_config_or_exit(
     cli_kv_overrides: Vec<(String, toml::Value)>,
     overrides: ConfigOverrides,
+    loader_overrides: LoaderOverrides,
     cloud_requirements: CloudRequirementsLoader,
+    strict_config: bool,
 ) -> Config {
     load_config_or_exit_with_fallback_cwd(
         cli_kv_overrides,
         overrides,
+        loader_overrides,
         cloud_requirements,
+        strict_config,
         /*fallback_cwd*/ None,
     )
     .await
@@ -1710,13 +1765,17 @@ async fn load_config_or_exit(
 async fn load_config_or_exit_with_fallback_cwd(
     cli_kv_overrides: Vec<(String, toml::Value)>,
     overrides: ConfigOverrides,
+    loader_overrides: LoaderOverrides,
     cloud_requirements: CloudRequirementsLoader,
+    strict_config: bool,
     fallback_cwd: Option<PathBuf>,
 ) -> Config {
     #[allow(clippy::print_stderr)]
     match ConfigBuilder::default()
         .cli_overrides(cli_kv_overrides)
         .harness_overrides(overrides)
+        .loader_overrides(loader_overrides)
+        .strict_config(strict_config)
         .cloud_requirements(cloud_requirements)
         .fallback_cwd(fallback_cwd)
         .build()
@@ -1782,12 +1841,14 @@ mod tests {
     async fn start_test_embedded_app_server(
         config: Config,
     ) -> color_eyre::Result<InProcessAppServerClient> {
-        let state_db = state_db::init(&config).await;
+        let state_db =
+            init_state_db_for_app_server_target(&config, &AppServerTarget::Embedded).await?;
         start_embedded_app_server(
             Arg0DispatchPaths::default(),
             config,
             Vec::new(),
             LoaderOverrides::default(),
+            /*strict_config*/ false,
             CloudRequirementsLoader::default(),
             codex_feedback::CodexFeedback::new(),
             /*log_db*/ None,
@@ -2230,10 +2291,10 @@ mod tests {
         let target = AppServerTarget::Embedded;
         let environment_manager = EnvironmentManager::create_for_tests(
             Some("ws://127.0.0.1:8765".to_string()),
-            ExecServerRuntimePaths::new(
+            Some(ExecServerRuntimePaths::new(
                 std::env::current_exe().expect("current exe"),
                 /*codex_linux_sandbox_exe*/ None,
-            )?,
+            )?),
         )
         .await;
 
@@ -2353,6 +2414,7 @@ mod tests {
             config,
             Vec::new(),
             LoaderOverrides::default(),
+            /*strict_config*/ false,
             CloudRequirementsLoader::default(),
             codex_feedback::CodexFeedback::new(),
             /*log_db*/ None,
@@ -2373,6 +2435,37 @@ mod tests {
         );
         Ok(())
     }
+
+    #[tokio::test]
+    async fn embedded_state_db_failure_is_typed_for_cli_recovery() -> color_eyre::Result<()> {
+        let temp_dir = TempDir::new()?;
+        let mut config = build_config(&temp_dir).await?;
+        let occupied_sqlite_home = temp_dir.path().join("sqlite-home");
+        std::fs::write(&occupied_sqlite_home, "occupied")?;
+        config.sqlite_home = occupied_sqlite_home.clone();
+
+        let err =
+            match init_state_db_for_app_server_target(&config, &AppServerTarget::Embedded).await {
+                Ok(_) => panic!("embedded startup should surface state db init failures"),
+                Err(err) => err,
+            };
+        let startup_error = err
+            .get_ref()
+            .and_then(|err| err.downcast_ref::<LocalStateDbStartupError>())
+            .expect("state db startup failure should retain its typed context");
+
+        assert_eq!(
+            startup_error.state_db_path(),
+            codex_state::state_db_path(occupied_sqlite_home.as_path()).as_path()
+        );
+        assert!(
+            startup_error
+                .detail()
+                .contains("failed to initialize state runtime"),
+            "startup error should preserve the underlying state db failure"
+        );
+        Ok(())
+    }
     #[tokio::test]
     #[serial]
     async fn windows_shows_trust_prompt_with_sandbox() -> std::io::Result<()> {
diff --git a/codex-rs/tui/src/local_chatgpt_auth.rs b/codex-rs/tui/src/local_chatgpt_auth.rs
index 1f84b289a7..270d64f5f7 100644
--- a/codex-rs/tui/src/local_chatgpt_auth.rs
+++ b/codex-rs/tui/src/local_chatgpt_auth.rs
@@ -16,7 +16,7 @@ pub(crate) struct LocalChatgptAuth {
 pub(crate) fn load_local_chatgpt_auth(
     codex_home: &Path,
     auth_credentials_store_mode: AuthCredentialsStoreMode,
-    forced_chatgpt_workspace_id: Option<&str>,
+    forced_chatgpt_workspace_id: Option<&[String]>,
 ) -> Result<LocalChatgptAuth, String> {
     let auth = load_auth_dot_json(codex_home, auth_credentials_store_mode)
         .map_err(|err| format!("failed to load local auth: {err}"))?
@@ -33,11 +33,11 @@ pub(crate) fn load_local_chatgpt_auth(
         .account_id
         .or(tokens.id_token.chatgpt_account_id.clone())
         .ok_or_else(|| "local ChatGPT auth is missing chatgpt account id".to_string())?;
-    if let Some(expected_workspace) = forced_chatgpt_workspace_id
-        && chatgpt_account_id != expected_workspace
+    if let Some(expected_workspaces) = forced_chatgpt_workspace_id
+        && !expected_workspaces.contains(&chatgpt_account_id)
     {
         return Err(format!(
-            "local ChatGPT auth must use workspace {expected_workspace}, but found {chatgpt_account_id:?}"
+            "local ChatGPT auth must use one of workspace(s) {expected_workspaces:?}, but found {chatgpt_account_id:?}",
         ));
     }
 
@@ -122,7 +122,7 @@ mod tests {
         let auth = load_local_chatgpt_auth(
             codex_home.path(),
             AuthCredentialsStoreMode::File,
-            Some("workspace-1"),
+            Some(&["workspace-1".to_string()]),
         )
         .expect("chatgpt auth should load");
 
@@ -186,7 +186,7 @@ mod tests {
         let auth = load_local_chatgpt_auth(
             codex_home.path(),
             AuthCredentialsStoreMode::File,
-            Some("workspace-1"),
+            Some(&["workspace-1".to_string(), "workspace-2".to_string()]),
         )
         .expect("managed auth should win");
 
@@ -202,7 +202,7 @@ mod tests {
         let auth = load_local_chatgpt_auth(
             codex_home.path(),
             AuthCredentialsStoreMode::File,
-            Some("workspace-1"),
+            Some(&["workspace-1".to_string()]),
         )
         .expect("chatgpt auth should load");
 
diff --git a/codex-rs/tui/src/main.rs b/codex-rs/tui/src/main.rs
index 8574b16f8a..9c69c7c81a 100644
--- a/codex-rs/tui/src/main.rs
+++ b/codex-rs/tui/src/main.rs
@@ -1,5 +1,4 @@
 use clap::Parser;
-use codex_app_server_client::legacy_core;
 use codex_arg0::Arg0DispatchPaths;
 use codex_arg0::arg0_dispatch_or_else;
 use codex_config::LoaderOverrides;
@@ -8,12 +7,14 @@ use codex_tui::Cli;
 use codex_tui::ExitReason;
 use codex_tui::run_main;
 use codex_utils_cli::CliConfigOverrides;
+use codex_utils_cli::resume_hint;
 use supports_color::Stream;
 
 fn format_exit_messages(exit_info: AppExitInfo, color_enabled: bool) -> Vec<String> {
     let AppExitInfo {
         token_usage,
         thread_id,
+        thread_name,
         ..
     } = exit_info;
 
@@ -22,9 +23,7 @@ fn format_exit_messages(exit_info: AppExitInfo, color_enabled: bool) -> Vec<Stri
         lines.push(token_usage.to_string());
     }
 
-    if let Some(resume_cmd) =
-        legacy_core::util::resume_command(/*thread_name*/ None, thread_id)
-    {
+    if let Some(resume_cmd) = resume_hint(thread_name.as_deref(), thread_id) {
         let command = if color_enabled {
             format!("\u{1b}[36m{resume_cmd}\u{1b}[39m")
         } else {
diff --git a/codex-rs/tui/src/onboarding/auth.rs b/codex-rs/tui/src/onboarding/auth.rs
index 91362bf5a5..8486de32b4 100644
--- a/codex-rs/tui/src/onboarding/auth.rs
+++ b/codex-rs/tui/src/onboarding/auth.rs
@@ -1056,6 +1056,7 @@ mod tests {
             config: Arc::new(config),
             cli_overrides: Vec::new(),
             loader_overrides: Default::default(),
+            strict_config: false,
             cloud_requirements: cloud_requirements_loader_for_storage(
                 codex_home_path.clone(),
                 /*enable_codex_api_key_env*/ false,
diff --git a/codex-rs/tui/src/pager_overlay.rs b/codex-rs/tui/src/pager_overlay.rs
index be8629542e..c301700eaa 100644
--- a/codex-rs/tui/src/pager_overlay.rs
+++ b/codex-rs/tui/src/pager_overlay.rs
@@ -1133,7 +1133,7 @@ mod tests {
         cells.push(apply_begin_cell);
 
         let apply_end_cell: Arc<dyn HistoryCell> = history_cell::new_approval_decision_cell(
-            vec!["ls".into()],
+            history_cell::ApprovalDecisionSubject::Command(vec!["ls".into()]),
             ReviewDecision::Approved,
             history_cell::ApprovalDecisionActor::User,
         )
diff --git a/codex-rs/tui/src/permission_compat.rs b/codex-rs/tui/src/permission_compat.rs
index 93dc40e19f..953793feba 100644
--- a/codex-rs/tui/src/permission_compat.rs
+++ b/codex-rs/tui/src/permission_compat.rs
@@ -44,22 +44,21 @@ pub(crate) fn legacy_compatible_permission_profile(
 #[cfg(test)]
 mod tests {
     use super::*;
-    use codex_app_server_protocol::FileSystemAccessMode;
-    use codex_app_server_protocol::FileSystemPath;
-    use codex_app_server_protocol::FileSystemSandboxEntry;
-    use codex_app_server_protocol::FileSystemSpecialPath;
-    use codex_app_server_protocol::PermissionProfile as AppServerPermissionProfile;
-    use codex_app_server_protocol::PermissionProfileFileSystemPermissions;
-    use codex_app_server_protocol::PermissionProfileNetworkPermissions;
+    use codex_protocol::models::ManagedFileSystemPermissions;
+    use codex_protocol::permissions::FileSystemAccessMode;
+    use codex_protocol::permissions::FileSystemPath;
+    use codex_protocol::permissions::FileSystemSandboxEntry;
+    use codex_protocol::permissions::FileSystemSpecialPath;
+    use codex_protocol::permissions::NetworkSandboxPolicy;
     use pretty_assertions::assert_eq;
 
     #[test]
     fn compatibility_profile_preserves_unbridgeable_write_roots() {
         let cwd = AbsolutePathBuf::try_from("/workspace/project").expect("absolute cwd");
         let extra_root = AbsolutePathBuf::try_from("/workspace/extra").expect("absolute root");
-        let permission_profile: PermissionProfile = AppServerPermissionProfile::Managed {
-            network: PermissionProfileNetworkPermissions { enabled: false },
-            file_system: PermissionProfileFileSystemPermissions::Restricted {
+        let permission_profile: PermissionProfile = PermissionProfile::Managed {
+            network: NetworkSandboxPolicy::Restricted,
+            file_system: ManagedFileSystemPermissions::Restricted {
                 entries: vec![
                     FileSystemSandboxEntry {
                         path: FileSystemPath::Special {
@@ -76,8 +75,7 @@ mod tests {
                 ],
                 glob_scan_max_depth: None,
             },
-        }
-        .into();
+        };
 
         let compatibility_profile =
             legacy_compatible_permission_profile(&permission_profile, cwd.as_path());
diff --git a/codex-rs/tui/src/pets/image_protocol.rs b/codex-rs/tui/src/pets/image_protocol.rs
index 25a20c3528..06b6fc77bc 100644
--- a/codex-rs/tui/src/pets/image_protocol.rs
+++ b/codex-rs/tui/src/pets/image_protocol.rs
@@ -21,6 +21,7 @@ const ESC: &str = "\x1b";
 const ST: &str = "\x1b\\";
 const KITTY_CHUNK_SIZE: usize = 4096;
 const SIXEL_CACHE_VERSION: &str = "v2";
+const ITERM2_KITTY_MIN_VERSION: (u64, u64, u64) = (3, 6, 0);
 
 #[derive(Debug, Clone, Copy, PartialEq, Eq)]
 pub enum ImageProtocol {
@@ -55,6 +56,7 @@ impl PetImageSupport {
 pub(crate) enum PetImageUnsupportedReason {
     Tmux,
     Zellij,
+    Iterm2TooOld,
     Terminal,
 }
 
@@ -67,6 +69,9 @@ impl PetImageUnsupportedReason {
             Self::Zellij => {
                 "Pets are disabled in Zellij. Terminal images don’t stay reliably pane-local in Zellij. Run Codex outside Zellij to use pets."
             }
+            Self::Iterm2TooOld => {
+                "Pets require iTerm2 3.6 or newer. Upgrade iTerm2 to use terminal pets."
+            }
             Self::Terminal => {
                 "Pets aren’t available in this terminal. Terminal pets need image support, and this terminal environment doesn’t expose a supported image protocol. Try a terminal with Kitty graphics or Sixel support, or run Codex outside tmux."
             }
@@ -132,7 +137,7 @@ fn pet_image_support_for_terminal(info: &TerminalInfo) -> PetImageSupport {
         Some(Multiplexer::Tmux { .. }) => {
             return PetImageSupport::Unsupported(PetImageUnsupportedReason::Tmux);
         }
-        Some(Multiplexer::Zellij {}) => {
+        Some(Multiplexer::Zellij { .. }) => {
             return PetImageSupport::Unsupported(PetImageUnsupportedReason::Zellij);
         }
         None => {}
@@ -142,6 +147,10 @@ fn pet_image_support_for_terminal(info: &TerminalInfo) -> PetImageSupport {
         return PetImageSupport::Supported(ImageProtocol::KittyLocalFile);
     }
 
+    if is_iterm2_terminal(info) {
+        return PetImageSupport::Unsupported(PetImageUnsupportedReason::Iterm2TooOld);
+    }
+
     if supports_kitty_graphics(info) {
         return PetImageSupport::Supported(ImageProtocol::Kitty);
     }
@@ -154,6 +163,14 @@ fn pet_image_support_for_terminal(info: &TerminalInfo) -> PetImageSupport {
 }
 
 fn supports_iterm2_kitty_graphics(info: &TerminalInfo) -> bool {
+    is_iterm2_terminal(info)
+        && version_is_at_least(
+            info.version.as_deref(),
+            /*minimum*/ ITERM2_KITTY_MIN_VERSION,
+        )
+}
+
+fn is_iterm2_terminal(info: &TerminalInfo) -> bool {
     matches!(info.name, TerminalName::Iterm2)
         || terminal_field_contains(info.term_program.as_deref(), "iterm")
 }
@@ -181,6 +198,24 @@ fn terminal_field_contains(value: Option<&str>, needle: &str) -> bool {
     value.is_some_and(|value| value.to_ascii_lowercase().contains(needle))
 }
 
+fn version_is_at_least(version: Option<&str>, minimum: (u64, u64, u64)) -> bool {
+    parse_dotted_version(version).is_some_and(|version| version >= minimum)
+}
+
+fn parse_dotted_version(version: Option<&str>) -> Option<(u64, u64, u64)> {
+    let version = version?;
+    let mut parts = version.split('.');
+    let major = parts.next()?.parse().ok()?;
+    let minor = parts.next().unwrap_or("0").parse().ok()?;
+    let patch = parts.next().unwrap_or("0").parse().ok()?;
+
+    if parts.next().is_some() {
+        return None;
+    }
+
+    Some((major, minor, patch))
+}
+
 pub fn kitty_delete_image(image_id: u32) -> String {
     wrap_for_tmux_if_needed(&format!("{ESC}_Ga=d,d=I,i={image_id},q=2;{ST}"))
 }
@@ -389,7 +424,7 @@ mod tests {
         assert_eq!(
             pet_image_support_for_terminal(&terminal_info_for_test(
                 TerminalName::Kitty,
-                Some(Multiplexer::Zellij {}),
+                Some(Multiplexer::Zellij { version: None }),
                 Some("kitty"),
                 /*term*/ None,
             )),
@@ -400,16 +435,18 @@ mod tests {
     #[test]
     fn pet_image_support_detects_iterm2_kitty_file_graphics() {
         for info in [
-            terminal_info_for_test(
+            terminal_info_with_version_for_test(
                 TerminalName::Iterm2,
                 /*multiplexer*/ None,
                 Some("iTerm.app"),
+                Some("3.6.10"),
                 /*term*/ None,
             ),
-            terminal_info_for_test(
+            terminal_info_with_version_for_test(
                 TerminalName::Unknown,
                 /*multiplexer*/ None,
                 Some("iTerm.app"),
+                Some("3.6.10"),
                 Some("xterm-256color"),
             ),
         ] {
@@ -420,6 +457,49 @@ mod tests {
         }
     }
 
+    #[test]
+    fn pet_image_support_rejects_old_iterm2_versions() {
+        for info in [
+            terminal_info_with_version_for_test(
+                TerminalName::Iterm2,
+                /*multiplexer*/ None,
+                Some("iTerm.app"),
+                Some("3.5.14"),
+                /*term*/ None,
+            ),
+            terminal_info_with_version_for_test(
+                TerminalName::Unknown,
+                /*multiplexer*/ None,
+                Some("iTerm.app"),
+                /*version*/ None,
+                Some("xterm-256color"),
+            ),
+            terminal_info_with_version_for_test(
+                TerminalName::Iterm2,
+                /*multiplexer*/ None,
+                Some("iTerm.app"),
+                Some("3.5"),
+                /*term*/ None,
+            ),
+        ] {
+            assert_eq!(
+                pet_image_support_for_terminal(&info),
+                PetImageSupport::Unsupported(PetImageUnsupportedReason::Iterm2TooOld)
+            );
+        }
+    }
+
+    #[test]
+    fn pet_image_support_old_iterm2_message_mentions_upgrade() {
+        let message = PetImageSupport::Unsupported(PetImageUnsupportedReason::Iterm2TooOld)
+            .unsupported_message();
+
+        assert_eq!(
+            message,
+            Some("Pets require iTerm2 3.6 or newer. Upgrade iTerm2 to use terminal pets.")
+        );
+    }
+
     #[test]
     fn pet_image_support_detects_kitty_graphics_terminals() {
         for info in [
@@ -538,16 +618,42 @@ mod tests {
         multiplexer: Option<Multiplexer>,
         term_program: Option<&str>,
         term: Option<&str>,
+    ) -> TerminalInfo {
+        terminal_info_with_version_for_test(
+            name,
+            multiplexer,
+            term_program,
+            /*version*/ None,
+            term,
+        )
+    }
+
+    fn terminal_info_with_version_for_test(
+        name: TerminalName,
+        multiplexer: Option<Multiplexer>,
+        term_program: Option<&str>,
+        version: Option<&str>,
+        term: Option<&str>,
     ) -> TerminalInfo {
         TerminalInfo {
             name,
             term_program: term_program.map(str::to_string),
-            version: /*version*/ None,
+            version: version.map(str::to_string),
             term: term.map(str::to_string),
             multiplexer,
         }
     }
 
+    #[test]
+    fn parse_dotted_version_requires_simple_numeric_components() {
+        assert_eq!(parse_dotted_version(Some("3.6.10")), Some((3, 6, 10)));
+        assert_eq!(parse_dotted_version(Some("3.6")), Some((3, 6, 0)));
+        assert_eq!(parse_dotted_version(Some("3")), Some((3, 0, 0)));
+        assert_eq!(parse_dotted_version(Some("3.6.10.1")), None);
+        assert_eq!(parse_dotted_version(Some("3.6beta")), None);
+        assert_eq!(parse_dotted_version(/*version*/ None), None);
+    }
+
     #[test]
     fn sixel_frame_encodes_without_external_crate() {
         let dir = tempfile::tempdir().unwrap();
diff --git a/codex-rs/tui/src/resume_picker.rs b/codex-rs/tui/src/resume_picker.rs
index 527c84a8e2..c7be652f85 100644
--- a/codex-rs/tui/src/resume_picker.rs
+++ b/codex-rs/tui/src/resume_picker.rs
@@ -477,6 +477,9 @@ async fn run_session_picker_with_loader(
                             return Ok(sel);
                         }
                     }
+                    TuiEvent::Paste(pasted) => {
+                        state.handle_paste(pasted);
+                    }
                     TuiEvent::Draw | TuiEvent::Resize => {
                         if let Ok(size) = alt.tui.terminal.size() {
                             let list_height =
@@ -489,7 +492,6 @@ async fn run_session_picker_with_loader(
                             state.open_pending_transcript_if_ready();
                         }
                     }
-                    _ => {}
                 }
             }
             Some(event) = background_events.next() => {
@@ -543,6 +545,11 @@ fn picker_cwd_filter(
     }
 }
 
+fn normalize_pasted_query(pasted: &str) -> Option<String> {
+    let normalized = pasted.split_whitespace().collect::<Vec<_>>().join(" ");
+    (!normalized.is_empty()).then_some(normalized)
+}
+
 fn spawn_app_server_page_loader(
     app_server: AppServerSession,
     include_non_interactive: bool,
@@ -1227,6 +1234,21 @@ impl PickerState {
         Ok(None)
     }
 
+    fn handle_paste(&mut self, pasted: String) {
+        if self.is_transcript_loading() {
+            return;
+        }
+        let Some(pasted) = normalize_pasted_query(&pasted) else {
+            return;
+        };
+        let mut new_query = self.query.clone();
+        if !new_query.is_empty() && !new_query.ends_with(char::is_whitespace) {
+            new_query.push(' ');
+        }
+        new_query.push_str(&pasted);
+        self.set_query(new_query);
+    }
+
     fn start_initial_load(&mut self) {
         self.relative_time_reference = Some(Utc::now());
         self.reset_pagination();
@@ -2929,12 +2951,12 @@ fn render_expanded_session_details(
     width: u16,
 ) -> Vec<Line<'static>> {
     let reference = state.relative_time_reference.unwrap_or_else(Utc::now);
-    let session = row
-        .thread_name
-        .as_deref()
-        .map(str::to_string)
-        .or_else(|| row.thread_id.map(|thread_id| thread_id.to_string()))
-        .unwrap_or_else(|| "-".to_string());
+    let session = match (row.thread_name.as_deref(), row.thread_id) {
+        (Some(thread_name), Some(thread_id)) => format!("{thread_name} ({thread_id})"),
+        (Some(thread_name), None) => thread_name.to_string(),
+        (None, Some(thread_id)) => thread_id.to_string(),
+        (None, None) => "-".to_string(),
+    };
     let directory = row
         .cwd
         .as_ref()
@@ -3387,7 +3409,9 @@ mod tests {
         let expected_directory =
             format_directory_display(row.cwd.as_deref().expect("cwd"), /*max_width*/ None);
 
-        assert!(rendered.contains("Session:    feat(tui): add raw scrollback mode"));
+        assert!(rendered.contains(
+            "Session:    feat(tui): add raw scrollback mode (019dabc1-0ef5-7431-b81c-03037f51f62c)"
+        ));
         assert!(rendered.contains("Created:    17 minutes ago · 2026-05-02 14:31:08"));
         assert!(rendered.contains("Updated:    now · 2026-05-02 14:48:19"));
         assert!(rendered.contains(&format!("Directory:  {expected_directory}")));
@@ -6216,6 +6240,87 @@ session_picker_view = "dense"
         assert!(state.pagination.reached_scan_cap);
     }
 
+    #[tokio::test]
+    async fn paste_appends_to_existing_query() {
+        let loader = page_only_loader(|_| {});
+        let mut state = PickerState::new(
+            FrameRequester::test_dummy(),
+            loader,
+            ProviderFilter::MatchDefault(String::from("openai")),
+            /*show_all*/ true,
+            /*filter_cwd*/ None,
+            SessionPickerAction::Resume,
+        );
+        state.query = String::from("resize");
+
+        state.handle_paste(String::from("results"));
+
+        assert_eq!(state.query, "resize results");
+    }
+
+    #[test]
+    fn normalize_pasted_query_collapses_whitespace() {
+        assert_eq!(
+            normalize_pasted_query("  alpha\n\tbeta\r\n gamma  "),
+            Some(String::from("alpha beta gamma"))
+        );
+    }
+
+    #[tokio::test]
+    async fn whitespace_only_paste_is_ignored() {
+        let loader = page_only_loader(|_| {});
+        let mut state = PickerState::new(
+            FrameRequester::test_dummy(),
+            loader,
+            ProviderFilter::MatchDefault(String::from("openai")),
+            /*show_all*/ true,
+            /*filter_cwd*/ None,
+            SessionPickerAction::Resume,
+        );
+        state.query = String::from("resize");
+
+        state.handle_paste(String::from("  \n\t  "));
+
+        assert_eq!(state.query, "resize");
+    }
+
+    #[tokio::test]
+    async fn paste_uses_existing_search_loading_path() {
+        let recorded_requests: Arc<Mutex<Vec<PageLoadRequest>>> = Arc::new(Mutex::new(Vec::new()));
+        let request_sink = recorded_requests.clone();
+        let loader = page_only_loader(move |req: PageLoadRequest| {
+            request_sink.lock().unwrap().push(req);
+        });
+
+        let mut state = PickerState::new(
+            FrameRequester::test_dummy(),
+            loader,
+            ProviderFilter::MatchDefault(String::from("openai")),
+            /*show_all*/ true,
+            /*filter_cwd*/ None,
+            SessionPickerAction::Resume,
+        );
+        state.reset_pagination();
+        state.ingest_page(page(
+            vec![make_row(
+                "/tmp/start.jsonl",
+                "2025-01-01T00:00:00Z",
+                "alpha",
+            )],
+            Some("2025-01-02T00:00:00Z"),
+            /*num_scanned_files*/ 1,
+            /*reached_scan_cap*/ false,
+        ));
+        recorded_requests.lock().unwrap().clear();
+
+        state.handle_paste(String::from("target"));
+
+        let guard = recorded_requests.lock().unwrap();
+        assert_eq!(state.query, "target");
+        assert_eq!(guard.len(), 1);
+        assert!(guard[0].search_token.is_some());
+    }
+
     #[tokio::test]
     async fn esc_with_empty_query_starts_fresh() {
         let loader = page_only_loader(|_| {});
diff --git a/codex-rs/tui/src/session_log.rs b/codex-rs/tui/src/session_log.rs
index b1f533a050..4acf2180ec 100644
--- a/codex-rs/tui/src/session_log.rs
+++ b/codex-rs/tui/src/session_log.rs
@@ -88,10 +88,7 @@ pub(crate) fn maybe_init(config: &Config) {
     let path = if let Ok(path) = std::env::var("CODEX_TUI_SESSION_LOG_PATH") {
         PathBuf::from(path)
     } else {
-        let mut p = match crate::legacy_core::config::log_dir(config) {
-            Ok(dir) => dir,
-            Err(_) => std::env::temp_dir(),
-        };
+        let mut p = config.log_dir.clone();
         let filename = format!(
             "session-{}.jsonl",
             chrono::Utc::now().format("%Y%m%dT%H%M%SZ")
diff --git a/codex-rs/tui/src/session_state.rs b/codex-rs/tui/src/session_state.rs
index e4d2dbab96..c9d964d620 100644
--- a/codex-rs/tui/src/session_state.rs
+++ b/codex-rs/tui/src/session_state.rs
@@ -34,17 +34,40 @@ pub(crate) struct ThreadSessionState {
     pub(crate) service_tier: Option<String>,
     pub(crate) approval_policy: AskForApproval,
     pub(crate) approvals_reviewer: codex_protocol::config_types::ApprovalsReviewer,
-    /// Canonical active permissions for this session. Legacy app-server
+    /// Permission snapshot used by TUI display surfaces. Legacy app-server
     /// responses are converted to a profile at ingestion time using the
     /// response cwd so cached sessions do not reinterpret cwd-bound grants.
+    /// Turn requests must not treat this snapshot as a local permission
+    /// override unless the user explicitly changed permissions in the TUI.
     pub(crate) permission_profile: PermissionProfile,
     /// Named or implicit built-in profile that produced `permission_profile`,
     /// when the server knows it.
     pub(crate) active_permission_profile: Option<ActivePermissionProfile>,
     pub(crate) cwd: AbsolutePathBuf,
+    pub(crate) runtime_workspace_roots: Vec<AbsolutePathBuf>,
     pub(crate) instruction_source_paths: Vec<AbsolutePathBuf>,
     pub(crate) reasoning_effort: Option<codex_protocol::openai_models::ReasoningEffort>,
     pub(crate) message_history: Option<MessageHistoryMetadata>,
     pub(crate) network_proxy: Option<SessionNetworkProxyRuntime>,
     pub(crate) rollout_path: Option<PathBuf>,
 }
+
+impl ThreadSessionState {
+    pub(crate) fn set_cwd_retargeting_implicit_runtime_workspace_root(
+        &mut self,
+        cwd: AbsolutePathBuf,
+    ) {
+        let previous_cwd = std::mem::replace(&mut self.cwd, cwd.clone());
+        if !self.runtime_workspace_roots.contains(&previous_cwd) {
+            return;
+        }
+
+        let previous_roots = std::mem::take(&mut self.runtime_workspace_roots);
+        self.runtime_workspace_roots.push(cwd);
+        for root in previous_roots {
+            if root != previous_cwd && !self.runtime_workspace_roots.contains(&root) {
+                self.runtime_workspace_roots.push(root);
+            }
+        }
+    }
+}
diff --git a/codex-rs/tui/src/slash_command.rs b/codex-rs/tui/src/slash_command.rs
index beaaa7f319..970d1cbd5a 100644
--- a/codex-rs/tui/src/slash_command.rs
+++ b/codex-rs/tui/src/slash_command.rs
@@ -36,7 +36,6 @@ pub enum SlashCommand {
     Compact,
     Plan,
     Goal,
-    Collab,
     Agent,
     Side,
     Copy,
@@ -114,7 +113,6 @@ impl SlashCommand {
             SlashCommand::Settings => "configure realtime microphone/speaker",
             SlashCommand::Plan => "switch to Plan mode",
             SlashCommand::Goal => "set or view the goal for a long-running task",
-            SlashCommand::Collab => "change collaboration mode (experimental)",
             SlashCommand::Agent | SlashCommand::MultiAgents => "switch the active agent thread",
             SlashCommand::Side => "start a side conversation in an ephemeral fork",
             SlashCommand::Permissions => "choose what Codex is allowed to do",
@@ -224,7 +222,6 @@ impl SlashCommand {
             SlashCommand::TestApproval => true,
             SlashCommand::Realtime => true,
             SlashCommand::Settings => true,
-            SlashCommand::Collab => true,
             SlashCommand::Agent | SlashCommand::MultiAgents => true,
             SlashCommand::Theme | SlashCommand::Pets => false,
         }
diff --git a/codex-rs/tui/src/snapshots/codex_tui__app__tests__side_backtrack_rejection_reports_unavailable_message.snap b/codex-rs/tui/src/snapshots/codex_tui__app__tests__side_backtrack_rejection_reports_unavailable_message.snap
new file mode 100644
index 0000000000..841e0c0f59
--- /dev/null
+++ b/codex-rs/tui/src/snapshots/codex_tui__app__tests__side_backtrack_rejection_reports_unavailable_message.snap
@@ -0,0 +1,5 @@
+---
+source: tui/src/app/tests.rs
+expression: rendered
+---
+■ Editing previous prompts is unavailable in side conversations.
diff --git a/codex-rs/tui/src/startup_error.rs b/codex-rs/tui/src/startup_error.rs
new file mode 100644
index 0000000000..55b691d836
--- /dev/null
+++ b/codex-rs/tui/src/startup_error.rs
@@ -0,0 +1,29 @@
+use std::path::Path;
+use std::path::PathBuf;
+
+#[derive(Debug, thiserror::Error)]
+#[error(
+    "failed to initialize sqlite state db at {}: {detail}",
+    state_db_path.display()
+)]
+pub struct LocalStateDbStartupError {
+    state_db_path: PathBuf,
+    detail: String,
+}
+
+impl LocalStateDbStartupError {
+    pub fn new(state_db_path: PathBuf, detail: String) -> Self {
+        Self {
+            state_db_path,
+            detail,
+        }
+    }
+
+    pub fn state_db_path(&self) -> &Path {
+        self.state_db_path.as_path()
+    }
+
+    pub fn detail(&self) -> &str {
+        self.detail.as_str()
+    }
+}
diff --git a/codex-rs/tui/src/status/card.rs b/codex-rs/tui/src/status/card.rs
index aa98a20bc4..7f7768e2cf 100644
--- a/codex-rs/tui/src/status/card.rs
+++ b/codex-rs/tui/src/status/card.rs
@@ -15,14 +15,16 @@ use codex_protocol::ThreadId;
 use codex_protocol::account::PlanType;
 use codex_protocol::config_types::ApprovalsReviewer;
 use codex_protocol::models::ActivePermissionProfile;
-use codex_protocol::models::ActivePermissionProfileModification;
+use codex_protocol::models::BUILT_IN_PERMISSION_PROFILE_DANGER_FULL_ACCESS;
+use codex_protocol::models::BUILT_IN_PERMISSION_PROFILE_READ_ONLY;
+use codex_protocol::models::BUILT_IN_PERMISSION_PROFILE_WORKSPACE;
 use codex_protocol::models::PermissionProfile;
 use codex_protocol::openai_models::ReasoningEffort;
+use codex_utils_absolute_path::AbsolutePathBuf;
 use codex_utils_sandbox_summary::summarize_permission_profile;
 use ratatui::prelude::*;
 use ratatui::style::Stylize;
 use std::collections::BTreeSet;
-use std::path::Path;
 use std::path::PathBuf;
 use url::Url;
 
@@ -104,6 +106,7 @@ struct StatusHistoryCell {
     agents_summary: Arc<RwLock<String>>,
     collaboration_mode: Option<String>,
     model_provider: Option<String>,
+    show_chatgpt_usage_link: bool,
     account: Option<StatusAccountDisplay>,
     thread_name: Option<String>,
     session_id: Option<String>,
@@ -253,7 +256,8 @@ impl StatusHistoryCell {
         refreshing_rate_limits: bool,
     ) -> (Self, StatusHistoryHandle) {
         let approval_policy = AskForApproval::from(config.permissions.approval_policy.value());
-        let permission_profile = config.permissions.permission_profile();
+        let permission_profile = config.permissions.effective_permission_profile();
+        let workspace_roots = config.effective_workspace_roots();
         let mut config_entries = vec![
             ("workdir", config.cwd.display().to_string()),
             ("model", model_name.to_string()),
@@ -264,7 +268,11 @@ impl StatusHistoryCell {
             ),
             (
                 "sandbox",
-                summarize_permission_profile(&permission_profile, config.cwd.as_path()),
+                summarize_permission_profile(
+                    &permission_profile,
+                    &config.cwd,
+                    workspace_roots.as_slice(),
+                ),
             ),
         ];
         if config.model_provider.wire_api == WireApi::Responses {
@@ -288,7 +296,9 @@ impl StatusHistoryCell {
             .map(|(_, v)| v.clone())
             .unwrap_or_else(|| "<unknown>".to_string());
         let active_permission_profile = config.permissions.active_permission_profile();
-        let sandbox = status_permission_summary(&permission_profile, config.cwd.as_path());
+        let sandbox =
+            status_permission_summary(&permission_profile, &config.cwd, workspace_roots.as_slice());
+        let workspace_root_suffix = workspace_root_suffix(workspace_roots.as_slice(), &config.cwd);
         let approval = status_approval_label(approval_policy, config.approvals_reviewer, &approval);
         let permissions = status_permissions_label(
             active_permission_profile.as_ref(),
@@ -296,8 +306,10 @@ impl StatusHistoryCell {
             approval_policy,
             &sandbox,
             &approval,
+            workspace_root_suffix.as_deref(),
         );
         let model_provider = format_model_provider(config, runtime_model_provider_base_url);
+        let show_chatgpt_usage_link = config.model_provider.requires_openai_auth;
         let account = compose_account_display(account_display);
         let session_id = session_id.as_ref().map(std::string::ToString::to_string);
         let forked_from = forked_from.map(|id| id.to_string());
@@ -337,6 +349,7 @@ impl StatusHistoryCell {
                 permissions,
                 collaboration_mode: collaboration_mode.map(ToString::to_string),
                 model_provider,
+                show_chatgpt_usage_link,
                 account,
                 thread_name,
                 session_id,
@@ -539,8 +552,12 @@ impl StatusHistoryCell {
     }
 }
 
-fn status_permission_summary(permission_profile: &PermissionProfile, cwd: &Path) -> String {
-    let summary = summarize_permission_profile(permission_profile, cwd);
+fn status_permission_summary(
+    permission_profile: &PermissionProfile,
+    cwd: &AbsolutePathBuf,
+    workspace_roots: &[AbsolutePathBuf],
+) -> String {
+    let summary = summarize_permission_profile(permission_profile, cwd, workspace_roots);
     if let Some(details) = summary.strip_prefix("read-only") {
         if details.contains("(network access enabled)") {
             return "read-only with network access".to_string();
@@ -559,57 +576,68 @@ fn status_permission_summary(permission_profile: &PermissionProfile, cwd: &Path)
     summary
 }
 
+fn workspace_root_suffix(
+    workspace_roots: &[AbsolutePathBuf],
+    cwd: &AbsolutePathBuf,
+) -> Option<String> {
+    let extra_roots = workspace_roots
+        .iter()
+        .filter(|root| *root != cwd)
+        .map(|root| root.to_string_lossy().to_string())
+        .collect::<Vec<_>>();
+    if extra_roots.is_empty() {
+        None
+    } else {
+        Some(format!(" [{}]", extra_roots.join(", ")))
+    }
+}
+
 fn status_permissions_label(
     active_permission_profile: Option<&ActivePermissionProfile>,
     permission_profile: &PermissionProfile,
     approval_policy: AskForApproval,
     sandbox: &str,
     approval: &str,
+    workspace_root_suffix: Option<&str>,
 ) -> String {
     let active_id = active_permission_profile.map(|active| active.id.as_str());
-    let writable_root_modifications = active_permission_profile
-        .map(|active| {
-            active
-                .modifications
-                .iter()
-                .filter(|modification| {
-                    matches!(
-                        modification,
-                        ActivePermissionProfileModification::AdditionalWritableRoot { .. }
-                    )
-                })
-                .count()
-        })
-        .unwrap_or(0);
-    let modification_suffix = match writable_root_modifications {
-        0 => String::new(),
-        1 => " + 1 writable root".to_string(),
-        count => format!(" + {count} writable roots"),
-    };
     match active_id {
-        Some(":read-only") => {
+        Some(BUILT_IN_PERMISSION_PROFILE_READ_ONLY) => {
             let label = if sandbox == "read-only with network access" {
                 "Read Only with network access"
             } else {
                 "Read Only"
             };
-            return format!("{label}{modification_suffix} ({approval})");
+            return format!("{label} ({approval})");
         }
-        Some(":workspace") => match sandbox {
-            "workspace" => return format!("Workspace{modification_suffix} ({approval})"),
+        Some(BUILT_IN_PERMISSION_PROFILE_WORKSPACE) => match sandbox {
+            "workspace" => {
+                return format!(
+                    "Workspace{} ({approval})",
+                    workspace_root_suffix.unwrap_or("")
+                );
+            }
             "workspace with network access" => {
-                return format!("Workspace with network access{modification_suffix} ({approval})");
+                return format!(
+                    "Workspace with network access{} ({approval})",
+                    workspace_root_suffix.unwrap_or("")
+                );
             }
             _ => {}
         },
-        Some(":danger-no-sandbox") if permission_profile == &PermissionProfile::Disabled => {
+        Some(BUILT_IN_PERMISSION_PROFILE_DANGER_FULL_ACCESS)
+            if permission_profile == &PermissionProfile::Disabled =>
+        {
             return if approval_policy == AskForApproval::Never {
                 "Full Access".to_string()
             } else {
                 format!("No Sandbox ({approval})")
             };
         }
-        Some(id) => return format!("Profile {id}{modification_suffix} ({sandbox}, {approval})"),
+        Some(id) => {
+            let sandbox = decorate_workspace_sandbox_label(sandbox, workspace_root_suffix);
+            return format!("Profile {id} ({sandbox}, {approval})");
+        }
         None => {}
     }
 
@@ -617,16 +645,27 @@ fn status_permissions_label(
         return format!("Read Only ({approval})");
     }
     if approval_policy == AskForApproval::OnRequest && sandbox == "workspace" {
-        return format!("Workspace ({approval})");
+        return format!(
+            "Workspace{} ({approval})",
+            workspace_root_suffix.unwrap_or("")
+        );
     }
     if approval_policy == AskForApproval::Never
         && permission_profile == &PermissionProfile::Disabled
     {
         return "Full Access".to_string();
     }
+    let sandbox = decorate_workspace_sandbox_label(sandbox, workspace_root_suffix);
     format!("Custom ({sandbox}, {approval})")
 }
 
+fn decorate_workspace_sandbox_label(sandbox: &str, workspace_root_suffix: Option<&str>) -> String {
+    match workspace_root_suffix {
+        Some(suffix) if sandbox.starts_with("workspace") => format!("{sandbox}{suffix}"),
+        _ => sandbox.to_string(),
+    }
+}
+
 fn status_approval_label(
     approval_policy: AskForApproval,
     approvals_reviewer: ApprovalsReviewer,
@@ -729,8 +768,12 @@ impl HistoryCell for StatusHistoryCell {
             [note_first_line, note_second_line],
             RtOptions::new(available_inner_width),
         );
-        lines.extend(note_lines);
-        lines.push(Line::from(Vec::<Span<'static>>::new()));
+        // The ChatGPT usage page only applies to providers backed by OpenAI auth;
+        // providers like Bedrock manage limits and billing elsewhere.
+        if self.show_chatgpt_usage_link {
+            lines.extend(note_lines);
+            lines.push(Line::from(Vec::<Span<'static>>::new()));
+        }
 
         let mut model_spans = vec![Span::from(self.model_name.clone())];
         if !self.model_details.is_empty() {
diff --git a/codex-rs/tui/src/status/rate_limits.rs b/codex-rs/tui/src/status/rate_limits.rs
index 3be813beb9..1146bb8a31 100644
--- a/codex-rs/tui/src/status/rate_limits.rs
+++ b/codex-rs/tui/src/status/rate_limits.rs
@@ -5,7 +5,8 @@
 //!
 //! The key contract is that time-sensitive values are interpreted relative to a caller-provided
 //! capture timestamp so stale detection and reset labels remain coherent for a given draw cycle.
-use crate::chatwidget::get_limits_duration;
+use crate::chatwidget::fallback_limit_label;
+use crate::chatwidget::limit_label_for_window;
 use crate::text_formatting::capitalize_first;
 
 use super::helpers::format_reset_timestamp;
@@ -23,7 +24,7 @@ const STATUS_LIMIT_BAR_EMPTY: &str = "░";
 
 #[derive(Debug, Clone)]
 pub(crate) struct StatusRateLimitRow {
-    /// Human-readable row label, such as `"5h limit"` or `"Credits"`.
+    /// Human-readable row label, such as `"5h limit"`, `"Monthly limit"`, or `"Credits"`.
     pub label: String,
     /// Value payload for the row.
     pub value: StatusRateLimitValue,
@@ -92,9 +93,9 @@ pub(crate) struct RateLimitSnapshotDisplay {
     pub limit_name: String,
     /// Local timestamp representing when this display snapshot was captured.
     pub captured_at: DateTime<Local>,
-    /// Primary usage window (typically short duration).
+    /// Primary usage window.
     pub primary: Option<RateLimitWindowDisplay>,
-    /// Secondary usage window (typically weekly).
+    /// Secondary usage window.
     pub secondary: Option<RateLimitWindowDisplay>,
     /// Optional credits metadata when available.
     pub credits: Option<CreditsSnapshotDisplay>,
@@ -188,21 +189,13 @@ pub(crate) fn compose_rate_limit_data_many(
             .primary
             .as_ref()
             .map(|window| {
-                window
-                    .window_minutes
-                    .map(get_limits_duration)
-                    .unwrap_or_else(|| "5h".to_string())
+                limit_label_for_window(window.window_minutes, /*is_secondary*/ false)
             })
             .map(|label| capitalize_first(&label));
         let secondary_label = snapshot
             .secondary
             .as_ref()
-            .map(|window| {
-                window
-                    .window_minutes
-                    .map(get_limits_duration)
-                    .unwrap_or_else(|| "weekly".to_string())
-            })
+            .map(|window| limit_label_for_window(window.window_minutes, /*is_secondary*/ true))
             .map(|label| capitalize_first(&label));
         let window_count =
             usize::from(snapshot.primary.is_some()) + usize::from(snapshot.secondary.is_some());
@@ -220,12 +213,16 @@ pub(crate) fn compose_rate_limit_data_many(
                 format!(
                     "{} {} limit",
                     limit_bucket_label,
-                    primary_label.clone().unwrap_or_else(|| "5h".to_string())
+                    primary_label.clone().unwrap_or_else(|| capitalize_first(
+                        fallback_limit_label(/*is_secondary*/ false)
+                    ))
                 )
             } else {
                 format!(
                     "{} limit",
-                    primary_label.clone().unwrap_or_else(|| "5h".to_string())
+                    primary_label.clone().unwrap_or_else(|| capitalize_first(
+                        fallback_limit_label(/*is_secondary*/ false)
+                    ))
                 )
             };
             rows.push(StatusRateLimitRow {
@@ -242,16 +239,16 @@ pub(crate) fn compose_rate_limit_data_many(
                 format!(
                     "{} {} limit",
                     limit_bucket_label,
-                    secondary_label
-                        .clone()
-                        .unwrap_or_else(|| "weekly".to_string())
+                    secondary_label.clone().unwrap_or_else(|| capitalize_first(
+                        fallback_limit_label(/*is_secondary*/ true)
+                    ))
                 )
             } else {
                 format!(
                     "{} limit",
-                    secondary_label
-                        .clone()
-                        .unwrap_or_else(|| "weekly".to_string())
+                    secondary_label.clone().unwrap_or_else(|| capitalize_first(
+                        fallback_limit_label(/*is_secondary*/ true)
+                    ))
                 )
             };
             rows.push(StatusRateLimitRow {
@@ -420,7 +417,7 @@ mod tests {
             secondary: Some(RateLimitWindowDisplay {
                 used_percent: 40.0,
                 resets_at: Some("later".to_string()),
-                window_minutes: None,
+                window_minutes: Some(2 * 60),
             }),
             credits: None,
         };
@@ -434,8 +431,8 @@ mod tests {
             labels,
             vec![
                 "codex-other limit".to_string(),
-                "1h limit".to_string(),
-                "Weekly limit".to_string(),
+                "Usage limit".to_string(),
+                "Secondary usage limit".to_string(),
             ]
         );
     }
diff --git a/codex-rs/tui/src/status/snapshots/codex_tui__status__tests__status_snapshot_uses_generic_limit_labels_for_unsupported_windows.snap b/codex-rs/tui/src/status/snapshots/codex_tui__status__tests__status_snapshot_uses_generic_limit_labels_for_unsupported_windows.snap
new file mode 100644
index 0000000000..f983cf478d
--- /dev/null
+++ b/codex-rs/tui/src/status/snapshots/codex_tui__status__tests__status_snapshot_uses_generic_limit_labels_for_unsupported_windows.snap
@@ -0,0 +1,24 @@
+---
+source: tui/src/status/tests.rs
+expression: sanitized
+---
+/status
+
+╭──────────────────────────────────────────────────────────────────────────────╮
+│  >_ OpenAI Codex (v0.0.0)                                                    │
+│                                                                              │
+│ Visit https://chatgpt.com/codex/settings/usage for up-to-date                │
+│ information on rate limits and credits                                       │
+│                                                                              │
+│  Model:                   gpt-5.1-codex-max (reasoning none, summaries auto) │
+│  Directory: [[workspace]]                                                    │
+│  Permissions:             Custom (workspace with network access, on-request) │
+│  Agents.md:               <none>                                             │
+│                                                                              │
+│  Token usage:             1.2K total  (800 input + 400 output)               │
+│  Context window:          100% left (1.2K used / 272K)                       │
+│  Usage limit:             [█████████████░░░░░░░] 65% left                    │
+│                           (resets 07:08 on 7 May)                            │
+│  Secondary usage limit:   [██████████░░░░░░░░░░] 50% left                    │
+│                           (resets 07:08 on 8 May)                            │
+╰──────────────────────────────────────────────────────────────────────────────╯
diff --git a/codex-rs/tui/src/status/tests.rs b/codex-rs/tui/src/status/tests.rs
index b511957d84..e6fa90071a 100644
--- a/codex-rs/tui/src/status/tests.rs
+++ b/codex-rs/tui/src/status/tests.rs
@@ -5,6 +5,7 @@ use super::rate_limit_snapshot_display;
 use crate::history_cell::HistoryCell;
 use crate::legacy_core::config::Config;
 use crate::legacy_core::config::ConfigBuilder;
+use crate::legacy_core::config::PermissionProfileSnapshot;
 use crate::status::StatusAccountDisplay;
 use crate::test_support::PathBufExt;
 use crate::test_support::test_path_buf;
@@ -15,36 +16,38 @@ use chrono::TimeZone;
 use chrono::Utc;
 use codex_app_server_protocol::AskForApproval;
 use codex_app_server_protocol::CreditsSnapshot;
-use codex_app_server_protocol::FileSystemAccessMode;
-use codex_app_server_protocol::FileSystemPath;
-use codex_app_server_protocol::FileSystemSandboxEntry;
-use codex_app_server_protocol::FileSystemSpecialPath;
-use codex_app_server_protocol::PermissionProfile as AppServerPermissionProfile;
-use codex_app_server_protocol::PermissionProfileFileSystemPermissions;
-use codex_app_server_protocol::PermissionProfileNetworkPermissions;
 use codex_app_server_protocol::RateLimitSnapshot;
 use codex_app_server_protocol::RateLimitWindow;
+use codex_config::LoaderOverrides;
 use codex_model_provider_info::ModelProviderAwsAuthInfo;
 use codex_model_provider_info::ModelProviderInfo;
 use codex_protocol::ThreadId;
 use codex_protocol::config_types::ApprovalsReviewer;
 use codex_protocol::config_types::ReasoningSummary;
 use codex_protocol::models::ActivePermissionProfile;
-use codex_protocol::models::ActivePermissionProfileModification;
+use codex_protocol::models::BUILT_IN_PERMISSION_PROFILE_WORKSPACE;
+use codex_protocol::models::ManagedFileSystemPermissions;
 use codex_protocol::models::PermissionProfile;
 use codex_protocol::openai_models::ReasoningEffort;
+use codex_protocol::permissions::FileSystemAccessMode;
+use codex_protocol::permissions::FileSystemPath;
+use codex_protocol::permissions::FileSystemSandboxEntry;
+use codex_protocol::permissions::FileSystemSpecialPath;
 use codex_protocol::permissions::NetworkSandboxPolicy;
+use codex_utils_absolute_path::AbsolutePathBuf;
 use insta::assert_snapshot;
 use pretty_assertions::assert_eq;
 use ratatui::prelude::*;
 use tempfile::TempDir;
 
 fn app_server_workspace_write_profile(network_enabled: bool) -> PermissionProfile {
-    AppServerPermissionProfile::Managed {
-        network: PermissionProfileNetworkPermissions {
-            enabled: network_enabled,
+    PermissionProfile::Managed {
+        network: if network_enabled {
+            NetworkSandboxPolicy::Enabled
+        } else {
+            NetworkSandboxPolicy::Restricted
         },
-        file_system: PermissionProfileFileSystemPermissions::Restricted {
+        file_system: ManagedFileSystemPermissions::Restricted {
             entries: vec![
                 FileSystemSandboxEntry {
                     path: FileSystemPath::Special {
@@ -74,12 +77,12 @@ fn app_server_workspace_write_profile(network_enabled: bool) -> PermissionProfil
             glob_scan_max_depth: None,
         },
     }
-    .into()
 }
 
 async fn test_config(temp_home: &TempDir) -> Config {
     let mut config = ConfigBuilder::default()
         .codex_home(temp_home.path().to_path_buf())
+        .loader_overrides(LoaderOverrides::without_managed_config_for_tests())
         .build()
         .await
         .expect("load config");
@@ -93,6 +96,14 @@ async fn test_config(temp_home: &TempDir) -> Config {
     config
 }
 
+fn set_workspace_cwd(config: &mut Config, cwd: AbsolutePathBuf) {
+    config.cwd = cwd.clone();
+    config.workspace_roots = vec![cwd];
+    config
+        .permissions
+        .set_workspace_roots(config.workspace_roots.clone());
+}
+
 fn test_status_account_display() -> Option<StatusAccountDisplay> {
     None
 }
@@ -191,7 +202,7 @@ async fn status_snapshot_includes_reasoning_details() {
     config.model = Some("gpt-5.1-codex-max".to_string());
     config.model_provider_id = "openai".to_string();
     config.model_reasoning_summary = Some(ReasoningSummary::Detailed);
-    config.cwd = test_path_buf("/workspace/tests").abs();
+    set_workspace_cwd(&mut config, test_path_buf("/workspace/tests").abs());
     config
         .permissions
         .set_permission_profile(PermissionProfile::workspace_write())
@@ -269,7 +280,7 @@ async fn status_permissions_non_default_workspace_write_uses_workspace_label() {
         .approval_policy
         .set(AskForApproval::OnRequest.to_core())
         .expect("set approval policy");
-    config.cwd = test_path_buf("/workspace/tests").abs();
+    set_workspace_cwd(&mut config, test_path_buf("/workspace/tests").abs());
     config
         .permissions
         .set_permission_profile(app_server_workspace_write_profile(
@@ -294,10 +305,10 @@ async fn status_permissions_named_read_only_profile_shows_builtin_label() {
         .expect("set approval policy");
     config
         .permissions
-        .set_permission_profile_with_active_profile(
+        .set_permission_profile_from_session_snapshot(PermissionProfileSnapshot::active(
             PermissionProfile::read_only(),
-            Some(ActivePermissionProfile::new(":read-only")),
-        )
+            ActivePermissionProfile::read_only(),
+        ))
         .expect("set permission profile");
 
     assert_eq!(
@@ -321,24 +332,18 @@ async fn status_permissions_read_only_profile_shows_additional_writable_roots()
         .with_additional_writable_roots(config.cwd.as_path(), std::slice::from_ref(&extra_root));
     config
         .permissions
-        .set_permission_profile_with_active_profile(
+        .set_permission_profile_from_session_snapshot(PermissionProfileSnapshot::active(
             PermissionProfile::from_runtime_permissions(
                 &file_system_policy,
                 NetworkSandboxPolicy::Restricted,
             ),
-            Some(
-                ActivePermissionProfile::new(":read-only").with_modifications(vec![
-                    ActivePermissionProfileModification::AdditionalWritableRoot {
-                        path: extra_root,
-                    },
-                ]),
-            ),
-        )
+            ActivePermissionProfile::read_only(),
+        ))
         .expect("set permission profile");
 
     assert_eq!(
         permissions_text_for(&config).as_deref(),
-        Some("Read Only + 1 writable root (on-request)")
+        Some("Read Only (on-request)")
     );
 }
 
@@ -353,10 +358,10 @@ async fn status_permissions_named_workspace_profile_shows_builtin_label() {
         .expect("set approval policy");
     config
         .permissions
-        .set_permission_profile_with_active_profile(
+        .set_permission_profile_from_session_snapshot(PermissionProfileSnapshot::active(
             PermissionProfile::workspace_write(),
-            Some(ActivePermissionProfile::new(":workspace")),
-        )
+            ActivePermissionProfile::new(BUILT_IN_PERMISSION_PROFILE_WORKSPACE),
+        ))
         .expect("set permission profile");
 
     assert_eq!(
@@ -377,10 +382,10 @@ async fn status_permissions_workspace_auto_review_shows_reviewer_label() {
         .expect("set approval policy");
     config
         .permissions
-        .set_permission_profile_with_active_profile(
+        .set_permission_profile_from_session_snapshot(PermissionProfileSnapshot::active(
             PermissionProfile::workspace_write(),
-            Some(ActivePermissionProfile::new(":workspace")),
-        )
+            ActivePermissionProfile::new(BUILT_IN_PERMISSION_PROFILE_WORKSPACE),
+        ))
         .expect("set permission profile");
 
     assert_eq!(
@@ -401,26 +406,85 @@ async fn status_permissions_named_profile_shows_additional_writable_roots() {
     let extra_root = test_path_buf("/workspace/extra").abs();
     config
         .permissions
-        .set_permission_profile_with_active_profile(
+        .set_permission_profile_from_session_snapshot(PermissionProfileSnapshot::active(
             PermissionProfile::workspace_write_with(
                 std::slice::from_ref(&extra_root),
                 NetworkSandboxPolicy::Restricted,
                 /*exclude_tmpdir_env_var*/ false,
                 /*exclude_slash_tmp*/ false,
             ),
-            Some(
-                ActivePermissionProfile::new(":workspace").with_modifications(vec![
-                    ActivePermissionProfileModification::AdditionalWritableRoot {
-                        path: extra_root,
-                    },
-                ]),
+            ActivePermissionProfile::new(BUILT_IN_PERMISSION_PROFILE_WORKSPACE),
+        ))
+        .expect("set permission profile");
+
+    assert_eq!(
+        permissions_text_for(&config).as_deref(),
+        Some("Workspace (on-request)")
+    );
+}
+
+#[tokio::test]
+async fn status_permissions_workspace_roots_show_additional_directories() {
+    let temp_home = TempDir::new().expect("temp home");
+    let mut config = test_config(&temp_home).await;
+    set_workspace_cwd(&mut config, test_path_buf("/workspace/tests").abs());
+    config
+        .permissions
+        .approval_policy
+        .set(AskForApproval::OnRequest.to_core())
+        .expect("set approval policy");
+    let extra_root = test_path_buf("/workspace/extra").abs();
+    config.workspace_roots = vec![config.cwd.clone(), extra_root.clone()];
+    config
+        .permissions
+        .set_workspace_roots(config.workspace_roots.clone());
+    config
+        .permissions
+        .set_permission_profile_from_session_snapshot(PermissionProfileSnapshot::active(
+            PermissionProfile::workspace_write(),
+            ActivePermissionProfile::new(":workspace"),
+        ))
+        .expect("set permission profile");
+
+    assert_eq!(
+        permissions_text_for(&config),
+        Some(format!("Workspace [{}] (on-request)", extra_root.display()))
+    );
+}
+
+#[tokio::test]
+async fn status_permissions_workspace_roots_include_profile_defined_directories() {
+    let temp_home = TempDir::new().expect("temp home");
+    let mut config = test_config(&temp_home).await;
+    set_workspace_cwd(&mut config, test_path_buf("/workspace/tests").abs());
+    config
+        .permissions
+        .approval_policy
+        .set(AskForApproval::OnRequest.to_core())
+        .expect("set approval policy");
+    let profile_root = test_path_buf("/workspace/shared").abs();
+    config
+        .permissions
+        .set_permission_profile_from_session_snapshot(
+            PermissionProfileSnapshot::active_with_profile_workspace_roots(
+                PermissionProfile::workspace_write_with(
+                    std::slice::from_ref(&profile_root),
+                    NetworkSandboxPolicy::Restricted,
+                    /*exclude_tmpdir_env_var*/ false,
+                    /*exclude_slash_tmp*/ false,
+                ),
+                ActivePermissionProfile::new(":workspace"),
+                vec![profile_root.clone()],
             ),
         )
         .expect("set permission profile");
 
     assert_eq!(
-        permissions_text_for(&config).as_deref(),
-        Some("Workspace + 1 writable root (on-request)")
+        permissions_text_for(&config),
+        Some(format!(
+            "Workspace [{}] (on-request)",
+            profile_root.display()
+        ))
     );
 }
 
@@ -435,15 +499,15 @@ async fn status_permissions_broadened_workspace_profile_shows_builtin_label() {
         .expect("set approval policy");
     config
         .permissions
-        .set_permission_profile_with_active_profile(
+        .set_permission_profile_from_session_snapshot(PermissionProfileSnapshot::active(
             PermissionProfile::workspace_write_with(
                 &[],
                 NetworkSandboxPolicy::Enabled,
                 /*exclude_tmpdir_env_var*/ false,
                 /*exclude_slash_tmp*/ false,
             ),
-            Some(ActivePermissionProfile::new(":workspace")),
-        )
+            ActivePermissionProfile::new(BUILT_IN_PERMISSION_PROFILE_WORKSPACE),
+        ))
         .expect("set permission profile");
 
     assert_eq!(
@@ -458,10 +522,10 @@ async fn status_permissions_user_defined_profile_shows_name() {
     let mut config = test_config(&temp_home).await;
     config
         .permissions
-        .set_permission_profile_with_active_profile(
+        .set_permission_profile_from_session_snapshot(PermissionProfileSnapshot::active(
             PermissionProfile::read_only(),
-            Some(ActivePermissionProfile::new("locked")),
-        )
+            ActivePermissionProfile::new("locked"),
+        ))
         .expect("set permission profile");
 
     assert_eq!(
@@ -475,13 +539,13 @@ async fn status_snapshot_shows_active_user_defined_profile() {
     let temp_home = TempDir::new().expect("temp home");
     let mut config = test_config(&temp_home).await;
     config.model = Some("gpt-5.1-codex-max".to_string());
-    config.cwd = test_path_buf("/workspace/tests").abs();
+    set_workspace_cwd(&mut config, test_path_buf("/workspace/tests").abs());
     config
         .permissions
-        .set_permission_profile_with_active_profile(
+        .set_permission_profile_from_session_snapshot(PermissionProfileSnapshot::active(
             PermissionProfile::read_only(),
-            Some(ActivePermissionProfile::new("locked")),
-        )
+            ActivePermissionProfile::new("locked"),
+        ))
         .expect("set permission profile");
 
     let usage = TokenUsage::default();
@@ -518,7 +582,7 @@ async fn status_snapshot_shows_active_user_defined_profile() {
 }
 
