## Why
Guardian reviews must not lose user authorization constraints or reuse an
unreadable or incompatible parent checkpoint after compaction.
## What changed
- Retain bounded excerpts of oversized root user messages across compaction,
resume, and rollback, and recover excerpts from legacy Guardian history when
available.
- Require thread-owned Guardian review sessions and asynchronous scoring to
reuse only non-empty checkpoints produced by a compatible review model.
- Fail closed instead of reviewing without the required checkpoint when reuse
is disabled, compatibility is unknown, or checkpoint content is unusable.
## Testing
Expanded retained-context, review-session, asynchronous-scoring, and app-server
coverage for oversized instructions, legacy recovery, model incompatibility,
missing content, resume, rollback, and disabled checkpoint reuse.
GitOrigin-RevId: f30d837197e0d838e656a632109f490c38208f5e
## What changed
- Add rendered HTML alongside the original Markdown when copying a whole response through the native clipboard, so rich-text destinations preserve headings, lists, tables, code, and other formatting.
- Keep code-block, blockquote, transcript, terminal, and WSL clipboard copies as plain text.
- Escape raw HTML, omit remote image sources, and render unsupported link destinations as visible text when producing clipboard HTML.
## Testing
- Add coverage for rich formatting, local and unsafe links, inert images, fenced tables, copy selection formats, and clipboard fallbacks.
GitOrigin-RevId: c6f5edd88b65f9e9b1ddc5618442868cf47ee560
## Why
Guardian reviews need the original user instructions even when compaction or
transcript selection removes them from the active conversation window.
## What changed
- Capture complete user messages in host-owned retained context and include them
as ordered authorization evidence alongside verified answers.
- Omit oversized instructions atomically and emit an explicit incomplete-evidence
notice instead of exposing a potentially misleading partial permission.
- Mark user messages inherited by forked agents so they remain model-visible
without becoming child-local authorization.
## Testing
- Cover retained instructions across compaction, resume, rollback, and agent
forks, including oversized evidence and legacy context behavior.
GitOrigin-RevId: 97122509d818c90d2f87c6a1b29c99c05ad0316e
## Why
Guardian approval actions can contain paths from a remote executor whose path convention differs from the host, such as Windows paths reviewed on a POSIX host. Converting those paths to host-native absolute paths prevents the action from being reviewed.
## What changed
- Render command working directories using the executor's reported path convention, and preserve URI-backed paths for attribution.
- Carry foreign command and patch paths through Guardian events and app-server schemas as legacy path strings.
- Bound remote plugin attribution within the overall review deadline and reject Guardian action payloads that exceed the review byte limit.
## Testing
- Cover Windows and POSIX executor path rendering, foreign patch paths, protocol round trips, oversized payload rejection, and remote Guardian review context.
GitOrigin-RevId: 38be0fcdac897139519e74e077eb5cb4f8f8017e
## Why
Windows sandbox setup reconciles persistent deny ACLs against the paths supplied for a session. The `codex sandbox --permission-profile` path supplied an empty list, which could discard the profile's deny-read restrictions.
## What changed
Resolve deny-read paths from the selected permission profile and workspace roots before starting a Windows sandbox session, and pass them through to setup.
## Testing
Add a Windows CLI integration test that launches the same managed-deny profile twice and verifies that denied file reads and DLL loads remain blocked while allowed access still works.
GitOrigin-RevId: 6ec8b6a13a33b862d7b152eadbbdde3146de4b7d
## Why
Guardian reviews for delegated workers need the current root instructions and verified answers even after the parent context is compacted. Approvals must also become stale when that root authorization changes.
## What changed
- Build bounded root review evidence from retained context, preserving source order and answer scope while prioritizing user instructions over optional assistant context.
- Recover retained instructions from Guardian history after compaction and mark authorization incomplete when required instructions or answers are unavailable.
- Version root authorization in synchronous and reusable review sessions so an allow result is cancelled when its evidence changes.
