## What changed
- Remove the `fast_decision` and `full_review` extension hooks and `ApprovalAssessment`, leaving `ApprovalReviewContributor::decide` as the approval decision interface.
- Remove the duplicate Guardian V2 fast-approval implementation and `StrictReviewReason` state.
- Require an explicit `GuardianReviewReason` for synchronous reviews.
## Testing
Migrate Guardian reviewer tests to the production `decide_approval` path and cached-score tests to the registry's decision interface.
GitOrigin-RevId: 1f9092c0ff5bb1eed0c63fa557fb3807e2e71564
## What changed
Resolve `GuardianContextMode` once at session construction and share it across history retention, replay, evidence capture, compaction, and review consumers.
Extract synchronous reviewer context policy and consolidate Guardian V2 parent checkpoint selection so sampling and fast approval use the same eligibility checks. Preserve legacy checkpoint omission and strict compatibility requirements for thread-owned context.
## Testing
Adapt existing review and history tests to the explicit context mode. Move checkpoint tests alongside the extracted selector, retaining coverage for latest-item identity, unusable checkpoints, and complete-item size limits.
GitOrigin-RevId: c73fb6fea556921acfffe758a5f709d7494019dd
## What changed
- Let approval extensions choose between cached approval, synchronous review, and a user prompt for tool and permission requests, while core enforces mandatory Guardian and fresh-review requirements.
- Carry an optional `review_reason` on Guardian assessment events and use it to trigger strict-review notifications, retaining the fallback for older events.
- Require synchronous review when cached evidence has an unusable encrypted parent compaction.
## Testing
Add regression coverage for manual prompts and cached approvals with non-UTF-8 working directories. Update approval contributors in existing tests to use the decision API.
GitOrigin-RevId: a4e66416070bdaa881daa41429c49021629f44c1
## Why
When no healthy pooled WebSocket is available, classification waits for a new connection to open and can stall on its handshake.
## What changed
- Use HTTP streaming when no healthy idle WebSocket is ready, and replenish the pool in the background with a five-minute cooldown after connection timeouts.
- Share concurrency limits and the sampling retry budget across both transports, and bound the wait for HTTP response headers.
- Cancel superseded requests while awaiting response headers and stop SSE polling when the consumer closes.
## Testing
Add coverage for HTTP fallback and recovery after cooldown, shared transport capacity, stalled response headers, and cancellation before headers or during body draining. Update sampler and extension tests to cover fallback after socket expiry, authentication changes, and transient failures.
GitOrigin-RevId: 0b23ccc1bfb2dfdbc8d2791d097706cd4dd44f39
## What changed
Replace `features.guardian_thread_context` with `features.guardianv2.thread_context` and update the configuration schema. The setting controls thread-owned context for synchronous and asynchronous Guardian, defaults to `false`, and remains independent of `features.guardianv2.enabled`.
## Testing
Update configuration tests to cover the nested setting, profile overrides, and enabling thread context while Guardian v2 is disabled. Migrate Guardian approval, history, and async scorer tests to the new configuration key.
GitOrigin-RevId: 54a91555eb68001e0adedc8a07bdbc5ea2273f9b
## Why
Classification metrics report failures without distinguishing their causes, and WebSocket connection attempts lack a dedicated duration metric.
## What changed
- Add `failure_reason` tags to classification counters and duration histograms, covering setup, sampler, and output-processing errors.
- Record `codex.guardian_v2.connection.duration_ms` for WebSocket connection attempts with endpoint, outcome, and failure reason tags.
- Map sampler errors to fixed, low-cardinality categories instead of using error messages that may contain server responses or credentials.
GitOrigin-RevId: bb366be92af2f605643ea7cd527678fa8dbfe53f
## What changed
Capture the ID from `response.created` and pass it as `parent_response_id` in Guardian review and classifier request metadata. Clear the current response ID before sampling retries so tool reviews cannot inherit a failed response's ID.
Request Guardian credits with `guardian_credits_requested` on eligible parent requests. Remove the ticket protocol, transport attachment, and ticket-specific body redaction. Keep ordinary app-server client `parent_response_id` values inside `x-codex-turn-metadata` rather than promoting them to Guardian request metadata.
