## Why
Async classification could use policy from the manager's startup catalog even when the reviewed thread had a different reviewer policy.
## What changed
Share reviewer resolution between synchronous review and async classification, using the thread's catalog and reviewer eligibility rules. Select reviewer metadata from the same catalog snapshot, filter out models unsupported by API authentication, and preserve captured parent metadata when no eligible default reviewer exists.
## Testing
Update the async classification regression test with distinct thread and manager catalog policies, asserting that the thread reviewer's policy appears in classifier instructions.
GitOrigin-RevId: 0b28644d30bda42d2cf1bd8a31de2e8f8d38e1a6
## Why
A delayed file change approval cancellation could interrupt a later turn, even when the original approval was no longer pending.
## What changed
Send `Op::CancelPatchApproval` with the approval ID and requesting turn ID from the app server. Resolve cancellations only for a matching pending approval and interrupt its requesting turn only if it is still active. Route legacy `Op::PatchApproval` abort decisions through the same pending-approval handling.
## Testing
Add a regression test that cancels an approval, then replays that cancellation while a second turn has a pending approval with the same call ID. Verify that the second approval succeeds and its turn remains active.
GitOrigin-RevId: 4c833ccd0f33c2df4e9dfb25e2729ab19b6c879f
Read inline image dimensions with `ImageReader::into_dimensions` instead of
loading the full image into memory. Keep the existing patch-based estimate
and fallback when dimensions cannot be read.
GitOrigin-RevId: fd45eb748ce03134261c867397e1fe46c6023f2d
## Why
Switching away from a model that requires automatic review should restore the user's requested approval reviewer instead of retaining the model's enforced reviewer.
## What changed
Recompute the reviewer from the requested preference and model requirements when the model changes without an explicit reviewer update, unless the session uses a trusted guardian reviewer. Preserve an explicit automatic-review preference across subsequent model switches.
## Testing
Extend the app-server settings regression test to cover restoring user review after leaving a protected model and retaining an explicit automatic-review choice across repeated model switches.
GitOrigin-RevId: a5672d1ebe94c2fac201ad460b4789d11df03b1a
## What changed
Read `final_answer_moderation` metadata and attach `moderation: { moderated: boolean }` to the completed final-answer message only when its item ID matches. Apply this in both normal and plan modes, and reset the pending decision when a new response starts.
Preserve the answer's native item ID and moderation flag through legacy events and history reconstruction. Combine text parts into one legacy event when a moderation decision is present.
Expose nullable moderation data on app-server agent messages and update the JSON schemas, TypeScript types, and Python models.
## Testing
Add an integration test for moderation on completed answers and their legacy events. Extend protocol conversion tests to cover populated moderation data and serialization as `null` when absent.
GitOrigin-RevId: f286b67731a84b3daf5d10b7644f2e31b62f0e53
## Why
Incremental tool declarations were limited to Responses Lite. Regular OpenAI Responses requests sent the full current tool catalog on each request.
## What changed
- Add the disabled-by-default `incremental_tools_legacy` feature for regular OpenAI Responses, independently of the Responses Lite `incremental_tools` flag.
- Support tool declarations and updates in conversation history, including during compaction, while preserving existing history prefixes.
- Keep hosted `web_search` configuration in top-level `tools` rather than `additional_tools`, including in compaction requests.
## Testing
Extend request-history scenarios and snapshots to cover regular Responses catalog updates, model switches, compaction, and MCP tool removal and restoration. Assert that incremental requests preserve input prefixes and keep web search out of history declarations.
GitOrigin-RevId: fa347409e387aa973ce2e41df8505769b7db1ec2
## Why
Runtime authentication must use the credential selected by the model provider. Explicit API keys and command credentials need independent ownership so cached connections and in-flight work cannot cross credential sources.
## What changed
- Register and reuse runtimes per credential source, supporting explicit provider keys and command credentials without falling back to saved login credentials.
- Track `AuthOwner` by credential manager and owner generation across WebSocket state, compaction, and scoring.
- Preserve cached identity and runtime registration state during credential-source outages or failed storage reloads. Require a successful auth reload before logout revokes credentials.
