## What changed
- Add `features.guardianv2.sync_elastic_budgeting` and `sync_elastic_sections` to configure section minimums, per-entry token caps, and optional section maximums. Require and validate section limits when enabled.
- Use the selected budgeting policy consistently for history capture, resume, prompt preparation, and review input budgeting. Keep fixed budgeting as the default.
## Testing
Add configuration validation tests, capture-and-resume coverage for both budgeting modes, and a request-history snapshot verifying retained instructions and transcript section limits.
GitOrigin-RevId: c7b0bdfd3e0e008d75c4d8a204959bcc58eb1bf8
## Why
Agent messages that arrive after a model request starts must survive compaction until a normal inference request includes them. Compactor output alone does not establish that those messages were delivered.
## What changed
- Persist history sequences and sampling checkpoints in harness metadata, capturing the input prefix for each normal inference request.
- Retain pending agent messages within existing size budgets during local and remote compaction, placing the summary before pending messages and subsequent caller input.
- Preserve sampling progress across history replacement and resume, and drain queued mail after interrupted sampling even when compaction leaves context above the token limit.
## Testing
Add regression coverage for request-boundary sampling checkpoints, pending messages across local compaction and repeated remote compaction with resume, and injected messages that interrupt sampling before mid-turn compaction.
GitOrigin-RevId: 26c04ab96b5a1c3cc1d6625ccc74a0f00201d14c
Pass `uuid_v7_item_id_generator_for_test()` to the two remaining
`record_user_message` calls in the transcript source-proof and budgeting test
to match the required API signature.
GitOrigin-RevId: d9ea7da605de895e009a67a3ab378111599b5bbd
## Why
Elastic allocation could shrink section minimums under budget pressure and bypass section maxima when the complete request fit. Instruction deduplication also needs to account for which transcript entries actually survive allocation.
## What changed
- Fund demand-capped section minimums before scaling headroom up to section maxima. Reject requests whose minimum reservations cannot fit after duplicate credit.
- Prioritize required records over optional records within each section, reconsider selections when redistributing packing gaps, and reserve global space for protected content and framing.
- Deduplicate retained instructions only against complete selected transcript sources, keep that proof selected during refills, and reuse the released budget.
- Retain elastic transcript history by byte limits instead of fixed item counts. On non-user byte overflow, evict whole older entries toward half the byte allowance.
## Testing
Add regression coverage for section minimums and maxima, priority selection, shared framing, duplicate-proof refills, and elastic history retention and replay.
GitOrigin-RevId: d73b40b88ba1bdab97a619014577f4a297171413
## Why
Tests need to distinguish slow subprocess startup from operation timeouts and wait for asynchronous work before asserting results or cleaning up fixtures.
## What changed
- Synchronize subprocess readiness, queued-turn completion, and matching UI events; allow more time for cold startup and separate startup from shutdown deadlines.
- Adapt Windows fixtures and permission expectations, provide the voice-host test runtime DLL path, and normalize platform paths and animated status snapshots.
- Use current configuration permissions when changing directories in embedded TUI sessions, while retaining saved permissions for remote sessions.
- Allow the release prompt-prefix comparison to accept the exact image-tool description update that removes image detail options, and refresh the corresponding tool snapshot.
## Testing
Extend inherited-session metadata coverage to both legacy and paginated thread history, including persisted history mode and revision-aware resume.
GitOrigin-RevId: 0afb38403fc0adb0d83175344749584f0cdf9979
## What changed
Store a shared `ContextWindowIdGenerator` in `LocalAgentRuntime` and pass it into each session. Use it for both initial context window IDs and subsequent window advances, retaining UUID v7 allocation by default.
Make `AutoCompactWindow` accept caller-provided IDs instead of allocating them directly.
## Testing
Update the window boundary test to verify that advancing installs the supplied ID while preserving the first and previous window IDs.
