## What changed
- Apply all per-request environment overrides, including `PATH`, after restoring
the captured shell environment.
- Remove `runtime_path_prepends` from `ShellSnapshotRequest` and the associated
PATH replay and deduplication logic.
- Keep the shell snapshot integration test's runtime PATH setup in the command
being executed.
GitOrigin-RevId: a6f8d2e144bf9977c7434bc58b60ac972f7e0449
## Why
Clients that create and negotiate realtime calls themselves need Codex to join
those calls without creating another call or overwriting the client-owned
session configuration.
## What changed
- Add the `existingCall` transport to `thread/realtime/start`, accepting a
client-provided `callId` and optional `realtimeSessionId`.
- Attach Codex over the call's sideband WebSocket without SDP negotiation or a
session update, and reconnect that sideband while preserving transcript
state.
- Default existing calls to realtime v1, support v1 and v3, and reject v2 or
options that would reconfigure the client-owned session.
- Encode call IDs as a single URL path segment for v3 sideband connections.
## Testing
Add protocol, app-server, core, reconnection, authentication-header, and URL
encoding coverage for existing-call attachments.
GitOrigin-RevId: 2046b70566f98efa55381bb1e461ea3cc68256c5
## What changed
- Add unbound `previous_permission_mode` and `next_permission_mode` actions to
`tui.keymap.chat` so users can configure shortcuts that cycle through the
available built-in permission modes.
- Apply shortcut selections only to the active session, without writing them
to `config.toml`, and report update failures in the transcript.
- Exclude modes disallowed by managed requirements or platform safety checks,
reject printable-key bindings, and ignore these bindings in project config.
## Testing
- Cover mode cycling, unavailable modes, session-only updates, server errors,
stale threads, keymap validation, and project-config sanitization.
GitOrigin-RevId: c3cfdf1e732b7b7bfe8f53fcac19a37e593bbfab
## Why
`codex agents` rejected invocation-specific configuration, preventing the
dashboard from applying settings when starting a shared thread.
## What changed
- Accept interactive options such as model, approval, sandbox, search, working
directory, and configuration overrides when opening the agents dashboard.
- Forward supported session-flag configuration into threads started through an
embedded or remote app server, while excluding unrelated values.
- Continue to reject initial prompts and images, along with local provider and
additional-directory settings that cannot be applied to a remote server.
## Testing
- Cover accepted dashboard options and rejected incompatible inputs.
- Verify that explicit feature and sandbox overrides reach shared threads in
both embedded and remote modes.
GitOrigin-RevId: f10aa1e16ff62b49d55679e987d9e458438ba3f8
## Why
Pending input previews display at most three wrapped rows, but previously wrapped every logical line before truncating the result. This made rendering do unnecessary work for very large multiline inputs.
## What changed
Limit pending steers, rejected steers, and queued follow-up inputs to four source lines before wrapping: three for the preview and one to detect overflow and render the ellipsis.
## Testing
Keep multiline preview coverage for queued messages and pending steers, including blank lines near the truncation boundary.
GitOrigin-RevId: 4c300b13532983ff9c3bdfbd62d6ca722ea3a5aa
## Why
Refreshing a Noise rendezvous bundle after an unauthorized handshake inherited
the initial registry lookup's retry count. If that lookup had exhausted its
retries, a transient registry error during the refresh failed immediately.
## What changed
Reset the registry retry count along with the operation deadline before
requesting a replacement bundle after a `401` handshake response.
## Testing
Extend the initial Noise connection test to exhaust the first lookup's retry
budget, receive a `401`, then verify that an offline replacement lookup is
retried and connects successfully.
GitOrigin-RevId: bcfad50ea32d69855f1c2c4c461022b3ecbbd941
## What changed
- Add `context_window_id` to turn metadata for sampling and compaction requests, using the UUID for the model-visible context window.
- Keep the ID stable for requests in the same context window and advance it after compaction, independently of the existing thread-generation `window_id`.
- Reserve `context_window_id` so client metadata cannot override it.
## Testing
- Cover HTTP and WebSocket metadata, remote compaction, token-budget context alignment, resume behavior, and post-compaction window changes.
GitOrigin-RevId: 55cceea377ad509c8dd96ad668f2b5703ea46a63
## What changed
- Skip project-scoped `AGENTS.md` discovery when the active project is untrusted, while preserving user-level instructions.
