## Why
Linux sandbox unreadable globs without a non-root directory prefix cannot be safely expanded because they would require scanning from `/`. Silently skipping these patterns leaves the requested deny-read rule unenforced.
## What changed
Return a fatal sandbox construction error when an unreadable glob cannot be split into a safe ripgrep search root. The error directs callers to use a pattern with a non-root directory prefix.
## Testing
Add a regression test confirming that `/**/*.env` rejects Bubblewrap command construction.
GitOrigin-RevId: 2f3cb398d39a9bc077d3a1b74e08dc506d239e60
## What changed
- Add structured `usageLimitExceeded` metadata to failed image-generation
items, including the image limit ID and optional reset timestamp.
- Preserve the failure metadata in completion events, app-server thread
history, thread reads and resumes, and migrated legacy rollouts.
- Export the new failure type in the generated JSON and TypeScript schemas.
## Testing
- Cover usage-limit responses through item completion, persistence, and thread
resume.
- Verify legacy rollout migration retains image-generation failure metadata.
GitOrigin-RevId: 91c31a2a47456b6b916ee03002ff314b05946dd4
## Why
A retryable failure during the initial remote exec-server connection left the
environment disconnected on subsequent readiness checks.
## What changed
Route retryable startup errors through the existing reconnect path. This lets
later `get()` and `wait_until_ready()` calls establish a replacement client,
while concurrent callers share the same reconnect attempt.
## Testing
Add a WebSocket test that fails the initial handshake, then verifies that later
readiness and client requests share a successful replacement connection.
GitOrigin-RevId: 82d425af0a73331884439b4350a7a1052d4ae865
## What changed
- Remove effective-config lockfile export, replay, and validation from session startup.
- Remove the `debug.config_lockfile` settings and generated schema entries.
- Remove feature-config materialization helpers that were only used to create lockfiles.
GitOrigin-RevId: a8c07c1c06325b3ec3dae9a97c36c2488d37df25
## What changed
- Import skill metadata and mention helpers directly from `codex-skills`.
- Import host skill loading types directly from `codex-skills-extension`.
- Make the remaining `codex-core` skills module private and remove its skill API re-exports, including the `HostSkillsService` re-export from `codex-core-api`.
GitOrigin-RevId: 26bf8fffd980df9c4d0c308d7e983ceab9a5df82
## Why
`skills/list` can load multiple working directories in one request, but bundled
skill discovery did not account for different effective configurations across
those directories.
## What changed
- Resolve `skills.bundled.enabled` from each load input's effective config layer
stack inside the host skills service.
- Include or exclude system-scoped skills for each working directory based on
that resolved setting.
- Keep bundled skills enabled by default when the setting is absent or invalid.
## Testing
- Add a multi-directory `skills/list` test with bundled skills disabled in one
project and enabled in another.
- Add config-layer tests for defaults, overrides, and malformed bundled-skill
configuration.
GitOrigin-RevId: e4e97dc7d0a374ac71d0aa11e55a9e337f661717
## Why
Subagents should be able to use known HTTP MCP tool definitions without opening a connection until a tool is actually called.
## What changed
- Add streamable HTTP configurations to the process-scoped MCP tool catalog cache when their authentication identity can be derived safely.
- Fingerprint transport settings, relevant environment variables, protocol mode, plugin status, and client capabilities so catalogs are reused only across equivalent connections.
- Keep OAuth and other dynamically resolved credential configurations out of the shared cache.
## Testing
- Add an integration test proving that a subagent receives cached HTTP tools without reinitializing the server, then starts its own connection when it calls one.
GitOrigin-RevId: bb2787e29e9b71993def31aafd1f0d8f1b728d26
## What changed
- Reject invalid or unsupported image data before producing tool output, so
non-image file contents are not exposed through code mode.
- Preserve valid image bytes and metadata while leaving image preparation and
resizing to the history insertion path.
## Testing
- Cover invalid images in both code mode and standard `view_image` calls.
- Verify that code mode preserves PNG bytes, dimensions, EXIF orientation, and
metadata.