 #[tokio::test]
-async fn status_model_provider_uses_bedrock_runtime_base_url() {
+async fn status_model_provider_uses_bedrock_runtime_base_url_and_gates_usage_link() {
     let temp_home = TempDir::new().expect("temp home");
     let mut config = test_config(&temp_home).await;
     config.model_provider_id = "amazon-bedrock".to_string();
@@ -565,6 +629,42 @@ async fn status_model_provider_uses_bedrock_runtime_base_url() {
         !rendered.contains("bedrock-mantle.us-east-1"),
         "expected /status to ignore configured Bedrock base URL, got: {rendered}"
     );
+    assert!(
+        !rendered.contains("https://chatgpt.com/codex/settings/usage"),
+        "expected /status to hide ChatGPT usage link for Bedrock, got: {rendered}"
+    );
+
+    config.model_provider_id = "openai-proxy".to_string();
+    config.model_provider = ModelProviderInfo {
+        name: "OpenAI Proxy".to_string(),
+        base_url: Some("https://openai-proxy.example/v1".to_string()),
+        requires_openai_auth: true,
+        ..ModelProviderInfo::default()
+    };
+    let (composite, _handle) = new_status_output_with_rate_limits_handle(
+        &config,
+        /*runtime_model_provider_base_url*/ None,
+        test_status_account_display().as_ref(),
+        /*token_info*/ None,
+        &usage,
+        &None,
+        /*thread_name*/ None,
+        /*forked_from*/ None,
+        /*rate_limits*/ &[],
+        None,
+        captured_at,
+        &model_slug,
+        /*collaboration_mode*/ None,
+        /*reasoning_effort_override*/ None,
+        "<none>".to_string(),
+        /*refreshing_rate_limits*/ false,
+    );
+    let rendered = render_lines(&composite.display_lines(/*width*/ 120)).join("\n");
+
+    assert!(
+        rendered.contains("https://chatgpt.com/codex/settings/usage"),
+        "expected /status to show ChatGPT usage link for OpenAI-auth proxy, got: {rendered}"
+    );
 }
 
 #[tokio::test]
@@ -572,14 +672,14 @@ async fn status_snapshot_shows_auto_review_permissions() {
     let temp_home = TempDir::new().expect("temp home");
     let mut config = test_config(&temp_home).await;
     config.model = Some("gpt-5.1-codex-max".to_string());
-    config.cwd = test_path_buf("/workspace/tests").abs();
+    set_workspace_cwd(&mut config, test_path_buf("/workspace/tests").abs());
     config.approvals_reviewer = ApprovalsReviewer::AutoReview;
     config
         .permissions
-        .set_permission_profile_with_active_profile(
+        .set_permission_profile_from_session_snapshot(PermissionProfileSnapshot::active(
             PermissionProfile::workspace_write(),
-            Some(ActivePermissionProfile::new(":workspace")),
-        )
+            ActivePermissionProfile::new(BUILT_IN_PERMISSION_PROFILE_WORKSPACE),
+        ))
         .expect("set permission profile");
 
     let usage = TokenUsage::default();
@@ -626,13 +726,10 @@ async fn status_permissions_full_disk_managed_with_network_is_danger_full_access
         .expect("set approval policy");
     config
         .permissions
-        .set_permission_profile(
-            AppServerPermissionProfile::Managed {
-                network: PermissionProfileNetworkPermissions { enabled: true },
-                file_system: PermissionProfileFileSystemPermissions::Unrestricted,
-            }
-            .into(),
-        )
+        .set_permission_profile(PermissionProfile::Managed {
+            network: NetworkSandboxPolicy::Enabled,
+            file_system: ManagedFileSystemPermissions::Unrestricted,
+        })
         .expect("set permission profile");
 
     assert_eq!(
@@ -652,13 +749,10 @@ async fn status_permissions_full_disk_managed_without_network_is_external_sandbo
         .expect("set approval policy");
     config
         .permissions
-        .set_permission_profile(
-            AppServerPermissionProfile::Managed {
-                network: PermissionProfileNetworkPermissions { enabled: false },
-                file_system: PermissionProfileFileSystemPermissions::Unrestricted,
-            }
-            .into(),
-        )
+        .set_permission_profile(PermissionProfile::Managed {
+            network: NetworkSandboxPolicy::Restricted,
+            file_system: ManagedFileSystemPermissions::Unrestricted,
+        })
         .expect("set permission profile");
 
     assert_eq!(
@@ -673,7 +767,7 @@ async fn status_snapshot_includes_forked_from() {
     let mut config = test_config(&temp_home).await;
     config.model = Some("gpt-5.1-codex-max".to_string());
     config.model_provider_id = "openai".to_string();
-    config.cwd = test_path_buf("/workspace/tests").abs();
+    set_workspace_cwd(&mut config, test_path_buf("/workspace/tests").abs());
 
     let account_display = test_status_account_display();
     let usage = TokenUsage {
@@ -727,7 +821,7 @@ async fn status_snapshot_includes_monthly_limit() {
     let mut config = test_config(&temp_home).await;
     config.model = Some("gpt-5.1-codex-max".to_string());
     config.model_provider_id = "openai".to_string();
-    config.cwd = test_path_buf("/workspace/tests").abs();
+    set_workspace_cwd(&mut config, test_path_buf("/workspace/tests").abs());
 
     let account_display = test_status_account_display();
     let usage = TokenUsage {
@@ -784,6 +878,73 @@ async fn status_snapshot_includes_monthly_limit() {
     assert_snapshot!(sanitized);
 }
 
+#[tokio::test]
+async fn status_snapshot_uses_generic_limit_labels_for_unsupported_windows() {
+    let temp_home = TempDir::new().expect("temp home");
+    let mut config = test_config(&temp_home).await;
+    config.model = Some("gpt-5.1-codex-max".to_string());
+    config.model_provider_id = "openai".to_string();
+    set_workspace_cwd(&mut config, test_path_buf("/workspace/tests").abs());
+
+    let account_display = test_status_account_display();
+    let usage = TokenUsage {
+        input_tokens: 800,
+        cached_input_tokens: 0,
+        output_tokens: 400,
+        reasoning_output_tokens: 0,
+        total_tokens: 1_200,
+    };
+
+    let captured_at = chrono::Local
+        .with_ymd_and_hms(2024, 5, 6, 7, 8, 9)
+        .single()
+        .expect("timestamp");
+    let snapshot = RateLimitSnapshot {
+        limit_id: None,
+        limit_name: None,
+        primary: Some(RateLimitWindow {
+            used_percent: 35,
+            window_duration_mins: Some(2 * 60),
+            resets_at: Some(reset_at_from(&captured_at, /*seconds*/ 86_400)),
+        }),
+        secondary: Some(RateLimitWindow {
+            used_percent: 50,
+            window_duration_mins: Some(3 * 60),
+            resets_at: Some(reset_at_from(&captured_at, /*seconds*/ 172_800)),
+        }),
+        credits: None,
+        plan_type: None,
+        rate_limit_reached_type: None,
+    };
+    let rate_display = rate_limit_snapshot_display(&snapshot, captured_at);
+
+    let model_slug = crate::legacy_core::test_support::get_model_offline(config.model.as_deref());
+    let token_info = token_info_for(&model_slug, &config, &usage);
+    let composite = new_status_output(
+        &config,
+        account_display.as_ref(),
+        Some(&token_info),
+        &usage,
+        &None,
+        /*thread_name*/ None,
+        /*forked_from*/ None,
+        Some(&rate_display),
+        None,
+        captured_at,
+        &model_slug,
+        /*collaboration_mode*/ None,
+        /*reasoning_effort_override*/ None,
+    );
+    let mut rendered_lines = render_lines(&composite.display_lines(/*width*/ 80));
+    if cfg!(windows) {
+        for line in &mut rendered_lines {
+            *line = line.replace('\\', "/");
+        }
+    }
+    let sanitized = sanitize_directory(rendered_lines).join("\n");
+    assert_snapshot!(sanitized);
+}
+
 #[tokio::test]
 async fn status_snapshot_shows_unlimited_credits() {
     let temp_home = TempDir::new().expect("temp home");
@@ -985,7 +1146,7 @@ async fn status_card_token_usage_excludes_cached_tokens() {
     let temp_home = TempDir::new().expect("temp home");
     let mut config = test_config(&temp_home).await;
     config.model = Some("gpt-5.1-codex-max".to_string());
-    config.cwd = test_path_buf("/workspace/tests").abs();
+    set_workspace_cwd(&mut config, test_path_buf("/workspace/tests").abs());
 
     let account_display = test_status_account_display();
     let usage = TokenUsage {
@@ -1033,7 +1194,7 @@ async fn status_snapshot_truncates_in_narrow_terminal() {
     config.model = Some("gpt-5.1-codex-max".to_string());
     config.model_provider_id = "openai".to_string();
     config.model_reasoning_summary = Some(ReasoningSummary::Detailed);
-    config.cwd = test_path_buf("/workspace/tests").abs();
+    set_workspace_cwd(&mut config, test_path_buf("/workspace/tests").abs());
 
     let account_display = test_status_account_display();
     let usage = TokenUsage {
@@ -1097,7 +1258,7 @@ async fn status_snapshot_shows_missing_limits_message() {
     let temp_home = TempDir::new().expect("temp home");
     let mut config = test_config(&temp_home).await;
     config.model = Some("gpt-5.1-codex-max".to_string());
-    config.cwd = test_path_buf("/workspace/tests").abs();
+    set_workspace_cwd(&mut config, test_path_buf("/workspace/tests").abs());
 
     let account_display = test_status_account_display();
     let usage = TokenUsage {
@@ -1145,7 +1306,7 @@ async fn status_snapshot_uses_default_reasoning_when_config_empty() {
     let temp_home = TempDir::new().expect("temp home");
     let mut config = test_config(&temp_home).await;
     config.model = Some("gpt-5.1-codex-max".to_string());
-    config.cwd = test_path_buf("/workspace/tests").abs();
+    set_workspace_cwd(&mut config, test_path_buf("/workspace/tests").abs());
 
     let account_display = test_status_account_display();
     let usage = TokenUsage {
@@ -1196,7 +1357,7 @@ async fn status_snapshot_shows_refreshing_limits_notice() {
     let temp_home = TempDir::new().expect("temp home");
     let mut config = test_config(&temp_home).await;
     config.model = Some("gpt-5.1-codex-max".to_string());
-    config.cwd = test_path_buf("/workspace/tests").abs();
+    set_workspace_cwd(&mut config, test_path_buf("/workspace/tests").abs());
 
     let usage = TokenUsage {
         input_tokens: 500,
@@ -1261,7 +1422,7 @@ async fn status_snapshot_includes_credits_and_limits() {
     let temp_home = TempDir::new().expect("temp home");
     let mut config = test_config(&temp_home).await;
     config.model = Some("gpt-5.1-codex".to_string());
-    config.cwd = test_path_buf("/workspace/tests").abs();
+    set_workspace_cwd(&mut config, test_path_buf("/workspace/tests").abs());
 
     let account_display = test_status_account_display();
     let usage = TokenUsage {
@@ -1331,7 +1492,7 @@ async fn status_snapshot_shows_unavailable_limits_message() {
     let temp_home = TempDir::new().expect("temp home");
     let mut config = test_config(&temp_home).await;
     config.model = Some("gpt-5.1-codex-max".to_string());
-    config.cwd = test_path_buf("/workspace/tests").abs();
+    set_workspace_cwd(&mut config, test_path_buf("/workspace/tests").abs());
 
     let account_display = test_status_account_display();
     let usage = TokenUsage {
@@ -1389,7 +1550,7 @@ async fn status_snapshot_treats_refreshing_empty_limits_as_unavailable() {
     let temp_home = TempDir::new().expect("temp home");
     let mut config = test_config(&temp_home).await;
     config.model = Some("gpt-5.1-codex-max".to_string());
-    config.cwd = test_path_buf("/workspace/tests").abs();
+    set_workspace_cwd(&mut config, test_path_buf("/workspace/tests").abs());
 
     let usage = TokenUsage {
         input_tokens: 500,
@@ -1447,7 +1608,7 @@ async fn status_snapshot_shows_stale_limits_message() {
     let temp_home = TempDir::new().expect("temp home");
     let mut config = test_config(&temp_home).await;
     config.model = Some("gpt-5.1-codex-max".to_string());
-    config.cwd = test_path_buf("/workspace/tests").abs();
+    set_workspace_cwd(&mut config, test_path_buf("/workspace/tests").abs());
 
     let account_display = test_status_account_display();
     let usage = TokenUsage {
@@ -1514,7 +1675,7 @@ async fn status_snapshot_cached_limits_hide_credits_without_flag() {
     let temp_home = TempDir::new().expect("temp home");
     let mut config = test_config(&temp_home).await;
     config.model = Some("gpt-5.1-codex".to_string());
-    config.cwd = test_path_buf("/workspace/tests").abs();
+    set_workspace_cwd(&mut config, test_path_buf("/workspace/tests").abs());
 
     let account_display = test_status_account_display();
     let usage = TokenUsage {
diff --git a/codex-rs/tui/src/terminal_palette.rs b/codex-rs/tui/src/terminal_palette.rs
index 229a97d947..53c68d96e7 100644
--- a/codex-rs/tui/src/terminal_palette.rs
+++ b/codex-rs/tui/src/terminal_palette.rs
@@ -68,6 +68,13 @@ pub fn default_bg() -> Option<(u8, u8, u8)> {
     default_colors().map(|c| c.bg)
 }
 
+#[cfg(unix)]
+pub(crate) fn set_default_colors_from_startup_probe(
+    colors: Option<crate::terminal_probe::DefaultColors>,
+) {
+    imp::set_default_colors_from_startup_probe(colors);
+}
+
 #[cfg(all(unix, not(test)))]
 mod imp {
     use super::DefaultColors;
@@ -112,6 +119,18 @@ mod imp {
         cache.get_or_init_with(query_default_colors)
     }
 
+    pub(super) fn set_default_colors_from_startup_probe(
+        colors: Option<crate::terminal_probe::DefaultColors>,
+    ) {
+        if let Ok(mut cache) = default_colors_cache().lock() {
+            cache.value = colors.map(|colors| DefaultColors {
+                fg: colors.fg,
+                bg: colors.bg,
+            });
+            cache.attempted = true;
+        }
+    }
+
     pub(super) fn requery_default_colors() {
         if let Ok(mut cache) = default_colors_cache().lock() {
             // Don't try to refresh if the cache is already attempted and failed.
@@ -166,6 +185,12 @@ mod imp {
         None
     }
 
+    #[cfg(unix)]
+    pub(super) fn set_default_colors_from_startup_probe(
+        _colors: Option<crate::terminal_probe::DefaultColors>,
+    ) {
+    }
+
     pub(super) fn requery_default_colors() {}
 }
 
diff --git a/codex-rs/tui/src/terminal_probe.rs b/codex-rs/tui/src/terminal_probe.rs
index c4e0f57049..d9927ffa20 100644
--- a/codex-rs/tui/src/terminal_probe.rs
+++ b/codex-rs/tui/src/terminal_probe.rs
@@ -39,6 +39,21 @@ mod imp {
         pub(crate) bg: (u8, u8, u8),
     }
 
+    /// Results from the TUI's one-shot startup terminal probe.
+    #[derive(Debug, Clone, Copy, Eq, PartialEq)]
+    pub(crate) struct StartupProbe {
+        pub(crate) cursor_position: Option<Position>,
+        pub(crate) default_colors: Option<DefaultColors>,
+        pub(crate) keyboard_enhancement_supported: Option<bool>,
+    }
+
+    /// Whether the startup probe should query keyboard enhancement support.
+    #[derive(Clone, Copy, Eq, PartialEq)]
+    pub(crate) enum StartupKeyboardEnhancementProbe {
+        Query,
+        Skip,
+    }
+
     /// Temporary terminal handle used while a startup probe owns terminal input.
     ///
     /// The preferred path is duplicated stdin/stdout, because terminal replies are delivered to the
@@ -198,19 +213,6 @@ mod imp {
         Ok(unsafe { File::from_raw_fd(duplicated) })
     }
 
-    /// Queries the current cursor position and returns a zero-based Ratatui position.
-    ///
-    /// A timeout or a non-CPR response is not fatal. Callers should treat `Ok(None)` as "terminal
-    /// did not answer this optional query" and choose a conservative fallback.
-    pub(crate) fn cursor_position(timeout: Duration) -> io::Result<Option<Position>> {
-        let mut tty = Tty::open()?;
-        tty.write_all(b"\x1B[6n")?;
-        let Some(response) = read_until(&mut tty, timeout, parse_cursor_position)? else {
-            return Ok(None);
-        };
-        Ok(Some(response))
-    }
-
     /// Queries OSC 10 and OSC 11 default colors under one shared deadline.
     ///
     /// Foreground and background are only useful as a pair for palette calculations, so a missing
@@ -226,16 +228,24 @@ mod imp {
         Ok(Some(colors))
     }
 
-    /// Checks whether the terminal reports support for keyboard enhancement flags.
+    /// Runs the optional terminal queries needed during TUI startup under one shared deadline.
     ///
-    /// The probe sends the kitty keyboard-status query followed by primary-device-attributes as a
-    /// fallback. A PDA response proves that the terminal answered but does not prove that keyboard
-    /// enhancement is unsupported until the bounded wait has expired; flags that arrive later in
-    /// the same deadline must still win.
-    pub(crate) fn keyboard_enhancement_supported(timeout: Duration) -> io::Result<Option<bool>> {
+    /// Keeping these queries batched avoids paying one timeout per unsupported capability before
+    /// the first frame can render.
+    pub(crate) fn startup(
+        timeout: Duration,
+        keyboard_probe: StartupKeyboardEnhancementProbe,
+    ) -> io::Result<StartupProbe> {
         let mut tty = Tty::open()?;
-        tty.write_all(b"\x1B[?u\x1B[c")?;
-        read_keyboard_enhancement_supported(&mut tty, timeout)
+        match keyboard_probe {
+            StartupKeyboardEnhancementProbe::Query => {
+                tty.write_all(b"\x1B[6n\x1B]10;?\x1B\\\x1B]11;?\x1B\\\x1B[?u\x1B[c")?;
+            }
+            StartupKeyboardEnhancementProbe::Skip => {
+                tty.write_all(b"\x1B[6n\x1B]10;?\x1B\\\x1B]11;?\x1B\\")?;
+            }
+        }
+        read_startup_probe(&mut tty, timeout, keyboard_probe)
     }
 
     /// Reads available terminal bytes until `parse` recognizes a probe response or time expires.
@@ -265,42 +275,95 @@ mod imp {
         }
     }
 
-    /// Reads keyboard-enhancement responses while giving flags the full bounded window to arrive.
-    fn read_keyboard_enhancement_supported(
+    fn read_startup_probe(
         tty: &mut Tty,
         timeout: Duration,
-    ) -> io::Result<Option<bool>> {
+        keyboard_probe: StartupKeyboardEnhancementProbe,
+    ) -> io::Result<StartupProbe> {
         let deadline = Instant::now() + timeout;
         let mut buffer = Vec::new();
-        let mut saw_supported = false;
-        let mut saw_unsupported_fallback = false;
+        let mut probe = StartupProbe {
+            cursor_position: None,
+            default_colors: None,
+            keyboard_enhancement_supported: None,
+        };
+        let mut saw_supported_keyboard = false;
         loop {
             tty.read_available(&mut buffer)?;
-            match parse_keyboard_enhancement_support(&buffer) {
-                KeyboardProbeState::SupportedAndFallback => return Ok(Some(true)),
-                KeyboardProbeState::Supported => saw_supported = true,
-                KeyboardProbeState::UnsupportedFallback => saw_unsupported_fallback = true,
-                KeyboardProbeState::Pending => {}
-            }
-            if saw_supported && saw_unsupported_fallback {
-                return Ok(Some(true));
+            update_startup_probe(
+                &mut probe,
+                &mut saw_supported_keyboard,
+                &buffer,
+                keyboard_probe,
+            );
+            if startup_probe_complete(&probe, keyboard_probe) {
+                return Ok(probe);
             }
             let now = Instant::now();
             if now >= deadline {
-                if saw_supported {
-                    return Ok(Some(true));
-                }
-                return Ok(saw_unsupported_fallback.then_some(false));
+                finish_startup_probe(&mut probe, keyboard_probe, saw_supported_keyboard);
+                return Ok(probe);
             }
             if !tty.poll_readable(deadline.saturating_duration_since(now))? {
-                if saw_supported {
-                    return Ok(Some(true));
-                }
-                return Ok(saw_unsupported_fallback.then_some(false));
+                finish_startup_probe(&mut probe, keyboard_probe, saw_supported_keyboard);
+                return Ok(probe);
             }
         }
     }
 
+    fn update_startup_probe(
+        probe: &mut StartupProbe,
+        saw_supported_keyboard: &mut bool,
+        buffer: &[u8],
+        keyboard_probe: StartupKeyboardEnhancementProbe,
+    ) {
+        if probe.cursor_position.is_none() {
+            probe.cursor_position = parse_cursor_position(buffer);
+        }
+        if probe.default_colors.is_none() {
+            probe.default_colors = parse_default_colors(buffer);
+        }
+        if keyboard_probe == StartupKeyboardEnhancementProbe::Skip
+            || probe.keyboard_enhancement_supported.is_some()
+        {
+            return;
+        }
+        match parse_keyboard_enhancement_support(buffer) {
+            KeyboardProbeState::SupportedAndFallback => {
+                probe.keyboard_enhancement_supported = Some(true);
+            }
+            KeyboardProbeState::Supported => {
+                *saw_supported_keyboard = true;
+            }
+            KeyboardProbeState::UnsupportedFallback => {
+                probe.keyboard_enhancement_supported = Some(false);
+            }
+            KeyboardProbeState::Pending => {}
+        }
+    }
+
+    fn startup_probe_complete(
+        probe: &StartupProbe,
+        keyboard_probe: StartupKeyboardEnhancementProbe,
+    ) -> bool {
+        probe.cursor_position.is_some()
+            && probe.default_colors.is_some()
+            && (keyboard_probe == StartupKeyboardEnhancementProbe::Skip
+                || probe.keyboard_enhancement_supported.is_some())
+    }
+
+    fn finish_startup_probe(
+        probe: &mut StartupProbe,
+        keyboard_probe: StartupKeyboardEnhancementProbe,
+        saw_supported_keyboard: bool,
+    ) {
+        if keyboard_probe == StartupKeyboardEnhancementProbe::Query
+            && probe.keyboard_enhancement_supported.is_none()
+        {
+            probe.keyboard_enhancement_supported = saw_supported_keyboard.then_some(true);
+        }
+    }
+
     fn parse_cursor_position(buffer: &[u8]) -> Option<Position> {
         for start in find_all_subslices(buffer, b"\x1B[") {
             let rest = &buffer[start + 2..];
@@ -382,11 +445,12 @@ mod imp {
 
     /// Parser state for the keyboard enhancement probe.
     ///
-    /// `UnsupportedFallback` records that a primary-device-attributes response arrived, but the
-    /// caller should keep waiting until the deadline because a later keyboard-flags response is
-    /// more specific. `Supported` records that keyboard flags arrived, but the caller should still
-    /// drain the PDA fallback response if it arrives before the deadline so those bytes do not leak
-    /// into the normal event stream.
+    /// `UnsupportedFallback` records that a primary-device-attributes response arrived without
+    /// keyboard flags. Startup treats that as unsupported immediately, matching crossterm's
+    /// previous behavior and avoiding a fixed delay in terminals without the keyboard protocol.
+    /// `Supported` records that keyboard flags arrived, but the caller should still drain the PDA
+    /// fallback response if it arrives before the deadline so those bytes do not leak into the
+    /// normal event stream.
     #[derive(Debug, Clone, Copy, Eq, PartialEq)]
     enum KeyboardProbeState {
         Pending,
@@ -556,6 +620,38 @@ mod imp {
                 KeyboardProbeState::Pending
             );
         }
+
+        #[test]
+        fn startup_probe_parses_batched_terminal_responses() {
+            let mut probe = StartupProbe {
+                cursor_position: None,
+                default_colors: None,
+                keyboard_enhancement_supported: None,
+            };
+            let mut saw_supported_keyboard = false;
+            update_startup_probe(
+                &mut probe,
+                &mut saw_supported_keyboard,
+                b"\x1B[20;10R\x1B]11;rgb:1111/1111/1111\x07\x1B[?64;1;2c\x1B]10;rgb:eeee/eeee/eeee\x1B\\\x1B[?7u",
+                StartupKeyboardEnhancementProbe::Query,
+            );
+
+            assert_eq!(
+                probe,
+                StartupProbe {
+                    cursor_position: Some(Position { x: 9, y: 19 }),
+                    default_colors: Some(DefaultColors {
+                        fg: (238, 238, 238),
+                        bg: (17, 17, 17),
+                    }),
+                    keyboard_enhancement_supported: Some(true),
+                }
+            );
+            assert!(startup_probe_complete(
+                &probe,
+                StartupKeyboardEnhancementProbe::Query
+            ));
+        }
     }
 }
 
diff --git a/codex-rs/tui/src/tui.rs b/codex-rs/tui/src/tui.rs
index 2d22e161fa..32123b787c 100644
--- a/codex-rs/tui/src/tui.rs
+++ b/codex-rs/tui/src/tui.rs
@@ -63,6 +63,11 @@ pub(crate) const TARGET_FRAME_INTERVAL: Duration = frame_rate_limiter::MIN_FRAME
 /// A type alias for the terminal type used in this application
 pub type Terminal = CustomTerminal<CrosstermBackend<Stdout>>;
 
+pub(crate) struct InitializedTerminal {
+    pub(crate) terminal: Terminal,
+    pub(crate) enhanced_keys_supported: bool,
+}
+
 pub(crate) fn running_in_vscode_terminal() -> bool {
     keyboard_modes::running_in_vscode_terminal()
 }
@@ -334,7 +339,7 @@ fn flush_terminal_input_buffer() {
 pub(crate) fn flush_terminal_input_buffer() {}
 
 /// Initialize the terminal (inline viewport; history stays in normal scrollback)
-pub fn init() -> Result<Terminal> {
+pub(crate) fn init() -> Result<InitializedTerminal> {
     if !stdin().is_terminal() {
         return Err(std::io::Error::other("stdin is not a terminal"));
     }
@@ -351,20 +356,57 @@ pub fn init() -> Result<Terminal> {
     let backend = CrosstermBackend::new(stdout());
 
     #[cfg(unix)]
-    let cursor_pos =
-        match crate::terminal_probe::cursor_position(crate::terminal_probe::DEFAULT_TIMEOUT) {
-            Ok(Some(pos)) => pos,
-            Ok(None) => {
-                tracing::warn!("initial cursor position probe timed out; defaulting to origin");
-                Position { x: 0, y: 0 }
+    let startup_probe = {
+        use crate::terminal_probe::StartupKeyboardEnhancementProbe;
+
+        let started_at = std::time::Instant::now();
+        let keyboard_probe = if keyboard_modes::keyboard_enhancement_disabled() {
+            StartupKeyboardEnhancementProbe::Skip
+        } else {
+            StartupKeyboardEnhancementProbe::Query
+        };
+        match crate::terminal_probe::startup(crate::terminal_probe::DEFAULT_TIMEOUT, keyboard_probe)
+        {
+            Ok(probe) => {
+                tracing::info!(
+                    duration_ms = %started_at.elapsed().as_millis(),
+                    cursor_position = probe.cursor_position.is_some(),
+                    default_colors = probe.default_colors.is_some(),
+                    keyboard_enhancement_supported = ?probe.keyboard_enhancement_supported,
+                    "terminal startup probes completed"
+                );
+                probe
             }
             Err(err) => {
                 tracing::warn!(
-                    "failed to read initial cursor position; defaulting to origin: {err}"
+                    duration_ms = %started_at.elapsed().as_millis(),
+                    "terminal startup probes failed: {err}"
                 );
-                Position { x: 0, y: 0 }
+                crate::terminal_probe::StartupProbe {
+                    cursor_position: None,
+                    default_colors: None,
+                    keyboard_enhancement_supported: None,
+                }
             }
-        };
+        }
+    };
+
+    #[cfg(unix)]
+    crate::terminal_palette::set_default_colors_from_startup_probe(startup_probe.default_colors);
+
+    #[cfg(unix)]
+    let cursor_pos = match startup_probe.cursor_position {
+        Some(pos) => pos,
+        None => {
+            tracing::warn!("initial cursor position probe timed out; defaulting to origin");
+            Position { x: 0, y: 0 }
+        }
+    };
+
+    #[cfg(unix)]
+    let enhanced_keys_supported = startup_probe
+        .keyboard_enhancement_supported
+        .unwrap_or(/*default*/ false);
 
     #[cfg(not(unix))]
     let mut backend = CrosstermBackend::new(stdout());
@@ -372,8 +414,15 @@ pub fn init() -> Result<Terminal> {
     #[cfg(not(unix))]
     let cursor_pos = cursor_position_with_crossterm(&mut backend);
 
+    #[cfg(not(unix))]
+    let enhanced_keys_supported =
+        !keyboard_modes::keyboard_enhancement_disabled() && detect_keyboard_enhancement_supported();
+
     let tui = CustomTerminal::with_options_and_cursor_position(backend, cursor_pos)?;
-    Ok(tui)
+    Ok(InitializedTerminal {
+        terminal: tui,
+        enhanced_keys_supported,
+    })
 }
 
 #[cfg(not(unix))]
@@ -384,13 +433,6 @@ fn cursor_position_with_crossterm(backend: &mut CrosstermBackend<Stdout>) -> Pos
     })
 }
 
-#[cfg(unix)]
-fn detect_keyboard_enhancement_supported() -> bool {
-    crate::terminal_probe::keyboard_enhancement_supported(crate::terminal_probe::DEFAULT_TIMEOUT)
-        .unwrap_or(/*default*/ None)
-        .unwrap_or(/*default*/ false)
-}
-
 #[cfg(not(unix))]
 fn detect_keyboard_enhancement_supported() -> bool {
     // Non-Unix startup keeps the existing crossterm path because the bounded probe implementation
@@ -461,14 +503,10 @@ where
 }
 
 impl Tui {
-    pub fn new(terminal: Terminal) -> Self {
+    pub fn new(terminal: Terminal, enhanced_keys_supported: bool) -> Self {
         let (draw_tx, _) = broadcast::channel(1);
         let frame_requester = FrameRequester::new(draw_tx.clone());
 
-        // Detect keyboard enhancement support before any EventStream is created so the
-        // crossterm poller can acquire its lock without contention.
-        let enhanced_keys_supported = !keyboard_modes::keyboard_enhancement_disabled()
-            && detect_keyboard_enhancement_supported();
         // Cache this to avoid contention with the event reader.
         supports_color::on_cached(supports_color::Stream::Stdout);
         let _ = crate::terminal_palette::default_colors();
diff --git a/codex-rs/tui/src/wrapping.rs b/codex-rs/tui/src/wrapping.rs
index 61bd8147ab..bc66b18ad5 100644
--- a/codex-rs/tui/src/wrapping.rs
+++ b/codex-rs/tui/src/wrapping.rs
@@ -49,8 +49,16 @@ where
     for (line_index, line) in textwrap::wrap(text, &opts).iter().enumerate() {
         match line {
             std::borrow::Cow::Borrowed(slice) => {
-                let start = unsafe { slice.as_ptr().offset_from(text.as_ptr()) as usize };
-                let end = start + slice.len();
+                let range = borrowed_slice_range(text, slice).unwrap_or_else(|| {
+                    let synthetic_prefix = if line_index == 0 {
+                        opts.initial_indent
+                    } else {
+                        opts.subsequent_indent
+                    };
+                    map_owned_wrapped_line_to_range(text, cursor, slice, synthetic_prefix)
+                });
+                let start = range.start;
+                let end = range.end;
                 let trailing_spaces = text[end..].chars().take_while(|c| *c == ' ').count();
                 lines.push(start..end + trailing_spaces + 1);
                 cursor = end + trailing_spaces;
@@ -84,10 +92,16 @@ where
     for (line_index, line) in textwrap::wrap(text, &opts).iter().enumerate() {
         match line {
             std::borrow::Cow::Borrowed(slice) => {
-                let start = unsafe { slice.as_ptr().offset_from(text.as_ptr()) as usize };
-                let end = start + slice.len();
-                lines.push(start..end);
-                cursor = end;
+                let range = borrowed_slice_range(text, slice).unwrap_or_else(|| {
+                    let synthetic_prefix = if line_index == 0 {
+                        opts.initial_indent
+                    } else {
+                        opts.subsequent_indent
+                    };
+                    map_owned_wrapped_line_to_range(text, cursor, slice, synthetic_prefix)
+                });
+                cursor = range.end;
+                lines.push(range);
             }
             std::borrow::Cow::Owned(slice) => {
                 let synthetic_prefix = if line_index == 0 {
@@ -104,6 +118,19 @@ where
     lines
 }
 
+fn borrowed_slice_range(text: &str, slice: &str) -> Option<Range<usize>> {
+    let text_start = text.as_ptr() as usize;
+    let text_end = text_start.checked_add(text.len())?;
+    let slice_start = slice.as_ptr() as usize;
+    let slice_end = slice_start.checked_add(slice.len())?;
+
+    if slice_start < text_start || slice_end > text_end {
+        return None;
+    }
+
+    Some((slice_start - text_start)..(slice_end - text_start))
+}
+
 /// Maps an owned (materialized) wrapped line back to a byte range in `text`.
 ///
 /// `textwrap` returns `Cow::Owned` when it inserts a hyphenation penalty
@@ -1485,6 +1512,17 @@ them."#
         assert_eq!(range, 0..5);
     }
 
+    #[test]
+    fn borrowed_slice_range_rejects_slices_outside_source_text() {
+        let text = "test message";
+        let external = String::from("test");
+
+        assert_eq!(borrowed_slice_range(text, &external), None);
+
+        let fallback = map_owned_wrapped_line_to_range(text, /*cursor*/ 0, &external, "");
+        assert_eq!(fallback, 0..4);
+    }
+
     #[test]
     fn map_owned_wrapped_line_to_range_indent_coincides_with_source() {
         // When the synthetic indent prefix starts with a character that also
diff --git a/codex-rs/tui/tests/suite/mod.rs b/codex-rs/tui/tests/suite/mod.rs
index b205ead325..7e19b10f2b 100644
--- a/codex-rs/tui/tests/suite/mod.rs
+++ b/codex-rs/tui/tests/suite/mod.rs
@@ -1,6 +1,4 @@
 // Aggregates all former standalone integration tests as modules.
-mod model_availability_nux;
-mod no_panic_on_startup;
 mod resize_reflow;
 mod status_indicator;
 mod vt100_history;
diff --git a/codex-rs/tui/tests/suite/model_availability_nux.rs b/codex-rs/tui/tests/suite/model_availability_nux.rs
deleted file mode 100644
index 836dfe7ea4..0000000000
--- a/codex-rs/tui/tests/suite/model_availability_nux.rs
+++ /dev/null
@@ -1,226 +0,0 @@
-use std::collections::HashMap;
-use std::time::Duration;
-
-use anyhow::Context;
-use anyhow::Result;
-use codex_models_manager::bundled_models_response;
-use core_test_support::responses;
-use core_test_support::skip_if_no_network;
-use serde_json::Value as JsonValue;
-use tempfile::tempdir;
-use tokio::select;
-use tokio::time::sleep;
-use tokio::time::timeout;
-use wiremock::MockServer;
-
-#[tokio::test]
-async fn resume_startup_does_not_consume_model_availability_nux_count() -> Result<()> {
-    // run_codex_cli() does not work on Windows due to PTY limitations.
-    if cfg!(windows) {
-        return Ok(());
-    }
-    skip_if_no_network!(Ok(()));
-
-    let repo_root = codex_utils_cargo_bin::repo_root()?;
-    let codex_home = tempdir()?;
-
-    let mut source_catalog: JsonValue = serde_json::to_value(bundled_models_response()?)?;
-    let models = source_catalog
-        .get_mut("models")
-        .and_then(JsonValue::as_array_mut)
-        .context("models array missing")?;
-    for model in models.iter_mut() {
-        if let Some(object) = model.as_object_mut() {
-            object.remove("availability_nux");
-        }
-    }
-    let first_model = models.first_mut().context("models array is empty")?;
-    let first_model_object = first_model
-        .as_object_mut()
-        .context("first model was not a JSON object")?;
-    let model_slug = first_model_object
-        .get("slug")
-        .and_then(JsonValue::as_str)
-        .context("first model missing slug")?
-        .to_string();
-    first_model_object.insert(
-        "availability_nux".to_string(),
-        serde_json::json!({
-            "message": "Model now available",
-        }),
-    );
-
-    let custom_catalog_path = codex_home.path().join("catalog.json");
-    std::fs::write(
-        &custom_catalog_path,
-        serde_json::to_string(&source_catalog)?,
-    )?;
-
-    let repo_root_display = repo_root.display();
-    let catalog_display = custom_catalog_path.display();
-    let config_contents = format!(
-        r#"model = "{model_slug}"
-model_provider = "openai"
-model_catalog_json = "{catalog_display}"
-
-[projects."{repo_root_display}"]
-trust_level = "trusted"
-
-[tui.model_availability_nux]
-"{model_slug}" = 1
-"#
-    );
-    std::fs::write(codex_home.path().join("config.toml"), config_contents)?;
-
-    let server = MockServer::start().await;
-    let sse = responses::sse(vec![
-        responses::ev_response_created("resp-seed-session"),
-        responses::ev_assistant_message("msg-seed-session", "seed session response"),
-        responses::ev_completed("resp-seed-session"),
-    ]);
-    let _response_mock = responses::mount_sse_once(&server, sse).await;
-    let openai_base_url_config = format!("openai_base_url=\"{}/v1\"", server.uri());
-    let codex = if let Ok(path) = codex_utils_cargo_bin::cargo_bin("codex") {
-        path
-    } else {
-        let fallback = repo_root.join("codex-rs/target/debug/codex");
-        if fallback.is_file() {
-            fallback
-        } else {
-            eprintln!("skipping integration test because codex binary is unavailable");
-            return Ok(());
-        }
-    };
-
-    let exec_output = std::process::Command::new(&codex)
-        .arg("exec")
-        .arg("--skip-git-repo-check")
-        .arg("-c")
-        .arg(&openai_base_url_config)
-        .arg("-C")
-        .arg(&repo_root)
-        .arg("seed session for resume")
-        .env("CODEX_HOME", codex_home.path())
-        .env("OPENAI_API_KEY", "dummy")
-        .output()
-        .context("failed to execute codex exec")?;
-    anyhow::ensure!(
-        exec_output.status.success(),
-        "codex exec failed: {}",
-        String::from_utf8_lossy(&exec_output.stderr)
-    );
-
-    let mut env = HashMap::new();
-    env.insert(
-        "CODEX_HOME".to_string(),
-        codex_home.path().display().to_string(),
-    );
-    env.insert("OPENAI_API_KEY".to_string(), "dummy".to_string());
-
-    let args = vec![
-        "resume".to_string(),
-        "--last".to_string(),
-        "--no-alt-screen".to_string(),
-        "-C".to_string(),
-        repo_root.display().to_string(),
-        "-c".to_string(),
-        "analytics.enabled=false".to_string(),
-        "-c".to_string(),
-        openai_base_url_config,
-    ];
-
-    let spawned = codex_utils_pty::spawn_pty_process(
-        codex.to_string_lossy().as_ref(),
-        &args,
-        &repo_root,
-        &env,
-        &None,
-        codex_utils_pty::TerminalSize::default(),
-    )
-    .await?;
-
-    let mut output = Vec::new();
-    let codex_utils_pty::SpawnedProcess {
-        session,
-        stdout_rx,
-        stderr_rx,
-        exit_rx,
-    } = spawned;
-    let mut output_rx = codex_utils_pty::combine_output_receivers(stdout_rx, stderr_rx);
-    let mut exit_rx = exit_rx;
-    let writer_tx = session.writer_sender();
-    let interrupt_writer = writer_tx.clone();
-    let mut startup_ready = false;
-    let mut answered_cursor_query = false;
-
-    let exit_code_result = timeout(Duration::from_secs(30), async {
-        loop {
-            select! {
-                result = output_rx.recv() => match result {
-                    Ok(chunk) => {
-                        let has_cursor_query = chunk.windows(4).any(|window| window == b"\x1b[6n");
-                        if has_cursor_query {
-                            let _ = writer_tx.send(b"\x1b[1;1R".to_vec()).await;
-                            answered_cursor_query = true;
-                        }
-                        output.extend_from_slice(&chunk);
-                        if !startup_ready && answered_cursor_query && !has_cursor_query {
-                            startup_ready = true;
-                            for _ in 0..4 {
-                                let _ = interrupt_writer.send(vec![3]).await;
-                                sleep(Duration::from_millis(500)).await;
-                            }
-                        }
-                    }
-                    Err(tokio::sync::broadcast::error::RecvError::Closed) => break exit_rx.await,
-                    Err(tokio::sync::broadcast::error::RecvError::Lagged(_)) => {}
-                },
-                result = &mut exit_rx => break result,
-            }
-        }
-    })
-    .await;
-
-    let exit_code = match exit_code_result {
-        Ok(Ok(code)) => code,
-        Ok(Err(err)) => return Err(err.into()),
-        Err(_) => {
-            session.terminate();
-            anyhow::bail!("timed out waiting for codex resume to exit");
-        }
-    };
-    let output_text = String::from_utf8_lossy(&output);
-    let rendered_output = {
-        let mut parser = vt100::Parser::new(
-            /*rows*/ 24, /*cols*/ 80, /*scrollback_len*/ 0,
-        );
-        parser.process(&output);
-        parser.screen().contents()
-    };
-    let interrupted_during_terminal_startup = {
-        let trimmed_output = rendered_output.trim();
-        trimmed_output.is_empty()
-            || trimmed_output
-                .chars()
-                .all(|character| character == '^' || character == 'C' || character.is_whitespace())
-    };
-    anyhow::ensure!(
-        exit_code == 0
-            || exit_code == 130
-            || (exit_code == 1 && interrupted_during_terminal_startup),
-        "unexpected exit code from codex resume: {exit_code}; output: {output_text}",
-    );
-
-    let config_contents = std::fs::read_to_string(codex_home.path().join("config.toml"))?;
-    let config: toml::Value = toml::from_str(&config_contents)?;
-    let shown_count = config
-        .get("tui")
-        .and_then(|tui| tui.get("model_availability_nux"))
-        .and_then(|nux| nux.get(&model_slug))
-        .and_then(toml::Value::as_integer)
-        .context("missing tui.model_availability_nux count")?;
-
-    assert_eq!(shown_count, 1);
-
-    Ok(())
-}
diff --git a/codex-rs/tui/tests/suite/no_panic_on_startup.rs b/codex-rs/tui/tests/suite/no_panic_on_startup.rs
deleted file mode 100644
index 6b9a369699..0000000000
--- a/codex-rs/tui/tests/suite/no_panic_on_startup.rs
+++ /dev/null
@@ -1,127 +0,0 @@
-use std::collections::HashMap;
-use std::path::Path;
-use std::time::Duration;
-use tokio::select;
-use tokio::time::timeout;
-
-/// Regression test for https://github.com/openai/codex/issues/8803.
-#[tokio::test]
-#[ignore = "TODO(mbolin): flaky"]
-async fn malformed_rules_should_not_panic() -> anyhow::Result<()> {
-    // run_codex_cli() does not work on Windows due to PTY limitations.
-    if cfg!(windows) {
-        return Ok(());
-    }
-
-    let tmp = tempfile::tempdir()?;
-    let codex_home = tmp.path();
-    std::fs::write(
-        codex_home.join("rules"),
-        "rules should be a directory not a file",
-    )?;
-
-    // TODO(mbolin): Figure out why using a temp dir as the cwd causes this test
-    // to hang.
-    let cwd = std::env::current_dir()?;
-    let config_contents = format!(
-        r#"
-# Pick a local provider so the CLI doesn't prompt for OpenAI auth in this test.
-model_provider = "ollama"
-
-[projects]
-"{cwd}" = {{ trust_level = "trusted" }}
-"#,
-        cwd = cwd.display()
-    );
-    std::fs::write(codex_home.join("config.toml"), config_contents)?;
-
-    let CodexCliOutput { exit_code, output } = run_codex_cli(codex_home, cwd).await?;
-    assert_ne!(0, exit_code, "Codex CLI should exit nonzero.");
-    assert!(
-        output.contains("ERROR: Failed to initialize codex:"),
-        "expected startup error in output, got: {output}"
-    );
-    assert!(
-        output.contains("failed to read rules files"),
-        "expected rules read error in output, got: {output}"
-    );
-    Ok(())
-}
-
-struct CodexCliOutput {
-    exit_code: i32,
-    output: String,
-}
-
-async fn run_codex_cli(
-    codex_home: impl AsRef<Path>,
-    cwd: impl AsRef<Path>,
-) -> anyhow::Result<CodexCliOutput> {
-    let codex_cli = codex_utils_cargo_bin::cargo_bin("codex")?;
-    let mut env = HashMap::new();
-    env.insert(
-        "CODEX_HOME".to_string(),
-        codex_home.as_ref().display().to_string(),
-    );
-
-    let args = vec!["-c".to_string(), "analytics.enabled=false".to_string()];
-    let spawned = codex_utils_pty::spawn_pty_process(
-        codex_cli.to_string_lossy().as_ref(),
-        &args,
-        cwd.as_ref(),
-        &env,
-        &None,
-        codex_utils_pty::TerminalSize::default(),
-    )
-    .await?;
-    let mut output = Vec::new();
-    let codex_utils_pty::SpawnedProcess {
-        session,
-        stdout_rx,
-        stderr_rx,
-        exit_rx,
-    } = spawned;
-    let mut output_rx = codex_utils_pty::combine_output_receivers(stdout_rx, stderr_rx);
-    let mut exit_rx = exit_rx;
-    let writer_tx = session.writer_sender();
-    let exit_code_result = timeout(Duration::from_secs(10), async {
-        // Read PTY output until the process exits while replying to cursor
-        // position queries so the TUI can initialize without a real terminal.
-        loop {
-            select! {
-                result = output_rx.recv() => match result {
-                    Ok(chunk) => {
-                        // The TUI asks for the cursor position via ESC[6n.
-                        // Respond with a valid position to unblock startup.
-                        if chunk.windows(4).any(|window| window == b"\x1b[6n") {
-                            let _ = writer_tx.send(b"\x1b[1;1R".to_vec()).await;
-                        }
-                        output.extend_from_slice(&chunk);
-                    }
-                    Err(tokio::sync::broadcast::error::RecvError::Closed) => break exit_rx.await,
-                    Err(tokio::sync::broadcast::error::RecvError::Lagged(_)) => {}
-                },
-                result = &mut exit_rx => break result,
-            }
-        }
-    })
-    .await;
-    let exit_code = match exit_code_result {
-        Ok(Ok(code)) => code,
-        Ok(Err(err)) => return Err(err.into()),
-        Err(_) => {
-            session.terminate();
-            anyhow::bail!("timed out waiting for codex CLI to exit");
-        }
-    };
-    // Drain any output that raced with the exit notification.
-    while let Ok(chunk) = output_rx.try_recv() {
-        output.extend_from_slice(&chunk);
-    }
-
-    let output = String::from_utf8_lossy(&output);
-    Ok(CodexCliOutput {
-        exit_code,
-        output: output.to_string(),
-    })
-}
diff --git a/codex-rs/utils/approval-presets/src/lib.rs b/codex-rs/utils/approval-presets/src/lib.rs
index b254950500..c7ce9e578b 100644
--- a/codex-rs/utils/approval-presets/src/lib.rs
+++ b/codex-rs/utils/approval-presets/src/lib.rs
@@ -1,3 +1,7 @@
+use codex_protocol::models::ActivePermissionProfile;
+use codex_protocol::models::BUILT_IN_PERMISSION_PROFILE_DANGER_FULL_ACCESS;
+use codex_protocol::models::BUILT_IN_PERMISSION_PROFILE_READ_ONLY;
+use codex_protocol::models::BUILT_IN_PERMISSION_PROFILE_WORKSPACE;
 use codex_protocol::models::PermissionProfile;
 use codex_protocol::protocol::AskForApproval;
 
@@ -12,6 +16,8 @@ pub struct ApprovalPreset {
     pub description: &'static str,
     /// Approval policy to apply.
     pub approval: AskForApproval,
+    /// Built-in permission profile selected by this preset.
+    pub active_permission_profile: ActivePermissionProfile,
     /// Permission profile to apply.
     pub permission_profile: PermissionProfile,
 }
@@ -26,6 +32,9 @@ pub fn builtin_approval_presets() -> Vec<ApprovalPreset> {
             label: "Read Only",
             description: "Codex can read files in the current workspace. Approval is required to edit files or access the internet.",
             approval: AskForApproval::OnRequest,
+            active_permission_profile: ActivePermissionProfile::new(
+                BUILT_IN_PERMISSION_PROFILE_READ_ONLY,
+            ),
             permission_profile: PermissionProfile::read_only(),
         },
         ApprovalPreset {
@@ -33,6 +42,9 @@ pub fn builtin_approval_presets() -> Vec<ApprovalPreset> {
             label: "Default",
             description: "Codex can read and edit files in the current workspace, and run commands. Approval is required to access the internet or edit other files. (Identical to Agent mode)",
             approval: AskForApproval::OnRequest,
+            active_permission_profile: ActivePermissionProfile::new(
+                BUILT_IN_PERMISSION_PROFILE_WORKSPACE,
+            ),
             permission_profile: PermissionProfile::workspace_write(),
         },
         ApprovalPreset {
@@ -40,7 +52,26 @@ pub fn builtin_approval_presets() -> Vec<ApprovalPreset> {
             label: "Full Access",
             description: "Codex can edit files outside this workspace and access the internet without asking for approval. Exercise caution when using.",
             approval: AskForApproval::Never,
+            active_permission_profile: ActivePermissionProfile::new(
+                BUILT_IN_PERMISSION_PROFILE_DANGER_FULL_ACCESS,
+            ),
             permission_profile: PermissionProfile::Disabled,
         },
     ]
 }
+
+/// Return the concrete profile for one of the built-in active profile ids.
+pub fn builtin_permission_profile_for_active_permission_profile(
+    active_permission_profile: &ActivePermissionProfile,
+) -> Option<PermissionProfile> {
+    if active_permission_profile.extends.is_some() {
+        return None;
+    }
+
+    match active_permission_profile.id.as_str() {
+        BUILT_IN_PERMISSION_PROFILE_READ_ONLY => Some(PermissionProfile::read_only()),
+        BUILT_IN_PERMISSION_PROFILE_WORKSPACE => Some(PermissionProfile::workspace_write()),
+        BUILT_IN_PERMISSION_PROFILE_DANGER_FULL_ACCESS => Some(PermissionProfile::Disabled),
+        _ => None,
+    }
+}
diff --git a/codex-rs/utils/cli/Cargo.toml b/codex-rs/utils/cli/Cargo.toml
index 1ade005e3b..9d330c5ce6 100644
--- a/codex-rs/utils/cli/Cargo.toml
+++ b/codex-rs/utils/cli/Cargo.toml
@@ -10,6 +10,7 @@ workspace = true
 [dependencies]
 clap = { workspace = true, features = ["derive", "wrap_help"] }
 codex-protocol = { workspace = true }
+codex-shell-command = { workspace = true }
 serde = { workspace = true }
 toml = { workspace = true }
 
diff --git a/codex-rs/utils/cli/src/config_override.rs b/codex-rs/utils/cli/src/config_override.rs
index 41be3ca6b6..8368b10f89 100644
--- a/codex-rs/utils/cli/src/config_override.rs
+++ b/codex-rs/utils/cli/src/config_override.rs
@@ -37,6 +37,13 @@ pub struct CliConfigOverrides {
 }
 
 impl CliConfigOverrides {
+    /// Prepend root-level config flags so they have lower precedence than
+    /// command-specific flags parsed after a subcommand.
+    pub fn prepend_root_overrides(&mut self, root_overrides: Self) {
+        self.raw_overrides
+            .splice(0..0, root_overrides.raw_overrides);
+    }
+
     /// Parse the raw strings captured from the CLI into a list of `(path,
     /// value)` tuples where `value` is a `serde_json::Value`.
     pub fn parse_overrides(&self) -> Result<Vec<(String, Value)>, String> {
@@ -190,6 +197,24 @@ mod tests {
         assert_eq!(parsed[0].1.as_bool(), Some(true));
     }
 
+    #[test]
+    fn prepends_root_overrides() {
+        let mut subcommand_overrides = CliConfigOverrides {
+            raw_overrides: vec![r#"model="gpt-5.2""#.to_string()],
+        };
+        subcommand_overrides.prepend_root_overrides(CliConfigOverrides {
+            raw_overrides: vec![r#"model="gpt-5.1""#.to_string()],
+        });
+
+        assert_eq!(
+            subcommand_overrides.raw_overrides,
+            vec![
+                r#"model="gpt-5.1""#.to_string(),
+                r#"model="gpt-5.2""#.to_string(),
+            ]
+        );
+    }
+
     #[test]
     fn parses_inline_table() {
         let v = parse_toml_value("{a = 1, b = 2}").expect("parse");
diff --git a/codex-rs/utils/cli/src/lib.rs b/codex-rs/utils/cli/src/lib.rs
index 35e4fd1daf..633638e72d 100644
--- a/codex-rs/utils/cli/src/lib.rs
+++ b/codex-rs/utils/cli/src/lib.rs
@@ -1,11 +1,15 @@
 mod approval_mode_cli_arg;
 mod config_override;
 pub(crate) mod format_env_display;
+mod resume_command;
 mod sandbox_mode_cli_arg;
 mod shared_options;
 
 pub use approval_mode_cli_arg::ApprovalModeCliArg;
+pub use codex_protocol::config_types::ProfileV2Name;
 pub use config_override::CliConfigOverrides;
 pub use format_env_display::format_env_display;
+pub use resume_command::resume_command;
+pub use resume_command::resume_hint;
 pub use sandbox_mode_cli_arg::SandboxModeCliArg;
 pub use shared_options::SharedCliOptions;
diff --git a/codex-rs/utils/cli/src/resume_command.rs b/codex-rs/utils/cli/src/resume_command.rs
new file mode 100644
index 0000000000..d3c6839057
--- /dev/null
+++ b/codex-rs/utils/cli/src/resume_command.rs
@@ -0,0 +1,103 @@
+//! Shared formatting for user-facing `codex resume` command hints.
+
+use codex_protocol::ThreadId;
+use codex_shell_command::parse_command::shlex_join;
+
+pub fn resume_command(thread_name: Option<&str>, thread_id: Option<ThreadId>) -> Option<String> {
+    let resume_target = thread_name
+        .filter(|name| !name.is_empty())
+        .map(str::to_string)
+        .or_else(|| thread_id.map(|thread_id| thread_id.to_string()));
+    resume_target.map(|target| {
+        let needs_double_dash = target.starts_with('-');
+        let escaped = shlex_join(&[target]);
+        if needs_double_dash {
+            format!("codex resume -- {escaped}")
+        } else {
+            format!("codex resume {escaped}")
+        }
+    })
+}
+
+pub fn resume_hint(thread_name: Option<&str>, thread_id: Option<ThreadId>) -> Option<String> {
+    let thread_id = thread_id?;
+    match thread_name.filter(|name| !name.is_empty()) {
+        Some(thread_name) => Some(format!(
+            "codex resume, then select {thread_name} ({thread_id})"
+        )),
+        None => resume_command(/*thread_name*/ None, Some(thread_id)),
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use pretty_assertions::assert_eq;
+
+    #[test]
+    fn prefers_name_over_id() {
+        let thread_id = ThreadId::from_string("123e4567-e89b-12d3-a456-426614174000").unwrap();
+        let command = resume_command(Some("my-thread"), Some(thread_id));
+        assert_eq!(command, Some("codex resume my-thread".to_string()));
+    }
+
+    #[test]
+    fn formats_thread_id_when_name_is_missing() {
+        let thread_id = ThreadId::from_string("123e4567-e89b-12d3-a456-426614174000").unwrap();
+        let command = resume_command(/*thread_name*/ None, Some(thread_id));
+        assert_eq!(
+            command,
+            Some("codex resume 123e4567-e89b-12d3-a456-426614174000".to_string())
+        );
+    }
+
+    #[test]
+    fn returns_none_without_a_resume_target() {
+        let command = resume_command(/*thread_name*/ None, /*thread_id*/ None);
+        assert_eq!(command, None);
+    }
+
+    #[test]
+    fn quotes_thread_names_when_needed() {
+        let command = resume_command(Some("-starts-with-dash"), /*thread_id*/ None);
+        assert_eq!(
+            command,
+            Some("codex resume -- -starts-with-dash".to_string())
+        );
+
+        let command = resume_command(Some("two words"), /*thread_id*/ None);
+        assert_eq!(command, Some("codex resume 'two words'".to_string()));
+
+        let command = resume_command(Some("quote'case"), /*thread_id*/ None);
+        assert_eq!(command, Some("codex resume \"quote'case\"".to_string()));
+    }
+
+    #[test]
+    fn resume_hint_names_picker_item_with_id() {
+        let thread_id = ThreadId::from_string("123e4567-e89b-12d3-a456-426614174000").unwrap();
+        let hint = resume_hint(Some("my-thread"), Some(thread_id));
+        assert_eq!(
+            hint,
+            Some(
+                "codex resume, then select my-thread (123e4567-e89b-12d3-a456-426614174000)"
+                    .to_string()
+            )
+        );
+    }
+
+    #[test]
+    fn resume_hint_uses_direct_id_command_without_name() {
+        let thread_id = ThreadId::from_string("123e4567-e89b-12d3-a456-426614174000").unwrap();
+        let hint = resume_hint(/*thread_name*/ None, Some(thread_id));
+        assert_eq!(
+            hint,
+            Some("codex resume 123e4567-e89b-12d3-a456-426614174000".to_string())
+        );
+    }
+
+    #[test]
+    fn resume_hint_requires_thread_id() {
+        let hint = resume_hint(Some("my-thread"), /*thread_id*/ None);
+        assert_eq!(hint, None);
+    }
+}
diff --git a/codex-rs/utils/cli/src/shared_options.rs b/codex-rs/utils/cli/src/shared_options.rs
index 78b123f4e1..b59a3b5c85 100644
--- a/codex-rs/utils/cli/src/shared_options.rs
+++ b/codex-rs/utils/cli/src/shared_options.rs
@@ -2,9 +2,10 @@
 
 use crate::SandboxModeCliArg;
 use clap::Args;
+use codex_protocol::config_types::ProfileV2Name;
 use std::path::PathBuf;
 
-#[derive(Args, Debug, Default)]
+#[derive(Args, Clone, Debug, Default)]
 pub struct SharedCliOptions {
     /// Optional image(s) to attach to the initial prompt.
     #[arg(
@@ -33,6 +34,10 @@ pub struct SharedCliOptions {
     #[arg(long = "profile", short = 'p')]
     pub config_profile: Option<String>,
 
+    /// Layer $CODEX_HOME/<name>.config.toml on top of the base user config.
+    #[arg(long = "profile-v2")]
+    pub config_profile_v2: Option<ProfileV2Name>,
+
     /// Select the sandbox policy to use when executing model-generated shell
     /// commands.
     #[arg(long = "sandbox", short = 's')]
@@ -71,6 +76,7 @@ impl SharedCliOptions {
             oss,
             oss_provider,
             config_profile,
+            config_profile_v2,
             sandbox_mode,
             dangerously_bypass_approvals_and_sandbox,
             bypass_hook_trust,
@@ -83,6 +89,7 @@ impl SharedCliOptions {
             oss: root_oss,
             oss_provider: root_oss_provider,
             config_profile: root_config_profile,
+            config_profile_v2: root_config_profile_v2,
             sandbox_mode: root_sandbox_mode,
             dangerously_bypass_approvals_and_sandbox: root_dangerously_bypass_approvals_and_sandbox,
             bypass_hook_trust: root_bypass_hook_trust,
@@ -102,6 +109,9 @@ impl SharedCliOptions {
         if config_profile.is_none() {
             config_profile.clone_from(root_config_profile);
         }
+        if config_profile_v2.is_none() {
+            config_profile_v2.clone_from(root_config_profile_v2);
+        }
         if sandbox_mode.is_none() {
             *sandbox_mode = *root_sandbox_mode;
         }
@@ -136,6 +146,7 @@ impl SharedCliOptions {
             oss,
             oss_provider,
             config_profile,
+            config_profile_v2,
             sandbox_mode,
             dangerously_bypass_approvals_and_sandbox,
             bypass_hook_trust,
@@ -155,6 +166,9 @@ impl SharedCliOptions {
         if let Some(config_profile) = config_profile {
             self.config_profile = Some(config_profile);
         }
+        if let Some(config_profile_v2) = config_profile_v2 {
+            self.config_profile_v2 = Some(config_profile_v2);
+        }
         if subcommand_selected_sandbox_mode {
             self.sandbox_mode = sandbox_mode;
             self.dangerously_bypass_approvals_and_sandbox =
diff --git a/codex-rs/utils/plugins/src/mcp_connector.rs b/codex-rs/utils/plugins/src/mcp_connector.rs
index 0f02258c16..0c293936c9 100644
--- a/codex-rs/utils/plugins/src/mcp_connector.rs
+++ b/codex-rs/utils/plugins/src/mcp_connector.rs
@@ -11,8 +11,6 @@ const DISALLOWED_CONNECTOR_IDS: &[&str] = &[
 ];
 const FIRST_PARTY_CHAT_DISALLOWED_CONNECTOR_IDS: &[&str] =
     &["connector_0f9c9d4592e54d0a9a12b3f44a1e2010"];
-const ALLOWED_OPENAI_CONNECTOR_IDS: &[&str] = &["connector_openai_library"];
-const DISALLOWED_CONNECTOR_PREFIX: &str = "connector_openai_";
 
 pub fn is_connector_id_allowed(connector_id: &str) -> bool {
     is_connector_id_allowed_for_originator(connector_id, originator().value.as_str())
@@ -25,12 +23,7 @@ fn is_connector_id_allowed_for_originator(connector_id: &str, originator_value:
         DISALLOWED_CONNECTOR_IDS
     };
 
-    if ALLOWED_OPENAI_CONNECTOR_IDS.contains(&connector_id) {
-        return true;
-    }
-
-    !connector_id.starts_with(DISALLOWED_CONNECTOR_PREFIX)
-        && !disallowed_connector_ids.contains(&connector_id)
+    !disallowed_connector_ids.contains(&connector_id)
 }
 
 pub fn sanitize_name(name: &str) -> String {
diff --git a/codex-rs/utils/sandbox-summary/Cargo.toml b/codex-rs/utils/sandbox-summary/Cargo.toml
index 758d779781..cb892238d9 100644
--- a/codex-rs/utils/sandbox-summary/Cargo.toml
+++ b/codex-rs/utils/sandbox-summary/Cargo.toml
@@ -11,6 +11,7 @@ workspace = true
 codex-core = { workspace = true }
 codex-model-provider-info = { workspace = true }
 codex-protocol = { workspace = true }
+codex-utils-absolute-path = { workspace = true }
 
