## What changed
Make “Yes, clear context and implement” save the approved plan as an app-server attachment and submit a short prompt referencing it. Add the experimental `thread/prepareApprovedPlan` request to verify that the fresh thread's executor can read the file and that its contents match the approved plan.
If the attachment cannot be written or read, inject the complete plan as `proposed_plan` tool output within the model's context and truncation limits. If the complete plan cannot fit, report an error and keep the current session. Clear the UI and switch threads only after plan preparation succeeds.
## Testing
Add TUI tests covering a large plan read from its attachment, complete fallback context when attachment writes or reads fail, and preservation of the original session when the fallback is too large. Snapshot the fresh thread's initial request.
GitOrigin-RevId: b717f30359256994c6efb3f4fe7f87aabe8936af
## What changed
Carry `ContextWindowId` through session metadata, compaction checkpoints, rollout recording, and thread creation instead of converting IDs to strings. Add deserialization and JSON schema support while preserving the serialized string format and legacy numeric compaction IDs.
Validate deserialized IDs as UUIDv7 values before restoring context windows, preserving the existing handling of unsupported IDs.
GitOrigin-RevId: fda329d0654f438171a955c9f75550817c32c047
## What changed
Add the disabled-by-default `daybreak_program_propagation` feature to capture a parent's saved Daybreak choice when spawning native helpers. Retain the choice and account identity for helper turns and nested spawns, while preserving explicit `cyber_access_program` overrides. A helper's own saved preference takes precedence on later turns.
Read pending metadata before persisted metadata so preferences survive thread materialization, with stored choices taking precedence. Share this resolution logic with `thread/read` and support refreshing the feature through user configuration.
## Testing
Add coverage for saved and pending preferences, unset choices, explicit overrides, failed metadata reads, nested spawns, parent unloading, feature withdrawal, and preference changes between helper turns.
GitOrigin-RevId: b3b349da8cb3d48154cddf058890587385efcda2
## Why
Converting message content to tool output previously reduced file-backed audio to a text file ID, losing its audio type.
## What changed
- Allow `input_audio` tool output items to carry either `audio_url` or `file_id`, preserving both forms during content conversion.
- Account for file-backed tool audio in history estimates and output truncation, and prepare only inline audio data.
- Reject uploaded audio in raw function and custom tool output injection, extending the existing requirement to submit uploaded audio through typed turn input.
- Regenerate app-server schemas and TypeScript/Python types while preserving the Python inline audio class name.
## Testing
Add coverage for tool audio wire-format round trips, repeated file audio sharing text and audio output budgets, and rejection of raw uploaded audio injection across messages and tool outputs. Extend Python SDK coverage for the inline tool audio shape.
GitOrigin-RevId: f4704466e6151662d2c8b8dc3f5ca2ab2f5710a2
## Why
MCP config refreshes previously retained session app overrides, leaving connector approval changes unapplied in existing sessions.
## What changed
- Refresh explicit session `apps` overrides alongside `plugins`, allowing updated link approval settings to take effect on the next turn.
- Preserve overrides for omitted sections and restore inheritance when a section is an empty table.
- Validate app overrides and the effective app configuration, rejecting refreshes that expose invalid inherited settings.
## Testing
Add coverage for independent and combined app/plugin updates, clearing overrides, and rejecting invalid inherited app settings. Add an integration test verifying that changing a link's approval mode from `approve` to `prompt` requests approval before executing the next turn's tool call.
GitOrigin-RevId: 3fa36744a9ccd9e735e4cda7f061ccff1cf2a269
## What changed
Expose history initialization and the effective history mode to thread-ready contributors. Add `EvidenceCursor::at_thread_ready` with paginated-history validation:
- Start new or cleared threads at position zero without requiring an existing rollout.
- Start resumed, forked, or supplied-history threads at the durable tail to avoid backfilling existing evidence.
- Skip the initial `SessionMeta` header when capturing evidence from position zero.
## Testing
Extend evidence tests to cover initialization before a rollout exists, capture of the first original record, rejection of resume without a rollout, and exclusion of existing records on resume.
GitOrigin-RevId: 32aa8e2afb71eb4e882b5f1fb107ac8616b33c8e
## Why
Waiting for host acceptance of a service-tier update in the submission loop can block interrupts while the host receipt is pending.
