## What changed
When `features.guardian_denial_reconsideration` is enabled, retry the first terminal denial once using the unchanged inference request. Buffer provisional output so only the selected response enters reviewer history, while allowing tool calls to proceed normally.
Preserve the original denial if the retry fails or times out, and continue to honor cancellation. Account for token usage from both attempts, including failed reviews.
Remove `auto_review.experimental_denial_reconsideration_prompt` and warn when it remains in configuration.
## Testing
Update the Guardian scenario and snapshot to verify identical retry inputs, retained tool evidence, and reuse of the selected assessment in a subsequent review, with asynchronous compaction enabled.
GitOrigin-RevId: cc4e303d40a02acc824c8b4b954852325e64ad52
## Why
Guardian scoring and cached approvals need to use the requesting turn's captured policy even when the live thread configuration changes. Newly tightened mandatory review requirements must still prevent cached approvals.
## What changed
- Pass captured turn configuration through tool lifecycle and approval review inputs, and use it to resolve Guardian policy and classifier instructions.
- Apply current reviewer and model requirements before scoring and cached approval, including rechecking restrictions after collecting score authorization.
- Count computer-use JavaScript execution attempts even when background scoring is disabled, so a synchronous call consumes the initial-call allowance.
- Retain runtime configuration snapshots when applying agent role overrides, and share Guardian policy text resolution between configuration loading and runtime publication.
## Testing
Add and extend regression coverage for captured policy instructions, reviewer restrictions, stale cached evidence, and a synchronous computer-use call followed by an adaptive turn.
GitOrigin-RevId: 24ed4a1b6ce1733ad775790f30e440da614f9cd6
## Why
`pin-utils` 0.1.0 is unmaintained with no patched release and remains a transitive dependency through AWS Smithy and `loom` under `tokio-graceful`.
## What changed
Add `RUSTSEC-2026-0441` to the ignore lists in `codex-rs/.cargo/audit.toml` and `codex-rs/deny.toml`. Document the dependency paths and remove the exception when they drop `pin-utils`.
GitOrigin-RevId: 803d519ad3ad044d49d73ff2a172c6e0b01fc8d3
## Why
A Code Mode script can start a command without returning its session handle. Make retained sessions visible to the model so it can find running commands and collect exited results with `write_stdin`.
## What changed
- Add the disabled-by-default `command_sessions_world_state` feature.
- Publish snapshots of up to 16 retained sessions with their IDs, running or exited status, and whether they are in use. Report omitted sessions and suppress unchanged updates.
- Preserve session visibility when `write_stdin` is unavailable and refresh snapshots after compaction. Clear stale session handles after restart or when the feature is disabled.
## Testing
Add an end-to-end scenario and model-visible history snapshot covering a dropped command handle, unchanged state, unavailable polling, compaction, exit and result collection, and stale-handle cleanup after restart.
GitOrigin-RevId: 45704d8c6403149997231aafb8496c12879aff23
## What changed
Remove `dynamic_network_policy`, which only converted `SandboxPolicy` to `NetworkSandboxPolicy`. Update the Seatbelt network policy tests to call `dynamic_network_policy_for_network` directly with explicit `Restricted` or `Enabled` policies, preserving the existing assertions.
GitOrigin-RevId: 8d712cc542a07e516de677d69499aff7f3918354
## What changed
Allow experimental clients to request `deferOutput: {"commandExecution": true}` in `thread/items/list` for a specific `turnId`. Completed commands with a recorded completion time, exit code zero, and nonempty saved output return `outputDeferred: true` and `item.aggregatedOutput: null`. Clients can retrieve the complete output through `thread/items/read` using the turn and item IDs.
Keep full output by default and for listings across turns. Make conversion from `ThreadItemEntry` to `ThreadItem` fallible so Rust consumers detect deferred output instead of treating an incomplete item as complete.
## Testing
Add integration coverage for experimental capability gating, default and disabled options, command status and output eligibility, listings across turns, deferred-item conversion, and full output retrieval by item ID.
