## What changed
- Stop writing Guardian v2 security risk scores to rollout history.
- Treat resumed and forked threads as having no previous Guardian score, so their
first tool approval is classified and reviewed normally.
- Remove the now-unused `codex-history` dependency from the Guardian v2
extension.
## Testing
- Update app-server coverage for new, resumed, and forked threads to wait for
classification completion and verify the expected approval reviews.
GitOrigin-RevId: 74d9caa903a1ff9d38e577b4697b5f8970f11ebb
## What changed
- Pass session-attributed extension metrics to the Guardian v2 sampler.
- Record `codex.guardian_v2.classification.token_usage` histograms for total, input, cached input, cache-write input, non-cached input, output, and reasoning output tokens.
- Preserve token accounting when streamed JSON produces an early score by recording usage from the terminal response in the background.
## Testing
- Cover token metrics through the Guardian v2 extension and the sampler's early-score path.
GitOrigin-RevId: 04fadc07f3b9cbe83f9fa3737536860b5cf5b4be
## What changed
- Add `NODE_REPL_AUTH_TOKEN` to the environment variables that model-reachable child processes cannot inherit.
- Remove the variable case-insensitively after shell environment policy overrides and from explicitly configured child command environments.
- Extend the environment scrubber tests to cover inherited and configured forms of the token.
GitOrigin-RevId: 716c65e0a9e222f705c226b7c86545251d3ea580
## Why
Agent roles should customize a child agent without expanding the authority or changing the provider configuration inherited from its parent session.
## What changed
- Apply only supported role overrides for model behavior, developer instructions, personality, service tier, and capability reductions.
- Preserve parent-owned permissions, model providers, endpoints, MCP servers, notifications, and other unrestricted configuration.
- Keep managed feature requirements effective when a role disables capabilities, and reject symlinked user role files.
- Use the same bounded role application path for both multi-agent implementations and resumed agents.
## Testing
Add coverage for authority preservation, managed feature requirements, symlink rejection, provider inheritance, and provider routing after resume.
GitOrigin-RevId: c528d615b691f9c02bfbc21154d514ea07743010
## What changed
- Execute `mcp_tool` hook handlers through the session's shared MCP runtime, including managed hook configurations.
- Restrict hook calls to already-connected, cataloged, and policy-allowed tools. Unavailable servers fail immediately without starting or reconnecting them.
- Pass session metadata to hook tools, cap hook timeouts by the server timeout, and invoke hooks without model-tool approval or recursive hook dispatch.
- Record handler type and execution mode in hook telemetry, and mark memory as externally influenced after successful or blocking MCP hooks when configured.
## Testing
- Added end-to-end coverage for prompt interpolation, hidden tools, blocking decisions, unavailable servers, thread metadata, approval bypass, and memory-mode handling.
- Added MCP runtime coverage for startup readiness, tool filters, catalog revisions, and managed connector policy.
GitOrigin-RevId: 1647cb801ebc5fa385c7bda9d9c266a389c611b8
## What changed
- Increase the default bounded log queue capacity from 512 to 2,048 entries.
- Raise the default insert batch size from 128 to 512 entries.
- Extend the default periodic flush interval from 2 to 10 seconds.
GitOrigin-RevId: e96be0996152b4a2a84d88c23d36959436685682
## Why
`codex-http-client` is the intended owner of `reqwest`, while direct first-party
dependencies are tracked as migration debt.
## What changed
- Build app-server test HTTP clients through `HttpClientBuilder`.
- Use `http` and `url` types directly where only protocol types are needed.
- Remove `reqwest` from `codex-app-server` and its temporary dependency-policy
exception.
GitOrigin-RevId: ff9f14a54bc20ec1ea39050bbe08c381ee376119
## What changed
- Report the configured Windows sandbox backend and whether denied-read restrictions are active.
- Diagnose incompatible backend policy, incomplete or failed elevated sandbox provisioning, unreadable setup failure reports, and missing, locked, disabled, or expired sandbox accounts.
