## Why
Resumed threads can carry a persisted capability-root location that no longer
matches the location reported by the attached executor.
## What changed
- Refresh matching thread-owned capability roots from the live environment while
preserving persisted roots when the executor reports none.
- Use the same merge behavior for capability-root inspection and per-step MCP
resolution, without changing owner-configured root precedence.
## Testing
Extend the remote-environment resume test to cover both an executor-provided
replacement root and the persisted-root fallback.
GitOrigin-RevId: 0c66195b2406f431a2e156e00d5225a8d22d18b2
## What changed
- Add `rejection_instructions` and `timeout_instructions` to catalog-provided auto-review messages.
- Use the acting model's instructions for denied and timed-out reviews across tool approvals, shell escalation, and MCP elicitation responses.
- Fall back to the existing instructions only when a catalog value is absent, while preserving explicit empty-string overrides.
## Testing
- Cover catalog overrides, legacy fallbacks, empty values, and separation between acting-model and reviewer-model messages.
GitOrigin-RevId: c5b2c2dbdaefd45d1d658651dd1abaeb6d8c93da
## What changed
- Emit started and completed collaboration tool events for multi-agent v2
`spawn_agent` calls, including failed invocations.
- Record execution duration and successful child-agent configuration metadata
without including the spawn prompt.
- Deduplicate collaboration and subagent activity items by call ID when
calculating per-turn subagent tool counts.
## Testing
- Extend the app-server multi-agent v2 integration test to cover successful
and failed spawn telemetry, duration, prompt omission, and turn counts.
GitOrigin-RevId: c1c2fb9cc2a1a9b0f63ef68509ad36d11a92d1e5
## What changed
- Add `in_app_browser.allow_external_browser_settings_import` to managed requirements, preserving explicit Boolean values through layered composition while leaving an omitted value unset.
- Return the policy as `inAppBrowser.allowExternalBrowserSettingsImport` from `configRequirements/read` and include it in the generated protocol schemas.
- Keep the import policy independent from the in-app browser feature flag and agent Browser Use requirements.
## Testing
- Cover parsing, managed-layer precedence, invalid values, user and session override resistance, and app-server response serialization.
GitOrigin-RevId: efa2621d2b1cf503f1bee2505d9914cb4fb7221d
## What changed
- Accept borrowed byte slices when appending output chunks, avoiding clones before
forwarding those chunks to streaming consumers.
- Merge drained head-tail buffers by reusing their owned storage while preserving
the retained prefix, latest suffix, and omitted-byte count.
- Make unified exec output handles capacity-generic so bounded-output tests can
exercise repeated drains with small buffers.
## Testing
- Update head-tail buffer and process manager tests to cover chunk retention,
omission accounting, and repeated output drains with the new APIs.
GitOrigin-RevId: caa9813d3c9d9921cff28888263a212def381640
## What changed
Replace the core integration test for allowed `globalThis` properties with an
in-process code-mode runtime test. The test continues to fail when the runtime
exposes a global outside the allowlist without requiring the core network test
harness.
GitOrigin-RevId: f33846ae2bb35e6779b5bec0a3f0ba5729eb707d
## What changed
Use the shared `wait_for_event` helper to wait for `TurnComplete` from initial
and reloaded worker threads before checking their requests. This replaces
manual polling of `AgentStatus` with two-second deadlines.
GitOrigin-RevId: 862884afae9969aacf0f53c5c24cf8b72f8d078a
## What changed
Add named tracing spans for MCP dirty-state refreshes and time spent waiting
to acquire the refresh semaphore.
GitOrigin-RevId: 1dbb3572d2061581beb83b3de098d6ec91791104
## What changed
- Add the configurable `vim_normal.replace_char` action, bound to `r` by default, to replace the grapheme under the cursor while remaining in normal mode.
- Support change-operator motions such as `cw`, `c$`, `cj`, and `ck`, plus the repeated `cc` command for changing the current line.
