## Why
Security reminder requests need to use app-server's active authentication and HTTP runtime, with results bound to the login that fetched them.
## What changed
- Add `account/securitySetup/read`, returning an optional notice with account and user IDs, plus generated protocol schemas and bindings.
- Fetch reminders in app-server only for a matching saved ChatGPT login. Return `notice: null` for ineligible, unavailable, or timed-out reads, and discard results when the login changes during the request.
- Route TUI reminder reads through the new method while retaining notice validation and identity checks. Unsupported servers produce no reminder.
## Testing
Add coverage for shared runtime use across restarts, ineligible authentication modes, and login changes during a fetch. Update TUI coverage for unavailable, unsupported, and mismatched notices.
GitOrigin-RevId: 426fee7ce98df17970957c06876881bc5b005196
## What changed
Make `ModelRequestContributor::budget_exhausted` return an `ExtensionFuture` and await budget checks before HTTP and WebSocket generation. WebSocket warmup continues to skip budget checks.
If the account changes during the post-connect budget check, rebuild the request setup and reconnect before sending the WebSocket request.
## Testing
Update tests to cover a pending budget check that resolves to exhaustion, warmup connection reuse, and an account switch while the post-connect budget check is awaiting completion.
GitOrigin-RevId: 462c74b86a46a4b2276f901c69187fc7cbc3ff81
## What changed
Make `AgentServiceTier` reads asynchronous and have updates return a receipt for local acceptance. Await acceptance during root startup and settings updates outside state and registry locks, sharing the receipt with explicit same-tier retries.
Await shared-tier reads during child preparation, startup prewarm, and step capture. Allow cancellation while capturing a step, and keep host propagation independent of the acceptance wait.
## Testing
Extend the host-child WebSocket test to cover delayed acceptance, same-tier retries without duplicate updates, accessible settings while acceptance is pending, and tier inheritance during prewarm and subsequent steps.
GitOrigin-RevId: 0e2e1899834c37684e904c4a36e66344a0c6c7f3
## Why
Remote-control enrollment, refresh, and client-management requests used ChatGPT bearer authentication without resolving the configured runtime authentication mode.
## What changed
Pass the app server's runtime auth slot and mode into remote control, and resolve authentication and HTTP client policy for each request. Supported OpenAI destinations use fresh runtime assertions in `dual_header` or `assertion_only` mode, while custom destinations retain bearer authentication.
Wait for runtime authentication to initialize and reject unsupported OpenAI origins or mismatched registered accounts. Pairing continues to use its server token.
## Testing
Add transport and app-server integration coverage for both runtime auth modes, fresh assertions, shared runtime registration, network policy enforcement, account validation, redirect credential handling, and pairing token preservation.
GitOrigin-RevId: 5401cf565630ab84eaba71ff6040ac27f7b92461
## Why
An inherited turn can suppress a fork's configured developer instructions, leaving the first side-chat request without its developer policy.
## What changed
- Move shared side-conversation instructions and the history boundary into `codex-context-fragments`.
- Inject the developer policy before the user-role boundary when creating a TUI side-chat fork, while retaining the configured instructions.
- Distinguish attached and temporary policies, applying the worktree restriction only to temporary side chats.
- Add guidance to set up recurring monitors in the main chat or a new chat because temporary side chats cannot run scheduled updates.
## Testing
Add a TUI integration test that checks the first side-chat model request contains the policy and boundary. Add a core request-history snapshot covering an attached side chat that preserves inherited context, policy, and its prior answer after resuming from disk.
GitOrigin-RevId: 889cb317dc3327457cd9ef0879ec9f77dbfaeeba
## Why
Guardian Decisions requests used bearer keys directly, bypassing runtime authentication. Memory startup quota checks used the app-level auth manager instead of the thread's provider auth context.
## What changed
- Bind Decisions credentials to runtime authentication and use route-aware HTTP clients with sensitive header protection. Preserve workload identity credentials, reuse the saved-login runtime binding, and isolate explicit API key bindings.
- Select the staging Decisions endpoint when the ChatGPT environment is staging.
- Use the thread's `ProviderAuthContext` for memory startup and quota checks, preserving account-bound network policy and applying runtime authentication.
- Keep custom destinations independent of runtime assertions.
