## Why
MCP servers must forward sandbox policy unchanged to `codex sandbox --sandbox-state-json`, while interpreting launcher information to find the Codex CLI. Keep those contracts separate so consumers can preserve unknown policy fields.
## What changed
- Accept the experimental `codex/sandbox-state` capability alongside the deprecated `codex/sandbox-state-meta` capability, and send identical policy values under both `_meta` keys.
- Move `codexExecutable` out of the policy into `codex/sandbox-launcher`, supplied only when a verified CLI path is available for a local stdio server.
- Replace stale sandbox metadata while retaining unrelated entries, and remove stale launcher metadata when no launcher is available.
- Document the metadata contract and how servers should forward policy and retain authority for long-lived subprocesses.
## Testing
Update unit and integration coverage for policy serialization, identical state aliases, launcher availability across execution environments, and stale metadata replacement.
GitOrigin-RevId: e544c06e6e023953b1fc8069b7b1affa065262d1
## Why
Rewriting source agent names and instruction filenames inside URLs and email addresses can change their destinations when importing external agent content.
## What changed
Use `linkify` to preserve recognized URLs and email addresses while rewriting surrounding text, including Markdown link labels and titles. Continue migrating instruction filename references to `AGENTS.md`, including relative links and references with line or column suffixes.
## Testing
Add rewrite coverage for URLs, email addresses, Markdown links, and surrounding Unicode text. Extend skill import and app-server configuration import tests to verify that link labels migrate while URL destinations remain unchanged.
GitOrigin-RevId: c4d210a287c99b6440438c99527364d379c568bd
## What changed
- Mark `cli_daybreak` as stable and enable it by default.
- Apply Daybreak to background turns only for eligible OpenAI accounts, allowing API-key accounts when `api_key_cyber_access_programs` is enabled. Preserve saved settings for ineligible accounts and report account lookup failures when Daybreak is enabled for the OpenAI provider.
- Skip inheriting Daybreak configuration when the app server does not support reading effective configuration.
## Testing
Expand dynamic-tool request tests to cover the feature toggle, ChatGPT and API-key authentication, API-key program eligibility, and unsupported configuration reads.
GitOrigin-RevId: 55a57315c9f527f977dd8305ea62d4096ed7dae9
## Why
Pending classifications can outlive the `max_tool_call_lag` window in which their scores are reusable, keeping metadata waits or classifier transports active after the result becomes stale.
## What changed
- Expire pending classifications when tool-call progress exceeds the configured lag allowance, preserving the wrapper discount while nested code-mode actions remain active.
- Cancel metadata waits and sampling in snapshot and conversation modes, including snapshot response drains after an early score.
- Treat expiry as supersession, preserving cached scores and the last completed conversation checkpoint and transcript cursor.
## Testing
Add regression coverage for lag boundaries, active wrapper discounts, transport cancellation before and after early scores, expired requests skipping preparation, and conversation history and transcript deltas surviving cancellation.
GitOrigin-RevId: 892ff13a05fd2b1573cef9842b934d1fc865d951
## Why
Canceled classifier requests need bounded cleanup that preserves received token usage and returns only safe WebSocket connections to the pool.
## What changed
- Own classifier response streams and connection leases together, interrupting dropped responses with a one-second cleanup deadline.
- Require a matching interruption acknowledgement and response completion before reusing a canceled response's socket. Retire sockets on rejection, invalid acknowledgements, or timeout while preserving any received completion and token usage.
- Skip requests canceled before dispatch and return their unused sockets to the pool.
- Distinguish cancellation from ordinary steering, which continues draining without requiring an interruption acknowledgement.
## Testing
Add regression coverage for cancellation, acknowledgement ordering and failures, cleanup timeouts, socket reuse, and token accounting under backpressure. Extend steering tests to cover rejected and missing acknowledgements.