## What changed
Move the host acceptance wait out of the submission loop while keeping explicit thread settings replies pending until acceptance completes. Report handoff failures to the caller while preserving the locally committed settings, and allow a subsequent explicit request for the same tier to retry a failed handoff.
## Testing
Add a WebSocket regression test covering interrupts with pending host receipts, failure reporting, same-tier retries, and continued thread operation after startup caller cancellation.
GitOrigin-RevId: 1b27d156eba3ebb47e717a987f41f4f595635be8
## Why
Holding the session MCP gate during `tools/list` blocks other runtime access. Releasing it requires preventing stale refresh results from publishing after configuration or authentication changes.
## What changed
- Capture the Apps client under the session gate, then release the gate before fetching tools.
- Validate runtime and authentication state before publishing the shared cache and client catalog; retry a superseded refresh once.
- Wait for in-flight Apps refreshes before capturing model tools, preparing Apps calls, or shutting down the runtime.
## Testing
Add regression coverage for stale refreshes after runtime invalidation or logout, publication validation after call preparation drains, and a model step that waits for refreshed Apps tools while MCP status queries remain available.
GitOrigin-RevId: 42d4be8c4a9218933f8e3d07fc7f32f2da9cbd9d
## What changed
Allow GCP Responses requests to use `incremental_tools_legacy`. When enabled, tool declarations are sent through `additional_tools` inputs instead of the top-level `tools` array.
## Testing
Extend Vertex request coverage to check incremental tool declarations, including namespaces, tool search, and `exec_command`. Add GCP cases to the scenario that verifies tool catalog updates are appended without rewriting history, with incremental tools enabled and disabled.
GitOrigin-RevId: 8f4c02f8d62575e24e695d6fae0472a09625409f
## Why
Forked and recovered sessions can restore a tool call before its output has been recorded. Missing outputs for these calls should be treated as interrupted work rather than an error.
## What changed
Track the restored history's sequence cutoff so custom tool and local shell calls in that history can receive synthetic `aborted` outputs without reporting a missing-output error. Keep the existing checks for newly recorded calls and clamp the cutoff when history is replaced.
## Testing
Extend the active-turn fork test with a pending `apply_patch` call and verify that the fork's model input includes its `aborted` output.
GitOrigin-RevId: d989fa0991db72f0f8fa8a6d5de403fb307c40c7
Add `McpRefreshReason::SessionPermissionsGranted` and pass it when marking the
MCP runtime dirty after a session-scoped permission grant. This supplies the
required reason argument and identifies the refresh cause in CLI diagnostics.
GitOrigin-RevId: 2ff8f6b9e1a40d68e1f799d0414c2d45e2576a1a
## Why
An explicit denial from a workspace inference hook should stop the request, including retries and compaction model fallback.
## What changed
Recognize `inference_hook_denied` provider errors and preserve the provider's message, with a fallback when none is supplied. Expose the distinct `inferenceHookDenied` error through the app-server protocol and generated schemas and SDK types. Treat the denial as non-retryable during turns, compaction, and guardian review.
## Testing
Add coverage for terminal denials over HTTP, SSE, and WebSocket, error serialization and persistence in `thread/read`, and compaction failures that preserve token usage and history without retrying or falling back to another model.
GitOrigin-RevId: 2ebd480f01e52f4e6bd3db8a0f92d5814d18ccb1
## What changed
- Track and log `McpRefreshReason` values for runtime refreshes, including invalidations received during thread startup and forced refreshes. Restore claimed reasons when a refresh is cancelled before publication, while preserving concurrent invalidations.
- Correlate installed-plugin metadata invalidations with downstream MCP refreshes using a shared change ID. Log changed field names by plugin ID, additions, removals, and reordering without logging field values.
- Record whether background installed-plugin bundle updates were requested by startup, plugin listing, or installation.
## Testing
Add coverage for metadata change attribution across membership changes and reordering, and for retaining refresh causes across cancellation and concurrent invalidation.
GitOrigin-RevId: 3d4485ccfcc1d8788eb9909a060ac200c467af13
## What changed
Compute the `sandbox_policy` label for `codex.conversation_starts` from the effective `PermissionProfile` without constructing a legacy `SandboxPolicy`. Preserve the historical labels and native-path compatibility fallbacks, including `workspace-write` for writable profiles that cannot be represented by a legacy policy.
