## What changed
- Preserve `encrypted_function_args` on function calls so an empty list can mark plaintext collaboration arguments across request replay.
- Deliver `spawn_agent`, `send_message`, and `followup_task` payloads as structured plaintext agent messages when that marker is present; retain encrypted delivery otherwise.
- Redact plaintext collaboration arguments from tool and communication logs, and omit the metadata when sending requests to non-OpenAI providers.
## Testing
- Cover serialization of empty encrypted-argument metadata and plaintext versus encrypted subagent message delivery.
- Verify plaintext tool arguments are redacted and provider-specific metadata is removed from non-OpenAI requests.
GitOrigin-RevId: 64db98ff0b61a3af2f04ed609292363f2e2362a8
## What changed
- Add the stable, disabled-by-default `recommended_plugins` feature flag.
- Load recommended plugin candidates when apps and plugins are enabled and
either `tool_suggest` or `recommended_plugins` is active.
- Keep the `request_plugin_install` tool gated by `tool_suggest`.
## Testing
- Cover the first turn after external login with `tool_suggest` both enabled
and disabled, including the expected install-tool availability.
GitOrigin-RevId: 06d9a1c2e8dd2498a47796d833eb6d25ba528351
## What changed
- Propagate the initiating turn ID through agent spawns, follow-up tasks, reviews, and delegated Codex sessions.
- Add `parent_turn_id` to Responses client and turn metadata while keeping it out of external MCP metadata.
- Preserve parent-turn provenance across queued agent messages when their triggering parent is unambiguous.
## Testing
- Cover spawned, resumed, nested, reviewed, delegated, and WebSocket request metadata.
- Verify queued messages do not claim ambiguous or queue-only parent turns.
GitOrigin-RevId: 481fdebbe7df2031880fe259509273cce50b20a8
## What changed
- Use `https://api.openai.com/v1` for WebRTC sideband websocket joins instead of deriving the URL from the model provider.
- Keep `experimental_realtime_ws_base_url` as an explicit sideband override for local development and tests.
- Exclude provider query parameters when building sideband URLs.
## Testing
- Add coverage that a frameless sideband join uses `wss://api.openai.com/v1/live/rtc_test` even when the provider points at the ChatGPT backend.
- Update the sideband retry end-to-end test to inject its mock server URL through the new override.
GitOrigin-RevId: 5d3d2cd69905ba04143010ced36a22712825b563
## What changed
- Require callers to provide an HTTP client for MCP OAuth discovery and login, removing the separate direct `reqwest` path.
- Use the shared `http` and `url` types throughout the MCP client and drop its direct `reqwest` dependency.
- Preserve configured MCP headers when routing OAuth discovery through the provided client.
## Testing
- Add coverage that routed OAuth discovery forwards configured headers.
GitOrigin-RevId: 1345f56bd794626533133447597a5908e57b9b48
## What changed
Run the thread-title lookup alongside instruction refresh and plugin and skill
warmup, avoiding an additional sequential wait during session initialization.
GitOrigin-RevId: 021f48abeac249c5d3fe526d026bf031acf1bed9
## What changed
- Allocate 2% of the resolved model context window to skill metadata without
imposing the previous 4,000-token ceiling.
- Keep the 8,000-character fallback when no context window is available.
- Extend catalog rendering coverage to verify that a 400,000-token context
window receives an 8,000-token metadata budget and includes more skills.
GitOrigin-RevId: 5120d462de22fbfe5f9c4ab0d1bb97e51950d4b2
## Why
Matching model ETags can arrive on every response, but a recent models cache does
not need to be rewritten each time.
## What changed
Renew the models cache timestamp only after more than half of its configured TTL
has elapsed. Matching ETags continue to avoid refetching `/models`.
## Testing
Added integration coverage that verifies a recent cache remains unchanged and an
older cache is renewed without another `/models` request.