## Testing
Add regression tests for dual-header and assertion-only authentication, fresh Decisions assertions, saved versus explicit credential isolation, workload identity, staging routing, redirect header protection, and memory quota authentication with custom destinations.
GitOrigin-RevId: 27bc7821a1cad1f5d1d2a71680527ea91ace95db
## Why
Cloud messages previously accepted only plain text, and switching a draft to Cloud waited for session preparation without processing composer input.
## What changed
- Support ordered text and image parts in Cloud submissions and user-message summaries, preserving attachment placeholders, image detail, and client message IDs.
- Accept inline data URLs and uploaded file IDs, including image-only messages. Reject invalid references and text spans locally, and cap encoded image requests at 3.75 MiB while retaining the existing plain-text limit.
- Keep the composer editable and redraw the TUI while Cloud prepares a conversation. Carry the latest draft, attachments, and Vim mode into the destination, retain drafts on failure, and prevent submission to the outgoing session during the handoff.
- Preserve buffered paste input and pending clipboard reads across the handoff, with connection and failure hints.
## Testing
Add regression coverage for image wire encoding, receipt identity, validation and size boundaries, draft editing during successful and failed handoffs, clipboard completion, Vim state, and attachment recovery after rejected submissions.
GitOrigin-RevId: 0cbcde0ab89ba961780b5f88456057e6b6a19cd5
## Why
An open WebSocket can remain usable after its runtime is paused. Runtime-authenticated requests need a fresh handshake to revalidate access before submitting more work.
## What changed
- Reconnect before each runtime-authenticated Responses request and skip speculative preconnection. Preserve turn routing when the runtime identity is unchanged.
- Open a fresh connection for each runtime-authenticated Guardian classification instead of prewarming or reusing pooled sockets.
- Preserve HTTP fallback for unsupported upgrades and connection failures, while propagating authentication, authorization, rate-limit, and policy errors.
## Testing
Add regression coverage for pause and unpause behavior, credential changes, fresh assertions, and Guardian HTTP and WebSocket transports in both runtime authentication modes.
GitOrigin-RevId: 9f650147260da5cbbf5bb23dfff0af095fff3955
## Why
Child startup can lose remote model capabilities such as `tool_search` when the selected catalog is uninitialized or disk data is older than the parent's in-memory snapshot.
## What changed
- Initialize the final provider, auth, and originator catalog before resolving a child's startup model, then read it from memory.
- Preserve loaded catalogs, including empty responses and updates that failed to persist, without overwriting concurrent refreshes.
- Reuse catalogs across retry and WebSocket transport overrides while retaining routing and header distinctions.
## Testing
Add regression coverage for child tool search with warm, cold, and disabled caches; failed cache writes; concurrent refreshes; empty catalogs; and Guardian reviewer catalog reuse.
GitOrigin-RevId: 01d995a65b623cc7d6f26e2dc9b6e8cf380de782
## What changed
Raise the per-entry limit for plugin `interface.defaultPrompt` from 128 to 512 characters, retaining the maximum of three prompts. Update the protocol documentation and generated schemas and bindings to reflect the new limit.
## Testing
Update manifest coverage to accept a 512-character Unicode prompt and reject an over-limit prompt. Adjust the discovery warning test to use a 513-character prompt.
GitOrigin-RevId: 0ba3ceb253edf22a583f774492934b7c9b5ac231
## Why
Stale saved grants or malformed rules can cause valid network denials to be discarded. A failed rule write can also leave the in-memory policy inconsistent with native enforcement.
## What changed
- Add a helper to derive MCP network policy from controller and environment policies, permission profiles, approval settings, and saved rules. Preserve managed restrictions and conservatively deny traffic that requires review, request hooks, or DNS checks the metadata cannot express.
- Retain valid saved denials when grants violate managed constraints or a rule batch is malformed.
- Serialize runtime updates and persistence, publishing denials before the write so they remain effective if saving fails. Publish saved grants after a successful write.
- Extract validation of listener settings for running proxy updates.
## Testing
Add coverage for policy composition, mixed-executor local binding, native proxy denial parity, stale grants, malformed denials, failed persistence, and compatibility with trusted MCP servers without policy negotiation support.
GitOrigin-RevId: ef00632acb48a51fc582f18d20a3e713f953a191
Add `WindowsSandboxFilesystemOverrides::resolve` to select the elevated or
restricted-token resolver, and use it in core, exec-server, and direct-spawn
sandbox preparation. Pass the child environment through to the elevated
resolver.
