## What changed
- Move config-layer, user, system, plugin, extra, and repository skill-root
resolution from `core-skills` into the host skills extension.
- Keep the core loader focused on loading explicit `SkillRoot` values.
- Relocate and expand tests for root precedence, deduplication, repository
ancestry, plugin metadata, and concurrent probing.
GitOrigin-RevId: 3b95cf28101b8b4d64d54079d202154dad560aab
## Why
Reviews may use a different model from their parent turn. They need current
thread settings without inheriting defaults resolved for the parent model.
## What changed
- Build review configuration from the parent turn context while preserving
explicitly configured token-budget overrides.
- Use the review model's token-budget defaults and select a supported reasoning
effort when switching models.
- Carry the session's resolved service tier and current environment,
permissions, and approval settings into the review thread.
## Testing
Expanded review coverage for updated thread settings, model-specific
token-budget defaults, service tiers, and reasoning effort selection.
GitOrigin-RevId: cefa0f22cd9b9e28047d94e1d2d49ff83eded43e
## Why
Guardian reviews received sandbox retry reasons, but not the execution-policy reason that triggered an initial approval request.
## What changed
- Propagate approval and retry reasons through the tool approval flow and include the applicable reason in the Guardian prompt.
- Prefer a sandbox retry reason when both are available.
- Truncate approval context to 512 tokens while preserving the start and end of the reason.
## Testing
Added prompt and integration coverage for policy reasons, retry precedence, and truncation.
GitOrigin-RevId: 5b0f4e1c40b792b031bc8f7b31685a61d12b8d92
## Why
Amazon Bedrock supports hosted text web search, but it rejects the
`search_content_types` field used for multimodal search and does not support
external live or indexed web access.
## What changed
- Advertise hosted web search for Amazon Bedrock while marking external web
access as unsupported.
- Resolve unsupported live and indexed modes to cached search, or disable the
tool when cached search is prohibited by managed requirements.
- Normalize built-in and configured Bedrock model catalogs to text-only web
search, and retain the runtime provider in session configuration so turn
setup can apply its capabilities.
## Testing
- Cover cached fallback, managed-mode restrictions, text-only tool payloads,
provider capabilities, and catalog normalization.
GitOrigin-RevId: 310473849257401654388a4ebb42920e03aa3228
## What changed
- Replace the TUI directory-trust prompt with automatic trust for local projects whose trust level is unset. Keep explicit trust settings and remote workspaces unchanged.
- Persist trust for the resolved Git or configured project root, then reload configuration so project-local settings take effect.
- Fall back to an in-memory trust override and an embedded app server when the config update cannot be persisted.
## Testing
- Cover persisted and in-memory trust, custom project-root markers, and the working directories selected by resume and fork flows.
GitOrigin-RevId: 8fd51eb4cd88267073324bfd7dc4106a56d7c745
## What changed
- Remove the cached permission profile from `TurnContext` and derive the
effective profile, filesystem policy, network policy, and legacy sandbox
policy from `config.permissions`.
- Update sandbox consumers and tests to use the current turn configuration.
- Verify that role-based agent spawning reapplies runtime permissions and that
cold-resumed agents retain their disabled permission profile.
GitOrigin-RevId: d67c5d2bcbe6dc76f15b56defb485b155fd1f138
## What changed
- Move host skill discovery, snapshot caching, and configuration handling from
`codex-core-skills` to `codex-skills-extension`.
- Rename `SkillsService` and `SkillsLoadInput` to `HostSkillsService` and
`HostSkillsLoadInput` to distinguish the host implementation from other skill
providers.
- Keep shared loading primitives and skill outcome modeling in
`codex-core-skills`.
GitOrigin-RevId: d81a21791d2ef8c066e157e7e538b8cb7ee4c24b
## What changed
Expand the ChatGPT dual-surface plugin integration test to cover both enabled
and disabled app configurations. Verify that plugin app guidance and searchable
app tools follow `apps.calendar.enabled`, while plugin MCP guidance and tools
remain suppressed.