GitOrigin-RevId: b45da3824674c6b41d982ba4a405b419b09b7715
## Why
Rendering host and executor skill catalogs independently allows their combined
metadata to exceed the skills context budget.
## What changed
- Allocate one budget across both catalogs when both contain model-visible
skills.
- Prefer retaining executor skills when budget pressure requires omissions,
while preserving an executor omission marker and reporting when all host
skills were omitted.
- Evaluate absolute and aliased host paths under the shared budget and select
the rendering that best preserves executor entries, total entries, and
descriptions, in that order.
## Testing
Added renderer and production-turn coverage for shared-budget description
shortening, host-first omission, executor omission markers, and alias selection.
GitOrigin-RevId: 30041736a76aa173cb641aa98a876a306cb437d2
## Why
Host skill catalogs supplied through extension world state should report budget warnings only when their catalog update is actually rendered.
## What changed
- Stop rebuilding an extension-owned host catalog in core.
- Emit host catalog budget warnings when the corresponding world-state fragment is rendered, and deduplicate them with executor catalog warnings.
- Cover full, shortened, and omitted host and executor catalogs, including repeated turns and resumed persisted snapshots.
GitOrigin-RevId: ba28b6e337281b49ed4da2175c193fd4a6898ab7
## Why
An agent can be registered again with restored path metadata after a root thread
resumes. Leaving its previous registry entry behind can make later lookup and
release operations act on stale metadata.
## What changed
- Add a thread-to-path index alongside the agent tree.
- Keep both indexes synchronized when root and spawned agents are registered,
replaced, moved between paths, or released.
- Preserve other restored siblings when one agent is closed, while still
allowing a surviving sibling to be reloaded for follow-up work.
## Testing
Add registry coverage for replacement, release, and path migration, plus resume
tests with multiple sibling agents.
GitOrigin-RevId: 1c1acf422884a6842d9bbdf89ba993d98187770d
## Why
A pending optional MCP server can delay the first model request even when the
turn does not need that server.
## What changed
- Give optional MCP servers a shared one-second startup grace, then omit servers
that are still pending from the captured tool catalog.
- Continue waiting when the turn explicitly requires a server through a plugin,
skill dependency, or `mcp://` mention, and preserve this behavior for input
received between sampling steps.
- Route direct resource requests to the live connection set when a pending
server was omitted from the binding, while keeping all-server resource
discovery non-blocking.
## Testing
- Cover the shared grace period and resource behavior for pending optional
servers.
- Verify plugin, plugin-skill, and direct MCP mentions wait for startup.
- Verify an Apps-enabled turn proceeds without tools from an unrelated pending
optional server.
GitOrigin-RevId: b5f895c5a5362fe73f7d33250367662d4a217e4d
## What changed
- Add protocol types and `ResponseItem` helpers for attaching and clearing
locally recorded tool-call names and arguments.
- Bound serialized metadata across a prompt, replacing oversized arguments and
omitted calls with trusted truncation details.
- Prevent deserialized response items or model-provided arguments from forging
locally generated tool-call and truncation metadata.
## Testing
- Cover prompt-wide size limits, omission accounting, idempotent bounding, and
forged truncation markers.
GitOrigin-RevId: 960a223437ce81fe6b4cbb5fc7a9774408b2755b
## What changed
- Add an opt-in `mcp_2026_07_28` protocol mode while preserving the legacy
lifecycle by default.
- Negotiate the new protocol over streamable HTTP with `server/discover`,
including bounded responses, redirect protection, and fallback only when a
response establishes that the endpoint is legacy-only.
- Require stdio servers to opt in with
`CODEX_MCP_PROTOCOL_VERSION=2026-07-28`, and add a bounded local stdio
transport for the modern lifecycle.
- Consume paginated tool, resource, and resource-template catalogs in modern
mode, reject repeated cursors, and retain discovered server identity.
- Reconnect reusable MCP clients when their selected protocol mode changes.