Share the full-disk write compatibility check with session startup and the write-intent check with legacy policy conversion.
## Testing
Extend telemetry tests to assert sandbox labels in both logs and traces across disabled, external, read-only, workspace-write, and full-disk profiles, including unrenderable writable URIs and read restrictions. Add protocol assertions for legacy write-intent detection.
GitOrigin-RevId: 00f11d763c366453e7bb0899546a4ebbdb93c4d5
## What changed
Route MCP elicitations through the standard handling paths for Xcode 26.4 clients. Remove the client-specific auto-deny flag and the synthetic acceptance of session elicitation requests without dispatching them to the client.
Simplify `request_mcp_server_elicitation` to return the optional response directly, and remove telemetry guards that depended on whether the workaround bypassed dispatch.
GitOrigin-RevId: ab540dcd67f8fa6d16c69bc7629f436e4b5aa73a
## Why
Approved filesystem access should make executor skills discoverable and readable for the lifetime of the grant. Turn-scoped access must not authorize persistent plugin servers or hooks, or bypass disabled-plugin policy.
## What changed
- Apply environment-specific session grants to capability discovery and refresh MCP after session grants change.
- Use a separate discovery inventory for skills with turn-scoped grants, keeping plugin servers and hooks on the session inventory. Reuse discovery results across unchanged model steps.
- Preserve disabled-plugin checks for unreadable manifests and symlinked manifest files or directories, including ancestor markers, while retaining standalone skill roots.
## Testing
Add coverage for V1 and V2 skill discovery before approval, after approval, and on the next turn; disabled-plugin ownership checks; discovery cache reuse; and session hooks surviving turn-scoped discovery failure.
GitOrigin-RevId: 929a7f8cb01f4bcfb4bee2c50ae02cd762066b2d
## Why
A pending realtime connection handshake can hold up subsequent attachment requests. Callers need to cancel obsolete attempts or limit how long they may take to establish a connection.
## What changed
- Add `RealtimeAttachmentOptions` with an optional cancellation receiver and `start_before` deadline to `Op::RealtimeConversationAttach`.
- Interrupt pending connection work and finish cleanup before acknowledging cancellation. Reject cancelled or expired requests before replacing an existing conversation, and recheck cancellation and the deadline before publishing a connection.
- Preserve a successfully published connection when cancellation arrives later. Dropping a cancellation sender whose value is `false` lets the attempt continue.
- Prepare the daemon startup test's socket directory with `codex_uds::prepare_private_socket_directory`.
## Testing
Add integration coverage for cancelling a held handshake, skipping cancelled or expired queued requests, preserving the next usable call, and releasing a pending handshake when its deadline expires without a cancellation receiver.
GitOrigin-RevId: 7144c1237bcbe3b859f10b654d919ae9ff20cbbb
## What changed
- Pass goal objectives as untrusted `goal_objective` context instead of embedding them in continuation instructions. Direct the model to use `get_goal` if the objective is missing or truncated.
- Inject newly created objectives into their originating active turn without dropping unrelated client context. Render them as tool outputs when `UntrustedAsToolOutput` is enabled.
- Queue additional context together with automatic turn input so both reach the first model request.
## Testing
Extend app-server coverage to verify that model-written objectives appear as tool outputs at creation and continuation, without duplicating them in user messages. Update steering and Python SDK tests to check objective preservation and delivery alongside continuation instructions.
GitOrigin-RevId: 6f44f6d6c895bb4dc378c9cf84d6470ccc885c67
## Why
Changes to nested tools should update the model's catalog without repeating the full `functions.exec` declaration or rewriting retained context.
## What changed
Pass structured exec definitions through the tool router into the session's tool world state. Enable granular updates for Responses Lite in `CodeModeOnly` when both `IncrementalTools` and `IncrementalExecTools` are enabled.
Append changed tool definitions, namespace instructions, and removals as developer messages. Keep common exec instructions and shared types frozen until compaction, then install the latest full catalog.
## Testing
Add feature-gating coverage and a scenario snapshot covering tool additions and removals, namespace instruction changes, eager/deferred transitions, re-enabling tools, retained context, and catalog restoration after compaction.