GitOrigin-RevId: 40c51fbc075e07a8b03b5c520f5c46e360f71ceb
## What changed
- Add `AppToolPolicyEvaluator::apply_app_enabled_state` and use it when
presenting app lists, building plugin context, and deciding whether app
instructions are available.
- Preserve each app's source state unless local or managed configuration
explicitly overrides it.
- Keep connector discovery and post-install refresh checks based on raw
accessibility rather than configured enablement.
## Testing
- Cover default enablement, per-app overrides, managed disablement, and
preservation of unconfigured source state.
GitOrigin-RevId: f1a62d55e7cc48b37113848e3baa0d69d8d9c8a8
## Why
Thread settings can update the approval policy after a turn context is created.
Keeping a separate copy on `TurnContext` could leave tool approval checks using
the previous policy.
## What changed
- Remove the duplicated approval-policy field from `TurnContext`.
- Resolve the policy through the turn's current configuration everywhere it is
needed, including tool execution, Guardian routing, MCP handling, and
permission requests.
## Testing
- Update the shell escalation test to apply a thread-level policy override and
verify that the next turn rejects an escalation using the updated policy.
GitOrigin-RevId: e5966ba08f179d53fd76871ad904762958c0f5ea
## Why
App-server clients need to advertise structured MCP extension settings, including supported MCP App UI MIME types, rather than only opting into OpenAI form elicitation with a boolean.
## What changed
- Add an `extensions` map to initialize capabilities and preserve `mcpServerOpenaiFormElicitation` as a legacy alias for `openai/form`.
- Capture the declared extension profile when a thread is started, resumed, or forked, propagate it to subagents, and advertise it to downstream MCP servers during initialization.
- Keep the profile stable for the lifetime of the loaded session instead of changing it on later turns or direct tool calls.
## Testing
- Cover extension conversion, downstream MCP initialization, session isolation, legacy form support, and subagent inheritance.
GitOrigin-RevId: fbcedbb74ce788e574b0f884a4c45c4cedb9de54
## Why
Reloading an unloaded v2 agent could inherit the model provider from the
agent that triggered the reload, even though the worker's model was restored
from its persisted thread state.
## What changed
- Restore both the model and model provider from the stored thread when
reloading a v2 agent.
- Return an invalid-request error if the stored provider is no longer present
in the configured provider map.
## Testing
Extend the v2 agent reload test to trigger the reload with a different sender
provider and verify that the worker retains its stored provider.
GitOrigin-RevId: 6401d9f0d1c116e9954e3bd193d016f04da5f223
## What changed
- Apply the session's current approval policy whenever per-turn configuration is built.
- Have review threads inherit the parent turn's full permission settings and approval reviewer.
- Add coverage for settings updated after session startup, including the approval policy, permission profile, and approval reviewer.
GitOrigin-RevId: bff050c6de157dd65d62f7b49651bef3f426ee3f
## What changed
- Gate Codex Apps MCP tool registration on whether apps are enabled instead of requiring each tool's connector to appear in the accessible connector list.
- Continue enforcing model-visibility and app-tool policy checks, including the requirement for connector metadata.
- Use the merged connector catalog for tool-suggestion discovery.
## Testing
- Cover app-tool registration from catalog metadata, including synthetic links, source ordering, and the apps-disabled case.
GitOrigin-RevId: eef4eb03da9738d3a165dd6cfda0d3c1844d51e7
## What changed
- Allow multi-agent v2 parents to spawn any visible model that has not explicitly disabled multi-agent support.
- Expose collaboration tools to child agents only when their selected model supports multi-agent v2, keeping legacy models as leaf workers.
- Preserve a worker's selected model when reloading it into residency.
- Propagate multi-agent capability metadata to Amazon Bedrock model entries so delegation is gated consistently.
## Testing
- Cover model selection, leaf-worker tool visibility, Bedrock capability handling, and model preservation after reload.
