## What changed
- Define `capabilities/discoverV2` request and inventory types and advertise `capabilityDiscoveryV2` in executor metadata.
- Prewarm installed plugin and global skill locations at server startup, with nonfatal scan failures.
- Add sandbox-scoped discovery caching with file watcher invalidation and request-time reloads when watching is unavailable.
- Batch metadata reads through the filesystem sandbox helper and bound discovery responses to 4 MiB and 2,048 capabilities.
- Share plugin identity and installed-version selection in `codex-core-plugin-common`, and fall back to `.app.json` when a plugin does not declare an apps configuration.
The V2 discovery manager is not yet wired into RPC request dispatch.
## Testing
Add coverage for inventory metadata, sandbox cache isolation, watcher invalidation, startup scan failures, response limits, and compatibility with older executor metadata.
GitOrigin-RevId: a223a5bc15fdf251023c0c71f468fd92c3b2d847
## What changed
Add `ModelRequestContributor` and `ModelResponseInterceptor` to the extension API. Contributors can add filtered `client_metadata` without overwriting existing or reserved fields and create interceptors for individual requests.
Wire contributors into HTTP and WebSocket requests, distinguishing generation from warmup. Apply response interceptors in registration order before tracing and response bookkeeping so transformed output is recorded consistently. Interceptors can inspect, buffer, or transform events, with stream ownership carrying request state and cancellation.
## Testing
Add tests for metadata protection, incremental event transformation, interceptor ordering, upstream cancellation, and consistency between delivered output, traces, and WebSocket bookkeeping. Integration tests cover output gating and interruption over HTTP and WebSocket, including a contributor that bypasses gating for warmup requests.
GitOrigin-RevId: d4bc1745d2cacf8636728dbc0a58ab9f250e9392
## What changed
Add `otel.log_agent_responses`, disabled by default and requiring an OTLP HTTP or gRPC log exporter. Emit `codex.agent_response` for completed `final_answer` messages from main agents and spawned task agents, with session, turn, item, and available parent/root attribution.
Strip memory citations from exported text, preserve the stored answer, and cap responses at 64 KiB on a UTF-8 character boundary. Include the original byte length and a truncation flag, and suppress duplicate item completions within each turn. Exclude commentary and non-task agents.
## Testing
Extend configuration tests for default-off and explicit opt-in behavior, the agent execution test for main/subagent response attribution, and the log-buffer test for response-event exclusion.
GitOrigin-RevId: eacda1150de2e6bac2c667d71b57214b0a086f1a
## Why
App-server clients need a way to connect to executors that require bearer authentication through `environment/add` and `environments.toml`.
## What changed
- Add optional `authBearerToken` to `environment/add` and `auth_bearer_token` to URL entries in `environments.toml`.
- Send the token as an `Authorization: Bearer` header on initial connections and reconnects, without automatic refresh. Require `wss://` or a loopback destination when a token is supplied.
- Redact tokens in debug output, mark connection headers sensitive, and omit source text from TOML parse errors.
- Preserve unauthenticated behavior when tokens are omitted, including requests with a null `authBearerToken`.
## Testing
Add integration coverage for authenticated and unauthenticated executors through both RPC and TOML configuration, including missing, null, incorrect, and malformed RPC tokens. Extend tests for reconnect authorization headers, token redaction, URL-only token configuration, and timeout preservation.
GitOrigin-RevId: 2a5d48a1846df1720e4a9b295968348378c287c6
## Why
HTTP retries used local backoff even when the server supplied `Retry-After`. Relative retry delays also failed to account for time spent propagating errors or reporting retries.
## What changed
- Parse `Retry-After` delay seconds and HTTP dates into a monotonic deadline captured when response headers arrive.
- Honor that deadline for HTTP retries, falling back to local backoff when valid advice is absent.
- Preserve deadlines through API and Bedrock error mapping, stream retries, and exhausted retry state. Expired advice remains a zero delay instead of triggering local backoff.
## Testing
Add coverage for header parsing, deadline countdown and expiry, error mapping after exhausted HTTP retries, and delayed stream retry notifications. Update Responses and remote compaction tests to verify that HTTP retries honor `Retry-After`.
GitOrigin-RevId: a2eff02946e5524f29e06f7ba1431e3d339261a4
## Why
Linux pipe launches need session, parent-death signal, and descriptor setup. Move this work into a fresh, single-threaded executable image to avoid forking the app-server for child setup.
## What changed
- Register an early setup helper and launch it through `posix_spawn` for Linux pipe processes.
- Start the helper with an empty environment, then transfer the target environment over a control socket so loader settings cannot interfere with helper startup.
- Await target execution asynchronously, propagate setup and execution errors, and kill incomplete launches on cancellation.
- Preserve direct spawning as a fallback when the helper is unavailable or fails before target execution.