GitOrigin-RevId: d6bfac34bb68f7e3b327fd5553270ed6d0fe87cf
## What changed
Add the disabled-by-default `async_compaction_root_only` feature flag. When enabled, it restricts background compaction to root sessions, excluding non-root agents. Expose the flag in the configuration schema.
## Testing
Add a parameterized test covering root session eligibility and eligibility for review subagents and guardian sessions with the flag enabled and disabled.
GitOrigin-RevId: b4cce3f24f7f418ae61a82a7aef310f849cfd532
## What changed
Add configurable pane actions with default leader shortcuts:
- `leader z` zooms or restores the focused conversation pane.
- `leader ,`, `leader .`, and `leader =` minimize, maximize, or equalize pane widths within layout limits.
- `leader shift-h` and `leader shift-l` move the divider while the side pane has focus.
- `leader r` enters resize mode, highlighting the divider and showing keyboard hints. Arrow keys or `h`/`l` move it one column; Shift+Left/Right move it ten columns. Enter or Esc saves the width to `tui.sidebar_width_percent`.
Discard resize previews when terminal focus is lost or the split layout becomes unavailable. Preserve exact column widths at the current terminal size for presets and completed keyboard resizing, avoiding percentage-rounding drift.
## Testing
Extend TUI tests and snapshots to cover zoom and restore, width presets, divider movement, resize previews and persistence, and interrupted resizing. Extend keymap tests to cover zoom binding conflicts and custom chords.
GitOrigin-RevId: 7dd823fd8c2a0c90368c66f254c4fdd7c863c8a8
## Why
Shared hosts serve independent chats and their subagents. Larger callback workloads need room for unrelated work and control messages, while gRPC completion bursts can exhaust HTTP/2's small-DATA-frame budget and disconnect shared sessions.
## What changed
- Raise the active-cell limit from 128 to 2,048 and the pending delegate callback limit from 1,024 to 4,096. Expand request and transport queues to leave room for completion bursts and control traffic.
- Negotiate larger callback budgets through the stdio `delegate-capacity-4096` capability and gRPC `max_pending_delegate_calls` field. Preserve the 1,024-callback budget for legacy clients and enforce both session and shared host limits on gRPC.
- Limit concurrent gRPC completion RPCs to 64 across a provider's sessions, allowing queued completions to be canceled without waiting for delivery capacity.
## Testing
Add stdio and gRPC integration tests covering 256 cells and 4,096 callbacks across shared sessions while unrelated work completes. Add tests for callback budget isolation and reuse, rejection of zero capacity, and cancellation of queued completions. Include an ignored resource-intensive test for full host capacity.
GitOrigin-RevId: e85bfa24cc46cc8a735b464d80adf8066a6a6d3a
## Why
Pets were unavailable in tmux even when fullscreen Codex could render Kitty images through passthrough.
## What changed
- Enable pet images and picker previews in fullscreen tmux panes with Kitty passthrough, and update the unavailable notice to recommend fullscreen mode with `allow-passthrough all`.
- Use pane-specific image IDs and virtual placements for pets and previews, reserving separate IDs from transcript images. Repaint underlying text when pet placeholders move or disappear.
- Draw pets and previews when refreshing the fullscreen transcript, and consume preview areas once per render.
## Testing
Extend the owned-screen lifecycle test to verify that preparing fullscreen enables the Kitty protocol in tmux and returning to scrollback disables it. Update `/pets` notice assertions and the popup snapshot.
GitOrigin-RevId: 02c838ceb06abcbb45314e1d38ff4cde77221426
## What changed
Enable composer and transcript image previews in owned-screen mode under tmux when the client is Ghostty or Kitty, RGB is supported, and `allow-passthrough` is `all`.
Use Kitty virtual placements and Unicode placeholders so images move with their pane. Allocate image IDs per pane and repaint the viewport when replacing or removing images to clear stale placeholders.