## Testing
- Cover HTTP JSON and SSE discovery, legacy fallback and rejection cases,
redirects, retries, response limits, and pagination.
- Cover local and executor stdio discovery, protocol markers, message limits,
and legacy compatibility.
GitOrigin-RevId: f6a78816e127d2a482292d63b91c8384f1595903
## What changed
- Replace the `isPinned` thread metadata and filters with an optional persisted
`section` and `sectionId`.
- Add the paginated `threadSection/list` app-server method so clients can
discover sections even when they contain no threads.
- Seed a stable `Pinned` section, validate section assignments, and support
filtering for a specific section or for unsectioned threads.
## Testing
- Cover section protocol serialization, listing and pagination, metadata
updates, filtering, persistence, migration compatibility, and operation
without SQLite state.
GitOrigin-RevId: 7972b5471d29317b9387bfd90aa9f573f691ad4c
## Why
When the code mode host feature was disabled, thread startup always selected the in-process provider, even when `disable_in_process_fallback` was set.
## What changed
- Select a disabled provider when both the process host and in-process fallback are disabled.
- Return a clear tool error instead of running code mode in process for that configuration.
## Testing
Added an integration test covering code mode with the process host feature and in-process fallback both disabled.
GitOrigin-RevId: 3ed80afc23e0a5518c0133fe337a37b1fa545ead
## What changed
- Update the `rmcp` model and transport integrations for `3.0.0-beta.3`.
- Preserve legacy `elicitation/create` form requests, schema defaults, metadata, and wire-format compatibility while adopting the new elicitation types.
- Harden OAuth discovery by using GET-first discovery without starting an MCP session, preventing cross-origin header redirects, validating authorization-server and callback issuers, and retaining compatibility with metadata that omits an issuer.
- Keep stored OAuth credentials readable and avoid requiring reauthorization after transient refresh failures.
## Testing
- Add coverage for legacy elicitation round trips, OAuth discovery variants, callback issuer validation, credential migration, and refresh failures.
GitOrigin-RevId: 756197d26f3fd347c28c400228f6b3d06ed493b7
## What changed
- Store a request-logging-disabled `RouteAwareClientPool` in session services and use it for file creation, blob upload, and finalization requests.
- Preserve the existing system-root fallback for transport-default proxy routes, and emit a warning event when that fallback is used.
- Remove the direct `reqwest` dependency from `codex-api` now that uploads use the shared HTTP abstraction.
## Testing
- Add coverage for completing multiple uploads through a shared client pool.
GitOrigin-RevId: 01842415cad2d349a6bd3869abb3332e8110ebce
## What changed
- Add `features.multi_agent_v2.subagent_developer_instructions` to override inherited developer instructions for subagents that do not define role-specific instructions.
- Preserve role-specific instructions as the higher-precedence setting, and carry the effective instructions through full and bounded forks, compacted histories, and cold resume without duplication.
- Treat an unset override as inheritance and a blank override as clearing inherited instructions.
## Testing
- Cover configuration parsing and materialization, instruction precedence, fork modes, compaction, role application, and resumed subagents.
GitOrigin-RevId: 32321e61abc59b14a1be5f31e6bd6570bb1cd89d
## Why
Turn preparation waited for MCP discovery before requesting endpoint plugin
recommendations, adding their latencies together.
## What changed
- Prepare the MCP runtime and endpoint plugin recommendations concurrently.
- Wait for both results before building tools and starting model sampling.
- Cancel the combined preparation when the turn is interrupted.
## Testing
- Add coverage that gates MCP initialization and verifies recommendation fetching
overlaps it while the final request includes both results.
- Verify interrupting concurrent preparation prevents model sampling.
GitOrigin-RevId: 295ec268331bf05304e6b313925fd2b6c2ae4190
## Why
Curated plugin capabilities need to follow the active authentication mode, including after an account switch and when the configured model provider differs from the authentication source.