GitOrigin-RevId: a9da4232fe6ab9a53b75e239cb412ceae0fe3216
## What changed
Add `Client::prewarm_default_thread` to prepare an ordinary coding thread in the default managed cloud environment, with optional model and provider selection. Return the thread identity and resolved settings as `ThreadActivation` without a separate activation RPC, preserving unknown thread protobuf fields.
Send prewarm requests once without automatic retries or cleanup, and document that a failed response can leave a prepared thread whose identity the caller did not receive.
## Testing
Add coverage for default and explicit model/provider requests, resolved settings and native thread metadata preservation, and rejection of responses missing sandbox policy.
GitOrigin-RevId: 425ee5ee6bb30ec77ebdd0079955701a7f9704e4
## What changed
Add `Client::activate` to load a cloud thread through `UpdateConfig`, sending only the thread ID and `exclude_turns=true`. Return serializable resolved settings, thread metadata, and history cursors while leaving turns for separate pagination. Preserve the original thread protobuf, including unknown fields.
Validate required fields and thread identity, reject unsupported security policies, and redact sensitive activation data in debug output. Treat activation as a mutation that is never retried, with uncertain outcomes reported through `MutationError::OutcomeUnknown`.
## Testing
Add coverage for activation request encoding, settings and metadata preservation, serialization, compatibility defaults, unsupported policies, debug redaction, invalid input rejection, and explicit successful gRPC trailers.
GitOrigin-RevId: cd925b7a05f518d782e5b4cf188556567dad9e21
## What changed
- Monitor session lock state on Linux, macOS, and Windows, checking the initial state before starting audio.
- Abort local media on lock, including while connecting, retrying, or running a parked call, and display why voice stopped.
- Keep lock monitoring across startup retries and ignore stale lock notifications after a call restarts.
- Document lock behavior and platform limitations. After unlocking, users must run `/voice` to start a new call.
## Testing
Add lifecycle tests for already-locked startup, parked-call media shutdown, stale notifications, and locks during retry cleanup, plus a macOS test for password grace-period expiry.
GitOrigin-RevId: fea4b4a7903a48727c546ee3b7bd06e957a9b885
## What changed
Add `ContextWindowId` as a string-backed protocol type with UUIDv7 generation and parsing. Use it throughout compaction state, rollout reconstruction, token budget context, and request metadata in place of raw UUIDs, preserving the serialized string format and UUIDv7 validation.
GitOrigin-RevId: 786b74fcc331707ca5d6765f429b6e5e322d9328
## Why
Replaying a fork's inherited command history can make the TUI show background terminals belonging to its parent thread.
## What changed
Fetch the displayed thread's background terminals after history replay instead of treating replayed commands as live terminals. Read all pages, merge without duplicating tracked processes, and exclude terminals that exit while the request is pending. Clear terminal tracking and invalidate pending restoration when resetting thread state or stopping background terminals.
## Testing
Add a regression test verifying that `/ps` shows a resumed fork's own terminal, excludes inherited commands, and does not restore a terminal that exited during the list request.
GitOrigin-RevId: aca9ae9cde877f03143f8fbeea11affcc34dc372
## What changed
Introduce `ItemIdGenerator` and pass the runtime-owned generator through sessions, model clients, history, hooks, tool outputs, and memory requests. Keep UUIDv7 generation as the default and replace direct calls to `ResponseItemId::new` with the shared callable.
Preserve existing item IDs and backfill missing or empty IDs through the same generator, including forked history before reconstruction and persistence.
## Testing
Extend coverage for UUIDv7 IDs on user messages, agent messages, and additional tools, and assert that forked model context matches the backfilled items persisted to history.
GitOrigin-RevId: 0dd9ccf0f46f0f1005a6acfc740133b03ce82259
## What changed
Update the `v8` Cargo patch and Bazel archive to use `openai-oss-forks/rusty_v8` with a new pinned revision. Refresh both lockfiles, the archive checksum, and the allowed Git source in `codex-rs/deny.toml`.
