## What changed
Document the existing `?` wildcard behavior: it matches exactly one character,
including a dot, in allow and deny patterns. For example, `api?.example.com`
matches `api1.example.com`, but not `api.example.com` or `api12.example.com`.
## Testing
Add table-driven tests for both allowlist and denylist compilation, covering
single and repeated `?` wildcards, combinations with `*`, `*.`, and `**.`,
dot matching, and host and pattern normalization.
GitOrigin-RevId: dd5cd1817c6ea0b701335a38a57fbb5e8039c284
## What changed
- Add `ResolvedModelMessages` to resolve catalog text and bundled defaults while preserving explicit empty overrides and their source.
- Move base-instruction rendering, Guardian prompt composition, multi-agent role rendering, and `update_plan` guidance filtering into `codex-prompts`; migrate consumers to the shared APIs.
- Separate permission-profile resolution from prompt composition, and annotate Guardian policy and classifier instructions with content kinds.
## Testing
Add and update coverage for missing versus empty templates, literal overrides, multi-agent role composition, Guardian policy substitution and truncation, and preservation of permission path spellings and order.
GitOrigin-RevId: 52335bb7acec0f432d5c57acb2accd5f0276056e
## What changed
Add `rollout/compress` to trigger a best-effort background compression pass for cold local rollouts, even when `features.local_thread_store_compression` is disabled. The method takes no parameters and immediately returns `{}` to acknowledge scheduling, not completion. Existing worker locks, concurrency limits, and cooldowns still apply.
Require the `experimentalApi` capability and reject non-local thread stores. Document the endpoint and the requirement that clients sharing the Codex home support compressed rollout files.
## Testing
Add integration tests for compression with the startup flag disabled, lossless rollout readback, experimental capability enforcement, and rejection of non-local thread stores.
GitOrigin-RevId: be73a3b3f37f3adc54512de8256abf684d5d8112
## What changed
Add an optional `protocol_mode` to `McpServerContribution::HostedApps` and apply it when registering the server. Preserve the hosted Apps default when no override is provided.
## Testing
Add an integration test that selects MCP `2026-07-28` with the global feature disabled and completes a native user verification flow, including resuming the tool call with the verification response. Extend capability tests to confirm that the override preserves hosted Apps user verification without granting it to ordinary extension registrations.
GitOrigin-RevId: e8662c45f964c00b0bb4503bbcfd8432d7e2fa70
## Why
Executor skill discovery enabled every discovered skill, with no provider option for callers to disable selected skills.
## What changed
Add `ExecutorSkillProvider::with_disabled_skill_paths` to accept `SKILL.md` paths grouped by environment ID. Mark matching catalog entries disabled in both discovery routes so they are omitted from model context. Skills remain enabled by default, and paths configured for another environment have no effect.
## Testing
Extend catalog tests to cover default enablement, matching paths, and environment isolation across both discovery routes. Add a model-context snapshot test confirming that an active skill appears while a disabled skill is omitted.
GitOrigin-RevId: 7426eb94566db2bcf7e49a5dee28673ab743ad25
## Why
Permission shortcuts updated local permission state as soon as the server accepted the settings request, before receiving the server's settings notification.
## What changed
Use `select_permission_profile` for session-only permission shortcuts so local permissions follow the server's `ThreadSettingsUpdated` notification. Report the selection as requested while it is pending, and use the shared rejection messages. Include the full error chain when permission selection fails.
## Testing
Update shortcut tests to verify that local permissions remain unchanged until the settings notification arrives, pending state clears afterward, and `config.toml` remains unchanged. Update rejection snapshots for unsupported servers and server errors.
GitOrigin-RevId: 0ecd3d8b0698a039bf354d83b25b64b4c38fb45f
## Why
Realtime connections construct API providers directly, bypassing the residency override applied by higher-level model provider code. Configured provider headers could therefore take precedence over managed residency requirements.
## What changed
Apply the shared process-wide residency requirement in `ModelProviderInfo::to_api_provider`. With `enforce_residency = "us"`, the managed value overrides both static and environment-supplied residency headers, including for realtime WebSocket connections and WebRTC calls and sideband connections. Preserve unrelated headers and configured residency values when no managed requirement is set.
Share the residency policy with default HTTP headers, remove redundant enforcement at callers, and recover the stored policy from poisoned locks.
## Testing
Add a provider unit test for managed and unmanaged header behavior without mutating provider configuration. Add realtime integration coverage across WebSocket and WebRTC transports, managed and unmanaged residency, and static and environment-supplied headers.