- Strip parent-only Guardian approvals when forking worker history in retained-context mode.
## Testing
- Cover retained and legacy context modes, oversized evidence, message limits, parent compaction, and authorization changes during review.
GitOrigin-RevId: 658219b7cee08f2752adcea9966268fd21727976
## Why
Queued prompts and `request_user_input` answers can be persisted in a different
order from when the host accepted them. Using persistence order can therefore
reorder retained instructions during replay or apply the wrong rollback
boundary.
## What changed
- Reserve an acceptance sequence for user prompts and elicitation responses
when retained thread context is enabled.
- Persist that sequence with user-message metadata and verified answers, and
use it when ordering, bounding, replaying, and rolling back retained context.
- Keep events without acceptance metadata compatible with legacy recording
order.
## Testing
- Cover delayed queued-input recording, rejected prompts, checkpoint replay,
compaction, rollback migration, and legacy retained-context behavior.
GitOrigin-RevId: 42d24465cc2033bc51c0c2da79d3c0884a8ad98a
## Why
Guardian review needs the original user instructions alongside verified answers, even after compaction, resume, or rollback. A summarized or legacy checkpoint cannot establish a complete instruction history.
## What changed
- Capture text user messages in retained context when `guardian_thread_context` is enabled, preserving their message identity through compaction and replay.
- Keep retained instructions and verified answers in arrival order, with independent size and completeness tracking for each family.
- Roll back retained evidence at the exact user-message boundary, including steers that share a turn ID, and apply the same semantics during rollout migration.
- Treat checkpoints without retained user messages as incomplete while preserving their verified answers.
## Testing
- Cover capture, compaction, resume, rollback, child forks, legacy checkpoints, storage bounds, and rollout migration.
GitOrigin-RevId: 72706731b54e5ac8645db61b446d2401afb42235
## What changed
- Request and parse server-issued Guardian tickets for eligible Codex backend responses.
- Scope each ticket to the response that produced a Guardian review or classifier request, including HTTP and WebSocket retries, without adding it to model-visible or persisted context.
- Validate ticket shape, reserve its metadata keys, redact it from debug and request-body logging, and attach it only at the Guardian transport boundary.
## Testing
- Cover ticket parsing, endpoint and authentication routing, retry scoping, classifier retries, and redaction for compressed and uncompressed requests.
GitOrigin-RevId: 6219dd15c9f19ed3387de516aac1b8e7c9cdb0e3
## Why
A remote process can finish while a network policy review is still pending. Normal process cleanup should withdraw that review without turning the completed command into a review failure or losing its output.
## What changed
- Record whether a network policy request was withdrawn because the process finished, was cancelled, lost its executor connection, or timed out.
- Treat normal process completion as cleanup while retaining fail-closed behavior for other cancellation causes.
- Preserve explicit network denials before policy persistence so cleanup cannot replace the reported call outcome.
## Testing
Add an integration test that completes a remote process during a pending network review and verifies that the command reports its successful exit and output without approving the withdrawn request.
GitOrigin-RevId: 7f42d75631ee29eba43bf04cc953eea490f553fc
## What changed
- Add optional per-model Guardian modes for computer use, shell, code mode,
file changes, MCP, network, and permission requests.
- Apply disabled, synchronous, or adaptive review by action category while
preserving legacy configuration when model policy is absent.
- Bind cached risk scores to the active model policy, thread settings, and
environment selections so outdated scores cannot approve later actions.
- Keep unknown review modes on the synchronous path and ignore unknown policy
fields for forward compatibility.
## Testing
- Cover policy serialization, legacy fallback, scoped tool classification,
disabled categories, and score invalidation after policy changes.
GitOrigin-RevId: f334a5f4fffb198da66cde3a400233e0df650516
## What changed
- Add the stable, default-on `unified_exec_tty` feature.
- When disabled, omit `tty` from the `exec_command` tool schema and reject calls that explicitly request a TTY.
