## What changed
- Add `remote_plugin_id` to skill invocation facts and analytics event parameters.
- Propagate the ID for both explicit and implicit plugin skill invocations.
## Testing
- Cover explicit and implicit remote plugin skill invocations with analytics integration tests.
GitOrigin-RevId: 3e1d25b5ff88dcff9c2b6c9fe44bca97e8778221
## What changed
- Carry a plugin's local and remote identities together from plugin loading into
`SkillMetadata`.
- Resolve remote IDs from the installed-plugin snapshot when available, falling
back to persisted install metadata only when no snapshot exists.
- Include plugin identity in skill cache keys so identity changes refresh cached
skill metadata.
## Testing
- Cover snapshot and persisted identity resolution, local marketplace isolation,
cached skill refreshes, and propagation through plugin skill snapshots.
GitOrigin-RevId: aabeeb631a43361fe817358ace7f1ea8ba5db708
## Why
MCP authentication checks need to use the same HTTP routing as the MCP
transport so servers reached through configured proxies can be discovered
reliably.
## What changed
- Resolve OAuth discovery and authentication status through each server's
runtime HTTP client for both local and managed environments.
- Keep local discovery capped at five seconds while allowing explicit login
requests to retain their requested timeout.
- Resolve refreshed MCP configuration and its runtime context from the same
snapshot.
## Testing
- Cover OAuth discovery through an environment proxy and macOS system proxy
resolution.
- Cover proxied MCP startup and runtime refresh with updated authorization
headers.
- Verify capped and preserved OAuth discovery timeout policies.
GitOrigin-RevId: 461fb1d4786e547df8b1e6b2215a8ac40438a3aa
## Why
Hooks can only consume a transcript path when the thread has a local rollout.
## What changed
- Resolve the local rollout path before materializing the transcript.
- Return no transcript path for non-local thread stores without persisting them.
- Continue materializing lazy local rollouts before passing their path to hooks.
## Testing
Added session and hook tests covering both non-local thread stores and lazy local rollouts.
GitOrigin-RevId: c742984d146f7a3e1048b848198198fc7a64f4de
## Why
`thread/fork` rejected threads using paginated history, so they could not use the same fork workflow as legacy threads.
## What changed
- Create paginated forks by referencing a frozen source-history prefix while persisting only child-owned records in the new rollout.
- Support latest, `lastTurnId`, and `beforeTurnId` boundaries, including inherited lineage, model-context reconstruction, interruption markers, and approval-reviewer inheritance.
- Make paginated reads and occurrence search traverse referenced history while excluding source records added after the fork.
- Coordinate fork preparation with archive and delete operations, and materialize compressed rollouts before they become fork references.
## Testing
Added app-server and thread-store coverage for boundary selection, active turns, inherited reads and search, compressed lineage, and concurrent source lifecycle operations.
GitOrigin-RevId: 66052d69517d7fb97a3b7817ab77a39c5ad995fd
## Why
MCP config reloads updated resolved server and authentication values, but did not
carry managed server constraints or plugin requirements into active threads.
## What changed
- Refresh MCP state from the typed thread config, including its managed
requirements, while retaining the thread's user layer and unrelated settings.
- Apply the refreshed config directly through `CodexThread` instead of encoding it
as a protocol operation.
- Re-evaluate effective plugins immediately after account changes so their MCP
requirements reach existing threads.
## Testing
- Cover replacement and enforcement of managed server and plugin requirements.
- Verify refreshed MCP settings are installed without changing the active model.
GitOrigin-RevId: 3cf0d69f51ef4893a4d722ee803fcbfdf1cd959e
## Why
MCP elicitation reviewers are reused across runtime refreshes, while an active
turn can retain the approval settings it started with. Reviewing against that
turn could therefore apply stale authority after session settings changed.
## What changed
- Read the latest published MCP runtime configuration when reviewing an
elicitation, including the approval policy, permission profile, configuration
layers, and reviewer selection.
- Apply `never` and granular MCP-elicitation policy decisions before routing an
eligible request to Guardian.
- Keep MCP runtime startup registered for refresh invalidation through session
creation.
