## Why
Detached Windows daemons can inherit the launcher's output pipes, leaving callers waiting for EOF after the launcher exits.
## What changed
Clear inheritance flags on the launcher's standard handles before spawning managed Windows processes. Leave the flags cleared to protect concurrent launches while preserving the child's configured stdio, and tolerate missing or already-closed handles.
## Testing
- Add a Windows regression test verifying that captured launcher output closes while the detached child remains alive and writes to its configured log.
- Give optional MCP startup grace tests more time to complete on slow runners while keeping the pending server's startup timeout longer than the turn timeout.
GitOrigin-RevId: 053e0417793db3c961e738476a05c7467978f339
## What changed
Expose Windows process creation flags on the shared command wrapper and use
`CREATE_NO_WINDOW` when launching local stdio MCP servers, including fallback
launches without Job Object containment. Preserve `CREATE_SUSPENDED` when
assigning the server to a Job Object before execution.
## Testing
Add a Windows regression test covering direct launches and launches through
`cmd.exe`. Verify that the server has no console, initializes successfully,
returns tools, and exits after shutdown.
GitOrigin-RevId: 84475e82999d91a431e09327d4f5639b59c01427
Set `CREATE_NO_WINDOW` when launching the code-mode host on Windows so the
child process does not create a console window.
GitOrigin-RevId: ce0d04d7f516d137bcaf5206140aaeaa23334022
## Why
A Windows breakaway launch can leave an outer Job Object attached after escaping an inner job. Job membership alone does not establish whether the daemon will be terminated, so rejecting all remaining membership can block valid launches.
## What changed
Remove the job-membership checks from the launch preflight and the spawned daemon. Keep the suspended breakaway probe to verify that launch is permitted before stopping an existing daemon, and terminate and reap the probe afterward.
## Testing
Add a Windows regression test with nested jobs that verifies the probe and daemon leave the inner job while retaining the outer job, and that daemon startup succeeds.
GitOrigin-RevId: 4c6aafd158300fa428ec398d72dc5d3411c0d8b8
## What changed
- Let `Left` return to the command center from a conversation open in another app, including while disconnected, without discarding the retained draft.
- Respect editor and Vim keymaps, conflicting shortcuts, and chord prefixes before enabling this navigation.
- Show `←/esc` in the command center hint when `Left` is available; otherwise keep `esc`.
## Testing
Add regression coverage for connected and disconnected navigation, draft preservation, and remapped `Left` with Vim enabled or disabled. Extend attach-conflict coverage to verify that both `Left` and `Esc` preserve the command center selection, and update footer snapshots.
GitOrigin-RevId: 80ef004b548176443ebee03c2a143e723e54c44a
## What changed
Update `each_loader_owns_refresh_until_its_last_clone_is_dropped` to use
`SequenceBundleClient` request notifications and Tokio timeouts instead of
request-count polling with wall-clock deadlines. Await refresh requests from
both loader owners together while retaining the assertions that each refresh
task stops when its last loader clone is dropped.
GitOrigin-RevId: 5fea595fa67d5348a23f59033502e012406a2bd1
## What changed
Add an optional `preempt` signal to `CodeModeSession::execute` and `CodeModeSession::wait` so callers can end an observation early while the cell continues running and remains available for later waits.
Support the signal in the in-process runtime and across both remote transports: `operation/yield` with the negotiated `yield-observation` capability for stdio, and `YieldObservation` for gRPC. Preserve signals received before gRPC observation registration, and retain normal timeout behavior for older hosts that lack support.
## Testing
Add runtime and transport tests covering early execute and wait yields followed by successful cell completion, yields before observation registration, and suppression of yield frames for older stdio hosts.
GitOrigin-RevId: 3f8049d8f0582be6b8f0832cc03f2d974a0b8f18
## Why
Starting a new session from the command center could clear the startup composer or replace it with `Loading task` before the attached chat was ready to render.
## What changed
Show the startup draft immediately and skip loading frames while it is present. Reset transcript state without clearing the visible draft, deferring the terminal clear until the next synchronized draw. Preserve this behavior during resize reflow as well.
## Testing
Add a regression test and snapshot covering inline and owned-screen modes. Verify that draft text survives the handoff, queued events leave the startup frame intact, and the attached composer retains the draft.