## Testing
Add coverage for launch semantics, avoiding fork, loader environment isolation, early argument dispatch, closed standard descriptors, and fallback under bootstrap failure or descriptor pressure. Add an app-server regression test that reuses a process handle after an execution failure.
GitOrigin-RevId: 079c673f0f22ebd531f8c57e5338095cc98acfdc
## Why
Unix command hooks use a `pre_exec` callback to detach from the controlling terminal, forcing the launcher to fork. Native spawn attributes can create the detached session without that callback.
## What changed
- Route Unix hooks through `codex_utils_pty::Command` with `ProcessMode::NewSession`.
- Extend the native `posix_spawn` launcher to detached Linux sessions, retaining compatibility fallbacks for unsupported libc features and executable handling.
- Preserve the session environment snapshot, hook overrides, and restricted-variable filtering.
## Testing
Add regression coverage for launches without parent forks, terminal detachment, environment and argument handling, Linux `PATH` lookup, and executable compatibility. Cover process-group cleanup on cancellation and timeout, including descendants holding output pipes open, and preservation of background descendants after completed hooks.
GitOrigin-RevId: dbe2cf12d84aa79868cfb55ace40c7d5b5282703
## What changed
Expose the shared `--ws-auth` options on `codex exec-server` for direct WebSocket listeners. Support capability tokens configured by token file or SHA-256 digest, and signed JWT bearer tokens. Validate `Authorization: Bearer TOKEN` before each WebSocket upgrade, rejecting missing or invalid credentials with HTTP 401 when authentication is enabled.
Reject listener authentication with stdio, `--remote`, or `forward`. Document the options and connection-time authentication behavior.
## Testing
Add CLI integration tests for all three credential configurations, unauthorized upgrade rejection, authenticated RPC initialization and reconnects, invalid configuration, and incompatible transports.
GitOrigin-RevId: 941fbd3d43e732c910d29b6f8137077b7c332835
## What changed
Move WebSocket authentication arguments, settings, credential loading, and upgrade authorization into a shared crate using `http` types. Update the app server, transport, and CLI to consume it directly, and remove the `AppServer` prefix from the shared types.
Hide token digests and JWT verification secrets from authentication policy `Debug` output.
## Testing
Move the existing argument validation, capability-token authorization, and signed bearer-token verification tests into the new crate.
GitOrigin-RevId: 1dd20043a3f8efbca55af7eda338b62a62e8fd68
## What changed
- Detect Terminal.app from primary and secondary device attributes during startup on Unix SSH sessions without a detected multiplexer. Ignore signatures inside bracketed paste and leave incomplete replies unknown.
- Use inline mode when Terminal.app is detected and `tui.alternate_screen` is `auto`. Apply the decision before the first startup frame and retain it for later configuration loads. Preserve explicit `always`, `never`, and `--no-alt-screen` overrides.
- Update the `crossterm` dependency revision and lockfiles.
## Testing
Add coverage for terminal signatures, fragmented and pasted replies, probe completion and timeout behavior, screen-mode overrides, and an inline startup snapshot.
GitOrigin-RevId: 9b937824b080f9bd6de29df1d9e84f42a698af46
## What changed
- Route remote-control enrollment, pairing, client management, and WebSocket connections through the authenticated HTTP client factory. Keep policy denials distinct from authentication failures and wait for policy changes before reconnecting.
- Preserve policy denials through exec-server connection failures so later connection attempts and capability discovery can recover. Keep direct executors running through temporary policy outages while rejecting permanent policy failures.
- Build cached HTTP transports on blocking workers, serialize construction, and retain successful builds after callers time out so request deadlines cover queued construction.
## Testing
Add regression coverage for policy recovery during remote startup, direct registration, accepted WebSocket reconnection, and capability discovery; queued transport construction timeouts; and remote-control WebSocket fallback with invalid custom CA files.
GitOrigin-RevId: c81db18e83de957175bb213d165281ac701089dd
## Why
AWS credential discovery, analytics, and telemetry used clients that did not share the application's network policy. These requests need to honor destination restrictions and permission revocation.
## What changed
- Route AWS credential and region HTTP requests through the shared HTTP client, and check the signing destination before loading credentials. Skip discovery for static access keys with an explicit region.
- Apply account-scoped policy to Bedrock authentication. Require unrestricted policy for credential exporters and reauthentication commands, and cancel active work when permission is revoked. Document that AWS profile `credential_process` network traffic remains outside the application's HTTP policy.
- Send analytics through the authenticated account's HTTP client factory.
- Guard OTLP log, trace, and metric exports with revocable permits, disable them under destination restrictions, and make managed HTTP exports cancellable. Suppress global Statsig settings while managed policy is active.
## Testing
Add coverage for metadata credential request cancellation, allowed and denied SigV4 destinations, AWS credential precedence and endpoint configuration, and blocked credential exporter recovery. Update telemetry tests for account transitions and managed-policy Statsig suppression.
