## What changed
Once Responses requests fall back to HTTP after exhausting WebSocket retries or receiving HTTP 426, keep subsequent requests and turns on HTTP for the remainder of the session. Clear cached WebSocket state and remove background recovery probes, recovery trials, and their acknowledgement timeout.
## Testing
Update fallback tests to verify that a second turn stays on HTTP without additional WebSocket attempts. Adjust retry and `Retry-After` request-count assertions to exclude background probes.
GitOrigin-RevId: a4f6376604527c14db8d60f79bd21c3aaf289f70
## Why
Injected agent messages need to reach active sampling before stale tool calls execute, while messages queued around a final answer must wait for the next task without requesting another response.
## What changed
- Include injected `agent_message` items in mailbox preemption checks when the matching turn still accepts mail and `DeferMailboxPreemption` is disabled.
- Treat injected agent messages as queue-only mail so they do not reopen delivery after a final answer or force a follow-up response.
## Testing
Add a streaming scenario and context snapshot covering idle injection, active sampling preemption, deferred delivery around a final answer, and preservation of message payloads and ordering before the next task.
GitOrigin-RevId: 70f49cbe5074725c11e1fcb33eea05e0e92e17f7
## What changed
Add `BoardBackend` so the core adapter selects the configured backend and supplies a `MessageBoardHost`, while the extension opens MCP, connected, remote, in-memory, and local boards at thread startup.
Move remote credential handling, HTTP client construction, and backend installation into `codex-agent-message-board-extension`, preserving existing notification delivery semantics.
GitOrigin-RevId: 98fa5525f142596c6cc6b203198fd537546c01d5
## Why
Hosts need to apply subagent-style capability restrictions without changing a thread's session attribution, agent lineage, or permission profile.
## What changed
Add the public `RestrictRootCapabilities` marker to thread startup extension data. Capture the restriction once at startup and apply it alongside the restrictions native subagents already receive. Hosts must supply the marker again when cold-resuming a restricted thread.
Use the restriction to gate user-input and plugin-install requests, async user messaging, legacy MCP tool approvals, and Full Access MCP form input. Exclude inherited user messages from Guardian's retained authorization context for restricted threads, including after cold resume.
## Testing
Add coverage for host-restricted tool registration, MCP approval rejection, Full Access form-input handling, and inherited instruction authorization after cold resume. Update handler tests to exercise the shared restriction flag.
GitOrigin-RevId: 4d6d7102a20dc747431c7511a74a204c773e8420
## What changed
- Add critical path capture status and duration fields to `codex.turn_profile` traces.
- Emit capture counts for complete and incomplete profiles, and total and component duration histograms for complete profiles, tagged by product SKU and reasoning effort. Record metrics once per turn timing state and skip disabled captures.
- Extend critical path histogram boundaries up to two hours to cover long turns.
## Testing
Add coverage for duplicate reporting, disabled and incomplete captures, product SKU normalization, trace fields, component durations, and extended histogram boundaries.
GitOrigin-RevId: 5b1af9255f1c4a376b61c81eb68c7a74b01ae9ae
## Why
Host-owned runtimes skip controller rollout-budget accounting. Give hosts an optional callback to account for inference spending and signal budget exhaustion.
## What changed
- Add `AgentUsageAccounting`, `AgentUsageReport`, and `UsageAccountingDecision`, captured at startup and supported by host child spawn reservations.
- Await per-response usage reports with thread and turn attribution, including provider budget units and foreground and background compaction usage.
- Map host exhaustion to `SessionBudgetExceeded` and accounting failures to fatal errors without retrying inference. Preserve the original error for incomplete responses.
- Keep controller accounting unchanged and leave accounting disabled for host-owned runtimes without a provider.
## Testing
Add coverage for usage attribution, child accounting, budget exhaustion, nonretryable accounting failures, incomplete responses, and compaction reporting, including background usage charged once to its originating turn.
GitOrigin-RevId: 887703f50fe882497e4e8cb33259072935ec82e0
## What changed
Enable `multi_agent_v2` and the new `agent_message_board_mcp` feature to automatically start a temporary, tree-scoped HTTP MCP message board without plugin or endpoint configuration. The MCP feature defaults off and takes precedence over `agent_message_board`.