GitOrigin-RevId: 26a7ba2929a3b46537da960cbb7201b21b5dc61f
## Why
The worker's completion notice can interrupt the root's one-shot question response before the messaging call reaches its cancellation point in `guardian_subagent_review_preserves_late_root_user_authorization`.
## What changed
Gate the worker's initial response with a `oneshot` channel and a streaming SSE server. Release it after the root's question turn completes or its cancellation is observed, then wait for worker completion and shut down the server.
GitOrigin-RevId: d7f287557a7c27f1054c7ae90ba331ff26bba8ef
## What changed
- Add `tui.right_click_paste` with `auto`, `on`, and `off` modes. The default `auto` enables the fallback on Windows and Linux, including WSL when terminal detection is conclusive. `on` also enables macOS. Both modes skip SSH sessions and recognized VS Code terminals.
- Paste clipboard text through the normal composer input path when no selection, search, or blocking view takes precedence. Discard pending results after intervening input, focus loss, or changes to the target thread, draft, or cursor.
- Read text asynchronously through the shared clipboard worker, with a five-second deadline and the message size limit. Read the Windows clipboard through PowerShell on WSL and reject overlapping clipboard operations.
## Testing
Add coverage for platform and terminal policy, normal paste delivery, stale reads, overlapping clipboard operations, read timeouts, oversized text, and large command output.
GitOrigin-RevId: 0a7b6d445c09928da6c5335841ba2a9a66cc7e4b
## Why
Reasoning shortcuts stopped before Max even when the active model supported it, requiring users to open the advanced-reasoning picker.
## What changed
Allow `Alt+.` and `Shift+Up` to raise reasoning to Max in default and Plan modes. Keep Ultra behind the explicit picker and update the guidance to mention only Ultra.
## Testing
Add coverage for both shortcuts reaching Max in both modes, with footer snapshots. Update the Ultra boundary test to verify that raising from Max shows picker guidance without changing reasoning effort.
GitOrigin-RevId: 4e5ef2866f118a1f59313d494a2383db43293da9
## Why
Local compaction flattened retained user messages into a single text part, losing their original content boundaries and per-part annotations.
## What changed
Preserve the original content parts and annotations for text-only user messages that fit within the token budget. Borrow the original messages until selected history entries are materialized, and rebuild only the text fallback for truncated messages or messages containing media.
## Testing
Extend unit coverage for text boundaries, empty parts, omitted media, and retained metadata. Update the compaction integration test to verify that a multipart user message survives unchanged in the next request and retains its content parts and annotations in persisted replacement history.
GitOrigin-RevId: 39d9df9ae5360506c2a4bdeac76d89198dbbd39c
## Why
Async Guardian requests include retained user instructions even when complete copies are already present in the same request's transcript.
## What changed
- Include retained source metadata and order labels in async user transcript entries.
- Omit retained instructions when the current transcript contains the same complete source revision. Keep ordering guidance in every async sample and never rely on previous samples for deduplication.
- Preserve retained originals when transcript copies are incomplete or lack source metadata.
## Testing
Extend retained-instruction tests to cover async deduplication, preservation of originals without complete source proof, and budget protection. Update async scorer expectations for source order labels and deduplicated instructions.
GitOrigin-RevId: 7029731b296d2342eea4ad74ffa9d3447578d83e
## Why
Synchronous Guardian reviews can include the same user instruction in both the retained instructions section and the conversation transcript. Avoid this duplication while preserving complete authorization evidence and its original acceptance order.
## What changed
- Carry retained source metadata into transcript rendering. Omit a retained instruction when the transcript delivers its complete matching source revision.
- Label qualifying transcript entries with retained source order and protect them from budget truncation. Keep separate retained instructions when source metadata is missing or incomplete.
- Track delivery of source-order guidance so it remains available even when all retained instructions are delivered through the transcript. Invalidate that delivery proof when messages are shortened.
## Testing
Add coverage for complete-source deduplication, missing or incomplete metadata, budget protection, guidance redelivery, and source metadata preservation across resume. Update Guardian review assertions and snapshots to verify instructions are delivered once.
GitOrigin-RevId: 20ad0304501fa49f1596c4cfaf3ef89d64815753
## Why
`/ps` previously showed only the first line of each background command, hiding useful details when a command began with an opening parenthesis.
## What changed
Render LF and CRLF line breaks as `↵` in command previews. Include subsequent lines within the existing 80-grapheme limit, and show the truncation marker only when the command exceeds that limit.