GitOrigin-RevId: 76cdc8583804e22169275422e2580baffaa1a948
## What changed
- Record `codex.skills.read.result` and `codex.skills.installations.result` counters with bounded outcome labels for successes and failures.
- Tag both counters with `discovery_version` and installation listings with `source_filter`.
- Make session telemetry available through the step store so skill tools emit metrics with the current step's model metadata.
## Testing
Add coverage for read metrics in both discovery versions, installation listing outcomes and source filters, and extension metrics retaining the current model metadata after a model switch.
GitOrigin-RevId: 0b5418e2b94a89149a20877f32ca2b2e196884e7
## Why
Direct executor skill discovery used unrestricted filesystem access, bypassing the turn's permission context. Cached catalogs also needed to account for changes in filesystem access within a turn.
## What changed
- Bind selected capability roots to callback-scoped filesystem access through `AccessedSelectedCapabilityRoot`.
- Pass accessors built with the turn's granted permissions into skill preparation and discovery, removing the executor skill provider's environment lookup and unrestricted accessor.
- Include filesystem access keys in the direct discovery cache so permission changes trigger rediscovery.
## Testing
Extend tests to verify that restricted discovery returns no skills when sandbox access is unavailable, restoring access restores discovery, and changing or restoring access invalidates the catalog cache.
GitOrigin-RevId: 0f7aa7646f65923f65f0cfc0b387d94bd7f2db05
## What changed
- Add configurable `focus_pane_left` and `focus_pane_right` actions, defaulting to `leader left` / `leader h` and `leader right` / `leader l`.
- Move focus to the parent or open side conversation without reopening a hidden pane. Preserve the current interaction when no neighbor is available, and accept fresh typing after a no-op shortcut while suppressing reported key repeats.
- Expose the actions in the keymap picker and configuration schema, and prevent workspace-only pane bindings from claiming keys in classic mode.
## Testing
Add regression coverage for pane navigation, preserved transcript selection and search, fresh typing after a no-op, key capture, and binding conflicts and limits.
GitOrigin-RevId: 7f7629d15cffcd35d1353b36c5c9208dbb1034e8
## What changed
Mark `unified_image_budget` stable and enable it by default. Supported models now use unified image preparation with `original` detail, and `view_image` omits the `detail` parameter from its advertised schema.
## Testing
Update image input, MCP output, history replay, and tool schema expectations for the new default. Keep explicit coverage of the disabled feature and models that do not support original image detail.
GitOrigin-RevId: 2d6fc8019149fcf18b5813db2d2082ba95de2241
## Why
Repository skill discovery must reflect current filesystem access, including newly approved grants and narrower permissions. Previously listed skills can remain in conversation history after a turn-scoped grant expires, so catalog updates need to tell the model when availability changes.
## What changed
- Discover repository skills through the selected executor's permission-aware filesystem accessor and refresh snapshots when the working directory or access changes. Use the current step's snapshot for skill selection and invocation.
- Preserve repository boundaries even when project markers are hidden by read restrictions, and report unsupported sandbox backends as skill-loading errors.
- Track grant-dependent catalog entries and emit availability notices when skills disappear or return, even when the metadata budget is exhausted.
- Resolve implicit skill paths through their owning filesystem and exclude remote repository skills from local implicit command attribution.
## Testing
Add coverage for turn and session grants, grant expiry and restoration, hidden and newly created repository markers, cached read denials on Windows, unsupported remote sandboxes, and executor-backed implicit skill paths.
GitOrigin-RevId: ac1af483e73e3130524aeeabe218630435054028
## Why
Skill discovery and metadata loading used raw filesystem handles with unrestricted reads, and cache keys distinguished filesystems without accounting for captured permissions.
## What changed
- Pass borrowed `EnvironmentAccess` accessors through skill root resolution, discovery, canonicalization, and metadata reads.
- Include captured permissions in skill snapshot and empty remote root cache keys.
