## Why
Compaction using the previous model can inherit the current turn's access program, producing a model/program pair that the server rejects.
## What changed
- Persist `cyber_access_program` in previous-turn settings and restore it during rollout reconstruction.
- Use the previous turn's access program when compacting with its model, preserving an absent program instead of inheriting the current selection.
- Pass the selected access program into local compaction prompts.
## Testing
Add regression coverage for local and remote compaction after model switches, including resume, fork, rollback, and compaction checkpoints. Verify fallback and subsequent sampling use the current model/program pair, and API-key sessions do not inherit access-program authorization.
GitOrigin-RevId: eaa7162e8711446dc9eb1bfff194e711abd54d7e
## What changed
Allow `cursor` to accept an item anchor such as `{"type":"item","itemId":"item-123"}` with a non-empty `turnId`. Ascending pagination returns items after the anchor; descending pagination returns items before it. The anchor itself is excluded, and subsequent pages use the returned opaque string cursor.
Resolve anchors within the requested turn's visible history, including inherited fork history. Reject missing turn IDs and empty, unknown, or out-of-scope item IDs with invalid params (`-32602`). Preserve existing string and null cursor behavior, and update the protocol schemas, TypeScript and Python types, and API documentation.
## Testing
Add protocol round-trip and invalid-shape tests, app-server coverage for anchored pagination and errors, and thread-store coverage for growing turns, reverse pagination, page boundaries, fork visibility, and anchor scope validation.
GitOrigin-RevId: a74cea190d3ff1b44865429f8b0650b793eb688d
## Why
Synchronous Guardian reviews can include the same user instruction in both the retained instructions section and the conversation transcript. Avoid this duplication while preserving complete authorization evidence and its original acceptance order.
## What changed
- Carry retained source metadata into transcript rendering. Omit a retained instruction when the transcript delivers its complete matching source revision.
- Label qualifying transcript entries with retained source order and protect them from budget truncation. Keep separate retained instructions when source metadata is missing or incomplete.
- Track delivery of source-order guidance so it remains available even when all retained instructions are delivered through the transcript. Invalidate that delivery proof when messages are shortened.
## Testing
Add coverage for complete-source deduplication, missing or incomplete metadata, budget protection, guidance redelivery, and source metadata preservation across resume. Update Guardian review assertions and snapshots to verify instructions are delivered once.
GitOrigin-RevId: 20ad0304501fa49f1596c4cfaf3ef89d64815753
## Why
User messages could fill the root context limit before assistant questions were considered, while commentary could displace relevant conversational context. Guardian needs that context to interpret user authorization when reviewing subagent actions.
## What changed
- Select recent user and assistant evidence together under a shared message limit, discarding assistants with unknown ordering first.
- Exclude explicit assistant commentary and retain message phases across compaction. For older retained records, check available source messages for commentary phases.
- Mark missing instructions or assistant context when the shared limit removes corresponding evidence, and use remaining space for legacy instructions.
## Testing
Update Guardian authorization tests to cover shared message limits, commentary filtering across compaction and resume, and preservation of ordered replies when legacy assistant context has unknown ordering.
GitOrigin-RevId: c369a2760917cba9d7dfca37fb5e85a7ec49012f
## Why
Reused Guardian sessions already contain previously delivered instructions. Follow-up reviews can avoid repeating that evidence, but must deliver it again if it changes or compaction removes it.
## What changed
- Track retained source identity, revision, and completeness in host-owned history metadata, preserving revisions during replay.
- Omit retained instructions from synchronous review inputs only when the same complete revision remains in reviewer history.
- Restore missing evidence after reviewer compaction, enforcing the request budget before persisting additions. Classify restored evidence as context rather than new user authorization.
- Keep source-order labels stable across eviction and retain full delivery for legacy records without reliable provenance.
## Testing
Add coverage for consecutive-review deduplication, changed revisions, missing or incomplete metadata, and restoring compacted evidence exactly once. Extend compaction and resume coverage to verify retained revisions.
GitOrigin-RevId: e90fca16cde0a0970da36dd873af2ca1dbaaf4d3
## What changed
- Stop sending `includeExtensions=true` when fetching installed plugins and remove extension metadata from remote plugin models.
- Remove `PluginSummary.extensions` and the associated extension declaration types from the app-server protocol.
- Update generated JSON schemas, TypeScript and Python bindings, and precomputed protocol exports to match.
GitOrigin-RevId: 56509437b6bdf58d99badff68e86bcf7f09fe036
## What changed
- Recognize `promax` in authentication, account responses, and backend rate limits; update generated schemas and client types.
- Display `prolite` as “Pro”, `pro` as “Pro (More)”, and `promax` as “Pro (Max)” in account labels, status, and analytics.
- Include Pro Max in experimental context eligibility, paid-plan tooltips, and usage-limit guidance for purchasing credits.
