## What changed
Build a `SandboxExecRequest` before applying backend-specific command wrapping. Extract Linux wrapping into `wrap_linux` and route Windows restricted-token requests through `prepare_legacy_windows_request`. Return unsandboxed requests before preparing native sandbox paths.
GitOrigin-RevId: afe3bcb444c222e9e0af9a556fe580eee074e34c
## Why
Submitted prompts need readable foreground and background colors when the terminal does not report its default colors.
## What changed
- Use a contrasting gray pair for truecolor and 256-color terminals when default colors are unavailable. Keep terminal defaults for 16-color terminals and unknown color support.
- Preserve voice markers, inline element accents, and asynchronous reply code colors when applying prompt styles to native history.
## Testing
Add contrast coverage for each color level and terminal rendering regressions for inline elements and asynchronous reply code colors. Update prompt snapshots to cover the fallback colors.
GitOrigin-RevId: dcda0fc3e2b12a5dc9046322a4d82c61986e3ecd
## What changed
- Support `tui.notification_method = "osc777"` with a `Codex` title and tmux passthrough.
- Replace control characters in OSC notification bodies and escape semicolon delimiters for OSC 777. Limit Ghostty bodies to 255 bytes, preserving UTF-8 boundaries and adding an ellipsis when truncated.
- Remove the 30-grapheme command limit from approval notifications, strip shell wrappers, and describe terminal input and network access requests explicitly.
## Testing
Add coverage for notification method selection, OSC 777 output with and without tmux, control character handling, Ghostty truncation, and approval notification text.
GitOrigin-RevId: e15fa7fdb007c38a148217f6aa0bbcc5e7371f9e
## Why
Reusable clients need fresh authentication for each request while preserving the credential source and transport policy selected when the client was created.
## What changed
- Add runtime-aware backend client construction and per-request authentication. Allow token refresh within the original credential source, reject credential replacement, and validate destination and account/organization selectors.
- Let runtime authentication finish persisting rotated tokens when the requesting task is cancelled.
- Apply asynchronous authentication to file creation and finalization requests, generating fresh assertions while keeping credentials off blob uploads.
- Preserve direct sandbox routing without enabling legacy custom-CA fallback for protected clients that reject redirects.
- Exclude login account metadata from model cache identities when provider bearer credentials override the login, and record authentication selection outcomes and duration.
## Testing
Add regression coverage for credential refresh and replacement, organization selection, destination restrictions, transport policy preservation, cancellation during token rotation, credential stripping on redirects, and file upload authentication in both runtime authentication modes.
GitOrigin-RevId: d045595e869dfcdfd9f705a6228cf0eb4c2d2c12
## Why
Allow remote exec-server registration to use credentials independently of Codex login while retaining the usual local configuration and plugins.
## What changed
- Add `--registration-bearer-stdin` to read one newline-terminated bearer and use it for remote registration.
- Validate the bearer, require HTTPS or HTTP loopback for the registry, and disable process dumpability on Linux before reading the credential.
- Document the option and its distinction from rotating credentials via `--executor-credential-stdin`.
## Testing
Add integration coverage for registration with the supplied bearer across desktop sign-in states, rejection of non-loopback HTTP registries, and restricted process environment access on Linux. Update CLI help snapshots.
GitOrigin-RevId: da99492270c5dc6bb5e0cac41947e9c999a72b75
## What changed
For live, retryable `ResponseStreamDisconnected` errors with HTTP status `429`, replace `Reconnecting... <attempt>` with `Server is busy, reconnecting <attempt>` in the TUI status header.
## Testing
Update the stream recovery test to assert `Server is busy, reconnecting 2/5` and verify that the previous status is restored when streaming resumes.
GitOrigin-RevId: 7fb97f61b856a830565b86ec1bac2ef8608875b8
## What changed
Add `ReviewExecution` observers and an optional `auto_review_overhead` subcomponent to `PathDurations`. Compute overhead by subtracting the union of observed child execution intervals from automatic review time, clipping intervals to the selected path segments and requested window.