## Testing
Update snapshot coverage for multiline commands, including parenthesized commands and CRLF line endings, and add a snapshot for a multiline command exceeding the preview limit.
GitOrigin-RevId: 92544e5636821fc94bc1ca4af389c3c646127c0e
## What changed
Add `codex-agent-message-board-client` with a `RemoteAgentMessageBoard` implementation of the existing `AgentMessageBoard` interface over a versioned HTTP API. Use the shared HTTP client for authenticated board creation, deletion, member registration, and board operations.
Validate endpoints and credentials, bound request and response sizes, and support a caller-supplied clock. Allow post retries without a fresh timestamp so the service can replay an already committed result.
Provide live SSE receivers that wait for readiness and reject notifications for another agent or turn, as well as previews exceeding 150 characters.
## Testing
Add a mock HTTP integration test covering endpoint and returned-credential validation, bearer authentication, post retries when the clock is unavailable, Unicode post reads, SSE readiness and notification validation, and service error handling.
GitOrigin-RevId: 844f63ee14dc216a9d61767115892c4783fe9d44
## Why
Legacy shell snapshots could retain exports excluded by `shell_environment_policy` and restore captured values over explicit overrides when replayed.
## What changed
- Build snapshots with the resolved environment's policy and omit filtered exports and original values for variables overridden by `set`.
- Skip eager snapshot creation when configuration is unavailable, and reject snapshots whose policy differs from the current turn's policy.
## Testing
Add a regression test covering default and custom exclusions, `include_only`, preservation of multiline values, and `set` overrides that survive snapshot replay. Verify excluded and overridden captured values are absent from the snapshot file.
GitOrigin-RevId: 4b785130f6c5a4d268ab86fd36ab9d77d8c4a3b9
## Why
User messages could fill the root context limit before assistant questions were considered, while commentary could displace relevant conversational context. Guardian needs that context to interpret user authorization when reviewing subagent actions.
## What changed
- Select recent user and assistant evidence together under a shared message limit, discarding assistants with unknown ordering first.
- Exclude explicit assistant commentary and retain message phases across compaction. For older retained records, check available source messages for commentary phases.
- Mark missing instructions or assistant context when the shared limit removes corresponding evidence, and use remaining space for legacy instructions.
## Testing
Update Guardian authorization tests to cover shared message limits, commentary filtering across compaction and resume, and preservation of ordered replies when legacy assistant context has unknown ordering.
GitOrigin-RevId: c369a2760917cba9d7dfca37fb5e85a7ec49012f
## Why
Large shell snapshots need a replay path that does not add their state to the child process environment.
## What changed
- Keep captured state cached in memory and give each Bash or Zsh launch an independent, read-only file descriptor to source. Unlink the file before writing shell state, create it under the sandbox-protected daemon directory, and close the carrier descriptor before restoring functions.
- Probe descriptor-path access inside the capture sandbox. Retain environment replay for `sh` and when descriptor paths are unavailable; use normal shell startup if preparing the replay file fails.
- Group options and aliases during capture so sourcing preserves their parsing behavior.
## Testing
Add coverage for concurrent replays with 480 KiB payloads, pipe and TTY execution, stdin preservation, descriptor cleanup, sandbox protection, blocked descriptor-path fallback, and alias/option parsing equivalence.
GitOrigin-RevId: 8103d5c37ce4d1885628a4efba3551549f12bea8
Derive `Serialize` and `Deserialize` for `CreateChannelRequest`,
`ReadPostRequest`, and `SubscriptionRequest`.
GitOrigin-RevId: 7da638c029f7d57b59e865a3a45ae80924780fba
## Why
Runtime filesystem grants, such as those used for plugin metrics, could trigger unnecessary approval for `write_stdin` and prevent input when sandbox approval was disabled.
## What changed
Include retained runtime grants in the baseline permission comparison for stdin review. Continue requiring review for additional agent permissions, sandbox bypasses, and policy changes. Update the approval description to report current permissions when only runtime grants are present.
## Testing
Extend unit coverage to ensure runtime grants do not require review or mask agent filesystem and network grants, and that sandbox bypasses still require review. Add local and remote plugin regression cases that send stdin and verify metric emission with sandbox approval disabled.
