## Why
Thread settings could replace an owner-provided environment configuration with
`FromThread`, allowing the thread to take ownership of that configuration.
## What changed
Reject environment settings updates that change an existing owner-provided
configuration to `FromThread`.
## Testing
Cover preview and turn settings updates for pending, ready, and failed
owner-provided environments.
GitOrigin-RevId: c516954819447ceb29e2ff9f29fe781ca101ae54
## What changed
- Add a dedicated developer policy for Guardian reviews of Node REPL browser and computer-use actions.
- Inject the policy once before the first eligible Node REPL approval and retain it when the reviewer session is reused.
- Include Node REPL policy eligibility in the reviewer reuse key so sessions are not reused across incompatible model settings.
- Keep the approval request itself on the generic planned-action format.
## Testing
- Cover first-action injection, reuse after a shell review, repeated Node REPL reviews, and ineligible parent models through the production approval path.
GitOrigin-RevId: bfce190ff8599788aa85e388cc6a959d27fb489c
## Why
A stored permission grant may allow access to a parent while explicitly denying
a child path. A later request for that child must not be treated as already
approved by the broader parent grant.
## What changed
- Compare materialized permission profiles without intersecting away denied or
reopened paths before deciding that a request is preapproved.
- Execute preapproved commands with the stored grant itself so its denied paths
remain enforced.
- Fail closed when permission profiles cannot be materialized.
## Testing
Added unit and integration coverage for turn and session grants across
`exec_command`, `shell_command`, and `apply_patch`, including approval-disabled
and `Never` approval modes.
GitOrigin-RevId: 5455880328a89c7958f859c7ce87805dff9704fb
## What changed
- Reconnect frameless bidirectional WebRTC sideband sockets after unexpected transport loss with capped exponential backoff.
- Preserve pending text or handoff output and bounded transcript state across reconnects.
- Treat `404 Not Found` and `410 Gone` handshake responses as terminal session completion, and preserve HTTP status information from failed WebSocket handshakes.
- Bound Realtime delegation input and transcript fields while retaining the most relevant portion of each.
## Testing
- Add unit coverage for reconnect backoff, terminal status handling, transport error classification, transcript continuity and truncation, and pending outbound messages.
- Add an end-to-end WebRTC conversation test covering an unclean disconnect, reconnect, transcript reconciliation, outbound progress during sustained inbound traffic, and terminal session completion.
GitOrigin-RevId: 544fd7e542c3434d0bb42cfbcc7143604419a037
## What changed
- Add an optional `connectorId` to `mcpServer/resource/read`.
- Forward the selected connector through `x-codex-turn-metadata` for threaded and threadless resource reads, restricting hosted app resources to that connector.
- Update the generated protocol schemas and app-server documentation.
GitOrigin-RevId: 5cc94d703abbbb6086665910c1c9ed5dc7075210
## Why
`node_repl` screenshots are nested tool results and do not appear in the parent
conversation history, so Guardian v2 transcript image collection could miss
them.
## What changed
- Allow Guardian v2 to enable bounded, thread-scoped `node_repl` image capture
when transcript images are configured.
- Add retained `node_repl` screenshots to review requests when transcript
sources include tool outputs, while deduplicating images and keeping them out
of the parent turn input.
## Testing
- Add an integration test covering screenshot capture without the synchronous
Guardian transcript feature flags and verifying that screenshots stay out of
the parent request.
GitOrigin-RevId: 5f70c5f2e80389aa8b2a286c3b7f9b1104865486
## What changed
- Pass metrics bound to the active turn's model to approval-review contributors.
- Add counter support to `ExtensionMetrics` while preserving host session attribution.
- Record Guardian v2 tool-call score lag and count stale-score fallbacks with the `score_lag` reason.
## Testing
- Cover counter forwarding and session metadata tags.
- Verify Guardian v2 metric samples for current and stale scores.
GitOrigin-RevId: 0ec34736d29d2e37ed217a27e773b4f6230ae38a
## Why
Custom model providers that do not require OpenAI authentication could inherit
ambient authentication headers, including the bearer token and
`ChatGPT-Account-ID`, and send them to the custom provider endpoint.