- Provide issue-specific remediation and promote the sandbox check status and summary to the highest detected severity.
- Export the Windows sandbox setup data needed by the diagnostic check.
## Testing
- Cover missing Linux helpers and malformed or oversized Windows setup failure reports.
- Cover a recorded Windows sandbox refresh failure after setup completed.
GitOrigin-RevId: e965b703578a5c0597dcce9f836d2e1f510ad0c8
## What changed
- Add the under-development `send_async_message` feature, disabled by default.
- Expose the feature key in the generated configuration schema.
GitOrigin-RevId: dd27483f2ef802dba49e47f3ce03146ee6a58f1e
## Why
Submitting a diagnostic report could appear successful without confirming that Sentry accepted the upload, leaving callers unable to detect transport or HTTP failures.
## What changed
- Send report envelopes through the route-aware HTTP client and await the response.
- Reject redirects, propagate transport and non-success HTTP responses, and include the full error chain in upload JSON-RPC errors.
- Add structured logs for upload attempts, successes, and failures without including report contents.
## Testing
Added coverage for successful uploads, rejected responses, blocked redirects, transport failures, and app-server JSON-RPC error reporting.
GitOrigin-RevId: 07b5cfccd7a65f35d51a720537d2cd8962ed6cdb
## What changed
- Show a description and the destination paths affected by each file-change approval.
- Include both source and target paths for moves, format cross-platform paths for display, and show `unavailable` when change details are missing.
- Recover file changes from buffered events and thread snapshots so live and replayed approvals retain their destination details.
## Testing
- Add coverage for active and replayed approvals, moved and cross-platform paths, and the missing-destination fallback.
GitOrigin-RevId: 24f90b313fd8643f90cbead1504c788b140d7fed
## Why
When a local proxy request disconnects before network approval completes, the
owning tool call needs a model-visible explanation instead of remaining tied to
the abandoned request.
## What changed
- Track disconnect timing while plain HTTP and CONNECT requests await policy
decisions.
- Cancel the owning execution and report how long the request waited when it
disconnects before approval completes.
- Preserve an explicit approval outcome when disconnect cleanup runs afterward.
## Testing
Added unit coverage for disconnect tracking and outcome precedence, plus
end-to-end coverage for plain HTTP and CONNECT requests.
GitOrigin-RevId: b354b29bbe86f38e252fcaf529541f177480136b
## What changed
- Add a public `snapshot_script` helper to `codex-shell-command` for Bash,
Zsh, POSIX shell, and PowerShell, returning `None` for Command Prompt.
- Update `codex-core` and its shell snapshot tests to use the shared helper
without changing snapshot behavior.
GitOrigin-RevId: 779b9dc964635b717922ea9f5646b94c4dbb0da1
## Why
Windows sandbox preflight could report success when applying a deny ACE failed,
leaving a detected world-writable path without the intended capability
restriction.
## What changed
- Return errors from `SetEntriesInAclW` and `SetNamedSecurityInfoW`, including the
affected path in ACL API errors.
- Attempt every flagged path, aggregate deny-ACE failures, and fail preflight
after logging them.
- Preserve cleanup of security descriptors and newly allocated ACLs on failure.
## Testing
Added tests that verify ACL API failures are returned and that preflight keeps
processing remaining paths before propagating an error.
GitOrigin-RevId: e2be1c70f72840046dc55760364de7bcf3b1bdc9
## Why
Thread settings could replace an owner-provided environment configuration with
`FromThread`, allowing the thread to take ownership of that configuration.
## What changed
Reject environment settings updates that change an existing owner-provided
configuration to `FromThread`.
## Testing
Cover preview and turn settings updates for pending, ready, and failed
owner-provided environments.
GitOrigin-RevId: c516954819447ceb29e2ff9f29fe781ca101ae54
## What changed
- Add experimental `account/bedrock/discover` and `account/bedrock/setup`
requests to the app-server protocol.