- Add fixed-path watches to `EnvironmentAccess`, falling back to live discovery when read restrictions prevent using unsandboxed executor watches.
- Keep user and plugin roots under host filesystem authority independently of the selected repository executor.
## Testing
Extend remote root cache coverage to verify that changing captured permissions triggers a fresh scan and that restricted accessors decline unsandboxed watches.
GitOrigin-RevId: 97d4bfdfcba78a93fc8845773c6397d4364494e3
## Why
Cached repository skill metadata must not authorize reads after access is revoked or a skill file or directory becomes a symlink to a denied location.
## What changed
Read repository skill instructions through a current environment accessor for the filesystem that discovered them. Reject reads when no matching accessor is available, and cache filesystem identity instead of retaining unrestricted read access.
## Testing
Add regression coverage for revoked permissions, file and directory symlink replacements, and missing or mismatched filesystem accessors.
GitOrigin-RevId: 8dad83b7c7893e0d66e2fe1c0c240715db582005
## Why
Workload identity authentication assumed every token exchange resolved to ChatGPT, preventing API service accounts from using the same flow.
## What changed
- Accept `wif_product: "api"` responses with organization, project, and service account metadata. Preserve ChatGPT compatibility when `wif_product` is omitted.
- Resolve API workload identity tokens as API key authentication and apply login restrictions to the resolved product. Read the actual login status during TUI startup instead of assuming ChatGPT.
- Preserve auth ownership across token renewal for the same API identity, and reject product or identity changes during refresh.
- Redact API keys from debug output.
## Testing
Add coverage for both exchange products, malformed metadata, assertion rotation and unauthorized recovery, identity changes, login and workspace restrictions, and CLI login status under both forced login methods.
GitOrigin-RevId: f4fc4da74b86e4a9ae47b28221d3e065500f5b6e
## Why
A model requirement can force `auto_review` even when the requested reviewer is `user`. Persisting or sending that effective value back as an explicit choice loses the original selection, so removing the requirement cannot restore it on resume.
## What changed
- Retain `requested_approvals_reviewer` separately from the effective reviewer in configuration and thread settings, with a fallback for older histories.
- Restore the requested reviewer on resume while applying current model requirements and reviewer allowlists.
- Let ordinary TUI turns, continuations, retries, and forks inherit the server's reviewer instead of echoing its effective value as an explicit request.
- Preserve a worker's requested reviewer when reloading it rather than inheriting the sender's selection.
## Testing
Extend resume coverage for explicit `auto_review`, removal of a model requirement, and a tightened reviewer allowlist. Update TUI assertions for omitted reviewer overrides and verify worker reload preserves its reviewer.
GitOrigin-RevId: d8c9c3a7b89e55e63f0e8ae210d6a87cb5547933
## Why
Uploaded audio always reserved 12,000 tokens per file, even for short clips. This could discard recordings during compaction that would fit within the retained-message budget.
## What changed
- Add optional audio duration metadata to attachments and cache measured durations per session, resolving metadata for new input and replayed history.
- Use measured durations for history estimates and compaction budgets at 10 tokens per second, rounded up and capped at 12,000 tokens. Keep the full budget for missing or unusable metadata.
- Bound metadata lookups to 250 milliseconds per batch with up to eight concurrent requests, and record accepted input before lookup so interruption preserves the batch.
## Testing
Add coverage for duration rounding and fallback estimates, mixed measured and unknown audio, retention through compaction and cold resume, and interruption during metadata lookup.
GitOrigin-RevId: 26fe320c7024944d9d4c371d5fdcda84442b5cc5
## What changed
Track Guardian compaction and review turn execution within each tool's auto-review interval, and expose `critical_path_auto_review_overhead_ms` in turn analytics. This measures the portion of `auto_review_ms` outside observed Guardian turn execution; it is a subset, not an additional duration.
Freeze review observations when the review or tool invocation ends. Report unknown overhead as `null`, including when denial reconsideration runs an unobserved follow-up turn.
