## What changed
- Emit started and completed collaboration tool events for multi-agent v2
`spawn_agent` calls, including failed invocations.
- Record execution duration and successful child-agent configuration metadata
without including the spawn prompt.
- Deduplicate collaboration and subagent activity items by call ID when
calculating per-turn subagent tool counts.
## Testing
- Extend the app-server multi-agent v2 integration test to cover successful
and failed spawn telemetry, duration, prompt omission, and turn counts.
GitOrigin-RevId: c1c2fb9cc2a1a9b0f63ef68509ad36d11a92d1e5
## What changed
- Add `in_app_browser.allow_external_browser_settings_import` to managed requirements, preserving explicit Boolean values through layered composition while leaving an omitted value unset.
- Return the policy as `inAppBrowser.allowExternalBrowserSettingsImport` from `configRequirements/read` and include it in the generated protocol schemas.
- Keep the import policy independent from the in-app browser feature flag and agent Browser Use requirements.
## Testing
- Cover parsing, managed-layer precedence, invalid values, user and session override resistance, and app-server response serialization.
GitOrigin-RevId: efa2621d2b1cf503f1bee2505d9914cb4fb7221d
## Why
Unsupported untrusted approval policies must remain startup errors even when
app-server is allowed to fall back from other invalid configuration. Likewise,
compound command summaries must not discard a `sed` stage that can edit files
in place.
## What changed
- Propagate `UnsupportedUntrustedApprovalPolicyError` from both app-server
configuration loads instead of replacing it with default configuration.
- Parse `sed` options through `--`, option arguments, combined short flags, and
backup suffixes so `-i`/`--in-place` commands remain unknown actions.
- Keep non-mutating `sed` operands after `--` from being mistaken for flags.
## Testing
Added parser coverage for in-place `sed` variants in compound commands and for
dash-prefixed operands after `--`.
GitOrigin-RevId: 112ead912e10fcb6c7dd0ede4bf84e390af82da8
## Why
An `apply_patch` path can be replaced with a symlink after verification, allowing an unsandboxed patch operation to reach a different file than the one that was approved.
## What changed
- Add `follow_symlinks` options to executor filesystem reads, writes, metadata lookups, directory creation, and removal, including the corresponding `followSymlinks` protocol fields.
- Implement no-follow filesystem operations on Unix and Windows that reject links in any path component and restrict file access to regular files.
- Run `apply_patch` with symlink traversal disabled when an otherwise-required sandbox is bypassed, while retaining the existing follow-symlink default for standalone callers.
## Testing
- Cover leaf and ancestor symlinks across patch add, update, delete, and move operations, including a path swap after verification.
- Exercise local and remote no-follow filesystem behavior, concurrent directory creation, special-file rejection, and Windows reparse points.
GitOrigin-RevId: 43fd479084891493ce13564fbd894b98f329c6dd
## What changed
- Allow the Guardian V2 approval monitor to handle reviews for models that require automatic review.
- Preserve full Guardian review when Guardian V2 is disabled by configuration or managed requirements.
- Cover required-model routing for low- and high-risk actions, plus both Guardian V2 disable paths.
GitOrigin-RevId: d1201cc3dbd7c4a07de633388b14f17ada9feb39
## Why
Project instructions must respect the selected environment's filesystem read
permissions. Tightening those permissions for a later turn must not allow
previously cached instructions to reach the model.
## What changed
- Apply each environment's filesystem sandbox while discovering and reading
`AGENTS.md` files.
- Fail thread or turn setup when sandboxing blocks a discovered instruction
file, while allowing a restricted project with no instructions to start.
- Clear cached instructions before refresh and include the Windows sandbox
level in the cache key.
- Ignore inaccessible ancestor marker probes so readable instructions in the
selected working directory can still load.
## Testing
Added coverage for restricted projects, denied instruction files, cache
invalidation after permissions tighten, and unreadable ancestor markers.
GitOrigin-RevId: 6ea1a27b9c873a6260e4f87d42ae1317a6a4ae4b
## Why
Model provider configuration could override the residency header required by
`enforce_residency`, so provider-backed requests did not reliably honor the
managed setting.
