## What changed
Export `ElasticBudgetConfig`, named `ElasticSection` groups, and validated `ElasticSectionLimits` for optional evidence. Each group can specify a minimum token reservation and a per-entry text cap.
Validate limits during construction and deserialization: both values must be positive, and the entry cap must fit within the minimum reservation and the existing text-part delivery allowance. Reject unknown configuration fields.
This adds configuration types only; elastic allocation is not activated.
## Testing
Add a serialization round-trip test and deserialization checks for zero limits, entry caps above the minimum reservation, and entry caps above the delivery allowance.
GitOrigin-RevId: c869018cfc0d96377b1adbfbdd98e1d88bd1b32a
Register `incremental_exec_tools` as an under-development feature, disabled
by default, and expose it in the configuration schema.
GitOrigin-RevId: 444767b7a46e3ada7efb3f6c4fb570feb299e0c7
## What changed
Move the model client's request-preparation loop into the shared `prepare_provider_request` helper and add `RequestAuthChange` to classify auth state changes. For managed auth, retry preparation when credentials change and reject account changes, including when the provider starts or stops exposing an auth manager during setup.
Capture the auth owner and credential generations together and pass them into the preparation callback so the resulting client setup records the state used for that attempt.
## Testing
Add a test verifying that an explicit provider bearer token survives a workspace switch during setup without retrying preparation.
GitOrigin-RevId: ed8710d1c344b48ebf6182e25e6269214dd2d3fe
## What changed
Expose `thread/guardianReview` to review an idle thread's final injected `exec_command` without executing it. Return the call ID and Guardian assessment, or `null` for the assessment when exec policy skips approval.
Subscribe the requesting connection to the thread, enforce input and model-provider restrictions, and cancel an in-flight review when the connection disconnects so the thread is released promptly.
## Testing
Add integration coverage for assessment responses, policy-skipped reviews, model-provider enforcement, and WebSocket disconnect cancellation.
GitOrigin-RevId: e8ad5598e8f101a937447ebe26136310bb76c8d1
## Why
`libz-sys` 1.1.29 is pulled in through `curl-sys`/`curl` in `codex-http-client` only on Windows, where it skips the affected probe. The lockfile also pins `cc` to 1.2.55, below 1.6.0.
## What changed
Add `RUSTSEC-2026-0418` to the `cargo-audit` and `cargo-deny` ignore lists with the rationale. Remove the exception when `libz-sys` reaches 1.1.31 or later, and reassess if it is used on Unix with `cc` 1.6.0 or later.
GitOrigin-RevId: 0e2ffb4686d9c77dfd7f1312aef6a093a803f832
Use `gpt-6-luna` for memory extraction and `gpt-6.1-terra` for memory
consolidation when the provider does not require a backend-specific model ID.
GitOrigin-RevId: 51419103b090d66af21e092983658da1285f6660
## Why
The schema exporter sits on application builds' critical path, but compiling it as a test harness also compiles and registers unit tests that schema generation does not need.
## What changed
Build the exporter with `--cfg=test` to retain test-only schema derives without the test harness, and disable its debug metadata. Run schema generation directly on a thread with an 8 MiB stack.
Share the environment-driven schema writer with the existing ignored test, allow a configurable crate root in `schema_sources`, and switch the public schema bundle to the dedicated generator.
GitOrigin-RevId: 317e24f77e153b9ba0c5c583837eed3bcd3774fd
## What changed
- Match final serving assessments to their response and output item, then retain them with tool invocations and code cells across waits.
- Use matching assessments instead of asynchronous scoring for adaptive review: low-risk actions can skip synchronous review, while elevated-risk actions require it.
- Revalidate captured authorization and policy before approval. Require fresh review for stale or incomplete authorization, preserve explicit review requirements, and discard assessments when hooks rewrite tool input.
- Keep asynchronous scoring as the fallback when an assessment is missing or does not match.