 [dev-dependencies]
 codex-utils-absolute-path = { workspace = true }
diff --git a/codex-rs/utils/sandbox-summary/src/sandbox_summary.rs b/codex-rs/utils/sandbox-summary/src/sandbox_summary.rs
index 0719773aad..47e801bec4 100644
--- a/codex-rs/utils/sandbox-summary/src/sandbox_summary.rs
+++ b/codex-rs/utils/sandbox-summary/src/sandbox_summary.rs
@@ -1,7 +1,7 @@
 use codex_protocol::models::PermissionProfile;
 use codex_protocol::protocol::NetworkAccess;
 use codex_protocol::protocol::SandboxPolicy;
-use std::path::Path;
+use codex_utils_absolute_path::AbsolutePathBuf;
 
 pub fn summarize_sandbox_policy(sandbox_policy: &SandboxPolicy) -> String {
     match sandbox_policy {
@@ -51,8 +51,39 @@ pub fn summarize_sandbox_policy(sandbox_policy: &SandboxPolicy) -> String {
     }
 }
 
-pub fn summarize_permission_profile(permission_profile: &PermissionProfile, cwd: &Path) -> String {
-    match permission_profile.to_legacy_sandbox_policy(cwd) {
+pub fn summarize_permission_profile(
+    permission_profile: &PermissionProfile,
+    cwd: &AbsolutePathBuf,
+    workspace_roots: &[AbsolutePathBuf],
+) -> String {
+    match permission_profile.to_legacy_sandbox_policy(cwd.as_path()) {
+        Ok(SandboxPolicy::WorkspaceWrite {
+            network_access,
+            exclude_tmpdir_env_var,
+            exclude_slash_tmp,
+            ..
+        }) => {
+            let mut summary = "workspace-write".to_string();
+            let mut writable_entries = vec!["workdir".to_string()];
+            if !exclude_slash_tmp {
+                writable_entries.push("/tmp".to_string());
+            }
+            if !exclude_tmpdir_env_var {
+                writable_entries.push("$TMPDIR".to_string());
+            }
+            writable_entries.extend(
+                workspace_roots
+                    .iter()
+                    .filter(|root| *root != cwd)
+                    .map(|root| root.to_string_lossy().to_string()),
+            );
+
+            summary.push_str(&format!(" [{}]", writable_entries.join(", ")));
+            if network_access {
+                summary.push_str(" (network access enabled)");
+            }
+            summary
+        }
         Ok(policy) => summarize_sandbox_policy(&policy),
         Err(_) => {
             if permission_profile.network_sandbox_policy().is_enabled() {
@@ -67,6 +98,7 @@ pub fn summarize_permission_profile(permission_profile: &PermissionProfile, cwd:
 #[cfg(test)]
 mod tests {
     use super::*;
+    use codex_protocol::permissions::NetworkSandboxPolicy;
     use codex_utils_absolute_path::AbsolutePathBuf;
     use pretty_assertions::assert_eq;
 
@@ -112,4 +144,39 @@ mod tests {
             )
         );
     }
+
+    #[test]
+    fn permission_profile_summary_uses_runtime_workspace_roots_and_hides_internal_writes() {
+        let cwd =
+            AbsolutePathBuf::try_from(if cfg!(windows) { "C:\\repo" } else { "/repo" }).unwrap();
+        let extra_root = AbsolutePathBuf::try_from(if cfg!(windows) {
+            "C:\\repo-extra"
+        } else {
+            "/repo-extra"
+        })
+        .unwrap();
+        let hidden_root = AbsolutePathBuf::try_from(if cfg!(windows) {
+            "C:\\Users\\test\\.codex\\memories"
+        } else {
+            "/Users/test/.codex/memories"
+        })
+        .unwrap();
+        let profile = PermissionProfile::workspace_write_with(
+            std::slice::from_ref(&hidden_root),
+            NetworkSandboxPolicy::Restricted,
+            /*exclude_tmpdir_env_var*/ false,
+            /*exclude_slash_tmp*/ false,
+        );
+
+        let summary =
+            summarize_permission_profile(&profile, &cwd, &[cwd.clone(), extra_root.clone()]);
+
+        assert_eq!(
+            summary,
+            format!(
+                "workspace-write [workdir, /tmp, $TMPDIR, {}]",
+                extra_root.display()
+            )
+        );
+    }
 }
diff --git a/codex-rs/v8-poc/src/lib.rs b/codex-rs/v8-poc/src/lib.rs
index f43a9a1253..5103cdeb39 100644
--- a/codex-rs/v8-poc/src/lib.rs
+++ b/codex-rs/v8-poc/src/lib.rs
@@ -78,4 +78,15 @@ mod tests {
     fn evaluates_string_concatenation() {
         assert_eq!(evaluate_expression("'hello ' + 'world'"), "hello world");
     }
+
+    #[test]
+    fn parses_crdtp_dispatchable_messages() {
+        let cbor = v8::crdtp::json_to_cbor(br#"{"id":7,"method":"Runtime.evaluate","params":{}}"#)
+            .expect("JSON should convert to CBOR");
+        let dispatchable = v8::crdtp::Dispatchable::new(&cbor);
+
+        assert!(dispatchable.ok());
+        assert_eq!(dispatchable.call_id(), 7);
+        assert_eq!(dispatchable.method(), b"Runtime.evaluate");
+    }
 }
diff --git a/codex-rs/windows-sandbox-rs/src/audit.rs b/codex-rs/windows-sandbox-rs/src/audit.rs
index c45e3341b7..c7e7fc0b11 100644
--- a/codex-rs/windows-sandbox-rs/src/audit.rs
+++ b/codex-rs/windows-sandbox-rs/src/audit.rs
@@ -2,14 +2,16 @@ use crate::acl::add_deny_write_ace;
 use crate::acl::path_mask_allows;
 use crate::cap::cap_sid_file;
 use crate::cap::load_or_create_cap_sids;
+use crate::cap::workspace_write_cap_sid_for_root;
+use crate::cap::workspace_write_root_contains_path;
 use crate::logging::debug_log;
 use crate::logging::log_note;
 use crate::path_normalization::canonical_path_key;
 use crate::policy::SandboxPolicy;
-use crate::token::convert_string_sid_to_sid;
+use crate::setup::effective_write_roots_for_setup;
+use crate::token::LocalSid;
 use crate::token::world_sid;
 use anyhow::Result;
-use anyhow::anyhow;
 use std::collections::HashSet;
 use std::ffi::OsStr;
 use std::ffi::c_void;
@@ -231,6 +233,7 @@ pub fn apply_world_writable_scan_and_denies(
         &flagged,
         sandbox_policy,
         cwd,
+        env_map,
         logs_base_dir,
     ) {
         log_note(
@@ -246,6 +249,7 @@ pub fn apply_capability_denies_for_world_writable(
     flagged: &[PathBuf],
     sandbox_policy: &SandboxPolicy,
     cwd: &Path,
+    env_map: &std::collections::HashMap<String, String>,
     logs_base_dir: Option<&Path>,
 ) -> Result<()> {
     if flagged.is_empty() {
@@ -255,46 +259,56 @@ pub fn apply_capability_denies_for_world_writable(
     let cap_path = cap_sid_file(codex_home);
     let caps = load_or_create_cap_sids(codex_home)?;
     std::fs::write(&cap_path, serde_json::to_string(&caps)?)?;
-    let (active_sid, workspace_roots): (*mut c_void, Vec<PathBuf>) = match sandbox_policy {
-        SandboxPolicy::WorkspaceWrite { writable_roots, .. } => {
-            let sid = unsafe { convert_string_sid_to_sid(&caps.workspace) }
-                .ok_or_else(|| anyhow!("ConvertStringSidToSidW failed for workspace capability"))?;
-            let mut roots: Vec<PathBuf> =
-                vec![dunce::canonicalize(cwd).unwrap_or_else(|_| cwd.to_path_buf())];
-            for root in writable_roots {
-                let candidate = root.as_path();
-                roots.push(dunce::canonicalize(candidate).unwrap_or_else(|_| root.to_path_buf()));
-            }
-            (sid, roots)
+    let (active_sids, workspace_roots): (Vec<LocalSid>, Vec<PathBuf>) = match sandbox_policy {
+        SandboxPolicy::WorkspaceWrite { .. } => {
+            let roots = effective_write_roots_for_setup(
+                sandbox_policy,
+                cwd,
+                cwd,
+                env_map,
+                codex_home,
+                /*write_roots_override*/ None,
+            );
+            let active_sids = roots
+                .iter()
+                .map(|root| {
+                    workspace_write_cap_sid_for_root(codex_home, cwd, root)
+                        .and_then(|sid| LocalSid::from_string(&sid))
+                })
+                .collect::<Result<Vec<_>>>()?;
+            (active_sids, roots)
+        }
+        SandboxPolicy::ReadOnly { .. } => {
+            (vec![LocalSid::from_string(&caps.readonly)?], Vec::new())
         }
-        SandboxPolicy::ReadOnly { .. } => (
-            unsafe { convert_string_sid_to_sid(&caps.readonly) }
-                .ok_or_else(|| anyhow!("ConvertStringSidToSidW failed for readonly capability"))?,
-            Vec::new(),
-        ),
         SandboxPolicy::DangerFullAccess | SandboxPolicy::ExternalSandbox { .. } => {
             return Ok(());
         }
     };
     for path in flagged {
-        if workspace_roots.iter().any(|root| path.starts_with(root)) {
+        if workspace_roots
+            .iter()
+            .any(|root| workspace_write_root_contains_path(root, path))
+        {
             continue;
         }
-        let res = unsafe { add_deny_write_ace(path, active_sid) };
-        match res {
-            Ok(true) => log_note(
-                &format!("AUDIT: applied capability deny ACE to {}", path.display()),
-                logs_base_dir,
-            ),
-            Ok(false) => {}
-            Err(err) => log_note(
-                &format!(
-                    "AUDIT: failed to apply capability deny ACE to {}: {}",
-                    path.display(),
-                    err
+        for active_sid in &active_sids {
+            let res = unsafe { add_deny_write_ace(path, active_sid.as_ptr()) };
+            match res {
+                Ok(true) => log_note(
+                    &format!("AUDIT: applied capability deny ACE to {}", path.display()),
+                    logs_base_dir,
                 ),
-                logs_base_dir,
-            ),
+                Ok(false) => {}
+                Err(err) => log_note(
+                    &format!(
+                        "AUDIT: failed to apply capability deny ACE to {}: {}",
+                        path.display(),
+                        err
+                    ),
+                    logs_base_dir,
+                ),
+            }
         }
     }
     Ok(())
diff --git a/codex-rs/windows-sandbox-rs/src/bin/setup_main/win.rs b/codex-rs/windows-sandbox-rs/src/bin/setup_main/win.rs
index d862f33eca..f0475bc39f 100644
--- a/codex-rs/windows-sandbox-rs/src/bin/setup_main/win.rs
+++ b/codex-rs/windows-sandbox-rs/src/bin/setup_main/win.rs
@@ -20,7 +20,6 @@ use codex_windows_sandbox::extract_setup_failure;
 use codex_windows_sandbox::hide_newly_created_users;
 use codex_windows_sandbox::install_wfp_filters;
 use codex_windows_sandbox::is_command_cwd_root;
-use codex_windows_sandbox::load_or_create_cap_sids;
 use codex_windows_sandbox::log_note;
 use codex_windows_sandbox::path_mask_allows;
 use codex_windows_sandbox::sandbox_bin_dir;
@@ -29,7 +28,8 @@ use codex_windows_sandbox::sandbox_secrets_dir;
 use codex_windows_sandbox::string_from_sid_bytes;
 use codex_windows_sandbox::sync_persistent_deny_read_acls;
 use codex_windows_sandbox::to_wide;
-use codex_windows_sandbox::workspace_cap_sid_for_cwd;
+use codex_windows_sandbox::workspace_write_cap_sid_for_root;
+use codex_windows_sandbox::workspace_write_root_overlaps_path;
 use codex_windows_sandbox::write_setup_error_report;
 use serde::Deserialize;
 use serde::Serialize;
@@ -120,6 +120,42 @@ fn log_line(log: &mut File, msg: &str) -> Result<()> {
     Ok(())
 }
 
+fn workspace_write_cap_sids_for_path(
+    codex_home: &Path,
+    command_cwd: &Path,
+    write_roots: &[PathBuf],
+    path: &Path,
+) -> Result<Vec<String>> {
+    let mut sid_strs = Vec::new();
+    for root in write_roots {
+        if workspace_write_root_overlaps_path(root, path) {
+            sid_strs.push(workspace_write_cap_sid_for_root(
+                codex_home,
+                command_cwd,
+                root,
+            )?);
+        }
+    }
+    if sid_strs.is_empty() {
+        if write_roots.is_empty() {
+            sid_strs.push(workspace_write_cap_sid_for_root(
+                codex_home,
+                command_cwd,
+                command_cwd,
+            )?);
+        } else {
+            for root in write_roots {
+                sid_strs.push(workspace_write_cap_sid_for_root(
+                    codex_home,
+                    command_cwd,
+                    root,
+                )?);
+            }
+        }
+    }
+    Ok(sid_strs)
+}
+
 fn spawn_read_acl_helper(payload: &Payload, _log: &mut File) -> Result<()> {
     let mut read_payload = payload.clone();
     read_payload.mode = SetupMode::ReadAclsOnly;
@@ -566,25 +602,6 @@ fn run_setup_full(payload: &Payload, log: &mut File, sbx_dir: &Path) -> Result<(
     let sandbox_group_sid_str =
         string_from_sid_bytes(&sandbox_group_sid).map_err(anyhow::Error::msg)?;
 
-    let caps = load_or_create_cap_sids(&payload.codex_home).map_err(|err| {
-        anyhow::Error::new(SetupFailure::new(
-            SetupErrorCode::HelperCapabilitySidFailed,
-            format!("load or create capability SIDs failed: {err}"),
-        ))
-    })?;
-    let cap_psid = unsafe {
-        convert_string_sid_to_sid(&caps.workspace).ok_or_else(|| {
-            anyhow::Error::new(SetupFailure::new(
-                SetupErrorCode::HelperCapabilitySidFailed,
-                format!("convert capability SID {} failed", caps.workspace),
-            ))
-        })?
-    };
-    let workspace_sid_str = workspace_cap_sid_for_cwd(&payload.codex_home, &payload.command_cwd)?;
-    let workspace_psid = unsafe {
-        convert_string_sid_to_sid(&workspace_sid_str)
-            .ok_or_else(|| anyhow::anyhow!("convert workspace capability SID failed"))?
-    };
     let mut refresh_errors: Vec<String> = Vec::new();
     if !refresh_only {
         let proxy_allowlist_result = firewall::ensure_offline_proxy_allowlist(
@@ -681,10 +698,9 @@ fn run_setup_full(payload: &Payload, log: &mut File, sbx_dir: &Path) -> Result<(
         )?;
     }
 
-    let cap_sid_str = caps.workspace;
     let write_mask =
         FILE_GENERIC_READ | FILE_GENERIC_WRITE | FILE_GENERIC_EXECUTE | DELETE | FILE_DELETE_CHILD;
-    let mut grant_tasks: Vec<PathBuf> = Vec::new();
+    let mut grant_tasks: Vec<(PathBuf, String)> = Vec::new();
 
     let mut seen_deny_paths: HashSet<PathBuf> = HashSet::new();
     let mut seen_write_roots: HashSet<PathBuf> = HashSet::new();
@@ -706,16 +722,17 @@ fn run_setup_full(payload: &Payload, log: &mut File, sbx_dir: &Path) -> Result<(
         let cap_label = if is_command_cwd {
             "workspace_cap"
         } else {
-            "cap"
+            "root_cap"
         };
-        let cap_psid_for_root = if is_command_cwd {
-            workspace_psid
-        } else {
-            cap_psid
+        let root_cap_sid_str =
+            workspace_write_cap_sid_for_root(&payload.codex_home, &payload.command_cwd, root)?;
+        let root_cap_psid = unsafe {
+            convert_string_sid_to_sid(&root_cap_sid_str)
+                .ok_or_else(|| anyhow::anyhow!("convert write root capability SID failed"))?
         };
         for (label, psid) in [
             ("sandbox_group", sandbox_group_psid),
-            (cap_label, cap_psid_for_root),
+            (cap_label, root_cap_psid),
         ] {
             let has =
                 match path_mask_allows(root, &[psid], write_mask, /*require_all_bits*/ true) {
@@ -741,6 +758,9 @@ fn run_setup_full(payload: &Payload, log: &mut File, sbx_dir: &Path) -> Result<(
                 need_grant = true;
             }
         }
+        unsafe {
+            LocalFree(root_cap_psid as HLOCAL);
+        }
         if need_grant {
             log_line(
                 log,
@@ -749,19 +769,14 @@ fn run_setup_full(payload: &Payload, log: &mut File, sbx_dir: &Path) -> Result<(
                     root.display()
                 ),
             )?;
-            grant_tasks.push(root.clone());
+            grant_tasks.push((root.clone(), root_cap_sid_str));
         }
     }
 
     let (tx, rx) = mpsc::channel::<(PathBuf, Result<bool>)>();
     std::thread::scope(|scope| {
-        for root in grant_tasks {
-            let is_command_cwd = is_command_cwd_root(&root, &canonical_command_cwd);
-            let sid_strings = if is_command_cwd {
-                vec![sandbox_group_sid_str.clone(), workspace_sid_str.clone()]
-            } else {
-                vec![sandbox_group_sid_str.clone(), cap_sid_str.clone()]
-            };
+        for (root, root_cap_sid_str) in grant_tasks {
+            let sid_strings = vec![sandbox_group_sid_str.clone(), root_cap_sid_str];
             let tx = tx.clone();
             scope.spawn(move || {
                 // Convert SID strings to psids locally in this thread.
@@ -823,27 +838,36 @@ fn run_setup_full(payload: &Payload, log: &mut File, sbx_dir: &Path) -> Result<(
                 .with_context(|| format!("failed to create deny-write path {}", path.display()))?;
         }
 
-        let canonical_path = canonicalize_path(path);
-        let deny_psid = if canonical_path.starts_with(&canonical_command_cwd) {
-            workspace_psid
-        } else {
-            cap_psid
-        };
+        let deny_sid_strs = workspace_write_cap_sids_for_path(
+            &payload.codex_home,
+            &payload.command_cwd,
+            &payload.write_roots,
+            path,
+        )?;
+        for deny_sid_str in deny_sid_strs {
+            let deny_psid = unsafe {
+                convert_string_sid_to_sid(&deny_sid_str)
+                    .ok_or_else(|| anyhow::anyhow!("convert deny capability SID failed"))?
+            };
 
-        match unsafe { add_deny_write_ace(path, deny_psid) } {
-            Ok(true) => {
-                log_line(
-                    log,
-                    &format!("applied deny ACE to protect {}", path.display()),
-                )?;
+            match unsafe { add_deny_write_ace(path, deny_psid) } {
+                Ok(true) => {
+                    log_line(
+                        log,
+                        &format!("applied deny ACE to protect {}", path.display()),
+                    )?;
+                }
+                Ok(false) => {}
+                Err(err) => {
+                    refresh_errors.push(format!("deny ACE failed on {}: {err}", path.display()));
+                    log_line(
+                        log,
+                        &format!("deny ACE failed on {}: {err}", path.display()),
+                    )?;
+                }
             }
-            Ok(false) => {}
-            Err(err) => {
-                refresh_errors.push(format!("deny ACE failed on {}: {err}", path.display()));
-                log_line(
-                    log,
-                    &format!("deny ACE failed on {}: {err}", path.display()),
-                )?;
+            unsafe {
+                LocalFree(deny_psid as HLOCAL);
             }
         }
     }
@@ -924,12 +948,6 @@ fn run_setup_full(payload: &Payload, log: &mut File, sbx_dir: &Path) -> Result<(
         if !sandbox_group_psid.is_null() {
             LocalFree(sandbox_group_psid as HLOCAL);
         }
-        if !cap_psid.is_null() {
-            LocalFree(cap_psid as HLOCAL);
-        }
-        if !workspace_psid.is_null() {
-            LocalFree(workspace_psid as HLOCAL);
-        }
     }
     if refresh_only && !refresh_errors.is_empty() {
         log_line(
@@ -946,9 +964,13 @@ fn run_setup_full(payload: &Payload, log: &mut File, sbx_dir: &Path) -> Result<(
 mod tests {
     use super::Payload;
     use super::SETUP_VERSION;
+    use super::workspace_write_cap_sids_for_path;
     use codex_otel::StatsigMetricsSettings;
+    use codex_windows_sandbox::load_or_create_cap_sids;
+    use codex_windows_sandbox::workspace_write_cap_sid_for_root;
     use pretty_assertions::assert_eq;
     use serde_json::json;
+    use std::fs;
 
     fn payload_json() -> serde_json::Value {
         json!({
@@ -986,4 +1008,104 @@ mod tests {
             })
         );
     }
+
+    #[test]
+    fn deny_path_under_active_root_uses_only_matching_root_sid() {
+        let temp = tempfile::tempdir().expect("tempdir");
+        let codex_home = temp.path().join("codex-home");
+        let workspace = temp.path().join("workspace");
+        let active_root = temp.path().join("active-root");
+        let stale_root = temp.path().join("stale-root");
+        let deny_path = active_root.join("protected");
+        fs::create_dir_all(&codex_home).expect("create codex home");
+        fs::create_dir_all(&workspace).expect("create workspace");
+        fs::create_dir_all(&active_root).expect("create active root");
+        fs::create_dir_all(&stale_root).expect("create stale root");
+        fs::create_dir_all(&deny_path).expect("create deny path");
+
+        let stale_sid = workspace_write_cap_sid_for_root(&codex_home, &workspace, &stale_root)
+            .expect("stale sid");
+        let active_sid = workspace_write_cap_sid_for_root(&codex_home, &workspace, &active_root)
+            .expect("active sid");
+        let workspace_sid = workspace_write_cap_sid_for_root(&codex_home, &workspace, &workspace)
+            .expect("workspace sid");
+        let caps = load_or_create_cap_sids(&codex_home).expect("load caps");
+
+        let deny_sids = workspace_write_cap_sids_for_path(
+            &codex_home,
+            &workspace,
+            &[workspace.clone(), active_root],
+            &deny_path,
+        )
+        .expect("deny sids");
+
+        assert_eq!(deny_sids, vec![active_sid]);
+        assert!(!deny_sids.contains(&workspace_sid));
+        assert!(!deny_sids.contains(&stale_sid));
+        assert!(!deny_sids.contains(&caps.workspace));
+    }
+
+    #[test]
+    fn deny_path_outside_active_roots_falls_back_to_all_active_root_sids() {
+        let temp = tempfile::tempdir().expect("tempdir");
+        let codex_home = temp.path().join("codex-home");
+        let workspace = temp.path().join("workspace");
+        let active_root = temp.path().join("active-root");
+        let stale_root = temp.path().join("stale-root");
+        let deny_path = temp.path().join("outside-deny");
+        fs::create_dir_all(&codex_home).expect("create codex home");
+        fs::create_dir_all(&workspace).expect("create workspace");
+        fs::create_dir_all(&active_root).expect("create active root");
+        fs::create_dir_all(&stale_root).expect("create stale root");
+        fs::create_dir_all(&deny_path).expect("create deny path");
+
+        let stale_sid = workspace_write_cap_sid_for_root(&codex_home, &workspace, &stale_root)
+            .expect("stale sid");
+        let active_sid = workspace_write_cap_sid_for_root(&codex_home, &workspace, &active_root)
+            .expect("active sid");
+        let workspace_sid = workspace_write_cap_sid_for_root(&codex_home, &workspace, &workspace)
+            .expect("workspace sid");
+        let caps = load_or_create_cap_sids(&codex_home).expect("load caps");
+
+        let deny_sids = workspace_write_cap_sids_for_path(
+            &codex_home,
+            &workspace,
+            &[workspace.clone(), active_root],
+            &deny_path,
+        )
+        .expect("deny sids");
+
+        assert_eq!(deny_sids.len(), 2);
+        assert!(deny_sids.contains(&workspace_sid));
+        assert!(deny_sids.contains(&active_sid));
+        assert!(!deny_sids.contains(&stale_sid));
+        assert!(!deny_sids.contains(&caps.workspace));
+    }
+
+    #[test]
+    fn deny_path_includes_nested_active_root_sid() {
+        let temp = tempfile::tempdir().expect("tempdir");
+        let codex_home = temp.path().join("codex-home");
+        let workspace = temp.path().join("workspace");
+        let protected_dir = workspace.join(".codex");
+        let nested_root = protected_dir.join("nested-root");
+        fs::create_dir_all(&codex_home).expect("create codex home");
+        fs::create_dir_all(&workspace).expect("create workspace");
+        fs::create_dir_all(&nested_root).expect("create nested root");
+
+        let workspace_sid = workspace_write_cap_sid_for_root(&codex_home, &workspace, &workspace)
+            .expect("workspace sid");
+        let nested_sid = workspace_write_cap_sid_for_root(&codex_home, &workspace, &nested_root)
+            .expect("nested sid");
+
+        let deny_sids = workspace_write_cap_sids_for_path(
+            &codex_home,
+            &workspace,
+            &[workspace.clone(), nested_root],
+            &protected_dir,
+        )
+        .expect("deny sids");
+
+        assert_eq!(deny_sids, vec![workspace_sid, nested_sid]);
+    }
 }
diff --git a/codex-rs/windows-sandbox-rs/src/bin/setup_main/win/firewall.rs b/codex-rs/windows-sandbox-rs/src/bin/setup_main/win/firewall.rs
index caa1780437..0a83950853 100644
--- a/codex-rs/windows-sandbox-rs/src/bin/setup_main/win/firewall.rs
+++ b/codex-rs/windows-sandbox-rs/src/bin/setup_main/win/firewall.rs
@@ -2,6 +2,7 @@ use anyhow::Result;
 use std::fs::File;
 use std::io::Write;
 
+use windows::Win32::Foundation::S_OK;
 use windows::Win32::Foundation::VARIANT_TRUE;
 use windows::Win32::NetworkManagement::WindowsFirewall::INetFwPolicy2;
 use windows::Win32::NetworkManagement::WindowsFirewall::INetFwRule3;
@@ -10,6 +11,8 @@ use windows::Win32::NetworkManagement::WindowsFirewall::NET_FW_ACTION_BLOCK;
 use windows::Win32::NetworkManagement::WindowsFirewall::NET_FW_IP_PROTOCOL_ANY;
 use windows::Win32::NetworkManagement::WindowsFirewall::NET_FW_IP_PROTOCOL_TCP;
 use windows::Win32::NetworkManagement::WindowsFirewall::NET_FW_IP_PROTOCOL_UDP;
+use windows::Win32::NetworkManagement::WindowsFirewall::NET_FW_MODIFY_STATE;
+use windows::Win32::NetworkManagement::WindowsFirewall::NET_FW_MODIFY_STATE_OK;
 use windows::Win32::NetworkManagement::WindowsFirewall::NET_FW_PROFILE2_ALL;
 use windows::Win32::NetworkManagement::WindowsFirewall::NET_FW_RULE_DIR_OUT;
 use windows::Win32::NetworkManagement::WindowsFirewall::NetFwPolicy2;
@@ -75,6 +78,7 @@ pub fn ensure_offline_proxy_allowlist(
                         format!("CoCreateInstance NetFwPolicy2 failed: {err:?}"),
                     ))
                 })?;
+            ensure_local_policy_rules_take_effect(&policy)?;
             let rules = policy.Rules().map_err(|err| {
                 anyhow::Error::new(SetupFailure::new(
                     SetupErrorCode::HelperFirewallPolicyAccessFailed,
@@ -170,6 +174,7 @@ pub fn ensure_offline_outbound_block(offline_sid: &str, log: &mut File) -> Resul
                         format!("CoCreateInstance NetFwPolicy2 failed: {err:?}"),
                     ))
                 })?;
+            ensure_local_policy_rules_take_effect(&policy)?;
             let rules = policy.Rules().map_err(|err| {
                 anyhow::Error::new(SetupFailure::new(
                     SetupErrorCode::HelperFirewallPolicyAccessFailed,
@@ -215,6 +220,52 @@ fn remove_rule_if_present(rules: &INetFwRules, internal_name: &str, log: &mut Fi
     Ok(())
 }
 
+fn ensure_local_policy_rules_take_effect(policy: &INetFwPolicy2) -> Result<()> {
+    let mut modify_state = NET_FW_MODIFY_STATE::default();
+    let result = unsafe {
+        (Interface::vtable(policy).LocalPolicyModifyState)(
+            Interface::as_raw(policy),
+            &mut modify_state,
+        )
+    };
+    validate_local_policy_modify_result(result, modify_state)
+}
+
+fn validate_local_policy_modify_result(
+    result: windows::core::HRESULT,
+    modify_state: NET_FW_MODIFY_STATE,
+) -> Result<()> {
+    if result.is_err() {
+        // The COM query itself failed, so Windows never gave us a policy answer.
+        return Err(anyhow::Error::new(SetupFailure::new(
+            SetupErrorCode::HelperFirewallPolicyAccessFailed,
+            format!("INetFwPolicy2::LocalPolicyModifyState failed: {result:?}"),
+        )));
+    }
+
+    if result != S_OK {
+        // S_FALSE means the answer only holds for some active profiles, not all of them.
+        return Err(anyhow::Error::new(SetupFailure::new(
+            SetupErrorCode::HelperFirewallPolicyIneffective,
+            format!(
+                "local firewall policy modifications do not apply to every current profile: LocalPolicyModifyState result={result:?}"
+            ),
+        )));
+    }
+
+    if modify_state == NET_FW_MODIFY_STATE_OK {
+        return Ok(());
+    }
+
+    // Windows answered uniformly, and that answer says local rule edits are ineffective.
+    Err(anyhow::Error::new(SetupFailure::new(
+        SetupErrorCode::HelperFirewallPolicyIneffective,
+        format!(
+            "local firewall policy modifications will not take effect: LocalPolicyModifyState={modify_state:?}"
+        ),
+    )))
+}
+
 fn ensure_block_rule(rules: &INetFwRules, spec: &BlockRuleSpec<'_>, log: &mut File) -> Result<()> {
     let name = BSTR::from(spec.internal_name);
     let rule: INetFwRule3 = match unsafe { rules.Item(&name) } {
@@ -410,6 +461,10 @@ fn log_line(log: &mut File, msg: &str) -> Result<()> {
 
 #[cfg(test)]
 mod tests {
+    use pretty_assertions::assert_eq;
+    use windows::Win32::Foundation::S_FALSE;
+    use windows::Win32::NetworkManagement::WindowsFirewall::NET_FW_MODIFY_STATE_GP_OVERRIDE;
+
     use super::*;
 
     #[test]
@@ -507,4 +562,37 @@ mod tests {
             );
         }
     }
+
+    #[test]
+    fn local_policy_modify_state_accepts_effective_policy() {
+        assert!(validate_local_policy_modify_result(S_OK, NET_FW_MODIFY_STATE_OK).is_ok());
+    }
+
+    #[test]
+    fn local_policy_modify_state_rejects_ineffective_policy() {
+        let err = validate_local_policy_modify_result(S_OK, NET_FW_MODIFY_STATE_GP_OVERRIDE)
+            .expect_err("group-policy override should fail sandbox firewall setup");
+        let failure = err
+            .downcast_ref::<SetupFailure>()
+            .expect("expected setup failure");
+
+        assert_eq!(
+            failure.code,
+            SetupErrorCode::HelperFirewallPolicyIneffective
+        );
+    }
+
+    #[test]
+    fn local_policy_modify_state_rejects_partial_profile_coverage() {
+        let err = validate_local_policy_modify_result(S_FALSE, NET_FW_MODIFY_STATE_OK)
+            .expect_err("partial profile coverage should fail sandbox firewall setup");
+        let failure = err
+            .downcast_ref::<SetupFailure>()
+            .expect("expected setup failure");
+
+        assert_eq!(
+            failure.code,
+            SetupErrorCode::HelperFirewallPolicyIneffective
+        );
+    }
 }
diff --git a/codex-rs/windows-sandbox-rs/src/cap.rs b/codex-rs/windows-sandbox-rs/src/cap.rs
index 85f7e2c9d6..41b33b63fd 100644
--- a/codex-rs/windows-sandbox-rs/src/cap.rs
+++ b/codex-rs/windows-sandbox-rs/src/cap.rs
@@ -1,4 +1,5 @@
 use crate::path_normalization::canonical_path_key;
+use crate::path_normalization::canonicalize_path;
 use anyhow::Context;
 use anyhow::Result;
 use rand::RngCore;
@@ -22,6 +23,13 @@ pub struct CapSids {
     /// without permanently affecting other workspaces.
     #[serde(default)]
     pub workspace_by_cwd: HashMap<String, String>,
+    /// Per-write-root capability SIDs keyed by canonicalized write-root path.
+    ///
+    /// These are included in a workspace-write token only when the root is
+    /// currently allowed, so stale ACLs from earlier extra roots do not expand
+    /// later workspace sandboxes.
+    #[serde(default)]
+    pub writable_root_by_path: HashMap<String, String>,
 }
 
 pub fn cap_sid_file(codex_home: &Path) -> PathBuf {
@@ -61,6 +69,7 @@ pub fn load_or_create_cap_sids(codex_home: &Path) -> Result<CapSids> {
                 workspace: t.to_string(),
                 readonly: make_random_cap_sid_string(),
                 workspace_by_cwd: HashMap::new(),
+                writable_root_by_path: HashMap::new(),
             };
             persist_caps(&path, &caps)?;
             return Ok(caps);
@@ -70,6 +79,7 @@ pub fn load_or_create_cap_sids(codex_home: &Path) -> Result<CapSids> {
         workspace: make_random_cap_sid_string(),
         readonly: make_random_cap_sid_string(),
         workspace_by_cwd: HashMap::new(),
+        writable_root_by_path: HashMap::new(),
     };
     persist_caps(&path, &caps)?;
     Ok(caps)
@@ -89,10 +99,50 @@ pub fn workspace_cap_sid_for_cwd(codex_home: &Path, cwd: &Path) -> Result<String
     Ok(sid)
 }
 
+/// Returns the capability SID for an additional writable root, creating and persisting it if missing.
+pub fn writable_root_cap_sid_for_path(codex_home: &Path, root: &Path) -> Result<String> {
+    let path = cap_sid_file(codex_home);
+    let mut caps = load_or_create_cap_sids(codex_home)?;
+    let key = canonical_path_key(root);
+    if let Some(sid) = caps.writable_root_by_path.get(&key) {
+        return Ok(sid.clone());
+    }
+    let sid = make_random_cap_sid_string();
+    caps.writable_root_by_path.insert(key, sid.clone());
+    persist_caps(&path, &caps)?;
+    Ok(sid)
+}
+
+pub fn workspace_write_cap_sid_for_root(
+    codex_home: &Path,
+    cwd: &Path,
+    root: &Path,
+) -> Result<String> {
+    if canonical_path_key(root) == canonical_path_key(cwd) {
+        workspace_cap_sid_for_cwd(codex_home, cwd)
+    } else {
+        writable_root_cap_sid_for_path(codex_home, root)
+    }
+}
+
+pub fn workspace_write_root_contains_path(root: &Path, path: &Path) -> bool {
+    canonicalize_path(path).starts_with(canonicalize_path(root))
+}
+
+pub fn workspace_write_root_overlaps_path(root: &Path, path: &Path) -> bool {
+    workspace_write_root_contains_path(root, path) || workspace_write_root_contains_path(path, root)
+}
+
+pub fn workspace_write_root_specificity(root: &Path) -> usize {
+    canonicalize_path(root).components().count()
+}
+
 #[cfg(test)]
 mod tests {
     use super::load_or_create_cap_sids;
     use super::workspace_cap_sid_for_cwd;
+    use super::workspace_write_cap_sid_for_root;
+    use super::writable_root_cap_sid_for_path;
     use pretty_assertions::assert_eq;
     use std::path::PathBuf;
 
@@ -123,4 +173,31 @@ mod tests {
         let caps = load_or_create_cap_sids(&codex_home).expect("load caps");
         assert_eq!(caps.workspace_by_cwd.len(), 1);
     }
+
+    #[test]
+    fn write_roots_get_path_scoped_sids() {
+        let temp = tempfile::tempdir().expect("tempdir");
+        let codex_home = temp.path().join("codex-home");
+        std::fs::create_dir_all(&codex_home).expect("create codex home");
+
+        let workspace = temp.path().join("workspace");
+        let extra_root = temp.path().join("extra-root");
+        std::fs::create_dir_all(&workspace).expect("create workspace");
+        std::fs::create_dir_all(&extra_root).expect("create extra root");
+
+        let workspace_sid = workspace_write_cap_sid_for_root(&codex_home, &workspace, &workspace)
+            .expect("workspace sid");
+        let extra_sid = workspace_write_cap_sid_for_root(&codex_home, &workspace, &extra_root)
+            .expect("extra root sid");
+
+        assert_ne!(workspace_sid, extra_sid);
+        assert_eq!(
+            extra_sid,
+            writable_root_cap_sid_for_path(&codex_home, &extra_root).expect("extra root sid again")
+        );
+
+        let caps = load_or_create_cap_sids(&codex_home).expect("load caps");
+        assert_eq!(caps.workspace_by_cwd.len(), 1);
+        assert_eq!(caps.writable_root_by_path.len(), 1);
+    }
 }
diff --git a/codex-rs/windows-sandbox-rs/src/deny_read_resolver.rs b/codex-rs/windows-sandbox-rs/src/deny_read_resolver.rs
index 1e24ca096e..ce07df1726 100644
--- a/codex-rs/windows-sandbox-rs/src/deny_read_resolver.rs
+++ b/codex-rs/windows-sandbox-rs/src/deny_read_resolver.rs
@@ -43,7 +43,7 @@ pub fn resolve_windows_deny_read_paths(
                 path: FileSystemPath::GlobPattern {
                     pattern: pattern.clone(),
                 },
-                access: FileSystemAccessMode::None,
+                access: FileSystemAccessMode::Deny,
             })
             .collect(),
     );
@@ -205,7 +205,7 @@ mod tests {
     fn unreadable_glob_entry(pattern: String) -> FileSystemSandboxEntry {
         FileSystemSandboxEntry {
             path: FileSystemPath::GlobPattern { pattern },
-            access: FileSystemAccessMode::None,
+            access: FileSystemAccessMode::Deny,
         }
     }
 
@@ -214,7 +214,7 @@ mod tests {
             path: FileSystemPath::Path {
                 path: AbsolutePathBuf::from_absolute_path(path).expect("absolute path"),
             },
-            access: FileSystemAccessMode::None,
+            access: FileSystemAccessMode::Deny,
         }
     }
 
diff --git a/codex-rs/windows-sandbox-rs/src/elevated_impl.rs b/codex-rs/windows-sandbox-rs/src/elevated_impl.rs
index e1ce8c1db7..f43715c122 100644
--- a/codex-rs/windows-sandbox-rs/src/elevated_impl.rs
+++ b/codex-rs/windows-sandbox-rs/src/elevated_impl.rs
@@ -24,6 +24,7 @@ mod windows_impl {
     use super::ElevatedSandboxCaptureRequest;
     use crate::acl::allow_null_device;
     use crate::cap::load_or_create_cap_sids;
+    use crate::cap::workspace_write_cap_sid_for_root;
     use crate::env::ensure_non_interactive_pager;
     use crate::env::inherit_path_env;
     use crate::env::normalize_null_device_env;
@@ -41,7 +42,8 @@ mod windows_impl {
     use crate::runner_client::spawn_runner_transport;
     use crate::sandbox_utils::ensure_codex_home_exists;
     use crate::sandbox_utils::inject_git_safe_directory;
-    use crate::token::convert_string_sid_to_sid;
+    use crate::setup::effective_write_roots_for_setup;
+    use crate::token::LocalSid;
     use anyhow::Result;
     use codex_utils_absolute_path::AbsolutePathBuf;
     use std::path::Path;
@@ -109,22 +111,28 @@ mod windows_impl {
             anyhow::bail!("DangerFullAccess and ExternalSandbox are not supported for sandboxing")
         }
         let caps = load_or_create_cap_sids(codex_home)?;
-        let (psid_to_use, cap_sids) = match &policy {
+        let (sid_for_null, cap_sids) = match &policy {
             SandboxPolicy::ReadOnly { .. } => {
-                #[allow(clippy::unwrap_used)]
-                let psid = unsafe { convert_string_sid_to_sid(&caps.readonly).unwrap() };
-                (psid, vec![caps.readonly])
+                let sid = LocalSid::from_string(&caps.readonly)?;
+                (sid, vec![caps.readonly])
             }
             SandboxPolicy::WorkspaceWrite { .. } => {
-                #[allow(clippy::unwrap_used)]
-                let psid = unsafe { convert_string_sid_to_sid(&caps.workspace).unwrap() };
-                (
-                    psid,
-                    vec![
-                        caps.workspace,
-                        crate::cap::workspace_cap_sid_for_cwd(codex_home, cwd)?,
-                    ],
-                )
+                let write_roots = effective_write_roots_for_setup(
+                    &policy,
+                    sandbox_policy_cwd,
+                    cwd,
+                    &env_map,
+                    codex_home,
+                    write_roots_override,
+                );
+                let cap_sids = write_roots
+                    .iter()
+                    .map(|root| workspace_write_cap_sid_for_root(codex_home, cwd, root))
+                    .collect::<Result<Vec<_>>>()?;
+                if cap_sids.is_empty() {
+                    anyhow::bail!("workspace-write sandbox has no writable root capability SIDs");
+                }
+                (LocalSid::from_string(&cap_sids[0])?, cap_sids)
             }
             SandboxPolicy::DangerFullAccess | SandboxPolicy::ExternalSandbox { .. } => {
                 unreachable!("DangerFullAccess handled above")
@@ -132,7 +140,7 @@ mod windows_impl {
         };
 
         unsafe {
-            allow_null_device(psid_to_use);
+            allow_null_device(sid_for_null.as_ptr());
         }
 
         (|| -> Result<CaptureResult> {
diff --git a/codex-rs/windows-sandbox-rs/src/lib.rs b/codex-rs/windows-sandbox-rs/src/lib.rs
index 78081b5e1f..da2a2d3634 100644
--- a/codex-rs/windows-sandbox-rs/src/lib.rs
+++ b/codex-rs/windows-sandbox-rs/src/lib.rs
@@ -110,6 +110,12 @@ pub use cap::load_or_create_cap_sids;
 #[cfg(target_os = "windows")]
 pub use cap::workspace_cap_sid_for_cwd;
 #[cfg(target_os = "windows")]
+pub use cap::workspace_write_cap_sid_for_root;
+#[cfg(target_os = "windows")]
+pub use cap::workspace_write_root_contains_path;
+#[cfg(target_os = "windows")]
+pub use cap::workspace_write_root_overlaps_path;
+#[cfg(target_os = "windows")]
 pub use conpty::ConptyInstance;
 #[cfg(target_os = "windows")]
 pub use conpty::spawn_conpty_process_as_user;
@@ -222,7 +228,7 @@ pub use setup_error::setup_error_path;
 pub use setup_error::write_setup_error_report;
 #[cfg(target_os = "windows")]
 #[doc(hidden)]
-pub use spawn_prep::LocalSid;
+pub use token::LocalSid;
 #[cfg(target_os = "windows")]
 pub use token::convert_string_sid_to_sid;
 #[cfg(target_os = "windows")]
@@ -273,34 +279,23 @@ pub use stub::run_windows_sandbox_legacy_preflight;
 
 #[cfg(target_os = "windows")]
 mod windows_impl {
-    use super::acl::add_allow_ace;
-    use super::acl::add_deny_write_ace;
-    use super::acl::allow_null_device;
-    use super::acl::revoke_ace;
-    use super::allow::AllowDenyPaths;
-    use super::allow::compute_allow_paths;
-    use super::cap::load_or_create_cap_sids;
-    use super::cap::workspace_cap_sid_for_cwd;
-    use super::deny_read_acl::apply_deny_read_acls;
-    use super::deny_read_state::sync_persistent_deny_read_acls;
     use super::logging::log_failure;
     use super::logging::log_success;
-    use super::path_normalization::canonicalize_path;
     use super::policy::SandboxPolicy;
     use super::process::create_process_as_user;
     use super::sandbox_utils::ensure_codex_home_exists;
+    use super::spawn_prep::LegacyAclSids;
+    use super::spawn_prep::allow_null_device_for_workspace_write;
+    use super::spawn_prep::apply_legacy_session_acl_rules;
+    use super::spawn_prep::legacy_session_capability_roots;
+    use super::spawn_prep::prepare_legacy_session_security;
     use super::spawn_prep::prepare_legacy_spawn_context;
-    use super::token::convert_string_sid_to_sid;
-    use super::token::create_workspace_write_token_with_caps_from;
-    use super::workspace_acl::is_command_cwd_root;
-    use anyhow::Context;
+    use super::spawn_prep::root_capability_sids;
     use anyhow::Result;
     use codex_utils_absolute_path::AbsolutePathBuf;
     use std::collections::HashMap;
-    use std::ffi::c_void;
     use std::io;
     use std::path::Path;
-    use std::path::PathBuf;
     use std::ptr;
     use windows_sys::Win32::Foundation::CloseHandle;
     use windows_sys::Win32::Foundation::GetLastError;
@@ -418,130 +413,34 @@ mod windows_impl {
         if !additional_deny_read_paths.is_empty() {
             anyhow::bail!("deny-read overrides require the elevated Windows sandbox backend");
         }
-        let caps = load_or_create_cap_sids(codex_home)?;
-        let (h_token, psid_generic, psid_workspace): (HANDLE, *mut c_void, Option<*mut c_void>) = unsafe {
-            match &policy {
-                SandboxPolicy::ReadOnly { .. } => {
-                    #[allow(clippy::expect_used)]
-                    let psid =
-                        convert_string_sid_to_sid(&caps.readonly).expect("valid readonly SID");
-                    let (h, _) = super::token::create_readonly_token_with_cap(psid)?;
-                    (h, psid, None)
-                }
-                SandboxPolicy::WorkspaceWrite { .. } => {
-                    #[allow(clippy::expect_used)]
-                    let psid_generic =
-                        convert_string_sid_to_sid(&caps.workspace).expect("valid workspace SID");
-                    let ws_sid = workspace_cap_sid_for_cwd(codex_home, cwd)?;
-                    #[allow(clippy::expect_used)]
-                    let psid_workspace =
-                        convert_string_sid_to_sid(&ws_sid).expect("valid workspace SID");
-                    let base = super::token::get_current_token_for_restriction()?;
-                    let h_res = create_workspace_write_token_with_caps_from(
-                        base,
-                        &[psid_generic, psid_workspace],
-                    );
-                    windows_sys::Win32::Foundation::CloseHandle(base);
-                    let h = h_res?;
-                    (h, psid_generic, Some(psid_workspace))
-                }
-                SandboxPolicy::DangerFullAccess | SandboxPolicy::ExternalSandbox { .. } => {
-                    unreachable!("DangerFullAccess handled above")
-                }
-            }
-        };
-
-        unsafe {
-            if is_workspace_write
-                && let Ok(base) = super::token::get_current_token_for_restriction()
-            {
-                if let Ok(bytes) = super::token::get_logon_sid_bytes(base) {
-                    let mut tmp = bytes;
-                    let psid2 = tmp.as_mut_ptr() as *mut c_void;
-                    allow_null_device(psid2);
-                }
-                windows_sys::Win32::Foundation::CloseHandle(base);
-            }
-        }
-
-        let persist_aces = is_workspace_write;
-        let AllowDenyPaths { allow, mut deny } =
-            compute_allow_paths(&policy, sandbox_policy_cwd, &current_dir, &env_map);
-        for path in additional_deny_write_paths {
-            // Explicit deny-write carveouts must already exist when the process
-            // starts, otherwise it could create a missing path under a writable
-            // parent before the deny-write ACE exists.
-            if !path.exists() {
-                std::fs::create_dir_all(&path)
-                    .with_context(|| format!("create deny-write path {}", path.display()))?;
-            }
-            deny.insert(path.clone());
-        }
-        let canonical_cwd = canonicalize_path(&current_dir);
-        let mut guards: Vec<(PathBuf, *mut c_void)> = Vec::new();
-        unsafe {
-            for p in &allow {
-                let psid = if is_workspace_write && is_command_cwd_root(p, &canonical_cwd) {
-                    psid_workspace.unwrap_or(psid_generic)
-                } else {
-                    psid_generic
-                };
-                if let Ok(added) = add_allow_ace(p, psid)
-                    && added
-                {
-                    if persist_aces {
-                        if p.is_dir() {
-                            // best-effort seeding omitted intentionally
-                        }
-                    } else {
-                        guards.push((p.clone(), psid));
-                    }
-                }
-            }
-            for p in &deny {
-                if let Ok(added) = add_deny_write_ace(p, psid_generic)
-                    && added
-                    && !persist_aces
-                {
-                    guards.push((p.clone(), psid_generic));
-                }
-            }
-            // Read denies are layered after allow/deny-write setup so they can
-            // override broad read grants for the sandbox principal without
-            // changing the existing write policy computation.
-            let applied_deny_read_paths = match if persist_aces {
-                sync_persistent_deny_read_acls(
-                    codex_home,
-                    &caps.workspace,
-                    &additional_deny_read_paths,
-                    psid_generic,
-                )
-            } else {
-                apply_deny_read_acls(&additional_deny_read_paths, psid_generic)
-            } {
-                Ok(paths) => paths,
-                Err(err) => {
-                    if !persist_aces {
-                        cleanup_acl_guards(&mut guards);
-                    }
-                    return Err(err);
-                }
-            };
-            if !persist_aces {
-                for path in applied_deny_read_paths {
-                    guards.push((path, psid_generic));
-                }
-            }
-            allow_null_device(psid_generic);
-            if let Some(psid) = psid_workspace {
-                allow_null_device(psid);
-            }
-        }
+        let capability_roots = legacy_session_capability_roots(
+            &policy,
+            sandbox_policy_cwd,
+            &current_dir,
+            &env_map,
+            codex_home,
+        );
+        let security = prepare_legacy_session_security(&policy, codex_home, cwd, capability_roots)?;
+        allow_null_device_for_workspace_write(is_workspace_write);
+        apply_legacy_session_acl_rules(
+            &policy,
+            sandbox_policy_cwd,
+            codex_home,
+            &current_dir,
+            &env_map,
+            &additional_deny_read_paths,
+            &additional_deny_write_paths,
+            LegacyAclSids {
+                readonly_sid: security.readonly_sid.as_ref(),
+                readonly_sid_str: security.readonly_sid_str.as_deref(),
+                write_root_sids: &security.write_root_sids,
+            },
+        )?;
         let (stdin_pair, stdout_pair, stderr_pair) = unsafe { setup_stdio_pipes()? };
         let ((in_r, in_w), (out_r, out_w), (err_r, err_w)) = (stdin_pair, stdout_pair, stderr_pair);
         let spawn_res = unsafe {
             create_process_as_user(
-                h_token,
+                security.h_token,
                 &command,
                 cwd,
                 &env_map,
@@ -553,7 +452,6 @@ mod windows_impl {
         let created = match spawn_res {
             Ok(v) => v,
             Err(err) => {
-                cleanup_acl_guards(&mut guards);
                 unsafe {
                     CloseHandle(in_r);
                     CloseHandle(in_w);
@@ -561,7 +459,7 @@ mod windows_impl {
                     CloseHandle(out_w);
                     CloseHandle(err_r);
                     CloseHandle(err_w);
-                    CloseHandle(h_token);
+                    CloseHandle(security.h_token);
                 }
                 return Err(err);
             }
@@ -643,7 +541,7 @@ mod windows_impl {
             if pi.hProcess != 0 {
                 CloseHandle(pi.hProcess);
             }
-            CloseHandle(h_token);
+            CloseHandle(security.h_token);
         }
         let _ = t_out.join();
         let _ = t_err.join();
@@ -661,9 +559,6 @@ mod windows_impl {
             log_failure(&command, &format!("exit code {exit_code}"), logs_base_dir);
         }
 
-        if !persist_aces {
-            cleanup_acl_guards(&mut guards);
-        }
         Ok(CaptureResult {
             exit_code,
             stdout,
@@ -672,14 +567,6 @@ mod windows_impl {
         })
     }
 
-    fn cleanup_acl_guards(guards: &mut Vec<(PathBuf, *mut c_void)>) {
-        unsafe {
-            for (p, sid) in guards.drain(..) {
-                revoke_ace(&p, sid);
-            }
-        }
-    }
-
     pub fn run_windows_sandbox_legacy_preflight(
         sandbox_policy: &SandboxPolicy,
         sandbox_policy_cwd: &Path,
@@ -693,33 +580,29 @@ mod windows_impl {
         }
 
         ensure_codex_home_exists(codex_home)?;
-        let caps = load_or_create_cap_sids(codex_home)?;
-        #[allow(clippy::expect_used)]
-        let psid_generic =
-            unsafe { convert_string_sid_to_sid(&caps.workspace) }.expect("valid workspace SID");
-        let ws_sid = workspace_cap_sid_for_cwd(codex_home, cwd)?;
-        #[allow(clippy::expect_used)]
-        let psid_workspace =
-            unsafe { convert_string_sid_to_sid(&ws_sid) }.expect("valid workspace SID");
         let current_dir = cwd.to_path_buf();
-        let AllowDenyPaths { allow, deny } =
-            compute_allow_paths(sandbox_policy, sandbox_policy_cwd, &current_dir, env_map);
-        let canonical_cwd = canonicalize_path(&current_dir);
-        unsafe {
-            for p in &allow {
-                let psid = if is_command_cwd_root(p, &canonical_cwd) {
-                    psid_workspace
-                } else {
-                    psid_generic
-                };
-                let _ = add_allow_ace(p, psid);
-            }
-            for p in &deny {
-                let _ = add_deny_write_ace(p, psid_generic);
-            }
-            allow_null_device(psid_generic);
-            allow_null_device(psid_workspace);
-        }
+        let capability_roots = legacy_session_capability_roots(
+            sandbox_policy,
+            sandbox_policy_cwd,
+            &current_dir,
+            env_map,
+            codex_home,
+        );
+        let write_root_sids = root_capability_sids(codex_home, cwd, capability_roots)?;
+        apply_legacy_session_acl_rules(
+            sandbox_policy,
+            sandbox_policy_cwd,
+            codex_home,
+            &current_dir,
+            env_map,
+            &[],
+            &[],
+            LegacyAclSids {
+                readonly_sid: None,
+                readonly_sid_str: None,
+                write_root_sids: &write_root_sids,
+            },
+        )?;
 
         Ok(())
     }
diff --git a/codex-rs/windows-sandbox-rs/src/setup.rs b/codex-rs/windows-sandbox-rs/src/setup.rs
index 3b6e47086e..0de2c6e029 100644
--- a/codex-rs/windows-sandbox-rs/src/setup.rs
+++ b/codex-rs/windows-sandbox-rs/src/setup.rs
@@ -413,6 +413,26 @@ pub(crate) fn gather_write_roots(
     out
 }
 
+pub(crate) fn effective_write_roots_for_setup(
+    policy: &SandboxPolicy,
+    policy_cwd: &Path,
+    command_cwd: &Path,
+    env_map: &HashMap<String, String>,
+    codex_home: &Path,
+    write_roots_override: Option<&[PathBuf]>,
+) -> Vec<PathBuf> {
+    let write_roots = if let Some(roots) = write_roots_override {
+        canonical_existing(roots)
+    } else {
+        gather_write_roots(policy, policy_cwd, command_cwd, env_map)
+    };
+    let write_roots = expand_user_profile_root(write_roots);
+    let write_roots = filter_user_profile_root(write_roots);
+    let write_roots = filter_user_profile_root_exclusions(write_roots);
+    let write_roots = filter_ssh_config_dependency_roots(write_roots);
+    filter_sensitive_write_roots(write_roots, codex_home)
+}
+
 #[derive(Serialize)]
 struct ElevationPayload {
     version: u32,
@@ -761,21 +781,14 @@ fn build_payload_roots(
     request: &SandboxSetupRequest<'_>,
     overrides: &SetupRootOverrides,
 ) -> (Vec<PathBuf>, Vec<PathBuf>) {
-    let write_roots = if let Some(roots) = overrides.write_roots.as_deref() {
-        canonical_existing(roots)
-    } else {
-        gather_write_roots(
-            request.policy,
-            request.policy_cwd,
-            request.command_cwd,
-            request.env_map,
-        )
-    };
-    let write_roots = expand_user_profile_root(write_roots);
-    let write_roots = filter_user_profile_root(write_roots);
-    let write_roots = filter_user_profile_root_exclusions(write_roots);
-    let write_roots = filter_ssh_config_dependency_roots(write_roots);
-    let write_roots = filter_sensitive_write_roots(write_roots, request.codex_home);
+    let write_roots = effective_write_roots_for_setup(
+        request.policy,
+        request.policy_cwd,
+        request.command_cwd,
+        request.env_map,
+        request.codex_home,
+        overrides.write_roots.as_deref(),
+    );
     let mut read_roots = if let Some(roots) = overrides.read_roots.as_deref() {
         // An explicit override is the split policy's complete readable set. Keep only the
         // helper/platform roots the elevated setup needs; do not re-add legacy cwd/full-read roots.
@@ -1405,6 +1418,66 @@ mod tests {
         );
     }
 
+    #[test]
+    fn effective_write_roots_match_payload_filtering_for_overrides() {
+        let tmp = TempDir::new().expect("tempdir");
+        let codex_home = tmp.path().join("codex-home");
+        let command_cwd = tmp.path().join("workspace");
+        let extra_root = tmp.path().join("extra-root");
+        let sandbox_root = super::sandbox_dir(&codex_home);
+        fs::create_dir_all(&codex_home).expect("create codex home");
+        fs::create_dir_all(&command_cwd).expect("create workspace");
+        fs::create_dir_all(&extra_root).expect("create extra root");
+        fs::create_dir_all(&sandbox_root).expect("create sandbox root");
+        let policy = SandboxPolicy::WorkspaceWrite {
+            writable_roots: vec![],
+            network_access: false,
+            exclude_tmpdir_env_var: true,
+            exclude_slash_tmp: true,
+        };
+        let override_roots = vec![
+            command_cwd.clone(),
+            extra_root.clone(),
+            codex_home.clone(),
+            sandbox_root.clone(),
+        ];
+        let request = super::SandboxSetupRequest {
+            policy: &policy,
+            policy_cwd: &command_cwd,
+            command_cwd: &command_cwd,
+            env_map: &HashMap::new(),
+            codex_home: &codex_home,
+            proxy_enforced: false,
+        };
+        let overrides = super::SetupRootOverrides {
+            read_roots: None,
+            read_roots_include_platform_defaults: false,
+            write_roots: Some(override_roots.clone()),
+            deny_read_paths: None,
+            deny_write_paths: None,
+        };
+
+        let effective_write_roots = super::effective_write_roots_for_setup(
+            &policy,
+            &command_cwd,
+            &command_cwd,
+            &HashMap::new(),
+            &codex_home,
+            Some(&override_roots),
+        );
+        let (_read_roots, payload_write_roots) = build_payload_roots(&request, &overrides);
+
+        let expected_workspace = dunce::canonicalize(&command_cwd).expect("canonical workspace");
+        let expected_extra = dunce::canonicalize(&extra_root).expect("canonical extra root");
+        let forbidden_codex_home = dunce::canonicalize(&codex_home).expect("canonical codex home");
+        let forbidden_sandbox = dunce::canonicalize(&sandbox_root).expect("canonical sandbox root");
+        assert_eq!(effective_write_roots, payload_write_roots);
+        assert!(effective_write_roots.contains(&expected_workspace));
+        assert!(effective_write_roots.contains(&expected_extra));
+        assert!(!effective_write_roots.contains(&forbidden_codex_home));
+        assert!(!effective_write_roots.contains(&forbidden_sandbox));
+    }
+
     #[test]
     fn payload_deny_write_paths_merge_explicit_and_protected_children() {
         let tmp = TempDir::new().expect("tempdir");
diff --git a/codex-rs/windows-sandbox-rs/src/setup_error.rs b/codex-rs/windows-sandbox-rs/src/setup_error.rs
index 64e618ace1..efaaa531e2 100644
--- a/codex-rs/windows-sandbox-rs/src/setup_error.rs
+++ b/codex-rs/windows-sandbox-rs/src/setup_error.rs
@@ -56,6 +56,8 @@ pub enum SetupErrorCode {
     HelperFirewallComInitFailed,
     /// Helper failed to access firewall policy or rule collections.
     HelperFirewallPolicyAccessFailed,
+    /// Helper detected that local firewall policy changes will not fully take effect.
+    HelperFirewallPolicyIneffective,
     /// Helper failed to create, update, or add the firewall rule.
     HelperFirewallRuleCreateOrAddFailed,
     /// Helper failed to verify the configured firewall rule scope.
@@ -91,6 +93,7 @@ impl SetupErrorCode {
             Self::HelperCapabilitySidFailed => "helper_capability_sid_failed",
             Self::HelperFirewallComInitFailed => "helper_firewall_com_init_failed",
             Self::HelperFirewallPolicyAccessFailed => "helper_firewall_policy_access_failed",
+            Self::HelperFirewallPolicyIneffective => "helper_firewall_policy_ineffective",
             Self::HelperFirewallRuleCreateOrAddFailed => {
                 "helper_firewall_rule_create_or_add_failed"
             }
diff --git a/codex-rs/windows-sandbox-rs/src/spawn_prep.rs b/codex-rs/windows-sandbox-rs/src/spawn_prep.rs
index b0cf0f3075..b27fa822fa 100644
--- a/codex-rs/windows-sandbox-rs/src/spawn_prep.rs
+++ b/codex-rs/windows-sandbox-rs/src/spawn_prep.rs
@@ -4,8 +4,10 @@ use crate::acl::allow_null_device;
 use crate::allow::AllowDenyPaths;
 use crate::allow::compute_allow_paths;
 use crate::cap::load_or_create_cap_sids;
-use crate::cap::workspace_cap_sid_for_cwd;
-use crate::deny_read_acl::apply_deny_read_acls;
+use crate::cap::workspace_write_cap_sid_for_root;
+use crate::cap::workspace_write_root_contains_path;
+use crate::cap::workspace_write_root_overlaps_path;
+use crate::cap::workspace_write_root_specificity;
 use crate::deny_read_state::sync_persistent_deny_read_acls;
 use crate::env::apply_no_network_to_env;
 use crate::env::ensure_non_interactive_pager;
@@ -19,7 +21,8 @@ use crate::policy::SandboxPolicy;
 use crate::policy::parse_policy;
 use crate::sandbox_utils::ensure_codex_home_exists;
 use crate::sandbox_utils::inject_git_safe_directory;
-use crate::token::convert_string_sid_to_sid;
+use crate::setup::effective_write_roots_for_setup;
+use crate::token::LocalSid;
 use crate::token::create_readonly_token_with_cap;
 use crate::token::create_workspace_write_token_with_caps_from;
 use crate::token::get_current_token_for_restriction;
@@ -35,8 +38,6 @@ use std::path::Path;
 use std::path::PathBuf;
 use windows_sys::Win32::Foundation::CloseHandle;
 use windows_sys::Win32::Foundation::HANDLE;
-use windows_sys::Win32::Foundation::HLOCAL;
-use windows_sys::Win32::Foundation::LocalFree;
 
 pub(crate) struct SpawnContext {
     pub(crate) policy: SandboxPolicy,
@@ -54,36 +55,21 @@ pub(crate) struct ElevatedSpawnContext {
 
 pub(crate) struct LegacySessionSecurity {
     pub(crate) h_token: HANDLE,
-    pub(crate) psid_generic: LocalSid,
-    pub(crate) psid_workspace: Option<LocalSid>,
-    pub(crate) cap_sid_str: String,
+    pub(crate) readonly_sid: Option<LocalSid>,
+    pub(crate) readonly_sid_str: Option<String>,
+    pub(crate) write_root_sids: Vec<RootCapabilitySid>,
 }
 
