## What changed
- Serialize each history and notes request's output truncation policy into the
`x-openai-tool-output-truncation-policy` header.
- Forward the invoking tool call's policy for tool requests and use the thread
hint byte limit for context-contributor requests.
GitOrigin-RevId: 9d4e61480397b325efdb033861893e88c708de3b
## Why
Executed-tool metadata for a Code Mode cell can span its `exec` and `wait`
outputs. Consumers need to know whether that metadata contains the cell's full
tool call inventory or only a partial record.
## What changed
- Associate recorded tool calls with the originating Code Mode cell across
`exec` and `wait` outputs.
- Add a host-owned `tool_calls_complete` marker when recording finishes without
dropped or truncated calls. The marker describes inventory completeness, not
tool success.
- Preserve the cell metadata through replay and pruning, and clear the
completeness marker when prompt budgeting makes the record incomplete.
## Testing
Add coverage for multi-wait cells, retries, interruptions, recording limits,
argument truncation, prompt budgeting, and rejection of input-forged metadata.
GitOrigin-RevId: 377014edec06aab42aadab78b8b5dccc0a1c83ba
## What changed
- Add bundled proactivity and follow-up guidance when `ReasoningEffort::Persistent` is selected.
- Allow model metadata to override or disable the guidance with `persistent_instructions`.
- Track the instructions as world state so effort and model changes replace or retire stale guidance without duplicating unchanged context.
- Tailor approval guidance to `send_user_message_async` availability, rebuild it for forked agents and rolled-back history, and exclude Guardian sessions.
## Testing
- Cover default, overridden, disabled, replaced, and retired instructions.
- Cover model changes, history transitions, agent forks, Guardian sessions, and asynchronous-message tool availability.
GitOrigin-RevId: 78e05d0335a70b385bd069b45edcd4ba570cef91
## Why
Delegated prompts should retain the authority of the TUI tool that sent them instead of being recorded as user input.
## What changed
- Start delegated `create_thread` and `send_message_to_thread` turns with a namespaced tool output and an empty user input list.
- Recognize delegated outputs from trusted Codex namespaces when building activity summaries.
- Render replayed delegation outputs in history and transcripts with their source task attribution, without adding them to composer history.
## Testing
- Cover turn request encoding, namespace filtering, activity summaries, and replayed history/transcript rendering.
GitOrigin-RevId: aeb2f5c8ad2f2a898c80e8fc791ed879a0ab655d
## What changed
- Mark history and notes search queries, appended note text, and replacement note text as encrypted in their tool schemas.
- Send `x-openai-encrypted-tool-arguments: true` for the corresponding backend routes without changing the JSON request body.
## Testing
- Cover encrypted schema fields and backend headers for history search, notes search, append, and write calls.
- Verify unrelated history and notes requests do not receive the encrypted-arguments header.
GitOrigin-RevId: 58263cff832c979b436ddb4013b5c27218aca678
## Why
Trusted Guardian reviewer sessions can emit events without an app-server listener, leaving their turns and tool usage absent from analytics.
## What changed
- Translate Guardian session lifecycle and canonical tool item events into analytics notifications while excluding messages, reasoning, and review content.
- Preserve Guardian lineage during prewarming even when inherited client metadata is not yet available, without emitting an incomplete thread initialization event.
- Limit direct session tracking to trusted Guardian children so resumed threads that have an app-server listener do not report duplicate events.
## Testing
- Cover completed, failed, and interrupted Guardian turns, tool counts and timing, lineage, content exclusion, prewarmed lineage, and resumed-thread deduplication.
GitOrigin-RevId: 70ace5f7ed30a7e3b6a9d6097c8b2a6a326dc4f7
## What changed
- Add callback lifetimes to extension `ToolCall`, `ToolEnvironment`, turn-input context, and skill-read request types.
- Require extension tool executors to handle calls for any invocation lifetime and tie their returned futures to that lifetime.