GitOrigin-RevId: bbf850d4e5018388eeb4c09345d885d776962e09
## What changed
Make `AgentServiceTier` reads asynchronous and have updates return a receipt for local acceptance. Await acceptance during root startup and settings updates outside state and registry locks, sharing the receipt with explicit same-tier retries.
Await shared-tier reads during child preparation, startup prewarm, and step capture. Allow cancellation while capturing a step, and keep host propagation independent of the acceptance wait.
## Testing
Extend the host-child WebSocket test to cover delayed acceptance, same-tier retries without duplicate updates, accessible settings while acceptance is pending, and tier inheritance during prewarm and subsequent steps.
GitOrigin-RevId: 0e2e1899834c37684e904c4a36e66344a0c6c7f3
## Why
Child startup can lose remote model capabilities such as `tool_search` when the selected catalog is uninitialized or disk data is older than the parent's in-memory snapshot.
## What changed
- Initialize the final provider, auth, and originator catalog before resolving a child's startup model, then read it from memory.
- Preserve loaded catalogs, including empty responses and updates that failed to persist, without overwriting concurrent refreshes.
- Reuse catalogs across retry and WebSocket transport overrides while retaining routing and header distinctions.
## Testing
Add regression coverage for child tool search with warm, cold, and disabled caches; failed cache writes; concurrent refreshes; empty catalogs; and Guardian reviewer catalog reuse.
GitOrigin-RevId: 01d995a65b623cc7d6f26e2dc9b6e8cf380de782
## Why
Stale saved grants or malformed rules can cause valid network denials to be discarded. A failed rule write can also leave the in-memory policy inconsistent with native enforcement.
## What changed
- Add a helper to derive MCP network policy from controller and environment policies, permission profiles, approval settings, and saved rules. Preserve managed restrictions and conservatively deny traffic that requires review, request hooks, or DNS checks the metadata cannot express.
- Retain valid saved denials when grants violate managed constraints or a rule batch is malformed.
- Serialize runtime updates and persistence, publishing denials before the write so they remain effective if saving fails. Publish saved grants after a successful write.
- Extract validation of listener settings for running proxy updates.
## Testing
Add coverage for policy composition, mixed-executor local binding, native proxy denial parity, stale grants, malformed denials, failed persistence, and compatibility with trusted MCP servers without policy negotiation support.
GitOrigin-RevId: ef00632acb48a51fc582f18d20a3e713f953a191
## What changed
Gate `incremental_tools_legacy` on the `amazon-bedrock` and
`amazon-bedrock-runtime` provider IDs instead of the OpenAI provider for regular
Responses requests. Responses Lite continues to use `incremental_tools`.
## Testing
Expand the tool catalog update scenarios to cover both Bedrock provider IDs with
legacy incremental tools enabled and disabled. Update the regular Responses tool
removal scenario to use the Bedrock provider.
GitOrigin-RevId: ad0ff31975166a2a7fdcee6fefc272ecc79dd448
## Why
Regular chats start MCP servers eagerly even when cached tool definitions are available and the servers go unused. Allow those chats to use the cached catalog and defer eligible stdio servers until first use.
## What changed
- Add the disabled-by-default `mcp_lazy_stdio_startup` feature and expose it through experimental feature configuration.
- Defer cached stdio servers in regular chats when enabled, while keeping servers that require a live startup connection eager. Required servers with `startup_readiness = "catalog"` may defer; explicit reconnects remain eager.
- Announce the full eager startup batch before terminal statuses and exclude dormant servers from the initial startup summary. Update TUI tracking so deferred servers can report startup independently in later rounds.
## Testing
Add scenario coverage for a cached server staying dormant during unrelated work, starting on first use, and refreshing tool definitions and visibility. Cover required live startup, eager event ordering, experimental feature configuration, and TUI status handling.
GitOrigin-RevId: 74075fcd4f26c8c79b5901b6a8cb03fdb9e35a7f
## Why
A cached MCP tool can remain advertised after its server fails to start. Calling it previously returned a generic unavailable-tool error, hiding the startup failure from the model.
## What changed
Propagate preparation errors through MCP tool calls and recorded approval preparation, preserving the error chain and adding the server name to startup failures. Keep the unavailable-tool error for tools that are missing, filtered, or no longer visible to the model.
## Testing
Update the executor capability downgrade test to require the credential resolution startup error in the model's tool output and assert that the host token is absent.
