## Why
MCP inventory can be cached or collected separately from a thread's live
connections, so tool availability alone does not describe the current runtime
state.
## What changed
- Add a nullable `runtimeStatus` to `mcpServerStatus/list` for thread-scoped
requests, covering not-started, starting, connected, authentication-required,
failed, cancelled, and disabled connections.
- Observe published connection state without starting or reconnecting servers,
and return an unknown status when no thread is supplied or the active
configuration no longer matches the published registration.
- Show connection state and tool counts in the compact `/mcp` view while
retaining the detailed inventory in `/mcp verbose` and compatibility with
servers that omit `runtimeStatus`.
## Testing
- Cover runtime status transitions, deferred and disabled servers, closed
transports, configuration changes, protocol compatibility, and TUI rendering.
GitOrigin-RevId: e3bb6efe652f0fa8b3c97d5c53e4729b3a87cd91
## Why
An active root turn needs to be stopped without marking it complete or aborted
before another runtime can recover the same turn ID.
## What changed
- Add `CodexThread::suspend_turn_and_shutdown` and `SuspendTurnOutcome`.
- Flush history, stop the active regular task, close the history writer, and
shut down the session without recording a terminal turn event.
- Reject suspension when no supported turn is active or the loaded agent
subtree still contains a live descendant.
## Testing
- Verify that suspension preserves unfinished history and allows the turn to be
recovered under its original ID after the descendant guard is cleared.
GitOrigin-RevId: 1f9b019d07c51474ec2d991d263bc15cdd4f89ad
## What changed
Propagate canonical denial, timeout, and abort responses from strict MCP
auto-review instead of replacing them with a generic decline. This preserves
the reviewer's action and metadata, including denial rationale, while still
failing closed when no canonical decision is available.
Update the fallback message to direct the agent to request explicit user
approval before proceeding.
## Testing
Add unit and app-server integration coverage for strict auto-review denials
and cancellations.
GitOrigin-RevId: d8126ab223ab546b95e2d984f6e4dd540a324a59
## What changed
- Use the shared approval-policy check for unified exec sandbox escalation so
`require_escalated` commands can prompt when granular `sandbox_approval` is
enabled and remain rejected when it is disabled.
- Add an approval scenario covering sandbox escalation with granular approvals
enabled.
GitOrigin-RevId: 98907960cd9df181e1b2fd9d7fea11fa3c0ed7e6
## What changed
Propagate tool cancellation tokens into Guardian approval reviews so interrupting a tool also aborts its pending review. Apply the same cancellation behavior to server-initiated MCP approval elicitation.
## Testing
Add integration coverage for cancellation from direct tool calls, code-mode turns, background code-mode cells, and MCP elicitation.
GitOrigin-RevId: cbee4b422bbcbf6984e415ef6409cee705beebdc
## Testing
- Verify an executor plugin's `Stop` hook starts running after its environment
attaches and stops after disconnection.
- Confirm hook calls carry the expected session, thread, turn, model, and request
metadata.
- Reject hooks whose MCP server belongs to a different executor environment.
- Cover the current restriction to the first executor environment and handler.
GitOrigin-RevId: ef13baf61379997f117cc57515363cc9880d3724
## What changed
- Add typed `browser_use` settings for history access and per-origin access,
download, upload, and full CDP policies.
- Add typed `computer_use` settings for default app access, macOS bundle IDs,
Windows AUMIDs, and Windows executable identities.
- Expose the merged settings through app-server config reads and generated
Rust, TypeScript, and JSON schemas.
## Testing
- Cover TOML serialization round trips, layered config reads with origin
metadata, and app-server batch writes.
GitOrigin-RevId: 78065f6fec990602071fc81ff639ff97f7ad8cd5
## What changed
- Add trace-level `turn_context.make` instrumentation around turn context
construction.
- Add a trace-level `realtime_conversation.running_state` span around realtime
conversation state checks.