GitOrigin-RevId: c4e7aac49d36cea2c2d0e9f2ba5f6147f67471dd
## What changed
Add transcript select-mode state with an underlined cursor, grapheme-aware movement via arrow keys or `h`/`j`/`k`/`l`, and vertical movement that preserves the preferred display column. Support marking with `v`, Space, or Shift-arrow keys and copying through the existing selection machinery.
Keep the displayed transcript snapshot and reading position paused during selection and after exiting the mode. Add entry and exit methods; this change does not yet bind mode entry to a user-facing key.
## Testing
Add unit tests for initial cursor placement, movement across empty lines and entry boundaries, wrapped text, preferred-column preservation, and Enter behavior with and without a marked range.
GitOrigin-RevId: e5bc380ea0eb6e2c6157ba73ac063d548a7de145
## Why
Encrypted compaction payloads can include sampled-token replay caches that increase their size roughly threefold. Budgeting them as ordinary text can reject checkpoints that fit the model context budget.
## What changed
Use a shared estimate of one token per twelve ciphertext bytes, rounded up, for encrypted `Compaction` and `ContextCompaction` items in history and Guardian context budgeting. Guardian continues to count framing and metadata separately.
Check parent compactions against the configured token budget and a separate hard wire-size limit. Preserve the complete encrypted checkpoint when it fits. The token estimate remains a heuristic and can underestimate legacy checkpoints without replay caches.
## Testing
Add coverage for token-estimate rounding, parent compaction token and wire-size limits, and reviewer continuation with a cached compaction preserved intact.
GitOrigin-RevId: cc18ca29802491865167eef992830efcf93d97da
## Why
Servers can advertise cyber access programs without accepting them for API-key accounts. The TUI must account for server support before exposing those programs.
## What changed
- Check `features.api_key_cyber_access_programs` at startup and when loading models for API-key accounts, clearing `available_access_programs` when forwarding is unavailable.
- Use thread-scoped feature settings after thread creation and honor feature requirements and CLI overrides at startup.
- Refresh account-scoped models when switching to or from API-key authentication or changing API-key thread context, clearing cached access programs while the refresh is pending.
## Testing
Extend session tests to cover enabled and disabled server settings, CLI overrides, and catalog filtering before and after thread creation. Update account-change tests to handle the model refresh.
GitOrigin-RevId: c80de30a0063b84949098d137715d8678bd70587
## Why
Prediction forks need to retain their parent's context even when it exceeds the automatic compaction threshold. Compaction or context resets can otherwise replace the history used for the prediction.
## What changed
- Apply a thread-local `AutoCompactionDisabled` policy to experimental prediction forks without changing model or skill budgets.
- Skip automatic compaction before, during, and after turns, including context-limit recovery, and suppress new token-budget reminders.
- Reject `new_context` requests for these threads and report context-limit failures without compacting their history.
## Testing
Add regression tests for legacy and paginated prediction forks across compaction thresholds, unchanged parent compaction and skill/tool inputs, context-limit failures, and rejected context resets. Add a request-history snapshot verifying inherited context and reminders survive without compaction or additional reminders after a tool call.
GitOrigin-RevId: 7df374287f4142f776981bb6c22e5caa564d74a5
## What changed
Replace `softprops/action-gh-release` in `.github/workflows/rust-release.yml` with explicit `gh` commands:
- Look up the release by tag, including drafts, and fail on API errors.
- Create stable releases as drafts until assets are uploaded. Create prereleases directly to preserve prerelease events.
- Upload sorted assets with `--clobber`, then publish the release with the configured title, notes, prerelease status, and latest status.
- Cap release notes at 124,999 characters, including a trailing newline.
GitOrigin-RevId: f343e4f265b06e047d85fe5a2b89a92690c7a7fb
## Why
A transient Apps MCP startup failure can remove cached tools that the model has already discovered, preventing a later Code Mode invocation from using them.
## What changed
Keep cached Apps tools in the model's tool catalog while startup recovery runs. Let invocation readiness start or join a shared retry before acquiring the tool execution lock, while tool discovery remains nonblocking. Keep recovery running if a waiting invocation is cancelled.