- Update built-in extensions, adapters, and tests to use the lifetime-scoped APIs without retaining host-owned environment capabilities.
GitOrigin-RevId: aca9ce3a1b6870df550bc84ec9308cc65533f161
## What changed
- Inject W3C `traceparent` metadata into code-mode session and execution requests.
- Carry each execution's trace context on streamed tool callbacks so callback and nested-tool spans remain connected across the gRPC boundary.
- Preserve the relevant spans when execution, callback, and dispatch work moves into spawned tasks.
GitOrigin-RevId: 6482963cb9b2e2f0ea27f1345bba208b70a80d0b
## Why
Repeated skill locator roots can make catalog prompts larger even when the
catalog fits within its metadata budget.
## What changed
Evaluate aliased catalogs regardless of budget pressure and select them when
they preserve skill inclusion and description content while reducing prompt
size. Apply the same selection to combined host, executor, and orchestrator
catalogs.
## Testing
Add coverage for alias selection in full host-only catalogs and update skill,
symlink, and orchestrator resource tests to expect shortened locators and their
root mappings.
GitOrigin-RevId: ccedd3f3f6c7efaa1e5177a2d8c3d81d59239f52
## Why
Guardian treated all skill instructions as untrusted, so it could not use the
invocation of a user-owned skill as authorization evidence.
## What changed
- Record explicit and implicit skill invocations through extension contributors.
- Send Guardian a bounded, deduplicated list of canonical skill paths only when
they resolve under the user's Codex or `.agents` skill directories.
- Keep repository skills and symlinks that escape trusted roots untrusted, and
send only verified paths rather than skill contents to the classifier.
- Avoid recording host skill prompts that were superseded by core skill
injection.
## Testing
- Added unit coverage for trusted roots, symlink escapes, deduplication, and
size limits.
- Added integration coverage showing that Guardian trusts invoked user skills
while rejecting a forged repository skill.
GitOrigin-RevId: 1cc0be230f7e6649110201c23c3de8f26447ff36
## What changed
- Fetch ChatGPT account access and attach `cyber_trusted_access` under
`openai/entitlementContext` when an installed or selected plugin explicitly
requests it from a local, read-only stdio tool with no arguments.
- Reject caller-supplied entitlement context on direct MCP calls, and fall back
to an `unknown` status when access cannot be verified or the account changes
during the lookup.
- Count entitlement lookup time against the MCP tool-call timeout.
## Testing
- Cover eligible calls plus unowned, remote, HTTP, mutable, argument-bearing,
API-key, undeclared, direct, and account-switch cases in core and app-server
integration tests.
GitOrigin-RevId: 303b61585ef4530276c373d914a2d0ccef1f4ac2
## What changed
- Add an optional `toolOutput` to `turn/start` for starting or steering a turn with a named function-call output instead of user input.
- Emit standalone outputs as `functionCallOutput` thread items, persist them in durable history, and include them in resumed threads.
- Validate that tool outputs have a name, are not combined with nonempty `input`, satisfy the text-size limit, and use supported image URLs.
## Testing
- Cover standalone tool-output notifications, model input, and resumed history in both legacy and paginated history modes.
- Cover the text-size limit for structured tool output.
GitOrigin-RevId: a1eeec7b9b7de67b1a1c5e829a54552b85ec118b
## Why
Filesystem policies can describe paths using a convention that differs from the
host running Codex. Native path comparisons can therefore mis-handle cases such
as case-variant Windows paths or ambiguous encoded components.
## What changed
- Resolve policy entries and special roots as `PathUri` values using the
executor's path convention.
- Use validated URI components for containment, overlap, and precedence, and
fail closed when component boundaries are ambiguous.
- Restrict relative joins to descendants and apply the same matching rules to
protected metadata paths and permission-profile intersections.
## Testing
Added coverage for Windows case variants, encoded and opaque paths, repeated
separators, descendant joins, special roots, metadata protection, and preserved
deny entries.
