## What changed
Remove the duplicate tool metadata stored in `CachedMcpHandler` and compare incoming metadata directly with `McpHandler::tool_info()`.
Preserve complete agent plugin namespace descriptions in the handler, applying the existing 1,000-byte limit when building tool specs and search metadata. Truncation continues to respect UTF-8 character boundaries.
## Testing
Extend the agent plugin namespace description test to verify that the handler retains the full description while search output remains bounded.
GitOrigin-RevId: d0a9d5f6796143315235e658e77e059657e85f13
## Why
Guardian cannot capture sender instructions from another host when the sender thread is absent from the receiver's local runtime.
## What changed
Fall back to the authenticated thread store to reconstruct sender history without resuming the sender. Respect compaction and rollback, and label persisted evidence to indicate that newer unpersisted messages may be missing.
Limit storage reads to five seconds and capture sender context before acquiring the active-turn lock. Bind the captured evidence to the turn that accepts the delivery, allowing an existing turn to finish while the read is pending.
## Testing
Add cross-host scenarios for legacy and paginated history that verify sender evidence reaches only Guardian and excludes rolled-back permissions. Add a gated storage-read test that verifies turn completion remains unblocked and evidence is bound to the newly accepted turn.
GitOrigin-RevId: fe896f4e82fe3e32017fe4884846f3fa90a87949
Background discovery can cache a successful response before the test mounts
its unauthorized-response mock, bypassing the intended token refresh.
Mount the `401` mock before invalidating the route cached during login in
`external_auth_refreshes_on_unauthorized`.
GitOrigin-RevId: 8c280ca7287dab09230d534a44ca80d0835d2ef2
## What changed
Apply `code_mode_tool_description_first` when preparing nested tool definitions for Code Mode execution and tool search. When enabled, place each tool's description before its namespace description; otherwise, preserve namespace-first ordering.
Reuse cached MCP definitions only when both the input schema budget and description-order setting match.
## Testing
Extend deferred app tool integration tests to cover both description orders with and without ranked search, including consistency between search results and `ALL_TOOLS`. Extend the MCP cache test to reject reuse when the description-order setting changes.
GitOrigin-RevId: 1e3f84d2d95c200aef21ad710d367274b2169b4b
## What changed
Register `code_mode_tool_description_first` as an under-development feature, disabled by default, for placing tool descriptions before namespace descriptions in Code Mode. Add the boolean option to the configuration schema.
GitOrigin-RevId: 5d7e2f7cef87a040f9d96b0d97c2697880c12c17
Replace fixed 500 ms sleeps in `helper_attempt_is_shared_after_cancellation` with polling of the helper completion marker every 10 ms, bounded by a five-second timeout.
This lets the test observe completion independently of the cancelled headers or refresh request without assuming the helper finishes within 500 ms. Preserve the assertions that subsequent calls reuse the same helper attempt.
GitOrigin-RevId: 2612679aff756306ea3e05ef7bb9b4db02633fd5
## Why
Authorization updates during a pending Guardian approval can invalidate its decision. Retries need the updated guidance without inheriting the invalidated review or losing earlier valid context.
## What changed
- Validate authorization while the reviewer is reserved, before publishing its history checkpoint.
- Roll back stale attempts to the last committed review, preserving earlier valid reviews across repeated invalidations.
- Pin the issuing action's repository instruction snapshot for reviewers and retries, avoiding fresh instruction discovery through disconnected executors.
- Treat stale authorization as a request for a new review rather than a failed decision.
## Testing
Add regression coverage for repeated approval invalidation, retention of earlier valid context, exclusion of stale decisions, and execution of the pending action exactly once. Extend the disconnected-executor test to verify that retries retain repository instructions and use updated authorization.
GitOrigin-RevId: 0bff6cc551fee1f0905082eb97ccdecaa8628867
## Why
Elevated Windows sandbox tests share machine-wide accounts. Running them in the sharded core suite can consume test deadlines while shards wait for the account lock.
## What changed
Move the Windows sandbox tests into the Windows-only `windows_sandbox` integration-test binary. Update the nextest account-sharing group to select the entire binary instead of individual test names, so tests queue before their timeouts start. Keep the existing guard for coordination with other test binaries.