Replace the exported unsupported-sandbox reason helper with a test-local
wrapper around the shared resolver.
GitOrigin-RevId: f1d404356a4f680ce81123bc8284508f27d4d6ab
## What changed
Keep untrusted project configuration and MCP servers disabled in exec runs, even with `--sandbox workspace-write`, and warn when project configuration is disabled.
Add `--trust` to `codex exec` and `codex review` to save project trust for the current and future chats, including MCP commands outside the sandbox. The grant persists with `--ephemeral`, refuses explicitly untrusted projects, and cannot be combined with `--ignore-user-config`.
Pass the working directory as a configuration default so embedded server startup does not implicitly grant trust. Preserve the selected `--oss` provider across configuration reloads.
## Testing
Extend CLI parsing and MCP integration coverage for explicit trust, persistence across ephemeral runs, disabled project configuration with write access, and rejection of conflicting or explicitly untrusted settings.
GitOrigin-RevId: b57f4f8829f98d77c5487fa8405c7f29b5d70d0c
## What changed
Gate `incremental_tools_legacy` on the `amazon-bedrock` and
`amazon-bedrock-runtime` provider IDs instead of the OpenAI provider for regular
Responses requests. Responses Lite continues to use `incremental_tools`.
## Testing
Expand the tool catalog update scenarios to cover both Bedrock provider IDs with
legacy incremental tools enabled and disabled. Update the regular Responses tool
removal scenario to use the Bedrock provider.
GitOrigin-RevId: ad0ff31975166a2a7fdcee6fefc272ecc79dd448
## Why
Regular chats start MCP servers eagerly even when cached tool definitions are available and the servers go unused. Allow those chats to use the cached catalog and defer eligible stdio servers until first use.
## What changed
- Add the disabled-by-default `mcp_lazy_stdio_startup` feature and expose it through experimental feature configuration.
- Defer cached stdio servers in regular chats when enabled, while keeping servers that require a live startup connection eager. Required servers with `startup_readiness = "catalog"` may defer; explicit reconnects remain eager.
- Announce the full eager startup batch before terminal statuses and exclude dormant servers from the initial startup summary. Update TUI tracking so deferred servers can report startup independently in later rounds.
## Testing
Add scenario coverage for a cached server staying dormant during unrelated work, starting on first use, and refreshing tool definitions and visibility. Cover required live startup, eager event ordering, experimental feature configuration, and TUI status handling.
GitOrigin-RevId: 74075fcd4f26c8c79b5901b6a8cb03fdb9e35a7f
## Why
A cached MCP tool can remain advertised after its server fails to start. Calling it previously returned a generic unavailable-tool error, hiding the startup failure from the model.
## What changed
Propagate preparation errors through MCP tool calls and recorded approval preparation, preserving the error chain and adding the server name to startup failures. Keep the unavailable-tool error for tools that are missing, filtered, or no longer visible to the model.
## Testing
Update the executor capability downgrade test to require the credential resolution startup error in the model's tool output and assert that the host token is absent.
GitOrigin-RevId: 434074eb748165b2fe19de3a40046835f26992df
## Why
Subagents reusing cached MCP tool definitions were forced to use the legacy protocol, preventing connection sharing from being negotiated on first use.
## What changed
Keep stdio protocol discovery enabled during deferred startup while allowing dormant subagents to advertise cached legacy tools. Track modern discovery separately from catalog updates so discovery clients reject older legacy catalogs while legacy clients can still reuse them. Keep modern tools out of the legacy catalog when joining pooled connections.
## Testing
Add coverage for deferred subagents negotiating sharing on first use and reusing the same server process, while a legacy sibling retains cached definitions without starting its server. Extend cache coverage to ensure older legacy fetches cannot undo modern discovery.
GitOrigin-RevId: 5f8f4deb22cfb81a08c05ff3fcd7ba5c9199551c
## Why
Git-attribution settings requests need to honor runtime authentication for their destination. Repeated authorization failures after a credential refresh must also let world-state contribution finish.
## What changed
- Use the thread's `ProviderAuthContext` credentials and runtime authentication when available.
- Bind the settings client's network policy to the authenticated account and select authentication through the runtime-aware backend client.