- Let `Esc` cancel a pending replacement before it reaches composer-level handling.
- Preserve existing custom Vim bindings and chord prefixes when introducing the new default.
## Testing
- Cover replacement, grapheme boundaries, remapping and unbinding, change motions, cancellation, keymap conflicts, and keymap picker snapshots.
GitOrigin-RevId: 98feb4eeb57142c37adb73abfe58d1f703b9270d
## Why
An `apply_patch` path can be replaced with a symlink after verification, allowing an unsandboxed patch operation to reach a different file than the one that was approved.
## What changed
- Add `follow_symlinks` options to executor filesystem reads, writes, metadata lookups, directory creation, and removal, including the corresponding `followSymlinks` protocol fields.
- Implement no-follow filesystem operations on Unix and Windows that reject links in any path component and restrict file access to regular files.
- Run `apply_patch` with symlink traversal disabled when an otherwise-required sandbox is bypassed, while retaining the existing follow-symlink default for standalone callers.
## Testing
- Cover leaf and ancestor symlinks across patch add, update, delete, and move operations, including a path swap after verification.
- Exercise local and remote no-follow filesystem behavior, concurrent directory creation, special-file rejection, and Windows reparse points.
GitOrigin-RevId: 43fd479084891493ce13564fbd894b98f329c6dd
## What changed
- Allow the Guardian V2 approval monitor to handle reviews for models that require automatic review.
- Preserve full Guardian review when Guardian V2 is disabled by configuration or managed requirements.
- Cover required-model routing for low- and high-risk actions, plus both Guardian V2 disable paths.
GitOrigin-RevId: d1201cc3dbd7c4a07de633388b14f17ada9feb39
## What changed
- Run local and remote compaction test turns with approvals disabled and an unrestricted permission profile.
- Keep the full test harness available where compaction turns need the configured model and working directory.
- Enable the Windows sandbox for managed-network unified exec process-event coverage.
- Update request snapshots to reflect the resulting `danger-full-access` sandbox metadata.
GitOrigin-RevId: 38eb46ca6ab28246d738e31eab900b2825072c7d
## Why
Project instructions must respect the selected environment's filesystem read
permissions. Tightening those permissions for a later turn must not allow
previously cached instructions to reach the model.
## What changed
- Apply each environment's filesystem sandbox while discovering and reading
`AGENTS.md` files.
- Fail thread or turn setup when sandboxing blocks a discovered instruction
file, while allowing a restricted project with no instructions to start.
- Clear cached instructions before refresh and include the Windows sandbox
level in the cache key.
- Ignore inaccessible ancestor marker probes so readable instructions in the
selected working directory can still load.
## Testing
Added coverage for restricted projects, denied instruction files, cache
invalidation after permissions tighten, and unreadable ancestor markers.
GitOrigin-RevId: 6ea1a27b9c873a6260e4f87d42ae1317a6a4ae4b
## What changed
Run both branches of the heuristically safe command policy test with the
Windows sandbox level set to `RestrictedToken`.
GitOrigin-RevId: ae5d754ec4a51d73a8e5f9d844f94a91f795fb72
## Why
Model provider configuration could override the residency header required by
`enforce_residency`, so provider-backed requests did not reliably honor the
managed setting.
## What changed
- Apply the managed residency header after building a provider, making it
authoritative for model requests and model discovery.
- Warn when a provider configures the residency header through
`http_headers` or `env_http_headers`, while preserving the original provider
configuration and unrelated headers.
- Cover HTTP and WebSocket requests, model discovery, and case-insensitive
header detection with targeted tests.
GitOrigin-RevId: 461ef8989d5bd06ffdea694aee4265e392e07590
## Why
Developer messages can contain both inherited agent policy and unrelated context. Full-history forks need to replace the parent policy without dropping the unrelated content that shares its message.
## What changed
- Filter fork-specific developer instructions by content item instead of excluding an entire developer message.