GitOrigin-RevId: fb09d44d11df25faaac806fe00457e6f6b0d8596
## Why
Linux managed networking routed proxy connections through filesystem-backed Unix sockets, requiring an extra readable sandbox path and stale socket cleanup.
## What changed
- Transfer loopback TCP listeners from the sandbox namespace to host bridge processes over anonymous Unix socket pairs.
- Validate transferred descriptors, keep bootstrap channels private to each sandbox launch, and close them before running untrusted commands.
- Tie proxy bridge lifetime to the sandbox so cancellation closes active upstream connections.
## Testing
- Cover descriptor validation and interrupted handoffs.
- Verify concurrent sandboxes keep proxy endpoints isolated and do not inherit privileged sockets.
- Exercise managed networking end to end through `app-server`, confirming proxied access succeeds while direct host access remains blocked.
GitOrigin-RevId: 6561e09c83b927c604951bf2aa00ff532d179da5
## What changed
- Promote `compaction_image_budget` to stable and enable it by default.
- Charge retained images against the remote compaction context budget unless the feature is explicitly disabled, trimming older images as needed.
## Testing
- Update remote compaction coverage for the default, explicitly enabled, and explicitly disabled behavior.
GitOrigin-RevId: 0f715347cefc33b814bdcfd9b430ef453d3bd6df
## Why
Executor plugin manifests are unsigned, so cleanup hooks must remain limited to
explicitly trusted plugin identities and MCP targets.
## What changed
- Allow the bundled Browser, Chrome, Chrome Dev, and Chrome Internal plugins to
run the existing `Stop` hook for `node_repl.turn_ended`.
- Continue allowing the bundled Computer Use plugin and rejecting unlisted or
lookalike marketplace identities.
## Testing
- Extend manifest-filtering coverage for unlisted bundled plugins and marketplace
name variants.
GitOrigin-RevId: 1ad5d679a1530994df5a9628c2117ce509fec9ad
## What changed
- Add `TrustedAccessContext` to fetch account-bound cyber verified-access grants and attach them as host-owned `openai/entitlementContext` metadata.
- Replace caller-supplied entitlement metadata and return an `unknown` status when authentication, identity consistency, response validation, size limits, or the lookup deadline cannot be verified.
- Add `HttpResponseBodyStream::from_chunks` for lightweight in-memory streaming clients.
## Testing
- Cover grant mapping, unsupported authentication, account and workspace changes, malformed or oversized responses, duplicate programs, and lookup timeouts.
GitOrigin-RevId: 343b6a6608c98c45a34939ef507c2183516a11c1
## What changed
- Allow `start_or_steer_turn` to accept named `function_call_output` items without a `call_id`, starting a turn when idle or steering the active turn.
- Preserve standalone outputs as pending input, assign response item IDs, and record them in conversation history without treating them as user prompts.
## Testing
- Cover starting a turn with a standalone output and steering an active turn with one.
- Verify passive response items do not signal pending steering activity.
GitOrigin-RevId: e32b292106b3c5a5f03577b8ebf67d2d7dee4e5d
## What changed
- Add the zero-based `window_number` to Responses turn metadata and include it in prewarm requests.
- Persist `forked_from_ordinal_exclusive` separately from the physical history base so fork lineage remains accurate after reverts and cold resumes.
- Report context-inheriting subagents through `parent_thread_id` without also emitting fork lineage.
- Reserve the new metadata keys while accepting and filtering previously valid configured values so Codex-owned values take precedence.
## Testing
- Cover window numbering across compaction, resume, and fork operations.
- Cover fork cutoff persistence across direct forks, legacy rollouts, reverts into inherited history, and cold resumes.
GitOrigin-RevId: 288f6cd632254814c1f166668b33828082d799a1
## Why
Opening Guardian's initial WebSocket connections can be delayed, but thread startup and resume do not need to wait for those connections.