- Stop policy resolution after an unsuccessful settings lookup or timeout instead of restarting it when credentials changed during recovery.
## Testing
Add app-server coverage for `dual_header` and `assertion_only` authentication with default and custom destinations, including attribution instructions in model input. Add a regression test verifying that repeated `401` responses trigger only one credential refresh and omit attribution instructions.
GitOrigin-RevId: 4824bde7d9ec11c241f1caebc754d203dbb0480c
## Why
Command arguments and environment variables can contain credentials. Logging them when spawning a child process can expose those credentials in trace output.
## What changed
Replace argument, `arg0`, and environment contents in `spawn_child_async` trace logs with argument and environment counts and a flag indicating whether `arg0` is overridden. Keep the program, working directory, network sandbox policy, and stdio policy in the trace.
## Testing
Add a regression test that captures trace output and verifies that argument, `arg0`, and environment canaries are omitted while the program path remains visible.
GitOrigin-RevId: c317e7dcc6fd8b4eafb6fcfe98dc8634807c813d
## Why
Extension status content was limited to one row, clipping multiline text and content that wraps at narrow terminal widths.
## What changed
Measure extension status content at the available width and reserve up to four rows in both shared and separate status layouts. Account for mode indicators and warnings, and remeasure when content or available width changes.
Extra status rows yield to the draft and other composer surfaces when vertical space is limited. An unfocused composer keeps a single dim status row.
## Testing
Add regression coverage for resizing, wrapping beside mode indicators and warnings, hyperlink preservation, limited vertical space, cursor placement, footer overrides, focus changes, theme updates, and reasoning effort changes.
GitOrigin-RevId: 6a637b5cf6f34684639a92d920da4795c90abb6f
## What changed
- Use the same status renderer for shared footer rows and separate status lines, allocating extension content the width left by the mode indicator.
- Measure extension content with `measure_natural()` instead of rendering it at maximum width.
- Skip reasoning effort status transitions for extension content and clear an active transition when extension content replaces the status line.
## Testing
Add regression coverage for matching shared and separate layouts across terminal resizing, natural width measurement, viewport clipping with hyperlinks, and skipping effort transitions when switching between native and extension content.
GitOrigin-RevId: 4ffc52ec6374f3c2b4995c0472bee25aa15ae7a0
## What changed
Use a shared layout traversal to measure prepared UI trees and paint text directly into terminal buffers. Add natural and viewport-constrained size measurement, and use direct rendering for extension footer content.
Preserve wrapping, styles, and terminal hyperlinks while clipping at grapheme boundaries and leaving overflow ellipses unlinked.
## Testing
Add coverage for size measurement in terminal cells, wide characters at clipping boundaries, and zero-width text around overflow ellipses. Update rendering tests to check painted buffer contents and hyperlinks.
GitOrigin-RevId: 828c45d3400f9e3dfce9a7bd812d1cc0ea51642f
## Why
Footer width measurement and rendering each prepared the same UI tree again.
## What changed
- Prepare footer extension content once and share the owned `PreparedUiTree` through `Arc`.
- Resolve colors against the active theme at render time, caching each color resolution within a render pass.
- Share leaf text buffers across prepared chunks instead of copying their slices.
## Testing
Add a test verifying that chunks from a clean text leaf retain slices of the original buffer. Update existing UI tree rendering tests to use the owned prepared representation.
GitOrigin-RevId: daba035c291338f3e0036e9ad4f2fd26f56a3910
## Why
Enabling `tui_extensions_status_line` routed configured status lines through a plain-text extension renderer and hid the “Use theme colors” option in the status line picker.
## What changed
Always use the native status line renderer for configured items and their live picker previews, preserving theme colors and pull request links regardless of the extensions flag. Always expose the theme color option in the picker, and clarify that the flag enables experimental MCP status line providers.
## Testing
Update coverage to require native status line content across extensions flag changes and exercise the live picker preview with the flag enabled. Retain checks for pull request hyperlinks and color preference preservation.
GitOrigin-RevId: bce7df5696c2bd3583d3ef99c43e7a2014e17294
## What changed
Render prepared UI trees within a viewport's width and height, preserving authored line breaks and wrapping text while retaining styles and hyperlink ranges.
- Add `wrap: "wrap"` for rows to move children onto additional lines; keep `nowrap` as the default.