## What changed
- Apply the managed residency header after building a provider, making it
authoritative for model requests and model discovery.
- Warn when a provider configures the residency header through
`http_headers` or `env_http_headers`, while preserving the original provider
configuration and unrelated headers.
- Cover HTTP and WebSocket requests, model discovery, and case-insensitive
header detection with targeted tests.
GitOrigin-RevId: 461ef8989d5bd06ffdea694aee4265e392e07590
## What changed
- Remove `untrusted` from the CLI, configuration schema, and MCP tool interface. Explicit `approval_policy = "untrusted"` settings now fail with an actionable error.
- Remove the known-safe command allowlist. Projects marked untrusted now request approval for every command unless an explicit exec policy rule allows it.
- Keep command parsing conservative by treating in-place `sed` forms as mutating and ignoring unrecognized commands when recording memory usage.
## Testing
- Cover rejection of the retired configuration value and approval requests for commands in untrusted projects.
GitOrigin-RevId: d6bf425edddfffbb325eee6acf383434af5fd33b
## Why
The Linux sandbox represents missing protected metadata paths such as `.git`
with empty read-only directories. Repository and project discovery treated any
`.git` directory as a checkout root, so this synthetic directory could hide a
real parent repository and its trust configuration.
## What changed
- Treat a `.git` directory as repository metadata only when it contains
`HEAD`, while continuing to recognize file-based `.git` entries.
- Protect missing `.git` paths with the same read-only synthetic mounts as
other workspace metadata without disrupting parent-repository discovery.
- Canonicalize and read-only bind the synthetic-mount registry into the
sandbox, and make protected-path cleanup handle read-only directory trees.
## Testing
Added coverage for repository, project-root, trust, synthetic-mount, and
Landlock behavior, including nested incomplete `.git` directories and a
redirected `TMPDIR`.
GitOrigin-RevId: 0724c54d56531143bb28011e4ca414cd3b0212be
## Why
A checkout could point its `.git` file at a trusted repository's worktree
directory without proving that the repository had registered that checkout.
This could cause project configuration from an unrelated checkout to be treated
as trusted.
## What changed
- Verify the linked worktree's `gitdir` backlink, `commondir`, registered
checkout, and main checkout ownership before resolving the main repository's
trust key.
- Reject missing, oversized, symlinked, mismatched, or swapped Git metadata.
- Preserve valid linked worktrees that use path aliases, separate Git
directories, or non-UTF-8 POSIX paths.
## Testing
Add resolver and config-loading coverage for forged worktrees, metadata races,
case-sensitive paths, moved worktrees, and host MCP startup from project config.
GitOrigin-RevId: 6052a7d10ad2d613436f20175c356abdef8c758e
## Why
An authorization server discovered for an MCP server can change. A stored refresh token must not be sent to a different issuer than the one that originally granted it.
## What changed
- Persist the discovered authorization server issuer with new OAuth credentials and preserve it across refreshes.
- Validate that issuer against a single pinned metadata snapshot before refreshing or adopting stored refresh credentials.
- Require reauthentication when refresh credentials have no issuer or the issuer changed. An unexpired access token can still be used without exposing its refresh token.
## Testing
Add coverage for issuer persistence, missing and changed issuers, metadata changes during startup, and refresh-token preservation.
GitOrigin-RevId: 07e48ba892f627428a28bbed5cca4ad703e2a5fd
## What changed
- Add a `test_threads` option to `codex_rust_crate` that sets
`RUST_TEST_THREADS` for sharded integration tests when configured.
- Run the `core` and `app-server` Bazel integration tests with one Rust test
thread on macOS, leaving the thread count unchanged on other platforms.
GitOrigin-RevId: 118147413eb141f557d9ee82858860617d61acce
## Why
Environment-owned permission profiles and workspace roots must remain effective
without being persisted or restored as thread-owned settings.
## What changed
- Keep thread settings snapshots and restore data separate from the effective
configuration supplied by the primary environment.
- Use resolved environment permissions, active profiles, workspace roots, and
network policy when building turn context and session events.