GitOrigin-RevId: 07343ed10b781d0ce0ffb5b24432658be4c046e3
## What changed
- Add `codex-build-info` to resolve a packaged runtime's semantic version from `codex-package.json` while preserving the commit stamped into the executable.
- Represent source builds as version `0.0.0` and expose helpers for display, serialization, and source-build detection.
- Stamp `STABLE_GIT_COMMIT` into final Bazel Rust binaries so Git changes do not invalidate the shared library graph.
## Testing
- Cover packaged, source, legacy, and invalid-version resolution, plus serialization round trips.
GitOrigin-RevId: 669b02449644c738ba2946a1b7aafe4ec31a9edb
## What changed
- Add `PersistContext` to the thread-store persistence contract so stores can
identify persistence requested immediately before model sampling. A
`TurnStart` request may be enqueued in the background when later flush and
shutdown operations fence it and report any failure; all other persistence
remains synchronous.
- Use the turn-start context only for the initial input of a regular turn, while
admission acknowledgments, steered input, and other persistence paths keep
the standard durability behavior.
- Flush pending metadata before turn-start persistence and ensure shutdown is
still attempted if that metadata update fails.
## Testing
- Verify that developer instructions and user input are persisted before the
model request completes for a default paginated-history thread.
GitOrigin-RevId: 162f0ec796a61aebe66ca0b909fbcccec3047b85
## What changed
- Move the host process harness and common session delegates into shared test
support modules.
- Allow the host harness to start either WebSocket or gRPC listeners and
validate the endpoint scheme they publish.
- Update the stdio and WebSocket integration tests to use the shared fixtures.
GitOrigin-RevId: a0408be7c88e4eb9ad1832b6d2698781de77168a
## Why
Background refreshes previously warmed only the on-disk cache, so new sessions in the same process continued using the startup snapshot.
## What changed
- Make `CloudConfigBundleLoader` retrieve the latest shared bundle on each configuration load.
- Update the in-memory bundle after successful refreshes while preserving the last successful bundle when a refresh fails.
- Stop refresh work when its loader is replaced or its final clone is dropped.
## Testing
- Cover refreshed requirements and managed configuration in later sessions.
- Cover concurrent initial loads, refresh failures and recovery, bundle clearing, and refresh-task cancellation.
GitOrigin-RevId: ae3d79b575bad71a1eed370cee6dc66dc022ffa8
## What changed
- Send notification events without waiting for client acknowledgment, so an
unacknowledged notification no longer delays cell completion.
- Keep the notification acknowledgment RPC as a compatibility no-op after
validating the session and notification ID.
- Remove pending-notification tracking and cancellation events from the gRPC
session routing path.
## Testing
- Verify that a cell completes after emitting an unacknowledged notification
and that a later acknowledgment is still accepted.
GitOrigin-RevId: 19cf3ed5ce82cf45d84fa75f238c2afa4e83acb5
## What changed
- Pass image bytes from `view_image` through unchanged for both direct and code-mode calls, leaving decoding and resizing to the shared history-insertion path.
- Represent invalid image data with the existing image-omission placeholder instead of returning a tool error.
## Testing
- Update the `view_image` integration test to cover placeholder output for invalid image data.
GitOrigin-RevId: 62863defd4815efb8a7725712fd583ad81db3fbb
## What changed
- Remove `Clone` from `Submission` and remove `Clone` and `PartialEq` from `Op`.
- Consume operations directly in the submission loop instead of cloning them.
- Limit thread-manager test capture to the operation variants under test and update assertions to compare their relevant fields.
GitOrigin-RevId: 781cc631391b8583d94dad5ca45f589856c0b21a
## What changed
- Add optional `icon` and `color` appearance fields to custom thread sections and expose them through the app-server protocol.
- Persist appearance metadata in SQLite and include it when listing sections or returning threads.
- Let `threadSection/update` preserve an omitted appearance, clear it with `null`, or replace it with a new value.
- Reject appearance fields larger than 64 bytes.
## Testing
- Cover protocol compatibility, persistence across restart, update and clear behavior, and field-length validation.