GitOrigin-RevId: 98ceb456cc97f88241df5a829c72288aa5e66aec
## What changed
Capture result metadata for host-owned app calls when analytics and executed tool call metadata recording are enabled. Respect both `analytics.enabled = false` and host-disabled analytics, using the prepared call's ownership to determine eligibility.
Disable incremental WebSocket request reuse when raw result metadata or its call binding changes, so late results attached to an already-sent output are included in the next request. Continue allowing reuse when only other metadata changes or result metadata is filtered out for the endpoint.
## Testing
Extend coverage for direct and code-mode calls, analytics settings and host overrides, runtime recording changes, and prepared call ownership. Add metadata comparison and WebSocket reuse tests, and verify that raw response item notifications continue to omit result metadata.
GitOrigin-RevId: 411843fbff3749ee96fd6f0ebc591362942a4555
## What changed
Add `codex_history::CompactionCheckpoint` to keep a checkpoint and its recorded producer model hash together, with shared checks for usability and reviewer compatibility.
Replace `ConversationHistorySnapshot::latest_compaction_model_hash()` with `latest_compaction()` and use the shared abstraction in Guardian context selection, review sessions, and parent compaction reuse. Preserve selection of the latest checkpoint even when unusable, and leave missing producer metadata unknown.
## Testing
Add coverage showing that the latest checkpoint retains its own provenance even with missing or empty encrypted content, and that compatibility requires matching producer and reviewer hashes. Adapt existing history, migration, and parent compaction tests to the new API.
GitOrigin-RevId: 98e794644edf979c98fcc8294baa48ff82ea0ed0
## Why
Built-in permission selections in connected TUI threads previously applied local settings directly. Use server-confirmed settings so the TUI adopts the authoritative permissions and refreshes cached network configuration.
## What changed
- Send built-in permission selections through the existing app-server settings API, including selections after Windows sandbox setup. Allow built-in selections during a running turn.
- Block task creation and switching while permission updates are pending, restoring submitted text to the composer when necessary.
- Refresh local permissions, approval settings, runtime overrides, and network configuration when the server confirms a built-in selection.
- Submit a pending initial prompt when the selected permissions already match the current settings.
## Testing
Add regression tests for server-confirmed built-in selection during a running turn, blocked task switches, stale proxy removal, and pending prompt submission when permissions already match. Update background-task tests to wait for settings confirmation.
GitOrigin-RevId: 76e71a8c278c37c0a7ce7c0246da7d185e12ee7a
## Why
With `NonfatalClockReadErrors` enabled, a clock failure after a successful read could be suppressed if an earlier failure had already been reported in the same turn and context window. This left the model without a fresh notice that the clock was unavailable again.
## What changed
Clear `last_clock_failure` after a successful clock read so a subsequent outage produces a new notice while consecutive failures remain deduplicated.
## Testing
Add a regression test that scripts two failures, a successful read, and another failure within one turn. It verifies that the consecutive failures share one notice, recovery delivers a time reminder, and the later failure adds a new notice.
GitOrigin-RevId: f2a9c4d7b63f2e8408a47b1803b0bc4577f23f32
## Why
An omitted controller socket policy was treated as an explicit denial, preventing execution environments from supplying their own Unix socket grants.
## What changed
- Preserve omission of `dangerously_allow_all_unix_sockets` separately from `false`, and retain explicitly empty `unix_sockets` maps.
- Defer to attachment socket permissions when the controller supplies neither setting. Continue enforcing explicit restrictions, socket denials, and managed requirements.
- Resolve omitted values to `false` for ordinary execution and remote configuration, preserving the default for commands without attachment grants.
- Add debug logging for effective environment and remote execution network policies.
## Testing
Add regression coverage for omitted, explicit, finite, empty, and managed socket policies through remote launch configuration, including live policy replacement and serialization round trips. Adjust remote environment tests to tolerate child-completion ordering and box large cold-resume test futures to reduce Windows stack usage.
GitOrigin-RevId: 98a88d01cbb91aea1faaa03b3c414ef3be7af398
## What changed
Move request sending, redirect handling, and rustls fallback from `route_aware_client_pool.rs` into `route_aware_client_pool/execution.rs`, preserving existing behavior. Give the moved methods parent-module visibility and import `MAX_REDIRECTS` explicitly in the existing tests.