-/// Owns a SID allocated by `ConvertStringSidToSidW` and releases it with `LocalFree`.
-pub struct LocalSid {
-    psid: *mut c_void,
+pub(crate) struct RootCapabilitySid {
+    pub(crate) root: PathBuf,
+    pub(crate) sid: LocalSid,
+    pub(crate) sid_str: String,
 }
 
-impl LocalSid {
-    pub fn from_string(sid: &str) -> Result<Self> {
-        let psid = unsafe { convert_string_sid_to_sid(sid) }
-            .ok_or_else(|| anyhow::anyhow!("invalid SID string: {sid}"))?;
-        Ok(Self { psid })
-    }
-
-    pub fn as_ptr(&self) -> *mut c_void {
-        self.psid
-    }
-}
-
-impl Drop for LocalSid {
-    fn drop(&mut self) {
-        if !self.psid.is_null() {
-            unsafe {
-                LocalFree(self.psid as HLOCAL);
-            }
-        }
-    }
+pub(crate) struct LegacyAclSids<'a> {
+    pub(crate) readonly_sid: Option<&'a LocalSid>,
+    pub(crate) readonly_sid_str: Option<&'a str>,
+    pub(crate) write_root_sids: &'a [RootCapabilitySid],
 }
 
 pub(crate) fn should_apply_network_block(policy: &SandboxPolicy) -> bool {
@@ -161,27 +147,31 @@ pub(crate) fn prepare_legacy_session_security(
     policy: &SandboxPolicy,
     codex_home: &Path,
     cwd: &Path,
+    capability_roots: impl IntoIterator<Item = PathBuf>,
 ) -> Result<LegacySessionSecurity> {
     let caps = load_or_create_cap_sids(codex_home)?;
-    let (h_token, psid_generic, psid_workspace, cap_sid_str) = unsafe {
+    let (h_token, readonly_sid, readonly_sid_str, write_root_sids) = unsafe {
         match policy {
             SandboxPolicy::ReadOnly { .. } => {
                 let psid = LocalSid::from_string(&caps.readonly)?;
                 let (h_token, _psid) = create_readonly_token_with_cap(psid.as_ptr())?;
-                (h_token, psid, None, caps.readonly)
+                (h_token, Some(psid), Some(caps.readonly), Vec::new())
             }
             SandboxPolicy::WorkspaceWrite { .. } => {
-                let psid_generic = LocalSid::from_string(&caps.workspace)?;
-                let workspace_sid = workspace_cap_sid_for_cwd(codex_home, cwd)?;
-                let psid_workspace = LocalSid::from_string(&workspace_sid)?;
+                let write_root_sids = root_capability_sids(codex_home, cwd, capability_roots)?;
+                if write_root_sids.is_empty() {
+                    anyhow::bail!("workspace-write sandbox has no writable root capability SIDs");
+                }
                 let base = get_current_token_for_restriction()?;
-                let h_token = create_workspace_write_token_with_caps_from(
-                    base,
-                    &[psid_generic.as_ptr(), psid_workspace.as_ptr()],
-                );
+                let cap_ptrs: Vec<*mut c_void> = write_root_sids
+                    .iter()
+                    .map(|root| root.sid.as_ptr())
+                    .collect();
+                let h_token =
+                    create_workspace_write_token_with_caps_from(base, cap_ptrs.as_slice());
                 CloseHandle(base);
                 let h_token = h_token?;
-                (h_token, psid_generic, Some(psid_workspace), caps.workspace)
+                (h_token, None, None, write_root_sids)
             }
             SandboxPolicy::DangerFullAccess | SandboxPolicy::ExternalSandbox { .. } => {
                 unreachable!("dangerous policies rejected before legacy session prep")
@@ -191,12 +181,80 @@ pub(crate) fn prepare_legacy_session_security(
 
     Ok(LegacySessionSecurity {
         h_token,
-        psid_generic,
-        psid_workspace,
-        cap_sid_str,
+        readonly_sid,
+        readonly_sid_str,
+        write_root_sids,
     })
 }
 
+pub(crate) fn legacy_session_capability_roots(
+    policy: &SandboxPolicy,
+    policy_cwd: &Path,
+    current_dir: &Path,
+    env_map: &HashMap<String, String>,
+    codex_home: &Path,
+) -> Vec<PathBuf> {
+    let allow_paths = compute_allow_paths(policy, policy_cwd, current_dir, env_map)
+        .allow
+        .into_iter()
+        .collect::<Vec<_>>();
+    if matches!(policy, SandboxPolicy::WorkspaceWrite { .. }) {
+        effective_write_roots_for_setup(
+            policy,
+            policy_cwd,
+            current_dir,
+            env_map,
+            codex_home,
+            Some(allow_paths.as_slice()),
+        )
+    } else {
+        allow_paths
+    }
+}
+
+pub(crate) fn root_capability_sids(
+    codex_home: &Path,
+    cwd: &Path,
+    allow_paths: impl IntoIterator<Item = PathBuf>,
+) -> Result<Vec<RootCapabilitySid>> {
+    let mut roots: Vec<PathBuf> = allow_paths.into_iter().collect();
+    roots.sort_by_key(|root| canonicalize_path(root.as_path()));
+    roots.dedup_by(|a, b| canonicalize_path(a.as_path()) == canonicalize_path(b.as_path()));
+
+    let mut out = Vec::with_capacity(roots.len());
+    for root in roots {
+        let sid_str = workspace_write_cap_sid_for_root(codex_home, cwd, &root)?;
+        let sid = LocalSid::from_string(&sid_str)?;
+        out.push(RootCapabilitySid { root, sid, sid_str });
+    }
+    Ok(out)
+}
+
+fn matching_root_capability<'a>(
+    path: &Path,
+    root_sids: &'a [RootCapabilitySid],
+) -> Option<&'a RootCapabilitySid> {
+    root_sids
+        .iter()
+        .filter(|root_sid| workspace_write_root_contains_path(&root_sid.root, path))
+        .max_by_key(|root_sid| workspace_write_root_specificity(&root_sid.root))
+}
+
+fn deny_root_capabilities_for_path<'a>(
+    path: &Path,
+    root_sids: &'a [RootCapabilitySid],
+) -> Vec<&'a RootCapabilitySid> {
+    let matching_root_sids = root_sids
+        .iter()
+        .filter(|root_sid| workspace_write_root_overlaps_path(&root_sid.root, path))
+        .collect::<Vec<_>>();
+    if matching_root_sids.is_empty() {
+        root_sids.iter().collect()
+    } else {
+        matching_root_sids
+    }
+}
+
 pub(crate) fn allow_null_device_for_workspace_write(is_workspace_write: bool) {
     if !is_workspace_write {
         return;
@@ -221,17 +279,12 @@ pub(crate) fn apply_legacy_session_acl_rules(
     codex_home: &Path,
     current_dir: &Path,
     env_map: &HashMap<String, String>,
-    psid_generic: &LocalSid,
-    psid_workspace: Option<&LocalSid>,
-    cap_sid_str: &str,
     additional_deny_read_paths: &[PathBuf],
     additional_deny_write_paths: &[PathBuf],
-    persist_aces: bool,
-) -> Result<Vec<PathBuf>> {
+    acl_sids: LegacyAclSids<'_>,
+) -> Result<()> {
     let AllowDenyPaths { allow, mut deny } =
         compute_allow_paths(policy, sandbox_policy_cwd, current_dir, env_map);
-    let mut guards: Vec<PathBuf> = Vec::new();
-    let canonical_cwd = canonicalize_path(current_dir);
     unsafe {
         for path in additional_deny_write_paths {
             // Explicit carveouts must exist before the command starts so the
@@ -242,49 +295,63 @@ pub(crate) fn apply_legacy_session_acl_rules(
             }
             deny.insert(path.clone());
         }
-        for p in &allow {
-            let psid = if matches!(policy, SandboxPolicy::WorkspaceWrite { .. })
-                && is_command_cwd_root(p, &canonical_cwd)
-            {
-                psid_workspace.unwrap_or(psid_generic).as_ptr()
-            } else {
-                psid_generic.as_ptr()
-            };
-            if matches!(add_allow_ace(p, psid), Ok(true)) && !persist_aces {
-                guards.push(p.clone());
+        if let Some(readonly_sid) = acl_sids.readonly_sid {
+            for p in &allow {
+                let _ = add_allow_ace(p, readonly_sid.as_ptr());
+            }
+        } else {
+            for p in &allow {
+                let Some(root_sid) = matching_root_capability(p, acl_sids.write_root_sids) else {
+                    continue;
+                };
+                let _ = add_allow_ace(p, root_sid.sid.as_ptr());
             }
         }
         for p in &deny {
-            if let Ok(added) = add_deny_write_ace(p, psid_generic.as_ptr())
-                && added
-                && !persist_aces
-            {
-                guards.push(p.clone());
+            for root_sid in deny_root_capabilities_for_path(p, acl_sids.write_root_sids) {
+                let _ = add_deny_write_ace(p, root_sid.sid.as_ptr());
             }
         }
-        let applied_deny_read_paths = if persist_aces {
-            sync_persistent_deny_read_acls(
-                codex_home,
-                cap_sid_str,
-                additional_deny_read_paths,
-                psid_generic.as_ptr(),
-            )?
-        } else {
-            apply_deny_read_acls(additional_deny_read_paths, psid_generic.as_ptr())?
-        };
-        if !persist_aces {
-            guards.extend(applied_deny_read_paths);
+        if !additional_deny_read_paths.is_empty() {
+            if let Some(readonly_sid) = acl_sids.readonly_sid {
+                let Some(readonly_sid_str) = acl_sids.readonly_sid_str else {
+                    anyhow::bail!("readonly capability SID string missing");
+                };
+                sync_persistent_deny_read_acls(
+                    codex_home,
+                    readonly_sid_str,
+                    additional_deny_read_paths,
+                    readonly_sid.as_ptr(),
+                )?;
+            } else {
+                for root_sid in acl_sids.write_root_sids {
+                    sync_persistent_deny_read_acls(
+                        codex_home,
+                        &root_sid.sid_str,
+                        additional_deny_read_paths,
+                        root_sid.sid.as_ptr(),
+                    )?;
+                }
+            }
         }
-        allow_null_device(psid_generic.as_ptr());
-        if let Some(psid_workspace) = psid_workspace {
-            allow_null_device(psid_workspace.as_ptr());
-            if persist_aces && matches!(policy, SandboxPolicy::WorkspaceWrite { .. }) {
-                let _ = protect_workspace_codex_dir(current_dir, psid_workspace.as_ptr());
-                let _ = protect_workspace_agents_dir(current_dir, psid_workspace.as_ptr());
+        for root_sid in acl_sids.write_root_sids {
+            allow_null_device(root_sid.sid.as_ptr());
+        }
+        if let Some(readonly_sid) = acl_sids.readonly_sid {
+            allow_null_device(readonly_sid.as_ptr());
+        }
+        if matches!(policy, SandboxPolicy::WorkspaceWrite { .. })
+            && let Some(workspace_sid) =
+                matching_root_capability(current_dir, acl_sids.write_root_sids)
+        {
+            let canonical_cwd = canonicalize_path(current_dir);
+            if is_command_cwd_root(&workspace_sid.root, &canonical_cwd) {
+                let _ = protect_workspace_codex_dir(current_dir, workspace_sid.sid.as_ptr());
+                let _ = protect_workspace_agents_dir(current_dir, workspace_sid.sid.as_ptr());
             }
         }
     }
-    Ok(guards)
+    Ok(())
 }
 
 #[allow(clippy::too_many_arguments)]
@@ -324,6 +391,24 @@ pub(crate) fn prepare_elevated_spawn_context(
     } else {
         None
     };
+    let write_roots_for_setup = write_roots_override.or(computed_write_roots_override);
+    let effective_write_roots = if common.is_workspace_write {
+        effective_write_roots_for_setup(
+            &common.policy,
+            sandbox_policy_cwd,
+            &common.current_dir,
+            env_map,
+            codex_home,
+            write_roots_for_setup,
+        )
+    } else {
+        Vec::new()
+    };
+    let setup_write_roots_override = if common.is_workspace_write {
+        Some(effective_write_roots.as_slice())
+    } else {
+        write_roots_override
+    };
     let sandbox_creds = require_logon_sandbox_creds(
         &common.policy,
         sandbox_policy_cwd,
@@ -332,7 +417,7 @@ pub(crate) fn prepare_elevated_spawn_context(
         codex_home,
         read_roots_override,
         read_roots_include_platform_defaults,
-        write_roots_override.or(computed_write_roots_override),
+        setup_write_roots_override,
         deny_read_paths_override,
         if deny_write_paths_override.is_empty() {
             &deny_write_paths
@@ -348,11 +433,14 @@ pub(crate) fn prepare_elevated_spawn_context(
             vec![caps.readonly.clone()],
         ),
         SandboxPolicy::WorkspaceWrite { .. } => {
-            let cap_sid = workspace_cap_sid_for_cwd(codex_home, cwd)?;
-            (
-                LocalSid::from_string(&caps.workspace)?,
-                vec![caps.workspace.clone(), cap_sid],
-            )
+            let cap_sids = root_capability_sids(codex_home, cwd, effective_write_roots)?
+                .into_iter()
+                .map(|root_sid| root_sid.sid_str)
+                .collect::<Vec<_>>();
+            if cap_sids.is_empty() {
+                anyhow::bail!("workspace-write sandbox has no writable root capability SIDs");
+            }
+            (LocalSid::from_string(&cap_sids[0])?, cap_sids)
         }
         SandboxPolicy::DangerFullAccess | SandboxPolicy::ExternalSandbox { .. } => {
             unreachable!("dangerous policies rejected before elevated session prep")
@@ -373,9 +461,15 @@ pub(crate) fn prepare_elevated_spawn_context(
 #[cfg(test)]
 mod tests {
     use super::SandboxPolicy;
+    use super::deny_root_capabilities_for_path;
+    use super::legacy_session_capability_roots;
     use super::prepare_legacy_spawn_context;
     use super::prepare_spawn_context_common;
+    use super::root_capability_sids;
     use super::should_apply_network_block;
+    use crate::cap::load_or_create_cap_sids;
+    use crate::cap::workspace_write_cap_sid_for_root;
+    use codex_utils_absolute_path::AbsolutePathBuf;
     use pretty_assertions::assert_eq;
     use std::collections::HashMap;
     use tempfile::TempDir;
@@ -450,4 +544,114 @@ mod tests {
             Some(&"http://user.proxy:8080".to_string())
         );
     }
+
+    #[test]
+    fn root_capability_sids_only_include_active_roots() {
+        let temp = TempDir::new().expect("tempdir");
+        let codex_home = temp.path().join("codex-home");
+        let workspace = temp.path().join("workspace");
+        let active_root = temp.path().join("active-root");
+        let stale_root = temp.path().join("stale-root");
+        std::fs::create_dir_all(&codex_home).expect("create codex home");
+        std::fs::create_dir_all(&workspace).expect("create workspace");
+        std::fs::create_dir_all(&active_root).expect("create active root");
+        std::fs::create_dir_all(&stale_root).expect("create stale root");
+
+        let stale_sid = workspace_write_cap_sid_for_root(&codex_home, &workspace, &stale_root)
+            .expect("stale sid");
+        let active_sid = workspace_write_cap_sid_for_root(&codex_home, &workspace, &active_root)
+            .expect("active sid");
+        let workspace_sid = workspace_write_cap_sid_for_root(&codex_home, &workspace, &workspace)
+            .expect("workspace sid");
+        let caps = load_or_create_cap_sids(&codex_home).expect("load caps");
+
+        let sid_strs = root_capability_sids(
+            &codex_home,
+            &workspace,
+            vec![workspace.clone(), active_root],
+        )
+        .expect("root capabilities")
+        .into_iter()
+        .map(|root_sid| root_sid.sid_str)
+        .collect::<Vec<_>>();
+
+        assert_eq!(sid_strs.len(), 2);
+        assert!(sid_strs.contains(&workspace_sid));
+        assert!(sid_strs.contains(&active_sid));
+        assert!(!sid_strs.contains(&stale_sid));
+        assert!(!sid_strs.contains(&caps.workspace));
+    }
+
+    #[test]
+    fn legacy_deny_path_includes_nested_active_root_sid() {
+        let temp = TempDir::new().expect("tempdir");
+        let codex_home = temp.path().join("codex-home");
+        let workspace = temp.path().join("workspace");
+        let protected_dir = workspace.join(".codex");
+        let nested_root = protected_dir.join("nested-root");
+        let unrelated_root = temp.path().join("unrelated-root");
+        std::fs::create_dir_all(&codex_home).expect("create codex home");
+        std::fs::create_dir_all(&workspace).expect("create workspace");
+        std::fs::create_dir_all(&nested_root).expect("create nested root");
+        std::fs::create_dir_all(&unrelated_root).expect("create unrelated root");
+
+        let workspace_sid = workspace_write_cap_sid_for_root(&codex_home, &workspace, &workspace)
+            .expect("workspace sid");
+        let nested_sid = workspace_write_cap_sid_for_root(&codex_home, &workspace, &nested_root)
+            .expect("nested sid");
+        let unrelated_sid =
+            workspace_write_cap_sid_for_root(&codex_home, &workspace, &unrelated_root)
+                .expect("unrelated sid");
+        let root_sids = root_capability_sids(
+            &codex_home,
+            &workspace,
+            vec![workspace.clone(), nested_root, unrelated_root],
+        )
+        .expect("root capabilities");
+
+        let deny_sid_strs = deny_root_capabilities_for_path(&protected_dir, &root_sids)
+            .into_iter()
+            .map(|root_sid| root_sid.sid_str.clone())
+            .collect::<Vec<_>>();
+
+        assert_eq!(deny_sid_strs, vec![workspace_sid, nested_sid]);
+        assert!(!deny_sid_strs.contains(&unrelated_sid));
+    }
+
+    #[test]
+    fn legacy_capability_roots_use_effective_write_roots() {
+        let temp = TempDir::new().expect("tempdir");
+        let codex_home = temp.path().join("codex-home");
+        let workspace = temp.path().join("workspace");
+        let active_root = temp.path().join("active-root");
+        let sandbox_root = codex_home.join(".sandbox");
+        std::fs::create_dir_all(&codex_home).expect("create codex home");
+        std::fs::create_dir_all(&workspace).expect("create workspace");
+        std::fs::create_dir_all(&active_root).expect("create active root");
+        std::fs::create_dir_all(&sandbox_root).expect("create sandbox root");
+
+        let policy = SandboxPolicy::WorkspaceWrite {
+            writable_roots: vec![
+                AbsolutePathBuf::try_from(active_root.as_path()).expect("active root"),
+                AbsolutePathBuf::try_from(codex_home.as_path()).expect("codex home"),
+                AbsolutePathBuf::try_from(sandbox_root.as_path()).expect("sandbox root"),
+            ],
+            network_access: false,
+            exclude_tmpdir_env_var: true,
+            exclude_slash_tmp: true,
+        };
+
+        let roots = legacy_session_capability_roots(
+            &policy,
+            &workspace,
+            &workspace,
+            &HashMap::new(),
+            &codex_home,
+        );
+
+        assert!(roots.contains(&dunce::canonicalize(&workspace).expect("workspace")));
+        assert!(roots.contains(&dunce::canonicalize(&active_root).expect("active root")));
+        assert!(!roots.contains(&dunce::canonicalize(&codex_home).expect("codex home")));
+        assert!(!roots.contains(&dunce::canonicalize(&sandbox_root).expect("sandbox root")));
+    }
 }
diff --git a/codex-rs/windows-sandbox-rs/src/token.rs b/codex-rs/windows-sandbox-rs/src/token.rs
index aabf77469f..2c7a746474 100644
--- a/codex-rs/windows-sandbox-rs/src/token.rs
+++ b/codex-rs/windows-sandbox-rs/src/token.rs
@@ -139,6 +139,33 @@ pub unsafe fn convert_string_sid_to_sid(s: &str) -> Option<*mut c_void> {
     if ok != 0 { Some(psid) } else { None }
 }
 
+/// Owns a SID allocated by `ConvertStringSidToSidW` and releases it with `LocalFree`.
+pub struct LocalSid {
+    psid: *mut c_void,
+}
+
+impl LocalSid {
+    pub fn from_string(sid: &str) -> Result<Self> {
+        let psid = unsafe { convert_string_sid_to_sid(sid) }
+            .ok_or_else(|| anyhow!("invalid SID string: {sid}"))?;
+        Ok(Self { psid })
+    }
+
+    pub fn as_ptr(&self) -> *mut c_void {
+        self.psid
+    }
+}
+
+impl Drop for LocalSid {
+    fn drop(&mut self) {
+        if !self.psid.is_null() {
+            unsafe {
+                LocalFree(self.psid as HLOCAL);
+            }
+        }
+    }
+}
+
 /// # Safety
 /// Caller must close the returned token handle.
 pub unsafe fn get_current_token_for_restriction() -> Result<HANDLE> {
diff --git a/codex-rs/windows-sandbox-rs/src/unified_exec/backends/legacy.rs b/codex-rs/windows-sandbox-rs/src/unified_exec/backends/legacy.rs
index 81096e8c62..2cb12bfd71 100644
--- a/codex-rs/windows-sandbox-rs/src/unified_exec/backends/legacy.rs
+++ b/codex-rs/windows-sandbox-rs/src/unified_exec/backends/legacy.rs
@@ -1,6 +1,5 @@
 use super::windows_common::finish_driver_spawn;
 use super::windows_common::normalize_windows_tty_input;
-use crate::acl::revoke_ace;
 use crate::conpty::ConptyInstance;
 use crate::conpty::spawn_conpty_process_as_user;
 use crate::desktop::LaunchDesktop;
@@ -10,9 +9,10 @@ use crate::process::StderrMode;
 use crate::process::StdinMode;
 use crate::process::read_handle_loop;
 use crate::process::spawn_process_with_pipes;
-use crate::spawn_prep::LocalSid;
+use crate::spawn_prep::LegacyAclSids;
 use crate::spawn_prep::allow_null_device_for_workspace_write;
 use crate::spawn_prep::apply_legacy_session_acl_rules;
+use crate::spawn_prep::legacy_session_capability_roots;
 use crate::spawn_prep::prepare_legacy_session_security;
 use crate::spawn_prep::prepare_legacy_spawn_context;
 use anyhow::Result;
@@ -22,7 +22,6 @@ use codex_utils_pty::SpawnedProcess;
 use codex_utils_pty::TerminalSize;
 use std::collections::HashMap;
 use std::path::Path;
-use std::path::PathBuf;
 use std::ptr;
 use std::sync::Arc;
 use std::sync::Mutex as StdMutex;
@@ -204,8 +203,6 @@ fn finalize_exit(
     process_handle: Arc<StdMutex<Option<HANDLE>>>,
     thread_handle: HANDLE,
     output_join: std::thread::JoinHandle<()>,
-    guards: Vec<PathBuf>,
-    cap_sid: Option<String>,
     logs_base_dir: Option<&Path>,
     command: Vec<String>,
 ) {
@@ -241,16 +238,6 @@ fn finalize_exit(
     } else {
         log_failure(&command, &format!("exit code {exit_code}"), logs_base_dir);
     }
-
-    if let Some(cap_sid) = cap_sid
-        && let Ok(sid) = LocalSid::from_string(&cap_sid)
-    {
-        unsafe {
-            for path in guards {
-                revoke_ace(&path, sid.as_ptr());
-            }
-        }
-    }
 }
 
 fn resize_conpty_handle(hpc: &Arc<StdMutex<Option<HANDLE>>>, size: TerminalSize) -> Result<()> {
@@ -311,30 +298,34 @@ pub(crate) async fn spawn_windows_sandbox_session_legacy(
     if !additional_deny_read_paths.is_empty() {
         anyhow::bail!("deny-read overrides require the elevated Windows sandbox backend");
     }
-    let additional_deny_read_paths = additional_deny_read_paths
-        .iter()
-        .map(AbsolutePathBuf::to_path_buf)
-        .collect::<Vec<_>>();
     let additional_deny_write_paths = additional_deny_write_paths
         .iter()
         .map(AbsolutePathBuf::to_path_buf)
         .collect::<Vec<_>>();
-    let security = prepare_legacy_session_security(&common.policy, codex_home, cwd)?;
+    let capability_roots = legacy_session_capability_roots(
+        &common.policy,
+        sandbox_policy_cwd,
+        &common.current_dir,
+        &env_map,
+        codex_home,
+    );
+    let security =
+        prepare_legacy_session_security(&common.policy, codex_home, cwd, capability_roots)?;
     allow_null_device_for_workspace_write(common.is_workspace_write);
 
-    let persist_aces = common.is_workspace_write;
-    let guards = apply_legacy_session_acl_rules(
+    apply_legacy_session_acl_rules(
         &common.policy,
         sandbox_policy_cwd,
         codex_home,
         &common.current_dir,
         &env_map,
-        &security.psid_generic,
-        security.psid_workspace.as_ref(),
-        &security.cap_sid_str,
-        &additional_deny_read_paths,
+        &[],
         &additional_deny_write_paths,
-        persist_aces,
+        LegacyAclSids {
+            readonly_sid: security.readonly_sid.as_ref(),
+            readonly_sid_str: security.readonly_sid_str.as_deref(),
+            write_root_sids: &security.write_root_sids,
+        },
     )?;
 
     let (writer_tx, writer_rx) = mpsc::channel::<Vec<u8>>(128);
@@ -370,14 +361,6 @@ pub(crate) async fn spawn_windows_sandbox_session_legacy(
         Ok(handles) => handles,
         Err(err) => {
             unsafe {
-                if !persist_aces
-                    && !guards.is_empty()
-                    && let Ok(sid) = LocalSid::from_string(&security.cap_sid_str)
-                {
-                    for path in &guards {
-                        revoke_ace(path, sid.as_ptr());
-                    }
-                }
                 CloseHandle(security.h_token);
             }
             return Err(err);
@@ -388,12 +371,6 @@ pub(crate) async fn spawn_windows_sandbox_session_legacy(
     let process_handle = Arc::new(StdMutex::new(Some(pi.hProcess)));
     let wait_handle = Arc::clone(&process_handle);
     let command_for_wait = command.clone();
-    let guards_for_wait = if persist_aces { Vec::new() } else { guards };
-    let cap_sid_for_wait = if guards_for_wait.is_empty() {
-        None
-    } else {
-        Some(security.cap_sid_str)
-    };
     let hpc_for_wait = hpc_handle.clone();
     std::thread::spawn(move || {
         let _desktop = desktop;
@@ -424,8 +401,6 @@ pub(crate) async fn spawn_windows_sandbox_session_legacy(
             wait_handle,
             pi.hThread,
             output_join,
-            guards_for_wait,
-            cap_sid_for_wait,
             common.logs_base_dir.as_deref(),
             command_for_wait,
         );
diff --git a/justfile b/justfile
index 9297c372a3..ab2fbc6362 100644
--- a/justfile
+++ b/justfile
@@ -33,8 +33,8 @@ app-server-test-client *args:
 # Format Rust and Python SDK code.
 fmt:
     cargo fmt -- --config imports_granularity=Item 2>/dev/null
-    uv run --project ../sdk/python --extra dev ruff check --fix --fix-only ../sdk/python
-    uv run --project ../sdk/python --extra dev ruff format ../sdk/python
+    uv run --frozen --project ../sdk/python --extra dev ruff check --fix --fix-only ../sdk/python
+    uv run --frozen --project ../sdk/python --extra dev ruff format ../sdk/python
 
 fix *args:
     cargo clippy --fix --tests --allow-dirty "$@"
diff --git a/patches/BUILD.bazel b/patches/BUILD.bazel
index b58292c727..72d6990790 100644
--- a/patches/BUILD.bazel
+++ b/patches/BUILD.bazel
@@ -4,6 +4,7 @@ exports_files([
     "aws-lc-sys_windows_msvc_prebuilt_nasm.patch",
     "aws-lc-sys_windows_msvc_memcmp_probe.patch",
     "bzip2_windows_stack_args.patch",
+    "llvm_rusty_v8_custom_libcxx.patch",
     "llvm_windows_symlink_extract.patch",
     "rules_rust_windows_bootstrap_process_wrapper_linker.patch",
     "rules_rust_windows_build_script_runner_paths.patch",
@@ -12,6 +13,7 @@ exports_files([
     "rules_rust_windows_process_wrapper_skip_temp_outputs.patch",
     "rules_rust_windows_msvc_direct_link_args.patch",
     "rules_rust_windows_gnullvm_build_script.patch",
+    "rules_cc_rusty_v8_custom_libcxx.patch",
     "rules_rs_windows_gnullvm_exec.patch",
     "rules_rs_windows_exec_linker.patch",
     "rusty_v8_prebuilt_out_dir.patch",
diff --git a/patches/llvm_rusty_v8_custom_libcxx.patch b/patches/llvm_rusty_v8_custom_libcxx.patch
new file mode 100644
index 0000000000..c30a28ac63
--- /dev/null
+++ b/patches/llvm_rusty_v8_custom_libcxx.patch
@@ -0,0 +1,79 @@
+diff --git a/toolchain/BUILD.bazel b/toolchain/BUILD.bazel
+index fa00156236..bf0ee9d368 100644
+--- a/toolchain/BUILD.bazel
++++ b/toolchain/BUILD.bazel
+@@ -222,11 +222,16 @@ cc_args_list(
+ 
+ # TODO(cerisier): extract those into proper semantic args list.
+ # TODO(zbarsky): This must match llvm/toolchains/llvm.bzl
++_DEFAULT_LIBCXX_HEADER_ARGS = select({
++    "@@//third_party/v8:use_rusty_v8_custom_libcxx": [],
++    "//conditions:default": [
++        "//toolchain/args:libcxx_headers_include_search_paths",
++    ],
++})
++
+ cc_args_list(
+     name = "linux_toolchain_args",
+-    args = [
+-        "//toolchain/args:libcxx_headers_include_search_paths",
+-    ] + select({
++    args = _DEFAULT_LIBCXX_HEADER_ARGS + select({
+         "//platforms/config:musl": [
+             "//toolchain/args/linux:kernel_headers_include_search_paths",
+             "//toolchain/args/linux:musl_libc_headers_include_search_paths",
+@@ -252,8 +257,7 @@ cc_args_list(
+ # TODO(zbarsky): This must match llvm/toolchains/llvm.bzl
+ cc_args_list(
+     name = "windows_toolchain_args",
+-    args = [
+-        "//toolchain/args:libcxx_headers_include_search_paths",
++    args = _DEFAULT_LIBCXX_HEADER_ARGS + [
+         "//toolchain/args/windows:mingw_headers_include_search_paths",
+     ],
+ )
+diff --git a/toolchain/llvm/llvm.bzl b/toolchain/llvm/llvm.bzl
+index d36d8b94bd..97aa879d4a 100644
+--- a/toolchain/llvm/llvm.bzl
++++ b/toolchain/llvm/llvm.bzl
+@@ -186,16 +186,22 @@ def declare_llvm_targets(*, suffix = ""):
+         ],
+     )
+ 
++    default_libcxx_target_headers = select({
++        "@@//third_party/v8:use_rusty_v8_custom_libcxx": [],
++        "//conditions:default": [
++            "@llvm//runtimes/libcxx:libcxx_headers_include_search_directory",
++            "@llvm//runtimes/libcxx:libcxxabi_headers_include_search_directory",
++        ],
++    })
++
+     # This must match //toolchain:linux_toolchain_args
+     include_path(
+         name = "linux_target_headers",
+         srcs = [
+             ":builtin_resource_dir",
+-            "@llvm//runtimes/libcxx:libcxx_headers_include_search_directory",
+-            "@llvm//runtimes/libcxx:libcxxabi_headers_include_search_directory",
+             "@kernel_headers//:kernel_headers_directory",
+             "@llvm//sanitizers:sanitizers_headers_include_search_directory",
+-        ] + select({
++        ] + default_libcxx_target_headers + select({
+             "@llvm//platforms/config:musl": [
+                 "@llvm//runtimes/musl:musl_headers_include_search_directory",
+             ],
+@@ -210,13 +216,11 @@ def declare_llvm_targets(*, suffix = ""):
+         name = "windows_target_headers",
+         srcs = [
+             ":builtin_resource_dir",
+-            "@llvm//runtimes/libcxx:libcxx_headers_include_search_directory",
+-            "@llvm//runtimes/libcxx:libcxxabi_headers_include_search_directory",
+             "@mingw//:mingw_generated_headers_crt_directory",
+             "@mingw//:mingw_w64_headers_include_directory",
+             "@mingw//:mingw_w64_headers_crt_directory",
+             "@mingw//:mingw_w64_winpthreads_include_directory",
+-        ],
++        ] + default_libcxx_target_headers,
+     )
+ 
+     include_path(
diff --git a/patches/rules_cc_rusty_v8_custom_libcxx.patch b/patches/rules_cc_rusty_v8_custom_libcxx.patch
new file mode 100644
index 0000000000..3efda03525
--- /dev/null
+++ b/patches/rules_cc_rusty_v8_custom_libcxx.patch
@@ -0,0 +1,44 @@
+diff --git a/cc/cc_library.bzl b/cc/cc_library.bzl
+index c45c5fd954..2e3a01f12a 100644
+--- a/cc/cc_library.bzl
++++ b/cc/cc_library.bzl
+@@ -15,5 +15,39 @@
+
+ load("@cc_compatibility_proxy//:proxy.bzl", _cc_library = "cc_library")
+ 
++_RUSTY_V8_CUSTOM_LIBCXX_COPTS = select({
++    "@@//third_party/v8:use_rusty_v8_custom_libcxx": [
++        "-nostdinc++",
++        "-D_LIBCPP_DISABLE_VISIBILITY_ANNOTATIONS",
++        "-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_EXTENSIVE",
++        "-D_LIBCPP_INSTRUMENTED_WITH_ASAN=0",
++        "-D_LIBCXXABI_DISABLE_VISIBILITY_ANNOTATIONS",
++    ],
++    "//conditions:default": [],
++})
++
++_RUSTY_V8_CUSTOM_LIBCXX_DEPS = select({
++    "@@//third_party/v8:use_rusty_v8_custom_libcxx": [
++        "@@//third_party/v8:rusty_v8_custom_libcxx_headers",
++    ],
++    "//conditions:default": [],
++})
++
++_RUSTY_V8_CUSTOM_LIBCXX_REPOS = [
++    # V8 and ICU are patched in-tree. These external C++ dependencies still
++    # build inside the artifact closure once the LLVM toolchain's default
++    # libc++ headers are suppressed.
++    "@abseil-cpp+",
++    "@v8++http_archive+highway",
++    "@v8++http_archive+simdutf",
++]
++
++def _should_use_rusty_v8_custom_libcxx():
++    return native.repository_name() in _RUSTY_V8_CUSTOM_LIBCXX_REPOS
++
+ def cc_library(**kwargs):
++    if _should_use_rusty_v8_custom_libcxx():
++        kwargs["copts"] = (kwargs.get("copts", []) or []) + _RUSTY_V8_CUSTOM_LIBCXX_COPTS
++        kwargs["deps"] = (kwargs.get("deps", []) or []) + _RUSTY_V8_CUSTOM_LIBCXX_DEPS
++        kwargs["features"] = (kwargs.get("features", []) or []) + ["-module_maps"]
+     _cc_library(**kwargs)
diff --git a/patches/v8_bazel_rules.patch b/patches/v8_bazel_rules.patch
index 70ab440d85..1c49d06b09 100644
--- a/patches/v8_bazel_rules.patch
+++ b/patches/v8_bazel_rules.patch
@@ -7,16 +7,47 @@ diff --git a/orig/v8-14.6.202.11/bazel/defs.bzl b/mod/v8-14.6.202.11/bazel/defs.
 index 9648e4a..88efd41 100644
 --- a/orig/v8-14.6.202.11/bazel/defs.bzl
 +++ b/mod/v8-14.6.202.11/bazel/defs.bzl
-@@ -97,7 +97,7 @@ v8_config = rule(
+@@ -33,9 +33,21 @@
+ )
+ 
+ def v8_flag(name, default = False):
+-    _create_option_flag(name = name, build_setting_default = default)
+-    native.config_setting(name = "is_" + name, flag_values = {name: "True"})
+-    native.config_setting(name = "is_not_" + name, flag_values = {name: "False"})
++    _create_option_flag(
++        name = name,
++        build_setting_default = default,
++        visibility = ["//visibility:public"],
++    )
++    native.config_setting(
++        name = "is_" + name,
++        flag_values = {name: "True"},
++        visibility = ["//visibility:public"],
++    )
++    native.config_setting(
++        name = "is_not_" + name,
++        flag_values = {name: "False"},
++        visibility = ["//visibility:public"],
++    )
+ 
+ def v8_string(name, default = ""):
+     _create_option_string(name = name, build_setting_default = default)
+@@ -97,7 +109,13 @@
  
  def _default_args():
      return struct(
 -        deps = [":define_flags", "@libcxx//:libc++"],
-+        deps = [":define_flags"],
++        deps = [":define_flags"] + select({
++            "@v8//:is_v8_use_rusty_v8_custom_libcxx": [
++                "@@//third_party/v8:rusty_v8_custom_libcxx_headers",
++                "@@//third_party/v8:rusty_v8_custom_libcxx_runtime",
++            ],
++            "//conditions:default": [],
++        }),
          defines = select({
              "@v8//bazel/config:is_windows": [
                  "UNICODE",
-@@ -128,12 +128,6 @@ def _default_args():
+@@ -127,12 +145,15 @@
              ],
              "//conditions:default": [],
          }) + select({
@@ -26,20 +57,29 @@ index 9648e4a..88efd41 100644
 -                "-Wno-deprecated-declarations",
 -                "-std=c++20",
 -            ],
++            "@v8//:is_v8_use_rusty_v8_custom_libcxx": [
++                "-nostdinc++",
++                "-D_LIBCPP_DISABLE_VISIBILITY_ANNOTATIONS",
++                "-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_EXTENSIVE",
++                "-D_LIBCPP_INSTRUMENTED_WITH_ASAN=0",
++                "-D_LIBCXXABI_DISABLE_VISIBILITY_ANNOTATIONS",
++            ],
++            "//conditions:default": [],
++        }) + select({
              "@v8//bazel/config:is_gcc": [
                  "-Wno-extra",
                  "-Wno-array-bounds",
-@@ -155,7 +149,15 @@ def _default_args():
--            "@v8//bazel/config:is_windows": [
+@@ -152,9 +173,17 @@
+                 "-std=gnu++2a",
+             ],
+             "@v8//bazel/config:is_windows": [
 -                "/std:c++20",
--            ],
--            "//conditions:default": [],
-+            "@v8//bazel/config:is_windows": [
 +                "-Wno-invalid-offsetof",
 +                "-Wno-deprecated-this-capture",
 +                "-Wno-deprecated-declarations",
 +                "-std=c++20",
-+            ],
+             ],
+-            "//conditions:default": [],
 +            "//conditions:default": [
 +                "-Wno-invalid-offsetof",
 +                "-Wno-deprecated-this-capture",
@@ -49,7 +89,9 @@ index 9648e4a..88efd41 100644
          }) + select({
              "@v8//bazel/config:is_gcc_fastbuild": [
                  # Non-debug builds without optimizations fail because
-@@ -180,10 +179,10 @@ def _default_args():
+@@ -178,12 +207,12 @@
+         includes = ["include"],
+         linkopts = select({
              "@v8//bazel/config:is_windows": [
 -                "Winmm.lib",
 -                "DbgHelp.lib",
@@ -65,19 +107,21 @@ index 9648e4a..88efd41 100644
              ":should_add_rdynamic": ["-rdynamic"],
              "//conditions:default": [],
 diff --git a/orig/v8-14.6.202.11/BUILD.bazel b/mod/v8-14.6.202.11/BUILD.bazel
-index 85f31b7..bbc351b 100644
+index 421ebcd..52283ea 100644
 --- a/orig/v8-14.6.202.11/BUILD.bazel
 +++ b/mod/v8-14.6.202.11/BUILD.bazel
-@@ -148,6 +148,8 @@ v8_flag(name = "v8_enable_trace_maps")
+@@ -148,6 +148,10 @@ v8_flag(name = "v8_enable_trace_maps")
  
  v8_flag(name = "v8_enable_v8_checks")
  
 +v8_flag(name = "v8_enable_sandbox")
++
++v8_flag(name = "v8_use_rusty_v8_custom_libcxx")
 +
  v8_flag(name = "v8_enable_verify_csa")
  
  v8_flag(name = "v8_enable_verify_heap")
-@@ -303,7 +305,7 @@ v8_int(
+@@ -313,7 +317,7 @@ v8_int(
  # If no explicit value for v8_enable_pointer_compression, we set it to 'none'.
  v8_string(
      name = "v8_enable_pointer_compression",
@@ -86,7 +130,7 @@ index 85f31b7..bbc351b 100644
  )
  
  # Default setting for v8_enable_pointer_compression.
-@@ -503,6 +505,7 @@ v8_config(
+@@ -513,6 +517,7 @@ v8_config(
          "v8_enable_slow_dchecks": "ENABLE_SLOW_DCHECKS",
          "v8_enable_runtime_call_stats": "V8_RUNTIME_CALL_STATS",
          "v8_enable_snapshot_native_code_counters": "V8_SNAPSHOT_NATIVE_CODE_COUNTERS",
@@ -94,7 +138,7 @@ index 85f31b7..bbc351b 100644
          "v8_enable_trace_maps": "V8_TRACE_MAPS",
          "v8_enable_turbofan": "V8_ENABLE_TURBOFAN",
          "v8_enable_v8_checks": "V8_ENABLE_CHECKS",
-@@ -4077,28 +4080,14 @@ filegroup(
+@@ -4098,28 +4103,14 @@ filegroup(
      }),
  )
  
@@ -129,7 +173,7 @@ index 85f31b7..bbc351b 100644
  )
  
  filegroup(
-@@ -4405,6 +4394,20 @@ genrule(
+@@ -4422,6 +4413,20 @@ genrule(
      srcs = [
          "include/js_protocol.pdl",
          "src/inspector/inspector_protocol_config.json",
@@ -150,7 +194,7 @@ index 85f31b7..bbc351b 100644
      ],
      outs = [
          "include/inspector/Debugger.h",
-@@ -4426,15 +4429,19 @@ genrule(
+@@ -4443,15 +4448,19 @@ genrule(
          "src/inspector/protocol/Schema.cpp",
          "src/inspector/protocol/Schema.h",
      ],
@@ -174,7 +218,7 @@ index 85f31b7..bbc351b 100644
      ],
  )
  
-@@ -4448,6 +4455,15 @@ filegroup(
+@@ -4465,6 +4474,35 @@ filegroup(
      ],
  )
  
@@ -186,11 +230,31 @@ index 85f31b7..bbc351b 100644
 +    strip_include_prefix = "",
 +    visibility = ["//visibility:public"],
 +)
++
++cc_library(
++    name = "rusty_v8_crdtp_headers",
++    hdrs = [
++        "third_party/inspector_protocol/crdtp/cbor.h",
++        "third_party/inspector_protocol/crdtp/dispatch.h",
++        "third_party/inspector_protocol/crdtp/error_support.h",
++        "third_party/inspector_protocol/crdtp/export.h",
++        "third_party/inspector_protocol/crdtp/find_by_first.h",
++        "third_party/inspector_protocol/crdtp/frontend_channel.h",
++        "third_party/inspector_protocol/crdtp/json.h",
++        "third_party/inspector_protocol/crdtp/parser_handler.h",
++        "third_party/inspector_protocol/crdtp/protocol_core.h",
++        "third_party/inspector_protocol/crdtp/serializable.h",
++        "third_party/inspector_protocol/crdtp/span.h",
++        "third_party/inspector_protocol/crdtp/status.h",
++    ],
++    strip_include_prefix = "",
++    visibility = ["//visibility:public"],
++)
 +
  filegroup(
      name = "d8_files",
      srcs = [
-@@ -4567,16 +4583,9 @@ cc_library(
+@@ -4584,16 +4602,9 @@ cc_library(
      ],
  )
  
@@ -210,7 +274,7 @@ index 85f31b7..bbc351b 100644
  )
  
  v8_library(
-@@ -4593,7 +4602,7 @@ v8_library(
+@@ -4610,7 +4621,7 @@ v8_library(
      copts = ["-Wno-implicit-fallthrough"],
      icu_deps = [
          ":icu/generated_torque_definitions_headers",
@@ -219,7 +283,7 @@ index 85f31b7..bbc351b 100644
      ],
      icu_srcs = [
          ":generated_regexp_special_case",
-@@ -4608,7 +4617,7 @@ v8_library(
+@@ -4625,7 +4636,7 @@ v8_library(
      ],
      deps = [
          ":lib_dragonbox",
@@ -228,7 +292,7 @@ index 85f31b7..bbc351b 100644
          ":lib_fp16",
          ":simdutf",
          ":v8_libbase",
-@@ -4664,6 +4673,7 @@ alias(
+@@ -4681,6 +4692,7 @@ alias(
  alias(
      name = "core_lib_icu",
      actual = "icu/v8",
@@ -236,7 +300,7 @@ index 85f31b7..bbc351b 100644
  )
  
  v8_library(
-@@ -4715,7 +4725,7 @@ v8_binary(
+@@ -4732,7 +4744,7 @@ v8_binary(
      ],
      deps = [
          ":v8_libbase",
@@ -245,17 +309,53 @@ index 85f31b7..bbc351b 100644
      ],
  )
  
+@@ -4772,9 +4784,15 @@ v8_binary(
+         ":icu/generated_torque_initializers",
+         ":icu/v8_initializers_files",
+     ],
++    # Match GN's mksnapshot `disable_icf` config. If the linker folds distinct
++    # external-reference helpers together while producing the snapshot, the
++    # final embedder binary may not fold the same pair and startup
++    # deserialization will reject the snapshot.
+     linkopts = select({
+         "@v8//bazel/config:is_android": ["-llog"],
+-        "//conditions:default": [],
++        "@v8//bazel/config:is_macos": ["-Wl,-no_deduplicate"],
++        "@v8//bazel/config:is_windows": ["/OPT:NOICF"],
++        "//conditions:default": ["-Wl,--icf=none"],
+     }),
+     noicu_deps = [":v8_libshared_noicu"],
+     noicu_srcs = [
 diff --git a/orig/v8-14.6.202.11/bazel/BUILD.icu b/mod/v8-14.6.202.11/bazel/BUILD.icu
-index 5fda2f4..381386c 100644
+index 5fda2f4..9729451 100644
 --- a/orig/v8-14.6.202.11/bazel/BUILD.icu
 +++ b/mod/v8-14.6.202.11/bazel/BUILD.icu
-@@ -1,3 +1,5 @@
+@@ -1,3 +1,24 @@
 +load("@rules_cc//cc:defs.bzl", "cc_library")
++
++CUSTOM_LIBCXX_COPTS = select({
++    "@v8//:is_v8_use_rusty_v8_custom_libcxx": [
++        "-nostdinc++",
++        "-D_LIBCPP_DISABLE_VISIBILITY_ANNOTATIONS",
++        "-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_EXTENSIVE",
++        "-D_LIBCPP_INSTRUMENTED_WITH_ASAN=0",
++        "-D_LIBCXXABI_DISABLE_VISIBILITY_ANNOTATIONS",
++    ],
++    "//conditions:default": [],
++})
++
++CUSTOM_LIBCXX_DEPS = select({
++    "@v8//:is_v8_use_rusty_v8_custom_libcxx": [
++        "@@//third_party/v8:rusty_v8_custom_libcxx_headers",
++        "@@//third_party/v8:rusty_v8_custom_libcxx_runtime",
++    ],
++    "//conditions:default": [],
++})
 +
  # Copyright 2021 the V8 project authors. All rights reserved.
  # Use of this source code is governed by a BSD-style license that can be
  # found in the LICENSE file.
-@@ -16,10 +18,7 @@ cc_library(
+@@ -16,15 +37,12 @@
      ]),
      copts = select({
          "@platforms//os:windows": [
@@ -267,7 +367,21 @@ index 5fda2f4..381386c 100644
          ],
          "//conditions:default": [
              "-Wno-deprecated-declarations",
-@@ -65,10 +64,7 @@ cc_library(
+         ],
+-    }),
++    }) + CUSTOM_LIBCXX_COPTS,
+     data = [":icudata"],
+     defines = [
+         "HAVE_DLOPEN=0",
+@@ -54,6 +72,7 @@
+         "U_ICUDATAENTRY_IN_COMMON",
+     ],
+     tags = ["requires-rtti"],
++    deps = CUSTOM_LIBCXX_DEPS,
+     alwayslink = 1,
+ )
+ 
+@@ -65,19 +84,16 @@
      ]),
      copts = select({
          "@platforms//os:windows": [
@@ -279,7 +393,18 @@ index 5fda2f4..381386c 100644
          ],
          "//conditions:default": [
              "-Wno-deprecated-declarations",
-@@ -93,10 +89,7 @@ cc_library(
+         ],
+-    }),
++    }) + CUSTOM_LIBCXX_COPTS,
+     local_defines = [
+         "U_I18N_IMPLEMENTATION",
+     ],
+-    deps = [":icuuc"],
++    deps = [":icuuc"] + CUSTOM_LIBCXX_DEPS,
+     alwayslink = 1,
+ )
+ 
+@@ -93,13 +109,10 @@
      ]),
      copts = select({
          "@platforms//os:windows": [
@@ -290,4 +415,16 @@ index 5fda2f4..381386c 100644
 +            "-Wno-deprecated-declarations",
          ],
          "//conditions:default": [],
-     }),
+-    }),
++    }) + CUSTOM_LIBCXX_COPTS,
+     include_prefix = "third_party/icu",
+     local_defines = [
+         "U_COMMON_IMPLEMENTATION",
+@@ -108,6 +121,6 @@
+     deps = [
+         ":icui18n",
+         ":icuuc",
+-    ],
++    ] + CUSTOM_LIBCXX_DEPS,
+     alwayslink = 1,
+ )
diff --git a/scripts/build_codex_package.py b/scripts/build_codex_package.py
new file mode 100755
index 0000000000..8e1097c488
--- /dev/null
+++ b/scripts/build_codex_package.py
@@ -0,0 +1,16 @@
+#!/usr/bin/env python3
+"""Build a canonical Codex package directory and optional archive."""
+
+from pathlib import Path
+import sys
+
+
+# Some developer environments set PYTHONSAFEPATH=1, which prevents Python from
+# adding the script directory to sys.path. Add it explicitly so the local helper
+# package remains importable when this executable is launched from any cwd.
+sys.path.insert(0, str(Path(__file__).resolve().parent))
+
+from codex_package.cli import main
+
+if __name__ == "__main__":
+    raise SystemExit(main())
diff --git a/scripts/codex_package/README.md b/scripts/codex_package/README.md
new file mode 100644
index 0000000000..8c3c7ac58b
--- /dev/null
+++ b/scripts/codex_package/README.md
@@ -0,0 +1,39 @@
+# Codex package builder
+
+This package contains the implementation behind `scripts/build_codex_package.py`.
+The top-level script is the stable executable entry point; these modules keep the
+package-building logic split by responsibility.
+
+The builder creates a canonical Codex package directory:
+
+```text
+.
+├── codex-package.json
+├── bin
+│   └── codex[.exe]
+├── codex-resources
+│   ├── bwrap                             # Linux only
+│   ├── codex-command-runner.exe          # Windows only
+│   └── codex-windows-sandbox-setup.exe   # Windows only
+└── codex-path
+    └── rg[.exe]
+```
+
+The package directory is the primary artifact. Archive formats such as
+`.tar.gz`, `.tar.zst`, and `.zip` are serializations of that directory.
+
+## Source-built artifacts
+
+Artifacts built from this repository are always built by the package builder in
+one grouped `cargo build` command per package:
+
+- all targets: `codex`
+- Linux targets: `bwrap`
+- Windows targets: `codex-command-runner` and `codex-windows-sandbox-setup`
+
+The default cargo profile is `dev-small` because local iteration should favor
+fast, small builds. Release jobs should pass `--cargo-profile release`.
+
+`rg` is not built from this repository, so it remains an input. If `--rg-bin` is
+omitted, the builder looks in the existing `codex-cli/vendor/<target>/path/`
+location.
diff --git a/scripts/codex_package/__init__.py b/scripts/codex_package/__init__.py
new file mode 100644
index 0000000000..bf8a68ab78
--- /dev/null
+++ b/scripts/codex_package/__init__.py
@@ -0,0 +1 @@
+"""Helpers for building canonical Codex package archives."""
diff --git a/scripts/codex_package/archive.py b/scripts/codex_package/archive.py
new file mode 100644
index 0000000000..fe09c0a4f7
--- /dev/null
+++ b/scripts/codex_package/archive.py
@@ -0,0 +1,87 @@
+"""Archive writers for canonical Codex package directories."""
+
+import shutil
+import subprocess
+import tarfile
+import tempfile
+import zipfile
+from pathlib import Path
+
+
+def write_archive(package_dir: Path, archive_path: Path, *, force: bool) -> None:
+    if is_relative_to(archive_path, package_dir):
+        raise RuntimeError(
+            f"Archive output must be outside the package directory: {archive_path}"
+        )
+
+    archive_path.parent.mkdir(parents=True, exist_ok=True)
+    if archive_path.exists():
+        if not force:
+            raise RuntimeError(f"Archive output already exists: {archive_path}")
+        archive_path.unlink()
+
+    archive_format = archive_format_for_path(archive_path)
+    if archive_format == "tar.gz":
+        write_tar_archive(package_dir, archive_path, mode="w:gz")
+    elif archive_format == "tar.zst":
+        write_tar_zst_archive(package_dir, archive_path)
+    elif archive_format == "zip":
+        write_zip_archive(package_dir, archive_path)
+    else:
+        raise AssertionError(f"unexpected archive format: {archive_format}")
+
+
+def is_relative_to(path: Path, parent: Path) -> bool:
+    try:
+        path.relative_to(parent)
+        return True
+    except ValueError:
+        return False
+
+
+def archive_format_for_path(path: Path) -> str:
+    suffixes = path.suffixes
+    if suffixes[-2:] == [".tar", ".gz"] or path.suffix == ".tgz":
+        return "tar.gz"
+    if suffixes[-2:] == [".tar", ".zst"]:
+        return "tar.zst"
+    if path.suffix == ".zip":
+        return "zip"
+    raise RuntimeError(
+        f"Unsupported archive suffix for {path}. Use .tar.gz, .tgz, .tar.zst, or .zip."
+    )
+
+
+def write_tar_archive(package_dir: Path, archive_path: Path, *, mode: str) -> None:
+    with tarfile.open(archive_path, mode) as archive:
+        for path in package_entries(package_dir):
+            archive.add(
+                path,
+                arcname=path.relative_to(package_dir),
+                recursive=False,
+            )
+
+
+def write_tar_zst_archive(package_dir: Path, archive_path: Path) -> None:
+    zstd = shutil.which("zstd")
+    if zstd is None:
+        raise RuntimeError("zstd is required to write .tar.zst archives.")
+
+    with tempfile.TemporaryDirectory(prefix="codex-package-archive-") as temp_dir_str:
+        tar_path = Path(temp_dir_str) / "package.tar"
+        write_tar_archive(package_dir, tar_path, mode="w")
+        subprocess.check_call([zstd, "-T0", "-19", "-f", str(tar_path), "-o", str(archive_path)])
+
+
+def write_zip_archive(package_dir: Path, archive_path: Path) -> None:
+    with zipfile.ZipFile(archive_path, "w", compression=zipfile.ZIP_DEFLATED) as archive:
+        for path in package_entries(package_dir):
+            relative_path = path.relative_to(package_dir)
+            if path.is_dir():
+                archive.write(path, f"{relative_path}/")
+            else:
+                archive.write(path, relative_path)
+
+
+def package_entries(package_dir: Path) -> list[Path]:
+    return sorted(package_dir.rglob("*"), key=lambda path: path.relative_to(package_dir).as_posix())
diff --git a/scripts/codex_package/cargo.py b/scripts/codex_package/cargo.py
new file mode 100644
index 0000000000..9ee2d2f832
--- /dev/null
+++ b/scripts/codex_package/cargo.py
@@ -0,0 +1,106 @@
+"""Cargo builds for source-built Codex package artifacts."""
+
+import os
+import subprocess
+from dataclasses import dataclass
+from pathlib import Path
+
+from .targets import REPO_ROOT
+from .targets import TargetSpec
+
+
+CODEX_RS_ROOT = REPO_ROOT / "codex-rs"
+
+
+@dataclass(frozen=True)
+class SourceBuildOutputs:
+    codex_bin: Path
+    bwrap_bin: Path | None
+    codex_command_runner_bin: Path | None
+    codex_windows_sandbox_setup_bin: Path | None
+
+
+def build_source_binaries(
+    spec: TargetSpec,
+    *,
+    cargo: str,
+    profile: str,
+) -> SourceBuildOutputs:
+    binaries = source_binaries_for_target(spec)
+    cmd = [
+        cargo,
+        "build",
+        "--target",
+        spec.target,
+        "--profile",
+        profile,
+    ]
+    for binary in binaries:
+        cmd.extend(["--bin", binary])
+
+    print("+", " ".join(cmd))
+    subprocess.run(cmd, cwd=CODEX_RS_ROOT, check=True)
+
+    output_dir = cargo_profile_output_dir(spec, profile)
+    outputs = SourceBuildOutputs(
+        codex_bin=output_dir / spec.codex_name,
+        bwrap_bin=output_dir / "bwrap" if spec.is_linux else None,
+        codex_command_runner_bin=(
+            output_dir / "codex-command-runner.exe" if spec.is_windows else None
+        ),
+        codex_windows_sandbox_setup_bin=(
+            output_dir / "codex-windows-sandbox-setup.exe" if spec.is_windows else None
+        ),
+    )
+    validate_source_outputs(outputs)
+    return outputs
+
+
+def source_binaries_for_target(spec: TargetSpec) -> list[str]:
+    binaries = ["codex"]
+    if spec.is_linux:
+        binaries.append("bwrap")
+    if spec.is_windows:
+        binaries.extend(
+            [
+                "codex-command-runner",
+                "codex-windows-sandbox-setup",
+            ]
+        )
+    return binaries
+
+
+def cargo_profile_output_dir(spec: TargetSpec, profile: str) -> Path:
+    target_dir = cargo_target_dir()
+    return target_dir / spec.target / cargo_profile_dirname(profile)
+
+
+def cargo_target_dir() -> Path:
+    target_dir = os.environ.get("CARGO_TARGET_DIR")
+    if target_dir is None:
+        return CODEX_RS_ROOT / "target"
+
+    path = Path(target_dir)
+    if path.is_absolute():
+        return path
+
+    return CODEX_RS_ROOT / path
+
+
+def cargo_profile_dirname(profile: str) -> str:
+    if profile == "dev":
+        return "debug"
+    if profile == "release":
+        return "release"
+    return profile
+
+
+def validate_source_outputs(outputs: SourceBuildOutputs) -> None:
+    for path in [
+        outputs.codex_bin,
+        outputs.bwrap_bin,
+        outputs.codex_command_runner_bin,
+        outputs.codex_windows_sandbox_setup_bin,
+    ]:
+        if path is not None and not path.is_file():
+            raise RuntimeError(f"cargo build did not produce expected binary: {path}")
diff --git a/scripts/codex_package/cli.py b/scripts/codex_package/cli.py
new file mode 100644
index 0000000000..beddffa3b9
--- /dev/null
+++ b/scripts/codex_package/cli.py
@@ -0,0 +1,105 @@
+"""Command-line interface for building Codex package directories."""
+
+import argparse
+from pathlib import Path
+
+from .archive import write_archive
+from .cargo import build_source_binaries
+from .layout import build_package_dir
+from .layout import prepare_package_dir
+from .layout import validate_package_dir
+from .targets import TARGET_SPECS
+from .targets import PackageInputs
+from .targets import resolve_rg_bin
+
+
+def parse_args() -> argparse.Namespace:
+    parser = argparse.ArgumentParser(
+        description="Build a canonical Codex package directory and optional archive.",
+        formatter_class=argparse.ArgumentDefaultsHelpFormatter,
+    )
+    parser.add_argument(
+        "--target",
+        required=True,
+        choices=sorted(TARGET_SPECS),
+        help="Rust target triple for the package.",
+    )
+    parser.add_argument(
+        "--version",
+        default="0.0.0-dev",
+        help="Codex version to record in codex-package.json.",
+    )
+    parser.add_argument(
+        "--variant",
+        default="codex",
+        help="Package variant to record in codex-package.json.",
+    )
+    parser.add_argument(
+        "--package-dir",
+        type=Path,
+        required=True,
+        help="Output directory to create as the package root.",
+    )
+    parser.add_argument(
+        "--archive-output",
+        type=Path,
+        help=(
+            "Optional archive output path. Supported suffixes: .tar.gz, .tgz, "
+            ".tar.zst, .zip."
+        ),
+    )
+    parser.add_argument(
+        "--force",
+        action="store_true",
+        help="Replace an existing package directory or archive output.",
+    )
+    parser.add_argument(
+        "--cargo",
+        default="cargo",
+        help="Cargo executable to use for source-built package artifacts.",
+    )
+    parser.add_argument(
+        "--cargo-profile",
+        default="dev-small",
+        help=(
+            "Cargo profile for source-built package artifacts. Use release for "
+            "release packages."
+        ),
+    )
+    parser.add_argument(
+        "--rg-bin",
+        type=Path,
+        help="Path to the ripgrep executable to place in codex-path/.",
+    )
+    return parser.parse_args()
+
+
+def main() -> int:
+    args = parse_args()
+    spec = TARGET_SPECS[args.target]
+    package_dir = args.package_dir.resolve()
+
+    source_outputs = build_source_binaries(
+        spec,
+        cargo=args.cargo,
+        profile=args.cargo_profile,
+    )
+    inputs = PackageInputs(
+        codex_bin=source_outputs.codex_bin,
+        rg_bin=resolve_rg_bin(spec, args.rg_bin),
+        bwrap_bin=source_outputs.bwrap_bin,
+        codex_command_runner_bin=source_outputs.codex_command_runner_bin,
+        codex_windows_sandbox_setup_bin=source_outputs.codex_windows_sandbox_setup_bin,
+    )
+    prepare_package_dir(package_dir, force=args.force)
+    build_package_dir(package_dir, args.version, args.variant, spec, inputs)
+    validate_package_dir(package_dir, spec)
+
+    archive_output = args.archive_output
+    if archive_output is not None:
+        archive_path = archive_output.resolve()
+        write_archive(package_dir, archive_path, force=args.force)
+        print(f"Built Codex package archive at {archive_path}")
+
+    print(f"Built Codex package directory at {package_dir}")
+    return 0
diff --git a/scripts/codex_package/layout.py b/scripts/codex_package/layout.py
new file mode 100644
index 0000000000..faf24ef810
--- /dev/null
+++ b/scripts/codex_package/layout.py
@@ -0,0 +1,153 @@
+"""Canonical Codex package directory layout."""
+
+import json
+import shutil
+import stat
+from pathlib import Path
+
+from .targets import PackageInputs
+from .targets import TargetSpec
+
+
+LAYOUT_VERSION = 1
+
+
+def prepare_package_dir(package_dir: Path, *, force: bool) -> None:
+    if package_dir.exists():
+        if not package_dir.is_dir():
+            raise RuntimeError(f"Package output exists and is not a directory: {package_dir}")
+        if any(package_dir.iterdir()):
+            if not force:
+                raise RuntimeError(
+                    f"Package output directory is not empty: {package_dir}. "
+                    "Pass --force to replace it."
+                )
+            shutil.rmtree(package_dir)
+
+    package_dir.mkdir(parents=True, exist_ok=True)
+
+
+def build_package_dir(
+    package_dir: Path,
+    version: str,
+    variant: str,
+    spec: TargetSpec,
+    inputs: PackageInputs,
+) -> None:
+    bin_dir = package_dir / "bin"
+    resources_dir = package_dir / "codex-resources"
+    path_dir = package_dir / "codex-path"
+    bin_dir.mkdir()
+    resources_dir.mkdir()
+    path_dir.mkdir()
+
+    copy_executable(inputs.codex_bin, bin_dir / spec.codex_name, is_windows=spec.is_windows)
+    copy_executable(inputs.rg_bin, path_dir / spec.rg_name, is_windows=spec.is_windows)
+
+    if inputs.bwrap_bin is not None:
+        copy_executable(inputs.bwrap_bin, resources_dir / "bwrap", is_windows=False)
+
+    if inputs.codex_command_runner_bin is not None:
+        copy_executable(
+            inputs.codex_command_runner_bin,
+            resources_dir / "codex-command-runner.exe",
+            is_windows=True,
+        )
+
+    if inputs.codex_windows_sandbox_setup_bin is not None:
+        copy_executable(
+            inputs.codex_windows_sandbox_setup_bin,
+            resources_dir / "codex-windows-sandbox-setup.exe",
+            is_windows=True,
+        )
+
+    metadata = {
+        "layoutVersion": LAYOUT_VERSION,
+        "version": version,
+        "target": spec.target,
+        "variant": variant,
+        "entrypoint": f"bin/{spec.codex_name}",
+        "resourcesDir": "codex-resources",
+        "pathDir": "codex-path",
+    }
+    write_json(package_dir / "codex-package.json", metadata)
+
+
+def validate_package_dir(package_dir: Path, spec: TargetSpec) -> None:
+    required_dirs = [
+        Path("bin"),
+        Path("codex-resources"),
+        Path("codex-path"),
+    ]
+    for relative_dir in required_dirs:
+        path = package_dir / relative_dir
+        if not path.is_dir():
+            raise RuntimeError(f"Missing package directory: {relative_dir}")
+
+    metadata_path = package_dir / "codex-package.json"
+    if not metadata_path.is_file():
+        raise RuntimeError("Missing package metadata: codex-package.json")
+
+    with open(metadata_path, encoding="utf-8") as fh:
+        metadata = json.load(fh)
+
+    expected_metadata = {
+        "layoutVersion": LAYOUT_VERSION,
+        "target": spec.target,
+        "entrypoint": f"bin/{spec.codex_name}",
+        "resourcesDir": "codex-resources",
+        "pathDir": "codex-path",
+    }
+    for key, expected in expected_metadata.items():
+        actual = metadata.get(key)
+        if actual != expected:
+            raise RuntimeError(
+                f"Invalid package metadata field {key!r}: expected {expected!r}, got {actual!r}"
+            )
+
+    required_files = [
+        Path("bin") / spec.codex_name,
+        Path("codex-path") / spec.rg_name,
+    ]
+    executable_files = list(required_files)
+
+    if spec.is_linux:
+        required_files.append(Path("codex-resources") / "bwrap")
+        executable_files.append(Path("codex-resources") / "bwrap")
+
+    if spec.is_windows:
+        required_files.extend(
+            [
+                Path("codex-resources") / "codex-command-runner.exe",
+                Path("codex-resources") / "codex-windows-sandbox-setup.exe",
+            ]
+        )
+
+    for relative_file in required_files:
+        path = package_dir / relative_file
+        if not path.is_file():
+            raise RuntimeError(f"Missing package file: {relative_file}")
+
+    if not spec.is_windows:
+        for relative_file in executable_files:
+            path = package_dir / relative_file
+            if not is_executable(path):
+                raise RuntimeError(f"Package file is not executable: {relative_file}")
+
+
+def copy_executable(src: Path, dest: Path, *, is_windows: bool) -> None:
+    dest.parent.mkdir(parents=True, exist_ok=True)
+    shutil.copy2(src, dest)
+    if not is_windows:
+        mode = dest.stat().st_mode
+        dest.chmod(mode | stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH)
+
+
+def write_json(path: Path, value: object) -> None:
+    with open(path, "w", encoding="utf-8") as out:
+        json.dump(value, out, indent=2)
+        out.write("\n")
+
+
+def is_executable(path: Path) -> bool:
+    return bool(path.stat().st_mode & stat.S_IXUSR)
diff --git a/scripts/codex_package/targets.py b/scripts/codex_package/targets.py
new file mode 100644
index 0000000000..bdba8bd766
--- /dev/null
+++ b/scripts/codex_package/targets.py
@@ -0,0 +1,114 @@
+"""Supported package targets and default binary discovery."""
+
+import stat
+from dataclasses import dataclass
+from pathlib import Path
+
+
+SCRIPT_DIR = Path(__file__).resolve().parents[1]
+REPO_ROOT = SCRIPT_DIR.parent
+
+
+@dataclass(frozen=True)
+class TargetSpec:
+    target: str
+    is_windows: bool
+    is_linux: bool
+
+    @property
+    def exe_suffix(self) -> str:
+        return ".exe" if self.is_windows else ""
+
+    @property
+    def codex_name(self) -> str:
+        return f"codex{self.exe_suffix}"
+
+    @property
+    def rg_name(self) -> str:
+        return f"rg{self.exe_suffix}"
+
+
+@dataclass(frozen=True)
+class PackageInputs:
+    codex_bin: Path
+    rg_bin: Path
+    bwrap_bin: Path | None
+    codex_command_runner_bin: Path | None
+    codex_windows_sandbox_setup_bin: Path | None
+
+
+TARGET_SPECS: dict[str, TargetSpec] = {
+    "x86_64-unknown-linux-musl": TargetSpec(
+        target="x86_64-unknown-linux-musl",
+        is_windows=False,
+        is_linux=True,
+    ),
+    "aarch64-unknown-linux-musl": TargetSpec(
+        target="aarch64-unknown-linux-musl",
+        is_windows=False,
+        is_linux=True,
+    ),
+    "x86_64-apple-darwin": TargetSpec(
+        target="x86_64-apple-darwin",
+        is_windows=False,
+        is_linux=False,
+    ),
+    "aarch64-apple-darwin": TargetSpec(
+        target="aarch64-apple-darwin",
+        is_windows=False,
+        is_linux=False,
+    ),
+    "x86_64-pc-windows-msvc": TargetSpec(
+        target="x86_64-pc-windows-msvc",
+        is_windows=True,
+        is_linux=False,
+    ),
+    "aarch64-pc-windows-msvc": TargetSpec(
+        target="aarch64-pc-windows-msvc",
+        is_windows=True,
+        is_linux=False,
+    ),
+}
+
+
+def resolve_rg_bin(spec: TargetSpec, rg_bin: Path | None) -> Path:
+    return resolve_input_path(
+        rg_bin,
+        default_rg_candidates(spec),
+        "ripgrep executable",
+        "--rg-bin",
+    )
+
+
+def default_rg_candidates(spec: TargetSpec) -> list[Path]:
+    return [
+        REPO_ROOT / "codex-cli" / "vendor" / spec.target / "path" / spec.rg_name,
+    ]
+
+
+def resolve_input_path(
+    explicit_path: Path | None,
+    default_candidates: list[Path],
+    description: str,
+    flag_name: str,
+) -> Path:
+    if explicit_path is not None:
+        path = explicit_path.resolve()
+        if not path.is_file():
+            raise RuntimeError(f"{description} does not exist: {path}")
+        if not is_executable(path):
+            raise RuntimeError(f"{description} is not executable: {path}")
+        return path
+
+    for candidate in default_candidates:
+        if candidate.is_file():
+            return candidate.resolve()
+
+    candidates = "\n".join(f"  - {candidate}" for candidate in default_candidates)
+    raise RuntimeError(
+        f"Could not find {description}. Pass {flag_name}, or create one of:\n{candidates}"
+    )
+
+
+def is_executable(path: Path) -> bool:
+    return bool(path.stat().st_mode & (stat.S_IXUSR | stat.S_IXGRP | stat.S_IXOTH))
diff --git a/sdk/python/README.md b/sdk/python/README.md
index 31d8213b5f..5b8e6b8178 100644
--- a/sdk/python/README.md
+++ b/sdk/python/README.md
@@ -17,10 +17,8 @@ source .venv/bin/activate
 ```
 
 Published SDK builds pin an exact `openai-codex-cli-bin` runtime dependency
-with the same version as the SDK. For local repo development, either pass
-`AppServerConfig(codex_bin=...)` to point at a local build explicitly, or use
-the repo examples/notebook bootstrap which installs the pinned runtime package
-automatically.
+with the same version as the SDK. Pass `AppServerConfig(codex_bin=...)` only
+when you intentionally want to run against a specific local app-server binary.
 
 ## Quickstart
 
@@ -28,14 +26,45 @@ automatically.
 from openai_codex import Codex
 
 with Codex() as codex:
+    # Call login_api_key(...) first when this app-server session is not
+    # already authenticated.
     thread = codex.thread_start(model="gpt-5")
     result = thread.run("Say hello in one sentence.")
     print(result.final_response)
     print(len(result.items))
 ```
 
