## Why
Namespace mounts can have roots such as `mnt:[inode]` or `net:[inode]` that are not filesystem paths. Treating every mount root as a path rejects these unrelated mounts and prevents sandbox startup.
## What changed
Parse mount roots as paths only for the daemon socket's filesystem. Continue validating every mount destination and checking mount ancestry, nested mounts, and socket aliases.
## Testing
Add regression cases for namespace mounts, invalid destinations, and socket aliases, both with and without a mount ID. Extend the socket-isolation integration fixture with an unrelated network namespace mount to exercise successful startup and rejection of a real socket alias.
GitOrigin-RevId: 9a1d2a69e5bd3f8d09b1de7cf998ee6d9c6bb980
Add an `env_inherit` string-list attribute and pass it to
`RunEnvironmentInfo.inherited_environment`, allowing tests to inherit
selected environment variables from the calling environment.
GitOrigin-RevId: 4ea868bda2d80dd57a8fc139ffa9625cb8311b37
## What changed
Default `model_reasoning_summary` to `none` instead of `detailed` when starting a new TUI thread, while preserving explicit settings. Enabling `features.concurrent_reasoning_summaries` alone no longer enables summaries.
## Testing
Update thread configuration and embedded app-server request tests to cover the disabled default, explicit summary settings, and concurrent summary delivery.
GitOrigin-RevId: 16b0711d92c28944afd6bc85d44a9de0282a6533
## Why
Memory consolidation and ephemeral title generation need to use their selected request-level reasoning effort even when managed settings enable reasoning-effort overrides.
## What changed
- Exempt current and legacy memory consolidation sessions and ephemeral `thread_title` threads from reasoning-effort overrides.
- Tag temporary title threads with `thread_title` and keep them excluded from agents overview refreshes. Recap threads retain the `system` tag.
- Preserve override behavior for persisted `thread_title` threads and other ephemeral threads.
## Testing
Extend regression coverage to verify request effort, omission of effort updates from exempt workers' requests, preservation of inherited history, title thread tagging, and overview filtering.
GitOrigin-RevId: 8dbc2eb13509f9c80f90d5798a56ea33fad2a0bc
## Why
Using Responses Lite does not establish whether a model accepts reasoning-effort `configuration_update` items. Unsupported models need to use the selected request-level effort, including when resuming history containing saved updates.
## What changed
- Add `supports_reasoning_effort_updates` model metadata, defaulting to `false`.
- Require the override feature, an OpenAI provider, and explicit model support for reasoning effort updates, independently of `use_responses_lite`.
- Filter saved configuration updates from unsupported requests without changing persisted history.
- Clear the pinned effort baseline when sampling with an unsupported model so returning to a supported model establishes a fresh baseline. Compaction uses the selected effort without clearing the pin.
## Testing
Add coverage for supported models with either Responses mode, unsupported-model history filtering over HTTP and WebSocket, switching to an unsupported model and back, and compaction versus sampling pin behavior. Verify missing capability metadata defaults to `false`.
GitOrigin-RevId: 8a0fbc141964bd854dbcdd6f31e1c8e97697cf22
## Why
Feature overrides previously forced embedded mode even when they could work with the shared daemon. A running daemon can also have different feature settings from the current invocation, including when the invocation uses defaults.
## What changed
- Allow selected Boolean feature overrides and `suppress_unstable_features_warning` in daemon mode. Keep explicit overrides that disable shared services in embedded mode.
- Pass shared-service feature overrides to newly launched daemons and persist them for restarts and updates without changing a running daemon's settings.
- Check daemon feature settings with `experimentalFeature/list` before attaching. Warn and fall back to embedded mode on mismatches, failed checks, or an incompatible code-mode host fallback policy. Skip this check for the agents overview.
- Resolve worktree configuration before daemon selection and allow worktree sessions to auto-start the daemon.
- Forward `suppress_unstable_features_warning` in thread configuration overrides.