## Testing
Extend coverage for Pro Max plan parsing, account and rate-limit responses, experimental context eligibility, and plan display names. Update the login token test to expect “Pro (More)”.
GitOrigin-RevId: 197e00fa7a99cbce125c8f1d43a451ec1ed5c1fb
## What changed
- Recognize `flex_unavailable` in HTTP 429 responses and streamed `error` and `response.failed` events. End normal turns without retries and report `Flex capacity unavailable.`
- Expose `flexUnavailable` through the core and app-server protocols and generated schemas and SDK types.
- Keep Flex capacity failures eligible for Guardian review and sampler retries, with a distinct telemetry classification.
- Map unexpected HTTP responses to `HttpConnectionFailed`, preserving their status codes.
## Testing
Add regression coverage for terminal Flex failures over HTTP, SSE, and WebSocket, HTTP 504 status preservation after a stream retry, and protocol serialization. Update Guardian retry and sampler recovery tests to cover Flex failures.
GitOrigin-RevId: f2e03a6d2d36a6d9748c35952e40397f8670d121
## Why
The `attribution_error` status does not explain why MCP attribution is incomplete. Preserve a diagnostic reason so callers can distinguish history and recorder errors from request serialization failures.
## What changed
- Add optional `error_reason` diagnostics to `McpAttribution`, retaining the first recorder error through checkpoints, compaction, resume, and fork.
- Identify missing or invalid checkpoints, conflicting sources, invalid sources, and poisoned recorder state. Use `restored_error_unknown` for older error checkpoints without a reason.
- Distinguish `payload_too_large` from `serialization_failed` in request metadata fallbacks.
- Tolerate missing, unknown, or malformed diagnostic reasons when reading history, without letting diagnostics determine attribution status.
## Testing
Add coverage for reason preservation, recorder poisoning, backward-compatible checkpoint decoding, resume and cold-fork restoration, and request metadata serialization, including oversized payloads.
GitOrigin-RevId: 389b9446fae119f793978f3e7e4a926677e84d8c
## Why
Unchanged scheduled heartbeat instructions should not become fresh authorization evidence that supersedes a later human override or floods Guardian review context.
## What changed
- Capture heartbeat provenance per input, including when steering an active turn, and persist it in history and retained context.
- Coalesce unchanged instructions for each automation at their original acceptance order. Preserve changed instruction versions and ordinary human messages.
- Represent repeated heartbeats as references to earlier instructions in Guardian transcripts, while tracking the latest input turn separately for trusted skill selection.
- Limit coalescing to recognized, bounded heartbeat envelopes with host-provided provenance.
## Testing
Add regression coverage for human overrides across repeated and steered heartbeats, instruction changes, checkpoint restoration, transcript references, envelope parsing, and latest-turn trusted skills in delegated reviews.
GitOrigin-RevId: 31e444ddb685a1a618be26d3cc32fb562296946b
## Why
App-server clients need a way to connect to executors that require bearer authentication through `environment/add` and `environments.toml`.
## What changed
- Add optional `authBearerToken` to `environment/add` and `auth_bearer_token` to URL entries in `environments.toml`.
- Send the token as an `Authorization: Bearer` header on initial connections and reconnects, without automatic refresh. Require `wss://` or a loopback destination when a token is supplied.
- Redact tokens in debug output, mark connection headers sensitive, and omit source text from TOML parse errors.
- Preserve unauthenticated behavior when tokens are omitted, including requests with a null `authBearerToken`.
## Testing
Add integration coverage for authenticated and unauthenticated executors through both RPC and TOML configuration, including missing, null, incorrect, and malformed RPC tokens. Extend tests for reconnect authorization headers, token redaction, URL-only token configuration, and timeout preservation.
GitOrigin-RevId: 2a5d48a1846df1720e4a9b295968348378c287c6
## Why
Ordinary user replies can depend on preceding assistant messages. Losing those messages during compaction can leave Guardian without the context needed to interpret a reply's scope.
## What changed
- Retain original assistant messages, including commentary, with their recorded order across checkpoints and resume. Exclude compaction output from this evidence.
- Include assistant context in local and delegated reviews as untrusted context, with separate storage limits and lower budget priority than user instructions.
- Prefer assistant context preceding ordinary replies when selecting bounded root evidence, and report unavailable context without inferring what a reply refers to.
- Preserve inherited context scope and remove assistant evidence beyond rollback boundaries, including during rollout migration.
## Testing
Extend coverage for compaction and resume, checkpoint migration, queued-input ordering and rollback, role labeling, and evidence budgets that preserve user restrictions while dropping assistant context.
GitOrigin-RevId: 886189b0be29ffc3d324b56f5d0b673d6b8d84da
## What changed
Add `backend_reasoning_status`, disabled by default, to relay public reasoning summaries during active, server-managed realtime V3 delegations.
