## Why
Background code-mode cells can continue running after a new turn starts. Looking up grants and strict review requirements through the active turn can make those cells lose their approved access or use another turn's permissions.
## What changed
- Keep turn-scoped grants and strict review state in `TurnContext`, retained by captured steps and background cells.
- Record permission responses against the requesting turn, including requests made after a later turn starts.
- Share live session-scoped grants across turns while keeping turn-scoped grants isolated.
- Use the originating turn's permissions and review requirements for tool execution, patches, MCP calls, file uploads, and terminal input.
## Testing
Add regression coverage for background cells retaining grants across turn changes, turn versus session scope, permission requests after the next turn starts, and strict review enabled while `write_stdin` is queued.
GitOrigin-RevId: 641502fbfd43553c2c42424d4aaa53ae8020c850
## Why
Detached launches truncate stderr logs, losing details from previous failures. Updater handoffs can also leave existing writers with stale offsets after truncation.
## What changed
- Record daemon lifecycle and update stages with timings, outcomes, and typed OS errors, omitting error messages and context.
- Preserve the last 256 KiB of nonempty stderr logs before truncation and use append handles to prevent gaps during handoff. Preservation failures do not block launch.
- Attach current and previous updater log tails when log inclusion is enabled for a report, with a 512 KiB total limit and legacy filename fallback. Skip missing, empty, and nonregular files.
## Testing
Add regression coverage for diagnostic error redaction, bounded log preservation, append behavior during handoff, attachment selection, and updater logs in captured report uploads.
GitOrigin-RevId: 918317022ab9dcfd1b13d676872706c77e9ffbb2
## What changed
Add the experimental `account/bedrock/checkGovCloudRequirements` RPC so clients can check the active Bedrock configuration after login or setup. It returns `isGovCloud` and `shouldWarn`, warning for GovCloud when managed requirements lack API-only login or enabled application network restrictions with an explicit allow entry for the active endpoint domain.
Reload configuration and requirements on each check while preserving the current session's authentication. Official Bedrock endpoint hostnames determine the region; otherwise, resolve it using the current authentication state. Non-Bedrock providers and commercial regions return both fields as `false`; configuration and region resolution failures return RPC errors. The check is advisory and does not block login or certify the entire network configuration.
## Testing
Add integration coverage for configuration and requirements updates without a restart, login changes, unreadable saved credentials, Mantle and Runtime endpoints, custom proxies, official endpoint region precedence, and invalid requirements.
GitOrigin-RevId: 24bfa91326cf5c73ada176c47351445de91b60a0
## What changed
- Mark `api_key_model_discovery` as stable and enable it by default, while preserving explicit user opt-outs and provider catalog requirements.
- Fall back to bundled models when discovery is disabled at runtime, including when a remote catalog has already been loaded.
## Testing
Extend model-list coverage for default enablement, app overrides, and user configuration precedence. Add a regression assertion that runtime opt-outs hide loaded catalogs without additional fetches, and update daemon compatibility tests for the new default.
GitOrigin-RevId: feaf732757792cc58063f21a5327d0e633f079f4
## Why
Guardian review continuations can repeat retained-instruction omission notices even when availability has not changed. When retained context becomes complete, earlier notices also need to be superseded explicitly.
## What changed
Track delivered user-instruction and assistant-context omission states in host metadata scoped to the retained-instructions section. Suppress redundant notice-only sections when the state is unchanged, and emit an availability-change notice when an earlier omission clears, including when no retained originals remain.
Treat missing delivery metadata as unknown. Matching notice text in coalesced tool output cannot establish host delivery, and incomplete history entries discard omission delivery proof.
## Testing
Add coverage for repeated notices, independent histories, availability recovery, and matching notice text in multimodal REPL output. Extend app-server review-continuation tests to assert that each effective classifier context contains the retained user-instruction omission notice exactly once.
GitOrigin-RevId: c6d52dd1dafb284af34b46174aecc7c8cc9b8404
## Why
Retained Guardian classifier conversations already contain previously delivered synchronous reviews. Appending those reviews again repeats evidence and consumes input budget.
## What changed
Track each review completion with a stable identity in host-only history metadata. Filter already delivered reviews before composing and budgeting continuation input, while preserving distinct completions even when their text is identical.
Fresh conversations receive the review evidence again, and shortened messages no longer count as complete delivery. Delivery metadata stays out of model requests.
## Testing
Add coverage for delivering retained reviews once, appending newly completed reviews, restoring evidence after failed streams, and retaining reviews when history lacks complete delivery metadata.
