## Why
With deferred execution enabled, rebuilding a step context from the latest
thread environment snapshot could apply a settings update to a turn that was
already in progress.
## What changed
- Preserve each turn's captured environment selections when creating later
step contexts.
- Refresh only the readiness of environments that were already starting, while
retaining their original selection order.
- Apply updated environment selections to the next turn.
## Testing
Add coverage for changing the selected workspace while a turn is paused,
verifying that the active turn keeps its original working directory and the
next turn uses the new one.
GitOrigin-RevId: c6f4388c843384ef045b7abdbc303dcfca11d230
## Why
Durable v2 sub-agents can be lazily reloaded after their root session resumes. The reload path restored the agent identity but did not reapply the agent's selected role configuration.
## What changed
- Recover the agent role from the resumed session source and apply it before reloading the sub-agent.
- Preserve the runtime approval policy, approval reviewer, working directory, and permission profile while applying the role.
## Testing
Extend the cold-resume integration test to verify that the reloaded worker retains its role-defined instructions, model, provider, reasoning effort, and permission profile.
GitOrigin-RevId: a26dbbd2599838ca317326a1223a6a0a9cb2a2ed
## Why
Agent roles can override the model or reasoning effort after the initial
`spawn_agent` configuration is validated, leaving an unsupported combination
unchecked.
## What changed
- Validate the final reasoning effort against model metadata whenever a role
changes the spawned agent's model settings.
- Preserve independently configured subagent defaults when a role does not
override them.
- Apply the same role validation in both multi-agent spawn implementations.
## Testing
Added coverage for independent model and reasoning defaults, instruction-only
roles, and rejection of a reasoning effort unsupported by a role-selected
model.
GitOrigin-RevId: 1885314e9380f778603f067fc04a6225ee963428
## What changed
- Add the experimental `app/read` request for fetching metadata for up to 100
app IDs, with optional display-only tool summaries.
- Preserve first-request order while deduplicating IDs, and report unknown or
unauthorized apps as partial misses.
- Cache metadata by backend and ChatGPT account/workspace identity, refetch
metadata-only entries when tools are requested, and preserve cached records
when a backend request fails.
## Testing
- Cover request serialization, ordering, deduplication, partial misses, caching,
tool-summary refetches, backend failures, cache isolation, and the ID limit.
GitOrigin-RevId: 55fc3281d99291e76d6c4a581e8d11569d3cb1ac
## What changed
- Allow parallel `write_stdin` tool calls to interact with independent terminal sessions.
- Serialize reads and writes within each session so its output buffer and process lifecycle remain consistent.
- Prevent active sessions from being pruned while a `write_stdin` interaction is in progress.
## Testing
- Added unified exec and code mode coverage that uses two terminal sessions concurrently and verifies output from both.
GitOrigin-RevId: 618f5503f4c4670421f680c0f0c27414bc6b2ddd
## What changed
- Emit one final `app/list/updated` notification for an initial cached
`app/list` request so other initialized clients can refresh.
- Suppress duplicate notifications for unchanged cached continuation pages.
- Preserve progressive update notifications for `forceRefetch: true` requests.
## Testing
- Cover notification behavior for cached initial and paginated requests.
GitOrigin-RevId: 54f2d25a0adf6e0707402328b4c81fa5f950cf9a
## What changed
- Remove `codex-realtime-webrtc` from the Cargo workspace and Bazel build,
along with its native WebRTC dependency graph.
- Use `blake3`'s pure Rust implementation on
`x86_64-pc-windows-gnullvm`, where the Bazel lint toolchain cannot
reliably materialize the crate's native x86 assembly archives.
GitOrigin-RevId: c382d888cd7ada7a17a7a0dcbdecbe00744f5055
## Why
An execution environment marked `starting` is not yet usable, but unrelated work can continue while it becomes ready.
## What changed
- Add developer guidance that explains execution-environment isolation and the resources that become available after startup.
- Tell the model to wait only when the current task needs the starting environment.
- Retain the guidance across world-state updates without duplicating it in request history.
## Testing
- Cover world-state transitions, history retention, rollback handling, and deferred-environment request deduplication.