GitOrigin-RevId: d8a2018bfbbe971ec430699b0d3f86a7a9e1e072
## What changed
- Load `application.network` requirements at startup and explicit config/account reloads, applying local policy before authentication and cloud configuration bootstrap.
- Block traffic when policy loading fails, cancel requests that a new policy no longer permits, and reject configuration loads based on superseded policy snapshots. Local requirements edits take effect on the next explicit reload or restart.
- Bind authenticated clients to the current account and revoke them when account ownership changes. Carry policy enforcement through backend requests, realtime connections, workload identity exchanges, and code-mode gRPC streams while preserving gRPC trailers.
- Treat denied credential refreshes as policy errors without retrying them or invalidating stored credentials.
## Testing
Add regression coverage for startup restrictions, reload ordering, cancellation after restrictive or malformed requirements edits, account revocation, gRPC destination denial, workload identity cancellation, and credential preservation after denied OAuth refresh.
GitOrigin-RevId: 0cb4c720a906397e9df06675f01ecf60d741101f
## Why
Destination restrictions and policy revocation must remain effective during redirects, response body reads, and established WebSocket traffic. Policy denials must also survive error handling so callers do not retry them or report a revoked operation as successful.
## What changed
- Route managed HTTP clients through a shared `RequestBuilder` and policy-aware execution, checking each redirect destination before route resolution and retaining a network permit while consuming response bodies.
- Guard WebSocket connection setup, reads, and writes with revocable permits, including independent wakeups for split readers and writers.
- Preserve `TransportError::Policy` through HTTP, SSE, and realtime error handling, and treat policy denials as non-retryable.
- Keep the supplied network policy in plugin startup HTTP requests and propagate response body failures from backend and plugin requests.
## Testing
Add regression coverage for rejection before connecting, revocation during redirect routing and streamed body reads, split WebSocket revocation, realtime writer error propagation, and revoked plugin upload responses.
GitOrigin-RevId: fba36700444c98a8364c09b4dc5452c4d78a90fb
## Why
MCP requests pass through background transport queues, so HTTP requests need the caller's trace context carried explicitly to preserve trace ancestry.
## What changed
- Capture W3C trace context in request metadata for tool and resource operations, custom requests, and event streams.
- Restore that context in an `mcp.http.request` span around HTTP POSTs, linking outgoing HTTP traces to the originating request.
- Preserve application metadata while replacing trace fields with the current caller's context and removing stale `tracestate`. Read the SDK's merged metadata so extension fields retain precedence over parameter metadata.
## Testing
Add a unit test for metadata merge precedence and an integration test covering concurrent paginated requests, tool calls, custom requests, and tool-call continuations across legacy and `2026-07-28` protocol modes. Verify HTTP trace ancestry, metadata preservation, and removal of stale `tracestate`.
GitOrigin-RevId: 0b22cd75f31f9fcb855b27fa8d34ecdffd6e3549
## Why
Standalone web search used a default HTTP client, bypassing the configured system proxy route when `respect_system_proxy` was enabled.
## What changed
Pass the configured `HttpClientFactory` to the web search tool and create its client asynchronously for the provider's search URL using the API route policy. Export and reuse `SEARCH_ENDPOINT` so route selection and search requests use the same endpoint.
## Testing
Add an isolated regression test with environment proxies removed and a mock system proxy. Verify that standalone web search reaches the proxy and returns its result in the follow-up model request.
GitOrigin-RevId: 3b64803a777b9d1eb0ccf694e06658b0fd562129
## What changed
- Add optional `network.mitm_ca` configuration with `certificate_file` and
`private_key_file` for trusted proxy configuration. Require MITM to be enabled
and retain the generated CA when no external CA is configured.
- Validate absolute paths, regular files, file sizes, certificate/key matching,
and Unix private-key permissions. Reject symlinks on Unix, private keys embedded
in certificate files, and external private keys on non-Unix platforms.
- Store derived external-CA trust bundles in the proxy artifact directory,
include only certificates, and skip inherited generated bundles to avoid
retaining stale roots.
- Preserve MITM for external CAs when disabling credential brokerage. Reject
external CA configuration for remote execution, even when the proxy is disabled,
and reject unknown fields in `NetworkProxyConfig`.
- Default the upstream request version adapter to HTTP/1.1 and remove the request
URI from upstream request failure context.
## Testing
Add regression coverage for external CA configuration, mismatched keys, embedded
private keys, non-Unix rejection, trust-bundle placement and contents, stale-root
exclusion, credential-broker toggling, and remote configuration rejection.
GitOrigin-RevId: cb209295c19fbe53a9fa0194f11ff06acccabef6
## Why
Extension calls omitted environments whose working directories could not be converted to host-native paths, preventing extensions from receiving those environments.