GitOrigin-RevId: 8f55ce4f42f8bd17aa5416848a85845f681953df
## What changed
- Add pinned `windows_support` repositories for the Windows SDK and MSVC runtime on `x64` and `arm64`.
- Require explicit acceptance through `--repo_env=BAZEL_MSVC_RUNTIME_VISUAL_STUDIO_EULA=1` before materializing the MSVC runtime.
- Preserve case-only SDK aliases when repositories created on case-insensitive Windows filesystems are consumed by case-sensitive remote executors.
GitOrigin-RevId: c7a5278e87c5e7e25e9c5f60af3d99e19303b0fd
## What changed
- Add `responses_api_metadata` for product-owned key/value metadata included in
every Responses API turn metadata payload, including parent and subagent
requests.
- Limit the map to 16 entries, ASCII identifier keys of at most 64 bytes, and
values of at most 128 bytes. Reject reserved Codex metadata keys and ignore
this setting in project-local configuration.
- Give configured product metadata precedence over app-server client metadata
while keeping it out of metadata sent to external MCP servers.
## Testing
- Cover reserved-key validation, metadata precedence, MCP isolation, and
propagation to parent and subagent Responses API requests.
GitOrigin-RevId: a7be798294fde25145ab375a468321bb4e4a49f1
## What changed
- Decode image data in the `view_image` handler and return a clear error for invalid or unsupported input.
- Re-encode code-mode images as PNG pixel data while preserving original image bytes for direct tool calls.
- Cover code-mode PNG output and rejection of invalid image data.
GitOrigin-RevId: 0a00e595ab749c19eab866a22f6577b6627e19f1
## What changed
- Add an optional `threadId` parameter to `app/read`.
- When provided, load the thread's effective configuration before applying app feature gating, workspace policy, and plugin attribution.
- Share the thread-aware configuration loader with `app/list`.
## Testing
- Add coverage showing that `app/read` honors a thread-level connector feature override.
GitOrigin-RevId: 161e910a2d7435ecf4acd0ba9f5f5069d1631f12
## Why
Unix socket proxy permissions are macOS-only, but configuring them could still
clamp Windows proxy listeners to loopback and emit warnings about unsupported
settings.
## What changed
- Exclude Unix socket permissions from Windows runtime settings and bind-address
clamping.
- Suppress the macOS-only Unix socket warning on Windows.
- Preserve the original configuration for state updates and remote launch
configuration.
## Testing
Add coverage for proxy startup, live configuration replacement, remote launch
configuration, and warning behavior with Unix socket permissions configured.
GitOrigin-RevId: 5d72f5365486ab11ae3cf5edfd78da665e05344d
## What changed
- Recognize executables under `codex-resources/` as part of a package layout by resolving the sibling `bin/` directory, while requiring that directory to exist.
- Add `InstallContext::package_manifest()` to parse the semantic package version from `codex-package.json`.
## Testing
- Extend the package-layout test fixture with a complete manifest and verify that version `1.2.3` is returned.
GitOrigin-RevId: 034aad3e8b865c6c6ecdff47da7c12c969744404
## What changed
- Parse safety-buffering payloads from typed `response.metadata` SSE events.
- Preserve the existing top-level `safety_buffering` field as the authoritative value when it is present, including when it is null or malformed.
- Continue applying the header-provided fallback model when the metadata payload omits `retry_model`.
## Testing
- Add parser coverage for metadata fallback, top-level precedence, and unrelated metadata events.
- Exercise metadata-based safety-buffering delivery through the core SSE integration test.
GitOrigin-RevId: 7dadfd54be28f2f33c2283de92fd49da0557d98a
## What changed
- Add `goals.max_goal_token_budget` as a positive-integer configuration setting.
- Use the configured maximum as the default budget for new goals and when `tokenBudget` is reset to `null`.
- Reject goal creation and updates whose token budget exceeds the configured maximum, including requests through goal tools and `thread/goal/set`.
- Respect managed configuration precedence and per-thread configuration overrides.
## Testing
- Cover configuration parsing and managed overrides.
- Cover defaulting, resetting, and rejecting oversized budgets through the goal service, goal tools, and app-server API.