GitOrigin-RevId: f12f9204d4cbddce50a70eb0998beb6b66cd2fa9
## What changed
- Tell the model to call `wait_for_environment` only when a task needs the selected environment's files, commands, or installed capabilities.
- Document that waiting can take several minutes and blocks other tool calls, and direct the model to continue if startup fails.
- Require the exact `starting` environment ID shown in `<environment_context>`.
GitOrigin-RevId: 6b434b835d379318879d5499c365c70598673afd
## What changed
- Represent built-in filesystem policy entries with the same `Path` and
`Special` variants used by other entries.
- Remove generated-default filtering from Windows sandbox policy resolution and
simplify elevated deny-write handling to rely on direct-runtime enforcement
and the legacy policy projection.
- Update protocol conversions, policy transforms, and profile expectations for
the reduced filesystem path model.
GitOrigin-RevId: a65793e6855a03d52a575e82cb3d4b9b2e32db5c
## What changed
- Apply `agents.default_subagent_model` and
`agents.default_subagent_reasoning_effort` when a spawn request does not
provide explicit values, including agent job workers.
- Allow full-history forks to use configured defaults or explicit model and
reasoning-effort overrides while retaining the parent conversation context.
- Preserve the selected model and reasoning effort when an agent role does not
override them.
## Testing
- Cover configured defaults, explicit override precedence, full-history forks,
role application, and agent job workers.
GitOrigin-RevId: b1efa8c9abeee82355088fceef57560433144595
## What changed
- Add a lexical selector that splits compound queries into sentence and connector-delimited views.
- Merge candidates across the full query and its component views, prioritizing their best rank while using full-query rank, view coverage, and stable identifiers as tie-breakers.
- Bound query decomposition and result counts, propagate truncation signals, and include the selector in the shadow-selection experiment.
## Testing
- Add unit coverage for compound-query ranking, single-query compatibility, query splitting, and bounded-input signals.
GitOrigin-RevId: 2442bf7198fc24295cbc270b9d222275ae8a7cc3
## What changed
- Add a character n-gram selector that scores matches across skill names, short descriptions, and descriptions using field weights and inverse document frequency.
- Include the selector in the shadow selection experiment alongside the existing lexical selectors.
- Bound query, document, candidate, and result processing, and report query or candidate truncation through the existing selection metadata.
## Testing
Add unit coverage for related word forms, typos, CJK text without word boundaries, and bounded inputs.
GitOrigin-RevId: 4df60cc661338050eeb7741c716bc1c9f730fedd
## What changed
- Add a bounded BM25 selector that ranks skills across name, short-description,
and description fields, weighting names most heavily and rare terms more highly.
- Run the selector alongside the weighted lexical method in the shadow-selection
experiment, with deterministic tie-breaking and existing per-method metrics.
- Add unit coverage for field weighting, rare-term ranking, unmatched queries,
and input limits.
- Remove the implicit-invocation integration test and its telemetry development
dependency.
GitOrigin-RevId: e5ac6a1f0d6a1f68b194467ef7da48adf4a88d7c
## Why
The `agent_type` argument is only useful when agent roles are configured. Avoid
advertising an inapplicable override in the model-visible `spawn_agent` schema.
## What changed
- Include `agent_type` in the V1 and V2 spawn tools only when configured roles
are available.
- Clarify that `agent_type` is an explicit override and document its interaction
with context forking.
- Remove the unused `agents.support_agent_type` configuration field.
## Testing
- Add coverage for hiding `agent_type` without roles and exposing it when a role
is configured.
GitOrigin-RevId: 32e0f123b15f317e9cdb71774029375bc073d9ad
## What changed
- Add `agents.enabled` as a user override for multi-agent tools while keeping an enabled `features.multi_agent_v2` authoritative.
- Rename the shared spawned-thread limit to `agents.max_concurrent_threads_per_session`, retain `agents.max_threads` as an alias, and apply the setting to both multi-agent backends.
- Add reserved subagent model, reasoning effort, and agent-type settings to the config surface and persist all resolved agent settings in config locks.
- Show the resolved `[agents]` values in TUI debug-config output.