GitOrigin-RevId: 613925c9398b5acc8440fa34c658680f31f65c8b
## What changed
Increment `codex.agents_md.edit` for committed `apply_patch` changes to `AGENTS.md` and `AGENTS.override.md`, matching filenames case-insensitively and tagging the counter with the normalized filename.
Count additions, deletions, updates, and distinct move destinations, including changes committed before a later patch failure.
GitOrigin-RevId: bcbfa671acb37a2a24fe7e4effc9318981a22ec7
## Why
Failed Guardian review evidence was process-local, so restarting Codex lost the context needed for later diagnostic reports.
## What changed
- Persist failed-review records in SQLite before reviewer cleanup, retaining at most 64 records globally, eight per thread, and 8 MiB of evidence. Delete persisted evidence when its reviewed thread is deleted.
- Recover and deduplicate persisted and in-memory records for the reported task tree when uploading `auto-review-failures.jsonl`.
- Bound persistence attempts to 250 ms and retain an in-memory fallback when storage is unavailable. Keep capture gated by user opt-in and non-ephemeral sessions, and export evidence only when logs are included.
## Testing
Add coverage for persistence across reopen and process restart, retention limits, cascading deletion, busy-storage fallback, and report uploads with and without logs, including SQLite log failures.
GitOrigin-RevId: ea2da1818d4a5da3da29f211042ca45e834342bc
## Why
Resolving unapproved hostnames discloses them to DNS even when the proxy ultimately rejects the request. Allowing local binding in a managed macOS sandbox also granted direct outbound access to port `53`.
## What changed
- Require an allowlist match or policy approval before resolving a hostname for address checks.
- Recheck baseline restrictions after local and remote policy approval so approval cannot bypass explicit denies or local/private address restrictions.
- Preserve DNS checks for inner HTTPS requests after an approved CONNECT, including hosts without a persisted allowlist entry.
- Remove the Seatbelt allowance for external DNS while retaining local binding and loopback proxy access.
## Testing
Add regression tests for zero DNS lookups on unapproved hosts, private-address rejection after approval, local and remote approval ordering, and DNS checks after approved CONNECT requests. Add a macOS Seatbelt child test that verifies external UDP and TCP port `53` access is denied while local binding and proxy connectivity remain available.
GitOrigin-RevId: 490790462c51928e831dd8375ac098bc3a257bac
## What changed
Update retained instruction splitting and empty assistant-context detection to match `SectionContent::Other`, and convert assistant framing markers into `SectionContent`.
## Testing
Extend the snapshot-splitting regression test to use `prepare_transcript` with both line and JSON formats, with and without source message IDs. It checks evidence preservation, deduplication, and a stable instruction prefix as assistant context and reviews change.
GitOrigin-RevId: e2205eaf9b31a2b8291dc6c0c22a899596b10206
## Why
Retained assistant context changes as the conversation grows. Keeping it separate from retained user instructions lets independent Guardian snapshots preserve a reusable instruction and transcript prefix.
## What changed
Move retained user instructions before the transcript and place assistant originals and their omission notice in a separate `RETAINED ASSISTANT CONTEXT` section afterward. Preserve evidence, delivery roles, source metadata, and deduplication across both retained sections. Clear omission delivery metadata when a split assistant notice cannot be attributed to a single section.
## Testing
Add regression coverage for prefix stability as assistant context and previous reviews change, evidence preservation, repeated preparation, and deduplication. Update approval-routing and scorer tests to check the new section order and retention of assistant text outside a smaller transcript budget.
GitOrigin-RevId: 15cda59d24bee0106f6a66c067f6a790fa91df69
## Why
Published MCP elicitation requests could lose their response waiter without notifying the event consumer that the request was no longer answerable.
## What changed
- Add `ElicitationAbandoned` with the original server name and response token for requests published through unbounded event channels.
- Emit abandonment exactly once when a waiter is dropped, response delivery fails, or the MCP runtime shuts down.
- Close the elicitation router during shutdown, reject new requests on unbounded sources, and wait for terminal deliveries before shutdown completes. Preserve bounded sources' request-only behavior and backpressure.
