## Why
Stdio servers without `CODEX_MCP_PROTOCOL_VERSION` use the legacy handshake, even when they support MCP `2026-07-28`.
## What changed
- Add the disabled-by-default `mcp_connection_sharing` feature to enable discovery for eligible local stdio servers.
- Recover from failed or late discovery with a fresh handshake when needed, waiting for the previous helper to release resources before restarting.
- Retain a working legacy connection when an upgrade attempt fails for the same account, except on authentication errors.
- Keep tool catalogs separate by protocol and invalidate legacy catalogs when discovery negotiates the modern protocol.
## Testing
Add regression coverage for failed and late discovery, legacy fallback, protocol-specific catalog reuse, message limits, and Windows descendant cleanup.
GitOrigin-RevId: 36c675ef3b81d32fccf06ccbddda2312cfe602c9
## What changed
Include critical-path capture status and duration totals in `codex_turn_event`, with categories for inference, auto review, user wait, tools, overhead, and unknown time. Count sampling and compaction as inference.
Distinguish `disabled`, `incomplete`, and `complete` capture. Emit null durations for disabled or incomplete capture so missing measurements are not reported as zero. Freeze the completion timestamp so repeated terminal notifications preserve the original measurement window.
## Testing
Add core and analytics tests for capture status, duration reporting, rounding, and repeated completion. Add app-server integration coverage for completed and interrupted turns with default, enabled, and disabled capture.
GitOrigin-RevId: c6c867120ee563ac48584c2f4b12df23acbabe06
## What changed
Support `model_providers.gcp.credential_file` as an absolute path to a Google Application Default Credentials (ADC) file. Pass it as `GOOGLE_APPLICATION_CREDENTIALS` in the provider auth command's environment, retaining the override for token refreshes without changing the parent process environment.
Validate the path before merging GCP defaults and preserve the setting in thread configuration serialization.
## Testing
Add coverage for invalid paths, configuration round trips, separate provider token caches, and credential overrides retained after a `401` refresh. Include a Windows regression test for credential paths containing command metacharacters.
GitOrigin-RevId: d9a1d4b3775a9a4c4325dddaa153d92a2d1430a0
## What changed
- Add an optional `name` to `AdditionalContextEntry` across the protocol, app-server schemas, and generated clients.
- Accept names matching `[a-z][a-z0-9_]{0,63}` only for `untrusted` context. Reject invalid names and names on `application` context before admitting turn input, returning invalid-request errors from `turn/start` and `turn/steer`.
- Preserve existing model-input rendering and deduplicate context when only its name changes.
## Testing
Add coverage for valid name boundaries, callers that omit `name`, invalid-name rejection without admitting input, and deduplication across name changes.
GitOrigin-RevId: 2caffa6fddd40ddb178733b335f520f317239edd
## Why
API keys with FedRAMP issuance markers previously used commercial endpoint defaults without a FedRAMP request header.
## What changed
- Recognize `sk-proj-fedramp-` and `sk-svcacct-fedramp-` prefixes as routing hints and send `X-OpenAI-Fedramp: true`, preserving the complete key for authentication.
- Select `https://gov.api.openai.com/v1` for default OpenAI API routing and `https://gov.chatgpt.com/backend-api/` for default ChatGPT backend requests, including model discovery and analytics.
- Preserve explicit endpoint overrides, including an explicitly configured commercial default URL.
- Resolve provider routing and authentication from the same credential snapshot, and apply key-dependent routing to realtime WebSocket startup.
## Testing
Add regression coverage for prefix recognition, unchanged key storage and authorization, provider credential precedence, endpoint overrides, credential rotation, model discovery, analytics routing, and realtime request preparation.
GitOrigin-RevId: a62576ce205c34e067532b8e6c0e431f87a157e2
## What changed
- Use the managed configuration loader in CLI, exec, TUI, and app-server configuration flows so `requirements.toml` can select a config server.
- Sign in to the config server when needed during interactive TUI startup and CLI login, reload configuration after CLI sign-in, and clear config-server credentials on CLI logout.
- Preserve the app-server's config-server settings and refresh worker across OpenAI login and logout.
- Require config-server settings to be applied when loading CLI and doctor configuration.
## Testing
Add app-server integration tests using a local HTTPS config server to verify managed provider and instruction settings at startup, preservation across API-key login and logout, and cache reuse after restart and thread resume.
