## What changed
- Register `send_user_message_async` as `DirectModelOnly` so supported models can call it directly without exposing it through code mode.
- Exercise the async message flow with a code-mode-only model configuration and verify that the tool remains directly visible.
GitOrigin-RevId: ce22d5f63471ce90ac55ae2f3d0048f6cda57e01
## Why
A sandboxed process could replace a writable directory root, changing the
authority boundary used to construct a later sandbox policy.
## What changed
- Deny unlinking or renaming directory roots granted write access by Seatbelt,
while preserving replacement and deletion behavior for writable files.
- Reject writable roots with nested symlink components and report these as
Seatbelt preparation errors instead of network proxy failures.
- Normalize writable roots before adding them to the generated Seatbelt policy.
## Testing
Add coverage for symlink rejection, error classification, directory-root
replacement and rename protection, newly created roots, and writable file
replacement.
GitOrigin-RevId: ab1ed4e55f20034bc43e028e6529d3d1f0d8181c
## Why
Environment-owned permission profiles and workspace roots must remain effective
without being persisted or restored as thread-owned settings.
## What changed
- Keep thread settings snapshots and restore data separate from the effective
configuration supplied by the primary environment.
- Use resolved environment permissions, active profiles, workspace roots, and
network policy when building turn context and session events.
- Preserve environment selections when agents are evicted, resumed, or spawned,
and validate owner configuration when it becomes ready.
- Start memory initialization only after the primary environment is configured.
## Testing
- Extend remote-environment and multi-agent tests to cover settings persistence,
owner permission profiles, workspace roots, spawning, eviction, and resume.
GitOrigin-RevId: d82f126981cd0190233020bbdd61d96c70558868
## What changed
- Stop writing `last_updated` and `last_revision` to marketplace entries in
`config.toml`; keep the activated revision in
`.codex-marketplace-install.json` instead.
- Use installed marketplace metadata to detect up-to-date checkouts.
- Snapshot the installed marketplace before activation and roll back a stale
upgrade if another installation changed the destination concurrently.
## Testing
- Verify marketplace add and upgrade operations leave `config.toml` unchanged.
- Cover restoring a newer concurrently installed marketplace when a stale
activation is rejected.
GitOrigin-RevId: 10942c3fc7c6c3f68b7d5953e8c1b5e86bf71866
## Why
The Responses API accepts tool names up to 128 bytes, but MCP tool name
normalization limited model-visible names to 64 bytes.
## What changed
- Preserve MCP tool names up to the 128-byte Responses API limit.
- Continue shortening and hashing names that exceed the limit so generated
names remain bounded and unique.
## Testing
- Cover names at the 128-byte boundary and immediately above it.
- Verify distinct long names remain 128 bytes and code-mode compatible.
GitOrigin-RevId: 75544d00e75dd0e9328b3e2ac763d26f9cc99a48
## Why
Warnings emitted while querying SQLite or acquiring a connection must not be
written back through the same SQLite log sink.
## What changed
- Disable the `sqlx::query` and `sqlx::pool::acquire` targets for the SQLite
log filter.
- Keep warnings from other `sqlx` targets so useful diagnostics remain
available.
## Testing
Extend the log filter test to verify that query and pool-acquisition warnings
are dropped while another `sqlx` warning is retained.
GitOrigin-RevId: cec9d4e07d113de8eccec7445ede0ae68e21886d
## Why
Plugin installation skips symlinks while copying a plugin into the cache. A
symlinked manifest could therefore be used during source validation but omitted
from the staged copy, allowing a lower-precedence manifest to take its place.
## What changed
- Require discoverable manifests and their parent directories to be regular
files and directories, rejecting symlinks and other non-regular entries at a
higher-precedence manifest path.
- Verify that staging preserves the selected manifest path and contents before
activating the cached plugin.
- Preserve generated fallback manifests by injecting and validating them in the
staged plugin.
## Testing
Add coverage for symlinked manifest files and directories, precedence changes,
and fallback-manifest staging.