GitOrigin-RevId: b8d58ffdd7d9c484676af707c65fa50020aae73c
## What changed
- Add `features.guardianv2.async_classifier_mode` with `snapshot` and `conversation` modes. Local configuration overrides model defaults; snapshots remain the fallback.
- Retain completed classifier requests and responses in conversation mode, appending transcript deltas without repeating previously delivered user instructions.
- Rebuild retained history when authorization, classifier instructions, or parent compaction changes, after an incomplete response, or when the next request exceeds the configured token limit. Add `async_classifier_conversation_token_limit`, defaulting to 100,000 tokens, while preserving the model's input limit for fresh requests.
- Serialize conversation requests in observation order, bound outstanding work, and reject stale work after authorization changes or thread shutdown. Record retained and new input token costs.
## Testing
Add tests for configuration precedence, history reuse and resets, ordered admission, queue overflow, and stale or stopped requests. Exercise the approval matrix in both modes, including resume, fork, mandatory review, authorization changes, and stream failure after an early score.
GitOrigin-RevId: 35b9800104648cde4f467086e678dee12458c3e5
## Why
Naming a paginated thread before its first turn must make it durable so it can be resumed immediately and after an app-server restart.
## What changed
Persist the live rollout before updating name metadata in SQLite. Propagate persistence failures before saving the name.
## Testing
Add thread-store tests for empty-thread persistence and failure handling, plus an app-server regression test that resumes a named empty thread before and after a restart and completes its first turn.
GitOrigin-RevId: 2f7556c7de65f6a86177130c39e1a17951496931
## What changed
Allow API-key sessions using the OpenAI provider to forward explicit cyber access programs when `features.api_key_cyber_access_programs` is enabled, regardless of `features.api_key_model_discovery`.
## Testing
Expand the app-server test to cover all four combinations of the two feature flags, checking forwarded programs and failures when forwarding is disabled. Default the API-key test helper to model discovery disabled.
GitOrigin-RevId: f9cf1d2bd7c231645d50178cc6721b55a8d63268
## Why
A database can open successfully while containing corruption that startup previously missed. Detecting it before runtime initialization completes allows recoverable databases to be rebuilt while preserving the damaged files.
## What changed
- Run `PRAGMA quick_check(1)` when opening writable databases, with a 100 ms scan budget. Share attempts across cloned `SqliteConfig` instances by file identity so repeated opens skip validation and replacement files are checked again.
- Back up and rebuild runtime databases that support recovery. Report corruption without rebuilding thread history or other databases without an automatic recovery policy. Treat interrupted or locked checks as incomplete rather than confirmed corruption.
- Collect startup backups across recovery retries and include their locations in the app server warning. Explain that saved conversations can restore the thread list and history, while some database-only metadata may be unavailable.
- Record confirmed corruption in `codex.sqlite.corruption.count`.
## Testing
Add tests for recovery policies, backup preservation, validation caching and concurrency, cancelled and interrupted checks, and locked databases. Add app server coverage for recovery warnings and saved conversation restoration, a TUI warning snapshot, and message board post preservation.
GitOrigin-RevId: 43e26328888e0301def642d69bd324acee867566
## What changed
Register `in_app_voice` as a stable, default-enabled feature and add it to the configuration schema. The gate is intended for managed requirements to control permission for voice in desktop apps; permission does not establish voice availability or provider support.
## Testing
Add app-server coverage for reporting `in_app_voice = false` from `requirements.toml` in both requirements and feature-list responses. Extend the CLI feature-list test to verify that cloud-managed requirements disable the gate despite a user-configured `true` value, without rewriting the user configuration.
GitOrigin-RevId: 6ec3bc0176fdb3e1714b0136bf812bd56591f6a1
## Why
User goal edits and clears need to reach the model as user instructions, including when a thread is unloaded or history is being compacted. Automatic goal lifecycle updates must not supply user authorization.
## What changed
- Add optional `origin` values of `user` and `automatic` to `thread/goal/set` and `thread/goal/clear`, and mark TUI goal requests as user actions. Omitted origins do not supply user authorization.
- Persist explicit user objective, status, and clear instructions before changing goal state. Recording failures leave goal state unchanged.
- Coordinate goal edits with thread resume, reload stored history under writer ownership, and preserve edits accepted after the compaction input snapshot.
- Update generated protocol schemas and TypeScript and Python bindings.