GitOrigin-RevId: 27ee81f7943d2290a5c3fcc0ac556579ec63f8b4
## What changed
- Add nullable `startedAtMs` and `completedAtMs` fields to `ThreadItem` in live notifications and turn history. Values are Unix milliseconds when recorded.
- Preserve recorded item times through history reconstruction, pagination, and resume, including command start times recorded during approval.
- Separate the Rust item payload into `ThreadItemPayload` while keeping the JSON payload flat, and update consumers, schemas, and generated TypeScript and Python types.
## Testing
Extend coverage for timestamp serialization, history reconstruction, paginated reads and resume, and persisted Python SDK items.
GitOrigin-RevId: ecbcee95af52db7c807b46a6e9deb30e5fba1f80
## What changed
- Rename ChatGPT-specific bundle loaders to `chatgpt_config_bundle_loader*` and use managed-config terminology for shared loader plumbing.
- Pass `Config` directly when updating the app-server's managed configuration loader.
- Share configuration loading, logging setup, and result handling between browser and device-code login.
- Expose the CLI cloud-config helpers and `provider_uses_first_party_auth_path` through their library APIs.
## Testing
Extend CLI login coverage to verify that `forced_login_method="api"` rejects both `login` and `login --device-auth` while preserving saved API-key credentials.
GitOrigin-RevId: 9e8fa6110dc80882ba365e550b48ac77da604940
## Why
Automatic marketplace update failures were only logged, leaving users without a visible startup warning.
## What changed
Send marketplace update errors and task startup failures through app-server warning notifications. Queue background warnings until a client initializes in both standalone and in-process servers, and centralize startup configuration warning delivery.
## Testing
Add a TUI integration test and snapshot covering two marketplace name mismatch failures, the warning count, and navigation between their details with `F2` and the arrow keys.
GitOrigin-RevId: af55a5555affd9d89ac15a546163daeaafd3b3e8
## Why
Deriving a Vertex AI endpoint previously required environment variables. Allow the project and location to be specified directly in GCP provider configuration.
## What changed
- Add `model_providers.gcp.project_id` and `model_providers.gcp.location`, with each taking precedence over its corresponding environment variable. Keep `global` as the default location and preserve explicit `base_url` overrides.
- Validate configured endpoint fields and preserve them through thread configuration serialization.
- Apply built-in GCP defaults, including default command authentication, when checking managed provider requirements so unchanged requirements are accepted.
## Testing
Add coverage for endpoint precedence, invalid explicit configuration, provider construction, thread configuration round trips, and managed GCP requirement checks, including repeated model listing.
GitOrigin-RevId: c3704bcc0b7d4872374e2cae623fd24d75fb02b4
## What changed
- Always use the retained conversation backend for asynchronous classification; keep snapshot sampling test-only.
- Accept legacy `async_classifier_mode` values in configuration and model metadata but ignore them. Emit a startup warning when `[features.guardianv2].async_classifier_mode` is configured.
- Ignore legacy classifier mode differences when checking model-switch compatibility, and fail closed if the conversation backend is missing.
## Testing
Update coverage for legacy configuration warnings, model-switch compatibility, retained approval-review context, and conversation-based scoring.
GitOrigin-RevId: 5e8bb7e4e6e7d1589572f38bfe2498c9fa6825a0
## Why
Listing hooks by working directory alone omits hooks supplied by a thread's selected execution environments, including hooks that can block a turn.
## What changed
- Add `threadId` to `hooks/list` to return a loaded thread's current hook inventory, including selected, ready environments. Reject requests that also specify `cwds`.
- Expose `environmentId` in hook metadata and have the TUI hooks browser query the current thread and label environment-owned hooks. Keep working-directory lookup for startup review.
- Represent environment hook source paths with `PathUri` and use `LegacyAppPathString` in hook run summaries to preserve native path conventions.
## Testing
Add coverage for listing a blocking environment hook and removing it after environment failure, delivering prompt input and reporting exit status in PowerShell and Bash, and running `PreToolUse` hooks only on the command's owning executor. Extend remote network tests to verify that environment hooks use the command's network policy while retaining their filesystem access.
GitOrigin-RevId: 97229e22793df51f4bd502c1f9e19f0c52fb2305
## What changed
Add `thread/memory/read` to return `{summary}` for a thread that has been started or resumed. Read `memory_summary.md` from the thread's resolved memory version, honoring thread-specific configuration overrides without falling back to another version.
Return `null` when memory use is disabled or the selected summary is missing, unreadable, or blank.
## Testing
Extend app-server integration coverage to check explicit and automatic memory version selection, disabled memory use, and missing summaries without fallback.