## What changed
- Select the ChatGPT, remote, or API curated marketplace from the current authentication mode, with an API marketplace fallback for ambient Amazon Bedrock credentials.
- Apply that selection consistently to plugin loading, hooks, skills, installed-plugin conflict filtering, marketplace listing, and `codex mcp` discovery.
- Start the local curated repository sync when an account change makes the remote catalog unavailable, and refresh existing thread MCP runtimes when the effective plugin cache changes.
## Testing
Added coverage for account switches, ChatGPT-authenticated Bedrock sessions, API-key MCP discovery, curated marketplace filtering, hook and skill routing, and existing-thread MCP refreshes.
GitOrigin-RevId: dbefdba3a3ea7281e7b6013e057a418770ccfc95
## What changed
- Clamp the initial `exec_command` yield time to at least 10 seconds on Windows.
- Update the tool description and unit coverage for the new effective range.
- Allow the Windows Ctrl-C integration test up to 20 seconds to complete.
GitOrigin-RevId: 65d4d1c9a89dc9979e10d3e565af61c9f632c058
Initialize the Windows-only `ProcessDriver::tty` field to `false` when
constructing the streaming output test harness.
GitOrigin-RevId: 95683779072cba31664d059750b81ee0d9c17664
## What changed
- Insert the `host_skills` world-state section before the permissions section
when permissions are present.
- Verify that skill metadata appears before `<permissions instructions>` in the
rendered developer message.
GitOrigin-RevId: e9fc62f498c384e841fc34ef679850557645f989
## Why
`features.multi_agent_v2` can be represented as either a legacy boolean toggle
or a table with an `enabled` field and nested settings. Layering or editing
configs that mix these forms could replace one form with the other and discard
the enabled state or nested settings.
## What changed
- Normalize boolean toggles to the table's `enabled` field when merging config
layers, applying CLI overrides, and editing user or profile config.
- Preserve nested multi-agent settings when toggling the feature, while keeping
ordinary replacement semantics for unrelated paths.
- Attribute normalized `enabled` values to the layer that supplied the boolean
toggle so config write results report overrides correctly.
## Testing
Added coverage for layered config, CLI overrides, config edits, app-server
writes, and origin metadata using both root and profile feature paths.
GitOrigin-RevId: 38b248c949b9ea5d6340a73d754f91c1834ac486
## Why
Windows non-TTY exec sessions reported interrupts as unsupported, so sending
Ctrl-C through `write_stdin` did not stop the running process.
## What changed
- Route interrupt requests for Windows non-TTY processes through their existing
termination callback, including pipe-backed processes.
- Track whether driver-backed Windows sessions use a TTY so PTY interrupts keep
their existing behavior.
- Consume the terminator after a successful interrupt to avoid invoking it again
when the process handle is dropped.
## Testing
Added coverage for local and remote exec-server sessions, unified exec, pipe
fallbacks, and legacy Windows sandbox processes.
GitOrigin-RevId: 34504d01f091ef57bb961e98ad5a8d9f1acee4ee
## Testing
- Verify full, compacted, and bounded history forks preserve developer messages while removing stale parent usage hints.
- Add an app-server regression test that cold-resumes a root thread and confirms a roleless worker retains inherited developer instructions when lazily reloaded for follow-up work.
GitOrigin-RevId: 40e454a2a2b721ea645cbc607b17a3ae6b617bd9
## What changed
- Forward remote managed-network policy requests to the controller-side decider when Guardian review is enabled.
- Bound callbacks using the configured permission-hook and Guardian review timeouts, restore trusted execution attribution, and recheck live baseline policy before requesting a decision.
- Cancel pending decisions when the process or execution scope ends, and propagate EOF across the sandbox proxy bridge with half-closes.
## Testing
- Cover callback enablement, strict allowlist behavior, live policy updates, trusted attribution, and execution-scope cancellation.