## Testing
Added coverage that refreshes a running session and verifies the same reviewer
uses the latest authority for Guardian routing, denial, and empty-form
auto-approval.
GitOrigin-RevId: 826a157aa70fc8e3a9e3a14ecb0261bf7b63f63a
## Why
MCP configuration can change while a thread is still starting, before it appears in the thread manager's loaded-thread list. In that window, invalidation could miss the new thread and leave it with a stale MCP runtime.
## What changed
- Centralize MCP runtime invalidation in `ThreadManager` so it refreshes loaded threads and marks in-progress thread startups for refresh after publication.
- Use the centralized invalidation path for account and plugin changes.
- Invalidate MCP runtimes after successful server and plugin OAuth logins.
## Testing
- Add a regression test that pauses thread startup, invalidates MCP runtimes, and verifies that the newly published thread refreshes its MCP projection.
GitOrigin-RevId: 8944f5a21816a1405e038a0d4c08b66362ea9368
## Why
The Apps MCP background retry could complete before the test inspected the
initial sampling request, making the recovery timing nondeterministic.
## What changed
- Add a test-server gate that can hold and explicitly release the next
successful Apps MCP initialization.
- Use a dedicated MCP mock server so the held initialization does not block
model responses or app discovery.
- Assert that recovery uses exactly two initialization attempts and that Apps
guidance and the deferred namespace appear only after the gate is released.
GitOrigin-RevId: deb21d4b41f353c3f84428616769af9faa1a0487
## What changed
- Add executor authority support to `skills.list` and `skills.read` for skills from selected capability roots.
- Allow `skills.read` to load package-relative resources referenced by an executor skill while keeping reads within the selected package.
- Paginate skill listings and resource contents with bounded response sizes and stale-cursor validation.
- Resolve executor filesystems per sampling step so skill tools use the active selected capability roots.
## Testing
- Extend the app-server executor skill test to list an executor skill, read its main `SKILL.md`, and read a paginated reference resource.
- Cover visibility filtering, metadata bounds, pagination, invalid cursors, package boundaries, and resource size limits.
GitOrigin-RevId: 1b5de95d5d1b9f79c34d2879d6e67f24401e9c29
## Why
The follow-up request assertion can run before the lazily reloaded worker has
finished handling its task.
## What changed
Poll the reloaded worker's status with a two-second deadline, then inspect the
recorded request after the worker reports completion.
GitOrigin-RevId: 4d53cdc5e5ed53009b4445385f8e835e19be7b8b
## Why
Extension warnings need a stable thread target even when they are emitted outside an active turn.
## What changed
- Add `ExtensionWarning` and a dedicated `ExtensionEventSink::emit_warning` path with an explicit thread ID and optional turn ID.
- Deliver extension warnings as thread-scoped app-server `warning` notifications, preserving listener ordering and waiting briefly for a subscriber when no listener is active.
- Move skills warnings to the new path, limiting provider catalog warnings to four messages of 256 bytes each.
## Testing
- Cover warning routing, ordering, UTF-8-safe truncation, subscriber fallback, and invalid thread IDs.
- Verify skills warning bounds and app-server delivery of executor catalog budget warnings.
GitOrigin-RevId: 4dcb1ba7f17c0edb1a9d548f9568e0c734bffc15
## What changed
- Add `McpRefresh` to own the pending invalidation state and serialize MCP runtime refreshes.
- Keep cancellation recovery alongside the refresh state so a claimed refresh is marked pending again if publication does not complete.
- Update session initialization, shutdown, refresh paths, and tests to use the new abstraction.
GitOrigin-RevId: 915b28fa8b98a4f4c87ce8f2aa0d0ff99b57577d
## Why
Runtime updates reuse unchanged MCP connections, so an explicit
`RefreshMcpServers` operation could leave existing server connections intact.
## What changed
- Mark explicit MCP refreshes to rebuild connections for every configured
server on the next runtime replacement.
- Preserve the reconnect request if that replacement is cancelled before it
finishes.
- Continue reusing connections for ordinary runtime updates.
## Testing
Update the transient Apps startup recovery test to wait for both turn
completion and the MCP server's ready event before checking the recovered tool.