- Preserve environment selections when agents are evicted, resumed, or spawned,
and validate owner configuration when it becomes ready.
- Start memory initialization only after the primary environment is configured.
## Testing
- Extend remote-environment and multi-agent tests to cover settings persistence,
owner permission profiles, workspace roots, spawning, eviction, and resume.
GitOrigin-RevId: d82f126981cd0190233020bbdd61d96c70558868
## What changed
- Stop writing `last_updated` and `last_revision` to marketplace entries in
`config.toml`; keep the activated revision in
`.codex-marketplace-install.json` instead.
- Use installed marketplace metadata to detect up-to-date checkouts.
- Snapshot the installed marketplace before activation and roll back a stale
upgrade if another installation changed the destination concurrently.
## Testing
- Verify marketplace add and upgrade operations leave `config.toml` unchanged.
- Cover restoring a newer concurrently installed marketplace when a stale
activation is rejected.
GitOrigin-RevId: 10942c3fc7c6c3f68b7d5953e8c1b5e86bf71866
## Why
New non-ephemeral threads have no persisted rollout or preview until their first
turn, so moving them into a section could leave them absent from section-filtered
thread lists.
## What changed
- Materialize and flush a non-ephemeral thread before applying an explicit
section move.
- Include explicitly sectioned threads with empty previews in section-filtered
queries, and update the partial indexes to cover them.
## Testing
- Add an app-server test that moves a newly started thread into and out of the
pinned section before its first turn.
- Cover empty-preview threads in recency and section-position query tests.
GitOrigin-RevId: aa3c4daf9890f06c08b93cd60f146099cbc6cfb2
## Why
Background marketplace and plugin refreshes can otherwise inherit repository-local or command-scoped Git configuration from the project that launched Codex. That configuration can redirect remotes or invoke Git helpers during an automatic operation.
## What changed
- Run automatic marketplace upgrades, plugin cache refreshes, and curated marketplace lookups with repository-scoped Git environment variables removed and a temporary trusted repository under the Codex home.
- Carry the automatic/manual trust mode through marketplace upgrades and plugin materialization.
- Preserve the caller's Git configuration for explicit marketplace upgrades, plugin installs, and refreshes.
## Testing
- Add regression coverage for repository URL rewrites, protocol helpers, command-scoped configuration, and manual Git filters.
GitOrigin-RevId: 957f45fa3bd7ce7e1b83355f276cf65dc5e99c8e
## What changed
- Emit `codex_control_tool_call_event` for built-in control tools such as
`request_user_input`, `update_plan`, `view_image`, and goal tools.
- Record correlation and timing metadata plus completed, failed, rejected, or
interrupted outcomes, and include these calls in turn-level tool counts.
- Keep tool arguments out of control-tool analytics events.
## Testing
- Extend the app-server turn profile test to cover successful and failed
control tools, event correlation, turn counts, and argument exclusion.
GitOrigin-RevId: c20f73dfb79654e31b4b5040eddb0e0d91cae10d
## What changed
- Move the Guardian thread lifecycle contributor and subagent-spawn context into `codex-guardian-v2`.
- Install the lifecycle contributor and asynchronous risk scorer through a single extension entry point.
- Remove the redundant `codex-guardian` crate and group the existing scorer implementation under `async_scorer`.
GitOrigin-RevId: 97141190c843e588b8c09c9ccd3fe00e1fae39a4
## What changed
- Add environment-provided MCP restrictions for configured and plugin-provided servers.
- Disable attachment-scoped servers while their environment configuration is pending, failed, or unselected, while preserving selected-plugin access and the controller-owned Apps server.
- Apply the resolved policy to runtime startup, model tool exposure, telemetry, OAuth flows, and skill dependency installation.
## Testing
- Cover policy filtering for configured and plugin servers, environment state transitions, Apps ownership, and managed OAuth rejection.
GitOrigin-RevId: 7ca5d4dda14068e758497f88835d5cba685e159e
## What changed
- Recognize `edu_plus` and `edu_pro` as distinct education workspace plans across authentication, backend rate-limit mapping, and app-server account schemas.
- Include both plans in cloud configuration eligibility and use the education usage-limit behavior.