## Testing
Add coverage for user edits and clears on loaded and unloaded threads, concurrent path-based resume, exclusion of automatic goals from user instructions, preservation of edits during compaction, and recording failures that leave goal state unchanged.
GitOrigin-RevId: d779d7c678a0c32a6ef76975dbe5b1400d1df245
## What changed
Forward explicit `cyberAccessProgram` selections for the built-in OpenAI provider when both `api_key_cyber_access_programs` and `api_key_model_discovery` are enabled. The new feature defaults to disabled and can be toggled through the app server's experimental feature enablement API.
Reject explicit selections in OpenAI API-key sessions when either feature is disabled, instead of silently omitting the program. Leave entitlement and model restrictions to the server, and preserve the requested program when a server rejection triggers transport retries.
## Testing
Add app-server coverage for both feature gates, forwarding all three program values, and server rejection without fallback. Update core coverage for API-key resumes with disabled features and custom-provider omission.
GitOrigin-RevId: aa639afb841aa651b28f6f3f61198299372baa2d
## Why
Successful file fallback can hide a secure-store failure. Storage diagnostics need to distinguish that fallback from explicit file storage while keeping credential values out of error output.
## What changed
- Record credential load, save, delete, and fallback-file cleanup outcomes, including secure-store failures and fallback reasons.
- Preserve the initiating client's attribution across app-server requests, login tasks, sessions, turns, and blocking token persistence.
- Preserve storage error context and typed causes while redacting credential JSON data errors and payload-bearing keyring errors.
- Include sanitized fallback completion warnings in the default `codex login` file logs.
## Testing
Add coverage for storage policy and metric attribution, credential redaction, login diagnostics, concurrent app-server clients, device-code login, and token refresh during a turn.
GitOrigin-RevId: 6d5651c1718d184016fa77befa02aa528750b2ae
## What changed
Add `openai.gpt-6.1-sol` to the Bedrock Mantle catalog and its `global.` and `us.` variants to the Bedrock Runtime catalog. Make GPT-6.1 Sol the default and provider fallback model, preferring the global variant for Runtime. Keep existing models available.
## Testing
Update catalog and provider assertions, thread-start fallback tests, and TUI model-picker snapshots to cover GPT-6.1 Sol and the new defaults.
GitOrigin-RevId: ec65744ff9409980474cc1faf516beed0b2430da
## Why
Stale thread capability roots can reconnect executors that are not selected for the current turn and shadow selected roots with the same ID.
## What changed
Filter out roots whose environments are absent from the turn snapshot before deduplication and readiness resolution. Update app-server capability tests to explicitly select the executor environments used by each turn, including after resume.
## Testing
Add regression coverage for full-access and workspace-write permissions, verifying that stale roots never connect an unselected executor, selected roots with matching IDs remain available, and turns with no environments expose no roots.
GitOrigin-RevId: afe375047cc5e8aad06df83334149510460dcdcc
## Why
The app server previously rejected OAuth login for enterprise-managed MCP servers. These servers need an explicit sign-in flow that ties saved authorization to the active Codex user and workspace and prevents canceled or superseded attempts from saving credentials.
## What changed
- Enable enterprise sign-in through `mcpServer/oauth/login` for configured servers with a connected thread, trusted IdP registration, and `features.use_xaa` enabled. Scope shared enterprise credentials by user, workspace, issuer, and client ID.
- Add `loginId` to MCP OAuth login responses and completion notifications, preserving compatibility with older servers that omit it.
- Support enterprise login replacement and `account/login/cancel`, wait for callback listener shutdown before replacement, and recheck account and configuration before saving grants. Fence stale attempts across processes and account changes.
- Remove shared enterprise authorization during account logout and `codex mcp logout`, including when the feature is disabled. Continue account logout if enterprise cleanup fails, and invalidate MCP runtimes on account changes.
Start a fresh session after successful enterprise sign-in to use the saved grant.
## Testing
Add regression coverage for login replacement and cancellation, callback port reuse, account changes during setup, cross-process logout invalidation, persisted workspace policy selection, cleanup failures, and responses from older servers without `loginId`.
GitOrigin-RevId: 7ed4caaab4659ed1e67064262cf5cee48e3a26ac
## Why
Configuration reloads must honor current managed restrictions without granting new enterprise MCP authority to existing sessions or overwriting newer configuration with stale snapshots.
## What changed
- Allow enterprise managed authentication only for configured MCP servers. Remove plugin `ema_auth` overlays from the schema and disable servers that still use them.
