## What changed
Add experimental `deferOutput.mcpToolCall` support to `thread/items/list` requests scoped to a `turnId`. Successful, completed MCP calls with nonempty, unannotated plain-text results can return empty `result.content` with `outputDeferred: true`. Clients can retrieve the saved output through `thread/items/read`; connector identity remains on the listed item.
Keep rich results, JSON or fenced text, app UI results, and built-in `codex_app` results inline. Preserve plain-text output when creating bounded previews of oversized MCP results so those previews remain eligible for deferral. Reads return the saved preview when output exceeds the 64 KiB history limit.
## Testing
Extend thread history integration coverage for independent and combined command/MCP deferral, experimental capability gating, excluded result types, connector identity, oversized previews, and retrieval of deferred items.
GitOrigin-RevId: 5c160b30a4eac2a9b70e3fa65b6dbd83e935338b
## Why
Invalid assertions and paused or revoked runtime instances cannot recover through request retries or credential refresh. Permanent refresh-token failures also need to retain their sign-in error instead of becoming retryable stream errors.
## What changed
- Recognize terminal runtime denial codes in `401` and `403` response bodies and identity error headers, preserving HTTP diagnostics while stopping retries.
- Skip credential recovery for runtime denials in runtime-enabled model providers and backend requests, while preserving recovery for ordinary credential expiration.
- Propagate permanent refresh-token failures through runtime authentication as `RefreshTokenFailed` errors.
## Testing
Add coverage for body and header denials, preserved HTTP diagnostics, provider-scoped credential recovery, and cached permanent refresh failures. Complete-turn tests verify that runtime denials stop without retries or refreshes while expired credentials recover in both runtime authentication modes.
GitOrigin-RevId: 33f6f707454130e97e13f3b53e29d2c484602152
## Why
Security reminder requests need to use app-server's active authentication and HTTP runtime, with results bound to the login that fetched them.
## What changed
- Add `account/securitySetup/read`, returning an optional notice with account and user IDs, plus generated protocol schemas and bindings.
- Fetch reminders in app-server only for a matching saved ChatGPT login. Return `notice: null` for ineligible, unavailable, or timed-out reads, and discard results when the login changes during the request.
- Route TUI reminder reads through the new method while retaining notice validation and identity checks. Unsupported servers produce no reminder.
## Testing
Add coverage for shared runtime use across restarts, ineligible authentication modes, and login changes during a fetch. Update TUI coverage for unavailable, unsupported, and mismatched notices.
GitOrigin-RevId: 426fee7ce98df17970957c06876881bc5b005196
## Why
Guardian Decisions requests used bearer keys directly, bypassing runtime authentication. Memory startup quota checks used the app-level auth manager instead of the thread's provider auth context.
## What changed
- Bind Decisions credentials to runtime authentication and use route-aware HTTP clients with sensitive header protection. Preserve workload identity credentials, reuse the saved-login runtime binding, and isolate explicit API key bindings.
- Select the staging Decisions endpoint when the ChatGPT environment is staging.
- Use the thread's `ProviderAuthContext` for memory startup and quota checks, preserving account-bound network policy and applying runtime authentication.
- Keep custom destinations independent of runtime assertions.
## Testing
Add regression tests for dual-header and assertion-only authentication, fresh Decisions assertions, saved versus explicit credential isolation, workload identity, staging routing, redirect header protection, and memory quota authentication with custom destinations.
GitOrigin-RevId: 27bc7821a1cad1f5d1d2a71680527ea91ace95db
## Why
Regular chats start MCP servers eagerly even when cached tool definitions are available and the servers go unused. Allow those chats to use the cached catalog and defer eligible stdio servers until first use.
## What changed
- Add the disabled-by-default `mcp_lazy_stdio_startup` feature and expose it through experimental feature configuration.
- Defer cached stdio servers in regular chats when enabled, while keeping servers that require a live startup connection eager. Required servers with `startup_readiness = "catalog"` may defer; explicit reconnects remain eager.
- Announce the full eager startup batch before terminal statuses and exclude dormant servers from the initial startup summary. Update TUI tracking so deferred servers can report startup independently in later rounds.
## Testing
Add scenario coverage for a cached server staying dormant during unrelated work, starting on first use, and refreshing tool definitions and visibility. Cover required live startup, eager event ordering, experimental feature configuration, and TUI status handling.
GitOrigin-RevId: 74075fcd4f26c8c79b5901b6a8cb03fdb9e35a7f
## What changed
Add a nullable `userId` to `GetAccountResponse`, populated from the same authenticated account snapshot as the rest of the response. ChatGPT and personal access token sessions return the canonical ChatGPT user ID when available; API-only and signed-out sessions return `null`.
Update the cloud client, generated schemas, TypeScript and Python types, and account identity documentation. Default missing IDs to `None` when deserializing responses from older app servers.