## What changed
- Install the Guardian sampler and related thread state before opening its initial connections.
- Prewarm the sampler's WebSocket pool in a background task while retaining the existing on-demand connection behavior.
## Testing
- Verify extension startup returns before a delayed WebSocket handshake completes, then warms the full initial connection pool.
- Verify resuming a thread likewise returns before Guardian's delayed handshake completes.
GitOrigin-RevId: 58c91cf045b223f917c67d7e8dc82eac529db4ce
## What changed
- Return the number of directories flagged by successful Windows sandbox world-writable scans.
- Record that count in the `codex.windows_sandbox.world_writable_scan_flagged_directories` histogram for startup and warning-triggered scans.
- Tag each measurement with a `success` or `error` result, using a count of zero when the scan fails.
GitOrigin-RevId: 076160f36b1d62fa737f4b2d0318774e6c44a4b1
## What changed
- Add a bounded developer context fragment identifying the MCP server or connector and the user-owned configuration that declared it.
- Emit the fragment only when the effective entry matches the user configuration or an active plugin declaration resolves inside the Codex home directory.
- Keep tool descriptions, outputs, and unrelated tools untrusted, and reject unsupported sources or paths that escape through symlinks.
## Testing
- Cover user-configured servers and connectors, plugin-provided capabilities, token truncation, symlink escapes, and app-server request integration.
GitOrigin-RevId: 0bfe2a2f3a48334d1d5faad692b5d36452febb68
## What changed
Point the stable exec-server compatibility test at the pinned Codex 0.150.0
Linux x86_64 release and update the release archive checksum.
GitOrigin-RevId: 6178a1170faffe3dc70c9cfbfcbe3439b201096f
## What changed
- Add the `write_stdin_approval` feature flag, disabled by default, to require a fresh approval before sending non-empty input to an escalated unified-exec terminal.
- Route these reviews through hooks, Guardian, app-server, and the TUI as `writeStdin` approvals while keeping the parent command item unchanged.
- Preserve the terminal environment, launch directory, and escalation state across turns, and revalidate the process identity after approval before writing input.
## Testing
- Cover approval routing, policy decisions, process reuse, terminal identity preservation, app-server events, analytics, and TUI rendering.
GitOrigin-RevId: 4ba29eaae6208e934737ba078c96e589c7c2164d
## What changed
- Add optional `McpToolContext` metadata to `ToolStartInput`, exposing the
model-visible MCP tool details and its source classification without exposing
the executable client.
- Classify MCP calls as connectors, configured servers, plugin servers,
executor-selected plugins, or other registrations based on the prepared call.
- Prepare each MCP call before notifying tool lifecycle contributors and reuse
that same call for execution so the callback describes the call that runs.
## Testing
- Cover host-owned connector calls and extension-owned Apps server calls,
including their distinct provenance and executed tool names.
GitOrigin-RevId: efd23f511b1045ffdd96349d621ad62365569b2b
## Why
Models that require automatic review previously skipped Guardian v2 risk scoring
entirely, even when Guardian was limited to computer-use tools. That scope cannot
use a low-risk result to approve unrelated tools, so the blanket skip is
unnecessary.
## What changed
- Retain Guardian v2 risk scoring for required-review models in
`ComputerUseOnly` scope while continuing to skip it in standard scope.
- Preserve strict automatic approval review for Node REPL-backed tools, including
when classification fails.
## Testing
Added coverage for low-risk, high-risk, and invalid classifications across the
Node REPL and computer-use REPL paths, plus an unrelated MCP tool.
GitOrigin-RevId: ee38fabf82e196df0ae13b4216b5892be9b799cf
## What changed
Remove `minimum`, `maximum`, and `maxLength` from the supported tool input
schema representation. Schema parsing now drops these bounds instead of
including them in generated tool declarations, including declarations for
reserved history and notes tools.