GitOrigin-RevId: 989098bdc7fbf839786c01f11cbf02999bae1cc1
## What changed
Return post metadata from the in-memory message board after updating board state when no notification recipients remain. This avoids constructing an unused notification preview, including when the author is the only requested recipient.
## Testing
Run the existing post-and-search model-context scenario against both disk and in-memory message boards, checking that post metadata and search results reach the model without self-notifications.
GitOrigin-RevId: dcf07a5fd55738fbcd6edd3dce3f6fb8fc910eaf
## Why
The network command can yield before its request reaches Guardian, allowing a parent request to consume the mock response intended for Guardian.
## What changed
Update `guardian_receives_exact_trigger_for_single_network_request` to match parent and Guardian requests separately. Have the parent poll running processes with `write_stdin` until they exit, and bound the wait for turn completion to 30 seconds. Preserve the assertion that Guardian receives exactly the original call ID and command.
GitOrigin-RevId: f39e9461c3628fbab00ba241f828d318b17975b5
## Why
Reused Guardian sessions already contain previously delivered instructions. Follow-up reviews can avoid repeating that evidence, but must deliver it again if it changes or compaction removes it.
## What changed
- Track retained source identity, revision, and completeness in host-owned history metadata, preserving revisions during replay.
- Omit retained instructions from synchronous review inputs only when the same complete revision remains in reviewer history.
- Restore missing evidence after reviewer compaction, enforcing the request budget before persisting additions. Classify restored evidence as context rather than new user authorization.
- Keep source-order labels stable across eviction and retain full delivery for legacy records without reliable provenance.
## Testing
Add coverage for consecutive-review deduplication, changed revisions, missing or incomplete metadata, and restoring compacted evidence exactly once. Extend compaction and resume coverage to verify retained revisions.
GitOrigin-RevId: e90fca16cde0a0970da36dd873af2ca1dbaaf4d3
## What changed
- Stop sending `includeExtensions=true` when fetching installed plugins and remove extension metadata from remote plugin models.
- Remove `PluginSummary.extensions` and the associated extension declaration types from the app-server protocol.
- Update generated JSON schemas, TypeScript and Python bindings, and precomputed protocol exports to match.
GitOrigin-RevId: 56509437b6bdf58d99badff68e86bcf7f09fe036
## What changed
Add app-server integration coverage for awaiting `request_permissions` and then running `exec_command` in the same code-mode cell:
- Verify that turn- and session-scoped write grants allow the command to create a file, including grant propagation to Windows command approval requests.
- Verify that `strictAutoReview` immediately triggers review for a command needing no additional access and returns the reviewer's denial rationale.
GitOrigin-RevId: 02c958071db4e9ba667be9ba95fbb3a506ae1572
## Why
Tool suggestions could pass unchecked `install_url` values to the app link view for opening in a browser.
## What changed
Reuse the external URL validator to require HTTPS URLs with a host and no embedded credentials. Decline suggestions with invalid URLs on the requesting thread without showing a popup.
## Testing
Add a regression test covering malformed URLs, unsupported schemes, embedded credentials, and a valid HTTPS URL. Verify that rejected suggestions leave the popup unchanged and resolve on the requesting thread, while the valid URL opens on confirmation.
GitOrigin-RevId: e47bf09868ec81aeaf1ffed8330039b69c60e093
## Why
The sample hardcoded file-based credential storage and omitted configured auth routing and login restrictions. It should use the configured credentials, including secure storage in `cargo run` builds.
## What changed
- Load authentication settings through the shared bootstrap path and re-export the required helpers and types from `codex-core-api`.
- Honor CLI and MCP credential stores, `features.secret_auth_storage`, auth routing, the ChatGPT base URL, and system proxy settings.
- Preserve managed login-method and ChatGPT workspace restrictions while keeping the sample's built-in execution settings.
- Document the sample's authentication configuration behavior.
GitOrigin-RevId: b49883537acbebf9266b3970d2709e8e7d1bf217
## Why
When a container denies fresh `/proc` mounts, the existing sandbox fallback retains the caller's `/proc` while creating a new PID namespace. Process IDs inside the sandbox can then differ from those exposed by `/proc`, breaking process lookups.
## What changed
- Add `codex exec-server --linux-sandbox-pid-namespace=inherit` to reuse the caller's PID namespace and `/proc` for both process and filesystem helpers. Repository config and command environment variables cannot enable it.