## Testing
Update coverage for HTTP fallback, WebSocket review reuse, missing response IDs, classifier transport retries, and code-mode yield/resume attribution. Extend app-server tests to verify client metadata placement over HTTP and WebSocket.
GitOrigin-RevId: c1665e56382ecec8d260fc2ca0ecd5e20b0b2391
## Why
Guardian reviews must not lose user authorization constraints or reuse an
unreadable or incompatible parent checkpoint after compaction.
## What changed
- Retain bounded excerpts of oversized root user messages across compaction,
resume, and rollback, and recover excerpts from legacy Guardian history when
available.
- Require thread-owned Guardian review sessions and asynchronous scoring to
reuse only non-empty checkpoints produced by a compatible review model.
- Fail closed instead of reviewing without the required checkpoint when reuse
is disabled, compatibility is unknown, or checkpoint content is unusable.
## Testing
Expanded retained-context, review-session, asynchronous-scoring, and app-server
coverage for oversized instructions, legacy recovery, model incompatibility,
missing content, resume, rollback, and disabled checkpoint reuse.
GitOrigin-RevId: f30d837197e0d838e656a632109f490c38208f5e
## Why
Guardian reviews need the original user instructions even when compaction or
transcript selection removes them from the active conversation window.
## What changed
- Capture complete user messages in host-owned retained context and include them
as ordered authorization evidence alongside verified answers.
- Omit oversized instructions atomically and emit an explicit incomplete-evidence
notice instead of exposing a potentially misleading partial permission.
- Mark user messages inherited by forked agents so they remain model-visible
without becoming child-local authorization.
## Testing
- Cover retained instructions across compaction, resume, rollback, and agent
forks, including oversized evidence and legacy context behavior.
GitOrigin-RevId: 97122509d818c90d2f87c6a1b29c99c05ad0316e
## Why
Guardian reviews for delegated workers need the current root instructions and verified answers even after the parent context is compacted. Approvals must also become stale when that root authorization changes.
## What changed
- Build bounded root review evidence from retained context, preserving source order and answer scope while prioritizing user instructions over optional assistant context.
- Recover retained instructions from Guardian history after compaction and mark authorization incomplete when required instructions or answers are unavailable.
- Version root authorization in synchronous and reusable review sessions so an allow result is cancelled when its evidence changes.
- Strip parent-only Guardian approvals when forking worker history in retained-context mode.
## Testing
- Cover retained and legacy context modes, oversized evidence, message limits, parent compaction, and authorization changes during review.
GitOrigin-RevId: 658219b7cee08f2752adcea9966268fd21727976
## Why
Approval routing must remain available even when the async scorer does not start successfully.
## What changed
- Register a dedicated Guardian approval reviewer before the existing async scorer contributor.
- Reuse eligible cached low-risk evidence, including the initial computer-use allowance, without waiting for a fresh score.
- Route requests to the user when automatic review does not apply, and fall back to a synchronous assessment with the applicable review reason when cached evidence cannot be used.
GitOrigin-RevId: 956427040456bed4c497da952f0bed7f22e93fa6
## What changed
- Extend `ApprovalReviewContributor` with a `decide` hook that can allow an
action, return a synchronous review result, or hand the request to the user.
- Pass contributors the request's approval state and a callback bound to the
existing synchronous reviewer. Review results satisfy the review gate while
the host continues to enforce permissions.
- Add structured reasons for requesting a fresh Guardian review and select the
first contributor decision in registration order.
GitOrigin-RevId: ec84474b3fcbcf1027c8502aa1c2947c10149f9d
## What changed
- Request and parse server-issued Guardian tickets for eligible Codex backend responses.
- Scope each ticket to the response that produced a Guardian review or classifier request, including HTTP and WebSocket retries, without adding it to model-visible or persisted context.
- Validate ticket shape, reserve its metadata keys, redact it from debug and request-body logging, and attach it only at the Guardian transport boundary.
## Testing
- Cover ticket parsing, endpoint and authentication routing, retry scoping, classifier retries, and redaction for compressed and uncompressed requests.
GitOrigin-RevId: 6219dd15c9f19ed3387de516aac1b8e7c9cdb0e3
## What changed
- Add optional per-model Guardian modes for computer use, shell, code mode,
file changes, MCP, network, and permission requests.
