## What changed
Add `experimentalDisablePredictionMcp` to `thread/fork` and `disableMcp` to `thread/sample`. Disable MCP servers when requested and the inherited history contains incremental tools on Responses Lite. The fork option requires `experimentalPredictionMode: true`.
Apply disablement through a thread-local policy that excludes configured MCP servers and runtime contributions, including after MCP refresh. Preserve the inherited history prefix and append tool-removal instructions without changing the parent's tools.
## Testing
Add coverage for prediction forks with legacy and paginated history, flag validation, conditional disablement, MCP refresh, and sample/fork request parity. Add a request-history snapshot covering preserved history, tool removal across child turns, and unchanged parent tools.
GitOrigin-RevId: e31d602480e6550ed130d8152f538b8668280fa0
## What changed
Add the experimental `thread/sample/cancel` request with a `requestId` identifying a `thread/sample` request on the same connection. Cancellation returns an empty response, stops the matching sample with `sample canceled`, and cleans up its ephemeral fork. Repeated cancellation and unknown request IDs are harmless no-ops; other request types are unaffected.
## Testing
Add coverage for connection and request ID isolation, request type filtering, and repeated cancellation. Extend the sample integration test to verify cancellation keeps the parent responsive and reclaims the child thread.
GitOrigin-RevId: 92d12e5c0190e1d3b06cb482543615a3ec77bdc8
## Why
A temporary exec-server transport loss could emit a thread environment disconnect notification while the session was still recovering.
## What changed
- Add `EnvironmentConnectionState::Recovering` for interrupted transports and pending session recovery.
- Suppress thread lifecycle notifications during recovery, emit a connected notification after successful recovery, and report disconnection when recovery fails.
- Ignore recovery callbacks from retired clients so they cannot overwrite the connection state during refresh.
## Testing
Add coverage for fast and near-deadline recovery, recovery timeout, rejected session resume, and retired-client callbacks. Extend app-server coverage to verify one lifecycle notification per selected thread and usable `environment/info` after recovery.
GitOrigin-RevId: d6dce5cc5264af29b6f993daa209b93102122e40
## Why
Cancelled or timed-out Guardian reviews can admit transcript evidence without completing a review. Reusing that session can leave subsequent reviews without the evidence they need.
## What changed
Mark interrupted reviews for rollback to the last completed review instead of reusing their live context. Preserve committed review history and replay pending evidence on the next review.
## Testing
Add cancellation and timeout regression coverage that verifies encrypted evidence appears exactly once in the next review, the last completed review survives rollback, and interrupted or denied commands do not execute. Update session disposition assertions and make the program-change session reuse test wait for review completion before releasing the classifier result.
GitOrigin-RevId: f39552b24db5309cffddd9eda97280256be3e97b
## Why
Enterprise-managed MCP authentication requires the thread's admitted connection. Bulk `mcpServerStatus/list` requests need to use that connection to report the enterprise server's catalog consistently with single-server requests.
## What changed
- Read enterprise server metadata from the thread runtime when listing all MCP servers, preserving ordinary server discovery.
- Check the expected server registration before discovery so edited or disabled registrations cannot reuse an old connection's catalog.
## Testing
Add coverage for bulk and single-server status consistency, catalog metadata, and registration changes. Extend enterprise authentication lifecycle tests to cover bearer renewal, grant replacement, and logout during a pending exchange. Add a scenario asserting that enterprise sign-in failure preserves ordinary MCP tool schemas, calls, and model history.
GitOrigin-RevId: 3bf3bd672511d0c753cd95ec777892f72bd6eb89
## What changed
- Recognize `sci` and `sci_plus` in authentication, account responses, rate limits, and generated client schemas.
- Treat both plans as workspace accounts eligible for cloud configuration, and use business analytics routes.
- Display “Academic Researchers” and “Academic Researchers Plus” in the TUI and direct users to their admin when usage limits are reached.
## Testing
Add coverage for plan parsing, workspace classification, account and rate-limit responses, cloud configuration eligibility, analytics routing, TUI labels, and usage-limit guidance. Exercise installed-app refresh and listing with `sci_plus` authentication.
GitOrigin-RevId: b51c5df03029b8bc249d44f11b353a7755e7dd04
## Why
A live thread can have updated SQLite metadata before its rollout file exists.
Reading metadata from the missing file loses creation details such as fork and
parent relationships and triggers unnecessary filesystem discovery and retries.