GitOrigin-RevId: 83b47657c8c4546dfe98eec8b272833e96a46b7e
## What changed
- Add token-budget settings to model catalog messages and apply them when the
feature is enabled without explicit token-budget configuration.
- Keep explicit user settings authoritative, reject invalid catalog defaults,
and preserve resolved defaults in exported config locks.
- Manage context-window guidance through world state so it updates once when
the active model changes while retaining prior conversation history.
## Testing
- Cover catalog defaults, explicit overrides, disabled features, invalid
values, config-lock replay, and model switching.
GitOrigin-RevId: 54544fefaa14b09f5ef5bad9967a13c52b87b0fe
## What changed
- Add an optional `ExtensionMetrics` capability to thread, turn-input, and world-state contributors, backed by session telemetry in the host.
- Record skill counts, omissions, and truncated description characters for extension-rendered catalogs, tagged by the catalog surface.
- Preserve host session attribution on extension metrics, including the effective model for each turn, and prevent extension tags from overriding host metadata.
- Avoid duplicate host-catalog samples by recording world-state metrics only when the section is published or changes.
## Testing
- Cover metric values and surface tags, session metadata preservation, turn-level model changes, and host world-state publication behavior.
GitOrigin-RevId: 9059e521943a8f81df25a38b03692eddbc1d990d
## What changed
Update the v2 `wait_agent` timeout description to recommend minute-scale waits
that avoid busy polling, matching the existing v1 guidance. Extend the tool-spec
test to cover the updated description.
GitOrigin-RevId: 615dfbd7cb5038013131ae8cb959d35e07c6f48a
## Why
Cached MCP definitions can be supplied to inference without waiting for the
server to finish initializing.
## What changed
- Publish cached tools while startup is still in progress, clearing their
potentially stale read-only hint.
- Wait for the selected server to start before executing a tool call, then
prepare the call against the refreshed live binding.
- Keep cached tools visible in a binding even when no live client is available,
while rejecting attempts to prepare those calls.
## Testing
- Cover cached-tool visibility before startup and replacement with live tool
metadata afterward.
- Verify cached definitions reach inference before MCP initialization and that
calls unavailable in the live catalog return the expected model-visible
error.
GitOrigin-RevId: 3aae8f474c344ccdc5e08fe321bbad21d85bffd1
## What changed
- Add the stable, default-enabled `in_app_updates` requirements-only feature.
- Allow administrators to disable in-app updates through `[features]` in `requirements.toml`.
- Expose the policy through `configRequirements/read` and include it in the config schema.
## Testing
- Verify that in-app updates are enabled by default and disabled by the managed requirement.
- Verify that `configRequirements/read` returns the configured policy.
GitOrigin-RevId: e9c7074b516fe58385fdf7dc8420c0109c0c3df6
## What changed
- Add model and personality sections to the persisted world-state snapshot.
- Generate model-switch and personality instructions through world-state diffs, including when prior state must be inferred during replay.
- Keep those instruction fragments in standalone developer messages instead of merging them with adjacent context updates.
## Testing
- Cover initial, unchanged, and changed model and personality states.
- Verify that model changes are recorded in rollout world-state items.
GitOrigin-RevId: 497e29cf38cac08e992e546df900f6f8b01120f9
## Why
The Code Mode tool-name mapping is unbounded and can make HTTP and WebSocket
headers grow without limit.
## What changed
Omit `code_mode_tool_names` from the direct `x-codex-turn-metadata`
compatibility header while retaining it in the canonical
`client_metadata["x-codex-turn-metadata"]` payload.
GitOrigin-RevId: 494a30b6846e32ab44eb79b08dfec63360f563a7
## What changed
- Add an optional `started_at_ms` field to `ItemCompletedEvent`, retaining
compatibility with older persisted events that lack it.