- Remove inherited multi-agent mode instructions before applying the child agent's current mode.
- Preserve unrelated content items and discard developer messages only when filtering leaves them empty.
## Testing
Extend agent-control and subagent notification tests to cover compound compacted messages, multi-agent mode instructions, and proactive-to-explicit mode transitions.
GitOrigin-RevId: 028834e237d8636c13b17a724574bc8eb09a55ba
## What changed
- Add `Config::resolve_permission_profile` to resolve named profiles from the
effective configuration and managed requirements.
- Make active-profile network proxy lookup public and re-export
`CodexThreadSettingsOverrides` from `codex-core-api`.
- Cover configured and managed profile inheritance, duplicate-name rejection,
and preservation of managed network settings.
GitOrigin-RevId: ffb5f54a932ef1a4b624677b5f051ecdcd1134b8
## What changed
- Exclude sandboxed `exec_command` and `shell_command` calls from Guardian v2 classification by default while continuing to classify calls that request `require_escalated` permissions.
- Add `guardianv2.review_scope.sandboxed_exec_commands` to opt sandboxed shell commands back into classification.
- Keep other tools and namespaced shell tools in scope, and advance tool-call progress when a call is skipped.
## Testing
- Cover the default and configured review scopes, tool namespaces, permission modes, and skipped-call progress tracking.
GitOrigin-RevId: 32fb540c69959b9a82569f0f2fc76b5517496e6b
## What changed
- Remove `untrusted` from the CLI, configuration schema, and MCP tool interface. Explicit `approval_policy = "untrusted"` settings now fail with an actionable error.
- Remove the known-safe command allowlist. Projects marked untrusted now request approval for every command unless an explicit exec policy rule allows it.
- Keep command parsing conservative by treating in-place `sed` forms as mutating and ignoring unrecognized commands when recording memory usage.
## Testing
- Cover rejection of the retired configuration value and approval requests for commands in untrusted projects.
GitOrigin-RevId: d6bf425edddfffbb325eee6acf383434af5fd33b
## Why
The Linux sandbox represents missing protected metadata paths such as `.git`
with empty read-only directories. Repository and project discovery treated any
`.git` directory as a checkout root, so this synthetic directory could hide a
real parent repository and its trust configuration.
## What changed
- Treat a `.git` directory as repository metadata only when it contains
`HEAD`, while continuing to recognize file-based `.git` entries.
- Protect missing `.git` paths with the same read-only synthetic mounts as
other workspace metadata without disrupting parent-repository discovery.
- Canonicalize and read-only bind the synthetic-mount registry into the
sandbox, and make protected-path cleanup handle read-only directory trees.
## Testing
Added coverage for repository, project-root, trust, synthetic-mount, and
Landlock behavior, including nested incomplete `.git` directories and a
redirected `TMPDIR`.
GitOrigin-RevId: 0724c54d56531143bb28011e4ca414cd3b0212be
## What changed
- Add the opt-in `cwd_relative_turn_diffs` feature.
- When enabled, render turn diff paths relative to each selected environment's
working directory instead of the detected Git root.
- Preserve repository-root-relative paths when the feature is disabled.
## Testing
- Cover enabled and disabled behavior for nested working directories across
supported originators.
GitOrigin-RevId: 8b4908706a82b01f33ccd035b0945f9a29fce26f
## Why
A checkout could point its `.git` file at a trusted repository's worktree
directory without proving that the repository had registered that checkout.
This could cause project configuration from an unrelated checkout to be treated
as trusted.
## What changed
- Verify the linked worktree's `gitdir` backlink, `commondir`, registered
checkout, and main checkout ownership before resolving the main repository's
trust key.
- Reject missing, oversized, symlinked, mismatched, or swapped Git metadata.
- Preserve valid linked worktrees that use path aliases, separate Git
directories, or non-UTF-8 POSIX paths.
