## What changed
Allow `mcpServer/resource/read` to specify `target: {connectorId, linkId}` for direct hosted app reads without tool discovery, when supported by the backend. Require an explicit `linkId`: a string selects an account, while `null` requests no-auth access subject to backend policy.
Restrict direct targets to `codex_apps` and reject empty connector IDs, empty link IDs, and synthetic link IDs. Preserve originating app/account scope when `originCallId` and `threadId` are supplied, and retain discovery when `target` is omitted.
Update protocol schemas and TypeScript and Python models, preserving required-but-nullable `linkId` semantics in Python code generation.
## Testing
Extend resource-read tests to check target metadata with and without a thread, including explicit no-auth targets and omitted targets. Add Python model tests for string and null `linkId` values and rejection of a missing `linkId`.
GitOrigin-RevId: 8cf5595fbdd937193aeb529901fc95299f6e18ad
## What changed
Add `LocalAgentControl::resume_agent` to reuse an existing thread or restore it from its rollout when lookup returns `ThreadNotFound`. Return the agent's current status, metadata, and configuration snapshot.
Route the `resume_agent` tool through this method, replacing its status-based resume check and separate restoration helper.
GitOrigin-RevId: 2ae0572a030f169eca1760ba0aff1fb9e2ab6651
## Why
Accepted inter-agent messages can still be waiting in the submission queue when a worker appears idle. Evicting that worker can lose the queued work, while cancelling an eviction caller can leave shutdown unfinished and allow delivery to a closing runtime.
## What changed
- Pin V2 recipients until queued submissions are handled or dropped, and verify that delivery targets the registered runtime.
- Move `Submission` into core so it can carry the residency guard through queue handoffs.
- Give eviction exclusive access to each runtime and keep it counted against capacity until removal. Run teardown in a separate task so it completes even if its caller is cancelled, and remove registry and residency entries together.
## Testing
Add a regression test covering queued follow-up delivery, eviction refusal while mail is pending, cancelled eviction completing teardown, rejection of late delivery, and capacity reuse after removal.
GitOrigin-RevId: d6de3d68cb6b911942e9ddfc05c65b3741b796b2
## Why
Channel and thread subscriptions, or explicit `agents_to_notify`, could cause agents to receive notifications for their own posts.
## What changed
Exclude the author from notification recipients, even when explicitly targeted. Preserve the author's subscriptions so replies from other agents still reach them, and document this requirement in the board API.
## Testing
Update board tests to cover explicit self-targeting, subscribed authors, and delivery of other agents' replies. Update the model-context scenario and snapshot to verify posts remain searchable without a `CHANNEL_POST` self-notification.
GitOrigin-RevId: 0b2558e7df79122a6da06ad592f9735ba260cce1
## What changed
- Route both multi-agent spawn handlers through `LocalAgentControl::spawn`, accepting user input or an agent message.
- Centralize spawn message attribution and canonical path validation, and require message input to use `TriggerTurn`.
- Return the child's configuration snapshot alongside `LiveAgent`, so handlers obtain effective settings directly from spawning without a separate lookup.
- Update child test fixtures to use the shared spawn entry point.
GitOrigin-RevId: 9f9278df08041a62215f9ec3d38688c78fc5e0e2
## Why
MCP requests pass through background transport queues, so HTTP requests need the caller's trace context carried explicitly to preserve trace ancestry.
## What changed
- Capture W3C trace context in request metadata for tool and resource operations, custom requests, and event streams.
- Restore that context in an `mcp.http.request` span around HTTP POSTs, linking outgoing HTTP traces to the originating request.
- Preserve application metadata while replacing trace fields with the current caller's context and removing stale `tracestate`. Read the SDK's merged metadata so extension fields retain precedence over parameter metadata.
## Testing
Add a unit test for metadata merge precedence and an integration test covering concurrent paginated requests, tool calls, custom requests, and tool-call continuations across legacy and `2026-07-28` protocol modes. Verify HTTP trace ancestry, metadata preservation, and removal of stale `tracestate`.