## Testing
Extend image rendering tests to cover tmux virtual placements, placeholder snapshots, redraw retention, and overlay cleanup. Add probe coverage for pane-specific image IDs and rejection of visible-only passthrough.
GitOrigin-RevId: d34abacabfabc47a4354eab016ee4370835cadc9
## What changed
- Share the harness runtime identity with analytics delivery and turn-cost queries, and resolve request authentication together with its account-bound transport policy.
- Add runtime authentication to ChatGPT request helpers and `codex cloud`, including environment discovery. Resolve environment credentials for each request and honor CLI configuration overrides when loading cloud authentication.
- Preserve custom-backend authentication, validate runtime destinations, and keep cloud requests from following redirects.
- Forward only organization and project selectors from model-provider headers to API-key analytics requests.
## Testing
Add regression coverage for runtime request signing, credential refresh, account and resource selection, redirect credential handling, custom destinations, and cloud credential-store overrides.
GitOrigin-RevId: 75f33961ee6482881e9ff9817e99d977f31b65b8
## What changed
- Add `--chatgpt-token-stdin` for remote HTTPS registration and optional `--chatgpt-account-id`, which must match the token's account claim when present. Read a bounded, newline-terminated token from a pipe without persisting it to `auth.json`.
- Load managed configuration using the supplied account, enforce account restrictions, and preserve configured policy-server authentication. Skip ChatGPT policy lookup only for known plans that do not require managed configuration.
- Allow `--exit-on-stdin-close` to cancel pending policy loading, and redact the registration bearer from registry diagnostics.
- Reject incompatible stdin credential options, including flags placed on opposite sides of `forward`, and disallow ChatGPT token stdin authentication with `forward`.
## Testing
Add coverage for account-claim validation, policy selection, policy-server sign-in requirements, shutdown during policy loading, credential flag conflicts, and bearer redaction.
GitOrigin-RevId: b6b50565e1f150b96edf3cee796909a991f1b47f
## What changed
- Use the shared runtime and effective configuration for account API clients and remote plugin requests, including standalone plugin commands.
- Support dual-header and assertion-only authentication for remote plugins and MCP file uploads when runtime agent instances are enabled.
- Keep plugin credentials and caches scoped to the thread's account when resuming with different credentials. Bind request pools and multi-step plugin storage operations to the selected account so account replacement revokes stale operations.
- Protect runtime credentials on cross-origin redirects while preserving configured routing policies and legacy authentication for custom backends.
- Apply server-provided `upload_headers` to file storage uploads.
## Testing
Add coverage for shared runtime registration, both authentication modes, configuration reloads, resumed-thread account selection, account replacement during plugin uploads and downloads, and credential stripping on redirects. Extend file upload tests to verify runtime assertions and storage-only upload headers.
GitOrigin-RevId: 68aef81051a6f9bf919fffda52f372b108fce805
Replace loopback TCP sockets with an in-memory duplex connection in
`malformed_handshakes_preserve_active_streams_and_admission_recovers`
so Tokio can advance deadlines after both peers become idle.
Service keepalive pings while waiting for the handshake failure cooldown,
and remove the blocking clock guard and switches to real time for validation
timeouts and connection shutdown.
GitOrigin-RevId: 5c468ee9f150f701a819936322430e23ef3046a7
## What changed
Add a Model providers entry under Sessions to browse the connected app server's provider catalog. Show the current chat's provider and the default for new chats, with scrollable details for endpoints, authentication settings, and provider-specific configuration. Browsing does not change the active provider.
Handle loading, dismissal, stale responses, disconnected servers, and unsupported server versions. Refresh an open provider list when the first chat attaches.
## Testing
Add tests and snapshots covering provider lists, scrollable details, initial chat attachment, nested views, stale results after dismissal and reopening, and unsupported server methods.
GitOrigin-RevId: 2deb4e286b2648d9f459e403361e5501db98ca96
## Why
Decimal IDs of up to three digits fit in a single token. Issuing shorter IDs first keeps identifiers compact in model context.
