## What changed
Add `codex queue --resume` to resume an unloaded thread after queueing a message through the local daemon or selected `--remote` server. Already loaded threads are left running. If resumption fails, emit a warning while preserving the successful queue result.
Read only the thread status when checking whether to resume, allowing remote metadata to contain paths from another operating system.
## Testing
Extend CLI integration coverage for unloaded threads consuming queued messages, archived thread rejection, and successful queueing when another server owns the thread and rejects resumption.
GitOrigin-RevId: cc8aa3c11a37e990da36e6ff9a17934f73322e7b
## What changed
Remove unused pending initial-yield state and its plumbing from cell completion handling. Route completion delivery through `send_cell_event`, retaining the completion event and original timestamp when an observer has disconnected.
## Testing
Extend `failed_completion_delivery_rebuffers_the_event` to verify that failed delivery attempts preserve output and report the full elapsed buffering duration on a later successful observation.
GitOrigin-RevId: eebe990a4f8258f1ccb12d0694945678f0cc3a8f
## Why
Pairing can take up to 30 seconds in the daemon, but the client used a two-second timeout when waiting for each response message.
## What changed
Apply a single 35-second deadline to `start_pairing`, including connection and initialization. Wait for the pairing response without a per-message timeout so status notifications cannot extend the overall deadline. Preserve the existing per-message timeout for other remote control requests.
## Testing
Extend the manual pairing test with a three-second response delay and add coverage verifying that a status notification does not reset the pairing deadline.
GitOrigin-RevId: c011fd131262b30baa21e17bc0e0f733dce53fb0
## Why
A running turn can record stale permissions after the thread accepts a settings update. Resuming or forking from that history should preserve the accepted approval and permission settings.
## What changed
- Prefer settings snapshots owned by the source thread over stale turn contexts, including later legacy updates associated with that thread's checkpoint.
- Restore unnamed permission profiles from attributable settings updates while honoring explicit request overrides. Avoid restoring raw permission grants from history without an identifiable owner.
- Share permission restoration logic between resume and fork.
## Testing
Add regression coverage for stale turn contexts, legacy updates across thread ownership boundaries, and unnamed permission restoration on resume and fork.
GitOrigin-RevId: 450bc1688be78c7ec685f6dc56bcc5e5dd2d130a
## Why
NFS database migration rejected files with group or other access. Allow accessible databases to migrate while making the effects on file access explicit.
## What changed
- Preserve file mode bits during migration while requiring owner read and write permissions on replacement files.
- Before CLI consent, disclose that replacements belong to the current user and do not copy the original owner, group, or extended ACLs. Require explicit confirmation for files with permissions other than `0600`.
- Warn at Linux TUI startup when NFS databases need migration and permission confirmation. Inspect journal mode without accessing WAL shared memory or releasing another connection's locks.
- Allow five seconds to acquire the exclusive database lock during migration.
## Testing
Add CLI coverage for consent, access disclosures, and migration of `0644` files. Extend state tests for permission preservation, rejection of missing owner access, and interrupted migration recovery; snapshot the startup warning.
GitOrigin-RevId: 2d9c3663172c3e631a787dc1dc76db95c39e6aa1
## Why
Existing databases retain their journal mode, so selecting `DELETE` for new NFS databases leaves existing WAL databases unchanged.
## What changed
- Add the managed `unsafe_enforce_sqlite_journal_mode` requirement to migrate existing NFS databases before opening writable pools and require `DELETE` on each connection.
- Share migration code between startup and `codex migrate-nfs-db`, preserving WAL backups and resuming interrupted replacements, including lazily opened databases.
- Hold the migration lock through pool initialization and keep migration failures out of automatic corruption recovery.
- Preserve local logs behavior and skip legacy NFS logs cleanup when enforcement is enabled.
## Testing
Add coverage for requirement precedence, database settings, data and backup preservation across restarts, interrupted replacement recovery, refusal of active WAL databases, migration lock waiting, and local logs remaining in WAL mode.
GitOrigin-RevId: da41ec1b58b1ee8092591cdf8b358280928ff9d4
## Why
Leaving transcript selection with a held key can send repeated input to the composer and submit a preserved draft.
## What changed
- Route the transcript selection shortcut and selection controls in both the owned transcript and transcript overlay, preserving drafts and ignoring pastes outside search.
- Give fixed selection controls and pager motions precedence over conflicting key chords while allowing search and voice controls.