- Include the active project trust level in the instruction cache key so runtime trust changes reload the applicable instructions.
- Preserve updated project trust metadata during runtime configuration refreshes.
## Testing
Add coverage for initially untrusted projects and for switching between trusted and untrusted states at runtime.
GitOrigin-RevId: 284bf7693943f585013fb5fe4b6aa3309bc50cf3
## What changed
Rename the token-budget configuration key and its Rust field from
`use_history_notes_history` to `use_history_notes_extension`. Update the config
schema, extension gating, explicit-setting detection, and tests to use the new
name consistently.
GitOrigin-RevId: b6a514e23f02095fcd1d35dc42eeb7394b800c77
## Why
Token-budget sessions need a way to recover prior conversation context and preserve working state across context-window transitions.
## What changed
- Add direct-model `history` tools for listing windows and items, reading items, and searching conversation contents.
- Add direct-model `notes` tools for listing, reading, searching, appending, and writing persistent notes.
- Route tool calls through the configured Codex backend with trusted session and agent context, bounded request arguments, and truncation-aware output handling.
- Expose the extension when `features.token_budget.use_history_notes_history` is enabled with an OpenAI provider and Codex backend authentication.
## Testing
- Cover tool registration, configuration changes, provider and authentication requirements, backend request context, encrypted output preservation, and request and response limits.
GitOrigin-RevId: 43b259f01014ba3f30803dd7cd5634942407a9bb
## What changed
- Switch Amazon Bedrock remote compaction to `compaction_trigger` items sent through `/v1/responses`.
- Remove the legacy dedicated compaction protocol from provider capabilities.
- Default remote compaction to unsupported and explicitly enable it for OpenAI, Azure Responses, and Amazon Bedrock providers.
## Testing
- Cover manual and automatic Amazon Bedrock compaction requests and their compacted history.
- Verify remote-compaction capabilities for configured and Amazon Bedrock providers.
GitOrigin-RevId: cf9ba314595367518b37a85f334f0c105ce47e45
## Why
Guardian v2 applied an implicit token limit to classifier instructions even when
no limit was configured, which could truncate the rendered policy.
## What changed
- Leave classifier instructions unbounded by default.
- Continue honoring `max_classifier_instruction_tokens` from local or model
configuration, with local configuration taking precedence.
## Testing
- Cover full policy rendering without a configured cap and truncation when an
explicit cap is present.
GitOrigin-RevId: 70eb42d43858e0656129dd438b10b60940fd97c6
## Why
Applying session settings rebuilt and compared a legacy filesystem policy even
when the update could not trigger cwd-based policy rebinding.
## What changed
Compute the legacy projection only for cwd changes whose filesystem policy has
a rebindable project-root write entry. Preserve the existing equivalence check
before rederiving the policy.
GitOrigin-RevId: c428a5c54f1b5b1300be406cac374a6fd29bb9a8
## What changed
- Add `FileSystemSandboxPolicy::has_writable_roots_with_cwd` to detect an
effective writable root without constructing its read-only carveouts.
- Use the helper when classifying permission profiles and selecting patch
rejection reasons.
## Testing
- Verify the presence check matches the existing materialized-root result
across read-only, unrestricted, external, writable, denied, and unresolved
special-path policies.
GitOrigin-RevId: 17ee490aa3180e05732133203f68544d9de5268b
## Why
The macOS preferences service can expose data outside a sandbox's allowed
filesystem read roots.
## What changed
- Move the Seatbelt preference and `cfprefsd` grants into a separate policy
section that is included only when filesystem reads are unrestricted.
- Remove the equivalent grants from the restricted platform defaults.
## Testing
- Verify both Seatbelt profiles include preference grants only for full-disk
read policies, including policies with denied paths or globs.
- Verify a restricted sandbox cannot retrieve a preference whose plist is
denied, while an unrestricted read policy can.
GitOrigin-RevId: 90388366a7302bca1830ad0439544be8babc7321
## What changed
- Add `WINDIR` to the Windows core environment variable allowlist.
- Extend the Windows core-inheritance test to verify that a case-variant
`WinDir` entry is retained.