GitOrigin-RevId: 434074eb748165b2fe19de3a40046835f26992df
## What changed
- When `multi_agent_v2.disable_native_tools` is enabled, use bundled mode policies instead of model catalog guidance, while preserving explicitly configured mode hints.
- Refer to multi-agent tools and instruct the model to read the full multi-agent skill before calling them. Keep proactive delegation enabled for `Ultra` reasoning and explicit-request-only delegation for other reasoning levels.
- Reset retained nonempty custom mode hints to explicit-request-only guidance when multi-agent support is disabled, including after a cold resume.
## Testing
Extend integration tests and request snapshots to cover hosted-tool guidance, configured hint precedence, proactive mode with `Ultra` reasoning, and the mode reset after a cold resume.
GitOrigin-RevId: 403791ef76f990e385d9c155d9c2edc9acfcd4fe
## What changed
Add `.github/actions/setup-bazel-windows` to prepare MSVC, derive the Bazel Windows path, download the pinned Cygwin snapshot, and run the existing verified Windows dependency bootstrap. Export the Windows system root and host architecture for subsequent steps.
Use the action in the Bazel workflow and argument-comment lint action. Remove an unused `EnvironmentAttachment` import from the session tests.
GitOrigin-RevId: 8dc711dc9301bb44d49be3fdab79bd4ca981b7d0
## What changed
Replace `ThreadManager::models_manager_for_startup` with `resolve_startup_model`, which accepts `StartThreadOptions` and returns the selected `ModelInfo` before starting or cold-resuming a thread.
Share model resolution and effective session source selection with thread startup so the lookup honors the same catalog, configuration overrides, and provider fallback setting.
## Testing
Update coverage to compare startup model information with the started thread's selected model, including provider catalog defaults and context window overrides. Add coverage for provider fallback being enabled and disabled.
GitOrigin-RevId: 57040c4afeacc47c7596832271898577a3584c89
## What changed
Make `TurnContextItem.permission_profile` required and remove its legacy `sandbox_policy` and `file_system_sandbox_policy` fields. Normalize older histories into a permission profile during deserialization, preserving the restrictive fallback for malformed filesystem rules.
Keep legacy compatibility fields in rollout serialization so older readers remain usable. Update turn recording, metadata extraction, and permission checks to consume the profile directly.
## Testing
Add coverage for legacy normalization, profile-only serialization, missing permissions, and malformed filesystem rules. Extend rollout round-trip fixtures to cover deny rules and filesystem roots from another platform.
GitOrigin-RevId: 27515fec60cccbac5806b98fb71f54e311a09701
## Why
Completed remote commands wait up to 100 ms for late network denials even when all execution-owned network decision callbacks and requests have finished.
## What changed
Allow deferred network approval cleanup to finish as soon as an executor-owned remote proxy's decisions drain. Retain the grace period when a shared listener could still report an untagged denial, including when that listener starts during the command. Always register the blocked-request observer when starting the session proxy.
## Testing
Extend the paused-time regression test to cover immediate completion after remote callbacks drain and propagation of a late denial from a newly registered shared listener.
GitOrigin-RevId: 41bda6504f6d97d5626beba58cf30fb4a9a2dbdd
## What changed
- Add `ThreadManager::models_manager_for_startup` to obtain the model catalog used when starting or cold-resuming a root thread, including its effective originator.
- Add `CodexThread::selected_model_info` to resolve the model for future turns using the thread's current settings, catalog, and model overrides.
- Share catalog selection logic between startup lookup and thread creation.
## Testing
Add coverage verifying that startup and thread lookups use the thread-specific catalog, preserve the configured context window, and reflect model selection updates.
GitOrigin-RevId: d7976caebb7459e1e9ca55f3c6f6bb2af92cf3de
## What changed
Check the effective permission profile directly when applying startup restrictions for models that require automatic review, instead of converting it to a legacy sandbox policy.
Preserve the downgrade to `workspace-write` for profiles with full disk write access and enabled network access, excluding external enforcement and writable paths that cannot be converted to local paths. Share writable-path conversion with the legacy sandbox adapter.
## Testing
Add startup regression coverage for profiles that are downgraded, preserved, or rejected, including read-only carveouts and writable paths that cannot be converted locally. Verify restored permissions, automatic review selection, and workspace settings.