GitOrigin-RevId: b218f31e379c69ccbacb444bb9d6ee920cd4882b
## Why
Concurrent imports and consolidation can modify the same memory workspace, leaving a partial import across memory versions or interfering with consolidation snapshots and baselines.
## What changed
- Add a cross-process workspace lock shared by memory imports and consolidation.
- Acquire locks for every import destination before modifying any workspace. Return a retryable busy error if a destination is locked, and skip consolidation when its workspace is busy.
- Hold locks through import completion even if the caller drops the future, and through consolidation agent termination and baseline finalization.
## Testing
Add an app-server integration test that blocks an active consolidation, verifies import rejection without partial writes or snapshot changes, then retries successfully and confirms imported resources remain visible to the next consolidation.
GitOrigin-RevId: c4ce945f916dcb4d75a3190ea869751fac51de83
## Why
The steering test needs to deliver guidance after the first Responses request starts and ensure it is routed before releasing the blocked response. A steering acknowledgement alone does not establish that routing has completed.
## What changed
Wait for the first request before triggering the scripted steering call with an audio frame, then wait for its `handoff_request` notification before unblocking the response. Assert that the steering text is absent from the first Responses request and present in the second.
GitOrigin-RevId: d62f9785624e92774a45857923dab2b903854aea
## Why
Provider errors with code `model_not_found` should end the turn immediately and preserve the provider's message instead of triggering retries.
## What changed
- Recognize `model_not_found` in HTTP 400, 403, and 404 responses and in streamed `error` and `response.failed` events.
- Preserve the provider message and any available HTTP status, and expose `modelNotFound` through the app-server protocol and generated schemas and SDK types.
## Testing
Add coverage for HTTP classification, statusless stream errors, and terminal failures without retries across HTTP, SSE, and WebSocket responses. Verify that `thread/read` preserves the error reported by the live notification.
GitOrigin-RevId: 88f824ac03c8c9669915b1e40c67b76c08326fbe
## Why
External-agent memory imports previously wrote only to the v1 workspace and queued only v1 consolidation, leaving the v2 pipeline without imported resources.
## What changed
- Always import selected resources into `memories_v2`. Also update `memories` when v1 is selected or a legacy workspace exists.
- Read `memories.version` for detection and import, detect pending changes across the applicable namespaces, and enqueue consolidation separately for each updated namespace.
- Combine project results across namespaces so cleanup in either can succeed while failures in either are reported.
- Adapt imported-memory consolidation instructions to the active pipeline's output format.
## Testing
Expand app-server integration coverage for v2 profiles, explicit v1 selection, default profiles, and existing legacy workspaces. Verify resource copies, consolidation queues, repeat detection, and cleanup of deleted or unscoped projects.
GitOrigin-RevId: 7e9206942d63fd55b7f2a7f5f9210b687da6a973
## What changed
Add optional `threadSource` to `thread/sample` requests and apply it to the ephemeral fork. Keep `thread_sample` as the default when omitted.
## Testing
Extend sampling tests to assert that turn metadata includes the supplied thread source and retains the default when no source is provided.
GitOrigin-RevId: 8ea941c932267e3bcb9e6b086764ac2795d6edef
## What changed
- Add `attachToSource` to `thread/fork` to persist a fork attached to its source without emitting `thread/started`. Attached forks require local storage and cannot use `ephemeral` or `deferGoalContinuation`.
- Hide attached threads from ordinary listings and add `attachedToThreadId` to `thread/list` for explicit discovery, including empty threads. Keep this relationship separate from spawned-agent parent and ancestor filters.
- Persist attachment metadata in rollouts and SQLite so it survives restarts and database recovery. Reject source deletion until its attached threads are deleted.
## Testing
Add coverage for legacy and paginated history, restart and missing or corrupt database recovery, filtered listings and pagination, resume, conflicting options, and deletion safeguards across store instances.
GitOrigin-RevId: 589f3174fc36f6054e75d65818360695645a5913
## What changed
Add an optional `NetworkPolicyMetadataProvider` to the MCP runtime. Advertise `codex/network-policy-meta` only to trusted ChatGPT origins when a provider is available, and attach policy metadata only when the sending session also advertises support.
Strip caller-supplied policy metadata and derive restrictions from the call's captured permission profile and server environment. Resolve metadata against each session's capabilities, including after recovery, while retaining one policy snapshot per call. Fail the call before sending if policy resolution fails. Existing runtime callers leave the provider unset.