- Skip recording function arguments in both spans.
GitOrigin-RevId: f0b905e75eb487432f56a2efdd65972f5322555d
## What changed
- Retain bounded evidence from completed synchronous Guardian allow and deny reviews and supply it to subsequent Guardian v2 async classifier samples as trusted developer context.
- Keep review evidence isolated from the conversation transcript, escape and truncate its fields, and ignore failed or incomplete reviews.
- Invalidate retained evidence after conversation history rewrites or new user messages, including authorization changes in a worker's root thread.
## Testing
- Cover approved, denied, malformed, and forged review inputs, plus root rollback and authorization-change scenarios.
GitOrigin-RevId: 27817e1fde9a136de727048c4220d148fcf72f42
## What changed
- Scope executor-provided stop-hook calls to the MCP server environment that registered the hook, and reject calls when that environment does not match.
- Forward turn metadata with executor stop-hook requests while retaining the hook call's `threadId` metadata.
## Testing
- Cover environment matching for MCP tool calls and verify executor stop hooks receive their environment ID and request metadata.
GitOrigin-RevId: b544ea3a6ca1f61389fb4597978ed7aac27d529a
## What changed
- Hold all three concurrent turns at a barrier until their Git enrichment is
complete.
- Verify workspace metadata on follow-up requests and associate each result
with its thread ID before comparison.
GitOrigin-RevId: ca3cf52c8e9bd805fbddae676fea0d1bd4064781
## What changed
- Discover inline hooks from executor-provided plugin manifests and accept only
the bundled Computer Use `Stop` hook for `node_repl.turn_ended`.
- Add the accepted hook to the current step's hook engine with
executor-scoped provenance.
- Run executor-scoped hooks in the background after regular stop-hook
decisions, without delaying turn completion, applying control effects, or
exposing them in hook summaries. Skip them when regular hooks only block
continuation.
## Testing
- Added coverage for manifest filtering and option preservation.
- Added coverage for background execution, interaction with regular stop
hooks, and non-blocking turn completion.
GitOrigin-RevId: c0f75f83a23ba8a83bb3a5d5997c4882aacc32d6
## What changed
- Track Git enrichment completion with a watch channel and unblock waiters when enrichment finishes or is canceled.
- Let the test sync tool wait for the current turn's enrichment with a bounded timeout.
- Replace polling in metadata tests and wait for enrichment before asserting workspace metadata in the guardian integration test.
GitOrigin-RevId: 8d35f75a0ebfe412674e1e797c6a13c03b1ea373
## Why
Commands requesting `sandbox_permissions=require_escalated` need a full Guardian review even when they are not marked as retries.
## What changed
- Treat escalated command requests, along with retries, as requiring synchronous Guardian review.
- Bypass extension approval and Guardian V2 shortcuts for these requests.
## Testing
Add an integration test that installs an auto-approving extension and verifies that an escalated command still reaches Guardian and honors its denial.
GitOrigin-RevId: 30eed273460f3c3c6b24d1ce2d29889e34513afd
## Why
Runtime permission updates must not weaken managed filesystem `deny_read`
requirements.
## What changed
- Retain managed deny-read rules separately and merge them into updated
permission profiles.
- Reject permission profiles and legacy sandbox policies that conflict with a
managed denied path.
- Apply the same constraint when `command/exec` handles a request-specific
sandbox policy.
## Testing
- Cover thread permission updates with managed deny-read requirements.
- Cover `command/exec` enforcement for managed and user-defined denies,
including conflicting policy and profile overrides.
GitOrigin-RevId: 5e387b9c1bf1650a21753a74a3338bd33df7d0ce
## What changed
- Add a top-level `allow_browser_and_computer_use` requirement.
- Support browser requirements for history access, automatic review, persistent approvals, and default or per-origin access policies.
- Support computer-use requirements for persistent approvals, default app access, macOS bundle IDs, Windows AUMIDs, and Windows executables.