- Continue to support commands that omit `tty` or set it to `false`.
## Testing
- Add unified exec coverage for the disabled tool schema, explicit TTY rejection, and non-TTY command execution.
GitOrigin-RevId: c5934fe9db1423170b891c7ecd0188792cd03f42
## What changed
- Add the macOS-only `allow_symlinked_codex_home` user setting. When enabled in the execution host's `$CODEX_HOME/config.toml`, writable roots at or beneath that home may traverse symlinks.
- Keep the exception disabled by default and prevent project config, command-line overrides, and ignored user config from enabling it. Other writable roots remain subject to symlink checks.
- Propagate the resolved setting through local, interactive, and exec-server sandbox paths, including `CODEX_HOME` aliases.
- Explain the opt-out in symlink rejection errors, including that it trusts targets outside `CODEX_HOME` and targets that change between commands.
## Testing
- Add macOS coverage for shell commands, patches, filesystem helpers, process execution, and interactive startup with enabled, disabled, aliased, and out-of-scope homes.
GitOrigin-RevId: 99fcdf611200c9e1b7713cf06f7fdea5bfa7f089
## What changed
- Add the `codex-attachment-store` crate with storage-neutral attachment metadata, references, errors, and an asynchronous persistence interface.
- Provide an inline implementation that preserves attachment bytes as media-typed base64 data URLs.
- Inject the store into `ThreadManager`, expose it to consumers, and retain inline storage as the default for existing entry points.
## Testing
- Verify inline storage round-trips binary, text, PNG, and JPEG data.
- Verify attachment debug output redacts URLs while retaining file IDs.
GitOrigin-RevId: 7688dcd3c89d7540ed2398f3e7c63881fbfcda97
## What changed
- Add the hidden `gpt-6-astra` model definition, including its reasoning levels,
tool capabilities, context limits, agent instructions, and review policies.
- Reorder existing model priorities around the new catalog entry and provide the
browser-use policy to the bundled auto-review model.
- Keep TUI snapshots pinned to `gpt-5.6-sol` and make Guardian coverage read the
policy from the model selected by each test case.
- Allow the expanded `models.json` through the repository blob-size check.
GitOrigin-RevId: 039b224b91ca35c8d894cf6d23568bc6dc18ceeb
## Why
Guardian authorization reviews need host-verified `request_user_input` answers to
remain aligned with thread history across compaction, resume, and rollback.
## What changed
- Record verified question-and-answer pairs in retained thread context when
`GuardianThreadContext` is enabled, and source both local and delegated Guardian
review evidence from that context.
- Preserve complete answer records within the evidence budget. Mark authorization
context incomplete when records are unavailable or oversized, and defer cached
fast approvals in that case.
- Keep the existing runtime-only answer path for threads that do not enable the
thread-owned context.
## Testing
- Cover answer retention through compaction and resume, removal after rollback,
source-call eviction, oversized answers, delegated review evidence, and legacy
behavior.
GitOrigin-RevId: 01f6f4541515434a0d00fdde318ff59f2f8bd2eb
## What changed
- Pass the selected executor's `PathUri` through user command approval requests instead of converting the working directory to a host-native path.
- Make native-path permission helpers explicitly local and require executor-aware permission transforms to receive a `FileSystemSandboxPolicyContext`.
- Cover approved remote commands to verify that the approval request reports the selected remote working directory and execution resumes after approval.
GitOrigin-RevId: 0aa3042f2d7594af6c7d0abf31d7f99cf67d5556
## Why
When silent OAuth refresh cannot recover a rejected MCP tool call, the caller
needs the server's authentication challenge to initiate interactive login. The
rejected call must not be replayed automatically after refresh has failed.
## What changed
- Convert `401 Unauthorized` responses with `WWW-Authenticate` headers into an
MCP tool error containing `mcp/www_authenticate` metadata.
- Preserve multiple authentication challenges by combining all
`WWW-Authenticate` header values.