GitOrigin-RevId: 41be33a9250f09f562fb18a77fdb8fd9398cb49a
## What changed
Move duplicated action preparation into `codex_guardian_context::action_for_review`, shared by approval rendering and cached-evidence size checks. Preserve the existing behavior: omit top-level `tool_description` and `connector_description` metadata from MCP tool calls while keeping tool arguments intact.
## Testing
Add unit tests verifying that MCP arguments retain description fields, including nested fields, and that other action types remain unchanged.
GitOrigin-RevId: 8e890fb263556596f695177f917750377c04d43c
## What changed
Introduce `ReviewTurnResult` and `ReviewSessionResult` to carry review outcomes, session disposition, and completion or analytics data. Propagate `SessionDisposition` directly through review execution and pooling, replacing boolean reuse flags and positional tuple access while preserving existing behavior.
Update existing review-session tests to assert the named fields and explicit session dispositions.
GitOrigin-RevId: 93eea8b482cd592167956444042becc1ef5f2eb5
## Why
Network access and Unix-socket allowlists must not let commands with filesystem restrictions reach the privileged app-server RPC transport.
## What changed
- Bind Unix control sockets in a fixed, user-owned directory with mode `0700`, independent of environment settings, and expose the advertised paths as symlinks. Preserve existing parent permissions, reject unsafe parents, and serialize socket setup and publication.
- Mask the socket directory in Linux bubblewrap sandboxes after each bind that exposes it. Reject host mount aliases and nested mounts that compromise isolation.
- Deny access to the directory and outbound connections to its sockets in macOS Seatbelt policies, including when network access or Unix-socket allowlists grant broader access.
- Require bubblewrap for filesystem-restricted Linux execution. Users with `features.use_legacy_landlock` enabled must disable it for these policies.
## Testing
Add regression coverage for direct and symlink socket access, hardlink attempts, Linux host-process links and bind-mount aliases, and continued use of unrelated and sandbox-local sockets. Add transport coverage for parent permissions, concurrent restart after a stale symlink, and cleanup that preserves a replacement at the advertised path.
GitOrigin-RevId: 53372c27eea278d964f2cf68aed24323ef3b7082
## Why
Task attachment awaits server requests while the event handler cannot process scheduled frames. Prompts and chat widget replacement can also clear the terminal during loading.
## What changed
Draw a bold `Loading task…` message immediately when attaching a task, and redraw it after folder selection, trust prompts, and chat widget replacement. Schedule a frame to restore the normal view afterward.
## Testing
Extend the cold-resume test to verify that a loading message appears before server requests complete, survives widget replacement, and is replaced on the next draw.
GitOrigin-RevId: cb2e73efe38758025964aa53f52127a2b2609fca
## Why
The default resolver misses macOS supplemental resolvers and VPN split DNS, preventing Codex from reaching hosts that depend on those DNS settings.
## What changed
Use `tokio::net::lookup_host` for IPv4 and IPv6 lookups in the macOS TCP connector, including connections to upstream proxies. Preserve existing checks on resolved destination addresses and reject unsupported TXT lookups without falling back to a different resolver.
## Testing
Add macOS tests for IPv4 and IPv6 localhost resolution and connections, local-network rejection, and resolving the upstream proxy instead of the destination.
GitOrigin-RevId: 3c7fc4f8b309e26b02923d8fafd4e1f1e1f7755f
## Why
Permission profile changes reloaded configuration without the thread's session overrides, so profiles defined at thread start could be unavailable to `thread/settings/update`.
## What changed
Reload permission configuration with the thread's merged, enabled `SessionFlags` layers, the effective working directory, and the requested profile. Preserve sandbox executable paths through `ConfigManager`.
## Testing
Add regression coverage for switching away from and back to session-defined and disk-defined profiles, including top-level profile selection. Add a config manager test for merging session layers, excluding disabled layers, and retaining filesystem access to the exec wrapper directory.
GitOrigin-RevId: b0271e28a90cd55d3faf5fdf5f044d768395b0b6
## Why
History paging failures can prevent the TUI from opening a conversation that is already open elsewhere, even when its prompts and final replies are available through turn summaries.
## What changed
- When paginated read-only history loading fails, request the latest 100 turns from `thread/turns/list` with `itemsView: summary` and display them in chronological order.
- Clear history pagination state and show a notice that intermediate messages and tool activity are unavailable. Surface the notice during startup, session selection, and command center selection.
- Show a concise retry message when the command center cannot load the conversation, preserving the current conversation.
