## What changed
- Configure the CLI and app server to use `tikv-jemallocator` on
`x86_64-unknown-linux-musl` and `aarch64-unknown-linux-musl`.
- Keep the dependency and global allocator selection scoped to those targets.
GitOrigin-RevId: 93c54c90d9acb7e48edffd032cd8ec685a782210
## What changed
- Add rendered HTML alongside the original Markdown when copying a whole response through the native clipboard, so rich-text destinations preserve headings, lists, tables, code, and other formatting.
- Keep code-block, blockquote, transcript, terminal, and WSL clipboard copies as plain text.
- Escape raw HTML, omit remote image sources, and render unsupported link destinations as visible text when producing clipboard HTML.
## Testing
- Add coverage for rich formatting, local and unsafe links, inert images, fenced tables, copy selection formats, and clipboard fallbacks.
GitOrigin-RevId: c6f5edd88b65f9e9b1ddc5618442868cf47ee560
## What changed
- Add `codex-mxc-sandbox` with native MXC availability detection and a launcher that inherits standard I/O and waits for the sandboxed process.
- Reject unsupported learning-mode and fallback policies, and verify deny-path support before launch.
- Route the existing Windows MXC availability metric through the new crate and move its Windows linking dependencies alongside the adapter.
GitOrigin-RevId: e2a220b85718e00b0e710c30bbe66b6c56958176
## Why
Allow remote exec servers to connect directly to AWS-hosted registries that
authenticate registry requests and WebSocket handshakes with AWS SigV4.
## What changed
- Add `--remote-transport direct` with SigV4 profile, region, and service
options while keeping Noise as the default transport.
- Register the `direct_jsonrpc_v1` transport and carry plain exec-server
JSON-RPC messages over the authenticated WebSocket.
- Reuse direct registrations across transient disconnects, refresh them after
a `409 Conflict`, and require TLS for non-loopback endpoints.
## Testing
- Cover CLI validation and SigV4 request signing.
- Exercise direct registration, handshake retry behavior, JSON-RPC
interoperability, and process recovery after reconnecting.
GitOrigin-RevId: 0755df330ba3abe5db0a516fdaa49338d9bbe2d2
## What changed
- Add helper protocol requests to create a WebRTC offer, apply an answer, and report readiness once the ordered `oai-events` data channel opens.
- Support UDP and TCP candidates while bounding signaling size, remote candidates, inbound TCP streams, and WebRTC buffers. Redact session descriptions and peer errors from diagnostics.
- Close unexpected remote data channels and tear down the peer during helper shutdown, including when the parent pipe is lost during startup.
## Testing
- Exercise offer/answer negotiation and clean shutdown over real UDP and TCP sockets.
- Cover signaling validation, candidate and connection limits, early packet loss, slow TCP connection setup, and blocked-startup parent loss.
GitOrigin-RevId: 5f5e60a3a4d1d8eaca2e4724e66284f54061b6af
## What changed
- Add the experimental `worktrees` feature and a shared `--worktree` flag for new and forked `codex exec` sessions.
- Create each enabled session in a managed Git worktree, use that checkout as the session working directory, and bind the checkout to the new thread.
- Share the configured worktree pool with Desktop while leaving automatic cleanup disabled for CLI allocations.
- Reject unsupported commands, remote execution, ignored user configuration, ephemeral sessions, and use without the feature enabled before allocating a worktree.
## Testing
- Cover flag placement and inheritance, supported and rejected command combinations, worktree allocation and thread ownership, configuration gating, and compatibility with existing worktree-backed sessions.
GitOrigin-RevId: 011ff4639b09e8992c50d7b823df23e71798670e
## What changed
- Add the `codex-attachment-store` crate with storage-neutral attachment metadata, references, errors, and an asynchronous persistence interface.
- Provide an inline implementation that preserves attachment bytes as media-typed base64 data URLs.
- Inject the store into `ThreadManager`, expose it to consumers, and retain inline storage as the default for existing entry points.