- Consume held exit keys across selection dismissal and asynchronous copy completion, and require fresh presses for composer submit and queue actions.
- Initialize overlay selection against the refreshed transcript frame and complete selection navigation when older history finishes loading.
## Testing
Add regression coverage for draft preservation, repeated `Enter` events, selection and search key precedence, refreshed-frame selection, and pending copy exit-key cleanup.
GitOrigin-RevId: 6cca9f399af1d49ff79337ae745cfc1564a14b88
## What changed
- Add `tui.keymap.global.select_transcript` with an implicit `leader [` shortcut that follows the configured leader, respects explicit remapping or unbinding, and yields to existing bindings.
- Connect transcript overlays to keyboard selection, including Find, mouse selection, and navigation to the beginning of paged history. Give selection commands priority over remapped pager shortcuts.
- Close selection overlays on exit or after a confirmed copy-and-follow operation, preserving the pending close decision while clipboard confirmation is asynchronous.
- Show selection navigation and copy hints that adapt to the available footer width.
## Testing
Add coverage for shortcut dispatch, remapping, unbinding, and conflicts; overlay exit behavior; selection across history paging; mouse and keyboard selection interaction; and cursor and footer rendering snapshots.
GitOrigin-RevId: 8a920e5fa2b06ff0544d829ba30f8ecb654db0ee
## What changed
- Support `/` to open Find in selection mode and `Enter` to move the cursor to the match, extending an active selection.
- Repeat the accepted search from the cursor with `n` for older matches and `Shift+n` for newer matches. Cancel pending repeats when the cursor or selection changes.
- Restore the previous search, cursor, and selection when cancelling a new search, and reuse the previous search when accepting an empty query.
- Align the cursor to selectable graphemes and preserve expanded matches when leaving selection mode.
## Testing
Add regression coverage for search acceptance and cancellation, repeated searches, Unicode cursor placement, expanded output retention, and history pages loaded while a search is saved.
GitOrigin-RevId: 077be52a54d5e006f65eacc4634baf8c089d3662
## What changed
- Add word motions (`w`, `b`, `e`), logical line boundaries, page and half-page motions, and jumps to the transcript's beginning and end. Honor configured pager bindings for navigation.
- Add whole-line selection with `V` and active-end swapping with `o`.
- Adopt existing mouse selections when entering select mode, preserving selection units and endpoint bounds so keyboard motions can adjust the range.
## Testing
Add regression tests for word motion across entries, reverse whole-line selection, empty-line boundaries, configured pager motion, final-grapheme selection, endpoint swapping, and caret placement after copying.
GitOrigin-RevId: f0cd05900f2a7a15840777cee4d50659a2c8b134
## What changed
Track cumulative compressed and uncompressed payload bytes, message counts, and percentage savings for each connection and direction. Use paired Zstd codecs for listener and native client connections, sharing a connection ID between transmit and receive statistics.
Log totals as traffic is processed at 60-second intervals and when codecs are dropped. Transmit totals include encoded payloads even if the subsequent socket write fails; receive totals count only successfully decoded messages.
## Testing
Extend compression tests to verify shared connection IDs, matching transmit and receive totals, savings calculations, and exclusion of oversized messages rejected during decoding.
GitOrigin-RevId: 32602caa85864de7a4e0d28907311af6f67d8db2
## What changed
Advertise `zstd-stream-v1` compression for WebSocket and Unix socket connections and use the negotiated codec for JSON-RPC messages. Retain compression history for the connection and keep plain-text messaging when compression is not negotiated.
Fragment compressed writes to respect the server's advertised frame limit, reject text messages in compressed sessions, and stop using the connection after a failed write to avoid mismatched compression history.
## Testing
Add an integration test covering compression negotiation, fragmentation, retained codec history, request/response handling, and disconnection on an uncompressed text message.
GitOrigin-RevId: 510073444ea49376a116c05214bcb79bd0bc3b50
## What changed
- Add a source coordinator that streams rows as backends reply, preserves each source's pagination cursor and listing mode, and rejects stale replies.
- Route previews, transcripts, archive, and restore requests to the selected row's backend.
- Keep healthy results visible when a source fails, and fall back from an empty or failed initial database listing per source.
- Cancel reads when the picker closes while allowing accepted mutations to finish.
The app-server picker now uses the coordinator with a single source.
## Testing
Add regression coverage for independent source replies, pagination and fallback, action ownership, stale replies, disconnected sources, and mutation completion after picker shutdown. Add a snapshot for the partial-backend failure warning.