Track concurrent and retried submissions, preserve unknown attribution for incomplete or unobserved execution, and allow observations to be sealed against late callbacks.
## Testing
Add unit coverage for overlapping execution, window clipping, human waits, cached reviews, losing parallel paths, canceled submissions, and sealed observations.
GitOrigin-RevId: 73ebe5ed9100a6598f28099ba46cc6d76578d8d9
## What changed
Use the `ignore` crate to snapshot matching files and directories in-process, replacing the external `rg` scan and fallback walker. Remove scanner discovery from MXC sandbox dependency checks.
Keep case-insensitive matching and configured scan depth limits. Skip directory links below the scan root while following explicitly linked roots, and continue past missing or inaccessible entries.
## Testing
Update resolver tests to cover child directory links, linked scan roots, dangling links, and literal brackets in glob patterns.
GitOrigin-RevId: e7f02d4db1fd42958adc212bb54055710fa2e536
## What changed
- Report sampling and compaction separately as `critical_path_sampling_ms` and `critical_path_compaction_ms`, retaining `critical_path_inference_ms` as their combined compatibility total.
- Enable critical path capture for subagent and Guardian turns when `CriticalPathTiming` is enabled, while continuing to exclude memory consolidation sessions.
- Preserve capture across incoming agent messages and support direct `spawn_agent` and `wait_agent` calls. Attribute these calls to the parent's tool time and keep child work on the child's own turn.
## Testing
Add runtime coverage for independent parent/child timing, incoming agent messages, Guardian turns, feature gating, and memory consolidation exclusion. Update phase accounting and analytics tests to cover the new fields and millisecond truncation.
GitOrigin-RevId: 09d4c0b853e817216bed173e4404d0d782de97ec
Configure `--experimental_disk_cache_gc_max_age` and
`--repo_contents_cache_gc_max_age` to `7d` in `.bazelrc`.
GitOrigin-RevId: d4d9c652269d56b854ad8d473b83809b76d683e5
## What changed
Create an empty `.chatgptcreated` sentinel in each missing deny-path parent directory created by the Windows MXC launcher. Leave existing directories and sentinel contents untouched, including when another process creates a directory first.
Reject deny-path parents that use the reserved `.chatgptcreated` name, accounting for case and trailing dots or spaces, before creating directories. If sentinel creation fails, attempt to remove the newly created directory so preparation can be retried.
## Testing
Extend Windows policy tests to cover sentinel creation, preservation of existing directories and sentinel contents, and rejection of reserved directory names before any parents are created.
GitOrigin-RevId: 640a1f3e05c118cca357643745e0d3b437354ffb
## What changed
Tag untrusted additional context rendered as tool outputs with history metadata and apply `guardian_include_additional_context` when building Guardian review history. Preserve this metadata across session resume and apply the current session's setting to restored review checkpoints.
Keep ordinary tool outputs in review history and preserve the acting model's additional-context payload.
## Testing
Add coverage for inclusion and exclusion after restart, restored checkpoints after compaction, and asynchronous Guardian review. Verify both line and JSON transcripts and check that metadata does not alter the acting model's request.
GitOrigin-RevId: 8ba270a6aac16398c88db3282e9d666702f462fe
## What changed
Add `guardian_include_additional_context` as a stable feature enabled by default, with a corresponding `GuardianIncludeAdditionalContext` enum variant. Document its purpose as including standalone additional-context tool outputs in Guardian review history, and expose the boolean flag in the configuration schema.
GitOrigin-RevId: 505132e5916bd7b3f1d6d80c2219051912ad8271
## Why
Remote compaction did not charge retained file audio against its token budget, allowing audio-heavy history to exceed the intended limit.
## What changed
- Charge file audio using `FILE_AUDIO_TOKENS_ESTIMATE`, independently of image budgeting.
- Retain the newest media content that fits, keeping images and audio together with their adjacent labels and preserving content annotations. Stop at oversized media instead of backfilling older content.
- Share media-label detection with user-input event mapping.