## Testing
Extend read-only history tests to cover summary recovery, the 100-turn limit and ordering, the user notice, and preservation of the current conversation when both history loading methods fail.
GitOrigin-RevId: c9f06ad58ed5573ce0b4578f429558bfd475830f
## Why
Hiding the selected task can reset selection to the current task or first row, interrupting navigation through the list.
## What changed
Select the next visible task before hiding the selected task, falling back to the previous task at the end of the list. Follow the active grouping and search filter. Preserve the existing rename cancellation behavior when hiding a rename target so its draft cannot transfer to a neighboring task.
## Testing
Add regression tests and a selection snapshot covering project, status, and model grouping, filtered and unfiltered lists, custom hide bindings, hiding all visible tasks, and hiding a task with an unsubmitted rename draft.
GitOrigin-RevId: e5ca6b2a9955622bcf60e68621322b3abd801a7f
## What changed
- Emit one read counter and duration observation per rollout reader, tagged by format, outcome, failure stage, and error kind. Distinguish EOF, partial reads, and failures, including failed opens.
- Accumulate time spent in completed open/retry and read calls, excluding caller processing and canceled calls, without exporting a metric for each JSONL record.
- Record materialization duration when decompressing a rollout for append, for both successful decompression and failures.
GitOrigin-RevId: 3d1e257863ffa696a63040172df54d8234d56ed5
## Why
A compression run can report `completed` after hitting its time budget or encountering file, scan, or cleanup errors. The run metrics do not distinguish these cases from a clean, complete pass.
## What changed
- Add `completion_reason` (`time_budget` or `scan_finished`) and `file_errors`, `scan_errors`, and `cleanup_errors` tags to completed run counts and durations, preserving `status=completed`.
- Record scan failures and additional stale-temp cleanup failures with operation stages and bounded I/O error kinds, and track recoverable errors in the run summary.
GitOrigin-RevId: bb6c33890371a2cdb02bc6ccc82a5df343b823b5
## Why
Memory usage telemetry identifies artifact kinds but does not distinguish reads from `memories` and `memories_v2`.
## What changed
Return each artifact's memory version from shell command classification and add a `memory_version` tag (`v1` or `v2`) to usage counters. Normalize Windows path separators before classifying memory paths.
## Testing
Extend regression coverage for both memory versions with Unix and PowerShell reads, and add a test for commands that read artifacts from both roots.
GitOrigin-RevId: 68eaab3af0317613e4969e8c4e5478b18255ca52
## What changed
- Extend `GuardianModelPolicy` with controls for uncategorized tools, unscored actions, the initial computer-use call allowance, and sandboxed command coverage.
- Add `GuardianPolicyLoader` in `codex-config` to translate legacy settings, preserve catalog policy precedence, and enforce reviewer requirements. Apply live model review requirements through `ConfigRequirements::constrain_guardian_policy`.
- Use the shared model policy for Guardian scoring and approval, replacing the extension-local policy wrapper while retaining legacy defaults.
## Testing
Add configuration tests for catalog precedence, legacy scope fallback, required-model constraints, and legacy computer-use opt-in and feature gating. Adapt existing extension tests to consume the shared policy.
GitOrigin-RevId: 6fed1c3a831964ad28ea7de5cb19e74e323c1204
## What changed
Emit a `codex.memory.storage_bytes` histogram after successful phase-two consolidation, including runs with no workspace changes. Sum regular-file sizes recursively from filesystem metadata, excluding `.git` entries and symbolic links. Stop the phase-two duration timer before measuring storage.
## Testing
Add coverage for both memory versions, nested files, UTF-8 byte counts, Git metadata exclusion, and Unix symbolic links, including broken links and directory loops. Extend the workspace baseline reset test to verify the remaining storage size.
GitOrigin-RevId: 9170c34d656728897790decd2e2cabb38a81836f
## Why
Reusing a Guardian reviewer could trigger a model catalog refresh during the previous-model compaction check, even when the model was unchanged and no compaction compatibility change required compaction.
## What changed
Return early from the previous-model compaction check for Guardian sessions when the model slug is unchanged and the compaction compatibility hashes do not require compaction.
## Testing
Add a regression test with an expired model catalog cache that verifies two approvals reuse the same Guardian reviewer, both reviews and the parent turn complete, and no additional model catalog request occurs.
GitOrigin-RevId: cc1cdc5f89c6f9ec03f1bedfb78cad9780825733
## Why
Model catalog decode errors can include the full response body and payload values from deserialization errors. Catalog request deadlines also report a generic timeout instead of a request timeout.