## Testing
Extend account response tests to check ChatGPT and personal access token user IDs, null IDs for other providers and signed-out sessions, and ID changes when switching providers with saved ChatGPT credentials.
GitOrigin-RevId: 7ad3da3cfc835c4d08d03c8e91b06cd7e007d874
## What changed
Make `TurnContextItem.permission_profile` required and remove its legacy `sandbox_policy` and `file_system_sandbox_policy` fields. Normalize older histories into a permission profile during deserialization, preserving the restrictive fallback for malformed filesystem rules.
Keep legacy compatibility fields in rollout serialization so older readers remain usable. Update turn recording, metadata extraction, and permission checks to consume the profile directly.
## Testing
Add coverage for legacy normalization, profile-only serialization, missing permissions, and malformed filesystem rules. Extend rollout round-trip fixtures to cover deny rules and filesystem roots from another platform.
GitOrigin-RevId: 27515fec60cccbac5806b98fb71f54e311a09701
## What changed
Read `final_answer_moderation` metadata and attach `moderation: { moderated: boolean }` to the completed final-answer message only when its item ID matches. Apply this in both normal and plan modes, and reset the pending decision when a new response starts.
Preserve the answer's native item ID and moderation flag through legacy events and history reconstruction. Combine text parts into one legacy event when a moderation decision is present.
Expose nullable moderation data on app-server agent messages and update the JSON schemas, TypeScript types, and Python models.
## Testing
Add an integration test for moderation on completed answers and their legacy events. Extend protocol conversion tests to cover populated moderation data and serialization as `null` when absent.
GitOrigin-RevId: f286b67731a84b3daf5d10b7644f2e31b62f0e53
## Why
Queued inputs previously stored and dispatched without the submitting client's Responses API metadata, losing attribution such as `client_type` when the queued turn started.
## What changed
- Accept `responsesapiClientMetadata` when adding or updating queued submissions and expose it on returned queue items.
- Persist metadata with the input and forward it when starting a selected item or dispatching an idle queue, including after restoration.
- Preserve existing metadata when an update omits it or supplies an empty map; replace it when a non-empty map is supplied.
- Keep stored inputs readable by older queue workers and update generated protocol artifacts.
## Testing
Extend queue service and app-server tests to cover metadata round trips, preservation and replacement on edits, compatibility with older readers, and forwarding during selected, idle, and restored dispatch.
GitOrigin-RevId: 508043b1d3d0298c9af2be8e05b6999de46596a1
## Why
Runtime authentication must use the credential selected by the model provider. Explicit API keys and command credentials need independent ownership so cached connections and in-flight work cannot cross credential sources.
## What changed
- Register and reuse runtimes per credential source, supporting explicit provider keys and command credentials without falling back to saved login credentials.
- Track `AuthOwner` by credential manager and owner generation across WebSocket state, compaction, and scoring.
- Preserve cached identity and runtime registration state during credential-source outages or failed storage reloads. Require a successful auth reload before logout revokes credentials.
- Reject requests whose production or staging environment differs from runtime registration, including model catalog requests.
## Testing
Add regression coverage for credential selection and runtime reuse, owner isolation, source outages, failed reloads and logout recovery, and environment mismatches.
GitOrigin-RevId: 7bab55e0ea502593393df10046309fd8502edbd0
## Why
Gateway OAuth reads and logins previously used only the current provider, preventing clients from authorizing another configured provider without changing the default.
## What changed
- Add optional `modelProvider` params to `account/gatewayOAuth/read` and `account/gatewayOAuth/login`, preserving current-provider behavior for omitted or null params and selectors.
- Validate explicit providers against current managed policy without changing the default or any thread's provider.
- Retain readiness state across providers and send `account/gatewayOAuth/changed` notifications for every configured provider sharing the changed credential.
- Update protocol schemas, TypeScript types, Python models, and documentation.
## Testing
Add coverage for non-default provider login, retained readiness when alternating providers, notifications for shared credentials without starting login, and legacy TypeScript request compatibility.
GitOrigin-RevId: cfd472c322b821fe36b8c133a8de774f4ba48534
## Why
Item reads with an update boundary previously rejected forked thread histories and only supported an exclusive lower bound on update ordinals.
## What changed
- Add `before_updated_at_ordinal` as an exclusive upper bound, mutually exclusive with `after_updated_at_ordinal`.
- Allow update-filtered and update-ordered item reads across parent and child segments, applying segment bounds and preserving cursor pagination in both directions.
- Require an update boundary for update-order sorting and reject either boundary when using an item anchor or item-ID filtering.
## Testing
Extend thread-store tests to cover upper-bound filtering, descending cursor pagination, forward and backward paging across forked lineages, mutually exclusive boundaries, and ordinals outside SQLite's integer range.