## Testing
Add tests for capability negotiation, trusted-origin restrictions, forged metadata removal, both tool dispatch paths, and policy snapshot reuse. Add HTTP session-recovery coverage for changing capabilities and policy-resolution failures while preserving caller metadata and read-only restrictions.
GitOrigin-RevId: 4b978f986abc0475fc67659be98fc01a2d6ce7cd
## What changed
- Support `model_provider = "gcp"` with a Vertex AI endpoint derived from `GOOGLE_CLOUD_PROJECT` and `GOOGLE_CLOUD_LOCATION`, defaulting to the `global` location.
- Obtain credentials through `gcloud auth application-default print-access-token` by default, and allow `base_url`, `auth`, and `http_headers` overrides under `model_providers.gcp`.
- Use a static model catalog tailored to Vertex AI, preserve function tools, namespaces, and client-side tool search, and support remote compaction V2. Disable unsupported reasoning summaries, Responses Lite, custom tools, web search, and image generation.
- Expose a `gcp` account type through the app-server protocol and generated clients without resolving credentials during account reads or requiring OpenAI authentication.
## Testing
Add coverage for endpoint resolution, configuration overrides, model catalog filtering, authenticated requests, unsupported request fields, missing credentials, account reporting across provider changes, and automatic remote compaction.
GitOrigin-RevId: 97a3158269e6dbc2605e2cf576998e09817ea12a
## Why
Resuming a thread with unchanged settings appended another `ThreadSettingsApplied` event to its rollout.
## What changed
Compare the effective settings with the latest persisted settings for the same thread before writing a checkpoint. Persist settings when they differ or no matching checkpoint exists, even if no turn follows the resume.
## Testing
Add a regression test that restarts the app server, resumes a materialized thread without overrides, and verifies that its persisted settings events remain unchanged.
GitOrigin-RevId: c545791ed3bb4020fa3da6d233607a9ba73e5c8d
## What changed
Move inline crate tests into `lib_tests.rs` and nest related test suites under each crate's `tests` module. Update imports, subprocess test filters, logging targets, and snapshot names to match the new module paths.
Keep test helpers accessible where needed and preserve the schema writer's exact test name used by release tooling.
GitOrigin-RevId: de55eaae66dce4941abb33dd0b2f170093daa8f9
## Why
Resuming a paginated thread rechecks stored history after loading configuration. Unchanged model context can be reused instead of loading it again.
## What changed
Retain the prepared model context across configuration loading and reuse it when the thread ID, rollout path, and history revision still match. Add `ThreadStore::is_model_context_current` to validate revisions, with a fresh read when validation fails or is unavailable.
## Testing
Add coverage for revision invalidation after history is appended or removed. Extend resume tests to cover paginated history, concurrent metadata and lifecycle changes, workspace-root changes, and preservation of saved user messages in model requests.
GitOrigin-RevId: bad2ca0caddb63523264ac530ffb801db3961f2b
## Why
Profiles without a v1 memory workspace have no legacy context to preserve or consolidate before using v2.
## What changed
- Select v2 when memories are enabled and the `memories` directory is absent. Preserve explicit `memories.version` settings, the `memories.dual_write = false` opt-out, and the v1 default for existing workspaces or filesystem check errors.
- Report `v2_ready` immediately for profiles without a v1 workspace. Keep the consolidation count and valid-summary requirements for profiles with a v1 workspace.
- Make resetting an absent memory workspace a no-op so it does not create an unused v1 directory.
## Testing
Extend coverage for default and explicit version selection, opt-outs, version-specific memory reads, fresh-profile readiness and reset behavior, and running only the v2 pipeline for fresh profiles.
GitOrigin-RevId: a8fb0844962ae9266ffbe88af97e8dc4a99ac15f
## Why
Managed network policies need to require approval for selected hosts even when an exact or wildcard allow rule matches them.
## What changed
- Add `experimental_network.review_domains` to managed requirements and route matching hosts through the existing network approval flow. Explicit denials retain precedence, and approved connections still undergo DNS and local-address checks.
- Preserve review patterns across environment policy attachments and remote proxy configuration. Reject execution on an exec-server that lacks the `networkProxyReviewDomains` capability when review patterns are present.
- Expose `reviewDomains` through the app-server requirements API and generated schemas, and show `review_domains` in debug configuration output.
- Update approval reasons to say that network access requires approval rather than assuming the host is absent from the allowlist.