GitOrigin-RevId: b7c7733651e65d38cc3d0cef2efa127ab3f8a32f
## What changed
- Add a synchronous reviewer prompt builder that combines root authorization,
trusted user answers, bounded conversation history, parent environment and
permission context, retained REPL evidence, and the proposed action.
- Select text or image REPL evidence from Guardian feature and transcript
settings while respecting the reviewer model's supported modalities and
shared image limits.
- Render network access requests with trigger-specific guidance and bound
approval reasons and nested action strings before including them.
## Testing
- Add a prompt test covering root authorization, untrusted transcript framing,
retry reasons, denied-read restrictions, and action serialization.
GitOrigin-RevId: d1cf886c2e30f7abbf94cce977cef14439ef3f2e
## Why
Responses Lite rebuilds its tools and base-instruction prefix for each request. Stable item identities let follow-up WebSocket requests recognize that unchanged prefix and send only incremental input.
## What changed
- Derive deterministic IDs for additional-tools and base-instruction items from the thread ID and each item's serialized payload.
- Preserve IDs when rebuilding an unchanged request or resuming a session, while changing them when the thread or payload changes.
## Testing
- Cover ID stability and payload/thread sensitivity in request construction.
- Verify resumed Responses Lite sessions reuse prefix IDs and WebSocket follow-ups use `previous_response_id` with only new input items.
GitOrigin-RevId: 3c8548b96979d7578865b0ccc51c147926823478
## Why
Filesystem helpers should not inherit access to system scratch directories beyond the paths granted by their filesystem policy, while ordinary processes still need scratch access for compatibility.
## What changed
- Move the `/tmp` and `/var/tmp` read/write grants, including their `/private` aliases, from the shared platform defaults into the process-only Seatbelt defaults.
- Keep process access to `/Applications` alongside the scratch-directory grants.
## Testing
Add a macOS Seatbelt test that verifies the generated policies and, when nested Seatbelt execution is available, confirms process scratch access, helper denial, and helper access to an approved project path.
GitOrigin-RevId: 26d83f09c131c1f1d000163b2f8929f601749719
## What changed
- Add `gg` and `G` motions to jump to the first and last buffer lines.
- Support the motions with delete, change, and yank operators, including dot-repeat for edits.
- Expose normal-mode and operator-motion bindings in the configurable keymap while preserving conflicting user bindings.
## Testing
- Cover buffer jumps, operator combinations, repeat behavior, chord routing, and custom remapping.
GitOrigin-RevId: 24a9178cf7964053aaf9a8cd268c5434dda0778e
## What changed
- Resolve plugin activation, MCP server policy, and marketplace definitions from the effective configuration stack, including system settings and trusted project overrides.
- Load plugin skills independently for each working directory passed to `skills/list`.
- Exclude project configuration from catalog requests whose `cwds` are omitted or empty.
- Cache up to eight loaded plugin configurations with least-recently-used eviction so requests for different working directories can reuse their results.
## Testing
- Cover layered plugin and MCP policy across trusted and untrusted projects.
- Cover per-directory skill and plugin catalog results, cache reuse and eviction, and system-defined marketplaces.
GitOrigin-RevId: cb68b2b1bdab1da48e05ca7562bc05014431fc71
## Why
App-server clients need the explanation and steering instruction returned with a
misalignment policy violation to offer a user-confirmed continuation. Missing or
incomplete details must continue to behave as a terminal block.
## What changed
- Parse optional misalignment classification, explanation, and steering details
from streamed and HTTP Responses errors and propagate them through core errors.
- Include the details in live app-server `error` and `turn/completed` payloads and
export the corresponding protocol schemas and TypeScript types.
- Keep explanations and steering messages out of serialized rollout events and
redact them from debug output.
- Document how clients can resume with `turn/start` after user confirmation.
## Testing
- Cover streamed, HTTP, and WebSocket-wrapped errors, including malformed and
classification-only details.
- Verify live app-server notifications expose resumable details without writing
the explanation or steering message to the rollout.