Share board state across parent and child agents while retaining each caller's host binding. Keep the server alive while participating threads remain, and serialize board tool calls through the MCP server configuration.
## Testing
Extend the HTTP board integration scenario to cover automatic discovery, parent-child message sharing, child subscriptions and posts after the parent unloads, serialized mutations, and absence of a persistent board database.
GitOrigin-RevId: 613183c14b2ab67dfb1aaf3a3abf338376d1cc05
## What changed
Add `AgentRuntimeOwnership::Host` and an `AgentTurnAdmission` provider so hosts can acquire execution capacity before runtime tasks run, including root turns. Require the provider at startup and retain its execution guard for the task lifetime. Controller ownership remains the default; host ownership skips controller rollout-budget accounting, budget reminders, and subagent roster context.
Keep pending admission interruptible without blocking input submission. Report admission failures through the turn lifecycle, record accepted input before exposing the error, and unwind task setup such as review mode. Preserve recoverable input during suspension. On interruption, skip prompts that still require a `UserPromptSubmit` hook rather than recording them without inspection.
## Testing
Add integration tests for missing-provider startup cleanup, denial and immediate retry, steering during admission, cancellation, execution guard lifetime, submit-hook handling, suspension recovery, and review-mode cleanup. Add a context snapshot verifying retained input reaches the next admitted turn.
GitOrigin-RevId: 9ee85fad2ecfbfb38735bac8ef88888fb179a967
## Why
Deduplicating against optional transcript entries can remove retained instructions or required tool calls even though the optional copies may later be evicted. Elastic instruction caps can also report evidence loss for revisions already delivered in full.
## What changed
- Capture the review's budget policy and use it for feasibility checks, admission, and restoration after compaction.
- Prefer required and protected native messages over optional duplicates, and use only complete, required pending transcript entries as proof of instruction delivery.
- Match elastic instruction duplicates by source revision and discard truncation observations for copies already delivered in full.
## Testing
Extend coverage for compaction recovery under fixed and elastic budgets, required and protected tool-call deduplication, and capped instruction duplicates covered by complete delivery metadata.
GitOrigin-RevId: fe456e645cdba6f782fb16ad582702d3b7ed012c
## Why
Host-provided context such as budget reminders can become stale while compaction runs. Replaying a captured value or retaining its comparison snapshot can prevent the next step from emitting a fresh reminder, even when the remaining budget has changed.
## What changed
- Add `WorldStateSectionContribution::without_full_context()` to omit a section's fragment and comparison snapshot from initial and compacted context rebuilds while preserving ordinary step updates.
- Reset comparison state after prefix compaction for sections excluded at either capture or installation, including when their messages survive in the live suffix.
- Include step World State updates when building debug prompt input.
## Testing
Add regression coverage for budget reminders refreshing after remote compaction within the same threshold, unchanged request prefixes within a context window, refreshes with a retained live suffix, and step reminders in debug prompts.
GitOrigin-RevId: ea4456755e16c93b5d16e8c762b26a33f8571a86
## What changed
Replace `thread_store_from_config` with `ThreadStoreBuilder`, exported through `codex_core` and `codex_core_api`, and migrate callers to the builder.
Allow hosts to register `with_additional_cleanup` for permanent deletion in local stores. The callback runs after successful agent-board cleanup and before rollout deletion, under the existing deletion locks. Document that cleanup must be idempotent and must avoid thread-store operations that reacquire those locks. In-memory stores do not invoke the callback.
Preserve the existing backend selection, startup rollout migration, and compression behavior.
GitOrigin-RevId: f2853d7de06fe12ef29451b204cf9fcbb349c359
## What changed
Add `RealtimeSidebandTransport` and `Op::RealtimeConversationAttachStream` so callers can attach Core to an existing realtime call through bounded JSON channels without opening or reconnecting a socket.
Read events independently of outbound backpressure, enforce a 1 MiB message limit, and drain accepted input on detach or channel closure before flushing the transcript. Pending writes are never replayed.
## Testing
Add transport and Core integration tests covering delegation without a callback socket, stalled output, attachment replacement and detach, channel closure, oversized messages, and preservation of queued transcripts in history.
