## Why
Community expertise is most useful when shared through detailed issue reports, reproduction steps, logs, analysis, and design discussion. Reviewing external code changes requires broader architectural and roadmap context and can divert maintainers from higher-priority work.
## What changed
- State that external code contributions and pull requests are not accepted.
- Replace invited-contributor workflow and CLA guidance with instructions for reporting bugs and requesting features through the issue tracker.
- Remove the pull request template and align the ChatGPT crate guidance with the repository-wide policy.
- Direct vulnerability reports to the security policy.
GitOrigin-RevId: 736c0cb181e07cc751bc46f4fefc53c6964e3dab
## What changed
- Use `/subagents` consistently for the subagent picker and status UI, removing the `/agent` alias.
- Rejoin already-loaded subagent threads without overriding their existing settings.
- Route notifications and approval requests only to the active thread or its known subagents, discard unrelated startup events, and avoid replaying resolved approvals.
## Testing
- Add coverage for filtering buffered startup events, dropping resolved approvals, preserving owned subagent approvals, and resuming threads without setting overrides.
GitOrigin-RevId: b4e597f7cd4756faccf31d8b964e7a172f5ab0eb
## What changed
- Give `PluginsManager` a shared `AuthManager` instead of a separately mutable authentication-mode snapshot.
- Read the current authentication mode and credentials from that shared manager for plugin discovery, startup tasks, CLI commands, MCP setup, and external-agent migration.
- Update test helpers and coverage to exercise plugin projections and curated marketplace selection as authentication changes.
GitOrigin-RevId: 600c94de5130eda2da5727e1a0b4d39083fefc56
## Why
Filesystem permission paths can use a convention that differs from the host
running Codex. Converting them immediately to native absolute paths can change
the meaning of ambiguous paths such as `/C:/secret` or Windows UNC paths.
## What changed
- Store literal filesystem permission paths as `PathUri` values through the
runtime policy and execution protocol.
- Keep legacy string-based serialization at explicit protocol boundaries and
reject conversions that cannot be represented losslessly.
- Encode native paths as opaque URIs when a normal file URI would imply the
wrong path convention.
## Testing
Added coverage for cross-platform and ambiguous path round trips, UNC path
variants, permission-profile serialization, and deny-policy enforcement.
GitOrigin-RevId: 5247713796d1f2bb4e02f94eb9fc82d4698060f0
## Why
Elevated provisioning can apply ACLs beneath a user-supplied `CODEX_HOME`.
Following a directory junction or another reparse point could apply those ACLs
to a different directory than the one provisioning intended to secure.
## What changed
- Require provisioning paths to be absolute paths on a local Windows disk.
- In provision-only mode, open or create sandbox directories with
`OBJ_DONT_REPARSE` and keep the resulting handle open while applying ACLs
with `SetSecurityInfo`.
- Reject reparse points in both the final directory and its ancestors while
preserving the existing path-based behavior for full setup.
## Testing
Add Windows tests covering plain directory creation and rejection of junctions
at both the leaf and ancestor levels.
GitOrigin-RevId: d165b8b3685c89bc171e4d58c63c739fa9fb2cf9
## What changed
- Query the remote app server for project config layers before starting a thread and show the trust prompt when the project has no existing decision.
- Resolve relative remote working directories and repository-root trust targets, then persist accepted trust through `config/batchWrite` on the remote server.
- Preserve existing trusted and untrusted decisions, including an untrusted repository that contains the requested working directory.
- Exit when the remote trust prompt is declined and ignore repeated key events in the trust selector.
## Testing
- Add coverage for remote trust detection, persistence, thread startup, existing decisions, nested untrusted projects, and rendering a remote Git subdirectory.
GitOrigin-RevId: e5fba2ea23bad1fb28f01df522cadbe05fcbb942
## Why
The per-thread replay buffer limited its event count, but streamed agent-message
deltas could still retain an unbounded amount of text while a thread was
inactive.
## What changed
- Coalesce adjacent deltas for the same thread, turn, and item into chunks of up
to 4 KiB.
- Limit buffered agent-message deltas to 256 KiB, discard a single delta larger
than that limit, and evict the oldest events when either buffer limit is
exceeded.
- Keep pending input and approval state in sync when eviction removes the
corresponding request, including clearing side-thread status indicators.
## Testing
Added coverage for delta coalescing, byte-based eviction, oversized deltas,
replaying only retained text, and side-thread status updates after eviction.