GitOrigin-RevId: 0b22cd75f31f9fcb855b27fa8d34ecdffd6e3549
## Why
Clients with a gateway sign-in UI need to control when browser authorization starts and inspect credential readiness before making authenticated requests.
## What changed
- Add `initialize.capabilities.explicitGatewayOauth` to require explicit login while allowing existing credentials to refresh. Preserve automatic authorization for clients that omit the capability, and prevent later connections from undoing explicit opt-in.
- Add `account/gatewayOAuth/read`, `account/gatewayOAuth/login`, and `account/gatewayOAuth/cancel`, plus `account/gatewayOAuth/changed` notifications. Send the authorization URL only to the initiating connection and cancel its login on disconnect.
- Check gateway authentication before returning cached results from `model/list`, with restart guidance when provider settings have changed.
- Update protocol schemas, TypeScript and Python bindings, and document capability probing and the sign-in lifecycle.
## Testing
Add tests for passive readiness reads, credential reuse after login, token exchange failures, cancellation and immediate retry, connection ownership, legacy versus explicit login, and model-list authentication checks.
GitOrigin-RevId: a26e116a62c9f3db84dc238a40b7f4e816eb1594
## Why
Standalone web search selected a proxy route only for the initial endpoint. Redirect destinations can require a different system proxy route.
## What changed
- Add `RouteAwareClientPool` support to `ReqwestTransport` for both buffered and streaming requests, and use it for standalone web search.
- Preserve default Codex headers and Cloudflare cookie handling across routes, while retaining the default client behavior when route-aware handling is disabled or Codex is sandboxed.
- Share request construction so URL authentication and header precedence follow `reqwest` semantics, applying them once before redirects and TLS retries.
- Map route-aware failures to transport errors and remove request URLs from those errors.
## Testing
Add regression coverage for redirects through distinct proxies, preservation of POST bodies and default headers, URL authentication and header precedence, and transport error classification without URL leakage.
GitOrigin-RevId: 19a10a62118846db09dd95265dc277e54aac09ef
## Why
Injecting context before the first turn currently forces a full flush. Stores need a preparation checkpoint that can leave disposable context in memory, while local storage must keep prepared context durable before the first user input.
## What changed
- Add `PersistContext::ThreadPreparation` and `CodexThread::checkpoint_preparation()`, and use the checkpoint in `inject_response_items()`.
- Allow stores to defer rollout-derived metadata writes through `record_thread_metadata()`, including during preparation and execution checkpoints. Keep standard metadata updates synchronous.
- Flush local storage at preparation checkpoints so injected context survives restart.
## Testing
Add tests showing that preparation and first sampling can proceed without waiting for durable metadata. Cover prepared context in first and follow-up requests, plus durability before first input and restoration after restart, in both legacy and paginated history modes.
GitOrigin-RevId: 74f6bb1a5f8d47192364b8bba6afd703a3b7d688
## Why
Aligned equations and common optimization notation previously fell back to TeX source. Scripts without Unicode equivalents also prevented otherwise supported expressions from rendering.
## What changed
- Add display layouts for `aligned` and `\boxed`, preserving fraction geometry and alignment with surrounding math.
- Stack sum limits and `\underset`/`\overset` annotations in display math, with compact forms for inline math and nested arguments.
- Support `\substack`, uppercase `\mathcal`, and single-grapheme `\widehat`.
- Preserve scripts without Unicode equivalents using explicit grouping, such as `x_{gpt}` and `x^{q+1}`.
- Keep layouts bounded and retain source fallback for unsupported input or expressions that do not fit.
## Testing
Add snapshots and regression tests for optimization models, display limits, grouped scripts, fraction alignment, narrow-width fallback, malformed input, and layout bounds. Add streaming coverage comparing character-by-character output with complete rendering at wide and narrow widths in rich and raw modes.
GitOrigin-RevId: 83937880a309375f472228368ebe885d4f50bf9c
## Why
Conversations open in another app disable the composer. Let users continue in an editable fork while the original conversation remains owned by that app.