GitOrigin-RevId: 63f7e18fb24a89a41ff8e570cf65963622519a25
## What changed
Allow `model_providers.<id>.gateway_oauth.credential_export` to supply a gateway access token instead of browser OAuth. Run the configured command on first use, cache its token in memory, and deliver it through the configured header or cookie. Export failures surface directly, and command-backed providers do not require an OAuth session.
Require mutually exclusive OAuth and exporter settings, same-origin model catalog access, and rejection of HTTP redirects for command-backed gateway credentials. Share the bounded, timeout-controlled command runner with AWS credential export.
## Testing
Add tests for inference and model listing without OAuth, token caching and recovery after invalid output, preservation of primary authentication, and rejection of mixed OAuth/exporter configuration.
GitOrigin-RevId: e3dbfd8823b1992045f1c1efd56ec98ee17e07a5
## Why
Clients need to list models for a configured provider other than the app-server's startup default.
## What changed
Add an optional `modelProvider` parameter to `model/list` and expose it in the generated schemas and client types. Explicit selections use provider definitions loaded at startup and respect current managed provider requirements. Unknown providers return a structured `modelProviderNotConfigured` error.
Use a temporary catalog when selecting another provider, preserving the default catalog and its disk cache while retaining runtime authentication. Requests without a selector keep the existing provider and caching behavior.
## Testing
Add coverage for provider selection, preservation of the default catalog and disk cache, unknown-provider errors, managed requirement enforcement, and runtime authentication for temporary catalogs.
GitOrigin-RevId: 6092df9f6141810c6ac215a8e1fb601f77e54747
## What changed
- Remove startup prefetching of remote catalogs, featured plugins, and recommendations while retaining installed-plugin refreshes and bundle downloads.
- Fetch featured plugin IDs on demand, concurrently with marketplace fetching when listing the remote global catalog, and reuse the cached results.
- Retire `plugin_discovery_prefetch` as an ignored compatibility flag and remove forced background catalog refreshes.
## Testing
Update app-server tests to verify that startup downloads installed bundles without discovery requests and that two `plugin/list` calls share one featured-plugin fetch.
GitOrigin-RevId: aa10474f3429102d624c83472e81ec85e3b470ae
## What changed
- Select fresh authentication for each HTTP operation on eligible OpenAI MCP connections while preserving the connection's credential source and account network policy. Stop redirects when requests carry runtime assertions.
- Pass the owning thread's authentication and runtime context through app discovery, connector metadata, and trusted-access requests. Include the runtime authentication mode in MCP connection and tool-cache identities.
- Give resumed actors analytics clients bound to their own authentication context, and serialize stored-credential reloads with token refresh while preserving host-provided credentials.
## Testing
Add coverage for fresh request assertions, revoked account policies, redirect handling, resumed-actor isolation, and MCP uploads in dual-header and assertion-only modes.
GitOrigin-RevId: f06900a6db61cd6cf53c3aa8075afeec4d5706d9
## What changed
Allow experimental clients to request `deferOutput: {"commandExecution": true}` in `thread/items/list` for a specific `turnId`. Completed commands with a recorded completion time, exit code zero, and nonempty saved output return `outputDeferred: true` and `item.aggregatedOutput: null`. Clients can retrieve the complete output through `thread/items/read` using the turn and item IDs.
Keep full output by default and for listings across turns. Make conversion from `ThreadItemEntry` to `ThreadItem` fallible so Rust consumers detect deferred output instead of treating an incomplete item as complete.
## Testing
Add integration coverage for experimental capability gating, default and disabled options, command status and output eligibility, listings across turns, deferred-item conversion, and full output retrieval by item ID.
GitOrigin-RevId: d6bfac34bb68f7e3b327fd5553270ed6d0fe87cf
## What changed
- Use the shared runtime and effective configuration for account API clients and remote plugin requests, including standalone plugin commands.
- Support dual-header and assertion-only authentication for remote plugins and MCP file uploads when runtime agent instances are enabled.
- Keep plugin credentials and caches scoped to the thread's account when resuming with different credentials. Bind request pools and multi-step plugin storage operations to the selected account so account replacement revokes stale operations.
- Protect runtime credentials on cross-origin redirects while preserving configured routing policies and legacy authentication for custom backends.
- Apply server-provided `upload_headers` to file storage uploads.
## Testing
Add coverage for shared runtime registration, both authentication modes, configuration reloads, resumed-thread account selection, account replacement during plugin uploads and downloads, and credential stripping on redirects. Extend file upload tests to verify runtime assertions and storage-only upload headers.
GitOrigin-RevId: 68aef81051a6f9bf919fffda52f372b108fce805
## What changed
Accept an optional `_meta` object on `mcpServer/resource/read` and forward it to MCP `resources/read`, including reads bound to an originating tool call. Update the protocol schemas and generated TypeScript and Python types.
Reject caller metadata containing host-owned `threadId`, `x-codex-turn-metadata`, or `codex/connectionLease` keys. For `codex_apps`, also reserve `connector_id`, `link_id`, and `_codex_apps.resource_uri` to preserve app and account routing.