GitOrigin-RevId: 1b565c680133d460f4a29c9946a8398e9c950773
## What changed
- Configure the code-mode host to send zstd-compressed responses when clients advertise support, and enable both client transports to accept them.
- Preserve uncompressed responses for clients that do not advertise zstd support.
- Patch `tonic` in Bazel builds to use zstd compression level 1, favoring response latency over compression ratio.
## Testing
Extend the TCP session integration test to check response encoding and successful session opening for both zstd-capable and uncompressed-only clients.
GitOrigin-RevId: b6cf0da51dd30fc2ac9a1b0af11bec26555c559d
## What changed
Extend `mcp_connection_sharing` to pool compatible local stdio connections that negotiate MCP `2026-07-28`. Keep legacy servers and servers that request input during startup private.
Preserve each chat's tool catalog and route input requests to the calling chat. Release connections independently for each chat, shutting down the shared server after the final release, and retire pooled connections on forced refresh without interrupting other chats.
## Testing
Add pool, runtime, app-server, and core scenario tests covering protocol gating, startup cancellation, refresh, final-release shutdown, and separate tool visibility and simultaneous input responses across chats sharing one process.
GitOrigin-RevId: 896b107267a20ec1bffccdefca6c40fe2945a022
## Why
Stdio servers without `CODEX_MCP_PROTOCOL_VERSION` use the legacy handshake, even when they support MCP `2026-07-28`.
## What changed
- Add the disabled-by-default `mcp_connection_sharing` feature to enable discovery for eligible local stdio servers.
- Recover from failed or late discovery with a fresh handshake when needed, waiting for the previous helper to release resources before restarting.
- Retain a working legacy connection when an upgrade attempt fails for the same account, except on authentication errors.
- Keep tool catalogs separate by protocol and invalidate legacy catalogs when discovery negotiates the modern protocol.
## Testing
Add regression coverage for failed and late discovery, legacy fallback, protocol-specific catalog reuse, message limits, and Windows descendant cleanup.
GitOrigin-RevId: 36c675ef3b81d32fccf06ccbddda2312cfe602c9
## What changed
Include critical-path capture status and duration totals in `codex_turn_event`, with categories for inference, auto review, user wait, tools, overhead, and unknown time. Count sampling and compaction as inference.
Distinguish `disabled`, `incomplete`, and `complete` capture. Emit null durations for disabled or incomplete capture so missing measurements are not reported as zero. Freeze the completion timestamp so repeated terminal notifications preserve the original measurement window.
## Testing
Add core and analytics tests for capture status, duration reporting, rounding, and repeated completion. Add app-server integration coverage for completed and interrupted turns with default, enabled, and disabled capture.
GitOrigin-RevId: c6c867120ee563ac48584c2f4b12df23acbabe06
## Why
The standalone Unix update pipeline could return success when `curl` failed because the shell consuming its output exited successfully.
## What changed
Download the installer into a shell variable and evaluate it only after a successful download, preserving `CODEX_NON_INTERACTIVE=1`. Update the displayed update command to match.
## Testing
Add a Unix regression test that forces an installer download failure and asserts a nonzero exit status. Update the update-available snapshot for the new command.
GitOrigin-RevId: cf6ce0dae483203e3609bb35f35eb04bb3096c28
## Why
Automatic reviews and user prompts previously invalidated critical-path captures even when their owning tool invocation was known.
## What changed
Record automatic review time as `auto_review` and waits for approvals, permission requests, and user input as `user_wait` when `CriticalPathTiming` is enabled. Bind timing to the owning invocation before asynchronous work begins, and use the triggering tool's identity for network approvals. Continue invalidating captures when a wait cannot be attributed.
## Testing
Add coverage for cancellation, reused call IDs, network ownership, and disabled capture. Update the automatic review integration test to verify attributed review duration.
GitOrigin-RevId: 0a1f5feebd0c4f5ed67dc058e832ec5f8818db02
Add `RUSTSEC-2026-0387` to the `cargo audit` and `cargo deny` ignore lists for `crypto-bigint` 0.5.5, pulled in through `elliptic-curve` 0.13.8.
Document the affected dependency paths and the potential timing leakage during private-key or session-secret operations. Remove the exceptions when those paths use `crypto-bigint` 0.7.6 or later.
