## Why
Message roles and content classifications do not identify who supplied each context part. Source attribution needs to survive prompt assembly and history truncation, including messages that combine text from different producers.
## What changed
- Add per-part `ContentItemMetadata` for user input, developer instructions, `AGENTS.md`, skills, harness context, command hooks, and tool context with optional callable namespaces.
- Carry attribution alongside content and classifications through contextual fragments, extension prompts, hook output, and agent messages. Keep tool-provided context-window hints separate from harness text.
- Preserve the source of retained text slices during compaction and attribute generated truncation notices to the harness. Default missing historical attribution to unknown.
- Attribute host MCP calls using cached tool namespaces only when catalog revisions remain stable, without starting servers or refreshing catalogs for attribution.
- Send the new metadata to Responses Lite and strip it from requests to endpoints that do not support it.
## Testing
Extend compaction tests to cover mixed sources, missing or extra metadata entries, and discarded media. Update Responses Lite request assertions to verify endpoint-specific attribution handling.
GitOrigin-RevId: b0ebc929b7c60f3ec49d1affbf897312d63edcc8
## What changed
- Add the disabled-by-default `output_token_replay` feature to request `output.encrypted_content` from OpenAI providers.
- Preserve encrypted message and tool-call output, message and function-call status, and output-text `annotations` and `logprobs` through history and replay. Update the generated protocol schemas and SDK types.
- Strip output ciphertext from requests to other providers while retaining it in stored history, including after replay is disabled. Remove encrypted content from memory extraction inputs.
## Testing
Add integration coverage for the feature/provider combinations, metadata replay across follow-up requests, and history preservation when resuming with replay disabled.
GitOrigin-RevId: 77729a021b6771933402aebe74ece8eb39c057e2
## What changed
- Remove `ContentItemMetadata`, provenance and namespace types, and the `content_item_metadata` protocol field while retaining `content_item_kinds` classifications.
- Simplify context fragments, extension contributions, and hook output to carry content without source attribution. Return MCP tool results directly without an attribution wrapper.
- Render context-window hints together in a single text fragment.
## Testing
Update Responses and Responses Lite request assertions to expect content-kind classifications without per-content attribution, and adapt context, hook, and extension tests to the simplified types.
GitOrigin-RevId: 201894cd4c93c6d4b4c41c845e7a9af1dd3c95ca
## Why
Fixed argument limits truncated recorded tool calls even when their metadata fit within the available message budget.
## What changed
- Remove the 8 KiB per-call and 32 KiB per-output argument limits for direct calls and Code Mode.
- Preserve full recorded arguments while retaining message metadata budgets, pending-call limits, and the direct metadata retention limit.
- Rename the normalization helper to `normalize_executed_tool_call_completeness`; it now only clears completeness when calls or tool names were lost.
## Testing
Update regression coverage for large arguments, escaped inputs, reserved-key wrappers, and argument and result metadata preservation across Code Mode waits.
GitOrigin-RevId: 8c199ccf39191d5d44eef02d28b1773654735b43
## What changed
- Add `ContentItemMetadata` to distinguish user input, developer instructions, `AGENTS.md`, skills, harness context, and tool-supplied context independently of message role and content classification.
- Keep attribution attached to content through prompt assembly, history processing, and hook-output spilling. Distinguish command hooks from MCP hooks and retain tool namespaces when known.
- Treat missing historical attribution as unknown and send per-content metadata only to Responses Lite.
## Testing
Update request and history assertions to cover attribution persistence and Responses Lite metadata handling.
GitOrigin-RevId: 24e56005f5bdb98bf82f2b3943f29c4c81f3d587
## Why
Truncating recorded arguments does not lose the call inventory. Clearing `tool_calls_complete` in that case incorrectly treats retained calls and tool names as incomplete.
## What changed
Define `tool_calls_complete` as completeness of the ordered call inventory, independent of recorded arguments. Preserve it for direct tool outputs and Code Mode cells when argument limits or message budgets truncate arguments, including across later waits. Continue clearing completeness when calls are omitted or tool names are truncated.
## Testing
Update protocol, recorder, and integration tests to verify completeness survives argument truncation and message budgeting. Add coverage confirming that omitted calls and truncated tool names still clear completeness.
GitOrigin-RevId: 1534dbfabbd1291b840dd6fb6738ed51bcd4c0c4
## Why
Changing the incremental tools setting on resume should not move tool declarations and base instructions within an existing context window.
## What changed
- Determine the current window's tool declaration mode from its history, and apply the incremental tools setting when building a new window after compaction or a context reset.