- Keep `isolate` as the default, preserving the existing mount fallback and compatibility with older helpers. Inheritance requires an updated helper and omits `--unshare-pid` and `--as-pid-1`.
- Preserve other sandbox restrictions. With `:minimal`, bind the inherited `/proc` read-only with its container masks and apply explicit filesystem denials afterward.
Inheritance is intended for dedicated environments: it allows sandboxed commands to signal other same-UID processes, including the executor.
## Testing
Add unit and integration coverage for namespace flags, denied proc mounts, consistent process IDs, retained sandbox restrictions, and startup-only selection across process and filesystem helpers.
GitOrigin-RevId: dd13f2b9286d7edcf366b3a42a455f4d78daaf27
## Why
Refreshing the MCP catalog with unchanged tool metadata recreated handlers and forced the tool search index to rebuild.
## What changed
Cache handlers by canonical tool name and reuse them when tool metadata, agent plugin status, and the input schema size limit are unchanged. Replace handlers when those inputs change and evict tools removed from the catalog, preserving search index reuse across equivalent bindings.
## Testing
Extend the deferred tool world state test to verify that an unchanged catalog refresh captures a new binding without rebuilding the search index, and that removing all deferred tools stops advertising `tool_search`.
GitOrigin-RevId: 150866f635e9ee817d7ca44fb76e724a3f7608a5
## What changed
- Record successful spawn phase durations in `codex.multi_agent.spawn.phase.duration_ms`, covering residency reservation and fork context when applicable, child creation, durability waits, input admission, and total latency.
- Count spawn failures from the V1 and V2 tool handlers in `codex.multi_agent.spawn.failure`, grouped by bounded error categories.
- Use bounded labels for fork mode, multi-agent version, product SKU, and successful-spawn history mode. Emit phase timings only after a successful spawn.
## Testing
Add in-memory metrics tests for phase durations and labels, plus a tool-handler test verifying that a thread-limit failure emits one counter increment with the expected labels.
GitOrigin-RevId: 04cba9042b9b34acdf57376ace5288c3f741f3b2
## What changed
Prepare each MCP call from the selected server's current client and catalog instead of building a full runtime binding. Match the advertised tool by server, tool name, and connector ID, and enforce current tool filters and model visibility.
Preserve the advertised `callable_namespace` and `callable_name` while using current schema, annotations, approval metadata, timeout, and permission authority for execution.
GitOrigin-RevId: 703a90926fc72bd446d83ac974162aee6439f363
## Why
Queued voice answers could reappear as text under a newer question when speech failed, the pending queue overflowed, or voice stopped, including answers already spoken as paraphrases.
## What changed
Filter recovered and replayed speech by the current input generation, preserving that generation across conversation resets. Keep text fallbacks for answers still awaiting turn completion so delayed user transcripts do not discard unspoken answers.
## Testing
Add regression coverage for paraphrased answers, queue overflow, stop and replay, failed delivery for current versus superseded input, and delayed transcripts.
GitOrigin-RevId: b7b230910bf4fdb4ae93f7de8ca2222a19c55d7f
## Why
A `.git` pointer can resolve to a Git directory inside another writable root. Broader Seatbelt grants or later bubblewrap mounts can leave that directory writable despite its metadata protections.
## What changed
Include resolved Git directories in read-only exclusions for broader writable roots on Linux and macOS. Resolve symlink aliases when locating exclusion targets and retain explicit policy overrides.
## Testing
Add regression tests for Git directories reached directly or through symlink aliases in another writable root, and for linked worktree metadata under the macOS temporary directory. Verify that metadata writes are denied while ordinary files in the surrounding writable root remain writable.
GitOrigin-RevId: 6971f1cf35008d23eaeb0d02a9c61bee7cf83b12
## What changed
- Recognize `promax` in authentication, account responses, and backend rate limits; update generated schemas and client types.
- Display `prolite` as “Pro”, `pro` as “Pro (More)”, and `promax` as “Pro (Max)” in account labels, status, and analytics.
- Include Pro Max in experimental context eligibility, paid-plan tooltips, and usage-limit guidance for purchasing credits.
## Testing
Extend coverage for Pro Max plan parsing, account and rate-limit responses, experimental context eligibility, and plan display names. Update the login token test to expect “Pro (More)”.
GitOrigin-RevId: 197e00fa7a99cbce125c8f1d43a451ec1ed5c1fb
## Why
`active_turn_environment_selections()` returns the selections captured at turn start, so it does not reflect later environment settings updates.