- Reject requests whose production or staging environment differs from runtime registration, including model catalog requests.
## Testing
Add regression coverage for credential selection and runtime reuse, owner isolation, source outages, failed reloads and logout recovery, and environment mismatches.
GitOrigin-RevId: 7bab55e0ea502593393df10046309fd8502edbd0
## Why
Gateway sign-in needs an alternative for terminals that cannot open a browser.
## What changed
- Add optional `gateway_oauth.device_authorization_url` configuration and a `login_with_device_code` API that presents a verification URL and user code, polls for approval, and persists the resulting credentials.
- Use the configured proxy and network policy, validate verification URLs, and bound OAuth responses. Support cancellation and report denied or expired codes without exposing issuer error details.
## Testing
Add tests for successful authorization and credential persistence, unsafe verification URLs, network-policy denials, denied and expired codes, and cancellation during approval or credential storage.
GitOrigin-RevId: 96398578fb866d34929e85c04eadf468d8cd3255
## Why
Cached gateway command credentials need to be refreshed when the gateway rejects them with a `401`.
## What changed
Clear the cached `credential_export` token after an inference HTTP `401` or a WebSocket upgrade rejected with `401`, then rerun the command for one retry. Preserve subsequent primary authentication recovery if the retry is also unauthorized, and document the behavior.
## Testing
Add integration coverage for using a new exported token, reporting an invalid export, recovering primary authentication after the gateway retry, and stopping after a second unauthorized WebSocket upgrade.
GitOrigin-RevId: 3397476dbfd3bec1bd44f90657c4f9e17bb7df67
## What changed
Add an optional `thread_id` to `HostedFileUploadContext` and include it as `codex_thread_id` in file creation requests when provided. Keep MCP app uploads without this field while retaining the thread ID in tool-call metadata.
## Testing
Extend upload tests to check inclusion and omission of `codex_thread_id`, and assert that MCP app calls retain `_meta.threadId` without adding it to file uploads.
GitOrigin-RevId: cff15b35e5130e56973f944b3b849807550d298b
## What changed
Add a default `ModelRequestContributor::budget_exhausted` hook and fail generation with `SessionBudgetExceeded` when any contributor reports an exhausted budget for the thread.
Check budgets before HTTP requests and before WebSocket connection setup, then check again after the connection is established. WebSocket warmup remains available when the budget is exhausted.
## Testing
Add coverage for budget changes during a tool call, verifying that exhaustion prevents the next model request while an available budget allows completion. Extend WebSocket coverage to verify that exhausted generation opens no connection and warmup still permits connection reuse once the budget becomes available.
GitOrigin-RevId: 97ce02dc7f9bd54830e4b73c4f0334a30367eebf
## What changed
Allow `model_providers.<id>.gateway_oauth.credential_export` to supply a gateway access token instead of browser OAuth. Run the configured command on first use, cache its token in memory, and deliver it through the configured header or cookie. Export failures surface directly, and command-backed providers do not require an OAuth session.
Require mutually exclusive OAuth and exporter settings, same-origin model catalog access, and rejection of HTTP redirects for command-backed gateway credentials. Share the bounded, timeout-controlled command runner with AWS credential export.
## Testing
Add tests for inference and model listing without OAuth, token caching and recovery after invalid output, preservation of primary authentication, and rejection of mixed OAuth/exporter configuration.
GitOrigin-RevId: e3dbfd8823b1992045f1c1efd56ec98ee17e07a5
## Why
A message's model-visible item ID may be unknown until the recipient records it. Message lifecycle observers need to capture publication state before that point.
## What changed
Remove `message_id` from `MessageLifecycleInput` and give each publication's `ExtensionData` a fresh UUID key. Stop assigning an item ID when publishing messages for lifecycle observers.
## Testing
Update the agent mailbox test to store a contributor-specific token in `ExtensionData` at publication and retrieve it at consumption, verifying that publication state survives queued delivery and recipient eviction.