GitOrigin-RevId: 06b7d1dfe2388054438d72d925e510a959dfe106
## Why
A transient WebSocket failure previously kept the session on HTTP for its remaining lifetime, even if WebSocket connectivity recovered.
## What changed
- Probe WebSocket connectivity in the background during HTTP fallback, allowing a subsequent request to use a ready connection without delaying HTTP requests.
- Verify recovery with a real request and bound its first-response wait to five seconds. Keep HTTP 426 responses and recovery timeouts on HTTP for the rest of the session.
- Keep retries of an HTTP request on HTTP. If a recovered connection fails before output, replay the request over HTTP without consuming its ordinary retry budget; failures after output use normal retry accounting.
- Rate-limit recovery probes and honor `Retry-After` deadlines.
## Testing
Extend integration coverage for successful recovery within a turn, disconnects before and after output, full-context replay followed by incremental WebSocket requests, persistent HTTP 426 fallback, and retry deadlines.
GitOrigin-RevId: 1c139a4bbce1a67442db5622fd70ff0cc8056c9c
## Why
Delegation messages containing `<source_orbit_id>` fail sender provenance parsing, leaving Guardian without the sender's instructions.
## What changed
Accept an optional `<source_orbit_id>` between `<source_thread_id>` and `<input>`, rejecting values containing `<`. Continue to derive sender authority from the source thread ID.
## Testing
Update the cross-host sender context scenario and snapshot to include orbit attribution. The scenario checks that sender evidence reaches Guardian after compaction and rollback without exposing it to the receiving agent.
GitOrigin-RevId: 463b18667384d30297245eedcd0f6bcbf683634e
## Why
After provider setup, new threads could still use the models manager created for the server's startup provider, leaving their default model inconsistent with the model picker.
## What changed
- Build a models manager from the thread's configuration when its provider differs from the startup provider.
- Invalidate the model catalog after successful Amazon Bedrock setup so subsequent model listings reflect the configured provider.
## Testing
Extend Bedrock and GCP setup integration tests to verify that a new thread's model matches the refreshed model listing. The Bedrock test also checks that the thread uses `amazon-bedrock`.
GitOrigin-RevId: 1db30ad040ba97e2f4f31c9e162a2b73af1377fa
## What changed
Eligible interactive launches now start or reuse the shared daemon regardless of `features.daemon_auto_start`. Remote-control daemon eligibility also no longer checks this flag. Use `--no-daemon` to run without the shared background server.
Treat `daemon_auto_start` as removed: ignore configured values with a migration notice, ignore managed requirements with a warning, and hide the flag from experimental feature discovery. Remove its launch telemetry tag.
## Testing
Extend retired-feature requirement coverage and add a migration-notice snapshot. Update CLI and TUI integration tests for daemon startup and explicit `--no-daemon` usage.
GitOrigin-RevId: e0290e5acd4bc0169a0f71c3296c567e46269ce3
## Why
The previous histogram placed post-truncation values just over 4,000 bytes in a bucket ending at 8,000 bytes, obscuring their size near the truncation cap.
## What changed
Use logarithmic boundaries through 4 MiB for `codex.additional_context.value_bytes`, with an explicit 4 KiB boundary near the truncation cap.
## Testing
Add a regression test verifying that post-truncation samples between 4,024 and 4,043 bytes land in buckets ending at or below 4 KiB while preserving their sum and count.
GitOrigin-RevId: af268fc0de3d5ceb648ce51fced3918317f2457a
## Why
`CodexThread::call_mcp_tool` returns only the tool result, so computing attribution and creating a cached runtime binding for these calls is unnecessary.
## What changed
Add `McpRuntime::latest_call_tool_without_attribution` and use it for direct thread calls. Validate the call, wait for server startup, and dispatch through the latest connections without capturing an attribution binding.
## Testing
Extend the runtime binding cache test to verify that a successful call without attribution leaves the cached binding empty. Update the test server to return a successful tool result.
GitOrigin-RevId: 898e655d9a0174ddaf71c390757d6fc9a5a61780
## What changed
Strengthen the execution cancellation test to verify that a session approval wakes a queued request before it is polled again. Assert that the request remains unwoken while the session policy commit lock is held, then receives a wakeup after the grant completes.