## What changed
- Read deferred `SessionMeta` through the rollout writer, ordered with persistence.
Return no in-memory metadata once the rollout is materialized or resumed.
- Combine that creation metadata with SQLite metadata for reads that exclude
history, and use it to determine the canonical history mode during updates.
- Keep untouched threads without a stored record unavailable for fork and resume.
## Testing
Add coverage for metadata reads and updates before persistence in both legacy and
paginated history modes, including equality with metadata read after persistence.
Verify the recorder exposes creation metadata only while deferred, and expand
fork/resume rejection tests across history modes and resume turn inclusion.
GitOrigin-RevId: 8d293cc8f87156409f195130437d93858a4099b9
## Why
Backgrounding a Claude session creates a continuation that includes its history. Offering both sessions for import duplicates that history.
## What changed
Skip sessions containing a `continued-in` record with a nonblank `continuedInSessionId` during import detection, leaving the continuation available for import.
## Testing
Add detection and app-server regression tests covering continuation-only detection, importing the full history into one thread, and no remaining import candidates afterward.
GitOrigin-RevId: bf8383faadce984ae3c41a0b8e8b3072680fd4b2
## What changed
Add `thread/sample` to collect one model response on an ephemeral fork that inherits a loaded thread's context and configuration. Return the source turn ID, response ID, assistant text, and available token usage without modifying the source conversation.
Require an idle, persistent root thread and an `expectedTurnId` matching its latest completed turn. Reject results if the source history changes during sampling. Keep the parent responsive while sampling, hide sample forks from `thread/loaded/list`, and reclaim them after completion or timeout.
Intercept responses before tool execution or Stop hooks can run, returning null text for tool calls or responses without text. Apply optional reasoning-effort updates only when the provider and model support cache-preserving updates.
## Testing
Add integration coverage for inherited context and reasoning effort, source preservation, tool and Stop hook suppression, invalid requests, stream errors, parent responsiveness, and timeout cleanup.
GitOrigin-RevId: 08f4867e53ec7f6c8f4428d5542eeea4e6dadd0b
## Why
Thread unload timing used the server-wide delay, ignoring per-thread configuration overrides. Clients need to control how long individual idle, unsubscribed threads remain loaded.
## What changed
- Resolve unload timing from each loaded thread's `thread_unload_delay_secs` configuration. Setting it to `0` allows immediate unloading once the thread has no subscribers or activity.
- Allow this runtime retention override in `experimentalPredictionMode` forks while continuing to reject other configuration overrides. Reject negative values and delays too large to schedule.
- Replace the source-specific immediate-unload behavior with explicit configuration.
## Testing
Extend integration coverage for per-thread delays, unloading after active turns finish, fork overrides, and invalid prediction-fork delays. Verify that immediate unloading preserves persistent history and that cold resumes and ordinary nested forks use their default delay instead of retaining the previous runtime's override.
GitOrigin-RevId: fcb82bd73a101260c51e2a8476f94320c23ac929
## What changed
Set the app server's unload delay to zero for ephemeral threads whose `thread_source` is `composer_predictions`, excluding subagent sessions. These threads unload once they are idle and have no subscribers, while active turns continue to completion.
## Testing
Extend integration coverage to check immediate unloading after an active prediction turn finishes and after unsubscribing from a fork that inherits the prediction configuration. Verify that persistent threads and ephemeral threads without the prediction source retain the configured delay.
GitOrigin-RevId: 04a0e405b666c689ccf6f482055d24692b18ead0
## What changed
Add `features.app_server_websocket_compression`, disabled by default. TCP WebSocket and Unix-domain socket listeners now negotiate zstd compression only when the feature is enabled and the client offers the supported protocol. Otherwise, connections use plain text messages.
Include the feature in the configuration schema and allow its override during TUI daemon startup.
## Testing
Extend transport tests to cover enabled and disabled compression with supported, unsupported, and absent client offers on both transports. Add an app-server integration test that verifies startup configuration controls negotiation and the message format used for initialization responses.
GitOrigin-RevId: 6001d65f66f9c48f099b85380c2cad8ffee04de7
## Why
A plugin's scripts can change without changing its hook declaration. Declaration-only approval therefore lets changed plugin code run under an existing hook approval.
## What changed
- Fingerprint plugin bundle contents and include the content hash in the approval value returned by `hooks/list`. Persist it as `trusted_content_hash`, keeping `trusted_hash` compatible with older clients.