## What changed
- Resolve providers without `requires_openai_auth` or configured `auth` as
unauthenticated.
- Continue to honor an explicit `experimental_bearer_token` or command-resolved
provider authentication.
- Preserve ambient authentication for OpenAI providers.
## Testing
Added unit and request-level coverage for custom, explicitly authenticated, and
OpenAI provider authentication behavior.
GitOrigin-RevId: d89a79604338bc660a3edb2af0068cfa9b694fa2
## What changed
- Exclude descendant-authored `MESSAGE` progress updates from the history retained after remote compaction v2.
- Continue retaining descendant-authored tasks while omitting progress updates and final answers from subsequent requests.
## Testing
- Extend the remote compaction follow-up test to cover descendant progress updates and descendant-authored tasks.
GitOrigin-RevId: 3e3e60bb108d27e99e2a4c222eed4b9d02fd3829
## Why
Collaboration guidance can change without changing the active mode or model, such as after a model catalog refresh. Tracking only the mode and model leaves the earlier guidance in retained history.
## What changed
- Include a hash of the rendered collaboration instructions in the world-state snapshot so changed guidance is appended to retained history once.
- Emit one empty collaboration fragment when guidance is removed, preventing stale instructions from remaining active without repeatedly clearing them.
- Refresh legacy snapshots that lack an instruction hash once on resume.
## Testing
Cover same-mode catalog updates, clearing missing or explicitly empty guidance, retained-history behavior, and cold resume from legacy snapshots.
GitOrigin-RevId: 69f690adeccd1fb9794a6b15647e6efae3fec4f6
## Why
Tree-sitter can represent brace expansions, globs, and escaped text as plain
words even though the shell changes them at runtime. Treating their source text
as literal argv could let a command match a safe-command check or allow rule
that does not match what will actually execute.
## What changed
- Reject unquoted Bash and Zsh words containing expansion, glob, or escape
syntax from literal command parsing, including heredoc command prefixes.
- Reject double-quoted escape sequences that the shell removes or interprets,
while continuing to accept quoted metacharacters that remain literal.
- Require approval for affected commands under `UnlessTrusted`, even when a
policy contains an allow rule for the unexpanded source text.
## Testing
Add parser and approval scenarios covering brace expansion, globs, escapes,
Zsh-specific syntax, heredocs, and quoted literals.
GitOrigin-RevId: 31f2c6062680c42ac65362e3f3eebfaaf4eb71da
## What changed
- Add the optional `active_permission_profile` field to `TurnContextItem` to record the built-in or named profile that produced the effective permission profile.
- Populate the field when serializing a turn context while preserving compatibility with records where it is absent.
## Testing
- Add coverage verifying that turn-context serialization stores the active permission profile.
GitOrigin-RevId: d69142ab1b26595ab406235f89818ef41370e963
## What changed
- Fetch recommendations from the Codex-specific `/ps/plugins/suggested/codex` endpoint and parse its compact response shape.
- Fetch the selected plugin's details before presenting an install request, using them to verify availability and populate connector metadata.
- Skip install elicitation when the selected recommendation is no longer available, and return a retryable response when its metadata cannot be verified.
## Testing
- Cover the new recommendation route and response shape.
- Cover metadata hydration for available plugins and rejection of unavailable plugins.
GitOrigin-RevId: 2b0e2d70572aae2b7cd8e458b42e9dd14be3dbaf
## Why
Dangerous-command inspection has a bounded wrapper depth. Returning no match
after that limit could let a nested dangerous payload escape policy detection.
## What changed
- Classify commands beyond the wrapper-depth limit as dangerous.
- Cover the boundary and overflow cases in the command-safety unit tests.
- Verify that exec policy rejects a deeply `env`-wrapped forced `rm` before it
can delete a sentinel file when approvals are disabled.
GitOrigin-RevId: a6cdbbb7bdc6274a62745f668189fabaaf46745f
## What changed
- Give `PluginsManager` a shared `AuthManager` instead of a separately mutable authentication-mode snapshot.