## Testing
Add coverage for override eligibility and precedence, launch-feature persistence and reuse, and TUI fallback warnings for feature and host-policy mismatches. Extend worktree integration coverage to exercise daemon auto-start and warning suppression.
GitOrigin-RevId: 68c316f74843b1dfd8fa39bdb48bd1f649fee57f
## Why
Identical script contents across plugin versions do not establish that the same measurement declaration applies. Resolving measurements through generic command attribution could use a different version's declaration, while shared helper paths could make attribution ambiguous.
## What changed
- Match canonical executor paths against trusted plugin identities before comparing script contents. Require an exact version match for measurements while retaining attribution across versions with matching contents.
- Keep measurement declarations bound to the selected trusted root, and allow distinct versions to coexist when extending trusted roots.
- Add `PluginMeasurementTarget` to extract an untrusted plugin/version hint from canonical remote cache paths, respecting Windows and POSIX path conventions.
- Skip executor lookups for unrelated scripts so attribution does not wait for executor provisioning.
- Increase the login unit test timeout in Bazel to `long`.
## Testing
Add regression coverage for multiple plugins and versions, canonical aliases, symlink escapes, path casing, and executor lookup avoidance. Add a remote execution integration test verifying that mismatched versions retain command attribution but receive no metrics sidecar, and matching versions use the trusted measurement declaration.
GitOrigin-RevId: d63430b37bf2de360c8d09af7f7453a5b5024d72
## Why
The WinGet Releaser action references `cargo-binstall@main`, violating the requirement for full commit SHA action pins.
## What changed
Replace the action with explicit steps that install SHA-pinned `cargo-binstall` version `1.23.0` and `komac` version `2.16.0`. Discover the published Windows archive URLs and require two matching assets before submitting the `OpenAI.Codex` update.
Use `komac` to sync the publishing fork, submit the WinGet update, and clean up merged branches.
GitOrigin-RevId: da4da51937a372b841f42420b5bf775a9c151e4e
## Why
Freshly copied executables can briefly remain busy on Linux CI workers, causing packaged daemon tests to fail at launch.
## What changed
Retry the command launch in `packaged_daemon_launch` up to twice on `std::io::ErrorKind::ExecutableFileBusy`, waiting 10 ms between attempts. Other launch errors still propagate immediately.
GitOrigin-RevId: afb6213173a7ae4bcfe2e1e6fab6ced65ab5bf77
## Why
MXC's native host-loopback access is bidirectional, so it cannot enforce `allow_local_binding = false`. Treating an omitted setting as `false` prevents managed networking from working with the default configuration.
## What changed
- Preserve an omitted `allow_local_binding` until the executor's sandbox policy is known. Default to `true` for Windows MXC and `false` elsewhere, including remote execution.
- Reject an effective `false` for MXC managed networking after applying policy restrictions, without enabling disabled networking.
- Use the executor's resolved value for remote network approval decisions while preserving explicit controller restrictions.
- Document that local binding permits local servers and direct host-loopback connections and skips additional private-network destination checks; proxy domain rules still apply.
## Testing
Add coverage for per-executor defaults, explicit values, MXC rejection of `false`, and remote network review cleanup with the resolved policy.
GitOrigin-RevId: 0fa7c1eaec68bebada2b8f7af45688315eea70a9
## What changed
Promote `guardian_reuse_parent_compaction` to stable and enable it by default, allowing Guardian to reuse encrypted parent compaction when restarting review sessions.
## Testing
Update Guardian tests to rely on the default setting, including evidence retention after compaction and resume. Adjust cache-key assertions to verify that parent-history changes invalidate cached review sessions by default, while explicitly disabling reuse preserves the previous behavior.
GitOrigin-RevId: 196aff1e91d022490b3782f6c7b5f168907efab9
## Why
On macOS, process-group signals can be denied even when individual members can be signalled. Core execution cleanup used helpers that did not retry those signals against group members.
## What changed
- Make `terminate_process_group` and `kill_process_group` use the existing member fallback on macOS, and simplify MCP and pipe callers to use the shared helpers.
- Use the saved process-group ID when escalating cancellation after the termination grace period, so this path also uses the fallback.