Wait for the second request to hold a prompt queue reference and install a counting waker on its semaphore. Share `WakeCount` with the existing manual prompt wakeup tests.
GitOrigin-RevId: c559a7c31385000347cd1c7dace25e84d1099db9
## What changed
- Thread `ContextBudgeting` through synchronous context and image preparation. Elastic mode preserves candidates for later entry capping and allocation; existing reviewer callers continue to use `Fixed`.
- Defer transcript selection, supporting-text caps, and image budget admission in elastic mode while preserving exact planned actions. Mark host framing as protected and distinguish optional user messages from required manual approvals.
- Add `ElasticBudgetConfig` validation requiring section minimums, including fallback policies, to sum to `DEFAULT_MAX_INPUT_TOKENS`.
## Testing
Extend tests for elastic transcript preservation, deferred native tool-call limits, oversized planned actions, image allocation, and section minimum totals above and below the required budget.
GitOrigin-RevId: 46a4605e12e2bab5973097eb1caf5fd99f6640aa
## Why
Direct Guardian review rejected recorded `exec_command` calls intercepted as `apply_patch`, even though normal execution could review those patches.
## What changed
Share intercepted patch preparation between execution and direct review so Guardian assesses the verified patch and its approval requirement without applying it.
## Testing
Extend the direct patch review scenario to cover `exec_command` heredocs alongside native `apply_patch` calls, asserting identical live and direct review inputs and no file writes after direct approval.
GitOrigin-RevId: af62cf66a3f01c65a65c15cfad3fc9cdd1f2bf19
## What changed
Allow `guardian_review` to assess a final recorded `request_permissions` call without granting permissions. Build the review action using the same permission request preparation as live review, while continuing to reject earlier permission requests in the recorded history.
Return no assessment when the approval policy is `never` or granular policy disables permission requests.
## Testing
Add coverage comparing live and direct permission review inputs, plus tests that disallowed requests return no assessment without contacting the reviewer.
GitOrigin-RevId: cb5935202b0980e657b023f840a0186cea5e0b74
## What changed
Allow `guardian_review` to assess recorded native `apply_patch` calls alongside `exec_command` calls. Use the existing patch preparation and approval logic without applying the patch, and skip assessment when approval is unnecessary.
## Testing
Add coverage that compares direct and live patch review inputs, verifies that an allow decision leaves files unchanged, and checks that writable files skip review without writes or model requests.
GitOrigin-RevId: 8634ad8c00a67bcac9e7930ebf89c02707c3a6f7
## What changed
- Add `model_messages.plugins` overrides for generic usage guidance, selected-plugin hints, and recommendation introductions, with independent fallback to bundled wording for missing or invalid fields.
- Validate text limits and required template placeholders while keeping plugin identities, available capabilities, and eligibility controlled by the client.
- Track generic guidance changes across model switches and session resume, emitting replacement or retirement notices and supporting legacy snapshots and retained history.
## Testing
Add unit and scenario coverage for sparse overrides, literal text preservation, template validation, UTF-8 size bounds, capability filtering, recommendation fallback, and guidance recovery after resume.
GitOrigin-RevId: 148b658c2d8490c9d0dc208addbee1be5342a5f5
## What changed
Add the disabled-by-default `cli_resume_account_check` feature. When enabled for `codex-tui` and `codex_exec`, reject resuming or attaching to a local thread if its recorded creator user or workspace differs from the current ChatGPT account. Return an error directing the user to sign in with the original account.
Carry creator IDs through stored thread metadata and check them before loading resume history. Preserve existing behavior for untagged threads, other clients, and authentication modes without a comparable ChatGPT account.
## Testing
Add integration coverage for account and workspace mismatches, matching accounts, legacy and paginated history, ID and path lookup, and the feature's default and bypass behavior. Verify that switching back to the original account permits attachment to a loaded thread and that creator metadata remains unchanged.
GitOrigin-RevId: a3ab089254703417dde0890a5f8d6326c4cbb75a
## Why
Input accepted while a regular turn was flushing its transcript could miss the final pending-input check and remain unprocessed when the turn completed.
## What changed
Check pending input atomically with closing steer admission. If input was accepted, resume sampling in the same turn while preserving MCP startup requirements, and complete the turn with the updated answer.