## Testing
- Verify inline storage round-trips binary, text, PNG, and JPEG data.
- Verify attachment debug output redacts URLs while retaining file IDs.
GitOrigin-RevId: 7688dcd3c89d7540ed2398f3e7c63881fbfcda97
## Why
The voice helper previously supported only handshake and shutdown, without
validating that its packaged native runtime could be initialized safely.
## What changed
- Add an `initializeRuntime` protocol exchange that loads GStreamer and the
required plugins from physical package paths without opening audio devices.
- Restrict plugin discovery, registry access, and native library search paths,
and keep loaded libraries alive until the helper exits.
- Give initialization a dedicated deadline and terminate the owned helper when
initialization is cancelled or fails.
- Allow binary-only Rust targets to disable the default Bazel library target.
## Testing
- Cover helper-only packages, cancellation, and environment filtering.
- Add an ignored integration test for initialization from a relocated prepared
runtime and rejection of duplicate initialization.
GitOrigin-RevId: 8fff68fe26e52cb2e0722dc98fb5f124eddb0d4d
## Why
Guardian authorization reviews need host-verified `request_user_input` answers to
remain aligned with thread history across compaction, resume, and rollback.
## What changed
- Record verified question-and-answer pairs in retained thread context when
`GuardianThreadContext` is enabled, and source both local and delegated Guardian
review evidence from that context.
- Preserve complete answer records within the evidence budget. Mark authorization
context incomplete when records are unavailable or oversized, and defer cached
fast approvals in that case.
- Keep the existing runtime-only answer path for threads that do not enable the
thread-owned context.
## Testing
- Cover answer retention through compaction and resume, removal after rollback,
source-call eviction, oversized answers, delegated review evidence, and legacy
behavior.
GitOrigin-RevId: 01f6f4541515434a0d00fdde318ff59f2f8bd2eb
## Why
The managed app-server daemon and automatic TUI attachment were limited to
Unix, so Windows users could not share a background server across Codex
sessions.
## What changed
- Enable daemon lifecycle commands, `codex agents` startup, and AF_UNIX daemon
discovery on Windows.
- Require Windows daemons to start non-elevated and verify the discovered
socket directory and peer before connecting.
- Preflight detached process support, preserve path-based environment settings,
and keep daemon processes out of the launching project's working directory.
- Fall back to an embedded server when an implicitly discovered daemon cannot
connect, while preserving errors for explicit remote endpoints and bypassing
daemon reuse when `CODEX_EXEC_SERVER_URL` is set.
## Testing
Add coverage for Windows launch restrictions and socket validation, implicit
connection fallback, executor selection, daemon discovery, and the agents
dashboard startup result.
GitOrigin-RevId: e7fd63cf8690bcca8b5155266416f31f2f792aa2
## What changed
- Upgrade `rmcp` and `rmcp-macros` from 3.1.3 to 3.2.0.
- Refresh the Cargo and Bazel lockfiles for the new versions.
GitOrigin-RevId: a1d7696eafe6a150c6e09c3cc9c3663a8fd68679
## Why
The PID-managed app-server lifecycle previously supported Unix only, leaving Windows unable to start and stop the managed daemon.
## What changed
- Launch the Windows daemon as a detached process and fail clearly when the host Job Object prevents detachment.
- Add Windows file locking and process creation-time checks so stale or reused PIDs cannot cause an unrelated process to be terminated.
- Request graceful shutdown through a shutdown file, then terminate the verified process after the grace period.
- Prepare private daemon state directories consistently and pin the executable path across installer junction updates.
## Testing
Add Windows tests for process-query permissions, reused and inaccessible PIDs, and stale-record cleanup.
GitOrigin-RevId: 5ea579a7c3dc8bb6122ec3a02513836ccaacc41c
## What changed
- Record the authenticated sandbox owner and observe package uninstall events across service restarts and session changes.