- Read the current authentication mode and credentials from that shared manager for plugin discovery, startup tasks, CLI commands, MCP setup, and external-agent migration.
- Update test helpers and coverage to exercise plugin projections and curated marketplace selection as authentication changes.
GitOrigin-RevId: 600c94de5130eda2da5727e1a0b4d39083fefc56
## Why
Filesystem permission paths can use a convention that differs from the host
running Codex. Converting them immediately to native absolute paths can change
the meaning of ambiguous paths such as `/C:/secret` or Windows UNC paths.
## What changed
- Store literal filesystem permission paths as `PathUri` values through the
runtime policy and execution protocol.
- Keep legacy string-based serialization at explicit protocol boundaries and
reject conversions that cannot be represented losslessly.
- Encode native paths as opaque URIs when a normal file URI would imply the
wrong path convention.
## Testing
Added coverage for cross-platform and ambiguous path round trips, UNC path
variants, permission-profile serialization, and deny-policy enforcement.
GitOrigin-RevId: 5247713796d1f2bb4e02f94eb9fc82d4698060f0
## Why
Image generation did not save its result when the extension host did not provide a host-local save root.
## What changed
- Save generated images under the turn environment's `generated_images` directory through its sandboxed filesystem executor when no host save root is configured.
- Limit executor-written images to 32 MiB, reject symlinked output directories and existing destinations, and continue returning the image if persistence fails.
- Include the saved workspace path in the tool output hint while preserving host-managed persistence when a save root is available.
## Testing
- Extend the granted-turn-permissions integration test to verify the image and path hint are written to the turn workspace without creating a host-local artifact.
GitOrigin-RevId: 3d24381a75fe4595641b5250e19fac8ed473b2cd
## What changed
- Add `EnvironmentNetworkPolicy` as a serializable view of portable domain,
Unix-socket, upstream-proxy, and local-binding restrictions without exposing
controller-owned proxy runtime settings.
- Add an optional `network_policy` field to `EnvironmentConfig` and re-export
the policy and related permission types through the core APIs.
- Reject owner-provided network policies during environment preview and
readiness until runtime enforcement is implemented, while preserving the
existing controller policy when the field is absent.
## Testing
- Cover rejection through both environment preview and readiness, including
preservation of the existing environment selection.
GitOrigin-RevId: 80ad4cf4d4a45632daa7a823e6cf568eb0e8bb80
## Why
Unified exec could drop network approval registration when a selected environment used a Windows working directory on a non-Windows host because the trigger path could not be converted to a host absolute path.
## What changed
- Keep network approval trigger working directories as `PathUri` values and render them with their inferred native path syntax for Guardian requests.
- Fall back to the selected turn environment only when a trigger path can be converted to a host absolute path.
- Reject selected environment working directories larger than 8 KiB at the thread-manager validation boundary.
## Testing
- Cover managed-network approval registration for a foreign Windows working directory.
- Verify that oversized working directories are rejected as invalid `thread/start` requests.
GitOrigin-RevId: 646fbf12115a35a7e5cb04b511464797bee6647b
## Why
Guardian V2 should not override a managed approval-reviewer policy that excludes
the user reviewer.
## What changed
- Force `features.guardianv2` off when `allowed_approvals_reviewers` does not
include `user`, for both local requirements and cloud config bundles.
- Preserve Guardian V2 when the user reviewer remains allowed or when only
legacy Guardian feature settings are present.
- Return the effective disabled value through `config/read`.
## Testing
Added coverage for cloud requirements and the app-server config RPC.
GitOrigin-RevId: 82b6d0aaf47fbaa58ae349d4e56777cd442f5807
## What changed
- Add optional `guardian_v2` model-message defaults for classifier instructions,
review thresholds, reasoning effort, transcript selection and limits, and
action and compaction token limits.
- Apply those defaults when Guardian v2 samples a tool call, while preserving
explicit `[features.guardianv2]` settings over catalog values.
- Preserve the new catalog configuration when applying model overrides.
## Testing
- Cover model-catalog serialization and model override behavior.
- Verify that sampling uses catalog defaults while retaining local overrides.