GitOrigin-RevId: cb9fd978b3c07543058a2393a154fb70911531de
## What changed
- Track the authentication state used by each published MCP runtime and mark the runtime dirty when the auth mode, account details, or token changes.
- Refresh plugin auth mode before evaluating pending MCP work, and rebuild the initial MCP projection if authentication changes during session startup.
- Carry one auth snapshot through runtime construction so plugin discovery and MCP connections use consistent credentials.
## Testing
- Add a regression test that replaces an API key, reloads authentication, and verifies that MCP refresh publishes a runtime using the new credentials.
GitOrigin-RevId: 219c2f7a157f53b5467116e18bfe70a8c3dca695
## Why
Changes to MCP inputs can require rebuilding the runtime before the next model
step. Start that work eagerly so the step is less likely to wait for it.
## What changed
- Add a per-session worker that prewarms dirty MCP state after configuration,
authentication, or explicit refresh changes.
- Coalesce queued refreshes and always rebuild from the latest session state,
while keeping exact model-step refreshes as the correctness path.
- Stop and join the worker during session shutdown.
## Testing
- Verify rapid refreshes skip superseded configuration and publish the latest
state.
- Verify MCP-relevant policy changes mark the runtime for refresh.
GitOrigin-RevId: 045ed406caff97dcbb483bc183fd16eae0c7d7ad
## What changed
- Add `WaitForEnvironmentToolConfig` as thread extension data for overriding the
model-visible tool and `environment_id` descriptions.
- Preserve the default descriptions when no override is provided or when the
configured descriptions exceed the input or serialized tool-spec limits.
- Keep `wait_for_environment` availability gated by the deferred executor
feature independently of whether a host override is present.
## Testing
- Cover default, custom, oversized, and feature-disabled tool configurations.
- Verify the custom descriptions in the deferred-environment integration flow.
GitOrigin-RevId: 6b49a73a434becd99ea5df911be53f3706a17c0a
## What changed
- Add `--code-mode-host ws://...` and `wss://...` support to `codex app-server`, gated by the `code_mode_host` feature. When omitted, app-server continues to start a local host.
- Share one remote WebSocket connection across the process's threads, using the configured HTTP client's proxy and TLS policy and preserving the existing framed host protocol.
- Reject invalid host URLs, bound WebSocket frame sizes, close connections cleanly, and return an error when a connection exceeds 1,024 pending delegate calls without disconnecting it.
## Testing
- Cover CLI validation, WebSocket protocol execution and shutdown, connection sharing across app-server threads, and delegate-call capacity recovery.
GitOrigin-RevId: 715e82d4d9db1e7e2f91b754a777dcab504e2ae4
## Why
Deferred tool world state already advertises the available tool sources, so
repeating them in the `tool_search` description adds redundant context.
## What changed
- Omit the source listing from `tool_search` when
`DeferredToolWorldState` is enabled while preserving the tool discovery
instructions.
- Include the source-listing mode in the tool search handler cache key so the
description is rebuilt when the feature state changes.
## Testing
Added coverage for source omission, cache invalidation when the feature is
toggled, and the resulting request payload.
GitOrigin-RevId: f7dc0c4f3351a7c7daadec936b26a080202730bc
## What changed
- Add the disabled-by-default `deferred_tool_world_state` feature, which exposes deferred tool namespaces and their descriptions to the model in a `<tools>` world-state section.
- Emit added and removed namespace updates as tool availability changes, bound the rendered context size, and persist nonempty state across thread resumes.
- Omit empty tool state while retaining deferred tool discovery through `tool_search`.
## Testing
- Cover initial, unchanged, removed, recovered, empty, and resumed namespace state, along with description truncation and rendered-size limits.
GitOrigin-RevId: 867e599666dc3569eb0789ba78aaa40254253a6f
## What changed
- Add a default-on `tools.update_plan.enabled` configuration option.
- Omit `update_plan` from the visible and registered tool sets when the option is disabled.
## Testing
- Cover configuration resolution and tool registration for the disabled setting.