- Display the plans as `Edu Plus` and `Edu Pro` in the TUI status view.
## Testing
- Cover parsing, workspace classification, account and rate-limit responses, cloud configuration eligibility, usage-limit messages, and TUI display names for the new variants.
GitOrigin-RevId: bf8add780ae03a3c6d10c4f4afa0da262c37928e
## What changed
- Add an optional `delivery` field to agent message events and app-server
`agentMessage` items, with `"async"` identifying a user-visible message sent
without ending the current turn.
- Preserve the marker through legacy event conversion, thread history
materialization, replay, and generated JSON and TypeScript schemas.
- Require delivery of async agent message completion notifications on the
in-process app-server transport.
## Testing
- Cover preservation of async delivery metadata in thread history.
- Cover delivery-required classification for async agent messages.
GitOrigin-RevId: f92ba25de1293ee271404badfdf0d117d6530329
## What changed
- Carry selected plugin identities from MCP discovery into per-turn extension data, limited to capability roots that are ready for the turn.
- Annotate executor skill catalog entries with the matching plugin ID and `user` scope.
- Include that attribution in `skill_invocation` analytics for both explicit and implicit executor skill invocations.
## Testing
- Extend the executor skills app-server test to verify plugin ID, skill scope, and invocation type for explicit and implicit analytics events.
GitOrigin-RevId: 9345600ae29bcb8eb894fffd2d6f7b05f22ebf74
## What changed
- Include legacy managed-file and MDM settings when resolving project root markers and project trust in both canonical and executor-local config loads.
- Preserve the existing managed-layer precedence in the final config stack and resolve managed relative paths against the same bases used by the final loader.
- Update explicit-untrusted warnings to describe the effective configuration and direct users to an administrator when the setting is managed.
## Testing
- Cover managed root markers, managed trust overrides, MDM precedence, app-server config reads, and the remote TUI warning.
GitOrigin-RevId: 9b5ddd54b4530f73589d6842a15cbab7e6d6bbb9
## What changed
- Stop writing Guardian v2 security risk scores to rollout history.
- Treat resumed and forked threads as having no previous Guardian score, so their
first tool approval is classified and reviewed normally.
- Remove the now-unused `codex-history` dependency from the Guardian v2
extension.
## Testing
- Update app-server coverage for new, resumed, and forked threads to wait for
classification completion and verify the expected approval reviews.
GitOrigin-RevId: 74d9caa903a1ff9d38e577b4697b5f8970f11ebb
## What changed
- Execute `mcp_tool` hook handlers through the session's shared MCP runtime, including managed hook configurations.
- Restrict hook calls to already-connected, cataloged, and policy-allowed tools. Unavailable servers fail immediately without starting or reconnecting them.
- Pass session metadata to hook tools, cap hook timeouts by the server timeout, and invoke hooks without model-tool approval or recursive hook dispatch.
- Record handler type and execution mode in hook telemetry, and mark memory as externally influenced after successful or blocking MCP hooks when configured.
## Testing
- Added end-to-end coverage for prompt interpolation, hidden tools, blocking decisions, unavailable servers, thread metadata, approval bypass, and memory-mode handling.
- Added MCP runtime coverage for startup readiness, tool filters, catalog revisions, and managed connector policy.
GitOrigin-RevId: 1647cb801ebc5fa385c7bda9d9c266a389c611b8
## Why
`codex-http-client` is the intended owner of `reqwest`, while direct first-party
dependencies are tracked as migration debt.
## What changed
- Build app-server test HTTP clients through `HttpClientBuilder`.
- Use `http` and `url` types directly where only protocol types are needed.
- Remove `reqwest` from `codex-app-server` and its temporary dependency-policy
exception.
GitOrigin-RevId: ff9f14a54bc20ec1ea39050bbe08c381ee376119
## Why
Submitting a diagnostic report could appear successful without confirming that Sentry accepted the upload, leaving callers unable to detect transport or HTTP failures.
## What changed
- Send report envelopes through the route-aware HTTP client and await the response.
- Reject redirects, propagate transport and non-success HTTP responses, and include the full error chain in upload JSON-RPC errors.