- Allocate space to row children while reserving later siblings' minimum widths.
- Mark horizontal clipping and vertical overflow with an unlinked ellipsis, including in single-line rendering.
- Respect word hyphens across style boundaries and nonbreaking spaces when wrapping.
## Testing
Add regression tests for nested row wrapping, sibling width allocation, hyperlink offsets and clipping, and word boundaries. Add a buffer snapshot covering authored line breaks, collapsed whitespace, styles, and links.
GitOrigin-RevId: fdfbdee92808c0a8f55e2fdf11db95d68a76d9a5
## What changed
Add `UiTree::prepare` and `PreparedUiTree` to prepare styled inline text and row structure independently of viewport width. Compute minimum and preferred widths for text and nested rows, including gaps, and retain authored line breaks when filtering zero-width children.
Render the first line from the prepared tree while retaining overflow ellipses and hyperlink clipping.
## Testing
Add a preparation test covering row width measurements across styled text, nested rows, gaps, empty children, combining marks, and non-breaking spaces.
GitOrigin-RevId: 5f63366c0568a01cb55686d9f14c1b3fac90946f
## What changed
- Collapse spaces and tabs across inline leaves, trim leading and trailing whitespace, and keep rendering limited to the first line.
- Prepare Unicode line-break opportunities across style boundaries and join graphemes split across leaves. Use the first fragment's style and retain a hyperlink only when all fragments share its destination.
- Preserve row boundaries and explicit gaps, and use row gaps for status-line separators.
- Prevent zero-width fragments from adding row gaps or changing the ellipsis style.
## Testing
Add regression tests for whitespace collapse, split graphemes, hyperlink ownership, zero-width fragments, and line-break consistency between styled runs and contiguous text.
GitOrigin-RevId: 94e58808bc8469e9cd0adddb16c194b9568cfbb6
## Why
The UI tree renderer's CSI-only sanitizer leaves OSC command contents visible in rendered text, including embedded hyperlink URLs.
## What changed
Use `vtparse` to sanitize each string independently, retaining printable text, tabs, and newlines while discarding terminal commands and other control characters. Preserve the existing text limit, first-line rendering, and tab expansion.
## Testing
Add a regression test covering color escapes, carriage returns, OSC hyperlinks, and an incomplete escape sequence before a structured link. Assert the rendered text and the structured link's hyperlink range.
GitOrigin-RevId: 51899f62d10f6a1321f96278616fe7a51bad17d9
## Why
Extension UI trees previously accepted only named terminal colors and literal RGB values. Semantic colors let extension content follow the active syntax theme and terminal color capabilities.
## What changed
- Accept `primary`, `surface`, `accent`, and `status-*` color roles for text foregrounds and row backgrounds.
- Resolve semantic colors against the active theme when rendering extension footer content. Prefer the `codex.accent` scope for `accent`, falling back to the theme's accent setting.
- Reuse status-line scope mappings and fallback colors, with terminal-default fallbacks for unavailable primary, surface, and accent colors.
## Testing
Add color serialization coverage and rendering snapshots for dark, light, and empty themes in truecolor and ANSI 16-color terminals, including nested foreground and background styles.
GitOrigin-RevId: 156f137859d74178f9ae6aa46a02eecb815e9802
## What changed
Include `turn_trigger` from turn metadata in tool, artifact, skill, app, plugin usage, and hook analytics events. Omit the field when no trigger is available.
## Testing
Extend app serialization and reducer tests to check trigger propagation, and verify that MCP tool events retain the trigger after turn completion.
GitOrigin-RevId: 975780983d0761eb34fecf5e8b4abe98a432d0c3
## What changed
Allow `requirements.toml` to pin `features.runtime_agent_instances.mode` to `dual_header` or `assertion_only`. Apply the required mode when no explicit mode is configured and reject conflicting explicit settings, while preserving legacy boolean requirements.
Document experimental runtime authentication configuration, credential lifecycle, and bootstrap authentication behavior.
## Testing
Add coverage for managed mode defaults and conflicts, runtime reuse and rotation across account requests and restarts, fresh assertions on Realtime and MCP reconnects, and Realtime destination and environment restrictions.