GitOrigin-RevId: e254f94994d0976e61cb46ee23297f3248b9a389
## Why
Clients need to list models for a configured provider other than the app-server's startup default.
## What changed
Add an optional `modelProvider` parameter to `model/list` and expose it in the generated schemas and client types. Explicit selections use provider definitions loaded at startup and respect current managed provider requirements. Unknown providers return a structured `modelProviderNotConfigured` error.
Use a temporary catalog when selecting another provider, preserving the default catalog and its disk cache while retaining runtime authentication. Requests without a selector keep the existing provider and caching behavior.
## Testing
Add coverage for provider selection, preservation of the default catalog and disk cache, unknown-provider errors, managed requirement enforcement, and runtime authentication for temporary catalogs.
GitOrigin-RevId: 6092df9f6141810c6ac215a8e1fb601f77e54747
## What changed
Remove `FileSystemSandboxContext::from_legacy_sandbox_policy` and migrate its test callers to `from_permission_profile`. Construct read-only, disabled, and externally enforced sandbox contexts directly with `PermissionProfile`.
GitOrigin-RevId: e330b89d060061eda106232eab554be5ccd06149
## What changed
- Expose an optional `AgentServiceTier` provider so host-owned children, including detached children, inherit the root's committed tier during spawn preparation, startup prewarm, and each inference step.
- Reject per-turn tier overrides for children using the shared provider. Root updates apply to subsequent requests without changing requests already in flight.
- Preserve independent configured tiers and role overrides when no provider is installed, including across eviction and reload. Spawned children inherit the parent's thread preference rather than its per-turn override.
- Publish the latest committed root tier only after successful runtime registration, preventing failed duplicate starts from changing shared settings.
## Testing
Add coverage for detached-child WebSocket prewarm and between-step tier changes, shared-child override rejection, independent-tier inheritance and reload, and settings updates before registration.
GitOrigin-RevId: f0f3676813a1c59bd77baf95121e2d13e0163a8e
## Why
WebSocket telemetry reparses text frames to extract event kinds that the transport already decodes.
## What changed
Pass decoded event kinds to telemetry and report receive failures separately. Keep JSON parsing for timing metrics and as a fallback when stream event decoding fails. Remove the `tokio-tungstenite` dependency from `codex-otel` and restrict it to tests in `codex-core`.
Limit wrapped error parsing to error events or failed stream decoding, preserving HTTP error forwarding when unrelated stream fields are malformed.
## Testing
Update runtime summary coverage to include receive failures and extend the WebSocket error forwarding test with a malformed stream field.
GitOrigin-RevId: e1f9d200fd6d30ec124a2354bdbc01f3082ddde3
## What changed
- Remove startup prefetching of remote catalogs, featured plugins, and recommendations while retaining installed-plugin refreshes and bundle downloads.
- Fetch featured plugin IDs on demand, concurrently with marketplace fetching when listing the remote global catalog, and reuse the cached results.
- Retire `plugin_discovery_prefetch` as an ignored compatibility flag and remove forced background catalog refreshes.
## Testing
Update app-server tests to verify that startup downloads installed bundles without discovery requests and that two `plugin/list` calls share one featured-plugin fetch.
GitOrigin-RevId: aa10474f3429102d624c83472e81ec85e3b470ae
## Why
Starting a side chat waits for fork and setup requests. Keep the workspace responsive during those requests and let users return to an existing side chat through the sidebar chooser.
## What changed
- Add a clickable `Side chat` tab and `+` chooser, plus the configurable `focus_sidebar_tabs` action bound to `leader t` by default.
- Create workspace side chats in the background, showing loading and failure states with `Enter` to retry and `Esc` to go back. Preserve opening prompts and avoid taking focus when the user has moved away.
- Retain inherited permission profiles and defer startup notifications until the side chat is registered on its owning backend.
- Quiet the parent composer while the chooser has focus and prevent completion popups or repeated activation keys from consuming chooser input.
## Testing
Extend tests and snapshots for loading and failure states, returning to an existing chat, draft preservation, inherited permissions, focus transitions, and deferred MCP startup notifications.