GitOrigin-RevId: 7ff42c9b127900ddf772bf1cc88947f6e7dfcd10
## What changed
Add `untrusted_as_tool_output` as an under-development feature, disabled by default, and expose it in the configuration schema. The flag is intended for rendering client-supplied untrusted context as standalone named tool outputs.
GitOrigin-RevId: 6fe630c8d380a87edb48e08887215c1ec17447ed
## Why
`PermissionRequest` and `PostToolUse` hook inputs could report the turn's working directory instead of the local command's execution directory. This also affected commands whose results were collected in a later turn after the working directory changed.
## What changed
- Report the local command's execution directory in hook input `cwd`, consistent with `PreToolUse`.
- Preserve the original directory through `write_stdin` approvals and delayed completion, including network permission requests.
- Retain the host directory for remote commands and keep hook process working directories unchanged.
## Testing
Add coverage for relative and absolute workdirs, approval denials, command rewrites, completion and stdin approval across turns, remote command fallback, network approvals, and Unix and Windows path formatting.
GitOrigin-RevId: ef5dad2a0634dda9edb2f841ef4fe49ae0d1187d
## What changed
Instrument the returned tool runtime future with the same dispatch span as the spawned dispatch task, keeping completion and cancellation handling in that span.
## Testing
Extend the detached code-mode callback test to assert that the router's `dispatch_tool_call_with_state` span has `dispatch_tool_call_with_code_mode_result` as its parent.
GitOrigin-RevId: e4d4bef26563554bf703b3e4f05490e25d8eb0ad
## What changed
Add the default-disabled `critical_path_timing` feature to capture dependency paths for root-agent turns. Connect direct tool dispatch, execution-lock handoffs, and completed tool batches to turn timing so overlapping work shares its common history without double counting.
Omit captures for unsupported dependencies, including CodeMode, agent communication, approval review, and user waits. Settle aborted tasks before freezing timing, invalidate captures on forced teardown, and apply runtime feature changes only to future turns.
## Testing
Add coverage for serial and overlapping tool dispatch, execution-lock dependency handoffs, cancellation, unsupported paths, frozen timing after completion, and configuration refresh boundaries.
GitOrigin-RevId: 71458b654b1c4a05799886928b449c948ea33109
## Why
Truncating a JSON summary at the 240-byte limit can panic when the cutoff falls inside a multibyte UTF-8 character.
## What changed
Truncate at the nearest preceding character boundary before appending `...`.
## Testing
Extend the JSON tool-call reuse test with multibyte arguments and assert the truncated summary and original payload reference.
GitOrigin-RevId: e4b2af17eb6e3abaeb042772944305c6e1744bdf
## Why
`PreToolUse` hooks receive the host working directory even when a local
`exec_command` call specifies a different `workdir`. This prevents hooks from
seeing the directory in which the command will execute.
## What changed
- Share working-directory resolution between command execution and hook input,
using the selected environment and the command's `workdir`.
- Report the resolved local directory in the hook input's `cwd`. Keep hook
processes in the host directory and retain the host `cwd` for remote commands.
- Reject invalid environment selections or paths before running hooks and record
failures in tool-result telemetry.
## Testing
Add unit and integration coverage for default, empty, relative, and absolute
working directories; Windows path conventions; remote commands; hook denial and
input rewriting; and invalid arguments that fail without running hooks.
GitOrigin-RevId: 97f71f6d3e21a5d95a7abf5384f06f4993241797
## What changed
Omit zero-count actions and use singular or plural wording when summarizing skill changes. For example, show `Disabled 1 skill` instead of `0 skills enabled, 1 skills disabled`.
## Testing
Add a snapshot test covering enable-only, disable-only, mixed, and unchanged skill states, including no summary when nothing changes.
GitOrigin-RevId: ff68c799f29ceb8736e6941778d29a3f8d500b70
## Why
Concurrent requests on a shared MCP connection need to route prompts to their own callers and pause only their own timeouts while awaiting input.
## What changed
- Add `call_tool_with_elicitation` and `read_resource_with_elicitation` with per-request callbacks and timeout pause state, requiring MCP protocol `2026-07-28`.
- Share continuation handling between tool calls and resource reads, and assign globally unique input IDs across requests and connections.
- Add `enable_request_cancellation` to extend cancellation on dropped response futures to catalog, resource, and custom requests.
## Testing
Add or extend tests for concurrent form and URL input routing, unique prompt IDs, independent native verification cancellation and timeouts, resource continuations, and remote cancellation when resource or custom request futures are dropped.