GitOrigin-RevId: 1457adb1a09806d1f0621311d5a42a6815b9dd4e
## What changed
- Keep complete MCP namespace descriptions in tool-search source metadata.
- Raise the namespace tool-spec description limit from 1,000 bytes to 512 KiB,
truncating at a UTF-8 character boundary only when the new limit is exceeded.
## Testing
- Cover descriptions beyond the former limit and multibyte truncation at 512 KiB.
- Update SSE and stdio MCP tests to verify that complete server instructions are
preserved without hiding tools.
GitOrigin-RevId: 000bfcafb3df348065ae451685bfbf978a0e3248
## What changed
- Add `ThreadSpawnRequest` to carry thread options, authentication, agent
control, fork metadata, inherited state, and shell overrides.
- Route new, resumed, and forked threads through one `spawn_thread` path.
- Centralize default session-source and environment selection when the request
is consumed.
GitOrigin-RevId: 8fd1a8531a212000c7430218c2200aa4a047cb9a
## What changed
- Allow namespace tool specs to contain custom freeform tools alongside function tools.
- Include namespaced custom tools in deferred tool search and expose them to code mode with names such as `editor__apply_patch`.
- Route custom payloads to matching extension tools while preserving function-only payload validation.
## Testing
- Add serialization, tool search, code-mode definition, and end-to-end dispatch coverage for namespaced custom tools.
GitOrigin-RevId: be64d35f6ae54685c5a9fcf45a732320742ea7e5
## What changed
- Add optional `defer_loading` support to freeform Responses API tool definitions.
- Omit the field when it is unset so existing eager tool definitions retain their wire shape.
## Testing
- Verify legacy freeform tool deserialization and eager and deferred serialization shapes.
GitOrigin-RevId: 50e8658a54ac5b6ae0c1dbfe65f7bb62efef561d
## Why
Code-mode `wait` and `terminate` requests can remain pending when the host
transport stalls.
## What changed
- Add a 60-second transport allowance to the runtime timeout for `wait`, and
apply the same transport deadline to `terminate`.
- Return a model-visible timeout error and invalidate the connection when the
deadline expires, so the next execution reconnects to the host.
## Testing
- Cover queued `wait` and `terminate` requests that exceed their deadlines.
- Verify that a timed-out `wait` reports the error and reconnects on the next
code-mode execution.
GitOrigin-RevId: 5d772e5a6f3793aa8865a1160639b851fd4824fb
## What changed
Add the tool name to `ApprovalCtx` and use the context's call ID and session
telemetry when recording approval decisions. This removes redundant `ToolCtx`
and telemetry parameters from `resolve_tool_approval`.
GitOrigin-RevId: 238a6f708f83993d64606bfaa74df344b0b46178
Rename `resolve_tool_apporval` to `resolve_tool_approval` and update its
call sites in the tool orchestrator.
GitOrigin-RevId: bc7d9ae675b45dd5b6b5b5643fd75e532f6314ca
## What changed
- Replace the thread ID in `<context_window>` metadata with the session's canonical agent path.
- Default sessions without an agent path to `/root`.
- Verify that root sessions emit `/root` and subagent sessions emit their own path, such as `/root/worker`.
GitOrigin-RevId: bcf057842ed31f93d554b7de063b6c03403a2594
## What changed
- Store the effective `allow_login_shell` setting on each turn environment, including inherited environments whose child thread has a different policy.
- Expose the `login` argument for shell tools when any selected environment permits login shells.
- Validate each command against the policy of its selected environment instead of the turn-wide configuration.
## Testing
- Cover tool schema generation for single and multiple environments.
- Cover login-shell rejection by both the command handler and the unified exec integration.
GitOrigin-RevId: 5a93149a5c86f4087f2b92d663ebc33feff8a57c
## What changed
- Add `codex-utils-audio` as a workspace crate for canonicalizing audio inputs
and estimating their token usage.
- Update `codex-core` to consume the new crate while preserving the existing
audio preparation tests.