## What changed
Add `codex-utils-model-facing-id` with deterministic, seed-based ID generation. Each salt prefixes the displayed ID and derives a separate sequence from the session seed. The generator shuffles decimal pools, exhausting `000`–`999` before issuing six-digit suffixes, then expanding in groups of three digits.
Support serializable, versioned snapshots that resume at the next unissued ID, plus suffix-only formatting for protocols that supply their own prefix.
## Testing
Add integration tests for pool exhaustion, stable outputs across pool boundaries, serialization and restore, salt-based seed derivation, invalid snapshots, and wraparound after the last `u64` ordinal.
GitOrigin-RevId: 80ffbf861106980b731d34a61ca2b9448d3bbb0d
## What changed
- Support `canonical_matching=True` in `prefix_rule` and `canonical_matching = true` in managed TOML prefix rules. Apply Unicode canonical caseless matching to every prefix token, including alternatives, while keeping exact matching as the default.
- Match case and canonically equivalent Unicode spellings, such as `bash` and `bAſh`, without resolving executables on the filesystem.
- Preserve managed restrictions when checking absolute-path rule amendments, and enforce applicable `host_executable` path allowlists during basename fallback.
## Testing
Add coverage for case folding, Unicode normalization, token alternatives, exact-match defaults, and host executable allowlists. Extend managed-policy and shell-execution tests to cover canonical matching.
GitOrigin-RevId: c2f79069dc38d55c77028c457b22beb468d5c571
## What changed
- Expose `AgentSessionReader` and `AgentRef` for read-only access to host-owned agent session membership.
- Read direct children when rendering V2 environment context, using the existing roster size limits. Refresh membership when rebuilding context after compaction, and omit the roster if the provider is absent or the read fails.
- Preserve unrecorded initial input across suspension or interruption while waiting for a roster read. Resolve the roster before advancing the compaction window.
## Testing
Add coverage for roster refreshes after compaction, unchanged environments avoiding extra reads, unavailable rosters, recoverable input during blocked reads, and stale compaction results rejected after a concurrent history replacement.
GitOrigin-RevId: 3c7e3822af09e9295d405e53dabb87b020c8f00c
## What changed
Add optional executor workspace roots to `SandboxTransformRequest` and resolve symbolic workspace rules after merging additional permissions. Preserve explicit deny rules and treat an empty root list as granting no workspace access.
Route Windows restricted-token preparation through the shared transform path and use explicit roots when building its direct-spawn wrapper. Update Windows MXC debug launches to bind configured roots before adding the managed CA read grant.
## Testing
Extend sandbox manager tests to cover workspace and subpath expansion, empty root lists, deny preservation, and the roots and write permissions serialized into the Windows wrapper.
GitOrigin-RevId: 0bebdb08b67cbbc182c18b031b9d13a21a799682
## What changed
- Allow dragging the pane divider and save the preferred width in `tui.sidebar_width_percent`, defaulting to one third of the terminal. Defer reflow until release when retained images are present.
- Support scrolling and loading older history in the unfocused pane, opening links, copying selections, and clicking its composer to switch focus while preserving the clicked text position.
- Keep assistant replies, running command completion, and turn status current in the unfocused pane without duplicating answers or completion metadata when focus returns.
## Testing
Add regression coverage for divider previews and saved widths, image-aware resizing, composer clicks, unfocused history pagination and copying, and streaming replies and command completion across focus changes.
GitOrigin-RevId: a26accc0f8df3c17f53bc915db29a11c8de3c480
## Why
The cloud backend discarded item start and completion events, preventing clients from receiving user message receipts and complete assistant messages through those notifications.
## What changed
Convert cloud user and agent message summaries into `ItemStarted` and `ItemCompleted` notifications. Preserve user submission IDs and text, assistant text and questions, and lifecycle timestamps. Continue ignoring unsupported item types.
## Testing
Add unit tests covering user receipt identity and text, plus completed assistant message text, questions, and timestamp.