GitOrigin-RevId: bcf9502178f477c1e8232386f1f3e360bf23d667
## What changed
- When `multi_agent_v2.disable_native_tools` is enabled, use bundled mode policies instead of model catalog guidance, while preserving explicitly configured mode hints.
- Refer to multi-agent tools and instruct the model to read the full multi-agent skill before calling them. Keep proactive delegation enabled for `Ultra` reasoning and explicit-request-only delegation for other reasoning levels.
- Reset retained nonempty custom mode hints to explicit-request-only guidance when multi-agent support is disabled, including after a cold resume.
## Testing
Extend integration tests and request snapshots to cover hosted-tool guidance, configured hint precedence, proactive mode with `Ultra` reasoning, and the mode reset after a cold resume.
GitOrigin-RevId: 403791ef76f990e385d9c155d9c2edc9acfcd4fe
## What changed
Add `.github/actions/setup-bazel-windows` to prepare MSVC, derive the Bazel Windows path, download the pinned Cygwin snapshot, and run the existing verified Windows dependency bootstrap. Export the Windows system root and host architecture for subsequent steps.
Use the action in the Bazel workflow and argument-comment lint action. Remove an unused `EnvironmentAttachment` import from the session tests.
GitOrigin-RevId: 8dc711dc9301bb44d49be3fdab79bd4ca981b7d0
## What changed
- Add the disabled-by-default `gateway_setup_wizard` feature to let users choose a saved custom gateway during eligible local sign-in onboarding.
- Save the selection as `model_provider`, restart the embedded app server with that provider, and complete required primary authentication and gateway OAuth before starting the first chat.
- Show gateway loading and configuration errors, browser sign-in links, and an OAuth retry action. Respect provider policy and launch overrides.
## Testing
Add coverage for onboarding eligibility, saved gateway selection and persistence, and gateway error and OAuth screens. Add a terminal integration test verifying that the selected gateway receives the first chat with authentication.
GitOrigin-RevId: 92bd2da3abd28d6c2274c91b2d7561bf359f0ca0
## What changed
- Extract helpers for image paste shortcuts, paste-burst ticks, restricted draft edits, and composer activity detection.
- Thread `ShellPrefixHandling` through text insertion and pending-input flushing.
- Return a configuration rebuild future that does not borrow the app or base configuration.
## Testing
Add a regression test covering image paste while `!` is buffered: Enter preserves the draft during the paste burst, and subsequent submission includes the image and literal `!` without running a shell command.
GitOrigin-RevId: fb9a3c8a70aed524c65022f2c0910ce2ad11d4d2
## What changed
Pass the local project's GitHub origin to cloud prewarming so new cloud threads can provision a repository checkout. Preserve the attached local project when switching backends and resolve its origin for each thread start.
Normalize supported GitHub origins to credential-free HTTPS URLs and select a repository-specific cloud working directory. Unsupported origins retain the blank environment behavior. Keep project metadata outside the app-server wire protocol, and fix HTTP Git URL parsing so query strings and fragments cannot be mistaken for authority text.
## Testing
Add coverage for project routing, origin normalization and rejection, managed environment encoding, local project retention, and Git URL credential stripping.
GitOrigin-RevId: 5859769965faf060461ccc1cbb3fd48f8e2f2155
## Why
Token-usage observations previously required full metadata writes. Concurrent history writers could also occupy pool connections while waiting for SQLite's single writer.
## What changed
- Update only timestamps and token totals for eligible activity patches, preserving concurrent metadata edits. Retain metadata repair for missing rows, changed sources, missing spawn edges, history promotion, and preview backfill.
- Serialize local history writes before acquiring transaction connections so readers can use the remaining pool connections.
- Use `ROWS UNBOUNDED PRECEDING` for cumulative log-byte limits so SQLite can compute byte and row limits in one pass.
## Testing
Add coverage for token updates preserving concurrent edits, clamping negative totals, and rejecting stale source or missing spawn metadata. Extend metadata repair tests across legacy and paginated history modes to cover token updates, preview backfill, and spawn-edge repair.
GitOrigin-RevId: 4a30fd42a7498c616ed13adb46fc3d7e0226a94d
## What changed
Add a nullable `userId` to `GetAccountResponse`, populated from the same authenticated account snapshot as the rest of the response. ChatGPT and personal access token sessions return the canonical ChatGPT user ID when available; API-only and signed-out sessions return `null`.