- Add structured logs for upload attempts, successes, and failures without including report contents.
## Testing
Added coverage for successful uploads, rejected responses, blocked redirects, transport failures, and app-server JSON-RPC error reporting.
GitOrigin-RevId: 07b5cfccd7a65f35d51a720537d2cd8962ed6cdb
## What changed
- Add experimental `account/bedrock/discover` and `account/bedrock/setup`
requests to the app-server protocol.
- Define discovery results for AWS profiles and environment credentials, plus
setup inputs for profiles, environment credentials, and access keys.
- Export the new types in the experimental protocol schema. The app server
currently returns `method not found` for both requests because setup is not
yet implemented.
GitOrigin-RevId: 656b4bc11231a417e97041068cecc5dc692786e3
## What changed
- Replace the minimal default classifier prompt with predictive security-review guidance covering authorization, action risk, untrusted evidence, and browser or computer use.
- Trigger full Guardian review at an `action_risk` score of `0.5` or higher for the new default prompt, while retaining the `0.8` calibration for custom and model-provided prompts unless they specify a threshold.
- Render security policy configuration into prompt templates before enforcing the classifier instruction token limit. Prompts without the policy placeholder retain the existing append-and-truncate behavior.
## Testing
- Cover default, custom, and model-provided prompt thresholds and precedence.
- Verify policy substitution, truncation, sampling requests, and full review at the threshold boundary.
GitOrigin-RevId: 7aad9e2d8c9fbea453dc52147a3d0a46bf191aec
## What changed
- Add an optional `connectorId` to `mcpServer/resource/read`.
- Forward the selected connector through `x-codex-turn-metadata` for threaded and threadless resource reads, restricting hosted app resources to that connector.
- Update the generated protocol schemas and app-server documentation.
GitOrigin-RevId: 5cc94d703abbbb6086665910c1c9ed5dc7075210
## Why
Repository-scoped imports must not follow redirected Codex paths and write
generated configuration outside the repository.
## What changed
- Reject repository migration scopes when generated configuration paths are
symlinks or, on Windows, reparse points.
- Recheck hook and subagent destinations during import, skipping redirected
directories, files, and dangling links without reporting them as imported.
## Testing
Add service and app-server coverage for redirected generated destinations,
including a repository path replaced with a symlink after detection.
GitOrigin-RevId: 3afb521ead9d76250f0e967eccfdd1dc194f027a
## Why
Compaction can remove the tool-call events that associate an MCP app widget with
the tool, account, and URI needed to authorize later resource reads.
## What changed
- Store a bounded MCP resource-origin checkpoint with each compacted rollout.
- Restore the checkpoint when resuming a session so existing widgets remain
readable after compaction and restart.
- Discard saved origins when rollback rewrites history across the compaction
boundary, and reject oversized or invalid checkpoints during restoration.
## Testing
- Extend the app-server MCP resource-origin test to compact a paginated thread,
continue the conversation, and read the original widgets before and after a
restart.
- Verify rollback clears provenance that no longer matches retained history.
GitOrigin-RevId: 7f91c6202fe8d9be21c78dda42fa205937c44263
## Why
App widgets need to read resources using the app and account context of the
tool call that produced them, including after a thread is restored.
## What changed
- Add an optional `originCallId` to `mcpServer/resource/read` requests and
return it on successful scoped reads.
- Track bounded provenance for successful app tool calls in thread history and
use the current tool binding, account link, and app policy when reading the
associated widget resource.
- Reject missing, mismatched, failed, or ambiguous origins, while keeping
app-only tools available for widget reads without exposing them to the model.
## Testing
Add app-server coverage for scoped widget reads across both history modes,
ephemeral and persistent threads, server restarts, app-only visibility, and
invalid origin cases.
GitOrigin-RevId: 11eaefc066b2a3b639599e4cbdef680233d150a2
## Why
Repository manifests and user-configured sources must not be able to claim names reserved for managed or remote marketplaces.
## What changed
- Reject reserved marketplace names from unmanaged sources during discovery, installation, configuration projection, and configured marketplace upgrades, even when source restrictions are disabled.