GitOrigin-RevId: 244bcd3f170819e2260f21dc1041cf8899fe048c
## What changed
- Expose `RequiredCyberAccessPrograms` so hosts can require an explicit allowed program on a thread. Snapshot the requirement before extension callbacks; hosts must reapply it on cold resume.
- Validate resolved `access_programs` before HTTP and WebSocket model requests, rejecting omitted or disallowed programs. Explicit `Standard` remains distinct from omission. Reject memory summarization and realtime requests when a requirement is present.
- Keep required programs scoped to the parent thread by preventing Guardian reviewers from inheriting its program, including Guardian v2 reviews.
## Testing
Add HTTP and WebSocket coverage for allowed programs, omission, disallowed programs, unsupported providers, and connection reuse. Extend Guardian tests to verify parent-only program scope and that removing the public attachment does not erase the startup snapshot.
GitOrigin-RevId: 9306a9af0e03e7a1728dfeb610cd7ec7517367fd
## What changed
- Select fresh authentication for each HTTP operation on eligible OpenAI MCP connections while preserving the connection's credential source and account network policy. Stop redirects when requests carry runtime assertions.
- Pass the owning thread's authentication and runtime context through app discovery, connector metadata, and trusted-access requests. Include the runtime authentication mode in MCP connection and tool-cache identities.
- Give resumed actors analytics clients bound to their own authentication context, and serialize stored-credential reloads with token refresh while preserving host-provided credentials.
## Testing
Add coverage for fresh request assertions, revoked account policies, redirect handling, resumed-actor isolation, and MCP uploads in dual-header and assertion-only modes.
GitOrigin-RevId: f06900a6db61cd6cf53c3aa8075afeec4d5706d9
## Why
Explicit cyber access program selections were dropped for requests using `CodexAuth::Headers`, preventing the server from evaluating the requested program.
## What changed
Forward explicit program selections for header-authenticated requests, leaving entitlement decisions to the server.
## Testing
Add integration tests covering explicit selections and omission over HTTP and a reused WebSocket connection, preservation of actor and account headers, and propagation of backend HTTP 403 denials without dropping the selected program.
GitOrigin-RevId: 5e549e87a1420ce8a5f1ce5c704cc6b7630af3ba
## What changed
Require the `openai` provider ID as well as `GuardianNativeMultiAgentHistory` to enable native agent history and review of multi-agent calls. Apply the same check to Guardian prompt construction, collaboration tool registration, and Guardian v2 configuration.
## Testing
Add coverage for fresh and resumed sessions with the feature enabled and disabled on OpenAI, and enabled on Bedrock and LiteLLM. Verify that only OpenAI sessions with the feature enabled request native review and include the agent call as evidence.
GitOrigin-RevId: bfbe547b0544e66763dca7d1e1376f805994bcb2
## What changed
Extend `guardian_review` to assess recorded MCP tool calls using the current tool catalog, bindings, and approval policy without executing the call or remembering an approval. Return no assessment when policy or a remembered approval skips review, and reject tools blocked by app configuration.
## Testing
Add a scenario test that compares direct and live MCP review inputs, verifies that neither dispatches the tool, and checks that the current app approval policy can skip review.
GitOrigin-RevId: 05746dd0804a0f96d7946468701d5222171ff64f
## Why
Multi-agent V2 still supplied native tool usage guidance when native tools were disabled, leaving instructions for unavailable tools in model requests.
## What changed
Skip bundled and model catalog role guidance for both root agents and subagents when `disable_native_tools` is enabled. Preserve explicitly configured usage hints.
## Testing
Add coverage for omitted bundled and catalog guidance and preserved configured hints with native tools disabled. Update the request snapshot and assert that spawned agents do not receive native tool call guidance.
GitOrigin-RevId: 6f2facabc95e78cbf64af19636a4daf488bbcc51
## What changed
Expose `AgentTurnOutcomeReporter` for hosts to install through `StartThreadOptions::thread_extension_init`. Await its callback after emitting the terminal turn event, independently of native parent notifications, so hosts can handle result delivery and retries.