- Preserve these settings and their sources when composing layered requirements.
## Testing
- Cover deserialization, empty-value detection, source propagation, and layered TOML merging for the new requirements.
GitOrigin-RevId: d14a10b64465f1c54e9bcc3795dc93031e6b029b
## What changed
- Add an extension API for spawning host-owned internal sessions and a
`ThreadReadyInput` lifecycle callback that runs after thread registration.
- Add Guardian reviewer session scaffolding that records the parent thread and
effective model, plus the under-development `guardian_ext` feature flag.
- Start internal sessions with fresh history while preserving parent lineage,
shared session controls, and internal-thread visibility rules.
- Scope internal-session prompt cache keys to their source and parent thread,
and expose `guardian` as an internal session source.
## Testing
- Cover internal-session spawning, parent metadata, history isolation, prompt
cache keys, and extension spawner argument forwarding.
GitOrigin-RevId: 682dae80397d62bb36247796b447042e760ca364
## Why
App-server logs can be persisted or included in submitted diagnostics, so credentials used by model providers, authentication refreshes, and attestation requests must not appear in diagnostic output.
## What changed
- Add `RedactedString`, which preserves serialization and string access while replacing debug output with `<redacted>`.
- Use it for model-provider bearer tokens, header and query values, authentication command arguments, and attestation tokens.
- Avoid logging JSON-RPC error payloads and parser or authentication errors that may echo credentials; retain safe context such as error codes and categories.
## Testing
- Add an app-server regression test that exercises provider credentials, refreshed authentication tokens, and attestation tokens, then verifies none appear in persisted SQLite or submitted diagnostic logs.
GitOrigin-RevId: 8c50408adf94d93847658b1320682cf3b637d2cc
## Why
`EnvironmentConfig.network_policy` could describe attachment-owned traffic
restrictions, but core rejected every configured policy because execution did
not enforce it.
## What changed
- Resolve each remote environment's network policy for the selected command
and apply it to the execution-scoped proxy.
- Compose owner rules with controller constraints and saved network decisions
while preserving inherited domain and Unix-socket denials.
- Keep strict allowlists non-expandable, allow reviewable policies to use
network approvals, and reject sandbox escalation that would bypass an owner
policy.
- Reject policies for local execution, disabled managed enforcement, or a
disabled controller proxy.
## Testing
Added coverage for policy composition, scoped remote proxy behavior, approval
and denial flows, offline execution, and unsupported environment authority.
GitOrigin-RevId: d9331f616df24de6cd13ed68196f0ff7b0ca4dd9
## Why
MultiAgent V2 workers can be reviewed after the root conversation has received
new user authorization that is absent from the worker's own transcript. Guardian
reviews need that genuine user context without treating forwarded or
assistant-authored claims as authorization.
## What changed
- Add the bounded root conversation to Guardian prompts for worker reviews.
- Preserve user and assistant roles, and explicitly treat only root user messages
as authorization evidence.
- Exclude summaries, review artifacts, and assistant commentary from the root
conversation evidence.
- Apply the same evidence to both core Guardian prompts and Guardian V2
classification.
## Testing
Add an integration test covering late root-user authorization, forged role text,
forwarded agent claims, and filtered synthetic authorization.
GitOrigin-RevId: 8846de69ba214a88f58f70675798d324e213427c
## What changed
- Cover object serialization through the `text()` helper directly in the code
mode runtime suite.
- Remove redundant core integration coverage for serialized text and rejected
image outputs.
GitOrigin-RevId: f465b8361e9d725a7246994d9c41e9d01c969011
## Why
Executor-owned MCP configuration can include required servers that are unavailable. Guardian review sessions should not attempt to discover those servers or let them block an approval review.
## What changed
- Skip projecting MCP servers from selected executors when the session source is a Guardian reviewer.
- Preserve executor MCP discovery for regular thread sessions.
## Testing
Added an app-server integration test that configures an unreachable required executor MCP server and verifies that Guardian can still review an escalated command and return its decision.
