## What changed
Add a presentation-only `UserVerificationView` with explicit verify and cancel choices, request details, and a waiting state. Report decisions through a callback, suppress duplicate approvals while waiting, and allow cancellation before or during verification. Dismiss the view when its matching MCP elicitation request resolves.
Add a full-screen request details overlay that can be opened without making a decision. Wrap prompt text and long URLs for narrow terminals. The view is not yet connected to incoming verification requests.
## Testing
Add tests and snapshots covering prompt and waiting rendering, narrow layouts, long URLs, duplicate approval suppression, cancellation, matching request dismissal, and full-screen inspection and scrolling.
GitOrigin-RevId: de1ff80d0defb3707b641e9bfccff9e2b91255ec
## Why
Trimming the live voice transcript to its 1,024-byte window could restart
animations for retained words or skip animations for new text that repeats
existing text.
## What changed
Track discarded prefix bytes and render the retained text to identify which
tiles survive. Preserve their arrival times and animation phase so only new
tiles begin animating. Start fresh when the speaker changes or the retained
text no longer matches.
## Testing
Add regression coverage for repeated text, retained-word visibility, Unicode
and Markdown rendering, reduced motion, and replaced or changed-speaker windows.
GitOrigin-RevId: dd33f76441baa4d7787d0a9a1e72b281476acb4c
## What changed
Add `tui.show_server_version_notice`, enabled by default. Set it to `false` to suppress informational notices about older stable app servers at startup, on reconnect, and in the agents overview. Compatibility errors and version status remain unaffected.
Refresh the overview notice when local settings change, clearing pending notices when the setting is disabled.
## Testing
Add coverage for disabling and re-enabling overview notices, clearing pending notice state, and preserving remote version status. Extend reconnect and local-settings tests to cover the new setting.
GitOrigin-RevId: d50dcf4472ee221ce31cdd7ab2cd766f901a8039
## Why
Footer updates and transcript animation can trigger redraws before more audio arrives, consuming peaks too early and adding spurious quiet samples. Old peaks also linger in the meter after a channel becomes quiet.
## What changed
- Sample microphone and speaker peaks at most once every 100 ms, preserving accumulated peaks on early redraws and scheduling the next sampling frame.
- Clear each channel's meter history on its first quiet sample without clearing the other channel.
## Testing
Add regression tests for early redraw scheduling, peak preservation, independent channel silence, delayed sampling, and sampling after a conversation reset. Snapshot the meters at wide and narrow widths and after each channel becomes quiet.
GitOrigin-RevId: d7b116af2c099a2eaeb6db0d66bca93b230db970
## Why
Voice mute used a hard-coded `Ctrl+X` shortcut and footer hint, so keymap customization could not change or disable it.
## What changed
- Wire `tui.keymap.chat.toggle_voice_mute` into runtime keybindings and the keymap picker, supporting custom keys, chords, and unbinding.
- Keep `Ctrl+X` as the default, but let existing configured shortcuts and overlapping chord prefixes take precedence. Validate explicitly configured mute bindings for conflicts.
- Activate voice chords only when the microphone shortcut is available, excluding pagers and overlays.
- Refresh the voice footer when bindings change, showing the configured shortcut or `/voice mute` when unbound.
## Testing
Add regression tests for binding resolution, conflicts, voice chord context, and live keymap updates. Add footer snapshots covering custom keys, chords, and unbinding in muted and listening states at wide and narrow widths.
GitOrigin-RevId: ec9385f3956aa268bba34dcf2cc2b0c92a31bfec
## Why
Voice controls replaced the normal footer and could be truncated at narrow widths. Give them dedicated space while keeping the status line visible.
## What changed
- Render voice status, `ctrl+x` mute/unmute, and `/voice stop` above the draft, with separate microphone and Codex audio history meters.
- Keep control positions stable across mute states, prioritize stop at narrow widths, and hide the strip when vertical space is needed for the draft and cursor.
- Reflect actual microphone capture in the recording indicator, respect reduced motion, and allow muting during connection once the audio handle is available.
- Preserve speaker history when muting the microphone and clear speaker samples when playback is suppressed.
## Testing
Add layout and snapshot regressions for voice states, narrow and clipped composers, recording colors, independent audio histories, and status-line visibility. Extend coverage for audio intensity scaling and spoken transcript rendering.