- During uninstall, serialize setup and cleanup, disable sandbox accounts, stop their processes, and remove sandbox directories, firewall and WFP rules, hidden-user entries, accounts, and the sandbox group.
- Restrict desktop-owned directory cleanup to pinned paths and perform it while impersonating the authenticated owner.
- Detect missing or disabled sandbox accounts after interrupted cleanup and reprovision them before restoring network access.
GitOrigin-RevId: 7d63fff7ddcff3eb01d018653146df12044bd277
## Why
Exec-server process and network-policy events need stable attribution to the
launching tool call and executor without recording process payloads.
## What changed
- Add optional `ExecMetadata` to `ExecParams` and propagate the thread and tool
call IDs from unified exec.
- Emit bounded OpenTelemetry events for process start, spawn failure, sandbox
denial, and exit. Correlate them with the launch trace and registry-issued
executor identity while excluding arguments, paths, environment values,
output, and error text.
- Preserve launch attribution across long-running processes and reconnects, and
attach the same metadata to network-policy audit events.
- Keep the protocol backward compatible when metadata is omitted, and prevent
invalid trace headers from inheriting an unrelated active span.
## Testing
Add coverage for metadata serialization and propagation, lifecycle event
fields, trace relationships, reconnect behavior, spawn failures, sandbox
denials, and network-policy attribution.
GitOrigin-RevId: 7aa480a7289c73cb95e2c124c35500bb6f0d5084
## What changed
- Add a Windows sandbox service validator that loads managed configuration while impersonating the provisioning client.
- Reject elevated sandbox or network settings that conflict with managed requirements, including local binding and HTTP or SOCKS proxy-port restrictions.
- Add a one-shot cloud configuration loader that bypasses the disk cache so policy checks use a fresh backend response without modifying cached configuration.
- Keep the provisioning integration disabled until authenticated transport can supply the policy inputs.
## Testing
- Cover elevated sandbox restrictions, disabled networking, local binding, proxy-port classification, malformed policy, impersonation failure, and cache bypass behavior.
GitOrigin-RevId: b76aa8959c515c6507c2eaf61af768efa1305253
## Why
Windows sandbox provisioning performs privileged work beneath a requested Codex home. Provisioning paths and output entries must remain bound to the files and directories that were validated, without following reparse points or writing through caller-controlled hard links.
## What changed
- Add reusable no-reparse directory opens, path validation, directory guards, and handle-relative atomic file replacement.
- Use fresh or retained handles for provisioning logs, sandbox credentials, setup markers, and error reports in service provisioning mode.
- Add service-side validation for framed provisioning requests, proxy settings, fixed-drive Codex homes, and pinned sandbox directories.
## Testing
Add Windows tests covering junction and unsafe-path rejection, hard-link-safe output replacement, retained output handles, request framing and normalization, and ancestor pinning.
GitOrigin-RevId: 2ec4f0d15404c3387df1414bb0c1915cf452ecf2
## What changed
- Add the `codex-windows-sandbox-service` workspace crate and Windows-only build target.
- Integrate `CodexSandboxService` with the Windows Service Control Manager, including start, stop, shutdown, status reporting, and event-log handling.
- Support service mode by default and a debug-only `--foreground` mode. Keep provisioning IPC disabled until authenticated request handling is available.
## Testing
- Add argument-parsing tests for service, foreground, unknown, and multiple arguments.
GitOrigin-RevId: 1c84f0a593b65e5cf97ab7606cde03675542b0b0
## Why
Windows control sockets need a rendezvous directory that cannot be accessed or
replaced by another user while the listener is active.
## What changed
- Create socket directories with a protected, inheritable, current-user-only
DACL, and reject existing directories with broader permissions.
- Validate socket paths without following a junction at the rendezvous
directory, and pin the directory through listener cleanup to prevent
replacement after validation.
- Add a Windows peer check that verifies the kernel-reported peer process uses
the current user's non-elevated token.