- Refresh ordinary MCP settings while preserving session settings and initially admitted enterprise registrations. Disable enterprise MCP when its registration changes, policy revokes access, or configuration loading or resolution fails; require a new session to restore enterprise authority.
- Publish refreshes only when their captured configuration is still current, with bounded retries in app-server reloads. Preserve updated managed restrictions even when a refresh is rejected.
- Finish processing other thread refreshes before `config/mcpServer/reload` reports a rejection, and document that an error can accompany partially applied changes.
## Testing
Add regression coverage for stale refreshes, bounded retries, managed-policy revocation, persistent enterprise disablement, ordinary MCP transport changes, and rejection of plugin enterprise authentication. Verify that denied enterprise servers receive no requests.
GitOrigin-RevId: 34429cd339c1ec152a2ee8697cb29f0cff5d9e5f
## Why
Providers with `model_catalog_url` could advertise bundled models absent from their catalog or reuse stale models after a failed refresh. Model metadata could also match by prefix or namespaced suffix instead of the provider's exact model ID.
## What changed
- Suppress bundled model fallback and merging for explicit provider catalogs, including when discovery is disabled.
- Require unique, non-empty catalog slugs and match metadata by exact model ID.
- Serialize explicit catalog refreshes and invalidate in-memory and persisted catalog entries after fetch failures, preventing stale cache reuse.
- Report a clear configuration error when startup has no available model, while allowing an explicitly configured `model`.
## Testing
Add regression coverage for exact model matching, hidden catalog entries, cache invalidation across restart and recovery, invalid slugs, and empty-catalog startup with and without an explicit model. Update app-server model-list expectations and verify the TUI configuration error.
GitOrigin-RevId: ac323a94178e3c48df8d4a159a86fdbac20b03a2
## Why
Responses stopped by `content_filter` previously followed generic stream-error retry handling without guidance about the block. Retried requests need instructions to explain the limitation and offer a permitted alternative.
## What changed
- Recognize content-filter failures as a distinct error while preserving retryability and the existing public error representation.
- Append developer guidance to the conversation after each sampling block, retaining delivered output and using the existing retry handling.
- Support a model catalog override through `model_messages.content_filter_guidance`. Missing, null, blank, or values exceeding 512 UTF-8 bytes fall back to bundled guidance.
- The bundled guidance tells the model to avoid reproducing or working around blocked content, briefly explain the limitation, offer a permitted alternative, and continue unrelated authorized work.
## Testing
Add a scenario and request-history snapshot covering repeated blocks, catalog guidance on each retry, retained partial output, and eventual completion. Add error-mapping assertions for retryability, public error classification, and error text.
GitOrigin-RevId: ba0c201b3a5a3acf5cfa971332027240e0690225
## Why
Repeated plugin discovery and loading reparse unchanged manifests and repeat warnings for invalid fields.
## What changed
- Share a manifest cache through `PluginStore` across marketplace listing, plugin loading, capability inspection, and tool suggestion metadata.
- Reuse successful parses by plugin root, manifest path, and content digests, including the Codex overlay. Reread files on each load so manifest edits and overlay changes or removal remain visible.
- Bound the cache to 128 entries and bypass caching for inputs larger than 64 KiB. Retry failed parses and share entries across store clones while keeping independent stores isolated.
- Reuse loaded manifest data when loading apps and MCP metadata.
## Testing
Add unit coverage for parse reuse, warning deduplication, revision invalidation, repair after parse failures, equivalent Windows paths, store isolation, and oversized inputs. Add an app-server regression test that verifies repeated `plugin/list` requests observe manifest and overlay revisions in one running server.
GitOrigin-RevId: ed082cd7d198015cd8ed35db7f2af74e13f49915
## Why
Fresh threads have no rollout until their first turn, so archiving them previously failed with a missing-rollout error.
## What changed
Persist loaded, non-ephemeral threads before looking them up for archival. This lets a newly started thread be archived without creating a user turn.
## Testing
Update the archive regression test to cover threads with no turns in both legacy and paginated history modes. Verify the archive notification, empty turn history, `NotLoaded` status, and archived rollout path.
GitOrigin-RevId: 507351c6238ad96f5e3ffbd2ed7f432058e3d52c
## Why
Guardian denial-limit interruptions lack a structured error identifying the cause. Make this opt-in because older clients may not recognize the new error in shared history.
## What changed
- Add `auto_review.circuit_break_action = "strict"` to attach `TooManyDenials` to the interrupted turn. The default leaves the error unset.