- Keep successful silent refresh behavior while avoiding replay when refresh
fails.
## Testing
Added coverage for successful and failed refresh, multiple authentication
headers, propagation through agent tool-call events, and no-replay behavior.
GitOrigin-RevId: c560cff6286d7ab09b1f5c6cf3618d4650cde47d
## What changed
- Honor `McpOAuthRefreshMode::Coordinated` for streamable HTTP MCP connections by letting RMCP refresh and persist credentials through the pinned credential store.
- Reread credentials while holding the refresh lock, persist refreshed tokens before retrying requests, and serialize login and logout writes with in-flight refreshes.
- Keep OAuth preparation outside MCP operation and handshake deadlines, and allow refresh persistence to finish if the initiating caller is cancelled.
## Testing
- Cover coordinated startup refresh, concurrent refreshes, `401` retries, credential mutation races, provider timeouts, and caller cancellation.
GitOrigin-RevId: 100ae788048087be23e26bb43f868b1fcebb007a
## What changed
- Set `CODEX_VERSION` to the running package version in user shell and unified
exec environments, overriding stale shell-policy or snapshot values.
- Add the reserved `codex_version` field to MCP turn metadata.
## Testing
- Cover version propagation through shell policies, shell snapshots, unified
exec, and MCP metadata.
GitOrigin-RevId: 7846c70d668176530b1f467293b749dc9ddd79a0
## Why
Patch targets can use a different path convention from the Codex host, so
host-native path conversion can misclassify writable roots and requested
permissions.
## What changed
- Evaluate patch targets as `PathUri` values with the active filesystem policy
context, including workspace roots and the executor's path convention.
- Distinguish executor-managed sandboxing from local platform sandboxing when
deciding whether a patch can be auto-approved and how to normalize additional
write permissions.
- Make full-disk and special-path policy checks honor the selected executor's
Windows or POSIX convention.
## Testing
Add coverage for Windows executor URIs, full-disk policy aliases, remote patch
permission requests, sandbox availability, and owner-provided workspace roots.
GitOrigin-RevId: 1a054ea443efd342623c67432762f85c53d20c15
## What changed
- Add the under-development `features.context_management.experimental_mode` configuration and schema.
- For eligible ChatGPT Plus, Pro, and Pro Lite sessions using the Codex backend, enable token-budget context, history notes, and the `new_context` tool when experimental context management is configured.
- Keep the feature disabled for custom providers, provider credentials, non-Codex endpoints, and temporary structured threads.
## Testing
- Cover subscription eligibility, backend restrictions, configuration resolution, token-budget guidance, and temporary-thread overrides.
GitOrigin-RevId: 19402af19c4d69e09a7cdb3687ee7d233f6a562a
## Why
Directly deserializing the flattened `RolloutLine` envelope can reject nested
decimal values, preventing affected paginated sessions from resuming.
## What changed
- Add canonical string, byte, and reverse-scanner helpers that decode rollout
records through `serde_json::Value` before decoding the flattened item.
- Route rollout readers across session discovery, history, migration, search,
thread storage, and transcript previews through those helpers.
- Remove `Deserialize` from `RolloutLine` so new readers cannot bypass the
canonical persistence decoder.
## Testing
Add coverage that resumes a paginated rollout after a token-count record with
a decimal rate-limit value and verifies that ordinal sequencing continues.
GitOrigin-RevId: 49abac1e0751c073daa5a93a840d8a483fd2d013
## Why
Exec-server process and network-policy events need stable attribution to the
launching tool call and executor without recording process payloads.
## What changed
- Add optional `ExecMetadata` to `ExecParams` and propagate the thread and tool
call IDs from unified exec.
- Emit bounded OpenTelemetry events for process start, spawn failure, sandbox
denial, and exit. Correlate them with the launch trace and registry-issued
executor identity while excluding arguments, paths, environment values,
output, and error text.
- Preserve launch attribution across long-running processes and reconnects, and
attach the same metadata to network-policy audit events.