GitOrigin-RevId: 329258a444c2cd91d0c57ab1720830b33ddcfac5
## What changed
- Default the current-time reminder and interruptible `clock.sleep` tool on for
turns using persistent reasoning effort.
- Preserve explicit `features.current_time_reminder` settings and managed
requirements, and gate reminder recording on the resolved feature state.
## Testing
- Cover configured, persistent, ordinary-effort, explicitly disabled, and
managed-disabled clock setups.
- Verify review turns do not expose clock tools or current-time reminders.
GitOrigin-RevId: 4ff8805807ceeef374abd962b1d9e7c37f1fbd83
## What changed
- Classify `response.failed` events with the `rate_limit_exceeded` code as a distinct retryable error while preserving any parsed retry delay.
- Expose the error as `rateLimitExceeded` through the core protocol and app-server schemas after stream retries are exhausted.
- Preserve the upstream message for TUI display while keeping it out of telemetry summaries.
## Testing
- Cover SSE classification, retry metadata, protocol conversion and serialization, exhausted stream retries, telemetry redaction, and TUI rendering.
GitOrigin-RevId: 02dab4d3477dcd7653a58c49c4bd38687a616579
## What changed
- Add effective workspace roots to `EnvironmentConfig` and use them when
materializing permission profiles and filesystem context.
- Preserve selection roots for thread-owned configurations while allowing a
ready environment attachment to supply its resolved roots.
- Propagate resolved roots to child environments and validate both command and
`apply_patch` writes in owner-provided secondary workspaces.
GitOrigin-RevId: 1832c168ce1fc37fa67efc2a472998ab4f448c70
## What changed
- Add the `features.guardianv2.persist_scores` configuration option for debugging.
- Default the option to `false`, so Guardian V2 reviewed actions and risk scores are only written to rollout files when explicitly enabled and the session is not ephemeral.
## Testing
- Cover configuration deserialization, default non-persistence, and opt-in persistence for nested code-mode actions.
GitOrigin-RevId: 452af99ef14553d45140340ececc2913389124d0
## Why
Responses-compatible requests can use routes other than `/responses`, but their
tracing spans reported the default route regardless of the selected endpoint.
## What changed
- Populate `api.path` from the selected `ResponsesEndpoint` for HTTP and
WebSocket requests.
- Retain the endpoint on WebSocket connections so stream-request spans report
the same route as connection spans.
GitOrigin-RevId: 349eca94b27d4cc3a1adde8b257313506bdaf0f4
## What changed
- Add optional `call_id` and `action` fields to `SecurityRiskScore` so a persisted score identifies the tool call and bounded action that produced it.
- Populate the fields after Guardian V2 classifies an action while leaving fail-closed and legacy scores without provenance.
## Testing
- Verify scores preserve action details for direct tool calls and nested code-mode calls.
- Verify rollout serialization retains the new fields.
GitOrigin-RevId: fce69af37f368cecf1d9bce42bfc38a969e969b7
## What changed
- Add the opt-in `features.guardianv2.free_guardian` setting to route eligible
Guardian reviews to `/guardian` and asynchronous classifications to
`/guardian-classifier`.
- Support endpoint selection for both HTTP and WebSocket Responses clients,
including endpoint-aware connection reuse.
- Keep `/responses` for API-key authentication, custom provider URLs,
non-Guardian models, and configurations where the option is disabled.
- Omit routing hints and `service_tier` from requests sent to the dedicated
Guardian endpoints.
## Testing
- Cover route selection across authentication modes, provider URLs, HTTP
fallback, WebSocket review sessions, and classifier sampling.
GitOrigin-RevId: 9c88673c710d009e0239559b9245a4e6c4f4befc
## What changed
- Append accepted Guardian V2 classification results to rollout history for non-ephemeral threads.
- Keep resumed and forked threads from restoring a persisted score into active Guardian state.
## Testing
- Verify that asynchronous scoring records the resulting `SecurityRiskScore` rollout item.