## Testing
Add coverage for shared compaction and review observations, cached reviews, unfinished reviews, reused tool call IDs, and execution timing with child critical-path capture enabled or disabled. Extend analytics and app-server tests to check the new field.
GitOrigin-RevId: a63dec2a75571a3167c8c3f0c1d21e11e4a8d050
## What changed
Build a `SandboxExecRequest` before applying backend-specific command wrapping. Extract Linux wrapping into `wrap_linux` and route Windows restricted-token requests through `prepare_legacy_windows_request`. Return unsandboxed requests before preparing native sandbox paths.
GitOrigin-RevId: afe3bcb444c222e9e0af9a556fe580eee074e34c
## Why
Submitted prompts need readable foreground and background colors when the terminal does not report its default colors.
## What changed
- Use a contrasting gray pair for truecolor and 256-color terminals when default colors are unavailable. Keep terminal defaults for 16-color terminals and unknown color support.
- Preserve voice markers, inline element accents, and asynchronous reply code colors when applying prompt styles to native history.
## Testing
Add contrast coverage for each color level and terminal rendering regressions for inline elements and asynchronous reply code colors. Update prompt snapshots to cover the fallback colors.
GitOrigin-RevId: dcda0fc3e2b12a5dc9046322a4d82c61986e3ecd
## What changed
- Support `tui.notification_method = "osc777"` with a `Codex` title and tmux passthrough.
- Replace control characters in OSC notification bodies and escape semicolon delimiters for OSC 777. Limit Ghostty bodies to 255 bytes, preserving UTF-8 boundaries and adding an ellipsis when truncated.
- Remove the 30-grapheme command limit from approval notifications, strip shell wrappers, and describe terminal input and network access requests explicitly.
## Testing
Add coverage for notification method selection, OSC 777 output with and without tmux, control character handling, Ghostty truncation, and approval notification text.
GitOrigin-RevId: e15fa7fdb007c38a148217f6aa0bbcc5e7371f9e
## Why
Reusable clients need fresh authentication for each request while preserving the credential source and transport policy selected when the client was created.
## What changed
- Add runtime-aware backend client construction and per-request authentication. Allow token refresh within the original credential source, reject credential replacement, and validate destination and account/organization selectors.
- Let runtime authentication finish persisting rotated tokens when the requesting task is cancelled.
- Apply asynchronous authentication to file creation and finalization requests, generating fresh assertions while keeping credentials off blob uploads.
- Preserve direct sandbox routing without enabling legacy custom-CA fallback for protected clients that reject redirects.
- Exclude login account metadata from model cache identities when provider bearer credentials override the login, and record authentication selection outcomes and duration.
## Testing
Add regression coverage for credential refresh and replacement, organization selection, destination restrictions, transport policy preservation, cancellation during token rotation, credential stripping on redirects, and file upload authentication in both runtime authentication modes.
GitOrigin-RevId: d045595e869dfcdfd9f705a6228cf0eb4c2d2c12
## Why
Allow remote exec-server registration to use credentials independently of Codex login while retaining the usual local configuration and plugins.
## What changed
- Add `--registration-bearer-stdin` to read one newline-terminated bearer and use it for remote registration.
- Validate the bearer, require HTTPS or HTTP loopback for the registry, and disable process dumpability on Linux before reading the credential.
- Document the option and its distinction from rotating credentials via `--executor-credential-stdin`.
## Testing
Add integration coverage for registration with the supplied bearer across desktop sign-in states, rejection of non-loopback HTTP registries, and restricted process environment access on Linux. Update CLI help snapshots.
GitOrigin-RevId: da99492270c5dc6bb5e0cac41947e9c999a72b75
## What changed
For live, retryable `ResponseStreamDisconnected` errors with HTTP status `429`, replace `Reconnecting... <attempt>` with `Server is busy, reconnecting <attempt>` in the TUI status header.