## Testing
Add integration coverage for direct and nested tool calls, hook rewrites, explicit escalation, interrupted responses, catalog-driven policy, incomplete authorization, and assessment retention across code-cell yields and waits.
GitOrigin-RevId: 4346a227204137f018c03c34b302d6f1e9592c96
Expose `MAX_TEXT_PART_ESTIMATED_TOKENS` from `codex-guardian-context` and use it for native tool calls, transcript entries, and delivery-size assertions. Keep the existing 9,000-token limit while replacing duplicated limits in code and tests.
GitOrigin-RevId: 90cb98eea9bade34f18db0d1666ed7ed1e93febe
Set `native_call` to `None` in the `ToolCall` and `ToolInvocation` fixtures used by the agent host invocation and spawn tests.
GitOrigin-RevId: 2a6f9ccb95d99297085a2861bb44e5ce7599715c
## Why
Managed command policies need to require a human decision independently of automatic review, hook allowances, and saved approvals.
## What changed
- Support `decision = "prompt-user"` in managed `requirements.toml` prefix rules, requiring a fresh, one-time human decision for matching commands.
- Add experimental `humanCommand` approval requests for clients advertising both `experimentalApi` and `requiredHumanApproval`. Accept only `accept`, `decline`, or `cancel`; reject commands when no capable client is available.
- Restrict responses to capable clients that received the request, and replay pending prompts to compatible clients on reconnect.
- Enable the capability in the TUI and update protocol schemas and client bindings.
## Testing
Add coverage for fresh decisions overriding saved allowances, hook allowances, and automatic review, plus child-thread approval routing and rejection of responses from incompatible or unrelated clients.
GitOrigin-RevId: 0b95ff6aab7f8a04b7298c8a4329d1fddf6a603e
## Why
Guardian review needs the original function-call metadata even when the call is no longer in live conversation history. Looking it up in history can lose the evidence needed to review encrypted multi-agent messages.
## What changed
Capture native-review policy in the tool registry and retain the original call through dispatch for multi-agent tools that require review. Use that retained call for Guardian review, applying hook-rewritten arguments while preserving encrypted-argument metadata and clearing stale replay content. Limit `ToolCall` debug output to the tool name and call ID.
## Testing
Add coverage for selective call retention across review settings and namespaces. Extend Guardian tests to cover calls absent from live history and hook rewrites that preserve call identity and encrypted-argument metadata across incremental reviews.
GitOrigin-RevId: 0e49833741c09c29228440bddd2e12695ae99583
## What changed
Add `otel.log_sse_deltas`, enabled by default. Setting it to `false` suppresses successful SSE event logs whose kind ends in `.delta` while preserving errors, completion events, and metrics.
Apply the setting to session and memory telemetry, support managed requirements, and expose it in the app-server configuration requirements API and generated schemas and bindings.
## Testing
Add coverage for delta log suppression with errors, completion logs, event counts, and duration metrics preserved. Extend configuration and app-server tests to cover defaults, overrides, and managed requirements.
GitOrigin-RevId: 751c7f357c41f51848b025c838246a733eb92e2f
## What changed
Add `CodexThread::guardian_review` to assess the final injected `exec_command` call against recorded history without executing the command. Reuse command preparation and approval policy, returning the call ID and an optional assessment when approval is required.
Reject active threads, unsupported calls, commands intercepted by `apply_patch`, and histories containing `request_permissions`. Honor cancellation and the configured review timeout.
## Testing
Add a scenario test and request snapshot verifying that direct review matches live Guardian input, leaves commands unexecuted, skips assessment for explicitly allowed commands, and rejects trailing tool output and recorded permission grants.
GitOrigin-RevId: 704f8dc77bbb991c231fce03cfda1c238c4e0b02
## Why
WebSocket heartbeat progress only establishes relay reachability, not executor receipt or completion. A blocked write or full application queue can also leave a Pong unread, so diagnosing stalled requests requires separate transport and application progress signals.