GitOrigin-RevId: 4ae9ec235c647acbca05a20b7c4b87a4e1331161
## What changed
- Add `[skills].max_context_tokens` to override the token budget used to render the available-skills catalog.
- Require a positive value and cap configured budgets at 10,000 tokens.
- Preserve the existing default of 2% of the model context window when the option is unset.
## Testing
- Cover configuration parsing, override behavior, the 10,000-token cap, and catalog rendering within the configured budget.
GitOrigin-RevId: f29ddcb57fc2d800c0006d03e1c33cbe3ab6272d
## What changed
- Add an optional restrictive execution policy to `EnvironmentConfig` and merge it over the active command policy for shell execution and approval decisions.
- Reject environment policies that contain allow rules, so environment configuration can only tighten command access.
- Include the environment policy fingerprint in cached approval keys so policy changes require fresh session approvals.
## Testing
- Cover restrictions overriding saved prefix approvals, policy changes invalidating session approvals, and environment overlays remaining effective when model-specific prefix filtering is active.
GitOrigin-RevId: e94f877549ed5e0f577b8cb52f3c1872c58f029d
## Why
`CODEX_EXEC_SERVER_NOISE_AUTH_TOKEN` is an execution-server credential and
must not be exposed to model-reachable commands or command hooks, including
when shell environment policy explicitly sets a case variant of the name.
## What changed
- Add `CODEX_EXEC_SERVER_NOISE_AUTH_TOKEN` to the shared list of
non-inheritable environment variables.
- Keep the environment variable constant in `codex-protocol` so the exec
server and environment scrubber use the same definition.
- Verify case-insensitive removal after policy overrides for shell commands
and command hooks.
GitOrigin-RevId: 759b224b6a7fb4f56f7b1a6d94ffbb0b188c658f
## What changed
- Carry `ShellEnvironmentPolicy` in each resolved `EnvironmentConfig` and use
the selected turn environment's policy for shell commands, user shell tasks,
and unified exec.
- Infer the policy from the thread configuration when an environment does not
provide its own resolved configuration.
- Redact the policy from `EnvironmentConfig` debug output because it can contain
explicit environment variable values.
## Testing
- Verify shell handlers and unified exec filter inherited variables according
to the selected environment while preserving its explicit overrides.
GitOrigin-RevId: 9f6a52aa4af60e5f17251a0e1b11e1926b779055
## Why
Callers need to associate host-owned state with a thread before Core starts it.
## What changed
- Add `ThreadManager::reserve_thread_id` and allow new threads to start with the reserved ID. Reject reserved IDs when resuming an existing thread.
- Let thread stores stage metadata for a reserved ID. The local store merges staged values into the first successful metadata update and then removes them.
- Clear staged metadata when an unmaterialized thread shuts down or is discarded, and require the state database for staging.
## Testing
- Cover reserved ID generation and resume validation.
- Cover metadata persistence, merging, rollout-compatible updates, cleanup, and invalid staging requests.
GitOrigin-RevId: 3f9bc48f0f7764011cc90ea01349e497dda0a9e3
## Why
Thread settings can change while a turn is still active, including between sampling requests. Those updates should apply to the next turn instead of changing the model configuration partway through the current turn.
## What changed
- Snapshot the model, reasoning settings, service tier, approval settings, and model-attributed telemetry in `StepContext`.
- Build prompts, model requests, world state, tracing, and startup prewarms from that step-scoped snapshot.
- Share immutable model metadata between turn and step contexts.
## Testing
Added an integration test that pauses an active turn, updates its thread settings, and verifies that all requests in the active turn retain the original settings while the next turn uses the updates.
GitOrigin-RevId: c51352218e463dcc9b7338566d16742292c49fbf
## What changed
- Represent `request_permissions` calls as shared approval actions and convert them into Guardian permission requests through the common approval path.
- Preserve turn cancellation while an automatic permission review is pending.
- Cover Guardian allow and deny decisions, cancellation without a user-approval fallback, and clean follow-up turns.
GitOrigin-RevId: 95d0df0288e232f32b162756aa7d64a30df7efa5
## Why
An environment connection can be available before its owner has supplied the
configuration for a particular thread attachment. Threads need to start without
blocking while ensuring turns do not use that attachment prematurely.