## Testing
Extend connection-manager tests to cover cached tool bindings and shared recovery. Add a Code Mode regression test that discovers a cached Calendar tool, invokes it after startup fails, and verifies that it succeeds after recovery while unrelated tools remain able to execute.
GitOrigin-RevId: e888501a1050884a50a473e71b893cf6672fe256
## Why
Terminal `response.incomplete` errors discard reported token usage. Counting that usage as a new context baseline can also double-count input and trigger unnecessary compaction on the next turn.
## What changed
- Carry the response ID and valid reported usage with incomplete-response errors.
- Record usage for sampling and foreground compaction in cumulative totals, rollout records, budgets, and token-usage contributors without replacing the context baseline. Preserve the original terminal error, including when accounting exhausts the budget or cancellation races the error.
- Charge incomplete background compaction requests to the rollout budget without publishing foreground token usage.
- Ignore missing or malformed usage rather than estimating it.
## Testing
Extend coverage for SSE and WebSocket incomplete responses, rollout usage records, compaction accounting, deferred token-count events, and token-usage contributors. Add regressions for unnecessary compaction on the next turn and background compaction publishing foreground usage.
GitOrigin-RevId: bf1ee6df3912052ab7c19e1c6af8ad3dc4b07675
## Why
The remote exec-server parent-lifetime test can hide an early process exit behind a connection timeout, making startup failures harder to diagnose.
## What changed
- Race the WebSocket connection against the child process exiting so startup exits are reported immediately.
- Include the registration request count and child status when attachment fails, without inspecting request headers or bodies containing authentication data.
- Enable remote exec-server info logging in the test while keeping other logs at error level.
GitOrigin-RevId: 75739fc93d7f28ba0a3f447a14d4d20b2dbdfd14
## What changed
Move child configuration, task path construction, fork usage hints, and backend spawning into `core::thread_spawn`. Add request, result, and error types that distinguish preparation failures from backend errors.
Route the v2 `spawn_agent` handler through the shared helper while retaining tool-specific telemetry, activity events, and response formatting in the handler.
GitOrigin-RevId: a09a8f66beb41c1403220750d236a12717dbfc6c
## Why
`with_executor_hooks` clones the hook registry to create an executor-specific view. Copying the configured handlers, plugin sources, and diagnostics on every clone is unnecessary when that configuration is unchanged.
## What changed
Store hook configuration in `Arc`-backed collections and use copy-on-write when replacing executor-scoped handlers. Skip handler mutation when there are no executor hooks to add or remove.
## Testing
Extend the executor hook registration test to verify that updating a cloned engine leaves the previous engine's handlers unchanged.
GitOrigin-RevId: 6b188ca6ca21772ccd7336344d98c023f769834e
## Why
Cancellation after initial input admission could leave a child registered even though the spawn caller had not received its result.
## What changed
Resolve the child's status and configuration before committing reservations and releasing provisional ownership. This keeps cancellation cleanup active through the final awaits and lets the spawn result return without yielding after commitment. Cancellation after the result returns does not retract the accepted child.
## Testing
Add a regression test that cancels spawn during the final status lookup after input admission and verifies that the child is unregistered, terminated, and unloaded, and that shutdown completes. Extend the provisional-child cancellation test to cover both native V1 and V2 callers.
GitOrigin-RevId: 028b873ad4c1fac2c4b5d1dc823b4561ff19e6bf
## What changed
Allow Guardian Decisions to use `OPENAI_API_KEY` when the default `openai` provider has no custom base URL and neither `CODEX_GUARDIAN_DECISIONS_API_KEY` nor a cached API key is available. Preserve cached API key precedence over the environment fallback.
Report missing credentials as `credentials_unavailable` instead of `provider_error` in Decisions failure metrics.
## Testing
Add tests for cached API key precedence and the environment fallback with ChatGPT authentication. Run each test in a child process to isolate environment changes.
GitOrigin-RevId: fbb772dcb9287d9e1be1b34292ad9bdffeb3d6b3
## Why
Non-parallel tool calls can acquire their lock in either order, making the shared board scenario's `last_message_id` snapshot nondeterministic.