- Verify contents before each command or MCP hook execution, within the hook's timeout, and require renewed approval when approved contents change.
- Migrate legacy declaration-only approvals to a shared, immutable content baseline per plugin and config home.
- Exclude generated Python bytecode, `.venv`, and `.egg-info` entries from fingerprints. Run app-server hook listing on blocking tasks.
## Testing
Extend integration coverage for plugin upgrades and rollbacks requiring approval, same-turn script changes preventing further hook execution, shared legacy approval baselines, and generated Python artifacts preserving trust.
GitOrigin-RevId: faaf7658210d8adb2534ddd614c72ec993920840
## What changed
Add optional `inputImages` metadata containing each referenced local image's path and SHA-256 hash of the bytes read before normalization. Compute the hash from the same bytes used to prepare the edit request.
Preserve this metadata through completion events, persisted thread history, resume, and legacy rollout migration. Update app-server schemas and generated TypeScript and Python types; older items continue to deserialize without the field.
## Testing
Add coverage for input ordering, changed contents at the same path, unreadable or invalid references, serialization, persisted history and resume, and legacy migration.
GitOrigin-RevId: 522be8ec1e39c9b2bbe5b9ccb37ea67d17f0e21a
## What changed
- Upload generated images to the attachment store and expose `fileId` in image-generation items when available, with inline `result` fallback on upload or decoding failure.
- Preserve file references through legacy events, persisted rollouts, thread history, and task output summaries. Keep model-facing image preparation separate.
- Add attachment request tags and mark generated-image uploads with `usage=image_gen`, preserving the thread's ephemeral setting.
- Update public schemas and SDK types to accept either image representation, retain the Python `ImageGenerationThreadItem` alias, and prefer `fileId` when reading records containing both fields.
## Testing
Add coverage for file-backed generation and rollout persistence, legacy history replay, inline and transitional serialization, task output visibility, and Python SDK alias compatibility.
GitOrigin-RevId: f7a2bb5707e2f277348a547a988bc33c8e96d891
## Why
Trimming interleaved realtime transcripts by utterance order can discard the latest speech from an earlier utterance. Evicting after each delta can also drop one speaker before the other speaker's delta from the same frame arrives, losing recent instructions at handoff.
## What changed
Use raw frame recency to trim timed frameless bidirectional transcripts within the 8 KiB budget. Defer eviction until the frame advances or the transcript is consumed, and retain both speakers' suffixes when they share the newest frame. Preserve conversation order and fall back to FIFO eviction when timing is unavailable.
Track trimmed prefixes so final transcripts can extend retained speech without making delayed finals appear newer.
## Testing
Add regression coverage for frame recency, same-frame event ordering, UTF-8 truncation, delayed finals, and untimed fallback. Add an app-server handoff test verifying that both speakers' recent speech and the latest user instruction survive while live transcript notifications remain unchanged.
GitOrigin-RevId: b01b729d8bdd4acb26e0385442ce40819355deac
## Why
The app server retained its startup model provider for catalog requests, so signing in or out could leave `model/list` using stale provider settings or requiring a restart after managed provider requirements changed.
## What changed
- Invalidate the catalog after successful login and logout, then reload the effective configuration on the next model list or background refresh. Rebuild the models manager when the provider or catalog changes, while preserving existing threads' routes.
- Retain the original project context and the TUI's `--oss` provider selection across reloads. Retry configuration loading after falling back to defaults so temporary failures do not pin the fallback catalog.
- Keep provider policy checks for cached catalogs and apply runtime `api_key_model_discovery` toggles to the active catalog manager.
## Testing
Add and extend tests for provider selection and definition changes after login, catalog reloads after logout, OAuth gateway transitions, fallback recovery, project context, and runtime model discovery toggles.
GitOrigin-RevId: bce2e23ff567e1a52eac2b6ad736a6e63ff61e2b
## Why
Native extensions need configured Responses metadata for request attribution, but extension calls used the MCP metadata template, which omits it. Image requests also did not forward the turn metadata to the backend.
## What changed
Use the Responses metadata template for native extension calls while continuing to exclude tool inventory. Forward the resulting metadata in the `x-codex-turn-metadata` header on image generation and edit requests.
## Testing
Extend metadata tests to cover configured values in extension calls and app-server tests to verify `display_name` and `turn_trigger` on image generation and edit requests, including a Unicode display name.