GitOrigin-RevId: ad5a3cd0e289726828a694d00c20870e2d1108c6
## Why
Tool interception and MCP aliases can route a requested callable to a different handler. Rollout traces need to reflect the handler that actually executes, including when an `exec_command` invocation is intercepted as `apply_patch`.
## What changed
Carry an explicit `ToolCallKind` in runtime-start events and use it to update the tool call's execution classification. This replaces MCP-specific payload inspection while preserving the original callable summary and invocation for intercepted patch and aliased MCP calls.
## Testing
Add a regression test verifying that an intercepted `exec_command` is recorded as `ApplyPatch`, retains its original summary and invocation, completes successfully, and creates no terminal operations or sessions.
GitOrigin-RevId: 0e72f3ef55cda2796e779efd16241e4a0dbf0c5b
## Why
Invalid model arguments to `write_stdin` represent a tool failure, but parsing them could fail rollout trace replay.
## What changed
Skip terminal operation creation when dispatched `write_stdin` arguments cannot be parsed or lack a usable `session_id`. Preserve the generic tool call and its error, including the original arguments, so replay can continue.
## Testing
Add a regression test covering malformed JSON and missing or null `session_id` values. Verify that replay retains the failed call's arguments and error without creating terminal operations or sessions.
GitOrigin-RevId: 967e975a88072c169eb3e391d5c62e807d608fbf
## Why
Executors older than `0.164.0` can advertise V2 discovery support without implementing the final contract. Enabling V2 also suppressed V1 discovery for incompatible executors, hiding selected capability roots and skills.
## What changed
Require both the V2 capability flag and an executor version of at least `0.164.0` before issuing `capabilities/discoverV2`. Share this compatibility check between session discovery and the exec-server client. Fall back to V1 when incompatible executors provide no V2 snapshots, clearing any previously stored V2 inventory.
## Testing
Add coverage for version boundaries, prereleases, missing and malformed versions, and transport recovery for compatible executors. Verify that an older executor retains selected plugins and skill instructions through V1 with V2 enabled.
GitOrigin-RevId: 93adf52fc91f02b58fd14f8ff3b093712b3346b8
## What changed
Consume local stdout and stderr receivers directly with `tokio::select!`, removing the intermediate broadcast channel and its lag-related chunk skipping. Drain both streams until they close.
Pass `ExecOutputStream` through local and remote output collection to `OutputBuffers::push_chunk`, while retaining combined output buffers.
## Testing
Update output-buffer tests for the stream argument and exercise stderr chunks in pushed-event and replay test fixtures.
GitOrigin-RevId: be7804fd30cefeb812e372454665923ba051ddb4
## What changed
Support `model_providers.gcp.credential_file` as an absolute path to a Google Application Default Credentials (ADC) file. Pass it as `GOOGLE_APPLICATION_CREDENTIALS` in the provider auth command's environment, retaining the override for token refreshes without changing the parent process environment.
Validate the path before merging GCP defaults and preserve the setting in thread configuration serialization.
## Testing
Add coverage for invalid paths, configuration round trips, separate provider token caches, and credential overrides retained after a `401` refresh. Include a Windows regression test for credential paths containing command metacharacters.
GitOrigin-RevId: d9a1d4b3775a9a4c4325dddaa153d92a2d1430a0
## What changed
Add `features.rollout_budget.enforce_limit`, defaulting to `true`. Setting it to `false` keeps shared usage accounting and budget reminders active while allowing turns to continue after the budget is exhausted.
## Testing
Extend coverage to check enforced and advisory budgets on the current and subsequent turns, including a zero-remaining-budget reminder in advisory mode. Verify that configuration defaults to enforcing the limit.
GitOrigin-RevId: deeac8dae5714cc7c10d030cade6f3bfbfc8d3a7
## Why
Linux sandbox deny-glob expansion silently skipped search roots when metadata lookup failed, potentially discarding a deny rule.
## What changed
Return a fatal error with the search root and underlying error when metadata lookup fails, except for missing or non-directory roots, which still have no matches. Continue following directory symlinks.
## Testing
Add regression tests for symlink-loop metadata errors stopping expansion before scanning, absent and non-directory roots being skipped, and symlink roots expanding to both logical and canonical paths without ripgrep.