## Testing
Extend coverage for review precedence over exact and wildcard allows, explicit denials, DNS checks after local and remote approvals, approval hooks, policy merging, remote configuration round trips, and requirements API serialization.
GitOrigin-RevId: 4a861061a0ed80b3537d3b72f2caecb0db2a4f0b
## Why
Enterprise MCP token exchange and sign-in failures can collapse into generic errors, hiding useful diagnostics such as an OAuth `invalid_scope` rejection or a cancelled sign-in.
## What changed
Introduce `EmaErrorDetail` to carry static operation messages and sanitized SDK diagnostics through token-source errors and enterprise login completion. Exchange failures can report the stage, HTTP status, and allowlisted OAuth error code, such as `IdentityProvider: HTTP 400: invalid_scope`, without retaining arbitrary provider text or raw error chains.
Preserve specific discovery, credential storage, cancellation, and account/configuration mismatch errors instead of replacing them with generic failure messages.
## Testing
Extend tests to cover `invalid_scope` diagnostics, specific sign-in completion errors, and exclusion of credentials from diagnostics even when an outer error context contains sensitive text.
GitOrigin-RevId: e9280a5db3565ea91da0810bab528da5ee088d64
## What changed
Add the disabled-by-default `guardian_recorded_items` feature to forward recorded reviewer items and interruptions through the parent's raw-event subscription, preserving reviewer thread and turn IDs without modifying the parent's history or completing its turn.
Emit reviewer items as `rawResponseItem/completed` notifications and interruptions as interrupted `turn/completed` notifications. Mark opted-in reviewer requests with `guardian_recorded_items` metadata.
## Testing
Extend Guardian integration tests to cover reviewer identity, recorded-item metadata replay, concurrent reviewer interruptions, independent parent completion, and behavior without the feature enabled.
GitOrigin-RevId: beb4dbf6c6f2a800a2fbf3cfd11ae174a1382386
## Why
Local administrators need to require managed configuration from a specific customer-hosted server before a session can start.
## What changed
- Add a local managed `config_server` requirement with an HTTPS base URL and optional OAuth settings. Validate endpoints and derive the bundle route as `codex/config/bundle` beneath the base URL.
- Replace the entire `config_server` block when a higher-priority requirements layer supplies one, keeping the endpoint and OAuth settings together. Reject this setting in fetched policy.
- Track the applied server through configuration snapshots, role overrides, and refreshes. Reject session startup and managed refreshes when the applied server does not match the requirement; user refreshes retain the session's managed configuration.
## Testing
Add coverage for missing, mismatched, and matching server configuration at session startup, whole-block replacement, rejection of server settings in fetched policy, and preservation across role overrides and refreshes.
GitOrigin-RevId: 51e8a1738dabdb117ae858120f6fb09ae2ff1261
## What changed
Add optional `responsesapiClientMetadata` to `ThreadSampleParams` and forward it to the sample turn's Responses API metadata. Update the experimental protocol schema.
## Testing
Extend the thread sample integration test to verify that client metadata appears in both the request header and body, preserves the explicit `turn_trigger` when client metadata supplies a conflicting value, and does not carry over to the next parent turn.
GitOrigin-RevId: eb1f80824d476fc6c584a2b35d97e59d51fd4273
## Why
`thread/sample` previously required the latest source turn to have completed successfully, rejecting failed or interrupted turns even when the source was idle.
## What changed
Accept the latest completed, failed, or interrupted turn in both legacy and paginated history modes. Update the protocol documentation and validation error to reflect the accepted statuses, while continuing to reject stale or active sources.
## Testing
Expand integration coverage across all three terminal statuses and both history modes, checking that sampling preserves context and leaves the source unchanged. Also verify that sampling an active source is rejected before interrupting it.
GitOrigin-RevId: a5dfdb2800868ee178eae16b12ee7f6f9515898c
## Why
Enterprise-managed MCP authentication previously required public OAuth clients at both the identity provider and the MCP authorization server, preventing use of registrations that require client secrets.
## What changed
- Accept separate `client_secret` and `token_endpoint_auth_method` settings for the enterprise IdP and MCP server OAuth registration. Support `client_secret_basic` and `client_secret_post`, defaulting to Basic when a secret is configured.
- Validate the registered method against server metadata and use it for enterprise login and both ID-JAG exchanges.
- Require a configured `oauth.authorization_server_issuer` for confidential MCP registrations and reject empty secrets or authentication methods without secrets.
- Require the account OAuth client to match the configured IdP client before reusing an account grant with a provisioned secret; otherwise use dedicated enterprise login.