- Add download timeouts and a Debian mirror fallback for the musl build's `libcap` source archive.
## Testing
Add unit coverage for audio budgeting in both image-budget modes, atomic media labels, and truncation boundaries. Add integration coverage showing that compaction retains the newest five of seven file-audio items within the retained-message budget, including a mixed-media case.
GitOrigin-RevId: 4b7cd69f53966461fdeec14096712671d480187b
## Why
Uploaded audio was rejected even for audio-capable models. Invalid or expired recordings also need to be excluded from later requests so users can continue the conversation.
## What changed
- Accept uploaded audio when the selected model supports audio; otherwise, preserve valid sibling input and report the unsupported attachment before inference.
- Track successful audio decoding by model and provider, and attribute provider rejections against the exact submitted request. Preserve attachments when attribution is ambiguous.
- Persist confirmed rejected file IDs across compaction and resume, omitting them from future requests without rewriting retained user history.
- Check audio availability before remote compaction and retry once without an unambiguously rejected recording. Include guidance to remove or replace affected attachments in audio errors.
## Testing
Add unit and scenario coverage for uploaded audio across follow-up turns, compaction, cold and paginated resume, model switching, ambiguous rejections, expired files, and queued or interrupted input.
GitOrigin-RevId: e701901e7b1c0865c9f2a5918197215f549b06c0
## What changed
Use `resolve_for_enforcement` when preparing Windows restricted-token and elevated sandbox overrides, preserving read-only carveouts at volume roots. Expand deny-read ACL targets from the resolved permissions.
Use the same resolution in MXC policy preparation when volume roots do not require materialization, while retaining special handling for symbolic root denies.
## Testing
Add regression coverage for read-only carveouts in a volume-root workspace. Extend the Windows package smoke test to verify that a helper-created log matching a deny glob cannot be read while a neighboring allowed file remains readable.
GitOrigin-RevId: cee0834444464b3a7b0c8dbeecb8abcd5828b4b0
Add a macOS platform condition to apply `-Wno-pragma-clang-attribute` and
`-Wno-thread-safety-analysis` when compiling V8's libc++ library.
GitOrigin-RevId: daa5355a081e819818ada1f86833159cfa4cf555
## What changed
- Resolve Linux sandbox test binaries with `cargo_bin` and canonicalize the helper path used by the managed proxy filesystem policy so Bubblewrap can re-execute it.
- Restrict the rollout ownership test to supplementary groups mapped in the Linux user namespace, skipping when no alternate group is available.
- Exclude `gstcoreelements.dll` from the Windows startup-only voice fixture so handshakes succeed while runtime initialization still fails for missing plugins.
GitOrigin-RevId: 618376705c49d6ee3eea09f0d089b2eff4623fd2
## What changed
Map provider `budget_reached` errors to `SessionBudgetExceeded` for HTTP 400 responses and streaming failures. End SSE streams immediately on this error, ignoring retry headers and later completion events, and display `budget reached` in the TUI.
## Testing
Add coverage for HTTP error classification, immediate SSE termination without retries, WebSocket error delivery and subsequent request recovery, and TUI error rendering and task-state cleanup.
GitOrigin-RevId: 6a62d699cdb9cb446214cacfacd0c9ed68bf21a6
## Why
Redirecting stderr on `exec` while closing the lock descriptor suppressed subsequent installer warnings, including the warning that an existing npm-managed Codex installation remains installed.
## What changed
Remove the stderr redirection from `release_install_lock` when closing file descriptor 9. Add a regression test asserting that a noninteractive install succeeds and emits the existing npm installation warning.
GitOrigin-RevId: 5a35ccd9bf62afb99cc949892ec724a01e2d9eee
## Why
Parent input can change authorization while a Guardian assessment is in flight. A denial based on stale context must be retried, just as an approval is, so newly granted authorization can take effect.
## What changed
Revalidate both verdicts before publishing reviewer checkpoints or recording failed-review records. Discard invalidated assessments so they do not persist in reviewer history or count toward the denial limit.
