## Why
An inherited `FILE_DELETE_CHILD` grant can make a write root look stale, but
`SET_ACCESS` cannot replace an ACE inherited from an ancestor. Treating that
grant as explicit causes unnecessary ACL refresh attempts that cannot converge.
## What changed
- Add explicit-ACE filtering to the Windows DACL permission checks.
- Refresh a write root only when `FILE_DELETE_CHILD` is present in an explicit
allow ACE, while retaining effective-permission checks for required rights.
- Ignore inherited stale rights when deciding whether `SET_ACCESS` must repair
an allow ACE.
## Testing
Add a Windows regression test covering a write root that inherits
`FILE_DELETE_CHILD`, verifying that repeated refresh checks leave its explicit
write ACE unchanged.
GitOrigin-RevId: d0df9429efcf299da3ff3c1bce92942684803293
(cherry picked from commit bd92b056dd)
## Why
Code-mode `exec` and `wait` can use the same yield duration as an
awaited nested tool call. Because the outer timer starts first, it can
expire just before the nested result arrives, forcing an otherwise
unnecessary continuation and extra `wait` call.
## What changed
- Add a one-second internal grace period to code-mode `exec` and `wait`
yield timers only when the configured yield is at least 10 seconds.
- Keep the model-visible yield values, defaults, and accepted parameters
unchanged.
- Preserve exact timing for explicit short yields, including the
immediate-yield `0` case.
- Cover the 10-second threshold and nested-tool behavior through both
`exec` and `wait` with virtual-time tests instead of slow wall-clock
integration tests.
## User impact
Nested calls using the 10-second default (or a longer configured yield)
get one extra second to return through the current code-mode call
instead of needlessly yielding the outer cell. Sub-10-second yields
retain their existing timing.
## Test plan
- `just test -p codex-code-mode`
## Why
`write_stdin` inherited serial tool dispatch, so long polls for
independent unified-exec sessions blocked each other even when the
caller used parallel tool calls or code-mode `Promise.all`.
The useful boundary is the terminal process: independent sessions should
overlap, while operations sharing one process must not overlap because
they mutate stdin, drain one output buffer, and observe the same
lifecycle.
## What changed
- opt `write_stdin` into parallel tool dispatch
- guard each unified-exec process with a process-local interaction mutex
while allowing different process IDs to overlap
- treat a held interaction mutex as a pruning reservation so parallel
`exec_command` calls cannot evict an actively polled process
- revalidate process identity after waiting for that mutex so a stale
waiter cannot redirect input to a replacement process
- add direct non-code and code-mode integration coverage using a
symmetric rendezvous: both sessions can finish only if their
`write_stdin` calls overlap
This does not add a source-order contract for calls targeting the same
session. Their interactions are mutually exclusive, but callers must not
depend on which concurrent call acquires the process mutex first.
## Testing
- `just test -p codex-core write_stdin` (13 passed)
- `just fix -p codex-core`
## What changed
- Add personality instruction variables for the GPT-5.6 model variants.
- Add the GPT-5.5 availability notice.
- Remove the `auto_review` and `permissions` message fields and the legacy `supports_reasoning_summary_parameter` flag from the bundled catalog.
GitOrigin-RevId: 426b0735a78232d2f658e0124db7c45889d08286
## What changed
- Set the bundled GPT-5.6 model variants' context windows to 272,000 tokens.
- Refresh model instructions and message configuration.
- Record reasoning-summary support and update skills, permissions, and auto-review metadata across the model catalog.
GitOrigin-RevId: 8be55124bf50af14756a174033a5cb362f4db714
## What changed
- Emit one final `app/list/updated` notification for an initial cached
`app/list` request so other initialized clients can refresh.
- Suppress duplicate notifications for unchanged cached continuation pages.
- Preserve progressive update notifications for `forceRefetch: true` requests.
## Testing
- Cover notification behavior for cached initial and paginated requests.
GitOrigin-RevId: 54f2d25a0adf6e0707402328b4c81fa5f950cf9a
## What changed
- Remove `codex-realtime-webrtc` from the Cargo workspace and Bazel build,
along with its native WebRTC dependency graph.