## What changed
- Add an `f`/`F` shortcut and footer hint to the locked conversation view, preserving local drafts and queued prompts in the fork.
- Show “Forking conversation…” while a fork is pending, block additional key input, and discard buffered input after forking from the locked view.
- Replace the previous session summary after a fork with “Fork created. You can continue here.”
- Keep the locked view and draft intact if the fork request fails.
## Testing
Add tests for shortcut ownership and modifiers, repeated input, editable forks that preserve drafts and queued prompts without taking the source lease, and failure recovery. Add snapshots for fork progress, completion, and the updated footer.
GitOrigin-RevId: 2ecdb0b7fc7e82d8295097faa567995d7a2f7d92
## What changed
Promote `daemon_auto_start` to stable and enable it by default for eligible interactive launches. Remove its entry from `/experimental`.
## Testing
Update daemon startup, `--no-daemon`, and startup failure tests to exercise the default without explicitly enabling the feature. Disable daemon startup in unrelated TUI and path-safety test fixtures.
GitOrigin-RevId: 107d71108b96d09431148d7d61f10c6381929e05
## What changed
Default `tui.fullscreen_transcript` to `true`, including when the `[tui]`
section is absent, and apply the same default to the first frame. Update the
configuration schema to match. Alternate-screen restrictions still take
precedence, and `tui.fullscreen_transcript=false` restores terminal scrollback.
## Testing
Update configuration and startup tests for the new default, including an empty
`[tui]` section and `--no-alt-screen`. Adjust PTY tests to cover default fullscreen
entry and explicit opt-out to terminal scrollback.
GitOrigin-RevId: e460dcd058d52c50da2abc5113bbb678e845d5fc
## Why
Reaching the pending tool-call limit could evict finished empty cells even though removing them frees no pending-call capacity. This loses the metadata needed to certify an empty tool-call inventory on a later `wait`.
## What changed
Only evict cells with pending calls when reclaiming pending-call capacity. Keep empty cells eligible for eviction when a cell slot is needed.
## Testing
Extend recorder coverage to check empty inventories under pending-call pressure in fresh and resumed sessions. Add a code-mode integration test verifying that `wait` serializes an empty inventory with `tool_calls_complete: true` while another cell has filled the pending-call budget.
GitOrigin-RevId: 559d0b4fdc9864c42a90b7d087eb2a3327272d5c
## What changed
- Add `GatewayLoginControl` so hosts can require caller-initiated browser authorization while retaining automatic login by default.
- Expose passive readiness checks, scoped status subscriptions, and cancellable browser login that reports success after credentials are persisted.
- Return non-retryable request errors for `LoginRequired` and `LoginInProgress`, while preserving retries for transient authentication failures.
- Keep rejected credentials unready until replaced, and prevent slow readiness reads from blocking cached requests or overwriting newer credentials.
## Testing
Add coverage for login cancellation, status notifications, external credential recovery, concurrent credential I/O, legacy automatic login, and request retry behavior.
GitOrigin-RevId: e236d203998ceb6eeaca9704cc05d20ad45f2931
## Why
Classifier requests need to preserve their owning thread's workspace routing and account binding, including when reusing pooled connections or retrying after authentication changes.
## What changed
- Share the thread's `WorkspaceRoutingContext` with Guardian v2 and resolve routing before leasing HTTP or pooled WebSocket connections.
- Reuse WebSockets only when their connection key and authentication state still match. Cache HTTP transports by URL and redirect policy, rejecting redirects when routing requires it.
- Stop classification requests and retries when the account owner changes while allowing token refreshes for the same user and workspace.
## Testing
Add regression coverage for routing failures with prewarmed sockets, shared thread routing state, account switches during HTTP and WebSocket requests, same-account token refreshes, and HTTP redirect-policy cache changes.