GitOrigin-RevId: 9deb432654f4328cc8a577b8896eee088a0a1d5e
## What changed
- Render spoken user prompts with a bold red chevron, preserving its color during live transcript animation. Trim leading whitespace for display while retaining the raw transcript text.
- Underline and link file references such as `src/lib.rs:42` in spoken assistant transcripts using terminal hyperlinks. Preserve existing links and support Windows-style relative separators.
- Restrict generated file links to existing files with allowed extensions inside the workspace, rejecting hidden paths, traversal, and symlink escapes.
## Testing
Add rendering and transcript tests for the spoken marker, raw text preservation, file links, Unicode column offsets, and Windows-style paths, plus validation tests for rejected file destinations.
GitOrigin-RevId: 5fa180aa606acdc579a916441520602cb2bf3655
## What changed
Render live voice transcripts with a split-flap effect, a black background, and brief speaker-colored highlights as characters settle. Preserve settled characters when text is appended and include animation ticks in the active transcript cache key so frames refresh.
Respect `animations = false`, preserve Unicode graphemes and raw transcript text, and keep completed transcripts as ordinary history cells. Stop requesting animation frames once the effect settles.
## Testing
Add frame snapshots and regression coverage for row styling, speaker colors, appended text, reduced motion, Unicode width, frame scheduling, and unchanged final transcript history.
GitOrigin-RevId: 934f577c7279158f9161d6232634087ab32b0ea3
## What changed
- Add `Ctrl+X` to toggle the microphone for the active voice session on the current thread, with a footer hint and guards for modals, popups, and repeated key events.
- Show a recording dot in the terminal title's activity indicator while the microphone is listening, respecting title settings and clearing it when capture stops.
- Replace the microphone and speaker bars with compact Braille meters showing four recent amplitude samples.
- Briefly show `heard` when voice input interrupts speech, when animations are enabled.
## Testing
Add regression tests for shortcut routing, amplitude glyphs, interruption acknowledgment, and terminal title lifecycle, plus updated voice footer snapshots.
GitOrigin-RevId: e1dc0c1744667e646e0040e247c5a0409b416075
## What changed
- Add app-to-RPC tests for voice startup, shutdown, thread switching, speech delivery, and rejected or stale speech, using a recording app server without audio hardware.
- Cover session retries, typed and voice handoffs, reasoning visibility, and recovery of undelivered answers in focused chat widget test modules.
- Add transcript and buffered replay tests for caption reconciliation, partial transcript preservation, and voice output ownership across thread changes, with rendering snapshots.
GitOrigin-RevId: 8a76523907289f94f257fe97386db7d2e7f33ca5
## Why
The user-verification API previously returned an unsupported provider on macOS. Enable native verification using biometric-protected credentials.
## What changed
- Implement credential status, creation, reuse, deletion, and challenge signing with P-256 Secure Enclave keys in the Data Protection Keychain.
- Require biometric authentication through the key's access-control policy and use a fresh `LAContext` for each signature.
- Report Touch ID hardware support independently of enrollment and current readiness, and map native failures to structured verification errors.
- Serialize credential operations across processes with cancellable file-lock waits. Invalidate pending authentication on cancellation and wait for the signer to exit before releasing the lock.
## Testing
Add unit tests for lock contention and cancellation, authentication teardown and late-result rejection, native error classification, and validation of Secure Enclave key attributes.
GitOrigin-RevId: 93268962cd824b2befc1a0c54b99dcb77a0f1044
## What changed
Show an older-service notice at startup and reconnect when both versions are official stable releases. Display it in conversation history or the agents overview, with wrapping and a compact fallback for small terminals.
For the implicit local daemon, suggest `codex app-server daemon update` and warn that updating may interrupt active or queued work. Suppress repeated notices for the same service and version pair, and defer fresh-session notices until session attachment.
## Testing
Add coverage for version notice eligibility, local-only update guidance, service identity, startup ordering, reconnect deduplication, and overview rendering at narrow and short sizes.
GitOrigin-RevId: e0a5b306e0a4d405544c5f6eaa72f77df6d68e6d
## What changed
Add `is_worktree` to thread initialization analytics and the `codex.thread.started` metric using validated Git repository metadata. Classify linked worktrees as `true` and primary checkouts as `false`; report an unavailable classification as `null` in analytics and `unknown` in metrics. Subagent initialization analytics leave the field unset (`null`).