GitOrigin-RevId: 1b69c1e75cdfecb8cab4070a32aa9739833a70de
## Why
Reducing a heredoc shell script to its inner executable lets a prefix rule for
that executable apply to the entire wrapper, even though the full script was
not parsed as a plain command.
## What changed
- Fall back to evaluating the complete shell wrapper when plain-command parsing
fails, including for heredoc scripts.
- Keep these commands sandboxed when only the inner executable is allowed.
- Propose the full wrapper as the exec policy amendment when approval is needed.
## Testing
Added exec policy, Unix escalation, and approval scenario coverage for unparsed
and heredoc shell wrappers.
GitOrigin-RevId: 8f65133acb6b7c638263917e1d9137e45990772c
## What changed
- Pass `--unshare-ipc` when building Bubblewrap arguments for both restricted-filesystem and full-filesystem sandbox paths.
- Update the Bubblewrap argument tests to cover the new namespace flag.
GitOrigin-RevId: 61fb1d5150d09626a3b6ee7a9c6a508108c52e80
## Why
The pre-trust remote lookup must not inherit Git configuration from the
repository that launched Codex, where URL rewrites can invoke custom transport
helpers during an automatic plugin sync.
## What changed
- Add a Unix regression test that runs the startup lookup from a repository
with a local `insteadOf` rewrite to an `ext` transport and verifies that the
helper is not executed.
- Reuse `OPENAI_PLUGINS_GIT_URL` for the lookup so the production command and
regression fixture target the same remote.
GitOrigin-RevId: e53af4a82a4206c31bf0f4733f908dcc064a4795
## What changed
- Add `just assemble-codex-package` as the documented entry point for the package builder.
- Export `CODEX_REPO_ROOT` from `just` and release CI, and require the package builder to use it for repository-relative inputs.
- Resolve the ripgrep and zsh manifests relative to their Python modules.
GitOrigin-RevId: 039d12107a49171f064b0119adc6b99cf97c6c1e
## Why
Repository configuration can cause even read-only Git commands to execute
helpers, so Git command arguments alone are not enough to establish trust.
## What changed
- Remove Git commands from the known-safe command classification on Unix and
Windows, including commands nested in supported shells.
- Under the `unless-trusted` approval policy, require approval for commands such
as `git status` unless an explicit execution policy rule allows them.
## Testing
- Cover direct, shell-wrapped, absolute-path, and PowerShell Git commands.
- Verify `git status` approval behavior with and without an explicit allow rule.
GitOrigin-RevId: dd04e0ddca0c56ba64ae64abe6e658bae7bf5a4d
## Why
New non-ephemeral threads have no persisted rollout or preview until their first
turn, so moving them into a section could leave them absent from section-filtered
thread lists.
## What changed
- Materialize and flush a non-ephemeral thread before applying an explicit
section move.
- Include explicitly sectioned threads with empty previews in section-filtered
queries, and update the partial indexes to cover them.
## Testing
- Add an app-server test that moves a newly started thread into and out of the
pinned section before its first turn.
- Cover empty-preview threads in recency and section-position query tests.
GitOrigin-RevId: aa3c4daf9890f06c08b93cd60f146099cbc6cfb2
## Why
Background marketplace and plugin refreshes can otherwise inherit repository-local or command-scoped Git configuration from the project that launched Codex. That configuration can redirect remotes or invoke Git helpers during an automatic operation.
## What changed
- Run automatic marketplace upgrades, plugin cache refreshes, and curated marketplace lookups with repository-scoped Git environment variables removed and a temporary trusted repository under the Codex home.
- Carry the automatic/manual trust mode through marketplace upgrades and plugin materialization.
- Preserve the caller's Git configuration for explicit marketplace upgrades, plugin installs, and refreshes.
## Testing
- Add regression coverage for repository URL rewrites, protocol helpers, command-scoped configuration, and manual Git filters.