GitOrigin-RevId: 256c949f23d84dfba185a45a01b638ff5f1df52e
## Why
A delayed file change approval cancellation could interrupt a later turn, even when the original approval was no longer pending.
## What changed
Send `Op::CancelPatchApproval` with the approval ID and requesting turn ID from the app server. Resolve cancellations only for a matching pending approval and interrupt its requesting turn only if it is still active. Route legacy `Op::PatchApproval` abort decisions through the same pending-approval handling.
## Testing
Add a regression test that cancels an approval, then replays that cancellation while a second turn has a pending approval with the same call ID. Verify that the second approval succeeds and its turn remains active.
GitOrigin-RevId: 4c833ccd0f33c2df4e9dfb25e2729ab19b6c879f
## Why
Switching away from a model that requires automatic review should restore the user's requested approval reviewer instead of retaining the model's enforced reviewer.
## What changed
Recompute the reviewer from the requested preference and model requirements when the model changes without an explicit reviewer update, unless the session uses a trusted guardian reviewer. Preserve an explicit automatic-review preference across subsequent model switches.
## Testing
Extend the app-server settings regression test to cover restoring user review after leaving a protected model and retaining an explicit automatic-review choice across repeated model switches.
GitOrigin-RevId: a5672d1ebe94c2fac201ad460b4789d11df03b1a
## What changed
Read `final_answer_moderation` metadata and attach `moderation: { moderated: boolean }` to the completed final-answer message only when its item ID matches. Apply this in both normal and plan modes, and reset the pending decision when a new response starts.
Preserve the answer's native item ID and moderation flag through legacy events and history reconstruction. Combine text parts into one legacy event when a moderation decision is present.
Expose nullable moderation data on app-server agent messages and update the JSON schemas, TypeScript types, and Python models.
## Testing
Add an integration test for moderation on completed answers and their legacy events. Extend protocol conversion tests to cover populated moderation data and serialization as `null` when absent.
GitOrigin-RevId: f286b67731a84b3daf5d10b7644f2e31b62f0e53
## Why
Incremental tool declarations were limited to Responses Lite. Regular OpenAI Responses requests sent the full current tool catalog on each request.
## What changed
- Add the disabled-by-default `incremental_tools_legacy` feature for regular OpenAI Responses, independently of the Responses Lite `incremental_tools` flag.
- Support tool declarations and updates in conversation history, including during compaction, while preserving existing history prefixes.
- Keep hosted `web_search` configuration in top-level `tools` rather than `additional_tools`, including in compaction requests.
## Testing
Extend request-history scenarios and snapshots to cover regular Responses catalog updates, model switches, compaction, and MCP tool removal and restoration. Assert that incremental requests preserve input prefixes and keep web search out of history declarations.
GitOrigin-RevId: fa347409e387aa973ce2e41df8505769b7db1ec2
## Why
Runtime authentication must use the credential selected by the model provider. Explicit API keys and command credentials need independent ownership so cached connections and in-flight work cannot cross credential sources.
## What changed
- Register and reuse runtimes per credential source, supporting explicit provider keys and command credentials without falling back to saved login credentials.
- Track `AuthOwner` by credential manager and owner generation across WebSocket state, compaction, and scoring.
- Preserve cached identity and runtime registration state during credential-source outages or failed storage reloads. Require a successful auth reload before logout revokes credentials.
- Reject requests whose production or staging environment differs from runtime registration, including model catalog requests.
## Testing
Add regression coverage for credential selection and runtime reuse, owner isolation, source outages, failed reloads and logout recovery, and environment mismatches.
GitOrigin-RevId: 7bab55e0ea502593393df10046309fd8502edbd0
## What changed
- Expose an optional `AgentServiceTier` provider so host-owned children, including detached children, inherit the root's committed tier during spawn preparation, startup prewarm, and each inference step.
- Reject per-turn tier overrides for children using the shared provider. Root updates apply to subsequent requests without changing requests already in flight.
- Preserve independent configured tiers and role overrides when no provider is installed, including across eviction and reload. Spawned children inherit the parent's thread preference rather than its per-turn override.
- Publish the latest committed root tier only after successful runtime registration, preventing failed duplicate starts from changing shared settings.
## Testing
Add coverage for detached-child WebSocket prewarm and between-step tier changes, shared-child override rejection, independent-tier inheritance and reload, and settings updates before registration.