GitOrigin-RevId: 88d85353a124467d467822d2fd9854312b68d547
## What changed
- Resolve MCP server policy directly from the effective user configuration for selected executor-plugin roots.
- Apply server enablement, tool allow/deny lists, and default and per-tool approval modes while preserving stricter plugin-declared restrictions.
- Cover policy merging and opaque selected-root IDs in the executor-plugin MCP integration tests.
GitOrigin-RevId: dce3021969ba71e642de52312449cab6277515c3
## What changed
- Add spans for environment resolution, readiness waits, and environment info,
including fields for the selected environment and resolution state.
- Propagate the active span and tracing subscriber into spawned resolution,
startup, and shell-snapshot tasks.
- Verify that blocking snapshots retain the expected nested environment spans.
GitOrigin-RevId: 3c47e9ec1ebf45dbe1250b9ff76e2983d2a8df2a
## Why
In-process app-server filesystem requests use typed protocol requests and do
not need JSON-RPC parameters.
## What changed
Pass remote filesystem parameters to `request_fs_path` as closures and
evaluate them only when the session uses a remote request handle.
GitOrigin-RevId: 623c8733542553d73e2c0e4c4a60d40258bc91c1
## Why
The custom TUI buffer diff emitted `ClearToEnd` for unchanged trailing blank
regions, producing unnecessary terminal output.
## What changed
- Clear a row tail only when its cached contents changed or a wide glyph overlaps
the clear boundary.
- Keep blank cells marked `AlwaysUpdate` in the drawable region so viewport
invalidation still forces them to repaint.
- Preserve Ratatui's native cell diff behavior for the remaining updates.
## Testing
Add coverage for unchanged row tails, forced blank-cell updates, and shrinking
wide graphemes, including half-width katakana with combining marks.
GitOrigin-RevId: a9cac06f5624032a2b8c80a66c651cf3e85ec7fb
## What changed
- Probe the installed desktop app's update endpoint on macOS and Windows and report update-CDN reachability alongside the existing network diagnostics.
- Report newer Windows Store builds and macOS updates that Sparkle has staged for installation in the updates check and human-readable notes.
- Validate Windows update manifests against the production app identity, and use the persisted production appcast configuration when selecting the macOS feed.
## Testing
- Cover Windows version comparison and manifest identity validation.
- Cover macOS appcast selection and staged-bundle discovery.
- Verify the human-readable desktop update note.
GitOrigin-RevId: 1af5aa750144346b4b31f2b27a20371daf40d3c0
## What changed
- Add `x-cluster-name` from `OPENAI_CLUSTER` and
`x-openai-internal-caller` from `DD_SERVICE` to rendezvous WebSocket
handshakes when the environment values are nonempty and valid HTTP header
values.
- Apply the rendezvous headers to both client and remote executor connections
while preserving the existing W3C trace context headers.
GitOrigin-RevId: fead0244ba24fa208990b92d2170a9ae76ff2ceb
## Why
Image generation did not save its result when the extension host did not provide a host-local save root.
## What changed
- Save generated images under the turn environment's `generated_images` directory through its sandboxed filesystem executor when no host save root is configured.
- Limit executor-written images to 32 MiB, reject symlinked output directories and existing destinations, and continue returning the image if persistence fails.
- Include the saved workspace path in the tool output hint while preserving host-managed persistence when a save root is available.
## Testing
- Extend the granted-turn-permissions integration test to verify the image and path hint are written to the turn workspace without creating a host-local artifact.
GitOrigin-RevId: 3d24381a75fe4595641b5250e19fac8ed473b2cd
## What changed
- Stop parsing and exposing the `model` field from skill frontmatter.
- Remove the skill model delegation types and instruction generation.
GitOrigin-RevId: 01198c68c095da5062e8abec417cc3539099d9d5
## What changed
- Add a `desktop.security.enforcement` doctor check for macOS that assesses the app with Gatekeeper and classifies recent Gatekeeper and XProtect events.
- Add the same check on Windows by inspecting recent Microsoft Defender, AppLocker, and Windows App Control events for Codex executables.
- Report blocked or quarantined executions as failures, audit-only or unavailable evidence as warnings, and include actionable remediation while bounding and redacting collected event details.
## Testing
- Add coverage for platform event classification, trusted executable matching, unavailable diagnostics, remediation, and bounded redacted evidence.
GitOrigin-RevId: 792844390cd2cf92d3bc20e6a0973020b4364e51
## What changed
- Skip hyperlink layout for wrapped rows above the scroll offset and stop once
processing reaches the bottom of the viewport.
- Resolve each rendered link destination once while marking its visible cells.