## Testing
Extend authorization-refresh regression coverage for approval arriving during a denial and repeated stale denials. Verify refreshed reviews omit invalidated assessments and stale denials produce neither denial-limit errors nor failed-review records.
GitOrigin-RevId: c699178bc3b5e2d8b075279b00967a4e09fc533c
## What changed
Configure `zstd-sys` to depend on `@zstd` and disable its Cargo build script. Upgrade the Bazel `zstd` dependency to `1.5.7.bcr.2`, update the lockfile, and remove the unused Windows MSVC include-directory patch.
GitOrigin-RevId: 723b1a0245ea9e1789a95960bf99100038a03c45
Update the reviewer configuration test to call
`ManagedFeatures::from_configured_with_warnings` and pass
`parent_config.startup_warnings`, avoiding the crate-private
`from_configured` constructor.
GitOrigin-RevId: 2ba41ba6918e1007b3af013b7146940d919e4560
## What changed
- Add configurable `focus_main_composer` and `focus_sidebar_content` actions, with default `leader c` and `leader s` bindings in workspace mode.
- Let users return to the main composer while keeping the side pane open, or focus the side conversation and hide it when already focused.
- Clear transcript search, selection, and activity focus when returning to the main composer, including when hiding the side pane.
## Testing
Extend tests for focus switching, blocked thread switches, offline composer focus, key capture, and binding conflicts.
GitOrigin-RevId: da624ce7e00a63c4f13870e55c4bc95f09b32cc4
## What changed
Expose `add_user_message` for plain-text input using the existing thread configuration, with explicit `StartIfIdle`, `Steer`, and `Queue` modes and typed admission outcomes. Expose `interrupt_turn` to interrupt a specific turn without removing queued input.
Distinguish local validation failures from unknown remote outcomes, require successful final gRPC status, and avoid automatic retries. Preserve client message identity and raw admission payloads; report duplicate admissions by original turn ID without implying current lifecycle status.
Document reconciliation requirements and extend the attach example to submit an optional message while draining events.
## Testing
Add wire-fixture tests for admission variants, request encoding, malformed responses, local validation, redacted diagnostics, uncertain RPC outcomes, final gRPC status requirements, and dropping pending submissions without retrying or interrupting.
GitOrigin-RevId: 1def92de3fc5ca8c1f89431b7ea29b9b80d64600
## What changed
Add `SavedDaybreakChoice` and `ModelAccessPrograms::select_saved` to resolve an optional saved preference. Enabled selects an advertised Daybreak program, disabled selects an advertised standard program, and unset or unsupported choices return `None`.
## Testing
Extend selection tests to cover enabled, disabled, and unset preferences across advertised program combinations, preserving the preference for Daybreak Blue over Red.
GitOrigin-RevId: 1c7ab3fe1d3a48ad64519bfedfe27de90838516c
## What changed
- Share a lazily registered runtime across threads, model discovery, and extension clients when `runtime_agent_instances` is enabled, while honoring each thread's authentication mode and credential owner.
- Bind model catalogs to the effective provider and authentication context while preserving cache policy and live API-key discovery settings.
- Resolve credentials, routing, and transport policy together for each request. Preserve proxy and TLS settings, validate runtime account selectors, and prevent pooled connections from crossing runtime identities.
- Accept supported ChatGPT subdomains when selecting the registration environment.
## Testing
Add integration coverage for shared runtime registration, dual-header and assertion-only modes, disabled and third-party providers, credential replacement, subagents, and delegated review. Add coverage for catalog cache policy and runtime-aware connection reuse.
GitOrigin-RevId: 99dd9d987c29c93597a648f6586f98ac6a932c3c
## What changed
Move permanent agent message board deletion from `codex-core` into the app server's thread-store cleanup callback. Keep board cleanup active when the board feature is disabled, and run it before optional Guardian evidence-board cleanup.
Remove the message board extension dependency from `codex-core` and retain `codex-message-board` only as a development dependency. Update the core test harness to install the app server's cleanup callback.