GitOrigin-RevId: 3e88129553844a90eea2a006d35f32a0b7d9e53a
## Why
Saving local secrets invalidated the decrypted cache, forcing the next read to decrypt contents already available in memory.
## What changed
Populate the cache with the saved snapshot after the atomic write succeeds. Only cache the current schema version, leaving normalization and rejection of other versions to the read path. Reads continue to verify the ciphertext and keyring before reusing cached contents.
## Testing
Add coverage across all four local secrets namespaces for cache reuse after saving, including through backend clones, and preservation of the committed snapshot after a failed write. Update existing tests to verify cache reuse after setting and deleting secrets while retaining concurrent cold-read coverage.
GitOrigin-RevId: 61519aadc16bbe8db8c5055b126885500716418a
## Why
UI tree limits previously applied during rendering, silently dropping content
beyond the budgets. Validate the whole JSON tree before rendering so oversized
inputs are rejected, including content outside the visible line.
## What changed
- Add a `UiTree` string parser that limits JSON to 64 KiB, nesting depth to 16,
non-null nodes to 256, and total string content to 16 KiB of UTF-8.
- Represent text as string leaves or `text` elements with children. Remove node
keys, `spacer`, and `divider` elements.
- Require an explicit `row` gap as a non-negative JavaScript-safe integer measured
in terminal columns. Bound rendered spacing by the viewport and skip empty
children when inserting gaps.
- Update footer content and built-in status lines to use the revised tree format.
## Testing
Add coverage for malformed elements and gaps, whole-tree size boundaries, URL
length limits, large-gap rendering, and bounded UTF-8 prefixes for directly
constructed text. Update hyperlink and footer clipping tests for the new format.
GitOrigin-RevId: 3c00881d3e7f2d79d11aa188f64f0725cd47ee68
## What changed
Replace parallel lookup sets and per-turn maps with a single arrival-ordered list of pending interactive requests. Centralize request matching for replay filtering and cleanup, deduplicate repeated requests, and resolve user input answers against the oldest pending question for the turn.
GitOrigin-RevId: c02115c289718a39359a6e6653d1dc7d588d2f90
## What changed
Add `Client::list_threads` with cursor pagination, page limits, sorting, and originator filtering for unarchived threads. Return thread snapshots, optional read states, and forward and backward cursors while preserving server order and duplicate entries.
Allow stored thread snapshots to contain empty session IDs and model providers while retaining nonempty requirements for activation. Preserve the original snapshot protobuf bytes.
## Testing
Add fixture tests for pagination requests, default query encoding, snapshot and read-state preservation, legacy empty metadata, invalid responses, and activation validation.
GitOrigin-RevId: 6492cb60573d13cc7b7d0aa583d1dab6bccafc4d
## What changed
Update the Python SDK build requirement and release tooling to use `uv_build>=0.13.0,<0.14`. Refresh the release tooling lockfile from version `0.11.33` to `0.13.6`.
GitOrigin-RevId: 9c9a8ef8c24f133144ec141c6611ba4c7b1863b1
## What changed
- Extend server-owned fresh-start bootstrap to embedded connections, preserving explicit profile and launch overrides.
- Require `config/read` to succeed before starting a fresh thread, including on servers that do not support the method.
- Prefetch `model/list` alongside `hooks/list` and reuse the result during bootstrap.
## Testing
Extend startup coverage for managed model and reasoning-effort defaults across embedded, daemon, and remote connections. Verify startup failure shuts down all initial backends, and directory-trust startup requests the model catalog exactly once while `hooks/list` is outstanding.
GitOrigin-RevId: c96edfbc13c98203b7c2a809a87d225e05cf5f1b
## What changed
Accept an optional `_meta` object on `mcpServer/resource/read` and forward it to MCP `resources/read`, including reads bound to an originating tool call. Update the protocol schemas and generated TypeScript and Python types.
Reject caller metadata containing host-owned `threadId`, `x-codex-turn-metadata`, or `codex/connectionLease` keys. For `codex_apps`, also reserve `connector_id`, `link_id`, and `_codex_apps.resource_uri` to preserve app and account routing.
