## Why
Code Mode sessions always used client-side output handling, leaving server truncation settings and observation budgets unused.
## What changed
- Honor each session's `output_truncation` setting in the runtime and both host transports, and advertise the bounded-output capability.
- Apply `max_output_tokens` independently to execute, wait, and terminate responses in server mode. Keep client mode as the default when the setting is omitted.
- Use bounded output collection and rendering in server mode, preserving head and tail output with omission notices. Include script errors in the output budget while retaining failure status and a separate diagnostic capped at 64 KiB.
- Estimate audio tokens without the Tokio-dependent cache when rendering bounded output.
## Testing
Add runtime and host regression tests for session mode selection, per-request budgets, output overflow, oversized images, zero-token audio output, diagnostic preservation, and termination under output backpressure.
GitOrigin-RevId: 3d9661edcdd2dde31526bb92eb83fa0614f0fa88
## Why
Bounding collected output also requires limiting the raw event backlog between
V8 and the cell actor. Previously, runtime events and cell output accumulated
in an unbounded channel and vector.
## What changed
- Select the event transport and `OutputCollector` from the cell's
`output_truncation` mode. Server mode uses an ordered, bounded channel with
backpressure; client mode retains untruncated output.
- Transfer the collector with each observation and restore it on failed
delivery, preserving retained media and omission metadata.
- Include server-mode script errors in the observation's output budget. Build
completion output only after completion wins against termination, so a
rejected error cannot evict output returned by termination.
- Keep the public service on client-side truncation.
## Testing
Add regression coverage for channel backpressure, event ordering, receiver
closure, failed observation delivery, termination during completion commit,
and oversized errors across UTF-8 and omission boundaries.
GitOrigin-RevId: 7604b60416e33c636ca41138be65dc0fd452774a
## What changed
- Replace Rust `1.99.1` pins with `1.95.0` across Cargo, Bazel, CI, release workflows, and Windows setup, and update the Bazel lockfile.
- Adjust Rust APIs, borrowing, and lint-related code for the pinned toolchain, and box MCP tool dispatch to bound compiler async-layout query depth.
- Update the halfwidth sound mark snapshot and allow optional symbol hash suffixes in the code mode host package smoke test.
GitOrigin-RevId: 75460c3d0465dc601811e619bce373a4f7ff2912
## What changed
Remove unused pending initial-yield state and its plumbing from cell completion handling. Route completion delivery through `send_cell_event`, retaining the completion event and original timestamp when an observer has disconnected.
## Testing
Extend `failed_completion_delivery_rebuffers_the_event` to verify that failed delivery attempts preserve output and report the full elapsed buffering duration on a later successful observation.
GitOrigin-RevId: eebe990a4f8258f1ccb12d0694945678f0cc3a8f
## What changed
- Update Cargo and Bazel toolchain pins, CI and release workflows, and Windows setup from Rust `1.95.0` to `1.99.1`.
- Adapt Rust code to updated APIs and lint requirements, including `try_update` and `as_chunks`, and refresh the halfwidth sound marks snapshot.
- Update `webpki-root-certs` from `1.0.5` to `1.0.10` in the Cargo and Bazel lockfiles.
GitOrigin-RevId: e1aaed63b7e72bb8c8bbe25b32c6329c9a37b6c3
## What changed
- Add `CodeModeCellTiming` notifications for yielded executions, terminal waits, and unavailable cells, with thread, call, and cell identifiers.
- Measure how long completed results remain buffered before retrieval and carry `result_buffered_for` through the runtime, stdio protocol, and gRPC response metadata. Immediate delivery reports zero; waits without a completed result report no buffering measurement.
- Default missing buffering data to zero for compatibility with older hosts.
## Testing
Extend runtime tests to verify buffering duration with a paused clock and retrieval through termination. Add gRPC conversion tests for nanosecond precision, optional metadata, and the distinction between immediate delivery and no completed result.
GitOrigin-RevId: 60c0c5a3affa69ac3779bf1812fca50f5748af76
## What changed
Add an optional `preempt` signal to `CodeModeSession::execute` and `CodeModeSession::wait` so callers can end an observation early while the cell continues running and remains available for later waits.
Support the signal in the in-process runtime and across both remote transports: `operation/yield` with the negotiated `yield-observation` capability for stdio, and `YieldObservation` for gRPC. Preserve signals received before gRPC observation registration, and retain normal timeout behavior for older hosts that lack support.
## Testing
Add runtime and transport tests covering early execute and wait yields followed by successful cell completion, yields before observation registration, and suppression of yield frames for older stdio hosts.
GitOrigin-RevId: 3f8049d8f0582be6b8f0832cc03f2d974a0b8f18
## Why
Creating a cell deep-copies every stored JSON value, including values the cell never loads. Storing a value also duplicates its payload between the cell's local state and pending writes.
## What changed
Use `Arc<JsonValue>` throughout the session store, cell runtime, and completion writes to share immutable payloads. Keep a separate map snapshot for each cell so later commits cannot change its view of stored values.
GitOrigin-RevId: 4535f0f2ed0c8f8cbfb8d24cf1cb44cbc74472b5
## Why
A delegate bound at session creation cannot provide different callbacks for cells sharing that session. Each execution needs to retain its own delegate across yields and release it when the cell is cleaned up.
## What changed
- Pass `CodeModeSessionDelegate` to `execute` instead of session creation.
- Route tool calls, notifications, and cell closure callbacks through the execution's delegate in the in-process runtime and the gRPC and stdio transports.
- Retain delegates with pending executions and live cells, releasing them through closure and cancellation cleanup.
## Testing
Add coverage for distinct delegates across yielded cells, gRPC callbacks before cell admission, and delegate release after completion or abandoned execution cleanup. Update transport tests to verify callbacks reach the owning cell's delegate.
GitOrigin-RevId: 7469f52104b993e790a40c65fb800ad02b7fd606
## Why
Code-mode callbacks can outlive their initial request and run in separate tasks,
so their trace context must be preserved explicitly.
## What changed
- Preserve the execution context for code-mode callbacks and add spans for
nested tool invocations in the runtime and dispatch broker.
- Propagate each tool invocation span as the parent of its streamed gRPC
callback, falling back to the outer execution context when needed.
- Add a `codex.exec_server.process` span for each process lifetime, including
its process ID and completion result, without retaining the request span.
GitOrigin-RevId: a6059e34d895416f5517e51dad6ca0078355adca
## What changed
- Move the V8 implementation into a dedicated `codex-code-mode-runtime` crate used by `codex-code-mode-host`, removing the embedded runtime fallback from the Codex process.
- Resolve the host executable from the active installation layout and check its availability before selecting tools.
- Fall back to direct tools with a one-time warning when optional code mode is unavailable. Keep `code_mode_only` and `disable_in_process_fallback` configurations fail-closed.
## Testing
- Cover host discovery for standalone and package layouts, including missing hosts and symlinks.
- Verify direct-tool fallback, one-time warnings, and fail-closed code-mode-only behavior.
GitOrigin-RevId: 5aa3c6f1db148b2231fc24089a2ee0e2b00dbddb
Sean Huang