## What changed
Send each `collaboration.post` call in a separate mocked response to order the writes before snapshotting. Update the `board_connections` snapshot and expected request count from 15 to 17 to reflect the additional responses.
GitOrigin-RevId: a290a01f5071a2081d4d0b1531b1b31bfbb8a6e6
Empty drafts need not survive a daemon restart. Update the `discovered`
scenario in `codex-rs/cli/tests/daemon_startup.rs` to rename the thread before
restarting the daemon and include `thread-name` in the status line. Wait for
the confirmed footer name before issuing `/daemon` so the test proceeds only
after the thread is materialized.
GitOrigin-RevId: a91508582826fa1bd0cc7b89d9a1af7e8b4e1999
## What changed
Emit `codex.guardian.review.truncation` counts and `codex.guardian.review.truncation.bytes` histograms after successful input finalization. Aggregate observations across reduction stages by component and disposition (`truncated` or `omitted`), recording original, retained, and omitted byte totals. Exclude feasibility checks and failed retries from loss telemetry.
Keep blocking command-hook cancellation fixtures in the local environment and use double quotes for the Python command.
## Testing
Add metric-export tests covering aggregation across multiple reductions, separate truncation and omission totals, no loss metrics for rejected inputs, and no duplicate reporting on repeated finalization.
GitOrigin-RevId: 69182fc7afe230be69dd2469caedb5ae4494947b
## Why
Remote process exit can arrive before the final output, and inherited pipes can keep the output stream open after exit. Removing the session at exit can lose output that should remain available to `write_stdin` polls.
## What changed
- Retain remote sessions with open or unread output after exit, including early exits and cancelled initial collection.
- Collect pending output when `write_stdin` races with exit, skipping stdin writes once remote exit is known.
- After initial collection finishes and the process exits, allow a five-second grace period before a final background read. Respect active polling deadlines and keep later polls available while that read recovers retained output.
- Let explicit termination stop output collection even when the process has already exited, and install the exit watcher before cancellable cleanup.
## Testing
Extend remote process event tests to cover output arriving after the initial yield, polling during a delayed final read, active polls exceeding the background grace period, resumable cancellation, and termination before the initial yield.
GitOrigin-RevId: b1671fad8b61a2cdecf7cf9fdf92e57c028c7af8
## What changed
- Await a compatible pending background request when foreground compaction is needed, and share the result installation path with foreground requests.
- Validate the captured history generation, prefix length, model, and authentication owner before installing a prepared result. Fall back to foreground compaction when required if the result is rejected.
- Replace only the captured history prefix, preserving later messages, retained tool outputs, goal edits, and the current world-state baseline. Record installation analytics and completion events only after a result is installed.
GitOrigin-RevId: 798963f2fc603c3febba2c21eafa1bcb094b3ebf
## What changed
Add `features.multi_agent_v2.disable_native_tools` to hide native multi-agent tools while keeping the V2 runtime and its instructions enabled for host-provided tools. The option defaults to `false`, preserving existing tool exposure.
## Testing
Extend configuration parsing tests for the new option and parameterize the multi-agent catalog scenario to cover both settings. Add a snapshot showing native tools are absent while the V2 runtime and instructions remain enabled.
GitOrigin-RevId: 21a53584d2395bb678813c876a8b7927bea61c90
## What changed
- Capture history, prompt metadata, routing state, authentication ownership, and context-window identity for background compaction requests.
- Send background requests over HTTP while preserving foreground routing, and retain the latest candidate in session memory.
- Add feature and threshold eligibility checks and deduplicate attempts by history version, model, compaction hash, and authentication ownership.
- Cancel and drain background tasks during session shutdown, preserving completed usage accounting.
The background launch helper is not yet connected to the turn loop.
GitOrigin-RevId: 0e5e6ab7dac4d98a836733668a775ac48b5a59f1
## What changed
- Extract an HTTP Responses executor that can run without owning a turn's WebSocket state, with optional authentication-owner checks.