## What changed
- Accept `Pending` environment configuration and resolve each attachment only
after both its shared executor connection and owner configuration are ready.
- Add a `Failed` configuration state and `environment_failed` callback so an
owner can fail one thread's attachment without affecting other threads.
- Keep pending and failed attachments out of capability-root inspection and turn
environments, and allow failed attachments to recover through a ready update.
- Apply owner configuration before waking a waiting turn so its permission
profile, login-shell policy, capability roots, and tools are immediately
consistent.
## Testing
Add an integration test covering non-blocking thread startup, independent ready
and failed callbacks, waiting-turn resumption, installed capability and tool
configuration, and recovery from failure.
GitOrigin-RevId: d587e2025d584c867d782d470b18bf5a1a27b76c
## Why
Responses WebSocket fallback is session-scoped. A delegated session created
after its parent switched to HTTP could otherwise make another WebSocket
connection attempt.
## What changed
Disable WebSocket support for a delegated session when the parent session has
already fallen back to HTTP.
## Testing
Add a guardian review regression test that verifies only the parent's initial
WebSocket attempt occurs and the guardian request uses the HTTP response path.
GitOrigin-RevId: 1345f8fe739f55975aef432045348eae5a9278d6
## Why
Environment attachments can either inherit configuration from their thread or
provide their own. Later thread setting updates must refresh inherited
configuration without overwriting attachment-owned permissions and capability
roots.
## What changed
- Resolve each attachment's configuration when it is selected and retain
whether it came from the thread or the attachment owner.
- Apply subsequent thread configuration updates only to thread-owned
attachments, while preserving ownership across snapshots and child threads.
- Keep the resolved configuration with the environment selection so runtime
consumers use a single canonical value.
## Testing
- Extend remote-environment coverage to verify that thread-owned permissions
follow thread updates while owner-provided read-only permissions remain in
effect.
- Cover configuration inheritance, attachment replacement, and owner-configured
capability roots.
GitOrigin-RevId: fe70c4be5f151432b69bf4b141e316faa89036ae
## What changed
- Add a resolved `permission_profile` to each `EnvironmentConfig` and use the
complete attachment config for execution and capability-root selection.
- Let `Ready` environment configurations override thread permissions while
`FromThread` selections continue to inherit them.
- Restrict inherited Guardian environment profiles to read-only permissions.
## Testing
- Add coverage proving that a read-only environment blocks writes even when
the thread permits workspace writes.
- Update environment inheritance, Guardian review, and capability-root tests
for the resolved attachment configuration.
GitOrigin-RevId: 1a313b9e4892b1a579a0e880e322a782b4f6c0a7
## Why
Code Mode rendered document-local `$ref` values as `unknown`, hiding referenced
input and structured-output shapes from generated TypeScript declarations.
## What changed
- Resolve fragment-only JSON Pointer references against the root schema,
including escaped and percent-encoded pointer segments.
- Preserve `$ref` siblings as intersections and parenthesize unions used in
`allOf` intersections.
- Bound recursive and repeated expansion, intermediate rendering work, and
final output size, falling back to `unknown` when a limit is reached or a
reference cannot be resolved safely.
## Testing
Add unit coverage for recursive, escaped, nested-resource, dangling, and
oversized references, plus integration coverage for generated Code Mode tool
descriptions and MCP structured output types.
GitOrigin-RevId: 95c6aa32e25325b5be9359dfac3b3328e5e7a499
## Why
Windows sandbox requests must preserve managed filesystem deny rules across every execution path and setup refresh. Unsupported policies should fail closed instead of allowing a command to run without the requested protection.
## What changed
- Resolve Windows filesystem overrides while constructing each sandbox execution request so both `shell_command` and `exec_command` enforce exact-path and glob deny-read entries.
- Carry resolved deny-read paths into Windows sandbox setup refreshes, including workspace-relative entries.
- Reject unelevated restricted-token requests that cannot enforce deny-read rules.
- Reject recursive globs rooted at a filesystem root unless `glob_scan_max_depth` bounds their expansion.