- Add coverage for hyperlinks that span visible wrapped rows after scrolling.
GitOrigin-RevId: c1506d47fa3f1b895966dc2cde7d5b859c201792
## What changed
- Stop treating Vim normal-mode history-up as an alias for editing the latest queued message.
- Continue to edit queued messages through the configured `chat.edit_queued_message` binding.
GitOrigin-RevId: d830e0976a38725e948d420c1a5f374bb13fe945
## Why
Scrolling the transcript pager previously rendered a scratch buffer containing
all rows through the visible viewport, including hidden content above it. This
made rendering work and buffer size grow with the scroll offset.
## What changed
- Add viewport-aware rendering for committed transcript cells and the live tail.
- Forward scrolled rendering through cached and inset renderables while keeping
the full-height fallback for renderables that do not support it.
- Keep hyperlink metadata aligned with scrolled text.
## Testing
Add coverage comparing viewport-aware output with the full-height fallback
across wrapping widths, offsets, insets, styles, hyperlinks, and live tails.
GitOrigin-RevId: 630c30c4a61969a50f2b34701ca1dd87788a4298
## Why
The streaming TUI rerendered the entire mutable Markdown block whenever a
newline-bearing delta arrived. For long fenced code blocks, this repeatedly
parsed and syntax-highlighted the growing fence.
## What changed
- Detect open, top-level, language-tagged code fences and append newly
completed lines directly to the existing render.
- Preserve Syntect parser state across appended lines so multiline syntax and
the active theme remain consistent.
- Fall back to the canonical Markdown renderer for ambiguous fence syntax,
theme changes, incomplete lines, and highlighting limit transitions.
## Testing
Added coverage that compares streamed output with full renders across syntax
styles, Unicode, links, blank lines, fence variants, theme changes, and
highlighting limits. A long-fence test also verifies that the rendered prefix
is retained as new lines arrive.
GitOrigin-RevId: 036db2b7bc93607083b8001f8b4fa3cbb58c713e
## What changed
- Detect installed Codex desktop apps on macOS and Windows and report their version, running state, and redacted log location.
- Inspect bounded log data for the active desktop session and report the latest local app-server handshake outcome without exposing other log fields.
- Add a dedicated Desktop App section to human-readable doctor reports.
## Testing
- Cover local versus remote handshakes, failed handshakes with sensitive fields, bounded log reads, and stopped desktop sessions.
GitOrigin-RevId: ecfb4bd7af3589263624771ec9413b51953280eb
## What changed
Add `server_kind=openai_codex_apps` to the
`codex.mcp.protocol_discovery` counter and its duration metric when protocol
discovery runs for the Codex Apps MCP server. Other MCP servers retain the
existing `mode` and `outcome` tags.
GitOrigin-RevId: aadbdc54642f2c103a9f1bab39308e962c115f75
## Why
Recording a late frame's requested deadline as its emission time can leave the
rate limiter with a stale timestamp, allowing the next frame to be emitted
immediately in a redraw burst.
## What changed
Record the current time when the frame scheduler sends a draw notification so
the 120 FPS limit is measured from the actual emission.
## Testing
Add a paused-time regression test that submits an overdue draw and verifies the
next frame waits for `MIN_FRAME_INTERVAL`.
GitOrigin-RevId: 8c9a5ac0bf858b2ad87838f6d7c67c9470fdfc61
## Why
Release jobs download the `codex-zsh` manifest before packaging or signing its
bundled binaries. Verify that download against a pinned digest so an unexpected
manifest cannot enter release artifacts.
## What changed
- Pin the SHA-256 digest for the `codex-zsh-v0.1.0` manifest.
- Add a portable verification script that uses `sha256sum` or macOS `shasum`.
- Run verification in both the package archive and macOS helper signing flows.
GitOrigin-RevId: a404bb897c8cc0bf3c0ff38e8a6e1cce059d7fab
## What changed
- Add `EnvironmentNetworkPolicy` as a serializable view of portable domain,
Unix-socket, upstream-proxy, and local-binding restrictions without exposing
controller-owned proxy runtime settings.
- Add an optional `network_policy` field to `EnvironmentConfig` and re-export
the policy and related permission types through the core APIs.
- Reject owner-provided network policies during environment preview and
readiness until runtime enforcement is implemented, while preserving the
existing controller policy when the field is absent.
## Testing
- Cover rejection through both environment preview and readiness, including
preservation of the existing environment selection.