## Testing
Add router tests for ordered, exactly-once abandonment, closed receivers, failed response delivery, shutdown coordination, and bounded-channel backpressure. Add a core integration scenario verifying that a pending form's abandonment precedes `ShutdownComplete`.
GitOrigin-RevId: 53fe9f4a8b32f7324be180288aa492f31f4d2057
## Why
DB-only listing and pagination failures must not look like exhausted history. This hardens the DB-only listing added in https://github.com/openai/codex/pull/18502 and page refilling added in https://github.com/openai/codex/pull/7509.
## What changed
- Return JSON-RPC error `-32603` when `useStateDbOnly: true` cannot query the local state database, including requests with an empty `cwd` array.
- Track all cursors encountered while filling a page and return `-32603` for repeated cursors, including on full pages.
- Document that callers can retry these errors; a successful response with `nextCursor: null` still indicates exhaustion. Default scan-and-repair requests retain their filesystem fallback.
## Testing
Add regression tests for missing or mismatched state databases versus healthy empty history, with active and archived listings and null or empty `cwd` filters. Cover repeated cursors during page refilling and on full pages using the in-memory thread store.
GitOrigin-RevId: 09653a84fc65f47316d8bbae9e4cf3dd8ce9948a
## Why
Clients displaying a saved manual thread order need to list the remaining threads without repeating those already loaded separately.
## What changed
Add optional `excludedThreadIds` to `thread/list` and the generated protocol bindings. Apply exclusions before the result limit, refilling pages until the requested limit is reached or history is exhausted while preserving existing filters and ordering. Clients must send the same exclusions on each page.
Accept up to 100 entries, counting duplicates toward the bound. Reject invalid IDs or oversized lists with JSON-RPC error `-32602` rather than truncating them. Omitted, null, and empty lists preserve existing behavior.
## Testing
Add integration coverage for page refill across database-only and scan/repair paths, archived threads, sort directions, and project/section scopes. Cover duplicate and unknown IDs, the 100-entry boundary, invalid input, and preservation of section order.
GitOrigin-RevId: e9a884e642ae25d166aff7e275469d1d43179c6c
## What changed
- Extract `create_parser()`, `assemble_package()`, and `archive_package()` from the packaging CLI so callers can assemble a package directory, add files, and archive it separately.
- Support DotSlash artifacts with `format: "gz"` by decompressing the executable directly to its destination.
## Testing
Extend the zsh manifest override test to verify executable contents for both `tar.gz` and `gz` artifacts.
GitOrigin-RevId: 3542b795eea1f2320bef1402d575a9396be43df2
## Why
Interrupting a turn or terminating a Code Mode cell can drop a pending dynamic tool handler before it publishes its completion. Cancellation needs to settle the call in live events and persisted history without allowing a late response into model context.
## What changed
- Let dynamic tool handlers observe cancellation and publish their terminal item before dispatch finishes. Calls cancelled while awaiting a response complete with a failed item and a cancellation error.
- Keep readiness, dispatch admission, registry lock waits, hooks, and output processing cancellable so cancellation can finish even when a hook is blocked.
- Report an aborted tool lifecycle outcome when cancellation interrupts dispatch, including before handler execution.
## Testing
Add regression tests for turn interruption with pending calls or blocked hooks, cell termination with persisted failure and late-response exclusion, cancellation before dispatch admission, and exactly one completion when a response races cancellation.
GitOrigin-RevId: 0112fc74c8652c91503ed5bbfb334ae2e26930ef
## What changed
Add `windows.allow_mxc` to configuration and its JSON schema. Setting it to `false` blocks automatic MXC selection even when `features.prefer_mxc` is enabled, and rejects explicit `windows.sandbox = "mxc"` configuration with a clear error. Omitting the setting preserves existing behavior.
## Testing
Extend configuration tests to cover disabling automatic MXC selection and rejecting explicit MXC configuration when `windows.allow_mxc = false`.
GitOrigin-RevId: bf7c0648cfcb3cc1d0dc41b9faffcb8078672780
## Why
A delayed detach or cleanup from an older realtime conversation must not close its replacement or end the replacement's history segment. Realtime start parameters can also contain credentials in text and transport endpoints, so diagnostics should avoid exposing them.
## What changed
- Add `RealtimeConversationAttach` to report the connection attempt's result through a reply channel, using the sequential start path.