GitOrigin-RevId: a2ffaa4d15259c662917612391b8717ee34b9c6c
## Why
Clients need a way to update individual turn metadata entries without replacing the existing client metadata map.
## What changed
Add the experimental `responsesapiClientMetadataPatch` field to `turn/start` and `turn/steer`. Patches add or overwrite entries while retaining other keys and apply after `responsesapiClientMetadata` when both are supplied. The existing field retains replacement semantics, including clearing unprotected entries with an empty map.
Continue protecting reserved metadata keys and preserving targeted `misalignment_override` continuations across updates.
## Testing
Extend the app-server metadata integration test to cover replacement and patch steering, patch precedence at turn start, preservation of unrelated entries during patches, and protection of targeted continuations.
GitOrigin-RevId: 8c4da3ba1b87329da20b5295846bdcf3a88126de
## Why
Compression replaces `.jsonl` rollout files with `.jsonl.zst` files, so checking only the original path can skip existing sessions. Compression can also replace a file between path lookup and canonicalization.
## What changed
- Resolve compressed rollout alternatives when selecting the latest local session.
- Retry rollout path resolution when files disappear during lookup or canonicalization.
## Testing
Extend coverage to verify latest-session filtering after startup compression and resuming a compressed rollout through its original relative `.jsonl` path with preserved turns.
GitOrigin-RevId: a4d5c399567ab4c7cd8aaa8b5f38821ee8b8d802
## Why
Message roles and content classifications do not identify who supplied each context part. Source attribution needs to survive prompt assembly and history truncation, including messages that combine text from different producers.
## What changed
- Add per-part `ContentItemMetadata` for user input, developer instructions, `AGENTS.md`, skills, harness context, command hooks, and tool context with optional callable namespaces.
- Carry attribution alongside content and classifications through contextual fragments, extension prompts, hook output, and agent messages. Keep tool-provided context-window hints separate from harness text.
- Preserve the source of retained text slices during compaction and attribute generated truncation notices to the harness. Default missing historical attribution to unknown.
- Attribute host MCP calls using cached tool namespaces only when catalog revisions remain stable, without starting servers or refreshing catalogs for attribution.
- Send the new metadata to Responses Lite and strip it from requests to endpoints that do not support it.
## Testing
Extend compaction tests to cover mixed sources, missing or extra metadata entries, and discarded media. Update Responses Lite request assertions to verify endpoint-specific attribution handling.
GitOrigin-RevId: b0ebc929b7c60f3ec49d1affbf897312d63edcc8
## Why
Workspace routing reported generic requirements load and reload failures, hiding the cause. Raw configuration errors can contain secrets, so exposing their messages directly is unsafe.
## What changed
Include a safe reason in configuration load and reload errors: file locations or non-file line and column numbers, cloud error categories and HTTP status codes, known network policy denials, or OS error details. Exclude raw parser messages, configuration contents, and backend-supplied policy names and IDs.
## Testing
Add regression coverage for configuration locations, cloud failures, and network policy denials. Verify that malformed local and cloud configuration reports useful errors without exposing secret values or policy identifiers, and still prevents workspace routing from falling back to startup configuration.
GitOrigin-RevId: a71484c700d32662ced9e19041dbedda5d1da8a5
## What changed
Add optional `voiceSessionId` to realtime start parameters and forward it as the `voice-session-id` header for WebSocket, WebRTC, and existing-call transports. Keep this client-generated voice session identifier distinct from `realtimeSessionId`, which uses `x-session-id`.
## Testing
Extend serialization tests and add coverage for distinct session ID headers, WebRTC request forwarding, and existing-call handshake forwarding.
GitOrigin-RevId: cb558dbb9d438f2d34e281199a7e81fe5d33b879
## What changed
Use `conversation` when neither a local `async_classifier_mode` override nor a model default specifies a mode. Keep `snapshot` available as an explicit override and update the configuration documentation and schema to describe the new fallback.
## Testing
Expand configuration tests to cover all local override and model default combinations. Update app-server approval tests to exercise conversation mode without an explicit override, and explicitly select snapshot mode in tests that depend on it.
GitOrigin-RevId: a62479a3f6454bf28d589373a236d8b0ab5023b9
## Why
Rewriting source agent names and instruction filenames inside URLs and email addresses can change their destinations when importing external agent content.
## What changed
Use `linkify` to preserve recognized URLs and email addresses while rewriting surrounding text, including Markdown link labels and titles. Continue migrating instruction filename references to `AGENTS.md`, including relative links and references with line or column suffixes.