Update the cloud client, generated schemas, TypeScript and Python types, and account identity documentation. Default missing IDs to `None` when deserializing responses from older app servers.
## Testing
Extend account response tests to check ChatGPT and personal access token user IDs, null IDs for other providers and signed-out sessions, and ID changes when switching providers with saved ChatGPT credentials.
GitOrigin-RevId: 7ad3da3cfc835c4d08d03c8e91b06cd7e007d874
## Why
Realtime connections bypassed runtime authentication and reused captured authentication headers for sideband handshakes. They need to honor the selected credential source and its transport policy across call creation, retries, and reconnects.
## What changed
- Use runtime authentication for realtime WebSocket connections, WebRTC call creation, and sideband attachment when enabled for supported OpenAI destinations.
- Resolve authentication on every WebSocket handshake, preserving credential ownership and request scope while generating fresh assertions. Reject authentication failures without falling back to bearer authentication.
- Keep call creation and sideband attachment bound to the selected credentials and account network policy, including when inference uses a different provider.
- Avoid runtime initialization for local marketplace and MCP operations, plugin commands that do not use the remote catalog, and model debugging with a configured catalog.
## Testing
Add coverage for fresh handshake credentials on retries and reconnects, credential and account changes, runtime authentication modes, destination validation, and registration failures.
GitOrigin-RevId: 57e53122912fa78a524427b0f51013f76f9f7681
## Why
Guardian's retrieval, channel selection, and evidence delivery depend on concrete local message-board types. Expose the required operations through shared interfaces so these consumers can use trait-based board handles.
## What changed
- Introduce `BoardReadView` for captured catalogs and post boundaries, with read operations and JSON search configuration but no mutation methods.
- Extend `AgentMessageBoard` with namespace identification, read-view capture, and channel subscription operations, and implement them for the local board.
- Add `message_board_read_tools` to bind the five read-only tools to a captured view.
- Migrate Guardian consumers to `AgentMessageBoard` and `BoardReadView`, retaining Guardian namespace checks and captured read boundaries.
## Testing
Adapt read-view and Guardian retrieval tests to the trait interfaces. Add assertions for the five retrieval tools and rejection of ordinary boards by retrieval binding, subscription capture, and delivery planning.
GitOrigin-RevId: f8c5bc65d8297f6df6e3b02d6c09006bcaea4b1a
## What changed
Add `DeliveryPlan::deliver` to supply selected originals as `guardian_original_evidence` context in source order. Read whole posts one board page at a time and batch them within the model's tool-output budget, rejecting originals that cannot fit intact.
Record delivered ordinals only after the admission callback succeeds, and advance channel positions when the plan completes. Preserve successful admissions across partial plans so retries and overlapping channel selections do not duplicate evidence.
Add `LocalBoardReadView::read_post_texts` to retrieve posts in the requested order while enforcing the captured board boundary.
## Testing
Add retrieval tests covering ordered delivery into a retained conversation without starting inference, deduplication, failed admission, oversized-original retries, older evidence from newly selected channels, captured-view boundaries, and paged reads.
GitOrigin-RevId: b2f03e039c6677e0b94dceaa7ed75a966edf81eb
## What changed
Add `DeliveryState` to plan unique evidence originals from selected Guardian board channels in source order. Read request IDs in pages by insertion sequence within a captured board view, and reject evidence beyond the review's source-history cutoff.
Share evidence request-ID encoding between the housekeeper and delivery planner, and expose the source cutoff on `EvidenceSnapshot`.
## Testing
Add retrieval tests covering deduplication across channels, source ordering across storage pages, exclusion of unselected channels and posts appended after capture, and rejection of evidence beyond the source cutoff.
GitOrigin-RevId: fc181a52b46137538bb94a5bba1c1d6bf1bccf32
## What changed
Add `ReviewerSubscriptions::prepare` to select evidence channels using the review task, current subscriptions, and captured catalog. Validate unique channel names before atomically replacing the caller's subscriptions within that catalog, preserving subscriptions to channels outside it.
Share typed sampling between selection and housekeeper routing, enforce input byte budgets, and expose `OperationResult` so callers can honor runtime reuse or rollback requirements. Selection observes cancellation and deadlines before saving membership.