- Add `RealtimeConversationDetach` to close only the matching `realtime_session_id` after earlier starts finish. Detaching an older session leaves the replacement connected.
- Emit the previous conversation's close event before starting its replacement, and prevent stale fanout cleanup from closing or clearing the replacement's context.
- Limit `ConversationStartParams` debug output to output modality, initial item count, and protocol version.
## Testing
Add coverage for attachment completion after the handshake, stale detaches, failed replacement and retry, natural-close ordering, handoff history after replacement, and debug redaction for existing-call and WebRTC transports.
GitOrigin-RevId: 23aee6f70522f0b17e6aa9349dbbcc2ea985f233
## Why
User ripgrep configuration can suppress the file list used to construct Linux sandbox deny masks. For example, `--quiet` in `RIPGREP_CONFIG_PATH` can leave files matching deny globs unmasked.
## What changed
Pass `--no-config` to the ripgrep invocation that expands denied-file globs.
## Testing
Extend the multiple-denied-files regression test with a ripgrep configuration containing `--quiet`, checking that denied files remain unreadable and unwritable while allowed files remain accessible. Skip the ripgrep-specific case when no protected `rg` executable is available.
GitOrigin-RevId: 06a6e27e0edec92e79e99af5144b57f86079953f
## Why
Executor config reads omitted the startup `features.prefer_mxc` override, so clients could not see the CLI sandbox preference.
## What changed
- Include the explicit CLI `features.prefer_mxc` value in `environmentConfig/read` as a `session-flags` layer, above project config and below legacy managed file and MDM config.
- Retain only this preference from startup overrides.
- Expose `windows_mxc_allowed_by_config` to share MXC eligibility checks after callers resolve the active permission profile.
## Testing
Add CLI and remote executor coverage for preference propagation and filtering, plus a unit test verifying that both legacy managed config sources retain precedence.
GitOrigin-RevId: 5ac6f5257f1e807c2f197dcf5dcb2385cedca0ea
## Why
Attachment stores need to distinguish uploads from ephemeral threads, which intentionally skip durable persistence.
## What changed
Add `ephemeral` to `UploadRequest` and propagate the turn configuration through image preparation for messages, tool outputs, and history replay. Include the flag in debug output while keeping attachment bytes redacted.
## Testing
Extend the Guardian context-budget test to assert that a persistent Guardian uploads exactly one image with `ephemeral: false`. Update the attachment debug-output assertion to include the new field.
GitOrigin-RevId: 42814c514a571ed6798e4dcf79a22028ee4efc28
## Why
Agent tree shutdown previously returned a generic error without identifying which operation or thread failed, making cleanup failures difficult to diagnose.
## What changed
- Add `AgentTreeShutdown::wait_detailed()` and public report types while preserving the existing `wait()` result and error message.
- Record operation, optional thread ID, and either an abandoned teardown guard or a failed phase with a payload-free error category across session cleanup, child spawn cleanup, and resident eviction.
- Give each tree a correlation ID, log each failure, and retain up to 64 failures with a count of additional failures omitted. Record failures before releasing tree membership so all completed waiters observe the same report.
## Testing
Add unit coverage for aborted and completed teardown, cloned guard context, concurrent and repeated waiters, omitted failure counts, and report formatting without raw error payloads. Extend integration coverage for successful tree shutdown and persistence writer failures, including compatibility with `wait()`.
GitOrigin-RevId: 68784af28b63e875b00a55d78729f0cc5b01ac15
## Why
Windows temp grants could fall back to host `TEMP`/`TMP` values and bypass read-only or denied subpaths. Sandbox permissions must match the environment passed to the child process.
## What changed
- Resolve `:tmpdir` from absolute `TEMP`/`TMP` paths in the completed workload environment, preserving access modes and missing-path rules without falling back to host values.
- Deduplicate Windows environment keys case-insensitively in a deterministic order so permission resolution and the child environment select the same value.
- Use the resolved temp policy for elevated sandbox overrides across core execution, exec-server, and direct spawning.
- Launch direct-spawn sandbox wrappers with the supplied Codex executable, materializing an inner helper only when it is that executable.