## Testing
Add analytics coverage for primary checkouts, linked worktrees, unknown repositories, and event serialization. Extend the account-switch telemetry test to check that the `is_worktree` tag reaches the next account's collector.
GitOrigin-RevId: bc9bcd3c0212c0a123e4bcfed0c7020eef17dda6
## What changed
Add `is_official_server_older` to check whether a stable TUI version is newer than the app-server version. Require both versions to contain exactly three numeric components without leading zeros, and return `false` for source builds (`0.0.0`), prereleases, and malformed versions.
## Testing
Add unit coverage for older, equal, and newer server versions, plus invalid versions in either argument.
GitOrigin-RevId: afcc90b56e188df1bf410c69ca238765b4658000
## What changed
Remove `base_instructions` from `codex-rs/models-manager/models.json` and filter out the field in the `rust-release-prepare` workflow so automated catalog updates keep it excluded.
GitOrigin-RevId: 711d43c21a90aadc98e5622b8c24847bc4642c83
## Why
Lost tmux resize notifications can leave the TUI using stale terminal dimensions.
## What changed
Add a background size monitor for tmux on Unix that checks terminal dimensions every 500 ms and delivers detected changes as resize events. Queries run off the UI thread so a slow query does not block input.
Pause monitoring during terminal handoffs and discard samples invalidated by newer geometry or pause/resume transitions. Ignore unchanged, invalid, or failed samples, and stop monitoring without waiting for a blocked query.
## Testing
Add tests for missed-resize recovery and text wrapping, input responsiveness during blocked queries, stale sample rejection, pause/resume handling, nonblocking shutdown, and tmux-only activation.
GitOrigin-RevId: 461f09bf792f1d9760672dd33b125ecdf0ebd1e0
## What changed
Move completed REPL response rendering into `codex-guardian-context` and register a synchronous-only `NodeReplEvidence` section. Core supplies a borrowed view of its evidence snapshot and retains responsibility for capture, storage eviction, and the delivery cursor.
Preserve the existing text and multimodal layouts, rendering bounds, omission markers, image ordering, and deduplication. Exclude evidence payloads from the rendered section's debug output.
## Testing
Adapt the existing evidence tests to exercise the shared renderer. Extend registry coverage to verify synchronous-only inclusion, rendered content, and omission of evidence payloads from debug output.
GitOrigin-RevId: eb181870558a7f2f77270dee7c17d36700f3e148
## What changed
Move bounded transcript image collection into `codex-guardian-context` and expose it through an optional `TranscriptImages` section. Update the async scorer to consume this section, preserving source filtering, image detail, omission accounting, and the existing limits of four images and 8 MiB of image URL data.
## Testing
Add coverage for source order, tool-output filtering, disabled image collection, oldest-image eviction, oversized images, and omitted-byte accounting.
GitOrigin-RevId: 097799ea1be6d73b347088f959de1fd23f02ec2c
## What changed
Move trusted skill rendering into `codex-guardian-context` as `TrustedSkills` and collect it through an async-only context section. Pass the collected section to the sampler, preserving the separate developer message and bounded JSON rendering. Omit skill paths from `Debug` output, exposing only their count.
## Testing
Move rendering tests alongside the shared type, covering multiple paths and escaped UTF-8 within the size budget. Extend registry tests to cover async-only inclusion, omission for empty input, section ordering, and path redaction in debug output.
GitOrigin-RevId: c0778067f19d31e693ca954aee1a7d7be8f9739a
## What changed
Represent host-verified tool metadata as `TrustedTool` in `codex-guardian-context` and collect it through an async-only context section. Route Guardian v2 sampling through that section while preserving separate developer-message delivery and the 512-token rendering budget. Omit tool metadata from debug output.
## Testing
Move the rendering-budget test into the shared crate, extend registry coverage for async-only collection and debug redaction, and narrow the scoped approval test to messages tagged `guardian.trusted_tool`.
GitOrigin-RevId: ee7cb4e9b9ceced70438cb58060d1a2973e1dc6a
## What changed
Move prior-review rendering and developer-message construction into `codex_guardian_context`, and route async scorer evidence through a dedicated `PreviousReviews` context section.