- Recognize managed marketplaces only at their expected paths. Preserve the required macOS and Windows path equivalences without allowing symlink aliases to inherit managed provenance.
## Testing
- Cover reserved-name rejection for plugin list and install RPCs, configured upgrades, unrestricted policy, and remote marketplace names.
- Cover symlink spoofing and Windows managed-path normalization.
GitOrigin-RevId: a610bdc382857f306dd3e244f0992de2ec279673
## What changed
- Add the experimental `autoApprovalReview/strictReviewRequired` app-server notification with the review's `threadId`, `turnId`, and `startedAtMs`.
- Emit it when Guardian v2 leaves an approval review in progress because the action risk is elevated or its score is stale.
- Export the notification through the Rust, TypeScript, and JSON schema surfaces and route it to the associated thread.
## Testing
- Cover strict-review reason tracking for elevated and stale risk scores.
- Verify that high-risk approval routing emits one notification whose identifiers and timestamp match the review-started event.
GitOrigin-RevId: e65352894520bfb756c75b2c95e2e149f9767bb2
## Why
Cold resumes and forks could lose the thread's active permission profile and
fall back to the current configured default.
## What changed
- Restore the latest persisted approval policy, approvals reviewer, and active
permission-profile ID when resuming or forking a thread.
- Re-resolve persisted profile IDs through current configuration and
requirements. Missing or invalid profiles fall back to the configured
default, while threads without a persisted profile continue to use current
configuration.
- Keep explicit permission and approval overrides ahead of persisted settings.
## Testing
Added coverage for legacy and paginated histories, settings updates, explicit
overrides, removed or changed profiles, requirement fallbacks, and forks.
GitOrigin-RevId: 2289af2f3206bf131a6ffe0e8447e8d402e76c47
## What changed
- Add a shared helper for recovering the latest persisted approvals reviewer from turn context and thread settings history.
- Use the helper when resuming and forking threads while continuing to honor explicit request overrides.
- Fall back to an older persisted reviewer when the latest turn context omits the field.
## Testing
- Add unit coverage for settings snapshot precedence, turn context precedence, and fallback to an older reviewer.
GitOrigin-RevId: dfc0332b0f1410a4c9a550236eb32624f5133baa
## What changed
- Add the optional `active_permission_profile` field to `TurnContextItem` to record the built-in or named profile that produced the effective permission profile.
- Populate the field when serializing a turn context while preserving compatibility with records where it is absent.
## Testing
- Add coverage verifying that turn-context serialization stores the active permission profile.
GitOrigin-RevId: d69142ab1b26595ab406235f89818ef41370e963
## What changed
- Fetch recommendations from the Codex-specific `/ps/plugins/suggested/codex` endpoint and parse its compact response shape.
- Fetch the selected plugin's details before presenting an install request, using them to verify availability and populate connector metadata.
- Skip install elicitation when the selected recommendation is no longer available, and return a retryable response when its metadata cannot be verified.
## Testing
- Cover the new recommendation route and response shape.
- Cover metadata hydration for available plugins and rejection of unavailable plugins.
GitOrigin-RevId: 2b0e2d70572aae2b7cd8e458b42e9dd14be3dbaf
## Why
App-server response diagnostics can include access tokens returned by the ChatGPT auth refresh flow.
## What changed
- Log successfully parsed server responses instead of raw JSON-RPC response payloads.
- Redact `access_token` from the `Debug` representation of `ChatgptAuthTokensRefreshResponse`.
- Avoid formatting callback send errors that can retain the original response payload.
GitOrigin-RevId: fd47485b38ed89527b25937c759b3273581f6ae6
## What changed
- Remove `experimental_thread_config_endpoint` from the configuration model and schema.
- Stop app-server and the in-process client from constructing a remote thread config loader from local configuration.
- Keep the thread config loader supplied at app-server startup fixed for the lifetime of the config manager.
GitOrigin-RevId: e7907fee2d631e7ecf89ec6bac8f22bc2c221350
## What changed
- Give `PluginsManager` a shared `AuthManager` instead of a separately mutable authentication-mode snapshot.