## What changed
- Report only the JSON error category, line, column, and response byte count when model catalog decoding fails.
- Return `CodexErr::RequestTimeout` when the model catalog refresh deadline expires.
## Testing
Add regression tests for invalid response shapes, large payload values, malformed and truncated JSON, and a delayed catalog response that must return `RequestTimeout`.
GitOrigin-RevId: 6fe5111a3e3b113d79942b3c213f8e94d773eb5a
## Why
Code Mode wrappers should preserve cached scores for nested actions so adaptive review can reuse them across cells.
## What changed
Remove `code_mode` from `GuardianModelPolicy` and its approval scopes. Skip scoring and cache invalidation for direct Code Mode `exec` wrappers under model policies, leaving nested tools governed by their own categories. Preserve legacy wrapper scoring behavior.
## Testing
Expand app-server coverage for score reuse across cells, synchronous nested reviews, required model policies, and legacy configurations. Retain checks that ordinary tools named `exec` or MCP tools named `wait` invalidate cached scores.
GitOrigin-RevId: 7a0692e5330f3d4b4bda988ecbe7061bc8b2318c
## What changed
Add `codex tcp-tunnel` and the `codex-tcp-tunnel` crate to forward loopback TCP connections to an explicit target through a TLS-verified HTTP/3 CONNECT proxy.
- Require the proxy origin to match an approved HTTPS origin in a supplied policy file.
- Read bearer tokens and optional bounded, non-forwarding `x-` headers from stdin. Support token updates for new connections, `LISTENING` and `AUTH_UPDATED` notifications, and shutdown when the control pipe closes in token-update mode.
- Preserve the listener across proxy reconnects without replaying TCP streams, and let accepted streams continue while a proxy drains.
## Testing
Add tests for hidden CLI parsing, proxy and target validation, credential renewal, control-pipe closure, and invalid input without secret disclosure. A local HTTP/3 proxy test covers token replacement, transport recovery without stream replay, and graceful draining.
GitOrigin-RevId: c6af3025301c61e9fe90940cf5a6df0039465e69
## Why
Probing Windows network paths can send ambient credentials, even during metadata checks. Entries in `project_doc_fallback_filenames` must be validated before filesystem probes.
## What changed
Ignore entries containing path syntax according to the executor's OS, rather than the host's. Reject `.` and `..`, slashes, and NUL characters on all executors; also reject backslashes and colons on Windows. Log a warning for rejected entries and continue considering valid filenames.
## Testing
Add tests that verify invalid entries never reach metadata probes under POSIX and Windows path conventions, preserve backslashes and colons in POSIX filenames, and confirm valid fallback instructions still load alongside invalid entries.
GitOrigin-RevId: 4369e9b97ae6a3560d09e79efd8c85adac3d1d90
## Why
Executor profile roots can use path conventions that are not native to the current host. Converting them to host paths during configuration or turn reconstruction can reject or drop those roots, while case-insensitive comparison can hide Windows path spelling changes.
## What changed
- Store profile roots as URI-backed `ProfileWorkspaceRoot` values throughout permission snapshots and thread settings, preserving spelling in equality and deduplication.
- Keep effective workspace roots as `PathUri` values for permission materialization and status summaries. Convert Windows sandbox root hints to native paths only at native Windows sandbox boundaries, rejecting incompatible roots.
- Omit the legacy rollout `workspace_roots` field when profile roots cannot be represented as host paths, retaining the compiled permission profile.
## Testing
Add regression coverage for Windows and UNC root spelling changes, settings restoration and turn recording with foreign roots, executor-root status display, and backend-specific Windows root conversion.
GitOrigin-RevId: 903c068fd74959bdd10e7cb1141aa42b953a59a4
## Why
Local daemon version warnings direct users to a shell command. Provide an update flow from the TUI with an explicit choice of package source and confirmation before exiting.
## What changed
- Add `/daemon` with options to install the latest public stable release or use the current CLI package. Point local server version notices to the menu.
- Default confirmation to Cancel and explain restart, interruption, and relaunch behavior. After confirmation, exit the TUI and run the update through the launching CLI executable, propagating failures.
- Keep maintenance available when disconnected or using the embedded server. Disable updates for remote connections or a missing CLI executable, and disable copying the CLI build when no local package is available.