Use the last non-empty summary from each completed reasoning item, truncate it to 256 bytes at a character boundary, and append it as `[STATUS]` context on the `commentary` channel. Discard queued updates if their delegation is no longer active.
## Testing
Add an integration test covering enabled and disabled behavior, selection of the latest non-empty summary, exclusion of raw reasoning and partial summaries, and delivery without triggering `response.create` or changing the model's reasoning-summary setting.
GitOrigin-RevId: 75ce87dbbbab15a6d9d0ad0b23737738837192fd
## Why
`invalid_prompt` responses were classified as generic invalid requests, losing the server's specific error classification.
## What changed
Add `InvalidPrompt` variants to the API and core error types and serialize the core protocol classification as `invalid_prompt`. Recognize the code in HTTP 400 responses, wrapped WebSocket errors, and SSE `response.failed` events while preserving server messages and keeping the error non-retryable. Map it to `other` in the app-server v2 protocol.
## Testing
Extend coverage for typed error mapping, missing and blank messages, protocol conversion, and guardian retry handling. Exercise HTTP and SSE failures in core integration tests, asserting the error message, serialized classification, and a single request without retry.
GitOrigin-RevId: 5d9a299a013b06158a4dc27a4054f3dbc5fd0f4d
## Why
Compaction companion records do not represent all resume state, including the last started turn and previous turn settings. The selected multi-agent runtime also needs a persisted value when no companion turn context is present.
## What changed
- Add optional `resume_metadata` to `CompactedItem`, recording the multi-agent version, last started turn ID, and previous turn settings. Preserve the distinction between absent metadata and explicitly empty values while retaining compatibility with older records.
- Capture this metadata under the settings persistence lock alongside the compaction checkpoint.
- Rewrite inherited metadata to use the child agent's runtime, and clear previous turn settings when the child must rebuild context.
- Clear pending continuation state before delivering acceptance of standalone settings updates, while holding the persistence lock.
## Testing
Add coverage for metadata round trips with empty values, legacy reader compatibility, checkpoint companion records, inherited fork metadata, and continuation invalidation while settings event delivery is blocked.
GitOrigin-RevId: f30b7feaa7e2fdb5b65fc3c53b37fd7a7fe27903
## What changed
- Request installed-plugin metadata with `includeExtensions=true` and carry optional `extensions` through the cache into `PluginSummary`.
- Add typed declarations for global, settings, thread, and file entrypoints, quick actions, settings tools, icons, and search mention providers. Update JSON schemas and TypeScript and Python bindings.
- Accept supported snake_case aliases and emit camelCase fields. Discard incompatible extension declarations without invalidating the installed-plugin inventory.
## Testing
Add an integration test covering extension metadata preservation, field normalization, and unknown entrypoint and quick-action types across live and cached `plugin/installed` reads. Update pagination assertions to require `includeExtensions=true`.
GitOrigin-RevId: b73b0d13c151a30dc1fb9cda70b5cd6d7e3e2441
## What changed
Allow `mcpServer/resource/read` to specify `target: {connectorId, linkId}` for direct hosted app reads without tool discovery, when supported by the backend. Require an explicit `linkId`: a string selects an account, while `null` requests no-auth access subject to backend policy.
Restrict direct targets to `codex_apps` and reject empty connector IDs, empty link IDs, and synthetic link IDs. Preserve originating app/account scope when `originCallId` and `threadId` are supplied, and retain discovery when `target` is omitted.
Update protocol schemas and TypeScript and Python models, preserving required-but-nullable `linkId` semantics in Python code generation.
## Testing
Extend resource-read tests to check target metadata with and without a thread, including explicit no-auth targets and omitted targets. Add Python model tests for string and null `linkId` values and rejection of a missing `linkId`.
GitOrigin-RevId: 8cf5595fbdd937193aeb529901fc95299f6e18ad
## Why
Clients with a gateway sign-in UI need to control when browser authorization starts and inspect credential readiness before making authenticated requests.
## What changed
- Add `initialize.capabilities.explicitGatewayOauth` to require explicit login while allowing existing credentials to refresh. Preserve automatic authorization for clients that omit the capability, and prevent later connections from undoing explicit opt-in.
- Add `account/gatewayOAuth/read`, `account/gatewayOAuth/login`, and `account/gatewayOAuth/cancel`, plus `account/gatewayOAuth/changed` notifications. Send the authorization URL only to the initiating connection and cancel its login on disconnect.
- Check gateway authentication before returning cached results from `model/list`, with restart guidance when provider settings have changed.
- Update protocol schemas, TypeScript and Python bindings, and document capability probing and the sign-in lifecycle.
## Testing
Add tests for passive readiness reads, credential reuse after login, token exchange failures, cancellation and immediate retry, connection ownership, legacy versus explicit login, and model-list authentication checks.