- Add cancellation-aware compaction output collection that records background token usage against the rollout budget.
- Support installing a compacted history prefix while preserving later history items and placing initial context around real user or agent messages.
- Allow callers to supply a context window for history trimming and a captured window for compaction request metadata.
GitOrigin-RevId: 29f3ca0ae8841f295058feb207e3a225af9a1487
## What changed
Register the disabled-by-default `async_compaction` feature and accept either a boolean or a `[features.async_compaction]` table. Add `model_async_compact_threshold_percent` with a default of 65 and a valid range of 1–100, validated even when the feature is disabled. Setting a threshold alone does not enable the feature.
Expose the threshold in the runtime configuration and update the JSON schema for both configuration forms.
## Testing
Add configuration loader tests covering boolean and table forms, default and custom thresholds, explicit enablement, and rejection of out-of-range values.
GitOrigin-RevId: cf33de76878e7044bc8cf5d146375a07ea9eb078
## What changed
- Reuse `custom_terminal::ModifierDiff` when writing history spans.
- Share the terminal default-color probe and cache implementation between Unix and Windows.
Both changes remove duplicate implementations while preserving existing behavior.
GitOrigin-RevId: 35f8d77ade972b791c6beac0678d2fe2be3aa763
## Why
Policy evaluation and upstream parsers must not select different `Host` field lines from the same request.
## What changed
Return `400 Bad Request` for multiple `Host` headers, including identical values, before policy evaluation, upstream forwarding, or Unix socket routing. Apply the check to both plain HTTP requests and `CONNECT` requests.
## Testing
Add regression tests covering identical and conflicting headers in origin-form, absolute-form, and `CONNECT` requests, verifying rejection without an upstream connection. Also cover single-header forwarding and rejection before Unix socket routing.
GitOrigin-RevId: 8ec95171e120f784629d3121b9a1bedbaf88e7cd
## Why
Saving an Effects preference refreshes the picker. When users toggle repeatedly before saves finish, that refresh can discard newer choices and cause subsequent toggles to use stale values.
## What changed
- Update Effects checkboxes immediately and track pending saves per row, preserving newer choices when an earlier save takes effect.
- Preserve pending Composer stars choices while Animations disables the row, and clear pending state on a regular panel refresh.
- Use the shared list toggle handling for Effects, including Space support, while giving configured key bindings precedence over Space toggling.
## Testing
Add regression tests for repeated toggles across save refreshes, pending Composer stars choices while disabled, clearing pending state, and a Space cancel binding taking precedence over toggling. Update the Effects picker snapshot.
GitOrigin-RevId: 847dcc2dfd40448c7adc56c8c40879db28b1fc39
## What changed
Update `codex-rs/Cargo.lock` and `MODULE.bazel.lock` for `quinn-proto` 0.11.18, replacing 0.11.15. Refresh its resolved dependencies to use `rand` 0.10.1 and `getrandom` 0.4.2, and add `rand_pcg` 0.10.2.
GitOrigin-RevId: 642bdeccbff8017f2f97b640a2b2c48294c97bba
## Why
WSLg clipboard initialization can block indefinitely, and PowerShell clipboard writes can stall while receiving input or exiting. These stalls can prevent subsequent TUI copy requests from completing.
## What changed
- Try the Windows clipboard first for `/copy` and `Ctrl+O` on WSL, falling back to the native clipboard and terminal delivery when needed.
- Give Windows executable discovery and writing a shared five-second deadline, with a separate one-second deadline for native clipboard setup. Reuse pending setup tasks after timeouts to avoid accumulating blocked threads.
- Launch PowerShell through a native shell and stop its process group on write failures or timeouts. Reap the writer before returning so an older copy cannot overwrite a newer one, and suppress stderr that could expose clipboard contents.
## Testing
Add tests for command compatibility, large Unicode input, expired requests, and cleanup of stalled writers and subprocesses. Update routing tests to cover Windows-first copying and native fallback with HTML and clipboard leases.