- Keep the protocol backward compatible when metadata is omitted, and prevent
invalid trace headers from inheriting an unrelated active span.
## Testing
Add coverage for metadata serialization and propagation, lifecycle event
fields, trace relationships, reconnect behavior, spawn failures, sandbox
denials, and network-policy attribution.
GitOrigin-RevId: 7aa480a7289c73cb95e2c124c35500bb6f0d5084
## What changed
- Add the `send_message_to_user_async` control tool for concise questions and updates during ongoing work.
- Emit messages as asynchronous agent items without ending the turn, and reject empty message text.
- Expose the tool only to root agents when the model catalog explicitly opts in, independently of `request_user_input_async`.
## Testing
- Cover catalog gating for root agents and subagents.
- Verify asynchronous item emission, tool output, empty-message validation, and continued turn execution.
GitOrigin-RevId: 8c6a7988a502f3dbc9eff7000913e85f0c596550
## Why
Permission requests can originate in an environment whose path convention differs from the Codex host. Requiring the request working directory to be host-native prevents those requests from reaching interactive approval.
## What changed
- Carry the request `cwd` as a `LegacyAppPathString` through core events and the app-server protocol so the target environment's native representation is preserved.
- Convert the preserved value back to a `PathUri` when materializing permission grants.
- Regenerate the JSON and TypeScript protocol schemas for the updated `cwd` type.
## Testing
- Exercise the app-server permission request round trip with a target-native working directory across host path conventions.
- Verify remote permission requests retain their environment working directory and granted access still unblocks later execution.
GitOrigin-RevId: 97dc9707d9048883d20bab1b69c93871039f3188
## Why
A steer creates a new instruction boundary without creating a new turn ID. Retained `request_user_input` answers that share that turn ID must not all be discarded when only the later steer is rolled back.
## What changed
- Associate retained answers with their originating function call and instruction boundary.
- Keep answers whose source calls survive rollback, including through compaction, resume, and rollout migration.
- Remove answers whose source calls belong to the rolled-back instruction.
## Testing
- Cover live rollback and resume with answers before and after a steer.
- Cover rollout migration when delayed answers share a turn ID but originate from different calls.
GitOrigin-RevId: 225e7eb7b6a3ae5a5e7fa6fcb80cb7d259db90d0
## Why
Compaction replaces the model history window, but host-verified user answers may
still be needed for the rest of the owning thread.
## What changed
- Add bounded, model-invisible retained context for verified
`request_user_input` answers.
- Persist retained context in rollout events and compaction checkpoints, and
restore it when a thread resumes.
- Remove answers when their source turns are rolled back, and prevent
parent-local answers from being inherited by child forks.
## Testing
Add lifecycle coverage for deduplication and size limits, compaction and resume,
rollback, rollout migration, and child forks.
GitOrigin-RevId: c32900d3e8120a9899b71f0576683acd67a4b898
## What changed
- Replace `send_user_message_async` with `request_user_input_async`, accepting one or more questions with optional suggested answers while allowing the turn to continue.
- Attach structured question metadata to asynchronous agent messages while retaining readable fallback text, and preserve it through app-server events, thread history, and generated schemas.
- Continue enabling the new tool for model catalogs that advertise either the old or new tool name.
## Testing
- Cover tool registration, question validation, emitted items, continued turn execution, history preservation, and backwards-compatible deserialization.
GitOrigin-RevId: ffc49aebde2e854c3c50a122aa52805fec3fc6b3
## Why
Shell Snapshot V2 previously captured the login-shell environment lazily when a
command started, adding that work to the command path.
## What changed
- Start one asynchronous snapshot capture after turn hooks accept the turn, so
eligible local `exec_command` calls can reuse it without blocking the model.
- Use the turn's resolved tools, permissions, sandbox, environment, and shell
configuration, and skip prewarming for unsupported or network-managed cases.