- Use `blake3`'s pure Rust implementation on
`x86_64-pc-windows-gnullvm`, where the Bazel lint toolchain cannot
reliably materialize the crate's native x86 assembly archives.
GitOrigin-RevId: c382d888cd7ada7a17a7a0dcbdecbe00744f5055
## Why
An execution environment marked `starting` is not yet usable, but unrelated work can continue while it becomes ready.
## What changed
- Add developer guidance that explains execution-environment isolation and the resources that become available after startup.
- Tell the model to wait only when the current task needs the starting environment.
- Retain the guidance across world-state updates without duplicating it in request history.
## Testing
- Cover world-state transitions, history retention, rollback handling, and deferred-environment request deduplication.
GitOrigin-RevId: f12f9204d4cbddce50a70eb0998beb6b66cd2fa9
## What changed
- Tell the model to call `wait_for_environment` only when a task needs the selected environment's files, commands, or installed capabilities.
- Document that waiting can take several minutes and blocks other tool calls, and direct the model to continue if startup fails.
- Require the exact `starting` environment ID shown in `<environment_context>`.
GitOrigin-RevId: 6b434b835d379318879d5499c365c70598673afd
## What changed
- Represent built-in filesystem policy entries with the same `Path` and
`Special` variants used by other entries.
- Remove generated-default filtering from Windows sandbox policy resolution and
simplify elevated deny-write handling to rely on direct-runtime enforcement
and the legacy policy projection.
- Update protocol conversions, policy transforms, and profile expectations for
the reduced filesystem path model.
GitOrigin-RevId: a65793e6855a03d52a575e82cb3d4b9b2e32db5c
## What changed
- Apply `agents.default_subagent_model` and
`agents.default_subagent_reasoning_effort` when a spawn request does not
provide explicit values, including agent job workers.
- Allow full-history forks to use configured defaults or explicit model and
reasoning-effort overrides while retaining the parent conversation context.
- Preserve the selected model and reasoning effort when an agent role does not
override them.
## Testing
- Cover configured defaults, explicit override precedence, full-history forks,
role application, and agent job workers.
GitOrigin-RevId: b1efa8c9abeee82355088fceef57560433144595
## What changed
- Add a lexical selector that splits compound queries into sentence and connector-delimited views.
- Merge candidates across the full query and its component views, prioritizing their best rank while using full-query rank, view coverage, and stable identifiers as tie-breakers.
- Bound query decomposition and result counts, propagate truncation signals, and include the selector in the shadow-selection experiment.
## Testing
- Add unit coverage for compound-query ranking, single-query compatibility, query splitting, and bounded-input signals.
GitOrigin-RevId: 2442bf7198fc24295cbc270b9d222275ae8a7cc3
## What changed
- Add a character n-gram selector that scores matches across skill names, short descriptions, and descriptions using field weights and inverse document frequency.
- Include the selector in the shadow selection experiment alongside the existing lexical selectors.
- Bound query, document, candidate, and result processing, and report query or candidate truncation through the existing selection metadata.
## Testing
Add unit coverage for related word forms, typos, CJK text without word boundaries, and bounded inputs.
GitOrigin-RevId: 4df60cc661338050eeb7741c716bc1c9f730fedd
## What changed
- Add a bounded BM25 selector that ranks skills across name, short-description,
and description fields, weighting names most heavily and rare terms more highly.
- Run the selector alongside the weighted lexical method in the shadow-selection
experiment, with deterministic tie-breaking and existing per-method metrics.
- Add unit coverage for field weighting, rare-term ranking, unmatched queries,
and input limits.
- Remove the implicit-invocation integration test and its telemetry development
dependency.
GitOrigin-RevId: e5ac6a1f0d6a1f68b194467ef7da48adf4a88d7c
## Why
The `agent_type` argument is only useful when agent roles are configured. Avoid
advertising an inapplicable override in the model-visible `spawn_agent` schema.
## What changed
- Include `agent_type` in the V1 and V2 spawn tools only when configured roles
are available.
- Clarify that `agent_type` is an explicit override and document its interaction
with context forking.
- Remove the unused `agents.support_agent_type` configuration field.
## Testing
- Add coverage for hiding `agent_type` without roles and exposing it when a role
is configured.