- Use that mode consistently for sampling, remote compaction, startup prewarm, prompt debugging, and Guardian input budgeting.
- Preserve tool declarations alongside their comparison baseline in full-history agent forks, including compacted histories; remove them together when rebuilding context.
## Testing
Add request snapshots covering legacy resume, migration after remote compaction or a context reset, disabling incremental tools, and tool updates after restart. Extend agent fork and WebSocket startup prewarm tests to cover retained declarations and incremental tools.
GitOrigin-RevId: 7c46849a1788027a8435082e4d1f7e7f48d2700c
## Why
Persistence and aggregate metadata budgets can omit tool-call observations that are still relevant to the current request, including tool result metadata needed during compaction.
## What changed
- Retain live direct-call observations separately from bounded persisted outputs, keyed by response item ID so reused call IDs cannot mix results.
- Restore those observations for sampling and compaction, pruning them only when sampling confirms they have left the history window. Preserve observations across shortened compaction retries.
- Remove aggregate prompt metadata caps while retaining per-call argument limits and the outgoing message size limit. Invalidate cell completeness when argument normalization truncates a recorded call.
## Testing
Add regression coverage for exhausted persistence budgets, reused call IDs and reversed completion order, shortened compaction retries, and completeness after argument truncation. Extend integration coverage for large Code Mode metadata, provider metadata support, and fork/resume behavior.
GitOrigin-RevId: 004082b69bff9cc8b05f36d1052057f163c67f07
## Why
When a nested code-mode call's recorded arguments were truncated and attached to an output before its result arrived, the recorder could no longer attach the result metadata to that call.
## What changed
Retain validated call bindings so late result metadata updates the original output across retries and subsequent waits. Keep truncated arguments and incomplete call inventories intact, and apply existing metadata budgets.
Invalidate late metadata bindings when duplicate IDs, reused cells, conflicting outputs, or changed call inventories make attribution ambiguous. Clear stale pending calls when a cell ID is reused, and avoid counting duplicate pending IDs against capacity more than once.
## Testing
Add recorder regression tests for late metadata across retries, compaction, waits, and cell closure, plus ambiguous bindings and budget limits. Add a code-mode integration test that delays a tool result until its truncated call has been recorded and verifies metadata remains attached to the original output across later waits.
GitOrigin-RevId: 7398beaaa1a513147deebdea7aa841513a79d06b
## Why
Removing tool-result metadata alone can leave requests above the 15 MiB message budget when recorded tool calls and arguments occupy the remaining space. If trimming loses calls or arguments from a Code Mode cell, later waits must not report its call inventory as complete.
## What changed
- Bound all optional tool-call observations against the serialized HTTP or WebSocket message size, preserving ordinary tool outputs and continuation history.
- Shed generic result metadata, sources, and recorded arguments before resource-access evidence, retaining tool names and smaller metadata where possible.
- Invalidate completeness across affected cell outputs and later waits when the outgoing copy loses calls or arguments.
- Preserve size-limit omission markers for direct tool-result metadata when they fit, while continuing to exclude that metadata from custom providers.
## Testing
Add regression coverage for HTTP and WebSocket message budgets, unchanged tool results and history, resource-evidence retention, direct-call omission markers, and Code Mode waits after argument truncation.
GitOrigin-RevId: 538dc9d8c11b0830ec70327422f98a1803122e85
## Why
The 32 KiB per-result cap and 128 KiB aggregate budget discard tool metadata even when the outgoing request has room to retain it.
## What changed
- Remove the per-result capture cap and raise the aggregate executed-tool metadata budget to 2 MiB.
- Apply a 15 MiB soft budget to serialized HTTP requests and WebSocket messages, using the actual WebSocket delta. Trim optional result metadata on the wire copy while preserving ordinary content and logical history.
- Prioritize `openai/resource_access` metadata during trimming, and include `overage_bytes` in omission markers.
- Record bytes removed by metadata budgets in `codex.tool_metadata.shed_bytes`, tagged by stage.
## Testing
Add coverage for HTTP and WebSocket message boundaries, resource preservation, residual marker removal, unchanged history, and shedding metrics. Update direct-tool and code-mode tests to verify metadata survives beyond the previous limits.
GitOrigin-RevId: ed00996b77945300f60db1e52eff22b4de2707c1
## Why
Exceeding the aggregate metadata budget previously replaced all tool result metadata with omission markers, discarding small results unnecessarily. Oversized results also lost resource-access evidence even when that evidence alone would fit.
## What changed
- Raise the executed-tool-call metadata budget per request from 32 KiB to 128 KiB while retaining the 32 KiB per-result limit.