- Document the Windows requirements for custom control socket paths.
## Testing
Add Windows coverage for ACL inheritance and rejection, junction and volume-root
rejection, extended-length paths, directory pinning, and elevated peer rejection.
GitOrigin-RevId: cc8dd76e5732c288f6346cfd6138051188533bfa
## Why
Automatic startup work and `codex doctor` can run before a workspace is
trusted. A repository-controlled `PATH` must not be able to make those flows
execute workspace-provided helpers.
## What changed
- Resolve helpers used by automatic startup from trusted system installation
directories, and give plugin-sync Git subprocesses a sanitized environment.
- Make terminal detection environment-only and have doctor inspect executable
locations without running them. Fetch update metadata with the HTTP client
instead of `curl`.
- Fall back conservatively when trusted terminal helpers are unavailable,
including for tmux keyboard enhancement flags.
## Testing
Add black-box coverage with hostile workspace `PATH` entries for startup,
interactive tmux startup, support log collection, doctor, and curated plugin
sync. Add unit coverage for trusted executable resolution and bounded update
HTTP responses.
GitOrigin-RevId: 3b8995eb422b60ed53b0386951de59e8f9bfc542
## Why
Compaction replaces the model history window, but host-verified user answers may
still be needed for the rest of the owning thread.
## What changed
- Add bounded, model-invisible retained context for verified
`request_user_input` answers.
- Persist retained context in rollout events and compaction checkpoints, and
restore it when a thread resumes.
- Remove answers when their source turns are rolled back, and prevent
parent-local answers from being inherited by child forks.
## Testing
Add lifecycle coverage for deduplication and size limits, compaction and resume,
rollback, rollout migration, and child forks.
GitOrigin-RevId: c32900d3e8120a9899b71f0576683acd67a4b898
## Why
Clients need the executor's release version to make version-based compatibility decisions.
## What changed
- Add `executorVersion` to `EnvironmentInfo` and return it from both `initialize` and `environment/info`.
- Resolve the package release version at process startup so the advertised value remains stable for the server's lifetime.
- Use `0.0.0` when the version is unknown or omitted by a legacy executor.
## Testing
- Cover packaged and source-build initialization, startup caching, protocol serialization, and client-side metadata caching.
GitOrigin-RevId: a0c7f0b701a8e7e50345cd5fb1b5c5d2d38ff3b1
## What changed
- Emit a `codex_thread_hint_status` analytics event for each native history-notes thread hint attempt.
- Report whether retrieval was successful or failed along with thread context and timing, without including hint contents.
- Treat valid empty responses as successful retrievals while continuing to omit them from the context window.
## Testing
- Extend the app-server history-notes tests to verify success, empty-result success, and backend failure statuses.
GitOrigin-RevId: b9462f312847e8c871ed2be0c8cf8df0928a7fdd
## What changed
- Add `WorktreeManager::create` to create detached, Desktop-compatible worktrees from `HEAD` or an explicit base while preserving the source working-directory path.
- Isolate worktree Git operations from inherited repository selectors, hooks, filesystem monitors, and configured content filters.
- Validate the destination working directory and roll back incomplete worktrees and empty allocation buckets on failure.
## Testing
- Cover layout, base selection, annotated tags, nested working directories, Git environment isolation, filter suppression, source checkout preservation, unsafe symlinks, and creation rollback.
GitOrigin-RevId: bf172c3ff4268dab603d00a1d547485fcd0de368
## What changed
- Include remote catalog entries in `codex plugin list`, including their source,
version, install policy, and authentication policy in JSON output.
- Support adding and removing remote plugins through the existing plugin CLI.
- Cache remote catalogs by scope and collection. Prefer fresh cached results, and
refetch once when an add request misses a plugin in the cache.
- Preserve the local curated catalog when an unfiltered remote listing fails,
while surfacing errors for explicitly selected remote marketplaces.