## Testing
Add integration coverage for metadata forwarding through stdio, hosted app reads with and without a thread, and origin-bound widget reads. Cover rejection of reserved keys and non-object metadata.
GitOrigin-RevId: 227ee0fb5fe15fa2ff2ec66d4d5ae16de8935a8c
## What changed
Configure managed memory consolidation agents with a `PermissionProfile` directly and explicitly bind both configuration and permission workspace roots to the memory directory. Keep network access disabled and exclude temporary directories from writable roots. Preserve disabled and externally managed parent permission profiles.
## Testing
Extend regression coverage to check that inherited workspace roots remain readable but are not writable, protected metadata stays read-only whether or not it exists, and incompatible permission constraints prevent agent configuration. Verify effective filesystem enforcement, network policy, and disabled approvals across parent permission profiles.
GitOrigin-RevId: b1ae115cade059da9e5fb83c218a1d89185b4a70
## Why
Dylint 6.1.0 required a Git branch alias to accommodate rust-clippy's removed `master` branch.
## What changed
- Upgrade the lint dependencies and CI/release tooling to Dylint 6.3.0, updating the Cargo and Bazel lockfiles.
- Remove the Clippy compatibility script and run `cargo test --locked` directly in CI.
- Update installation instructions and wrapper diagnostics to recommend the matching tool versions.
GitOrigin-RevId: 18ac1489cd3faa7a80abf26b092e5478881f142d
## Why
Changing the default model provider should not prevent users from resuming or continuing a thread that uses another configured provider.
## What changed
- Resolve cold resumes using the thread's saved provider and reject explicit attempts to switch it on resume.
- Use retained provider configuration for loaded threads without reloading the current default selection, while continuing to enforce managed provider policy.
- Preserve errors for missing provider definitions and policy conflicts.
## Testing
Update app-server and TUI coverage for resuming with a different default, recovering after restoring a missing provider definition, preserving drafts across resume retries, and continuing loaded threads with malformed system defaults.
GitOrigin-RevId: c5bf3b03cacde7349480c94c2f10bac827a0eb1f
Update `workspace_policy_change_rejects_pending_transient_auth_fallback` to
pass `None` for `cached_auth` and unwrap the `load_auth` result before
checking the fallback credentials.
GitOrigin-RevId: 09b7812f2f072389f9633de977e63edfa45186ed
## What changed
- Log `thread/items/list` request IDs, cursor kinds, page sizes, next-page availability, elapsed time, and success status.
- Log remote-control item-page response preparation and WebSocket write times, along with request and stream IDs, sequence IDs, frame counts, wire bytes, and success, interruption, or write-error outcomes. Collect these transport metrics only when debug logging is enabled.
GitOrigin-RevId: 0f26bef6d6b8cacbd5a5c76c49a5f882669f6598
## Why
An enabled legacy feature flag could prevent a project's `agents.enabled = true` from overriding a lower-priority legacy opt-out, leaving V1 agent tools unavailable.
## What changed
Only stop scanning configuration layers at an explicit legacy feature opt-out. Enabled flags now allow the scan to continue, so project opt-ins can override lower-priority opt-outs while same-layer and higher-priority opt-outs remain effective.
## Testing
Extend the model runtime selector regression test to cover enabled `features.collab` flags in project configuration and CLI overrides, and verify that explicit `false` values still disable V1 agent tools.
GitOrigin-RevId: ca3dcf9dc6a642eb72e20929776fb74379715053
## What changed
Update `seed_gateway_auth` to seed either the keyring or file credential store according to the provider's configuration, using `GatewayAuthManager::credential_id()` to identify credentials.
Use file storage in the gateway model-cache reuse and login-required invalidation tests to keep keyring latency outside the behavior under test.