Validate a maximum of eight review fragments and a per-fragment byte budget equivalent to 1,000 approximate tokens. Reject oversized evidence without rewriting or dropping records, and fail closed when validation fails. Preserve authorization-version filtering and the existing developer-role delivery. Keep review contents out of debug output.
## Testing
Add coverage for count and UTF-8 byte-size boundaries, preservation of accepted fragments, async-only section delivery, and omission of review contents from debug output.
GitOrigin-RevId: 05e9f53a6405f490b2424b2491a834cd90ab24f0
`TranscriptState` has no `had_work_activity` field. Remove the assignment
from computer tool call completion handling to fix the resulting compile
error.
GitOrigin-RevId: 2adb15a213992e40a58dc6f217d7ae8d64c48154
## What changed
- Add feature-gated `/voice`, `/voice mute`, and `/voice stop` commands with local WebRTC audio and app-server signaling.
- Show live transcripts, conversation status, and microphone and speaker levels. Preserve captions and undelivered answers across thread switches.
- Speak final answers from voice handoffs while keeping delegated reasoning and commentary hidden and typed answers unspoken.
- Retry eligible startup failures once and clean up voice sessions on thread switches and disconnects.
- Stop voice and block late handoffs after a misalignment policy violation. Remove realtime event payloads and spoken text from receipt and debug logs.
## Testing
Add coverage for voice command mapping, rejected starts, disconnect cleanup, delegated final-answer speech, late handoff rejection, and transcript and footer rendering.
GitOrigin-RevId: 11def1f86b0e023b21d0d92072d6636ccad89815
## What changed
Render adjacent `cua_repl` calls as a compact “Using computer” or “Used computer” group with action and failure counts. Show the current action while running, and prioritize failures and screenshots in completed previews while preserving their chronological order.
Keep full call arguments and output in the expanded transcript, with a `ctrl+t` hint for hidden actions. End groups at other history items and turn boundaries, preserve completed results when pending actions are interrupted, and use the same grouping for live events and history replay.
## Testing
Add unit and snapshot coverage for live/replay parity, grouping boundaries, out-of-order completion, interruption, failure and screenshot previews, full transcript details, and narrow-terminal and Unicode rendering.
GitOrigin-RevId: 8e61ccf4c9f6d1a4d56d674a6d41ca5160d42c82
## Why
Managed app-server shutdowns use a fixed 60-second grace period. Allow users to adjust how long shutdown waits before forcing the process to exit.
## What changed
- Add `shutdownGraceSeconds` to daemon settings, accepting integers from 0 through 300 and defaulting to 60. Zero requests graceful shutdown and then forces termination immediately.
- Apply the setting to managed app-server stops and restarts, including updater-triggered restarts, and extend the lifecycle lock timeout to accommodate the maximum grace period.
- Keep `stop` usable with unreadable or invalid settings by falling back to the default grace period.
## Testing
Add tests for setting defaults and bounds, invalid-value fallback, preservation when saving remote-control settings, graceful process exit, and forced termination with zero or finite grace periods.
GitOrigin-RevId: 8627b391323cf27b40df96935a82e66aa715f572
## What changed
- Store the shared `GuardianReviewSessionManager` in thread extension data and let the Guardian extension spawn and fork reviewers through `ThreadManager`, independently of async scorer startup.
- Preserve reviewer reuse, concurrent forks, cancellation, inherited environments, and user instructions. Gate managed reviewer startup on parent registration and remove terminated reviewers from the manager.
- Retain the `guardian` subagent identity in saved conversations. Reject resume of live Guardian reviewers and reject client archive or delete of live owner-managed workers with JSON-RPC error `-32600`; allow normal access after the owner releases them.
- Keep standalone reviewer support for inline delegates and remove duplicated extension prompt and configuration code.
## Testing
Add app-server tests covering reviewer reuse and concurrent forks, inherited instructions and prompt cache keys, live resume and removal rejection, saved reviewer discovery and resume after parent shutdown, and strict Guardian assessment inside an inline review.
GitOrigin-RevId: 4f9893c1ade151eacb4c11ffeae3d9e9ec019187
## Why
The existing `userVerification/*` handlers always returned unavailability, leaving local clients unable to use the native verification provider.