GitOrigin-RevId: 218c8541a169a16536db0370455e076a31a42b1f
## Why
Inputs arriving during turn finalization could be queued after the final batch had already been drained, or recorded ahead of that batch.
## What changed
Mark active turns as finishing before draining pending input. Reject injection into finishing turns and make late client responses and notifications wait until the final batch is recorded before appending to history. Continue accepting input into turns reserved but not yet started.
## Testing
Extend the task-completion test to block final recording, verify that input admission is closed, and confirm that a late notification is recorded after queued input while preserving the notification truncation budget. Strengthen the retained-tool-output scenario to assert tool output names and ordering.
GitOrigin-RevId: a57e44bd974e60e134183dab989795e2c3538596
## Why
Incomplete responses such as `max_output_tokens` were classified as stream errors, allowing retries and compaction model fallback after the response had hit its output limit.
## What changed
Introduce `ResponseIncomplete` errors that preserve the server-provided reason and stop stream processing immediately. Make these errors non-retryable and stop compaction without falling back to the selected model. Record incomplete responses separately in sampler failure metrics.
## Testing
Add regression tests that verify incomplete responses surface a terminal error without retries over SSE and WebSocket, and that compaction stops without retrying or switching models for both local and remote compaction.
GitOrigin-RevId: 6e107d441b9bf03fa47ea47b88eeb94b71a9f729
## Why
Repeated turn diff notifications can print the same file changes multiple times, including after an unrelated command.
## What changed
Track the last diff and print nonempty updates only when they differ from the previous notification. Remember empty updates so a restored diff prints again, and reset the tracked diff when a new turn starts.
## Testing
Add a stderr snapshot test covering repeated, changed, empty, restored, and new-turn diffs. Add an integration test that applies one edit, runs an unrelated command, and verifies that the diff appears exactly once.
GitOrigin-RevId: db0a2aa8b77b800ca661e7d1314ed1e571743e74
## Why
Hermetic LLVM targets the GNU ABI on Windows even when an MSVC platform is selected. Native MSVC builds need the runner's MSVC toolchains and SDK environment.
## What changed
- Register the local x64 and ARM64 C++ toolchains in `ci-windows-msvc`.
- Apply `--config=ci-windows-msvc` to the native Windows Bazel test job.
- Allow the native Windows test job to run on `workflow_dispatch` as well as pushes to `main` so toolchain changes can be tested manually.
GitOrigin-RevId: b9fbd3f2bba8a3a8bf226cafda19a921c8738acd
## Why
RGB and extended indexed theme colors cannot be displayed directly on 16-color terminals, causing status line items to lose their color accents.
## What changed
Use each status line item's existing ANSI fallback accent when its theme foreground requires RGB or an indexed color beyond the first 16 colors.
## Testing
Add regression coverage for uncolored output with `FORCE_COLOR=0` and ANSI status line accents with `FORCE_COLOR=1`. Give the RGB styling test explicit terminal colors so it consistently exercises true-color behavior.
GitOrigin-RevId: 213ca5c6c366f0a3c696aab256a0b146558a2837
## Why
`TERM_SESSION_ID` is not specific to Apple Terminal. Treating it as an Apple Terminal identifier can mask Windows Terminal detection and the `TERM` fallback.
## What changed
Remove the `TERM_SESSION_ID` detection heuristic. Apple Terminal remains detectable through `TERM_PROGRAM=Apple_Terminal`.
## Testing
Update tests to cover Windows Terminal detection and the `TERM` fallback when `TERM_SESSION_ID` is present, and Apple Terminal detection with its version and user-agent token.
GitOrigin-RevId: 27db11cb7bcca8f94888f9e21a6cdfcf31561b1b
## Why
Pending requests can outlive a session switch, and different threads or connections can reuse request IDs. Replies and resolution notifications must stay associated with the request that prompted them.
## What changed
- Retain the original app-server reply handle for pending and buffered requests, including requests replayed after thread attachment or session reset.