## Testing
Extend configuration, login, exchange, and app-server lifecycle tests to cover confidential registrations, separate IdP and resource credentials, authentication method validation, and exclusion of client secrets from authorization URLs, stored login grants, and logs.
GitOrigin-RevId: b3be378c2b1bb67e6a3652c648e72fd2e21e956d
## What changed
- Store `logs_2.sqlite` in `log_dir` when explicitly configured, unless a managed `sqlite_home` requirement applies. Keep other databases in `sqlite_home` and preserve the existing SQLite log location when `log_dir` is unset.
- Initialize and lock the selected log directory only when opening its database, so an unavailable directory does not prevent authentication commands from loading configuration. Share the cleanup lock across configuration clones and allow failed initialization to be retried.
- Leave existing logs in place. Read legacy logs for diagnostic submissions when the current query returns no logs, attaching them as `codex-logs-legacy.log`. Continue retention cleanup and page reclamation for both locations, with independent maintenance locks and filesystem checks.
## Testing
Add coverage for configuration routing and managed requirements, deferred initialization and lock lifetimes, authentication with an unavailable log directory, legacy log attachments, and cleanup of current and legacy databases.
GitOrigin-RevId: 48216694596d738eff1b3c5eef6c4e7ada6d0137
## What changed
- Add `application.storage.default_project_parent` and `application.storage.projectless_workspace_root` requirements for new Desktop workspaces. Require absolute paths and reject unknown storage keys.
- Apply managed paths to `desktop.defaultProjectParent` and `desktop.projectlessWorkspaceRoot`, overriding local preferences and rejecting writes to managed settings or their containing table while preserving unrelated Desktop settings.
- Expose storage requirements through `config/requirements/read` and update generated JSON schemas, TypeScript types, and Python models.
## Testing
Add coverage for storage validation, per-setting layer precedence, config overrides, write protection, and requirements API responses. Adjust daemon shutdown test deadlines and TUI test synchronization, paste handling, and future allocation.
GitOrigin-RevId: 44b93fe69e6a471c3f485cbf5f9c9ebd34ac3234
## Why
Installed-plugin inventory fetches could keep following pagination cursors
without an overall bound, delaying release of the plugin mutation gate.
## What changed
- Limit each inventory fetch to 60 seconds and 100 pages, and reject repeated
pagination cursors.
- Request 200 items per page for scoped inventory fetches as well as all-scope
fetches.
- Report overall fetch timeouts as `remote_catalog_timeout`.
## Testing
Add coverage for cursor cycles, completion at the page limit, and overall
timeout cancellation after successful pages. Verify that failed pagination
preserves the cached inventory and plugin files and releases the mutation gate.
GitOrigin-RevId: e8429dd804581041d102defa9d19db02bcb1739b
## What changed
Add a save RPC that accepts the existing report options and an absolute `savePath` on the server host. Save the report, selected attachments, and a manifest without uploading, and return `savedPath`, `threadId`, and `promptHash`. Local exports remain available when uploads are disabled by configuration.
Publish archives atomically without replacing existing files. Bound uncompressed contents to 200 MiB and attachments to 128, preserve duplicate attachment names safely, and fail without publishing a partial ZIP when a selected file cannot be read. Honor `includeLogs` and omit automatic rollouts for untouched threads without materializing them.
Update protocol schemas and generated TypeScript and Python types.
## Testing
Add coverage for local-only saves, disabled uploads, path validation, overwrite protection, log consent, archive budgets, duplicate names, missing files, and rollout selection before materialization and after writer shutdown.
GitOrigin-RevId: 222c0fe7ab923904de9c8a9f12ad27f7a0104875
## Why
Resuming a thread can replace saved model settings with global defaults. A selected service tier can also be lost when the current model does not support it.
## What changed
- Restore saved service tier, reasoning summary, and personality on resume unless the caller explicitly overrides them, respecting thread ownership of settings snapshots.
- Retain the selected service tier for persistence, settings notifications, and resume comparisons while filtering the effective tier against the current model's capabilities.
- Carry the runtime model, service tier, and personality into thread revert reconstruction.
- Persist initial thread settings before user input during MCP startup so an interrupted first turn retains its settings checkpoint.
## Testing
Extend regression coverage for cold resume and explicit overrides, unsupported service tiers, settings preservation during revert, and settings checkpoints before user input when MCP startup is interrupted.