## Testing
Add integration coverage for metadata forwarding through stdio, hosted app reads with and without a thread, and origin-bound widget reads. Cover rejection of reserved keys and non-object metadata.
GitOrigin-RevId: 227ee0fb5fe15fa2ff2ec66d4d5ae16de8935a8c
## Why
Changing the default model provider should not prevent users from resuming or continuing a thread that uses another configured provider.
## What changed
- Resolve cold resumes using the thread's saved provider and reject explicit attempts to switch it on resume.
- Use retained provider configuration for loaded threads without reloading the current default selection, while continuing to enforce managed provider policy.
- Preserve errors for missing provider definitions and policy conflicts.
## Testing
Update app-server and TUI coverage for resuming with a different default, recovering after restoring a missing provider definition, preserving drafts across resume retries, and continuing loaded threads with malformed system defaults.
GitOrigin-RevId: c5bf3b03cacde7349480c94c2f10bac827a0eb1f
## What changed
- Log `thread/items/list` request IDs, cursor kinds, page sizes, next-page availability, elapsed time, and success status.
- Log remote-control item-page response preparation and WebSocket write times, along with request and stream IDs, sequence IDs, frame counts, wire bytes, and success, interruption, or write-error outcomes. Collect these transport metrics only when debug logging is enabled.
GitOrigin-RevId: 0f26bef6d6b8cacbd5a5c76c49a5f882669f6598
## What changed
- Add `direct_only_tool_namespaces` to `TurnStartOptions`. Omission inherits the thread configuration; an empty list clears direct-only routing for that turn. Steering ignores the option.
- Persist explicit overrides in turn context and restore them when recovering an interrupted turn, including turns started by standalone tool output.
- Keep subsequent turns and spawned or resumed child agents on the thread's routing defaults.
## Testing
Add coverage for routing changes across turns in Responses and Responses Lite, recovery without carrying overrides into subsequent turns, and child-agent inheritance.
GitOrigin-RevId: cea1a997424572d4cd372cd15b098626904c6796
## What changed
- Expose `PromptCacheTtl` through `TurnStartOptions` and `RecoverTurnRequest`, supporting `30m` and `12h` minimum cache lifetimes.
- Carry the selected TTL through turn execution and compaction into `prompt_cache_options.ttl` on Responses HTTP and WebSocket requests. Omit the field when unset and keep the selection scoped to the turn.
- Include prompt cache options in WebSocket request reuse checks.
## Testing
Add coverage for both TTL values and omission on a subsequent turn without an override, and extend WebSocket serialization coverage to include prompt cache options.
GitOrigin-RevId: 8529306e6ad6030fe77c5e6bf19f3810717c0c5e
## Why
Repository skill discovery must reflect current filesystem access, including newly approved grants and narrower permissions. Previously listed skills can remain in conversation history after a turn-scoped grant expires, so catalog updates need to tell the model when availability changes.
## What changed
- Discover repository skills through the selected executor's permission-aware filesystem accessor and refresh snapshots when the working directory or access changes. Use the current step's snapshot for skill selection and invocation.
- Preserve repository boundaries even when project markers are hidden by read restrictions, and report unsupported sandbox backends as skill-loading errors.
- Track grant-dependent catalog entries and emit availability notices when skills disappear or return, even when the metadata budget is exhausted.
- Resolve implicit skill paths through their owning filesystem and exclude remote repository skills from local implicit command attribution.
## Testing
Add coverage for turn and session grants, grant expiry and restoration, hidden and newly created repository markers, cached read denials on Windows, unsupported remote sandboxes, and executor-backed implicit skill paths.
GitOrigin-RevId: ac1af483e73e3130524aeeabe218630435054028
## Why
A model requirement can force `auto_review` even when the requested reviewer is `user`. Persisting or sending that effective value back as an explicit choice loses the original selection, so removing the requirement cannot restore it on resume.
## What changed
- Retain `requested_approvals_reviewer` separately from the effective reviewer in configuration and thread settings, with a fallback for older histories.
- Restore the requested reviewer on resume while applying current model requirements and reviewer allowlists.
- Let ordinary TUI turns, continuations, retries, and forks inherit the server's reviewer instead of echoing its effective value as an explicit request.
- Preserve a worker's requested reviewer when reloading it rather than inheriting the sender's selection.
## Testing
Extend resume coverage for explicit `auto_review`, removal of a model requirement, and a tightened reviewer allowlist. Update TUI assertions for omitted reviewer overrides and verify worker reload preserves its reviewer.
GitOrigin-RevId: d8c9c3a7b89e55e63f0e8ae210d6a87cb5547933
## What changed
- Share a lazily registered runtime across threads, model discovery, and extension clients when `runtime_agent_instances` is enabled, while honoring each thread's authentication mode and credential owner.