GitOrigin-RevId: 957f45fa3bd7ce7e1b83355f276cf65dc5e99c8e
## What changed
Replace the custom `HeadTailBuffer::drain` helper with `std::mem::take` at
the output collection call site. This moves the buffered output out while
resetting the shared buffer to its default empty state.
GitOrigin-RevId: 7a93d1312f2cea0d7913a5264eeb01726b45e0ea
## What changed
- Select user and agent summary items using the materialized `item_type` column.
- Fall back to the type in `item_json` when `item_type` is empty so rows written by older clients still produce the correct summary.
## Testing
- Extend the summary materialization test to cover items inserted without a stored item type.
GitOrigin-RevId: 45ca1107900e9b8d46561cea210a27ecd661cedc
## What changed
- Emit `codex_control_tool_call_event` for built-in control tools such as
`request_user_input`, `update_plan`, `view_image`, and goal tools.
- Record correlation and timing metadata plus completed, failed, rejected, or
interrupted outcomes, and include these calls in turn-level tool counts.
- Keep tool arguments out of control-tool analytics events.
## Testing
- Extend the app-server turn profile test to cover successful and failed
control tools, event correlation, turn counts, and argument exclusion.
GitOrigin-RevId: c20f73dfb79654e31b4b5040eddb0e0d91cae10d
## What changed
- Add a focused Code Mode integration test with Guardian transcript images enabled and enhanced Node REPL transcripts disabled.
- Verify that the Guardian request and parent request omit both the screenshot and its surrounding transcript markers.
- Remove this configuration from the broader parameterized transcript-evidence test.
GitOrigin-RevId: 1309de12337a28a7e1d49eca509ba73207d4d9be
## What changed
Move circular-value coverage for the `text()` helper from the core integration
suite to the in-process code mode runtime tests. Verify that stringification
returns no content and surfaces the V8 circular-structure error without needing
a mock server or network access.
GitOrigin-RevId: d506591af5ae8ce0a8c7305d633a7b0f2e458335
## What changed
Update the unified image budget integration test to resize a `6401x1` image to
`6000x1` and verify that the model receives the corresponding resize notice.
GitOrigin-RevId: 401e9728dc4bd6f0122bbc62f996a0b961e22b3a
## What changed
- Keep validating normalized dynamic tool visibility for both Responses and Responses Lite.
- Exercise the normalized dynamic tool call and its returned metadata only for Responses Lite.
- Let the standard Responses case complete in a single mocked response without expecting a dynamic tool request.
GitOrigin-RevId: 7793e6f6df07fc58c2976a773a1198496af08dfd
## What changed
Stop setting explicit one-second `timeout_ms` and `yield_time_ms` values in the
mock command calls. The shell command and unified exec variants now use their
default timing behavior while testing cyber exec policy.
GitOrigin-RevId: b1c25304ca47e7b08f023fe678467fc00330158b
## What changed
Use a 2049-by-32 image in the Guardian transcript evidence test and verify that
it is resized to 2048-by-32 while preserving its aspect ratio.
GitOrigin-RevId: 4b1b404c0fc76c46739379ef154e629bf8d669f3
## What changed
- Parameterize `HeadTailBuffer` by a const `MAX_BYTES` value and derive its
head and tail budgets from that value.
- Keep `UNIFIED_EXEC_OUTPUT_MAX_BYTES` as the default capacity for production
call sites.
- Update focused buffer tests to select their smaller capacities through the
type parameter.
GitOrigin-RevId: 106e81a2c2db935f7f77a4f301ef591017958287
## What changed
- Co-locate the Bash and zsh snapshot-script tests with
`codex-shell-command`, where `snapshot_script` is implemented.
- Add `tempfile` as a dev dependency for the relocated tests.
- Keep the higher-level snapshot lifecycle tests in `codex-core`.
GitOrigin-RevId: 6d5e9ab95962722f7c89ea40512bd70ee81d8da2
## What changed
- Move the Guardian thread lifecycle contributor and subagent-spawn context into `codex-guardian-v2`.
- Install the lifecycle contributor and asynchronous risk scorer through a single extension entry point.