## Testing
- Cover config loading, legacy alias normalization across merged layers, backend-selection precedence, V2 concurrency, and debug output.
GitOrigin-RevId: 2957c954a2e1aef51592768dbbccd56c4bf8f118
## What changed
- Convert MCP text content marked with `_meta["codex/encryptedContent"] = true`
into `encrypted_content` function call output items.
- Prefer the content-item payload whenever encrypted content is present so that
`structured_content` does not replace the encrypted output.
## Testing
- Add a stdio MCP integration test that round-trips mixed plaintext and
encrypted tool output.
GitOrigin-RevId: c3997a16b06ad38ff22b21016ede35b97974d9ec
## What changed
Add `cacheWriteInputTokens` to the usage breakdown in the
`rawResponse/completed` JSON schema, defaulting it to zero. Update the
compaction and turn-start notification expectations for the expanded usage
breakdown.
GitOrigin-RevId: d9232b724d646b803c7f5a64c5daa311f77ad408
## What changed
- Remove `template_id` from MCP tool call items and lifecycle events.
- Remove `templateId` from app-server `McpToolCallAppContext` responses and generated schemas.
- Update protocol conversions, documentation, and existing test expectations for the revised metadata shape.
GitOrigin-RevId: f2b1304eadff661eec3966673ea71206b1542b98
## Why
Forced `rm` commands can appear inside complex shell syntax or use option and wrapper variants that the existing dangerous-command heuristic does not recognize.
## What changed
- Detect literal forced `rm` invocations in control flow, substitutions, pipelines, traps, nested shells, and `sudo` or `env` wrappers.
- Recognize combined, separate, and long-form force options, including when they follow operands.
- Require approval for these commands, or reject them with a safer-alternative explanation when approvals are disabled, even when the sandbox is disabled.
- Preserve existing rejection reasons for other dangerous commands and explicit policy rules.
## Testing
Add unit, policy, and end-to-end coverage for forced `rm` variants, complex shell scripts, approval requests, and rejection messages.
GitOrigin-RevId: e1fabc55324e788bae00ab24aae50d089eb7b058
## What changed
Update the image generation guidance to set a 120-second yield for the
initial code-mode call and subsequent waits, then return the completed result
with `generatedImage(result)`.
GitOrigin-RevId: 85041db27a0b41d830014984518d95fdd2875bed
## What changed
- Track only agent messages with the `final_answer` phase as a turn's final
summary item, so commentary is excluded.
- Recover final answers when items arrive before the turn lifecycle record, and
fall back to phase-less agent messages for terminal turns.
## Testing
- Cover delayed turn lifecycle records and commentary-only turns when listing
summary items.
GitOrigin-RevId: 59d9c7fd23dd32037516883e964cf5869c5932a1
## What changed
- Move migration detection, import orchestration, models, and reporting from
`codex-app-server` into `codex-external-agent-migration`.
- Keep app-server protocol conversion in a dedicated boundary module.
- Organize source-specific configuration, sessions, hooks, plugins, commands,
subagents, and memory handling behind shared migration adapters.
- Relocate and split the migration tests alongside the extracted service.
GitOrigin-RevId: 3378ec2064806a28136d6ac98664ca1d75414a4e
## What changed
- Parse `cache_write_tokens` from response input token details and carry it through token usage aggregation.
- Expose `cache_write_input_tokens` in protocol, app-server, exec, and TypeScript SDK usage events, defaulting it to zero for compatibility with older payloads.
- Report cache-write usage in analytics, metrics, traces, and rollout data alongside existing cache-read usage.
## Testing
- Add coverage for response parsing, usage event output, aggregation, analytics, metrics, and telemetry fields.
GitOrigin-RevId: 634e4fbe3086a8923c0ee13b622573e7d9d221bd
## What changed
- Remove the standalone network proxy config loader, its mtime-based reloader, and their tests.
- Remove the helper exports and MITM action-reference validator used only by that loader.
GitOrigin-RevId: 60895fb4e3461e8c3f19db70869050410a4f5f07
## Why
Windows firewall enforcement is tied to the logon-user sandbox identities. Proxy-enforced commands therefore need the elevated backend even when the configured sandbox mode is the default restricted-token mode.