- Cancel outstanding prewarming during shutdown. Keep failed speculative
captures retryable by real commands without consuming their retry budget.
## Testing
Added coverage for non-blocking capture and reuse, failure recovery, sandbox and
permission isolation, shutdown cancellation, hook-stopped turns, eligibility
gates, and concurrent capture retries.
GitOrigin-RevId: ff24a4f0328c06653e09d03fd0a3db1eccd65030
## What changed
- Preserve the selected app account `link_id` when building native MCP tool
approval requests.
- Add `link_id` and `link_is_implicit` to the elicitation metadata, recognizing
IDs with the reserved `implicit_link::` prefix as implicit links.
## Testing
- Extend the app link policy integration test to verify elicitation metadata
for default, explicitly selected, and implicit account links.
GitOrigin-RevId: a76731d9f5f3640318187511ccdc0dc82967a9c5
## Why
Remembering an app tool approval by connector and tool alone could reuse an
approval when the same tool was called with a different selected account.
## What changed
Include the app `link_id` in MCP tool approval keys so remembered session
approvals apply only to the account link that was approved. Calls for another
link, or calls without a link selector, request their own approval.
## Testing
Add an integration test covering calls across two link IDs and the legacy
no-selector case.
GitOrigin-RevId: 7dd88330b75de312469020d5892dfb2fa5d5fada
## Why
Git root discovery is optional metadata work, but filesystem probes can block. They should not exhaust Tokio's blocking pool, delay runtime shutdown, or prevent later turns from observing repository changes.
## What changed
- Add a shared `GitRootDiscovery` service that coalesces concurrent lookups for the same working directory and limits probes across directories.
- Run probes on detached threads, retain in-flight work across caller cancellation, and discard completed results instead of caching them.
- Use the service for turn and memory metadata enrichment, abort unused turn enrichment when its state is dropped, and limit memory metadata waits to one second.
## Testing
Add coverage for probe sharing, capacity limits, cancellation, fresh discovery, runtime shutdown, memory timeouts, and repositories restored after startup prewarming.
GitOrigin-RevId: bca46fc263e7a12a2f69146d8a0b3e7c7e0846cb
## What changed
- Add the under-development `mcp_oauth_refresh_coordination` feature and pin its selected refresh mode to each MCP connection.
- Treat the refresh mode as part of OAuth connection identity so runtime and MCP configuration refreshes reconnect when the mode changes.
- Keep legacy refresh behavior in builds where coordination is unavailable and emit a warning when coordinated mode is selected.
## Testing
- Cover connection replacement when the feature is toggled through both runtime and MCP configuration refresh paths.
GitOrigin-RevId: 89596150f0338e6ede0e712badecea4450831766
## What changed
- Add `approvalsReviewer` to the experimental `turn/settings/update` API.
- Apply reviewer changes to subsequently captured steps and new background approval requests while preserving pending approvals and future-thread defaults.
- Allow reviewer-only updates without `step_model_switching`, while continuing to enforce managed reviewer restrictions and model-required auto review.
- Use an explicit live reviewer update for MCP approvals while retaining refreshed thread defaults for clients that have not set one.
## Testing
- Cover switching between user and automatic review during a live turn, future-turn isolation, and managed-authority rejection.
GitOrigin-RevId: e1216b09c6a7972c2c9eaf4955d8d57d60604ca1
## Why
Unified exec can run commands on an OS that differs from the Codex host. Using
host path and shell semantics for approval checks can therefore miss dangerous
Windows and PowerShell commands sent to a remote executor.
## What changed
- Thread the executor platform through command parsing, executable-name
normalization, and dangerous-command classification. Legacy executors fall
back to the host platform, while unknown reported platforms use Windows rules
conservatively.
- Bound model-facing `exec_command` rejection messages and avoid echoing the
rejected command into the error.
- Keep deterministic process IDs reserved after release so rejected test
commands cannot reuse an earlier ID.