- Update the unsafe process-group ID test to exercise `terminate_process_group`.
GitOrigin-RevId: 1bab28d3d53cd401b51ffe71d41fbece12aed66d
## Why
Timeout tests can avoid waiting for real deadlines by advancing Tokio's clock, but automatic advancement can expire requests before they reach the mock server.
## What changed
Pause Tokio time in the stalled-header sampling and model catalog deadline tests. Keep polling until the mock server receives each request, then explicitly advance past the relevant timeout. Add bounded wall-clock waits and fail if a request completes before reaching the server.
Preserve assertions for sampling retry exhaustion, connection permit recovery, and the catalog's `RequestTimeout` error.
GitOrigin-RevId: 252be25d75d73c713a4b8ccac1ff20ad820df556
## Why
Process startup can outlast the first `exec_command` yield, causing the network approval test's fixed response sequence to route a Guardian response to the parent request.
## What changed
Match mock responses by request role and call ID, and poll running sessions with `write_stdin` until final output is available. Check the allow and deny outcomes against that final output while preserving the action-routing assertions.
GitOrigin-RevId: 2ea31d1bfd5a46adc6561580783e916dfab15996
## Why
The test launches a real shell, but its fixture uses a working directory that does not exist on clean runners. Waiting only for a turn-start notification also does not establish that the shell is running before interruption.
## What changed
- Give `exit_interrupts_before_requesting_shutdown` a temporary working directory.
- Replace the fixed 30-second sleep with a loop that stays alive while a temporary directory exists, with cleanup allowing the command to finish if the test fails early.
- Wait for both the turn ID and `exit-test-ready` output within a single 10-second timeout, and fail immediately if the turn completes before interruption.
GitOrigin-RevId: d8f92b941b3fe8a077f447c6bf705a2ef922db03
## Why
A grandchild's completion can arrive while the worker is completing its response, triggering an extra sampling request to drain the message. The cold root resume test previously allowed only one worker completion request.
## What changed
Match worker completion requests by the nested spawn's `function_call_output` and allow one or two requests. Scope the mock to the initial worker's lifetime and drop it before the follow-up phase.
GitOrigin-RevId: 10e0a429e6e1f51b5f04a86e3351c5fa4df9cb66
## Why
Replaying a checkpoint into the original session can let preserved live state
mask missing checkpoint data.
## What changed
Update `guardian_checkpoint_preserves_live_context_without_storage` to restore
forked history into a fresh session with the matching guardian context mode.
Keep the existing context restoration assertions for both `Legacy` and
`ThreadOwned` modes.
GitOrigin-RevId: 211b567f6b33ffca6dc51110a208aec234004b98
## Why
Committing a Guardian review snapshot currently flushes and reloads the transcript from storage, even though the completed model context is already available in memory.
## What changed
- Build forkable checkpoints directly from live session state, preserving model history, retained Guardian context, world state, turn context, and token usage.
- Preserve compaction window metadata and MCP resource origins in the checkpoint.
- Recognize prior user turns inside compacted replacement history.
## Testing
Add round-trip checkpoint tests for legacy and thread-owned Guardian context without storage, including preservation after live history is mutated. Extend the review compaction test to assert that checkpoints do not load history from storage.
GitOrigin-RevId: cb2638ca93bba6ab4472de50c7e2913e1a2f25a8
## Why
Resuming a running thread with a summary initial page cloned every active-turn item before discarding those outside the summary, including potentially large reasoning payloads.
## What changed
- Snapshot the active turn using the requested `TurnItemsView`, copying only the first user message and final agent message for summaries and no items for `NotLoaded`.
- Preserve full snapshots when the resume response includes full turns, even if its initial page requests a summary.
- Share item selection between snapshots and page responses, and skip selection when a turn already has the requested view.
## Testing
Add unit coverage for summary selection, completed-turn metadata, and metadata-only snapshots. Extend running-thread resume coverage for default summaries, explicit full pages, and full turns returned alongside a summary page.