## What changed
Add `CodexThread::current_turn_environment_selections(expected_turn_id)` to read the running turn's current selections, including environments that are still starting or have failed. Return `None` when the requested turn is no longer active or has been cancelled.
## Testing
Add a regression test covering selection updates, mismatched turn IDs, and completed turns, while verifying that the initial selection snapshot remains unchanged.
GitOrigin-RevId: bb526a686d549209142150ffde99ad1444add205
## Why
Btrfs subvolumes can report an `st_dev` that differs from the device in `/proc/self/mountinfo`, causing daemon socket mount validation to reject valid mounts.
## What changed
Allow the mismatch only when the opened directory and its uniquely identified mount are both verified as Btrfs. Discover socket directory aliases using both device identities while retaining checks that reject unsafe directory and socket bind mounts.
## Testing
Add regression tests for aliases under both device numbers, unverified or inconsistent filesystems, unavailable or missing mount IDs, duplicate mount IDs, and unsafe bind mounts.
GitOrigin-RevId: 921d6465b7a97022573a42412606a26560cc086a
## What changed
- Recognize `flex_unavailable` in HTTP 429 responses and streamed `error` and `response.failed` events. End normal turns without retries and report `Flex capacity unavailable.`
- Expose `flexUnavailable` through the core and app-server protocols and generated schemas and SDK types.
- Keep Flex capacity failures eligible for Guardian review and sampler retries, with a distinct telemetry classification.
- Map unexpected HTTP responses to `HttpConnectionFailed`, preserving their status codes.
## Testing
Add regression coverage for terminal Flex failures over HTTP, SSE, and WebSocket, HTTP 504 status preservation after a stream retry, and protocol serialization. Update Guardian retry and sampler recovery tests to cover Flex failures.
GitOrigin-RevId: f2e03a6d2d36a6d9748c35952e40397f8670d121
## What changed
Keep `x-amzn-mantle-client-agent: codex` in the Amazon Bedrock Runtime provider instead of clearing the headers inherited from the Amazon Bedrock provider.
## Testing
Update provider construction expectations and extend the API provider header test to cover both Amazon Bedrock providers.
GitOrigin-RevId: eab07f347b53f0a6ba2e224a39590f49f181363e
## What changed
- Default `MALLOC_CONF` to `thp:always` for Cargo child processes, including tests and `cargo run`, while preserving an explicitly set value, even if empty.
- Patch `rules_rust` to request transparent huge pages for `codex-rs/` compilation with Linux GNU `rustc` on x86_64 and aarch64. Check policy on the execution worker and enable the setting only when seccomp is disabled, transparent huge pages are permitted, and no allocator, preload, or sanitizer configuration conflicts are detected. Leave the environment unchanged when policy cannot be determined.
GitOrigin-RevId: 3a9b2572ec9e1f30e2f719f30c885914c165eccd
## Why
Removing tool-result metadata alone can leave requests above the 15 MiB message budget when recorded tool calls and arguments occupy the remaining space. If trimming loses calls or arguments from a Code Mode cell, later waits must not report its call inventory as complete.
## What changed
- Bound all optional tool-call observations against the serialized HTTP or WebSocket message size, preserving ordinary tool outputs and continuation history.
- Shed generic result metadata, sources, and recorded arguments before resource-access evidence, retaining tool names and smaller metadata where possible.
- Invalidate completeness across affected cell outputs and later waits when the outgoing copy loses calls or arguments.
- Preserve size-limit omission markers for direct tool-result metadata when they fit, while continuing to exclude that metadata from custom providers.
## Testing
Add regression coverage for HTTP and WebSocket message budgets, unchanged tool results and history, resource-evidence retention, direct-call omission markers, and Code Mode waits after argument truncation.
GitOrigin-RevId: 538dc9d8c11b0830ec70327422f98a1803122e85
## Why
Editing recent conversation images failed when the selected images included a file reference from a message or tool output.
## What changed
Use `ImageReference` in `ImageEditRequest` to accept both `image_url` and `file_id` inputs. Pass file references from conversation history through to image edit requests while preserving image selection order.
## Testing
Update tests to cover file references from messages and tool outputs, and serialization of mixed inline and file references in image edit requests.