- Expose `turn.error.codexErrorInfo = "tooManyDenials"` in app-server notifications and saved history, and update protocol schemas and generated types.
- Preserve the warning, denial limit, and interrupted status without emitting a separate error notification.
## Testing
Add an integration test covering omitted, `default`, and `strict` settings, checking warnings, live turn errors, the absence of separate error notifications, and persisted turn errors after restart.
GitOrigin-RevId: cb5d379e64728d4d7b9daf834c13756e4a70db31
## Why
Inspecting one MCP server should not require full-inventory discovery or a separate connection when a thread already has one.
## What changed
- Add optional `serverName` to `mcpServerStatus/list` and update generated schemas and bindings.
- With `threadId`, apply any pending runtime refresh and reuse the thread's current connection and tool catalog, waiting only for the selected server during discovery.
- Without `threadId`, create a discovery connection for only the selected server. Unknown names return an empty page; omitting `serverName` preserves full-inventory discovery.
## Testing
Add a regression test covering both status detail modes, checking that tool metadata is preserved and that status reads do not repeat `initialize` or `tools/list` requests.
GitOrigin-RevId: 1b361b67a993ab45cae493e88c146f50cfaf753a
## Why
Guardian reviews need to retain original evidence across parent compaction when checkpoint reuse is disabled, including after resume and rollback.
## What changed
- Make disabling `guardian_reuse_parent_compaction` select a bounded, independent review transcript while preserving thread-owned authorization.
- Keep synchronous reviews and asynchronous scoring independent of parent checkpoints, and allow reviewer sessions to continue using transcript deltas across parent compaction.
- Persist transcript entries with rollback provenance while remaining compatible with older checkpoint readers and metadata-free checkpoints.
- Exclude compaction output from the transcript and synthetic summaries from rollback turn boundaries. Use acceptance ordering to remove rolled-back evidence even when persistence order differs.
## Testing
Add regression coverage for reviewer continuity, evidence retention across compaction and resume, rollback after local and remote compaction, and checkpoint serialization compatibility.
GitOrigin-RevId: fea0852cc5537372854f4a34bacb6bfda6d13e88
## What changed
- Delete the `plugin-creator` skill, its assets, reference docs, helper scripts, and associated Python tests.
- Update the app-server skills context budget warning test to expect six omitted skills instead of seven.
GitOrigin-RevId: 005b1ab7f2f7c2933e6c297d01541746cc489f68
## Why
Changes in executor availability can alter cloud skill catalog rendering under a shared budget and repeat an unchanged executor catalog when it reconnects.
## What changed
- Cap cloud skills at three quarters of the metadata budget initially, leaving the remaining budget and unused cloud allowance for filesystem skills. Reduce the cloud cap only when doing so allows all skill entries to fit; description truncation alone does not trigger rebalancing.
- Persist the allocation across disconnects, compaction, and thread resume. Recompute it when the cloud inventory or total budget changes.
- Emit a short availability update when an unchanged selected-environment catalog returns and its full text remains in history. Reinject the full catalog when that text is missing.
## Testing
Add coverage for allocation stability, catalog and budget changes, omission handling, and full catalog reinjection after compaction and resume. Extend the selected capability stack test to verify reconnection avoids repeating the catalog.
GitOrigin-RevId: 839fe98024e00c4082a46e6a40675e15fd2c16c6
## Why
Archived threads without previews were filtered out of thread listings, even though they had valid session metadata.
## What changed
- Include archived threads with empty previews in both SQLite and rollout-file listings.
- Add archive-specific indexes for creation, update, and recency ordering so these listings can use indexed pagination.
## Testing
Add regression coverage for paginated archive listings with and without SQLite, archive query plans that avoid temporary sorting, and metadata reads that preserve source and file timestamps for empty archived threads.
GitOrigin-RevId: e29d0257b2e029bea5fdf94eed6dab1006d2a8f2
## Why
Usage limit errors discarded the server-selected window responsible for the limit, leaving turn and compaction analytics unable to distinguish five-hour limits from weekly limits.
## What changed
Preserve optional `limit_window_minutes` from usage limit error responses in `UsageLimitReachedError` and report it as `usage_limit_window_minutes` in turn and compaction events. Accept unsigned integers that fit in `u16`; treat missing, null, malformed, or out-of-range values as unknown. Events for other error kinds report `null`.