- Apply disabled, synchronous, or adaptive review by action category while
preserving legacy configuration when model policy is absent.
- Bind cached risk scores to the active model policy, thread settings, and
environment selections so outdated scores cannot approve later actions.
- Keep unknown review modes on the synchronous path and ignore unknown policy
fields for forward compatibility.
## Testing
- Cover policy serialization, legacy fallback, scoped tool classification,
disabled categories, and score invalidation after policy changes.
GitOrigin-RevId: f334a5f4fffb198da66cde3a400233e0df650516
## Why
Guardian can reuse an opaque parent compaction only when the checkpoint's
recorded producer hash matches the scoring model. Missing or incompatible
provenance must not allow an asynchronous score or cached approval to omit
compacted context.
## What changed
- Record the producing model's compatibility hash on compaction history items
and expose the latest checkpoint hash through conversation snapshots.
- In thread-owned context mode, fail closed and require synchronous review when
checkpoint reuse is enabled but the latest checkpoint is incompatible or has
unknown provenance.
- Reject incompatible checkpoints in the sampler while preserving the legacy
context behavior.
## Testing
Add coverage for local, remote, resumed, compacted, and rolled-back histories,
including matching, mismatched, missing, and empty compatibility hashes.
GitOrigin-RevId: 1ce959cb276edc602fd7dfa442133c7fe5e53857
## Why
Guardian authorization reviews need host-verified `request_user_input` answers to
remain aligned with thread history across compaction, resume, and rollback.
## What changed
- Record verified question-and-answer pairs in retained thread context when
`GuardianThreadContext` is enabled, and source both local and delegated Guardian
review evidence from that context.
- Preserve complete answer records within the evidence budget. Mark authorization
context incomplete when records are unavailable or oversized, and defer cached
fast approvals in that case.
- Keep the existing runtime-only answer path for threads that do not enable the
thread-owned context.
## Testing
- Cover answer retention through compaction and resume, removal after rollback,
source-call eviction, oversized answers, delegated review evidence, and legacy
behavior.
GitOrigin-RevId: 01f6f4541515434a0d00fdde318ff59f2f8bd2eb
## Why
Computer-use-only Guardian scoring should follow the active model's REPL
auto-review requirement, including when the model changes within a live thread.
## What changed
- Run computer-use scoring and fast approval decisions only when the active
model sets `node_repl_auto_review_required`.
- Invalidate prior or in-flight scores when a model switch skips scoring, so
switching back to a reviewed model cannot revive a stale decision.
## Testing
- Cover model switches for both `node_repl` and `cua_repl` MCP servers.
- Verify skipped scoring and stale-score rejection across requirement changes.
GitOrigin-RevId: 46aec4d017bea8f135b435bcd769b87369b8ce95
## Why
Reasoning configuration changes need to retain their position and trusted provenance when model history is persisted and replayed. Client-injected history must not be able to forge these controls.
## What changed
- Add a typed `configuration_update` response item carrying reasoning effort, including custom model-defined values.
- Persist harness-authored updates with provenance and preserve them across history reconstruction, thread resume, raw response notifications, and agent forks.
- Exclude untrusted configuration updates from model history, strip client-supplied provenance metadata, and reject configuration updates supplied as turn input.
- Export the new item through the JSON and TypeScript app-server schemas and classify it in telemetry and persistence metrics.
## Testing
- Cover serialization, provenance persistence, history filtering and rollback, resume reconstruction, and injection attempts before and after restart.
GitOrigin-RevId: eb5559d2b52b7a931621e7c9812f009ff9fb8939
## Why
Compaction replaces the model history window, but host-verified user answers may
still be needed for the rest of the owning thread.
## What changed
- Add bounded, model-invisible retained context for verified
`request_user_input` answers.
- Persist retained context in rollout events and compaction checkpoints, and
restore it when a thread resumes.
- Remove answers when their source turns are rolled back, and prevent
parent-local answers from being inherited by child forks.
## Testing
Add lifecycle coverage for deduplication and size limits, compaction and resume,
rollback, rollout migration, and child forks.
GitOrigin-RevId: c32900d3e8120a9899b71f0576683acd67a4b898
## Why
Another process sharing `CODEX_HOME` can replace an installed plugin version
without invalidating the current process's caches. This could leave skill
listings tied to stale plugin paths and retain obsolete plugin generations.