## What changed
- Dispatch status, enrollment, deletion, and challenge signing through an account-scoped provider. Enrollment creates or reuses a local key; it does not register credentials with a server.
- Restrict enrollment, deletion, and signing to stdio and in-process connections, rejecting WebSocket and remote-control callers before parameter validation.
- Bound native work to one operation per service with a 120-second timeout, and propagate in-process caller cancellation. Recheck connection, cancellation, and authentication state before delivering results, including after waiting for response queue capacity.
- Add device-gated verification capability wiring for the experimental in-process `codex-tui` client, with automatic activation still disabled by default.
## Testing
Add tests for local key reuse and deletion, decoded challenge signing, cancellation, authentication changes during verification and response queuing, concurrent worker rejection, and stdio/WebSocket RPC behavior.
GitOrigin-RevId: 7eac15a5ffb049d27bf8fedcfbae19a49a3f6a3d
## What changed
Add `codex app-server daemon update` to check the latest stable release once, even when automatic updates are disabled. The command requires an installer-owned latest-channel standalone installation and reports `updated`, `noUpdate`, or `unsupported` as JSON, including installed and running versions.
Route manual requests through the updater so scheduled and manual installs share one owner and accepted updates continue if the CLI exits. Restart a running managed daemon when its binary or version differs from the selected installation; this may interrupt active or queued work. Return installer failures as command errors and retry requests across updater replacement.
## Testing
Add coverage for manual updates with automatic updates disabled, queued requests, same-version binary replacement, updater handoff retries, and unsupported installations or unmanaged servers.
GitOrigin-RevId: 240b63c79bae3a64a80768131a30da70900a4d62
## What changed
Replace horizontal turn separators with dim completion metadata after the final answer, including plain conversational answers. Show local completion times such as `done 2:32 PM`, adding the date for other days and the year for other years. Retain `Worked for` durations above sixty seconds and runtime metrics, and wrap metadata on narrow terminals.
Restore saved completion metadata when resuming conversations or loading older history. Keep each footer after its turn's items and deduplicate it across repeated notifications and overlapping pages. Only live completions fall back to the current time when a saved timestamp is unavailable. Failed, interrupted, and in-progress turns do not receive success footers.
Avoid submitting queued input or emitting completion notifications while replaying history.
## Testing
Add unit and snapshot coverage for timestamp formatting, duration thresholds, muted styling, narrow layouts, live and replayed completions, missing metadata, and pagination boundaries with overlapping pages.
GitOrigin-RevId: 308c35c6720720da43c9a391aa5a68c1b231c9a5
## Why
An installer can retarget the selected executable symlink or junction while an app server is running. Recording the launch-time identity preserves which binary was started after that path changes.
## What changed
- Resolve the executable path before launching on all platforms and store an optional executable identity in app-server PID records. Continue accepting older records without this field and expose the identity only for an active process.
- Use BLAKE3 for executable identity digests and make `ExecutableIdentity` serializable.
- Schedule updater checks with an explicit deadline in `tokio::select!`, preserving persisted update intervals, settings-error retries, and termination handling.
## Testing
Add a Unix test that verifies the recorded identity matches the resolved launch binary, differs from a retargeted symlink's binary, and remains optional when reading legacy PID records.
GitOrigin-RevId: 4821130b9a5e75b417a8e39c583b30427a872ff8
## What changed
- Introduce `codex-user-verification` with a provider interface for credential status, creation, deletion, and challenge signing. Include typed errors, shared cancellation guards, and hashed account-user key namespaces.
- Add P-256 public-key encoding as unpadded base64url SPKI DER, derive credential IDs from its SHA-256 digest, and redact proof fields in debug output.
- Add app-server helpers to validate challenge and display-text bounds and map provider errors to typed RPC errors without exposing provider diagnostics.
The platform implementation reports verification as unsupported. App-server requests still return typed unavailability, with the message updated to mention build or account availability.
## Testing
Add tests for credential encoding and signature verification, invalid curve points, cancellation across guard clones, stable and distinct account namespaces, and invalid challenge or display values. Update the app-server unavailability test for the revised message.
GitOrigin-RevId: fe4a4eb37c68d7fdc547704e76aa257abf3e9c81
## Why
A fork cutoff can exclude the `TurnContext` that records the source's multi-agent runtime version. Recovering that version should not require loading the source's full model context.