GitOrigin-RevId: 80ad4cf4d4a45632daa7a823e6cf568eb0e8bb80
## Why
The app directory is a discovery catalog and can include apps that are not
callable in the active thread. Using it for `$` suggestions can therefore
offer mentions that cannot be used.
## What changed
- Load mention candidates from `app/installed`, enrich callable apps through
bounded `app/read` batches, and retain compatibility with app servers that
do not support `app/installed`.
- Keep the mention catalog separate from the `/apps` directory cache and scope
results to the current thread, workspace, and account.
- Refresh mentions after app notifications, enablement changes, configuration
updates, and apps MCP readiness, while immediately removing disabled apps.
## Testing
Add coverage for batching and fallback behavior, stale scoped results,
notification refreshes, enablement changes, MCP startup races, and filtering
non-callable apps from mentions.
GitOrigin-RevId: 4d9e20794aed30cc97120170792fb555b86fe1e7
## Why
Creating the telemetry shutdown thread during shutdown can fail under resource
pressure, including when the native thread guard page cannot be allocated.
## What changed
- Start and verify a dedicated shutdown worker when `OtelProvider` is created.
- Send the provider to the prepared worker for bounded shutdown, while preserving
timeout behavior and avoiding a potentially blocking destructor if worker
preparation failed.
- Rename the fallible provider constructor to `try_new`.
## Testing
Add Unix regression coverage that injects guard-page allocation failures, plus
coverage for worker preparation failure, successful shutdown, and timeouts.
GitOrigin-RevId: 3656298078a800a7fa392437c2ee4a68753092e3
## Why
The app server sends sub-agent activity in both item-started and item-completed
notifications, causing the TUI to add the same activity to history twice.
## What changed
Render live sub-agent activity when the item completes instead of also rendering
it when the item starts. Preserve the existing replay behavior.
## Testing
Add a regression test that sends matching started and completed notifications
and verifies that the activity produces one history cell.
GitOrigin-RevId: 76a66f3657fe297f37067ed672ab9642997b4499
## What changed
Gate plugin hook resolution in `hooks/list` on both the hooks and plugins
feature flags. When hooks are disabled, return the default empty plugin hook
outcome without loading plugin hook sources or warnings.
GitOrigin-RevId: 166070576effaba248b790c4f2a47e6e9a7b1112
## Why
MCP requests can contain sensitive headers and tool-call bodies. Following a
cross-origin redirect could disclose them to another server.
## What changed
- Follow redirects only when every hop remains on the configured server's
origin, and require HTTPS for redirects on non-loopback hostnames.
- Preserve standard redirect method and body handling while sharing the
original timeout and enforcing a 10-hop limit.
- Avoid replaying plaintext proxy credentials across redirects, while leaving
OAuth requests that stop at redirects unchanged.
## Testing
Add coverage for same-origin and cross-origin redirects, redirect methods,
headers and bodies, proxy credentials, timeouts, hop limits, and legacy MCP
tool calls.
GitOrigin-RevId: 3e267911a1665ad8c2fc63825099a758770f4d68
## What changed
- Register `in_app_chat` and `in_app_dictation` as stable, default-enabled feature gates for desktop apps.
- Allow requirements to disable either capability and expose both keys in the generated configuration schema.
## Testing
- Add configuration tests that verify enterprise requirements can disable each gate.
GitOrigin-RevId: 5bba35d710fb0b6924aa55df98b2e013fa288f6d
## What changed
- Add `cli_auth_credentials_store` and `chatgpt_base_url` as exact managed requirements loaded from local requirements configuration.
- Apply these requirements to runtime and bootstrap authentication configuration, overriding user-configured values.
- Expose the managed values through `configRequirements/read` and reject attempts to change them through config write APIs.
- Ignore these local-only authentication requirements in cloud-managed requirement layers.
## Testing
- Cover requirement loading and composition, runtime and bootstrap overrides, app-server responses, and read-only config writes.
GitOrigin-RevId: 8ea9c096386072036ca5441f3d48af8707988a65
## Why
Unified exec could drop network approval registration when a selected environment used a Windows working directory on a non-Windows host because the trigger path could not be converted to a host absolute path.
## What changed
- Keep network approval trigger working directories as `PathUri` values and render them with their inferred native path syntax for Guardian requests.
- Fall back to the selected turn environment only when a trigger path can be converted to a host absolute path.
- Reject selected environment working directories larger than 8 KiB at the thread-manager validation boundary.
## Testing
- Cover managed-network approval registration for a foreign Windows working directory.
- Verify that oversized working directories are rejected as invalid `thread/start` requests.