## Testing
- Cover remote listing, installation, removal, catalog fallback, cache refresh,
collection isolation, and install failure behavior.
GitOrigin-RevId: 09796b2c393d102e00ba9289f784d78a2e166a54
## What changed
- Emit `codex_guardian_v2_classification` events with the outcome, risk
level, duration, model, and thread attribution.
- Emit `codex_guardian_v2_fast_decision` events when Guardian V2 approves an
action without a full review.
- Add `guardian_v2_enabled` to turn analytics, accounting for review scope
and model requirements.
## Testing
- Extend the Guardian V2 app-server coverage to verify event payloads,
attribution, enablement state, and scoped event emission.
GitOrigin-RevId: 0805975f8e8f9d954aa1058ea8c60545a090ae74
## Why
Git root discovery is optional metadata work, but filesystem probes can block. They should not exhaust Tokio's blocking pool, delay runtime shutdown, or prevent later turns from observing repository changes.
## What changed
- Add a shared `GitRootDiscovery` service that coalesces concurrent lookups for the same working directory and limits probes across directories.
- Run probes on detached threads, retain in-flight work across caller cancellation, and discard completed results instead of caching them.
- Use the service for turn and memory metadata enrichment, abort unused turn enrichment when its state is dropped, and limit memory metadata waits to one second.
## Testing
Add coverage for probe sharing, capacity limits, cancellation, fresh discovery, runtime shutdown, memory timeouts, and repositories restored after startup prewarming.
GitOrigin-RevId: bca46fc263e7a12a2f69146d8a0b3e7c7e0846cb
## What changed
- Add `codex-otel-trace-websocket` with a `TraceWebSocket` API that owns the
loopback OTLP receiver and WebSocket listener.
- Bind both listeners during startup, expose the exporter and bound listener
addresses, and surface listener failures through a single lifecycle method.
- Update `codex-code-mode-host` to use the new crate and shut down the bridge
after flushing its trace provider.
GitOrigin-RevId: ec5ca4c4369b6b3b1232875c2699730eb748ab1c
## What changed
- Probe whether the native Windows MXC process security environment is usable
when selecting a sandbox.
- Emit `codex.windows_mxc.available` at most once per process, labeled with the
probe result.
- Add the MXC workspace dependencies for Cargo and Bazel, and pin
`tracelogging` to a version compatible with the GNU Windows toolchain.
GitOrigin-RevId: d7cfeed6f0333feda5764e1ee44fe5bbd50f9a58
## What changed
- Make `local_thread_store_compression` compress cold rollout files across shared and forked histories without a separate compression mode.
- Retire `local_thread_store_shared_compression` while continuing to accept it in strict configuration without changing compression behavior.
- Read rollout files through the compressed-rollout reader when `codex exec resume` determines the latest turn's working directory.
## Testing
- Cover compression and restoration of an archived fork chain.
- Cover cwd-based resume selection when only the compressed rollout remains.
- Cover the removed compatibility key in strict configuration.
GitOrigin-RevId: 8edebf61eccc1f79cabb8e641f8982c76f337bf1
## Why
Code-mode callbacks can outlive their initial request and run in separate tasks,
so their trace context must be preserved explicitly.
## What changed
- Preserve the execution context for code-mode callbacks and add spans for
nested tool invocations in the runtime and dispatch broker.
- Propagate each tool invocation span as the parent of its streamed gRPC
callback, falling back to the outer execution context when needed.
- Add a `codex.exec_server.process` span for each process lifetime, including
its process ID and completion result, without retaining the request span.
GitOrigin-RevId: a6059e34d895416f5517e51dad6ca0078355adca
## Why
Audio models cannot reliably encode tool-generated clips shorter than 25 ms.
## What changed
- Measure the available audio frames in base64-encoded PCM and IEEE float WAV outputs.
- Replace clips under 25 ms with explanatory text while preserving surrounding Code Mode output.
- Leave clips at or above the threshold and unrecognized audio formats unchanged.