GitOrigin-RevId: 7b3efcadb4797b6a2de2e28e7506b297b0728d69
## What changed
Add nullable `httpOrigin` to `McpServerStatus`, derived from the effective configured endpoint for both configured and plugin-provided servers. Return only the HTTP(S) origin, excluding credentials, path, query, and fragment; return `null` for stdio transports, invalid URLs, and non-HTTP(S) schemes. Update the generated protocol schemas and TypeScript and Python types.
## Testing
Extend status integration tests to cover configured and plugin-provided HTTP servers, verify that endpoint paths and query parameters are omitted, and assert `null` for a stdio server. Update protocol tests to check null serialization and compatibility with older inventory responses.
GitOrigin-RevId: 033ebdeefe829e3a48b2d4ab7d8866dac4cda5c5
## Why
Credential I/O can block async workers, and canceled browser logins must not release the credential store lock while a write is still running. Provider errors can also echo secrets from authorization URL query parameters.
## What changed
- Move credential reads and writes to `spawn_blocking`, retaining the cross-process lock until encryption and the atomic write finish, even if the caller is canceled.
- Clear pending rotated credentials during browser login only when stored credentials have changed, preserving recovery after a failed login without overwriting an external login.
- Omit provider response details and request IDs when the authorization URL contains query parameters, matching the existing protection for token and resource URLs.
## Testing
Extend regression coverage for authorization URL query-secret redaction and failed browser login after a failed credential save, including retry, expiration, and external-login recovery.
GitOrigin-RevId: 4a63702a260fd7f3e2ad2314b0124c0d647d4f12
## Why
A queued close notification from an old runtime can arrive after the same thread has been resumed. Because thread IDs survive reloads, handling that notification can incorrectly exit the TUI or switch away from the displayed thread.
## What changed
Confirm the displayed thread's status with `thread/read` before handling its close notification. Ignore the notification if the thread is still loaded. Bound verification to five seconds and retry an internal server error once.
If verification fails, reconnect remote sessions. Preserve close handling for embedded sessions, unreadable unpersisted threads, and servers that do not support the request.
## Testing
Add regression tests for stale and genuine close notifications, plus disconnects, timeouts, transient and persistent server errors, embedded-session fallback, and unsupported requests.
GitOrigin-RevId: 783433b11ed268aed521f3b2cc4d0aa3a36a3836
Refresh the collaboration namespace hash and aggregate tools hash in the
`code_mode_catalog_messages` snapshot.
GitOrigin-RevId: bcfb793ba379760219cb4214d39f9c8bcd01e40c
## What changed
Move `codex exec-server` argument definitions, transport validation, configuration loading, authentication, and shutdown orchestration from `codex-rs/cli/src/main.rs` into `codex-rs/cli/src/exec_server_command.rs`.
Expose startup through `ExecServerCommand::run`, merge the root `--strict-config` flag into the command before dispatch, and update existing argument tests to use the new entry point.
GitOrigin-RevId: 4bcc59db2bd6e1d153a366142bd0b93ad03c6951
## Why
Standalone web search used a default HTTP client, bypassing the configured system proxy route when `respect_system_proxy` was enabled.
## What changed
Pass the configured `HttpClientFactory` to the web search tool and create its client asynchronously for the provider's search URL using the API route policy. Export and reuse `SEARCH_ENDPOINT` so route selection and search requests use the same endpoint.
## Testing
Add an isolated regression test with environment proxies removed and a mock system proxy. Verify that standalone web search reaches the proxy and returns its result in the follow-up model request.
GitOrigin-RevId: 3b64803a777b9d1eb0ccf694e06658b0fd562129
## Why
Dragging horizontally along the top or bottom transcript row could trigger autoscroll, moving the text under the pointer while selecting it.
## What changed
Require vertical pointer movement from the initial press row before selection autoscroll can begin. Remember that movement so a vertical drag can return to its starting edge and still autoscroll, and preserve the original pointer row across wheel scrolling.
## Testing
Extend regression tests and snapshots for horizontal selection at both edges, stable selected text across repeated ticks, wheel scrolling before the first drag, and autoscroll after a vertical drag returns to its starting edge.