- Define discovery results for AWS profiles and environment credentials, plus
setup inputs for profiles, environment credentials, and access keys.
- Export the new types in the experimental protocol schema. The app server
currently returns `method not found` for both requests because setup is not
yet implemented.
GitOrigin-RevId: 656b4bc11231a417e97041068cecc5dc692786e3
## What changed
- Let model providers identify recoverable authentication errors and refresh their own authentication state before falling back to `AuthManager` recovery.
- Apply provider recovery to both HTTP and WebSocket response requests, with at most one provider-owned recovery attempt per request.
- Preserve existing `401 Unauthorized` handling as the default for providers that do not customize recovery.
## Testing
- Add coverage for successful and failed provider recovery, including the single-attempt bound and preservation of the original unauthorized error.
GitOrigin-RevId: 9a737e3be96354699586f97dd88e544a45082969
## Why
Legacy threads and paginated threads read their displayed names from different metadata. Moving a rollout to paginated history must carry over its legacy-visible name so renamed threads do not lose it.
## What changed
- Load legacy indexed names once for an apply run.
- When promoting a thread, preserve an existing canonical name or copy its distinct legacy title, falling back to the legacy name index.
- Repair missing names when migration encounters an already-paginated rollout.
## Testing
Added migration tests covering preservation from both legacy name sources and repair on a rerun.
GitOrigin-RevId: 5fc526570b1cf358a159ef174c159ac091ccc40f
## What changed
- Add a dedicated developer policy for Guardian reviews of Node REPL browser and computer-use actions.
- Inject the policy once before the first eligible Node REPL approval and retain it when the reviewer session is reused.
- Include Node REPL policy eligibility in the reviewer reuse key so sessions are not reused across incompatible model settings.
- Keep the approval request itself on the generic planned-action format.
## Testing
- Cover first-action injection, reuse after a shell review, repeated Node REPL reviews, and ineligible parent models through the production approval path.
GitOrigin-RevId: bfce190ff8599788aa85e388cc6a959d27fb489c
## Why
A stored permission grant may allow access to a parent while explicitly denying
a child path. A later request for that child must not be treated as already
approved by the broader parent grant.
## What changed
- Compare materialized permission profiles without intersecting away denied or
reopened paths before deciding that a request is preapproved.
- Execute preapproved commands with the stored grant itself so its denied paths
remain enforced.
- Fail closed when permission profiles cannot be materialized.
## Testing
Added unit and integration coverage for turn and session grants across
`exec_command`, `shell_command`, and `apply_patch`, including approval-disabled
and `Never` approval modes.
GitOrigin-RevId: 5455880328a89c7958f859c7ce87805dff9704fb
## What changed
- Replace the minimal default classifier prompt with predictive security-review guidance covering authorization, action risk, untrusted evidence, and browser or computer use.
- Trigger full Guardian review at an `action_risk` score of `0.5` or higher for the new default prompt, while retaining the `0.8` calibration for custom and model-provided prompts unless they specify a threshold.
- Render security policy configuration into prompt templates before enforcing the classifier instruction token limit. Prompts without the policy placeholder retain the existing append-and-truncate behavior.
## Testing
- Cover default, custom, and model-provided prompt thresholds and precedence.
- Verify policy substitution, truncation, sampling requests, and full review at the threshold boundary.
GitOrigin-RevId: 7aad9e2d8c9fbea453dc52147a3d0a46bf191aec
## Why
The Windows PTY implementation probed `conpty.dll` by bare name. Windows could
resolve that lookup to a DLL in the process current directory and load it when
creating a pseudoconsole.
## What changed
Resolve the ConPTY entry points from `kernel32.dll` without probing
`conpty.dll`.
## Testing
Add a Windows regression test that places a compatible `conpty.dll` in the
current directory, creates a ConPTY, and verifies that the DLL was not loaded.