- Remove the redundant `codex-guardian` crate and group the existing scorer implementation under `async_scorer`.
GitOrigin-RevId: 97141190c843e588b8c09c9ccd3fe00e1fae39a4
## What changed
- Expose `send_user_message_async` to root agents whenever the selected model advertises support for it.
- Retain `send_async_message` as a removed compatibility flag so existing configuration is accepted without controlling tool availability.
- Update the async message test to cover model-driven tool exposure without enabling the legacy flag.
GitOrigin-RevId: 558b427c2b203a057dd7c836e0ec702ae6134346
## Why
Bedrock sessions that use the AWS SDK credential chain need a way to recover when credentials expire during a request.
## What changed
- Add `aws.auth_refresh` provider configuration with an `aws` command, arguments, and a configurable timeout.
- Run the command for refreshable Bedrock authentication failures, reload the SDK credentials, re-sign the request, and retry it.
- Share refresh state across matching provider configurations so concurrent failures invoke the command only once. Bearer tokens, command auth, and static environment credentials do not use this recovery path.
## Testing
- Add coverage for configuration validation, refreshable error classification, concurrent refresh sharing, and an end-to-end retry signed with refreshed credentials.
GitOrigin-RevId: 0302fe3aabdbc1097e7bd62a74d407ba38a3cc57
## Why
System Bubblewrap installations that lack `--ro-bind-fd` cannot directly create
the descriptor-backed read-only mounts used by the Linux sandbox.
## What changed
- Detect `--ro-bind-fd` support when probing system Bubblewrap.
- On older versions, translate descriptor-backed mounts to `/proc/self/fd`
read-only binds and pass their descriptors and destinations to the trusted
inner sandbox stage for verification.
- Reject malformed, duplicate, mismatched, or symlink-substituted mounts, and
close inherited descriptors before running sandboxed code.
## Testing
Added unit coverage for capability detection, legacy argument translation,
invalid mount rejection, inode verification, and descriptor closure.
GitOrigin-RevId: dfc0a457b572cdd9aed093fb5abf57360e9724a2
## What changed
Remove the `repo-checks` steps that staged a Codex npm package from a fixed
release workflow and uploaded the resulting tarball as an artifact.
GitOrigin-RevId: bb3756188eeea2ed236710273234e70f17dc9e9d
## What changed
- Resolve duplicate exact-name matches to the most recent session instead of rejecting the queue request as ambiguous.
- Include non-interactive and custom-source sessions in name-based queue lookups.
- Prefer state database matches before falling back to rollout scanning.
## Testing
- Cover queueing to non-interactive and custom-source sessions, including duplicate names and a state database match that avoids importing a legacy rollout.
GitOrigin-RevId: 5b019da0a950c9381d324a09a21c78a9d0ac2252
## Why
Approval and item IDs can collide across concurrent threads. Tracking pending app-server approvals by ID alone can therefore resolve, submit, or dismiss a request from the wrong thread.
## What changed
- Key command execution, file change, and permissions approvals by both thread ID and approval ID.
- Route approval responses through the originating thread and require the thread to match when processing resolution notifications or dismissing approval prompts.
- Canonicalize parseable thread IDs so equivalent UUID representations still match.
## Testing
- Cover colliding approval IDs across threads, mismatched resolution notifications, prompt dismissal, and response routing for primary and background threads.
GitOrigin-RevId: c2d899a1e4b6a6413c78a0595a5311f5fabb9815
## What changed
- Add environment-provided MCP restrictions for configured and plugin-provided servers.
- Disable attachment-scoped servers while their environment configuration is pending, failed, or unselected, while preserving selected-plugin access and the controller-owned Apps server.
- Apply the resolved policy to runtime startup, model tool exposure, telemetry, OAuth flows, and skill dependency installation.
## Testing
- Cover policy filtering for configured and plugin servers, environment state transitions, Apps ownership, and managed OAuth rejection.