## What changed
- Trace request dequeue and completed writes under the request's trace context, and emit an executor receipt span immediately after decoding, before queueing or execution completes.
- Record RPC enqueue wait time and queue occupancy.
- Add bounded heartbeat events and a transport closure summary with fixed exit categories, queue depths, message counters, and read/write timing. Distinguish write timeouts from missing Pongs and report application delivery backpressure separately.
- Keep request methods, IDs, payloads, raw errors, and peer-provided text out of the new trace-safe transport diagnostics.
## Testing
Add coverage for blocked data and keepalive writes, missing Pongs, saturated application queues, read errors, and responsive relays without application responses. Verify trace correlation, immediate receipt span export, bounded Pong telemetry, and exclusion of payloads and raw error text.
GitOrigin-RevId: b58b2f747c4050dcde8efb408c35ecadd3561b5f
## Why
MXC read-only volume-root grants already provide recursive access, so enumerating their children is unnecessary.
## What changed
Expand only writable volume roots into grants for their immediate children. Document that read-only grants recurse, while new children created during a running command are not implicitly writable.
## Testing
Update policy tests to verify that only writable roots expand their children and that narrowing one volume preserves the other volume's grants.
GitOrigin-RevId: a7c7348b2f75bc7258fb1f130cfa4d9660e2faa6
## What changed
Negotiate the `codex/connection-lease` extension for pooled stdio connections. For servers that advertise it, open a unique lease per chat and attach its host-owned ID to tool calls and resource reads via `codex/connectionLease`, overriding caller-supplied lease metadata.
When a chat releases its lease, write cancellations for pending requests before sending `codex/connection/release`. Preserve open-before-release ordering across startup timeouts, bound unload waits, and remove connections from the pool when lease cleanup fails or times out. Servers without the extension retain existing behavior.
## Testing
Add coverage for cancellation-before-release ordering, late open acknowledgements, and lease drops outside the runtime. Extend app-server sharing tests to verify distinct chat leases, metadata replacement, release on unload, and continued use by another chat.
GitOrigin-RevId: f4c8b606cb98b5697acab1c515e992ff80ec8425
## What changed
Allow `refresh_mcp_config` to replace explicit session `plugins` overrides while preserving other session overrides and user settings. Omitting session plugins retains the current overrides; supplying an empty map clears them and restores inheritance from lower configuration layers.
## Testing
Add coverage for replacing and clearing plugin overrides, preserving unrelated settings, rejecting stale refreshes, revoking and restoring plugin tools and hooks, and retaining refreshed plugin policy when a deferred executor becomes ready.
GitOrigin-RevId: 26913fac0f8ae9590b39bdc037a78c9be86abb67
## What changed
- Add the disabled-by-default `tui_extensions_statusline` feature to render configured status items and their picker preview through a shared UI tree renderer.
- Support text, HTTP(S) links, rows, spacers, dividers, and gaps with rendering budgets, text sanitization, and width-aware truncation that keeps the ellipsis outside hyperlinks.
- Use plain text for the extension status line and hide the picker's theme color toggle while preserving the saved color preference.
## Testing
Add coverage for tree serialization and URL validation, Unicode widths, hyperlink clipping, picker previews, color preference preservation, and token usage updates across renderer switches.
GitOrigin-RevId: a6b87c2b1096765d61296d73e142834fcd53ceee
## Why
Footer hyperlinks must follow their text when the status line is truncated or animated. Inferring link targets from underlined cells loses that association, and Unicode width differences can shift links onto the wrong cells.
## What changed
- Carry explicit hyperlink ranges with status-line content through footer layout and reasoning-effort transitions.
- Fit content to the space allocated beside right-hand indicators, keeping the truncation ellipsis outside links.
- Measure and truncate rendered graphemes consistently while preserving source columns for transcript tab expansion.
- Box the composer's footer state to reduce its stack footprint during session navigation.