GitOrigin-RevId: a26e116a62c9f3db84dc238a40b7f4e816eb1594
## What changed
Add nullable `httpOrigin` to `McpServerStatus`, derived from the effective configured endpoint for both configured and plugin-provided servers. Return only the HTTP(S) origin, excluding credentials, path, query, and fragment; return `null` for stdio transports, invalid URLs, and non-HTTP(S) schemes. Update the generated protocol schemas and TypeScript and Python types.
## Testing
Extend status integration tests to cover configured and plugin-provided HTTP servers, verify that endpoint paths and query parameters are omitted, and assert `null` for a stdio server. Update protocol tests to check null serialization and compatibility with older inventory responses.
GitOrigin-RevId: 033ebdeefe829e3a48b2d4ab7d8866dac4cda5c5
## What changed
- Persist producer-recorded item start and completion times in thread history, preserving existing non-null values on updates.
- Return nullable `startedAtMs` and `completedAtMs` Unix millisecond timestamps from `thread/items/list`, and update the generated schemas and TypeScript and Python types.
- Leave timestamps unknown for existing rows and older writers.
## Testing
Add coverage for exact timestamp persistence, protocol round trips with present and missing timestamps, paginated item responses, and compatibility with older database writers.
GitOrigin-RevId: 894853481085782ff54db1704799e41446d15e51
## What changed
- Capture optional `creator_user_id` and `creator_account_id` from authentication when creating a thread, including forks.
- Carry these fields through thread storage, rollout metadata, and a SQLite migration. Leave them absent when unavailable or when reading older threads.
- Preserve recorded creator values across resume and metadata updates. On revert, recover missing rollout values from SQLite before writing replacement metadata.
## Testing
Add coverage for ChatGPT and API-key sessions, resume under another account, forks using current authentication, metadata extraction and upserts, and repeated reverts after creator fields are removed from a rollout.
GitOrigin-RevId: 9839fa42f9392f12226002e2c27d05d5656f5695
## What changed
- Record each MCP source and its first turn, including connector and plugin identifiers when available. Cover direct and Code Mode calls, including returned errors and results that are not printed.
- Persist cumulative attribution checkpoints and restore them across compaction, resume, and forks, including forks limited to recent turns.
- Attach fresh attribution to Responses API `client_metadata` under `mcp_attribution`, outside model-visible content. Restrict transmission to allowed OpenAI HTTPS destinations for both HTTP and WebSocket requests.
- Report `attribution_error` for legacy history without checkpoints, malformed or conflicting attribution, and serialized attribution exceeding 16 KiB.
## Testing
Add coverage for source deduplication, checkpoint persistence and restoration, recent-turn forks, direct and Code Mode calls, destination filtering, and the serialized size limit.
GitOrigin-RevId: fd285e152ca9e24bfa000debb20013709d67a86e
## Why
Guardian's retained root context appended assistant messages after user evidence and omitted questions sent through User Messaging. This could leave subagent authorization reviews with missing or misplaced conversational context.
## What changed
- Record assistant messages and function calls in the same order sequence as accepted user inputs, then merge retained review context by recorded position while prioritizing user evidence within the message budget.
- Capture bounded User Messaging text after input hooks when a send succeeds, and match it to the original call for assistant context.
- Label assistant context without a recorded position explicitly and clear parent assistant and tool positions when forking agent history.
- Clarify that recorded order does not establish delivery order or pair ordinary replies with questions; assistant messages remain untrusted context.
## Testing
Add coverage for hook-rewritten messages, failed or unconfirmed sends, queued replies with delayed tool results, ordering across resume, and removal of inherited assistant positions from forked history.
GitOrigin-RevId: ac717cf0f5efe4b05c18f2d8370dd48453ac4e35
## Why
Native `openai/userVerification` requests need to carry optional `_meta` to clients for extension-specific presentation.
## What changed
- Accept optional metadata objects with the same validation as MCP elicitation.
- Restore metadata from the MCP request context, excluding `progressToken`, and forward it through `mcpServer/elicitation/request`.
- Update protocol types, schemas, and documentation while retaining support for requests without metadata. Challenge bytes and acceptance proofs remain unchanged.
## Testing
Add coverage for metadata validation, transport context restoration, and protocol round trips. Extend MCP integration tests to check that verification metadata reaches the client.
GitOrigin-RevId: 5d04004244cf33effac675c19e543157c48d1504
## What changed
- Remove the private-desktop opt-out from elevated and unelevated Windows sandbox launches.
- Remove `windows.sandbox_private_desktop` and its managed requirement and API fields. Warn users to remove the obsolete setting.
- Require a private desktop name when launching through the Windows sandbox wrapper and command runner.
## Testing
Add coverage for the obsolete-setting migration warning and update wrapper tests to verify a live private desktop is passed and a missing desktop name is rejected.
GitOrigin-RevId: c7135f8d211aac8d812180691c2c1e433d77cde4
## What changed
Add an optional `onboardingSkill` summary to `plugin/read` responses and update the generated schemas, TypeScript types, and Python models.