Track outstanding outcome handoffs and wait for them during graceful shutdown before running thread-stop hooks. Prevent new turns from starting once handoff registration closes.
## Testing
Add integration coverage for completed and errored outcomes, turn lineage, queued follow-up turns, and shutdown waiting for handoffs. Extend Guardian tests to verify that strict safety stops reach the reporter while default interruptions remain silent.
GitOrigin-RevId: 0d825f6208f0250969734488881f32fd1dcd7509
Give each independent MCP server and session setup its own test identity
and timeout budget by replacing nested loops with `test_case::test_matrix`.
Preserve all 64 configuration combinations and the existing assertions for
direct tool exposure, tool search availability, and advertised tool calls.
GitOrigin-RevId: 74ef56d34b6bab3038b70d7d84183f7d104788a2
## What changed
When `features.guardian_denial_reconsideration` is enabled, retry the first terminal denial once using the unchanged inference request. Buffer provisional output so only the selected response enters reviewer history, while allowing tool calls to proceed normally.
Preserve the original denial if the retry fails or times out, and continue to honor cancellation. Account for token usage from both attempts, including failed reviews.
Remove `auto_review.experimental_denial_reconsideration_prompt` and warn when it remains in configuration.
## Testing
Update the Guardian scenario and snapshot to verify identical retry inputs, retained tool evidence, and reuse of the selected assessment in a subsequent review, with asynchronous compaction enabled.
GitOrigin-RevId: cc4e303d40a02acc824c8b4b954852325e64ad52
## Why
Guardian scoring and cached approvals need to use the requesting turn's captured policy even when the live thread configuration changes. Newly tightened mandatory review requirements must still prevent cached approvals.
## What changed
- Pass captured turn configuration through tool lifecycle and approval review inputs, and use it to resolve Guardian policy and classifier instructions.
- Apply current reviewer and model requirements before scoring and cached approval, including rechecking restrictions after collecting score authorization.
- Count computer-use JavaScript execution attempts even when background scoring is disabled, so a synchronous call consumes the initial-call allowance.
- Retain runtime configuration snapshots when applying agent role overrides, and share Guardian policy text resolution between configuration loading and runtime publication.
## Testing
Add and extend regression coverage for captured policy instructions, reviewer restrictions, stale cached evidence, and a synchronous computer-use call followed by an adaptive turn.
GitOrigin-RevId: 24ed4a1b6ce1733ad775790f30e440da614f9cd6
## Why
A Code Mode script can start a command without returning its session handle. Make retained sessions visible to the model so it can find running commands and collect exited results with `write_stdin`.
## What changed
- Add the disabled-by-default `command_sessions_world_state` feature.
- Publish snapshots of up to 16 retained sessions with their IDs, running or exited status, and whether they are in use. Report omitted sessions and suppress unchanged updates.
- Preserve session visibility when `write_stdin` is unavailable and refresh snapshots after compaction. Clear stale session handles after restart or when the feature is disabled.
## Testing
Add an end-to-end scenario and model-visible history snapshot covering a dropped command handle, unchanged state, unavailable polling, compaction, exit and result collection, and stale-handle cleanup after restart.
GitOrigin-RevId: 45704d8c6403149997231aafb8496c12879aff23
## What changed
Add the disabled-by-default `async_compaction_root_only` feature flag. When enabled, it restricts background compaction to root sessions, excluding non-root agents. Expose the flag in the configuration schema.
## Testing
Add a parameterized test covering root session eligibility and eligibility for review subagents and guardian sessions with the flag enabled and disabled.
GitOrigin-RevId: b4cce3f24f7f418ae61a82a7aef310f849cfd532
## What changed
Add configurable pane actions with default leader shortcuts:
- `leader z` zooms or restores the focused conversation pane.
- `leader ,`, `leader .`, and `leader =` minimize, maximize, or equalize pane widths within layout limits.
- `leader shift-h` and `leader shift-l` move the divider while the side pane has focus.
- `leader r` enters resize mode, highlighting the divider and showing keyboard hints. Arrow keys or `h`/`l` move it one column; Shift+Left/Right move it ten columns. Enter or Esc saves the width to `tui.sidebar_width_percent`.