GitOrigin-RevId: 32e0f123b15f317e9cdb71774029375bc073d9ad
## What changed
- Add `agents.enabled` as a user override for multi-agent tools while keeping an enabled `features.multi_agent_v2` authoritative.
- Rename the shared spawned-thread limit to `agents.max_concurrent_threads_per_session`, retain `agents.max_threads` as an alias, and apply the setting to both multi-agent backends.
- Add reserved subagent model, reasoning effort, and agent-type settings to the config surface and persist all resolved agent settings in config locks.
- Show the resolved `[agents]` values in TUI debug-config output.
## Testing
- Cover config loading, legacy alias normalization across merged layers, backend-selection precedence, V2 concurrency, and debug output.
GitOrigin-RevId: 2957c954a2e1aef51592768dbbccd56c4bf8f118
## What changed
- Convert MCP text content marked with `_meta["codex/encryptedContent"] = true`
into `encrypted_content` function call output items.
- Prefer the content-item payload whenever encrypted content is present so that
`structured_content` does not replace the encrypted output.
## Testing
- Add a stdio MCP integration test that round-trips mixed plaintext and
encrypted tool output.
GitOrigin-RevId: c3997a16b06ad38ff22b21016ede35b97974d9ec
## What changed
Add `cacheWriteInputTokens` to the usage breakdown in the
`rawResponse/completed` JSON schema, defaulting it to zero. Update the
compaction and turn-start notification expectations for the expanded usage
breakdown.
GitOrigin-RevId: d9232b724d646b803c7f5a64c5daa311f77ad408
## What changed
- Remove `template_id` from MCP tool call items and lifecycle events.
- Remove `templateId` from app-server `McpToolCallAppContext` responses and generated schemas.
- Update protocol conversions, documentation, and existing test expectations for the revised metadata shape.
GitOrigin-RevId: f2b1304eadff661eec3966673ea71206b1542b98
## Why
Forced `rm` commands can appear inside complex shell syntax or use option and wrapper variants that the existing dangerous-command heuristic does not recognize.
## What changed
- Detect literal forced `rm` invocations in control flow, substitutions, pipelines, traps, nested shells, and `sudo` or `env` wrappers.
- Recognize combined, separate, and long-form force options, including when they follow operands.
- Require approval for these commands, or reject them with a safer-alternative explanation when approvals are disabled, even when the sandbox is disabled.
- Preserve existing rejection reasons for other dangerous commands and explicit policy rules.
## Testing
Add unit, policy, and end-to-end coverage for forced `rm` variants, complex shell scripts, approval requests, and rejection messages.
GitOrigin-RevId: e1fabc55324e788bae00ab24aae50d089eb7b058
## What changed
Update the image generation guidance to set a 120-second yield for the
initial code-mode call and subsequent waits, then return the completed result
with `generatedImage(result)`.
GitOrigin-RevId: 85041db27a0b41d830014984518d95fdd2875bed
## What changed
- Track only agent messages with the `final_answer` phase as a turn's final
summary item, so commentary is excluded.
- Recover final answers when items arrive before the turn lifecycle record, and
fall back to phase-less agent messages for terminal turns.
## Testing
- Cover delayed turn lifecycle records and commentary-only turns when listing
summary items.
GitOrigin-RevId: 59d9c7fd23dd32037516883e964cf5869c5932a1
## What changed
- Move migration detection, import orchestration, models, and reporting from
`codex-app-server` into `codex-external-agent-migration`.
- Keep app-server protocol conversion in a dedicated boundary module.
- Organize source-specific configuration, sessions, hooks, plugins, commands,
subagents, and memory handling behind shared migration adapters.
- Relocate and split the migration tests alongside the extracted service.
GitOrigin-RevId: 3378ec2064806a28136d6ac98664ca1d75414a4e
## What changed
- Parse `cache_write_tokens` from response input token details and carry it through token usage aggregation.
- Expose `cache_write_input_tokens` in protocol, app-server, exec, and TypeScript SDK usage events, defaulting it to zero for compatibility with older payloads.
- Report cache-write usage in analytics, metrics, traces, and rollout data alongside existing cache-read usage.