## What changed
- Select the elevated Windows sandbox backend whenever a command uses the managed network proxy.
- Remove configuration and startup checks that required users or managed requirements to select the elevated sandbox explicitly.
- Start and expose managed network proxy state consistently on Windows.
## Testing
- Verify that proxy enforcement selects the elevated backend for the restricted-token sandbox mode.
GitOrigin-RevId: e01ac052587721c468a8fbcf4e2c7c5a185a3e05
## What changed
- Explicitly shut down and wait for each approval scenario's Codex thread.
- Preserve and return the scenario verification result after shutdown, so cleanup also runs when verification returns an error.
GitOrigin-RevId: 78dfbe657700a47b457ea9abd5efec4edd8f8a25
## Why
Selected capability roots are deduplicated by ID. When ready environments
report the same ID with different locations, silently dropping later roots
hides the conflict.
## What changed
Track each selected root's location while combining thread and ready-environment
roots. Keep the first root for a duplicate ID and emit a warning when a later
root uses a different location.
## Testing
Add a regression test with two ready environments that verifies the first
location is retained and the conflict warning is logged.
GitOrigin-RevId: e51692ae9cd2c3a7f3c1ac50bb8446846f314929
## What changed
- Inherit paginated history mode when spawning or forking a subagent from a paginated parent.
- Load the parent's model context when forking and persist it as an inherited rollout prefix, while excluding that prefix from the child's projected turns, items, and metadata.
- Record the boundary between inherited context and child history, and reject partially initialized paginated subagent rollouts on resume.
- Resume paginated subagents from their stored model context instead of legacy rollout history.
## Testing
Added coverage for fresh and forked paginated subagents, compacted-history forks, model-context resume, inherited-prefix projection, metadata isolation, and incomplete-prefix detection.
GitOrigin-RevId: e57dc37c29aa4aaaf57b052b991be591d730e5ba
## Why
Elevated Windows sandbox setup could turn the built-in read-only protections
for workspace metadata into deny-write paths, creating metadata directories
that did not already exist.
## What changed
- Track whether filesystem permission entries come from a built-in profile or
were explicitly configured.
- Exclude generated metadata defaults from direct Windows deny-write overrides
while continuing to enforce explicit read-only carveouts for the same paths.
- Preserve the distinction while materializing and normalizing permission
paths, without exposing generated defaults as user configuration.
## Testing
Added Windows coverage confirming that elevated sandbox setup leaves missing
workspace metadata absent and still produces overrides for explicit metadata
carveouts.
GitOrigin-RevId: 701bcb229f631b18ab5ced22f3edf6f303d932f3
## What changed
- Let deferred environments provide selected capability roots with their ready signal.
- Validate that those roots have unique, non-empty IDs, belong to the registering environment, and stay within the root limit.
- Include roots from ready turn environments when resolving MCP contributions, and refresh the MCP runtime when the selected root set changes.
- Expose the exact ready root set to MCP contributors so executor plugins become available with their environment.
## Testing
- Cover ready-root propagation, validation failures, replacement isolation, reconnection, and MCP plugin availability refresh.
GitOrigin-RevId: ec3498aab1164824025094e96a9b1063b7b731ad
## What changed
- Detect and import supported Cursor settings, sandbox permissions, MCP servers,
project instructions, hooks, agents, commands, plugins, and recent chat
sessions.
- Update the `/import` flow to check Claude Code and Cursor, prompting for a
source when both have importable data.
- Add `migrationSource` to the app-server detect and import requests so each
operation uses the selected adapter, while retaining `source` for import
attribution and backwards compatibility.
## Testing
- Add coverage for Cursor config conversion, hooks, plugins, session discovery
and conversion, app-server imports, and TUI source selection.
GitOrigin-RevId: a65a1511b6c1c2f9e3e0cfe4f816bb435807282e
## Why
Host skills can change after a thread starts. Subsequent turns need the updated
catalog without reinjecting an unchanged catalog on every turn.
## What changed
- Register the host skill provider in app-server and project its catalog through
a dedicated World State section.
- Render host skills with the existing metadata budget and usage instructions,
including skill-root aliases when available.