GitOrigin-RevId: 6ddcd93c44dbc8083827ac82f442b31730a4edde
## Why
Resuming a running thread cloned the active turn's items even when the response did not need them.
## What changed
Add a metadata-only turn snapshot and use it for resume status checks and initial pages with `TurnItemsView::NotLoaded`. Only snapshot items when including turns or requesting an initial page with items, preserving item data for `Summary` and `Full` views.
## Testing
Add lifecycle coverage for metadata snapshots and extend running-thread resume tests to check metadata-only responses and populated `Summary` and `Full` pages.
GitOrigin-RevId: 281a2b7e1faf3a3fc07e007a065b16235eda08b6
## Why
The parent could receive a Guardian decision before the review's terminal event was flushed, allowing the reviewed action to start while completion was still being saved.
## What changed
Flush the review transcript and `TurnComplete` event together before delivering completion to the parent. Clear the reviewer's active turn before delivery so the parent can immediately request another review. Skip redundant completion flushes for Guardian reviewers while retaining the existing pre-completion flush on errors and cancellation.
## Testing
Add a gated thread-store regression test covering two consecutive reviews in the same reviewer thread. Verify that each save includes `TurnComplete` and that the approved command cannot start while the save is blocked.
GitOrigin-RevId: 9274b08ddba1ea93d4fb4709bbfdc2ccaea866ab
## Why
Credential changes can leave the in-memory model catalog associated with a different identity, causing subsequent turns to use bundled model metadata instead of the active credentials' catalog.
## What changed
- Refresh mismatched catalogs before user turns and mailbox-triggered wakeups, resolving lazy command credentials before comparing identities.
- Reuse a matching cache or fetch models with a five-second deadline covering auth resolution and cache access. Preserve fallback behavior on failure or timeout; static catalogs need no refresh.
- Recheck the active turn after discovery so an interrupted wakeup does not continue starting a turn.
## Testing
Add coverage for user and mailbox turns after credential rotation, including switching back after another identity replaces the shared catalog. Verify refreshed context windows and request behavior, fallback on discovery failure or auth timeout, and command-auth token rotation.
GitOrigin-RevId: 7e4ad25f1c4476e2023225731924af28c1181767
## Why
Sandbox setup rotates machine-wide account passwords. The process-local test lock cannot prevent concurrent `exec-server` elevated filesystem tests from changing those passwords between setup and logon.
## What changed
- Add the Bazel `exclusive-if-local` test tag to `windows-sandbox-rs` to prevent this overlap during local test execution.
- Include the full error chain and sandbox log when the elevated non-TTY command test fails to spawn a session.
GitOrigin-RevId: bba87fc606ea60a35cf0451ed0ef68ef2eb14d3a
## Why
WebSocket handshakes did not reuse the HTTP cookie store or retain response cookies, so routing cookies such as `__oailb` were unavailable to subsequent connections.
## What changed
- Reuse the HTTP factory's ChatGPT cookies for secure WebSocket handshakes, preserving explicit `Cookie` headers and marking generated headers sensitive.
- Retain allowlisted infrastructure cookies from both successful and rejected upgrades. Keep configured cookies scoped to their factory and exclude account and session cookies from the shared store.
- Apply HTTPS cookie scope to `wss` requests, preserving host and path restrictions and excluding insecure `ws` requests and non-ChatGPT hosts.
## Testing
Add HTTP/WebSocket cookie-sharing coverage and local TLS handshake tests for routing-cookie reuse across connectors, rejected-upgrade refreshes, explicit header precedence, cookie scope, session-cookie exclusion, and deletion.
GitOrigin-RevId: 6bd6afe16e97cf9758ca7ba207a4e88c969497a4
## What changed
Add optional JSON-encoded `parameters` to catalog tool messages and apply them to all six Multi-Agent V2 tools, including plain, namespaced, and code-mode exposure. Schema selection follows the active model, including mid-turn model changes.
Require an object schema supported by the existing `JsonSchema` subset and preserve bundled encryption annotations. Fall back to bundled parameters when overrides are missing, invalid, unsupported, or omit encrypted properties. Tool execution and argument handling remain unchanged.