## Testing
Add rewrite coverage for URLs, email addresses, Markdown links, and surrounding Unicode text. Extend skill import and app-server configuration import tests to verify that link labels migrate while URL destinations remain unchanged.
GitOrigin-RevId: c4d210a287c99b6440438c99527364d379c568bd
## Why
Prediction forks need to retain their parent's context even when it exceeds the automatic compaction threshold. Compaction or context resets can otherwise replace the history used for the prediction.
## What changed
- Apply a thread-local `AutoCompactionDisabled` policy to experimental prediction forks without changing model or skill budgets.
- Skip automatic compaction before, during, and after turns, including context-limit recovery, and suppress new token-budget reminders.
- Reject `new_context` requests for these threads and report context-limit failures without compacting their history.
## Testing
Add regression tests for legacy and paginated prediction forks across compaction thresholds, unchanged parent compaction and skill/tool inputs, context-limit failures, and rejected context resets. Add a request-history snapshot verifying inherited context and reminders survive without compaction or additional reminders after a tool call.
GitOrigin-RevId: 7df374287f4142f776981bb6c22e5caa564d74a5
## What changed
Add a Linux app-server integration test that resumes a saved read-only thread after the default permissions change to `:danger-full-access`. Verify that the live network proxy honors restored grants, requests approval for a new host, persists the approved rule, and reuses it without another approval.
The test also verifies that proxied requests succeed while direct access remains blocked.
GitOrigin-RevId: 08f63efb8752d738df0ee97e4e98c3366ae54f56
## Why
Restoring unnamed thread permissions after configuration loading leaves network proxy initialization and permission validation using the configured default. A saved read-only thread should also resume when that default is incompatible with current managed requirements.
## What changed
Apply eligible saved permission profiles during configuration loading, before network preparation and final validation. Keep explicit permission overrides and managed requirements authoritative, preserve managed deny-read restrictions, and reject saved external enforcement or materialized filesystem grants. Include the saved profile in the app-server's prepared resume configuration state.
## Testing
Add regression coverage for resuming saved read-only permissions with an incompatible full-access default and for retaining managed, remembered, and newly approved network domains in the restored profile's proxy allowlist.
GitOrigin-RevId: 73e32b0a31ac678fd3f60a8ccf8fa9df627f16c3
## Why
Cold resume can replace saved unnamed permissions with current configuration defaults or recover an executor's permissions from turn context. A first-turn context can also predate an acknowledged settings update.
## What changed
- Restore eligible unnamed permission profiles from settings snapshots owned by the resumed thread, honoring explicit caller overrides and current managed requirements.
- Use owned snapshots as the authority for named permission profiles and reapply workspace permissions for the resumed workspace roots.
- Persist a thread-owned settings checkpoint after the first turn's context, serialized with settings updates so older checkpoints cannot supersede newer settings.
## Testing
Extend regression coverage for cold resume with changed defaults, managed permission restrictions, workspace-root overrides, foreign snapshots, and settings updates during first-turn processing.
GitOrigin-RevId: e411d9fd3d586a4162498c9c77c4184459071bd1
## What changed
- Update the pinned `rmcp` dependency and Cargo/Bazel lockfiles, and migrate MCP handlers and fixtures to `ClientConfig` and `ServerConfig`.
- Stop requiring responses for cancelled elicitation requests in cancellation tests while retaining checks for cleanup and continued connection usability.
- Handle client disconnects during WebSocket writes in the TUI test server, use an asynchronous HTTP mock for loopback proxy testing, and improve remote executor test diagnostics and the Windows subprocess fixture.
- Use `invalid_prompt` for the memory worker failure fixture.
## Testing
Add a regression test covering transport EOF during both form elicitation and user verification. Keep the client alive while checking that pending response channels close, the timeout pause clears, and the service exits with `QuitReason::Closed`.
GitOrigin-RevId: c0166b83fab3b59d84a5207c6630cb6adcf3b230
The initial user item seals realtime transcript segments, so starting speech before it completes can split the segment under test. Wait for its `item/completed` notification and assert that it is a `ThreadItem::UserMessage` before triggering speech, so only the steering under test can split that segment.
GitOrigin-RevId: 932443f4a0d6c4284cf95f44e64912506769a180
## What changed
- Add the disabled-by-default `output_token_replay` feature to request `output.encrypted_content` from OpenAI providers.