## Testing
Update the stream recovery test to assert `Server is busy, reconnecting 2/5` and verify that the previous status is restored when streaming resumes.
GitOrigin-RevId: 7fb97f61b856a830565b86ec1bac2ef8608875b8
## What changed
Add `ReviewExecution` observers and an optional `auto_review_overhead` subcomponent to `PathDurations`. Compute overhead by subtracting the union of observed child execution intervals from automatic review time, clipping intervals to the selected path segments and requested window.
Track concurrent and retried submissions, preserve unknown attribution for incomplete or unobserved execution, and allow observations to be sealed against late callbacks.
## Testing
Add unit coverage for overlapping execution, window clipping, human waits, cached reviews, losing parallel paths, canceled submissions, and sealed observations.
GitOrigin-RevId: 73ebe5ed9100a6598f28099ba46cc6d76578d8d9
## What changed
Use the `ignore` crate to snapshot matching files and directories in-process, replacing the external `rg` scan and fallback walker. Remove scanner discovery from MXC sandbox dependency checks.
Keep case-insensitive matching and configured scan depth limits. Skip directory links below the scan root while following explicitly linked roots, and continue past missing or inaccessible entries.
## Testing
Update resolver tests to cover child directory links, linked scan roots, dangling links, and literal brackets in glob patterns.
GitOrigin-RevId: e7f02d4db1fd42958adc212bb54055710fa2e536
## What changed
- Report sampling and compaction separately as `critical_path_sampling_ms` and `critical_path_compaction_ms`, retaining `critical_path_inference_ms` as their combined compatibility total.
- Enable critical path capture for subagent and Guardian turns when `CriticalPathTiming` is enabled, while continuing to exclude memory consolidation sessions.
- Preserve capture across incoming agent messages and support direct `spawn_agent` and `wait_agent` calls. Attribute these calls to the parent's tool time and keep child work on the child's own turn.
## Testing
Add runtime coverage for independent parent/child timing, incoming agent messages, Guardian turns, feature gating, and memory consolidation exclusion. Update phase accounting and analytics tests to cover the new fields and millisecond truncation.
GitOrigin-RevId: 09d4c0b853e817216bed173e4404d0d782de97ec
## What changed
Create an empty `.chatgptcreated` sentinel in each missing deny-path parent directory created by the Windows MXC launcher. Leave existing directories and sentinel contents untouched, including when another process creates a directory first.
Reject deny-path parents that use the reserved `.chatgptcreated` name, accounting for case and trailing dots or spaces, before creating directories. If sentinel creation fails, attempt to remove the newly created directory so preparation can be retried.
## Testing
Extend Windows policy tests to cover sentinel creation, preservation of existing directories and sentinel contents, and rejection of reserved directory names before any parents are created.
GitOrigin-RevId: 640a1f3e05c118cca357643745e0d3b437354ffb
## What changed
Tag untrusted additional context rendered as tool outputs with history metadata and apply `guardian_include_additional_context` when building Guardian review history. Preserve this metadata across session resume and apply the current session's setting to restored review checkpoints.
Keep ordinary tool outputs in review history and preserve the acting model's additional-context payload.
## Testing
Add coverage for inclusion and exclusion after restart, restored checkpoints after compaction, and asynchronous Guardian review. Verify both line and JSON transcripts and check that metadata does not alter the acting model's request.
GitOrigin-RevId: 8ba270a6aac16398c88db3282e9d666702f462fe
## What changed
Add `guardian_include_additional_context` as a stable feature enabled by default, with a corresponding `GuardianIncludeAdditionalContext` enum variant. Document its purpose as including standalone additional-context tool outputs in Guardian review history, and expose the boolean flag in the configuration schema.
GitOrigin-RevId: 505132e5916bd7b3f1d6d80c2219051912ad8271
## Why
Remote compaction did not charge retained file audio against its token budget, allowing audio-heavy history to exceed the intended limit.
## What changed
- Charge file audio using `FILE_AUDIO_TOKENS_ESTIMATE`, independently of image budgeting.