## Testing
- Add coverage that a long dangerous PowerShell command targeting a remote
Windows executor is rejected with a bounded response.
- Verify deterministic process IDs advance after release.
GitOrigin-RevId: a26b4a63ea3d6df7140032b88b3e7aec0b85b948
## What changed
- Centralize the allowlist for bundled MCP cleanup hooks and use it for both local and executor-discovered plugins, including `unified-computer-use` cleanup through `cua_repl`.
- Mark matching cleanup hooks as trusted built-ins so they run without saved hook trust and remain active when regular hooks or their per-hook state are disabled. Plugin enablement and managed-only policy still apply.
- Hide built-in cleanup hooks from hook listings and lifecycle notifications while retaining their metrics. Keep the built-in classification out of serialized protocol data.
## Testing
- Cover allowlist boundaries, trust and enablement behavior, inline and file-based hook declarations, MCP success and error responses, hook listing, lifecycle notifications, metrics, and protocol serialization.
GitOrigin-RevId: f93b7bc99f4ed9694f529def8ec383b45f31430e
## Why
When the remote Sites plugin is installed and its local bundle is available, exposing the bundled copy as well creates duplicate catalog entries and can load the wrong skills.
## What changed
- Persist an account- and backend-scoped exclusion for `sites@openai-bundled` once the remote replacement is installed and loadable.
- Apply the exclusion to plugin catalogs, search, direct reads and installs, runtime loading, hooks, and skill caches while preserving the remote plugin's server-owned enabled state.
- Restore the bundled fallback when the remote plugin is absent or its local files are unavailable, and throttle repeated availability checks for 60 seconds.
## Testing
- Added manager tests for persistence across restarts, account/backend isolation, fallback restoration, concurrent checks, and refresh throttling.
- Added app-server and agent-turn tests confirming that catalog, search, and skill loading prefer remote Sites.
GitOrigin-RevId: bc1154f79d3107910fee9fa27389a0ddb48ce6cf
## What changed
- Retain MCP invocation metadata for Node-backed REPL servers so nested
elicitations can resolve the enclosing tool call.
- Use a valid, same-server `callId` from the current turn as the Guardian
assessment target while continuing to review each nested action and connector
independently.
- Fall back to an elicitation-specific target when `callId` is missing,
malformed, unknown, from another server, or from an earlier turn.
## Testing
- Cover ordinary and strict reviews for `node_repl` and `cua_repl`, multiple
nested decisions, unrelated servers, and invalid or stale call IDs.
GitOrigin-RevId: adea4b5cff96726a540ff3b3ea902b0f5dd99299
## What changed
- Remove standalone TUI configuration tests whose defaults or parsing paths are
already covered by broader configuration tests.
- Remove a duplicate JSON-result test that invoked the same model as the
retained test.
- Remove a service-tier test whose `None` input case is already asserted by
the neighboring filtering test.
GitOrigin-RevId: ae1304e72d03a1d44a735b4e5816936e7e4e2de5
## Why
Guardian review evidence must remain available after a compacted thread is resumed or forked, while rolled-back or parent-local evidence must not grant authorization in a different context.
## What changed
- Store the bounded, model-invisible Guardian transcript alongside compacted rollout history and restore it from the newest surviving checkpoint during replay.
- Trim Guardian history at rollback boundaries, clearing it when the boundary has already been evicted.
- Preserve the checkpoint for user-initiated forks, but remove it when spawning a subagent so parent review evidence is not inherited.
- Keep the new rollout field optional for compatibility with existing compacted records and legacy readers.
## Testing
- Cover Guardian history across compaction, restart, paginated and pathless stores, user forks, rollback, bounded replay, serialization, and subagent forks.
GitOrigin-RevId: 6ab076d5e0c3aac4d6a41ebd50ba2b200c90213e
## What changed
- Resolve `link_id` from tool-call arguments when Apps metadata sets
`requires_explicit_link_id` to `true`.
- Reject the call before approval or execution when the required selector is
missing, empty, or not a string.