GitOrigin-RevId: e13f3a80adbead1eecbeb281301667c8e12e1541
## What changed
- Add optional `network.mitm_ca` configuration with `certificate_file` and
`private_key_file` for trusted proxy configuration. Require MITM to be enabled
and retain the generated CA when no external CA is configured.
- Validate absolute paths, regular files, file sizes, certificate/key matching,
and Unix private-key permissions. Reject symlinks on Unix, private keys embedded
in certificate files, and external private keys on non-Unix platforms.
- Store derived external-CA trust bundles in the proxy artifact directory,
include only certificates, and skip inherited generated bundles to avoid
retaining stale roots.
- Preserve MITM for external CAs when disabling credential brokerage. Reject
external CA configuration for remote execution, even when the proxy is disabled,
and reject unknown fields in `NetworkProxyConfig`.
- Default the upstream request version adapter to HTTP/1.1 and remove the request
URI from upstream request failure context.
## Testing
Add regression coverage for external CA configuration, mismatched keys, embedded
private keys, non-Unix rejection, trust-bundle placement and contents, stale-root
exclusion, credential-broker toggling, and remote configuration rejection.
GitOrigin-RevId: cb209295c19fbe53a9fa0194f11ff06acccabef6
## What changed
Remove `ultrafast` from the bundled `gpt-5.6-sol` model's `service_tiers`, leaving `priority` (Fast) as its only advertised service tier. Update scenario snapshots for the affected multi-agent tool definitions.
GitOrigin-RevId: 9a235d8f7ea8a72e71152708d2d602194256d420
## Why
Extension calls omitted environments whose working directories could not be converted to host-native paths, preventing extensions from receiving those environments.
## What changed
Store `ToolEnvironment.cwd` as `PathUri` and pass all turn environments to extension tools without requiring host-native path conversion. Keep image generation's existing path requirements by selecting the first environment with a convertible working directory when reading referenced images or saving generated images.
GitOrigin-RevId: b4320c6e07d27ef59885cd0013e5d1c535f69659
## What changed
- Add `auto_review.extra_policy` and the managed `guardian_extra_policy` requirement to supply policy text alongside the resolved tenant policy. Nonblank managed values take precedence; blank values are ignored.
- Render the additional text through `{{ extra_policy }}` in Guardian reviewer templates and append it to the tenant policy for Guardian v2 classification before truncation.
- Preserve placeholder-like text inside supplied policies literally.
## Testing
Add coverage for configuration precedence, blank values, template substitution, and classifier prompts, plus a scenario verifying that managed tenant and extra policies reach the Guardian reviewer together.
GitOrigin-RevId: 180d8d716c63fe96a92ec5bfbd22db4ddccd4f1f
## Why
Attachment stores need the receiving thread ID to support thread-based placement.
## What changed
Add `thread_id` to `UploadRequest` and pass the session's thread ID through image preparation for messages and tool outputs. Include the ID in debug output while continuing to redact attachment bytes.
## Testing
Extend the image rollout test to assert that a new image uploaded after resume carries the resumed session's thread ID. Update the debug-output test for the new field.
GitOrigin-RevId: f81e3bd761dca704064287177b8ecd7175662f07
## What changed
- Add `tools.code_mode` catalog messages for `exec`, `wait`, deferred-tool guidance, and shared MCP TypeScript definitions.
- Render `{{ default_exec_yield_time_ms }}` and `{{ image_helper }}` in `exec` descriptions while preserving runtime tool declarations and the freeform grammar.
- Resolve `wait` descriptions and parameter schemas independently, falling back to bundled parameters for invalid or unsupported schemas.
- Use the active model's Code Mode messages, including after mid-turn model changes. Missing overrides retain bundled defaults; empty text overrides suppress the corresponding text.
## Testing
Add coverage for literal template substitution, runtime section preservation, independent `wait` overrides and fallback behavior, mid-turn model changes, and a yielded cell completing through `wait` with catalog messages.