## Testing
Add a regression test that pauses the final flush, submits a steer, and verifies that the model receives it exactly once before the same turn completes with the answer to the steer.
GitOrigin-RevId: 193db3ab6916a86e97c3845590598fd8fbe47081
## Why
`start_or_steer_turn` rejected agent messages, preventing callers from submitting follow-up work through the turn input API.
## What changed
Route `TurnInput::InterAgentCommunication` through native agent message delivery and return `TurnInputSubmission::Accepted`, without implying an immediate turn ID. These submissions request work regardless of `trigger_turn`, retain the recipient's settings, and forward turn-start options.
Wrap plaintext messages with agent context while preserving encrypted content. Reject submissions to idle recipients when the host is draining.
## Testing
Add scenario tests and snapshots covering queued-message ordering, encrypted follow-ups, preemption at reasoning boundaries, and follow-ups arriving before or after a final answer. Extend drain-gate coverage to agent submissions with parent-turn lineage.
GitOrigin-RevId: 92d49465f97bb366babbf1b1bc18a1e8a6c6ed1c
## Why
When a response fails with incomplete output, attempted tool calls can appear only in the terminal response payload. Failed inference traces previously omitted those items, losing evidence of the attempted call.
## What changed
Retain output items marked `incomplete` on `ResponseIncompleteError` and include recognized items in failed inference traces, deduplicating by item ID. Keep these items out of streamed output, tool dispatch, and the continuation cache, and omit their payloads from the error's debug representation.
## Testing
Add tests for retaining only incomplete output from terminal responses and recording attempted calls in failed traces without streaming them or creating tool calls. Cover unknown response item types being skipped.
GitOrigin-RevId: 594f6a37a5af543694f19fcffe0c164cb2addb36
## What changed
Introduce `ContextBudgeting::Elastic` to prepare captured root conversation and Node REPL evidence without the fixed per-section request caps. Elastic preparation preserves message text and candidates for later allocation while retaining storage omission notices and legacy source deduplication.
Keep `ContextBudgeting::Fixed` as the default and use it at existing call sites.
## Testing
Add tests covering elastic root message preservation and legacy source deduplication, plus REPL text, images, and omission counts in text-only and multimodal modes.
GitOrigin-RevId: ce4fae9d725694456525a413fb511166df6f5e2c
## What changed
- Allow audio inputs to carry uploaded file references via `fileId` in the app-server API and `file_id` in model content, preserving existing inline audio shapes and Python class names.
- Preserve mixed inline and file-backed audio ordering through history reconstruction and migration, and budget file-backed audio conservatively when duration is unknown.
- Keep uploaded audio disabled at runtime: reject it before inference or raw history injection, preserve accompanying text, and prevent rejected attachments from reaching follow-up or resumed requests.
## Testing
Add coverage for wire-format round trips, SDK compatibility, mixed audio history ordering, and rejection during turn start, steering, task completion, and raw injection.
GitOrigin-RevId: 70895c47a2494c0c9936348ad1250eb1b7b892a6
## What changed
Inline validation and command preparation in `review_tool_call`, removing the
`RecordedExecCall` helper. Use the tool invocation's call ID for approval actions
and return `GuardianReviewResult` directly from the review future, including when
no assessment is required.
GitOrigin-RevId: aafd01f640d46dc542a649bc5b31b3cfba7bedb8
## Why
Host-owned tools need to wait for agent messages or steering input with the same behavior as native `wait_agent`, including when native multi-agent support is disabled.
## What changed
- Add `CodexThread::wait_for_input_activity` and export `InputWaitOutcome` through core and core-api, sharing the wait implementation with `wait_agent`.
- Distinguish notifying agent messages from steering input, with steering taking precedence when both are pending. Passive response items do not wake waits.
- Observe input without consuming it. Waits remain active after the original turn ends, support independent observers, and can be cancelled by dropping the future.
## Testing
Add coverage for pending and incoming input, agent-message classification, cancellation, independent observers, timeouts, and input arriving after the original turn completes or is interrupted.