GitOrigin-RevId: 0305d8fa882ba2705a7ce7661098cedac1339c43
## What changed
- Read the optional `pdf_c2pa_reservation` flag from file creation responses.
- When a reservation is present, include the original creation payload as
`pdf_c2pa_create_request` in the upload finalization request.
- Keep sending an empty finalization payload when the flag is absent for
compatibility with older server responses.
## Testing
- Cover reserved hosted PDF uploads and the legacy empty-payload path with mock
server tests.
GitOrigin-RevId: 454a4b9d872d70766c2bbb6c01d6015f7127af2f
## Why
Amazon Bedrock does not support the response items required by multi-agent V2.
## What changed
- Normalize Bedrock model catalogs to advertise `MultiAgentVersion::V1`.
- Cover both remote catalog normalization and the static Bedrock Runtime catalog in tests.
GitOrigin-RevId: 93832cd4b885daf4b87fb33a7be8502ae15c1b24
## What changed
Map lowercase match offsets back to the original thread text with monotonic
span cursors. This avoids rescanning all character spans for every occurrence
while preserving the original byte ranges returned for matches.
GitOrigin-RevId: 363fba5d56813c3aeb2a7ede1d7275147a9ef51a
## What changed
- Upgrade `rmcp` and `rmcp-macros` from 3.1.2 to 3.1.3.
- Preserve authentication-required and retryable transport classifications when modern MCP discovery falls back to legacy initialization.
- Prevent unrelated discovery errors from triggering legacy fallback while retaining their diagnostics.
## Testing
- Cover authentication challenges and transient initialization failures during legacy fallback.
- Verify that a failed OAuth issuer check does not consume the pending authorization state.
GitOrigin-RevId: 957c0873fec1148883dd163fbaeb77d7593d8c53
## What changed
- Add app-server client, runtime, thread source, and parent thread ID metadata to archive and unarchive analytics events when the reducer has that context.
- Omit non-automation feature thread sources and skip unavailable metadata.
## Testing
- Cover archive and unarchive event enrichment, filtered feature sources, and threads without cached context.
- Verify the app-server archive flow emits the enriched analytics payload.
GitOrigin-RevId: 163f9c30721cee0172bb4581b6dcd269e44cd941
## What changed
- Add `hostname` as a selectable status-line item and show it in setup previews.
- Read the normalized operating-system hostname without triggering DNS resolution, and omit the item when no hostname is available.
## Testing
- Cover hostname normalization, status-line rendering, and setup and surface previews.
GitOrigin-RevId: c5e4e0ee1dba6e4bfdf942562a6b037835ff9e69
## What changed
Install the `build-essential` package on apt-based runners in both full Rust CI workflows, including the platform-specific nextest workflow.
GitOrigin-RevId: 52e611235f032ed4a630301f40f8aafd9ca11a08
## What changed
- Apply the existing direct-input restriction to `thread/settings/update` for
parent-owned Multi-Agent V2 subagents.
- Document the restriction and extend the direct-input test to verify that the
request returns an invalid-request error.
GitOrigin-RevId: 2eead01c6f54ec637c68573378f3b56a7ee85652
## What changed
- Treat standalone `function_call_output` items without a `call_id` as external context, including items injected into new and forked threads, and mark the thread memory mode polluted when `memories.disable_on_external_context` is enabled.
- Include these outputs in guardian transcripts with their namespaced tool name and a placeholder for non-text content.
- Allow image generation to reuse images from standalone and otherwise unpaired function or custom-tool outputs.
## Testing
- Cover injected thread items, external-context detection, guardian transcript rendering, and recent-image selection.
GitOrigin-RevId: ca4e8c16a4b731e1256a5956908d00f785b4feb1
## What changed
Reuse the shared `build_zsh_fork_test` helper in the unified exec approval
suite and remove its identical suite-specific wrapper.
GitOrigin-RevId: 0593f0e1a56737eba1d491872a44d14e9171dbfb
## What changed
- Add `EnvironmentManager::from_accepted_websocket` so embedding hosts can
construct a remote environment from an already accepted and authenticated
Axum WebSocket.
- Add `replace_accepted_websocket` to retire the current transport and resume
the same exec-server session on a host-supplied replacement connection.