## What changed
Store `ToolEnvironment.cwd` as `PathUri` and pass all turn environments to extension tools without requiring host-native path conversion. Keep image generation's existing path requirements by selecting the first environment with a convertible working directory when reading referenced images or saving generated images.
GitOrigin-RevId: b4320c6e07d27ef59885cd0013e5d1c535f69659
## What changed
- Disable default features for `sentry`.
- Disable default features for `syntect`, explicitly enable `parsing`, `plist-load`, and `regex-onig`, and switch `two-face` to `syntect-onig` in `codex-rs/tui`.
- Remove the resulting unused dependencies from the Cargo and Bazel lockfiles, including Actix, Sentry integrations, `ureq`, and `yaml-rust`.
GitOrigin-RevId: b3ca6610fdc60ab99909660f56099fbb4093b9c5
## Why
Row derives and migration embedding do not need query macros or a host SQLite driver.
## What changed
- Remove the `macros` feature from `sqlx` and depend directly on `sqlx-macros` with only `derive` and `migrate` enabled.
- Update state and thread-store derives and migration embedding to use `sqlx_macros`.
- Enable `sqlx-sqlite`'s `offline` feature directly to preserve query-description support in the target driver.
- Pin `sqlx`, `sqlx-macros`, and `sqlx-sqlite` to `=0.9.0` to keep their versions aligned.
GitOrigin-RevId: 8a8ef691ff2862a7dad978a578c5206b52dfc0b6
## What changed
- Replace the built-in orchestrator skill provider with a host-supplied cloud provider, using `cloud` authority and `c` root aliases in skill tools and prompts.
- Add `cloud.skills.enabled`, defaulting to true but requiring a supplied provider. Keep `orchestrator.skills` accepted as a legacy no-op setting, and remove the app server's automatic orchestrator provider registration.
- Discover cloud skills once per turn during cancellable startup. Serve catalog snapshots to prompts and tools without triggering discovery or retries.
- Scope cached catalogs and resources to authentication state. Preserve them on refresh failures within the same scope, invalidate them when that scope changes, and reject late discovery or read results from replaced cache generations.
- Reuse executor discovery catalogs only when successful discovery inputs and bundled-skill settings match.
## Testing
Add coverage for per-turn refresh, skill removal, same-account failures and reconnects, authentication changes, and stale in-flight results. Update configuration and tool tests for cloud authority, provider gating, and resource reads without an executor.
GitOrigin-RevId: c57e38ec7dcc880c0d4c8a2995adfd3e28301079
## What changed
- Register the existing message-board tools with the app server through a lifecycle extension, gated on `agent_message_board`, multi-agent v2, and non-ephemeral sessions. The new feature flag is disabled by default.
- Bind tools to each agent's identity and share the SQLite-backed board across the agent tree and runtime resumes.
- Use the runtime clock for posts and deliver ID-only notifications to running agents, with tools to retrieve post contents. Skip inactive recipients without starting them or queuing notices.
- Emit a warning and leave board tools unavailable if initialization fails.
## Testing
Add runtime scenarios and a context snapshot covering feature gating without creating storage, posting and searching, active-only notifications, sharing with child agents, persistence across resume, and clock failure without channel creation.
GitOrigin-RevId: a81bd85cd372b0d122ba375ed1a1bfd3ba3a3b7c
## What changed
Expose `message_board_tools` to create nine tools for channel creation and discovery, thread listing, post search and reading, subscriptions, and posting. Bind tools to the host-supplied caller identity and resolve agent references relative to the caller. The factory does not register or enable the extension.
Keep responses valid JSON within an 8,000-byte cap and the call's output budget. Reduce read limits and previews as needed while preserving backend pagination, and reject mutations when the budget is too small to acknowledge them. Derive post request IDs from turn and invocation metadata for direct and Code Mode calls.
## Testing
Add integration coverage for invalid arguments, mutation rejection without writes under insufficient budgets, duplicate post calls, distinct Code Mode invocations, relative notification recipients, author filtering, and bounded Unicode reads with continuation offsets.
GitOrigin-RevId: 2fbc58a4c7eb861055847c363061d73749bf573c
## What changed
Implement `AgentMessageBoard` for `LocalAgentMessageBoard`, adding SQLite queries to list channels and threads, search posts, and read thread replies.
- Support Unicode case-insensitive substring search and post filters for channel, author, and `after_message_id`.
- Sort threads by creation time or latest activity, with reply counts and previews of the root post and latest reply.
- Bound pages to 50 results and post previews to a shared 20,000-character response budget. Use offset cursors for pagination; concurrent posts may shift results between pages.
- Add indexes for board and thread timestamp queries.
## Testing
Add integration tests covering pagination, page and preview caps, Unicode search and truncation, thread activity ordering, filtered search, and rejection of non-root thread IDs and unknown callers.