GitOrigin-RevId: d719ecc08363ef52778aa37f3df0ca14f7778324
## What changed
- Track approved command prefixes separately from the stable permissions
instructions in world-state snapshots.
- Emit only newly approved prefixes after an exec-policy amendment instead of
appending the full permissions block again.
- Preserve prefix updates when full permissions instructions are disabled and
remain compatible with legacy world-state snapshots.
## Testing
- Cover incremental prefix additions, removals, legacy snapshots, history
rollback, and approval flows with permissions instructions enabled or disabled.
GitOrigin-RevId: e6f68c6a91be82750e70e28456f2b7c58607fbd8
## What changed
- Add `include_plugin_usage_instructions` to model metadata, defaulting to false.
- Emit generic plugin guidance only when plugins are available and the selected model enables it.
- Enable the capability for interactive model presets while leaving `codex-auto-review` opted out.
GitOrigin-RevId: 67f5a97e978033f5f1d533956c0b9deeae610283
## What changed
- Remove `ModelInfo.base_instructions` as an in-memory instruction source and use `model_messages.instructions_template` consistently for bundled, remote, fallback, and overridden model metadata.
- Preserve compatibility by promoting legacy `base_instructions` values when reading model responses and caches, and by including rendered legacy instructions when serializing `ModelsResponse` for older clients.
- Treat templates without instruction variables as literal text and retain the other model-message fields when applying instruction overrides.
This completes the consolidation proposed in https://github.com/openai/codex/pull/31302.
## Testing
- Cover legacy response and cache migration, canonical-template precedence, fallback instructions, personality rendering, overrides, and model switching.
GitOrigin-RevId: 089d986ca5e30da67db2c77a1b6a046d2cff52dc
## Testing
- Verify consecutive tool reviews reuse the same Guardian session without
prewarming and execute both approved commands.
- Verify interrupting a pending Guardian review prevents command execution and
records an aborted tool result for the next turn.
GitOrigin-RevId: b8371ae82b4fef206857012589668f890f9305bf
## Why
MCP tools can be exposed directly, discovered through tool search, or called
from Code Mode. Servers need to be able to opt out of any of these surfaces
without disabling their tools everywhere.
## What changed
- Add `omit_tools_from` to MCP server configuration, accepting any combination
of `direct`, `deferred`, and `code_mode`.
- Apply the exclusions independently when building direct, deferred, and Code
Mode tool surfaces while keeping omitted tools registered for permitted uses.
- Remove client-private `_meta` fields from MCP results returned to Code Mode.
- Include the new setting in the configuration schema and MCP config
serialization.
## Testing
- Cover every exposure combination across Code Mode, Code-Mode-only sessions,
tool search, direct-only namespaces, and prefixed and unprefixed MCP names.
- Verify direct and nested execution paths, parallel-call support, config
round-tripping, and `_meta` filtering.
GitOrigin-RevId: 12dfcb78bb5c5ecf4d70f38a8b5022792463a27f
## What changed
- Replace the ordering enum and `include_disabled` boolean with named
`ConfigLayerStack` iterators for each precedence direction.
- Keep enabled-only iteration separate from `all_layers_*` iteration, which
includes disabled layers.
- Update config consumers to use the iterator matching their precedence and
disabled-layer requirements without allocating an intermediate `Vec`.
## Testing
- Add coverage that verifies ordering and disabled-layer filtering for all four
iterators.
GitOrigin-RevId: d14df3db4a2eae80ba97cdec246bff405e6c5f3d
## Why
Codex Apps tool catalogs can exceed the standard MCP limit of 2,048 items and
still need to remain available through tool search.
## What changed
- Allow up to 8,192 catalog items for host-owned `codex_apps` registrations.
- Keep the 2,048-item limit for other MCP servers, including extensions that
register the `codex_apps` name.
- Restrict the shared Codex Apps tool cache to host-owned registrations.
## Testing
- Cover large catalogs for built-in and hosted-plugin registrations while
verifying that another extension retains the standard limit.