-`result.final_response` is `None` when the turn completes without a final-answer
-or phase-less assistant message item.
+`thread.run(...)` and `thread.turn(...).run()` return `TurnResult`. Its
+`final_response` is `None` when the turn completes without a final-answer or
+phase-less assistant message item.
+
+## Login
+
+Use the auth helper that matches your app:
+
+```python
+from openai_codex import Codex
+
+with Codex() as codex:
+    codex.login_api_key("sk-...")
+    account = codex.account()
+    print(account.account)
+```
+
+Interactive ChatGPT login returns a handle. Open the provided URL or device-code
+page, then wait for the matching completion event:
+
+```python
+with Codex() as codex:
+    login = codex.login_chatgpt()
+    print(login.auth_url)
+    completed = login.wait()
+    print(completed.success)
+```
+
+Use `login_chatgpt_device_code()` for device-code auth, `handle.cancel()` to
+stop an in-progress interactive login, and `logout()` to clear the active
+app-server account session.
 
 ## Docs map
 
@@ -55,49 +84,12 @@ python examples/01_quickstart_constructor/sync.py
 python examples/01_quickstart_constructor/async.py
 ```
 
-## Runtime packaging
-
-The repo no longer checks `codex` binaries into `sdk/python`.
+## Runtime
 
 Published SDK builds are pinned to an exact `openai-codex-cli-bin` package
 version, and that runtime package carries the platform-specific binary for the
 target wheel. The SDK package version and runtime package version must match.
 
-For local repo development, the checked-in `sdk/python-runtime` package is only
-a template for staged release artifacts. Editable installs should use an
-explicit `codex_bin` override for manual SDK usage; the repo examples and
-notebook bootstrap the pinned runtime package automatically.
-
-## Maintainer workflow
-
-```bash
-cd sdk/python
-uv sync
-python scripts/update_sdk_artifacts.py generate-types
-python scripts/update_sdk_artifacts.py \
-  stage-sdk \
-  /tmp/codex-python-release/openai-codex \
-  --codex-version <codex-release-tag-or-pep440-version>
-python scripts/update_sdk_artifacts.py \
-  stage-runtime \
-  /tmp/codex-python-release/openai-codex-cli-bin \
-  /path/to/codex \
-  --codex-version <codex-release-tag-or-pep440-version>
-```
-
-Pass `--platform-tag ...` to `stage-runtime` when the wheel should be tagged for
-a Rust target that differs from the Python build host. The intended one-off
-matrix is `macosx_11_0_arm64`, `macosx_10_9_x86_64`,
-`musllinux_1_1_aarch64`, `musllinux_1_1_x86_64`, `win_arm64`, and
-`win_amd64`.
-
-This supports the CI release flow:
-
-- run `generate-types` before packaging
-- stage `openai-codex` once with an exact `openai-codex-cli-bin==...` dependency
-- stage `openai-codex-cli-bin` on each supported platform runner with the same pinned runtime version
-- build and publish `openai-codex-cli-bin` as platform wheels only through PyPI trusted publishing; do not publish an sdist
-
 ## Compatibility and versioning
 
 - Package: `openai-codex`
@@ -110,6 +102,8 @@ This supports the CI release flow:
 
 - `Codex()` is eager and performs startup + `initialize` in the constructor.
 - Use context managers (`with Codex() as codex:`) to ensure shutdown.
+- Plain strings are accepted anywhere a turn input is accepted; they are
+  shorthand for `TextInput(...)`.
 - Prefer `thread.run("...")` for the common case. Use `thread.turn(...)` when
   you need streaming, steering, or interrupt control.
 - For transient overload, use `retry_on_overload` from the package root.
diff --git a/sdk/python/docs/api-reference.md b/sdk/python/docs/api-reference.md
index 6be7e19737..db78ff5f1d 100644
--- a/sdk/python/docs/api-reference.md
+++ b/sdk/python/docs/api-reference.md
@@ -3,7 +3,7 @@
 Public surface of `openai_codex` for app-server v2.
 
 This SDK surface is experimental. Turn streams are routed by turn ID so one client can consume multiple active turns concurrently.
-Thread and turn starts expose `approval_mode`. `ApprovalMode.auto_review` is the default; use `ApprovalMode.deny_all` to deny escalated permissions.
+Thread starts default to `ApprovalMode.auto_review`; turn starts accept an optional `approval_mode` override.
 
 ## Package Entry
 
@@ -12,13 +12,18 @@ from openai_codex import (
     Codex,
     AsyncCodex,
     ApprovalMode,
-    RunResult,
+    ChatgptLoginHandle,
+    DeviceCodeLoginHandle,
+    AsyncChatgptLoginHandle,
+    AsyncDeviceCodeLoginHandle,
     Thread,
     AsyncThread,
     TurnHandle,
     AsyncTurnHandle,
+    TurnResult,
     Input,
     InputItem,
+    RunInput,
     TextInput,
     ImageInput,
     LocalImageInput,
@@ -26,9 +31,15 @@ from openai_codex import (
     MentionInput,
 )
 from openai_codex.types import (
+    Account,
+    AccountLoginCompletedNotification,
+    CancelLoginAccountResponse,
+    CancelLoginAccountStatus,
+    GetAccountResponse,
     InitializeResponse,
     ThreadItem,
     ThreadTokenUsage,
+    TurnError,
     TurnStatus,
 )
 ```
@@ -47,6 +58,11 @@ Properties/methods:
 
 - `metadata -> InitializeResponse`
 - `close() -> None`
+- `login_api_key(api_key: str) -> None`
+- `login_chatgpt() -> ChatgptLoginHandle`
+- `login_chatgpt_device_code() -> DeviceCodeLoginHandle`
+- `account(*, refresh_token: bool = False) -> GetAccountResponse`
+- `logout() -> None`
 - `thread_start(*, approval_mode=ApprovalMode.auto_review, base_instructions=None, config=None, cwd=None, developer_instructions=None, ephemeral=None, model=None, model_provider=None, personality=None, sandbox=None) -> Thread`
 - `thread_list(*, archived=None, cursor=None, cwd=None, limit=None, model_providers=None, sort_key=None, source_kinds=None) -> ThreadListResponse`
 - `thread_resume(thread_id: str, *, approval_mode=ApprovalMode.auto_review, base_instructions=None, config=None, cwd=None, developer_instructions=None, model=None, model_provider=None, personality=None, sandbox=None) -> Thread`
@@ -82,6 +98,11 @@ Properties/methods:
 
 - `metadata -> InitializeResponse`
 - `close() -> Awaitable[None]`
+- `login_api_key(api_key: str) -> Awaitable[None]`
+- `login_chatgpt() -> Awaitable[AsyncChatgptLoginHandle]`
+- `login_chatgpt_device_code() -> Awaitable[AsyncDeviceCodeLoginHandle]`
+- `account(*, refresh_token: bool = False) -> Awaitable[GetAccountResponse]`
+- `logout() -> Awaitable[None]`
 - `thread_start(*, approval_mode=ApprovalMode.auto_review, base_instructions=None, config=None, cwd=None, developer_instructions=None, ephemeral=None, model=None, model_provider=None, personality=None, sandbox=None) -> Awaitable[AsyncThread]`
 - `thread_list(*, archived=None, cursor=None, cwd=None, limit=None, model_providers=None, sort_key=None, source_kinds=None) -> Awaitable[ThreadListResponse]`
 - `thread_resume(thread_id: str, *, approval_mode=ApprovalMode.auto_review, base_instructions=None, config=None, cwd=None, developer_instructions=None, model=None, model_provider=None, personality=None, sandbox=None) -> Awaitable[AsyncThread]`
@@ -97,22 +118,46 @@ async with AsyncCodex() as codex:
     ...
 ```
 
+## Login handles
+
+### ChatgptLoginHandle / AsyncChatgptLoginHandle
+
+- `login_id: str`
+- `auth_url: str`
+- `wait() -> AccountLoginCompletedNotification`
+- `cancel() -> CancelLoginAccountResponse`
+
+Async handle methods return awaitables.
+
+### DeviceCodeLoginHandle / AsyncDeviceCodeLoginHandle
+
+- `login_id: str`
+- `verification_url: str`
+- `user_code: str`
+- `wait() -> AccountLoginCompletedNotification`
+- `cancel() -> CancelLoginAccountResponse`
+
+Async handle methods return awaitables.
+
+`wait()` consumes only the completion notification for its matching login
+attempt. API-key login completes synchronously and does not return a handle.
+
 ## Thread / AsyncThread
 
 `Thread` and `AsyncThread` share the same shape and intent.
 
 ### Thread
 
-- `run(input: str | Input, *, approval_mode=ApprovalMode.auto_review, cwd=None, effort=None, model=None, output_schema=None, personality=None, sandbox_policy=None, service_tier=None, summary=None) -> RunResult`
-- `turn(input: Input, *, approval_mode=ApprovalMode.auto_review, cwd=None, effort=None, model=None, output_schema=None, personality=None, sandbox_policy=None, summary=None) -> TurnHandle`
+- `run(input: str | Input, *, approval_mode=None, cwd=None, effort=None, model=None, output_schema=None, personality=None, sandbox_policy=None, service_tier=None, summary=None) -> TurnResult`
+- `turn(input: str | Input, *, approval_mode=None, cwd=None, effort=None, model=None, output_schema=None, personality=None, sandbox_policy=None, service_tier=None, summary=None) -> TurnHandle`
 - `read(*, include_turns: bool = False) -> ThreadReadResponse`
 - `set_name(name: str) -> ThreadSetNameResponse`
 - `compact() -> ThreadCompactStartResponse`
 
 ### AsyncThread
 
-- `run(input: str | Input, *, approval_mode=ApprovalMode.auto_review, cwd=None, effort=None, model=None, output_schema=None, personality=None, sandbox_policy=None, service_tier=None, summary=None) -> Awaitable[RunResult]`
-- `turn(input: Input, *, approval_mode=ApprovalMode.auto_review, cwd=None, effort=None, model=None, output_schema=None, personality=None, sandbox_policy=None, summary=None) -> Awaitable[AsyncTurnHandle]`
+- `run(input: str | Input, *, approval_mode=None, cwd=None, effort=None, model=None, output_schema=None, personality=None, sandbox_policy=None, service_tier=None, summary=None) -> Awaitable[TurnResult]`
+- `turn(input: str | Input, *, approval_mode=None, cwd=None, effort=None, model=None, output_schema=None, personality=None, sandbox_policy=None, service_tier=None, summary=None) -> Awaitable[AsyncTurnHandle]`
 - `read(*, include_turns: bool = False) -> Awaitable[ThreadReadResponse]`
 - `set_name(name: str) -> Awaitable[ThreadSetNameResponse]`
 - `compact() -> Awaitable[ThreadCompactStartResponse]`
@@ -121,6 +166,12 @@ async with AsyncCodex() as codex:
 the turn, consumes notifications until completion, and returns a small result
 object with:
 
+- `id: str`
+- `status: TurnStatus`
+- `error: TurnError | None`
+- `started_at: int | None`
+- `completed_at: int | None`
+- `duration_ms: int | None`
 - `final_response: str | None`
 - `items: list[ThreadItem]`
 - `usage: ThreadTokenUsage | None`
@@ -129,16 +180,16 @@ object with:
 phase-less assistant message item.
 
 Use `turn(...)` when you need low-level turn control (`stream()`, `steer()`,
-`interrupt()`) or the public `Turn` model from `TurnHandle.run()`.
+`interrupt()`) before collecting the turn result.
 
 ## TurnHandle / AsyncTurnHandle
 
 ### TurnHandle
 
-- `steer(input: Input) -> TurnSteerResponse`
+- `steer(input: str | Input) -> TurnSteerResponse`
 - `interrupt() -> TurnInterruptResponse`
 - `stream() -> Iterator[Notification]`
-- `run() -> openai_codex.types.Turn`
+- `run() -> TurnResult`
 
 Behavior notes:
 
@@ -147,10 +198,10 @@ Behavior notes:
 
 ### AsyncTurnHandle
 
-- `steer(input: Input) -> Awaitable[TurnSteerResponse]`
+- `steer(input: str | Input) -> Awaitable[TurnSteerResponse]`
 - `interrupt() -> Awaitable[TurnInterruptResponse]`
 - `stream() -> AsyncIterator[Notification]`
-- `run() -> Awaitable[openai_codex.types.Turn]`
+- `run() -> Awaitable[TurnResult]`
 
 Behavior notes:
 
@@ -168,14 +219,23 @@ Behavior notes:
 
 InputItem = TextInput | ImageInput | LocalImageInput | SkillInput | MentionInput
 Input = list[InputItem] | InputItem
+RunInput = Input | str
 ```
 
+Use a plain `str` as shorthand for `TextInput(...)` anywhere a turn input is accepted:
+`thread.run("...")`, `thread.turn("...")`, and `turn.steer("...")`.
+
 ## Public Types
 
 The SDK wrappers return and accept public app-server models wherever possible:
 
 ```python
 from openai_codex.types import (
+    Account,
+    AccountLoginCompletedNotification,
+    CancelLoginAccountResponse,
+    CancelLoginAccountStatus,
+    GetAccountResponse,
     ThreadReadResponse,
     Turn,
     TurnStatus,
diff --git a/sdk/python/docs/faq.md b/sdk/python/docs/faq.md
index 11118d8c9c..5f2ed87ffd 100644
--- a/sdk/python/docs/faq.md
+++ b/sdk/python/docs/faq.md
@@ -8,7 +8,8 @@
 
 ## `run()` vs `stream()`
 
-- `TurnHandle.run()` / `AsyncTurnHandle.run()` is the easiest path. It consumes events until completion and returns the public app-server `Turn` model from `openai_codex.types`.
+- `Thread.run(...)` starts a turn and returns `TurnResult`.
+- `TurnHandle.run()` / `AsyncTurnHandle.run()` consumes events for an existing turn handle and returns the same `TurnResult` shape.
 - `TurnHandle.stream()` / `AsyncTurnHandle.stream()` yields raw notifications (`Notification`) so you can react event-by-event.
 
 Choose `run()` for most apps. Choose `stream()` for progress UIs, custom timeout logic, or custom parsing.
@@ -23,6 +24,16 @@ Choose `run()` for most apps. Choose `stream()` for progress UIs, custom timeout
 
 If your app is not already async, stay with `Codex`.
 
+## How do I log in?
+
+- `login_api_key(...)` authenticates immediately with an API key.
+- `login_chatgpt()` starts browser login and returns a handle with `auth_url`.
+- `login_chatgpt_device_code()` starts device-code login and returns a handle
+  with `verification_url` and `user_code`.
+- Interactive handles expose `wait()` for the matching
+  `account/login/completed` notification and `cancel()` to stop that attempt.
+- `account()` reads the current account state, and `logout()` clears it.
+
 ## Public kwargs are snake_case
 
 Public API keyword names are snake_case. The SDK still maps them to wire camelCase under the hood.
@@ -56,31 +67,7 @@ Common causes:
 
 - published runtime package (`openai-codex-cli-bin`) is not installed
 - local `codex_bin` override points to a missing file
-- local auth/session is missing
-- incompatible/old app-server
-
-Maintainers stage releases by building the SDK once and the runtime once per
-platform with the same pinned runtime version. Publish `openai-codex-cli-bin`
-as platform wheels only; do not publish an sdist:
-
-```bash
-cd sdk/python
-python scripts/update_sdk_artifacts.py generate-types
-python scripts/update_sdk_artifacts.py \
-  stage-sdk \
-  /tmp/codex-python-release/openai-codex \
-  --codex-version <codex-release-tag-or-pep440-version>
-python scripts/update_sdk_artifacts.py \
-  stage-runtime \
-  /tmp/codex-python-release/openai-codex-cli-bin \
-  /path/to/codex \
-  --codex-version <codex-release-tag-or-pep440-version>
-```
-
-If you are packaging a binary for a different target than the Python build
-host, pass `--platform-tag ...` to `stage-runtime`. The intended one-off matrix
-is `macosx_11_0_arm64`, `macosx_10_9_x86_64`, `musllinux_1_1_aarch64`,
-`musllinux_1_1_x86_64`, `win_arm64`, and `win_amd64`.
+- app-server version older than the SDK schema
 
 ## Why does a turn "hang"?
 
@@ -93,11 +80,11 @@ A turn is complete only when `turn/completed` arrives for that turn ID.
 
 Use `retry_on_overload(...)` for transient overload failures (`ServerBusyError`).
 
-Do not blindly retry all errors. For `InvalidParamsError` or `MethodNotFoundError`, fix inputs/version compatibility instead.
+Do not blindly retry all errors. For `InvalidParamsError` or `MethodNotFoundError`, fix inputs or update the runtime/schema version instead.
 
 ## Common pitfalls
 
 - Starting a new thread for every prompt when you wanted continuity.
 - Forgetting to `close()` (or not using context managers).
-- Assuming `run()` returns extra SDK-only fields instead of the public `Turn` model.
+- Reading `Turn.items` from live start/completed payloads instead of using `TurnResult.items`.
 - Mixing SDK input classes with raw dicts incorrectly.
diff --git a/sdk/python/docs/getting-started.md b/sdk/python/docs/getting-started.md
index e1c2e27bf5..b21db2a207 100644
--- a/sdk/python/docs/getting-started.md
+++ b/sdk/python/docs/getting-started.md
@@ -2,7 +2,7 @@
 
 This is the fastest path from install to a multi-turn thread using the public SDK surface.
 
-The SDK is experimental. Treat the API, bundled runtime strategy, and packaging details as unstable until the first public release.
+The SDK is experimental, so the public API and runtime requirements may keep evolving before the first public release.
 
 ## 1) Install
 
@@ -19,9 +19,37 @@ Requirements:
 - Python `>=3.10`
 - uv
 - installed `openai-codex-cli-bin` runtime package, or an explicit `codex_bin` override
-- local Codex auth/session configured
 
-## 2) Run your first turn (sync)
+## 2) Authenticate when needed
+
+Existing Codex auth state is reused automatically. To authenticate from the SDK,
+use the flow that fits your app:
+
+```python
+from openai_codex import Codex
+
+with Codex() as codex:
+    codex.login_api_key("sk-...")
+    account = codex.account()
+    print(account.account)
+```
+
+Interactive ChatGPT browser login returns a handle that carries the URL and the
+matching completion event:
+
+```python
+with Codex() as codex:
+    login = codex.login_chatgpt()
+    print(login.auth_url)
+    completed = login.wait()
+    print(completed.success)
+```
+
+Device-code login works the same way with
+`login_chatgpt_device_code()`, which exposes `verification_url`, `user_code`,
+and `wait()`.
+
+## 3) Run your first turn (sync)
 
 ```python
 from openai_codex import Codex
@@ -42,12 +70,13 @@ What happened:
 
 - `Codex()` started and initialized `codex app-server`.
 - `thread_start(...)` created a thread.
-- `thread.run("...")` started a turn, consumed events until completion, and returned the final assistant response plus collected items and usage.
+- `thread.run("...")` started a turn, consumed events until completion, and returned `TurnResult` with turn metadata, final assistant response, collected items, and usage.
 - `result.final_response` is `None` when no final-answer or phase-less assistant message item completes for the turn.
-- use `thread.turn(...)` when you need a `TurnHandle` for streaming, steering, interrupting, or turn IDs/status
+- plain strings are accepted anywhere a turn input is accepted; typed inputs are still available for multimodal and structured cases
+- use `thread.turn(...)` when you need a `TurnHandle` for streaming, steering, or interrupting before collecting `TurnResult`
 - one client can consume multiple active turns concurrently; turn streams are routed by turn ID
 
-## 3) Continue the same thread (multi-turn)
+## 4) Continue the same thread (multi-turn)
 
 ```python
 from openai_codex import Codex
@@ -62,7 +91,7 @@ with Codex() as codex:
     print("second:", second.final_response)
 ```
 
-## 4) Async parity
+## 5) Async parity
 
 Use `async with AsyncCodex()` as the normal async entrypoint. `AsyncCodex`
 initializes lazily, and context entry makes startup/shutdown explicit.
@@ -82,7 +111,7 @@ async def main() -> None:
 asyncio.run(main())
 ```
 
-## 5) Resume an existing thread
+## 6) Resume an existing thread
 
 ```python
 from openai_codex import Codex
@@ -95,7 +124,7 @@ with Codex() as codex:
     print(result.final_response)
 ```
 
-## 6) Public app-server types
+## 7) Public app-server types
 
 The convenience wrappers live at the package root. Public app-server value and
 event types live under:
@@ -104,7 +133,7 @@ event types live under:
 from openai_codex.types import ThreadReadResponse, Turn, TurnStatus
 ```
 
-## 7) Next stops
+## 8) Next stops
 
 - API surface and signatures: `docs/api-reference.md`
 - Common decisions/pitfalls: `docs/faq.md`
diff --git a/sdk/python/examples/02_turn_run/async.py b/sdk/python/examples/02_turn_run/async.py
index 0f6ef94f91..c4071cde47 100644
--- a/sdk/python/examples/02_turn_run/async.py
+++ b/sdk/python/examples/02_turn_run/async.py
@@ -5,18 +5,13 @@ _EXAMPLES_ROOT = Path(__file__).resolve().parents[1]
 if str(_EXAMPLES_ROOT) not in sys.path:
     sys.path.insert(0, str(_EXAMPLES_ROOT))
 
-from _bootstrap import (
-    assistant_text_from_turn,
-    ensure_local_sdk_src,
-    find_turn_by_id,
-    runtime_config,
-)
+from _bootstrap import ensure_local_sdk_src, runtime_config
 
 ensure_local_sdk_src()
 
 import asyncio
 
-from openai_codex import AsyncCodex, TextInput
+from openai_codex import AsyncCodex
 
 
 async def main() -> None:
@@ -24,21 +19,16 @@ async def main() -> None:
         thread = await codex.thread_start(
             model="gpt-5.4", config={"model_reasoning_effort": "high"}
         )
-        turn = await thread.turn(TextInput("Give 3 bullets about SIMD."))
+        turn = await thread.turn("Give 3 bullets about SIMD.")
         result = await turn.run()
-        persisted = await thread.read(include_turns=True)
-        persisted_turn = find_turn_by_id(persisted.thread.turns, result.id)
 
         print("thread_id:", thread.id)
         print("turn_id:", result.id)
         print("status:", result.status)
         if result.error is not None:
             print("error:", result.error)
-        print("text:", assistant_text_from_turn(persisted_turn))
-        print(
-            "persisted.items.count:",
-            0 if persisted_turn is None else len(persisted_turn.items or []),
-        )
+        print("text:", result.final_response)
+        print("items.count:", len(result.items))
 
 
 if __name__ == "__main__":
diff --git a/sdk/python/examples/02_turn_run/sync.py b/sdk/python/examples/02_turn_run/sync.py
index 18aa8c2f81..af22a220ba 100644
--- a/sdk/python/examples/02_turn_run/sync.py
+++ b/sdk/python/examples/02_turn_run/sync.py
@@ -5,30 +5,20 @@ _EXAMPLES_ROOT = Path(__file__).resolve().parents[1]
 if str(_EXAMPLES_ROOT) not in sys.path:
     sys.path.insert(0, str(_EXAMPLES_ROOT))
 
-from _bootstrap import (
-    assistant_text_from_turn,
-    ensure_local_sdk_src,
-    find_turn_by_id,
-    runtime_config,
-)
+from _bootstrap import ensure_local_sdk_src, runtime_config
 
 ensure_local_sdk_src()
 
-from openai_codex import Codex, TextInput
+from openai_codex import Codex
 
 with Codex(config=runtime_config()) as codex:
     thread = codex.thread_start(model="gpt-5.4", config={"model_reasoning_effort": "high"})
-    result = thread.turn(TextInput("Give 3 bullets about SIMD.")).run()
-    persisted = thread.read(include_turns=True)
-    persisted_turn = find_turn_by_id(persisted.thread.turns, result.id)
+    result = thread.turn("Give 3 bullets about SIMD.").run()
 
     print("thread_id:", thread.id)
     print("turn_id:", result.id)
     print("status:", result.status)
     if result.error is not None:
         print("error:", result.error)
-    print("text:", assistant_text_from_turn(persisted_turn))
-    print(
-        "persisted.items.count:",
-        0 if persisted_turn is None else len(persisted_turn.items or []),
-    )
+    print("text:", result.final_response)
+    print("items.count:", len(result.items))
diff --git a/sdk/python/examples/03_turn_stream_events/async.py b/sdk/python/examples/03_turn_stream_events/async.py
index dcf57af4f2..e145b2222b 100644
--- a/sdk/python/examples/03_turn_stream_events/async.py
+++ b/sdk/python/examples/03_turn_stream_events/async.py
@@ -5,18 +5,13 @@ _EXAMPLES_ROOT = Path(__file__).resolve().parents[1]
 if str(_EXAMPLES_ROOT) not in sys.path:
     sys.path.insert(0, str(_EXAMPLES_ROOT))
 
-from _bootstrap import (
-    assistant_text_from_turn,
-    ensure_local_sdk_src,
-    find_turn_by_id,
-    runtime_config,
-)
+from _bootstrap import ensure_local_sdk_src, runtime_config
 
 ensure_local_sdk_src()
 
 import asyncio
 
-from openai_codex import AsyncCodex, TextInput
+from openai_codex import AsyncCodex
 
 
 async def main() -> None:
@@ -24,12 +19,13 @@ async def main() -> None:
         thread = await codex.thread_start(
             model="gpt-5.4", config={"model_reasoning_effort": "high"}
         )
-        turn = await thread.turn(TextInput("Explain SIMD in 3 short bullets."))
+        turn = await thread.turn("Explain SIMD in 3 short bullets.")
 
         event_count = 0
         saw_started = False
         saw_delta = False
-        completed_status = "unknown"
+        completed_status = None
+        completed_texts = []
 
         async for event in turn.stream():
             event_count += 1
@@ -38,24 +34,27 @@ async def main() -> None:
                 print("stream.started")
                 continue
             if event.method == "item/agentMessage/delta":
-                delta = getattr(event.payload, "delta", "")
+                delta = event.payload.delta
                 if delta:
                     if not saw_delta:
                         print("assistant> ", end="", flush=True)
                     print(delta, end="", flush=True)
                     saw_delta = True
                 continue
+            if event.method == "item/completed":
+                root = event.payload.item.root
+                if root.type == "agentMessage":
+                    completed_texts.append(root.text)
+                continue
             if event.method == "turn/completed":
-                completed_status = getattr(
-                    event.payload.turn.status, "value", str(event.payload.turn.status)
-                )
+                completed_status = event.payload.turn.status.value
 
+        if completed_status is None:
+            raise RuntimeError("stream ended without turn/completed")
         if saw_delta:
             print()
         else:
-            persisted = await thread.read(include_turns=True)
-            persisted_turn = find_turn_by_id(persisted.thread.turns, turn.id)
-            final_text = assistant_text_from_turn(persisted_turn).strip() or "[no assistant text]"
+            final_text = "".join(completed_texts).strip()
             print("assistant>", final_text)
 
         print("stream.started.seen:", saw_started)
diff --git a/sdk/python/examples/03_turn_stream_events/sync.py b/sdk/python/examples/03_turn_stream_events/sync.py
index f96f5c6acd..f5a734dc38 100644
--- a/sdk/python/examples/03_turn_stream_events/sync.py
+++ b/sdk/python/examples/03_turn_stream_events/sync.py
@@ -5,25 +5,21 @@ _EXAMPLES_ROOT = Path(__file__).resolve().parents[1]
 if str(_EXAMPLES_ROOT) not in sys.path:
     sys.path.insert(0, str(_EXAMPLES_ROOT))
 
-from _bootstrap import (
-    assistant_text_from_turn,
-    ensure_local_sdk_src,
-    find_turn_by_id,
-    runtime_config,
-)
+from _bootstrap import ensure_local_sdk_src, runtime_config
 
 ensure_local_sdk_src()
 
-from openai_codex import Codex, TextInput
+from openai_codex import Codex
 
 with Codex(config=runtime_config()) as codex:
     thread = codex.thread_start(model="gpt-5.4", config={"model_reasoning_effort": "high"})
-    turn = thread.turn(TextInput("Explain SIMD in 3 short bullets."))
+    turn = thread.turn("Explain SIMD in 3 short bullets.")
 
     event_count = 0
     saw_started = False
     saw_delta = False
-    completed_status = "unknown"
+    completed_status = None
+    completed_texts = []
 
     for event in turn.stream():
         event_count += 1
@@ -32,24 +28,27 @@ with Codex(config=runtime_config()) as codex:
             print("stream.started")
             continue
         if event.method == "item/agentMessage/delta":
-            delta = getattr(event.payload, "delta", "")
+            delta = event.payload.delta
             if delta:
                 if not saw_delta:
                     print("assistant> ", end="", flush=True)
                 print(delta, end="", flush=True)
                 saw_delta = True
             continue
+        if event.method == "item/completed":
+            root = event.payload.item.root
+            if root.type == "agentMessage":
+                completed_texts.append(root.text)
+            continue
         if event.method == "turn/completed":
-            completed_status = getattr(
-                event.payload.turn.status, "value", str(event.payload.turn.status)
-            )
+            completed_status = event.payload.turn.status.value
 
+    if completed_status is None:
+        raise RuntimeError("stream ended without turn/completed")
     if saw_delta:
         print()
     else:
-        persisted = thread.read(include_turns=True)
-        persisted_turn = find_turn_by_id(persisted.thread.turns, turn.id)
-        final_text = assistant_text_from_turn(persisted_turn).strip() or "[no assistant text]"
+        final_text = "".join(completed_texts).strip()
         print("assistant>", final_text)
 
     print("stream.started.seen:", saw_started)
diff --git a/sdk/python/examples/04_models_and_metadata/async.py b/sdk/python/examples/04_models_and_metadata/async.py
index ba36e51a23..23ca58131f 100644
--- a/sdk/python/examples/04_models_and_metadata/async.py
+++ b/sdk/python/examples/04_models_and_metadata/async.py
@@ -19,7 +19,7 @@ async def main() -> None:
         print("server:", server_label(codex.metadata))
         models = await codex.models()
         print("models.count:", len(models.data))
-        print("models:", ", ".join(model.id for model in models.data[:5]) or "[none]")
+        print("models:", ", ".join(model.id for model in models.data[:5]))
 
 
 if __name__ == "__main__":
diff --git a/sdk/python/examples/04_models_and_metadata/sync.py b/sdk/python/examples/04_models_and_metadata/sync.py
index 849116941f..155e53571d 100644
--- a/sdk/python/examples/04_models_and_metadata/sync.py
+++ b/sdk/python/examples/04_models_and_metadata/sync.py
@@ -15,4 +15,4 @@ with Codex(config=runtime_config()) as codex:
     print("server:", server_label(codex.metadata))
     models = codex.models()
     print("models.count:", len(models.data))
-    print("models:", ", ".join(model.id for model in models.data[:5]) or "[none]")
+    print("models:", ", ".join(model.id for model in models.data[:5]))
diff --git a/sdk/python/examples/05_existing_thread/async.py b/sdk/python/examples/05_existing_thread/async.py
index 4dc36531d8..e1f4db7105 100644
--- a/sdk/python/examples/05_existing_thread/async.py
+++ b/sdk/python/examples/05_existing_thread/async.py
@@ -5,18 +5,13 @@ _EXAMPLES_ROOT = Path(__file__).resolve().parents[1]
 if str(_EXAMPLES_ROOT) not in sys.path:
     sys.path.insert(0, str(_EXAMPLES_ROOT))
 
-from _bootstrap import (
-    assistant_text_from_turn,
-    ensure_local_sdk_src,
-    find_turn_by_id,
-    runtime_config,
-)
+from _bootstrap import ensure_local_sdk_src, runtime_config
 
 ensure_local_sdk_src()
 
 import asyncio
 
-from openai_codex import AsyncCodex, TextInput
+from openai_codex import AsyncCodex
 
 
 async def main() -> None:
@@ -25,16 +20,14 @@ async def main() -> None:
             model="gpt-5.4", config={"model_reasoning_effort": "high"}
         )
 
-        first_turn = await original.turn(TextInput("Tell me one fact about Saturn."))
+        first_turn = await original.turn("Tell me one fact about Saturn.")
         _ = await first_turn.run()
         print("Created thread:", original.id)
 
         resumed = await codex.thread_resume(original.id)
-        second_turn = await resumed.turn(TextInput("Continue with one more fact."))
+        second_turn = await resumed.turn("Continue with one more fact.")
         second = await second_turn.run()
-        persisted = await resumed.read(include_turns=True)
-        persisted_turn = find_turn_by_id(persisted.thread.turns, second.id)
-        print(assistant_text_from_turn(persisted_turn))
+        print(second.final_response)
 
 
 if __name__ == "__main__":
diff --git a/sdk/python/examples/05_existing_thread/sync.py b/sdk/python/examples/05_existing_thread/sync.py
index ca441c4223..7110ebac7f 100644
--- a/sdk/python/examples/05_existing_thread/sync.py
+++ b/sdk/python/examples/05_existing_thread/sync.py
@@ -5,26 +5,19 @@ _EXAMPLES_ROOT = Path(__file__).resolve().parents[1]
 if str(_EXAMPLES_ROOT) not in sys.path:
     sys.path.insert(0, str(_EXAMPLES_ROOT))
 
-from _bootstrap import (
-    assistant_text_from_turn,
-    ensure_local_sdk_src,
-    find_turn_by_id,
-    runtime_config,
-)
+from _bootstrap import ensure_local_sdk_src, runtime_config
 
 ensure_local_sdk_src()
 
-from openai_codex import Codex, TextInput
+from openai_codex import Codex
 
 with Codex(config=runtime_config()) as codex:
     # Create an initial thread and turn so we have a real thread to resume.
     original = codex.thread_start(model="gpt-5.4", config={"model_reasoning_effort": "high"})
-    first = original.turn(TextInput("Tell me one fact about Saturn.")).run()
+    first = original.turn("Tell me one fact about Saturn.").run()
     print("Created thread:", original.id)
 
     # Resume the existing thread by ID.
     resumed = codex.thread_resume(original.id)
-    second = resumed.turn(TextInput("Continue with one more fact.")).run()
-    persisted = resumed.read(include_turns=True)
-    persisted_turn = find_turn_by_id(persisted.thread.turns, second.id)
-    print(assistant_text_from_turn(persisted_turn))
+    second = resumed.turn("Continue with one more fact.").run()
+    print(second.final_response)
diff --git a/sdk/python/examples/06_thread_lifecycle_and_controls/async.py b/sdk/python/examples/06_thread_lifecycle_and_controls/async.py
index ad73a896ee..7a786a1d79 100644
--- a/sdk/python/examples/06_thread_lifecycle_and_controls/async.py
+++ b/sdk/python/examples/06_thread_lifecycle_and_controls/async.py
@@ -11,7 +11,7 @@ ensure_local_sdk_src()
 
 import asyncio
 
-from openai_codex import AsyncCodex, TextInput
+from openai_codex import AsyncCodex
 
 
 async def main() -> None:
@@ -19,10 +19,8 @@ async def main() -> None:
         thread = await codex.thread_start(
             model="gpt-5.4", config={"model_reasoning_effort": "high"}
         )
-        first = await (
-            await thread.turn(TextInput("One sentence about structured planning."))
-        ).run()
-        second = await (await thread.turn(TextInput("Now restate it for a junior engineer."))).run()
+        first = await (await thread.turn("One sentence about structured planning.")).run()
+        second = await (await thread.turn("Now restate it for a junior engineer.")).run()
 
         reopened = await codex.thread_resume(thread.id)
         listing_active = await codex.thread_list(limit=20, archived=False)
@@ -33,45 +31,29 @@ async def main() -> None:
         listing_archived = await codex.thread_list(limit=20, archived=True)
         unarchived = await codex.thread_unarchive(reopened.id)
 
-        resumed_info = "n/a"
-        try:
-            resumed = await codex.thread_resume(
-                unarchived.id,
-                model="gpt-5.4",
-                config={"model_reasoning_effort": "high"},
-            )
-            resumed_result = await (
-                await resumed.turn(TextInput("Continue in one short sentence."))
-            ).run()
-            resumed_info = f"{resumed_result.id} {resumed_result.status}"
-        except Exception as exc:
-            resumed_info = f"skipped({type(exc).__name__})"
+        resumed = await codex.thread_resume(
+            unarchived.id,
+            model="gpt-5.4",
+            config={"model_reasoning_effort": "high"},
+        )
+        resumed_result = await (await resumed.turn("Continue in one short sentence.")).run()
 
-        forked_info = "n/a"
-        try:
-            forked = await codex.thread_fork(unarchived.id, model="gpt-5.4")
-            forked_result = await (
-                await forked.turn(TextInput("Take a different angle in one short sentence."))
-            ).run()
-            forked_info = f"{forked_result.id} {forked_result.status}"
-        except Exception as exc:
-            forked_info = f"skipped({type(exc).__name__})"
+        forked = await codex.thread_fork(unarchived.id, model="gpt-5.4")
+        forked_result = await (
+            await forked.turn("Take a different angle in one short sentence.")
+        ).run()
 
-        compact_info = "sent"
-        try:
-            _ = await unarchived.compact()
-        except Exception as exc:
-            compact_info = f"skipped({type(exc).__name__})"
+        compact_result = await unarchived.compact()
 
         print("Lifecycle OK:", thread.id)
         print("first:", first.id, first.status)
         print("second:", second.id, second.status)
-        print("read.turns:", len(reading.thread.turns or []))
+        print("read.turns:", len(reading.thread.turns))
         print("list.active:", len(listing_active.data))
         print("list.archived:", len(listing_archived.data))
-        print("resumed:", resumed_info)
-        print("forked:", forked_info)
-        print("compact:", compact_info)
+        print("resumed:", resumed_result.id, resumed_result.status)
+        print("forked:", forked_result.id, forked_result.status)
+        print("compact:", compact_result.model_dump(mode="json", by_alias=True))
 
 
 if __name__ == "__main__":
diff --git a/sdk/python/examples/06_thread_lifecycle_and_controls/sync.py b/sdk/python/examples/06_thread_lifecycle_and_controls/sync.py
index d01f165235..744b56ebb7 100644
--- a/sdk/python/examples/06_thread_lifecycle_and_controls/sync.py
+++ b/sdk/python/examples/06_thread_lifecycle_and_controls/sync.py
@@ -9,12 +9,12 @@ from _bootstrap import ensure_local_sdk_src, runtime_config
 
 ensure_local_sdk_src()
 
-from openai_codex import Codex, TextInput
+from openai_codex import Codex
 
 with Codex(config=runtime_config()) as codex:
     thread = codex.thread_start(model="gpt-5.4", config={"model_reasoning_effort": "high"})
-    first = thread.turn(TextInput("One sentence about structured planning.")).run()
-    second = thread.turn(TextInput("Now restate it for a junior engineer.")).run()
+    first = thread.turn("One sentence about structured planning.").run()
+    second = thread.turn("Now restate it for a junior engineer.").run()
 
     reopened = codex.thread_resume(thread.id)
     listing_active = codex.thread_list(limit=20, archived=False)
@@ -25,40 +25,24 @@ with Codex(config=runtime_config()) as codex:
     listing_archived = codex.thread_list(limit=20, archived=True)
     unarchived = codex.thread_unarchive(reopened.id)
 
-    resumed_info = "n/a"
-    try:
-        resumed = codex.thread_resume(
-            unarchived.id,
-            model="gpt-5.4",
-            config={"model_reasoning_effort": "high"},
-        )
-        resumed_result = resumed.turn(TextInput("Continue in one short sentence.")).run()
-        resumed_info = f"{resumed_result.id} {resumed_result.status}"
-    except Exception as exc:
-        resumed_info = f"skipped({type(exc).__name__})"
+    resumed = codex.thread_resume(
+        unarchived.id,
+        model="gpt-5.4",
+        config={"model_reasoning_effort": "high"},
+    )
+    resumed_result = resumed.turn("Continue in one short sentence.").run()
 
-    forked_info = "n/a"
-    try:
-        forked = codex.thread_fork(unarchived.id, model="gpt-5.4")
-        forked_result = forked.turn(
-            TextInput("Take a different angle in one short sentence.")
-        ).run()
-        forked_info = f"{forked_result.id} {forked_result.status}"
-    except Exception as exc:
-        forked_info = f"skipped({type(exc).__name__})"
+    forked = codex.thread_fork(unarchived.id, model="gpt-5.4")
+    forked_result = forked.turn("Take a different angle in one short sentence.").run()
 
-    compact_info = "sent"
-    try:
-        _ = unarchived.compact()
-    except Exception as exc:
-        compact_info = f"skipped({type(exc).__name__})"
+    compact_result = unarchived.compact()
 
     print("Lifecycle OK:", thread.id)
     print("first:", first.id, first.status)
     print("second:", second.id, second.status)
-    print("read.turns:", len(reading.thread.turns or []))
+    print("read.turns:", len(reading.thread.turns))
     print("list.active:", len(listing_active.data))
     print("list.archived:", len(listing_archived.data))
-    print("resumed:", resumed_info)
-    print("forked:", forked_info)
-    print("compact:", compact_info)
+    print("resumed:", resumed_result.id, resumed_result.status)
+    print("forked:", forked_result.id, forked_result.status)
+    print("compact:", compact_result.model_dump(mode="json", by_alias=True))
diff --git a/sdk/python/examples/07_image_and_text/async.py b/sdk/python/examples/07_image_and_text/async.py
index 41fe96a830..c3237e320e 100644
--- a/sdk/python/examples/07_image_and_text/async.py
+++ b/sdk/python/examples/07_image_and_text/async.py
@@ -5,12 +5,7 @@ _EXAMPLES_ROOT = Path(__file__).resolve().parents[1]
 if str(_EXAMPLES_ROOT) not in sys.path:
     sys.path.insert(0, str(_EXAMPLES_ROOT))
 
-from _bootstrap import (
-    assistant_text_from_turn,
-    ensure_local_sdk_src,
-    find_turn_by_id,
-    runtime_config,
-)
+from _bootstrap import ensure_local_sdk_src, runtime_config
 
 ensure_local_sdk_src()
 
@@ -33,11 +28,9 @@ async def main() -> None:
             ]
         )
         result = await turn.run()
-        persisted = await thread.read(include_turns=True)
-        persisted_turn = find_turn_by_id(persisted.thread.turns, result.id)
 
         print("Status:", result.status)
-        print(assistant_text_from_turn(persisted_turn))
+        print(result.final_response)
 
 
 if __name__ == "__main__":
diff --git a/sdk/python/examples/07_image_and_text/sync.py b/sdk/python/examples/07_image_and_text/sync.py
index ca82e7cfdc..f7402f18c9 100644
--- a/sdk/python/examples/07_image_and_text/sync.py
+++ b/sdk/python/examples/07_image_and_text/sync.py
@@ -5,12 +5,7 @@ _EXAMPLES_ROOT = Path(__file__).resolve().parents[1]
 if str(_EXAMPLES_ROOT) not in sys.path:
     sys.path.insert(0, str(_EXAMPLES_ROOT))
 
-from _bootstrap import (
-    assistant_text_from_turn,
-    ensure_local_sdk_src,
-    find_turn_by_id,
-    runtime_config,
-)
+from _bootstrap import ensure_local_sdk_src, runtime_config
 
 ensure_local_sdk_src()
 
@@ -26,8 +21,6 @@ with Codex(config=runtime_config()) as codex:
             ImageInput(REMOTE_IMAGE_URL),
         ]
     ).run()
-    persisted = thread.read(include_turns=True)
-    persisted_turn = find_turn_by_id(persisted.thread.turns, result.id)
 
     print("Status:", result.status)
-    print(assistant_text_from_turn(persisted_turn))
+    print(result.final_response)
diff --git a/sdk/python/examples/08_local_image_and_text/async.py b/sdk/python/examples/08_local_image_and_text/async.py
index c3abf4d2ee..292c0c3e3d 100644
--- a/sdk/python/examples/08_local_image_and_text/async.py
+++ b/sdk/python/examples/08_local_image_and_text/async.py
@@ -6,9 +6,7 @@ if str(_EXAMPLES_ROOT) not in sys.path:
     sys.path.insert(0, str(_EXAMPLES_ROOT))
 
 from _bootstrap import (
-    assistant_text_from_turn,
     ensure_local_sdk_src,
-    find_turn_by_id,
     runtime_config,
     temporary_sample_image_path,
 )
@@ -36,11 +34,9 @@ async def main() -> None:
                 ]
             )
             result = await turn.run()
-            persisted = await thread.read(include_turns=True)
-            persisted_turn = find_turn_by_id(persisted.thread.turns, result.id)
 
             print("Status:", result.status)
-            print(assistant_text_from_turn(persisted_turn))
+            print(result.final_response)
 
 
 if __name__ == "__main__":
diff --git a/sdk/python/examples/08_local_image_and_text/sync.py b/sdk/python/examples/08_local_image_and_text/sync.py
index 45c5161cb8..ee80a181ff 100644
--- a/sdk/python/examples/08_local_image_and_text/sync.py
+++ b/sdk/python/examples/08_local_image_and_text/sync.py
@@ -6,9 +6,7 @@ if str(_EXAMPLES_ROOT) not in sys.path:
     sys.path.insert(0, str(_EXAMPLES_ROOT))
 
 from _bootstrap import (
-    assistant_text_from_turn,
     ensure_local_sdk_src,
-    find_turn_by_id,
     runtime_config,
     temporary_sample_image_path,
 )
@@ -29,8 +27,6 @@ with temporary_sample_image_path() as image_path:
                 LocalImageInput(str(image_path.resolve())),
             ]
         ).run()
-        persisted = thread.read(include_turns=True)
-        persisted_turn = find_turn_by_id(persisted.thread.turns, result.id)
 
         print("Status:", result.status)
-        print(assistant_text_from_turn(persisted_turn))
+        print(result.final_response)
diff --git a/sdk/python/examples/09_async_parity/sync.py b/sdk/python/examples/09_async_parity/sync.py
index 018e588524..a7ac8abbd7 100644
--- a/sdk/python/examples/09_async_parity/sync.py
+++ b/sdk/python/examples/09_async_parity/sync.py
@@ -5,27 +5,19 @@ _EXAMPLES_ROOT = Path(__file__).resolve().parents[1]
 if str(_EXAMPLES_ROOT) not in sys.path:
     sys.path.insert(0, str(_EXAMPLES_ROOT))
 
-from _bootstrap import (
-    assistant_text_from_turn,
-    ensure_local_sdk_src,
-    find_turn_by_id,
-    runtime_config,
-    server_label,
-)
+from _bootstrap import ensure_local_sdk_src, runtime_config, server_label
 
 ensure_local_sdk_src()
 
-from openai_codex import Codex, TextInput
+from openai_codex import Codex
 
 with Codex(config=runtime_config()) as codex:
     print("Server:", server_label(codex.metadata))
 
     thread = codex.thread_start(model="gpt-5.4", config={"model_reasoning_effort": "high"})
-    turn = thread.turn(TextInput("Say hello in one sentence."))
+    turn = thread.turn("Say hello in one sentence.")
     result = turn.run()
-    persisted = thread.read(include_turns=True)
-    persisted_turn = find_turn_by_id(persisted.thread.turns, result.id)
 
     print("Thread:", thread.id)
     print("Turn:", result.id)
-    print("Text:", assistant_text_from_turn(persisted_turn).strip())
+    print("Text:", result.final_response.strip())
diff --git a/sdk/python/examples/10_error_handling_and_retry/async.py b/sdk/python/examples/10_error_handling_and_retry/async.py
index 65c95b2b63..71f954544f 100644
--- a/sdk/python/examples/10_error_handling_and_retry/async.py
+++ b/sdk/python/examples/10_error_handling_and_retry/async.py
@@ -5,12 +5,7 @@ _EXAMPLES_ROOT = Path(__file__).resolve().parents[1]
 if str(_EXAMPLES_ROOT) not in sys.path:
     sys.path.insert(0, str(_EXAMPLES_ROOT))
 
-from _bootstrap import (
-    assistant_text_from_turn,
-    ensure_local_sdk_src,
-    find_turn_by_id,
-    runtime_config,
-)
+from _bootstrap import ensure_local_sdk_src, runtime_config
 
 ensure_local_sdk_src()
 
@@ -23,7 +18,6 @@ from openai_codex import (
     AsyncCodex,
     JsonRpcError,
     ServerBusyError,
-    TextInput,
     is_retryable_error,
 )
 from openai_codex.types import TurnStatus
@@ -73,24 +67,21 @@ async def main() -> None:
             )
         except ServerBusyError as exc:
             print("Server overloaded after retries:", exc.message)
-            print("Text:")
             return
         except JsonRpcError as exc:
             print(f"JSON-RPC error {exc.code}: {exc.message}")
-            print("Text:")
             return
 
-        persisted = await thread.read(include_turns=True)
-        persisted_turn = find_turn_by_id(persisted.thread.turns, result.id)
         if result.status == TurnStatus.failed:
             print("Turn failed:", result.error)
+            return
 
-        print("Text:", assistant_text_from_turn(persisted_turn))
+        print("Text:", result.final_response)
 
 
 def _run_turn(thread, prompt: str):
     async def _inner():
-        turn = await thread.turn(TextInput(prompt))
+        turn = await thread.turn(prompt)
         return await turn.run()
 
     return _inner
diff --git a/sdk/python/examples/10_error_handling_and_retry/sync.py b/sdk/python/examples/10_error_handling_and_retry/sync.py
index 24ee243db3..9c0f9f30e5 100644
--- a/sdk/python/examples/10_error_handling_and_retry/sync.py
+++ b/sdk/python/examples/10_error_handling_and_retry/sync.py
@@ -5,12 +5,7 @@ _EXAMPLES_ROOT = Path(__file__).resolve().parents[1]
 if str(_EXAMPLES_ROOT) not in sys.path:
     sys.path.insert(0, str(_EXAMPLES_ROOT))
 
-from _bootstrap import (
-    assistant_text_from_turn,
-    ensure_local_sdk_src,
-    find_turn_by_id,
-    runtime_config,
-)
+from _bootstrap import ensure_local_sdk_src, runtime_config
 
 ensure_local_sdk_src()
 
@@ -18,7 +13,6 @@ from openai_codex import (
     Codex,
     JsonRpcError,
     ServerBusyError,
-    TextInput,
     retry_on_overload,
 )
 from openai_codex.types import TurnStatus
@@ -28,20 +22,17 @@ with Codex(config=runtime_config()) as codex:
 
     try:
         result = retry_on_overload(
-            lambda: thread.turn(TextInput("Summarize retry best practices in 3 bullets.")).run(),
+            lambda: thread.turn("Summarize retry best practices in 3 bullets.").run(),
             max_attempts=3,
             initial_delay_s=0.25,
             max_delay_s=2.0,
         )
     except ServerBusyError as exc:
         print("Server overloaded after retries:", exc.message)
-        print("Text:")
     except JsonRpcError as exc:
         print(f"JSON-RPC error {exc.code}: {exc.message}")
-        print("Text:")
     else:
-        persisted = thread.read(include_turns=True)
-        persisted_turn = find_turn_by_id(persisted.thread.turns, result.id)
         if result.status == TurnStatus.failed:
             print("Turn failed:", result.error)
-        print("Text:", assistant_text_from_turn(persisted_turn))
+        else:
+            print("Text:", result.final_response)
diff --git a/sdk/python/examples/11_cli_mini_app/async.py b/sdk/python/examples/11_cli_mini_app/async.py
index 1b0a2cfd3a..e2a695a924 100644
--- a/sdk/python/examples/11_cli_mini_app/async.py
+++ b/sdk/python/examples/11_cli_mini_app/async.py
@@ -13,7 +13,6 @@ import asyncio
 
 from openai_codex import (
     AsyncCodex,
-    TextInput,
 )
 from openai_codex.types import (
     ThreadTokenUsageUpdatedNotification,
@@ -21,19 +20,9 @@ from openai_codex.types import (
 )
 
 
-def _status_value(status: object | None) -> str:
-    return str(getattr(status, "value", status))
-
-
-def _format_usage(usage: object | None) -> str:
-    if usage is None:
-        return "usage> (none)"
-
-    last = getattr(usage, "last", None)
-    total = getattr(usage, "total", None)
-    if last is None or total is None:
-        return f"usage> {usage}"
-
+def _format_usage(usage: object) -> str:
+    last = usage.last
+    total = usage.total
     return (
         "usage>\n"
         f"  last: input={last.input_tokens} output={last.output_tokens} reasoning={last.reasoning_output_tokens} total={last.total_tokens} cached={last.cached_input_tokens}\n"
@@ -61,20 +50,18 @@ async def main() -> None:
             if user_input in {"/exit", "/quit"}:
                 break
 
-            turn = await thread.turn(TextInput(user_input))
+            turn = await thread.turn(user_input)
             usage = None
             status = None
             error = None
-            printed_delta = False
 
             print("assistant> ", end="", flush=True)
             async for event in turn.stream():
                 payload = event.payload
                 if event.method == "item/agentMessage/delta":
-                    delta = getattr(payload, "delta", "")
+                    delta = payload.delta
                     if delta:
                         print(delta, end="", flush=True)
-                        printed_delta = True
                     continue
                 if isinstance(payload, ThreadTokenUsageUpdatedNotification):
                     usage = payload.token_usage
@@ -83,12 +70,13 @@ async def main() -> None:
                     status = payload.turn.status
                     error = payload.turn.error
 
-            if printed_delta:
-                print()
-            else:
-                print("[no text]")
+            print()
+            if status is None:
+                raise RuntimeError("stream ended without turn/completed")
+            if usage is None:
+                raise RuntimeError("stream ended without token usage")
 
-            status_text = _status_value(status)
+            status_text = status.value
             print(f"assistant.status> {status_text}")
             if status_text == "failed":
                 print("assistant.error>", error)
diff --git a/sdk/python/examples/11_cli_mini_app/sync.py b/sdk/python/examples/11_cli_mini_app/sync.py
index dcb801d29c..0bf906647c 100644
--- a/sdk/python/examples/11_cli_mini_app/sync.py
+++ b/sdk/python/examples/11_cli_mini_app/sync.py
@@ -11,7 +11,6 @@ ensure_local_sdk_src()
 
 from openai_codex import (
     Codex,
-    TextInput,
 )
 from openai_codex.types import (
     ThreadTokenUsageUpdatedNotification,
@@ -21,19 +20,9 @@ from openai_codex.types import (
 print("Codex mini CLI. Type /exit to quit.")
 