- Preserve encrypted message and tool-call output, message and function-call status, and output-text `annotations` and `logprobs` through history and replay. Update the generated protocol schemas and SDK types.
- Strip output ciphertext from requests to other providers while retaining it in stored history, including after replay is disabled. Remove encrypted content from memory extraction inputs.
## Testing
Add integration coverage for the feature/provider combinations, metadata replay across follow-up requests, and history preservation when resuming with replay disabled.
GitOrigin-RevId: 77729a021b6771933402aebe74ece8eb39c057e2
## Why
Graceful shutdown rejects new sessions with an invalid-request error. Give clients a structured shutdown reason and show command center users why session creation is paused.
## What changed
- Add `data: {"reason":"serverShuttingDown"}` to app-server shutdown admission errors while retaining JSON-RPC code `-32600`.
- Show a dedicated shutdown message explaining the wait for active turns and automatic reconnection for non-embedded servers. Recognize older servers by their exact draining message only when error data is absent, and preserve retained-worktree cleanup guidance.
- Keep the command center reconnect presentation when a shutdown error covers the initial overview and no conversation is open.
## Testing
Extend admission and WebSocket shutdown assertions, add embedded and daemon shutdown message snapshots, and cover reconnection with a shutdown error over the initial command center.
GitOrigin-RevId: f167144c0ddc77872afdf3daac8bb1c89f3425b4
## What changed
Pass the parent turn's `cyber_access_program` to Guardian reviewers and asynchronous classifiers. Use `daybreak_blue` for either Daybreak selection, preserve `standard`, and omit `access_programs` when no program is selected.
Capture the selection with the owning turn so asynchronous observations retain it across later turns. Resolve classifier programs using current authentication and the same provider and API-key feature policy as ordinary model requests.
## Testing
Add regression tests for program changes across reused reviewer sessions with API-key and ChatGPT authentication, snapshot and conversation classifiers at low and high risk, and enabled, disabled, and unsupported-provider API-key policies. Verify parent requests retain their selected program.
GitOrigin-RevId: 447f306df3a6bd6805464b819950690c751b04b4
## What changed
Add an optional `retain` flag to `TurnToolOutput` for `turn/start`. When set to `true`, pass the output to the core with a retention annotation to request retention in the thread's model history. The flag defaults to `false`, preserving existing behavior.
Update the generated JSON schemas, TypeScript types, and Python bindings to expose the flag.
## Testing
Add an integration test verifying that a retained tool output reaches the model and preserves client-authored sender metadata in persisted history, including the receiver message ID.
GitOrigin-RevId: 52893a8fcb308f26e77ba8f0bee9990073b26d54
## Why
Interrupted automatic goal continuations reset the empty-response counter, allowing repeated interruptions without activity to keep a goal running indefinitely.
## What changed
Count interrupted automatic continuations without activity toward the existing three-turn limit that marks a goal as `blocked`. Defer evaluation until the thread is idle and serialize it with turn-start accounting. Activity and user turns still reset the counter.
## Testing
Extend accounting tests to cover interrupted and mixed empty continuations, including resets after tool activity or user turns. Add an app-server regression case where a `PreCompact` hook repeatedly interrupts automatic continuations and verify the `thread/goal/updated` notification reports `blocked`.
GitOrigin-RevId: 4c34e3ed1ae612e97cf067c2aa76836b10c50ef5
## What changed
Add `thread/items/read` to retrieve persisted items by `threadId`, `turnId`, and 1–100 `itemIds`. Return matching items in canonical stored order, omitting missing IDs and items outside the requested turn.
Add item ID filtering to the thread store while preserving inherited history and fork cutoffs. Require the experimental API capability for the new endpoint.
## Testing
Add coverage for stored ordering, turn scoping, missing IDs, request size limits, experimental capability gating, and inherited items across fork cutoffs.
GitOrigin-RevId: 9b243dd87577bd4fe36900c388a386b2e26ff2e0
## Why
Clients need to mark threads read or unread without overwriting unseen results or another window's explicit mark.
## What changed
Add `thread/readState/update` for eligible durable local threads, gated by `initialize.capabilities.experimentalApi`. Requests include `threadId`, `expectedRevision`, and an operation of `{type:"read"}` or `{type:"unread"}`.
Marking read clears `firstUnread`; marking unread sets it to `threadStart`. Successful updates return the read state and notify subscribers through `thread/readState/changed`. Both operations require an exact revision match. Stale requests return `-32600` with `readStateConflict` and the current read state, requiring a fresh user action rather than a blind retry. Updates do not change thread recency.