## What changed
- Reject cached plugin loads when their roots no longer match the active
installation, so skills are reloaded after upgrades or rollbacks.
- Keep the 32 most recently used configuration-based skill snapshots while
allowing callers to continue using snapshots that have been evicted.
## Testing
- Cover external plugin upgrades and rollbacks through `skills/list`, including
a subsequent warm-cache read.
- Cover cache eviction, reuse, and the lifetime of caller-held snapshots.
GitOrigin-RevId: ca00f9539c01461e3945d340bf63f8436665220b
## What changed
- Skip Guardian prewarming and asynchronous scoring when `approvalsReviewer` is
`"user"`, including when the reviewer changes during an active turn.
- Automatically accept ordinary `node_repl.js` execution confirmations in this
mode while continuing to surface sensitive-action checks and requests for user
input.
- Cover transitions between User approval, automatic review, and Full Access in
the app-server integration tests.
GitOrigin-RevId: 599c8ebb672728b9bf3d64c34377ddec230325f8
## What changed
- Emit a `codex_thread_hint_status` analytics event for each native history-notes thread hint attempt.
- Report whether retrieval was successful or failed along with thread context and timing, without including hint contents.
- Treat valid empty responses as successful retrievals while continuing to omit them from the context window.
## Testing
- Extend the app-server history-notes tests to verify success, empty-result success, and backend failure statuses.
GitOrigin-RevId: b9462f312847e8c871ed2be0c8cf8df0928a7fdd
## Why
Full Access already combines `approvalPolicy: "never"` with unrestricted
permissions, so confirmation-only actions do not require a model review.
## What changed
- Detect Full Access consistently across the thread and every selected
environment. Pending, failed, or restricted environments are not treated as
Full Access.
- Approve confirmation-only Guardian and MCP requests without synchronous
review, sampler prewarming, or background scoring. Cancellation, explicit
denials, and forms that require user input keep their existing behavior.
- Re-evaluate the active permission state on each turn so an existing thread
can enter or leave Full Access safely.
## Testing
Added coverage for switching approval modes, strict sensitive MCP
confirmations, failed and pending environments, and suppression of Guardian
requests and background-scoring connections.
GitOrigin-RevId: 089ab4296dde473b8e33ab8324be79c5446c46f6
## What changed
- Emit `codex_guardian_v2_classification` events with the outcome, risk
level, duration, model, and thread attribution.
- Emit `codex_guardian_v2_fast_decision` events when Guardian V2 approves an
action without a full review.
- Add `guardian_v2_enabled` to turn analytics, accounting for review scope
and model requirements.
## Testing
- Extend the Guardian V2 app-server coverage to verify event payloads,
attribution, enablement state, and scoped event emission.
GitOrigin-RevId: 0805975f8e8f9d954aa1058ea8c60545a090ae74
## What changed
- Add `SectionRegistry::compose` to group collected authorization fragments and transcript entries while preserving fragment boundaries and registration order.
- Use the shared composed context in the core Guardian prompt and Guardian V2 synchronous and asynchronous reviewers.
- Keep transcript rendering, retention, and delta handling with each caller while removing duplicated section grouping and authorization rendering.
## Testing
- Cover composition for synchronous and asynchronous targets, including root conversation role handling, trusted user answers, transcript entries, empty context, and contributor failures.
- Verify the synchronous reviewer preserves authorization fragment boundaries in prompt items.
GitOrigin-RevId: 9268343631fd6417bb05a3c0abce883559a37685
## What changed
- Add typed context sections for root-conversation evidence, trusted user answers, and conversation transcripts to `codex-guardian-context`.
- Use the shared section registry when building core Guardian prompts and asynchronous Guardian V2 scoring context.
- Preserve source-role labeling while delivering authorization evidence as user-role context, and fail closed when context collection fails.
## Testing
- Cover shared section ordering and role preservation for synchronous and asynchronous targets.
- Verify trusted user answers appear exactly once as user-role input in Guardian V2 approval flows.
GitOrigin-RevId: 1d5d793ffbf166077411a66e85e039596907fb7e
## What changed
- Add a shared `select_user_messages` helper in `guardian-context` that always
anchors the first user message and fills the remaining token budget from
newest to oldest.