GitOrigin-RevId: 5b712a3ee04e6896d5ca0cff39a32dd8e0fe0132
## What changed
- Add the under-development `shell_snapshot_v2` feature and advertise executor support through environment capabilities.
- Use executor-managed, in-memory snapshots for eligible direct `bash`, `zsh`, and `sh` login commands, while applying the configured shell environment policy and avoiding duplicate automatic startup-file effects.
- Keep file-backed snapshots available for user-shell commands and fall back to the existing execution path when in-memory snapshots are unsupported or inapplicable.
## Testing
- Cover policy filtering, snapshot reuse without snapshot files, automatic startup files, local and remote execution, and legacy user-shell snapshots.
GitOrigin-RevId: 4ad6cdf13824913ac8c393ba38b9844230677579
## What changed
- Add `chat.toggle_voice_mute` to the configurable TUI keymap and generated configuration schema.
- Let the exec-server version-skew harness build the voice-enabled CLI on Debian-like Linux hosts without preinstalled development metadata by assembling a temporary package sysroot.
- Preserve the existing build path on other Linux environments when the Debian package tools are unavailable.
## Testing
- Add a shell test that verifies a non-Debian Linux environment without voice metadata still proceeds to the Cargo build.
GitOrigin-RevId: 95c5ebc3f85d152a5217dee561286f2be662f79a
## What changed
- Preserve the `required` setting on HTTP MCP servers discovered from a selected executor.
- Cover delayed startup for a required executor MCP server and verify its tool is available on the first turn.
GitOrigin-RevId: df66e12233b8e1aaa7744e29c154157af8dc4776
## What changed
- Read `mcp_servers` configuration and requirements from each selected remote
executor and add eligible HTTP servers to the thread's MCP runtime.
- Bind discovered servers to the thread's concrete executor snapshot and apply
environment MCP policy and requirements. Discovery is best effort, and
executor-local servers are not treated as required at startup.
- Ignore unsupported stdio servers and HTTP configurations that depend on
environment-provided headers or header helpers.
## Testing
- Added an app-server integration test covering discovery, authenticated HTTP
tool invocation, requirements enforcement, and exclusion of stdio servers.
GitOrigin-RevId: 6e1cdcebdbb1cc21a5a2285fbc5617d8d5997182
## What changed
- Cap each `ExecCommandOutputDelta` frame at 8 KiB and stop building frames once the per-call delta quota is exhausted.
- Preserve complete UTF-8 scalars across producer chunks while passing malformed or incomplete trailing bytes through without losing them.
- Append all process output to the transcript independently of delta emission.
## Testing
- Cover split multibyte characters, malformed and trailing bytes, frame and event limits, transcript preservation, and interactive PTY output.
GitOrigin-RevId: ef4100e353df01569a8fbae650c70f439920a2fd
## Why
Clients that create and negotiate realtime calls themselves need Codex to join
those calls without creating another call or overwriting the client-owned
session configuration.
## What changed
- Add the `existingCall` transport to `thread/realtime/start`, accepting a
client-provided `callId` and optional `realtimeSessionId`.
- Attach Codex over the call's sideband WebSocket without SDP negotiation or a
session update, and reconnect that sideband while preserving transcript
state.
- Default existing calls to realtime v1, support v1 and v3, and reject v2 or
options that would reconfigure the client-owned session.
- Encode call IDs as a single URL path segment for v3 sideband connections.
## Testing
Add protocol, app-server, core, reconnection, authentication-header, and URL
encoding coverage for existing-call attachments.
GitOrigin-RevId: 2046b70566f98efa55381bb1e461ea3cc68256c5
## What changed
- Add unbound `previous_permission_mode` and `next_permission_mode` actions to
`tui.keymap.chat` so users can configure shortcuts that cycle through the
available built-in permission modes.
- Apply shortcut selections only to the active session, without writing them
to `config.toml`, and report update failures in the transcript.