## Testing
Add coverage for HTTP and wrapped WebSocket error mapping, analytics serialization and reduction, and app-server propagation to turn and local/remote compaction events. Cases include five-hour and weekly windows, missing or invalid values, and unrelated errors.
GitOrigin-RevId: a32066a007559d91a3c868a756bfd0f976777176
## What changed
Allow `cursor` to accept an item anchor such as `{"type":"item","itemId":"item-123"}` with a non-empty `turnId`. Ascending pagination returns items after the anchor; descending pagination returns items before it. The anchor itself is excluded, and subsequent pages use the returned opaque string cursor.
Resolve anchors within the requested turn's visible history, including inherited fork history. Reject missing turn IDs and empty, unknown, or out-of-scope item IDs with invalid params (`-32602`). Preserve existing string and null cursor behavior, and update the protocol schemas, TypeScript and Python types, and API documentation.
## Testing
Add protocol round-trip and invalid-shape tests, app-server coverage for anchored pagination and errors, and thread-store coverage for growing turns, reverse pagination, page boundaries, fork visibility, and anchor scope validation.
GitOrigin-RevId: a74cea190d3ff1b44865429f8b0650b793eb688d
## Why
Cached executor MCP declarations must not gain access to host environment credentials when reconnecting to an executor that lacks environment credential resolution.
## What changed
- Retain credential policy through MCP registration, catalog materialization, and runtime setup. Derive selected HTTP plugin policy from the plugin's source environment.
- Reject host bearer-token fallback and transports requiring host environment headers or helpers for executor-owned declarations. Preserve host-configured credential resolution.
- Include credential policy in connection and tool catalog cache identities, and avoid reading host environment values for executor-only identities.
## Testing
Add regression coverage for legacy executors, cached declarations after a capability downgrade, policy preservation through catalog rebuilds, and connection and tool cache isolation.
GitOrigin-RevId: 2d5b85e4e98668c637c538cbe528914c936bd831
## What changed
- Stop sending `includeExtensions=true` when fetching installed plugins and remove extension metadata from remote plugin models.
- Remove `PluginSummary.extensions` and the associated extension declaration types from the app-server protocol.
- Update generated JSON schemas, TypeScript and Python bindings, and precomputed protocol exports to match.
GitOrigin-RevId: 56509437b6bdf58d99badff68e86bcf7f09fe036
## What changed
Add app-server integration coverage for awaiting `request_permissions` and then running `exec_command` in the same code-mode cell:
- Verify that turn- and session-scoped write grants allow the command to create a file, including grant propagation to Windows command approval requests.
- Verify that `strictAutoReview` immediately triggers review for a command needing no additional access and returns the reviewer's denial rationale.
GitOrigin-RevId: 02c958071db4e9ba667be9ba95fbb3a506ae1572
## What changed
- Recognize `promax` in authentication, account responses, and backend rate limits; update generated schemas and client types.
- Display `prolite` as “Pro”, `pro` as “Pro (More)”, and `promax` as “Pro (Max)” in account labels, status, and analytics.
- Include Pro Max in experimental context eligibility, paid-plan tooltips, and usage-limit guidance for purchasing credits.
## Testing
Extend coverage for Pro Max plan parsing, account and rate-limit responses, experimental context eligibility, and plan display names. Update the login token test to expect “Pro (More)”.
GitOrigin-RevId: 197e00fa7a99cbce125c8f1d43a451ec1ed5c1fb
## Why
Saved model selections can outlive their catalog entries. Removing GPT-5.4 needs to preserve a migration path without applying it to other providers that may still support the same model slug.
## What changed
- Remove `gpt-5.4` from the bundled catalog and `openai.gpt-5.4` from the Bedrock catalogs, including GovCloud.
- Add fallback migration prompts to GPT-6 Sol for saved GPT-5.4 selections on OpenAI and Amazon Bedrock. Scope fallback migrations, including the existing GPT-5.4 Mini migration, to their owning providers while honoring catalog metadata.
- Update tests that depend on bundled GPT-5.4 metadata to use GPT-5.5 or explicit model overrides.
## Testing
Extend migration tests to cover catalog metadata precedence, acknowledged targets, missing or hidden replacements, and preserving the provider while saving the replacement model and its default reasoning effort. Update Bedrock catalog assertions and picker snapshots.
GitOrigin-RevId: f739795da423b9622db2a416be6c52b01b8e7a71
## What changed
Use `127.0.0.1` instead of `localhost` in the OAuth callback URI and local login success URL.