GitOrigin-RevId: e542a0cd47a7138a414871192cee47790ed1214e
## Why
Remote plugin requests always sent `OAI-Product-Sku: codex`, ignoring the existing `apps_mcp_product_sku` setting.
## What changed
Pass `apps_mcp_product_sku` through plugin configuration and use it for authenticated remote plugin requests, including discovery, search, installation, and sharing. Keep `codex` as the default and include the SKU when comparing remote service configurations.
## Testing
Extend app-server plugin listing and core agent-turn tests to check default and configured SKU headers. Update the CLI worktree test to wait for the user prompt's model request, skipping background title generation requests.
GitOrigin-RevId: 508c9ef9aa3e41b87c92383c3088eb1eb9227fd8
## What changed
- Persist producer-recorded item start and completion times in thread history, preserving existing non-null values on updates.
- Return nullable `startedAtMs` and `completedAtMs` Unix millisecond timestamps from `thread/items/list`, and update the generated schemas and TypeScript and Python types.
- Leave timestamps unknown for existing rows and older writers.
## Testing
Add coverage for exact timestamp persistence, protocol round trips with present and missing timestamps, paginated item responses, and compatibility with older database writers.
GitOrigin-RevId: 894853481085782ff54db1704799e41446d15e51
## What changed
- Capture optional `creator_user_id` and `creator_account_id` from authentication when creating a thread, including forks.
- Carry these fields through thread storage, rollout metadata, and a SQLite migration. Leave them absent when unavailable or when reading older threads.
- Preserve recorded creator values across resume and metadata updates. On revert, recover missing rollout values from SQLite before writing replacement metadata.
## Testing
Add coverage for ChatGPT and API-key sessions, resume under another account, forks using current authentication, metadata extraction and upserts, and repeated reverts after creator fields are removed from a rollout.
GitOrigin-RevId: 9839fa42f9392f12226002e2c27d05d5656f5695
Change `R to Retry` to `r to retry` in the TUI notice and update the
corresponding rendering snapshots.
GitOrigin-RevId: f7971ba0f76ac446a5fea53b44390f65aa965be4
## Why
On Windows, MXC needs `SystemDrive` to resolve platform directories and
`LOCALAPPDATA` to create the sandboxed helper process. The helper environment
filter previously dropped both variables.
## What changed
Allow `SystemDrive` and `LOCALAPPDATA` alongside `PATH` in the Windows helper
environment, using case-insensitive name matching.
## Testing
Extend the Windows environment-filtering test to verify that mixed-case runtime
variable names are preserved while `PATH_INJECTION` and `OPENAI_API_KEY` remain
excluded.
GitOrigin-RevId: bab242dd59da59ac6e7f428436e1c139aadadfdd
## Why
Code Mode callbacks can retain skill tools after another turn becomes active. Looking up the active turn when a delayed skill invocation completes can lose access to the originating turn's metrics and metadata.
## What changed
- Capture and retain the originating `SkillTurnMetrics` when constructing skill analytics.
- Expose turn analytics metadata through the turn extension store and carry it into skill telemetry.
- Add optional turn metadata to `TrackEventsContext` and pass it from app, skill, and plugin usage call sites.
## Testing
Add a regression test that yields a Code Mode cell, starts another turn, and releases both skill reads through a shared barrier. Assert that each `skill_invocation` event retains its originating `turn_id`.
GitOrigin-RevId: aa629dd5f84563d558aa6a86bfbdfc356f1b98e4
## Why
Realtime WebSockets connected directly, bypassing the configured proxy policy for Voice's WebRTC sideband.
## What changed
Pass the configured `HttpClientFactory` into `RealtimeWebsocketClient` and connect through the shared `WebSocketConnector`. Add support for supplying an existing Rustls configuration to preserve custom CA handling and Windows platform trust.
## Testing
Add an integration test that enables `respect_system_proxy`, starts a WebRTC conversation, and verifies that the sideband establishes its session through an HTTP `CONNECT` proxy and closes successfully.