- Verify that a same-named extension cannot read the host-owned Apps cache.
GitOrigin-RevId: 2265693a460e9be63c4c849169cba7324def4f49
## What changed
- Enable `test_sync_tool` for the startup prewarm test.
- Hold the first user-turn response open while Git enrichment completes, then
verify the refreshed workspace metadata on the follow-up request.
GitOrigin-RevId: dd4254fba1ac2f346022988cc21a78648a29556a
## What changed
Derive code-mode tool names directly from registered tool names when checking
eligibility and collisions. Skip unsupported and empty tool specs explicitly,
without serializing schemas or augmenting descriptions that are not used during
executor registration.
GitOrigin-RevId: b439327aafd85ce3745d900301b7e48b56dbd6b4
## What changed
Move shell snapshot validation in the intercepted `apply_patch` test until after
the turn completes and its patch lifecycle events have been collected.
GitOrigin-RevId: 1c16bcfcc97f09165c4a2eb2d15f4059a14b2a99
## What changed
- Route verified patches from both direct tool calls and intercepted shell commands through a shared execution helper.
- Simplify patch safety preparation to return either a runtime invocation or a rejection directly.
- Keep permission resolution, approval handling, event emission, runtime execution, and diff tracking in the common path.
GitOrigin-RevId: e16aae8e91d96b8108aefac7f3fbf2da2cbac016
## What changed
Replace the type-erased `FragmentRegistration` trait and proxy objects with a
static list of `matches_text` function pointers. Remove the registration types
and their re-exports while preserving the existing contextual fragment matchers.
GitOrigin-RevId: 4e5a296b278984c6e783a67f48fa4bb37646946b
## What changed
- Store each turn's host skills snapshot in `ExtensionData` and expose it through
`TurnContext::skills_snapshot`.
- Lazily keep implicit skill invocation deduplication state in the same turn-scoped
store.
- Carry the skills snapshot into review turns without a separate
`TurnSkillsContext` field.
GitOrigin-RevId: d71579b5d230bd0b5f3c2ad062861f74d614d88c
## What changed
- Share argument normalization, server selection, cursor validation, and pagination setup between `list_mcp_resources` and `list_mcp_resource_templates`.
- Use a generic server-tagged wrapper to build single-server and deterministically sorted all-server payloads for both resources and templates.
## Testing
- Cover shared argument normalization and sorted resource-template payload serialization.
GitOrigin-RevId: 3505e4c1d2b95d8bbbb01f6f930fb914309eb898
## What changed
- Emit dynamic tool-call analytics for code mode `exec` and `wait` calls, including duration and terminal status.
- Associate code-mode cells and their nested tool calls with the originating and subsequent model response IDs.
- Buffer correlated tool events until the next response is known, while flushing pending events when turns, threads, or the analytics queue close.
## Testing
- Add reducer coverage for correlating `exec`, `wait`, and nested tool events across turns.
- Add an app-server test that verifies production analytics include the cell and response IDs for a code-mode `exec` call.
GitOrigin-RevId: 8b34ab59c1ad68ebbd57f9c8a05f19ab04df48a4
## What changed
- Store synchronization primitives directly in `TurnMetadataState` instead of
wrapping each field in its own `Arc`.
- Require an `Arc<TurnMetadataState>` when spawning Git enrichment so the
background task retains the complete state.
- Update Git enrichment tests to use the shared state container.
GitOrigin-RevId: 745ca6504c0a6533cb7726d045905472e51726df
## What changed
- Add a shared runner for MCP resource operation lifecycle events, output serialization, truncation, timing, and error handling.
- Use it for listing resources, listing resource templates, and reading resources.
GitOrigin-RevId: 84cae2e01a096d5b8ed97ea1cb462f01fe2ed1f9
## What changed
- Charge `codex_rollout_budget_units` against the shared rollout budget when the provider includes it in response usage.
- Fall back to weighted input and output token accounting when provider units are absent.
- Reject non-finite or negative provider units as a fatal response error.