- Bind model catalogs to the effective provider and authentication context while preserving cache policy and live API-key discovery settings.
- Resolve credentials, routing, and transport policy together for each request. Preserve proxy and TLS settings, validate runtime account selectors, and prevent pooled connections from crossing runtime identities.
- Accept supported ChatGPT subdomains when selecting the registration environment.
## Testing
Add integration coverage for shared runtime registration, dual-header and assertion-only modes, disabled and third-party providers, credential replacement, subagents, and delegated review. Add coverage for catalog cache policy and runtime-aware connection reuse.
GitOrigin-RevId: 99dd9d987c29c93597a648f6586f98ac6a932c3c
## Why
After provider setup, new threads could still use the models manager created for the server's startup provider, leaving their default model inconsistent with the model picker.
## What changed
- Build a models manager from the thread's configuration when its provider differs from the startup provider.
- Invalidate the model catalog after successful Amazon Bedrock setup so subsequent model listings reflect the configured provider.
## Testing
Extend Bedrock and GCP setup integration tests to verify that a new thread's model matches the refreshed model listing. The Bedrock test also checks that the thread uses `amazon-bedrock`.
GitOrigin-RevId: 1db30ad040ba97e2f4f31c9e162a2b73af1377fa
## What changed
- Add `currentAccountOnly` to `thread/list` and `thread/search`, defaulting to `false`, and enable it for TUI history discovery, resume pickers, and task mentions.
- Mark newly created threads as account-scoped and require each recorded creator user or account ID to match the current login. Older threads and threads without creator IDs remain shared; API-key logins continue to see all local history.
- Preserve account scope through resume and revert, including fallback to original rollout metadata when an older binary drops the marker. Forks receive new-thread scope.
- Skip unreadable rollout headers in scoped discovery and filter search candidates before reading snippets. Direct access by thread ID remains available.
## Testing
Add coverage for account matching, shared legacy history, list page refilling, search pagination, API-key visibility, and scope preservation across reverts. Extend rollout lookup coverage to compressed active and archived files.
GitOrigin-RevId: aa374f5e69165be5a71c0716ded1b105f5fb51e0
## What changed
Add the disabled-by-default `cli_resume_account_check` feature. When enabled for `codex-tui` and `codex_exec`, reject resuming or attaching to a local thread if its recorded creator user or workspace differs from the current ChatGPT account. Return an error directing the user to sign in with the original account.
Carry creator IDs through stored thread metadata and check them before loading resume history. Preserve existing behavior for untagged threads, other clients, and authentication modes without a comparable ChatGPT account.
## Testing
Add integration coverage for account and workspace mismatches, matching accounts, legacy and paginated history, ID and path lookup, and the feature's default and bypass behavior. Verify that switching back to the original account permits attachment to a loaded thread and that creator metadata remains unchanged.
GitOrigin-RevId: a3ab089254703417dde0890a5f8d6326c4cbb75a
## What changed
Add `modelProvider/config/write` to create custom gateways and patch existing custom gateway, Bedrock, and GCP settings. Return the saved provider using the same safe summary as `modelProvider/list`.
Omitted fields retain their values; explicit `null` clears nullable user overrides. Apply patches through the shared configuration queue with last-write-wins semantics, enforce field editability and validation, and preserve unexposed authentication settings.
Saving leaves provider selection and authentication unchanged. Saving the provider used by `model/list` invalidates its catalog for the next access. Include documentation and generated JSON, TypeScript, and Python protocol types.
## Testing
Add coverage for gateway creation and ID allocation, patch and null semantics, configuration policy enforcement, authentication preservation, and catalog refresh after active-provider edits. Extend Python protocol tests to verify wire round trips and reject mismatched provider IDs or fields.
GitOrigin-RevId: 850fe2c48ef5274944400efb5a859d720179c923
## What changed
- Add `modelProvider/list` to return OpenAI and explicitly configured providers, provider-specific settings, and the selected default provider.
- Report `canEdit` and `canChangeDefault` based on configuration requirements, layer precedence, and whether user configuration is enabled.
- Describe gateway authentication without resolving credentials, and omit endpoint URLs that are unsuitable for display.
- Document the API and update generated JSON schemas, TypeScript types, and Python models.
## Testing
Add app-server tests for provider discovery, authentication modes, unsafe URL suppression, and configuration editability, plus a Python wire-format round-trip test.
GitOrigin-RevId: 8ba26637cd6bdd075e0e815e88aeeb04c53a2364
## Why
`start_or_steer_turn` rejected agent messages, preventing callers from submitting follow-up work through the turn input API.
## What changed
Route `TurnInput::InterAgentCommunication` through native agent message delivery and return `TurnInputSubmission::Accepted`, without implying an immediate turn ID. These submissions request work regardless of `trigger_turn`, retain the recipient's settings, and forward turn-start options.