GitOrigin-RevId: f0f3676813a1c59bd77baf95121e2d13e0163a8e
## What changed
- Expose `RequiredCyberAccessPrograms` so hosts can require an explicit allowed program on a thread. Snapshot the requirement before extension callbacks; hosts must reapply it on cold resume.
- Validate resolved `access_programs` before HTTP and WebSocket model requests, rejecting omitted or disallowed programs. Explicit `Standard` remains distinct from omission. Reject memory summarization and realtime requests when a requirement is present.
- Keep required programs scoped to the parent thread by preventing Guardian reviewers from inheriting its program, including Guardian v2 reviews.
## Testing
Add HTTP and WebSocket coverage for allowed programs, omission, disallowed programs, unsupported providers, and connection reuse. Extend Guardian tests to verify parent-only program scope and that removing the public attachment does not erase the startup snapshot.
GitOrigin-RevId: 9306a9af0e03e7a1728dfeb610cd7ec7517367fd
## What changed
- Select fresh authentication for each HTTP operation on eligible OpenAI MCP connections while preserving the connection's credential source and account network policy. Stop redirects when requests carry runtime assertions.
- Pass the owning thread's authentication and runtime context through app discovery, connector metadata, and trusted-access requests. Include the runtime authentication mode in MCP connection and tool-cache identities.
- Give resumed actors analytics clients bound to their own authentication context, and serialize stored-credential reloads with token refresh while preserving host-provided credentials.
## Testing
Add coverage for fresh request assertions, revoked account policies, redirect handling, resumed-actor isolation, and MCP uploads in dual-header and assertion-only modes.
GitOrigin-RevId: f06900a6db61cd6cf53c3aa8075afeec4d5706d9
## Why
Multi-agent V2 still supplied native tool usage guidance when native tools were disabled, leaving instructions for unavailable tools in model requests.
## What changed
Skip bundled and model catalog role guidance for both root agents and subagents when `disable_native_tools` is enabled. Preserve explicitly configured usage hints.
## Testing
Add coverage for omitted bundled and catalog guidance and preserved configured hints with native tools disabled. Update the request snapshot and assert that spawned agents do not receive native tool call guidance.
GitOrigin-RevId: 6f2facabc95e78cbf64af19636a4daf488bbcc51
## What changed
Expose `AgentTurnOutcomeReporter` for hosts to install through `StartThreadOptions::thread_extension_init`. Await its callback after emitting the terminal turn event, independently of native parent notifications, so hosts can handle result delivery and retries.
Track outstanding outcome handoffs and wait for them during graceful shutdown before running thread-stop hooks. Prevent new turns from starting once handoff registration closes.
## Testing
Add integration coverage for completed and errored outcomes, turn lineage, queued follow-up turns, and shutdown waiting for handoffs. Extend Guardian tests to verify that strict safety stops reach the reporter while default interruptions remain silent.
GitOrigin-RevId: 0d825f6208f0250969734488881f32fd1dcd7509
## What changed
When `features.guardian_denial_reconsideration` is enabled, retry the first terminal denial once using the unchanged inference request. Buffer provisional output so only the selected response enters reviewer history, while allowing tool calls to proceed normally.
Preserve the original denial if the retry fails or times out, and continue to honor cancellation. Account for token usage from both attempts, including failed reviews.
Remove `auto_review.experimental_denial_reconsideration_prompt` and warn when it remains in configuration.
## Testing
Update the Guardian scenario and snapshot to verify identical retry inputs, retained tool evidence, and reuse of the selected assessment in a subsequent review, with asynchronous compaction enabled.
GitOrigin-RevId: cc4e303d40a02acc824c8b4b954852325e64ad52
## Why
A Code Mode script can start a command without returning its session handle. Make retained sessions visible to the model so it can find running commands and collect exited results with `write_stdin`.
## What changed
- Add the disabled-by-default `command_sessions_world_state` feature.
- Publish snapshots of up to 16 retained sessions with their IDs, running or exited status, and whether they are in use. Report omitted sessions and suppress unchanged updates.
- Preserve session visibility when `write_stdin` is unavailable and refresh snapshots after compaction. Clear stale session handles after restart or when the feature is disabled.