- Reduce the largest result metadata first and stop once the request fits, preserving smaller results.
- Retain `openai/resource_access` when full metadata exceeds capture, request, or direct-call retained-history limits. Keep resource lists intact, and discard optional result metadata before sacrificing call records, source evidence, or completion markers.
## Testing
Add regression coverage for selective reduction, resource-access retention, serialized request size, and direct-call and Code Mode behavior. Update compaction and truncation tests for the larger request budget.
GitOrigin-RevId: 698e47dcbdd3351e9a031e45ea39053608a5a0e4
## Why
Code Mode cells that finish without invoking tools omit completeness metadata, leaving a verified empty inventory indistinguishable from an unverified one.
## What changed
- Retain completed, losslessly recorded cells even when they contain no tool calls.
- Always include `executed_tool_calls` when setting `tool_calls_complete`, using `[]` for empty inventories or terminal waits with no new calls.
- Preserve completeness across request retries while revalidating history and rejecting late calls or ambiguous output mappings.
## Testing
Add regression coverage for empty tool discovery, errors, termination, feature gating, retries, and fresh-session requirements for waits. Update protocol assertions to require an explicit empty call list with completeness metadata.
GitOrigin-RevId: 24affe47f46068b6559d04a0103958ae83a00b92
## What changed
Capture result metadata for host-owned app calls when analytics and executed tool call metadata recording are enabled. Respect both `analytics.enabled = false` and host-disabled analytics, using the prepared call's ownership to determine eligibility.
Disable incremental WebSocket request reuse when raw result metadata or its call binding changes, so late results attached to an already-sent output are included in the next request. Continue allowing reuse when only other metadata changes or result metadata is filtered out for the endpoint.
## Testing
Extend coverage for direct and code-mode calls, analytics settings and host overrides, runtime recording changes, and prepared call ownership. Add metadata comparison and WebSocket reuse tests, and verify that raw response item notifications continue to omit result metadata.
GitOrigin-RevId: 411843fbff3749ee96fd6f0ebc591362942a4555
## Why
Direct tool-call records need to stay associated with the invocation that produced each output, including when call IDs are reused. Completeness must describe the recorded call inventory, independently of tool success.
## What changed
- Attach direct-call records to outputs before they enter history, and set `tool_calls_complete` when the invocation's arguments are fully recorded.
- Bound pending recordings and retained metadata, release reservations on completion or cancellation, and invalidate pending records when capture is disabled.
- Apply request budgets to direct metadata and strip it from inference and compaction inputs when capture is disabled.
- Remove executed-call metadata from app-server raw response notifications and exclude its size from Guardian history retention budgets.
- Track call IDs that bypass dispatch so their reuse cannot incorrectly establish Code Mode completeness.
## Testing
Add regression coverage for direct-call attribution, malformed calls, metadata budgets, cancellation, configuration changes, compaction, notification filtering, and Guardian context isolation.
GitOrigin-RevId: 2ebd39c7f141d04788736491495109841656b4c0
## Why
Reused call IDs, ambiguous exec/wait associations, and missing history can make tool-call completeness claims unreliable. Truncating one cell's recorded calls should also preserve completeness for unrelated cells.
## What changed
- Track observed call and runtime cell IDs with bounded memory, including call IDs from initial history, and withhold completeness when evidence is missing or ambiguous.
- Validate exec/wait input-output associations and keep invalidated completeness from returning on retries. Withhold wait completeness after resume or fork, where runtime cell IDs can be reused.
- Keep truncation markers and omission counts local to each output, clearing completeness across the affected cell while preserving unrelated cells within the metadata budget.
- Refresh recording enablement from runtime configuration without changing execution features, and preserve the live recorder during legacy configuration reloads.
## Testing
Add regression coverage for reused IDs, compaction, resumed waits, mismatched wrappers, runtime recording changes, and metadata budgeting that preserves unrelated complete calls.
GitOrigin-RevId: 0bc85964bee079879620ec0664eea530a13b61fb
## What changed
- Add host-recorded `tool_result_metadata` snapshots with size limits, redacted debug output, and protection against deserialization from untrusted input. MCP capture remains disabled.
- Preserve accepted metadata across retries and delayed Code Mode results. Shed raw metadata before source evidence, calls, or completion markers when the request budget is exceeded.
- Send raw metadata only to allowed OpenAI and ChatGPT HTTPS endpoints, filtering by the resolved destination for HTTP and WebSocket requests.
- Encode source parse failures as an array entry with type `parse_failed` and an empty ID.
## Testing
Add coverage for metadata bounds and redaction, retained-call updates, budget shedding, disabled MCP capture, and HTTP/WebSocket destination filtering.