Wrap plaintext messages with agent context while preserving encrypted content. Reject submissions to idle recipients when the host is draining.
## Testing
Add scenario tests and snapshots covering queued-message ordering, encrypted follow-ups, preemption at reasoning boundaries, and follow-ups arriving before or after a final answer. Extend drain-gate coverage to agent submissions with parent-turn lineage.
GitOrigin-RevId: 92d49465f97bb366babbf1b1bc18a1e8a6c6ed1c
## Why
Live paginated history retains completed assistant text even when summaries only need the latest message. Release older text for threads with persisted history while preserving full resume responses.
## What changed
- Evict superseded assistant text from live turn state while preserving corrected items and the latest assistant message.
- Restore evicted text for full resume responses from prepared history pages, fetching remaining items by ID in bounded batches. Return an error if saved text is missing.
- Only load the active turn when it belongs in the requested initial page, and use the item ID index for targeted history reads.
## Testing
Add reducer coverage for text eviction and corrected messages. Extend running-thread resume coverage to compare full and summary items with live notifications, exercise restoration when the prepared page lacks the active turn, and check missing-text errors.
GitOrigin-RevId: 3229c0cea820f117dc6331312f1e6056a8d1d52c
## Why
Clients need to refresh section membership and ordering when another client moves a thread.
## What changed
Broadcast `thread/section/changed` after a successful `thread/section/move`, including moves within the same section. Send the response before the notification, and include `threadId` and the destination `sectionId`, using `null` for removal. Failed moves do not emit the notification.
Add the notification to the protocol schemas, TypeScript exports, and Python SDK models and registry, and document its behavior.
## Testing
Add a WebSocket integration test with separate writer and observer clients covering section insertion, reordering, removal, and a failed move.
GitOrigin-RevId: 128ba7eddc9aae8e3bac766f47e4a2c55c64a6a5
## Why
A network request can disappear while its approval prompt is still pending. Leaving that prompt active allows a late cancellation to interrupt the turn even though the request no longer needs approval.
## What changed
- Track network prompt lifetimes in core and notify the app server when a prompt is resolved or withdrawn.
- Cancel the corresponding server request, emit `serverRequest/resolved`, and release its permission guard. Resolve outstanding network prompts during thread shutdown as well.
- Claim a live pending approval and validate its originating turn before applying a decision, so stale responses cannot interrupt a turn or persist policy changes.
- Distinguish network approvals that require the originating turn from proxy approvals that can be serviced by a later active turn.
## Testing
Extend regression coverage for disconnected network requests, late cancellation responses, turn completion during review, shutdown cleanup, mismatched turn IDs, and command approvals from background code running during a later turn.
GitOrigin-RevId: 78f656d92607ec21ddd0c5d781ed0947588cb2eb
## What changed
Allow shared network constraints in `[permissions.network]` in `requirements.toml`, alongside `[permissions.filesystem]`. Apply them throughout configuration loading, network approvals, Windows sandbox policy validation, and `configRequirements/read`, and show their source in `/debug-config`.
Retain `[network_proxy]` and `[experimental_network]`, but reject mixing either with `[permissions.network]`, even across requirements layers. Preserve independent network and filesystem precedence and source attribution, and report unknown nested network fields.
Reserve `network` as a managed requirements table name and reject empty or profile-shaped tables with migration guidance. Profiles named `network` remain valid in `config.toml`. Document that policy publishers must keep using `[experimental_network]` until all readers support the chosen replacement.
## Testing
Add coverage for layered constraints and source attribution, conflicting spellings, profile-name migration errors, unknown-field diagnostics, and cloud validation. Extend API, project discovery, network approval, and Windows policy tests to cover `[permissions.network]`, and verify managed proxy settings remain independent of disabled feature configuration.
GitOrigin-RevId: 994dfca9abf5a7aea914276c0ded8b40d7ed0372
## What changed
Expose `thread/guardianReview` to review an idle thread's final injected `exec_command` without executing it. Return the call ID and Guardian assessment, or `null` for the assessment when exec policy skips approval.
Subscribe the requesting connection to the thread, enforce input and model-provider restrictions, and cancel an in-flight review when the connection disconnects so the thread is released promptly.
## Testing
Add integration coverage for assessment responses, policy-skipped reviews, model-provider enforcement, and WebSocket disconnect cancellation.
GitOrigin-RevId: e8ad5598e8f101a937447ebe26136310bb76c8d1
## Why
Managed command policies need to require a human decision independently of automatic review, hook allowances, and saved approvals.
## What changed
- Support `decision = "prompt-user"` in managed `requirements.toml` prefix rules, requiring a fresh, one-time human decision for matching commands.
- Add experimental `humanCommand` approval requests for clients advertising both `experimentalApi` and `requiredHumanApproval`. Accept only `accept`, `decline`, or `cancel`; reject commands when no capable client is available.