GitOrigin-RevId: 7ca5d4dda14068e758497f88835d5cba685e159e
## What changed
- Execute hook-triggered MCP calls through the runtime's latest connection set instead of preparing a separate catalog-bound call.
- Keep hook calls from waiting for server startup or reconnecting, and reject disconnected servers immediately.
- Apply the shorter of the hook-requested timeout and the server's configured tool timeout.
## Testing
- Update connection manager tests to cover non-waiting calls and disabled tool filters.
GitOrigin-RevId: 3166b2d1e26d9ae2b8b3a648b4d0897cc260eb93
## What changed
- Validate externally supplied header credentials against configured ChatGPT workspace restrictions using their `chatgpt-account-id` header.
- Reject header credentials with a missing or disallowed account ID, including credentials returned during refresh, without replacing the previously cached authentication.
- Document that identity headers must be bound to validated credentials because Codex uses them for managed authentication policy.
## Testing
- Add coverage for allowed, disallowed, and missing account IDs.
- Add coverage for rejecting a refresh that changes to a disallowed workspace.
GitOrigin-RevId: 3e3db2607cd8f9f1b8000472342e42e4b1cf00b2
## What changed
- Cover same-origin redirects for protected-resource and authorization-server metadata.
- Verify that cross-origin redirects are rejected before contacting their targets and that redirect cycles fail within a bounded timeout.
- Exercise issuer validation and resource-header isolation for both direct and redirected metadata across legacy and Agent Plugin discovery modes.
- Reuse the test environment's local HTTP client throughout the discovery tests.
GitOrigin-RevId: bd12ac232c3b020a1c098a413361f8e205699699
## What changed
- Add `send_user_message_async` for root agents when the async-message feature is enabled and the model advertises tool support.
- Emit the supplied text as an asynchronous agent message and immediately return an accepted result so the turn can continue.
- Keep the user-visible update out of the model's input context.
## Testing
- Add an integration test covering tool registration, item events, continued turn execution, and model context.
GitOrigin-RevId: 13d5168cb8cd6742db17bb74a15c910994e9c98b
## What changed
- Recognize `edu_plus` and `edu_pro` as distinct education workspace plans across authentication, backend rate-limit mapping, and app-server account schemas.
- Include both plans in cloud configuration eligibility and use the education usage-limit behavior.
- Display the plans as `Edu Plus` and `Edu Pro` in the TUI status view.
## Testing
- Cover parsing, workspace classification, account and rate-limit responses, cloud configuration eligibility, usage-limit messages, and TUI display names for the new variants.
GitOrigin-RevId: bf8add780ae03a3c6d10c4f4afa0da262c37928e
## Why
Selecting only the newest entries changes the retained transcript prefix whenever a new entry arrives, reducing cache stability.
## What changed
- Replay non-user transcript entries through a bounded buffer and evict half of the applicable pool when an entry or token limit overflows.
- Keep message and tool token budgets independent, and reject entries that cannot fit without evicting retained evidence.
- Preserve user-message selection and emit retained entries in transcript order.
## Testing
Added coverage for stable tool prefixes, message-budget overflow, rejected messages, and chunked entry-count eviction.
GitOrigin-RevId: e6181f5a229a6de06c7ef5db21a5c74980a53e97
## What changed
- Capture the process environment when the hook registry is created and reuse
that snapshot across configuration reloads.
- Clear the live environment before launching command hooks and legacy notify
commands, then apply hook-specific overrides and scrub non-inheritable
credentials.
- Resolve the default shell from the captured environment.
## Testing
Add coverage for snapshot replay, overrides, credential scrubbing, default
shell selection, non-Unicode values, and runtime reconfiguration.
GitOrigin-RevId: fee60c88e842980cdfc1bd49b14b62b9a56b08cd
## What changed
- Add an optional `delivery` field to agent message events and app-server
`agentMessage` items, with `"async"` identifying a user-visible message sent
without ending the current turn.
- Preserve the marker through legacy event conversion, thread history
materialization, replay, and generated JSON and TypeScript schemas.