GitOrigin-RevId: c13aa463a6911956fca9f0ef5b74841b543798c4
## What changed
- Add `GuardianV2` to the feature registry for automatic approval reviews.
- Expose it as `features.guardianv2` in the configuration schema.
- Keep the under-development feature disabled by default.
GitOrigin-RevId: 92fa107e3ff1396a75a28a071353743a7bb48c43
## Why
Guardian review commands can run without the proxy-port environment used to
configure the parent session. Reconciling persistent Windows sandbox settings
for those commands can discard the parent's proxy configuration.
## What changed
- Add a session-level Windows sandbox proxy-settings mode and use `Preserve`
for guardian review sessions while keeping `Reconcile` as the default.
- Carry the mode through unified exec and the exec-server sandbox context to
Windows process launches.
- In preserve mode, reuse the proxy settings recorded by the existing sandbox
setup marker.
## Testing
Added coverage for guardian session configuration, exec-server transport, and
preserving an existing setup marker when proxy-port environment variables are
absent.
GitOrigin-RevId: 214655c6e6d97360906431773dc0de0fdda2db6e
## What changed
- Parse the `browser_use.disable_auto_review` setting from layered
`requirements.toml` configuration.
- Return the setting as `browserUse.disableAutoReview` from
`configRequirements/read` and publish it in the generated JSON and TypeScript
schemas.
## Testing
- Add an app-server RPC test covering the Browser Use requirement.
GitOrigin-RevId: 5749d5bc17bcc5b582bf7ed59b8e5b72d6c8f7fc
## What changed
- Add optional `plugin_id` and `script_path` fields to execution approval and guardian assessment events.
- Propagate validated plugin attribution through delegated approvals, guardian-reviewed command items, app-server notifications, thread history, and rollout traces.
- Preserve attribution on both started and completed command items, including declined commands.
## Testing
- Extend core, app-server, thread-history, and rollout-trace tests to cover plugin attribution propagation and serialization.
GitOrigin-RevId: 723684d010cab04142918d7a95e06ed95d008da1
## Why
After a remote plugin install refreshes the Apps tool catalog, a later MCP
runtime publication must not restore the catalog from the previous connection.
## What changed
- Rebuild the MCP runtime with fresh connections when hard-refreshing Apps
tools, using the latest desired runtime configuration.
- Refresh the Apps catalog on the newly published connection so subsequent
runtime updates retain it.
## Testing
Extend the remote plugin install test to verify that both newly available and
missing Apps tools remain consistent after an unrelated runtime configuration
refresh.
GitOrigin-RevId: 5b675d53d56379ab67fab09512fc2ad0ffcb8535
## What changed
- Resolve shell and unified-exec commands against the trusted plugin roots loaded for each turn.
- Add optional `pluginId` and safe plugin-relative `scriptPath` fields to command execution items and legacy execution events, and propagate them through app-server notifications.
- Include the attribution in command execution analytics while rejecting absolute, unsafe, and unattributed script paths.
## Testing
- Cover attribution for cached curated and remote plugin scripts from command execution through core and app-server events.
- Verify analytics serialization and unsafe-path filtering.
GitOrigin-RevId: 02fac3a233284ccfc6642fa502a95f1881dba83d
## What changed
- Add a configurable `toggle_side_conversation` TUI action, bound to `ctrl-/` by default, to switch between a side conversation and its parent without closing either.
- Show the active binding in the footer and distinguish switching from closing with `ctrl-c`.
- Allow starting a replacement side conversation from the parent, while cleaning up the previous side thread and preserving it if cleanup fails.
- Clean up retained side conversations when shutting down the current thread.
## Testing
- Cover shortcut remapping, conflicts, and compatibility with existing `ctrl-/` and `ctrl-7` bindings.
- Cover side-thread replacement and footer states for both the parent and side conversation.
GitOrigin-RevId: a621c21e1c45ba73197d59750b2e05efa5ee1081
## Why
Skill catalog rendering can shorten descriptions or omit enabled skills to fit
the model context budget. Surface these reductions so users know when the
model-visible catalog has lost detail.
## What changed
- Emit a warning with the omitted skill count whenever entries do not fit.