Discard resize previews when terminal focus is lost or the split layout becomes unavailable. Preserve exact column widths at the current terminal size for presets and completed keyboard resizing, avoiding percentage-rounding drift.
## Testing
Extend TUI tests and snapshots to cover zoom and restore, width presets, divider movement, resize previews and persistence, and interrupted resizing. Extend keymap tests to cover zoom binding conflicts and custom chords.
GitOrigin-RevId: 7dd823fd8c2a0c90368c66f254c4fdd7c863c8a8
## What changed
- Share the harness runtime identity with analytics delivery and turn-cost queries, and resolve request authentication together with its account-bound transport policy.
- Add runtime authentication to ChatGPT request helpers and `codex cloud`, including environment discovery. Resolve environment credentials for each request and honor CLI configuration overrides when loading cloud authentication.
- Preserve custom-backend authentication, validate runtime destinations, and keep cloud requests from following redirects.
- Forward only organization and project selectors from model-provider headers to API-key analytics requests.
## Testing
Add regression coverage for runtime request signing, credential refresh, account and resource selection, redirect credential handling, custom destinations, and cloud credential-store overrides.
GitOrigin-RevId: 75f33961ee6482881e9ff9817e99d977f31b65b8
## What changed
- Use the shared runtime and effective configuration for account API clients and remote plugin requests, including standalone plugin commands.
- Support dual-header and assertion-only authentication for remote plugins and MCP file uploads when runtime agent instances are enabled.
- Keep plugin credentials and caches scoped to the thread's account when resuming with different credentials. Bind request pools and multi-step plugin storage operations to the selected account so account replacement revokes stale operations.
- Protect runtime credentials on cross-origin redirects while preserving configured routing policies and legacy authentication for custom backends.
- Apply server-provided `upload_headers` to file storage uploads.
## Testing
Add coverage for shared runtime registration, both authentication modes, configuration reloads, resumed-thread account selection, account replacement during plugin uploads and downloads, and credential stripping on redirects. Extend file upload tests to verify runtime assertions and storage-only upload headers.
GitOrigin-RevId: 68aef81051a6f9bf919fffda52f372b108fce805
## What changed
- Support `canonical_matching=True` in `prefix_rule` and `canonical_matching = true` in managed TOML prefix rules. Apply Unicode canonical caseless matching to every prefix token, including alternatives, while keeping exact matching as the default.
- Match case and canonically equivalent Unicode spellings, such as `bash` and `bAſh`, without resolving executables on the filesystem.
- Preserve managed restrictions when checking absolute-path rule amendments, and enforce applicable `host_executable` path allowlists during basename fallback.
## Testing
Add coverage for case folding, Unicode normalization, token alternatives, exact-match defaults, and host executable allowlists. Extend managed-policy and shell-execution tests to cover canonical matching.
GitOrigin-RevId: c2f79069dc38d55c77028c457b22beb468d5c571
## What changed
- Expose `AgentSessionReader` and `AgentRef` for read-only access to host-owned agent session membership.
- Read direct children when rendering V2 environment context, using the existing roster size limits. Refresh membership when rebuilding context after compaction, and omit the roster if the provider is absent or the read fails.
- Preserve unrecorded initial input across suspension or interruption while waiting for a roster read. Resolve the roster before advancing the compaction window.
## Testing
Add coverage for roster refreshes after compaction, unchanged environments avoiding extra reads, unavailable rosters, recoverable input during blocked reads, and stale compaction results rejected after a concurrent history replacement.
GitOrigin-RevId: 3c7e3822af09e9295d405e53dabb87b020c8f00c
## What changed
Add optional executor workspace roots to `SandboxTransformRequest` and resolve symbolic workspace rules after merging additional permissions. Preserve explicit deny rules and treat an empty root list as granting no workspace access.
Route Windows restricted-token preparation through the shared transform path and use explicit roots when building its direct-spawn wrapper. Update Windows MXC debug launches to bind configured roots before adding the managed CA read grant.