- Use the helper for both core Guardian prompt rendering and the Guardian V2
async scorer so they apply the same retention policy.
## Testing
- Cover empty and single-message transcripts, over-budget anchors, and
newest-first selection across multiple token budgets.
GitOrigin-RevId: 7db246013875263ceb5806d2a6a19b4e2a3db1c4
## Why
Composer drafts include attachments, mention targets, and deferred paste payloads in addition to visible text. Vim undo needs to restore that complete state as a single edit.
## What changed
- Add bounded, draft-level Vim undo history, with `u` as the configurable default binding in normal mode.
- Group complete Vim commands and insert sessions into undo steps, including direct composer changes such as pastes and attachments.
- Preserve undo, repeat, and search state when a reverse-history preview is canceled, and start fresh history when another prompt is accepted.
## Testing
- Cover grouped edits, custom bindings, history and search interactions, attachments, and large paste payloads.
GitOrigin-RevId: 12ecdb3c34a2d66f5d856aa2f82dc15bd91b230b
## Why
Resumed threads need to continue per-turn and per-thread token totals without scanning arbitrarily far beyond the latest compaction checkpoint.
## What changed
- Add durable `TokenUsageRecord` rollout items with response, turn, thread, session, and root-turn attribution.
- Restore accumulated usage on resume and snapshot the latest record plus the compaction response ID in compaction checkpoints.
- Preserve root-turn lineage in persisted turn context, while ensuring forked child threads start with their own usage totals.
## Testing
- Cover usage accumulation across multiple responses and resumed turns.
- Cover local and remote compaction checkpoints, invalid remote compaction output, rollout reconstruction, and fork isolation.
GitOrigin-RevId: ef9e0c4a9102a08a2c382be4cdac68c84353c90a
## What changed
- Add `McpEventStreamManager` to own event stream workers by thread and subscription.
- Wait for activation before completing a start, tag updates with a stream attempt ID, and keep active streams alive independently of their originating runtime.
- Support cancellation and shutdown without depending on output queue capacity, and close streams when MCP access changes or an event server is removed.
- Reconnect reloaded threads to surviving streams so server removal still cancels them.
## Testing
Add coverage for activation, replacement attempts, task reloads, cancellation before activation, full output queues, access changes, and shutdown.
GitOrigin-RevId: b7156bbe62f9375b2138eb62868f052124e2a884
## Why
Event subscriptions may need to outlive the MCP runtime associated with a task.
## What changed
- Add `McpEventStreamOpener`, which retains the hosted Apps MCP connection settings and opens each event stream with an independent client.
- Keep subscription cancellation tied to account changes and removal of the task's event server, including when cancellation ownership is forwarded across runtime replacement.
- Expose the opener and cancellation forwarding through `McpResourceClient`.
## Testing
Add an HTTP transport test that shuts down the runtime, refreshes credentials for the same account, and verifies that a new event stream connects with the current authorization and receives notifications.
GitOrigin-RevId: e102aa382e63121661ff0567f7523515e459922d
## Why
Guardian reviews need the original conversation evidence even after the parent context has been compacted, while rollback must still remove evidence from reverted turns.
## What changed
- Build synchronous and asynchronous Guardian transcripts from the retained review-history snapshot.
- Use the shared Guardian transcript collector for consistent entry formatting, tool attribution, and per-entry truncation while preserving the existing transcript retention budgets.
## Testing
- Add app-server coverage for retaining user and tool evidence after compaction and discarding it after rollback.
- Extend transcript tests for standalone tool outputs, shell calls, attribution, truncation, and retention limits.
GitOrigin-RevId: a18b1176f14a4d006c263aa82d4e593afee66bc3
## Why
Context compaction can replace original conversation items that Guardian still needs to review approval-sensitive actions.
## What changed
- Retain a bounded, chronological review history independently of the model's compacted history.
- Keep separate limits for user messages and other transcript items so tool traffic cannot evict user instructions.
- Use the retained evidence for synchronous and asynchronous Guardian transcripts, while resetting it after rollback or history reconstruction.
## Testing
- Cover retention through compaction and eviction, reset behavior after rollback, independent size limits, and asynchronous transcript construction.
GitOrigin-RevId: c5851e992820504fc18de8cfec7f6f9f1b69f316
## What changed
- Default `tools.update_plan.enabled` to `false`; users can explicitly enable it to expose `update_plan`.