- Retain the newest media content that fits, keeping images and audio together with their adjacent labels and preserving content annotations. Stop at oversized media instead of backfilling older content.
- Share media-label detection with user-input event mapping.
- Add download timeouts and a Debian mirror fallback for the musl build's `libcap` source archive.
## Testing
Add unit coverage for audio budgeting in both image-budget modes, atomic media labels, and truncation boundaries. Add integration coverage showing that compaction retains the newest five of seven file-audio items within the retained-message budget, including a mixed-media case.
GitOrigin-RevId: 4b7cd69f53966461fdeec14096712671d480187b
## Why
Uploaded audio was rejected even for audio-capable models. Invalid or expired recordings also need to be excluded from later requests so users can continue the conversation.
## What changed
- Accept uploaded audio when the selected model supports audio; otherwise, preserve valid sibling input and report the unsupported attachment before inference.
- Track successful audio decoding by model and provider, and attribute provider rejections against the exact submitted request. Preserve attachments when attribution is ambiguous.
- Persist confirmed rejected file IDs across compaction and resume, omitting them from future requests without rewriting retained user history.
- Check audio availability before remote compaction and retry once without an unambiguously rejected recording. Include guidance to remove or replace affected attachments in audio errors.
## Testing
Add unit and scenario coverage for uploaded audio across follow-up turns, compaction, cold and paginated resume, model switching, ambiguous rejections, expired files, and queued or interrupted input.
GitOrigin-RevId: e701901e7b1c0865c9f2a5918197215f549b06c0
## What changed
Use `resolve_for_enforcement` when preparing Windows restricted-token and elevated sandbox overrides, preserving read-only carveouts at volume roots. Expand deny-read ACL targets from the resolved permissions.
Use the same resolution in MXC policy preparation when volume roots do not require materialization, while retaining special handling for symbolic root denies.
## Testing
Add regression coverage for read-only carveouts in a volume-root workspace. Extend the Windows package smoke test to verify that a helper-created log matching a deny glob cannot be read while a neighboring allowed file remains readable.
GitOrigin-RevId: cee0834444464b3a7b0c8dbeecb8abcd5828b4b0
## What changed
- Resolve Linux sandbox test binaries with `cargo_bin` and canonicalize the helper path used by the managed proxy filesystem policy so Bubblewrap can re-execute it.
- Restrict the rollout ownership test to supplementary groups mapped in the Linux user namespace, skipping when no alternate group is available.
- Exclude `gstcoreelements.dll` from the Windows startup-only voice fixture so handshakes succeed while runtime initialization still fails for missing plugins.
GitOrigin-RevId: 618376705c49d6ee3eea09f0d089b2eff4623fd2
## What changed
Map provider `budget_reached` errors to `SessionBudgetExceeded` for HTTP 400 responses and streaming failures. End SSE streams immediately on this error, ignoring retry headers and later completion events, and display `budget reached` in the TUI.
## Testing
Add coverage for HTTP error classification, immediate SSE termination without retries, WebSocket error delivery and subsequent request recovery, and TUI error rendering and task-state cleanup.
GitOrigin-RevId: 6a62d699cdb9cb446214cacfacd0c9ed68bf21a6
## Why
Parent input can change authorization while a Guardian assessment is in flight. A denial based on stale context must be retried, just as an approval is, so newly granted authorization can take effect.
## What changed
Revalidate both verdicts before publishing reviewer checkpoints or recording failed-review records. Discard invalidated assessments so they do not persist in reviewer history or count toward the denial limit.
## Testing
Extend authorization-refresh regression coverage for approval arriving during a denial and repeated stale denials. Verify refreshed reviews omit invalidated assessments and stale denials produce neither denial-limit errors nor failed-review records.
GitOrigin-RevId: c699178bc3b5e2d8b075279b00967a4e09fc533c
Update the reviewer configuration test to call
`ManagedFeatures::from_configured_with_warnings` and pass
`parent_config.startup_warnings`, avoiding the crate-private
`from_configured` constructor.