GitOrigin-RevId: 61813bbdcd8b57073b8c249e1f771e3fb0ea061e
## What changed
Move the board host adapter and `install_agent_message_board` from `codex-core` to `codex-app-server`, using public core runtime interfaces. Update extension registration, test callers, dependencies, and installation documentation to use the new location.
Format `CHANNEL_POST` notification payloads in the host adapter and retain recognition of legacy board notices in core. Expose `MULTI_AGENT_V2_NAMESPACE_DESCRIPTION` for host extensions to share with native tools.
GitOrigin-RevId: 679b5751de102bff80e6b9d4b0728a84fbdedd85
## What changed
- Move approval-request and prompt-composition tests from `core` to `guardian-reviewer`.
- Move transcript collection, budgeting, and approval-reason truncation tests to `guardian-context`, removing the test-only rendering helper from `core`.
- Move the managed-feature reviewer configuration test to `guardian-v2`.
GitOrigin-RevId: 1886a10cd6aba07b7ca2bcce28d45e0a698111a6
## What changed
- Add `CodexThread` methods for reading the registration source, resolving agent references, and reading the configured clock.
- Replace the board-specific thread lookup with public `ThreadManager::get_thread_with_extension`, which requires matching typed extension data and never loads a missing runtime.
- Update the local message board host to use these APIs and thread startup metadata instead of accessing session internals directly.
GitOrigin-RevId: 143b798cc710e079e20be59a84d05738a3bc6a0b
## Why
Board notifications were skipped when recipients had no active turn accepting mailbox delivery. Queue them through the ordinary agent-message path so idle recipients can receive them in a later turn.
## What changed
- Submit board notices as `Op::InterAgentCommunication` with `trigger_turn` disabled, preserving normal mailbox scheduling without reopening finalized answers.
- Hold a residency guard through dispatch of submitted agent messages to coordinate delivery with agent eviction.
- Update board tool descriptions to describe the host's notification queueing and wake policy.
## Testing
Update local and HTTP board scenarios to cover queued idle notices, delivery after a finalized answer, and mailbox delivery before a pending tool call. Extend residency coverage to verify that submission waits for the eviction gate and queued messages survive eviction.
GitOrigin-RevId: a77137fc40932f5903852e14742483844e07c9bc
## What changed
Introduce `GuardianReviewResponse` to retain both the parsed assessment and the original response text. Reuse the stored result for authorization checks, denial reconsideration, review record capture, and final assessment extraction instead of reparsing the response.
Preserve raw text for review records and keep invalid responses as completed turns so history and session reuse remain unchanged.
## Testing
Extend review record coverage to wrapped denials and invalid responses, and verify that invalid assessments remain retryable while missing assessments do not.
GitOrigin-RevId: 50c19e788a8d57f951c6140d66306b3538515adc
## What changed
- Replace `unwrap()` calls with descriptive `expect()` messages in rollout budget and web search scenario tests.
- Add a targeted `clippy::expect_used` exemption in `BackendSessions::set_preference_key`, documenting that preference keys are assigned only after backend registration.
GitOrigin-RevId: 5ff63e9abb4ea728371874ed121043e9e00438a0
## What changed
Add `tui.keymap.global.hide_pane`, defaulting to `leader -` in workspace mode. Hiding a focused side conversation returns to its parent while retaining the conversation, drafts, and view state for reopening.
Expose the action in the workspace keymap picker, validate binding conflicts, and suppress held shortcut keys after switching focus.
## Testing
Add coverage for hiding and reopening at split-pane and narrow widths, preserving conversation state, shortcut availability, key capture, and repeat/release handling.
GitOrigin-RevId: 6897c34b208041e6f90ae0e18c781eebd62566bd
Replace `unwrap()` with descriptive `expect()` messages when enabling denial reconsideration and setting the read-only permission profile in Guardian tests.
GitOrigin-RevId: 9e5e32ac94889e063d5a721fa6fde8e5c871747d
## Why
Setting granular `sandbox_approval` to `false` also blocked approval requests for dangerous commands such as `rm -f`, even when they requested no additional permissions. Reviewing a dangerous command should remain possible within the existing permission profile.