## Testing
Add an end-to-end scenario and model-visible history snapshot covering a dropped command handle, unchanged state, unavailable polling, compaction, exit and result collection, and stale-handle cleanup after restart.
GitOrigin-RevId: 45704d8c6403149997231aafb8496c12879aff23
## What changed
Add the disabled-by-default `async_compaction_root_only` feature flag. When enabled, it restricts background compaction to root sessions, excluding non-root agents. Expose the flag in the configuration schema.
## Testing
Add a parameterized test covering root session eligibility and eligibility for review subagents and guardian sessions with the flag enabled and disabled.
GitOrigin-RevId: b4cce3f24f7f418ae61a82a7aef310f849cfd532
## What changed
- Share the harness runtime identity with analytics delivery and turn-cost queries, and resolve request authentication together with its account-bound transport policy.
- Add runtime authentication to ChatGPT request helpers and `codex cloud`, including environment discovery. Resolve environment credentials for each request and honor CLI configuration overrides when loading cloud authentication.
- Preserve custom-backend authentication, validate runtime destinations, and keep cloud requests from following redirects.
- Forward only organization and project selectors from model-provider headers to API-key analytics requests.
## Testing
Add regression coverage for runtime request signing, credential refresh, account and resource selection, redirect credential handling, custom destinations, and cloud credential-store overrides.
GitOrigin-RevId: 75f33961ee6482881e9ff9817e99d977f31b65b8
## What changed
- Use the shared runtime and effective configuration for account API clients and remote plugin requests, including standalone plugin commands.
- Support dual-header and assertion-only authentication for remote plugins and MCP file uploads when runtime agent instances are enabled.
- Keep plugin credentials and caches scoped to the thread's account when resuming with different credentials. Bind request pools and multi-step plugin storage operations to the selected account so account replacement revokes stale operations.
- Protect runtime credentials on cross-origin redirects while preserving configured routing policies and legacy authentication for custom backends.
- Apply server-provided `upload_headers` to file storage uploads.
## Testing
Add coverage for shared runtime registration, both authentication modes, configuration reloads, resumed-thread account selection, account replacement during plugin uploads and downloads, and credential stripping on redirects. Extend file upload tests to verify runtime assertions and storage-only upload headers.
GitOrigin-RevId: 68aef81051a6f9bf919fffda52f372b108fce805
## What changed
- Expose `AgentSessionReader` and `AgentRef` for read-only access to host-owned agent session membership.
- Read direct children when rendering V2 environment context, using the existing roster size limits. Refresh membership when rebuilding context after compaction, and omit the roster if the provider is absent or the read fails.
- Preserve unrecorded initial input across suspension or interruption while waiting for a roster read. Resolve the roster before advancing the compaction window.
## Testing
Add coverage for roster refreshes after compaction, unchanged environments avoiding extra reads, unavailable rosters, recoverable input during blocked reads, and stale compaction results rejected after a concurrent history replacement.
GitOrigin-RevId: 3c7e3822af09e9295d405e53dabb87b020c8f00c
## Why
An MCP server can belong to a different environment from the turn's primary environment. An early Guardian score based on the issuing context must not bypass review when the server owner's permissions differ.
## What changed
- Capture the owning environment's permissions when preparing an MCP call and retain them for server-initiated approvals tied to that still-running call.
- Use the captured permissions consistently in Guardian review prompts and permission context.
- Require a fresh synchronous review when the captured owner permissions do not match the early score's authorization.
## Testing
Extend regression coverage for MCP score reuse across environments and for follow-up approvals from a local MCP server during a remote-primary turn. Assert that reviews use the owner's denied paths and require a fresh review when permissions differ.
GitOrigin-RevId: eb5eeb1259732c57f39765c38e34148fa0787dae
## What changed
- Add `direct_only_tool_namespaces` to `TurnStartOptions`. Omission inherits the thread configuration; an empty list clears direct-only routing for that turn. Steering ignores the option.
- Persist explicit overrides in turn context and restore them when recovering an interrupted turn, including turns started by standalone tool output.
- Keep subsequent turns and spawned or resumed child agents on the thread's routing defaults.
## Testing
Add coverage for routing changes across turns in Responses and Responses Lite, recovery without carrying overrides into subsequent turns, and child-agent inheritance.
GitOrigin-RevId: cea1a997424572d4cd372cd15b098626904c6796
Dylan Hurd