- Remove bundled `update_plan` guidance from model, collaboration-mode, multi-agent, compaction, prewarm, and goal-continuation prompts when the tool is disabled.
- Preserve custom base instructions, model catalog instructions, collaboration policies, and user goal text even when they mention planning or `update_plan`.
## Testing
- Cover default and explicitly enabled tool registration, prompt consistency across request paths, and preservation of custom instructions.
GitOrigin-RevId: a53964e6e72f98e2557dd3090fdb7caccb956527
## Why
The first REPL execution should proceed while its initial asynchronous Guardian
classification is still pending.
## What changed
- Fast-approve the first `js` execution from a Node REPL-backed server while
continuing its asynchronous classification.
- Track `js` executions separately so setup and reset tools do not consume the
first-execution allowance.
- Apply the normal Guardian review policy to subsequent executions.
## Testing
Add coverage for browser and computer-use startup, reset, and module-directory
setup sequences, verifying that only the first `js` execution skips the wait.
GitOrigin-RevId: 7297b35411a6317bcf9e7058c08c6db3e3310ac8
## Why
Compaction and host-injected context can rewrite the model-visible conversation
without changing what the user authorized. Treating those updates as authorization
changes prevents Guardian from reusing an otherwise valid review.
## What changed
- Track a host-owned user-message revision separately from the conversation history
generation.
- Advance the revision for genuine user messages and history resets, while preserving
it across compaction and internal context injection.
- Use message content-kind metadata to distinguish host context from user input,
conservatively treating unknown or incomplete metadata as user authorization.
## Testing
Added coverage that cached Guardian authorization survives compaction and internal
context, but is invalidated by user input and rollback.
GitOrigin-RevId: c7960fa182d1686042c23764d2abc58acbc4b882
## Why
Automatic goal continuations should remain attributable to the turn that created the goal. External input, hook context, or goal edits can make that attribution ambiguous and must not leave stale lineage metadata behind.
## What changed
- Carry the trusted root and previous parent turn through successive automatic goal continuations.
- Invalidate stored lineage when external context reaches an active turn or when a goal is edited or cleared.
- Preserve lineage for async hook results only when they belong to the receiving turn.
## Testing
- Cover goal continuations across intervening user turns and external objective edits.
- Cover active, buffered, and externally injected hook or response context.
GitOrigin-RevId: 22ccc07961cd0ed8f4b17912b7efa416b342bf50
## What changed
- Track failed `exec` attempts whose handler ran for each active goal.
- Mark the goal as blocked after three qualifying failure turns.
- Reset the failure streak when any tool succeeds, and keep failures from carrying over to a replacement goal.
## Testing
- Cover failure classification, streak resets, goal replacement, and end-to-end goal blocking through the app server.
GitOrigin-RevId: 14dac7f4eb35507f12df3b2a82ab97bdafe7b897
## What changed
- Add a positive `output_token_limit` setting to each entry under an MCP server's `tools` configuration.
- Apply the most restrictive limit when plugin and user policies overlap, while keeping approval policy independent.
- Carry the effective MCP output budget in conversation history so tool output, post-tool hook responses, and resumed sessions use the same truncation limit.
## Testing
- Cover configuration parsing, serialization, schema validation, and plugin policy merging.
- Cover MCP output below and above the configured limit, post-tool hook responses, and session resume.
GitOrigin-RevId: d0beb4fca9ba6055d9e1d31c137373b465d50d61
## What changed
- Generate a UUIDv7 turn ID for each Guardian classification and preserve it across retries.
- Record the owning turn as `parent_turn_id` and propagate its trusted `root_turn_id` when known, including through the tool lifecycle extension API.
- Omit ambiguous or unknown root lineage and keep classification identities distinct when reusing Guardian sessions and WebSocket connections.
## Testing
- Cover classification metadata across retries, connection reuse, concurrent samples, auth refresh, and consecutive owning turns.
GitOrigin-RevId: 78757f2ad031844e4b545802f634c678a9ee2298
## What changed
- Assign type-prefixed IDs to Guardian classifier input items before sending the request, preserving existing IDs and reusing generated IDs across WebSocket retries.