## What changed
- Preserve `multi_agent_version` in fork session metadata before applying the cutoff. If absent, scan backward for the newest version-bearing `TurnContext`, respecting inherited segment boundaries and stopping once resolved.
- Load the latest model context for paginated forks only when approval or permission settings need to be restored.
## Testing
Add regression tests covering stored-version precedence, early termination without reading older segments, and version recovery within inherited segment cutoffs.
GitOrigin-RevId: 00e66bcce6f4092805e273cde99bd50f304fb39e
## Why
The managed daemon's updater used a fixed hourly cadence with no saved preference to disable automatic updates.
## What changed
- Read `updater.autoUpdateEnabled` and `updater.updateIntervalMinutes` from `CODEX_HOME/app-server-daemon/settings.json`, defaulting to enabled with a 60-minute interval. Keep the initial five-minute delay and require a positive interval.
- Apply the enabled preference during daemon lifecycle operations and re-read settings before updates and recurring waits. Preserve updater preferences and unknown fields when saving remote-control settings, using atomic file replacement.
- Signal the updater's process group on Unix so stopping it also terminates installer children. Allow daemon shutdown even when settings are malformed.
- Document updater configuration and remote-control preference behavior. Manual `codex update` remains unaffected.
## Testing
Add tests for settings preservation, interval validation, recurring waits, enabling and disabling updates across restart and bootstrap, Unix installer termination, and shutdown with malformed settings.
GitOrigin-RevId: 5dbb72c5939e9ced2390b3760a7265608c8b61a0
## Why
A fork cutoff can remove the only `TurnContext` recording the source thread's selected multi-agent version. Forking before the first turn must preserve that version, including when the child is resumed before its first turn.
## What changed
Recover the version from the untrimmed source history or loaded parent, independently of permission overrides, and carry it into the fork's session metadata for `last_turn_id` and `before_turn_id` cutoffs.
## Testing
Add regression coverage for forks before the first turn across legacy and paginated history modes, with loaded and unloaded parents and explicit permission overrides. Verify that the child persists `MultiAgentVersion::V2` and still uses the `collaboration` tools after restarting and resuming.
GitOrigin-RevId: d7e30cf8bfdeb4f755fefab3d1d0884964d7c977
## What changed
Represent denied read paths and globs with `PermissionContext` and render them through a sync-only section in `codex-guardian-context`. Keep policy resolution in the host and preserve the existing permission warning in Guardian review prompts.
## Testing
Extend registry tests to verify permission sections appear only for synchronous reviews. Extend the session reuse test to check that resolved denied paths and globs appear in both the initial review request and the next review's delta.
GitOrigin-RevId: a966a14b367f1eedb5a577f7ed74a869559ae646
## What changed
- Replace `ComposedContext` with ordered `ContextSection` values that retain section identities through transcript selection and rendering.
- Add a shared `PlannedAction` section and renderer for core synchronous approval prompts and the Guardian V2 asynchronous scorer, preserving full, delta, terminal-input, and network-request framing.
- Keep action JSON and retry reasons out of `PlannedAction` debug output.
## Testing
Update registry and transcript tests to assert section identities and source roles. Extend registry coverage to verify planned-action collection for both consumers and omission of action JSON and reasons from debug output.
GitOrigin-RevId: 675b841a2cad06afce03f414615b4d7aa0553b13
## Why
Starting a latest-channel standalone daemon required a separate `bootstrap` to enable automatic updates. A missing updater could also leave a running server without automatic updates until `bootstrap` was run again.
## What changed
- Ensure a single supported updater after managed `start`, `restart`, and restarts caused by remote-control changes. Repeated starts recover a missing updater while reusing the running server.
- Report updater failures as warnings so successful server starts and restarts still succeed.
- Preserve an existing updater while the latest-channel marker and managed binary may be temporarily inconsistent during installation. Stop it when the latest-channel marker is removed.
- Document automatic updater startup and the limitations of detecting out-of-band binary replacements.
## Testing
Add Unix tests for updater reuse and recovery, invalid updater records, marker mismatches and release pinning, unmanaged servers, and bootstrap status for managed local builds.
GitOrigin-RevId: 44148a8d65709f68def2072f542494620d7e574b
## Why
A code-mode `exec` wrapper and its nested tool calls each advance Guardian's score lag. Counting the unscored wrapper against its own nested approval can trigger a synchronous review sooner than needed.