## Testing
- Cover the duration boundary across multiple sample rates and all supported `audio()` input forms.
- Verify bounded and truncated WAV chunks, output after `yield_control()`, and end-to-end mixed text and audio output.
GitOrigin-RevId: 342b4bdbc65db4238580f9cdc372763c2576eca5
## What changed
- Add the `codex-config-schema` workspace and Bazel crate for the
`codex-write-config-schema` binary.
- Preserve `codex-rs/core/config.schema.json` as the default output location.
- Update `just write-config-schema` to run the new crate and remove the schema
generator's `clap` dependency and binary target from `codex-core`.
GitOrigin-RevId: 7447f97d6e44d1077b16d2d850f8a8add9117ea6
## What changed
- Add `VoiceHost` to resolve the packaged voice helper, launch it with an
allowlisted environment, perform the protocol handshake, and enforce bounded
shutdown and process cleanup.
- Preserve native executable path encoding in the pipe process APIs.
- Add `third_party/voice/assemble_package.py` to create a fresh package copy
containing a target-compatible helper and a provenance manifest with file
hashes.
## Testing
- Cover installed helper lifecycle, build matching, missing and symlinked
helpers, non-UTF-8 package paths, environment filtering, package validation,
target pairing, and failure cleanup.
GitOrigin-RevId: f893074b36ae6bb9bcedc00fbe7af6bb72745f4c
## Why
Event subscriptions may need to outlive the MCP runtime associated with a task.
## What changed
- Add `McpEventStreamOpener`, which retains the hosted Apps MCP connection settings and opens each event stream with an independent client.
- Keep subscription cancellation tied to account changes and removal of the task's event server, including when cancellation ownership is forwarded across runtime replacement.
- Expose the opener and cancellation forwarding through `McpResourceClient`.
## Testing
Add an HTTP transport test that shuts down the runtime, refreshes credentials for the same account, and verifies that a new event stream connects with the current authorization and receives notifications.
GitOrigin-RevId: e102aa382e63121661ff0567f7523515e459922d
## What changed
- Add `codex-realtime-webrtc` with a length-prefixed, 256-byte JSON control protocol for `hello`, `ready`, `close`, and `closed` messages.
- Add a hardened `codex-voice-host` binary that validates protocol and build compatibility, handles orderly shutdown and parent pipe loss, and exposes its build commit.
- Keep this initial foundation limited to process lifecycle management; it does not open audio devices, load native plugins, negotiate WebRTC, or enable voice in the TUI.
## Testing
- Exercise the helper as a subprocess, covering handshake, explicit close, parent pipe loss, malformed frames, incompatible builds, and invalid message order.
GitOrigin-RevId: 6d8d7dd7ba5c4886879882d79314d235f6ab7cf4
## Why
Guardian reviews need the original conversation evidence even after the parent context has been compacted, while rollback must still remove evidence from reverted turns.
## What changed
- Build synchronous and asynchronous Guardian transcripts from the retained review-history snapshot.
- Use the shared Guardian transcript collector for consistent entry formatting, tool attribution, and per-entry truncation while preserving the existing transcript retention budgets.
## Testing
- Add app-server coverage for retaining user and tool evidence after compaction and discarding it after rollback.
- Extend transcript tests for standalone tool outputs, shell calls, attribution, truncation, and retention limits.
GitOrigin-RevId: a18b1176f14a4d006c263aa82d4e593afee66bc3
## Why
Context compaction can replace original conversation items that Guardian still needs to review approval-sensitive actions.
## What changed
- Retain a bounded, chronological review history independently of the model's compacted history.
- Keep separate limits for user messages and other transcript items so tool traffic cannot evict user instructions.
- Use the retained evidence for synchronous and asynchronous Guardian transcripts, while resetting it after rollback or history reconstruction.
## Testing
- Cover retention through compaction and eviction, reset behavior after rollback, independent size limits, and asynchronous transcript construction.