- Restrict responses to capable clients that received the request, and replay pending prompts to compatible clients on reconnect.
- Enable the capability in the TUI and update protocol schemas and client bindings.
## Testing
Add coverage for fresh decisions overriding saved allowances, hook allowances, and automatic review, plus child-thread approval routing and rejection of responses from incompatible or unrelated clients.
GitOrigin-RevId: 0b95ff6aab7f8a04b7298c8a4329d1fddf6a603e
## Why
Existing chats retain their provider configuration when the selected provider changes. Reject resume and input until the configured provider matches the chat, while keeping history readable and allowing recovery after configuration is restored.
## What changed
- Validate saved providers before applying resume overrides, preserving the provider when only model or reasoning settings change.
- Check the current provider selection, including profiles and launch overrides, before accepting input. Reject input when configuration cannot be loaded.
- Return structured `ModelProviderError` data for provider mismatches, missing definitions, and policy conflicts, with generated JSON Schema, TypeScript, and Python types.
## Testing
Add coverage for override bypass prevention, provider restoration, readable history after rejection, and blocked requests sending no inference traffic. Verify schema fields and Python round trips match the error wire format.
GitOrigin-RevId: 051f97c3815c547d8411c71b770df30eae969f68
## What changed
When a diagnostic upload includes logs, include saved threads attached directly to the reported thread in the existing bounded thread selection alongside spawned descendants. Query attached threads from the state database, including archived threads, so their rollouts, logs, and retained review failures can be collected. Log a warning and continue if the lookup fails.
## Testing
Extend the upload integration test to verify that the rollout archive includes the reported and directly attached threads, excludes unrelated threads, and is omitted when logs are disabled.
GitOrigin-RevId: 1bcd2794938339fb4b1c433c3731f507601cd8a4
## Why
Stopping a sideband observer should close its WebSocket while preserving the frontend-owned realtime session. The existing frameless session close also sends `session.close`, so observer shutdown needs a transport-only close.
## What changed
- Add `close_transport()` to send a normal WebSocket close without `session.close`.
- Close the sideband transport on cancellation or when the call becomes inactive, including an existing connection awaiting adoption by the input task. Bound the close attempt to five seconds.
- Thread an optional sideband base URL through realtime start processing and allow nested thread ID fields in request serialization scopes.
## Testing
Add WebSocket and core conversation regression tests covering observer detachment for both realtime parsers and conversation versions. Verify that explicit frameless session close still sends `session.close`.
GitOrigin-RevId: 874a8980b0fcd45058e976b00c0d968f5b4b2404
## Why
Waiting for the event channel to close after `ShutdownComplete` retains the thread runtime because the thread owns its event sender. Remaining subscribers still need late notifications after shutdown.
## What changed
- Release runtime references after `ShutdownComplete` while keeping the listener command queue available for ordered notifications and late request resolutions.
- Preserve other subscribers when a client unsubscribes or disconnects from an unloaded thread, and serialize terminal cleanup with cold resumes.
- Return the thread-closing error when `thread/resume` encounters a terminated runtime or a listener that cannot complete the request.
- Close the status watch when removing a thread so a later load gets a fresh watch.
## Testing
Add regression coverage for listeners attached before and after shutdown, verifying runtime release, preservation of remaining subscribers, late notification delivery, and rejection of resumes against a terminated runtime. Add a test that removing and reloading a thread closes the old status watch.
GitOrigin-RevId: 6dda8f83a0fbe06c9a713e9801356753a0de172e
## Why
A thread runtime can shut down while listener setup is awaiting I/O, and a cold resume can start before the previous listener forwards `ShutdownComplete`. Listener replacement must preserve those buffered terminal events.
## What changed
- Coordinate listener installation and connection subscriptions with pending unloads, and reject closing or replaced runtimes.
- Allow a newly created runtime that has already shut down to drain its queued events, while enforcing one event reader per runtime.
- Track shutdown draining with a shared watch channel so cold resume and runtime replacement wait for terminal events to be processed.
- Serialize idle unloading with goal edits and cold resume, and recheck thread state after acquiring the lock.
GitOrigin-RevId: d05e348b0a81bddb2defa963d0cfd3fde08dbd03
## What changed
`review/start` now supports only inline reviews on the supplied thread and returns that thread's id as `reviewThreadId`. Clients can omit `delivery`, send `null`, or specify `"inline"`; `"detached"` is no longer supported.
For a separate review thread, call `thread/start` followed by `review/start`. To preserve conversation history with custom review instructions, use `thread/fork` followed by `turn/start`.
Remove detached review execution and its app-server dependency on `codex-agent-extension`, and update the protocol schemas and generated clients. Preserve `ReviewDelivery.inline` as a Python enum member.
## Testing
Add a Python regression test verifying that inline review delivery parses as `ReviewDelivery.inline` and round-trips to the original JSON.