## Testing
Add resolver and config-loading coverage for forged worktrees, metadata races,
case-sensitive paths, moved worktrees, and host MCP startup from project config.
GitOrigin-RevId: 6052a7d10ad2d613436f20175c356abdef8c758e
## Why
An authorization server discovered for an MCP server can change. A stored refresh token must not be sent to a different issuer than the one that originally granted it.
## What changed
- Persist the discovered authorization server issuer with new OAuth credentials and preserve it across refreshes.
- Validate that issuer against a single pinned metadata snapshot before refreshing or adopting stored refresh credentials.
- Require reauthentication when refresh credentials have no issuer or the issuer changed. An unexpired access token can still be used without exposing its refresh token.
## Testing
Add coverage for issuer persistence, missing and changed issuers, metadata changes during startup, and refresh-token preservation.
GitOrigin-RevId: 07e48ba892f627428a28bbed5cca4ad703e2a5fd
## Why
Deriving permissions from the parent of an already-writable patch target can
unnecessarily grant write access outside the intended workspace.
## What changed
Skip targets already covered by the active filesystem sandbox policy before
deriving additional parent-directory permissions. Targets outside the writable
area continue to request the required parent access.
## Testing
Added unit and CLI regression coverage for workspace-directory targets,
already-writable parents, and symlink escapes outside the workspace.
GitOrigin-RevId: 187109ff0b56a1a399cb8a9981b7e822977025d5
## What changed
- Add a `test_threads` option to `codex_rust_crate` that sets
`RUST_TEST_THREADS` for sharded integration tests when configured.
- Run the `core` and `app-server` Bazel integration tests with one Rust test
thread on macOS, leaving the thread count unchanged on other platforms.
GitOrigin-RevId: 118147413eb141f557d9ee82858860617d61acce
## Why
A model-provided shell path should select the requested shell type without
allowing that path to determine which executable Codex runs.
## What changed
- Resolve model-provided shells through Codex's normal shell discovery and
fallback logic after detecting their type.
- Keep the configured packaged zsh executable when the zsh-fork feature is
enabled and the file exists.
- Update shell, unified exec, and network approval expectations to use the
resolved local executable and arguments.
GitOrigin-RevId: ebe6f7eec2cfd1c0548d5bf1a26b7a30dba02cc2
## What changed
- Register `send_user_message_async` as `DirectModelOnly` so supported models can call it directly without exposing it through code mode.
- Exercise the async message flow with a code-mode-only model configuration and verify that the tool remains directly visible.
GitOrigin-RevId: ce22d5f63471ce90ac55ae2f3d0048f6cda57e01
## Why
Environment-owned permission profiles and workspace roots must remain effective
without being persisted or restored as thread-owned settings.
## What changed
- Keep thread settings snapshots and restore data separate from the effective
configuration supplied by the primary environment.
- Use resolved environment permissions, active profiles, workspace roots, and
network policy when building turn context and session events.
- Preserve environment selections when agents are evicted, resumed, or spawned,
and validate owner configuration when it becomes ready.
- Start memory initialization only after the primary environment is configured.
## Testing
- Extend remote-environment and multi-agent tests to cover settings persistence,
owner permission profiles, workspace roots, spawning, eviction, and resume.
GitOrigin-RevId: d82f126981cd0190233020bbdd61d96c70558868
## Why
Reducing a heredoc shell script to its inner executable lets a prefix rule for
that executable apply to the entire wrapper, even though the full script was
not parsed as a plain command.
## What changed
- Fall back to evaluating the complete shell wrapper when plain-command parsing
fails, including for heredoc scripts.
- Keep these commands sandboxed when only the inner executable is allowed.
- Propose the full wrapper as the exec policy amendment when approval is needed.
## Testing
Added exec policy, Unix escalation, and approval scenario coverage for unparsed
and heredoc shell wrappers.
GitOrigin-RevId: 8f65133acb6b7c638263917e1d9137e45990772c
## Why
Repository configuration can cause even read-only Git commands to execute
helpers, so Git command arguments alone are not enough to establish trust.