- Require delivery of async agent message completion notifications on the
in-process app-server transport.
## Testing
- Cover preservation of async delivery metadata in thread history.
- Cover delivery-required classification for async agent messages.
GitOrigin-RevId: f92ba25de1293ee271404badfdf0d117d6530329
## Why
An unfamiliar executable can ignore its arguments, so trust in an apparent
inner command must not implicitly trust the executable that runs it.
## What changed
- Evaluate unfamiliar shell executables alongside their parsed commands when
determining unified exec approval requirements. Inner commands can add
restrictions, but cannot grant trust to the executable.
- Include the executable in reusable approval keys so approval for one custom
shell does not apply to another.
- Parse literal PowerShell scripts without launching the requested executable,
preserving command policy checks before approval.
## Testing
Add cross-platform coverage for spoofed shell paths, allowed and forbidden
inner commands, explicit custom-shell approval, and session approval isolation.
GitOrigin-RevId: 0dd2c7e9a2ac30965ef5fe5de1a8d2968bb5f9d0
## What changed
- Carry selected plugin identities from MCP discovery into per-turn extension data, limited to capability roots that are ready for the turn.
- Annotate executor skill catalog entries with the matching plugin ID and `user` scope.
- Include that attribution in `skill_invocation` analytics for both explicit and implicit executor skill invocations.
## Testing
- Extend the executor skills app-server test to verify plugin ID, skill scope, and invocation type for explicit and implicit analytics events.
GitOrigin-RevId: 9345600ae29bcb8eb894fffd2d6f7b05f22ebf74
## What changed
- Treat configuration, action serialization, thread lookup, and classification errors as elevated risk instead of retaining a prior low-risk result.
- Track asynchronous scoring failures separately from completed scores so approval review falls back to strict review when the latest tool call could not be scored.
- Preserve newer classification results when recording a fail-closed score.
## Testing
- Add coverage for each failure path and for ordering fail-closed scores with concurrent classifications.
GitOrigin-RevId: 7012f078a24031848f2943354a206866286ad9f4
## What changed
- Include legacy managed-file and MDM settings when resolving project root markers and project trust in both canonical and executor-local config loads.
- Preserve the existing managed-layer precedence in the final config stack and resolve managed relative paths against the same bases used by the final loader.
- Update explicit-untrusted warnings to describe the effective configuration and direct users to an administrator when the setting is managed.
## Testing
- Cover managed root markers, managed trust overrides, MDM precedence, app-server config reads, and the remote TUI warning.
GitOrigin-RevId: 9b5ddd54b4530f73589d6842a15cbab7e6d6bbb9
## What changed
- Stop writing Guardian v2 security risk scores to rollout history.
- Treat resumed and forked threads as having no previous Guardian score, so their
first tool approval is classified and reviewed normally.
- Remove the now-unused `codex-history` dependency from the Guardian v2
extension.
## Testing
- Update app-server coverage for new, resumed, and forked threads to wait for
classification completion and verify the expected approval reviews.
GitOrigin-RevId: 74d9caa903a1ff9d38e577b4697b5f8970f11ebb
## What changed
- Pass session-attributed extension metrics to the Guardian v2 sampler.
- Record `codex.guardian_v2.classification.token_usage` histograms for total, input, cached input, cache-write input, non-cached input, output, and reasoning output tokens.
- Preserve token accounting when streamed JSON produces an early score by recording usage from the terminal response in the background.
## Testing
- Cover token metrics through the Guardian v2 extension and the sampler's early-score path.
GitOrigin-RevId: 04fadc07f3b9cbe83f9fa3737536860b5cf5b4be
## What changed
- Add `NODE_REPL_AUTH_TOKEN` to the environment variables that model-reachable child processes cannot inherit.
- Remove the variable case-insensitively after shell environment policy overrides and from explicitly configured child command environments.
- Extend the environment scrubber tests to cover inherited and configured forms of the token.
GitOrigin-RevId: 716c65e0a9e222f705c226b7c86545251d3ea580