GitOrigin-RevId: d974c9275d7fe29f388d56a9d5d8ce0c483eb8d0
## Why
The 999-byte response budget and blanket string truncation could discard assistant answers alongside supporting history. Thread lists could also lose entries when shortened to fit the budget.
## What changed
- Raise the response budget to 8,000 bytes and remove the separate 2,000-character cap on assistant messages in `read_thread` and `wait_threads`.
- Compact oversized read responses around each turn's latest assistant message, and retain every wait target and returned list entry with pagination cursors intact.
- Shorten only content fields when further reduction is needed, preserving valid JSON and protocol values such as IDs, cursors, phases, and statuses. Mark compacted responses and shortened content with `truncated`.
- Request archived thread pages at the requested limit without retrying with smaller pages to meet the response budget.
## Testing
Add regression coverage for oversized wait responses with Unicode and escaped text, list entry and cursor preservation, and an oversized read whose assistant answer survives into the next model request. Extend read and wait tests to verify assistant messages longer than 2,000 characters are retained when they fit.
GitOrigin-RevId: 459fa522d02fbe4cd877b9afe8e66c9358b7bbce
## Why
Activity indicators and queued input previews could separate usage notices and
reading controls from the composer.
## What changed
- Reserve the shared hint row below activity and previews in the owned transcript
layout, and use its rendered position for hints and reading controls.
- Clip spacing and hints before activity and previews when vertical space is tight.
- Fit usage notice details within half the row, allowing the shortest complete
warning to use more space on narrow terminals.
## Testing
Expand regression tests and snapshots for running turns, queued inputs, multiline
drafts, short terminals, follow-control clicks, and hidden actionable banners.
Cover five-hour and weekly usage notice width thresholds.
GitOrigin-RevId: e73b3614839ce35c5b0a009901514627a77d4190
Delete the workflow that refreshed `codex-rs/models-manager/models.json`
and opened update pull requests every four hours or on manual dispatch.
GitOrigin-RevId: 0179d8af57b17fd69e9b7e94b7f7ed7b0c6dcc24
## Why
Local MCP servers communicate over stdio, so unrelated parent file descriptors should not propagate into the server or its descendants.
## What changed
Apply `DescriptorPolicy::StdioOnly` when launching local stdio MCP servers on Unix, preserving their explicit transport stdio.
## Testing
Add Unix integration tests that check inheritable pipe, socket, and file descriptors are absent from servers and descendants across absolute, relative, and shell-fallback launches. Verify MCP communication, arguments, environment, working directory, parent descriptor ownership, and exec failure reporting remain intact.
GitOrigin-RevId: 37409a5673dbaafa851fd1f78e3a2443eda5f7c6
## What changed
Serialize `ClientResponse` JSON-RPC results through the untagged
`ClientResponsePayload` enum, and serialize payloads directly instead of matching
on each variant. Preserve existing result shapes and request IDs.
## Testing
Add regression tests covering v1 and v2 payloads with integer and string request
IDs, legacy interrupt responses, and serialization errors from non-UTF-8 paths
on Unix across typed, borrowed, and owned response conversions.
GitOrigin-RevId: d46403b02f910a0d3e41a48a5bc6faa2581873e1
## What changed
- Disable default features for `sentry`.
- Disable default features for `syntect`, explicitly enable `parsing`, `plist-load`, and `regex-onig`, and switch `two-face` to `syntect-onig` in `codex-rs/tui`.
- Remove the resulting unused dependencies from the Cargo and Bazel lockfiles, including Actix, Sentry integrations, `ureq`, and `yaml-rust`.
GitOrigin-RevId: b3ca6610fdc60ab99909660f56099fbb4093b9c5
## Why
Chat analytics displayed raw credit strings, exposing values such as `0E-10` for plan-covered tasks and unnecessary trailing decimal zeros.