- Suppress the legacy host catalog and contextual fragment when World State owns
the catalog, while preserving host skills for explicit and shadow selection.
## Testing
Added an app-server test that installs a host skill at runtime and verifies the
catalog updates once and remains stable on the following turn.
GitOrigin-RevId: 4cacc6b2258fc3cab8499fbdf9aa6ab0324ec10d
## What changed
- Add `source=codex` to requests sent to the OpenAI developer docs MCP endpoint.
- Preserve OAuth discovery URLs and leave clients for other MCP servers unchanged.
## Testing
- Add unit coverage for regular and streaming HTTP requests, OAuth discovery, and non-docs MCP clients.
GitOrigin-RevId: d04e19fe6fc2db0b5cd7bfb429f0cb821c49b28a
## Why
MCP server and app connector declarations live in separate executor-owned files. Reading them sequentially makes remote environments pay the latency of both reads.
## What changed
Load both declaration files concurrently while preserving independent error handling for each result.
GitOrigin-RevId: 067e6d1677987ba52200b759a55cec6129575d4b
## Why
Workspace accounts fetched the paginated connector directory before starting the independent workspace connector request, adding the latency of both request chains.
## What changed
Start the workspace connector request alongside the public directory lookup. Continue to ignore workspace lookup failures and filter hidden workspace apps before merging the results.
## Testing
Add a regression test that blocks the directory response until the workspace request starts, verifying that both lookups overlap and their connectors are returned.
GitOrigin-RevId: fa29023a4154b555a31756054109e706e61c32c0
## What changed
- Correlate MCP server attribution in imported session records with connector
metadata, and persist normalized connector names in the session import ledger.
- Extend `externalAgentConfig/import/readHistories` with connector candidates,
including each connector's display name, imported-session count, and detection
source.
## Testing
- Cover connector detection through the session import and history-read flow.
- Verify candidate aggregation uses the latest import for each source session.
GitOrigin-RevId: 7f1f7f596925b2e6efcd17afd4490148e1ac9ff1
## What changed
- Add a shared test helper that renders before-and-after section states alongside the resulting role and content.
- Convert the agents, environment, apps, and plugins world-state tests to snapshot tables covering absent, unknown, unchanged, changed, and removed states.
GitOrigin-RevId: 03372a5f925d2019f37bf5a5a2f060261899026c
## What changed
- Convert supported plugin command Markdown into generated skills when a plugin is installed.
- Read command sources from the manifest's `commands` field, falling back to the plugin's `commands/` directory.
- Load generated command skills alongside native plugin skills while preferring native skills with the same name.
- Skip commands with unsupported templates, missing descriptions, name collisions, or generated skills larger than 4 KB, and keep migration failures from blocking plugin installation.
## Testing
- Cover default and manifest-configured command paths, stale generated skill cleanup, size limits, native-skill precedence, invalid manifest fields, and non-fatal migration errors.
GitOrigin-RevId: 67d910048544b160b191066569bca69b2b951ebc
## Why
Starting a user turn can wait on remote work. Show the submitted prompt immediately instead of leaving the input invisible during that wait.
## What changed
- Queue optimistic prompt history before app-event submissions and render a frame before starting the turn.
- Preserve the existing submit-failure behavior for direct submissions.
## Testing
- Verify that an initial prompt is added to history before its user-turn event is submitted during session replay.
GitOrigin-RevId: 57f30c6e0067127e6b082a206f7d154fcfef8d7d
## What changed
- Scan up to eight skill roots concurrently instead of loading them one at a time.
- Share scan capacity across host-skill and plugin-skill loads to bound aggregate filesystem work.
- Merge completed scans in input order so root precedence and error ordering remain deterministic.
- Skip canonicalization and parsing work for empty roots.
## Testing
- Add coverage for out-of-order scan completion and shared-capacity blocking.
GitOrigin-RevId: 33a47aaa02aee7fe31a050bb04d51c1e2043d6ae
## Why
Queue-only child-agent updates that arrive around a final answer should not
restart sampling, but they must remain available to the next turn. Explicitly
injected response items still need to reopen the current turn.
## What changed
- Defer queue-only inter-agent mail after a final answer without treating it as
same-turn pending input.