GitOrigin-RevId: ed16c5271c3315ae3afcb3ee78883ed421394b4d
## What changed
- Allow `requirements.toml` to manage OpenTelemetry logging flags, tool-result byte limits, environment, and log, trace, and metrics exporters.
- Apply higher-priority managed values over user configuration, replacing exporters atomically and warning when configured values conflict. Preserve unmanaged settings, including `span_attributes` and `tracestate`.
- Expose managed `otel` settings through `configRequirements/read`, apply them in `config/read` without ordinary field origins, and reject configuration writes that overlap managed fields.
- Distinguish omitted tool-result limits from explicit values while preserving the runtime default.
## Testing
Add coverage for requirement precedence, relative TLS paths, override warnings, managed write protection, effective configuration reads, and exporter serialization through the app-server API.
GitOrigin-RevId: 6a3343563bd3acb53a366ea6723684e3d0a4a01d
## What changed
Add optional `otel` requirements to `ConfigRequirements`, with types for logging controls, tool-result byte limits, environment, and telemetry exporters, including OTLP HTTP/gRPC headers and TLS settings.
Update the JSON schemas, precomputed exports, and generated TypeScript and Python bindings. The app-server requirements mapper currently returns `otel: None`.
GitOrigin-RevId: f73edc22efe1ab7fddf51419267daa6cf9fd34c5
## Why
Archiving a thread also archives its spawned descendants, but unarchiving it previously restored only the parent.
## What changed
- Restore archived spawned descendants when handling `thread/unarchive`, including descendants archived independently of the parent. Skip active descendants and continue past descendant restoration failures; fall back to restoring only the parent if descendant discovery fails.
- Emit `thread/unarchived` for each successfully restored thread. Hold the thread-list mutation permit through archive and unarchive responses and notifications to preserve ordering with other list mutations.
- Add `ThreadStore::unarchive_threads` and share rollout discovery across the subtree in the local store.
## Testing
Extend coverage for subtree restoration, independently archived children, descendant restoration failures, and failed descendant discovery. Store tests cover skipping active descendants and restoring archived descendants without hydrating their metadata.
GitOrigin-RevId: c54ca099c92bcb2df5e595fa252d7fad7c018760
## Why
Slow consumers can lose process output or block control replies when the in-process event queue fills. Descendants can also keep output streams open after the child exits, leaving clients unable to tell whether captured output is complete.
## What changed
- Require delivery of `process/outputDelta` and `process/exited` notifications, while allowing process request replies to proceed when event delivery is blocked.
- Exclude time spent delivering output to slow clients from the post-exit drain budget, and drain queued bytes after the deadline closes a stream.
- Keep draining after an output byte cap is reached so the child can finish writing; abort each stream's reader when its drain deadline expires.
- Add optional `outputDrainTimedOut` to `process/exited` and generated bindings. Report incomplete output separately from the child's exit code, treating a fully captured requested byte cap as complete.
- Deliver the exit notification before moving Windows console cleanup to a blocking task.
## Testing
Add regression coverage for full event queues, stalled consumers issuing process control requests, slow output delivery, inherited pipes, output caps, Windows console descendants, and compatibility with exit notifications that omit `outputDrainTimedOut`.
GitOrigin-RevId: 04cfeea5daa7c2b833cdec3f1fff7efeb4d1a86e
## What changed
- Add `accountSession/list` and `accountSession/switch` for the active managed ChatGPT login, with optional workspace membership refresh.
- Validate membership and workspace policy, pause new turns, and unload running threads before switching credentials. Notify clients with `thread/closed` and `account/updated`; selecting the current workspace leaves threads running.
- Support browser sign-in for SSO through `allowBrowserLogin`, binding the callback to the requesting login and workspace. Require a separate sign-in for government workspaces.
- Preserve the selected workspace across token refresh and conditionally restore the previous workspace if routing validation fails. Guard credential writes against concurrent login or logout changes.
## Testing
Add app-server and auth tests covering workspace switching, credential preservation, policy and identity rejection, conditional rollback, stale sessions, and SSO callback validation.
GitOrigin-RevId: 1234abc33b71e69b66318da3e201fccc08867906
## What changed
- Add `account/gcp/setup` to configure the built-in Vertex AI provider with a project, optional location (defaulting to `global`), and optional credential file. Omitting the file clears the active user override and uses Application Default Credentials.
- Validate configuration and obtain an access token before saving, return structured credential failure reasons, and reload the model catalog on the next `model/list` request.
- Share configuration previews and version-checked writes with Bedrock setup to reject conflicting settings and concurrent configuration changes.
## Testing
Add tests for credential selection and ADC fallback, catalog refresh, invalid credentials, policy and endpoint conflicts, cancellation when network permission is revoked, and configuration version conflicts.
GitOrigin-RevId: 6f411a85893f8da49581427451e0180529955b16
Brent Traut