## Testing
Add regression tests for clipped links after halfwidth katakana and Arabic prefixes, hyperlink positions during effort transitions, and narrow status rows beside the Plan mode indicator.
GitOrigin-RevId: ede62690e191daefc85f38e637f9bcc9796268b7
## What changed
Return the cached built-in runtime keymap when `TuiKeymap` matches the default configuration, avoiding repeated keymap resolution. Keep custom configurations on the existing resolution and validation path.
## Testing
Add a startup regression test that edits `config.toml` after the directory-trust read and verifies that `thread/start` uses the updated `service_tier`, including with an embedded app server.
GitOrigin-RevId: 0c079c96cb2925c1367782e289595c637612e2cc
## Why
Code Mode sessions always used client-side output handling, leaving server truncation settings and observation budgets unused.
## What changed
- Honor each session's `output_truncation` setting in the runtime and both host transports, and advertise the bounded-output capability.
- Apply `max_output_tokens` independently to execute, wait, and terminate responses in server mode. Keep client mode as the default when the setting is omitted.
- Use bounded output collection and rendering in server mode, preserving head and tail output with omission notices. Include script errors in the output budget while retaining failure status and a separate diagnostic capped at 64 KiB.
- Estimate audio tokens without the Tokio-dependent cache when rendering bounded output.
## Testing
Add runtime and host regression tests for session mode selection, per-request budgets, output overflow, oversized images, zero-token audio output, diagnostic preservation, and termination under output backpressure.
GitOrigin-RevId: 3d9661edcdd2dde31526bb92eb83fa0614f0fa88
## Why
A transient environment startup failure persisted across turns when the selected environment and workspace were unchanged, preventing commands from recovering after the executor became available.
## What changed
Retry failed environment resolution at the start of a new turn when the error is retryable and the workspace remains selected. Reuse healthy or pending resolutions and preserve provisioning failures until the selection is updated.
## Testing
Add coverage for command execution recovering on an unchanged next turn after endpoint availability is restored. Extend provisioning failure tests to verify that subsequent turns receive the original error without restarting resolution.
GitOrigin-RevId: b80af60990f30d277804160c9c39c286024c7667
## What changed
- Add the disabled-by-default `interrupt_on_cancel` feature to interrupt upstream inference when a Responses Lite turn is canceled, with a one-second cleanup deadline.
- Detach canceled WebSocket responses so replacement requests can open a new connection without waiting for cleanup.
- Add an optional `interrupt_on_cancel` override for thread samples, inheriting the parent setting when omitted.
## Testing
Add coverage for cancellation during inference and steering, replacement turns proceeding before cleanup finishes, and prompt cancellation of model response interceptors.
GitOrigin-RevId: 501368746fc04fd3fdbd45c1f34c75ce57f4e955
## Why
A slow session backend could block further pagination from responsive backends. Sessions arriving later also need to appear in the correct sort order without moving the selection to a different session.
## What changed
- Let each backend continue pagination independently while accepting delayed results from the current listing.
- Distinguish pending backend replies from available pages so search waits for results without issuing redundant requests.
- Ignore rows and errors from previous listings, and update search progress when a backend fails.
- Sort merged sessions globally by the selected timestamp and preserve the selected session and pending page-down distance.
## Testing
Add regression coverage for independent backend pagination, delayed failures, fallback errors, stale listing events, search query changes during loading, and selection preservation when rows are reordered. Update the mixed-backend table snapshot test to ingest sessions in separate batches.
GitOrigin-RevId: 15773717567c634d8b9bf7639c3bfc78369fee03
## Why
Hosted Apps returns no resource templates, so querying `resources/templates/list` is unnecessary.
## What changed
Return an empty template list for host-owned Apps in single-server binding requests and skip it during aggregate template discovery. Use server registration metadata so extension-provided servers named `codex_apps` continue to expose their templates.