- Re-enable current-turn mailbox delivery when the model requests a follow-up,
a stop hook continues the turn, or a response item is explicitly injected.
- Check for turn-triggering mailbox work after clearing the completed active
turn so pending work can start safely.
## Testing
Added coverage that queued child mail waits for the next user turn and that an
injected response item after a final answer triggers a follow-up request.
GitOrigin-RevId: aa81d00707943284b7ab069b60970e547908c895
## What changed
- Allow `thread/start` to select experimental `historyMode: "paginated"` when the thread store supports turn and item pagination.
- Resume paginated threads with bounded model context and require `excludeTurns: true` instead of loading full history.
- Return `turnsBackwardsCursor` and `itemsBackwardsCursor` from `thread/resume` so clients can hydrate durable history through `thread/turns/list` and `thread/items/list` while newer records arrive through live notifications.
- Reject operations that still require full history, including `initialTurnsPage`, `thread/read` with `includeTurns: true`, `thread/rollback`, and detached review.
- Make item cursors independent of the optional `turnId` filter.
## Testing
- Cover paginated thread start, cold and live resume, backwards cursor hydration, metadata reads, unsupported operations, and stores without pagination support.
GitOrigin-RevId: c42f9b268e29d049843330f474fa3ecde12f5b8a
## Why
Cached MCP tool catalogs must not substitute stale session state for the live
server connection.
## What changed
- Verify `mcpServerStatus/list` waits for replacement stdio server metadata
before combining it with cached tools.
- Verify configurations with remotely sourced environment variables bypass the
tool catalog cache.
- Assert that calls made from cached definitions return output from the live
replacement process.
- Make the stdio test server available to Windows Bazel integration tests.
GitOrigin-RevId: 0e518cd46f0d89af28e3a4e256023b5872e6e2fb
## What changed
- Recognize the experimental `codex/tool-catalog-cache` server capability during MCP initialization.
- When the server advertises `cacheable: false`, clear its shared tool catalog snapshot and prevent subsequent fetches from repopulating the cache.
GitOrigin-RevId: bce98371a68881001d3ab1378fa1548575f2dadc
## What changed
- Add realtime conversation version `v3`, which preserves the V1 Codex Voice behavior while using Frameless Bidi `delegation.*` events.
- Translate audio, transcripts, handoffs, session context, and lifecycle events between the app server and the Frameless Bidi wire protocol.
- Support `v3` over WebSocket and WebRTC, including the Frameless `/live` endpoint, session configuration, headers, and default model selection.
- Update the app-server protocol schemas and documentation for the new version.
## Testing
- Add unit coverage for Frameless event parsing, outbound messages, context chunking, URL construction, and call creation.
- Add app-server end-to-end coverage for WebSocket delegation and WebRTC session startup.
GitOrigin-RevId: 79a3307bc209e1a54582ebd2febc07c909fca016
## Why
Token-budget sessions need a final opportunity to preserve important state before the current context is compacted.
## What changed
- When `auto_compact_fallback_prompt` is configured, reserve `auto_compact_fallback_buffer_tokens` beyond the base auto-compaction limit.
- At the base limit, inject the fallback prompt once as a developer message while keeping the normal tool surface available. Continue reporting zero base-window tokens during this reserve.
- Roll over when the reserve or full model context is exhausted, and skip the fallback when a new context was already requested.
## Testing
Added coverage for using the fallback reserve, rolling over after it is exhausted, and bypassing the fallback for an explicit `new_context` request.
GitOrigin-RevId: 32983ecadc5cb4927e15ecd7b1e896cb52a9ad3b
## What changed
- Track connected and disconnected states across initial remote exec-server connections and reconnection attempts.
- Emit experimental `thread/environment/connected` and `thread/environment/disconnected` app-server notifications for each thread selecting the environment. Each payload identifies the thread and environment; current state is not replayed when a thread starts.
- Stop forwarding connection events when an environment selection is removed or replaced.
## Testing
- Cover connection, disconnection, reconnection, shared-environment notifications, and replacement of a selected environment.
GitOrigin-RevId: 5dd767372363c4a2a8319fc16164be117d5bd20c