## Testing
- Add coverage for response parsing, usage event output, aggregation, analytics, metrics, and telemetry fields.
GitOrigin-RevId: 634e4fbe3086a8923c0ee13b622573e7d9d221bd
## What changed
- Remove the standalone network proxy config loader, its mtime-based reloader, and their tests.
- Remove the helper exports and MITM action-reference validator used only by that loader.
GitOrigin-RevId: 60895fb4e3461e8c3f19db70869050410a4f5f07
## Why
Windows firewall enforcement is tied to the logon-user sandbox identities. Proxy-enforced commands therefore need the elevated backend even when the configured sandbox mode is the default restricted-token mode.
## What changed
- Select the elevated Windows sandbox backend whenever a command uses the managed network proxy.
- Remove configuration and startup checks that required users or managed requirements to select the elevated sandbox explicitly.
- Start and expose managed network proxy state consistently on Windows.
## Testing
- Verify that proxy enforcement selects the elevated backend for the restricted-token sandbox mode.
GitOrigin-RevId: e01ac052587721c468a8fbcf4e2c7c5a185a3e05
## What changed
- Explicitly shut down and wait for each approval scenario's Codex thread.
- Preserve and return the scenario verification result after shutdown, so cleanup also runs when verification returns an error.
GitOrigin-RevId: 78dfbe657700a47b457ea9abd5efec4edd8f8a25
## Why
Selected capability roots are deduplicated by ID. When ready environments
report the same ID with different locations, silently dropping later roots
hides the conflict.
## What changed
Track each selected root's location while combining thread and ready-environment
roots. Keep the first root for a duplicate ID and emit a warning when a later
root uses a different location.
## Testing
Add a regression test with two ready environments that verifies the first
location is retained and the conflict warning is logged.
GitOrigin-RevId: e51692ae9cd2c3a7f3c1ac50bb8446846f314929
## What changed
- Inherit paginated history mode when spawning or forking a subagent from a paginated parent.
- Load the parent's model context when forking and persist it as an inherited rollout prefix, while excluding that prefix from the child's projected turns, items, and metadata.
- Record the boundary between inherited context and child history, and reject partially initialized paginated subagent rollouts on resume.
- Resume paginated subagents from their stored model context instead of legacy rollout history.
## Testing
Added coverage for fresh and forked paginated subagents, compacted-history forks, model-context resume, inherited-prefix projection, metadata isolation, and incomplete-prefix detection.
GitOrigin-RevId: e57dc37c29aa4aaaf57b052b991be591d730e5ba
## Why
Elevated Windows sandbox setup could turn the built-in read-only protections
for workspace metadata into deny-write paths, creating metadata directories
that did not already exist.
## What changed
- Track whether filesystem permission entries come from a built-in profile or
were explicitly configured.
- Exclude generated metadata defaults from direct Windows deny-write overrides
while continuing to enforce explicit read-only carveouts for the same paths.
- Preserve the distinction while materializing and normalizing permission
paths, without exposing generated defaults as user configuration.
## Testing
Added Windows coverage confirming that elevated sandbox setup leaves missing
workspace metadata absent and still produces overrides for explicit metadata
carveouts.
GitOrigin-RevId: 701bcb229f631b18ab5ced22f3edf6f303d932f3
## What changed
- Let deferred environments provide selected capability roots with their ready signal.
- Validate that those roots have unique, non-empty IDs, belong to the registering environment, and stay within the root limit.
- Include roots from ready turn environments when resolving MCP contributions, and refresh the MCP runtime when the selected root set changes.
- Expose the exact ready root set to MCP contributors so executor plugins become available with their environment.
## Testing
- Cover ready-root propagation, validation failures, replacement isolation, reconnection, and MCP plugin availability refresh.
GitOrigin-RevId: ec3498aab1164824025094e96a9b1063b7b731ad
## What changed
- Detect and import supported Cursor settings, sandbox permissions, MCP servers,
project instructions, hooks, agents, commands, plugins, and recent chat
sessions.
- Update the `/import` flow to check Claude Code and Cursor, prompting for a
source when both have importable data.
- Add `migrationSource` to the app-server detect and import requests so each
operation uses the selected adapter, while retaining `source` for import
attribution and backwards compatibility.