## What changed
Allow heuristic dangerous-command approval requests with `sandbox_approval = false` when execution stays within current permissions. Do not propose reusable execution-policy amendments for these approvals, since reusable allow rules can bypass the sandbox on later calls.
Keep escalation requests, explicit policy rules, and Windows execution without required sandbox protection subject to their existing approval restrictions. Clarify the meaning of `sandbox_approval` in the protocol and generated schemas.
## Testing
Add coverage for POSIX and Windows approval decisions, approval and denial of deletion commands, preservation of read-only restrictions, and separate dangerous-command approval after turn-scoped or session-scoped write grants.
GitOrigin-RevId: 90adc137c7b7d3f3ee68efb1f6bea531229e7834
## Why
A timeout during denial reconsideration replaced an already completed Guardian denial with a timeout outcome, losing the original assessment.
## What changed
Keep the original denial when reconsideration times out, including its risk level, user authorization, and rationale. Discard the review session while preserving cancellation behavior.
## Testing
Add a reconsideration timeout scenario that verifies the original assessment and denial rationale are preserved and the requested file write remains blocked.
GitOrigin-RevId: 448a6d2d1e779c58076091384fe1215b8c02bde2
## Why
Waking an evicted worker from a sibling should preserve the worker's effective permissions, including runtime grants, denials, and network restrictions that a profile name alone cannot reconstruct.
## What changed
Retain the worker's effective configuration during eviction. On sender-driven reloads, restore its permissions and approvals reviewer while keeping the current wake configuration for other settings.
## Testing
Add regression coverage comparing loaded and reloaded workers with read-only, named, and legacy permission settings. Verify that worker permissions, active profiles, and network policies survive sibling wakeups and that parent and sender permissions remain unchanged.
GitOrigin-RevId: ffc353154535362cfbfbbe2b7fc43e08b42cf9b9
## Why
Existing chats can retain reasoning effort and service tier selections that a refreshed provider catalog no longer supports.
## What changed
- Apply fresh provider catalogs to saved settings in open and resumed chats, and normalize incoming settings before capturing the next turn.
- Replace unsupported ranked reasoning efforts with the highest supported level at or below the selection. For unsupported `ultra` or `persistent` selections, use the model's supported default when available. Reset unsupported `priority` and `ultrafast` service tiers to `default`.
- Retire incompatible reasoning effort pins using each step's captured model metadata, preserving running steps and the live pin during compaction.
- Publish catalog updates only from successful provider responses for the current identity, and refresh retained originator catalogs through the periodic refresh worker.
## Testing
Add coverage for setting correction, reasoning effort pins, resumed chats, stale queued settings, retained history, refresh failures, identity changes, and isolated originator notifications.
GitOrigin-RevId: 2ef4605c4acba98db3fe9d0328e2752084e900a2
## What changed
Add the disabled-by-default `guardian_denial_reconsideration` feature to reconsider a synchronous Guardian denial once before publishing the final decision. The follow-up uses the same review session, evidence, model settings, and original deadline, without compacting the retained context.
Only a valid second assessment replaces the denial. Invalid or failed follow-ups keep the original denial and discard the review session; cancellation and timeout retain their normal outcomes.
Allow a custom developer message through `auto_review.experimental_denial_reconsideration_prompt`, limited to 1,000 UTF-8 bytes. Omitted or blank values use the built-in prompt, which grants no new authorization and preserves the security policy.
## Testing
Add scenario coverage for feature gating, unchanged approvals, reconsidered approvals and denials, invalid assessments, failed follow-ups, custom prompts, and retained context. Extend cancellation coverage to reconsideration and config tests to prompt normalization and byte-limit validation.
GitOrigin-RevId: 61c45d5a948e3e5684c4b4048d6e90fd3f1f2476
## What changed
Add a shared command builder for `codex-voice-host` integration tests. On Windows MSVC builds with Bazel runfiles available, locate the architecture-specific voice runtime and prepend its `bin` directory to the helper's `PATH`.