GitOrigin-RevId: c9c673768596efb6d33160e2db8dff62ee9b9cdb
## What changed
Add `LocalAgentMessageBoard` with persistent channels, posts, and subscriptions scoped by `SessionId`. Support channel creation, posting and replies, subscription changes, and bounded reads using Unicode character offsets.
Serialize mutations across independent handles with immediate transactions. Deduplicate retries by caller and request ID, reject changed requests that reuse an ID, and return existing post metadata without repeating notifications. Deliver deduplicated notifications after commit; notification failures leave committed posts successful and readable.
## Testing
Add integration tests covering concurrent retries across independent handles, reopening persisted boards, subscription routing, board isolation, Unicode reads, invalid recipients, inactive recipients, and notification failures.
GitOrigin-RevId: 0cdf621d19517bf57d527fd729290e08ac99f165
## What changed
Add `codex-agent-message-board-extension` to the Cargo workspace with a Bazel target. Define backend-independent contracts for discussions within a persistent agent tree:
- `AgentMessageBoard` covers channel creation, posting, thread listing, post search, bounded reads, and subscriptions, with documented membership and retry semantics.
- `MessageBoardHost` provides agent resolution, the caller's configured clock, and metadata notifications restricted to active turns.
- Shared request and response types represent channels, posts, threads, subscriptions, and cursor pagination, including derived page counts and continuation indicators.
The crate defines interfaces and records for local or remote backends; storage, tool adapters, and feature registration remain separate.
GitOrigin-RevId: d8734f0226bc0c0d521929e7dd30b414136dcb95
## Why
Completion timestamps always used a 12-hour clock, even when the host preferred 24-hour time.
## What changed
- Detect the clock preference from native settings on macOS and Windows, and from `LC_ALL`, `LC_TIME`, then `LANG` on Linux with glibc.
- Render completion times in the detected format, such as `14:32` instead of `2:32 PM`, for both live turns and restored history.
- Cache detection without changing the process locale, and retain 12-hour output when the preference cannot be determined. Recognize standard `C` and `POSIX` locales as 24-hour on Linux and Android.
## Testing
Add tests for locale precedence, unavailable locales, and clock pattern parsing, plus snapshot coverage for 24-hour timestamps with dates and line wrapping. Update completion timestamp normalization to handle both clock formats.
GitOrigin-RevId: eb338e67de627cbb992de16058884ece2b4b9ff7
## Why
Server version notices previously required both versions to be stable releases, leaving prerelease and local clients without notices about differing background services.
## What changed
- Use semantic version parsing to distinguish older servers from version mismatches.
- Compare stable clients against older releases, including prereleases. Compare prerelease clients by precedence within the same release line and report other release lines as different.
- Report differing versions for local clients (`0.0.0` or versions with build metadata). Ignore malformed versions.
- Show the corresponding `older than` or `different from` notice and `<` or `≠` overview indicator, while preserving `/daemon` guidance and the `show_server_version_notice` setting.
## Testing
Add version-policy tests and notice snapshots covering prerelease ordering, local builds, mismatches, and malformed versions. Add daemon tests for notice suppression and manual update guidance without scheduling an update.
GitOrigin-RevId: 29df4713a7dbcbddcf30d56995a8496e7e8d0c6a
## What changed
Expose the shared `Child` type and `spawn_child` function from `codex-utils-pty`, and update the MCP stdio transport to use them. Move the existing macOS spawning implementation and its tests into the utility crate, preserving platform-specific spawning, piped stdio, and kill-on-drop behavior.
GitOrigin-RevId: 26c2fb2f22cdba907aa9d18cab7dc8c4ac1c909e
## Why
Allow the network policy proxy to run without a full Codex permissions profile.
## What changed
- Add `codex-network-proxy --config <PATH>` to load a standalone JSON file containing a `network` object and run the proxy independently of Codex.
- Require `network.enabled = true`, limit configuration size to 1 MiB, and reject unknown fields, including nested MITM hook fields, and trailing JSON values.
- Enable HTTPS MITM automatically for limited mode or configured `mitm_hooks`, while supporting explicit `mitm` configuration.
- Document the standalone configuration and invocation.
## Testing
Add tests for MITM defaults, dynamic policy keys, unknown fields, and trailing JSON values. Add a regression test that verifies `wait()` promptly returns an error when either the HTTP or SOCKS listener fails.
GitOrigin-RevId: ba20b9c3022b16abaa5597f473c418cfc06c18ee
## What changed
- Support an optional cloud provider alongside executor plugins, refreshing its thread-scoped catalog at each regular turn when plugins are enabled.
- Use cloud connector metadata for app attribution without starting cloud-declared MCP servers.
- Scope cached catalogs to authentication and Apps availability. Retain the previous catalog on discovery failure within the same scope, clear stale catalogs on auth changes, and reject results completed under outdated credentials.
- Add a cancellable regular-task startup phase that reconciles MCP before discovery and reapplies contributor state afterward without invalidating resource caches.