## Testing
- Add coverage for Cursor config conversion, hooks, plugins, session discovery
and conversion, app-server imports, and TUI source selection.
GitOrigin-RevId: a65a1511b6c1c2f9e3e0cfe4f816bb435807282e
## Why
Host skills can change after a thread starts. Subsequent turns need the updated
catalog without reinjecting an unchanged catalog on every turn.
## What changed
- Register the host skill provider in app-server and project its catalog through
a dedicated World State section.
- Render host skills with the existing metadata budget and usage instructions,
including skill-root aliases when available.
- Suppress the legacy host catalog and contextual fragment when World State owns
the catalog, while preserving host skills for explicit and shadow selection.
## Testing
Added an app-server test that installs a host skill at runtime and verifies the
catalog updates once and remains stable on the following turn.
GitOrigin-RevId: 4cacc6b2258fc3cab8499fbdf9aa6ab0324ec10d
## What changed
- Add `source=codex` to requests sent to the OpenAI developer docs MCP endpoint.
- Preserve OAuth discovery URLs and leave clients for other MCP servers unchanged.
## Testing
- Add unit coverage for regular and streaming HTTP requests, OAuth discovery, and non-docs MCP clients.
GitOrigin-RevId: d04e19fe6fc2db0b5cd7bfb429f0cb821c49b28a
## Why
MCP server and app connector declarations live in separate executor-owned files. Reading them sequentially makes remote environments pay the latency of both reads.
## What changed
Load both declaration files concurrently while preserving independent error handling for each result.
GitOrigin-RevId: 067e6d1677987ba52200b759a55cec6129575d4b
## Why
Workspace accounts fetched the paginated connector directory before starting the independent workspace connector request, adding the latency of both request chains.
## What changed
Start the workspace connector request alongside the public directory lookup. Continue to ignore workspace lookup failures and filter hidden workspace apps before merging the results.
## Testing
Add a regression test that blocks the directory response until the workspace request starts, verifying that both lookups overlap and their connectors are returned.
GitOrigin-RevId: fa29023a4154b555a31756054109e706e61c32c0
## What changed
- Correlate MCP server attribution in imported session records with connector
metadata, and persist normalized connector names in the session import ledger.
- Extend `externalAgentConfig/import/readHistories` with connector candidates,
including each connector's display name, imported-session count, and detection
source.
## Testing
- Cover connector detection through the session import and history-read flow.
- Verify candidate aggregation uses the latest import for each source session.
GitOrigin-RevId: 7f1f7f596925b2e6efcd17afd4490148e1ac9ff1
## What changed
- Add a shared test helper that renders before-and-after section states alongside the resulting role and content.
- Convert the agents, environment, apps, and plugins world-state tests to snapshot tables covering absent, unknown, unchanged, changed, and removed states.
GitOrigin-RevId: 03372a5f925d2019f37bf5a5a2f060261899026c
## What changed
- Convert supported plugin command Markdown into generated skills when a plugin is installed.
- Read command sources from the manifest's `commands` field, falling back to the plugin's `commands/` directory.
- Load generated command skills alongside native plugin skills while preferring native skills with the same name.
- Skip commands with unsupported templates, missing descriptions, name collisions, or generated skills larger than 4 KB, and keep migration failures from blocking plugin installation.
## Testing
- Cover default and manifest-configured command paths, stale generated skill cleanup, size limits, native-skill precedence, invalid manifest fields, and non-fatal migration errors.
GitOrigin-RevId: 67d910048544b160b191066569bca69b2b951ebc
## Why
Starting a user turn can wait on remote work. Show the submitted prompt immediately instead of leaving the input invisible during that wait.
## What changed
- Queue optimistic prompt history before app-event submissions and render a frame before starting the turn.
- Preserve the existing submit-failure behavior for direct submissions.
## Testing
- Verify that an initial prompt is added to history before its user-turn event is submitted during session replay.
GitOrigin-RevId: 57f30c6e0067127e6b082a206f7d154fcfef8d7d
## What changed
- Scan up to eight skill roots concurrently instead of loading them one at a time.
- Share scan capacity across host-skill and plugin-skill loads to bound aggregate filesystem work.