## What changed
- Remove Git commands from the known-safe command classification on Unix and
Windows, including commands nested in supported shells.
- Under the `unless-trusted` approval policy, require approval for commands such
as `git status` unless an explicit execution policy rule allows them.
## Testing
- Cover direct, shell-wrapped, absolute-path, and PowerShell Git commands.
- Verify `git status` approval behavior with and without an explicit allow rule.
GitOrigin-RevId: dd04e0ddca0c56ba64ae64abe6e658bae7bf5a4d
## Why
New non-ephemeral threads have no persisted rollout or preview until their first
turn, so moving them into a section could leave them absent from section-filtered
thread lists.
## What changed
- Materialize and flush a non-ephemeral thread before applying an explicit
section move.
- Include explicitly sectioned threads with empty previews in section-filtered
queries, and update the partial indexes to cover them.
## Testing
- Add an app-server test that moves a newly started thread into and out of the
pinned section before its first turn.
- Cover empty-preview threads in recency and section-position query tests.
GitOrigin-RevId: aa3c4daf9890f06c08b93cd60f146099cbc6cfb2
## What changed
Replace the custom `HeadTailBuffer::drain` helper with `std::mem::take` at
the output collection call site. This moves the buffered output out while
resetting the shared buffer to its default empty state.
GitOrigin-RevId: 7a93d1312f2cea0d7913a5264eeb01726b45e0ea
## What changed
- Emit `codex_control_tool_call_event` for built-in control tools such as
`request_user_input`, `update_plan`, `view_image`, and goal tools.
- Record correlation and timing metadata plus completed, failed, rejected, or
interrupted outcomes, and include these calls in turn-level tool counts.
- Keep tool arguments out of control-tool analytics events.
## Testing
- Extend the app-server turn profile test to cover successful and failed
control tools, event correlation, turn counts, and argument exclusion.
GitOrigin-RevId: c20f73dfb79654e31b4b5040eddb0e0d91cae10d
## What changed
- Add a focused Code Mode integration test with Guardian transcript images enabled and enhanced Node REPL transcripts disabled.
- Verify that the Guardian request and parent request omit both the screenshot and its surrounding transcript markers.
- Remove this configuration from the broader parameterized transcript-evidence test.
GitOrigin-RevId: 1309de12337a28a7e1d49eca509ba73207d4d9be
## What changed
Move circular-value coverage for the `text()` helper from the core integration
suite to the in-process code mode runtime tests. Verify that stringification
returns no content and surfaces the V8 circular-structure error without needing
a mock server or network access.
GitOrigin-RevId: d506591af5ae8ce0a8c7305d633a7b0f2e458335
## What changed
Update the unified image budget integration test to resize a `6401x1` image to
`6000x1` and verify that the model receives the corresponding resize notice.
GitOrigin-RevId: 401e9728dc4bd6f0122bbc62f996a0b961e22b3a
## What changed
- Keep validating normalized dynamic tool visibility for both Responses and Responses Lite.
- Exercise the normalized dynamic tool call and its returned metadata only for Responses Lite.
- Let the standard Responses case complete in a single mocked response without expecting a dynamic tool request.
GitOrigin-RevId: 7793e6f6df07fc58c2976a773a1198496af08dfd
## What changed
Stop setting explicit one-second `timeout_ms` and `yield_time_ms` values in the
mock command calls. The shell command and unified exec variants now use their
default timing behavior while testing cyber exec policy.
GitOrigin-RevId: b1c25304ca47e7b08f023fe678467fc00330158b
## What changed
Use a 2049-by-32 image in the Guardian transcript evidence test and verify that
it is resized to 2048-by-32 while preserving its aspect ratio.
GitOrigin-RevId: 4b1b404c0fc76c46739379ef154e629bf8d669f3
## What changed
- Parameterize `HeadTailBuffer` by a const `MAX_BYTES` value and derive its
head and tail budgets from that value.