## Testing
Add Windows regression coverage for temp-only writes, read-only and denied carveouts, mixed-case and duplicate environment keys, unavailable temp paths, and empty or missing write-root overrides. Exercise core execution and direct spawning, and extend exec-server RPC coverage to the elevated backend with temp values set through the environment policy.
GitOrigin-RevId: 16b8bd4702cc434fd743a08c75a3e4515780bff3
## Why
On Windows 10, strict native opens can reject the DOS drive alias itself as a reparse point, preventing no-follow filesystem operations on ordinary drive-letter paths.
## What changed
Retry rejected drive-letter opens relative to a verified local volume root. Require the root to resolve to a physical disk volume directory without reparse attributes, and retain `OBJ_DONT_REPARSE` for paths beneath it so junctions remain blocked.
## Testing
Add Windows tests for file creation and reading through the volume fallback, opening the drive root, and rejecting junction traversal and creation. Validate accepted volume-root names and verify that named pipes are rejected without establishing a client connection.
GitOrigin-RevId: 51ffde4f77d2af45d18dfc4cb026d73a0e69b061
## Why
Live preferences can be newer than the last successful configuration load. Starting a new thread after a reload failure could overwrite those preferences with stale settings.
## What changed
Carry local settings alongside the new-session configuration, retaining the live settings when reloading fails and applying the staged settings when the new thread starts. During resume and agent selection, replace staged local settings only when the directory-trust check actually reloads configuration.
## Testing
Add a regression test that changes a live rendering preference, writes invalid `config.toml`, and verifies that loading a new thread's configuration preserves the live local settings.
GitOrigin-RevId: 4ac3c70de6d627e1609cc0a5d4ba5df5a61a8b20
## Why
MCP contributors need the complete executor selection to distinguish an unavailable primary executor from a ready secondary. Ready capability roots alone do not preserve pending or failed selections.
## What changed
Add `with_selected_environments` and `selected_environments` to `McpServerContributionContext`, and pass the captured selections during thread MCP resolution and model-step plugin selection. Preserve priority order and pending or failed entries. Use `None` for threadless discovery and `Some(&[])` for an explicitly empty selection.
## Testing
Add regression coverage for executor ordering with pending and failed selections, environment context in model-step plugin selection, and the distinction between absent and explicitly empty selections.
GitOrigin-RevId: 2c1222fae72c7e2c75b2f40abfad3b2048cf9316
## Why
A stalled rendezvous WebSocket upgrade can prevent reconnects, while short-lived connections reset reconnect backoff too early. Blocked relay writes also prevent received pongs from clearing their heartbeat deadline.
## What changed
- Bound rendezvous WebSocket connection attempts with `DEFAULT_REMOTE_EXEC_SERVER_CONNECT_TIMEOUT`.
- Retain exponential reconnect backoff across short-lived connections, resetting it only after a connection lasts at least 120 seconds.
- Process pongs during blocked data writes while preserving the in-flight send and its independent write timeout. Prefer queued pongs over an expired heartbeat deadline.
- Abort the relay writer when its owning connection task is dropped.
## Testing
Add coverage for pongs arriving during blocked writes, missing and queued pongs, independent write timeouts, and writer cancellation. Extend reconnect tests to cover stalled WebSocket upgrades without re-registration and backoff reset after a stable session.
GitOrigin-RevId: 0efa350c2b4ada9b89e23df8909063fbb69f33dc
## What changed
- Use `p` to pin or unpin the selected task, with a configurable `agents.toggle_pin` binding.
- Display pinned tasks first in a `Pinned` group, preserving shared section order and applying search and status filters.
- Load pins from the shared thread section, including tasks outside the recent-task window, and refresh after pin changes. Disable pinning when the server does not support shared sections.
## Testing
Add coverage for shared pin/unpin state, paginated pin discovery and refreshing pins on reopen, shortcut dispatch and duplicate-action suppression, and pinned-group and custom-help snapshots.
GitOrigin-RevId: d1a2cab6642d059c3c8df8480b5c59a10c493936
## What changed
Move full rollout history reading and parsing into one blocking worker for both plain `.jsonl` and compressed `.jsonl.zst` files. Use the shared cancellation-aware line iterator so canceled loads stop before processing another record, while preserving rollout items, thread IDs, and parse-error counts.