- Scope user input, MCP elicitation, and user verification bookkeeping by thread, and send user input answers to the requesting thread.
- Keep background resolution notifications from dismissing foreground prompts.
- Consume failed replies to closed connections and clear pending replay state without falling through to another request route.
## Testing
Add WebSocket regression tests for direct and buffered approvals with colliding request IDs and replies to closed connections. Extend coverage for foreground prompt preservation and thread-scoped user verification cancellation.
GitOrigin-RevId: 541acb9910e92f6f2e83c27d2a2384185d4f8fec
## Why
Several configuration toggles required restarting Codex, and settings search only filtered the current group. Narrow terminals also truncated setting values and descriptions.
## What changed
- Apply animations, composer stars, paste detection, automatic recaps, and tips without restarting Codex. Update active motion effects and paste detection when their preferences change.
- Group animations and composer stars in an Effects picker that refreshes after saving and requires animations for composer stars.
- Search across all configuration groups, show each result's group, and preserve the query when switching groups.
- Keep setting values visible in narrow terminals and show the selected description below the list. Reserve space to keep the panel height stable and tailor footer hints to the selected action.
- Simplify configuration notices and omit routine save confirmations.
## Testing
Add and update tests and snapshots for live preference saves while offline, paste detection updates, Effects picker refreshes, global search, and stable panel height at narrow widths.
GitOrigin-RevId: 83773da2f6457ce461ef16f0cddde0df640a36c3
## Why
Managed runtime package registration errors lacked the terminal status, separate async and deployment error codes, and deployment activity ID needed to diagnose failures.
## What changed
Include these diagnostics in registration errors and distinguish failures in `GetResults`, the `ExtendedErrorCode` getter, and deployment itself. Preserve the original completion error; failures to read diagnostic fields do not turn successful registration into failure. Keep free-form Windows error text out of diagnostic summaries.
## Testing
Add unit tests for distinct async and deployment errors, failed or canceled result retrieval, and diagnostic getter failures, including preservation of native error codes and omission of free-form diagnostic text.
GitOrigin-RevId: 7f3a46741304ef04f5c3e2aa575bcfc4392dff62
## What changed
Add a Linux app-server integration test that resumes a saved read-only thread after the default permissions change to `:danger-full-access`. Verify that the live network proxy honors restored grants, requests approval for a new host, persists the approved rule, and reuses it without another approval.
The test also verifies that proxied requests succeed while direct access remains blocked.
GitOrigin-RevId: 08f63efb8752d738df0ee97e4e98c3366ae54f56
## Why
Restoring unnamed thread permissions after configuration loading leaves network proxy initialization and permission validation using the configured default. A saved read-only thread should also resume when that default is incompatible with current managed requirements.
## What changed
Apply eligible saved permission profiles during configuration loading, before network preparation and final validation. Keep explicit permission overrides and managed requirements authoritative, preserve managed deny-read restrictions, and reject saved external enforcement or materialized filesystem grants. Include the saved profile in the app-server's prepared resume configuration state.
## Testing
Add regression coverage for resuming saved read-only permissions with an incompatible full-access default and for retaining managed, remembered, and newly approved network domains in the restored profile's proxy allowlist.
GitOrigin-RevId: 73e32b0a31ac678fd3f60a8ccf8fa9df627f16c3
## Why
Windows and WSL can share `CODEX_HOME` without sharing a lock namespace, allowing cleanup to remove another platform's live helpers. Older clients can also clean helpers stored under the shared `tmp/arg0` root.
## What changed
Create helpers under `CODEX_HOME/tmp/arg0-<os>` and limit stale-directory cleanup to that operating system's root. Keep permission discovery compatible with both the current platform's root and legacy `tmp/arg0` directories, while ignoring other platforms' aliases.
## Testing
Add regression coverage for cleanup isolation, live helper preservation during legacy cleanup, and selection of the first session alias directory from either supported root.