## Testing
Add coverage for hosted Apps versus extension registrations and for full MCP server status with standalone and thread connections. Verify that status requests still call `resources/list` but omit `resources/templates/list`.
GitOrigin-RevId: 3182b619391aefbb2a47ca7b8d9611402846bfe3
Give users more time to complete browser sign-in, including MFA, by
increasing the OAuth callback timeout from three minutes to ten minutes.
GitOrigin-RevId: 6a89bd3f7efb323a83ce317604faeef3a4fb2230
## What changed
- Add a sign-in wizard behind `features.gcp_setup_wizard`, disabled by default, to collect a project ID, optional location, and optional credential file. Users can leave the credential file blank to use Application Default Credentials.
- Delegate credential validation and configuration persistence to the app-server, showing progress and allowing retries after errors.
- Share editable single-line fields with Bedrock setup and compact the sign-in menu when terminal height is limited.
## Testing
Add onboarding tests and snapshots covering feature gating, field editing, navigation, validation failures, successful configuration persistence, and compact menu rendering.
GitOrigin-RevId: 96eb31e847aa1c2d503176be68ff2e2efe4722fa
## Why
Loading plugin mentions should not fetch the browsable plugin catalog.
## What changed
Use `plugin/installed` instead of `plugin/list` to fetch mention candidates for the current working directory. Update the failure warning to name the endpoint being called.
## Testing
Adapt the existing eligibility test to `PluginInstalledResponse`, retaining coverage that includes active and shared plugins and excludes uninstalled, disabled, and admin-disabled plugins.
GitOrigin-RevId: 9c1bc2b91e25ca11fdfd0391bbc3615986b371c5
## Why
Bounding collected output also requires limiting the raw event backlog between
V8 and the cell actor. Previously, runtime events and cell output accumulated
in an unbounded channel and vector.
## What changed
- Select the event transport and `OutputCollector` from the cell's
`output_truncation` mode. Server mode uses an ordered, bounded channel with
backpressure; client mode retains untruncated output.
- Transfer the collector with each observation and restore it on failed
delivery, preserving retained media and omission metadata.
- Include server-mode script errors in the observation's output budget. Build
completion output only after completion wins against termination, so a
rejected error cannot evict output returned by termination.
- Keep the public service on client-side truncation.
## Testing
Add regression coverage for channel backpressure, event ordering, receiver
closure, failed observation delivery, termination during completion commit,
and oversized errors across UTF-8 and omission boundaries.
GitOrigin-RevId: 7604b60416e33c636ca41138be65dc0fd452774a
## What changed
Add output collection and rendering components in `code-mode-runtime`, without wiring them into runtime execution yet.
- Retain a text prefix and rolling tail under a 1 MiB text allowance, with independent allowances of 8 MiB for image URLs and 62 MiB for audio URLs and a separate 32,768-item limit.
- Render retained output using the shared token-budget formatter, preserving media details and reporting collector losses even with a zero-token budget. Summarize scattered losses to keep notices bounded.
- Preserve collected output and omission accounting when delivery fails, and document the separate media limits in the protocol.
## Testing
Add unit tests for Unicode retention, item pressure, independent media allowances, media-space reclamation, failed delivery, default token budgets, and loss-notice placement and aggregation.
GitOrigin-RevId: f419fdbe316a8456cea3b7b097c4d3a658f3150f
## What changed
- Add `GetProcessMetrics` and provider sampling APIs for process ID, start time, cumulative CPU time, and resident memory, exposed through `ThreadManager` without creating a thread or session.
- Distinguish unsupported collection, a locally absent host, and sampling failures. Process-owned providers never start or replace a host when sampling.
- Bound gRPC sampling to one second without retries or explicit connection resets. Run optional collectors on a detached worker with at most one collection in flight, so stalled collection cannot block the HTTP/2 driver or runtime shutdown.