## Testing
Extend integration coverage for schema overrides, fallback behavior, encryption annotations, exposure modes, and mid-turn model changes. Add a snapshot scenario exercising `list_agents` with a catalog parameter schema.
GitOrigin-RevId: 978be6d5f7e6a6865969922be5483bc697b20aca
## What changed
- Bundle `ada`, `babbage`, `curie`, `cushman`, `dali`, and `davinci` themes for configuration and the theme picker, preserving precedence and invalid-file warnings for custom themes with the same names.
- Use `codex.accent` for active and selected controls on truecolor and 256-color terminals, retaining existing fallbacks at lower color depths.
- Honor terminal-default diff backgrounds and clear matching gutter fills, allowing `dali` and `davinci` to show diffs without background fills.
- Restrict Windows native palette fallback to `ConsoleWindowClass` so a ConPTY palette is not mistaken for the renderer's colors when OSC probing fails.
## Testing
Add tests and snapshots for theme preview, selection, cancellation, custom-theme precedence, invalid-file warnings, accent color depth, and disabling individual diff fills.
GitOrigin-RevId: 72f3ef08f82626436dd2d80d40210cc77e1a5616
## Why
Model pickers and session details show raw model IDs even when the catalog provides a display name.
## What changed
- Use catalog display names in model and reasoning pickers, session headers, status displays, and terminal titles, retaining fallback labels for models absent from the catalog.
- Keep model IDs for selection and persistence, and preserve picker highlights by ID when display names change or are shared by multiple models.
- Remove the legacy-model instruction from the full model picker.
## Testing
Add regression tests and snapshots for custom display names, startup and resumed session headers, fallback labels, terminal titles, and picker refreshes. Verify that selecting a display name still persists the original model ID.
GitOrigin-RevId: 101fe82b20f7a8a90ceeff7999bd07ad42ca46db
## What changed
- Record an explicit allowlist of scalar configuration values and individual boolean feature tags for each sampling request, replacing the combined enabled-feature list.
- Distinguish configured context-window overrides from the effective model limit, and emit `unset` for absent values so earlier overrides do not linger.
- Expand `tags_json` into report metadata and raise the tag limit from 64 to 512, while allowing existing values to update at capacity.
## Testing
Add tests for configured and effective context windows, clearing overrides, feature toggles, dynamic tag upload serialization, and updates at the tag limit.
GitOrigin-RevId: 57608fac936d8ce315e36d452a2950e46370b39b
## Why
`F_MAKECOMPRESSED` and `F_TRANSFEREXTENTS` can mutate files through read-only descriptors, bypassing `file-write*` and `file-ioctl` restrictions. Even a deny-default Seatbelt policy needs an explicit denial for these operations.
## What changed
Deny `system-fcntl` commands `80` and `110` whenever the filesystem sandbox policy lacks full disk write access.
## Testing
Add macOS regression tests that run Seatbelt children under read-only and workspace-write policies, assert both operations fail with `EPERM`, and verify file contents and metadata remain unchanged. An unrestricted positive control verifies the mutations, allowing for unsupported extent transfers.
GitOrigin-RevId: 7a7a5ef30f9ff658a86071b51f1f7b4952d5cdad
## Why
Environment-owned network policies rejected explicit sandbox escalation before command approval, and retained terminals that bypassed or no longer matched those policies required a new terminal.
## What changed
- Allow `require_escalated` commands through the normal approval flow and bypass managed network proxies when full escalation is permitted.
- Preserve denied-read restrictions, including the sandbox and network proxy needed to enforce them.
- Track the network restrictions bypassed at launch and require escalation review for terminal input when launch permissions or network settings warrant it, instead of rejecting input outright.
## Testing
Extend network approval coverage for approved and denied escalation, unproxied remote execution, and preserved denied-read restrictions. Add retained-terminal coverage verifying command and `write_stdin` approvals with restricted and unrestricted filesystems, and update the unit test for changed environment network policies to expect escalation review.