- Serialize replacement handoffs, reject overlapping replacements, and release
the handoff claim when a replacement attempt is cancelled or fails.
## Testing
- Cover initial connection validation and immediate environment readiness.
- Verify replacement retry behavior and recovery of a running process and its
output after reconnecting.
GitOrigin-RevId: 1f2ab7bcf7b5abbbece5c101801432dc84a8058d
## What changed
- Route turn-cost queries for non-OpenAI providers through the configured
provider endpoint and authentication, while retaining the existing OpenAI
API-key path and excluding Amazon Bedrock.
- Observe turns only when their model provider matches the worker's provider.
- Retry custom-provider authentication failures during periodic availability
probes and ensure client authentication takes precedence over provider
headers.
## Testing
- Add coverage for provider matching, custom-provider authentication retries,
ChatGPT-auth rejection, and header precedence.
GitOrigin-RevId: 04a7b28e8e3e18a510ae6fface5193af40d114c0
## Why
Rollout migration outcomes expose free-form error messages, making failures hard to group without parsing text.
## What changed
- Add a serialized `RolloutMigrationFailureReason` to failed outcomes and classify failures across reading, conversion, SQLite materialization, publishing, and recovery.
- Add the failure reason as a low-cardinality tag on per-thread migration telemetry.
## Testing
- Cover missing SQLite metadata and invalid session metadata classifications.
GitOrigin-RevId: 2bff98483b484f4d02b72d52f39950ff99ebe429
## Why
External tool events may need to enter thread history without a preceding function call and therefore do not have a `call_id`.
## What changed
- Allow `function_call_output` items to omit `call_id` and carry optional `name` and `namespace` fields.
- Preserve named standalone outputs during history normalization and agent forks while retaining existing pairing behavior for outputs with a `call_id`.
- Accept, persist, and forward these outputs through `thread/inject_items`, and update the app-server schemas and documentation.
## Testing
- Cover paired and standalone JSON round trips, history normalization, agent forks, and injected thread history.
GitOrigin-RevId: a3258163a7dc93777c7c3023116fe204819bdbb0
## What changed
- Add `otel.tool_result.max_bytes`, defaulting to 2048 bytes, to control the
text included in `codex.tool_result` logs independently of model-visible
output limits.
- Apply truncation centrally when emitting telemetry, preserve UTF-8
boundaries, and report whether the logged output was truncated.
- Record typed tool names and namespaces, agent names, and process-local result
sequence numbers while keeping tool arguments and output out of trace events.
## Testing
- Cover configuration propagation, UTF-8-safe truncation, raw tool-output
logging, and log/trace event routing and fields.
GitOrigin-RevId: 89ca76e55f1a09b729e7770ce01f2e4d98f9a22d
## What changed
- Retry transient environment-registry failures while opening the initial Noise rendezvous connection, including timeouts, interrupted response bodies, retryable HTTP statuses, and temporarily offline environments.
- Bound registry attempts with per-request and overall timeouts, exponential backoff, and a retry limit while returning permanent registry errors immediately.
- Preserve the existing one-time bundle refresh after an unauthorized WebSocket handshake, with a fresh registry retry window.
- Treat malformed complete JSON responses as terminal rather than retryable transport failures.
## Testing
- Cover transient and permanent registry responses, stalled requests, retry limits and deadlines, interrupted bodies, malformed JSON, unauthorized bundle refresh, and session-resume behavior.
GitOrigin-RevId: 5929274103702ad477e7a638ab489319a43a93fa
## What changed
- Require macOS Desktop app bundles to pass strict `codesign` verification for the Codex bundle identifier and OpenAI signing team.
- Verify downloaded apps before installation and existing apps before launch.
- Add tests that reject unsigned bundles, ad-hoc signatures, and attempts to launch an unsigned existing app.
GitOrigin-RevId: 9b23739281d8abf7fc30c5366960eb1bb07a1b7d
## What changed
- Use `exec_command` and `write_stdin` as the shell tool surface.
- Treat legacy `default`, `local`, and `shell_command` model metadata as `unified_exec`.
- Remove obsolete shell-selection configuration and runtime paths while preserving the feature and policy gates for zsh fork execution.
GitOrigin-RevId: d743cbe598630d73052f1fecad680c4cde17977d
## What changed
- Add the hidden Daybreak Blue and Daybreak Red model definitions.