GitOrigin-RevId: 2764bf36a81a62ddd25cf9df27346a434a10c449
## What changed
Show the startup tip beneath the session header in the fullscreen transcript, with wrapping on narrow terminals. Remove rotating tips and startup announcements from above the composer, leaving that area for usage warnings.
## Testing
Add startup transcript snapshots at 80 and 32 columns and assert that compact tooltip rendering preserves styled links. Update usage-warning tests to verify composer geometry and recovery without rotating tips.
GitOrigin-RevId: b5e79a46147d112cd50802b0702537deb9b87001
## Why
Dropping the last board handle releases its state but leaves a stale entry in
`InMemoryMessageBoards`, allowing registry entries to accumulate across sessions.
## What changed
Prune entries whose state has no remaining strong references whenever a board is
opened, while preserving shared state for live boards.
## Testing
Add a regression test that repeatedly opens and drops boards, checks that expired
entries are removed, and verifies that reopening a live board shares its state.
GitOrigin-RevId: c3f1c27b42ee17915f0ece01b85a22d0fdf632ce
## What changed
Select checksum-pinned `rusty_v8` 150.4.0 release archives and matching Rust bindings for x64 and arm64 macOS and GNU Linux when pointer compression and the V8 sandbox are enabled.
Add `--//:rusty_v8_from_source=true` to select source-built archives and bindings together for custom V8 C++ flags or instrumentation. Fall back to the existing source path when the sandbox or pointer compression settings differ from the published artifacts, and retain source builds for musl Linux and Windows GNU.
On GNU Linux, weaken the ten shared `std::logic_error` and `std::runtime_error` constructor and assignment symbols in the Bazel output so toolchain libc++ definitions take precedence. Preserve the checksum-verified inputs and constructors accepting `std::__Cr::string`.
Document artifact selection, source overrides, and checksum maintenance.
GitOrigin-RevId: cedd474c739ae16e07a78f35459d2c383e5781d8
## What changed
Increase `MAX_ROOT_MESSAGES` from 8 to 16 so Guardian subagent authorization reviews can include more root conversation context.
## Testing
Update authorization integration tests to exercise the larger message limit, preserve late user authorization and question context, and expect incomplete root instructions when retained user messages exceed the cap.
GitOrigin-RevId: facc55f424a4d7e29626f4161ecfe031021b30c2
## Why
Ephemeral sessions cannot use the SQLite-backed agent message board. An in-memory backend lets agents share discussions without creating durable board storage.
## What changed
- Add the opt-in `message_board_in_memory` setting to the multi-agent v2 configuration, allowing the board to run in ephemeral sessions when both required features are enabled.
- Share board state across agents in the same tree and release it when the last handle is dropped.
- Implement channels, posts, subscriptions, notifications, search, and paginated reads through the existing `AgentMessageBoard` interface, including request deduplication.
## Testing
Add coverage for shared handles, concurrent request deduplication, tree isolation, and state release. Run existing query and tool test cases against both backends, and extend the parent/child scenario to verify ephemeral board sharing without creating a board database.
GitOrigin-RevId: d0b2083f8ea5b1c5a3a70f258ef738b87ea74cef
## What changed
Remove the Windows sandbox audit module and its exported scan-and-deny helper, including the associated tests. Remove the config edit variant and builder method for acknowledging `hide_world_writable_warning`.
GitOrigin-RevId: c9cfc9b276d46c45d5788fe8d29b2bc4e422001c
## Why
Plugin identity and skill ownership need to be available independently of MCP data, including for plugins without servers or connectors. Hosted plugins have no executor root and should not own executor skills.
## What changed
- Add `McpServerContributor::selected_plugins` to declare executor plugin identities with deferred MCP data. Let the host assign server attribution and precedence across contributors.
- Represent hosted connectors with `HostedPluginConnectors` and make `SelectedPluginIdentity::selected_root_id` optional instead of assigning synthetic roots to hosted plugins.
- Resolve executor contributions before reading hosted connectors, and clear stale hosted state on account changes before executor loading can wait.
- Preserve connector declarations from disabled plugins so Apps can hide those connectors.
## Testing
Add coverage for account changes while executor loading is pending. Update tests to verify hosted identities have no executor root and disabled plugins hide their connectors even when plugin IDs differ from root IDs.
GitOrigin-RevId: e7f511264c5874c1b56d5f3e4a46820724046db0
zm-oai