GitOrigin-RevId: b1a396323ad0623167cdd9e20ff9453f0d01bbf7
## Why
Reasoning configuration changes need to retain their position and trusted provenance when model history is persisted and replayed. Client-injected history must not be able to forge these controls.
## What changed
- Add a typed `configuration_update` response item carrying reasoning effort, including custom model-defined values.
- Persist harness-authored updates with provenance and preserve them across history reconstruction, thread resume, raw response notifications, and agent forks.
- Exclude untrusted configuration updates from model history, strip client-supplied provenance metadata, and reject configuration updates supplied as turn input.
- Export the new item through the JSON and TypeScript app-server schemas and classify it in telemetry and persistence metrics.
## Testing
- Cover serialization, provenance persistence, history filtering and rollback, resume reconstruction, and injection attempts before and after restart.
GitOrigin-RevId: eb5559d2b52b7a931621e7c9812f009ff9fb8939
## What changed
- Add per-tool `analytics_result_source` requirements, with support for the
`detailed_message_search_v1` format and normal configuration precedence.
- Attach host-generated source IDs from accepted app tool results to recorded
executed tool calls for both direct and Code Mode invocations.
- Bound and deduplicate source metadata, reject caller-supplied values, and
shed optional source data before dropping tool-call or completion metadata.
- Preserve source updates across waits and retries while preventing stale or
compacted records from overwriting accepted metadata.
## Testing
Add coverage for requirement parsing and merging, trusted source snapshots,
metadata budgets, retries, waits, and compaction.
GitOrigin-RevId: 7d5e394219eb33e0ab7b6db3f039138a78569d17
## Why
Executed-tool metadata for a Code Mode cell can span its `exec` and `wait`
outputs. Consumers need to know whether that metadata contains the cell's full
tool call inventory or only a partial record.
## What changed
- Associate recorded tool calls with the originating Code Mode cell across
`exec` and `wait` outputs.
- Add a host-owned `tool_calls_complete` marker when recording finishes without
dropped or truncated calls. The marker describes inventory completeness, not
tool success.
- Preserve the cell metadata through replay and pruning, and clear the
completeness marker when prompt budgeting makes the record incomplete.
## Testing
Add coverage for multi-wait cells, retries, interruptions, recording limits,
argument truncation, prompt budgeting, and rejection of input-forged metadata.
GitOrigin-RevId: 377014edec06aab42aadab78b8b5dccc0a1c83ba
## What changed
- Add `ContentItemKind` as an open-ended string classification and carry an
optional list of kinds in `InternalChatMessageMetadataPassthrough`.
- Keep unknown classification values intact during round trips, while treating
a malformed `content_item_kinds` value as absent so the response item can
still be loaded.
## Testing
- Cover round trips for future classification values and deserialization of
malformed metadata.
GitOrigin-RevId: 5398cae5bb294a9f71ddd192e297177fab54a576
## Why
External tool events may need to enter thread history without a preceding function call and therefore do not have a `call_id`.
## What changed
- Allow `function_call_output` items to omit `call_id` and carry optional `name` and `namespace` fields.
- Preserve named standalone outputs during history normalization and agent forks while retaining existing pairing behavior for outputs with a `call_id`.
- Accept, persist, and forward these outputs through `thread/inject_items`, and update the app-server schemas and documentation.
## Testing
- Cover paired and standalone JSON round trips, history normalization, agent forks, and injected thread history.
GitOrigin-RevId: a3258163a7dc93777c7c3023116fe204819bdbb0
## What changed
- Reattach recorded `executed_tool_calls` metadata when an output is included in a subsequent prompt.
- Bound retained metadata to 32 KiB, prioritizing recent calls and reporting omitted calls in truncation metadata.
- Drop retained entries after their corresponding outputs leave the prompt history.
## Testing
- Cover metadata replay, cleanup after compaction, bounded retained history, and propagation through later tool requests.
GitOrigin-RevId: 1c23a26123be3b7ad51c61f4ad522139b71bb773
## What changed
- Add protocol types and `ResponseItem` helpers for attaching and clearing
locally recorded tool-call names and arguments.
- Bound serialized metadata across a prompt, replacing oversized arguments and
omitted calls with trusted truncation details.
- Prevent deserialized response items or model-provided arguments from forging
locally generated tool-call and truncation metadata.
## Testing
- Cover prompt-wide size limits, omission accounting, idempotent bounding, and
forged truncation markers.
GitOrigin-RevId: 960a223437ce81fe6b4cbb5fc7a9774408b2755b
tongzhou wang