- Track the first start timestamp for each in-flight item and attach it when
emitting and persisting the completion event. If no start was recorded, use
the completion timestamp as a fallback.
- Emit a complete start/completion lifecycle for subagent activity items.
## Testing
- Cover concurrent item timing, repeated starts, turn-boundary cleanup, the
missing-start fallback, subagent activity, and persisted web-search events.
GitOrigin-RevId: e7cec9c4f1ef6ba67f287e81fb4d7d856fcf87a7
## What changed
- Leave plugin MCP servers unchanged when every plugin requirement omits
`mcp_servers`.
- Continue treating an explicitly empty `mcp_servers` allowlist as deny-all.
## Testing
Added coverage for both absent and explicitly empty plugin MCP allowlists.
GitOrigin-RevId: 80bb9aa6bbd779d669c573f63681dc46019b668c
## What changed
- Add `code_mode_tool_names` to Responses Lite turn metadata, mapping each normalized code-mode identifier to its structured `ToolName`.
- Reserve the metadata key against client overrides and omit it from metadata exposed to external MCP servers.
- Keep non-Lite requests and the legacy top-level client metadata unchanged.
## Testing
- Cover HTTP and WebSocket Responses Lite requests, including switching from a non-Lite model.
- Verify reserved-key handling and external MCP metadata filtering.
GitOrigin-RevId: b678afba13d57a91e26f5895aa37238fbb4cb276
## What changed
- Scope pending network approvals to a turn and execution while still coalescing duplicate requests within one execution.
- Fail abandoned approval owners closed, cancel denied executions, resolve any waiting requests, and cancel in-flight Guardian reviews when their owner is dropped.
- Serialize session policy updates with approval caches so concurrent allow and deny decisions cannot leave enforcement and cached decisions inconsistent.
- Give user approval requests and permission hooks unique per-execution identifiers.
## Testing
- Cover approval deduplication boundaries, abandoned-owner cleanup, cancellation outcomes, replacement requests, and Guardian cancellation events.
GitOrigin-RevId: 11e184dd1c70294a99581b6ff0d4b6607d9ea1d9
## What changed
- Allow `features.code_mode_host` to use a configuration table with
`disable_in_process_fallback`. When enabled, failure to start the standalone
host is returned as tool output instead of falling back to embedded V8.
- Preserve the existing fallback behavior by default and continue accepting the
boolean feature toggle.
- Limit displayed host paths in spawn errors to 512 bytes while retaining the
executable-bearing suffix and valid UTF-8 boundaries.
## Testing
- Cover boolean and table-based feature configuration, fallback-disabled host
failures, and bounded ASCII and UTF-8 error paths.
GitOrigin-RevId: ab3d014e79054c2f8beef9a658915f01cca197b2
## What changed
- Add `remote_plugin_id` to skill invocation facts and analytics event parameters.
- Propagate the ID for both explicit and implicit plugin skill invocations.
## Testing
- Cover explicit and implicit remote plugin skill invocations with analytics integration tests.
GitOrigin-RevId: 3e1d25b5ff88dcff9c2b6c9fe44bca97e8778221
## What changed
- Carry a plugin's local and remote identities together from plugin loading into
`SkillMetadata`.
- Resolve remote IDs from the installed-plugin snapshot when available, falling
back to persisted install metadata only when no snapshot exists.
- Include plugin identity in skill cache keys so identity changes refresh cached
skill metadata.
## Testing
- Cover snapshot and persisted identity resolution, local marketplace isolation,
cached skill refreshes, and propagation through plugin skill snapshots.
GitOrigin-RevId: aabeeb631a43361fe817358ace7f1ea8ba5db708
## Why
MCP authentication checks need to use the same HTTP routing as the MCP
transport so servers reached through configured proxies can be discovered
reliably.
## What changed
- Resolve OAuth discovery and authentication status through each server's
runtime HTTP client for both local and managed environments.