GitOrigin-RevId: be78974362a99dce0c18186cf3e7bbd86a8de73c
## Why
When the app server reports a misalignment policy violation, the TUI must stop the affected chat rather than allow more work to continue in it.
## What changed
- Finalize the active turn, clear queued and draft input, disable the composer, and reject further operations and interactive requests for the stopped chat.
- Interrupt an active side conversation when its parent reports the violation, and prevent queued turns, forks, approvals, or goal resumption from restarting work.
- Show a non-dismissible precaution view that directs users to start a new chat or resume another one, with agent command center navigation for remote sessions.
## Testing
Added coverage for stopped-chat behavior, parent/side-thread handling, blocked goal resumption, navigation actions, and narrow and remote-session rendering.
GitOrigin-RevId: 0268c46a19294a17765ea4099f389f15ffaaf030
## What changed
- Return retained unified-exec output as one contiguous byte buffer.
- Use the buffer directly for sandbox-denial checks, removing intermediate
chunk aggregation and an unnecessary owned string conversion.
- Update the output-retention test to assert the flattened snapshot.
GitOrigin-RevId: 84eacee0166b86d3cb2d6a37e96125977fad0267
## What changed
- Reconnect frameless bidirectional WebRTC sideband sockets after unexpected transport loss with capped exponential backoff.
- Preserve pending text or handoff output and bounded transcript state across reconnects.
- Treat `404 Not Found` and `410 Gone` handshake responses as terminal session completion, and preserve HTTP status information from failed WebSocket handshakes.
- Bound Realtime delegation input and transcript fields while retaining the most relevant portion of each.
## Testing
- Add unit coverage for reconnect backoff, terminal status handling, transport error classification, transcript continuity and truncation, and pending outbound messages.
- Add an end-to-end WebRTC conversation test covering an unclean disconnect, reconnect, transcript reconciliation, outbound progress during sustained inbound traffic, and terminal session completion.
GitOrigin-RevId: 544fd7e542c3434d0bb42cfbcc7143604419a037
## Why
SQLite metadata can identify a rollout through a non-canonical path. When that
path resolves to a rollout already found on disk, archive and unarchive
operations could schedule the same source file to be moved twice.
## What changed
- Deduplicate archive and unarchive moves by canonical source path.
- Cover both operations with metadata-backed tests that use equivalent rollout
paths.
GitOrigin-RevId: d190915264214413667fc2c83d360a7e8504d0aa
## What changed
- Add `codex exec-server forward --connect ws://HOST:PORT` to register an
existing WebSocket exec-server as a remote environment.
- Open a separate destination WebSocket for each authenticated Noise relay
stream and forward complete payloads unchanged in both directions.
- Preserve large messages through WebSocket fragmentation and coordinate
disconnects, close acknowledgements, and pending output delivery.
## Testing
- Cover CLI validation, opaque payload forwarding, disconnect handling, and
destination close behavior.
- Verify commands and large file transfers through the complete relay and
forwarding path.
GitOrigin-RevId: 6e2dccff05b9e3571865611f4d432b0e2b4cdbac
## Why
Guardian sampling uses a pool of WebSockets, while the bridge routes each
connection by thread ID. Each socket therefore needs its own identity instead
of reusing the source thread ID across the pool.
## What changed
- Generate a classifier thread ID for every pooled connection and use it for
request, window, and subagent attribution.
- Preserve the originating thread ID in turn metadata alongside the Guardian
classifier request kind.
- Build request metadata after leasing a connection so retries use the identity
of the socket that carries the request.
## Testing
- Cover unique identities across pooled and replacement connections.
- Verify classifier attribution metadata for extension requests and retries.
GitOrigin-RevId: 1c36207125157ff05cab9487a2fa37bf85e5fdd8
## What changed
- Add an optional `connectorId` to `mcpServer/resource/read`.
- Forward the selected connector through `x-codex-turn-metadata` for threaded and threadless resource reads, restricting hosted app resources to that connector.
- Update the generated protocol schemas and app-server documentation.