## What changed
Format ordinary credit amounts with two decimal places and thousands separators. Round directly from decimal digits to avoid floating-point rounding errors, so `1.005` becomes `1.01`. Normalize zero to `0.00`, while preserving the original strings for nonzero sub-cent amounts and values outside the safe conversion range.
## Testing
Add assertions for decimal and scientific notation, signed zero, rounding boundaries, tiny adjustments, and large values. Update the chat analytics snapshot to cover a plan-covered task showing `0.00` credits.
GitOrigin-RevId: f946cb408c2c37291447f90de02ebbb557fbc662
## What changed
- Describe GPT-5.6-Sol as a reliable agentic workhorse for everyday tasks and change its catalog `priority` from `6` to `4`.
- Describe GPT-5.5 as a proven previous-generation model for coding and general work.
- Refresh model picker, migration prompt, and agent tool snapshots to reflect the catalog updates.
GitOrigin-RevId: b39f51c22862b8cef585ed76f3973c9f4b670c27
## Why
Row derives and migration embedding do not need query macros or a host SQLite driver.
## What changed
- Remove the `macros` feature from `sqlx` and depend directly on `sqlx-macros` with only `derive` and `migrate` enabled.
- Update state and thread-store derives and migration embedding to use `sqlx_macros`.
- Enable `sqlx-sqlite`'s `offline` feature directly to preserve query-description support in the target driver.
- Pin `sqlx`, `sqlx-macros`, and `sqlx-sqlite` to `=0.9.0` to keep their versions aligned.
GitOrigin-RevId: 8a8ef691ff2862a7dad978a578c5206b52dfc0b6
Move status resolution, live settings, and subagent input eligibility into
`enrich_loaded_thread`. Keep `enrich_loaded_threads` responsible for fetching
watched statuses and enriching threads concurrently with `join_all`, preserving
existing behavior.
GitOrigin-RevId: 54f7b61b7cc6dcdfb4a63c1906080858b18df378
## What changed
Add a Voice entry using the configured `toggle_voice` binding (`F8` by default). Show it only when voice commands are enabled and no side conversation is active.
## Testing
Update footer and shortcut overlay snapshots to include the Voice entry.
GitOrigin-RevId: ba92f5af1ce1a06d9700d31dcc90e5acb1613803
## What changed
- Record each MCP source and its first turn, including connector and plugin identifiers when available. Cover direct and Code Mode calls, including returned errors and results that are not printed.
- Persist cumulative attribution checkpoints and restore them across compaction, resume, and forks, including forks limited to recent turns.
- Attach fresh attribution to Responses API `client_metadata` under `mcp_attribution`, outside model-visible content. Restrict transmission to allowed OpenAI HTTPS destinations for both HTTP and WebSocket requests.
- Report `attribution_error` for legacy history without checkpoints, malformed or conflicting attribution, and serialized attribution exceeding 16 KiB.
## Testing
Add coverage for source deduplication, checkpoint persistence and restoration, recent-turn forks, direct and Code Mode calls, destination filtering, and the serialized size limit.
GitOrigin-RevId: fd285e152ca9e24bfa000debb20013709d67a86e
## Why
The Linux sandbox rejected bind mounts of ancestors of the app-server socket directory, even when the exposed socket paths could be masked. This prevented sandbox startup with otherwise usable temporary-directory mount layouts.
## What changed
- Collect the socket directory and its exposed ancestor-mount aliases, then mask each path after filesystem binds, including read-only subpaths and the synthetic-mount registry.
- Continue rejecting direct directory or socket aliases and nested mounts that cannot preserve socket isolation.
- Reject non-UTF-8 mask destinations to avoid masking a different path through lossy conversion.
## Testing
Extend mount-analysis tests for ancestor aliases, private temporary directories, and WSLg masks. Extend socket-isolation coverage to verify that ancestor and registry aliases hide daemon sockets while unrelated sockets remain reachable. Add a regression test for non-UTF-8 mask paths.
GitOrigin-RevId: 49a9a764fbe1fddacd99c3a78099fbffff53b944
victor-openai