- Resolve local declarations from `extensions["com.openai"].onboardingSkill`, accepting relative paths with or without `./`. Require the resolved path to stay within the plugin root and match a loaded skill.
- Match remote release metadata's `onboarding_skill_name` against the plugin's skills.
- Return the summary only when the plugin and matching visible skill are enabled; remote plugins must also be available. Otherwise, return `null`.
## Testing
Add parameterized local and remote `plugin/read` tests covering matching, missing, and unmatched declarations, disabled plugins and skills, and unavailable remote plugins.
GitOrigin-RevId: 88cabdfddbecba5efba756617da0cb1ff064bdf7
## Why
Streaming `bio_policy` failures were classified as generic invalid requests, losing their policy-specific classification.
## What changed
- Add `BioPolicy` errors across the API and core protocol, recognizing streaming failures and HTTP 400 responses, including wrapped WebSocket errors.
- Preserve server messages and use a biological-risk fallback when the message is missing or blank.
- Treat bio policy errors as non-retryable in core and guardian handling, and classify them in diagnostics and telemetry.
- Map `BioPolicy` to `other` in the app-server v2 protocol.
## Testing
Add coverage for error classification, message preservation and fallbacks, HTTP and wrapped WebSocket responses, guardian retry decisions, and app-server conversion. Extend the core integration test to verify that bio policy failures emit a typed error and complete the turn after a single request.
GitOrigin-RevId: 78c2647e8fc8f80297cb8a23fff06ab141099632
## Why
A delegated task can omit restrictions from the sender's user messages. Guardian needs that context when reviewing actions in the receiving thread.
## What changed
- When thread-owned Guardian context is enabled, capture up to three recent local user messages when a `send_message_to_thread` delivery from `codex_app` or `codex_tui` is accepted.
- Provide a bounded snapshot to synchronous and asynchronous reviewers, with explicit notices for unavailable evidence and a reminder that historical context does not transfer permission. Keep the snapshot out of the worker prompt.
- Retain snapshots with their deliveries across replay, compaction, and rollback, and strip them from forked agent history.
## Testing
Add coverage for reviewer-only visibility, missing sender provenance, context-budget preservation, checkpoint replay and rollback, fork isolation, and input serialization that rejects harness metadata.
GitOrigin-RevId: 3870ba762aa81689713b56d4cb3b98566bffed88
## Why
Server-level tool exposure settings apply to every connector on the apps server. Individual connectors need a way to opt out of deferred discovery without changing exposure for other apps.
## What changed
Add `apps.<connector_id>.omit_tools_from` with support for `code_mode`, `deferred`, and `direct`. Combine connector omissions with server omissions so app settings preserve server restrictions.
For example, `omit_tools_from = ["deferred"]` makes a connector's tools available without tool search, through direct calls or Code Mode as permitted by the active tool mode and remaining restrictions.
Expose the setting in the app-server protocol, JSON schemas, and generated TypeScript and Python types.
## Testing
Add integration coverage for connector-specific exposure and MCP dispatch across tool modes, server restrictions, and direct-only namespaces. Extend config tests to cover populated, absent, and empty omission lists, and add a Code Mode request-history snapshot.
GitOrigin-RevId: cc99ab290c8a878d06d8d7ccf2d1dbd7c46bfa8a
## What changed
Add `rollout/compress` to trigger a best-effort background compression pass for cold local rollouts, even when `features.local_thread_store_compression` is disabled. The method takes no parameters and immediately returns `{}` to acknowledge scheduling, not completion. Existing worker locks, concurrency limits, and cooldowns still apply.
Require the `experimentalApi` capability and reject non-local thread stores. Document the endpoint and the requirement that clients sharing the Codex home support compressed rollout files.
## Testing
Add integration tests for compression with the startup flag disabled, lossless rollout readback, experimental capability enforcement, and rejection of non-local thread stores.
GitOrigin-RevId: be73a3b3f37f3adc54512de8256abf684d5d8112
## What changed
- Accept and ignore `features.personality` in user configuration, profiles, and managed requirements.
- Remove feature gating from `personality = "none"`, which strips the literal `# Personality` section when preparing model catalog instructions. Preserve explicit base instructions and existing thread instructions.
- Document deprecated personality fields in configuration, app-server schemas, and the Python SDK: `friendly` and `pragmatic` no longer select a style, and `supportsPersonality` is always `false`.
## Testing
Add regression coverage for ignored legacy flag values and managed requirements, personality opt-out behavior with the flag absent or set to either value, role overrides, and preservation of explicit base instructions, including empty strings.
GitOrigin-RevId: 4e12c66b42bfc59d6f151a5b3c28fadc6654ae99
## Why
Clients need widget presentation details to render MCP Apps without waiting for the full MCP catalog, including when replaying saved history.
## What changed
- Add `mcpToolCall.mcpAppUi` with the invoked descriptor's `resourceUri` and `preferredModelDisplayMode`, and carry it through tool-call events and saved history.