## Testing
Add regression coverage for per-turn refresh, empty catalogs, discovery failures, plugin disabling, auth changes during discovery, MCP reconciliation and cancellation, and cloud app attribution alongside executor MCP tools.
GitOrigin-RevId: 8469eb109ea316e21cbc4122c52ad8000caeef03
## What changed
Add `ToolLifecycleContributor::on_command_start` with `CommandStartInput` carrying the resolved command, working directory, selected executor's filesystem, and lifecycle context. Await contributors after command hooks and environment resolution so they can prepare the filesystem before `exec_command` runs, including calls from code mode.
Reserve process IDs only after preparation completes so cancelled preparation does not consume an ID. Keep deterministic process IDs from being reused after removal.
## Testing
Add tests for direct and code-mode calls that verify callbacks receive hook-rewritten commands and the executor's working directory, filesystem preparation completes before execution, and interrupted preparation prevents execution without consuming a process ID. Add a regression test for deterministic process ID reuse after removal.
GitOrigin-RevId: d10bcafcc583a6e3e8b5924d004806727e3763bb
## What changed
- Record an explicit allowlist of scalar configuration values and individual boolean feature tags for each sampling request, replacing the combined enabled-feature list.
- Distinguish configured context-window overrides from the effective model limit, and emit `unset` for absent values so earlier overrides do not linger.
- Expand `tags_json` into report metadata and raise the tag limit from 64 to 512, while allowing existing values to update at capacity.
## Testing
Add tests for configured and effective context windows, clearing overrides, feature toggles, dynamic tag upload serialization, and updates at the tag limit.
GitOrigin-RevId: 57608fac936d8ce315e36d452a2950e46370b39b
## Why
Providers configured with `gateway_oauth` need gateway credentials alongside primary authentication for inference and model discovery.
## What changed
- Attach gateway tokens through the configured header or cookie while preserving primary authentication, including WebSocket handshake headers.
- Share gateway credential managers across matching provider instances and model discovery so they observe refreshed tokens.
- Reject authentication on gateway setup or token failures, invalid token values, and conflicting auth headers. Mark gateway headers sensitive and avoid exposing issuer error details.
- Include gateway OAuth configuration in model catalog cache identity to prevent reuse across different gateway configurations.
## Testing
Add provider and core integration tests covering combined credentials, header and cookie delivery, token refresh, shared credential state, cache isolation, and request blocking on gateway token or HTTP client initialization failures.
GitOrigin-RevId: cb74125cf7e87660967d49edacf14646cf0b99c4
## Why
Async questions answered on another client should disappear from the TUI without losing drafts for other questions, even when questions have identical titles.
## What changed
- Send answers using the desktop reply envelope with stable per-question IDs, and resolve matching questions from committed messages and replayed history.
- Render replies as readable question-and-answer text in transcripts, queue previews, and input history.
- Preserve separate reply envelopes and message order when retrying rejected or interrupted input.
- Account for JSON escaping in input limits and fall back to plain text for oversized question IDs.
## Testing
Add regression coverage for cross-client dismissal, draft preservation, replay ordering, reply parsing, IDE context, distinct replies with identical text, and retry ordering. Update the async question scenario to use the reply envelope.
GitOrigin-RevId: 9b9e4b1e140508590401622d96cfc16fc192eb7c
Preserve known error classifications, including BioPolicy, while falling back to Other for unknown values so saved sessions can still be read.
Add optional gateway OAuth settings to model provider configuration.
Co-authored-by: Owen Lin <owen@openai.com>
Co-authored-by: alexsong-oai <alexsong@openai.com>
GitOrigin-RevId: 64bcf45ca042efca7645c798db3746375426b0fe
## What changed
- Add `Platform` to `codex-utils-path-uri` with metadata parsing, native platform detection, and path convention mapping. Preserve missing or unrecognized metadata as `Unknown`.
- Replace `NetworkProxyExecutorOs` with the shared type and keep executor-specific socket path validation in the network proxy.
- Extract `effective_sandbox_mode` with explicit platform and Windows sandbox level inputs, preserving the native Windows fallback from `workspace-write` to `read-only` when the sandbox is disabled.
## Testing
Add unit tests for platform metadata, path conventions, native platform detection, and sandbox mode selection across platforms and Windows sandbox levels.
GitOrigin-RevId: 4fe0972e3a91040e35f2a6dfa5bcdf6c9a29be88
Move the exponential backoff helper into `codex-async-utils` so
`codex-cloud-config` can use it without a runtime dependency on `codex-core`.
Keep `codex-core` as a development dependency for cloud-config tests.
Preserve the existing retry delays and jitter, and re-export `backoff` from
`codex_core::util` for existing callers.