GitOrigin-RevId: f8d7e6418cdc237d454c8cf47bb32ba0d44a60cf
## Why
Managed networking implicitly selected the elevated Windows sandbox backend,
even when the sandbox was configured to use a restricted token.
## What changed
- Select the Windows sandbox backend solely from `WindowsSandboxLevel`.
- Reject managed networking with a restricted-token sandbox before spawning a
process, since managed networking requires the elevated backend.
- Cover the rejection through sandbox preparation, unified exec, and Windows
sandbox session tests.
GitOrigin-RevId: 308858652d7b629af623d22896dafde3a23d3758
## What changed
- Exclude conversation turn count, response-engine latency, and turn token usage metrics from the built-in Statsig exporter, alongside the existing API and tool-call exclusions.
- Apply the Statsig exclusion list consistently to counters, histograms, gauges, observable gauges, and duration histograms.
- Preserve all excluded metrics for custom OTLP exporters and extend the loopback coverage to verify they are exported.
GitOrigin-RevId: e49f9aa1433126a3de8dbed76a4d2688f2831af8
## What changed
- Add `codex-history` for model-history and persisted-rollout domain types, including `RolloutItem`, `RolloutLine`, `CompactedItem`, and initial/resumed history state.
- Re-export the persisted types from `codex-rollout` and update consumers to use the new crate boundary instead of `codex-protocol`.
- Preserve existing rollout serialization, including legacy numeric compacted-window IDs.
## Testing
- Add `codex-history` tests for rollout JSON round trips, compacted-history compatibility, persisted history modes, and multi-agent version selection.
GitOrigin-RevId: 944daa9297ddd231d3aebbdcb05fff4adf8b4e1b
## What changed
- Reject patches containing multiple operations whose paths resolve to the same file, such as `duplicate.txt` and `./duplicate.txt`.
- Preserve support for patches that update multiple distinct files.
## Testing
- Add CLI integration coverage for distinct updates and duplicate resolved paths.
GitOrigin-RevId: 0fb7f69ae31acc5c677268ffd9e38ad8d8314276
## What changed
- Cover non-blocking credential probes when the file or secrets store is locked, including retaining only a matching prior credential snapshot and recovering after the lock is released.
- Extend the streamable HTTP OAuth round trip to verify that user turns continue during store contention, newly discovered servers recover after contention, and logged-out servers do not reuse authenticated connections.
- Cover reconciliation of authentication failures and effective `Authorization` headers.
GitOrigin-RevId: 8e377644001bd0be04dc9f79841080094d09d199
## Why
Standard MCP forms can require user-entered values even when tool permissions are
otherwise auto-approved in full-access sessions.
## What changed
- Recognize the `openai/standard-form-input` client extension and surface
non-approval forms in full-access, user-initiated root threads.
- Keep approval forms, automation and subagent threads, headless sessions, and
clients without the capability on their existing decline or review paths.
- Treat the capability as client-only so it is not advertised to MCP servers,
and enable it after session startup so required servers cannot block startup
waiting for form input.
## Testing
Add unit and app-server coverage for accepted form round trips, declined cases,
approval metadata safeguards, resumed threads, and extension filtering.
GitOrigin-RevId: 053bfe397a5c79eceef90a81d13e2aca6353af43
## What changed
- Rename `EnvironmentConfig` to `TurnEnvironmentConfig` to make its scope explicit.
- Rename the corresponding `SessionConfiguration` accessor and update all call sites.
GitOrigin-RevId: f47d745566199e699bd8e7c671c313eaf3bba79e
## Why
Refreshing MCP connection identities should not stall the async executor while another process holds the OAuth credential-store lock.
## What changed
- Probe file and secrets credential stores without waiting during runtime refreshes, retaining the last known credentials when the store is contended.
- Reuse unchanged authentication failures while credentials are temporarily unavailable instead of restarting the connection.
- Run blocking credential loads on a blocking worker during MCP client construction.
- Allow OAuth fallback when a configured authorization header is missing, empty, or invalid.