GitOrigin-RevId: 23b4f31b6d9f9561638267723582af73eabefcfc
## What changed
Expose `cloud_backend::connect` to adapt an authenticated `codex-cloud-client` client to `AppServerClient`. Support account reads, resuming a conversation by ID with saved settings, reading its metadata, listing the loaded thread, and unsubscribing.
Forward turn lifecycle events and agent message deltas, and track thread status from attachment notifications. Keep the previous attachment when a replacement fails, report stream disconnections, and reject turns without an active attachment. Unsupported requests and approval replies return explicit errors.
## Testing
Add tests covering failed attachment replacement, turn admission after disconnect, and thread status tracking across notifications and reattachment.
GitOrigin-RevId: 5a131e814d588cadeb9fb94513b99e92b47e3da4
## Why
A temporary external credential provider failure should not clear cached authentication or appear as a logout.
## What changed
Retain cached credentials after transient external auth failures when they still satisfy the current login and workspace restrictions. Advance the auth generation when the forced workspace policy changes so pending reloads cannot publish credentials validated against an outdated policy.
## Testing
Add regression tests for retaining credentials without auth change notifications during a transient failure, notifying watchers after recovery, rejecting credentials disallowed by a workspace policy change, and discarding a pending fallback validated before that change.
GitOrigin-RevId: 304f091f3b59d4840a8be09bf38671370e86abd8
## Why
An MCP server can belong to a different environment from the turn's primary environment. An early Guardian score based on the issuing context must not bypass review when the server owner's permissions differ.
## What changed
- Capture the owning environment's permissions when preparing an MCP call and retain them for server-initiated approvals tied to that still-running call.
- Use the captured permissions consistently in Guardian review prompts and permission context.
- Require a fresh synchronous review when the captured owner permissions do not match the early score's authorization.
## Testing
Extend regression coverage for MCP score reuse across environments and for follow-up approvals from a local MCP server during a remote-primary turn. Assert that reviews use the owner's denied paths and require a fresh review when permissions differ.
GitOrigin-RevId: eb5eeb1259732c57f39765c38e34148fa0787dae
## What changed
- Add `direct_only_tool_namespaces` to `TurnStartOptions`. Omission inherits the thread configuration; an empty list clears direct-only routing for that turn. Steering ignores the option.
- Persist explicit overrides in turn context and restore them when recovering an interrupted turn, including turns started by standalone tool output.
- Keep subsequent turns and spawned or resumed child agents on the thread's routing defaults.
## Testing
Add coverage for routing changes across turns in Responses and Responses Lite, recovery without carrying overrides into subsequent turns, and child-agent inheritance.
GitOrigin-RevId: cea1a997424572d4cd372cd15b098626904c6796
## What changed
- Expose `PromptCacheTtl` through `TurnStartOptions` and `RecoverTurnRequest`, supporting `30m` and `12h` minimum cache lifetimes.
- Carry the selected TTL through turn execution and compaction into `prompt_cache_options.ttl` on Responses HTTP and WebSocket requests. Omit the field when unset and keep the selection scoped to the turn.
- Include prompt cache options in WebSocket request reuse checks.
## Testing
Add coverage for both TTL values and omission on a subsequent turn without an override, and extend WebSocket serialization coverage to include prompt cache options.
GitOrigin-RevId: 8529306e6ad6030fe77c5e6bf19f3810717c0c5e
## What changed
Mark `[features].multi_agent` as deprecated while keeping it enabled by default and preserving its control of the V1 fallback.
Emit a startup warning when a user or project configuration explicitly sets the flag. The warning points to `[agents].enabled = false` for disabling subagent tools, with an exception when `[features].multi_agent_v2` is enabled. Session-only overrides do not trigger the warning.
## Testing
Add configuration-loader coverage for explicit user and project settings, including a project setting overridden by a session flag, and for session-only overrides. Update the default-enabled feature check to allow deprecated features.
GitOrigin-RevId: 8bcac6ce5eac27528a2b362755e25d6a6e811c59
## Why
Saved `features.multi_agent = false` settings can be overridden by a higher-precedence session setting. Session telemetry should retain visibility into those saved opt-outs.