## Testing
Add menu snapshots and interaction tests covering both update sources, cancellation, and unavailable actions. Add a Unix CLI handoff test verifying the selected executable, command arguments, and failure propagation.
GitOrigin-RevId: 06b485feb5650673ec7dd00adda01fedb8909393
## Why
Permission summaries must preserve executor paths without interpreting them in the host's filesystem namespace.
## What changed
Accept `PathUri` values and summarize permission profiles directly instead of converting them to a legacy sandbox policy. Render additional workspace roots using their inferred native path convention, and update the exec and TUI callers.
Keep workspace subpath writes and writes outside the working directory classified as `custom permissions` when the working directory itself is not writable.
## Testing
Add coverage for POSIX, Windows drive, and UNC workspace paths, including encoded spaces and case-distinct roots, plus opaque workspace subpath writes.
GitOrigin-RevId: ff2c456e2a720e7216f13e0241b3a935cc925d00
## What changed
Keep `shutdown_signal()` pinned across `tokio::select!` iterations and reset it only when it completes, so other events do not cancel and recreate the pending signal listener.
## Testing
Update the WebSocket drain interruption test to use gated responses and keep a second turn active until the `turn/interrupt` reply arrives, preventing shutdown from racing the reply.
GitOrigin-RevId: c939d84ed0e09c2ee49229e81a3becdfa6a4c7f1
## What changed
Use `thread/revert` to remove the selected turn and subsequent history, then restore the selected prompt in the composer. Keep the thread identity, settings, goal, and unrelated thread channels intact. Show a notice that conversation history was reverted and file changes are unchanged.
Resolve selections against persisted history, accounting for partially loaded transcripts and hidden review prompts. Reject stale selections and mid-turn steers. Refresh replay state and pagination after a revert, clear queued input and obsolete actions, and require a session reload when the revert cannot be confirmed.
## Testing
Add regression coverage for reverting earlier and first visible prompts in place, preserving unloaded history and thread state, rejecting steers in clipped history, and clearing streaming output, queued input, and stale approval actions.
GitOrigin-RevId: d3f0342539392bdbfec925d0c3d6f67369937f1b
## Why
WSLg's duplicate distro root can expose filesystem contents outside the sandbox's path masks.
## What changed
- Detect the duplicate root using filesystem identity, with mount metadata as a fallback, and hide it after applying filesystem grants and denials.
- Reject explicit grants, working directories, and executable paths that use the WSLg alias, directing users to the primary filesystem paths.
- Hide host procfs when a fresh procfs cannot be mounted so process roots cannot restore access to the masked view.
## Testing
Add regression tests for duplicate-root detection, mask ordering, existing ancestor masks, alias rejection, and unrestricted filesystem behavior. Add a WSLg runtime test covering masking with and without fresh procfs, continued access to an allowed file, and rejection of an executable using the alias.
GitOrigin-RevId: 9ea31724c00fb24e3a504b6658339e8dfea35343
## Why
Users need to change the active session's model and reasoning effort without replacing saved defaults for future threads.
## What changed
- Add an `s` shortcut to final model and reasoning choices, with footer hints and a session-only confirmation.
- Apply the selection to the active thread while preserving saved configuration, including separate Plan mode defaults.
- Restore Plan mode reasoning effort with thread input state and suppress the shortcut when it conflicts with configured list bindings.
## Testing
Add coverage for picker shortcuts, active-thread updates, unchanged configuration and fresh-thread defaults, Plan mode restoration, and shortcut conflicts. Update picker snapshots to show the new hints.
GitOrigin-RevId: 07fd129021cc076e3a9bdee04b71979212788eb4
## Why
The TUI's Windows sandbox turn-context override was ignored by `thread/settings/update`, and onboarding derived sandbox state from local configuration instead of the app server's effective configuration.
## What changed
- Read Windows sandbox configuration from the app server before showing the onboarding sandbox creation hint. Show the hint only when the read succeeds and the sandbox is disabled.
- Remove `windows_sandbox_level` from `AppCommand::OverrideTurnContext` and stop sending sandbox-only overrides after setup or feature changes.
- Rely on the effective configuration refresh after setup instead of updating local sandbox flags manually.
## Testing
Update the trust-directory rendering test and snapshot to cover the sandbox creation hint.
GitOrigin-RevId: 2ee6b0634812e7b39fd73dab3ae344729910ba70
## Why
Clock provider failures can abort a turn while preparing time context or running clock tools. Allow turns to continue with an explicit indication that the current time is unavailable.