 
-def _status_value(status: object | None) -> str:
-    return str(getattr(status, "value", status))
-
-
-def _format_usage(usage: object | None) -> str:
-    if usage is None:
-        return "usage> (none)"
-
-    last = getattr(usage, "last", None)
-    total = getattr(usage, "total", None)
-    if last is None or total is None:
-        return f"usage> {usage}"
-
+def _format_usage(usage: object) -> str:
+    last = usage.last
+    total = usage.total
     return (
         "usage>\n"
         f"  last: input={last.input_tokens} output={last.output_tokens} reasoning={last.reasoning_output_tokens} total={last.total_tokens} cached={last.cached_input_tokens}\n"
@@ -56,20 +45,18 @@ with Codex(config=runtime_config()) as codex:
         if user_input in {"/exit", "/quit"}:
             break
 
-        turn = thread.turn(TextInput(user_input))
+        turn = thread.turn(user_input)
         usage = None
         status = None
         error = None
-        printed_delta = False
 
         print("assistant> ", end="", flush=True)
         for event in turn.stream():
             payload = event.payload
             if event.method == "item/agentMessage/delta":
-                delta = getattr(payload, "delta", "")
+                delta = payload.delta
                 if delta:
                     print(delta, end="", flush=True)
-                    printed_delta = True
                 continue
             if isinstance(payload, ThreadTokenUsageUpdatedNotification):
                 usage = payload.token_usage
@@ -78,12 +65,13 @@ with Codex(config=runtime_config()) as codex:
                 status = payload.turn.status
                 error = payload.turn.error
 
-        if printed_delta:
-            print()
-        else:
-            print("[no text]")
+        print()
+        if status is None:
+            raise RuntimeError("stream ended without turn/completed")
+        if usage is None:
+            raise RuntimeError("stream ended without token usage")
 
-        status_text = _status_value(status)
+        status_text = status.value
         print(f"assistant.status> {status_text}")
         if status_text == "failed":
             print("assistant.error>", error)
diff --git a/sdk/python/examples/12_turn_params_kitchen_sink/async.py b/sdk/python/examples/12_turn_params_kitchen_sink/async.py
index 30b72f3173..f44ea229b0 100644
--- a/sdk/python/examples/12_turn_params_kitchen_sink/async.py
+++ b/sdk/python/examples/12_turn_params_kitchen_sink/async.py
@@ -6,12 +6,7 @@ _EXAMPLES_ROOT = Path(__file__).resolve().parents[1]
 if str(_EXAMPLES_ROOT) not in sys.path:
     sys.path.insert(0, str(_EXAMPLES_ROOT))
 
-from _bootstrap import (
-    assistant_text_from_turn,
-    ensure_local_sdk_src,
-    find_turn_by_id,
-    runtime_config,
-)
+from _bootstrap import ensure_local_sdk_src, runtime_config
 
 ensure_local_sdk_src()
 
@@ -19,7 +14,6 @@ import asyncio
 
 from openai_codex import (
     AsyncCodex,
-    TextInput,
 )
 from openai_codex.types import (
     Personality,
@@ -54,15 +48,13 @@ async def main() -> None:
         )
 
         turn = await thread.turn(
-            TextInput(PROMPT),
+            PROMPT,
             output_schema=OUTPUT_SCHEMA,
             personality=Personality.pragmatic,
             summary=SUMMARY,
         )
         result = await turn.run()
-        persisted = await thread.read(include_turns=True)
-        persisted_turn = find_turn_by_id(persisted.thread.turns, result.id)
-        structured_text = assistant_text_from_turn(persisted_turn).strip()
+        structured_text = result.final_response.strip()
         try:
             structured = json.loads(structured_text)
         except json.JSONDecodeError as exc:
@@ -70,8 +62,8 @@ async def main() -> None:
                 f"Expected JSON matching OUTPUT_SCHEMA, got: {structured_text!r}"
             ) from exc
 
-        summary = structured.get("summary")
-        actions = structured.get("actions")
+        summary = structured["summary"]
+        actions = structured["actions"]
         if (
             not isinstance(summary, str)
             or not isinstance(actions, list)
@@ -86,7 +78,7 @@ async def main() -> None:
         print("actions:")
         for action in actions:
             print("-", action)
-        print("Items:", 0 if persisted_turn is None else len(persisted_turn.items or []))
+        print("Items:", len(result.items))
 
 
 if __name__ == "__main__":
diff --git a/sdk/python/examples/12_turn_params_kitchen_sink/sync.py b/sdk/python/examples/12_turn_params_kitchen_sink/sync.py
index dffe74a915..160a9bf187 100644
--- a/sdk/python/examples/12_turn_params_kitchen_sink/sync.py
+++ b/sdk/python/examples/12_turn_params_kitchen_sink/sync.py
@@ -6,18 +6,12 @@ _EXAMPLES_ROOT = Path(__file__).resolve().parents[1]
 if str(_EXAMPLES_ROOT) not in sys.path:
     sys.path.insert(0, str(_EXAMPLES_ROOT))
 
-from _bootstrap import (
-    assistant_text_from_turn,
-    ensure_local_sdk_src,
-    find_turn_by_id,
-    runtime_config,
-)
+from _bootstrap import ensure_local_sdk_src, runtime_config
 
 ensure_local_sdk_src()
 
 from openai_codex import (
     Codex,
-    TextInput,
 )
 from openai_codex.types import (
     Personality,
@@ -48,15 +42,13 @@ with Codex(config=runtime_config()) as codex:
     thread = codex.thread_start(model="gpt-5.4", config={"model_reasoning_effort": "high"})
 
     turn = thread.turn(
-        TextInput(PROMPT),
+        PROMPT,
         output_schema=OUTPUT_SCHEMA,
         personality=Personality.pragmatic,
         summary=SUMMARY,
     )
     result = turn.run()
-    persisted = thread.read(include_turns=True)
-    persisted_turn = find_turn_by_id(persisted.thread.turns, result.id)
-    structured_text = assistant_text_from_turn(persisted_turn).strip()
+    structured_text = result.final_response.strip()
     try:
         structured = json.loads(structured_text)
     except json.JSONDecodeError as exc:
@@ -64,8 +56,8 @@ with Codex(config=runtime_config()) as codex:
             f"Expected JSON matching OUTPUT_SCHEMA, got: {structured_text!r}"
         ) from exc
 
-    summary = structured.get("summary")
-    actions = structured.get("actions")
+    summary = structured["summary"]
+    actions = structured["actions"]
     if (
         not isinstance(summary, str)
         or not isinstance(actions, list)
@@ -80,4 +72,4 @@ with Codex(config=runtime_config()) as codex:
     print("actions:")
     for action in actions:
         print("-", action)
-    print("Items:", 0 if persisted_turn is None else len(persisted_turn.items or []))
+    print("Items:", len(result.items))
diff --git a/sdk/python/examples/13_model_select_and_turn_params/async.py b/sdk/python/examples/13_model_select_and_turn_params/async.py
index f2810d8fd9..144169c46c 100644
--- a/sdk/python/examples/13_model_select_and_turn_params/async.py
+++ b/sdk/python/examples/13_model_select_and_turn_params/async.py
@@ -5,12 +5,7 @@ _EXAMPLES_ROOT = Path(__file__).resolve().parents[1]
 if str(_EXAMPLES_ROOT) not in sys.path:
     sys.path.insert(0, str(_EXAMPLES_ROOT))
 
-from _bootstrap import (
-    assistant_text_from_turn,
-    ensure_local_sdk_src,
-    find_turn_by_id,
-    runtime_config,
-)
+from _bootstrap import ensure_local_sdk_src, runtime_config
 
 ensure_local_sdk_src()
 
@@ -18,7 +13,6 @@ import asyncio
 
 from openai_codex import (
     AsyncCodex,
-    TextInput,
 )
 from openai_codex.types import (
     Personality,
@@ -35,29 +29,27 @@ REASONING_RANK = {
     "high": 4,
     "xhigh": 5,
 }
-PREFERRED_MODEL = "gpt-5.4"
 
 
 def _pick_highest_model(models):
-    visible = [m for m in models if not m.hidden] or models
-    preferred = next(
-        (m for m in visible if m.model == PREFERRED_MODEL or m.id == PREFERRED_MODEL), None
-    )
-    if preferred is not None:
-        return preferred
+    visible = [m for m in models if not m.hidden]
+    if not visible:
+        raise RuntimeError("models response did not include visible models")
+
     known_names = {m.id for m in visible} | {m.model for m in visible}
     top_candidates = [m for m in visible if not (m.upgrade and m.upgrade in known_names)]
-    pool = top_candidates or visible
-    return max(pool, key=lambda m: (m.model, m.id))
+    if not top_candidates:
+        raise RuntimeError("models response did not include top-level visible models")
+    return max(top_candidates, key=lambda m: (m.model, m.id))
 
 
 def _pick_highest_turn_effort(model) -> ReasoningEffort:
     if not model.supported_reasoning_efforts:
-        return ReasoningEffort.medium
+        raise RuntimeError(f"{model.model} did not advertise supported reasoning efforts")
 
     best = max(
         model.supported_reasoning_efforts,
-        key=lambda option: REASONING_RANK.get(option.reasoning_effort.value, -1),
+        key=lambda option: REASONING_RANK[option.reasoning_effort.value],
     )
     return ReasoningEffort(best.reasoning_effort.value)
 
@@ -98,21 +90,17 @@ async def main() -> None:
         )
 
         first_turn = await thread.turn(
-            TextInput("Give one short sentence about reliable production releases."),
+            "Give one short sentence about reliable production releases.",
             model=selected_model.model,
             effort=selected_effort,
         )
         first = await first_turn.run()
-        persisted = await thread.read(include_turns=True)
-        first_persisted_turn = find_turn_by_id(persisted.thread.turns, first.id)
 
-        print("agent.message:", assistant_text_from_turn(first_persisted_turn))
-        print(
-            "items:", 0 if first_persisted_turn is None else len(first_persisted_turn.items or [])
-        )
+        print("agent.message:", first.final_response)
+        print("items:", len(first.items))
 
         second_turn = await thread.turn(
-            TextInput("Return JSON for a safe feature-flag rollout plan."),
+            "Return JSON for a safe feature-flag rollout plan.",
             cwd=str(Path.cwd()),
             effort=selected_effort,
             model=selected_model.model,
@@ -122,14 +110,9 @@ async def main() -> None:
             summary=ReasoningSummary.model_validate("concise"),
         )
         second = await second_turn.run()
-        persisted = await thread.read(include_turns=True)
-        second_persisted_turn = find_turn_by_id(persisted.thread.turns, second.id)
 
-        print("agent.message.params:", assistant_text_from_turn(second_persisted_turn))
-        print(
-            "items.params:",
-            0 if second_persisted_turn is None else len(second_persisted_turn.items or []),
-        )
+        print("agent.message.params:", second.final_response)
+        print("items.params:", len(second.items))
 
 
 if __name__ == "__main__":
diff --git a/sdk/python/examples/13_model_select_and_turn_params/sync.py b/sdk/python/examples/13_model_select_and_turn_params/sync.py
index b1154ce171..962665363f 100644
--- a/sdk/python/examples/13_model_select_and_turn_params/sync.py
+++ b/sdk/python/examples/13_model_select_and_turn_params/sync.py
@@ -5,18 +5,12 @@ _EXAMPLES_ROOT = Path(__file__).resolve().parents[1]
 if str(_EXAMPLES_ROOT) not in sys.path:
     sys.path.insert(0, str(_EXAMPLES_ROOT))
 
-from _bootstrap import (
-    assistant_text_from_turn,
-    ensure_local_sdk_src,
-    find_turn_by_id,
-    runtime_config,
-)
+from _bootstrap import ensure_local_sdk_src, runtime_config
 
 ensure_local_sdk_src()
 
 from openai_codex import (
     Codex,
-    TextInput,
 )
 from openai_codex.types import (
     Personality,
@@ -33,29 +27,27 @@ REASONING_RANK = {
     "high": 4,
     "xhigh": 5,
 }
-PREFERRED_MODEL = "gpt-5.4"
 
 
 def _pick_highest_model(models):
-    visible = [m for m in models if not m.hidden] or models
-    preferred = next(
-        (m for m in visible if m.model == PREFERRED_MODEL or m.id == PREFERRED_MODEL), None
-    )
-    if preferred is not None:
-        return preferred
+    visible = [m for m in models if not m.hidden]
+    if not visible:
+        raise RuntimeError("models response did not include visible models")
+
     known_names = {m.id for m in visible} | {m.model for m in visible}
     top_candidates = [m for m in visible if not (m.upgrade and m.upgrade in known_names)]
-    pool = top_candidates or visible
-    return max(pool, key=lambda m: (m.model, m.id))
+    if not top_candidates:
+        raise RuntimeError("models response did not include top-level visible models")
+    return max(top_candidates, key=lambda m: (m.model, m.id))
 
 
 def _pick_highest_turn_effort(model) -> ReasoningEffort:
     if not model.supported_reasoning_efforts:
-        return ReasoningEffort.medium
+        raise RuntimeError(f"{model.model} did not advertise supported reasoning efforts")
 
     best = max(
         model.supported_reasoning_efforts,
-        key=lambda option: REASONING_RANK.get(option.reasoning_effort.value, -1),
+        key=lambda option: REASONING_RANK[option.reasoning_effort.value],
     )
     return ReasoningEffort(best.reasoning_effort.value)
 
@@ -95,18 +87,16 @@ with Codex(config=runtime_config()) as codex:
     )
 
     first = thread.turn(
-        TextInput("Give one short sentence about reliable production releases."),
+        "Give one short sentence about reliable production releases.",
         model=selected_model.model,
         effort=selected_effort,
     ).run()
-    persisted = thread.read(include_turns=True)
-    first_turn = find_turn_by_id(persisted.thread.turns, first.id)
 
-    print("agent.message:", assistant_text_from_turn(first_turn))
-    print("items:", 0 if first_turn is None else len(first_turn.items or []))
+    print("agent.message:", first.final_response)
+    print("items:", len(first.items))
 
     second = thread.turn(
-        TextInput("Return JSON for a safe feature-flag rollout plan."),
+        "Return JSON for a safe feature-flag rollout plan.",
         cwd=str(Path.cwd()),
         effort=selected_effort,
         model=selected_model.model,
@@ -115,8 +105,6 @@ with Codex(config=runtime_config()) as codex:
         sandbox_policy=SANDBOX_POLICY,
         summary=ReasoningSummary.model_validate("concise"),
     ).run()
-    persisted = thread.read(include_turns=True)
-    second_turn = find_turn_by_id(persisted.thread.turns, second.id)
 
-    print("agent.message.params:", assistant_text_from_turn(second_turn))
-    print("items.params:", 0 if second_turn is None else len(second_turn.items or []))
+    print("agent.message.params:", second.final_response)
+    print("items.params:", len(second.items))
diff --git a/sdk/python/examples/14_turn_controls/async.py b/sdk/python/examples/14_turn_controls/async.py
index 4f2777c2e4..86e8def04f 100644
--- a/sdk/python/examples/14_turn_controls/async.py
+++ b/sdk/python/examples/14_turn_controls/async.py
@@ -5,17 +5,13 @@ _EXAMPLES_ROOT = Path(__file__).resolve().parents[1]
 if str(_EXAMPLES_ROOT) not in sys.path:
     sys.path.insert(0, str(_EXAMPLES_ROOT))
 
-from _bootstrap import (
-    assistant_text_from_turn,
-    ensure_local_sdk_src,
-    runtime_config,
-)
+from _bootstrap import ensure_local_sdk_src, runtime_config
 
 ensure_local_sdk_src()
 
 import asyncio
 
-from openai_codex import AsyncCodex, TextInput
+from openai_codex import AsyncCodex
 
 
 async def main() -> None:
@@ -23,59 +19,49 @@ async def main() -> None:
         thread = await codex.thread_start(
             model="gpt-5.4", config={"model_reasoning_effort": "high"}
         )
-        steer_turn = await thread.turn(
-            TextInput("Count from 1 to 40 with commas, then one summary sentence.")
-        )
-        steer_result = "sent"
-        try:
-            _ = await steer_turn.steer(TextInput("Keep it brief and stop after 10 numbers."))
-        except Exception as exc:
-            steer_result = f"skipped {type(exc).__name__}"
+        steer_turn = await thread.turn("Count from 1 to 40 with commas, then one summary sentence.")
+        steer_result = await steer_turn.steer("Keep it brief and stop after 10 numbers.")
 
         steer_event_count = 0
-        steer_completed_status = "unknown"
-        steer_completed_turn = None
+        steer_completed_status = None
+        steer_deltas = []
         async for event in steer_turn.stream():
             steer_event_count += 1
+            if event.method == "item/agentMessage/delta":
+                steer_deltas.append(event.payload.delta)
+                continue
             if event.method == "turn/completed":
-                steer_completed_turn = event.payload.turn
-                steer_completed_status = getattr(
-                    event.payload.turn.status, "value", str(event.payload.turn.status)
-                )
+                steer_completed_status = event.payload.turn.status.value
 
-        steer_preview = (
-            assistant_text_from_turn(steer_completed_turn).strip() or "[no assistant text]"
-        )
+        if steer_completed_status is None:
+            raise RuntimeError("stream ended without turn/completed")
+        steer_preview = "".join(steer_deltas).strip()
 
         interrupt_turn = await thread.turn(
-            TextInput("Count from 1 to 200 with commas, then one summary sentence.")
+            "Count from 1 to 200 with commas, then one summary sentence."
         )
-        interrupt_result = "sent"
-        try:
-            _ = await interrupt_turn.interrupt()
-        except Exception as exc:
-            interrupt_result = f"skipped {type(exc).__name__}"
+        interrupt_result = await interrupt_turn.interrupt()
 
         interrupt_event_count = 0
-        interrupt_completed_status = "unknown"
-        interrupt_completed_turn = None
+        interrupt_completed_status = None
+        interrupt_deltas = []
         async for event in interrupt_turn.stream():
             interrupt_event_count += 1
+            if event.method == "item/agentMessage/delta":
+                interrupt_deltas.append(event.payload.delta)
+                continue
             if event.method == "turn/completed":
-                interrupt_completed_turn = event.payload.turn
-                interrupt_completed_status = getattr(
-                    event.payload.turn.status, "value", str(event.payload.turn.status)
-                )
+                interrupt_completed_status = event.payload.turn.status.value
 
-        interrupt_preview = (
-            assistant_text_from_turn(interrupt_completed_turn).strip() or "[no assistant text]"
-        )
+        if interrupt_completed_status is None:
+            raise RuntimeError("stream ended without turn/completed")
+        interrupt_preview = "".join(interrupt_deltas).strip()
 
-        print("steer.result:", steer_result)
+        print("steer.result:", steer_result.model_dump(mode="json", by_alias=True))
         print("steer.final.status:", steer_completed_status)
         print("steer.events.count:", steer_event_count)
         print("steer.assistant.preview:", steer_preview)
-        print("interrupt.result:", interrupt_result)
+        print("interrupt.result:", interrupt_result.model_dump(mode="json", by_alias=True))
         print("interrupt.final.status:", interrupt_completed_status)
         print("interrupt.events.count:", interrupt_event_count)
         print("interrupt.assistant.preview:", interrupt_preview)
diff --git a/sdk/python/examples/14_turn_controls/sync.py b/sdk/python/examples/14_turn_controls/sync.py
index 03180ba8eb..c8f1a75e28 100644
--- a/sdk/python/examples/14_turn_controls/sync.py
+++ b/sdk/python/examples/14_turn_controls/sync.py
@@ -5,69 +5,55 @@ _EXAMPLES_ROOT = Path(__file__).resolve().parents[1]
 if str(_EXAMPLES_ROOT) not in sys.path:
     sys.path.insert(0, str(_EXAMPLES_ROOT))
 
-from _bootstrap import (
-    assistant_text_from_turn,
-    ensure_local_sdk_src,
-    runtime_config,
-)
+from _bootstrap import ensure_local_sdk_src, runtime_config
 
 ensure_local_sdk_src()
 
-from openai_codex import Codex, TextInput
+from openai_codex import Codex
 
 with Codex(config=runtime_config()) as codex:
     thread = codex.thread_start(model="gpt-5.4", config={"model_reasoning_effort": "high"})
-    steer_turn = thread.turn(
-        TextInput("Count from 1 to 40 with commas, then one summary sentence.")
-    )
-    steer_result = "sent"
-    try:
-        _ = steer_turn.steer(TextInput("Keep it brief and stop after 10 numbers."))
-    except Exception as exc:
-        steer_result = f"skipped {type(exc).__name__}"
+    steer_turn = thread.turn("Count from 1 to 40 with commas, then one summary sentence.")
+    steer_result = steer_turn.steer("Keep it brief and stop after 10 numbers.")
 
     steer_event_count = 0
-    steer_completed_status = "unknown"
-    steer_completed_turn = None
+    steer_completed_status = None
+    steer_deltas = []
     for event in steer_turn.stream():
         steer_event_count += 1
+        if event.method == "item/agentMessage/delta":
+            steer_deltas.append(event.payload.delta)
+            continue
         if event.method == "turn/completed":
-            steer_completed_turn = event.payload.turn
-            steer_completed_status = getattr(
-                event.payload.turn.status, "value", str(event.payload.turn.status)
-            )
+            steer_completed_status = event.payload.turn.status.value
 
-    steer_preview = assistant_text_from_turn(steer_completed_turn).strip() or "[no assistant text]"
+    if steer_completed_status is None:
+        raise RuntimeError("stream ended without turn/completed")
+    steer_preview = "".join(steer_deltas).strip()
 
-    interrupt_turn = thread.turn(
-        TextInput("Count from 1 to 200 with commas, then one summary sentence.")
-    )
-    interrupt_result = "sent"
-    try:
-        _ = interrupt_turn.interrupt()
-    except Exception as exc:
-        interrupt_result = f"skipped {type(exc).__name__}"
+    interrupt_turn = thread.turn("Count from 1 to 200 with commas, then one summary sentence.")
+    interrupt_result = interrupt_turn.interrupt()
 
     interrupt_event_count = 0
-    interrupt_completed_status = "unknown"
-    interrupt_completed_turn = None
+    interrupt_completed_status = None
+    interrupt_deltas = []
     for event in interrupt_turn.stream():
         interrupt_event_count += 1
+        if event.method == "item/agentMessage/delta":
+            interrupt_deltas.append(event.payload.delta)
+            continue
         if event.method == "turn/completed":
-            interrupt_completed_turn = event.payload.turn
-            interrupt_completed_status = getattr(
-                event.payload.turn.status, "value", str(event.payload.turn.status)
-            )
+            interrupt_completed_status = event.payload.turn.status.value
 
-    interrupt_preview = (
-        assistant_text_from_turn(interrupt_completed_turn).strip() or "[no assistant text]"
-    )
+    if interrupt_completed_status is None:
+        raise RuntimeError("stream ended without turn/completed")
+    interrupt_preview = "".join(interrupt_deltas).strip()
 
-    print("steer.result:", steer_result)
+    print("steer.result:", steer_result.model_dump(mode="json", by_alias=True))
     print("steer.final.status:", steer_completed_status)
     print("steer.events.count:", steer_event_count)
     print("steer.assistant.preview:", steer_preview)
-    print("interrupt.result:", interrupt_result)
+    print("interrupt.result:", interrupt_result.model_dump(mode="json", by_alias=True))
     print("interrupt.final.status:", interrupt_completed_status)
     print("interrupt.events.count:", interrupt_event_count)
     print("interrupt.assistant.preview:", interrupt_preview)
diff --git a/sdk/python/examples/15_login_and_account/async.py b/sdk/python/examples/15_login_and_account/async.py
new file mode 100644
index 0000000000..7de6c2afa5
--- /dev/null
+++ b/sdk/python/examples/15_login_and_account/async.py
@@ -0,0 +1,34 @@
+import sys
+from pathlib import Path
+
+_EXAMPLES_ROOT = Path(__file__).resolve().parents[1]
+if str(_EXAMPLES_ROOT) not in sys.path:
+    sys.path.insert(0, str(_EXAMPLES_ROOT))
+
+from _bootstrap import ensure_local_sdk_src, runtime_config
+
+ensure_local_sdk_src()
+
+import asyncio
+
+from openai_codex import AsyncCodex
+
+
+async def main() -> None:
+    async with AsyncCodex(config=runtime_config()) as codex:
+        # Browser login returns a live handle. Open `auth_url` and await `wait()`
+        # in a real app; this example cancels immediately so it stays non-blocking.
+        login = await codex.login_chatgpt()
+        canceled = await login.cancel()
+        completed = await login.wait()
+        account = await codex.account()
+
+        print("login.id:", login.login_id)
+        print("login.auth_url:", login.auth_url)
+        print("login.cancel.status:", canceled.status)
+        print("login.completed.success:", completed.success)
+        print("account.requires_openai_auth:", account.requires_openai_auth)
+
+
+if __name__ == "__main__":
+    asyncio.run(main())
diff --git a/sdk/python/examples/15_login_and_account/sync.py b/sdk/python/examples/15_login_and_account/sync.py
new file mode 100644
index 0000000000..ed20531186
--- /dev/null
+++ b/sdk/python/examples/15_login_and_account/sync.py
@@ -0,0 +1,26 @@
+import sys
+from pathlib import Path
+
+_EXAMPLES_ROOT = Path(__file__).resolve().parents[1]
+if str(_EXAMPLES_ROOT) not in sys.path:
+    sys.path.insert(0, str(_EXAMPLES_ROOT))
+
+from _bootstrap import ensure_local_sdk_src, runtime_config
+
+ensure_local_sdk_src()
+
+from openai_codex import Codex
+
+with Codex(config=runtime_config()) as codex:
+    # Browser login returns a live handle. Open `auth_url` and call `wait()`
+    # in a real app; this example cancels immediately so it stays non-blocking.
+    login = codex.login_chatgpt()
+    canceled = login.cancel()
+    completed = login.wait()
+    account = codex.account()
+
+    print("login.id:", login.login_id)
+    print("login.auth_url:", login.auth_url)
+    print("login.cancel.status:", canceled.status)
+    print("login.completed.success:", completed.success)
+    print("account.requires_openai_auth:", account.requires_openai_auth)
diff --git a/sdk/python/examples/README.md b/sdk/python/examples/README.md
index fe5b630898..eef3893721 100644
--- a/sdk/python/examples/README.md
+++ b/sdk/python/examples/README.md
@@ -8,6 +8,9 @@ Each example folder contains runnable versions:
 All examples intentionally use only public SDK exports from `openai_codex`
 and `openai_codex.types`.
 
+Examples use plain strings for text-only turns and typed input objects for
+multimodal or structured input lists.
+
 ## Prerequisites
 
 - Python `>=3.10`
@@ -81,4 +84,6 @@ python examples/01_quickstart_constructor/async.py
 - `13_model_select_and_turn_params/`
   - list models, pick highest model + highest supported reasoning effort, run turns, print message and usage
 - `14_turn_controls/`
-  - separate best-effort `steer()` and `interrupt()` demos with concise summaries
+  - separate `steer()` and `interrupt()` demos with concise summaries
+- `15_login_and_account/`
+  - browser-login handle lifecycle, cancellation, and account inspection
diff --git a/sdk/python/examples/_bootstrap.py b/sdk/python/examples/_bootstrap.py
index af115119ac..92fe18e26a 100644
--- a/sdk/python/examples/_bootstrap.py
+++ b/sdk/python/examples/_bootstrap.py
@@ -6,7 +6,7 @@ import sys
 import tempfile
 import zlib
 from pathlib import Path
-from typing import Iterable, Iterator
+from typing import Any, Iterator
 
 _SDK_PYTHON_DIR = Path(__file__).resolve().parents[1]
 _SDK_PYTHON_STR = str(_SDK_PYTHON_DIR)
@@ -103,53 +103,5 @@ def temporary_sample_image_path() -> Iterator[Path]:
         yield image_path
 
 
-def server_label(metadata: object) -> str:
-    server = getattr(metadata, "serverInfo", None)
-    server_name = ((getattr(server, "name", None) or "") if server is not None else "").strip()
-    server_version = (
-        (getattr(server, "version", None) or "") if server is not None else ""
-    ).strip()
-    if server_name and server_version:
-        return f"{server_name} {server_version}"
-
-    user_agent = (
-        (getattr(metadata, "userAgent", None) or "") if metadata is not None else ""
-    ).strip()
-    return user_agent or "unknown"
-
-
-def find_turn_by_id(turns: Iterable[object] | None, turn_id: str) -> object | None:
-    for turn in turns or []:
-        if getattr(turn, "id", None) == turn_id:
-            return turn
-    return None
-
-
-def assistant_text_from_turn(turn: object | None) -> str:
-    if turn is None:
-        return ""
-
-    chunks: list[str] = []
-    for item in getattr(turn, "items", []) or []:
-        raw_item = item.model_dump(mode="json") if hasattr(item, "model_dump") else item
-        if not isinstance(raw_item, dict):
-            continue
-
-        item_type = raw_item.get("type")
-        if item_type == "agentMessage":
-            text = raw_item.get("text")
-            if isinstance(text, str) and text:
-                chunks.append(text)
-            continue
-
-        if item_type != "message" or raw_item.get("role") != "assistant":
-            continue
-
-        for content in raw_item.get("content") or []:
-            if not isinstance(content, dict) or content.get("type") != "output_text":
-                continue
-            text = content.get("text")
-            if isinstance(text, str) and text:
-                chunks.append(text)
-
-    return "".join(chunks)
+def server_label(metadata: Any) -> str:
+    return f"{metadata.serverInfo.name} {metadata.serverInfo.version}"
diff --git a/sdk/python/notebooks/sdk_walkthrough.ipynb b/sdk/python/notebooks/sdk_walkthrough.ipynb
index 62480fe18a..bd313a02b1 100644
--- a/sdk/python/notebooks/sdk_walkthrough.ipynb
+++ b/sdk/python/notebooks/sdk_walkthrough.ipynb
@@ -12,6 +12,7 @@
   {
    "cell_type": "code",
    "execution_count": null,
+   "id": "1b6614a5",
    "metadata": {},
    "outputs": [],
    "source": [
@@ -25,23 +26,10 @@
     "        f'Notebook requires Python 3.10+; current interpreter is {sys.version.split()[0]}.'\n",
     "    )\n",
     "\n",
-    "try:\n",
-    "    _ = os.getcwd()\n",
-    "except FileNotFoundError:\n",
-    "    os.chdir(str(Path.home()))\n",
-    "\n",
-    "\n",
     "def _is_sdk_python_dir(path: Path) -> bool:\n",
     "    return (path / 'pyproject.toml').exists() and (path / 'src' / 'openai_codex').exists()\n",
     "\n",
     "\n",
-    "def _iter_home_fallback_candidates(home: Path):\n",
-    "    # bounded depth scan under home to support launching notebooks from unrelated cwd values\n",
-    "    patterns = ('sdk/python', '*/sdk/python', '*/*/sdk/python', '*/*/*/sdk/python')\n",
-    "    for pattern in patterns:\n",
-    "        yield from home.glob(pattern)\n",
-    "\n",
-    "\n",
     "def _find_sdk_python_dir(start: Path) -> Path | None:\n",
     "    checked = set()\n",
     "\n",
@@ -70,21 +58,6 @@
     "        if found is not None:\n",
     "            return found\n",
     "\n",
-    "    for entry in sys.path:\n",
-    "        if not entry:\n",
-    "            continue\n",
-    "        entry_path = Path(entry).expanduser()\n",
-    "        for candidate in (entry_path, entry_path / 'sdk' / 'python'):\n",
-    "            found = _consider(candidate)\n",
-    "            if found is not None:\n",
-    "                return found\n",
-    "\n",
-    "    home = Path.home()\n",
-    "    for candidate in _iter_home_fallback_candidates(home):\n",
-    "        found = _consider(candidate)\n",
-    "        if found is not None:\n",
-    "            return found\n",
-    "\n",
     "    return None\n",
     "\n",
     "\n",
@@ -125,11 +98,12 @@
   {
    "cell_type": "code",
    "execution_count": null,
+   "id": "137a6d64",
    "metadata": {},
    "outputs": [],
    "source": [
     "# Cell 2: imports (public only)\n",
-    "from _bootstrap import assistant_text_from_turn, find_turn_by_id, server_label\n",
+    "from _bootstrap import server_label\n",
     "from openai_codex import (\n",
     "    AsyncCodex,\n",
     "    Codex,\n",
@@ -143,53 +117,67 @@
   {
    "cell_type": "code",
    "execution_count": null,
+   "id": "5fae892d",
+   "metadata": {},
+   "outputs": [],
+   "source": [
+    "# Cell 2b: browser login handle lifecycle\n",
+    "with Codex() as codex:\n",
+    "    # Open this URL and call `wait()` without canceling when completing login for real.\n",
+    "    login = codex.login_chatgpt()\n",
+    "    print('Please complete login at:', login.auth_url)\n",
+    "    completed = login.wait()\n",
+    "    account = codex.account()\n",
+    "\n",
+    "    print('login.id:', login.login_id)\n",
+    "    print('login.auth_url:', login.auth_url)\n",
+    "    print('login.completed.success:', completed.success)\n",
+    "    print('account:', account.email)\n"
+   ]
+  },
+  {
+   "cell_type": "code",
+   "execution_count": null,
+   "id": "ebdc04d9",
    "metadata": {},
    "outputs": [],
    "source": [
     "# Cell 3: simple sync conversation\n",
     "with Codex() as codex:\n",
     "    thread = codex.thread_start(model='gpt-5.4', config={'model_reasoning_effort': 'high'})\n",
-    "    turn = thread.turn(TextInput('Explain gradient descent in 3 bullets.'))\n",
-    "    result = turn.run()\n",
-    "    persisted = thread.read(include_turns=True)\n",
-    "    persisted_turn = find_turn_by_id(persisted.thread.turns, result.id)\n",
-    "\n",
-    "    print('server:', server_label(codex.metadata))\n",
-    "    print('status:', result.status)\n",
-    "    print(assistant_text_from_turn(persisted_turn))\n"
+    "    result = thread.run('Explain gradient descent in 3 bullets.')\n",
+    "    print(result.final_response)\n"
    ]
   },
   {
    "cell_type": "code",
    "execution_count": null,
+   "id": "bb4abb96",
    "metadata": {},
    "outputs": [],
    "source": [
     "# Cell 4: multi-turn continuity in same thread\n",
     "with Codex() as codex:\n",
     "    thread = codex.thread_start(model='gpt-5.4', config={'model_reasoning_effort': 'high'})\n",
-    "\n",
-    "    first = thread.turn(TextInput('Give a short summary of transformers.')).run()\n",
-    "    second = thread.turn(TextInput('Now explain that to a high-school student.')).run()\n",
-    "    persisted = thread.read(include_turns=True)\n",
-    "    second_turn = find_turn_by_id(persisted.thread.turns, second.id)\n",
-    "\n",
+    "    first = thread.turn('Give a short summary of transformers.').run()\n",
+    "    second = thread.turn('Now explain that to a high-school student.').run()\n",
     "    print('first status:', first.status)\n",
     "    print('second status:', second.status)\n",
-    "    print('second text:', assistant_text_from_turn(second_turn))\n"
+    "    print('second text:', second.final_response)\n"
    ]
   },
   {
    "cell_type": "code",
    "execution_count": null,
+   "id": "8b0c80fd",
    "metadata": {},
    "outputs": [],
    "source": [
     "# Cell 5: full thread lifecycle and branching (sync)\n",
     "with Codex() as codex:\n",
     "    thread = codex.thread_start(model='gpt-5.4', config={'model_reasoning_effort': 'high'})\n",
-    "    first = thread.turn(TextInput('One sentence about structured planning.')).run()\n",
-    "    second = thread.turn(TextInput('Now restate it for a junior engineer.')).run()\n",
+    "    first = thread.turn('One sentence about structured planning.').run()\n",
+    "    second = thread.turn('Now restate it for a junior engineer.').run()\n",
     "\n",
     "    reopened = codex.thread_resume(thread.id)\n",
     "    listing_active = codex.thread_list(limit=20, archived=False)\n",
@@ -200,46 +188,33 @@
     "    listing_archived = codex.thread_list(limit=20, archived=True)\n",
     "    unarchived = codex.thread_unarchive(reopened.id)\n",
     "\n",
-    "    resumed_info = 'n/a'\n",
-    "    try:\n",
-    "        resumed = codex.thread_resume(\n",
-    "            unarchived.id,\n",
-    "            model='gpt-5.4',\n",
-    "            config={'model_reasoning_effort': 'high'},\n",
-    "        )\n",
-    "        resumed_result = resumed.turn(TextInput('Continue in one short sentence.')).run()\n",
-    "        resumed_info = f'{resumed_result.id} {resumed_result.status}'\n",
-    "    except Exception as e:\n",
-    "        resumed_info = f'skipped({type(e).__name__})'\n",
+    "    resumed = codex.thread_resume(\n",
+    "        unarchived.id,\n",
+    "        model='gpt-5.4',\n",
+    "        config={'model_reasoning_effort': 'high'},\n",
+    "    )\n",
+    "    resumed_result = resumed.turn('Continue in one short sentence.').run()\n",
     "\n",
-    "    forked_info = 'n/a'\n",
-    "    try:\n",
-    "        forked = codex.thread_fork(unarchived.id, model='gpt-5.4')\n",
-    "        forked_result = forked.turn(TextInput('Take a different angle in one short sentence.')).run()\n",
-    "        forked_info = f'{forked_result.id} {forked_result.status}'\n",
-    "    except Exception as e:\n",
-    "        forked_info = f'skipped({type(e).__name__})'\n",
+    "    forked = codex.thread_fork(unarchived.id, model='gpt-5.4')\n",
+    "    forked_result = forked.turn('Take a different angle in one short sentence.').run()\n",
     "\n",
-    "    compact_info = 'sent'\n",
-    "    try:\n",
-    "        _ = unarchived.compact()\n",
-    "    except Exception as e:\n",
-    "        compact_info = f'skipped({type(e).__name__})'\n",
+    "    compact_result = unarchived.compact()\n",
     "\n",
     "    print('Lifecycle OK:', thread.id)\n",
     "    print('first:', first.id, first.status)\n",
     "    print('second:', second.id, second.status)\n",
-    "    print('read.turns:', len(reading.thread.turns or []))\n",
+    "    print('read.turns:', len(reading.thread.turns))\n",
     "    print('list.active:', len(listing_active.data))\n",
     "    print('list.archived:', len(listing_archived.data))\n",
-    "    print('resumed:', resumed_info)\n",
-    "    print('forked:', forked_info)\n",
-    "    print('compact:', compact_info)\n"
+    "    print('resumed:', resumed_result.id, resumed_result.status)\n",
+    "    print('forked:', forked_result.id, forked_result.status)\n",
+    "    print('compact:', compact_result.model_dump(mode='json', by_alias=True))\n"
    ]
   },
   {
    "cell_type": "code",
    "execution_count": null,
+   "id": "310db8c0",
    "metadata": {},
    "outputs": [],
    "source": [
@@ -268,7 +243,7 @@
     "with Codex() as codex:\n",
     "    thread = codex.thread_start(model='gpt-5.4', config={'model_reasoning_effort': 'high'})\n",
     "    turn = thread.turn(\n",
-    "        TextInput('Propose a safe production feature-flag rollout. Return JSON matching the schema.'),\n",
+    "        'Propose a safe production feature-flag rollout. Return JSON matching the schema.',\n",
     "        cwd=str(Path.cwd()),\n",
     "        effort=ReasoningEffort.medium,\n",
     "        model='gpt-5.4',\n",
@@ -278,16 +253,14 @@
     "        summary=summary,\n",
     "    )\n",
     "    result = turn.run()\n",
-    "    persisted = thread.read(include_turns=True)\n",
-    "    persisted_turn = find_turn_by_id(persisted.thread.turns, result.id)\n",
-    "\n",
     "    print('status:', result.status)\n",
-    "    print(assistant_text_from_turn(persisted_turn))\n"
+    "    print(result.final_response)\n"
    ]
   },
   {
    "cell_type": "code",
    "execution_count": null,
+   "id": "7a33c97d",
    "metadata": {},
    "outputs": [],
    "source": [
@@ -311,17 +284,20 @@
     "\n",
     "\n",
     "def pick_highest_model(models):\n",
-    "    visible = [m for m in models if not m.hidden] or models\n",
+    "    visible = [m for m in models if not m.hidden]\n",
+    "    if not visible:\n",
+    "        raise RuntimeError('models response did not include visible models')\n",
     "    known_names = {m.id for m in visible} | {m.model for m in visible}\n",
     "    top_candidates = [m for m in visible if not (m.upgrade and m.upgrade in known_names)]\n",
-    "    pool = top_candidates or visible\n",
-    "    return max(pool, key=lambda m: (m.model, m.id))\n",
+    "    if not top_candidates:\n",
+    "        raise RuntimeError('models response did not include top-level visible models')\n",
+    "    return max(top_candidates, key=lambda m: (m.model, m.id))\n",
     "\n",
     "\n",
     "def pick_highest_turn_effort(model) -> ReasoningEffort:\n",
     "    if not model.supported_reasoning_efforts:\n",
-    "        return ReasoningEffort.medium\n",
-    "    best = max(model.supported_reasoning_efforts, key=lambda opt: reasoning_rank.get(opt.reasoning_effort.value, -1))\n",
+    "        raise RuntimeError(f'{model.model} did not advertise supported reasoning efforts')\n",
+    "    best = max(model.supported_reasoning_efforts, key=lambda opt: reasoning_rank[opt.reasoning_effort.value])\n",
     "    return ReasoningEffort(best.reasoning_effort.value)\n",
     "\n",
     "\n",
@@ -347,17 +323,15 @@
     "    thread = codex.thread_start(model=selected_model.model, config={'model_reasoning_effort': selected_effort.value})\n",
     "\n",
     "    first = thread.turn(\n",
-    "        TextInput('Give one short sentence about reliable production releases.'),\n",
+    "        'Give one short sentence about reliable production releases.',\n",
     "        model=selected_model.model,\n",
     "        effort=selected_effort,\n",
     "    ).run()\n",
-    "    persisted = thread.read(include_turns=True)\n",
-    "    first_turn = find_turn_by_id(persisted.thread.turns, first.id)\n",
-    "    print('agent.message:', assistant_text_from_turn(first_turn))\n",
-    "    print('items:', 0 if first_turn is None else len(first_turn.items or []))\n",
+    "    print('agent.message:', first.final_response)\n",
+    "    print('items:', len(first.items))\n",
     "\n",
     "    second = thread.turn(\n",
-    "        TextInput('Return JSON for a safe feature-flag rollout plan.'),\n",
+    "        'Return JSON for a safe feature-flag rollout plan.',\n",
     "        cwd=str(Path.cwd()),\n",
     "        effort=selected_effort,\n",
     "        model=selected_model.model,\n",
@@ -366,15 +340,14 @@
     "        sandbox_policy=sandbox_policy,\n",
     "        summary=ReasoningSummary.model_validate('concise'),\n",
     "    ).run()\n",
-    "    persisted = thread.read(include_turns=True)\n",
-    "    second_turn = find_turn_by_id(persisted.thread.turns, second.id)\n",
-    "    print('agent.message.params:', assistant_text_from_turn(second_turn))\n",
-    "    print('items.params:', 0 if second_turn is None else len(second_turn.items or []))\n"
+    "    print('agent.message.params:', second.final_response)\n",
+    "    print('items.params:', len(second.items))\n"
    ]
   },
   {
    "cell_type": "code",
    "execution_count": null,
+   "id": "e9aef26a",
    "metadata": {},
    "outputs": [],
    "source": [
@@ -387,16 +360,14 @@
     "        TextInput('What do you see in this image? 3 bullets.'),\n",
     "        ImageInput(remote_image_url),\n",
     "    ]).run()\n",
-    "    persisted = thread.read(include_turns=True)\n",
-    "    persisted_turn = find_turn_by_id(persisted.thread.turns, result.id)\n",
-    "\n",
     "    print('status:', result.status)\n",
-    "    print(assistant_text_from_turn(persisted_turn))\n"
+    "    print(result.final_response)\n"
    ]
   },
   {
    "cell_type": "code",
    "execution_count": null,
+   "id": "a0cecc6c",
    "metadata": {},
    "outputs": [],
    "source": [
@@ -408,16 +379,14 @@
     "            TextInput('Describe the colors and layout in this generated local image in 2 bullets.'),\n",
     "            LocalImageInput(str(local_image_path.resolve())),\n",
     "        ]).run()\n",
-    "        persisted = thread.read(include_turns=True)\n",
-    "        persisted_turn = find_turn_by_id(persisted.thread.turns, result.id)\n",
-    "\n",
     "        print('status:', result.status)\n",
-    "        print(assistant_text_from_turn(persisted_turn))\n"
+    "        print(result.final_response)\n"
    ]
   },
   {
    "cell_type": "code",
    "execution_count": null,
+   "id": "91afa2b8",
    "metadata": {},
    "outputs": [],
    "source": [
@@ -426,21 +395,19 @@
     "    thread = codex.thread_start(model='gpt-5.4', config={'model_reasoning_effort': 'high'})\n",
     "\n",
     "    result = retry_on_overload(\n",
-    "        lambda: thread.turn(TextInput('List 5 failure modes in distributed systems.')).run(),\n",
+    "        lambda: thread.turn('List 5 failure modes in distributed systems.').run(),\n",
     "        max_attempts=3,\n",
     "        initial_delay_s=0.25,\n",
     "        max_delay_s=2.0,\n",
     "    )\n",
-    "    persisted = thread.read(include_turns=True)\n",
-    "    persisted_turn = find_turn_by_id(persisted.thread.turns, result.id)\n",
-    "\n",
     "    print('status:', result.status)\n",
-    "    print(assistant_text_from_turn(persisted_turn))\n"
+    "    print(result.final_response)\n"
    ]
   },
   {
    "cell_type": "code",
    "execution_count": null,
+   "id": "103be934",
    "metadata": {},
    "outputs": [],
    "source": [
@@ -451,8 +418,8 @@
     "async def async_lifecycle_demo():\n",
     "    async with AsyncCodex() as codex:\n",
     "        thread = await codex.thread_start(model='gpt-5.4', config={'model_reasoning_effort': 'high'})\n",
-    "        first = await (await thread.turn(TextInput('One sentence about structured planning.'))).run()\n",
-    "        second = await (await thread.turn(TextInput('Now restate it for a junior engineer.'))).run()\n",
+    "        first = await (await thread.turn('One sentence about structured planning.')).run()\n",
+    "        second = await (await thread.turn('Now restate it for a junior engineer.')).run()\n",
     "\n",
     "        reopened = await codex.thread_resume(thread.id)\n",
     "        listing_active = await codex.thread_list(limit=20, archived=False)\n",
@@ -463,41 +430,27 @@
     "        listing_archived = await codex.thread_list(limit=20, archived=True)\n",
     "        unarchived = await codex.thread_unarchive(reopened.id)\n",
     "\n",
-    "        resumed_info = 'n/a'\n",
-    "        try:\n",
-    "            resumed = await codex.thread_resume(\n",
-    "                unarchived.id,\n",
-    "                model='gpt-5.4',\n",
-    "                config={'model_reasoning_effort': 'high'},\n",
-    "            )\n",
-    "            resumed_result = await (await resumed.turn(TextInput('Continue in one short sentence.'))).run()\n",
-    "            resumed_info = f'{resumed_result.id} {resumed_result.status}'\n",
-    "        except Exception as e:\n",
-    "            resumed_info = f'skipped({type(e).__name__})'\n",
+    "        resumed = await codex.thread_resume(\n",
+    "            unarchived.id,\n",
+    "            model='gpt-5.4',\n",
+    "            config={'model_reasoning_effort': 'high'},\n",
+    "        )\n",
+    "        resumed_result = await (await resumed.turn('Continue in one short sentence.')).run()\n",
     "\n",
-    "        forked_info = 'n/a'\n",
-    "        try:\n",
-    "            forked = await codex.thread_fork(unarchived.id, model='gpt-5.4')\n",
-    "            forked_result = await (await forked.turn(TextInput('Take a different angle in one short sentence.'))).run()\n",
-    "            forked_info = f'{forked_result.id} {forked_result.status}'\n",
-    "        except Exception as e:\n",
-    "            forked_info = f'skipped({type(e).__name__})'\n",
+    "        forked = await codex.thread_fork(unarchived.id, model='gpt-5.4')\n",
+    "        forked_result = await (await forked.turn('Take a different angle in one short sentence.')).run()\n",
     "\n",
-    "        compact_info = 'sent'\n",
-    "        try:\n",
-    "            _ = await unarchived.compact()\n",
-    "        except Exception as e:\n",
-    "            compact_info = f'skipped({type(e).__name__})'\n",
+    "        compact_result = await unarchived.compact()\n",
     "\n",
     "        print('Lifecycle OK:', thread.id)\n",
     "        print('first:', first.id, first.status)\n",
     "        print('second:', second.id, second.status)\n",
-    "        print('read.turns:', len(reading.thread.turns or []))\n",
+    "        print('read.turns:', len(reading.thread.turns))\n",
     "        print('list.active:', len(listing_active.data))\n",
     "        print('list.archived:', len(listing_archived.data))\n",
-    "        print('resumed:', resumed_info)\n",
-    "        print('forked:', forked_info)\n",
-    "        print('compact:', compact_info)\n",
+    "        print('resumed:', resumed_result.id, resumed_result.status)\n",
+    "        print('forked:', forked_result.id, forked_result.status)\n",
+    "        print('compact:', compact_result.model_dump(mode='json', by_alias=True))\n",
     "\n",
     "\n",
     "await async_lifecycle_demo()\n"
@@ -506,58 +459,59 @@
   {
    "cell_type": "code",
    "execution_count": null,
+   "id": "365aa10c",
    "metadata": {},
    "outputs": [],
    "source": [
-    "# Cell 10: async turn controls (best effort steer + interrupt)\n",
+    "# Cell 10: async turn controls (steer + interrupt)\n",
     "import asyncio\n",
     "\n",
     "\n",
     "async def async_stream_demo():\n",
     "    async with AsyncCodex() as codex:\n",
     "        thread = await codex.thread_start(model='gpt-5.4', config={'model_reasoning_effort': 'high'})\n",
-    "        steer_turn = await thread.turn(TextInput('Count from 1 to 40 with commas, then one summary sentence.'))\n",
+    "        steer_turn = await thread.turn('Count from 1 to 40 with commas, then one summary sentence.')\n",
     "\n",
-    "        steer_result = 'sent'\n",
-    "        try:\n",
-    "            _ = await steer_turn.steer(TextInput('Keep it brief and stop after 10 numbers.'))\n",
-    "        except Exception as e:\n",
-    "            steer_result = f'skipped {type(e).__name__}'\n",
+    "        steer_result = await steer_turn.steer('Keep it brief and stop after 10 numbers.')\n",
     "\n",
     "        steer_event_count = 0\n",
-    "        steer_completed_status = 'unknown'\n",
-    "        steer_completed_turn = None\n",
+    "        steer_completed_status = None\n",
+    "        steer_deltas = []\n",
     "        async for event in steer_turn.stream():\n",
     "            steer_event_count += 1\n",
+    "            if event.method == 'item/agentMessage/delta':\n",
+    "                steer_deltas.append(event.payload.delta)\n",
+    "                continue\n",
     "            if event.method == 'turn/completed':\n",
-    "                steer_completed_turn = event.payload.turn\n",
-    "                steer_completed_status = getattr(event.payload.turn.status, 'value', str(event.payload.turn.status))\n",
+    "                steer_completed_status = event.payload.turn.status.value\n",
     "\n",
-    "        steer_preview = assistant_text_from_turn(steer_completed_turn).strip() or '[no assistant text]'\n",
+    "        if steer_completed_status is None:\n",
+    "            raise RuntimeError('stream ended without turn/completed')\n",
+    "        steer_preview = ''.join(steer_deltas).strip()\n",
     "\n",
-    "        interrupt_turn = await thread.turn(TextInput('Count from 1 to 200 with commas, then one summary sentence.'))\n",
-    "        interrupt_result = 'sent'\n",
-    "        try:\n",
-    "            _ = await interrupt_turn.interrupt()\n",
-    "        except Exception as e:\n",
-    "            interrupt_result = f'skipped {type(e).__name__}'\n",
+    "        interrupt_turn = await thread.turn('Count from 1 to 200 with commas, then one summary sentence.')\n",
+    "        interrupt_result = await interrupt_turn.interrupt()\n",
     "\n",
     "        interrupt_event_count = 0\n",
-    "        interrupt_completed_status = 'unknown'\n",
-    "        interrupt_completed_turn = None\n",
+    "        interrupt_completed_status = None\n",
+    "        interrupt_deltas = []\n",
     "        async for event in interrupt_turn.stream():\n",
     "            interrupt_event_count += 1\n",
+    "            if event.method == 'item/agentMessage/delta':\n",
+    "                interrupt_deltas.append(event.payload.delta)\n",
+    "                continue\n",
     "            if event.method == 'turn/completed':\n",
-    "                interrupt_completed_turn = event.payload.turn\n",
-    "                interrupt_completed_status = getattr(event.payload.turn.status, 'value', str(event.payload.turn.status))\n",
+    "                interrupt_completed_status = event.payload.turn.status.value\n",
     "\n",
-    "        interrupt_preview = assistant_text_from_turn(interrupt_completed_turn).strip() or '[no assistant text]'\n",
+    "        if interrupt_completed_status is None:\n",
+    "            raise RuntimeError('stream ended without turn/completed')\n",
+    "        interrupt_preview = ''.join(interrupt_deltas).strip()\n",
     "\n",
-    "        print('steer.result:', steer_result)\n",
+    "        print('steer.result:', steer_result.model_dump(mode='json', by_alias=True))\n",
     "        print('steer.final.status:', steer_completed_status)\n",
     "        print('steer.events.count:', steer_event_count)\n",
     "        print('steer.assistant.preview:', steer_preview)\n",
-    "        print('interrupt.result:', interrupt_result)\n",
+    "        print('interrupt.result:', interrupt_result.model_dump(mode='json', by_alias=True))\n",
     "        print('interrupt.final.status:', interrupt_completed_status)\n",
     "        print('interrupt.events.count:', interrupt_event_count)\n",
     "        print('interrupt.assistant.preview:', interrupt_preview)\n",
@@ -569,13 +523,21 @@
  ],
  "metadata": {
   "kernelspec": {
-   "display_name": "Python 3",
+   "display_name": ".venv",
    "language": "python",
    "name": "python3"
   },
   "language_info": {
+   "codemirror_mode": {
+    "name": "ipython",
+    "version": 3
+   },
+   "file_extension": ".py",
+   "mimetype": "text/x-python",
    "name": "python",
-   "version": "3.10+"
+   "nbconvert_exporter": "python",
+   "pygments_lexer": "ipython3",
+   "version": "3.14.3"
   }
  },
  "nbformat": 4,
diff --git a/sdk/python/scripts/update_sdk_artifacts.py b/sdk/python/scripts/update_sdk_artifacts.py
index a40a4aa9c3..5cad14cf5e 100755
--- a/sdk/python/scripts/update_sdk_artifacts.py
+++ b/sdk/python/scripts/update_sdk_artifacts.py
@@ -1040,12 +1040,12 @@ def _render_thread_block(
     lines = [
         "    def turn(",
         "        self,",
-        "        input: Input,",
+        "        input: RunInput,",
         "        *,",
         *_approval_mode_override_signature_lines(),
         *_kw_signature_lines(turn_fields),
         "    ) -> TurnHandle:",
-        "        wire_input = _to_wire_input(input)",
+        "        wire_input = _to_wire_input(_normalize_run_input(input))",
         _approval_mode_assignment_line("_approval_mode_override_settings"),
         "        params = TurnStartParams(",
         "            thread_id=self.id,",
@@ -1065,13 +1065,13 @@ def _render_async_thread_block(
     lines = [
         "    async def turn(",
         "        self,",
-        "        input: Input,",
+        "        input: RunInput,",
         "        *,",
         *_approval_mode_override_signature_lines(),
         *_kw_signature_lines(turn_fields),
         "    ) -> AsyncTurnHandle:",
         "        await self._codex._ensure_initialized()",
-        "        wire_input = _to_wire_input(input)",
+        "        wire_input = _to_wire_input(_normalize_run_input(input))",
         _approval_mode_assignment_line("_approval_mode_override_settings"),
         "        params = TurnStartParams(",
         "            thread_id=self.id,",
diff --git a/sdk/python/src/openai_codex/__init__.py b/sdk/python/src/openai_codex/__init__.py
index 4a68fabbef..3bc018a769 100644
--- a/sdk/python/src/openai_codex/__init__.py
+++ b/sdk/python/src/openai_codex/__init__.py
@@ -1,20 +1,25 @@
 from ._version import __version__
 from .api import (
     ApprovalMode,
+    AsyncChatgptLoginHandle,
     AsyncCodex,
+    AsyncDeviceCodeLoginHandle,
     AsyncThread,
     AsyncTurnHandle,
+    ChatgptLoginHandle,
     Codex,
+    DeviceCodeLoginHandle,
     ImageInput,
     Input,
     InputItem,
     LocalImageInput,
     MentionInput,
-    RunResult,
+    RunInput,
     SkillInput,
     TextInput,
     Thread,
     TurnHandle,
+    TurnResult,
 )
 from .client import AppServerConfig
 from .errors import (
@@ -39,13 +44,18 @@ __all__ = [
     "Codex",
     "AsyncCodex",
     "ApprovalMode",
+    "ChatgptLoginHandle",
+    "DeviceCodeLoginHandle",
+    "AsyncChatgptLoginHandle",
+    "AsyncDeviceCodeLoginHandle",
     "Thread",
     "AsyncThread",
     "TurnHandle",
     "AsyncTurnHandle",
-    "RunResult",
+    "TurnResult",
     "Input",
     "InputItem",
+    "RunInput",
     "TextInput",
     "ImageInput",
     "LocalImageInput",
diff --git a/sdk/python/src/openai_codex/_approval_mode.py b/sdk/python/src/openai_codex/_approval_mode.py
new file mode 100644
index 0000000000..bbb57030c0
--- /dev/null
+++ b/sdk/python/src/openai_codex/_approval_mode.py
@@ -0,0 +1,51 @@
+from __future__ import annotations
+
+from enum import Enum
+from typing import NoReturn
+
+from .generated.v2_all import (
+    ApprovalsReviewer,
+    AskForApproval,
+    AskForApprovalValue,
+)
+
+
+class ApprovalMode(str, Enum):
+    """High-level approval behavior for escalated permission requests."""
+
+    deny_all = "deny_all"
+    auto_review = "auto_review"
+
+
+def _approval_mode_settings(
+    approval_mode: ApprovalMode,
+) -> tuple[AskForApproval, ApprovalsReviewer | None]:
+    """Map the public approval mode to generated app-server start params."""
+    if not isinstance(approval_mode, ApprovalMode):
+        supported = ", ".join(mode.value for mode in ApprovalMode)
+        raise ValueError(f"approval_mode must be one of: {supported}")
+
+    match approval_mode:
+        case ApprovalMode.auto_review:
+            return (
+                AskForApproval(root=AskForApprovalValue.on_request),
+                ApprovalsReviewer.auto_review,
+            )
+        case ApprovalMode.deny_all:
+            return AskForApproval(root=AskForApprovalValue.never), None
+        case _:
+            return _assert_never_approval_mode(approval_mode)
+
+
+def _assert_never_approval_mode(approval_mode: NoReturn) -> NoReturn:
+    """Make approval mode mapping exhaustive for static type checkers."""
+    raise AssertionError(f"Unhandled approval mode: {approval_mode!r}")
+
+
+def _approval_mode_override_settings(
+    approval_mode: ApprovalMode | None,
+) -> tuple[AskForApproval | None, ApprovalsReviewer | None]:
+    """Map an optional public approval mode to app-server override params."""
+    if approval_mode is None:
+        return None, None
+    return _approval_mode_settings(approval_mode)
diff --git a/sdk/python/src/openai_codex/_initialize_metadata.py b/sdk/python/src/openai_codex/_initialize_metadata.py
new file mode 100644
index 0000000000..48e5922c46
--- /dev/null
+++ b/sdk/python/src/openai_codex/_initialize_metadata.py
@@ -0,0 +1,54 @@
+from __future__ import annotations
+
+from .models import InitializeResponse, ServerInfo
+
+
+def _split_user_agent(user_agent: str) -> tuple[str | None, str | None]:
+    raw = user_agent.strip()
+    if not raw:
+        return None, None
+    if "/" in raw:
+        name, version = raw.split("/", 1)
+        return (name or None), (version or None)
+    parts = raw.split(maxsplit=1)
+    if len(parts) == 2:
+        return parts[0], parts[1]
+    return raw, None
+
+
+def validate_initialize_metadata(payload: InitializeResponse) -> InitializeResponse:
+    user_agent = (payload.userAgent or "").strip()
+    server = payload.serverInfo
+
+    server_name: str | None = None
+    server_version: str | None = None
+
+    if server is not None:
+        server_name = (server.name or "").strip() or None
+        server_version = (server.version or "").strip() or None
+
+    if (server_name is None or server_version is None) and user_agent:
+        parsed_name, parsed_version = _split_user_agent(user_agent)
+        if server_name is None:
+            server_name = parsed_name
+        if server_version is None:
+            server_version = parsed_version
+
+    normalized_server_name = (server_name or "").strip()
+    normalized_server_version = (server_version or "").strip()
+    if not user_agent or not normalized_server_name or not normalized_server_version:
+        raise RuntimeError(
+            "initialize response missing required metadata "
+            f"(user_agent={user_agent!r}, server_name={normalized_server_name!r}, server_version={normalized_server_version!r})"
+        )
+
+    if server is None:
+        payload.serverInfo = ServerInfo(
+            name=normalized_server_name,
+            version=normalized_server_version,
+        )
+    else:
+        server.name = normalized_server_name
+        server.version = normalized_server_version
+
+    return payload
diff --git a/sdk/python/src/openai_codex/_login.py b/sdk/python/src/openai_codex/_login.py
new file mode 100644
index 0000000000..cdfdda41da
--- /dev/null
+++ b/sdk/python/src/openai_codex/_login.py
@@ -0,0 +1,172 @@
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Protocol
+
+from .async_client import AsyncAppServerClient
+from .client import AppServerClient
+from .generated.v2_all import (
+    AccountLoginCompletedNotification,
+    CancelLoginAccountResponse,
+    ChatgptDeviceCodeLoginAccountParams,
+    ChatgptDeviceCodeLoginAccountResponse,
+    ChatgptLoginAccountParams,
+    ChatgptLoginAccountResponse,
+    LoginAccountParams,
+)
+
+
+class _AsyncLoginOwner(Protocol):
+    """Subset of AsyncCodex needed by async login handles."""
+
+    _client: AsyncAppServerClient
+
+    async def _ensure_initialized(self) -> None:
+        """Ensure the owning SDK client has a live app-server connection."""
+        ...
+
+
+def start_chatgpt_login(client: AppServerClient) -> ChatgptLoginHandle:
+    """Start browser ChatGPT login and return the handle for that attempt."""
+    response = client.account_login_start(
+        LoginAccountParams(
+            root=ChatgptLoginAccountParams(type="chatgpt"),
+        )
+    )
+    response_root = response.root
+    if not isinstance(response_root, ChatgptLoginAccountResponse):
+        raise RuntimeError(f"unexpected ChatGPT login response: {response_root!r}")
+    return ChatgptLoginHandle(
+        client,
+        response_root.login_id,
+        response_root.auth_url,
+    )
+
+
+async def async_start_chatgpt_login(owner: _AsyncLoginOwner) -> AsyncChatgptLoginHandle:
+    """Start async browser ChatGPT login and return that attempt's handle."""
+    response = await owner._client.account_login_start(
+        LoginAccountParams(
+            root=ChatgptLoginAccountParams(type="chatgpt"),
+        )
+    )
+    response_root = response.root
+    if not isinstance(response_root, ChatgptLoginAccountResponse):
+        raise RuntimeError(f"unexpected ChatGPT login response: {response_root!r}")
+    return AsyncChatgptLoginHandle(
+        owner,
+        response_root.login_id,
+        response_root.auth_url,
+    )
+
+
+def start_device_code_login(client: AppServerClient) -> DeviceCodeLoginHandle:
+    """Start device-code ChatGPT login and return the handle for that attempt."""
+    response = client.account_login_start(
+        LoginAccountParams(
+            root=ChatgptDeviceCodeLoginAccountParams(type="chatgptDeviceCode"),
+        )
+    )
+    response_root = response.root
+    if not isinstance(response_root, ChatgptDeviceCodeLoginAccountResponse):
+        raise RuntimeError(f"unexpected device-code login response: {response_root!r}")
+    return DeviceCodeLoginHandle(
+        client,
+        response_root.login_id,
+        response_root.verification_url,
+        response_root.user_code,
+    )
+
+
+async def async_start_device_code_login(
+    owner: _AsyncLoginOwner,
+) -> AsyncDeviceCodeLoginHandle:
+    """Start async device-code ChatGPT login and return that attempt's handle."""
+    response = await owner._client.account_login_start(
+        LoginAccountParams(
+            root=ChatgptDeviceCodeLoginAccountParams(type="chatgptDeviceCode"),
+        )
+    )
+    response_root = response.root
+    if not isinstance(response_root, ChatgptDeviceCodeLoginAccountResponse):
+        raise RuntimeError(f"unexpected device-code login response: {response_root!r}")
+    return AsyncDeviceCodeLoginHandle(
+        owner,
+        response_root.login_id,
+        response_root.verification_url,
+        response_root.user_code,
+    )
+
+
+@dataclass(slots=True)
+class ChatgptLoginHandle:
+    """Live browser-login attempt returned by `Codex.login_chatgpt()`."""
+
+    _client: AppServerClient
+    login_id: str
+    auth_url: str
+
+    def wait(self) -> AccountLoginCompletedNotification:
+        """Wait for this browser login attempt's completion notification."""
+        return self._client.wait_for_login_completed(self.login_id)
+
+    def cancel(self) -> CancelLoginAccountResponse:
+        """Cancel this browser login attempt."""
+        return self._client.account_login_cancel(self.login_id)
+
+
+@dataclass(slots=True)
+class DeviceCodeLoginHandle:
+    """Live device-code login attempt returned by `Codex.login_chatgpt_device_code()`."""
+
+    _client: AppServerClient
+    login_id: str
+    verification_url: str
+    user_code: str
+
+    def wait(self) -> AccountLoginCompletedNotification:
+        """Wait for this device-code login attempt's completion notification."""
+        return self._client.wait_for_login_completed(self.login_id)
+
+    def cancel(self) -> CancelLoginAccountResponse:
+        """Cancel this device-code login attempt."""
+        return self._client.account_login_cancel(self.login_id)
+
+
+@dataclass(slots=True)
+class AsyncChatgptLoginHandle:
+    """Live browser-login attempt returned by `AsyncCodex.login_chatgpt()`."""
+
+    _codex: _AsyncLoginOwner
+    login_id: str
+    auth_url: str
+
+    async def wait(self) -> AccountLoginCompletedNotification:
+        """Wait for this browser login attempt's completion notification."""
+        await self._codex._ensure_initialized()
+        return await self._codex._client.wait_for_login_completed(self.login_id)
+
+    async def cancel(self) -> CancelLoginAccountResponse:
+        """Cancel this browser login attempt."""
+        await self._codex._ensure_initialized()
+        return await self._codex._client.account_login_cancel(self.login_id)
+
+
+@dataclass(slots=True)
+class AsyncDeviceCodeLoginHandle:
+    """Live device-code attempt returned by `AsyncCodex.login_chatgpt_device_code()`."""
+
+    _codex: _AsyncLoginOwner
+    login_id: str
+    verification_url: str
+    user_code: str
+
+    async def wait(self) -> AccountLoginCompletedNotification:
+        """Wait for this device-code login attempt's completion notification."""
+        await self._codex._ensure_initialized()
+        return await self._codex._client.wait_for_login_completed(self.login_id)
+
+    async def cancel(self) -> CancelLoginAccountResponse:
+        """Cancel this device-code login attempt."""
+        await self._codex._ensure_initialized()
+        return await self._codex._client.account_login_cancel(self.login_id)
diff --git a/sdk/python/src/openai_codex/_message_router.py b/sdk/python/src/openai_codex/_message_router.py
index 7d4554bb8a..14a01336a4 100644
--- a/sdk/python/src/openai_codex/_message_router.py
+++ b/sdk/python/src/openai_codex/_message_router.py
@@ -6,6 +6,7 @@ from collections import deque
 
 from .errors import AppServerError, map_jsonrpc_error
 from .generated.notification_registry import notification_turn_id
+from .generated.v2_all import AccountLoginCompletedNotification
 from .models import JsonValue, Notification, UnknownNotification
 
 ResponseQueueItem = JsonValue | BaseException
@@ -25,6 +26,8 @@ class MessageRouter:
         """Create empty response, turn, and global notification queues."""
         self._lock = threading.Lock()
         self._response_waiters: dict[str, queue.Queue[ResponseQueueItem]] = {}
+        self._login_notifications: dict[str, queue.Queue[NotificationQueueItem]] = {}
+        self._pending_login_notifications: dict[str, deque[Notification]] = {}
         self._turn_notifications: dict[str, queue.Queue[NotificationQueueItem]] = {}
         self._pending_turn_notifications: dict[str, deque[Notification]] = {}
         self._global_notifications: queue.Queue[NotificationQueueItem] = queue.Queue()
@@ -51,6 +54,36 @@ class MessageRouter:
             raise item
         return item
 
+    def register_login(self, login_id: str) -> None:
+        """Register a queue for one interactive login attempt."""
+
+        login_queue: queue.Queue[NotificationQueueItem] = queue.Queue()
+        with self._lock:
+            if login_id in self._login_notifications:
+                return
+            pending = self._pending_login_notifications.pop(login_id, deque())
+            self._login_notifications[login_id] = login_queue
+        for notification in pending:
+            login_queue.put(notification)
+
+    def unregister_login(self, login_id: str) -> None:
+        """Stop routing future notifications for one login attempt."""
+
+        with self._lock:
+            self._login_notifications.pop(login_id, None)
+
+    def next_login_notification(self, login_id: str) -> Notification:
+        """Block until the next notification for a registered login attempt."""
+
+        with self._lock:
+            login_queue = self._login_notifications.get(login_id)
+        if login_queue is None:
+            raise RuntimeError(f"login {login_id!r} is not registered for waiting")
+        item = login_queue.get()
+        if isinstance(item, BaseException):
+            raise item
+        return item
+
     def register_turn(self, turn_id: str) -> None:
         """Register a queue for a turn stream and replay early events."""
 