GitOrigin-RevId: 50524b1bc4e3df58447c3c92fb9e50e69ed50cf8
## Why
`--worktree` and command-line worktree feature overrides previously excluded sessions from using the local daemon, even though worktree allocation is client-owned and thread requests already forward the feature.
## What changed
- Allow `--worktree` and boolean `features.worktrees` overrides to remain eligible for daemon connections, while preserving exclusions for other configuration overrides and `--no-daemon`.
- Skip daemon auto-start for `--worktree` launches.
## Testing
Add daemon eligibility tests for worktree options and overrides. Run the existing worktree startup and fork test scenarios against both embedded and daemon backends, checking ownership before the first turn and confirming daemon connections through `/status`.
GitOrigin-RevId: b3f4782e83d8e20974fb4a831442cae013d58e56
## Why
Existing login-keychain access rules identify the CLI as `codex`. Packaging it in an app bundle must preserve that code-signing identifier independently of the bundle identifier and provisioned App ID.
## What changed
- Sign the provisioned CLI with the identifier `codex`, retaining `com.openai.codex.cli` as its bundle identifier.
- Require the expected signing identifier and team during signature verification, and reject unexpected bundle identifiers, executable names, or package types.
- Document the identity distinction and keychain compatibility limits.
## Testing
Extend signing-driver tests to check the signing identifier, verification requirement, bundle metadata, and provisioned entitlements, and to reject altered bundle identity fields. These tests use generated credentials and stubbed native tools; they do not verify runtime keychain access or credential recovery.
GitOrigin-RevId: ab00072e48189551adb0e70008210fee6d36241d
## Why
Workspace paths from the client configuration belong to the client host. Sending them to a remote app server can override the server's workspace roots.
## What changed
- Omit client-configured `runtimeWorkspaceRoots` from remote start, resume, and fork requests so the server resolves defaults or restores saved roots.
- Preserve server-provided roots when forking an active session or side conversation, including after reloading client configuration.
- Reject `--add-dir` and `sandbox_workspace_write.writable_roots` command-line overrides with `--remote` before connecting, directing users to configure additional roots on the server.
## Testing
Add regression coverage for remote workspace roots across start, turn, resume, and fork operations; active-session forks after configuration reloads; and embedded requests retaining explicit roots. CLI tests cover rejected root overrides and continued acceptance of network-access overrides.
GitOrigin-RevId: b87ea6037d197db68e25a1a8610d693f6aa13caf
## Why
MCP startup alone should not prevent opening the review picker or submitting inline review instructions.
## What changed
- Defer `/review` availability checks and draft clearing to dispatch, where thread state is available.
- Reject live review commands while foreground work is running, pending, or queued, preserving the draft and attachments.
- Distinguish live and queued dispatch so a queued review does not clear a newer composer draft.
## Testing
Add regression tests for the review picker and inline instructions during MCP startup, draft and attachment preservation when review is blocked, and newer draft preservation when a queued review opens.
GitOrigin-RevId: 48962bfc26127ffa8dd157f15be512b78bf9b39b
## What changed
- Use a shared preview renderer for agent command output and MCP results, showing the first three wrapped rows with a hidden-line count and `ctrl + t` transcript hint.
- Apply one preview budget across all MCP result blocks. Count partially displayed logical lines as hidden and hard-wrap long URLs to fit the available width.
- Preserve complete MCP result text in transcript and raw output, including trailing failure diagnostics.
- Bound preview input before wrapping to limit work on very long lines and combining characters.
## Testing
Add unit tests and snapshots for wrapped output, hidden-line counts, blank lines, combining characters, shared MCP block limits, transcript preservation, and matching streamed and completed command previews.
GitOrigin-RevId: bd3c2ec40ee837dc8a7a171aaf91577a0ac50985
## Why
Providers configured with `gateway_oauth` need gateway credentials alongside primary authentication for inference and model discovery.
## What changed
- Attach gateway tokens through the configured header or cookie while preserving primary authentication, including WebSocket handshake headers.