- Warn when description shortening averages more than 100 characters per skill.
- Deduplicate executor catalog warnings across repeated world-state builds in a
turn.
## Testing
- Cover the description-shortening threshold and omission warning text.
- Verify warnings through extension and production-turn catalogs, including
per-turn deduplication.
GitOrigin-RevId: bd7fc3482e5dfd8c79072f772a2f54aa502478d9
## What changed
- Wrap `CodexErrorDetails` and an optional retry delay in `CodexErr`, allowing any mapped error to preserve server-provided retry timing.
- Generate the payload-free `CodexErrKind` classification alongside the error details and reuse it for analytics.
- Update error handling sites to inspect `CodexErr::details()` while preserving existing display, debug, protocol mapping, and retryability behavior.
## Testing
- Add coverage for legacy debug formatting, error-specific retryability, and retry-delay propagation through API error mapping.
GitOrigin-RevId: d3ab8a305f2a2ee21d0c0a8c8c388b06dda9c59a
## Why
The TUI must inspect the default execution environment before loading its final
configuration. Initializing the environment manager at that point can give
startup services the bootstrap HTTP policy instead of the effective policy after
managed requirements are applied.
## What changed
- Split environment discovery from manager construction so callers can inspect
the default environment without starting remote connections.
- Build the environment manager after final configuration loading and pass its
resolved `HttpClientFactory` through all construction paths.
- Add shared test support for managers that use the legacy default HTTP policy.
## Testing
- Cover connection-free environment discovery and explicit HTTP policy
propagation.
- Verify TUI startup services use the final managed `respect_system_proxy` value.
GitOrigin-RevId: 928fa31e6b4bcfbe1a121cade2f351427fdfa0f4
## Why
Codex and SQLite data can use separate home directories, but state consumers
could reconstruct database paths from the Codex home instead of consistently
using the resolved SQLite configuration.
## What changed
- Pass `SqliteConfig` through the core, rollout, state runtime, and thread store
instead of passing a directory and rebuilding the configuration downstream.
- Use that shared configuration for state, logs, memories, goals, and paginated
thread-history database access, including integrity checks and cleanup.
- Reject state database handles whose SQLite configuration does not match the
requesting store.
## Testing
Add coverage with separate Codex and SQLite homes that verifies startup
backfill, thread listing, and paginated history all use the configured SQLite
directory.
GitOrigin-RevId: 1de1cdd1d6ff1d70bbb6c360c8352e6543fb8ebf
## What changed
- Accept a table form of `features.non_prefixed_mcp_tool_names` with an
optional `server_names` list while preserving the existing boolean form.
- Omit the legacy `mcp__` namespace prefix only for tools from selected MCP
servers. When no server list is provided, the enabled feature continues to
omit the prefix for every server.
- Cover configuration resolution, tool normalization, and an MCP stdio
round trip with selected servers.
GitOrigin-RevId: bdfb7ac54226de5051f06610e2c6b78b23912ef0
## Why
Only one app-server process should keep a paginated thread open for writing at
a time, while other processes must still be able to read it.
## What changed
- Acquire a per-thread filesystem lock when creating or resuming a paginated
thread, and retain it for the lifetime of the live recorder.
- Reject a competing `thread/resume` request with JSON-RPC error `-32600` and
release ownership when the writer is discarded, deleted, or shut down.
- Remove stale lock files without disturbing active writers.
## Testing
Added coverage for competing processes, ownership transfer after shutdown,
stale-lock cleanup, and lock release during discard and deletion.
GitOrigin-RevId: 81d49a2fffc73ba8135752b4944f27feafa4c0d6
## What changed
- Mark `clock.sleep` as `DirectModelOnly` so it remains directly callable in
code-mode-only sessions without appearing in the nested code-mode tool surface.
- Cover both code mode configurations with a tool-plan test that verifies the
sleep tool's exposure and visibility.
GitOrigin-RevId: 7ef67bea0678f27fdb17d88004368e5f1d475125
## Why
Refreshing MCP runtime state should not restart an unchanged, ready server or
relist its tools.