## Testing
Add coverage for snapshots, collector errors and panics, deadlines, overload, and shutdown with a stuck collector. Extend lifecycle tests to check that sampling preserves session state and keepalive behavior without starting or restarting local hosts.
GitOrigin-RevId: eeafe275891d0464636f28a29345a87aed1a12dc
## Why
Existing chats retain their provider configuration when the selected provider changes. Reject resume and input until the configured provider matches the chat, while keeping history readable and allowing recovery after configuration is restored.
## What changed
- Validate saved providers before applying resume overrides, preserving the provider when only model or reasoning settings change.
- Check the current provider selection, including profiles and launch overrides, before accepting input. Reject input when configuration cannot be loaded.
- Return structured `ModelProviderError` data for provider mismatches, missing definitions, and policy conflicts, with generated JSON Schema, TypeScript, and Python types.
## Testing
Add coverage for override bypass prevention, provider restoration, readable history after rejection, and blocked requests sending no inference traffic. Verify schema fields and Python round trips match the error wire format.
GitOrigin-RevId: 051f97c3815c547d8411c71b770df30eae969f68
## Why
Resuming or forking a thread loses the session flag indicating that reported token usage already includes retained reasoning. Counting that reasoning again can trigger automatic compaction too early.
## What changed
Persist `last_usage_includes_reasoning` with `TokenUsageInfo` and use it when estimating context usage. Record the flag with completed sampling and compaction usage, and mark local estimates as including reasoning. Older records without the field retain the existing accounting behavior.
## Testing
Add coverage for saved inclusive, exclusive, and legacy token counts. Extend the encrypted-reasoning compaction test to verify the compaction threshold for live, forked, and cold-resumed threads.
GitOrigin-RevId: 9f22262a693111ec0406dce11804eb4844ad8983
## What changed
- Include `codex-exec-server` in canonical CLI and app-server packages and advertise its path through `execServer` in `codex-package.json`.
- Build and sign the executor in release workflows, preserve signed prebuilt inputs, and verify packaged signatures. Use empty entitlements for the macOS executor.
- Have installers check for the executor when package metadata advertises it, while continuing to accept older packages.
- Omit the standalone executor and its manifest entry from npm packages to stay within npm's package size limit. Keep `codex exec-server` and its runtime helpers available.
## Testing
Add package smoke tests for executor initialization, version reporting, filesystem and process sandbox enforcement, and invalid-argument/configuration parity with `codex exec-server`. Extend archive, npm staging, and macOS signing tests to cover executor contents, executable permissions, preserved bytes, and entitlement verification.
GitOrigin-RevId: bc741fe7faa6fe631d076de18d448c55247c23c7
## What changed
Add an output schema for `image_gen.imagegen` so its code-mode declaration returns `Promise<{ image_url: string; output_hint?: string; }>`. Direct API tool serialization remains unchanged.
## Testing
Add coverage for the generated return type and unchanged direct API serialization, assert the full declaration in the app-server integration test, and verify that code-mode results omit oversized output hints.
GitOrigin-RevId: b3cee52a6b68c881f0c7507e791cc0fe86ca0d24
Replace `join_all` with a buffered stream in `replace_unresolvable_image_files` so at most eight distinct image file IDs are checked concurrently. Collect unavailable IDs as checks complete before replacing their image content with placeholders.
GitOrigin-RevId: 2a9ed8742fbb6157c99c69a15f212df3ed88810c
## What changed
Add `ReviewInput` to bundle an approval request with its captured parent history and review context. Its `assess_isolated` method runs a fresh reviewer without publishing a live approval, honors deadlines and cancellation, and returns a `GuardianAssessment` or review error.
Share review parameter construction with the live review path and extract assessment parsing and error conversion into `GuardianReviewSessionOutcome::into_assessment`.
## Testing
Add a mock-backed test that verifies the isolated assessment is returned and the reviewer receives the captured history without instructions added after capture.