## Testing
Added coverage for deny-read enforcement through both command runtimes, setup refresh resolution, restricted-token failure, and bounded root-level glob scans.
GitOrigin-RevId: 33dfa4d1a45b14850cbf58f9173717e3e707d9bf
## What changed
- Enable the stable `unified_exec` feature by default on every platform.
- Update cross-platform integration test expectations so `exec_command` and
`write_stdin` are exposed on Windows instead of `shell_command`.
GitOrigin-RevId: e5c864bacbde7eab109e7a0e399b8f7b843b384c
## What changed
Keep MCP namespace descriptions when publishing tool definitions to the
process-scoped catalog cache. Cached definitions now expose the server
instructions to the model before a lazily started MCP connection finishes
initializing.
## Testing
Update the cached MCP startup integration test to verify that cached namespace
descriptions retain the originating server instructions.
GitOrigin-RevId: d1b73381852fd43c6b54a7c22a599474c774dc20
## What changed
- Add model-catalog messages for root and subagent roles, explicit delegation, and delegation hints.
- Resolve role instructions in config, catalog, then bundled-default order, while preserving empty values as an explicit way to suppress fallback text.
- Refresh catalog-provided role and mode instructions when the model changes, and give full-history forks the selected child model's subagent role without retaining the parent's role guidance.
- Keep existing config overrides and reasoning-effort behavior, including proactive delegation for ultra reasoning effort.
## Testing
- Cover message deserialization and preservation through model overrides.
- Cover precedence, empty overrides, model switches, resumed sessions, and full-history subagent forks.
GitOrigin-RevId: 4625cf7c6a5490176adddfaa0fb99100707daea9
## What changed
- Start Guardian reviewer delegates with an empty extension registry while preserving extension inheritance for other delegates.
- Disable `GuardianV2` in the reviewer session configuration so reviews do not trigger nested Guardian processing.
- Cover both the reviewer isolation and continued delivery of parent-session tool lifecycle events.
GitOrigin-RevId: 858b3e23d1c06177e443fb0779fcf06cc5294fc2
## What changed
- Give approval review contributors the first opportunity to resolve an action when automatic review is not required for the model.
- Return an extension's decision directly and fall back to Guardian when no extension claims the review.
- Update Guardian V2 to approve actions below its risk threshold through the review contributor API, and remove the extension approval-policy API.
## Testing
- Verify that an extension approval bypasses both the Guardian model call and the user approval prompt.
- Cover Guardian V2 review decisions for low-risk, high-risk, and disabled threads.
GitOrigin-RevId: 5be56941143aff6f358b75b5f8101b7c047147ae
## What changed
- Add a thread-scoped extension API for requesting automatic review, resolving
multiple contributors to the strongest requirement.
- Have Guardian v2 request automatic review when it is enabled and the latest
`action_risk` score is at least `0.8`.
- Honor extension review requirements across tool approvals, MCP elicitation,
and remote execution while preserving host configuration and managed-policy
constraints.
## Testing
- Cover contributor registration and requirement resolution.
- Verify Guardian v2 requests review at the threshold, returns to the default
below it, and does not affect threads where the extension is disabled.
- Exercise extension-requested strict review with a remote model override.
GitOrigin-RevId: 6329fc23585d5cc7173c39bb9952c3109ec3884b
## What changed
- Invoke `ToolLifecycleContributor::on_tool_start` only after pre-tool hooks
have finalized the invocation.
- Pass hook-rewritten arguments and the post-hook conversation snapshot to the
callback.
- Skip the start callback when a hook denies execution or supplies input that
cannot be applied.
## Testing
Add lifecycle tests covering rewritten input, hook-added context, denied tool
calls, and invalid rewritten input.
GitOrigin-RevId: 936efaf4a8c35321f9982ff2a33bb8bece1ebf39
## What changed
- Add `EnvironmentConfigState` to `TurnEnvironmentSelection` so each environment attachment can inherit thread configuration or carry ready configuration for its login-shell policy and selected capability roots.
- Apply ready configuration during thread creation and thread-settings updates while reusing the existing environment connection.