GitOrigin-RevId: 646fbf12115a35a7e5cb04b511464797bee6647b
## Why
Resumed and forked threads need their persisted Guardian risk state available when routing later approval requests.
## What changed
- Initialize a session's `SecurityRiskScore` from the latest score in its rollout history when no score was supplied explicitly.
- Preserve the inherited score when resuming or forking a thread so low-risk actions can skip redundant Guardian reviews.
## Testing
- Add app-server coverage for inheriting the latest Guardian score when resuming and forking threads.
GitOrigin-RevId: 95a6c803f8dae75516d1da9d66a722379a0a7ef2
## Why
Config reads arriving while a long-running shared read was active waited for that
request to finish, even though they could safely run concurrently.
## What changed
- Admit newly queued shared reads into the active batch until an exclusive write
is queued, preserving the write as a fairness barrier.
- Treat `hooks/list` and `configRequirements/read` as shared config reads.
- Cover concurrent reads, read/write ordering, and config reads completing
alongside a `skills/list` request.
GitOrigin-RevId: 8194301c2ba60be0fc71b8915923af9accc745dc
## What changed
- Add end-to-end app-server tests for MCP tool approvals with Guardian V2 and automatic review enabled.
- Verify that sampling receives the thread context, uses a thread-scoped prompt cache key, and persists the resulting action risk score.
- Cover both routing outcomes: low-risk actions skip later Guardian reviews, while high-risk actions continue through full review.
GitOrigin-RevId: 78ba2b0560caf701ad333785c4dda4f7d2be4f2c
## Why
Durable thread queues can be updated through another SQLite connection, but loaded idle threads need to notice those updates before they can dispatch the new messages.
## What changed
- Track a durable revision for each thread queue, including backfilling existing queues and updating revisions on inserts, updates, and deletes.
- Poll SQLite's data version and query revisions to find changed queues for loaded threads.
- Wake idle threads with pending external messages, discover queued work when threads are loaded or resumed, and retry each thread independently so one blocked queue does not stall others.
## Testing
- Cover cross-runtime queue writes, edits, independent dispatch, wake retries, and resumed threads.
- Cover migration backfills and revision tracking for queue updates and deletes.
GitOrigin-RevId: 906d902bbf6a760be206a1b2c08fd71427b63c46
## Why
Building a resume-picker preview for a legacy session should not require loading its full thread history.
## What changed
- Read up to six preview lines by scanning at most 1 MiB from the end of a local legacy rollout.
- Fall back to the existing history hydration path when the local file is unavailable, the bounded scan is incomplete, or the tail contains a rollback.
- Keep the initial `thread/read` request turn-free while loading the preview.
## Testing
Added coverage for compaction, rollbacks, oversized records, exhausted scan budgets, and app-server request parameters.
GitOrigin-RevId: a8950f03d8b56323f268fd3355c6a38a16cb9833
## Why
Direct access to shimmer primitives can bypass the reduced-motion handling
introduced in https://github.com/openai/codex/pull/20564.
## What changed
- Make `shimmer` a private child of `motion` and restrict `shimmer_spans` to
its parent module, so Rust visibility enforces the animation boundary.
- Remove the source-scanning regression test that previously checked this
boundary with regular expressions.
GitOrigin-RevId: 1f4cccacaa907992c636cd1e9cd2829b7653f811
## What changed
- Reuse shared directory fixtures and local and remote app-server instances across the resume cwd case matrix.
- Seed the runtime working-directory override directly so each case focuses on resume behavior without starting and replacing an extra thread.
- Run the test on a four-thread Tokio runtime and shut down each shared server after all cases complete.
GitOrigin-RevId: 4bc4978abc546882f26bcb5e3591ff9673758b4a
## Why
Pet tests reuse the same blank WebP spritesheet fixture, so encoding a new image
for every temporary path does unnecessary repeated work.
## What changed
Encode the test spritesheet once with `LazyLock`, then write the cached WebP bytes
to each requested fixture path.
GitOrigin-RevId: 26d75bb1bac448717ca63aeb82eb4e500c86fad8
## Why
The 1,000-character human-like typing test waited on the wall clock after
every keypress, making the test unnecessarily slow.
## What changed
Advance an injected timestamp by the recommended paste flush delay and flush
the paste-burst detector explicitly after each character. This preserves the
coverage that slow typing appears directly without creating a paste
placeholder, without sleeping between keypresses.