## What changed
- Add `features.nonfatal_clock_read_errors`, disabled by default, to report clock failures to the model without failing the turn.
- Emit a generic `failed to read current time` notice for context reads and tool errors, without exposing provider error details. Deduplicate context notices per turn and compaction window, and remove inherited notices from forked subagent context.
- Omit unavailable environment dates and explicitly clear previously visible dates with `<current_date status="unavailable" />`.
- Return external sleep clock failures to the model when the feature is enabled, preserving sleep item completion notifications.
## Testing
Add coverage for continued inference after clock failures, notice deduplication across compaction, subagent notice filtering, environment date removal and recovery, and sleep failures during initial and polling reads.
GitOrigin-RevId: a39c3723c06a6f786d8ad59d667e8b9f626c973e
## Why
A release can succeed with the optional `provisioned-macos-candidate` job
skipped. R2 publishing needs explicit status conditions to avoid inheriting
GitHub Actions' default skip behavior from upstream jobs.
## What changed
Add `!cancelled()` and explicit dependency success checks to both R2 jobs in
`.github/workflows/rust-release.yml`. Asset publishing requires `release` to
succeed; finalization also requires `publish-dotslash` and `publish-r2-assets`
to succeed.
GitOrigin-RevId: dbb975b79592df26d128ebf5ea770d92555d431d
## Why
HTTP callers currently cannot bound response bodies. Callers accepting provider-controlled model catalogs need a size limit before decoding the response.
## What changed
- Add per-request `response_body_limit_bytes` for buffered, streaming, and error responses, leaving requests unbounded by default. Reject oversized declared lengths early and count observed bytes across chunks.
- Return a non-retryable `ResponseTooLarge` error that reports only the byte limit. Preserve HTTP status and headers when a bounded error body fails to read without exceeding the limit.
- Expose `ModelsClient::list_models_raw` to fetch bytes and an optional ETag using provider authentication and retries, with an optional body limit. Keep existing `list_models` decoding behavior.
## Testing
Add HTTP fixture tests covering size boundaries, chunked and missing-length responses, early rejection, stream termination, interrupted bodies, error text decoding, and request isolation. Add a models-client test verifying that limits survive authentication retries without affecting subsequent ordinary requests.
GitOrigin-RevId: 61b8940bc8a549588cee6865a3b5d1cff789074d
## Why
Windows sandbox setup and permission choices need to reflect the connected app server's requirements and the active thread's executors.
## What changed
- Refresh sandbox configuration and requirements for the current working directory when threads or directories change, before setup, and after setup completes.
- Use the thread's observed environments to determine whether sandbox setup is local, remote, mixed, or unknown.
- Defer initial prompt submission while requirements load and preserve the draft if loading fails or required setup is unavailable.
- Hide sandbox setup choices and elevation commands that requirements or executor selection disallow.
## Testing
Add coverage for observed thread hosts, app-server configuration reads, draft preservation and recovery after read failures, deferred initial prompts, and non-admin-only setup choices.
GitOrigin-RevId: d85ac66d18951b752e71d1a6bf25404eeedcad02
## Why
Daemon recovery reloads threads but leaves interrupted work unfinished. Resume eligible work automatically from the saved conversation, even without a connected client.
## What changed
- Attempt one new continuation turn immediately after restoration, including in Plan mode. Mark the old turn interrupted and supply recovery context without creating a user message or granting new authorization.
- Require an idle thread, matching permissions, and the same single local environment configured by the thread. Skip completed, aborted, or superseded work and snapshots without environment identity.
- Add `continue_turn_if_idle` with an atomic previous-turn check so newer tasks or standalone settings changes invalidate pending continuation.
- Preserve the output schema, service tier, and root turn ID, and emit a “Resuming interrupted work” warning when continuation starts.
## Testing
Add daemon restart coverage for continuation without a client, Plan mode, permission and environment mismatches, and legacy snapshots. Add core coverage for preserved continuation metadata, absence of user-message events, rejection of superseded continuations, and exclusion of remote execution from recovery snapshots.
GitOrigin-RevId: 2b290b75d9399fc58258bcda2e85c74e9b5b3b09
## What changed
Add `codex-mermaid`, a standalone crate that renders supported subsets of flowchart, sequence, state, class, and ER diagrams as Unicode text. Expose `render` for plain text and `render_spans` for semantic node, edge, and text spans that callers can style.