- Exclude modes disallowed by managed requirements or platform safety checks,
reject printable-key bindings, and ignore these bindings in project config.
## Testing
- Cover mode cycling, unavailable modes, session-only updates, server errors,
stale threads, keymap validation, and project-config sanitization.
GitOrigin-RevId: c3cfdf1e732b7b7bfe8f53fcac19a37e593bbfab
## Why
Refreshing a Noise rendezvous bundle after an unauthorized handshake inherited
the initial registry lookup's retry count. If that lookup had exhausted its
retries, a transient registry error during the refresh failed immediately.
## What changed
Reset the registry retry count along with the operation deadline before
requesting a replacement bundle after a `401` handshake response.
## Testing
Extend the initial Noise connection test to exhaust the first lookup's retry
budget, receive a `401`, then verify that an offline replacement lookup is
retried and connects successfully.
GitOrigin-RevId: bcfad50ea32d69855f1c2c4c461022b3ecbbd941
## What changed
- Add `context_window_id` to turn metadata for sampling and compaction requests, using the UUID for the model-visible context window.
- Keep the ID stable for requests in the same context window and advance it after compaction, independently of the existing thread-generation `window_id`.
- Reserve `context_window_id` so client metadata cannot override it.
## Testing
- Cover HTTP and WebSocket metadata, remote compaction, token-budget context alignment, resume behavior, and post-compaction window changes.
GitOrigin-RevId: 55cceea377ad509c8dd96ad668f2b5703ea46a63
## What changed
- Skip project-scoped `AGENTS.md` discovery when the active project is untrusted, while preserving user-level instructions.
- Include the active project trust level in the instruction cache key so runtime trust changes reload the applicable instructions.
- Preserve updated project trust metadata during runtime configuration refreshes.
## Testing
Add coverage for initially untrusted projects and for switching between trusted and untrusted states at runtime.
GitOrigin-RevId: 284bf7693943f585013fb5fe4b6aa3309bc50cf3
## What changed
Rename the token-budget configuration key and its Rust field from
`use_history_notes_history` to `use_history_notes_extension`. Update the config
schema, extension gating, explicit-setting detection, and tests to use the new
name consistently.
GitOrigin-RevId: b6a514e23f02095fcd1d35dc42eeb7394b800c77
## Why
Token-budget sessions need a way to recover prior conversation context and preserve working state across context-window transitions.
## What changed
- Add direct-model `history` tools for listing windows and items, reading items, and searching conversation contents.
- Add direct-model `notes` tools for listing, reading, searching, appending, and writing persistent notes.
- Route tool calls through the configured Codex backend with trusted session and agent context, bounded request arguments, and truncation-aware output handling.
- Expose the extension when `features.token_budget.use_history_notes_history` is enabled with an OpenAI provider and Codex backend authentication.
## Testing
- Cover tool registration, configuration changes, provider and authentication requirements, backend request context, encrypted output preservation, and request and response limits.
GitOrigin-RevId: 43b259f01014ba3f30803dd7cd5634942407a9bb
## What changed
- Switch Amazon Bedrock remote compaction to `compaction_trigger` items sent through `/v1/responses`.
- Remove the legacy dedicated compaction protocol from provider capabilities.
- Default remote compaction to unsupported and explicitly enable it for OpenAI, Azure Responses, and Amazon Bedrock providers.
## Testing
- Cover manual and automatic Amazon Bedrock compaction requests and their compacted history.
- Verify remote-compaction capabilities for configured and Amazon Bedrock providers.
GitOrigin-RevId: cf9ba314595367518b37a85f334f0c105ce47e45
## Why
Applying session settings rebuilt and compared a legacy filesystem policy even
when the update could not trigger cwd-based policy rebinding.
## What changed
Compute the legacy projection only for cwd changes whose filesystem policy has
a rebindable project-root write entry. Preserve the existing equivalence check
before rederiving the policy.