## Testing
Extend sandbox manager tests to cover workspace and subpath expansion, empty root lists, deny preservation, and the roots and write permissions serialized into the Windows wrapper.
GitOrigin-RevId: 0bebdb08b67cbbc182c18b031b9d13a21a799682
## What changed
- Allow dragging the pane divider and save the preferred width in `tui.sidebar_width_percent`, defaulting to one third of the terminal. Defer reflow until release when retained images are present.
- Support scrolling and loading older history in the unfocused pane, opening links, copying selections, and clicking its composer to switch focus while preserving the clicked text position.
- Keep assistant replies, running command completion, and turn status current in the unfocused pane without duplicating answers or completion metadata when focus returns.
## Testing
Add regression coverage for divider previews and saved widths, image-aware resizing, composer clicks, unfocused history pagination and copying, and streaming replies and command completion across focus changes.
GitOrigin-RevId: a26accc0f8df3c17f53bc915db29a11c8de3c480
## What changed
Accept an optional `_meta` object on `mcpServer/resource/read` and forward it to MCP `resources/read`, including reads bound to an originating tool call. Update the protocol schemas and generated TypeScript and Python types.
Reject caller metadata containing host-owned `threadId`, `x-codex-turn-metadata`, or `codex/connectionLease` keys. For `codex_apps`, also reserve `connector_id`, `link_id`, and `_codex_apps.resource_uri` to preserve app and account routing.
## Testing
Add integration coverage for metadata forwarding through stdio, hosted app reads with and without a thread, and origin-bound widget reads. Cover rejection of reserved keys and non-object metadata.
GitOrigin-RevId: 227ee0fb5fe15fa2ff2ec66d4d5ae16de8935a8c
## Why
An enabled legacy feature flag could prevent a project's `agents.enabled = true` from overriding a lower-priority legacy opt-out, leaving V1 agent tools unavailable.
## What changed
Only stop scanning configuration layers at an explicit legacy feature opt-out. Enabled flags now allow the scan to continue, so project opt-ins can override lower-priority opt-outs while same-layer and higher-priority opt-outs remain effective.
## Testing
Extend the model runtime selector regression test to cover enabled `features.collab` flags in project configuration and CLI overrides, and verify that explicit `false` values still disable V1 agent tools.
GitOrigin-RevId: ca3dcf9dc6a642eb72e20929776fb74379715053
## Why
An MCP server can belong to a different environment from the turn's primary environment. An early Guardian score based on the issuing context must not bypass review when the server owner's permissions differ.
## What changed
- Capture the owning environment's permissions when preparing an MCP call and retain them for server-initiated approvals tied to that still-running call.
- Use the captured permissions consistently in Guardian review prompts and permission context.
- Require a fresh synchronous review when the captured owner permissions do not match the early score's authorization.
## Testing
Extend regression coverage for MCP score reuse across environments and for follow-up approvals from a local MCP server during a remote-primary turn. Assert that reviews use the owner's denied paths and require a fresh review when permissions differ.
GitOrigin-RevId: eb5eeb1259732c57f39765c38e34148fa0787dae
## What changed
- Add `direct_only_tool_namespaces` to `TurnStartOptions`. Omission inherits the thread configuration; an empty list clears direct-only routing for that turn. Steering ignores the option.
- Persist explicit overrides in turn context and restore them when recovering an interrupted turn, including turns started by standalone tool output.
- Keep subsequent turns and spawned or resumed child agents on the thread's routing defaults.
## Testing
Add coverage for routing changes across turns in Responses and Responses Lite, recovery without carrying overrides into subsequent turns, and child-agent inheritance.
GitOrigin-RevId: cea1a997424572d4cd372cd15b098626904c6796
## What changed
- Expose `PromptCacheTtl` through `TurnStartOptions` and `RecoverTurnRequest`, supporting `30m` and `12h` minimum cache lifetimes.
- Carry the selected TTL through turn execution and compaction into `prompt_cache_options.ttl` on Responses HTTP and WebSocket requests. Omit the field when unset and keep the selection scoped to the turn.
- Include prompt cache options in WebSocket request reuse checks.