GitOrigin-RevId: 5cc94d703abbbb6086665910c1c9ed5dc7075210
## What changed
- Add `intersect_effective_permission_profiles` to derive the permissions shared by an authority profile and a requested profile.
- Preserve the more restrictive filesystem access, read denials, protected metadata paths, temporary-directory access, and network policy.
- Canonicalize concrete paths so symlinks cannot expand authority, and fail closed for policy shapes that cannot be intersected safely.
## Testing
Add coverage for workspace intersections, nested carveouts, deny patterns, unsupported policies, temporary-directory restrictions, symlink escapes, and macOS path aliases.
GitOrigin-RevId: a35bdc47e41afad13630f92c032514b300c14a0d
## What changed
- Emit a `codex.guardian_v2.classification` counter for each classification.
- Record classification latency in `codex.guardian_v2.classification.duration_ms`.
- Tag both metrics with `success`, `failure`, or `superseded` outcomes.
## Testing
- Verify metrics for successful classification and fail-closed handling.
GitOrigin-RevId: 021702f3b26565d6da5708d2b8f1f8881942a441
## What changed
- Give plugin managers for the same cache root a shared semaphore that permits
only one background installed-plugin bundle sync at a time.
- Hold the permit for the lifetime of the spawned sync task and refresh the
installed-plugin cache after a successful local cache change.
## Testing
- Add a test that starts bundle syncs from two plugin managers sharing a Codex
home and verifies that only one request is made.
GitOrigin-RevId: 86c39476c3a9015b9862ab75e8f11f110b0284fc
## What changed
- Add a `NoiseStreamHandler` abstraction that owns payload encoding, decoding,
and connection processing while the virtual stream handles framing,
encryption, and multiplexing.
- Reassemble authenticated payloads as opaque bytes, with the existing
JSON-RPC processor supplied as a handler implementation.
- Have the physical relay send a reset after the current stream instance
closes, including when its processor exits before the writer task.
## Testing
- Verify local JSON-RPC decoding creates the queued request span before queue
admission.
- Verify a processor exit resets the corresponding Noise harness stream.
GitOrigin-RevId: 270befcc8bfbf27e46c84d6a2c6e349cb98ea3f8
## Why
`node_repl` screenshots are nested tool results and do not appear in the parent
conversation history, so Guardian v2 transcript image collection could miss
them.
## What changed
- Allow Guardian v2 to enable bounded, thread-scoped `node_repl` image capture
when transcript images are configured.
- Add retained `node_repl` screenshots to review requests when transcript
sources include tool outputs, while deduplicating images and keeping them out
of the parent turn input.
## Testing
- Add an integration test covering screenshot capture without the synchronous
Guardian transcript feature flags and verifying that screenshots stay out of
the parent request.
GitOrigin-RevId: 5f70c5f2e80389aa8b2a286c3b7f9b1104865486
## What changed
- Pass metrics bound to the active turn's model to approval-review contributors.
- Add counter support to `ExtensionMetrics` while preserving host session attribution.
- Record Guardian v2 tool-call score lag and count stale-score fallbacks with the `score_lag` reason.
## Testing
- Cover counter forwarding and session metadata tags.
- Verify Guardian v2 metric samples for current and stale scores.
GitOrigin-RevId: 0ec34736d29d2e37ed217a27e773b4f6230ae38a
## Why
Repository-scoped imports must not follow redirected Codex paths and write
generated configuration outside the repository.
## What changed
- Reject repository migration scopes when generated configuration paths are
symlinks or, on Windows, reparse points.
- Recheck hook and subagent destinations during import, skipping redirected
directories, files, and dangling links without reporting them as imported.
## Testing
Add service and app-server coverage for redirected generated destinations,
including a repository path replaced with a symlink after detection.
GitOrigin-RevId: 3afb521ead9d76250f0e967eccfdd1dc194f027a
## Why
Guardian sampling WebSockets authenticate when the connection is opened. Reusing
a pooled connection after credentials change can therefore keep using the old
authorization.