GitOrigin-RevId: c5851e992820504fc18de8cfec7f6f9f1b69f316
## What changed
- Define the shared 16 MiB thread stack budget in `codex-async-utils`.
- Use it for both the async main/runtime threads and the dedicated approval-review thread.
GitOrigin-RevId: c825669e1545bcfaeaaaa07066dc63874f46630f
## What changed
- Allow MCP server names to contain `:`, `@`, `/`, and `.`, enabling names such as `npm:@modelcontextprotocol/server-sequential.thinking`.
- Preserve these names across `mcp add`, `get`, `list`, and `remove`, runtime tool namespaces, and OAuth credential lookup.
- Quote non-bare server names in generated `config.toml` recovery hints and keep similarly escaped OAuth credential names isolated.
## Testing
- Add CLI and runtime round-trip coverage for npm-style names.
- Add snapshot coverage for quoted recovery hints and a regression test for OAuth credential-name collisions.
GitOrigin-RevId: 97e9353cdbc544db4eb2377ddbfa1d2d539b1e04
## What changed
- Send the core report event before its attachments, then upload each attachment in a separate gzip-compressed envelope linked to that event.
- Bound encoded and decoded payload sizes, truncate oversized attachment copies with format-aware handling for JSONL, and preserve attachment priority when applying size limits.
- Retry transient attachment failures within a shared upload-time budget while honoring Sentry rate-limit and retry headers without replaying the core event.
- Add APIs to prepare and send persisted report events and attachments using a stable report ID, explicit delivery outcomes, and caller-controlled retries.
## Testing
- Cover attachment retries, truncation, rate limits, rejected responses, transport failures, redirect handling, content types, diagnostic consent, and report tags.
GitOrigin-RevId: 5eacd384843795d05d1c024b76e1c6d0c1c4b8d7
## What changed
- Admit the curated remote Browser plugin's `Stop` and `SubagentStop` hooks when its listed `browser.turn_ended` tool matches the expected connector and is enabled by app policy.
- Carry trusted app routing metadata and the MCP environment through hook registration and execution.
- Register hooks from multiple executor environments, while deduplicating cleanup calls that share an event, MCP environment, server, and tool.
## Testing
- Cover Browser and Computer Use cleanup through separate MCP routes, including user- and managed-policy disablement.
- Verify routing metadata, environment selection, multi-environment registration, and target deduplication.
GitOrigin-RevId: 66de088fd201b9ed0db8b97c23d33de88135120d
## What changed
- Add a reusable transcript contributor for synchronous and asynchronous Guardian context, with borrowed conversation history and request-specific configuration.
- Preserve conversation order and role or tool attribution while applying separate per-entry limits for messages, ordinary tools, and Node REPL-backed outputs.
- Make tool calls, tool outputs, and reasoning independently configurable, and expose transcript collection without requiring section composition.
- Register the transcript contributor in a process-wide default registry that retains no request state.
## Testing
- Add unit coverage for role and tool attribution, optional evidence sources, orphaned and named tool outputs, registry reuse, and request-specific entry limits.
GitOrigin-RevId: 2b60f8db4618de8a7175f8ee0183375a526a87db
## What changed
- Add the `codex-guardian-context` crate for assembling structured context shared by synchronous Guardian review and asynchronous scoring.
- Preserve transcript entry roles and original byte counts, and let section contributors declare shared or consumer-specific scope.
- Collect applicable sections in registration order, skip optional sections, and fail the collection when required evidence is missing.
- Provide UTF-8-safe prefix/suffix truncation with approximate omitted-token accounting.
## Testing
- Cover scoped registry collection, ordering, optional sections, required-evidence failures, truncation markers, and UTF-8 boundaries.
GitOrigin-RevId: 19d8458403c470c9b413992dbff925a12259c3c5
## What changed
- Generate a UUIDv7 turn ID for each Guardian classification and preserve it across retries.