GitOrigin-RevId: 38dad5606da9a1ceb30fe945000ec9151a5058fa
## What changed
- Send Unix `execve` approvals intercepted by the zsh fork through the shared approval pipeline, including permission hooks, Guardian review, user prompts, and telemetry.
- Resolve the active turn and its auto-review setting when an intercepted command needs approval, so commands sent to persistent terminals use the current turn's reviewer.
- Give each intercepted command a distinct approval ID and propagate an aborted approval as a turn abort.
## Testing
- Cover Guardian review for intercepted `unified_exec` commands and persistent terminals across turns.
- Verify repeated identical intercepted commands receive separate user approvals.
GitOrigin-RevId: e6cccf160637e4246aff4714c22f08c90b65306d
## What changed
- Add `pluginId` to each `mcpServerStatus/list` result.
- Populate it for MCP servers contributed by installed or selected plugins, and
return `null` for servers from other sources.
- Update the generated protocol schemas, TypeScript bindings, and app-server
documentation.
## Testing
- Cover plugin-owned servers in plugin installation and executor flows.
- Verify non-plugin servers and protocol serialization return a null
`pluginId`.
GitOrigin-RevId: 0e4b912252cf51be56dcb63e0c1c7365a5e870ee
## What changed
- Set `CODEX_SESSION_ID` to the shared root-session ID for shell tool calls,
unified exec processes, and user shell commands.
- Preserve `CODEX_SESSION_ID` when restoring a shell snapshot, alongside the
existing runtime-owned environment variables.
GitOrigin-RevId: 5228867d25507105c7edf11607a8298958c3b917
## What changed
- Restore a V2 agent's inherited environment selections when reloading its
thread after residency eviction.
- Keep the restored execution environment and its tools available when the
agent receives a follow-up task.
## Testing
- Add an integration test that evicts and reloads a V2 agent, then verifies
its environment selection and `exec_command` tool are preserved.
GitOrigin-RevId: a5d4ad0fa465c717b32b7ae6807486429187a41d
Call `scrub_non_inheritable_env_vars` directly from each Git command path and
remove the redundant crate-local forwarding helper.
GitOrigin-RevId: 9e4125dc538ea888626bde3cb3646a90712206a2
## Why
Concurrent MCP startup and status checks should not serialize when they only read the shared credential store. Repeated reads of the encrypted MCP OAuth store also needlessly decrypted unchanged contents.
## What changed
- Use shared locks for `File` and `Secrets` credential reads while keeping saves and deletes exclusive.
- Cache decrypted MCP OAuth secrets by store path, ciphertext, and passphrase, and invalidate the cache after writes.
## Testing
- Cover concurrent readers, reader/writer exclusion, shared credential loads, and cache invalidation after updates and deletes.
GitOrigin-RevId: f13512e6404d4919879ba5ba77a3e34e52b35640
## What changed
- Restrict host loading, snapshot, and outcome implementation details to the
skills extension crate.
- Require `HostSkillsLoadInput` construction through its public constructor
instead of exposing its fields.
- Remove redundant implicit-invocation helpers from `SkillLoadOutcome`; use the
`ImplicitSkillLookup` interface for enabled-skill lookup instead.
GitOrigin-RevId: e79c77fc3e69ecc0231b0c87e5f9f24a5487f9e4
## Why
The plugin and skill test suites were excluded wholesale on Windows, even though
most cases do not depend on POSIX behavior.
## What changed
- Make generated TOML and JSON fixtures escape Windows paths correctly.
- Use Windows-safe path canonicalization and normalize advertised skill paths.
- Select test environments through the environment-aware builders.
- Run the suites on Windows while narrowly skipping cases that execute POSIX
commands or require matching host and executor path conventions.
GitOrigin-RevId: aadf31013c2bf9bac728adc4dd96f572d4a3bf3f
## Why
The app server should not need access to host skill root internals to decide
which paths require filesystem watching.
## What changed
- Add `HostSkillsService::watchable_skill_root_paths` to return non-plugin,
non-system skill roots for the watcher.
- Make `HostSkillRoot` and root resolution private to the skills extension.
- Update the app-server watcher to consume the filtered paths directly.