- Keep local discovery capped at five seconds while allowing explicit login
requests to retain their requested timeout.
- Resolve refreshed MCP configuration and its runtime context from the same
snapshot.
## Testing
- Cover OAuth discovery through an environment proxy and macOS system proxy
resolution.
- Cover proxied MCP startup and runtime refresh with updated authorization
headers.
- Verify capped and preserved OAuth discovery timeout policies.
GitOrigin-RevId: 461fb1d4786e547df8b1e6b2215a8ac40438a3aa
## Why
Hooks can only consume a transcript path when the thread has a local rollout.
## What changed
- Resolve the local rollout path before materializing the transcript.
- Return no transcript path for non-local thread stores without persisting them.
- Continue materializing lazy local rollouts before passing their path to hooks.
## Testing
Added session and hook tests covering both non-local thread stores and lazy local rollouts.
GitOrigin-RevId: c742984d146f7a3e1048b848198198fc7a64f4de
## Why
`thread/fork` rejected threads using paginated history, so they could not use the same fork workflow as legacy threads.
## What changed
- Create paginated forks by referencing a frozen source-history prefix while persisting only child-owned records in the new rollout.
- Support latest, `lastTurnId`, and `beforeTurnId` boundaries, including inherited lineage, model-context reconstruction, interruption markers, and approval-reviewer inheritance.
- Make paginated reads and occurrence search traverse referenced history while excluding source records added after the fork.
- Coordinate fork preparation with archive and delete operations, and materialize compressed rollouts before they become fork references.
## Testing
Added app-server and thread-store coverage for boundary selection, active turns, inherited reads and search, compressed lineage, and concurrent source lifecycle operations.
GitOrigin-RevId: 66052d69517d7fb97a3b7817ab77a39c5ad995fd
## Why
MCP config reloads updated resolved server and authentication values, but did not
carry managed server constraints or plugin requirements into active threads.
## What changed
- Refresh MCP state from the typed thread config, including its managed
requirements, while retaining the thread's user layer and unrelated settings.
- Apply the refreshed config directly through `CodexThread` instead of encoding it
as a protocol operation.
- Re-evaluate effective plugins immediately after account changes so their MCP
requirements reach existing threads.
## Testing
- Cover replacement and enforcement of managed server and plugin requirements.
- Verify refreshed MCP settings are installed without changing the active model.
GitOrigin-RevId: 3cf0d69f51ef4893a4d722ee803fcbfdf1cd959e
## Why
MCP elicitation reviewers are reused across runtime refreshes, while an active
turn can retain the approval settings it started with. Reviewing against that
turn could therefore apply stale authority after session settings changed.
## What changed
- Read the latest published MCP runtime configuration when reviewing an
elicitation, including the approval policy, permission profile, configuration
layers, and reviewer selection.
- Apply `never` and granular MCP-elicitation policy decisions before routing an
eligible request to Guardian.
- Keep MCP runtime startup registered for refresh invalidation through session
creation.
## Testing
Added coverage that refreshes a running session and verifies the same reviewer
uses the latest authority for Guardian routing, denial, and empty-form
auto-approval.
GitOrigin-RevId: 826a157aa70fc8e3a9e3a14ecb0261bf7b63f63a
## Why
MCP configuration can change while a thread is still starting, before it appears in the thread manager's loaded-thread list. In that window, invalidation could miss the new thread and leave it with a stale MCP runtime.
## What changed
- Centralize MCP runtime invalidation in `ThreadManager` so it refreshes loaded threads and marks in-progress thread startups for refresh after publication.
- Use the centralized invalidation path for account and plugin changes.
- Invalidate MCP runtimes after successful server and plugin OAuth logins.
## Testing
- Add a regression test that pauses thread startup, invalidates MCP runtimes, and verifies that the newly published thread refreshes its MCP projection.
GitOrigin-RevId: 8944f5a21816a1405e038a0d4c08b66362ea9368