GitOrigin-RevId: f34292748b5b1d3c25629604d849db4b133dfa3a
## Why
Local message boards were scoped to an agent tree. Independently created Codex runtimes need a way to share a board while receiving different access permissions.
## What changed
- Add `LocalBoard` and `LocalBoardConnection` so hosts can supply read-only or read-write access through `thread_extension_init`, including for isolated, ephemeral runtimes.
- Allow read-only connections to read and manage their own subscriptions; reject posting, replying, channel creation, and changes to another agent's subscriptions. Expose effective permissions in channel discovery.
- Use unique runtime paths and require matching board IDs and canonical database paths when resolving agents or delivering notifications.
- Document explicit extension installation and connection setup for new runtimes, cold resumes, and forks.
## Testing
Add a scenario and context snapshot covering an independent writer and isolated Guardian sharing a board through a symlink alias, read-only permission denials, subscription and explicit notifications, and rejection of notifications to an unconnected runtime before a post is written.
GitOrigin-RevId: f92410c3a5c6a46920c3e0e71849c85dc83d9c31
## Why
The generic `parent_compaction_error` classification metric does not distinguish serialization failures, oversized compactions, and unusable compactions.
## What changed
Record separate `failure_reason` values for each case: `parent_compaction_serialization`, `parent_compaction_oversized`, and `parent_compaction_unusable`.
## Testing
Extend parent-compaction reuse tests to cover unusable checkpoints in parent-context mode and assert specific failure reasons. Verify rejected compactions receive the maximum risk score, provide no cached approval, and do not reuse stale context.
GitOrigin-RevId: 103c4173b2ebbdc33eb71bce7f8ecb56f73055f6
## Why
Reading `OPENAI_API_KEY` directly bypasses login credentials reloaded by `AuthManager`.
## What changed
Use the API key from `AuthManager`'s cached authentication for Guardian decisions when the provider is `openai` and has no custom base URL. Keep `CODEX_GUARDIAN_DECISIONS_API_KEY` as the highest-priority override.
## Testing
Add a regression test covering a reloaded API-key login, override precedence, and rejection of the login-key fallback for a custom base URL. Assertions avoid printing credentials on failure.
GitOrigin-RevId: 10b2e6c28d3268c3808c25b2be94d9b6c31f597a
## Why
`unsafe-libyaml` is unmaintained and has no patched release. It remains a transitive dependency through `serde_yaml`.
## What changed
Add `RUSTSEC-2024-0449` to the ignore lists in `codex-rs/.cargo/audit.toml` and `codex-rs/deny.toml`. Document the dependency path and require removing the exception when the affected users migrate off `serde_yaml`/`unsafe-libyaml`.
GitOrigin-RevId: 6f4cf32e55d2877d90bf00d2c12a1c85f18d229e
## Why
With `multi_agent_v2.disable_direct_message` enabled, an unavailable agent message board could cause tool router construction to reject the turn.
## What changed
Remove the requirement that the router expose the board's `post` tool. Unavailable board calls return an unsupported-call error to the model, allowing the turn to continue.
## Testing
Update scenario coverage for a disabled board feature, legacy agents, and ephemeral sessions. Assert that unavailable board calls return an error to the model, that `post`, `send_message`, and `followup_task` are not advertised, and that no board database is created.
GitOrigin-RevId: cb9571459c128d84c3c96f185e70c404e0463473
## What changed
Remove eight tests covering experimental API schema filtering and marking,
end-of-file unified diffs, MCP prompt auto-approval, and local-link regex
initialization. Remove the associated unused test imports and regex coverage
comment. Runtime behavior is unchanged.
GitOrigin-RevId: 91f59cab82393d43000eadf4e7c55e3a6ec2aa14
## What changed
Add a unified execution test where `exec_command` yields a session and a subsequent `write_stdin` poll completes after the remote process exits while its output stream remains open. Verify that the poll returns the delayed output and exit code, emits the command completion event, and removes the background session without issuing a `process/read` request.
GitOrigin-RevId: 3a316eb9f6b29682da81a2ecbdda52f659f4b792
Michael Bolin