## Testing
- Cover provider units in reminder thresholds and local and remote compaction budget exhaustion.
- Verify invalid units fail without retrying the response.
GitOrigin-RevId: b452403e365985854d16f298d1ba46383e9892c4
## What changed
- Parse `codex_rollout_budget_units` from completed Responses API usage into
`TokenUsage`.
- Keep the provider-only value out of serialized protocol, JSON schema, and
TypeScript representations.
## Testing
- Cover the value in unit and end-to-end SSE response parsing tests.
GitOrigin-RevId: a53d4202beb9c8985d25894cb10e7c01f20b2a44
## What changed
- Accept two-stroke bindings such as `ctrl-x ctrl-s` in TUI keymap configuration while preserving arrays as alternative bindings.
- Route chords through the active TUI context, show pending and configured chord hints, and cancel pending chords on `esc`, context changes, or a one-second timeout.
- Extend `/keymap` to capture, add, replace, and display key chords.
- Reject chords that conflict with active single-key bindings, overlapping-context chords, or reserved terminal shortcuts.
## Testing
- Add coverage for chord parsing, validation, matching, timeout and cancellation behavior, context dispatch, key capture, and rendered shortcut hints.
GitOrigin-RevId: dfdede03f518d4936ad8621ebf5537026f2b282e
## What changed
- Reattach recorded `executed_tool_calls` metadata when an output is included in a subsequent prompt.
- Bound retained metadata to 32 KiB, prioritizing recent calls and reporting omitted calls in truncation metadata.
- Drop retained entries after their corresponding outputs leave the prompt history.
## Testing
- Cover metadata replay, cleanup after compaction, bounded retained history, and propagation through later tool requests.
GitOrigin-RevId: 1c23a26123be3b7ad51c61f4ad522139b71bb773
## What changed
- Add the optional `delegationAckFiller` field to `thread/realtime/start`.
- Forward explicit `true` or `false` values to V3 Frameless Bidi session payloads as `delegation.ack_filler`; leave the field absent when unspecified so the Realtime API default is preserved.
- Document that V1 and V2 ignore this setting.
## Testing
- Cover both boolean values in Frameless Bidi serialization and verify the WebRTC V3 session creation payload.
GitOrigin-RevId: 9fe8efd14e42738c3e86e3e9a8af81d0f4521244
## What changed
- Run `git init` to mark command execution in the affected pre-tool hook tests.
- Keep marker repositories in per-test temporary directories and assert against
their `.git` directories.
- Check `git version` output when a code-mode hook rewrites a nested command.
GitOrigin-RevId: 71c54ef525b08e1d592f69c8b88eed1ee6403e4f
## Why
Clients need to know whether a `request_user_input` request must wait for an
explicit response or may auto-resolve. Using `autoResolutionMs` as that signal
conflated the blocking decision with timeout policy.
## What changed
- Add required `isBlocking` fields to user input protocol and app-server
request payloads. Plan-mode requests are blocking, while requests from other
enabled modes are non-blocking.
- Drive the TUI's auto-resolution behavior from `isBlocking` and remove
`autoResolutionMs` from the model-facing tool schema.
- Deprecate `autoResolutionMs` while retaining it for compatibility, and treat
legacy payloads without `isBlocking` as blocking.
## Testing
- Cover mode-derived blocking behavior, legacy deserialization, app-server
forwarding, delegated requests, and TUI auto-resolution.
GitOrigin-RevId: 29aade657ef743065ec264376ba567a9b353d7d7
## What changed
- Add optional `realtimeStartInstructions` and `realtimeEndInstructions` fields to `thread/realtime/start`.
- Apply the instructions when Codex enters and leaves realtime mode, while preserving the existing defaults when either field is omitted.
- Limit each field to 8,192 estimated tokens.
## Testing
- Cover custom entry and exit instructions across realtime state transitions.
- Cover token-limit validation for both fields.
GitOrigin-RevId: b9cfa1ff22e084d8a6b2ed56bd27d95ffdd6b6bd