## What changed
Add `config.legacy_multi_agent_disabled_sources` to `codex.conversation_starts`, reporting opt-outs from user configuration, project configuration, and managed requirements. Emit comma-separated source labels, or `none` when no opt-outs are found.
## Testing
Add a regression test confirming that a user opt-out is still reported when a CLI override enables multi-agent support for the session.
GitOrigin-RevId: 488bd317d67e9ee87c5903ae51f466e0a63c05eb
## Why
Migrating a project's multi-agent setting to `[agents] enabled = true` should preserve access to agent tools when a lower-priority config still sets `features.multi_agent = false`.
## What changed
Allow an explicit project agent opt-in to override a strictly lower-priority legacy feature setting. Preserve legacy feature settings in the same or higher-priority layer, and continue enforcing managed feature requirements.
## Testing
Add regression coverage for project migration, V1 and model-selected V2 tools, same-layer and CLI opt-outs, and enterprise requirements that disable multi-agent tools.
GitOrigin-RevId: 5810a42d4b7e66cdcbef8dad5281dda4a66291b3
## What changed
Extract argument parsing and approval policy selection into helpers. Separate
approval requirement evaluation and action construction from requesting approval,
with explicit states for approvals that are unnecessary, remembered, or required.
GitOrigin-RevId: 822cda972f9e0d12286ec833dfbe11b47b4c0ec8
## Why
Core tests depend on `codex-app-server` to install and clean up agent message boards. A dedicated host crate lets them use this functionality without depending on the app server.
## What changed
Move the existing host implementation into `codex-agent-message-board-host` and update core test helpers and scenarios to use it directly. Keep the installation and deletion functions re-exported from `codex-app-server`.
GitOrigin-RevId: 9ed62d50a5f31c70550d70ba3c583399e869168a
## Why
Directional pane switching cleared the parent conversation's transcript selection or Find state, so returning to it interrupted the interaction.
## What changed
Route left/right pane switches through the existing conversation toggle to park and restore each pane's transcript interaction. Explicitly focusing the main composer still clears transcript interaction.
## Testing
Extend the side-conversation test to cover restoring selections, Find text and caret position, and composer input after scrolling. Add a snapshot verifying that Find remains editable after switching away and back.
GitOrigin-RevId: 172f9be0df15517fbfe7f3773b63cbd1cef1cc77
## What changed
Add `PreparedFork::with_source_revalidation` for backends that revalidate the source when making the child's history reference durable, allowing the source reservation to be omitted.
Rename the reservation-backed constructor to `with_source_reservation` and update the local thread store to use it, preserving its source deletion protection.
GitOrigin-RevId: 659c23aaf83a3856eb628ea37f1b0a153d376516
## Why
Pressing `Ctrl-/` immediately after `/btw` must not switch focus before the queued side-conversation prompt is dispatched.
## What changed
Wait for queued app events to drain before reading terminal input when the displayed thread belongs to a parent/side conversation pair, even when side retention is disabled. This keeps queued prompts and transcript updates ahead of focus changes.
## Testing
Extend the side-conversation startup test to toggle focus at the earliest allowed opportunity and verify that the turn starts on the side thread. Also check that a queued request to reopen the side conversation blocks terminal input until handled.
GitOrigin-RevId: cb46636d35de97b02994ed68a32eb971cd7bf6db
## What changed
Add `user_input_extension_data` to `TurnInputRequest` and carry it with each queued user input through completion, including inputs that steer an active turn. Expose the data to lifecycle contributors through `on_item_completed_with_metadata`, whose default implementation forwards to `on_item_completed` for compatibility. Keep this data out of model input and preserve the existing serialized input shape when no extension data is present.
## Testing
Add serialization round-trip coverage and extend the concurrent submission test to verify that inputs sharing a client ID retain their own metadata, report completion in the accepting turn, and omit extension data from model requests.
GitOrigin-RevId: f880cf812994a030cb1be9418280ba69e2885808
jif