## Testing
Add app-server coverage for experimental capability gating, explicit unread marks and notifications, conflicts for both stale operations, and marking read with a fresh revision.
GitOrigin-RevId: 775f6e9584dc91bd3c2ee9a309144b5baf0edffa
## What changed
Add the experimental `thread/readState/changed` notification with `threadId` and the committed `readState` receipt. Send it to existing thread subscribers when terminal activity updates read state or a revert clears a removed unread position. Emit terminal read-state updates before `turn/completed` so completion remains the last notification for that result.
Expose the notification in generated JSON schemas, TypeScript types, and Python SDK models. Document experimental capability gating, subscription lifetime, notification opt-out, and refreshing receipts when concurrent responses disagree.
## Testing
Extend the read-state integration test to assert that the notification receipt matches the receipt returned by `thread/read` after terminal activity.
GitOrigin-RevId: 28935352a881b7a5e2e7f629173c3b2061bd7941
## Why
Realtime v3 voice validation used the v1 voice list, limiting the available voice choices.
## What changed
- Add a dedicated `v3` voice list containing the v1 voices and 16 additional voices, and use it to validate v3 requests.
- Expose `v3` in `RealtimeVoicesList`, defaulting to an empty list when omitted during deserialization.
- Update the configuration and app-server schemas, generated TypeScript and Python types, and voice-list test expectations.
GitOrigin-RevId: 7fc8060fe01d840f28eb92c3dfe49c5878c3c258
## What changed
- Add experimental `readState` to `thread/read` and a thread-ID-keyed `readStates` map to `thread/list` for eligible durable local user threads. Each receipt contains `firstUnread` and an opaque `revision`.
- Publish new visible terminal results before `turn/completed`, after flushing the rollout. Reading snapshots leaves activity unread; replayed history does not publish new activity.
- Clear unread positions removed by a paginated thread revert while preserving explicit thread-start marks and concurrent receipt updates.
## Testing
Add an integration test covering completed-turn receipts, repeated reads without acknowledgement, matching list receipts, and revert cleanup with a changed revision.
GitOrigin-RevId: e7f6ddfbb1fc2fa95d1ef2876d7f0f7b9f99ff65
## What changed
- Remove `ContentItemMetadata`, provenance and namespace types, and the `content_item_metadata` protocol field while retaining `content_item_kinds` classifications.
- Simplify context fragments, extension contributions, and hook output to carry content without source attribution. Return MCP tool results directly without an attribution wrapper.
- Render context-window hints together in a single text fragment.
## Testing
Update Responses and Responses Lite request assertions to expect content-kind classifications without per-content attribution, and adapt context, hook, and extension tests to the simplified types.
GitOrigin-RevId: 201894cd4c93c6d4b4c41c845e7a9af1dd3c95ca
## What changed
Add `history_initialization` to `x-codex-turn-metadata`, distinguishing `new`, `cleared`, `cold_resume`, `warm_fork`, `cold_fork`, and `supplied_history`.
Classify forks by whether the source runtime is loaded and has not shut down. Preserve the classification for the runtime's lifetime, including warm resumes and compaction. This records how history was initialized; it does not establish whether tool metadata is missing. Reserve the field against client-supplied overrides.
## Testing
Extend coverage for warm and cold forks, cold resumes, warm reconnects, supplied history, WebSocket metadata serialization, and reserved-field filtering.
GitOrigin-RevId: 468153512a84d0f4d4ea742198a29e0fa3873a72
## Why
Durable remote-control RPC changes need to update the managed daemon's launch settings so future launches use the saved preference.
## What changed
- Save non-ephemeral `remoteControl/enable` and `remoteControl/disable` requests to `remoteControlEnabled` in `app-server-daemon/settings.json` for managed daemons.
- Preserve other settings and write updates atomically. Skip persistence when `daemon.lock` is held so concurrent lifecycle operations take precedence without blocking the RPC.
- Leave daemon settings untouched for ephemeral requests and unmanaged servers.
## Testing
Add integration coverage for durable enable and disable, ephemeral requests, and lock contention. Extend the unmanaged-server test to verify that no daemon settings file is created.
GitOrigin-RevId: 2baf261ed62f7c7ad87c9779ffb91c59e923f0f8
## Why
Disabling OpenAI analytics also disabled explicitly configured OTLP metrics collectors. Users should be able to export metrics to their own collectors independently of `analytics.enabled`.