- Share gateway credential managers across matching provider instances and model discovery so they observe refreshed tokens.
- Reject authentication on gateway setup or token failures, invalid token values, and conflicting auth headers. Mark gateway headers sensitive and avoid exposing issuer error details.
- Include gateway OAuth configuration in model catalog cache identity to prevent reuse across different gateway configurations.
## Testing
Add provider and core integration tests covering combined credentials, header and cookie delivery, token refresh, shared credential state, cache isolation, and request blocking on gateway token or HTTP client initialization failures.
GitOrigin-RevId: cb74125cf7e87660967d49edacf14646cf0b99c4
## What changed
Replace `analytics_client_tests.rs` with event-specific suites under
`codex-rs/analytics/src/tests/suite/` and shared fixtures in `tests/support.rs`.
Group turn tests by events, requests, compaction, and accepted lines, and keep
cross-event arrival-order coverage in a dedicated reducer ordering suite.
Separate app and plugin ingestion assertions into their respective suites while
retaining a combined test for arrival order. Document where to place tests based
on the contract they cover.
GitOrigin-RevId: aba497f103ad6e23eca6266fc93d150d16f5913c
## Why
Reasoning summaries and nonzero command exits split adjacent exploration into separate groups, while compact history omitted exit codes. Replayed commands also failed to retain the same grouping as live commands.
## What changed
- Keep adjacent read, list, and search commands grouped across reasoning summaries and nonzero exits in both live and replayed history.
- Preserve reasoning in chronological order in the expanded transcript while omitting it from compact and raw history.
- Show nonzero exit codes in compact exploration entries and keep unsuccessful reads separate from successful read summaries. Render search exit code `1` without red failure styling, and label compound-command outcomes as `command exit`.
## Testing
Add regression coverage for live/replay rendering parity, reasoning order, grouping boundaries, and nonzero exit labels and colors. Update the overlapping-command test to verify that exploration stays grouped after a failure.
GitOrigin-RevId: 19c6ffec44c62c185fc6f79282c38e66468f7b80
## Why
Async questions answered on another client should disappear from the TUI without losing drafts for other questions, even when questions have identical titles.
## What changed
- Send answers using the desktop reply envelope with stable per-question IDs, and resolve matching questions from committed messages and replayed history.
- Render replies as readable question-and-answer text in transcripts, queue previews, and input history.
- Preserve separate reply envelopes and message order when retrying rejected or interrupted input.
- Account for JSON escaping in input limits and fall back to plain text for oversized question IDs.
## Testing
Add regression coverage for cross-client dismissal, draft preservation, replay ordering, reply parsing, IDE context, distinct replies with identical text, and retry ordering. Update the async question scenario to use the reply envelope.
GitOrigin-RevId: 9b9e4b1e140508590401622d96cfc16fc192eb7c
Preserve known error classifications, including BioPolicy, while falling back to Other for unknown values so saved sessions can still be read.
Add optional gateway OAuth settings to model provider configuration.
Co-authored-by: Owen Lin <owen@openai.com>
Co-authored-by: alexsong-oai <alexsong@openai.com>
GitOrigin-RevId: 64bcf45ca042efca7645c798db3746375426b0fe
## Why
Environment settings saved for the next turn must not change MCP tool availability during the active turn.
## What changed
- Use one captured environment snapshot for MCP policy evaluation and runtime publication, including selections that are still starting or have failed.
- Compare both captured selections and ready environment handles when deciding whether to refresh the runtime, and rebuild the startup configuration when resolved selections change.
- Preserve the configuration origin of failed selections so MCP authority evaluation retains whether configuration comes from the thread.
- Box the MCP refresh future to keep it off the sampling request's stack.
## Testing
Add a regression test that updates the environment MCP policy while a turn waits for user input, verifies the tool remains visible when that turn resumes, and verifies it disappears on the next turn. Extend snapshot tests to cover starting and failed selections.