GitOrigin-RevId: d0c0bd776c3b6fd4ba3021603d87eaaf1d93976f
## What changed
Mark `deferred_tool_world_state` as stable and enable it by default. Deferred tool namespaces now appear in the developer `<tools>` context instead of the `tool_search` description. Explicitly disabling the feature preserves discovery metadata in the search description.
## Testing
Update tool discovery tests to cover the default behavior and explicit opt-out, and refresh request snapshots for the deferred namespace context.
GitOrigin-RevId: d58e369ea22754cee593c26a5ca011e41ba56e79
## What changed
- Add `StartThreadOptions` setters for captured thread instructions and execution policy snapshots. Captured instructions replace the live thread provider; empty text clears the thread contribution. Hosts must supply inherited settings again on cold resume.
- Install inherited policies in independent managers only when the destination ignores user and project rules, has no additional policy files, and has matching managed requirements. Preserve managed command restrictions, host executable mappings, and network denials, including restrictions that absolute-path rules could otherwise bypass.
- Reject inherited startup settings for isolated sessions and reject combining local and transported execution policies.
## Testing
Add coverage for policy inheritance through children and grandchildren, incompatible or weakened policies, absolute-path amendments, and captured instructions overriding or clearing live instructions on startup and resume. An execution integration test checks that an inherited allow rule runs without approval while a managed denial still blocks execution.
GitOrigin-RevId: c1147992fe5bb5ba4bcf981c08fcfcb6f6bca8a1
## What changed
Add the default-off `suppress_model_change_announcements` feature flag. When enabled, incremental context updates omit the model ID announcement after a model switch while still delivering changed base instructions and tool definitions.
Advance the model snapshot even when a switch emits no context update, so subsequent turns recognize the current model.
## Testing
Add coverage for omitted and explicit flag values, snapshot advancement without repeated updates, and request history across model switches, repeated turns, and compaction with announcements suppressed.
GitOrigin-RevId: 89c70f1e9d7981fd945fb8e41b1f98492717a07e
## Why
Retained output from failed responses or responses without usage data can be omitted from context token estimates, delaying automatic compaction even as reasoning accumulates.
## What changed
Track the history boundary covered by the last usable usage report and estimate all items added after it. Spending-only updates preserve that boundary, while successful usage reports cover the request input even when the response contains no output items. Avoid counting unreported reasoning twice and align recomputed context counts and remote compaction estimates with the boundary.
## Testing
Add unit coverage for initial input, empty responses, spending-only updates, and reasoning accounting. Add regression coverage verifying that accumulated unreported reasoning triggers compaction for incomplete responses with or without usage and completed responses without usage.
GitOrigin-RevId: 80c0b800c7236ff40ae53fdd18320e0d06e026ab
## What changed
Expose `McpToolRequestMetaHook` and `McpToolRequestMetaProvider` so hosts can supply a per-invocation `_meta` value using the thread, turn, and call IDs. Apply the hook before dispatch only when the tool, server name, source, and full transport configuration match the selected local MCP registration.
Reject metadata key collisions and propagate provider errors to the tool caller without dispatching the call.
## Testing
Add integration coverage for matching registrations, different contributors and routing headers, unrelated tools and servers, provider failures, and existing metadata keys.
GitOrigin-RevId: 2bf51c375a04617d61b24ca1cbbcaa810fb06720
## What changed
Replace `PreparedThreadSpawn` with `PreparedChildContext`. `CodexThread::prepare_child` now captures parent inputs from a live tool invocation without requiring a child request. Hosts choose the child's name, role, and history, bind destination services, and apply child settings.
Expose captured instructions, environments, permissions, approval settings, disabled plugins, current inheritable dynamic tools, and an execution-policy snapshot with its original managed requirements. Retain those requirements across MCP configuration refreshes so hosts can assess policy-source compatibility.
Remove `ThreadManager::create_prepared_child`; `CodexThread::create_child` handles reserved child startup on the parent's manager with invocation-bound cancellation and cleanup.
## Testing
Add coverage for execution-policy snapshots and managed requirements after MCP refresh. Update child-spawn tests to verify captured instructions and permissions, current dynamic-tool declarations, and fresh versus forked history.