- Record the owning turn as `parent_turn_id` and propagate its trusted `root_turn_id` when known, including through the tool lifecycle extension API.
- Omit ambiguous or unknown root lineage and keep classification identities distinct when reusing Guardian sessions and WebSocket connections.
## Testing
- Cover classification metadata across retries, connection reuse, concurrent samples, auth refresh, and consecutive owning turns.
GitOrigin-RevId: 78757f2ad031844e4b545802f634c678a9ee2298
## What changed
- Convert history backend `images` into `input_image` function-call output items alongside encrypted or plaintext history content.
- Keep image data out of logged output and post-tool-use hook responses.
- Reject malformed image attachments instead of silently dropping them.
## Testing
- Cover encrypted and plaintext outputs, supported image detail values, malformed attachments, and propagation into the next model request.
GitOrigin-RevId: a8eee10eb09c637bcfb06a759dd6313caf707e51
## What changed
- Inject W3C `traceparent` metadata into code-mode session and execution requests.
- Carry each execution's trace context on streamed tool callbacks so callback and nested-tool spans remain connected across the gRPC boundary.
- Preserve the relevant spans when execution, callback, and dispatch work moves into spawned tasks.
GitOrigin-RevId: 6482963cb9b2e2f0ea27f1345bba208b70a80d0b
## Why
Guardian treated all skill instructions as untrusted, so it could not use the
invocation of a user-owned skill as authorization evidence.
## What changed
- Record explicit and implicit skill invocations through extension contributors.
- Send Guardian a bounded, deduplicated list of canonical skill paths only when
they resolve under the user's Codex or `.agents` skill directories.
- Keep repository skills and symlinks that escape trusted roots untrusted, and
send only verified paths rather than skill contents to the classifier.
- Avoid recording host skill prompts that were superseded by core skill
injection.
## Testing
- Added unit coverage for trusted roots, symlink escapes, deduplication, and
size limits.
- Added integration coverage showing that Guardian trusts invoked user skills
while rejecting a forged repository skill.
GitOrigin-RevId: 1cc0be230f7e6649110201c23c3de8f26447ff36
## Why
Linux managed networking routed proxy connections through filesystem-backed Unix sockets, requiring an extra readable sandbox path and stale socket cleanup.
## What changed
- Transfer loopback TCP listeners from the sandbox namespace to host bridge processes over anonymous Unix socket pairs.
- Validate transferred descriptors, keep bootstrap channels private to each sandbox launch, and close them before running untrusted commands.
- Tie proxy bridge lifetime to the sandbox so cancellation closes active upstream connections.
## Testing
- Cover descriptor validation and interrupted handoffs.
- Verify concurrent sandboxes keep proxy endpoints isolated and do not inherit privileged sockets.
- Exercise managed networking end to end through `app-server`, confirming proxied access succeeds while direct host access remains blocked.
GitOrigin-RevId: 6561e09c83b927c604951bf2aa00ff532d179da5
## What changed
- Append accepted Guardian V2 classification results to rollout history for non-ephemeral threads.
- Keep resumed and forked threads from restoring a persisted score into active Guardian state.
## Testing
- Verify that asynchronous scoring records the resulting `SecurityRiskScore` rollout item.
- Seed resume and fork tests with a persisted score and verify that approvals ignore it.
GitOrigin-RevId: 40d63a2ea7e7cf6398402c6aed7d5e5727dc9d68
## What changed
- Add `--otel-trace-exporter` for sending OTLP/HTTP JSON traces directly to an exporter.
- Add the mutually exclusive `--otel-trace-listen` option for streaming raw OTLP trace batches over a trace-only WebSocket, backed by a loopback OTLP receiver.
- Instrument host startup, transport requests, and gRPC operations with request, session, execution, cell, wait, and tool-call identifiers where available.
- Flush the trace provider with a bounded timeout during shutdown.
GitOrigin-RevId: 4dcdb2bc3b15166dccd5041fb875caea74f3f6fe
efrazer-oai