GitOrigin-RevId: bd97804ec5b599376c525addaacce6b1f29f9895
## What changed
Introduce `CapturedStream` to keep retained output text and omitted-byte counts together. Use its shared renderer for unified exec logs and model-facing output, preserving omission markers and truncation notices.
GitOrigin-RevId: 045d925df1e31945755196dafed5f78ed507b33b
## What changed
- Add an optional `name` to `AdditionalContextEntry` across the protocol, app-server schemas, and generated clients.
- Accept names matching `[a-z][a-z0-9_]{0,63}` only for `untrusted` context. Reject invalid names and names on `application` context before admitting turn input, returning invalid-request errors from `turn/start` and `turn/steer`.
- Preserve existing model-input rendering and deduplicate context when only its name changes.
## Testing
Add coverage for valid name boundaries, callers that omit `name`, invalid-name rejection without admitting input, and deduplication across name changes.
GitOrigin-RevId: 2caffa6fddd40ddb178733b335f520f317239edd
## What changed
- Export `StaticNetworkProxyConfig` to parse and serialize network policy with constraints, and validate them before building proxy state.
- Add `--strict` and `from_slice_strict` for managed callers, requiring explicit `constraints` and rejecting unknown fields at every typed level. Default parsing permits top-level `metadata` and omitted constraints while still rejecting unknown policy fields.
- Match allowed Unix socket paths case-sensitively when validating constraints.
- Bound configuration file reads to the size limit plus one byte.
## Testing
Add coverage for constraint round trips, weakened policy rejection, exact socket path matching, parsing modes, and CLI flag selection. Exercise automatic MITM enablement through both parsers.
GitOrigin-RevId: c45d094624240f23dd4659128e72a4208d5d5f1c
## What changed
Remove `AuthProvider::resolve_auth_headers` and use `apply_auth_headers` as the async interface for header-only authentication. Migrate providers, callers, and existing tests to the shared interface, passing an empty `HeaderMap` when only authentication headers are needed.
Document that providers may refresh credentials asynchronously and that callers must use the returned header map so providers can remove superseded credentials.
GitOrigin-RevId: 42449de6fddd2be2c50c475c8e92628493197007
## Why
API keys with FedRAMP issuance markers previously used commercial endpoint defaults without a FedRAMP request header.
## What changed
- Recognize `sk-proj-fedramp-` and `sk-svcacct-fedramp-` prefixes as routing hints and send `X-OpenAI-Fedramp: true`, preserving the complete key for authentication.
- Select `https://gov.api.openai.com/v1` for default OpenAI API routing and `https://gov.chatgpt.com/backend-api/` for default ChatGPT backend requests, including model discovery and analytics.
- Preserve explicit endpoint overrides, including an explicitly configured commercial default URL.
- Resolve provider routing and authentication from the same credential snapshot, and apply key-dependent routing to realtime WebSocket startup.
## Testing
Add regression coverage for prefix recognition, unchanged key storage and authorization, provider credential precedence, endpoint overrides, credential rotation, model discovery, analytics routing, and realtime request preparation.
GitOrigin-RevId: a62576ce205c34e067532b8e6c0e431f87a157e2
## What changed
Preserve complete Node REPL tool outputs during synchronous transcript collection and apply the configured output token limit during prompt preparation, after full or delta transcript selection.
## Testing
Update transcript assertions to verify that oversized Node REPL outputs remain intact during collection and are truncated to the selected token cap when rendered.
GitOrigin-RevId: 30ced935c04db456a277f7e58281d45e0e2047dd
## What changed
- Use the managed configuration loader in CLI, exec, TUI, and app-server configuration flows so `requirements.toml` can select a config server.
- Sign in to the config server when needed during interactive TUI startup and CLI login, reload configuration after CLI sign-in, and clear config-server credentials on CLI logout.
- Preserve the app-server's config-server settings and refresh worker across OpenAI login and logout.
- Require config-server settings to be applied when loading CLI and doctor configuration.
## Testing
Add app-server integration tests using a local HTTPS config server to verify managed provider and instruction settings at startup, preservation across API-key login and logout, and cache reuse after restart and thread resume.
GitOrigin-RevId: 27ee81f7943d2290a5c3fcc0ac556579ec63f8b4
## What changed
- Add `body_secret_substitution` actions to version 2 MITM configuration, replacing exact opaque placeholders with secrets from environment variables or files within the matching hook's scope.
- Bound body size, expansion, replacement count, and search work. Reject overlapping matches, compressed payloads, trailers, and supplied payload-integrity headers.