- Seed resume and fork tests with a persisted score and verify that approvals ignore it.
GitOrigin-RevId: 40d63a2ea7e7cf6398402c6aed7d5e5727dc9d68
## What changed
- Add the originating Responses item ID to MCP tool request metadata as
`_meta.itemId`.
- Preserve the initiating `exec` item ID across code-mode cells so nested MCP
calls carry the same origin.
## Testing
- Cover metadata generation for direct and code-mode MCP tool calls.
GitOrigin-RevId: 1161cac64f1cc3a6d4dac4368e63804bd9d2c417
## What changed
Remove the CI-specific `-Cdebuginfo=0` flags for both target and execution
Rust actions, allowing the Bazel Rust toolchain and compilation mode to select
the debug-info level.
GitOrigin-RevId: f785347cde2b3ad0b7814ece2ba44fd89aa823b3
## Why
Guardian approval reviews may need the original user instructions to decide
whether a command is authorized.
## What changed
- Forward the parent thread's `history.list_windows`, `history.list_items`,
`history.read_item`, and `history.search_contents` executors to Guardian
reviewer sessions.
- Keep other parent extension tools, including the `notes` namespace, isolated
from Guardian reviewers.
## Testing
Add an app-server integration test that reads parent history during a Guardian
review and verifies that `notes` tools are not exposed.
GitOrigin-RevId: 65a90036577050adfa23b1d98f862233c994d9d7
## What changed
- Default Guardian v2's review scope to computer-use tools. Set
`features.guardianv2.review_scope.computer_use_only = false` to retain the
broader tool review scope.
- Include images in Guardian transcripts by default. Set
`features.guardianv2.transcript.include_images = false` to disable them.
## Testing
- Update configuration and app-server coverage for the new defaults and
explicit broader-scope overrides.
GitOrigin-RevId: 88c3cfe6dd2a96df052111794ad59c5c9ea39b78
## What changed
- Evaluate recent unknown-authorization or critical-risk actions over the last five actions instead of ten.
- Flag predicted high- or critical-risk actions when they are credibly expected within the next two actions, rather than treating any potential risk within ten actions as high.
- Remove privileged or broad access as a standalone high-risk condition and classify a trajectory as low when none of the explicit high-risk conditions apply.
- Clarify the user-authorization and reviewer terminology in the classifier instructions.
GitOrigin-RevId: 1eaf63c3327f57a9c8560df085e1fe0afad99cd4
## Why
Tool actions and approval retries can outlive the step that issued them. If approval handling reads newer turn settings, a delayed action can use the wrong approval policy or reviewer.
## What changed
- Capture the approval policy and reviewer in `GuardianReviewContext` from the issuing step.
- Use step settings for command, patch, permission, sandbox-retry, and remote-network approval decisions.
- Use the active task's published settings for background network approvals and long-lived Unix shell interception.
- Preserve explicit MCP reviewer overrides.
## Testing
Added regression coverage for permission requests, same-turn network policy changes, delayed commands after a new turn starts, sandbox retries, patch policy selection, and MCP reviewer overrides.
GitOrigin-RevId: b7e84a2e1e79a71502272b15b5ef5b0e5643f8b0
## Why
Windows filesystem operations can complete while their helper process remains
alive, and elevated sandbox processes must not survive a disconnected control
pipe.
## What changed
- Read newline-delimited filesystem helper responses without imposing an
operation deadline, then bound the time spent reaping the helper.
- Drain helper stderr concurrently, retain a bounded diagnostic on failure, and
kill helpers that do not exit after responding.
- Terminate the elevated runner's job or process when its input pipe closes or
fails.
## Testing
Added coverage for delayed responses, noisy stderr, stuck helpers, duplicated
file handles, and termination of elevated descendants after a control-pipe
disconnect.
GitOrigin-RevId: c0d3d5d76e13318de17638df4db71fcfb9a7397f