GitOrigin-RevId: 338f3194e166e77003da532310ff5be78a0eac9e
## What changed
- Add `features.daemon_auto_start`, disabled by default and available through `/experimental`, to start the shared local server for eligible new, resumed, and forked sessions. Changes take effect on the next launch, and disabling the feature persists an explicit `false`.
- Require successful daemon startup and connection when auto-start applies. On failure, show guidance to rerun the same command with `--no-daemon` instead of silently falling back to an embedded server.
- Preserve embedded mode for excluded launches, including Bedrock sign-in, and carry exclusion warnings through resume and fork pickers. Honor `--no-daemon` without an exclusion warning.
- Update `/import` guidance to recommend restarting with `codex --no-daemon`.
## Testing
Add CLI and TUI coverage for automatic daemon attachment, startup and connection failures, `--no-daemon`, picker warning persistence, and Bedrock onboarding with and without a running daemon. Add snapshots and configuration-write assertions for the experimental toggle.
GitOrigin-RevId: 2e8eb163bc7ddd268a86c7546c05a85356c1e9ee
## Why
Removing the selected working directory can prevent filesystem sandbox helpers from launching, even when the requested absolute paths remain accessible. Permission rules must stay anchored to the selected directory while those operations continue.
## What changed
- Require a policy `cwd` in `FileSystemSandboxContext` and launch filesystem helpers from the filesystem root while preserving the policy directory and workspace roots.
- Carry explicit `policyContext` in filesystem RPCs, preserving legacy wire fields and resolving omitted directories from older clients at executor ingress.
- Keep permission paths as executor file URIs and validate host compatibility where they are enforced.
- Bind Windows relative denial globs to the policy directory before changing the helper's launch directory, preserving home-relative patterns.
## Testing
Add regression coverage for `apply_patch` after working-directory removal, legacy RPC directory fallbacks, cross-platform permission URI transport, and Windows relative read denials. The patch regression verifies that an allowed file is updated while an explicitly denied file remains unreadable and unchanged.
GitOrigin-RevId: b0f4db722b27cb72ec129fc297c85732afac11f7
## What changed
Upload prepared images from messages and tool outputs through the session's `AttachmentStore` before recording history. Use the returned inline bytes or file reference, and fall back to the prepared inline image if upload fails.
Keep history replay on `InlineAttachmentStore` so it does not upload recorded images, and preserve existing file references. Reuse image resizing directly for guardian review comparisons without uploading.
## Testing
Add coverage for upload failure preserving resized inline images. Extend rollout coverage to verify that only new images are uploaded, uploaded bytes have the expected dimensions, and file references and resize notices survive replay.
GitOrigin-RevId: e9966297c3579ef1e52376f0235fe3a7e3ec7ecc
## What changed
- Render completed `mermaid` fences with `codex-mermaid`, using syntax-theme colors for nodes and edges.
- Keep source visible for unclosed, invalid, unsupported, or oversized diagrams, and preserve the original Mermaid for copying and raw mode.
- Keep streamed diagrams mutable until the next top-level block so closing fences and terminal resizing can update their display. Preserve scrollback progress across width and render-mode changes.
## Testing
Add renderer and streaming tests covering supported diagram families, nested fences, Unicode, theme colors, source fallbacks, resizing, raw-mode transitions, and original-source preservation. Verify that node connection ports retain node styling in all four flowchart directions.
GitOrigin-RevId: 9a759248110e6730d629d653061ff7e2ec5dc2c0
## What changed
- Probe for screen readers at startup on macOS, Windows, and Linux, with a 450 ms timeout. Include Windows Narrator detection in the current login session.
- Save `tui.animations = false` when a screen reader is detected and no user animation preference is configured. Preserve explicit preferences and config comments, and retain a session default if saving fails.
- Record the attempt in `tui.screen_reader_detection_done`; either boolean value skips future detection. Allow explicit animation preferences to override the screen-reader default on reload.
## Testing
Add tests for one-time detection, timeouts, preference preservation, temporary CLI overrides, persistence failures, and preference reloads. Verify rendering without animation frame requests and interactive startup that records detection without replacing an explicit preference.
GitOrigin-RevId: f61c19dfd053f97e8cfed68dce7389fa7601120d
## What changed
- Add `ResolvedModelMessages` to resolve catalog text and bundled defaults while preserving explicit empty overrides and their source.
- Move base-instruction rendering, Guardian prompt composition, multi-agent role rendering, and `update_plan` guidance filtering into `codex-prompts`; migrate consumers to the shared APIs.
- Separate permission-profile resolution from prompt composition, and annotate Guardian policy and classifier instructions with content kinds.
## Testing
Add and update coverage for missing versus empty templates, literal overrides, multi-agent role composition, Guardian policy substitution and truncation, and preservation of permission path spellings and order.
GitOrigin-RevId: 52335bb7acec0f432d5c57acb2accd5f0276056e
## Why
Network access and Unix-socket allowlists must not let commands with filesystem restrictions reach the privileged app-server RPC transport.