- Add a prefixed ID to the memory phase-one user message.
## Testing
- Verify retried Guardian requests contain the same unique, prefixed item IDs.
- Verify the memory phase-one request includes a prefixed user-message ID.
GitOrigin-RevId: e01da49d9a661b6bfd2088f091a3ddf69d601e40
## Why
After switching a thread to a model that requires automatic review, a
standard-scope approval could reuse a cached low-risk score for an action that
skipped classification. This allowed the action to bypass the required full
review.
## What changed
Check the thread's current model requirements before making a fast Guardian
decision. Defer required models to the full review path instead of approving
from cached scoring state.
## Testing
Add coverage for switching to a required model and reviewing a sandboxed
command without running another classification.
GitOrigin-RevId: e79e6a5df19c46acd5c4176f522a859793177639
## What changed
- Convert history backend `images` into `input_image` function-call output items alongside encrypted or plaintext history content.
- Keep image data out of logged output and post-tool-use hook responses.
- Reject malformed image attachments instead of silently dropping them.
## Testing
- Cover encrypted and plaintext outputs, supported image detail values, malformed attachments, and propagation into the next model request.
GitOrigin-RevId: a8eee10eb09c637bcfb06a759dd6313caf707e51
## Why
History and notes results are already limited by the backend using the requested
output budget before encryption. Applying another client-side limit can reject
or truncate an already bounded response.
## What changed
- Return encrypted history and notes results without an additional size check.
- Preserve fallback JSON results instead of truncating them again when building
the tool response.
GitOrigin-RevId: 97e7a59a13e8d485cc3c613d0fdf8073f6eb67ab
## What changed
Return consistent `Unable to perform operation:` messages for provider,
authentication, request construction, transport, and response parsing failures.
Do not include the underlying error details in these user-facing messages.
GitOrigin-RevId: c23fe7713f9d61e5f013ef217e1c0bdc2b824d83
## What changed
- Add `ToolLifecycleContributor::on_mcp_tool_result` with access to the
executed MCP tool context, rewritten arguments, extension data stores, and
mutable server result.
- Run contributors before publishing MCP completion and before preparing the
result for the model, so extensions can inspect or replace successful and
error results.
## Testing
- Cover unchanged, replaced, and error results for direct MCP calls, plus
replaced and error results through Code Mode.
- Verify completion waits for result processing and the processed result flows
to both completion events and subsequent model input.
GitOrigin-RevId: ece7acfe9c5eed4778cb78a29c3ffd06a74e1bcf
Expand Windows deny-read globs robustly across protected directories while preserving filesystem enforcement. Preserve structured MCP tool and resource errors through app-server responses. Bind cached Guardian classifications to current local and root authorization state so stale scores cannot approve actions.
Add regression coverage for the sandbox resolver, structured protocol errors, and authorization changes.
GitOrigin-RevId: 4b80ed724d869afeca79204222d8465fa99d3a24
## Why
Guardian tests could continue after a WebSocket handshake but before the
connection entered the idle pool. The shared request waiter could also miss a
notification delivered between checking the request log and registering its
wait.
## What changed
- Wait for Guardian prewarming to populate the idle connection pool instead of
treating completed handshakes as sufficient.
- Use two initial Guardian connections in tests while retaining eight in
non-test builds.
- Register for request-log notifications before inspecting the log to avoid a
lost wakeup.
GitOrigin-RevId: 88f6a22c5401e03c24e6e114f2563fc641bfef80
## What changed
- Roll token usage from spawned descendants, including nested subagents, into the root goal's usage.
- Apply descendant usage during active and idle progress accounting so it contributes to token budgets.
- Reset descendant accounting baselines when the active goal changes and preserve usage recorded concurrently with a checkpoint.
## Testing
- Cover child and grandchild usage, budget exhaustion, unloaded parent runtimes, goal replacement, idle accounting, and concurrent checkpoints.
GitOrigin-RevId: 8f97ec6778c55b9adf94b887b5fd03999ed0eb94
## What changed
- Lower the default `max_tool_call_lag` from three tool calls to two, causing
older async risk scores to fall back to strict review sooner.
- Update the async scorer integration test to verify score expiration using the
default lag instead of a test-specific override.
GitOrigin-RevId: a07cae3634428a1e64745674eced92fb770f441a