## What changed
- Track authentication changes on each pooled sampling connection.
- Discard stale connections after an auth change and reject connections whose
authentication changes while the handshake is in progress.
## Testing
- Verify the sampler reconnects with the refreshed bearer token instead of
reusing its existing connection.
- Verify the installed Guardian extension reconnects after an external auth
refresh.
GitOrigin-RevId: 6d2e7df776fd21c78be0928f71162f5419a8b8f0
## Why
Custom model providers that do not require OpenAI authentication could inherit
ambient authentication headers, including the bearer token and
`ChatGPT-Account-ID`, and send them to the custom provider endpoint.
## What changed
- Resolve providers without `requires_openai_auth` or configured `auth` as
unauthenticated.
- Continue to honor an explicit `experimental_bearer_token` or command-resolved
provider authentication.
- Preserve ambient authentication for OpenAI providers.
## Testing
Added unit and request-level coverage for custom, explicitly authenticated, and
OpenAI provider authentication behavior.
GitOrigin-RevId: d89a79604338bc660a3edb2af0068cfa9b694fa2
## What changed
- Add a Tree-sitter-based lowerer that converts a conservative subset of literal PowerShell commands into argument vectors.
- Reject dynamic expressions, parse recovery, unsupported value conversions, directives, and source outside recognized command nodes instead of guessing their meaning.
- Keep the lowerer alongside the existing production parser for later adoption.
## Testing
- Add fixture-driven coverage for supported literal commands and unsupported or ambiguous syntax, including a dedicated `#requires` rejection test.
GitOrigin-RevId: a6e7acc264ca40df264db4b271e38ae7d89e1ec4
## What changed
- Reject a symbolic link used as the memory root.
- Recursively remove symbolic links before preparing or seeding the memory workspace.
- Remove and reject symbolic links created during consolidation, including when the worker fails, so they cannot affect files outside the workspace.
## Testing
Add Unix startup tests covering pre-existing extension links and links created by both successful and failed consolidation workers.
GitOrigin-RevId: f96e03812773f7beaa16455dd77370ee47d8a71f
## What changed
- Export `read_sensitive_file_to_string` from `codex-exec-server`.
- Require the opened path to be a regular disk file and avoid following its
final symlink component on Unix or reparse point on Windows.
- Read valid UTF-8 file contents asynchronously and return I/O errors for
unsupported inputs.
## Testing
Add tests covering regular files, directories, and symlinks.
GitOrigin-RevId: 68809e94c0d3719e5685c064f9610a0455ffd8d7
## Why
Compaction can remove the tool-call events that associate an MCP app widget with
the tool, account, and URI needed to authorize later resource reads.
## What changed
- Store a bounded MCP resource-origin checkpoint with each compacted rollout.
- Restore the checkpoint when resuming a session so existing widgets remain
readable after compaction and restart.
- Discard saved origins when rollback rewrites history across the compaction
boundary, and reject oversized or invalid checkpoints during restoration.
## Testing
- Extend the app-server MCP resource-origin test to compact a paginated thread,
continue the conversation, and read the original widgets before and after a
restart.
- Verify rollback clears provenance that no longer matches retained history.
GitOrigin-RevId: 7f91c6202fe8d9be21c78dda42fa205937c44263
## Why
App widgets need to read resources using the app and account context of the
tool call that produced them, including after a thread is restored.
## What changed
- Add an optional `originCallId` to `mcpServer/resource/read` requests and
return it on successful scoped reads.
- Track bounded provenance for successful app tool calls in thread history and
use the current tool binding, account link, and app policy when reading the
associated widget resource.
- Reject missing, mismatched, failed, or ambiguous origins, while keeping
app-only tools available for widget reads without exposing them to the model.
## Testing
Add app-server coverage for scoped widget reads across both history modes,
ephemeral and persistent threads, server restarts, app-only visibility, and
invalid origin cases.