- Support `fullscreen` and default to `inline` when the display preference is missing or unsupported.
- Keep existing resource URI fields for compatibility. Leave `mcpAppUi` null for older history and tools that declare widgets only in result metadata, where clients still use catalog discovery.
- Update protocol schemas, TypeScript and Python types, and app-server documentation.
## Testing
Add parameterized integration coverage for fullscreen, missing and unsupported preferences, legacy URI metadata, and result-only widgets, verifying consistent tool events and preservation across session resume.
GitOrigin-RevId: 2a9bed804dcea8c2b4903b8406fa6710681f7f5e
## What changed
- Accept `fileId` alongside the existing `url` form for app-server image inputs, and forward file references to the Responses API as `file_id`. Update generated schemas and client types.
- Preserve file references, image detail hints, and mixed inline/file image ordering through user-message events, thread history, and rollout migration. Retain file images when truncating tool output.
- Pass file references through image preparation without resolving them, while keeping resize-notice numbering correct. Omit them from unsupported TUI display and Guardian image context.
- Reject image-edit requests whose recent-image window includes a file reference, preventing selection of an older inline image instead.
## Testing
Add coverage for serialization, request and rollout preservation, mixed-image history ordering, incomplete ordering metadata, tool-output truncation, and rejection of unsupported image-edit selections.
GitOrigin-RevId: 6ca20a8577155cc934b720803c3b7b3bffdf972a
## Why
`allowedWindowsSandboxImplementations` uses the legacy setup-mode type, which cannot represent `mxc`.
## What changed
- Introduce `WindowsSandboxImplementation` with `elevated`, `unelevated`, and `mxc` variants for configuration requirements, and update the generated schemas and TypeScript and Python types.
- Keep `WindowsSandboxSetupMode` limited to `elevated` and `unelevated`, and update the requirements mapping and its test assertions to use the new type.
- Document that clients selecting `mxc` skip the legacy setup and readiness APIs and use the standard `command/exec` streaming and process-control path.
GitOrigin-RevId: c926e853f0bbdb29d4b437866c284c1394a7ea13
## What changed
Represent images in `ContentItem` and `FunctionCallOutputContentItem` with `ImageReference::Inline`, flattened to preserve the existing `image_url` wire format. Update image producers and consumers and regenerate app-server schemas and SDK artifacts.
Preserve the Python SDK's `InputImageContentItem` and `InputImageFunctionCallOutputContentItem` class names during generation.
## Testing
Add a regression test for stable Python image class names and adapt existing image tests to the shared representation.
GitOrigin-RevId: c38a780ac3314c2ac2deb3afc1b93b94b6f93fec
## What changed
- Add experimental `account/read.workspaceRouting` metadata containing the selected ChatGPT workspace ID, resolved HTTPS backend origin, and routing override (`us`, `us_cr`, or `NO_CONSTRAINT`).
- Discover and cache routing through `accounts/check` for saved logins, new logins, and workspace switches. Return `null` for signed-out accounts, API-only accounts, and saved credentials without a selected workspace.
- Validate discovered origins against required `chatgpt_base_url` origins. Return errors for failed or malformed discovery and retry on later reads.
- Wait for requirements and routing before publishing account updates, including to newly initialized connections. Clear routing on logout, discard stale discovery results, and guard queued notifications against account changes.
## Testing
Add unit and integration coverage for origin resolution and validation, discovery failures and retries, startup discovery, workspace switching, logout, configuration changes during discovery, and authentication changes while notifications wait for queue capacity.
GitOrigin-RevId: 2c5367bb01dd7543b08d374f44444323e40f1981
## Why
Resuming a thread initialized its collaboration mode to Default, losing the saved Plan mode and its developer instructions. Reconnecting clients also lacked a server-reported mode to reconcile changes made by another client.
## What changed
- Restore the saved collaboration mode from the latest matching `ThreadSettingsApplied` event, falling back to the last legacy `TurnContext`. Apply the effective model and reasoning effort while retaining the saved mode and developer instructions.
- Include `collaborationMode` in `thread/resume` responses and update the generated schemas and bindings.
- Use the restored mode in the TUI, including the first prompt after resume. Prefer the server's mode when restoring disconnected input, while preserving the local selection for older servers that omit it.
## Testing
Add regression coverage for persisted and legacy collaboration modes, model and reasoning-effort overrides, the resumed Plan mode display and first prompt, and reconnect behavior with and without a server-reported mode.
GitOrigin-RevId: ed064516e7fae1c1668152ab448f510cbcacfe06
## What changed
Add experimental `thread/start.daybreakEnabled` so clients can set the initial preference for persistent threads. Omitted or null values leave it unset; explicit values are rejected for ephemeral threads.