## What changed
- Reconcile refreshed MCP configuration against the published connection set
and reuse connections whose transport, environment, authentication, OAuth
credentials, and client capabilities are unchanged.
- Keep tool filters, timeouts, metadata, and plugin provenance in the published
server view so those settings can change without reconnecting.
- Update elicitation authority in place for reused connections, and reconnect
when connection-defining inputs or live OAuth credentials change.
## Testing
Added coverage for unchanged-server reuse, view-only and elicitation-policy
updates, connection identity changes, OAuth credential changes, and avoiding
redundant tool listing.
GitOrigin-RevId: f04f5db5fbdde127b6a14f6aa9673112c0b557e7
## What changed
- Treat batch writes containing only `model`, `model_reasoning_effort`,
`plan_mode_reasoning_effort`, `service_tier`, or `personality` as defaults for
future sessions, even when `reloadUserConfig` is requested.
- Keep runtime config reloads and skill/plugin cache invalidation for other
config changes, and document which settings remain session-static.
- Preserve cached skill listings after session-default writes until a forced
reload, with test coverage for each supported default.
GitOrigin-RevId: 6d988014cf4758ceb9422a11f7c2bd5fc6b9f90a
## Why
Amazon Bedrock configurations can operate without Codex auth, so auth mode alone
cannot determine which curated plugin marketplace to expose.
## What changed
- Pass the resolved model provider into plugin configuration.
- Select `openai-api-curated` when the resolved provider is `amazon-bedrock`,
while retaining API-key auth as a selection signal.
- Cover provider overrides and app-server plugin listing without an `auth.json`
file.
GitOrigin-RevId: 972a22e19c41490d8b19d989da052302dc30e8f2
## What changed
- Make `McpRuntime` own the published MCP configuration, connections, elicitation routing, and selected capability roots for a thread.
- Capture immutable MCP bindings for model steps and tool calls so in-flight work keeps a consistent connection set and approval authority while refreshed state is published atomically.
- Mark MCP state dirty when relevant configuration, plugins, environments, authentication, or elicitation capabilities change, then rebuild it before the next sampling request or out-of-band MCP operation.
- Separate config reloads from server invalidation: `ReloadMcpConfig` applies resolved MCP inputs, while `RefreshMcpServers` requests reinitialization from the thread's latest state.
## Testing
- Cover refreshed state visibility for existing turns, stable step bindings, current approval authority, cancelled refresh retries, resource-client reconciliation, and Apps recovery between sampling requests.
GitOrigin-RevId: 59eabb1aa8dc083426bd18ef4d3630508f376401
## What changed
- Add a default-on `features.multi_agent_v2.wait_agent_enabled` setting.
- Omit `collaboration.wait_agent` from the tool plan when the setting is disabled, independently of `features.current_time_reminder.sleep_tool`.
## Testing
- Cover configuration parsing and tool exposure with both clock sleep states.
GitOrigin-RevId: c2f34c5edd5bc191d6a5ac41d7bbb80708da1202
## Why
An idle thread with an outstanding durable sleep must resume when agent work
arrives, even when that message would normally remain queued without triggering a
turn.
## What changed
- Treat any pending mailbox message as wake-up work while a durable sleep is
attached to the thread.
- Keep requiring `trigger_turn` for idle threads that are not durably asleep.
- Cover waking a sleeping root thread from queue-only agent mail and persisting
the message in thread history.
GitOrigin-RevId: e361ac1b104436d4d63aebfe5e2422691a1cc139
## What changed
Skip registering the standalone `image_generation` tool when cached
authentication identifies the account plan as Free. Leave the existing
feature, provider capability, model modality, and authorization checks intact
for other account plans.
GitOrigin-RevId: 54d3b73dc610e508db7e281c4d7a8e72961e35a6
## Why
Parent context-window and auto-compaction overrides may describe a different
model than the one selected for Guardian review.
## What changed
- Clear `model_context_window` and `model_auto_compact_token_limit` when the
effective Guardian model differs from the parent model, allowing the review
model's own limits to apply.
- Preserve those overrides when Guardian uses the same effective model.
## Testing
Add unit coverage for both model-selection paths and verify that a Guardian
rollout records the selected review model's context window.