- Recompute `Content-Length` and substitute before SigV4 signing so signatures cover the transmitted body.
## Testing
Add coverage for markers split across chunks, expansion limits, invalid payloads, overlapping bindings, secret redaction, and search limits. Add a TLS forwarding test that verifies hook scope and independently checks the signature of the substituted body.
GitOrigin-RevId: fa95c9ae0c8fc8f695e03c0e87a0a4875d8418fd
## What changed
- Add nullable `startedAtMs` and `completedAtMs` fields to `ThreadItem` in live notifications and turn history. Values are Unix milliseconds when recorded.
- Preserve recorded item times through history reconstruction, pagination, and resume, including command start times recorded during approval.
- Separate the Rust item payload into `ThreadItemPayload` while keeping the JSON payload flat, and update consumers, schemas, and generated TypeScript and Python types.
## Testing
Extend coverage for timestamp serialization, history reconstruction, paginated reads and resume, and persisted Python SDK items.
GitOrigin-RevId: ecbcee95af52db7c807b46a6e9deb30e5fba1f80
## What changed
- Add opt-in runtime authentication through `ModelClient::with_runtime_auth`, requiring the provider and runtime manager to share the selected OpenAI credentials.
- Keep runtime identity, credentials, routing, and transport selection consistent for each request and its retries, signing a fresh assertion for each attempt.
- Apply authentication asynchronously to WebSocket handshakes, replace stale authentication headers, and reconnect when the runtime changes.
- Reject account, organization, or project selectors that conflict with the registered runtime, and preserve gateway OAuth composition.
## Testing
Add coverage for dual-header and assertion-only authentication, HTTP retries, runtime replacement and account switches, stale WebSocket headers, selector mismatches, gateway OAuth failures, transport revocation, and Realtime compatibility.
GitOrigin-RevId: 45b9efc2c80481406a0f6f6396a8cdd21d933c12
## What changed
- Refresh the DotSlash artifact URLs, sizes, and digests for all four supported platforms.
- Update the documented toolchain to `nightly-2026-08-20` and clarify how the bundled runner and repository wrapper normalize Dylint library filenames.
GitOrigin-RevId: f78190dd5fdab81e5accd20e811af51524c0864a
## What changed
- Rename ChatGPT-specific bundle loaders to `chatgpt_config_bundle_loader*` and use managed-config terminology for shared loader plumbing.
- Pass `Config` directly when updating the app-server's managed configuration loader.
- Share configuration loading, logging setup, and result handling between browser and device-code login.
- Expose the CLI cloud-config helpers and `provider_uses_first_party_auth_path` through their library APIs.
## Testing
Extend CLI login coverage to verify that `forced_login_method="api"` rejects both `login` and `login --device-auth` while preserving saved API-key credentials.
GitOrigin-RevId: 9e8fa6110dc80882ba365e550b48ac77da604940
## What changed
- Add `.nvmrc` pinning Node.js to `24.22.1` and raise the root package's minimum Node.js version to match.
- Use `.nvmrc` in repository checks, SDK CI, and npm packaging and publishing workflows.
- Update MCP conformance instructions to use the repository's pinned Node.js version.
GitOrigin-RevId: d864875e538de2b99df73e5a03fc870ce0f90cf0
## What changed
Emit `codex_cua_tool_call_started` for `js` MCP calls on Node REPL-backed connectors. Include start time, tool identity, plugin and connector IDs, and available thread and response attribution without recording tool arguments.
Suppress duplicate starts and replayed completions for CUA calls while retaining the existing MCP completion event. A completion received without a start does not prevent a later valid lifecycle from being recorded.
## Testing
Add a lifecycle regression test covering missing starts, duplicate notifications, replay after completion, attribution fields, timestamps, and exclusion of tool arguments from serialized events.
GitOrigin-RevId: 68554ad76c636bb3c2be38bda56f5ea6da8d9830
## Why
Automatic marketplace update failures were only logged, leaving users without a visible startup warning.
## What changed
Send marketplace update errors and task startup failures through app-server warning notifications. Queue background warnings until a client initializes in both standalone and in-process servers, and centralize startup configuration warning delivery.
## Testing
Add a TUI integration test and snapshot covering two marketplace name mismatch failures, the warning count, and navigation between their details with `F2` and the arrow keys.
GitOrigin-RevId: af55a5555affd9d89ac15a546163daeaafd3b3e8
Eric Traut