## What changed
- Bind Unix control sockets in a fixed, user-owned directory with mode `0700`, independent of environment settings, and expose the advertised paths as symlinks. Preserve existing parent permissions, reject unsafe parents, and serialize socket setup and publication.
- Mask the socket directory in Linux bubblewrap sandboxes after each bind that exposes it. Reject host mount aliases and nested mounts that compromise isolation.
- Deny access to the directory and outbound connections to its sockets in macOS Seatbelt policies, including when network access or Unix-socket allowlists grant broader access.
- Require bubblewrap for filesystem-restricted Linux execution. Users with `features.use_legacy_landlock` enabled must disable it for these policies.
## Testing
Add regression coverage for direct and symlink socket access, hardlink attempts, Linux host-process links and bind-mount aliases, and continued use of unrelated and sandbox-local sockets. Add transport coverage for parent permissions, concurrent restart after a stale symlink, and cleanup that preserves a replacement at the advertised path.
GitOrigin-RevId: 53372c27eea278d964f2cf68aed24323ef3b7082
## Why
The default resolver misses macOS supplemental resolvers and VPN split DNS, preventing Codex from reaching hosts that depend on those DNS settings.
## What changed
Use `tokio::net::lookup_host` for IPv4 and IPv6 lookups in the macOS TCP connector, including connections to upstream proxies. Preserve existing checks on resolved destination addresses and reject unsupported TXT lookups without falling back to a different resolver.
## Testing
Add macOS tests for IPv4 and IPv6 localhost resolution and connections, local-network rejection, and resolving the upstream proxy instead of the destination.
GitOrigin-RevId: 3c7fc4f8b309e26b02923d8fafd4e1f1e1f7755f
## What changed
- Extend `GuardianModelPolicy` with controls for uncategorized tools, unscored actions, the initial computer-use call allowance, and sandboxed command coverage.
- Add `GuardianPolicyLoader` in `codex-config` to translate legacy settings, preserve catalog policy precedence, and enforce reviewer requirements. Apply live model review requirements through `ConfigRequirements::constrain_guardian_policy`.
- Use the shared model policy for Guardian scoring and approval, replacing the extension-local policy wrapper while retaining legacy defaults.
## Testing
Add configuration tests for catalog precedence, legacy scope fallback, required-model constraints, and legacy computer-use opt-in and feature gating. Adapt existing extension tests to consume the shared policy.
GitOrigin-RevId: 6fed1c3a831964ad28ea7de5cb19e74e323c1204
## What changed
Add `codex tcp-tunnel` and the `codex-tcp-tunnel` crate to forward loopback TCP connections to an explicit target through a TLS-verified HTTP/3 CONNECT proxy.
- Require the proxy origin to match an approved HTTPS origin in a supplied policy file.
- Read bearer tokens and optional bounded, non-forwarding `x-` headers from stdin. Support token updates for new connections, `LISTENING` and `AUTH_UPDATED` notifications, and shutdown when the control pipe closes in token-update mode.
- Preserve the listener across proxy reconnects without replaying TCP streams, and let accepted streams continue while a proxy drains.
## Testing
Add tests for hidden CLI parsing, proxy and target validation, credential renewal, control-pipe closure, and invalid input without secret disclosure. A local HTTP/3 proxy test covers token replacement, transport recovery without stream replay, and graceful draining.
GitOrigin-RevId: c6af3025301c61e9fe90940cf5a6df0039465e69
## Why
Permission summaries must preserve executor paths without interpreting them in the host's filesystem namespace.
## What changed
Accept `PathUri` values and summarize permission profiles directly instead of converting them to a legacy sandbox policy. Render additional workspace roots using their inferred native path convention, and update the exec and TUI callers.
Keep workspace subpath writes and writes outside the working directory classified as `custom permissions` when the working directory itself is not writable.
## Testing
Add coverage for POSIX, Windows drive, and UNC workspace paths, including encoded spaces and case-distinct roots, plus opaque workspace subpath writes.
GitOrigin-RevId: ff2c456e2a720e7216f13e0241b3a935cc925d00
## What changed
Add `codex-mermaid`, a standalone crate that renders supported subsets of flowchart, sequence, state, class, and ER diagrams as Unicode text. Expose `render` for plain text and `render_spans` for semantic node, edge, and text spans that callers can style.
Enforce source, diagram, canvas, and display-width limits. Return errors for unsupported input or exceeded limits without producing partial diagrams, leaving source fallback to callers. Include documentation and a stdin rendering example.
## Testing
Add snapshots for each diagram family, checks for relationship endpoints, Unicode labels, semantic spans, truncated input, and size limits, plus edge reconstruction for all 512 directed three-node graphs in all four layout directions.
GitOrigin-RevId: 5b4e65d9152abce5d833e4e6b12113a5a21f700e
Anthony Tafoya