- Validate selection configuration before applying settings, rejecting unsupported pending state and invalid capability roots.
## Testing
- Cover attachment-scoped capability roots, ready configuration at thread startup and turn updates, and rejection of invalid selections without changing existing settings.
GitOrigin-RevId: 86cf8f2148fdaa746ea0dd12890ab7b1577d7587
## What changed
- Set `parallel_tool_calls` for regular and remote compaction prompts without consulting model metadata.
- Remove `supports_parallel_tool_calls` from `ModelInfo`, the bundled model catalog, and related fixtures.
- Preserve the existing Responses Lite behavior that disables parallel tool calls at request construction.
GitOrigin-RevId: 49552bdf97e71fa57325abb49f8adc0c88f1401a
## Why
MCP runtime reconciliation can occur while an unchanged server is still
starting, such as when capability roots become available. Reconciliation
should neither wait for that startup nor initialize the same server again.
## What changed
- Reuse an active, uncancelled pending MCP connection when its identity,
catalog limit, and protocol mode still match.
- Publish the shared startup result through the reconciled server view while
applying its updated tool filter.
- Preserve cancellation when a reused pending server is subsequently removed.
## Testing
Added coverage for filtered-tool publication, disabling a reused pending
server, and capability-root reconciliation during Codex Apps startup.
GitOrigin-RevId: 690cf8695e75b341d097d7d22b5da6993b24e787
## What changed
- Route MCP tool calls through the automatic reviewer when strict auto-review is enabled, even when the approval policy, tool annotations, or a remembered session decision would otherwise skip review.
- Pass the strict auto-review flag into the MCP approval request so reviewer selection follows the turn setting.
- Update MCP approval and turn-metadata tests to cover the forced review path and confirm that it does not request user input.
GitOrigin-RevId: 2c0b5f4dc1a15cb2fb827e4b21e69167fdcf3e56
## What changed
- When an explicitly selected plugin has apps available, instruct the model to use `tool_search` to discover relevant tools before falling back to unrelated or built-in tools.
- Scope the guidance to the request that selected the plugin and omit it for plugins without available apps.
## Testing
- Cover app-specific rendering, non-app plugins, bounded instruction output, and app enablement in dual-surface plugin requests.
GitOrigin-RevId: 1b9501cc403d2817334a9307e683e99c140a794a
## What changed
- Add the canonical agent path as `agent_name` in Responses API turn metadata.
- Fall back to `/root` when a session has no canonical agent path.
- Reserve `agent_name` from client metadata overrides and omit it from MCP request metadata.
## Testing
- Cover root, named subagent, legacy subagent, MCP, and client metadata merge cases.
GitOrigin-RevId: a9adcc079a51beae7d621aba24bcd759ceaa408e
## What changed
- Add the built-in `amazon-bedrock-runtime` provider for regional
`bedrock-runtime` OpenAI-compatible endpoints.
- Use endpoint-specific SigV4 service configuration while preserving bearer
token auth and per-provider AWS profile, region, and transport overrides.
- Provide global and US cross-region GPT-5.6 model variants, prefer global
routing for fallback and background tasks, and disable unsupported web search.
## Testing
- Cover provider configuration and capabilities, endpoint and auth selection,
runtime catalog ordering, model fallback, and web search omission.
GitOrigin-RevId: d158ab74a5768e1b4c61063365a0c06735313322
## What changed
- Preserve valid image content from completed `node_repl` Code Mode responses alongside text evidence for Guardian reviews.
- Enable multimodal evidence for models that require automatic `node_repl` review, or when both `guardian_enhanced_node_repl_transcripts` and `guardian_node_repl_transcript_images` are enabled.
- Bound retained and rendered evidence, deduplicate images already present in review history, and fall back to text-only evidence when the reviewer lacks image support or prompt capacity.
- Keep review evidence out of the parent turn input.
## Testing
- Cover feature gating, mixed text and image ordering, truncation and eviction, unsupported reviewers, prompt pressure, image detail normalization, and reused review sessions.
GitOrigin-RevId: a3e482402f7b3484401b231dadc662e6e3504fdf