## What changed
Track originating response items and approval tool-call IDs so cached approvals discount their own wrapper when it is newer than the latest score. Preserve wrapper identity across yields and waits, and retain the full lag when provenance is missing or evicted. Other wrappers and scoring failures still count.
Use the current `write_stdin` call's identity for approval freshness, and omit tool-call identity for `execve` intercepts that only retain the launch ID.
## Testing
Add coverage for wrapper-specific discounts, already-scored wrappers, missing and evicted provenance, identity across code-mode resumes, and approval identities for stdin writes and `execve` intercepts.
GitOrigin-RevId: 4002a06d64c4e1e0a13c072303503d6ddfacad09
## Why
Configured MCP servers must not be able to request user verification, even when they reuse the hosted apps server name. Local verification identity selection also needs to distinguish a user's workspace memberships.
## What changed
- Advertise `userVerification` only to the host-owned apps MCP server and cancel verification requests from other servers before prompting the client.
- Add `CodexAuth::get_chatgpt_account_user_id()` to read the access token's opaque `chatgpt_account_user_id` only when its workspace matches the selected account. Missing or malformed claims return no identity, without falling back to another user ID or breaking ordinary authentication.
## Testing
Add coverage for capability filtering, rejection of configured servers including those using the hosted apps name, and account-user identity selection with malformed or mismatched claims. Add an MCP round-trip test showing that verification waits for a client response even in full access mode, returns the supplied proof, and discards response metadata.
GitOrigin-RevId: 156e83d5a0302c013b85e564b46b4bfe858cbdb0
## Why
Bootstrapping the app-server daemon should preserve an explicitly selected release, even when that version is currently `latest`. Older managed binaries should also be able to serve app-server without supporting the updater command.
## What changed
- Record `latest` selections in `auto-update-version` in both standalone installers and clear the marker for explicit releases.
- Start the daemon updater only for a marked stable release whose binary supports `pid-update-loop`. Existing installs without a marker require a new `latest` installation to enable automatic updates.
- Recheck the selected release under the install lock so an in-flight update cannot overwrite a new pin, including installer calls from older updaters. Recheck selection before restarting app-server or replacing the updater.
- Cancel Unix installer process groups and clean up their owned fallback locks when the updater stops.
## Testing
Add coverage for channel markers, explicit pins of the current latest version, older updater guards, updater command support, and Unix installer cancellation with child-process and lock cleanup.
GitOrigin-RevId: 4d275237bd77d896bf64dc1b85a5bca3608142c7
## Why
Executor compatibility checks need a build identity that distinguishes commits
and compiler targets independently of the package release version.
## What changed
- Add optional `providerId` to exec-server environment metadata, cached at startup
and returned by initialization and `environment/info`.
- Derive the ID as SHA-256 of `git:<lowercase commit>:<target>`. It identifies a
standard build configuration, not exact executable bytes, and is omitted when
the commit stamp or target is unavailable or invalid.
- Embed the compiler target in `BuildInfo`, preserve compatibility with historical
metadata without a target, and stamp Cargo release builds with `STABLE_GIT_COMMIT`.
- Group Bazel build-script argument files under one `--arg-file` flag to reduce
Windows command-line length while preserving file order.
## Testing
Add deterministic build-ID vectors across targets, commit normalization and invalid
input coverage, and historical metadata compatibility tests. Extend exec-server
coverage for metadata caching and ensure runtime environment overrides cannot
replace the executor's build identity.
GitOrigin-RevId: 125a18c23de7ad006571940ba305836376c983f4
## Why
Unreaped zombies still pass `kill(pid, 0)` and retain their start time, so exited app-server and updater processes can appear active.
## What changed
Read process state alongside start time with `ps` and treat zombies as inactive. When the start time matches the PID record, attempt to reap the process with nonblocking `waitpid`.
## Testing
Add a Unix regression test verifying that an exited, unreaped updater is reported inactive and reaped.
GitOrigin-RevId: 55f1cd26dbb31b5835bea76591023817f1bc10b5
## What changed
Add `ThreadManager::fork_internal_session` to start an internal session from caller-selected committed history without reading an in-flight parent turn or appending an interruption marker. Preserve parent authentication and budget sharing, and propagate fork lineage. Keep `spawn_internal_session` starting with fresh history.