@@ -111,6 +144,18 @@ class MessageRouter:
     def route_notification(self, notification: Notification) -> None:
         """Deliver a notification to a turn queue or the global queue."""
 
+        login_id = self._notification_login_id(notification)
+        if login_id is not None:
+            with self._lock:
+                login_queue = self._login_notifications.get(login_id)
+                if login_queue is None:
+                    self._pending_login_notifications.setdefault(login_id, deque()).append(
+                        notification
+                    )
+                    return
+            login_queue.put(notification)
+            return
+
         turn_id = self._notification_turn_id(notification)
         if turn_id is None:
             self._global_notifications.put(notification)
@@ -132,16 +177,35 @@ class MessageRouter:
         with self._lock:
             response_waiters = list(self._response_waiters.values())
             self._response_waiters.clear()
+            login_queues = list(self._login_notifications.values())
+            self._login_notifications.clear()
+            self._pending_login_notifications.clear()
             turn_queues = list(self._turn_notifications.values())
             self._pending_turn_notifications.clear()
         # Put the same transport failure into every queue so no SDK call blocks
         # forever waiting for a response that cannot arrive.
         for waiter in response_waiters:
             waiter.put(exc)
+        for login_queue in login_queues:
+            login_queue.put(exc)
         for turn_queue in turn_queues:
             turn_queue.put(exc)
         self._global_notifications.put(exc)
 
+    def _notification_login_id(self, notification: Notification) -> str | None:
+        """Extract the login attempt id from completion notifications."""
+        if notification.method != "account/login/completed":
+            return None
+
+        payload = notification.payload
+        if isinstance(payload, AccountLoginCompletedNotification):
+            return payload.login_id
+        if isinstance(payload, UnknownNotification):
+            raw_login_id = payload.params.get("loginId")
+            if isinstance(raw_login_id, str):
+                return raw_login_id
+        return None
+
     def _notification_turn_id(self, notification: Notification) -> str | None:
         """Extract routing ids from known generated payloads or raw unknown payloads."""
         payload = notification.payload
diff --git a/sdk/python/src/openai_codex/_run.py b/sdk/python/src/openai_codex/_run.py
index 73ec362460..ac9fa5ed38 100644
--- a/sdk/python/src/openai_codex/_run.py
+++ b/sdk/python/src/openai_codex/_run.py
@@ -12,13 +12,20 @@ from .generated.v2_all import (
     ThreadTokenUsageUpdatedNotification,
     Turn as AppServerTurn,
     TurnCompletedNotification,
+    TurnError,
     TurnStatus,
 )
 from .models import Notification
 
 
 @dataclass(slots=True)
-class RunResult:
+class TurnResult:
+    id: str
+    status: TurnStatus
+    error: TurnError | None
+    started_at: int | None
+    completed_at: int | None
+    duration_ms: int | None
     final_response: str | None
     items: list[ThreadItem]
     usage: ThreadTokenUsage | None
@@ -56,7 +63,7 @@ def _raise_for_failed_turn(turn: AppServerTurn) -> None:
     raise RuntimeError(f"turn failed with status {turn.status.value}")
 
 
-def _collect_run_result(stream: Iterator[Notification], *, turn_id: str) -> RunResult:
+def _collect_turn_result(stream: Iterator[Notification], *, turn_id: str) -> TurnResult:
     completed: TurnCompletedNotification | None = None
     items: list[ThreadItem] = []
     usage: ThreadTokenUsage | None = None
@@ -76,16 +83,23 @@ def _collect_run_result(stream: Iterator[Notification], *, turn_id: str) -> RunR
         raise RuntimeError("turn completed event not received")
 
     _raise_for_failed_turn(completed.turn)
-    return RunResult(
+    turn = completed.turn
+    return TurnResult(
+        id=turn.id,
+        status=turn.status,
+        error=turn.error,
+        started_at=turn.started_at,
+        completed_at=turn.completed_at,
+        duration_ms=turn.duration_ms,
         final_response=_final_assistant_response_from_items(items),
         items=items,
         usage=usage,
     )
 
 
-async def _collect_async_run_result(
+async def _collect_async_turn_result(
     stream: AsyncIterator[Notification], *, turn_id: str
-) -> RunResult:
+) -> TurnResult:
     completed: TurnCompletedNotification | None = None
     items: list[ThreadItem] = []
     usage: ThreadTokenUsage | None = None
@@ -105,7 +119,14 @@ async def _collect_async_run_result(
         raise RuntimeError("turn completed event not received")
 
     _raise_for_failed_turn(completed.turn)
-    return RunResult(
+    turn = completed.turn
+    return TurnResult(
+        id=turn.id,
+        status=turn.status,
+        error=turn.error,
+        started_at=turn.started_at,
+        completed_at=turn.completed_at,
+        duration_ms=turn.duration_ms,
         final_response=_final_assistant_response_from_items(items),
         items=items,
         usage=usage,
diff --git a/sdk/python/src/openai_codex/api.py b/sdk/python/src/openai_codex/api.py
index 3d47de2a0e..f14a311789 100644
--- a/sdk/python/src/openai_codex/api.py
+++ b/sdk/python/src/openai_codex/api.py
@@ -2,12 +2,17 @@ from __future__ import annotations
 
 import asyncio
 from dataclasses import dataclass
-from enum import Enum
-from typing import AsyncIterator, Iterator, NoReturn
+from typing import AsyncIterator, Iterator
 
+from ._approval_mode import (
+    ApprovalMode as ApprovalMode,
+    _approval_mode_override_settings,
+    _approval_mode_settings,
+)
+from ._initialize_metadata import validate_initialize_metadata
 from ._inputs import (
     ImageInput as ImageInput,
-    Input,
+    Input as Input,
     InputItem as InputItem,
     LocalImageInput as LocalImageInput,
     MentionInput as MentionInput,
@@ -17,17 +22,28 @@ from ._inputs import (
     _normalize_run_input,
     _to_wire_input,
 )
+from ._login import (
+    AsyncChatgptLoginHandle,
+    AsyncDeviceCodeLoginHandle,
+    ChatgptLoginHandle,
+    DeviceCodeLoginHandle,
+    async_start_chatgpt_login,
+    async_start_device_code_login,
+    start_chatgpt_login,
+    start_device_code_login,
+)
 from ._run import (
-    RunResult,
-    _collect_async_run_result,
-    _collect_run_result,
+    TurnResult,
+    _collect_async_turn_result,
+    _collect_turn_result,
 )
 from .async_client import AsyncAppServerClient
 from .client import AppServerClient, AppServerConfig
 from .generated.v2_all import (
-    ApprovalsReviewer,
-    AskForApproval,
-    AskForApprovalValue,
+    ApiKeyLoginAccountParams,
+    GetAccountParams,
+    GetAccountResponse,
+    LoginAccountParams,
     ModelListResponse,
     Personality,
     ReasoningEffort,
@@ -49,77 +65,22 @@ from .generated.v2_all import (
     ThreadSourceKind,
     ThreadStartParams,
     ThreadStartSource,
-    Turn as AppServerTurn,
     TurnCompletedNotification,
     TurnInterruptResponse,
     TurnStartParams,
     TurnSteerResponse,
 )
-from .models import InitializeResponse, JsonObject, Notification, ServerInfo
-
-
-def _split_user_agent(user_agent: str) -> tuple[str | None, str | None]:
-    raw = user_agent.strip()
-    if not raw:
-        return None, None
-    if "/" in raw:
-        name, version = raw.split("/", 1)
-        return (name or None), (version or None)
-    parts = raw.split(maxsplit=1)
-    if len(parts) == 2:
-        return parts[0], parts[1]
-    return raw, None
-
-
-class ApprovalMode(str, Enum):
-    """High-level approval behavior for escalated permission requests."""
-
-    deny_all = "deny_all"
-    auto_review = "auto_review"
-
-
-def _approval_mode_settings(
-    approval_mode: ApprovalMode,
-) -> tuple[AskForApproval, ApprovalsReviewer | None]:
-    """Map the public approval mode to generated app-server start params."""
-    if not isinstance(approval_mode, ApprovalMode):
-        supported = ", ".join(mode.value for mode in ApprovalMode)
-        raise ValueError(f"approval_mode must be one of: {supported}")
-
-    match approval_mode:
-        case ApprovalMode.auto_review:
-            return (
-                AskForApproval(root=AskForApprovalValue.on_request),
-                ApprovalsReviewer.auto_review,
-            )
-        case ApprovalMode.deny_all:
-            return AskForApproval(root=AskForApprovalValue.never), None
-        case _:
-            return _assert_never_approval_mode(approval_mode)
-
-
-def _assert_never_approval_mode(approval_mode: NoReturn) -> NoReturn:
-    """Make approval mode mapping exhaustive for static type checkers."""
-    raise AssertionError(f"Unhandled approval mode: {approval_mode!r}")
-
-
-def _approval_mode_override_settings(
-    approval_mode: ApprovalMode | None,
-) -> tuple[AskForApproval | None, ApprovalsReviewer | None]:
-    """Map an optional public approval mode to app-server override params."""
-    if approval_mode is None:
-        return None, None
-    return _approval_mode_settings(approval_mode)
+from .models import InitializeResponse, JsonObject, Notification
 
 
 class Codex:
-    """Minimal typed SDK surface for app-server v2."""
+    """Typed Python client for app-server v2 workflows."""
 
     def __init__(self, config: AppServerConfig | None = None) -> None:
         self._client = AppServerClient(config=config)
         try:
             self._client.start()
-            self._init = self._validate_initialize(self._client.initialize())
+            self._init = validate_initialize_metadata(self._client.initialize())
         except Exception:
             self._client.close()
             raise
@@ -130,44 +91,6 @@ class Codex:
     def __exit__(self, _exc_type, _exc, _tb) -> None:
         self.close()
 
-    @staticmethod
-    def _validate_initialize(payload: InitializeResponse) -> InitializeResponse:
-        user_agent = (payload.userAgent or "").strip()
-        server = payload.serverInfo
-
-        server_name: str | None = None
-        server_version: str | None = None
-
-        if server is not None:
-            server_name = (server.name or "").strip() or None
-            server_version = (server.version or "").strip() or None
-
-        if (server_name is None or server_version is None) and user_agent:
-            parsed_name, parsed_version = _split_user_agent(user_agent)
-            if server_name is None:
-                server_name = parsed_name
-            if server_version is None:
-                server_version = parsed_version
-
-        normalized_server_name = (server_name or "").strip()
-        normalized_server_version = (server_version or "").strip()
-        if not user_agent or not normalized_server_name or not normalized_server_version:
-            raise RuntimeError(
-                "initialize response missing required metadata "
-                f"(user_agent={user_agent!r}, server_name={normalized_server_name!r}, server_version={normalized_server_version!r})"
-            )
-
-        if server is None:
-            payload.serverInfo = ServerInfo(
-                name=normalized_server_name,
-                version=normalized_server_version,
-            )
-        else:
-            server.name = normalized_server_name
-            server.version = normalized_server_version
-
-        return payload
-
     @property
     def metadata(self) -> InitializeResponse:
         return self._init
@@ -175,6 +98,33 @@ class Codex:
     def close(self) -> None:
         self._client.close()
 
+    def login_api_key(self, api_key: str) -> None:
+        """Authenticate app-server with an API key."""
+        self._client.account_login_start(
+            LoginAccountParams(
+                root=ApiKeyLoginAccountParams(
+                    api_key=api_key,
+                    type="apiKey",
+                )
+            )
+        )
+
+    def login_chatgpt(self) -> ChatgptLoginHandle:
+        """Start browser-based ChatGPT login and return its live handle."""
+        return start_chatgpt_login(self._client)
+
+    def login_chatgpt_device_code(self) -> DeviceCodeLoginHandle:
+        """Start device-code ChatGPT login and return its live handle."""
+        return start_device_code_login(self._client)
+
+    def account(self, *, refresh_token: bool = False) -> GetAccountResponse:
+        """Read the current app-server account state."""
+        return self._client.account_read(GetAccountParams(refresh_token=refresh_token))
+
+    def logout(self) -> None:
+        """Clear the current app-server account session."""
+        self._client.account_logout()
+
     # BEGIN GENERATED: Codex.flat_methods
     def thread_start(
         self,
@@ -354,7 +304,7 @@ class AsyncCodex:
             try:
                 await self._client.start()
                 payload = await self._client.initialize()
-                self._init = Codex._validate_initialize(payload)
+                self._init = validate_initialize_metadata(payload)
                 self._initialized = True
             except Exception:
                 await self._client.close()
@@ -376,6 +326,38 @@ class AsyncCodex:
         self._init = None
         self._initialized = False
 
+    async def login_api_key(self, api_key: str) -> None:
+        """Authenticate app-server with an API key."""
+        await self._ensure_initialized()
+        await self._client.account_login_start(
+            LoginAccountParams(
+                root=ApiKeyLoginAccountParams(
+                    api_key=api_key,
+                    type="apiKey",
+                )
+            )
+        )
+
+    async def login_chatgpt(self) -> AsyncChatgptLoginHandle:
+        """Start browser-based ChatGPT login and return its live handle."""
+        await self._ensure_initialized()
+        return await async_start_chatgpt_login(self)
+
+    async def login_chatgpt_device_code(self) -> AsyncDeviceCodeLoginHandle:
+        """Start device-code ChatGPT login and return its live handle."""
+        await self._ensure_initialized()
+        return await async_start_device_code_login(self)
+
+    async def account(self, *, refresh_token: bool = False) -> GetAccountResponse:
+        """Read the current app-server account state."""
+        await self._ensure_initialized()
+        return await self._client.account_read(GetAccountParams(refresh_token=refresh_token))
+
+    async def logout(self) -> None:
+        """Clear the current app-server account session."""
+        await self._ensure_initialized()
+        await self._client.account_logout()
+
     # BEGIN GENERATED: AsyncCodex.flat_methods
     async def thread_start(
         self,
@@ -550,9 +532,9 @@ class Thread:
         sandbox_policy: SandboxPolicy | None = None,
         service_tier: str | None = None,
         summary: ReasoningSummary | None = None,
-    ) -> RunResult:
+    ) -> TurnResult:
         turn = self.turn(
-            _normalize_run_input(input),
+            input,
             approval_mode=approval_mode,
             cwd=cwd,
             effort=effort,
@@ -565,14 +547,14 @@ class Thread:
         )
         stream = turn.stream()
         try:
-            return _collect_run_result(stream, turn_id=turn.id)
+            return _collect_turn_result(stream, turn_id=turn.id)
         finally:
             stream.close()
 
     # BEGIN GENERATED: Thread.flat_methods
     def turn(
         self,
-        input: Input,
+        input: RunInput,
         *,
         approval_mode: ApprovalMode | None = None,
         cwd: str | None = None,
@@ -584,7 +566,7 @@ class Thread:
         service_tier: str | None = None,
         summary: ReasoningSummary | None = None,
     ) -> TurnHandle:
-        wire_input = _to_wire_input(input)
+        wire_input = _to_wire_input(_normalize_run_input(input))
         approval_policy, approvals_reviewer = _approval_mode_override_settings(approval_mode)
         params = TurnStartParams(
             thread_id=self.id,
@@ -633,9 +615,9 @@ class AsyncThread:
         sandbox_policy: SandboxPolicy | None = None,
         service_tier: str | None = None,
         summary: ReasoningSummary | None = None,
-    ) -> RunResult:
+    ) -> TurnResult:
         turn = await self.turn(
-            _normalize_run_input(input),
+            input,
             approval_mode=approval_mode,
             cwd=cwd,
             effort=effort,
@@ -648,14 +630,14 @@ class AsyncThread:
         )
         stream = turn.stream()
         try:
-            return await _collect_async_run_result(stream, turn_id=turn.id)
+            return await _collect_async_turn_result(stream, turn_id=turn.id)
         finally:
             await stream.aclose()
 
     # BEGIN GENERATED: AsyncThread.flat_methods
     async def turn(
         self,
-        input: Input,
+        input: RunInput,
         *,
         approval_mode: ApprovalMode | None = None,
         cwd: str | None = None,
@@ -668,7 +650,7 @@ class AsyncThread:
         summary: ReasoningSummary | None = None,
     ) -> AsyncTurnHandle:
         await self._codex._ensure_initialized()
-        wire_input = _to_wire_input(input)
+        wire_input = _to_wire_input(_normalize_run_input(input))
         approval_policy, approvals_reviewer = _approval_mode_override_settings(approval_mode)
         params = TurnStartParams(
             thread_id=self.id,
@@ -712,8 +694,12 @@ class TurnHandle:
     thread_id: str
     id: str
 
-    def steer(self, input: Input) -> TurnSteerResponse:
-        return self._client.turn_steer(self.thread_id, self.id, _to_wire_input(input))
+    def steer(self, input: RunInput) -> TurnSteerResponse:
+        return self._client.turn_steer(
+            self.thread_id,
+            self.id,
+            _to_wire_input(_normalize_run_input(input)),
+        )
 
     def interrupt(self) -> TurnInterruptResponse:
         return self._client.turn_interrupt(self.thread_id, self.id)
@@ -734,21 +720,13 @@ class TurnHandle:
         finally:
             self._client.unregister_turn_notifications(self.id)
 
-    def run(self) -> AppServerTurn:
-        completed: TurnCompletedNotification | None = None
+    def run(self) -> TurnResult:
         stream = self.stream()
         try:
-            for event in stream:
-                payload = event.payload
-                if isinstance(payload, TurnCompletedNotification) and payload.turn.id == self.id:
-                    completed = payload
+            return _collect_turn_result(stream, turn_id=self.id)
         finally:
             stream.close()
 
-        if completed is None:
-            raise RuntimeError("turn completed event not received")
-        return completed.turn
-
 
 @dataclass(slots=True)
 class AsyncTurnHandle:
@@ -756,12 +734,12 @@ class AsyncTurnHandle:
     thread_id: str
     id: str
 
-    async def steer(self, input: Input) -> TurnSteerResponse:
+    async def steer(self, input: RunInput) -> TurnSteerResponse:
         await self._codex._ensure_initialized()
         return await self._codex._client.turn_steer(
             self.thread_id,
             self.id,
-            _to_wire_input(input),
+            _to_wire_input(_normalize_run_input(input)),
         )
 
     async def interrupt(self) -> TurnInterruptResponse:
@@ -785,17 +763,9 @@ class AsyncTurnHandle:
         finally:
             self._codex._client.unregister_turn_notifications(self.id)
 
-    async def run(self) -> AppServerTurn:
-        completed: TurnCompletedNotification | None = None
+    async def run(self) -> TurnResult:
         stream = self.stream()
         try:
-            async for event in stream:
-                payload = event.payload
-                if isinstance(payload, TurnCompletedNotification) and payload.turn.id == self.id:
-                    completed = payload
+            return await _collect_async_turn_result(stream, turn_id=self.id)
         finally:
             await stream.aclose()
-
-        if completed is None:
-            raise RuntimeError("turn completed event not received")
-        return completed.turn
diff --git a/sdk/python/src/openai_codex/async_client.py b/sdk/python/src/openai_codex/async_client.py
index 2c38a43087..282154b0cc 100644
--- a/sdk/python/src/openai_codex/async_client.py
+++ b/sdk/python/src/openai_codex/async_client.py
@@ -8,7 +8,14 @@ from pydantic import BaseModel
 
 from .client import AppServerClient, AppServerConfig
 from .generated.v2_all import (
+    AccountLoginCompletedNotification,
     AgentMessageDeltaNotification,
+    CancelLoginAccountResponse,
+    GetAccountParams as V2GetAccountParams,
+    GetAccountResponse,
+    LoginAccountParams as V2LoginAccountParams,
+    LoginAccountResponse,
+    LogoutAccountResponse,
     ModelListResponse,
     ThreadArchiveResponse,
     ThreadCompactStartResponse,
@@ -88,6 +95,14 @@ class AsyncAppServerClient:
         """Register a turn notification queue on the wrapped sync client."""
         self._sync.register_turn_notifications(turn_id)
 
+    def register_login_notifications(self, login_id: str) -> None:
+        """Register a login notification queue on the wrapped sync client."""
+        self._sync.register_login_notifications(login_id)
+
+    def unregister_login_notifications(self, login_id: str) -> None:
+        """Unregister a login notification queue on the wrapped sync client."""
+        self._sync.unregister_login_notifications(login_id)
+
     def unregister_turn_notifications(self, turn_id: str) -> None:
         """Unregister a turn notification queue on the wrapped sync client."""
         self._sync.unregister_turn_notifications(turn_id)
@@ -107,6 +122,28 @@ class AsyncAppServerClient:
             response_model=response_model,
         )
 
+    async def account_login_start(
+        self,
+        params: V2LoginAccountParams | JsonObject,
+    ) -> LoginAccountResponse:
+        """Start one account login attempt through the wrapped sync client."""
+        return await self._call_sync(self._sync.account_login_start, params)
+
+    async def account_login_cancel(self, login_id: str) -> CancelLoginAccountResponse:
+        """Cancel one active account login attempt through the wrapped sync client."""
+        return await self._call_sync(self._sync.account_login_cancel, login_id)
+
+    async def account_read(
+        self,
+        params: V2GetAccountParams | JsonObject | None = None,
+    ) -> GetAccountResponse:
+        """Read current account state through the wrapped sync client."""
+        return await self._call_sync(self._sync.account_read, params)
+
+    async def account_logout(self) -> LogoutAccountResponse:
+        """Clear the active account session through the wrapped sync client."""
+        return await self._call_sync(self._sync.account_logout)
+
     async def thread_start(
         self, params: V2ThreadStartParams | JsonObject | None = None
     ) -> ThreadStartResponse:
@@ -211,10 +248,21 @@ class AsyncAppServerClient:
         """Wait for the next global notification without blocking the event loop."""
         return await self._call_sync(self._sync.next_notification)
 
+    async def next_login_notification(self, login_id: str) -> Notification:
+        """Wait for the next notification routed to one login attempt."""
+        return await self._call_sync(self._sync.next_login_notification, login_id)
+
     async def next_turn_notification(self, turn_id: str) -> Notification:
         """Wait for the next notification routed to one turn."""
         return await self._call_sync(self._sync.next_turn_notification, turn_id)
 
+    async def wait_for_login_completed(
+        self,
+        login_id: str,
+    ) -> AccountLoginCompletedNotification:
+        """Wait for the completion notification routed to one login attempt."""
+        return await self._call_sync(self._sync.wait_for_login_completed, login_id)
+
     async def wait_for_turn_completed(self, turn_id: str) -> TurnCompletedNotification:
         """Wait for the completion notification routed to one turn."""
         return await self._call_sync(self._sync.wait_for_turn_completed, turn_id)
diff --git a/sdk/python/src/openai_codex/client.py b/sdk/python/src/openai_codex/client.py
index a4b1e4acaf..6f2e2b8aac 100644
--- a/sdk/python/src/openai_codex/client.py
+++ b/sdk/python/src/openai_codex/client.py
@@ -17,7 +17,16 @@ from ._version import __version__ as SDK_VERSION
 from .errors import AppServerError, TransportClosedError
 from .generated.notification_registry import NOTIFICATION_MODELS
 from .generated.v2_all import (
+    AccountLoginCompletedNotification,
     AgentMessageDeltaNotification,
+    CancelLoginAccountResponse,
+    ChatgptDeviceCodeLoginAccountResponse,
+    ChatgptLoginAccountResponse,
+    GetAccountParams as V2GetAccountParams,
+    GetAccountResponse,
+    LoginAccountParams as V2LoginAccountParams,
+    LoginAccountResponse,
+    LogoutAccountResponse,
     ModelListResponse,
     ThreadArchiveResponse,
     ThreadCompactStartResponse,
@@ -59,6 +68,8 @@ def _params_dict(
         | V2ThreadListParams
         | V2ThreadForkParams
         | V2TurnStartParams
+        | V2GetAccountParams
+        | V2LoginAccountParams
         | JsonObject
         | None
     ),
@@ -246,7 +257,10 @@ class AppServerClient:
         waiter = self._router.create_response_waiter(request_id)
 
         try:
-            self._write_message({"id": request_id, "method": method, "params": params or {}})
+            message: JsonObject = {"id": request_id, "method": method}
+            if params is not None:
+                message["params"] = params
+            self._write_message(message)
         except BaseException:
             self._router.discard_response_waiter(request_id)
             raise
@@ -258,12 +272,27 @@ class AppServerClient:
 
     def notify(self, method: str, params: JsonObject | None = None) -> None:
         """Send a JSON-RPC notification without waiting for a response."""
-        self._write_message({"method": method, "params": params or {}})
+        message: JsonObject = {"method": method}
+        if params is not None:
+            message["params"] = params
+        self._write_message(message)
 
     def next_notification(self) -> Notification:
         """Return the next notification that is not scoped to an active turn."""
         return self._router.next_global_notification()
 
+    def register_login_notifications(self, login_id: str) -> None:
+        """Start routing notifications for one interactive login attempt."""
+        self._router.register_login(login_id)
+
+    def unregister_login_notifications(self, login_id: str) -> None:
+        """Stop routing notifications for one interactive login attempt."""
+        self._router.unregister_login(login_id)
+
+    def next_login_notification(self, login_id: str) -> Notification:
+        """Return the next routed notification for the requested login id."""
+        return self._router.next_login_notification(login_id)
+
     def register_turn_notifications(self, turn_id: str) -> None:
         """Start routing notifications for one turn into its dedicated queue."""
         self._router.register_turn(turn_id)
@@ -276,6 +305,43 @@ class AppServerClient:
         """Return the next routed notification for the requested turn id."""
         return self._router.next_turn_notification(turn_id)
 
+    def account_login_start(
+        self,
+        params: V2LoginAccountParams | JsonObject,
+    ) -> LoginAccountResponse:
+        response = self.request(
+            "account/login/start",
+            _params_dict(params),
+            response_model=LoginAccountResponse,
+        )
+        response_root = response.root
+        if isinstance(
+            response_root,
+            ChatgptLoginAccountResponse | ChatgptDeviceCodeLoginAccountResponse,
+        ):
+            self.register_login_notifications(response_root.login_id)
+        return response
+
+    def account_login_cancel(self, login_id: str) -> CancelLoginAccountResponse:
+        return self.request(
+            "account/login/cancel",
+            {"loginId": login_id},
+            response_model=CancelLoginAccountResponse,
+        )
+
+    def account_read(
+        self,
+        params: V2GetAccountParams | JsonObject | None = None,
+    ) -> GetAccountResponse:
+        return self.request(
+            "account/read",
+            _params_dict(params),
+            response_model=GetAccountResponse,
+        )
+
+    def account_logout(self) -> LogoutAccountResponse:
+        return self.request("account/logout", None, response_model=LogoutAccountResponse)
+
     def thread_start(
         self, params: V2ThreadStartParams | JsonObject | None = None
     ) -> ThreadStartResponse:
@@ -417,6 +483,24 @@ class AppServerClient:
         finally:
             self.unregister_turn_notifications(turn_id)
 
+    def wait_for_login_completed(
+        self,
+        login_id: str,
+    ) -> AccountLoginCompletedNotification:
+        """Block until the matching interactive login attempt completes."""
+        self.register_login_notifications(login_id)
+        try:
+            while True:
+                notification = self.next_login_notification(login_id)
+                if (
+                    notification.method == "account/login/completed"
+                    and isinstance(notification.payload, AccountLoginCompletedNotification)
+                    and notification.payload.login_id == login_id
+                ):
+                    return notification.payload
+        finally:
+            self.unregister_login_notifications(login_id)
+
     def stream_text(
         self,
         thread_id: str,
diff --git a/sdk/python/src/openai_codex/types.py b/sdk/python/src/openai_codex/types.py
index bda240afeb..f5bbbc86c3 100644
--- a/sdk/python/src/openai_codex/types.py
+++ b/sdk/python/src/openai_codex/types.py
@@ -1,10 +1,15 @@
-"""Public generated app-server model exports for type annotations and matching."""
+"""Public app-server model exports for type annotations and matching."""
 
 from __future__ import annotations
 
 from .generated.v2_all import (
+    Account,
+    AccountLoginCompletedNotification,
     ApprovalsReviewer,
     AskForApproval,
+    CancelLoginAccountResponse,
+    CancelLoginAccountStatus,
+    GetAccountResponse,
     ModelListResponse,
     Personality,
     PlanType,
@@ -28,6 +33,7 @@ from .generated.v2_all import (
     ThreadTokenUsageUpdatedNotification,
     Turn,
     TurnCompletedNotification,
+    TurnError,
     TurnInterruptResponse,
     TurnStatus,
     TurnSteerResponse,
@@ -35,8 +41,13 @@ from .generated.v2_all import (
 from .models import InitializeResponse, JsonObject, Notification
 
 __all__ = [
+    "Account",
+    "AccountLoginCompletedNotification",
     "ApprovalsReviewer",
     "AskForApproval",
+    "CancelLoginAccountResponse",
+    "CancelLoginAccountStatus",
+    "GetAccountResponse",
     "InitializeResponse",
     "JsonObject",
     "ModelListResponse",
@@ -63,6 +74,7 @@ __all__ = [
     "ThreadTokenUsageUpdatedNotification",
     "Turn",
     "TurnCompletedNotification",
+    "TurnError",
     "TurnInterruptResponse",
     "TurnStatus",
     "TurnSteerResponse",
diff --git a/sdk/python/tests/app_server_harness.py b/sdk/python/tests/app_server_harness.py
index 26fa8cf7ef..63de28d3af 100644
--- a/sdk/python/tests/app_server_harness.py
+++ b/sdk/python/tests/app_server_harness.py
@@ -206,10 +206,11 @@ class MockResponsesServer:
 class AppServerHarness:
     """Test fixture that points a pinned runtime app-server at MockResponsesServer."""
 
-    def __init__(self, tmp_path: Path) -> None:
+    def __init__(self, tmp_path: Path, *, requires_openai_auth: bool = False) -> None:
         self.tmp_path = tmp_path
         self.codex_home = tmp_path / "codex-home"
         self.workspace = tmp_path / "workspace"
+        self.requires_openai_auth = requires_openai_auth
         self.responses = MockResponsesServer()
 
     def __enter__(self) -> AppServerHarness:
@@ -238,6 +239,7 @@ class AppServerHarness:
     def _write_config(self) -> None:
         """Write config.toml that routes model calls to the mock server."""
         config_toml = self.codex_home / "config.toml"
+        requires_openai_auth = "requires_openai_auth = true\n" if self.requires_openai_auth else ""
         config_toml.write_text(
             f"""
 model = "mock-model"
@@ -252,6 +254,7 @@ base_url = "{self.responses.url}/v1"
 wire_api = "responses"
 request_max_retries = 0
 stream_max_retries = 0
+{requires_openai_auth}
 """.lstrip()
         )
 
diff --git a/sdk/python/tests/app_server_helpers.py b/sdk/python/tests/app_server_helpers.py
index 10db00901c..af96a02e80 100644
--- a/sdk/python/tests/app_server_helpers.py
+++ b/sdk/python/tests/app_server_helpers.py
@@ -111,7 +111,7 @@ def agent_message_texts(events: list[Notification]) -> list[str]:
 
 
 def agent_message_texts_from_items(items: Iterable[Any]) -> list[str]:
-    """Extract agent-message text from completed run result items."""
+    """Extract agent-message text from completed turn result items."""
     texts: list[str] = []
     for item in items:
         root = item.root
diff --git a/sdk/python/tests/test_app_server_lifecycle.py b/sdk/python/tests/test_app_server_lifecycle.py
index 0baddccc57..9636c708c2 100644
--- a/sdk/python/tests/test_app_server_lifecycle.py
+++ b/sdk/python/tests/test_app_server_lifecycle.py
@@ -39,6 +39,61 @@ def test_thread_set_name_and_read(tmp_path) -> None:
     }
 
 
+def test_sync_and_async_initialization_round_trip_metadata(tmp_path) -> None:
+    """Public clients should initialize and start threads through app-server."""
+
+    async def async_scenario(harness: AppServerHarness) -> dict[str, object]:
+        async with AsyncCodex(config=harness.app_server_config()) as codex:
+            thread = await codex.thread_start()
+            server = codex.metadata.serverInfo
+            return {
+                "thread_id": thread.id,
+                "user_agent": codex.metadata.userAgent,
+                "server_name": None if server is None else server.name,
+                "server_version": None if server is None else server.version,
+            }
+
+    with AppServerHarness(tmp_path) as harness:
+        with Codex(config=harness.app_server_config()) as codex:
+            thread = codex.thread_start()
+            server = codex.metadata.serverInfo
+            sync_summary = {
+                "thread_id": thread.id,
+                "user_agent": codex.metadata.userAgent,
+                "server_name": None if server is None else server.name,
+                "server_version": None if server is None else server.version,
+            }
+        async_summary = asyncio.run(async_scenario(harness))
+
+    assert {
+        "sync": {
+            "thread_id_present": bool(sync_summary["thread_id"]),
+            "user_agent_present": bool(sync_summary["user_agent"]),
+            "server_name_present": bool(sync_summary["server_name"]),
+            "server_version_present": bool(sync_summary["server_version"]),
+        },
+        "async": {
+            "thread_id_present": bool(async_summary["thread_id"]),
+            "user_agent_present": bool(async_summary["user_agent"]),
+            "server_name_present": bool(async_summary["server_name"]),
+            "server_version_present": bool(async_summary["server_version"]),
+        },
+    } == {
+        "sync": {
+            "thread_id_present": True,
+            "user_agent_present": True,
+            "server_name_present": True,
+            "server_version_present": True,
+        },
+        "async": {
+            "thread_id_present": True,
+            "user_agent_present": True,
+            "server_name_present": True,
+            "server_version_present": True,
+        },
+    }
+
+
 def test_thread_list_filters_archived_threads(tmp_path) -> None:
     """Thread listing should reflect archive state through app-server."""
     with AppServerHarness(tmp_path) as harness:
@@ -102,7 +157,7 @@ def test_async_lifecycle_methods_round_trip(tmp_path) -> None:
 
             async with AsyncCodex(config=harness.app_server_config()) as codex:
                 thread = await codex.thread_start()
-                run_result = await thread.run("materialize async thread")
+                turn_result = await thread.run("materialize async thread")
                 await thread.set_name("async lifecycle")
                 named = await thread.read()
                 resumed = await codex.thread_resume(thread.id)
@@ -111,14 +166,14 @@ def test_async_lifecycle_methods_round_trip(tmp_path) -> None:
                 unarchived = await codex.thread_unarchive(thread.id)
 
         assert {
-            "run_final_response": run_result.final_response,
+            "turn_final_response": turn_result.final_response,
             "named_thread": named.thread.name,
             "resumed_id": resumed.id,
             "forked_is_distinct": forked.id != thread.id,
             "archive_response": archive_response.model_dump(by_alias=True, mode="json"),
             "unarchived_id": unarchived.id,
         } == {
-            "run_final_response": "async materialized",
+            "turn_final_response": "async materialized",
             "named_thread": "async lifecycle",
             "resumed_id": thread.id,
             "forked_is_distinct": True,
@@ -198,19 +253,19 @@ def test_compact_rpc_hits_mock_responses(tmp_path) -> None:
 
         with Codex(config=harness.app_server_config()) as codex:
             thread = codex.thread_start()
-            run_result = thread.run("create history")
+            turn_result = thread.run("create history")
             compact_response = thread.compact()
             requests = harness.responses.wait_for_requests(2)
 
     assert {
-        "run_final_response": run_result.final_response,
+        "turn_final_response": turn_result.final_response,
         "compact_response": compact_response.model_dump(
             by_alias=True,
             mode="json",
         ),
         "request_kinds": [request_kind(request.path) for request in requests],
     } == {
-        "run_final_response": "history",
+        "turn_final_response": "history",
         "compact_response": {},
         "request_kinds": ["responses", "responses"],
     }
diff --git a/sdk/python/tests/test_app_server_login.py b/sdk/python/tests/test_app_server_login.py
new file mode 100644
index 0000000000..088310e5e8
--- /dev/null
+++ b/sdk/python/tests/test_app_server_login.py
@@ -0,0 +1,90 @@
+from __future__ import annotations
+
+import base64
+import json
+
+from app_server_harness import AppServerHarness
+
+from openai_codex import AppServerConfig, Codex
+from openai_codex.generated.v2_all import (
+    ChatgptAuthTokensLoginAccountParams,
+    LoginAccountParams,
+)
+
+
+def _app_server_config(harness: AppServerHarness) -> AppServerConfig:
+    """Build an isolated login config without inheriting ambient API-key auth."""
+    config = harness.app_server_config()
+    config.env = {**(config.env or {}), "OPENAI_API_KEY": ""}
+    return config
+
+
+def test_api_key_login_authenticates_follow_up_model_requests(tmp_path) -> None:
+    """API-key login should authorize the next Responses request with that key."""
+    with AppServerHarness(tmp_path, requires_openai_auth=True) as harness:
+        harness.responses.enqueue_assistant_message("api key auth", response_id="api-key-auth")
+
+        with Codex(config=_app_server_config(harness)) as codex:
+            codex.login_api_key("sk-sdk-login-test")
+            result = codex.thread_start().run("prove api key auth")
+            request = harness.responses.single_request()
+
+    assert {
+        "final_response": result.final_response,
+        "authorization": request.header("authorization"),
+    } == {
+        "final_response": "api key auth",
+        "authorization": "Bearer sk-sdk-login-test",
+    }
+
+
+def test_chatgpt_token_login_authenticates_follow_up_model_requests(tmp_path) -> None:
+    """ChatGPT token handoff should authorize later Responses requests with that token."""
+    account_id = "workspace-sdk-chatgpt"
+
+    def _encode(payload: dict[str, object]) -> str:
+        raw = json.dumps(payload, separators=(",", ":"), sort_keys=True).encode("utf-8")
+        return base64.urlsafe_b64encode(raw).rstrip(b"=").decode("ascii")
+
+    # App-server parses claims from the access token before persisting external ChatGPT auth.
+    header = _encode({"alg": "none", "typ": "JWT"})
+    claims = _encode(
+        {
+            "email": "sdk-chatgpt@example.com",
+            "https://api.openai.com/auth": {
+                "chatgpt_account_id": account_id,
+                "chatgpt_plan_type": "pro",
+            },
+        }
+    )
+    access_token = f"{header}.{claims}.sig"
+
+    with AppServerHarness(tmp_path, requires_openai_auth=True) as harness:
+        harness.responses.enqueue_assistant_message(
+            "chatgpt token auth",
+            response_id="chatgpt-token-auth",
+        )
+
+        with Codex(config=_app_server_config(harness)) as codex:
+            login = codex._client.account_login_start(
+                LoginAccountParams(
+                    root=ChatgptAuthTokensLoginAccountParams(
+                        access_token=access_token,
+                        chatgpt_account_id=account_id,
+                        chatgpt_plan_type="pro",
+                        type="chatgptAuthTokens",
+                    )
+                )
+            )
+            result = codex.thread_start().run("prove chatgpt token auth")
+            request = harness.responses.single_request()
+
+    assert {
+        "login_type": login.root.type,
+        "final_response": result.final_response,
+        "authorization": request.header("authorization"),
+    } == {
+        "login_type": "chatgptAuthTokens",
+        "final_response": "chatgpt token auth",
+        "authorization": f"Bearer {access_token}",
+    }
diff --git a/sdk/python/tests/test_app_server_run.py b/sdk/python/tests/test_app_server_run.py
index a0ac3eca16..3f741e6ec6 100644
--- a/sdk/python/tests/test_app_server_run.py
+++ b/sdk/python/tests/test_app_server_run.py
@@ -145,8 +145,8 @@ def test_async_thread_run_uses_mock_responses(
     asyncio.run(scenario())
 
 
-def test_sync_run_result_uses_last_unknown_phase_message(tmp_path) -> None:
-    """RunResult should use the last unknown-phase agent message as final text."""
+def test_sync_turn_result_uses_last_unknown_phase_message(tmp_path) -> None:
+    """TurnResult should use the last unknown-phase agent message as final text."""
     with AppServerHarness(tmp_path) as harness:
         harness.responses.enqueue_sse(
             sse(
@@ -171,8 +171,8 @@ def test_sync_run_result_uses_last_unknown_phase_message(tmp_path) -> None:
     }
 
 
-def test_sync_run_result_preserves_empty_last_message(tmp_path) -> None:
-    """RunResult should preserve an empty final agent message instead of skipping it."""
+def test_sync_turn_result_preserves_empty_last_message(tmp_path) -> None:
+    """TurnResult should preserve an empty final agent message instead of skipping it."""
     with AppServerHarness(tmp_path) as harness:
         harness.responses.enqueue_sse(
             sse(
@@ -197,8 +197,8 @@ def test_sync_run_result_preserves_empty_last_message(tmp_path) -> None:
     }
 
 
-def test_sync_run_result_does_not_promote_commentary_only_to_final(tmp_path) -> None:
-    """RunResult final_response should stay unset when app-server marks only commentary."""
+def test_sync_turn_result_does_not_promote_commentary_only_to_final(tmp_path) -> None:
+    """TurnResult final_response should stay unset when app-server marks only commentary."""
     with AppServerHarness(tmp_path) as harness:
         harness.responses.enqueue_sse(
             sse(
@@ -226,8 +226,8 @@ def test_sync_run_result_does_not_promote_commentary_only_to_final(tmp_path) ->
     }
 
 
-def test_async_run_result_uses_last_unknown_phase_message(tmp_path) -> None:
-    """Async RunResult should use the last unknown-phase agent message."""
+def test_async_turn_result_uses_last_unknown_phase_message(tmp_path) -> None:
+    """Async TurnResult should use the last unknown-phase agent message."""
 
     async def scenario() -> None:
         """Run one async result-mapping case against a pinned app-server."""
@@ -263,10 +263,10 @@ def test_async_run_result_uses_last_unknown_phase_message(tmp_path) -> None:
     asyncio.run(scenario())
 
 
-def test_async_run_result_does_not_promote_commentary_only_to_final(
+def test_async_turn_result_does_not_promote_commentary_only_to_final(
     tmp_path,
 ) -> None:
-    """Async RunResult final_response should stay unset for commentary-only output."""
+    """Async TurnResult final_response should stay unset for commentary-only output."""
 
     async def scenario() -> None:
         """Run one async commentary mapping case against a pinned app-server."""
@@ -318,7 +318,7 @@ def test_thread_run_raises_when_real_app_server_reports_failed_turn(tmp_path) ->
 
 
 def test_final_answer_phase_survives_real_app_server_mapping(tmp_path) -> None:
-    """RunResult should use the final-answer item emitted by app-server."""
+    """TurnResult should use the final-answer item emitted by app-server."""
     with AppServerHarness(tmp_path) as harness:
         harness.responses.enqueue_sse(
             sse(
diff --git a/sdk/python/tests/test_app_server_streaming.py b/sdk/python/tests/test_app_server_streaming.py
index ae217adb6a..3b79d9def3 100644
--- a/sdk/python/tests/test_app_server_streaming.py
+++ b/sdk/python/tests/test_app_server_streaming.py
@@ -5,12 +5,13 @@ import asyncio
 from app_server_harness import AppServerHarness
 from app_server_helpers import (
     agent_message_texts,
+    agent_message_texts_from_items,
     next_async_delta,
     next_sync_delta,
     streaming_response,
 )
 
-from openai_codex import AsyncCodex, Codex, TextInput
+from openai_codex import AsyncCodex, Codex
 from openai_codex.generated.v2_all import (
     AgentMessageDeltaNotification,
     TurnCompletedNotification,
@@ -25,8 +26,9 @@ def test_sync_stream_routes_text_deltas_and_completion(tmp_path) -> None:
 
         with Codex(config=harness.app_server_config()) as codex:
             thread = codex.thread_start()
-            stream = thread.turn(TextInput("stream please")).stream()
+            stream = thread.turn("stream please").stream()
             events = list(stream)
+            request = harness.responses.single_request()
 
     assert {
         "deltas": [
@@ -35,6 +37,7 @@ def test_sync_stream_routes_text_deltas_and_completion(tmp_path) -> None:
             if isinstance(event.payload, AgentMessageDeltaNotification)
         ],
         "agent_messages": agent_message_texts(events),
+        "request_user_texts": request.message_input_texts("user")[-1:],
         "completed_statuses": [
             event.payload.turn.status
             for event in events
@@ -43,28 +46,31 @@ def test_sync_stream_routes_text_deltas_and_completion(tmp_path) -> None:
     } == {
         "deltas": ["he", "llo"],
         "agent_messages": ["hello"],
+        "request_user_texts": ["stream please"],
         "completed_statuses": [TurnStatus.completed],
     }
 
 
 def test_turn_run_returns_completed_turn(tmp_path) -> None:
-    """TurnHandle.run should wait for the app-server completion notification."""
+    """TurnHandle.run should collect output and completion metadata."""
     with AppServerHarness(tmp_path) as harness:
         harness.responses.enqueue_assistant_message("turn complete", response_id="turn-run-1")
 
         with Codex(config=harness.app_server_config()) as codex:
             thread = codex.thread_start()
-            turn = thread.turn(TextInput("complete this turn"))
+            turn = thread.turn("complete this turn")
             completed = turn.run()
 
     assert {
         "turn_id": completed.id,
         "status": completed.status,
-        "items": completed.items,
+        "agent_messages": agent_message_texts_from_items(completed.items),
+        "final_response": completed.final_response,
     } == {
         "turn_id": turn.id,
         "status": TurnStatus.completed,
-        "items": [],
+        "agent_messages": ["turn complete"],
+        "final_response": "turn complete",
     }
 
 
@@ -80,8 +86,9 @@ def test_async_stream_routes_text_deltas_and_completion(tmp_path) -> None:
 
             async with AsyncCodex(config=harness.app_server_config()) as codex:
                 thread = await codex.thread_start()
-                turn = await thread.turn(TextInput("async stream please"))
+                turn = await thread.turn("async stream please")
                 events = [event async for event in turn.stream()]
+                request = harness.responses.single_request()
 
         assert {
             "deltas": [
@@ -90,6 +97,7 @@ def test_async_stream_routes_text_deltas_and_completion(tmp_path) -> None:
                 if isinstance(event.payload, AgentMessageDeltaNotification)
             ],
             "agent_messages": agent_message_texts(events),
+            "request_user_texts": request.message_input_texts("user")[-1:],
             "completed_statuses": [
                 event.payload.turn.status
                 for event in events
@@ -98,6 +106,7 @@ def test_async_stream_routes_text_deltas_and_completion(tmp_path) -> None:
         } == {
             "deltas": ["as", "ync"],
             "agent_messages": ["async"],
+            "request_user_texts": ["async stream please"],
             "completed_statuses": [TurnStatus.completed],
         }
 
@@ -175,8 +184,8 @@ def test_interleaved_sync_turn_streams_route_by_turn_id(tmp_path) -> None:
         with Codex(config=harness.app_server_config()) as codex:
             first_thread = codex.thread_start()
             second_thread = codex.thread_start()
-            first_turn = first_thread.turn(TextInput("first"))
-            second_turn = second_thread.turn(TextInput("second"))
+            first_turn = first_thread.turn("first")
+            second_turn = second_thread.turn("second")
 
             first_stream = first_turn.stream()
             second_stream = second_turn.stream()
@@ -228,8 +237,8 @@ def test_interleaved_async_turn_streams_route_by_turn_id(tmp_path) -> None:
             async with AsyncCodex(config=harness.app_server_config()) as codex:
                 first_thread = await codex.thread_start()
                 second_thread = await codex.thread_start()
-                first_turn = await first_thread.turn(TextInput("async first"))
-                second_turn = await second_thread.turn(TextInput("async second"))
+                first_turn = await first_thread.turn("async first")
+                second_turn = await second_thread.turn("async second")
 
                 first_stream = first_turn.stream()
                 second_stream = second_turn.stream()
diff --git a/sdk/python/tests/test_app_server_turn_controls.py b/sdk/python/tests/test_app_server_turn_controls.py
index af02f6b74f..dd994b88f9 100644
--- a/sdk/python/tests/test_app_server_turn_controls.py
+++ b/sdk/python/tests/test_app_server_turn_controls.py
@@ -3,7 +3,7 @@ from __future__ import annotations
 from app_server_harness import AppServerHarness
 from app_server_helpers import agent_message_texts, streaming_response
 
-from openai_codex import Codex, TextInput
+from openai_codex import Codex
 from openai_codex.generated.v2_all import TurnStatus
 
 
@@ -21,9 +21,9 @@ def test_turn_steer_adds_follow_up_input(tmp_path) -> None:
 
         with Codex(config=harness.app_server_config()) as codex:
             thread = codex.thread_start()
-            turn = thread.turn(TextInput("Start a steerable turn."))
+            turn = thread.turn("Start a steerable turn.")
             harness.responses.wait_for_requests(1)
-            steer = turn.steer(TextInput("Use this steering input."))
+            steer = turn.steer("Use this steering input.")
             events = list(turn.stream())
             requests = harness.responses.wait_for_requests(2)
 
@@ -61,7 +61,7 @@ def test_turn_interrupt_stops_active_turn_and_follow_up_runs(tmp_path) -> None:
 
         with Codex(config=harness.app_server_config()) as codex:
             thread = codex.thread_start()
-            interrupted_turn = thread.turn(TextInput("Start a long turn."))
+            interrupted_turn = thread.turn("Start a long turn.")
             harness.responses.wait_for_requests(1)
             interrupt_response = interrupted_turn.interrupt()
             completed = interrupted_turn.run()
diff --git a/sdk/python/tests/test_artifact_workflow_and_binaries.py b/sdk/python/tests/test_artifact_workflow_and_binaries.py
index 4a8e4df4d1..b43cdd5703 100644
--- a/sdk/python/tests/test_artifact_workflow_and_binaries.py
+++ b/sdk/python/tests/test_artifact_workflow_and_binaries.py
@@ -66,8 +66,8 @@ def test_root_fmt_recipe_formats_rust_and_python_sdk() -> None:
         "previous_attribute": "# Format Rust and Python SDK code.",
         "commands": [
             "cargo fmt -- --config imports_granularity=Item 2>/dev/null",
-            "uv run --project ../sdk/python --extra dev ruff check --fix --fix-only ../sdk/python",
-            "uv run --project ../sdk/python --extra dev ruff format ../sdk/python",
+            "uv run --frozen --project ../sdk/python --extra dev ruff check --fix --fix-only ../sdk/python",
+            "uv run --frozen --project ../sdk/python --extra dev ruff format ../sdk/python",
         ],
     }
 
diff --git a/sdk/python/tests/test_public_api_signatures.py b/sdk/python/tests/test_public_api_signatures.py
index f38c2b8c94..9a1212dfdf 100644
--- a/sdk/python/tests/test_public_api_signatures.py
+++ b/sdk/python/tests/test_public_api_signatures.py
@@ -14,10 +14,13 @@ from openai_codex import (
     AppServerConfig,
     AsyncCodex,
     AsyncThread,
+    AsyncTurnHandle,
     Codex,
-    RunResult,
     Thread,
+    TurnHandle,
+    TurnResult,
 )
+from openai_codex._initialize_metadata import validate_initialize_metadata
 from openai_codex.types import InitializeResponse
 
 EXPECTED_ROOT_EXPORTS = [
@@ -26,13 +29,18 @@ EXPECTED_ROOT_EXPORTS = [
     "Codex",
     "AsyncCodex",
     "ApprovalMode",
+    "ChatgptLoginHandle",
+    "DeviceCodeLoginHandle",
+    "AsyncChatgptLoginHandle",
+    "AsyncDeviceCodeLoginHandle",
     "Thread",
     "AsyncThread",
     "TurnHandle",
     "AsyncTurnHandle",
-    "RunResult",
+    "TurnResult",
     "Input",
     "InputItem",
+    "RunInput",
     "TextInput",
     "ImageInput",
     "LocalImageInput",
@@ -54,8 +62,13 @@ EXPECTED_ROOT_EXPORTS = [
 ]
 
 EXPECTED_TYPES_EXPORTS = [
+    "Account",
+    "AccountLoginCompletedNotification",
     "ApprovalsReviewer",
     "AskForApproval",
+    "CancelLoginAccountResponse",
+    "CancelLoginAccountStatus",
+    "GetAccountResponse",
     "InitializeResponse",
     "JsonObject",
     "ModelListResponse",
@@ -82,6 +95,7 @@ EXPECTED_TYPES_EXPORTS = [
     "ThreadTokenUsageUpdatedNotification",
     "Turn",
     "TurnCompletedNotification",
+    "TurnError",
     "TurnInterruptResponse",
     "TurnStatus",
     "TurnSteerResponse",
@@ -118,9 +132,55 @@ def test_root_exports_app_server_config() -> None:
     assert AppServerConfig.__name__ == "AppServerConfig"
 