- Refresh model capabilities, instructions, plan availability, and service-tier metadata.
- Configure the auto-review model for Responses Lite and code-mode tools, and update Guardian request tests for the resulting `additional_tools` and developer-message layout.
## Testing
- Update Guardian request snapshots and assertions for initial and follow-up reviews.
- Verify MCP approval routing against the developer-message form of the Guardian prompt.
GitOrigin-RevId: 6680e9abebdcbc43224a81348591e26f8422f3ec
## What changed
- Add `suggestion_id` to plugin install elicitation metadata, using the same
value as the elicitation request ID and plugin-install analytics event.
- Leave connector install metadata unchanged by omitting the field.
## Testing
- Cover plugin and connector metadata serialization.
- Verify that remote plugin install metadata and analytics carry matching
suggestion IDs.
GitOrigin-RevId: 05dd1d210e2a82857094f09d27ecba79ee460b7e
## What changed
- Add experimental `mcpServer/event/stream/start` and `mcpServer/event/stream/stop` requests for hosted apps, plus `mcpServer/event/stream/notification` forwarding.
- Scope subscriptions to the owning app-server connection and subscribed thread, enforce unique IDs and a per-connection limit, and clean them up when the thread is unsubscribed or the connection closes.
- Wait for the MCP active notification before completing startup, retry streams that close immediately, and terminate them when authentication or hosted runtime ownership changes.
## Testing
- Add an app-server integration test covering activation, event forwarding, duplicate subscription rejection, and explicit cancellation.
GitOrigin-RevId: 8a6fc1615adfc5af7e67def3b824fa5909ab3e7b
## What changed
- Remove the legacy `shell_command` handler and runtime, leaving `exec_command`
and `write_stdin` as the shell execution tools.
- Treat legacy `shell_command` model metadata as `unified_exec`, and normalize
legacy user opt-outs so they do not disable command execution. Managed feature
requirements and `shell_tool` can still disable it.
- Preserve shell approvals, sandboxing, zsh-fork support, and output truncation
through the unified execution path.
## Testing
- Cover legacy configuration and model-metadata compatibility.
- Exercise unified shell execution, approvals, truncation, and `apply_patch`
serialization across the app-server and core test suites.
GitOrigin-RevId: 5c2fd6164fc3519cdae4944cb9db276b8467311c
## What changed
- Add the `shellSnapshotV2` executor capability and an optional shell snapshot request to `ExecParams`.
- Capture and restore Unix shell state and profile exports from an in-memory, attachment-scoped cache for `bash`, `zsh`, and `sh`.
- Apply environment policies, runtime `PATH` entries, sandbox context, and live managed-proxy settings when preparing restored commands.
- Bound snapshot size, capture time, scope length, and cache capacity, and fall back to the original command when capture fails.
## Testing
- Cover local, remote, TTY, sandboxed, and supported-shell execution, plus environment filtering, proxy handling, in-memory reuse, and capture failure fallback.
GitOrigin-RevId: 624f747972c249c88c6f10f42cf0af97b75b5541
## What changed
- Add `additional_developer_instructions` to managed requirements and expose it through `configRequirements/read` as `additionalDeveloperInstructions`, independently of ordinary developer instructions.
- Include the managed instructions in model context, emit explicit replacement or removal messages when requirements change, and preserve the current value across compaction, resume, and agent forks without duplication.
- Reject managed instructions whose rendered context exceeds 10,000 estimated tokens.
## Testing
- Cover requirements layering and API serialization, context updates and removal, size validation, repeated model requests, compaction and resume, rollout migration, and agent forks.
GitOrigin-RevId: bc0b70fb7988944c2f68176dff55f5ed61eb46c8
## What changed
- Add `resolve_permission_profile_selection` to select the effective profile using configured defaults, managed requirements, and allowlists.
- Return the merged configured and managed profile catalog without compiling platform-specific paths, leaving path interpretation to the executor.
## Testing
- Verify that a managed default overrides a configured default while preserving Windows-style paths.
- Verify that an allowlisted but undefined profile is rejected.
GitOrigin-RevId: 0172193d48f0346522f931d3b806054895d199c0
## What changed
- Make `ExecutorFileSystem::walk` a required backend operation instead of
providing a fallback built from directory reads and metadata requests.