Return the choice in the start response, `thread/started`, and reads before persistence. Stage it with the initial thread metadata and save it when the thread is persisted. Later changes still use `thread/metadata/update`. The preference does not select `turn/start.cyberAccessProgram` or grant access.
## Testing
Add coverage for true, false, and unset values in responses, notifications, reads, and reads after persistence and restart, plus rejection for ephemeral threads. Update existing metadata and access-program tests to exercise threads with an initial preference.
GitOrigin-RevId: 3bff3dc55a18436067bc2a3f156f5abf52d7321b
## Why
Configuration requirements did not report which login methods the running app server permits after applying managed policy, forced login settings, and workspace restrictions.
## What changed
- Add `allowedLoginMethods` to `configRequirements/read`, using the running authentication manager's effective policy rather than newly read authentication settings.
- Return requirements when login methods are restricted even without managed requirements, while preserving `requirements: null` for the unrestricted default.
- Update protocol schemas and generated TypeScript and Python types. An empty list permits no login method; older servers may omit the field.
## Testing
Add coverage for managed and forced login restrictions, workspace intersections, policy reporting after requirements files change, invalid login methods, and API-only Amazon Bedrock without ChatGPT requests. Extend tests for conflicting authentication requirements and cloud policy precedence.
GitOrigin-RevId: 56c0767a74143e793aac2ac165d0cbe98a09469b
## What changed
Remove `thread/rollback`, its request and response types, generated bindings, and the core `Op::ThreadRollback` operation. Requests now follow the generic unknown-method rejection path. Document `thread/revert` as the alternative for paginated threads.
Keep historical `ThreadRolledBack` markers and legacy error deserialization so existing rollouts remain compatible with replay and migration.
## Testing
Adapt retained-context and Guardian history tests to append legacy rollback markers and resume threads, preserving coverage of surviving instructions, answers, and review history.
GitOrigin-RevId: b3da1becdf86b1869275aacb0ffc2817cee5af2e
## What changed
- Accept `disabledPluginIds` in `thread/settings/update` and `turn/start`. A supplied list replaces the saved selection; omission or `null` preserves it, and `[]` clears it.
- Return the selection in thread start, resume, and fork responses and `thread/settings/updated` notifications. Update generated schemas and client types.
- Restore disabled plugin IDs from the history retained at the requested fork boundary, preserving explicit overrides.
The selection persists across resume but does not yet filter plugin capabilities.
## Testing
Add coverage for replacing, preserving, and clearing selections without inference; turn-start notifications; resume; and fork boundaries across legacy and paginated history, with loaded and restarted parents. Add a core regression test for history restoration and explicit clearing.
GitOrigin-RevId: 654a8c2a0527228d422c0dd4919228447e2663db
## What changed
Carry optional `available_access_programs` metadata through model information, presets, caches, and the TUI, and expose it as `availableAccessPrograms` in app-server `model/list` responses. Update the generated JSON schemas, TypeScript types, and Python models.
Preserve the distinction between missing metadata and an empty `cyber` list. Ignore unknown cyber program names when reading the catalog so new server programs do not prevent older clients from loading it. Discovery metadata does not grant access; inference still enforces authorization.
## Testing
Add coverage for absent, null, empty, and populated metadata, unknown program names, and app-server serialization. Extend cache tests and verify that online refreshes persist changed access metadata even when the catalog ETag stays unchanged.
GitOrigin-RevId: b3ef5805c1c61b8d64b9b896c9c0a79120143667
## Why
The trusted UI host needs the local credential's public metadata to complete backend registration. `userVerification/enroll` previously returned only `credentialId`.
## What changed
- Return `algorithm` and `publicKey` for newly created or reused credentials. The algorithm is `ecdsaP256Sha256X962`; the public key is unpadded base64url SPKI-DER.
- Keep both fields optional in the protocol for compatibility with older app-servers, while current servers populate both.
- Document caller-owned backend registration and revocation, including checking metadata, signing an enrollment challenge with `userVerification/verify`, matching credential IDs, and preserving the authenticated account throughout registration.
## Testing
Add protocol coverage for absent or null metadata and populated-response round trips. Add an RPC assertion for enrollment metadata and extend the local enrollment test to check metadata when creating and reusing a key.
GitOrigin-RevId: f0726e8c430e27559e1a01ba2ea635993cbeba09
## Why
A code-mode cell can outlive its turn. Nested tool calls dispatched during a later turn need the original step's tools and context, while approval handling must still work across that turn boundary.
## What changed
- Retain each cell's originating `StepContext` for nested tool dispatch and cancel queued calls whose context has been released.
- Keep MCP approval metadata available for the lifetime of the running invocation, keyed by server and call ID.
- Apply Guardian denial accounting and interruption to the active turn, including reviews from an earlier cell.
- Carry `turn_id` in legacy MCP begin/end events so history reconstruction and rollout migration assign late completions to their original turn. Preserve the current-turn fallback for older records without it.