- Merge completed scans in input order so root precedence and error ordering remain deterministic.
- Skip canonicalization and parsing work for empty roots.
## Testing
- Add coverage for out-of-order scan completion and shared-capacity blocking.
GitOrigin-RevId: 33a47aaa02aee7fe31a050bb04d51c1e2043d6ae
## Why
Queue-only child-agent updates that arrive around a final answer should not
restart sampling, but they must remain available to the next turn. Explicitly
injected response items still need to reopen the current turn.
## What changed
- Defer queue-only inter-agent mail after a final answer without treating it as
same-turn pending input.
- Re-enable current-turn mailbox delivery when the model requests a follow-up,
a stop hook continues the turn, or a response item is explicitly injected.
- Check for turn-triggering mailbox work after clearing the completed active
turn so pending work can start safely.
## Testing
Added coverage that queued child mail waits for the next user turn and that an
injected response item after a final answer triggers a follow-up request.
GitOrigin-RevId: aa81d00707943284b7ab069b60970e547908c895
## What changed
- Allow `thread/start` to select experimental `historyMode: "paginated"` when the thread store supports turn and item pagination.
- Resume paginated threads with bounded model context and require `excludeTurns: true` instead of loading full history.
- Return `turnsBackwardsCursor` and `itemsBackwardsCursor` from `thread/resume` so clients can hydrate durable history through `thread/turns/list` and `thread/items/list` while newer records arrive through live notifications.
- Reject operations that still require full history, including `initialTurnsPage`, `thread/read` with `includeTurns: true`, `thread/rollback`, and detached review.
- Make item cursors independent of the optional `turnId` filter.
## Testing
- Cover paginated thread start, cold and live resume, backwards cursor hydration, metadata reads, unsupported operations, and stores without pagination support.
GitOrigin-RevId: c42f9b268e29d049843330f474fa3ecde12f5b8a
## Why
Cached MCP tool catalogs must not substitute stale session state for the live
server connection.
## What changed
- Verify `mcpServerStatus/list` waits for replacement stdio server metadata
before combining it with cached tools.
- Verify configurations with remotely sourced environment variables bypass the
tool catalog cache.
- Assert that calls made from cached definitions return output from the live
replacement process.
- Make the stdio test server available to Windows Bazel integration tests.
GitOrigin-RevId: 0e518cd46f0d89af28e3a4e256023b5872e6e2fb
## What changed
- Recognize the experimental `codex/tool-catalog-cache` server capability during MCP initialization.
- When the server advertises `cacheable: false`, clear its shared tool catalog snapshot and prevent subsequent fetches from repopulating the cache.
GitOrigin-RevId: bce98371a68881001d3ab1378fa1548575f2dadc
## What changed
- Add realtime conversation version `v3`, which preserves the V1 Codex Voice behavior while using Frameless Bidi `delegation.*` events.
- Translate audio, transcripts, handoffs, session context, and lifecycle events between the app server and the Frameless Bidi wire protocol.
- Support `v3` over WebSocket and WebRTC, including the Frameless `/live` endpoint, session configuration, headers, and default model selection.
- Update the app-server protocol schemas and documentation for the new version.
## Testing
- Add unit coverage for Frameless event parsing, outbound messages, context chunking, URL construction, and call creation.
- Add app-server end-to-end coverage for WebSocket delegation and WebRTC session startup.
GitOrigin-RevId: 79a3307bc209e1a54582ebd2febc07c909fca016
## Why
Token-budget sessions need a final opportunity to preserve important state before the current context is compacted.
## What changed
- When `auto_compact_fallback_prompt` is configured, reserve `auto_compact_fallback_buffer_tokens` beyond the base auto-compaction limit.
- At the base limit, inject the fallback prompt once as a developer message while keeping the normal tool surface available. Continue reporting zero base-window tokens during this reserve.
- Roll over when the reserve or full model context is exhausted, and skip the fallback when a new context was already requested.
## Testing
Added coverage for using the fallback reserve, rolling over after it is exhausted, and bypassing the fallback for an explicit `new_context` request.
GitOrigin-RevId: 32983ecadc5cb4927e15ecd7b1e896cb52a9ad3b
Felipe Coury