- Implement bounded local walks on a blocking task with cancellation, symlink
cycle detection, deterministic ordering, error collection, and response-size
limits.
- Have remote filesystems use the server's walk operation directly.
## Testing
- Cover local and remote handling of invalid roots and limits, directory
symlinks, non-UTF-8 names, cancellation, sandbox contexts, and response
budgets.
GitOrigin-RevId: 7499bf05080c3f9965a5eb7ffd593de604d62c2a
## Why
Resumed threads can carry a persisted capability-root location that no longer
matches the location reported by the attached executor.
## What changed
- Refresh matching thread-owned capability roots from the live environment while
preserving persisted roots when the executor reports none.
- Use the same merge behavior for capability-root inspection and per-step MCP
resolution, without changing owner-configured root precedence.
## Testing
Extend the remote-environment resume test to cover both an executor-provided
replacement root and the persisted-root fallback.
GitOrigin-RevId: 0c66195b2406f431a2e156e00d5225a8d22d18b2
## What changed
Return the initial wrapping ranges directly when the composer input produces a
single line and its byte length is less than the available width. This avoids
the additional grapheme and word-boundary pass for input that cannot wrap.
GitOrigin-RevId: 55d990a354fcc61e9a90d5796b4b39d16742cc50
## What changed
- Add `rejection_instructions` and `timeout_instructions` to catalog-provided auto-review messages.
- Use the acting model's instructions for denied and timed-out reviews across tool approvals, shell escalation, and MCP elicitation responses.
- Fall back to the existing instructions only when a catalog value is absent, while preserving explicit empty-string overrides.
## Testing
- Cover catalog overrides, legacy fallbacks, empty values, and separation between acting-model and reviewer-model messages.
GitOrigin-RevId: c5b2c2dbdaefd45d1d658651dd1abaeb6d8c93da
## What changed
- Add `max_tool_call_lag`, `reuse_parent_compaction`, and transcript
`include_images` to the Guardian model configuration.
- Inherit these settings from model defaults while preserving explicit local
overrides.
- Enable image capture for Node REPL review evidence when transcript images are
included.
## Testing
- Cover inheritance and local override precedence for the new settings.
- Verify that enabling transcript images initializes review-evidence capture.
GitOrigin-RevId: 7c1965c2ec00a78a0436fa916b630be0004dbb51
## What changed
- Create remote plugin metrics directories through the standard executor filesystem API.
- Remove the `private` directory-creation protocol option and its platform-specific handling.
- Update the executor temporary-directory documentation to describe child-visible sidecars without an owner-private guarantee.
GitOrigin-RevId: 9a8532403a3ad2bf998281735be0b668893918c9
## Why
A newly started thread may not have materialized its rollout before the TUI
receives `ThreadStarted`. Trying to infer session state from that path can wait
through rollout reader retries even when a lifecycle response already provided
the authoritative session.
## What changed
- Preserve session state already stored for a known thread instead of inferring
it again from `ThreadStarted`.
- Continue updating agent-picker metadata from the notification.
- Restrict fallback session inference to newly observed `ThreadStarted`
notifications that do not already have session state.
## Testing
Added a startup test that verifies a known thread routes `ThreadStarted`
immediately, retains its configured session, buffers the notification, and
updates agent metadata when the rollout does not exist yet.
GitOrigin-RevId: 7ed98fb46df17566c4a61ac677f60fc8d94f7321
## What changed
Box `dialer::connect` before awaiting it in `WebSocketConnector::connect`,
erasing the dialer's concrete future type at the connector boundary.
GitOrigin-RevId: 617a2e4fd5bd61a408281973452e7b71b104bff2
## What changed
- Emit started and completed collaboration tool events for multi-agent v2
`spawn_agent` calls, including failed invocations.
- Record execution duration and successful child-agent configuration metadata
without including the spawn prompt.
- Deduplicate collaboration and subagent activity items by call ID when
calculating per-turn subagent tool counts.
## Testing
- Extend the app-server multi-agent v2 integration test to cover successful
and failed spawn telemetry, duration, prompt omission, and turn counts.
GitOrigin-RevId: c1c2fb9cc2a1a9b0f63ef68509ad36d11a92d1e5