GitOrigin-RevId: ebc399f4eba37c7f279fd0d258154c00d45e2d00
## What changed
- Add the `supports_standalone_web_search` model-provider setting, defaulting to `false`, and preserve it in remote thread configuration.
- Enable the standalone `web.run` tool for opted-in custom Responses providers when web search is enabled and the runtime provider supports it.
- Send standalone search requests through the custom provider's endpoint and authentication.
## Testing
- Cover opt-in, default-off, disabled-search, and unsupported-provider behavior.
- Verify custom-provider search request routing and authorization through the app server.
GitOrigin-RevId: 7c5f96b0ce924ad2b9715c45bfc635e89fc39cff
## Why
Multi-agent mode instructions are durable model context and need to survive
history changes without re-emitting unrelated setup hints.
## What changed
- Add a `multi_agent_mode` world-state section that diffs, retains, and restores
the effective mode instructions.
- Persist mode changes in world-state snapshots while keeping the legacy
`TurnContextItem.multi_agent_mode` field for reading older rollouts.
- Keep initial mode instructions after the root-agent usage hint so the active
mode takes precedence, and bound custom mode text before snapshotting it.
## Testing
- Add snapshot coverage for mode transitions, retained history, and custom-text
truncation.
- Verify live mode changes preserve instruction ordering, avoid duplicating the
usage hint, and record both modes in world state.
GitOrigin-RevId: 96b9964d6e5299b07a011c559b68e3d948a49226
## What changed
- Add `isPinned` to thread responses and allow `thread/metadata/update` to pin or unpin stored threads.
- Add an `isPinned` filter to `thread/list`, including cursor-based pagination and combinations with relationship filters.
- Persist pin state in SQLite without modifying rollout files, default existing threads to unpinned, and preserve pins through reconciliation and archive transitions.
## Testing
- Cover protocol serialization, database migration and indexing, pin updates, filtered pagination, rollout reconciliation, and archive/unarchive behavior.
GitOrigin-RevId: c2eacabd6dae465e2ae6ce8a169e00740960cdb7
## Why
Interrupting a turn while MCP tools were still starting could abort before the
submitted user input was recorded in conversation history.
## What changed
- Build and retain the MCP tool list and tool router as part of each step
snapshot, using the turn cancellation token during tool discovery.
- Record turn hooks and submitted input when cancellation occurs during startup
prewarming, pre-sampling compaction, or first-step capture.
- Reuse the captured router for sampling, compaction, and prompt debugging so
advertised and executable tools share the same request-scoped view.
## Testing
Add coverage that interrupts each affected MCP startup phase and verifies that
the user prompt remains in history before the turn-aborted marker.
GitOrigin-RevId: 6e96c6814357a55545d69b580e28f35933cfadf7
## What changed
- Add `compaction_ms` to turn profile facts and turn analytics events.
- Measure manual and automatic compaction as an exclusive profile phase instead of including it in surrounding idle time.
- Complete the profile and total turn duration from the same instant so their elapsed times remain consistent.
## Testing
- Cover compaction phase accounting and profile-duration consistency.
- Update turn event serialization coverage for `compaction_ms`.
GitOrigin-RevId: 50f0e1cf19789a807f9f56c2ef763c620a5d641c
## Why
Preparing Responses API requests rebuilt tool definitions as a generic JSON
tree, and incremental WebSocket requests cloned their full item prefix for
comparison.
## What changed
- Serialize tool definitions into shared raw JSON that can be embedded directly
in HTTP and WebSocket requests.
- Compare incremental request prefixes in place while still ignoring internal
message metadata.
## Testing
- Verify raw tool JSON matches the existing value encoding.
- Preserve the serialized WebSocket request payload.
GitOrigin-RevId: 66e2921792c332e8904954dafa597f6d39abcf29
## What changed
- Store the spawned session's working directory as a `PathUri` in
`GuardianReviewSessionReuseKey` so reuse comparisons use its canonical URI
representation.
- Assert that the reuse key contains the converted working directory.
GitOrigin-RevId: 68d440a37ebb310c610dabbb3373ed0ceff88dfa
jameswt-oai