## Testing
Add a host service test confirming that user skill roots remain watchable while
plugin and generated system roots are excluded.
GitOrigin-RevId: b3e3b576e4ffe96230af71d9bf7c6c315b1705d3
## What changed
- Remove the path-only `effective_skill_roots` API and its type-erasing trait in favor of `effective_plugin_skill_roots`, which preserves plugin metadata.
- Remove skill-path ancestor lookup helpers and keep namespace resolution scoped to an explicit plugin root.
- Update plugin manager and namespace tests to exercise the retained APIs directly.
GitOrigin-RevId: 507bf43bc6147bb5ab2deba4fa176bea2535159c
## What changed
Add the `codex.turn.unified_exec.running_processes` counter and increment it
by the number of background terminal processes remaining when a turn finishes.
GitOrigin-RevId: 82a33b89533960d86cef95360fa122836c8aa84d
## Why
A single `skills/list` request should use one view of shared skill roots across
all requested workspaces while still applying each workspace's skill rules.
## What changed
- Add a request-scoped host skills view that reuses non-plugin root snapshots
across `cwd` entries without persisting them across requests.
- Resolve user-scoped plugin skill roots once per request, then apply workspace
skill configuration separately for each `cwd`.
- Make `forceReload` refresh plugin roots before building the request-scoped
view so subsequent entries see the refreshed skills.
## Testing
Expanded `skills/list` and host skills service tests to cover multiple ordered
workspaces, per-workspace skill rules, request-local snapshots, cached results,
and forced plugin-root refreshes.
GitOrigin-RevId: eedd3a4c3e213b7f30df6cacd3adf23ba2967437
## What changed
- Load an optional package-supplied config file as the lowest-precedence
configuration layer, so every existing layer can override its values.
- Report the layer as `packagedDefaults`, including its source path, through
config diagnostics and the app-server protocol.
- Return an error when a configured packaged defaults file is missing.
## Testing
- Cover precedence across packaged, system, user, and session layers.
- Cover the missing-file error path.
GitOrigin-RevId: 52406890f4d580eedabc90bf2a9ee3affa36fee1
## What changed
- Make `package` the only required argument to `skills.read`, resolving the
owning orchestrator or executor catalog automatically.
- Default omitted `resource` values to the package's main `SKILL.md`.
- Render orchestrator skills as package locators and instruct the model to read
them directly without first calling `skills.list`.
- Update skill extension and app-server coverage for direct main-resource
reads, referenced resources, aliases, and the revised tool schema.
GitOrigin-RevId: 9faf57a8d0935566a15094931eaabaa8f0613e9e
## Why
Building a prompt cloned every model-visible `ToolSpec`, even though the tool
set is immutable for the lifetime of its router.
## What changed
- Store model-visible tool specs as an `Arc<[ToolSpec]>` in `ToolRouter` and
`Prompt` so prompt construction only clones the shared pointer.
- Keep separately built routers on distinct shared slices so refreshed tool
sets remain independent.
## Testing
Extend router tests to verify allocation sharing within a router, allocation
separation across rebuilt routers, and the existing deferred-tool filtering.
GitOrigin-RevId: 1e04cd7c4d1b3fa0b494c5c51670232d38ba8ebb
## What changed
- Direct the built-in `image_gen` path to request transparent backgrounds and
preserve the generated alpha channel.
- Remove the built-in chroma-key generation and local background-removal
workflow from the skill guidance and examples.
- Keep CLI model fallback explicit, including confirmation before switching
from `gpt-image-2` to `gpt-image-1.5` for transparent CLI output.
GitOrigin-RevId: 1a6fbbb632bbf3f95146347d66da5382313b32a2
## Why
Clients need to correlate a remote plugin installation request with a specific
installation attempt.
## What changed
- Add the optional `installAttemptId` field to `PluginInstallParams`.
- Forward the value as `install_attempt_id` in the remote plugin install POST
body.
- Preserve the existing empty request body when the field is omitted.
## Testing
- Cover protocol serialization and remote install request bodies with and
without an attempt ID.
GitOrigin-RevId: ffdceff4f9329b650848e6428a9ba39646c242c3