GitOrigin-RevId: cc2744b5137be69f000d70b0c7009b14079f39ae
## What changed
- Add `Platform` to `codex-utils-path-uri` with metadata parsing, native platform detection, and path convention mapping. Preserve missing or unrecognized metadata as `Unknown`.
- Replace `NetworkProxyExecutorOs` with the shared type and keep executor-specific socket path validation in the network proxy.
- Extract `effective_sandbox_mode` with explicit platform and Windows sandbox level inputs, preserving the native Windows fallback from `workspace-write` to `read-only` when the sandbox is disabled.
## Testing
Add unit tests for platform metadata, path conventions, native platform detection, and sandbox mode selection across platforms and Windows sandbox levels.
GitOrigin-RevId: 4fe0972e3a91040e35f2a6dfa5bcdf6c9a29be88
## Why
Cleanup needs fresh logon tokens for sandbox accounts that may already be disabled. Temporarily enabling those accounts must leave a durable obligation to disable them again if the service exits unexpectedly.
## What changed
- Persist `cleanup_logon_pending` before enabling an account, then disable it again after the logon attempt before clearing the marker.
- Recover pending account disables before owner restoration or IPC admission, validating account SIDs before restoration. Block runtime readiness and provisioning while recovery is pending, and defer retirement until cleanup logons are prepared.
- Include the blocking logon details in cleanup timeout errors and suppress repeated identical cleanup errors in the Windows event log.
## Testing
Add receipt tests covering backward-compatible defaults and pending cleanup state surviving serialization, blocking readiness and owner admission until cleared.
GitOrigin-RevId: 801bec408a27ac85ccdc3eb5ca2bdb2ccb3d5827
## What changed
Apply dim styling to all rendered recap lines and remove the cyan color from
`Next:`, preserving italics and bold labels.
## Testing
Update recap style assertions and add a rendered-buffer snapshot covering dimmed
text, label styling, line breaks, and next-action wrapping.
GitOrigin-RevId: 2dfef4753fa5da4e1fae32b5cdb03a881482f91b
## Why
Feature settings and managed requirements can replace domain and socket values. Validating the selected configuration first rejects invalid entries even when they would be replaced before use.
## What changed
Keep listener removal and unsupported controller-field rejection in `project_environment_profile_network`, but defer domain and socket validation to `validate_environment_network_policy` for the composed policy. Remove the executor OS argument from the preparation step.
## Testing
Update tests to verify that invalid domain patterns and socket paths survive preparation, fail final validation when retained, and pass when managed requirements replace them.
GitOrigin-RevId: 866c633c14ff0b4664e8bf5cf79fef51db5d7ed6
Move the exponential backoff helper into `codex-async-utils` so
`codex-cloud-config` can use it without a runtime dependency on `codex-core`.
Keep `codex-core` as a development dependency for cloud-config tests.
Preserve the existing retry delays and jitter, and re-export `backoff` from
`codex_core::util` for existing callers.
GitOrigin-RevId: 338f3194e166e77003da532310ff5be78a0eac9e
## Why
Starting a thread in a directory without a project could persist trust and
preapprove project configuration added later.
## What changed
Track whether configuration discovery found no project-root marker, Git checkout,
or project-local `.codex` directory. Skip implicit project trust in `thread/start`
for these directories. Preserve existing trust decisions and permission checks.
## Testing
Add regression coverage for starting a thread with full access, then adding
project configuration and verifying that a read-only thread does not load it or
persist trust. Add loader tests for projectless classification, project markers,
saved trust, managed configuration, and skipped discovery.
GitOrigin-RevId: da490c649d272494f65d4e22da1ebf89f9085477
## Why
After a model switch, compaction with the previous model could fail after exhausting stream retries without falling back to the selected model.
## What changed
Allow compaction to fall back to the current model for all errors except `TurnAborted`, `Interrupted`, and `SessionBudgetExceeded`.
## Testing
Add a regression test that exhausts the previous model's compaction stream retries, then verifies that fallback compaction and turn sampling use the selected model.
GitOrigin-RevId: 9c9b7ccbb206d19f1ae750a32636fc9acaacfb2b