- Keep `UNIFIED_EXEC_OUTPUT_MAX_BYTES` as the default capacity for production
call sites.
- Update focused buffer tests to select their smaller capacities through the
type parameter.
GitOrigin-RevId: 106e81a2c2db935f7f77a4f301ef591017958287
## What changed
- Co-locate the Bash and zsh snapshot-script tests with
`codex-shell-command`, where `snapshot_script` is implemented.
- Add `tempfile` as a dev dependency for the relocated tests.
- Keep the higher-level snapshot lifecycle tests in `codex-core`.
GitOrigin-RevId: 6d5e9ab95962722f7c89ea40512bd70ee81d8da2
## What changed
- Expose `send_user_message_async` to root agents whenever the selected model advertises support for it.
- Retain `send_async_message` as a removed compatibility flag so existing configuration is accepted without controlling tool availability.
- Update the async message test to cover model-driven tool exposure without enabling the legacy flag.
GitOrigin-RevId: 558b427c2b203a057dd7c836e0ec702ae6134346
## Why
Bedrock sessions that use the AWS SDK credential chain need a way to recover when credentials expire during a request.
## What changed
- Add `aws.auth_refresh` provider configuration with an `aws` command, arguments, and a configurable timeout.
- Run the command for refreshable Bedrock authentication failures, reload the SDK credentials, re-sign the request, and retry it.
- Share refresh state across matching provider configurations so concurrent failures invoke the command only once. Bearer tokens, command auth, and static environment credentials do not use this recovery path.
## Testing
- Add coverage for configuration validation, refreshable error classification, concurrent refresh sharing, and an end-to-end retry signed with refreshed credentials.
GitOrigin-RevId: 0302fe3aabdbc1097e7bd62a74d407ba38a3cc57
## What changed
- Add environment-provided MCP restrictions for configured and plugin-provided servers.
- Disable attachment-scoped servers while their environment configuration is pending, failed, or unselected, while preserving selected-plugin access and the controller-owned Apps server.
- Apply the resolved policy to runtime startup, model tool exposure, telemetry, OAuth flows, and skill dependency installation.
## Testing
- Cover policy filtering for configured and plugin servers, environment state transitions, Apps ownership, and managed OAuth rejection.
GitOrigin-RevId: 7ca5d4dda14068e758497f88835d5cba685e159e
## What changed
- Execute hook-triggered MCP calls through the runtime's latest connection set instead of preparing a separate catalog-bound call.
- Keep hook calls from waiting for server startup or reconnecting, and reject disconnected servers immediately.
- Apply the shorter of the hook-requested timeout and the server's configured tool timeout.
## Testing
- Update connection manager tests to cover non-waiting calls and disabled tool filters.
GitOrigin-RevId: 3166b2d1e26d9ae2b8b3a648b4d0897cc260eb93
## What changed
- Add `send_user_message_async` for root agents when the async-message feature is enabled and the model advertises tool support.
- Emit the supplied text as an asynchronous agent message and immediately return an accepted result so the turn can continue.
- Keep the user-visible update out of the model's input context.
## Testing
- Add an integration test covering tool registration, item events, continued turn execution, and model context.
GitOrigin-RevId: 13d5168cb8cd6742db17bb74a15c910994e9c98b
## What changed
- Add an optional `delivery` field to agent message events and app-server
`agentMessage` items, with `"async"` identifying a user-visible message sent
without ending the current turn.
- Preserve the marker through legacy event conversion, thread history
materialization, replay, and generated JSON and TypeScript schemas.
- Require delivery of async agent message completion notifications on the
in-process app-server transport.
## Testing
- Cover preservation of async delivery metadata in thread history.
- Cover delivery-required classification for async agent messages.
GitOrigin-RevId: f92ba25de1293ee271404badfdf0d117d6530329
sayan-oai