## What changed
Apply the analytics preference only to the built-in `statsig` metrics exporter. Keep custom OTLP HTTP and gRPC exporters enabled regardless of that preference, and use `otel.metrics_exporter = "none"` to disable metrics export. Clarify these settings in config documentation and the schema.
## Testing
Cover exporter selection across explicit and default analytics preferences. Update app-server and daemon telemetry tests to verify custom metrics export with analytics disabled, and worktree tests to disable metrics through the exporter setting.
GitOrigin-RevId: 0c61f0f01e2b694db642ac7e7fd1dac9965c7d96
## What changed
Add the disabled-by-default `guardian_trust_orchestrator_connectors` feature flag. When enabled, Guardian V2 accepts connectors with nonblank IDs from the host-owned plugin service orchestrator as a trusted source without requiring a matching user configuration declaration.
Distinguish orchestrator provenance from user configuration in trusted-tool context. Trust remains scoped to the exact server or connector identity and source; descriptions, outputs, other tools, and other connectors remain untrusted.
## Testing
Add coverage for host-owned connector context, rejection of extension-owned Apps lookalikes and blank connector IDs, source-specific trust metadata, and context token limits. Snapshot the connector approval request history.
GitOrigin-RevId: fbd87dd71110ca7b2b92d50eef02e1e739a74a02
## Why
Subagents should retain the spawning turn's selected skills and plugin choices whether `fork_turns` is `none` or `all`. Capability selection should not depend on copied conversation metadata.
## What changed
- Use a shared child startup path for fresh and history-forked agents, inheriting selected capability roots from the spawning environment snapshot.
- Pass the spawning turn's `disabled_plugin_ids` through both spawn handlers. When omitted, inherit the parent's current choices; explicit lists, including an empty list, override them.
- Resolve the parent before startup so inherited client MCP settings apply even when only the session source identifies the parent.
- Carry plugin choices into delegates with inherited isolation and preserve saved capability roots when resuming a child.
## Testing
Add regression coverage for executor skill listing and reading, plugin MCP registration with both history modes, plugin overrides, capability-root precedence and isolation, and restoring saved child settings after parent settings change.
GitOrigin-RevId: 2a6891a9bc6372fd2d1f30add2b5611f96b60594
## What changed
- Add optional `websocketRequestId` to `environment/add` and send it as `X-Request-ID` on direct WebSocket upgrades, including reconnects. It requires a secure transport or a loopback destination.
- Echo a supplied `X-Request-ID` in the exec-server WebSocket upgrade response.
## Testing
Add coverage for `websocketRequestId` serialization and for handshake header forwarding and echoing, both with and without a request ID.
GitOrigin-RevId: 235303ff7e1150405b7e1158d6024223144e0cc3
## What changed
Support `plugins._default.enabled` with explicit per-plugin `enabled` overrides. Omission preserves existing source and account enablement; configuration cannot activate a plugin disabled at its source. Plugin settings such as remembered tool approvals inherit the default unless `enabled` is explicitly set.
Apply the policy to plugin skills, MCP servers, Apps, and hooks, including selected executor roots and runtime configuration refreshes. Preserve the latest plugin policy when adding MCP dependencies and rebuild hooks when concurrent configuration updates replace their inputs.
Report effective enablement in `plugin/list`, `plugin/installed`, `plugin/read`, and `plugin/share/list`. Remote installation still installs disabled packages, but skips MCP and Apps authentication setup without writing an enablement override.
## Testing
Add regression coverage for default inheritance and explicit overrides, source-disabled plugins, policy refreshes during active turns, disabled or malformed selected plugin roots, and remote installation authentication behavior.
GitOrigin-RevId: 83b70c5b47fc95474fec292f248683f1f887221e
## What changed
- Add `ContentItemMetadata` to distinguish user input, developer instructions, `AGENTS.md`, skills, harness context, and tool-supplied context independently of message role and content classification.
- Keep attribution attached to content through prompt assembly, history processing, and hook-output spilling. Distinguish command hooks from MCP hooks and retain tool namespaces when known.
- Treat missing historical attribution as unknown and send per-content metadata only to Responses Lite.
## Testing
Update request and history assertions to cover attribution persistence and Responses Lite metadata handling.
GitOrigin-RevId: 24e56005f5bdb98bf82f2b3943f29c4c81f3d587
liame-oai