## Testing
Add regression tests for cancellation between records and equivalent history-loading results across plain and compressed files, including Unicode, CRLF line endings, malformed records, empty files, and invalid UTF-8.
GitOrigin-RevId: 65e1bd7ebcdbbd0ab5f560e73b2c7f074f627f8f
## Why
Capability discovery needs the roots captured with each environment snapshot. Threads sharing an executor can select different roots, and changing environment order must preserve executor skill aliases.
## What changed
- Attach the receiving thread's capability roots when constructing `TurnEnvironmentSelection` at startup and settings updates, including roots loaded from saved history.
- Resolve capability roots from environment snapshots while preserving their original order. Retain startup roots so deselecting and reselecting an environment restores its capabilities.
- Match inherited configuration by environment and workspace so differences in capability root metadata do not interrupt configuration propagation.
## Testing
Add regression coverage for root ordering across environment states and configuration changes, independent root selections on a shared executor, reselection with startup or saved roots, active turn updates, and pending configuration failures reaching child and grandchild threads.
GitOrigin-RevId: 4f2e4bb414d27195a6752406117a6050718a1198
## What changed
Remove `workspace_roots`, `current_date`, `timezone`, `network`, `personality`, and `multi_agent_mode` from `TurnContextItem` and stop recording them in rollouts. Update the precomputed protocol schema accordingly.
Make `summary` optional when reading turn context and write `"none"` as a compatibility placeholder for older readers, rather than persisting the active reasoning-summary setting.
## Testing
Update protocol tests to cover omitted `summary` fields and compatibility-placeholder serialization. Extend compaction tests to verify that model requests retain the updated reasoning-summary setting after compaction while the rollout checkpoint records the placeholder.
GitOrigin-RevId: d49eabaa1b340be1d79f7f09115281a307ea8a64
## Why
A malformed plugin manifest still marks a capability root as plugin-owned. Discovery or metadata failures must not be treated as evidence that a root is standalone.
## What changed
- Add `ExecutorPluginProvider::root_ownership` and export `PluginRootOwnership` to distinguish plugin-owned roots from standalone roots before capability parsing.
- Use discovery results when conclusive; otherwise probe manifest files at the selected root and its ancestors using the supplied filesystem sandbox. Nested plugin manifests do not establish ownership of their parent root.
- Share manifest lookup with plugin resolution and pipeline up to 256 metadata probes while preserving ancestor and manifest priority, including error ordering.
## Testing
Add tests for malformed ancestor manifests, discovery failures, ancestor versus nested ownership, concurrent probe ordering, and sandboxed metadata checks without reading manifest contents.
GitOrigin-RevId: 3512452cf1df22f52c2a2b422f96c760d98c24ac
## Why
Rendezvous connection warnings report only a generic WebSocket error, while debug logs include raw error text. Structured diagnostics make failures easier to investigate without logging potentially sensitive error payloads.
## What changed
- Generate a request ID for each connection attempt, send it as `x-request-id`, and include it in the connection span and connection, disconnection, and failure logs alongside the attempt count.
- Replace raw error logging with typed error categories, I/O error kinds, HTTP status codes, and allowlisted values from `x-codex-rendezvous-rejection-reason`.
- Ignore unknown rejection reasons and response bodies.
## Testing
Add tests for rejection-header allowlisting, typed I/O failures, and a rejected WebSocket handshake that verifies the request ID header and preserves the HTTP status and known rejection reason.
GitOrigin-RevId: a8274fec965bcf5b8453b047c0bb79396cdf6ba4
## Why
Skill selection and disabled-path matching need to recognize equivalent Windows paths across case and separator differences while preserving literal spaces, `%`, and `#` in native filenames.
## What changed
- Carry `PathUri` through skill metadata, discovery mappings, filesystem lookups, disabled-path sets, and invocation analytics.
- Match linked skill mentions and TUI selections by parsed path identity.
- Use `LegacyAppPathString` for app-server skill paths and regenerate schemas and SDK types, preserving native path strings on the wire.
- Preserve native catalog display paths and ordering. Keep host filesystem probes and configuration writes restricted to host-compatible paths.