GitOrigin-RevId: 0c1beb40283f7d73a381cd221725ab4227c8e233
## What changed
Construct the oversized unified diff fixture directly instead of generating it
from two large input strings. Keep the fixture just above
`MAX_HIGHLIGHT_LINES` so the test continues to verify that syntax highlighting
is skipped for large updates.
GitOrigin-RevId: 8f8853e03a50ff9f53e77b2ba0956cf85ee17c07
## Why
MCP tool results can contain multi-megabyte image, audio, or resource bodies,
even though TUI history renders only summaries for those content types.
## What changed
- Project completed MCP results into width-independent display data, dropping
media and resource bodies that history does not render.
- Preserve text output, JSON fallbacks, error state, Node REPL rendering, and
the fully decoded image-output marker.
- Add tests covering width-dependent rendering, image validation, and Node REPL
text fields on non-text and unknown content blocks.
GitOrigin-RevId: 2cfddf0864093e6837a4431e541f7a9cab544a68
## Why
Keeping overflowing separators with the following word can add whitespace-only
rows and make composer wrapping differ from the queued-input preview.
## What changed
- Hang breakable whitespace from the preceding visual row at soft word breaks
while preserving the underlying editable text.
- Keep indentation, trailing whitespace, mandatory breaks, and nonbreaking spaces
visible and editable according to their existing semantics.
- Align cursor placement, scrolling, vertical navigation, masked rendering, and
styled overlays with the visible wrapped content, including after resizes.
## Testing
Add focused wrapping, rendering, cursor, editing, scrolling, navigation, Unicode
separator, long whitespace-run, and resize coverage.
GitOrigin-RevId: 7fbdb0a4bf33cfee20c4c19dca5aee74df4f892c
## Why
Windows named pipe servers can impersonate connected clients. IDE context
connections only require the server to identify the client, so they should not
grant broader impersonation rights.
## What changed
Open Windows IDE context pipes with `SECURITY_SQOS_PRESENT` and
`SECURITY_IDENTIFICATION`, limiting the server's impersonation token to the
identification level.
## Testing
Add a Windows regression test that connects to a named pipe, asks the server to
impersonate the client, and verifies that the resulting token has the
`SecurityIdentification` level.
GitOrigin-RevId: 51ef080f3367857987e03b0113a476040ea40e56
## Why
Headers configured for an MCP resource can contain credentials and must not be
forwarded to a different origin during OAuth discovery, registration, or token
exchange.
## What changed
- Apply configured resource headers only to OAuth requests on the MCP resource
origin, while allowing OAuth-generated headers to take precedence.
- Follow credentialed OAuth redirects only when each destination remains on the
resource origin. Preserve redirect method semantics, the overall timeout, the
response size limit, and a maximum of 10 redirects.
- Use the Codex MCP user agent for requests to authorization-server origins.
## Testing
Add coverage for cross-origin header isolation, same-origin dynamic client
registration redirects, OAuth header precedence, token refresh, timeout
accounting, and response size limits.
GitOrigin-RevId: 609d06e2b065e4aa9ca5382b4ae60455f9e26db9
## What changed
- Define MCP server identities, matchers, requirements, and per-plugin MCP requirements in the new `codex_protocol::mcp_policy` module.
- Keep requirement validation and matching against `McpServerConfig` in `codex-config`.
- Re-export the moved types from `codex-config` to preserve existing consumers.
GitOrigin-RevId: ad8a107e3085191241a5766f061dd004103e21e6
## Why
Short continuation prompts such as `continue` do not contain enough context for
skill selection on their own.
## What changed
- Add the `task_context_fusion_v1` shadow selector, combining the current request
with up to two prior substantive requests and recently relevant skills.
- Record explicit skill intent and successful skill invocations for future turns,
while excluding same-turn observations from predictions.
- Bound retained requests, augmented queries, and skill history, including safe
truncation at UTF-8 character boundaries.
## Testing
Add unit and extension tests for continuation prompts, explicit intent, turn
isolation, cold thread state, bounded history, and unchanged control selectors.
GitOrigin-RevId: 72eca3f0d64620a0d24e95d5675f126ac982f8c7
## Why
Guardian stores a `SecurityRiskScore` before advancing its scored-tool-call
counter. Waiting only for the score can therefore let the test continue while
the asynchronous sampler is still updating its progress state.
## What changed
Wait for `latest_scored_tool_call` to advance before exercising Guardian v2
approval decisions, and reuse the same progress tracker for the subsequent
assertions.
GitOrigin-RevId: 3d92c9a3ccf52f4f43a2454aac60d2479258c1c8