GitOrigin-RevId: 2ba41ba6918e1007b3af013b7146940d919e4560
## What changed
- Add configurable `focus_main_composer` and `focus_sidebar_content` actions, with default `leader c` and `leader s` bindings in workspace mode.
- Let users return to the main composer while keeping the side pane open, or focus the side conversation and hide it when already focused.
- Clear transcript search, selection, and activity focus when returning to the main composer, including when hiding the side pane.
## Testing
Extend tests for focus switching, blocked thread switches, offline composer focus, key capture, and binding conflicts.
GitOrigin-RevId: da624ce7e00a63c4f13870e55c4bc95f09b32cc4
## What changed
Expose `add_user_message` for plain-text input using the existing thread configuration, with explicit `StartIfIdle`, `Steer`, and `Queue` modes and typed admission outcomes. Expose `interrupt_turn` to interrupt a specific turn without removing queued input.
Distinguish local validation failures from unknown remote outcomes, require successful final gRPC status, and avoid automatic retries. Preserve client message identity and raw admission payloads; report duplicate admissions by original turn ID without implying current lifecycle status.
Document reconciliation requirements and extend the attach example to submit an optional message while draining events.
## Testing
Add wire-fixture tests for admission variants, request encoding, malformed responses, local validation, redacted diagnostics, uncertain RPC outcomes, final gRPC status requirements, and dropping pending submissions without retrying or interrupting.
GitOrigin-RevId: 1def92de3fc5ca8c1f89431b7ea29b9b80d64600
## What changed
Add `SavedDaybreakChoice` and `ModelAccessPrograms::select_saved` to resolve an optional saved preference. Enabled selects an advertised Daybreak program, disabled selects an advertised standard program, and unset or unsupported choices return `None`.
## Testing
Extend selection tests to cover enabled, disabled, and unset preferences across advertised program combinations, preserving the preference for Daybreak Blue over Red.
GitOrigin-RevId: 1c7ab3fe1d3a48ad64519bfedfe27de90838516c
## What changed
- Share a lazily registered runtime across threads, model discovery, and extension clients when `runtime_agent_instances` is enabled, while honoring each thread's authentication mode and credential owner.
- Bind model catalogs to the effective provider and authentication context while preserving cache policy and live API-key discovery settings.
- Resolve credentials, routing, and transport policy together for each request. Preserve proxy and TLS settings, validate runtime account selectors, and prevent pooled connections from crossing runtime identities.
- Accept supported ChatGPT subdomains when selecting the registration environment.
## Testing
Add integration coverage for shared runtime registration, dual-header and assertion-only modes, disabled and third-party providers, credential replacement, subagents, and delegated review. Add coverage for catalog cache policy and runtime-aware connection reuse.
GitOrigin-RevId: 99dd9d987c29c93597a648f6586f98ac6a932c3c
## What changed
Move permanent agent message board deletion from `codex-core` into the app server's thread-store cleanup callback. Keep board cleanup active when the board feature is disabled, and run it before optional Guardian evidence-board cleanup.
Remove the message board extension dependency from `codex-core` and retain `codex-message-board` only as a development dependency. Update the core test harness to install the app server's cleanup callback.
GitOrigin-RevId: 61813bbdcd8b57073b8c249e1f771e3fb0ea061e
## What changed
Move the board host adapter and `install_agent_message_board` from `codex-core` to `codex-app-server`, using public core runtime interfaces. Update extension registration, test callers, dependencies, and installation documentation to use the new location.
Format `CHANNEL_POST` notification payloads in the host adapter and retain recognition of legacy board notices in core. Expose `MULTI_AGENT_V2_NAMESPACE_DESCRIPTION` for host extensions to share with native tools.
GitOrigin-RevId: 679b5751de102bff80e6b9d4b0728a84fbdedd85
ioanbudea-OAI