GitOrigin-RevId: 10dd5fddf5fc58bfab124f5962a6b7f45d435c83
## Why
Source-built V8 archives and generated Rust bindings must agree on their ABI, including in debug builds. Linux platform selection must also distinguish GNU and musl when using LLVM platforms.
## What changed
- Always select source-built V8 archives and matching bindings for Bazel consumers, removing the `rusty_v8_from_source` flag.
- Use LLVM's libc-aware Linux selectors for archives, bindings, headers, and bindgen targets.
- Keep `V8_ENABLE_CHECKS` undefined in debug builds to match Rust's `HandleScope` layout, and set `V8_LOGGING_LEVEL=2` for debug verification.
- Include compiler-rt builtins in the ARM64 GNU/Linux archive to provide `__clear_cache`.
- Set the Intel macOS minimum version for `codex-code-mode-host` releases to 10.13 for V8's aligned allocation support.
## Testing
Always include the existing ignored CppGC ABI checks in Bazel `v8-poc` unit tests and remove their exclusion from Bazel CI.
GitOrigin-RevId: f698a47502154cdfb80febed02e4465d9f2d1e0c
## What changed
When a diagnostic upload includes logs, include saved threads attached directly to the reported thread in the existing bounded thread selection alongside spawned descendants. Query attached threads from the state database, including archived threads, so their rollouts, logs, and retained review failures can be collected. Log a warning and continue if the lookup fails.
## Testing
Extend the upload integration test to verify that the rollout archive includes the reported and directly attached threads, excludes unrelated threads, and is omitted when logs are disabled.
GitOrigin-RevId: 1bcd2794938339fb4b1c433c3731f507601cd8a4
## What changed
- Allow `/quit` and `/exit` while offline, exiting without waiting for server shutdown.
- Retry `thread/resume` when the server reports `serverShuttingDown` instead of treating the conversation as unavailable.
- Report which reconnect stage timed out, including waiting for server shutdown, without exposing transport errors that may contain endpoint credentials.
## Testing
Extend regression coverage for offline quit commands and stage-specific timeout messages. Update the reconnect integration test to exercise a draining server and verify that local approval and sandbox settings are preserved.
GitOrigin-RevId: 4f6ed33db809f56ea09fc9423f3ffe28f22b7cc5
## What changed
Overlap independent plugin filesystem and skill loads with a concurrency limit of eight. Consume results in configured-name order to preserve duplicate MCP server precedence and startup hook warning order.
## Testing
Add a regression test with ten plugins that verifies skill loads overlap within the concurrency limit, results match sequential loading, and MCP precedence and hook warnings are preserved.
GitOrigin-RevId: 6ce8a05954fad157d8559abe9fd2dc684692cf3e
## What changed
- Skip path resolution for empty TOML tables and apply resolved values in place, preserving unknown keys and omitting defaults introduced by deserialization.
- Avoid scanning project trust entries after an exact lookup misses on non-Windows platforms. On Windows, select the smallest case-insensitive matching key without allocating and sorting a list.
- Only build the effective configuration for credential-origin filtering when credential origins are present.
GitOrigin-RevId: 77f1b24ffc4ec49c686331c318c5452fd0de170e
## Why
Stopping a sideband observer should close its WebSocket while preserving the frontend-owned realtime session. The existing frameless session close also sends `session.close`, so observer shutdown needs a transport-only close.
## What changed
- Add `close_transport()` to send a normal WebSocket close without `session.close`.
- Close the sideband transport on cancellation or when the call becomes inactive, including an existing connection awaiting adoption by the input task. Bound the close attempt to five seconds.
- Thread an optional sideband base URL through realtime start processing and allow nested thread ID fields in request serialization scopes.
## Testing
Add WebSocket and core conversation regression tests covering observer detachment for both realtime parsers and conversation versions. Verify that explicit frameless session close still sends `session.close`.