GitOrigin-RevId: c428a5c54f1b5b1300be406cac374a6fd29bb9a8
## What changed
- Add `FileSystemSandboxPolicy::has_writable_roots_with_cwd` to detect an
effective writable root without constructing its read-only carveouts.
- Use the helper when classifying permission profiles and selecting patch
rejection reasons.
## Testing
- Verify the presence check matches the existing materialized-root result
across read-only, unrestricted, external, writable, denied, and unresolved
special-path policies.
GitOrigin-RevId: 17ee490aa3180e05732133203f68544d9de5268b
## What changed
- Treat standalone `function_call_output` items without a `call_id` as external context, including items injected into new and forked threads, and mark the thread memory mode polluted when `memories.disable_on_external_context` is enabled.
- Include these outputs in guardian transcripts with their namespaced tool name and a placeholder for non-text content.
- Allow image generation to reuse images from standalone and otherwise unpaired function or custom-tool outputs.
## Testing
- Cover injected thread items, external-context detection, guardian transcript rendering, and recent-image selection.
GitOrigin-RevId: ca4e8c16a4b731e1256a5956908d00f785b4feb1
## What changed
Reuse the shared `build_zsh_fork_test` helper in the unified exec approval
suite and remove its identical suite-specific wrapper.
GitOrigin-RevId: 0593f0e1a56737eba1d491872a44d14e9171dbfb
## Why
External tool events may need to enter thread history without a preceding function call and therefore do not have a `call_id`.
## What changed
- Allow `function_call_output` items to omit `call_id` and carry optional `name` and `namespace` fields.
- Preserve named standalone outputs during history normalization and agent forks while retaining existing pairing behavior for outputs with a `call_id`.
- Accept, persist, and forward these outputs through `thread/inject_items`, and update the app-server schemas and documentation.
## Testing
- Cover paired and standalone JSON round trips, history normalization, agent forks, and injected thread history.
GitOrigin-RevId: a3258163a7dc93777c7c3023116fe204819bdbb0
## What changed
- Add `otel.tool_result.max_bytes`, defaulting to 2048 bytes, to control the
text included in `codex.tool_result` logs independently of model-visible
output limits.
- Apply truncation centrally when emitting telemetry, preserve UTF-8
boundaries, and report whether the logged output was truncated.
- Record typed tool names and namespaces, agent names, and process-local result
sequence numbers while keeping tool arguments and output out of trace events.
## Testing
- Cover configuration propagation, UTF-8-safe truncation, raw tool-output
logging, and log/trace event routing and fields.
GitOrigin-RevId: 89ca76e55f1a09b729e7770ce01f2e4d98f9a22d
## What changed
- Use `exec_command` and `write_stdin` as the shell tool surface.
- Treat legacy `default`, `local`, and `shell_command` model metadata as `unified_exec`.
- Remove obsolete shell-selection configuration and runtime paths while preserving the feature and policy gates for zsh fork execution.
GitOrigin-RevId: d743cbe598630d73052f1fecad680c4cde17977d
## What changed
- Add the hidden Daybreak Blue and Daybreak Red model definitions.
- Refresh model capabilities, instructions, plan availability, and service-tier metadata.
- Configure the auto-review model for Responses Lite and code-mode tools, and update Guardian request tests for the resulting `additional_tools` and developer-message layout.
## Testing
- Update Guardian request snapshots and assertions for initial and follow-up reviews.
- Verify MCP approval routing against the developer-message form of the Guardian prompt.
GitOrigin-RevId: 6680e9abebdcbc43224a81348591e26f8422f3ec
## What changed
- Add `suggestion_id` to plugin install elicitation metadata, using the same
value as the elicitation request ID and plugin-install analytics event.
- Leave connector install metadata unchanged by omitting the field.
## Testing
- Cover plugin and connector metadata serialization.
- Verify that remote plugin install metadata and analytics carry matching
suggestion IDs.