## Testing
Add a regression test verifying that the fork contains only the selected history, retains its parent association and authentication manager, and stays outside the public thread registry.
GitOrigin-RevId: df4260ed3adfa0abe7a07c2b6d8b8c6ef6ba3d16
## Why
Archiving threads reads metadata from every active rollout, including unrelated compressed files.
## What changed
Add `RolloutReferenceIndex::scan_unarchived_threads` and use it when archiving. Filter canonical filenames by the requested thread IDs before reading contents, while retaining metadata-based ownership checks.
## Testing
Add tests covering reverted rollouts, requested descendants, compressed rollouts, exclusion of archived and unrelated files, and candidate ownership checks.
GitOrigin-RevId: a64f7fa25e5493ed20312f1d8216422752272bae
## Why
After a cold resume and compaction, the subagent roster omitted children whose threads had not been loaded.
## What changed
Build the multi-agent v2 roster from registered direct children and render their full agent paths. Prioritize loaded children, sort alphabetically within each group, and cap the rendered roster at eight agents and 1,024 bytes. Preserve the existing behavior for other multi-agent versions.
## Testing
Extend the cold-resume integration test to check that post-compaction context includes unloaded children, excludes grandchildren, and lists a loaded child before an alphabetically earlier unloaded sibling.
GitOrigin-RevId: 745c1622133b9c01e61f4702e4b2ef6255417f39
## What changed
Add a public `codex_core::guardian_review` module exposing `GuardianAssessment`, the assessment parser and output schema, and the review session configuration builder for reuse by the Guardian extension.
Extract assessment handling and reviewer configuration into dedicated modules, preserving the existing parsing defaults, policy prompt, and read-only reviewer settings.
## Testing
Move the existing embedded-JSON, bare allow/deny, and output-schema tests alongside the assessment implementation.
GitOrigin-RevId: cb2aba3ccdb597e2876015e718e923d4f8f36802
## Why
A standalone root forked from a worker needs its inherited user instructions for Guardian review, including after compaction. Parent input counters belong to a different thread, and omitted parent answers may have restricted an inherited authorization.
## What changed
- Adopt inherited user instructions into thread-owned retained context for standalone roots, recovering surviving checkpoint messages when needed.
- Keep inherited instructions before local evidence without sharing local acceptance counters, and preserve that distinction during reconciliation and rollback.
- Mark parent verified answers as incomplete and treat recovered checkpoint instructions as incomplete excerpts.
## Testing
Add coverage for standalone forks from copied history and truncated checkpoints, retention through compaction and resume, inherited/local ordering collisions, and rollback scope.
GitOrigin-RevId: bf716e224a1d29d6c528ef0dd7cdb118a413a08c
## Why
Incomplete retained checkpoints can omit root user instructions that still survive in live history. Queued input can also reach model history after a later-accepted answer, so recording order cannot reliably order grants and restrictions for subagent authorization reviews.
## What changed
- Reconcile retained evidence with surviving local user messages using source identity and persisted acceptance order, including answers present only in the checkpoint.
- Preserve checkpoint gaps and mark evidence incomplete when recovered instructions lack an order or conflict with an existing order.
- Restore the input-order counter from surviving local metadata so new instructions sort after recovered evidence, even without a retained checkpoint.
## Testing
Add unit coverage for source matching, acceptance ordering, persistent gaps, conflicting orders, and counter restoration. Extend subagent authorization tests to cover checkpoint resume, queued approvals, missing sources, and a subsequent revocation.
GitOrigin-RevId: 8bfbfd2c797d725796187e5cecf7f3f11a5f3380
## What changed
- Remove the `fast_decision` and `full_review` extension hooks and `ApprovalAssessment`, leaving `ApprovalReviewContributor::decide` as the approval decision interface.
- Remove the duplicate Guardian V2 fast-approval implementation and `StrictReviewReason` state.
- Require an explicit `GuardianReviewReason` for synchronous reviews.
## Testing
Migrate Guardian reviewer tests to the production `decide_approval` path and cached-score tests to the registry's decision interface.
GitOrigin-RevId: 1f9092c0ff5bb1eed0c63fa557fb3807e2e71564