## Testing
Add integration coverage for subscription replacement, caller isolation, preservation of later channels, cancellation before sampling, and rejection of selections outside the captured catalog with a rollback disposition.
GitOrigin-RevId: fcab0de88ac862e21cdf3c780c780385e2543604
## What changed
Add `LocalAgentMessageBoard::set_subscriptions` to apply a caller's subscribe and unsubscribe choices for multiple channels in one transaction. Validate all supplied channels before applying changes, and preserve subscriptions for other channels, threads, and agents.
Allow this self-only operation on read-only live connections, reject fixed views, and emit no notifications. Share subscription and opt-out updates with the existing single-subscription API.
## Testing
Add coverage for bulk updates through a read-only connection, atomic failure when a channel is missing, preservation of other channels and agents, and the absence of notifications.
GitOrigin-RevId: 83ed587f9c5deaa3e9de87adb6319f9de0c804b1
## What changed
Add `ReviewerSubscriptions` to capture a Guardian catalog and expose self-only `subscribe` and `unsubscribe` tools. Restrict requests to channels in that catalog and return captured post IDs so later evidence stays outside the review boundary. Read current membership from storage and filter it through the captured catalog.
Share message-board tool size limits and query the latest channel post directly when updating subscriptions.
## Testing
Add coverage for caller-only subscription changes, rejection of later channels and explicit agent targets, captured post IDs, and unchanged subscriptions for other agents. Extend message-board tests to check unsubscribe post IDs and reject missing channels.
GitOrigin-RevId: 48bf4270d6079f7e436096175c67bb211ccbc248
## What changed
- Expose `guardian_board` tools to list channels and threads, search posts, and read evidence through a captured read-only view. Require a Guardian storage namespace and keep reads within the review's fixed cutoff, including searches across unsubscribed channels.
- Support literal, case-insensitive searches over decoded JSON fields and nested function-call arguments so quotes, Windows paths, and Unicode escapes do not hide matching evidence.
- Strip response-envelope harness metadata from captured evidence except for `user_input_order`, preserving message payloads and source ordering.
## Testing
Add retrieval coverage for unsubscribed channels, fixed cutoffs, and escaped JSON searches. Update evidence tests to verify serialized payloads retain source order while excluding other harness metadata.
GitOrigin-RevId: 3128e4a2d59d1f71f2cce0bc6b1fbdf7e2aba287
## Why
Concurrent appends can shift live results between pages. Readers need a fixed catalog and post boundary to browse without including later activity.
## What changed
- Add `LocalAgentMessageBoard::read_view` and export `LocalBoardReadView`, exposing the captured channel catalog and a read-only board handle.
- Freeze channel summaries and apply a post sequence cutoff to searches, thread listings, reply summaries, and individual reads. Later appends are excluded even when backdated.
- Reject all mutations through fixed views, including subscription changes, while preserving live handle behavior.
Views share SQLite storage without holding a transaction open. They do not retain deleted posts.
## Testing
Add integration coverage for frozen catalogs and paginated reads, exclusion of newer and backdated appends, mutation denial, and continued live updates.
GitOrigin-RevId: d32cd4989d07040891fa5d38f6ee91fa1960d0d6
## What changed
Keep the advertised `_codex_apps.invocation_context` when an app's tool metadata refreshes on the same server connection, while using refreshed values for other metadata. If the invocation context changes on a different connection, skip the call as unavailable.
## Testing
Extend the code-mode compaction test to refresh app tools before resuming a cell and verify that calls retain the original invocation context while picking up the refreshed `resource_uri`.
GitOrigin-RevId: 1b6072faed74623994ea82035a6ed977451984a4
## What changed
Support `bold`, `italic`, and `underline` nodes, plus text properties for color, weight, italics, and underlining. Nested text can override inherited styles, including disabling modifiers.
Add row backgrounds that apply to children and gaps. Text colors and row backgrounds accept the eight standard ANSI color names or `#RRGGBB` values, with RGB colors resolved through the terminal palette. Preserve the last visible span's style on overflow ellipses while keeping them unlinked.
## Testing
Add coverage for style serialization and invalid values, nested modifier depth limits, inherited styles and overrides, row backgrounds, styled truncation, and foreground/background palette resolution, including a rendered buffer snapshot.
GitOrigin-RevId: 6b19b6b740cd754890c8adb489fba414a6ee62d3
cooper-oai