GitOrigin-RevId: e5ec012a5678048c5eedd443e524f38c142bf9fd
## What changed
- Extend app-server tests for account credential reuse, refresh races, stale bearer rejection, retry exhaustion, and step-up failures at the identity provider and resource authorization server.
- Assert token-exchange request fields and enterprise protocol negotiation while preserving the ordinary MCP handshake.
- Add core scenarios for permission and tool-policy refreshes, policy revocation, and thread removal, including cancellation of in-flight enterprise calls.
- Snapshot conversation history after revocation to verify that prior calls remain visible and ordinary tools continue working.
- Allow the existing startup-failure test to wait through the MCP startup deadline.
GitOrigin-RevId: 31cf71a28f91bd30746b74df8fa669edb6bc23a1
## What changed
- Prefer an eligible account grant over saved enterprise credentials, with a fallback to saved enterprise sign-in during initial connection if the account grant is rejected.
- Remember rejected account grants per enterprise MCP registration across threads and report authentication failures as requiring reauthentication. Keep administrator configuration errors distinct from sign-in failures.
- Compare account grants independently of access and ID token rotation, recheck the latest identity eligibility after exchange, and retry once when the refresh grant changes.
- Make MCP authentication status reflect usable account grants, saved enterprise credentials, and completed connection failures.
## Testing
Extend regression coverage for enterprise sign-in failures and recovery, MCP authentication status, account grant identity across token refreshes, and retries after transient credential failures.
GitOrigin-RevId: eeac65f668d5d2d55e9d8bf4547fbcbdd6a6c42d
## Why
Managed stderr logs previously retained a tail only before a new launch, allowing logs to grow during a long-running process. Direct stderr writes could also block lifecycle operations on disk I/O.
## What changed
- Route managed app-server and updater logs through a shared nonblocking worker with a bounded queue. Drop records when the queue is full or a record exceeds 16 KiB, and avoid waiting for the worker at shutdown.
- Prune live logs when they exceed 1 MiB, preserving the latest 256 KiB in `.log.previous` before truncating the current file. Keep inherited stderr handles usable after truncation.
- Pause predecessor pruning during Windows updater handoff and resume it after a failed handoff only when ownership has been restored.
- Keep ordinary stderr output when managed logging has not been initialized.
## Testing
Add regression tests for stalled workers and queue overflow, tail retention, inherited append and nonappend handles, and pruning exclusion during updater handoff.
GitOrigin-RevId: b6301962b1180fa6cdb231a56edce2429dc20b54
## Why
Dropped lifecycle facts can leave incomplete turns retaining analytics metadata indefinitely.
## What changed
- Limit retained turns to 256, evicting the oldest turn and its associated tool and review state when capacity is reached.
- Forward `ThreadClosed` notifications to analytics and discard the closed thread's turn and review state, including reviews received without turn lifecycle facts.
## Testing
Add regression tests covering metadata release after capacity eviction, continued reporting of new complete turns, cleanup isolated to the closed thread, and ignored approval responses after thread closure.
GitOrigin-RevId: eed0a1fef013381654345d535f03de42b99e8607
## What changed
Store `RolloutItem::SessionMeta` and `RolloutItem::Compacted` payloads in `Box` values and update their producers, consumers, and test fixtures. Preserve the existing serialized rollout format.
GitOrigin-RevId: 59fcc4beb47d23160872dcb6e95ace9b142d3d11
## Why
Targeted notification delivery and broadcast routing clone the message for every recipient, then discard the original.
## What changed
Use `std::iter::repeat_n` to move the original message to the last recipient, avoiding one clone per nonempty recipient list while preserving delivery behavior.
## Testing
Expand notification tests to cover empty, single, and multiple recipient lists, checking payloads, target order, and shared timestamps. Add broadcast coverage for zero, one, and two eligible recipients, verifying that uninitialized clients, clients without the required experimental API support, and clients that opted out are skipped.
GitOrigin-RevId: 2ba192f416ccd786e3566da3e5c851518b509afe
## Why
Configuration reloads must cancel stale enterprise MCP startups while preserving access for running threads that still pass validation. Replacing a runtime during `thread/revert` must also leave the replacement able to use enterprise tools.
## What changed
- Separate pending startup cancellation from published thread lifetimes, with independent startup state for forks and replacement runtimes.
- Retain eligible enterprise MCP connections across refreshes and explicit reconnects while applying updated tool restrictions and approvals. Do not create replacement enterprise connections after initial startup.
- Revoke enterprise authorization when a thread is removed, drain requests when access is disabled, and revoke a connection's authority when token renewal requires authentication.