GitOrigin-RevId: f15b595b44997fa70cd0c9be0e92f470e1f333e1
## What changed
Add `AgentMcpMetadataRecipient` as a thread extension that lets the host select which MCP plugin registration receives `x-codex-root-turn-id` and `x-codex-cyber-access-program` in tool-call metadata.
Require an exact match on the plugin ID, installed root, server name, and transport configuration in the `local` MCP environment. Omit both keys without host opt-in or when the registration does not match, including same-name user overrides. Send JSON null for unset values on matching registrations.
## Testing
Add unit tests for registration matching and integration coverage for host opt-in, same-name user overrides, and an unset access program.
GitOrigin-RevId: eaa44e17b29aa0bdec6f6ed9faa86b8fc931faad
## Why
Direct Guardian review checked recorded `exec_command` calls without applying `PreToolUse` hooks, so approval decisions could miss hook rewrites or denials.
## What changed
Run the shared `PreToolUse` hook handling before evaluating approval requirements. Use the rewritten arguments for policy checks and the Guardian approval request, and return an error when a hook blocks the call, even if policy would otherwise skip review.
## Testing
Add regression tests covering rewritten commands that require approval and hook denials for policy-allowed commands. Verify the rewritten approval request, hook events and recorded denial context, and that reviewed commands are not executed.
GitOrigin-RevId: 3ec7700f695e422ac59c903c285acc0cf633b915
## What changed
Return `CatalogModel` from model lookups, keeping metadata together with its `Bundled`, `Provider`, `ExplicitConfig`, or `Synthetic` origin through config overrides and runtime snapshots. Replace `used_fallback_model_metadata` checks with explicit `Synthetic` origin checks.
Share the underlying `Arc<ModelInfo>` with extension stores and use copy-on-write for metadata changes. Keep origin tracking outside serialized model metadata.
## Testing
Extend coverage for origin retention across cache reloads, namespaced model lookups, catalog fallback, and config overrides. Verify that step snapshots and extension stores share the same model metadata allocation.
GitOrigin-RevId: bb6130c94a7a795aa168ee24664a1dd453579fba
## What changed
Move hook execution and input updates into `apply_pre_tool_use`, with distinct errors for blocked calls, failures, and cancellation. Preserve dispatch error reporting and clear the serving assessment when a hook changes the invocation payload.
GitOrigin-RevId: d3c5b37692970b739393cb0c998f6cff0ff39af2
## Why
Plugin and skill catalog reads currently wait for the Apps server's initial `tools/list` to finish, even after its MCP transport is initialized.
## What changed
Add the disabled-by-default `features.apps_early_resource_discovery` flag. When enabled, host-owned Apps requests for `mcp/plugin` and `mcp/skill` resources can use the initialized transport while the initial tool inventory is pending. Server readiness still waits for the inventory to complete, and retries use normal readiness.
Bound early client acquisition by the configured startup timeout, propagate startup failures and cancellation, and reject pages if the connection, authentication scope, or resource cache generation changes during discovery.
## Testing
Add coverage for gated discovery, concurrent plugin and skill reads, startup timeouts and failures, cancellation, cache invalidation, and account switches. Verify that early discovery reuses a single handshake and tool inventory, including with the newer MCP protocol and connection sharing enabled.
GitOrigin-RevId: 955b1f6d43b733bdf9763c1caf2ce6913c686c81
## Why
Concurrent executions accessing the same endpoint can produce duplicate network approval prompts before a session decision is recorded.
## What changed
- Queue manual prompts by environment, host, protocol, and port while keeping execution decisions separate.
- After a one-time approval or denial, let the next execution prompt. Reuse committed session grants and deny rules without another prompt.
- Keep tool results paused while requests are queued and attribute the wait to the triggering tool call.
## Testing
Extend coverage for concurrent requests, one-time and session decisions, independent ports, queued cancellation and timing, and isolation between local and remote environments.
GitOrigin-RevId: ebf580dddc39a9a9dc3b0d1acfa21438fbc6e100
## Why
A network request can disappear while its approval prompt is still pending. Leaving that prompt active allows a late cancellation to interrupt the turn even though the request no longer needs approval.
## What changed
- Track network prompt lifetimes in core and notify the app server when a prompt is resolved or withdrawn.
- Cancel the corresponding server request, emit `serverRequest/resolved`, and release its permission guard. Resolve outstanding network prompts during thread shutdown as well.