GitOrigin-RevId: 874a8980b0fcd45058e976b00c0d968f5b4b2404
## Why
`codex exec` recovers turn items at completion because item notifications can be dropped under backpressure. This recovery needs to respect the thread's history mode.
## What changed
For paginated threads, fetch every page from `thread/items/list`, scoped to the completed turn. Preserve items already present in the completion notification when merging the recovered history, and stop recovery if a cursor repeats. Keep `thread/read` recovery for other history modes.
## Testing
Add regression coverage for recovering a final answer across multiple item pages and for a failed fork recovering only its own turn.
GitOrigin-RevId: f005ca2cf9d8313bbbf32ed4c228ebb5e51428a2
## What changed
- Separate evidence collection from prompt preparation and pass reviewer history, model limits, and image preparation policy through shared `guardian-context` APIs.
- Detect captured images before composition and measure reviewer history tokens only when images and a valid context window require it.
- Share instruction and native-message delivery filtering across budget checks, including restoration of retained evidence after history changes.
GitOrigin-RevId: 65ef53cf0bc22e1bde9abfb7a9ffce65cfab6f1c
## Why
When `codex-auto-review` is missing from the model catalog, Guardian falls back to the parent model. Refresh the catalog before accepting that fallback so reviews and checkpoint compatibility checks can use the default reviewer when it becomes available.
## What changed
- Share one refresh attempt per parent session, preserving it across cancelled waiters and retaining the parent fallback if recovery fails.
- Respect explicit reviewer overrides and custom catalogs, and skip recovery for basic sessions.
- Resolve reviewers from the in-memory catalog so a failed disk cache write does not discard a recovered reviewer.
- Apply review deadlines and cancellation to configuration setup, and avoid reviewer resolution during history replay unless checkpoint compatibility requires it.
## Testing
Add coverage for recovery, failed fetches and cache writes, overrides and custom catalogs, checkpoint compatibility, cancelled prewarming, review deadlines, and interruption.
GitOrigin-RevId: 87ae285713afde518a12bc2daba006a043b13bc5
## Why
Waiting for the event channel to close after `ShutdownComplete` retains the thread runtime because the thread owns its event sender. Remaining subscribers still need late notifications after shutdown.
## What changed
- Release runtime references after `ShutdownComplete` while keeping the listener command queue available for ordered notifications and late request resolutions.
- Preserve other subscribers when a client unsubscribes or disconnects from an unloaded thread, and serialize terminal cleanup with cold resumes.
- Return the thread-closing error when `thread/resume` encounters a terminated runtime or a listener that cannot complete the request.
- Close the status watch when removing a thread so a later load gets a fresh watch.
## Testing
Add regression coverage for listeners attached before and after shutdown, verifying runtime release, preservation of remaining subscribers, late notification delivery, and rejection of resumes against a terminated runtime. Add a test that removing and reloading a thread closes the old status watch.
GitOrigin-RevId: 6dda8f83a0fbe06c9a713e9801356753a0de172e
## Why
A thread runtime can shut down while listener setup is awaiting I/O, and a cold resume can start before the previous listener forwards `ShutdownComplete`. Listener replacement must preserve those buffered terminal events.
## What changed
- Coordinate listener installation and connection subscriptions with pending unloads, and reject closing or replaced runtimes.
- Allow a newly created runtime that has already shut down to drain its queued events, while enforcing one event reader per runtime.
- Track shutdown draining with a shared watch channel so cold resume and runtime replacement wait for terminal events to be processed.
- Serialize idle unloading with goal edits and cold resume, and recheck thread state after acquiring the lock.
GitOrigin-RevId: d05e348b0a81bddb2defa963d0cfd3fde08dbd03
Default read access on Windows now excludes network shares unless they contain
the policy or command working directory. Skip object-identity probes and
implicit read enumeration for unrelated shares while preserving explicit
read/write grants.
GitOrigin-RevId: 869bacd578989f5348a449277ffbea795494f487
ioanbudea-OAI