## Testing
Add coverage for both TTL values and omission on a subsequent turn without an override, and extend WebSocket serialization coverage to include prompt cache options.
GitOrigin-RevId: 8529306e6ad6030fe77c5e6bf19f3810717c0c5e
## Why
Saved `features.multi_agent = false` settings can be overridden by a higher-precedence session setting. Session telemetry should retain visibility into those saved opt-outs.
## What changed
Add `config.legacy_multi_agent_disabled_sources` to `codex.conversation_starts`, reporting opt-outs from user configuration, project configuration, and managed requirements. Emit comma-separated source labels, or `none` when no opt-outs are found.
## Testing
Add a regression test confirming that a user opt-out is still reported when a CLI override enables multi-agent support for the session.
GitOrigin-RevId: 488bd317d67e9ee87c5903ae51f466e0a63c05eb
## Why
Migrating a project's multi-agent setting to `[agents] enabled = true` should preserve access to agent tools when a lower-priority config still sets `features.multi_agent = false`.
## What changed
Allow an explicit project agent opt-in to override a strictly lower-priority legacy feature setting. Preserve legacy feature settings in the same or higher-priority layer, and continue enforcing managed feature requirements.
## Testing
Add regression coverage for project migration, V1 and model-selected V2 tools, same-layer and CLI opt-outs, and enterprise requirements that disable multi-agent tools.
GitOrigin-RevId: 5810a42d4b7e66cdcbef8dad5281dda4a66291b3
## What changed
Extract argument parsing and approval policy selection into helpers. Separate
approval requirement evaluation and action construction from requesting approval,
with explicit states for approvals that are unnecessary, remembered, or required.
GitOrigin-RevId: 822cda972f9e0d12286ec833dfbe11b47b4c0ec8
## Why
Core tests depend on `codex-app-server` to install and clean up agent message boards. A dedicated host crate lets them use this functionality without depending on the app server.
## What changed
Move the existing host implementation into `codex-agent-message-board-host` and update core test helpers and scenarios to use it directly. Keep the installation and deletion functions re-exported from `codex-app-server`.
GitOrigin-RevId: 9ed62d50a5f31c70550d70ba3c583399e869168a
## What changed
Add `user_input_extension_data` to `TurnInputRequest` and carry it with each queued user input through completion, including inputs that steer an active turn. Expose the data to lifecycle contributors through `on_item_completed_with_metadata`, whose default implementation forwards to `on_item_completed` for compatibility. Keep this data out of model input and preserve the existing serialized input shape when no extension data is present.
## Testing
Add serialization round-trip coverage and extend the concurrent submission test to verify that inputs sharing a client ID retain their own metadata, report completion in the accepting turn, and omit extension data from model requests.
GitOrigin-RevId: f880cf812994a030cb1be9418280ba69e2885808
## What changed
Honor `features.daemon_auto_start` as a stable, default-enabled setting instead of ignoring it with a deprecation warning. Apply it to interactive daemon auto-start and remote-control daemon eligibility, and accept it in managed feature requirements.
Preserve explicit `false` values when saving the setting, even when the server reports a disabled default. Record the setting and disabled auto-start outcomes in launch telemetry.
## Testing
Update coverage for restarting a discovered daemon with auto-start disabled and for persisting an explicit opt-out when the server default is disabled. Adjust embedded-backend tests to disable auto-start through configuration.
GitOrigin-RevId: cbf079e3e27b4a7e6e802bf8f19dae653dd7472c
## Why
Project instructions could be truncated or skipped when the byte budget ran out without a user-facing warning.
## What changed
- Report truncated files and skipped files or environments, with guidance to trim instructions or increase `project_doc_max_bytes`.
- Warn when combined instructions exceed the configured budget, clarifying that global and thread instructions contribute to the total but the limit applies only to project files.
- Refresh cached project instructions when `project_doc_max_bytes` changes.
## Testing
Add warning snapshots for truncated files, skipped files and environments, and combined instructions exceeding the budget.
GitOrigin-RevId: 121eebb8ac8891decada2d028c194aa687815466
jif