## Testing
Update login and app-server tests to check the callback address, verify that the success redirect shares the callback origin, and assert that the token exchange uses the same `redirect_uri` as the authorization request.
GitOrigin-RevId: a27dd63dca34b9de81fb937da47c753d5dd1ac90
## Why
Elevated Windows sandbox setup rejected `danger-full-access` as an incompatible permission profile before registered Core could reach the provisioning service.
## What changed
Allow `PermissionProfile::Disabled` to reach service provisioning when registered Core is requested. Keep legacy full-access setup on the shared setup path and retain permission validation before provisioning for restricted profiles.
## Testing
Add Windows-only regression cases covering full-access and supported restricted profiles reaching the service, unsupported restricted permissions failing before provisioning, and legacy full-access setup skipping the service. Each case checks the completion error and verifies that the configuration file remains unchanged.
GitOrigin-RevId: 5ba190da6f8b1c6ef665015acdb9428718a724dc
Accept `service_name` and the expected originator as test parameters, passing
`service_name` through `ThreadStartParams`. Retain the existing case that
expects `TEST_ORIGINATOR` when no service name is provided.
GitOrigin-RevId: 71097dcfe45496216cf3e765999ed0abd0a0cd71
## Why
Thread startup can prewarm the Responses WebSocket before the creating client is registered with the thread, leaving the handshake unable to request attestation from that client.
## What changed
Reserve a thread ID and register the creating connection before starting the thread, including for ephemeral threads. Remove the thread state if startup fails.
## Testing
Extend the attestation round-trip test to cover persistent and ephemeral threads. Handle attestation requests while awaiting `thread/start` and `turn/start` responses, and verify the WebSocket handshake includes the expected `x-oai-attestation` header.
GitOrigin-RevId: 1bdb38bac641253eed58a2431658ab54d93819c5
## What changed
- Make `LocalThreadStore` default to paginated history while retaining explicit legacy mode.
- Explicitly use paginated history for Guardian review sessions and allow in-memory stores to create paginated threads.
- Rename full-history resume, fork, and subagent helpers to identify them as legacy APIs, and document the paginated alternatives.
- Reject `thread/revert` for ephemeral threads and prevent the TUI from replaying or attaching to ephemeral agent threads.
## Testing
Add coverage for preserving the default and explicitly selected history modes and conversation context across restart, and for retaining context after rejected ephemeral reverts. Extend Guardian checkpoint coverage across both history modes and verify that saved reviews use paginated history.
GitOrigin-RevId: 870239eb3757018159ee4f230a009c97d38ac5b7
## Why
MCP OAuth configuration supported a pre-registered client ID but could not supply a client secret for token exchange or refresh.
## What changed
- Add `oauth.client_secret` and `codex mcp add --oauth-client-secret`, requiring a nonempty secret and client ID. Persist the secret in server configuration and accept `clientSecret` in plugin configuration.
- Pass configured credentials through CLI, app-server, and plugin login flows and token refresh. Require a new login when a configured confidential client's ID differs from stored credentials.
- Redact secrets in debug output and keep them out of authorization URLs and persisted OAuth token records.
- Invalidate cached OAuth connections when the configured client ID or secret changes.
## Testing
Add coverage for configuration validation and round trips, CLI argument redaction and subsequent login, app-server login, connection invalidation, and refresh with `client_secret_basic` and `client_secret_post` in both refresh modes. Verify secret exclusion from token records and reject mismatched client IDs before contacting the provider.
GitOrigin-RevId: 85bb0e410e9e68e6cd68eb6359badfc7eac78147
## Why
Failed SQLite writes leave diagnostic logs incomplete. Notify users before they close Codex so they can submit logs or run `codex doctor`.
## What changed
- Add a best-effort warning on the first log write failure in standalone and in-process app servers, while continuing to retain failure diagnostics in memory.
- Handle failures that occurred before the in-process warning reporter was attached.
- Tailor the warning's guidance to whether submitting logs is enabled.
## Testing
Add coverage for warning deduplication, both guidance variants, retained diagnostics after the notification sender is dropped, and SQLite flush failures before and after reporter attachment. Extend log upload integration coverage and add a TUI warnings snapshot.
GitOrigin-RevId: 12a74126d13c3568430e539a180cca47fa931fa9
## Why
SQLite write failures can leave persisted logs incomplete, while log snapshots taken before collection miss errors raised during that collection.
## What changed
- Report SQLite flush failures directly to the in-memory log buffer without re-entering tracing, using an error category and batch size instead of raw error details.