- Read the current authentication mode and credentials from that shared manager for plugin discovery, startup tasks, CLI commands, MCP setup, and external-agent migration.
- Update test helpers and coverage to exercise plugin projections and curated marketplace selection as authentication changes.
GitOrigin-RevId: 600c94de5130eda2da5727e1a0b4d39083fefc56
## What changed
Gate plugin hook resolution in `hooks/list` on both the hooks and plugins
feature flags. When hooks are disabled, return the default empty plugin hook
outcome without loading plugin hook sources or warnings.
GitOrigin-RevId: 166070576effaba248b790c4f2a47e6e9a7b1112
## What changed
- Add `cli_auth_credentials_store` and `chatgpt_base_url` as exact managed requirements loaded from local requirements configuration.
- Apply these requirements to runtime and bootstrap authentication configuration, overriding user-configured values.
- Expose the managed values through `configRequirements/read` and reject attempts to change them through config write APIs.
- Ignore these local-only authentication requirements in cloud-managed requirement layers.
## Testing
- Cover requirement loading and composition, runtime and bootstrap overrides, app-server responses, and read-only config writes.
GitOrigin-RevId: 8ea9c096386072036ca5441f3d48af8707988a65
## Why
Unified exec could drop network approval registration when a selected environment used a Windows working directory on a non-Windows host because the trigger path could not be converted to a host absolute path.
## What changed
- Keep network approval trigger working directories as `PathUri` values and render them with their inferred native path syntax for Guardian requests.
- Fall back to the selected turn environment only when a trigger path can be converted to a host absolute path.
- Reject selected environment working directories larger than 8 KiB at the thread-manager validation boundary.
## Testing
- Cover managed-network approval registration for a foreign Windows working directory.
- Verify that oversized working directories are rejected as invalid `thread/start` requests.
GitOrigin-RevId: 646fbf12115a35a7e5cb04b511464797bee6647b
## Why
Resumed and forked threads need their persisted Guardian risk state available when routing later approval requests.
## What changed
- Initialize a session's `SecurityRiskScore` from the latest score in its rollout history when no score was supplied explicitly.
- Preserve the inherited score when resuming or forking a thread so low-risk actions can skip redundant Guardian reviews.
## Testing
- Add app-server coverage for inheriting the latest Guardian score when resuming and forking threads.
GitOrigin-RevId: 95a6c803f8dae75516d1da9d66a722379a0a7ef2
## Why
Config reads arriving while a long-running shared read was active waited for that
request to finish, even though they could safely run concurrently.
## What changed
- Admit newly queued shared reads into the active batch until an exclusive write
is queued, preserving the write as a fairness barrier.
- Treat `hooks/list` and `configRequirements/read` as shared config reads.
- Cover concurrent reads, read/write ordering, and config reads completing
alongside a `skills/list` request.
GitOrigin-RevId: 8194301c2ba60be0fc71b8915923af9accc745dc
## What changed
- Add end-to-end app-server tests for MCP tool approvals with Guardian V2 and automatic review enabled.
- Verify that sampling receives the thread context, uses a thread-scoped prompt cache key, and persists the resulting action risk score.
- Cover both routing outcomes: low-risk actions skip later Guardian reviews, while high-risk actions continue through full review.
GitOrigin-RevId: 78ba2b0560caf701ad333785c4dda4f7d2be4f2c
## What changed
- Track app-server turn lifecycle events for OpenAI API-key sessions when OTLP telemetry export is enabled.
- Query the turn-cost endpoint after completed or aborted turns and emit `codex.turn_cost` with the estimated USD cost, interruption state, model, speed, and reasoning effort.
- Preserve provider organization and project headers, wait for all observed responses to be priced, and retry pending or transiently failed queries with bounded tracking.
- Re-probe availability after authentication changes and shut the worker down with other app-server background tasks.
## Testing
- Cover late API-key login, transient probe failures, telemetry after thread removal, and turns with multiple responses.
- Verify turn-cost requests use API-key authentication and provider scope headers and deserialize priced response data.
GitOrigin-RevId: a303162a54798b554fcb2e9e2b372e1cf9f49f39