 
-def test_root_exports_run_result() -> None:
-    """The root package should expose the common-case run result wrapper."""
-    assert RunResult.__name__ == "RunResult"
+def test_root_exports_turn_result() -> None:
+    """The root package should expose the collected turn result wrapper."""
+    assert {
+        "name": TurnResult.__name__,
+        "fields": list(TurnResult.__dataclass_fields__),
+    } == {
+        "name": "TurnResult",
+        "fields": [
+            "id",
+            "status",
+            "error",
+            "started_at",
+            "completed_at",
+            "duration_ms",
+            "final_response",
+            "items",
+            "usage",
+        ],
+    }
+
+
+def test_turn_run_methods_return_turn_result() -> None:
+    """Both convenience and handle-based run APIs return the same result shape."""
+    funcs = [
+        Thread.run,
+        TurnHandle.run,
+        AsyncThread.run,
+        AsyncTurnHandle.run,
+    ]
+
+    assert {fn: inspect.signature(fn).return_annotation for fn in funcs} == dict.fromkeys(
+        funcs, "TurnResult"
+    )
+
+
+def test_turn_input_methods_accept_string_shortcut() -> None:
+    """Every public turn-input method should accept strings and typed inputs."""
+    funcs = [
+        Thread.run,
+        Thread.turn,
+        AsyncThread.run,
+        AsyncThread.turn,
+        TurnHandle.steer,
+        AsyncTurnHandle.steer,
+    ]
+
+    assert {fn: inspect.signature(fn).parameters["input"].annotation for fn in funcs} == (
+        dict.fromkeys(funcs, "RunInput")
+    )
 
 
 def test_root_exports_approval_mode() -> None:
@@ -444,7 +504,7 @@ def test_lifecycle_methods_are_codex_scoped() -> None:
 def test_initialize_metadata_parses_user_agent_shape() -> None:
     """Initialize metadata should accept the legacy user-agent-only payload shape."""
     payload = InitializeResponse.model_validate({"userAgent": "codex-cli/1.2.3"})
-    parsed = Codex._validate_initialize(payload)
+    parsed = validate_initialize_metadata(payload)
     assert parsed is payload
     assert parsed.userAgent == "codex-cli/1.2.3"
     assert parsed.serverInfo is not None
@@ -455,7 +515,7 @@ def test_initialize_metadata_parses_user_agent_shape() -> None:
 def test_initialize_metadata_requires_non_empty_information() -> None:
     """Initialize metadata should fail when the runtime gives no identity signal."""
     try:
-        Codex._validate_initialize(InitializeResponse.model_validate({}))
+        validate_initialize_metadata(InitializeResponse.model_validate({}))
     except RuntimeError as exc:
         assert "missing required metadata" in str(exc)
     else:
diff --git a/sdk/python/tests/test_real_app_server_integration.py b/sdk/python/tests/test_real_app_server_integration.py
index 292ba9632a..5c4ec83fd4 100644
--- a/sdk/python/tests/test_real_app_server_integration.py
+++ b/sdk/python/tests/test_real_app_server_integration.py
@@ -135,7 +135,7 @@ def _run_python(
     )
 
 
-def _runtime_compatibility_hint(
+def _runtime_schema_hint(
     runtime_env: PreparedRuntimeEnv,
     *,
     stdout: str,
@@ -144,7 +144,7 @@ def _runtime_compatibility_hint(
     combined = f"{stdout}\n{stderr}"
     if "ThreadStartResponse" in combined and "approvalsReviewer" in combined:
         return (
-            "\nCompatibility hint:\n"
+            "\nSchema hint:\n"
             f"Pinned runtime {runtime_env.runtime_version} returned a thread/start payload "
             "that is older than the current SDK schema and is missing "
             "`approvalsReviewer`. Bump `sdk/python/_runtime_setup.py` to a matching "
@@ -165,7 +165,7 @@ def _run_json_python(
         "Python snippet failed.\n"
         f"STDOUT:\n{result.stdout}\n"
         f"STDERR:\n{result.stderr}"
-        f"{_runtime_compatibility_hint(runtime_env, stdout=result.stdout, stderr=result.stderr)}"
+        f"{_runtime_schema_hint(runtime_env, stdout=result.stdout, stderr=result.stderr)}"
     )
     return json.loads(result.stdout)
 
@@ -234,25 +234,20 @@ def test_real_thread_and_turn_start_smoke(runtime_env: PreparedRuntimeEnv) -> No
         textwrap.dedent(
             """
             import json
-            from openai_codex import Codex, TextInput
+            from openai_codex import Codex
 
             with Codex() as codex:
                 thread = codex.thread_start(
                     model="gpt-5.4",
                     config={"model_reasoning_effort": "high"},
                 )
-                result = thread.turn(TextInput("hello")).run()
-                persisted = thread.read(include_turns=True)
-                persisted_turn = next(
-                    (turn for turn in persisted.thread.turns or [] if turn.id == result.id),
-                    None,
-                )
+                result = thread.turn("hello").run()
                 print(json.dumps({
                     "thread_id": thread.id,
                     "turn_id": result.id,
                     "status": result.status.value,
-                    "items_count": len(result.items or []),
-                    "persisted_items_count": 0 if persisted_turn is None else len(persisted_turn.items or []),
+                    "items_count": len(result.items),
+                    "final_response_is_text": isinstance(result.final_response, str) and bool(result.final_response.strip()),
                 }))
             """
         ),
@@ -261,8 +256,8 @@ def test_real_thread_and_turn_start_smoke(runtime_env: PreparedRuntimeEnv) -> No
     assert isinstance(data["thread_id"], str) and data["thread_id"].strip()
     assert isinstance(data["turn_id"], str) and data["turn_id"].strip()
     assert data["status"] == "completed"
-    assert isinstance(data["items_count"], int)
-    assert isinstance(data["persisted_items_count"], int)
+    assert data["items_count"] > 0
+    assert data["final_response_is_text"] is True
 
 
 def test_real_thread_run_convenience_smoke(runtime_env: PreparedRuntimeEnv) -> None:
@@ -295,6 +290,38 @@ def test_real_thread_run_convenience_smoke(runtime_env: PreparedRuntimeEnv) -> N
     assert isinstance(data["has_usage"], bool)
 
 
+def test_real_quickstart_style_flow_smoke(runtime_env: PreparedRuntimeEnv) -> None:
+    data = _run_json_python(
+        runtime_env,
+        textwrap.dedent(
+            """
+            import json
+            from openai_codex import Codex
+
+            with Codex() as codex:
+                thread = codex.thread_start()
+                result = thread.run("Say hello in one sentence.")
+                print(json.dumps({
+                    "thread_id": thread.id,
+                    "final_response": result.final_response,
+                    "items_count": len(result.items),
+                }))
+            """
+        ),
+    )
+
+    assert {
+        "thread_id_is_text": isinstance(data["thread_id"], str) and bool(data["thread_id"].strip()),
+        "final_response_is_text": isinstance(data["final_response"], str)
+        and bool(data["final_response"].strip()),
+        "items_count_is_int": isinstance(data["items_count"], int),
+    } == {
+        "thread_id_is_text": True,
+        "final_response_is_text": True,
+        "items_count_is_int": True,
+    }
+
+
 def test_real_async_thread_turn_usage_and_ids_smoke(
     runtime_env: PreparedRuntimeEnv,
 ) -> None:
@@ -304,7 +331,7 @@ def test_real_async_thread_turn_usage_and_ids_smoke(
             """
             import asyncio
             import json
-            from openai_codex import AsyncCodex, TextInput
+            from openai_codex import AsyncCodex
 
             async def main():
                 async with AsyncCodex() as codex:
@@ -312,18 +339,13 @@ def test_real_async_thread_turn_usage_and_ids_smoke(
                         model="gpt-5.4",
                         config={"model_reasoning_effort": "high"},
                     )
-                    result = await (await thread.turn(TextInput("say ok"))).run()
-                    persisted = await thread.read(include_turns=True)
-                    persisted_turn = next(
-                        (turn for turn in persisted.thread.turns or [] if turn.id == result.id),
-                        None,
-                    )
+                    result = await (await thread.turn("say ok")).run()
                     print(json.dumps({
                         "thread_id": thread.id,
                         "turn_id": result.id,
                         "status": result.status.value,
-                        "items_count": len(result.items or []),
-                        "persisted_items_count": 0 if persisted_turn is None else len(persisted_turn.items or []),
+                        "items_count": len(result.items),
+                        "final_response_is_text": isinstance(result.final_response, str) and bool(result.final_response.strip()),
                     }))
 
             asyncio.run(main())
@@ -334,8 +356,8 @@ def test_real_async_thread_turn_usage_and_ids_smoke(
     assert isinstance(data["thread_id"], str) and data["thread_id"].strip()
     assert isinstance(data["turn_id"], str) and data["turn_id"].strip()
     assert data["status"] == "completed"
-    assert isinstance(data["items_count"], int)
-    assert isinstance(data["persisted_items_count"], int)
+    assert data["items_count"] > 0
+    assert data["final_response_is_text"] is True
 
 
 def test_real_async_thread_run_convenience_smoke(
@@ -402,7 +424,7 @@ def test_notebook_sync_cell_smoke(runtime_env: PreparedRuntimeEnv) -> None:
         [
             _notebook_cell_source(1),
             _notebook_cell_source(2),
-            _notebook_cell_source(3),
+            _notebook_cell_source(4),
         ]
     )
     result = _run_python(runtime_env, source, timeout_s=240)
@@ -418,7 +440,7 @@ def test_notebook_advanced_cell_smoke(runtime_env: PreparedRuntimeEnv) -> None:
         [
             _notebook_cell_source(1),
             _notebook_cell_source(2),
-            _notebook_cell_source(7),
+            _notebook_cell_source(8),
         ]
     )
     result = _run_python(runtime_env, source, timeout_s=360)
@@ -436,14 +458,14 @@ def test_real_streaming_smoke_turn_completed(runtime_env: PreparedRuntimeEnv) ->
         textwrap.dedent(
             """
             import json
-            from openai_codex import Codex, TextInput
+            from openai_codex import Codex
 
             with Codex() as codex:
                 thread = codex.thread_start(
                     model="gpt-5.4",
                     config={"model_reasoning_effort": "high"},
                 )
-                turn = thread.turn(TextInput("Reply with one short sentence."))
+                turn = thread.turn("Reply with one short sentence.")
                 saw_delta = False
                 saw_completed = False
                 for event in turn.stream():
@@ -469,16 +491,16 @@ def test_real_turn_interrupt_smoke(runtime_env: PreparedRuntimeEnv) -> None:
         textwrap.dedent(
             """
             import json
-            from openai_codex import Codex, TextInput
+            from openai_codex import Codex
 
             with Codex() as codex:
                 thread = codex.thread_start(
                     model="gpt-5.4",
                     config={"model_reasoning_effort": "high"},
                 )
-                turn = thread.turn(TextInput("Count from 1 to 200 with commas."))
+                turn = thread.turn("Count from 1 to 200 with commas.")
                 turn.interrupt()
-                follow_up = thread.turn(TextInput("Say 'ok' only.")).run()
+                follow_up = thread.turn("Say 'ok' only.").run()
                 print(json.dumps({"status": follow_up.status.value}))
             """
         ),
@@ -499,7 +521,7 @@ def test_real_examples_run_and_assert(
         f"Example failed: {folder}/{script}\n"
         f"STDOUT:\n{result.stdout}\n"
         f"STDERR:\n{result.stderr}"
-        f"{_runtime_compatibility_hint(runtime_env, stdout=result.stdout, stderr=result.stderr)}"
+        f"{_runtime_schema_hint(runtime_env, stdout=result.stdout, stderr=result.stderr)}"
     )
 
     out = result.stdout
@@ -509,7 +531,7 @@ def test_real_examples_run_and_assert(
         assert "Server: unknown" not in out
     elif folder == "02_turn_run":
         assert "thread_id:" in out and "turn_id:" in out and "status:" in out
-        assert "persisted.items.count:" in out
+        assert "items.count:" in out
     elif folder == "03_turn_stream_events":
         assert "stream.completed:" in out
         assert "assistant>" in out
diff --git a/sdk/typescript/src/items.ts b/sdk/typescript/src/items.ts
index 182878f55b..8fd3b2c7ff 100644
--- a/sdk/typescript/src/items.ts
+++ b/sdk/typescript/src/items.ts
@@ -60,6 +60,7 @@ export type McpToolCallItem = {
   /** Result payload returned by the MCP server for successful calls. */
   result?: {
     content: McpContentBlock[];
+    _meta?: unknown;
     structured_content: unknown;
   };
   /** Error message reported for failed calls. */
diff --git a/sdk/typescript/tests/abort.test.ts b/sdk/typescript/tests/abort.test.ts
index 0af318272b..ca93b1e89d 100644
--- a/sdk/typescript/tests/abort.test.ts
+++ b/sdk/typescript/tests/abort.test.ts
@@ -127,7 +127,7 @@ describe("AbortSignal support", () => {
             void event; // Consume the event
             eventCount++;
             // Abort after first event
-            if (eventCount === 5) {
+            if (eventCount === 1) {
               controller.abort("Aborted during iteration");
             }
             // Continue iterating - should eventually throw
diff --git a/sdk/typescript/tests/responsesProxy.ts b/sdk/typescript/tests/responsesProxy.ts
index e9d3b29146..012cbf2320 100644
--- a/sdk/typescript/tests/responsesProxy.ts
+++ b/sdk/typescript/tests/responsesProxy.ts
@@ -181,15 +181,14 @@ export function assistantMessage(text: string, itemId: string = DEFAULT_MESSAGE_
 }
 
 export function shell_call(): SseEvent {
-  const command = ["bash", "-lc", "echo 'Hello, world!'"];
   return {
     type: "response.output_item.done",
     item: {
       type: "function_call",
       call_id: `call_id${Math.random().toString(36).slice(2)}`,
-      name: "shell",
+      name: "shell_command",
       arguments: JSON.stringify({
-        command,
+        command: "echo 'Hello, world!'",
         timeout_ms: 100,
       }),
     },
diff --git a/third_party/v8/BUILD.bazel b/third_party/v8/BUILD.bazel
index 94bb3b32c6..459d935854 100644
--- a/third_party/v8/BUILD.bazel
+++ b/third_party/v8/BUILD.bazel
@@ -22,57 +22,34 @@ config_setting(
     ],
 )
 
-alias(
-    name = "v8_146_4_0_x86_64_apple_darwin",
-    actual = "@rusty_v8_146_4_0_x86_64_apple_darwin_archive//file",
+config_setting(
+    name = "use_rusty_v8_custom_libcxx",
+    flag_values = {
+        "@v8//:v8_use_rusty_v8_custom_libcxx": "True",
+    },
 )
 
 alias(
-    name = "v8_146_4_0_aarch64_apple_darwin",
-    actual = "@rusty_v8_146_4_0_aarch64_apple_darwin_archive//file",
+    name = "v8_147_4_0_x86_64_pc_windows_msvc",
+    actual = "@rusty_v8_147_4_0_x86_64_pc_windows_msvc_archive//file",
 )
 
 alias(
-    name = "v8_146_4_0_x86_64_unknown_linux_gnu",
-    actual = "@rusty_v8_146_4_0_x86_64_unknown_linux_gnu_archive//file",
+    name = "v8_147_4_0_aarch64_pc_windows_msvc",
+    actual = "@rusty_v8_147_4_0_aarch64_pc_windows_msvc_archive//file",
 )
 
 alias(
-    name = "v8_146_4_0_aarch64_unknown_linux_gnu",
-    actual = "@rusty_v8_146_4_0_aarch64_unknown_linux_gnu_archive//file",
-)
-
-alias(
-    name = "v8_146_4_0_x86_64_unknown_linux_musl",
-    actual = "@rusty_v8_146_4_0_x86_64_unknown_linux_musl_archive//file",
-)
-
-alias(
-    name = "v8_146_4_0_aarch64_unknown_linux_musl",
-    actual = "@rusty_v8_146_4_0_aarch64_unknown_linux_musl_archive//file",
-)
-
-alias(
-    name = "v8_146_4_0_x86_64_pc_windows_msvc",
-    actual = "@rusty_v8_146_4_0_x86_64_pc_windows_msvc_archive//file",
-)
-
-alias(
-    name = "v8_146_4_0_aarch64_pc_windows_msvc",
-    actual = "@rusty_v8_146_4_0_aarch64_pc_windows_msvc_archive//file",
-)
-
-alias(
-    name = "v8_146_4_0_aarch64_pc_windows_gnullvm",
+    name = "v8_147_4_0_aarch64_pc_windows_gnullvm",
     # `rusty_v8` only ships prebuilt Windows archives for MSVC. Build the
     # GNU-flavored archive in-tree so windows-gnullvm consumers can link
     # against a matching ABI instead of trying to reuse the MSVC release.
-    actual = ":v8_146_4_0_aarch64_pc_windows_gnullvm_bazel",
+    actual = ":v8_147_4_0_aarch64_pc_windows_gnullvm_bazel",
 )
 
 alias(
-    name = "v8_146_4_0_x86_64_pc_windows_gnullvm",
-    actual = ":v8_146_4_0_x86_64_pc_windows_gnullvm_bazel",
+    name = "v8_147_4_0_x86_64_pc_windows_gnullvm",
+    actual = ":v8_147_4_0_x86_64_pc_windows_gnullvm_bazel",
 )
 
 filegroup(
@@ -96,80 +73,94 @@ filegroup(
 )
 
 alias(
-    name = "src_binding_release_x86_64_unknown_linux_musl",
-    actual = "@rusty_v8_146_4_0_x86_64_unknown_linux_musl_binding//file",
-)
-
-alias(
-    name = "src_binding_release_aarch64_unknown_linux_musl",
-    actual = "@rusty_v8_146_4_0_aarch64_unknown_linux_musl_binding//file",
-)
-
-filegroup(
-    name = "src_binding_release_x86_64_pc_windows_msvc",
-    srcs = ["@v8_crate_146_4_0//:src_binding_release_x86_64_pc_windows_msvc"],
-)
-
-filegroup(
-    name = "src_binding_release_aarch64_pc_windows_msvc",
-    srcs = ["@v8_crate_146_4_0//:src_binding_release_aarch64_pc_windows_msvc"],
-)
-
-alias(
-    name = "src_binding_release_x86_64_pc_windows_gnullvm",
+    name = "src_binding_release_x86_64_pc_windows_gnullvm_147_4_0_release",
     # `rusty_v8` does not publish a Windows GNU binding file. The generated
     # binding only describes this V8 release's C++ API surface, so reuse the
     # Linux release binding while the windows-gnullvm archive build is still
     # experimental.
-    actual = ":src_binding_release_x86_64_unknown_linux_gnu",
+    actual = ":src_binding_release_x86_64_unknown_linux_gnu_147_4_0_release",
 )
 
 alias(
-    name = "src_binding_release_aarch64_pc_windows_gnullvm",
-    actual = ":src_binding_release_aarch64_unknown_linux_gnu",
+    name = "src_binding_release_aarch64_pc_windows_gnullvm_147_4_0_release",
+    actual = ":src_binding_release_aarch64_unknown_linux_gnu_147_4_0_release",
 )
 
 alias(
     name = "rusty_v8_archive_for_target",
     actual = select({
-        "@rules_rs//rs/experimental/platforms/config:aarch64-apple-darwin": ":v8_146_4_0_aarch64_apple_darwin_bazel",
-        "@rules_rs//rs/experimental/platforms/config:aarch64-pc-windows-gnullvm": ":v8_146_4_0_aarch64_pc_windows_gnullvm",
-        "@rules_rs//rs/experimental/platforms/config:aarch64-pc-windows-msvc": ":v8_146_4_0_aarch64_pc_windows_msvc",
-        "@rules_rs//rs/experimental/platforms/config:aarch64-unknown-linux-gnu": ":v8_146_4_0_aarch64_unknown_linux_gnu_bazel",
-        ":platform_aarch64_unknown_linux_musl": ":v8_146_4_0_aarch64_unknown_linux_musl_release_base",
-        "@rules_rs//rs/experimental/platforms/config:x86_64-apple-darwin": ":v8_146_4_0_x86_64_apple_darwin_bazel",
-        "@rules_rs//rs/experimental/platforms/config:x86_64-pc-windows-gnullvm": ":v8_146_4_0_x86_64_pc_windows_gnullvm",
-        "@rules_rs//rs/experimental/platforms/config:x86_64-pc-windows-msvc": ":v8_146_4_0_x86_64_pc_windows_msvc",
-        "@rules_rs//rs/experimental/platforms/config:x86_64-unknown-linux-gnu": ":v8_146_4_0_x86_64_unknown_linux_gnu_bazel",
-        ":platform_x86_64_unknown_linux_musl": ":v8_146_4_0_x86_64_unknown_linux_musl_release",
-        "//conditions:default": ":v8_146_4_0_x86_64_unknown_linux_gnu_bazel",
+        "@rules_rs//rs/experimental/platforms/config:aarch64-apple-darwin": ":v8_147_4_0_aarch64_apple_darwin_bazel",
+        "@rules_rs//rs/experimental/platforms/config:aarch64-pc-windows-gnullvm": ":v8_147_4_0_aarch64_pc_windows_gnullvm",
+        "@rules_rs//rs/experimental/platforms/config:aarch64-pc-windows-msvc": ":v8_147_4_0_aarch64_pc_windows_msvc",
+        "@rules_rs//rs/experimental/platforms/config:aarch64-unknown-linux-gnu": ":v8_147_4_0_aarch64_unknown_linux_gnu_bazel",
+        ":platform_aarch64_unknown_linux_musl": ":v8_147_4_0_aarch64_unknown_linux_musl_release_base",
+        "@rules_rs//rs/experimental/platforms/config:x86_64-apple-darwin": ":v8_147_4_0_x86_64_apple_darwin_bazel",
+        "@rules_rs//rs/experimental/platforms/config:x86_64-pc-windows-gnullvm": ":v8_147_4_0_x86_64_pc_windows_gnullvm",
+        "@rules_rs//rs/experimental/platforms/config:x86_64-pc-windows-msvc": ":v8_147_4_0_x86_64_pc_windows_msvc",
+        "@rules_rs//rs/experimental/platforms/config:x86_64-unknown-linux-gnu": ":v8_147_4_0_x86_64_unknown_linux_gnu_bazel",
+        ":platform_x86_64_unknown_linux_musl": ":v8_147_4_0_x86_64_unknown_linux_musl_release",
+        "//conditions:default": ":v8_147_4_0_x86_64_unknown_linux_gnu_bazel",
     }),
 )
 
 alias(
     name = "rusty_v8_binding_for_target",
     actual = select({
-        "@rules_rs//rs/experimental/platforms/config:aarch64-apple-darwin": ":src_binding_release_aarch64_apple_darwin",
-        "@rules_rs//rs/experimental/platforms/config:aarch64-pc-windows-gnullvm": ":src_binding_release_aarch64_pc_windows_gnullvm",
-        "@rules_rs//rs/experimental/platforms/config:aarch64-pc-windows-msvc": ":src_binding_release_aarch64_pc_windows_msvc",
-        "@rules_rs//rs/experimental/platforms/config:aarch64-unknown-linux-gnu": ":src_binding_release_aarch64_unknown_linux_gnu",
-        ":platform_aarch64_unknown_linux_musl": ":src_binding_release_aarch64_unknown_linux_musl",
-        "@rules_rs//rs/experimental/platforms/config:x86_64-apple-darwin": ":src_binding_release_x86_64_apple_darwin",
-        "@rules_rs//rs/experimental/platforms/config:x86_64-pc-windows-gnullvm": ":src_binding_release_x86_64_pc_windows_gnullvm",
-        "@rules_rs//rs/experimental/platforms/config:x86_64-pc-windows-msvc": ":src_binding_release_x86_64_pc_windows_msvc",
-        "@rules_rs//rs/experimental/platforms/config:x86_64-unknown-linux-gnu": ":src_binding_release_x86_64_unknown_linux_gnu",
-        ":platform_x86_64_unknown_linux_musl": ":src_binding_release_x86_64_unknown_linux_musl",
-        "//conditions:default": ":src_binding_release_x86_64_unknown_linux_gnu",
+        "@rules_rs//rs/experimental/platforms/config:aarch64-apple-darwin": ":src_binding_release_aarch64_apple_darwin_147_4_0_release",
+        "@rules_rs//rs/experimental/platforms/config:aarch64-pc-windows-gnullvm": ":src_binding_release_aarch64_pc_windows_gnullvm_147_4_0_release",
+        "@rules_rs//rs/experimental/platforms/config:aarch64-pc-windows-msvc": ":src_binding_release_aarch64_pc_windows_msvc_147_4_0_release",
+        "@rules_rs//rs/experimental/platforms/config:aarch64-unknown-linux-gnu": ":src_binding_release_aarch64_unknown_linux_gnu_147_4_0_release",
+        ":platform_aarch64_unknown_linux_musl": ":src_binding_release_aarch64_unknown_linux_musl_147_4_0_release",
+        "@rules_rs//rs/experimental/platforms/config:x86_64-apple-darwin": ":src_binding_release_x86_64_apple_darwin_147_4_0_release",
+        "@rules_rs//rs/experimental/platforms/config:x86_64-pc-windows-gnullvm": ":src_binding_release_x86_64_pc_windows_gnullvm_147_4_0_release",
+        "@rules_rs//rs/experimental/platforms/config:x86_64-pc-windows-msvc": ":src_binding_release_x86_64_pc_windows_msvc_147_4_0_release",
+        "@rules_rs//rs/experimental/platforms/config:x86_64-unknown-linux-gnu": ":src_binding_release_x86_64_unknown_linux_gnu_147_4_0_release",
+        ":platform_x86_64_unknown_linux_musl": ":src_binding_release_x86_64_unknown_linux_musl_147_4_0_release",
+        "//conditions:default": ":src_binding_release_x86_64_unknown_linux_gnu_147_4_0_release",
     }),
 )
 
 V8_COPTS = ["-std=c++20"]
 
+V8_CUSTOM_LIBCXX_COPTS = select({
+    ":use_rusty_v8_custom_libcxx": [
+        "-nostdinc++",
+        "-D_LIBCPP_DISABLE_VISIBILITY_ANNOTATIONS",
+        "-D_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_EXTENSIVE",
+        "-D_LIBCPP_INSTRUMENTED_WITH_ASAN=0",
+        "-D_LIBCXXABI_DISABLE_VISIBILITY_ANNOTATIONS",
+    ],
+    "//conditions:default": [],
+})
+
 V8_STATIC_LIBRARY_FEATURES = [
     "-symbol_check",
     "-validate-static-library",
 ]
 
+cc_library(
+    name = "rusty_v8_custom_libcxx_headers",
+    defines = select({
+        ":platform_aarch64_unknown_linux_musl": ["ANDROID_HOST_MUSL"],
+        ":platform_x86_64_unknown_linux_musl": ["ANDROID_HOST_MUSL"],
+        "//conditions:default": [],
+    }),
+    deps = [
+        "@rusty_v8_libcxx//:headers",
+        "@rusty_v8_libcxxabi//:headers",
+    ],
+    visibility = ["//visibility:public"],
+)
+
+cc_library(
+    name = "rusty_v8_custom_libcxx_runtime",
+    deps = [
+        "@rusty_v8_libcxx//:libcxx",
+        "@rusty_v8_libcxxabi//:libcxxabi",
+    ],
+    visibility = ["//visibility:public"],
+)
+
 genrule(
     name = "binding_cc",
     srcs = ["@v8_crate_146_4_0//:binding_cc"],
@@ -210,6 +201,65 @@ cc_library(
     ],
 )
 
+genrule(
+    name = "binding_cc_147_4_0",
+    srcs = ["@v8_crate_147_4_0//:binding_cc"],
+    outs = ["binding_147_4_0.cc"],
+    cmd = " ".join([
+        "sed",
+        "-e '/#include \"v8\\/src\\/flags\\/flags.h\"/d'",
+        "-e 's|\"v8/src/libplatform/default-platform.h\"|\"src/libplatform/default-platform.h\"|'",
+        "-e 's|#include \"support.h\"|#include \"support_147_4_0.h\"|'",
+        "-e 's|  namespace i = v8::internal;|  (void)usage;|'",
+        "-e '/using HelpOptions = i::FlagList::HelpOptions;/d'",
+        "-e '/HelpOptions help_options = HelpOptions(HelpOptions::kExit, usage);/d'",
+        "-e 's|  i::FlagList::SetFlagsFromCommandLine(argc, argv, true, help_options);|  v8::V8::SetFlagsFromCommandLine(argc, argv, true);|'",
+        "$(location @v8_crate_147_4_0//:binding_cc)",
+        ">",
+        '"$@"',
+    ]),
+)
+
+genrule(
+    name = "crdtp_binding_cc_147_4_0",
+    srcs = ["@v8_crate_147_4_0//:crdtp_binding_cc"],
+    outs = ["crdtp_binding_147_4_0.cc"],
+    cmd = " ".join([
+        "sed",
+        "-e 's|#include \"support.h\"|#include \"support_147_4_0.h\"|'",
+        "-e 's|\"v8/third_party/inspector_protocol/|\"third_party/inspector_protocol/|g'",
+        "$(location @v8_crate_147_4_0//:crdtp_binding_cc)",
+        ">",
+        '"$@"',
+    ]),
+)
+
+copy_file(
+    name = "support_h_147_4_0",
+    src = "@v8_crate_147_4_0//:support_h",
+    out = "support_147_4_0.h",
+)
+
+cc_library(
+    name = "v8_147_4_0_binding",
+    srcs = [
+        ":binding_cc_147_4_0",
+        ":crdtp_binding_cc_147_4_0",
+    ],
+    hdrs = [":support_h_147_4_0"],
+    copts = V8_COPTS + V8_CUSTOM_LIBCXX_COPTS,
+    deps = [
+        "@v8//:core_lib_icu",
+        "@v8//:rusty_v8_crdtp_headers",
+        "@v8//:rusty_v8_internal_headers",
+    ] + select({
+        ":use_rusty_v8_custom_libcxx": [
+            ":rusty_v8_custom_libcxx_headers",
+        ],
+        "//conditions:default": [],
+    }),
+)
+
 cc_static_library(
     name = "v8_146_4_0_aarch64_apple_darwin_bazel",
     deps = [":v8_146_4_0_binding"],
@@ -292,66 +342,244 @@ filegroup(
     srcs = ["@v8_crate_146_4_0//:src_binding_release_x86_64_unknown_linux_gnu"],
 )
 
+cc_static_library(
+    name = "v8_147_4_0_aarch64_apple_darwin_bazel",
+    deps = [
+        ":rusty_v8_custom_libcxx_runtime",
+        ":v8_147_4_0_binding",
+    ],
+    features = V8_STATIC_LIBRARY_FEATURES,
+)
+
+cc_static_library(
+    name = "v8_147_4_0_aarch64_unknown_linux_gnu_bazel",
+    deps = [
+        ":rusty_v8_custom_libcxx_runtime",
+        ":v8_147_4_0_binding",
+    ],
+    features = V8_STATIC_LIBRARY_FEATURES,
+)
+
+cc_static_library(
+    name = "v8_147_4_0_aarch64_pc_windows_gnullvm_bazel",
+    deps = [":v8_147_4_0_binding"],
+    features = V8_STATIC_LIBRARY_FEATURES,
+)
+
+cc_static_library(
+    name = "v8_147_4_0_aarch64_unknown_linux_musl_release_base",
+    deps = [
+        ":rusty_v8_custom_libcxx_runtime",
+        ":v8_147_4_0_binding",
+    ],
+    features = V8_STATIC_LIBRARY_FEATURES,
+)
+
+genrule(
+    name = "v8_147_4_0_aarch64_unknown_linux_musl_release",
+    srcs = [
+        ":v8_147_4_0_aarch64_unknown_linux_musl_release_base",
+        "@llvm//runtimes/compiler-rt:clang_rt.builtins.static",
+    ],
+    tools = [
+        "@llvm//tools:llvm-ar",
+        "@llvm//tools:llvm-ranlib",
+    ],
+    outs = ["libv8_147_4_0_aarch64_unknown_linux_musl.a"],
+    cmd = """
+      cat > "$(@D)/merge.mri" <<'EOF'
+create $@
+addlib $(location :v8_147_4_0_aarch64_unknown_linux_musl_release_base)
+addlib $(location @llvm//runtimes/compiler-rt:clang_rt.builtins.static)
+save
+end
+EOF
+      $(location @llvm//tools:llvm-ar) -M < "$(@D)/merge.mri"
+      $(location @llvm//tools:llvm-ranlib) "$@"
+    """,
+)
+
+cc_static_library(
+    name = "v8_147_4_0_x86_64_apple_darwin_bazel",
+    deps = [
+        ":rusty_v8_custom_libcxx_runtime",
+        ":v8_147_4_0_binding",
+    ],
+    features = V8_STATIC_LIBRARY_FEATURES,
+)
+
+cc_static_library(
+    name = "v8_147_4_0_x86_64_unknown_linux_gnu_bazel",
+    deps = [
+        ":rusty_v8_custom_libcxx_runtime",
+        ":v8_147_4_0_binding",
+    ],
+    features = V8_STATIC_LIBRARY_FEATURES,
+)
+
+cc_static_library(
+    name = "v8_147_4_0_x86_64_pc_windows_gnullvm_bazel",
+    deps = [":v8_147_4_0_binding"],
+    features = V8_STATIC_LIBRARY_FEATURES,
+)
+
+cc_static_library(
+    name = "v8_147_4_0_x86_64_unknown_linux_musl_release",
+    deps = [
+        ":rusty_v8_custom_libcxx_runtime",
+        ":v8_147_4_0_binding",
+    ],
+    features = V8_STATIC_LIBRARY_FEATURES,
+)
+
+filegroup(
+    name = "src_binding_release_aarch64_apple_darwin_147_4_0_release",
+    srcs = ["@v8_crate_147_4_0//:src_binding_release_aarch64_apple_darwin"],
+)
+
+filegroup(
+    name = "src_binding_release_x86_64_apple_darwin_147_4_0_release",
+    srcs = ["@v8_crate_147_4_0//:src_binding_release_x86_64_apple_darwin"],
+)
+
+filegroup(
+    name = "src_binding_release_aarch64_unknown_linux_gnu_147_4_0_release",
+    srcs = ["@v8_crate_147_4_0//:src_binding_release_aarch64_unknown_linux_gnu"],
+)
+
+filegroup(
+    name = "src_binding_release_x86_64_unknown_linux_gnu_147_4_0_release",
+    srcs = ["@v8_crate_147_4_0//:src_binding_release_x86_64_unknown_linux_gnu"],
+)
+
+filegroup(
+    name = "src_binding_release_aarch64_unknown_linux_musl_147_4_0_release",
+    srcs = ["@v8_crate_147_4_0//:src_binding_release_aarch64_unknown_linux_gnu"],
+)
+
+filegroup(
+    name = "src_binding_release_x86_64_unknown_linux_musl_147_4_0_release",
+    srcs = ["@v8_crate_147_4_0//:src_binding_release_x86_64_unknown_linux_gnu"],
+)
+
+filegroup(
+    name = "src_binding_release_aarch64_pc_windows_msvc_147_4_0_release",
+    srcs = ["@v8_crate_147_4_0//:src_binding_release_aarch64_pc_windows_msvc"],
+)
+
+filegroup(
+    name = "src_binding_release_x86_64_pc_windows_msvc_147_4_0_release",
+    srcs = ["@v8_crate_147_4_0//:src_binding_release_x86_64_pc_windows_msvc"],
+)
+
 filegroup(
     name = "rusty_v8_release_pair_x86_64_apple_darwin",
     srcs = [
-        ":v8_146_4_0_x86_64_apple_darwin",
-        ":src_binding_release_x86_64_apple_darwin",
+        ":v8_147_4_0_x86_64_apple_darwin_bazel",
+        ":src_binding_release_x86_64_apple_darwin_147_4_0_release",
     ],
 )
 
 filegroup(
     name = "rusty_v8_release_pair_aarch64_apple_darwin",
     srcs = [
-        ":v8_146_4_0_aarch64_apple_darwin",
-        ":src_binding_release_aarch64_apple_darwin",
+        ":v8_147_4_0_aarch64_apple_darwin_bazel",
+        ":src_binding_release_aarch64_apple_darwin_147_4_0_release",
     ],
 )
 
 filegroup(
     name = "rusty_v8_release_pair_x86_64_unknown_linux_gnu",
     srcs = [
-        ":v8_146_4_0_x86_64_unknown_linux_gnu",
-        ":src_binding_release_x86_64_unknown_linux_gnu",
+        ":v8_147_4_0_x86_64_unknown_linux_gnu_bazel",
+        ":src_binding_release_x86_64_unknown_linux_gnu_147_4_0_release",
     ],
 )
 
 filegroup(
     name = "rusty_v8_release_pair_aarch64_unknown_linux_gnu",
     srcs = [
-        ":v8_146_4_0_aarch64_unknown_linux_gnu",
-        ":src_binding_release_aarch64_unknown_linux_gnu",
+        ":v8_147_4_0_aarch64_unknown_linux_gnu_bazel",
+        ":src_binding_release_aarch64_unknown_linux_gnu_147_4_0_release",
     ],
 )
 
 filegroup(
     name = "rusty_v8_release_pair_x86_64_unknown_linux_musl",
     srcs = [
-        ":v8_146_4_0_x86_64_unknown_linux_musl_release",
-        ":src_binding_release_x86_64_unknown_linux_musl_release",
+        ":v8_147_4_0_x86_64_unknown_linux_musl_release",
+        ":src_binding_release_x86_64_unknown_linux_musl_147_4_0_release",
     ],
 )
 
 filegroup(
     name = "rusty_v8_release_pair_aarch64_unknown_linux_musl",
     srcs = [
-        ":v8_146_4_0_aarch64_unknown_linux_musl_release",
-        ":src_binding_release_aarch64_unknown_linux_musl_release",
+        ":v8_147_4_0_aarch64_unknown_linux_musl_release",
+        ":src_binding_release_aarch64_unknown_linux_musl_147_4_0_release",
     ],
 )
 
 filegroup(
     name = "rusty_v8_release_pair_x86_64_pc_windows_msvc",
     srcs = [
-        ":v8_146_4_0_x86_64_pc_windows_msvc",
-        ":src_binding_release_x86_64_pc_windows_msvc",
+        ":v8_147_4_0_x86_64_pc_windows_msvc",
+        ":src_binding_release_x86_64_pc_windows_msvc_147_4_0_release",
     ],
 )
 
 filegroup(
     name = "rusty_v8_release_pair_aarch64_pc_windows_msvc",
     srcs = [
-        ":v8_146_4_0_aarch64_pc_windows_msvc",
-        ":src_binding_release_aarch64_pc_windows_msvc",
+        ":v8_147_4_0_aarch64_pc_windows_msvc",
+        ":src_binding_release_aarch64_pc_windows_msvc_147_4_0_release",
+    ],
+)
+
+filegroup(
+    name = "rusty_v8_sandbox_release_pair_x86_64_apple_darwin",
+    srcs = [
+        ":v8_147_4_0_x86_64_apple_darwin_bazel",
+        ":src_binding_release_x86_64_apple_darwin_147_4_0_release",
+    ],
+)
+
+filegroup(
+    name = "rusty_v8_sandbox_release_pair_aarch64_apple_darwin",
+    srcs = [
+        ":v8_147_4_0_aarch64_apple_darwin_bazel",
+        ":src_binding_release_aarch64_apple_darwin_147_4_0_release",
+    ],
+)
+
+filegroup(
+    name = "rusty_v8_sandbox_release_pair_x86_64_unknown_linux_gnu",
+    srcs = [
+        ":v8_147_4_0_x86_64_unknown_linux_gnu_bazel",
+        ":src_binding_release_x86_64_unknown_linux_gnu_147_4_0_release",
+    ],
+)
+
+filegroup(
+    name = "rusty_v8_sandbox_release_pair_aarch64_unknown_linux_gnu",
+    srcs = [
+        ":v8_147_4_0_aarch64_unknown_linux_gnu_bazel",
+        ":src_binding_release_aarch64_unknown_linux_gnu_147_4_0_release",
+    ],
+)
+
+filegroup(
+    name = "rusty_v8_sandbox_release_pair_x86_64_unknown_linux_musl",
+    srcs = [
+        ":v8_147_4_0_x86_64_unknown_linux_musl_release",
+        ":src_binding_release_x86_64_unknown_linux_musl_147_4_0_release",
+    ],
+)
+
+filegroup(
+    name = "rusty_v8_sandbox_release_pair_aarch64_unknown_linux_musl",
+    srcs = [
+        ":v8_147_4_0_aarch64_unknown_linux_musl_release",
+        ":src_binding_release_aarch64_unknown_linux_musl_147_4_0_release",
     ],
 )
diff --git a/third_party/v8/README.md b/third_party/v8/README.md
index f0961df1d0..336d03c74b 100644
--- a/third_party/v8/README.md
+++ b/third_party/v8/README.md
@@ -20,27 +20,39 @@ artifact contract.
 
 Current pinned versions:
 
-- Rust crate: `v8 = =146.4.0`
-- Embedded upstream V8 source for musl release builds: `14.6.202.9`
+- Rust crate: `v8 = =147.4.0`
+- Embedded upstream V8 source for Bazel-produced release builds: `14.7.173.20`
 
-When bumping the Rust crate version, keep the checked-in checksum manifest and
-`MODULE.bazel` in sync:
+## Updating to a new `v8` release
+
+Use this as the maintainer flow for a version bump:
+
+1. Bump the `v8` crate version and refresh `codex-rs/Cargo.lock`.
+2. Update the Bazel versioned inputs in `MODULE.bazel`, then refresh the
+   matching checksum manifest and generated checksums as described below.
+3. Publish a release-candidate PR and validate that `v8-canary` passes.
+4. If the canary is green, publish the release tag and release build.
+5. Once the release build completes, rerun the build on the candidate branch
+   and verify that the final artifact builds and tests pass.
+
+When changing the remaining prebuilt `rusty_v8` `http_file` inputs, keep the
+checked-in checksum manifest and `MODULE.bazel` in sync:
 
 ```bash
 python3 .github/scripts/rusty_v8_bazel.py update-module-bazel
 python3 .github/scripts/rusty_v8_bazel.py check-module-bazel
 ```
 
-The commands read `third_party/v8/rusty_v8_<crate_version>.sha256` by default
-and validate every matching `rusty_v8_<crate_version>` `http_file` entry.
-CI runs the check command to block checksum drift.
+The commands default to the single `rusty_v8_*` `http_file` version still
+present in `MODULE.bazel` and validate every matching entry. CI runs the check
+command to block checksum drift.
 
 The consumer-facing selectors are:
 
 - `//third_party/v8:rusty_v8_archive_for_target`
 - `//third_party/v8:rusty_v8_binding_for_target`
 
-Musl release assets are expected at the tag:
+Published release assets are expected at the tag:
 
 - `rusty-v8-v<crate_version>`
 
@@ -49,13 +61,45 @@ with these raw asset names:
 - `librusty_v8_release_<target>.a.gz`
 - `src_binding_release_<target>.rs`
 
-The dedicated publishing workflow is `.github/workflows/rusty-v8-release.yml`.
-It builds musl release pairs from source and keeps the release artifacts as the
-statically linked form:
+During the sandbox rollout, sandbox-enabled assets are published alongside those
+current assets on the same tag, with the Rust crate's sandbox feature suffix in
+their raw names:
 
+- `librusty_v8_ptrcomp_sandbox_release_<target>.a.gz`
+- `src_binding_ptrcomp_sandbox_release_<target>.rs`
+
+The dedicated publishing workflow is `.github/workflows/rusty-v8-release.yml`.
+Tagged runs build release artifacts from the Bazel graph itself:
+
+- `//third_party/v8:rusty_v8_release_pair_x86_64_apple_darwin`
+- `//third_party/v8:rusty_v8_release_pair_aarch64_apple_darwin`
+- `//third_party/v8:rusty_v8_release_pair_x86_64_unknown_linux_gnu`
+- `//third_party/v8:rusty_v8_release_pair_aarch64_unknown_linux_gnu`
 - `//third_party/v8:rusty_v8_release_pair_x86_64_unknown_linux_musl`
 - `//third_party/v8:rusty_v8_release_pair_aarch64_unknown_linux_musl`
 
+The same run also builds the matching sandbox pair targets:
+
+- `//third_party/v8:rusty_v8_sandbox_release_pair_x86_64_apple_darwin`
+- `//third_party/v8:rusty_v8_sandbox_release_pair_aarch64_apple_darwin`
+- `//third_party/v8:rusty_v8_sandbox_release_pair_x86_64_unknown_linux_gnu`
+- `//third_party/v8:rusty_v8_sandbox_release_pair_aarch64_unknown_linux_gnu`
+- `//third_party/v8:rusty_v8_sandbox_release_pair_x86_64_unknown_linux_musl`
+- `//third_party/v8:rusty_v8_sandbox_release_pair_aarch64_unknown_linux_musl`
+
+The Bazel graph pins the same libc++, libc++abi, and llvm-libc source revisions
+used by `rusty_v8 v147.4.0`, compiles published artifact targets with
+`--config=rusty-v8-upstream-libcxx`, and folds the matching runtime objects into
+the final static archive so Cargo consumers can link it with the `v8` crate's
+default `use_custom_libcxx` feature. The config keeps the object files and the
+bundled runtime on Chromium's `std::__Cr` ABI namespace instead of mixing those
+objects with the toolchain libc++ default namespace.
+
+MSVC is not part of the Bazel-produced matrix yet. The repository's current
+hermetic Windows C++ platform is `windows-gnullvm`/`x86_64-w64-windows-gnu`, so
+it cannot truthfully reproduce upstream's `*-pc-windows-msvc` archives until we
+add a real MSVC-targeting C++ toolchain to the Bazel graph.
+
 Cargo musl builds use `RUSTY_V8_ARCHIVE` plus a downloaded
 `RUSTY_V8_SRC_BINDING_PATH` to point at those `openai/codex` release assets
 directly. We do not use `RUSTY_V8_MIRROR` for musl because the upstream `v8`
diff --git a/third_party/v8/libcxx.BUILD.bazel b/third_party/v8/libcxx.BUILD.bazel
new file mode 100644
index 0000000000..71a8f8ddce
--- /dev/null
+++ b/third_party/v8/libcxx.BUILD.bazel
@@ -0,0 +1,157 @@
+load("@rules_cc//cc:defs.bzl", "cc_library")
+load("@llvm//toolchain/runtimes:cc_runtime_library.bzl", "cc_runtime_stage0_library")
+
+package(default_visibility = ["//visibility:public"])
+
+config_setting(
+    name = "is_linux",
+    constraint_values = ["@platforms//os:linux"],
+)
+
+config_setting(
+    name = "is_windows",
+    constraint_values = ["@platforms//os:windows"],
+)
+
+LIBCXX_SRCS = [
+    "src/algorithm.cpp",
+    "src/any.cpp",
+    "src/atomic.cpp",
+    "src/barrier.cpp",
+    "src/bind.cpp",
+    "src/call_once.cpp",
+    "src/charconv.cpp",
+    "src/chrono.cpp",
+    "src/condition_variable.cpp",
+    "src/condition_variable_destructor.cpp",
+    "src/error_category.cpp",
+    "src/exception.cpp",
+    "src/filesystem/directory_iterator.cpp",
+    "src/filesystem/filesystem_error.cpp",
+    "src/filesystem/operations.cpp",
+    "src/filesystem/path.cpp",
+    "src/functional.cpp",
+    "src/future.cpp",
+    "src/hash.cpp",
+    "src/ios.cpp",
+    "src/ios.instantiations.cpp",
+    "src/iostream.cpp",
+    "src/locale.cpp",
+    "src/memory.cpp",
+    "src/mutex.cpp",
+    "src/mutex_destructor.cpp",
+    "src/new.cpp",
+    "src/new_handler.cpp",
+    "src/new_helpers.cpp",
+    "src/optional.cpp",
+    "src/random.cpp",
+    "src/random_shuffle.cpp",
+    "src/regex.cpp",
+    "src/ryu/d2fixed.cpp",
+    "src/ryu/d2s.cpp",
+    "src/ryu/f2s.cpp",
+    "src/shared_mutex.cpp",
+    "src/stdexcept.cpp",
+    "src/string.cpp",
+    "src/strstream.cpp",
+    "src/system_error.cpp",
+    "src/thread.cpp",
+    "src/typeinfo.cpp",
+    "src/valarray.cpp",
+    "src/variant.cpp",
+    "src/vector.cpp",
+    "src/verbose_abort.cpp",
+]
+
+cc_library(
+    name = "headers",
+    hdrs = glob(["include/**"]),
+    strip_include_prefix = "include",
+    deps = ["@//third_party/v8/libcxx_config:headers"],
+)
+
+cc_library(
+    name = "internal_headers",
+    hdrs = glob([
+        "src/**/*.h",
+        "src/**/*.ipp",
+    ]),
+    includes = ["src"],
+)
+
+cc_runtime_stage0_library(
+    name = "libcxx",
+    srcs = LIBCXX_SRCS + select({
+        ":is_linux": [
+            "src/filesystem/directory_entry.cpp",
+            "src/filesystem/filesystem_clock.cpp",
+        ],
+        "//conditions:default": [],
+    }) + select({
+        ":is_windows": [
+            "src/support/win32/locale_win32.cpp",
+            "src/support/win32/support.cpp",
+            "src/support/win32/thread_win32.cpp",
+        ],
+        "//conditions:default": [],
+    }),
+    copts = [
+        "-fexceptions",
+        "-frtti",
+        "-fstrict-aliasing",
+        "-fvisibility=hidden",
+        "-fvisibility-inlines-hidden",
+        "-nostdinc++",
+        "-std=c++23",
+        "-Wno-nullability-completeness",
+        "-Wno-unused-parameter",
+        "-Wundef",
+    ] + select({
+        ":is_windows": ["-Wno-macro-redefined"],
+        "//conditions:default": ["-fPIC"],
+    }),
+    defines = [
+        "CR_LIBCXX_REVISION=7ab65651aed6802d2599dcb7a73b1f82d5179d05",
+        "LIBCXX_BUILDING_LIBCXXABI",
+        "LIBC_NAMESPACE=__llvm_libc_cr",
+        "_LIBCPP_BUILDING_LIBRARY",
+        "_LIBCPP_DISABLE_VISIBILITY_ANNOTATIONS",
+        "_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_EXTENSIVE",
+        "_LIBCPP_INSTRUMENTED_WITH_ASAN=0",
+        "_LIBCXXABI_DISABLE_VISIBILITY_ANNOTATIONS",
+    ] + select({
+        "@llvm//platforms/config:musl": [
+            # Chromium's checked-in __config_site uses this switch to enable
+            # libc++'s musl-specific configuration.
+            "ANDROID_HOST_MUSL",
+        ],
+        "//conditions:default": [],
+    }) + select({
+        ":is_windows": [
+            "NTDDI_VERSION=NTDDI_WIN7",
+            "WINVER=_WIN32_WINNT_WIN7",
+            "_WIN32_WINNT=_WIN32_WINNT_WIN7",
+        ],
+        "//conditions:default": [],
+    }),
+    includes = ["src"],
+    implementation_deps = [
+        ":headers",
+        ":internal_headers",
+        "@rusty_v8_libcxxabi//:headers",
+        "@rusty_v8_llvm_libc//:headers",
+    ] + select({
+        ":is_linux": [
+            "@@llvm++kernel_headers+kernel_headers//:kernel_headers",
+        ],
+        "//conditions:default": [],
+    }) + select({
+        "@llvm//platforms/config:gnu": [
+            "@@llvm++glibc+glibc//:gnu_libc_headers",
+        ],
+        "@llvm//platforms/config:musl": [
+            "@@llvm++musl+musl_libc//:musl_libc_headers",
+        ],
+        "//conditions:default": [],
+    }),
+)
diff --git a/third_party/v8/libcxx_config/BUILD.bazel b/third_party/v8/libcxx_config/BUILD.bazel
new file mode 100644
index 0000000000..e4a3ee6a85
--- /dev/null
+++ b/third_party/v8/libcxx_config/BUILD.bazel
@@ -0,0 +1,12 @@
+load("@rules_cc//cc:defs.bzl", "cc_library")
+
+package(default_visibility = ["//visibility:public"])
+
+cc_library(
+    name = "headers",
+    hdrs = [
+        "__assertion_handler",
+        "__config_site",
+    ],
+    includes = ["."],
+)
diff --git a/third_party/v8/libcxx_config/__assertion_handler b/third_party/v8/libcxx_config/__assertion_handler
new file mode 100644
index 0000000000..1d1c2c98f2
--- /dev/null
+++ b/third_party/v8/libcxx_config/__assertion_handler
@@ -0,0 +1,27 @@
+// -*- C++ -*-
+
+#ifndef _LIBCPP___ASSERTION_HANDLER
+#define _LIBCPP___ASSERTION_HANDLER
+
+#include <__config>
+#include <__verbose_abort>
+
+#if !defined(_LIBCPP_HAS_NO_PRAGMA_SYSTEM_HEADER)
+#pragma GCC system_header
+#endif
+
+#if defined(OFFICIAL_BUILD) && !defined(DCHECK_ALWAYS_ON)
+
+[[noreturn]] inline _LIBCPP_HIDE_FROM_ABI void __libcpp_hardening_failure() {
+  __builtin_trap();
+}
+
+#define _LIBCPP_ASSERTION_HANDLER(message) ((void)message, __libcpp_hardening_failure())
+
+#else
+
+#define _LIBCPP_ASSERTION_HANDLER(message) _LIBCPP_VERBOSE_ABORT("%s", message)
+
+#endif
+
+#endif  // _LIBCPP___ASSERTION_HANDLER
diff --git a/third_party/v8/libcxx_config/__config_site b/third_party/v8/libcxx_config/__config_site
new file mode 100644
index 0000000000..1053f9fe45
--- /dev/null
+++ b/third_party/v8/libcxx_config/__config_site
@@ -0,0 +1,55 @@
+#ifndef _LIBCPP_CONFIG_SITE
+#define _LIBCPP_CONFIG_SITE
+
+#define _LIBCPP_ABI_NAMESPACE __Cr
+#define _LIBCPP_ABI_VERSION 2
+
+#define _LIBCPP_ABI_FORCE_ITANIUM 0
+#define _LIBCPP_ABI_FORCE_MICROSOFT 0
+#define _LIBCPP_HAS_THREADS 1
+#define _LIBCPP_HAS_MONOTONIC_CLOCK 1
+#define _LIBCPP_HAS_TERMINAL 1
+
+#ifdef ANDROID_HOST_MUSL
+#define _LIBCPP_HAS_MUSL_LIBC 1
+#else
+#define _LIBCPP_HAS_MUSL_LIBC 0
+#endif
+
+#ifdef _WIN32
+#define _LIBCPP_HAS_THREAD_API_PTHREAD 0
+#define _LIBCPP_HAS_THREAD_API_EXTERNAL 0
+#define _LIBCPP_HAS_THREAD_API_WIN32 1
+#else
+#define _LIBCPP_HAS_THREAD_API_PTHREAD 1
+#define _LIBCPP_HAS_THREAD_API_EXTERNAL 0
+#define _LIBCPP_HAS_THREAD_API_WIN32 0
+#endif
+
+#define _LIBCPP_HAS_VENDOR_AVAILABILITY_ANNOTATIONS 0
+#define _LIBCPP_HAS_FILESYSTEM 1
+#define _LIBCPP_HAS_RANDOM_DEVICE 1
+#define _LIBCPP_HAS_LOCALIZATION 1
+#define _LIBCPP_HAS_UNICODE 1
+#define _LIBCPP_HAS_WIDE_CHARACTERS 1
+#define _LIBCPP_HAS_TIME_ZONE_DATABASE 1
+
+#if defined(__APPLE__)
+#define _LIBCPP_PSTL_BACKEND_LIBDISPATCH
+#else
+#define _LIBCPP_PSTL_BACKEND_STD_THREAD
+#endif
+
+#define _LIBCPP_ASSERTION_SEMANTIC_DEFAULT \
+    _LIBCPP_ASSERTION_SEMANTIC_HARDENING_DEPENDENT
+
+#define _LIBCPP_LIBC_PICOLIBC 0
+#define _LIBCPP_LIBC_NEWLIB 0
+
+#define _LIBCPP_NO_AUTO_LINK
+#define _LIBCPP_REMOVE_TRANSITIVE_INCLUDES
+#define _LIBCPP_NO_ABI_TAG
+#define _LIBCPP_VERBOSE_ABORT(...) ::std::__libcpp_verbose_abort(__VA_ARGS__)
+#define _LIBCPP_HAS_NO_INCOMPLETE_PSTL
+
+#endif  // _LIBCPP_CONFIG_SITE
diff --git a/third_party/v8/libcxxabi.BUILD.bazel b/third_party/v8/libcxxabi.BUILD.bazel
new file mode 100644
index 0000000000..0645511db7
--- /dev/null
+++ b/third_party/v8/libcxxabi.BUILD.bazel
@@ -0,0 +1,98 @@
+load("@rules_cc//cc:defs.bzl", "cc_library")
+load("@llvm//toolchain/runtimes:cc_runtime_library.bzl", "cc_runtime_stage0_library")
+
+package(default_visibility = ["//visibility:public"])
+
+config_setting(
+    name = "is_linux",
+    constraint_values = ["@platforms//os:linux"],
+)
+
+config_setting(
+    name = "is_windows",
+    constraint_values = ["@platforms//os:windows"],
+)
+
+cc_library(
+    name = "headers",
+    hdrs = glob(["include/**"]),
+    strip_include_prefix = "include",
+)
+
+cc_runtime_stage0_library(
+    name = "libcxxabi",
+    srcs = [
+        "src/abort_message.cpp",
+        "src/cxa_aux_runtime.cpp",
+        "src/cxa_default_handlers.cpp",
+        "src/cxa_demangle.cpp",
+        "src/cxa_exception.cpp",
+        "src/cxa_exception_storage.cpp",
+        "src/cxa_guard.cpp",
+        "src/cxa_handlers.cpp",
+        "src/cxa_personality.cpp",
+        "src/cxa_vector.cpp",
+        "src/cxa_virtual.cpp",
+        "src/fallback_malloc.cpp",
+        "src/private_typeinfo.cpp",
+        "src/stdlib_exception.cpp",
+        "src/stdlib_stdexcept.cpp",
+        "src/stdlib_typeinfo.cpp",
+    ] + select({
+        ":is_linux": ["src/cxa_thread_atexit.cpp"],
+        "//conditions:default": [],
+    }),
+    textual_hdrs = glob([
+        "src/**/*.def",
+        "src/**/*.h",
+        "src/**/*.inc",
+    ]),
+    copts = [
+        "-fexceptions",
+        "-frtti",
+        "-fstrict-aliasing",
+        "-fvisibility=hidden",
+        "-fvisibility-inlines-hidden",
+        "-nostdinc++",
+        "-std=c++23",
+        "-Wno-nullability-completeness",
+        "-Wno-unused-parameter",
+        "-Wundef",
+    ] + select({
+        ":is_windows": ["-Wno-macro-redefined"],
+        "//conditions:default": ["-fPIC"],
+    }),
+    defines = [
+        "LIBCXXABI_SILENT_TERMINATE",
+        "_LIBCPP_BUILDING_LIBRARY",
+        "_LIBCPP_DISABLE_VISIBILITY_ANNOTATIONS",
+        "_LIBCPP_HARDENING_MODE=_LIBCPP_HARDENING_MODE_EXTENSIVE",
+        "_LIBCPP_INSTRUMENTED_WITH_ASAN=0",
+        "_LIBCXXABI_DISABLE_VISIBILITY_ANNOTATIONS",
+    ] + select({
+        "@llvm//platforms/config:musl": [
+            "ANDROID_HOST_MUSL",
+        ],
+        "//conditions:default": [],
+    }),
+    includes = ["src"],
+    implementation_deps = [
+        ":headers",
+        "@rusty_v8_libcxx//:headers",
+        "@rusty_v8_libcxx//:internal_headers",
+        "@//third_party/v8/libcxx_config:headers",
+    ] + select({
+        ":is_linux": [
+            "@@llvm++kernel_headers+kernel_headers//:kernel_headers",
+        ],
+        "//conditions:default": [],
+    }) + select({
+        "@llvm//platforms/config:gnu": [
+            "@@llvm++glibc+glibc//:gnu_libc_headers",
+        ],
+        "@llvm//platforms/config:musl": [
+            "@@llvm++musl+musl_libc//:musl_libc_headers",
+        ],
+        "//conditions:default": [],
+    }),
+)
diff --git a/third_party/v8/llvm_libc.BUILD.bazel b/third_party/v8/llvm_libc.BUILD.bazel
new file mode 100644
index 0000000000..7940656fb8
--- /dev/null
+++ b/third_party/v8/llvm_libc.BUILD.bazel
@@ -0,0 +1,10 @@
+load("@rules_cc//cc:defs.bzl", "cc_library")
+
+package(default_visibility = ["//visibility:public"])
+
+cc_library(
+    name = "headers",
+    hdrs = glob(["**/*.h"]),
+    defines = ["LIBC_NAMESPACE=__llvm_libc_cr"],
+    includes = ["."],
+)
diff --git a/third_party/v8/rusty_v8_146_4_0.sha256 b/third_party/v8/rusty_v8_146_4_0.sha256
deleted file mode 100644
index 09b3e1b0b2..0000000000
--- a/third_party/v8/rusty_v8_146_4_0.sha256
+++ /dev/null
@@ -1,10 +0,0 @@
-bfe2c9be32a56c28546f0f965825ee68fbf606405f310cc4e17b448a568cf98a  librusty_v8_release_aarch64-apple-darwin.a.gz
-dbf165b07c81bdb054bc046b43d23e69fcf7bcc1a4c1b5b4776983a71062ecd8  librusty_v8_release_aarch64-unknown-linux-gnu.a.gz
-ed13363659c6d08583ac8fdc40493445c5767d8b94955a4d5d7bb8d5a81f6bf8  rusty_v8_release_aarch64-pc-windows-msvc.lib.gz
-630cd240f1bbecdb071417dc18387ab81cf67c549c1c515a0b4fcf9eba647bb7  librusty_v8_release_x86_64-apple-darwin.a.gz
-e64b4d99e4ae293a2e846244a89b80178ba10382c13fb591c1fa6968f5291153  librusty_v8_release_x86_64-unknown-linux-gnu.a.gz
-90a9a2346acd3685a355e98df85c24dbe406cb124367d16259a4b5d522621862  rusty_v8_release_x86_64-pc-windows-msvc.lib.gz
-27a08ed26c34297bfd93e514692ccc44b85f8b15c6aa39cf34e784f84fb37e8e  librusty_v8_release_aarch64-unknown-linux-musl.a.gz
-09f8900ced8297c229246c7a50b2e0ec23c54d0a554f369619cc29863f38dd1a  src_binding_release_aarch64-unknown-linux-musl.rs
-20d8271ad712323d352c1383c36e3c4b755abc41ece35819c49c75ec7134d2f8  librusty_v8_release_x86_64-unknown-linux-musl.a.gz
-09f8900ced8297c229246c7a50b2e0ec23c54d0a554f369619cc29863f38dd1a  src_binding_release_x86_64-unknown-linux-musl.rs
diff --git a/third_party/v8/rusty_v8_147_4_0.sha256 b/third_party/v8/rusty_v8_147_4_0.sha256
new file mode 100644
index 0000000000..a287e5fd5b
--- /dev/null
+++ b/third_party/v8/rusty_v8_147_4_0.sha256
@@ -0,0 +1,2 @@
+1fa3f94d9e09cff1f6bcce94c478e5cb072c0755f6a0357abadb9dd3b48d8127  rusty_v8_release_aarch64-pc-windows-msvc.lib.gz
+e2827ff98b1a9d4c0343000fc5124ac30dfab3007bc0129c168c9355fc2fcd7c  rusty_v8_release_x86_64-pc-windows-msvc.lib.gz
diff --git a/third_party/v8/v8_crate.BUILD.bazel b/third_party/v8/v8_crate.BUILD.bazel
index f9b2a1998c..3988bc0345 100644
--- a/third_party/v8/v8_crate.BUILD.bazel
+++ b/third_party/v8/v8_crate.BUILD.bazel
@@ -5,6 +5,11 @@ filegroup(
     srcs = ["src/binding.cc"],
 )
 
+filegroup(
+    name = "crdtp_binding_cc",
+    srcs = ["src/crdtp_binding.cc"],
+)
+
 filegroup(
     name = "support_h",
     srcs = ["src/support.h"],