- Track whether the log writer has lost a batch and make app-server diagnostic uploads use the memory buffer when SQLite logs are incomplete.
- Refresh log bytes after flushing and querying SQLite so the same submission includes collection failures, while preserving captured metadata and thread identity.
## Testing
Add regression tests for failure reporting without recursion, subsequent write recovery, metadata preservation, and healthy and failing SQLite collection. Add an upload integration test that captures attachments locally and checks failure diagnostics, memory-buffer fallback, and omission of raw SQLite error details.
GitOrigin-RevId: 51b0c4b69c977d9f4e74f2f245a9fd90fdb13761
## Why
Asynchronous Guardian scoring omitted the target environment's denied-read restrictions, and cached score authorization did not include that permission context. A score from one environment could therefore be reused for an action in another environment with different restrictions.
## What changed
- Share permission resolution between synchronous review and asynchronous scoring, including resolving `write_stdin` targets from the owning terminal session.
- Include environment identity and denied-read paths/globs in async scoring context and cached score authorization.
- Fall back to synchronous review when permission evidence cannot be resolved or exceeds the async limit of 3,000 bytes, rather than omitting restrictions.
## Testing
Add regression coverage for rejecting cached scores with different environments or denied paths, passing the target environment's restrictions to the classifier, and rejecting oversized async permission evidence.
GitOrigin-RevId: 14b6f3454bbea458be037560eb1da47d22874df1
## Why
Login clears the recommendation cache after its RPC response, allowing thread startup to race with cache invalidation in the external login tests.
## What changed
Wait for `account/login/completed` and assert a successful notification before starting the thread. This keeps thread startup and the background refresh on the same cache generation in both variants of the recommended plugin test, with `tool_suggest` enabled and disabled.
GitOrigin-RevId: 7be46dacd947b30a28c83176dc2e3b5f730005f1
## Why
New user input during a Guardian review invalidated an in-flight approval and aborted the pending action, even when the input was only a status inquiry. Review the action again against the latest authorization evidence so it can proceed or be denied based on the updated instructions.
## What changed
- Treat stale authorization as a retryable review error within the existing attempt budget and shared deadline.
- Refresh authorization evidence for each attempt while keeping the pending action fixed, and record evidence from the completed attempt.
- Preserve cancellation and history-reset aborts, and deny approval if stale authorization exhausts the retry budget.
## Testing
Add and update coverage for parent status updates, authorization revocation, repeated updates, cancellation, history resets, and retry deadlines. Verify that refreshed reviews see the latest input and that the pending action executes exactly once only after approval.
GitOrigin-RevId: c683e2efb6f07840b99d0d34acf0d38c9ddfe9bd
Wait for an assistant item to start before resuming a running paginated
thread, ensuring the user message has reached live history. Emit the initial
response events before the gate and keep completion gated during resume.
Increase the memory dual-write test's consolidation timeout from 10 to 60
seconds to allow Git workspace and agent process startup under contention
on Windows CI runners.
GitOrigin-RevId: 4d74d04955c88a9c208a809f639fe14fdb2ebf37
## Why
ChatGPT backend requests could bypass the configured network policy by using a default HTTP client. Requests using captured credentials must also retain the corresponding account policy so revocation continues to block them.
## What changed
- Use the configured HTTP client factory for ChatGPT GET and POST requests, enforcing managed network policy while retaining cookies.
- Capture authentication and network policy together for app reads and plugin reads and installs, preserving that policy across the post-install configuration reload.
- Bind GET requests to the current account policy before loading credentials.
## Testing
Add regression tests for revoked account policies, blocked connector destinations, and network policy enforcement after configuration reload with a cached app client.
GitOrigin-RevId: 5298842eec9664af49df70e89624653d1452fb33
## What changed
Remove the session-level capture mode and make thread-owned retained context the default throughout history management. Simplify input ordering, compaction identity preservation, fork handling, and approval freshness checks by removing legacy capture branches.
Keep checkpoint compatibility review separate: unknown or incompatible checkpoints can still use legacy review while retaining user evidence. Set the already-removed `guardianv2.thread_context` feature's default to false and remove redundant opt-out test variants.
## Testing
Update checkpoint tests to exercise legacy review through restored checkpoint data. Adapt existing compaction, resume, rollback, and fork tests to use unconditional context capture.
GitOrigin-RevId: ab23a0d7aca71d5a103458cff8b0c68137dd9708
Adam Perry @ OpenAI