## Testing
Add regression tests for Windows path identity and disabled-skill matching, literal filename characters, catalog resource reads, native path ordering, and foreign-path analytics normalization.
GitOrigin-RevId: c212916dc9fef0e7616542726e107f0d6a313267
## Why
Changing the incremental tools setting on resume should not move tool declarations and base instructions within an existing context window.
## What changed
- Determine the current window's tool declaration mode from its history, and apply the incremental tools setting when building a new window after compaction or a context reset.
- Use that mode consistently for sampling, remote compaction, startup prewarm, prompt debugging, and Guardian input budgeting.
- Preserve tool declarations alongside their comparison baseline in full-history agent forks, including compacted histories; remove them together when rebuilding context.
## Testing
Add request snapshots covering legacy resume, migration after remote compaction or a context reset, disabling incremental tools, and tool updates after restart. Extend agent fork and WebSocket startup prewarm tests to cover retained declarations and incremental tools.
GitOrigin-RevId: 7c46849a1788027a8435082e4d1f7e7f48d2700c
## Why
The hooks browser rendered detail URLs as plain text. Long URLs in hook commands can wrap or be truncated, so their visible text may omit part of the destination.
## What changed
Render web URLs in hook details as terminal hyperlinks, preserving the complete destination across wrapped lines and truncated text. Keep truncation ellipses outside the links.
## Testing
Add a regression test and snapshot for a wrapped, truncated hook command URL, checking that linked cells retain the complete destination and the ellipsis remains unlinked.
GitOrigin-RevId: 488562266bd5ef880c03bf313bc4cfa7d3104c7b
## What changed
Render web URLs in selection labels and descriptions as terminal hyperlinks, preserving their complete destinations when text wraps or is truncated. Carry hyperlink ranges through two-column layouts and keep truncation ellipses outside links.
## Testing
Add regression assertions and a snapshot covering wrapped and single-line rows, prefixed labels, descriptions, and wide Unicode characters. Verify that visible URL fragments retain complete destinations and ellipses are not linked.
GitOrigin-RevId: 9d50b3ced79cbd29200e48a676445ec169d60758
## What changed
Render web URLs in pending steers, rejected steers, and queued follow-up messages as terminal hyperlinks. Preserve the complete destination when the visible URL is clipped to the preview width.
Add `HyperlinkRows` to render already-wrapped rows without changing their spacing or row count, clipping text and hyperlink ranges to the viewport.
## Testing
Add regression coverage for complete URL destinations across all three preview sections, plus snapshots for oversized URLs and clipping overflow text and the edit hint in a narrow preview.
GitOrigin-RevId: 959df27bba381b1b3895f5a86cc2ecb1419806b1
## What changed
For managed app-server daemons using Unix sockets, raise the soft
`RLIMIT_NOFILE` limit to 4096 at startup, capped by the inherited hard limit.
Preserve existing higher soft limits and log a warning if the adjustment fails.
GitOrigin-RevId: 2ef27370e55cd86a7a62cbc3d47041933b89ac21
## Why
Submission diagnostics need approval and turn metadata without logging user input, tool responses, commands, paths, or instruction payloads.
## What changed
- Log thread and submission IDs, operation kind, and parent/root turn IDs as explicit fields.
- Give `Op` and `ThreadSettingsOverrides` selective `Debug` output that retains identifiers, approval decisions, and policy categories while omitting payloads.
- Preserve Guardian review identifiers and status when logging approval of a denied-action retry.
## Testing
Add an app-server integration test that verifies command approval, Guardian review, and turn policy metadata reach SQLite-backed diagnostic logs with `RUST_LOG=off`.
GitOrigin-RevId: 308acb7b70e4849cf31514b11e4d9b46eaf6a09b
## What changed
Introduce `TranscriptRecord` and `PreparedTranscript` to retain attributed transcript text through preparation and composition. Cache rendered content, byte counts, and token estimates, refreshing them when text or framing changes.
Keep JSON records structured during budget recovery so truncation replaces only `text`, preserving metadata, field order, and framing without reparsing serialized JSON. Preserve whole-entry truncation for line transcripts and update synchronous and asynchronous consumers to use the preparation API.