Use the builder for lifecycle helper launches and build-identity queries in the lifecycle, installed-client, and packaged-runtime tests.
GitOrigin-RevId: c9fbd0769842eb4ee20742e126a9c4173dd7e128
## Why
`Attach` delivers live events only. Clients also need access to stored turn metadata and item content.
## What changed
- Add `Client::list_turns` and `Client::list_items` using native gRPC history endpoints, with optional turn filtering for items.
- Expose page limits, sort order, access mode, and forward/backward cursors. Each call returns one page in server order without automatic pagination or retries.
- Preserve raw response and row payloads alongside typed summaries and item timestamps. Retain unknown item variants and command sources without typed summaries.
- Document cursor reuse and history/live overlap: history pages do not provide an atomic boundary with `Attach`, and coordinated reconciliation still requires caller-managed state.
## Testing
Add wire-fixture tests for request encoding, explicit pagination, raw payload preservation, unknown data, malformed rows, empty pages, RPC errors without retries, and diagnostic redaction.
GitOrigin-RevId: f507530b8e431236bc7e19d867517af56f74644f
## What changed
- Gate GIF output behind `features.image_generation_animation`, disabled by default.
- Accept `gif` options for generation and editing, with optional `frame_count` and `frame_duration_ms` controls. Use `gif: {}` for API defaults.
- Preserve animated output with `.gif` filenames and `image/gif` data URLs while providing a still preview to the model.
- Add guidance for simple animations and spritesheet-based GIF edits.
## Testing
Add integration coverage for GIF generation and editing, explicit frame controls and API defaults, saved animation bytes, and still-preview replay across follow-up turns.
GitOrigin-RevId: 08afa0316ae3675921652157836191a649f563cf
## What changed
Restore `code_mode_only_strict_3p_tools` as an opt-in feature under development. When the effective tool mode is Code Mode Only, keep eligible MCP/app and client-supplied dynamic tools deferred and callable through `exec`, regardless of `deferLoading`, `omit_tools_from`, or namespace exclusion and direct-only settings.
Preserve hidden tools, tool policy restrictions, and built-in tool classification. Log conflicting exposure settings without adding warnings to the model prompt. Leave other effective tool modes unaffected.
## Testing
Add coverage for exposure overrides, model mode overrides, built-in name collisions, and hidden or denied tools. Update integration coverage for app access restrictions and MCP catalog refreshes that preserve the cached prompt prefix while `exec` uses the current tools.
GitOrigin-RevId: 0cb085ba9d23bebc48dbc3fa298b982de0a66c47
## Why
Bedrock onboarding previously forced an embedded server and was unavailable when connected to a local daemon. Credential discovery uses the server environment, which can differ from the launching shell.
## What changed
- Allow the Bedrock setup wizard to use the local daemon while keeping GCP onboarding on the embedded server.
- Clarify that detected AWS credentials come from the server environment.
- Direct users who export AWS credentials in their shell to run `codex --no-daemon` in that shell.
## Testing
Update wizard eligibility tests and onboarding snapshots, and extend daemon startup coverage to verify discovery of a Bedrock API key available only to an already running daemon.
GitOrigin-RevId: 9502ffaa59250210e8f8bc8db6f82b0803cb6cac
## What changed
Decode live item start and completion notifications as `TranscriptUpdate::ItemStarted` and `TranscriptUpdate::ItemCompleted`, with turn identity, lifecycle timestamps, and summaries for user messages, agent messages, reasoning, commands, and file changes.
Preserve structured agent questions even when message text is empty, optional command output and exit details, and command or patch status independently of lifecycle completion. Keep unsupported or incomplete items as opaque notifications and redact summary fields in debug output.
## Testing
Add fixtures covering lifecycle ordering alongside deltas, identity and timestamps, status and optional-field preservation, structured questions, opaque fallback, malformed payloads, thread ownership, and debug redaction.
GitOrigin-RevId: d6bf2d25ee85be17d895726c5072850a9851b55f
viyatb-oai