- Preserve catalog-provided account metadata for legacy Apps tools and leave
non-Apps MCP tools unchanged.
## Testing
- Add unit coverage for required selectors, malformed values, legacy
fallbacks, and non-Apps tools.
- Add end-to-end coverage for execution, approval prompts, and rejection when
an Apps call omits `link_id`.
GitOrigin-RevId: 667fd04102a3934d53ded020da6d1bf68a1ca3e5
## What changed
- Make `local_thread_store_compression` compress cold rollout files across shared and forked histories without a separate compression mode.
- Retire `local_thread_store_shared_compression` while continuing to accept it in strict configuration without changing compression behavior.
- Read rollout files through the compressed-rollout reader when `codex exec resume` determines the latest turn's working directory.
## Testing
- Cover compression and restoration of an archived fork chain.
- Cover cwd-based resume selection when only the compressed rollout remains.
- Cover the removed compatibility key in strict configuration.
GitOrigin-RevId: 8edebf61eccc1f79cabb8e641f8982c76f337bf1
## Why
Reports from a large thread tree can exceed the rollout attachment limit, making
the threads involved in a failed Guardian review harder to diagnose.
## What changed
- Prioritize descendants with retained failed reviews when selecting bounded
report rollouts, while always preserving the reported thread.
- Include each selected thread's available Guardian trunk rollout alongside its
conversation rollout.
- Add a thread index attachment with selected filenames, bounded omission details,
retained failure threads, and the process-wide discarded-record count.
- Link failed-review records to their reviewed turn and target item when available.
## Testing
- Cover failed-review prioritization, bounded omission metadata, discarded-record
accounting, and turn/item linkage in Guardian report records.
GitOrigin-RevId: ae7916c27a3c279e899cd5a6ead8a4b7e0cc26a1
## What changed
- Include the complete upstream `response.usage` object in
`ResponseUsageMetadata.metadata` while retaining the existing `amount` field.
- Expose the metadata through `rawResponse/completed` notifications and update
the generated JSON and TypeScript schemas.
## Testing
- Cover SSE, WebSocket, turn, and compaction completion paths.
GitOrigin-RevId: 6d79b1b4c92ac11abf43ec98f380b4868288a701
## What changed
- Verify image-generation extensions rebind permissions on every turn, preserving session grants while expiring turn-only grants.
- Cover executor skill reference reads under current filesystem permissions, including paginated reads, permission changes, and edits between pages.
- Verify oversized live executor skill prompts emit a warning without replacing previously injected prompt content.
GitOrigin-RevId: 1fc8eef409fa65db4bb1ab6a00408fe72c9e938f
## What changed
- Retain bounded, process-local records for failed Guardian reviews, including the reviewed action, decision, status, model, instructions, and reviewer history.
- Add recent records from the reported thread and its descendants to log-enabled report uploads as `auto-review-failures.jsonl`.
- Preserve the action and decision while omitting oversized reviewer context, and exclude successful, ephemeral, and capture-disabled reviews.
## Testing
- Cover denied and invalid decisions, cleaned-up ephemeral reviewers, descendant-thread selection, record count and byte limits, and oversized-context fallback.
GitOrigin-RevId: 5f12f7605041c3c84e826e6bac1cf06b1518ab24
## Why
Audio models cannot reliably encode tool-generated clips shorter than 25 ms.
## What changed
- Measure the available audio frames in base64-encoded PCM and IEEE float WAV outputs.
- Replace clips under 25 ms with explanatory text while preserving surrounding Code Mode output.
- Leave clips at or above the threshold and unrecognized audio formats unchanged.
## Testing
- Cover the duration boundary across multiple sample rates and all supported `audio()` input forms.
- Verify bounded and truncated WAV chunks, output after `yield_control()`, and end-to-end mixed text and audio output.
GitOrigin-RevId: 342b4bdbc65db4238580f9cdc372763c2576eca5
felixxia-oai