Enforce source, diagram, canvas, and display-width limits. Return errors for unsupported input or exceeded limits without producing partial diagrams, leaving source fallback to callers. Include documentation and a stdin rendering example.
## Testing
Add snapshots for each diagram family, checks for relationship endpoints, Unicode labels, semantic spans, truncated input, and size limits, plus edge reconstruction for all 512 directed three-node graphs in all four layout directions.
GitOrigin-RevId: 5b4e65d9152abce5d833e4e6b12113a5a21f700e
## What changed
- Add `WindowsSandboxConfig` helpers to read app-server configuration and managed requirements, preserve legacy feature flag fallbacks, and select an allowed setup mode with elevated mode preferred when the configured mode is disallowed.
- Store the sandbox host classification in thread session state using reported environments across start, resume, fork, and replay paths. Classify missing or empty environments as `Unknown`, and distinguish local, remote, and mixed selections.
## Testing
Add coverage for managed setup restrictions, legacy configuration precedence, unknown policy state, environment classification, and remote host state in inactive-thread replay.
GitOrigin-RevId: ae8920d9c2a1c80b641ac90617ae607b171bd55a
## What changed
- Add an optional `WorkspaceRoutingResolver` to `AuthManager` and pass session configuration into routing lookups. Callers without a resolver retain existing routing behavior.
- Apply resolved backend origins and account routing overrides to eligible ChatGPT Responses HTTP requests and WebSocket handshakes. Preserve endpoint paths, validate routing values, and reject HTTP redirects for routed requests, including `NO_CONSTRAINT` routes.
- Key cached WebSocket connections by destination, routing header, and auth revision. Rebuild request setup after credential refreshes and reject account changes during setup or routing discovery.
- Serialize routing lookups per session and retain whether the session has previously been routed.
## Testing
Add tests for path preservation, provider exclusions, concurrent routing lookups, unavailable resolvers, workspace mismatches, redirect rejection, and credential refresh or account changes during request setup.
GitOrigin-RevId: 2b6609019e84a315745c94858955f3f16426fe7f
## Why
WSL interop can block while launching the Windows terminal probe, stalling TUI startup. Inconclusive detection can also enable keyboard enhancements that break dead-key composition in VS Code on WSL.
## What changed
- Give the Windows `TERM_PROGRAM` probe a one-second deadline, with launch and cleanup handled on a worker thread. Cache the result, including timeouts, and kill and reap probes that outlive the deadline once launch returns.
- Distinguish VS Code, other terminals, and unknown detection results. Disable keyboard enhancements on WSL for VS Code or unknown results, while preserving the `CODEX_TUI_DISABLE_KEYBOARD_ENHANCEMENT` override.
## Testing
Add regression tests for probe output and exit status, failed launches, timeouts during launch and execution, and child cleanup. Extend detection and override tests to cover unknown results.
GitOrigin-RevId: 39e980b0d7cf3d6716ee61597d6002b0fd59651e
## What changed
- Accept and ignore `features.personality` in user configuration, profiles, and managed requirements.
- Remove feature gating from `personality = "none"`, which strips the literal `# Personality` section when preparing model catalog instructions. Preserve explicit base instructions and existing thread instructions.
- Document deprecated personality fields in configuration, app-server schemas, and the Python SDK: `friendly` and `pragmatic` no longer select a style, and `supportsPersonality` is always `false`.
## Testing
Add regression coverage for ignored legacy flag values and managed requirements, personality opt-out behavior with the flag absent or set to either value, role overrides, and preservation of explicit base instructions, including empty strings.
GitOrigin-RevId: 4e12c66b42bfc59d6f151a5b3c28fadc6654ae99
## Why
Managed daemon recovery snapshots previously saved only loaded thread IDs, without identifying active turns or preserving their turn-specific options.
## What changed
- Capture regular, uncanceled turns after their input is recorded, saving the turn ID, output schema, service tier, and cyber access program alongside persisted thread IDs.
- Store interruption metadata atomically in the existing candidate array format so older servers can still read thread candidates.
- Begin snapshotting once admitted operations drain, while turns may still be running. Run snapshot collection and thread listener attachment independently of the event loop to keep forced shutdown responsive.
## Testing
Add coverage for running, completed, canceled, and compacting turns; recovery readiness for automatic and user turns; admitted resumes during shutdown; forced shutdown with a blocked rollout writer and child listener attachment; and legacy candidate-array compatibility.
GitOrigin-RevId: ed46342c3a5c71b09c48fa9acece2f15ae748e2f