GitOrigin-RevId: 05dd1d210e2a82857094f09d27ecba79ee460b7e
## What changed
- Add experimental `mcpServer/event/stream/start` and `mcpServer/event/stream/stop` requests for hosted apps, plus `mcpServer/event/stream/notification` forwarding.
- Scope subscriptions to the owning app-server connection and subscribed thread, enforce unique IDs and a per-connection limit, and clean them up when the thread is unsubscribed or the connection closes.
- Wait for the MCP active notification before completing startup, retry streams that close immediately, and terminate them when authentication or hosted runtime ownership changes.
## Testing
- Add an app-server integration test covering activation, event forwarding, duplicate subscription rejection, and explicit cancellation.
GitOrigin-RevId: 8a6fc1615adfc5af7e67def3b824fa5909ab3e7b
## What changed
- Remove the legacy `shell_command` handler and runtime, leaving `exec_command`
and `write_stdin` as the shell execution tools.
- Treat legacy `shell_command` model metadata as `unified_exec`, and normalize
legacy user opt-outs so they do not disable command execution. Managed feature
requirements and `shell_tool` can still disable it.
- Preserve shell approvals, sandboxing, zsh-fork support, and output truncation
through the unified execution path.
## Testing
- Cover legacy configuration and model-metadata compatibility.
- Exercise unified shell execution, approvals, truncation, and `apply_patch`
serialization across the app-server and core test suites.
GitOrigin-RevId: 5c2fd6164fc3519cdae4944cb9db276b8467311c
## What changed
- Add the `shellSnapshotV2` executor capability and an optional shell snapshot request to `ExecParams`.
- Capture and restore Unix shell state and profile exports from an in-memory, attachment-scoped cache for `bash`, `zsh`, and `sh`.
- Apply environment policies, runtime `PATH` entries, sandbox context, and live managed-proxy settings when preparing restored commands.
- Bound snapshot size, capture time, scope length, and cache capacity, and fall back to the original command when capture fails.
## Testing
- Cover local, remote, TTY, sandboxed, and supported-shell execution, plus environment filtering, proxy handling, in-memory reuse, and capture failure fallback.
GitOrigin-RevId: 624f747972c249c88c6f10f42cf0af97b75b5541
## What changed
- Add `additional_developer_instructions` to managed requirements and expose it through `configRequirements/read` as `additionalDeveloperInstructions`, independently of ordinary developer instructions.
- Include the managed instructions in model context, emit explicit replacement or removal messages when requirements change, and preserve the current value across compaction, resume, and agent forks without duplication.
- Reject managed instructions whose rendered context exceeds 10,000 estimated tokens.
## Testing
- Cover requirements layering and API serialization, context updates and removal, size validation, repeated model requests, compaction and resume, rollout migration, and agent forks.
GitOrigin-RevId: bc0b70fb7988944c2f68176dff55f5ed61eb46c8
## What changed
- Add `resolve_permission_profile_selection` to select the effective profile using configured defaults, managed requirements, and allowlists.
- Return the merged configured and managed profile catalog without compiling platform-specific paths, leaving path interpretation to the executor.
## Testing
- Verify that a managed default overrides a configured default while preserving Windows-style paths.
- Verify that an allowlisted but undefined profile is rejected.
GitOrigin-RevId: 0172193d48f0346522f931d3b806054895d199c0
## What changed
- Make `ExecutorFileSystem::walk` a required backend operation instead of
providing a fallback built from directory reads and metadata requests.
- Implement bounded local walks on a blocking task with cancellation, symlink
cycle detection, deterministic ordering, error collection, and response-size
limits.
- Have remote filesystems use the server's walk operation directly.
## Testing
- Cover local and remote handling of invalid roots and limits, directory
symlinks, non-UTF-8 names, cancellation, sandbox contexts, and response
budgets.
GitOrigin-RevId: 7499bf05080c3f9965a5eb7ffd593de604d62c2a