## Testing
Extend regression coverage to verify enterprise tool calls survive `thread/revert`, inherited fork configurations are cancelled after a reload, and enterprise calls fail after logout while ordinary MCP calls remain available.
GitOrigin-RevId: 2d634be3011854b57f73c741bd1ec6b5aed94ee5
## Why
Failed marketplace adds can leave temporary checkouts behind, and interrupted adds or upgrades can leave abandoned staging directories.
## What changed
- Share a staging guard across marketplace adds and upgrades so temporary checkouts are removed on completion or failure, including config-write rollback.
- Reclaim up to four abandoned directories per cleanup pass during add and upgrade operations. Use file locks to preserve active checkouts and operating-system-specific names to avoid reclaiming another platform's staging directories.
- Skip symlinks and unrelated entries, and report cleanup failures as warnings.
## Testing
Add regression coverage for failed adds, CLI and automatic-upgrade cleanup, cross-process ownership and abandonment, lock contention, bounded cleanup, and symlink handling.
GitOrigin-RevId: 20999da0eab861dfb8025aad5e9fba2bcaf818b8
## Why
A persisted login replacement can leave the auth cache holding the previous login, even for the same account. Enterprise MCP authorization must detect that replacement before continuing to use enterprise credentials.
## What changed
- Check cached and persisted account login ownership before enterprise MCP connections and around token exchanges, revoking authorization when ownership changes.
- Recheck account ownership and login generation before committing enterprise sign-in credentials.
- Compare complete token data when checking whether an account OAuth grant is still current, and expose grant token access and credential comparison helpers.
## Testing
Add regression coverage for detecting a same-account login replacement without updating cached auth, rejecting enterprise MCP use after replacement, and keeping ordinary MCP usable while an enterprise account storage read is blocked.
GitOrigin-RevId: 6303f88a9cbcc84c99e453dc281b23d66930f518
## What changed
- Update Cargo and Bazel toolchain pins, CI and release workflows, and Windows setup from Rust `1.95.0` to `1.99.1`.
- Adapt Rust code to updated APIs and lint requirements, including `try_update` and `as_chunks`, and refresh the halfwidth sound marks snapshot.
- Update `webpki-root-certs` from `1.0.5` to `1.0.10` in the Cargo and Bazel lockfiles.
GitOrigin-RevId: e1aaed63b7e72bb8c8bbe25b32c6329c9a37b6c3
## Why
Agent Plugin manifests previously skipped app declarations, including service-generated declarations installed with remote curated plugins. This prevented those plugins from using app routing and suppressing matching direct MCP connections.
## What changed
- Recognize app declarations for Agent Plugins from `openai-curated-remote` across loading, capability summaries, plugin details, tool suggestions, and install authentication.
- Apply app routing to suppress same-name MCP servers when an app route is available. Keep unrelated MCP servers available and preserve direct MCP access in API-key mode.
- Keep app declarations inactive for Agent Plugins from other marketplaces.
## Testing
Add coverage for marketplace and authentication routing, service-generated app declarations during installation with both manifest formats, and app tools reaching turns. Verify that disabling Apps does not restore matching direct MCP connections.
GitOrigin-RevId: 791739569f0e01c898040bc2d028cf517f767e00
## Why
When unread events block notification delivery and the client request queue is full, shutdown can hang waiting to enqueue its shutdown message before reaching its timeouts.
## What changed
Drop the event receiver at the start of `InProcessClientHandle::shutdown` to unblock notification delivery before waiting for space in the request queue.
## Testing
Add a regression test that fills both queues with real requests and notifications, then verifies shutdown completes within the configured timeout budget.
GitOrigin-RevId: a2b01042fc81dd2df4affca1d6cf2ddfb64b39db
## What changed
- Add `--cloud-skills-snapshot PATH` to load a cloud skill catalog and resource contents from JSON once at app-server startup, without contacting a live skill service.
- Expose snapshot skills through the native `skills.list` and `skills.read` interface, preserving aliases and prompt visibility. Reads remain available after the snapshot file is removed.
- Validate package boundaries, required resources, duplicate packages, and size limits; fail startup for missing or invalid snapshots.
- Keep frozen cloud catalog and read caches independent of live MCP resource changes.
## Testing
Add provider, cache, app-server, and core scenario tests covering validation, exact resource contents, authority boundaries, startup failures, and listing and reading frozen skills alongside a named executor.
GitOrigin-RevId: d438a5d678121db3e17515fc5edcd00d4e20b900
Charlie Marsh