## Testing
Add regression coverage for originating tool selection across turns, callback and metadata cleanup, delayed MCP elicitation review, Guardian interruption of the active turn, and late MCP completion attribution with legacy compatibility.
GitOrigin-RevId: 4533379aae6e4ecb4aabe5a25e4aca5d65385d76
## What changed
Add `serverCapabilities` to `mcpServerStatus/list` responses in both `full` and `toolsAndAuthOnly` modes, including thread-scoped reads. Return the initialized server's capabilities object, including its `extensions` map, or `null` when unavailable.
Capture capabilities during initialization so they remain available when tool discovery fails. Clear them on each new connection attempt and keep them independent of shared tool caches. Update the protocol schemas, generated TypeScript and Python types, and documentation.
## Testing
Add coverage for extension capabilities surviving tool-discovery failures in both detail modes. Extend existing tests to check advertised extensions, absent capabilities after initialization failure, and serialization of unavailable capabilities as `null`.
GitOrigin-RevId: 8e9d67c10fac3a54e82bef8be5d99caaf82597d1
## What changed
- Support `model_provider` and `model_providers` in managed requirements. Required selection overrides local and session configuration; each required provider definition replaces the corresponding local entry, including its authentication and headers.
- Merge provider requirement fragments before validation, preserving source-relative `auth.cwd` paths. Reject invalid cloud provider definitions before replacing the cached bundle, including unsupported Bedrock overrides.
- Expose `modelProvider` and `modelProviders` through the configuration requirements API and generated schemas. Reject writes to managed provider settings and omit their local origins, including for provider IDs containing dots.
## Testing
Add tests for requirement precedence, authentication fragment merging, path resolution, cloud cache preservation, and read-only configuration RPCs. Integration tests verify that model discovery and inference use the required gateway and ChatGPT authentication without leaking local headers, and that provider requirements survive configuration rebuilds.
GitOrigin-RevId: d1448604d4ef5662ebb5df7b693712d3b8ad6d54
## Why
Persisted turn-start events lack the originating root turn ID, so they cannot directly associate child turns with the root turn that initiated them.
## What changed
- Add optional `root_turn_id` to `TurnStartedEvent`. Use the inherited root turn ID when available, otherwise the turn's own ID.
- Centralize turn-start emission for regular turns, shell commands, and manual compaction so they record attribution consistently.
- Carry attribution into `ThreadHistoryTurnChange` when processing turn-start events and retain it through completion in the history builder.
- Keep older records compatible by defaulting missing attribution to `None`.
## Testing
Add coverage for root and child turn attribution, persistence when tool collisions fail a turn before sampling, history change propagation, and deserialization of older turn-start records.
GitOrigin-RevId: 54a80b828ca7d1c4c19f13d468c01d052e1b9130
## What changed
- Add `thread/attachment/add`, `thread/attachment/list`, and `thread/attachment/remove` to manage durable resource references without loading the owning thread or changing conversation history.
- Identify attachments by thread, `attachmentType`, and `identityKey`. Repeated adds return the existing attachment; repeated removals succeed without emitting another update. Listing supports cursor pagination.
- Broadcast `thread/attachment/updated` after creation or deletion, after responding to the requester. Serialize attachment mutations with thread lifecycle operations and reject stores that do not support attachments.
- Update protocol schemas, TypeScript and Python bindings, documentation, and TUI notification handling so attachment updates do not add untracked threads to the agent picker.
## Testing
Add coverage for unloaded threads, pagination, idempotent addition and removal, reattachment, invalid inputs, unsupported stores, response-before-notification ordering across clients, and TUI notification routing.
GitOrigin-RevId: 0d29cf903afd4e931a70a9cf96300475213b34aa
## What changed
- Add `disabled_plugin_ids` to thread startup options, settings overrides, snapshots, and persisted turn contexts. Omitted overrides preserve the current list; an empty list clears it.
- Restore the selection on resume and capture it before truncating history for a fork. Prefer the owning thread's latest settings snapshot, falling back only to the latest turn context so stale history cannot resurrect an older selection.
- Freeze the selection at turn admission and retain compatibility with histories that lack the new fields.
## Testing
Add coverage for owned settings, explicit clears, latest-turn fallback, and legacy snapshots. Extend settings tests to cover plugin selection during runtime restoration and compaction, and verify initial turn persistence without extra settings checkpoints in both history modes.
GitOrigin-RevId: 75ffbff5763cd93cc5ac69d73b08b237f59bc009
## What changed
Add nullable `promptHash` to the upload response, populated from the uploaded `prompt_hash` tag. It identifies the whitespace-normalized SHA-256 of the session base instructions, excludes later developer messages, and is `null` when the reported rollout has no prompt metadata.
Update the protocol schemas, precomputed exports, and generated TypeScript and Python types.
GitOrigin-RevId: 6fa70fbe7a06604ac1cd0ea363eb4f192083dad9
jamy-OAI