## Testing
Expand coverage for cached estimates and delivery with escaped text, Unicode, and large payloads; metadata and framing preservation during recovery; and stable asynchronous history prefixes in both line and JSON formats.
GitOrigin-RevId: 8b3b5231ca4a6ee47d17dcc788ea68c56dd1a9bc
## Why
Transcript content can contain forged role headers, transcript boundaries, or claims of user approval. Guardian needs to distinguish that content from host-assigned authorship metadata.
## What changed
- Add `features.guardianv2.transcript_mode` with `line` (the default) and `json` options for synchronous review and asynchronous scoring.
- Render JSON transcript entries with host-assigned metadata and escaped `text`, and prepend matching provenance instructions to reviewer and classifier prompts.
- Preserve JSON metadata when budget recovery shortens historical text, and keep provenance instructions outside the configured classifier prompt limit.
## Testing
Add coverage for forged roles and approvals remaining within their original entries, JSON metadata surviving budget recovery, and provenance instructions surviving prompt limits. Extend review and scoring integration tests to verify JSON evidence and matching instructions.
GitOrigin-RevId: 81a3580390d3c4d1a664e554976cda5f1adc9a2c
## What changed
Add `model` and `reasoningEffort` to `subAgentActivity` items for multi-agent v2 spawns. Capture startup settings before the child begins its turn and resolve the reported effort against model metadata, including model defaults, while preserving the child's configured effort.
Carry these fields through live notifications, persisted activity, thread history, and legacy rollout migration. Update the JSON schemas and generated TypeScript and Python types. Older records and other activity kinds retain null values.
## Testing
Add coverage for resolved spawn settings matching the child's request across legacy and paginated history, preserving configured effort, forwarding metadata through events and history, and reading and migrating older records without the new fields.
GitOrigin-RevId: a9e4241ae21bb8db1ead293f78ffba8257cca0ae
## Why
Instant Connect can return a call ID before ICE activates the call, causing sideband attachment to briefly fail with HTTP `404` while the client connects media.
## What changed
Retry `404` responses from `connect_existing_call_sideband` up to three times, waiting 100, 300, and 800 milliseconds. Return the error once this activation retry budget is exhausted, and preserve the existing handling of other errors.
## Testing
Add WebSocket coverage for successful attachment after three `404` responses, failure after four `404` responses, and no retry on HTTP `410`. Verify that successful attachment does not overwrite the prepared session configuration.
GitOrigin-RevId: 5d18ff7eeeb9abd56388808828382f7350c7ae57
## What changed
Render help text in Windows sandbox setup and fallback prompts with `HyperlinkText` so each wrapped URL fragment links to the complete destination. Strip OSC 8 sequences when rendering popup snapshots to keep assertions focused on visible text.
## Testing
Add a regression test covering both prompts at 40 columns, asserting that every linked cell retains the complete destination and the visible link text remains intact. Include a snapshot of the wrapped setup prompt.
GitOrigin-RevId: 98bd60f04ab3ec8d6552a0b74b9637cce26169d5
## What changed
Render user verification titles and request details with `HyperlinkText` so URLs carry terminal hyperlinks, including in the waiting-for-verification view.
## Testing
Extend the narrow-prompt regression test to verify that wrapped URLs retain their full hyperlink targets before and during verification. Strip OSC 8 annotations when comparing visible text in snapshots.
GitOrigin-RevId: 9b2fba963c028eaa2b177220b0487364b44d04bb
## Why
The ChatGPT usage URL in the status card loses its terminal hyperlink when it wraps across lines in a narrow terminal.
## What changed
Attach the usage URL destination to each underlined span so every wrapped fragment remains clickable.
## Testing
Extend status hyperlink coverage at widths of 24, 42, and 120 columns to verify that linked fragments reconstruct the full URL and all point to the same destination.
GitOrigin-RevId: 516421380763f48da8af63b4d374e2b352722ddb
## What changed
Render URLs in TUI banner titles and descriptions as terminal hyperlinks, preserving the full destination when a URL wraps across lines.
## Testing
Add a regression test that checks hyperlink destinations for a wrapped URL and snapshots the visible banner layout.
GitOrigin-RevId: 1b1957570c1c0940a60f5a202648b0eeed5b95e1
Owen Lin