GitOrigin-RevId: 11eaefc066b2a3b639599e4cbdef680233d150a2
## What changed
- Exclude descendant-authored `MESSAGE` progress updates from the history retained after remote compaction v2.
- Continue retaining descendant-authored tasks while omitting progress updates and final answers from subsequent requests.
## Testing
- Extend the remote compaction follow-up test to cover descendant progress updates and descendant-authored tasks.
GitOrigin-RevId: 3e3e60bb108d27e99e2a4c222eed4b9d02fd3829
## What changed
Start sampling for automatic idle `UserInput` requests without adding an empty
message to the input queue. Continue queuing automatic response-item input.
GitOrigin-RevId: 5d304aed9e7e165380b29b5b59d9245e97b40659
## Why
Repository manifests and user-configured sources must not be able to claim names reserved for managed or remote marketplaces.
## What changed
- Reject reserved marketplace names from unmanaged sources during discovery, installation, configuration projection, and configured marketplace upgrades, even when source restrictions are disabled.
- Recognize managed marketplaces only at their expected paths. Preserve the required macOS and Windows path equivalences without allowing symlink aliases to inherit managed provenance.
## Testing
- Cover reserved-name rejection for plugin list and install RPCs, configured upgrades, unrestricted policy, and remote marketplace names.
- Cover symlink spoofing and Windows managed-path normalization.
GitOrigin-RevId: a610bdc382857f306dd3e244f0992de2ec279673
## Why
Collaboration guidance can change without changing the active mode or model, such as after a model catalog refresh. Tracking only the mode and model leaves the earlier guidance in retained history.
## What changed
- Include a hash of the rendered collaboration instructions in the world-state snapshot so changed guidance is appended to retained history once.
- Emit one empty collaboration fragment when guidance is removed, preventing stale instructions from remaining active without repeatedly clearing them.
- Refresh legacy snapshots that lack an instruction hash once on resume.
## Testing
Cover same-mode catalog updates, clearing missing or explicitly empty guidance, retained-history behavior, and cold resume from legacy snapshots.
GitOrigin-RevId: 69f690adeccd1fb9794a6b15647e6efae3fec4f6
## Why
Tree-sitter can represent brace expansions, globs, and escaped text as plain
words even though the shell changes them at runtime. Treating their source text
as literal argv could let a command match a safe-command check or allow rule
that does not match what will actually execute.
## What changed
- Reject unquoted Bash and Zsh words containing expansion, glob, or escape
syntax from literal command parsing, including heredoc command prefixes.
- Reject double-quoted escape sequences that the shell removes or interprets,
while continuing to accept quoted metacharacters that remain literal.
- Require approval for affected commands under `UnlessTrusted`, even when a
policy contains an allow rule for the unexpanded source text.
## Testing
Add parser and approval scenarios covering brace expansion, globs, escapes,
Zsh-specific syntax, heredocs, and quoted literals.
GitOrigin-RevId: 31f2c6062680c42ac65362e3f3eebfaaf4eb71da
## What changed
- Add the experimental `autoApprovalReview/strictReviewRequired` app-server notification with the review's `threadId`, `turnId`, and `startedAtMs`.
- Emit it when Guardian v2 leaves an approval review in progress because the action risk is elevated or its score is stale.
- Export the notification through the Rust, TypeScript, and JSON schema surfaces and route it to the associated thread.
## Testing
- Cover strict-review reason tracking for elevated and stale risk scores.
- Verify that high-risk approval routing emits one notification whose identifiers and timestamp match the review-started event.
GitOrigin-RevId: e65352894520bfb756c75b2c95e2e149f9767bb2
## Why
The TUI startup future is large enough to inflate the CLI dispatcher's stack
frame.
## What changed
- Heap-pin the TUI startup future before awaiting it.
- Add a regression test that keeps the `run_interactive_tui` future below 64
KiB.
GitOrigin-RevId: 1f977928117537a5188c4d801517fb4a42e39e15