- Claim a live pending approval and validate its originating turn before applying a decision, so stale responses cannot interrupt a turn or persist policy changes.
- Distinguish network approvals that require the originating turn from proxy approvals that can be serviced by a later active turn.
## Testing
Extend regression coverage for disconnected network requests, late cancellation responses, turn completion during review, shutdown cleanup, mismatched turn IDs, and command approvals from background code running during a later turn.
GitOrigin-RevId: 78f656d92607ec21ddd0c5d781ed0947588cb2eb
## Why
Long realtime conversations could lose speech when active transcripts and handoff transcript fields were truncated.
## What changed
- Record completed V3 transcript chunks in model and client history once the active transcript exceeds 4 KiB, without triggering inference.
- Keep unfinished utterances pending to preserve conversation order, and persist completed chunks before subsequent handoffs.
- Preserve full V3 transcript text at handoff and session-end tail flush, and avoid adding handoff input already recorded in transcript history.
## Testing
Add integration coverage for long transcripts, XML escaping, recording before handoff without inference, repeated handoff input, and both session-end tail flush settings.
GitOrigin-RevId: 62218b811809c4cf5b16fb0247a335eb474f9ab9
## What changed
- Add a non-inlined `TryFrom<toml::Value>` implementation for `ConfigToml` and route callers through it to share the generated deserializer in `codex-config`.
- Reuse the ignored-field deserialization helper for strict validation, returning path-aware errors while preserving existing fallbacks for CLI validation and ignored-config warnings.
GitOrigin-RevId: 0208b314416ad4d3d7fbf3a30560a0c8c4035abd
## Why
Cyber access program selection was restricted to the `openai` provider ID, preventing custom providers from accepting explicit program selections.
## What changed
- Add `capabilities.cyber_access_programs` to provider configuration and preserve it through remote thread configuration. Default to enabled for `openai` and disabled for other provider IDs, with explicit overrides taking precedence.
- Use the capability when forwarding `access_programs.cyber` and determining Daybreak availability in exec and the TUI. Refresh TUI eligibility when the server changes the selected provider.
- Preserve authentication, API-key feature gates, and catalog access checks; the capability does not grant program access.
## Testing
Add coverage for capability defaults and overrides, configuration round trips, custom-provider requests with both authentication types, API-key feature gating, compaction, WebSocket response reuse, exec selection, and TUI provider changes.
GitOrigin-RevId: 579f7c33c9e857ff5fedd08311aa8e3129740c1f
## Why
Standalone web search must use the same permission mode as hosted search. Permission changes during a turn should take effect on the next turn, without changing web access for searches in the active turn.
## What changed
Pass the turn's `WebSearchMode` to the web search extension and use it to determine tool availability and `external_web_access`, while retaining provider support checks and thread-level search settings.
## Testing
Add an app-server regression test that switches from cached search to Full Access while a turn is paused. Searches before and after the update keep `external_web_access` disabled in that turn; the next turn enables it.
GitOrigin-RevId: 9e3b8598f2e491388b7e7d4840c849155ae95e88
## What changed
Allow shared network constraints in `[permissions.network]` in `requirements.toml`, alongside `[permissions.filesystem]`. Apply them throughout configuration loading, network approvals, Windows sandbox policy validation, and `configRequirements/read`, and show their source in `/debug-config`.
Retain `[network_proxy]` and `[experimental_network]`, but reject mixing either with `[permissions.network]`, even across requirements layers. Preserve independent network and filesystem precedence and source attribution, and report unknown nested network fields.
Reserve `network` as a managed requirements table name and reject empty or profile-shaped tables with migration guidance. Profiles named `network` remain valid in `config.toml`. Document that policy publishers must keep using `[experimental_network]` until all readers support the chosen replacement.
## Testing
Add coverage for layered constraints and source attribution, conflicting spellings, profile-name migration errors, unknown-field diagnostics, and cloud validation. Extend API, project discovery, network approval, and Windows policy tests to cover `[permissions.network]`, and verify managed proxy settings remain independent of disabled feature configuration.
GitOrigin-RevId: 994dfca9abf5a7aea914276c0ded8b40d7ed0372
Charlie Marsh