## What changed
Pass `PreparedExecCommand` through the process manager and runtime instead of copying command, shell, environment, and permission fields into separate request structs. Move approval requirement evaluation and approval action construction onto the prepared command, and use it for shell snapshots and launch failure events.
GitOrigin-RevId: 3e9f87e0974218fea6fffc0f7740616d696b9800
## What changed
Move argument parsing, working-directory and shell resolution, permission validation, and command lifetime setup into `unified_exec::preparation` with crate-visible parsed and prepared command types.
Update `ExecCommandHandler` to use the extracted preparation flow, preserving implicit skill event emission between parsing and preparation.
GitOrigin-RevId: 79e9be5d87c1b0ab905afdf1e343ac141fb7d4c6
## What changed
- Add `CoreToolRuntime::requires_guardian_review` to review opted-in function calls before dispatch and stop execution when review rejects the call.
- Deliver proposed calls as native review evidence, preserving encrypted argument metadata. When hooks rewrite arguments, review the updated arguments and discard the original encrypted replay content.
- Deduplicate native call evidence against reviewer history and include paired evidence outputs in input budgets.
- Keep review accounting and metrics for native calls without emitting action-specific client assessment events, and omit approval payloads from debug output.
## Testing
Extend regression coverage for rewritten native calls across review retries, denied calls that never execute their handlers, oversized native evidence, and review metrics without client events.
GitOrigin-RevId: c3b22c0220344581c2b38f233001abaed49cba34
## Why
Verified answers omitted because of request-size limits must be marked as missing. Legacy checkpoint messages also need to match retained excerpts after truncation so workers receive only one copy.
## What changed
Move root message preparation into `codex-guardian-context::prepare_root_context`, including handoff selection, shared message limits, legacy matching, and incomplete-context markers. Pass original legacy text into preparation and mark verified answers incomplete when oversized records are excluded.
## Testing
Add a handoff regression scenario for an ID-less checkpoint with a retained excerpt and an oversized verified answer. Assert that the worker receives one capped user message, both incomplete-evidence markers, and an incomplete authorization version.
GitOrigin-RevId: bd3f5fe164ae2fddba440e9269fd63b52e8b12f8
## What changed
- Replace Rust `1.99.1` pins with `1.95.0` across Cargo, Bazel, CI, release workflows, and Windows setup, and update the Bazel lockfile.
- Adjust Rust APIs, borrowing, and lint-related code for the pinned toolchain, and box MCP tool dispatch to bound compiler async-layout query depth.
- Update the halfwidth sound mark snapshot and allow optional symbol hash suffixes in the code mode host package smoke test.
GitOrigin-RevId: 75460c3d0465dc601811e619bce373a4f7ff2912
## What changed
Add optional `approvals.granular` catalog fields for the policy introduction and prompted and rejected category lists. Preserve template strings verbatim in `GranularApprovalMessages`, leaving validation and rendering to consumers.
Document the 500-byte template limit, required `{{ policy }}` and `{{ categories }}` markers, and fallback rules.
## Testing
Extend serialization tests to cover null, empty, and populated granular templates, and verify their preservation through model responses and base instruction overrides.
GitOrigin-RevId: ce32e41a9b37e2e7c45ac9b079708a640c99326c
## What changed
Add the `features.simplified_selection_hints` flag, disabled by default. When enabled, replace detailed plugin capability instructions with a concise developer message identifying the selected plugin and directing the model to use its available skills and tools.
Continue omitting hints for plugins without available capabilities and bounding hint length. Preserve the existing detailed instructions when the flag is disabled.
## Testing
Cover plugin refresh in an existing thread with the flag enabled and disabled. Verify that explicit skill prompts precede the simplified plugin hint and that the hint uses the developer role.
GitOrigin-RevId: 64fc3347bd49fffe675f343a4733ced1b4e5e88c
## What changed
Collect original retained instructions, assistant context, and verified answers before applying synchronous request limits in `guardian-context` preparation. Carry original record sizes through collection, preserving whole-record omission notices, source ordering, and host assistant-context framing.
Apply retained transcript source size checks during synchronous transcript preparation as well.
## Testing
Extend regression assertions for synchronous/asynchronous retained-context parity and equivalent verified-answer omissions when oversized records are filtered during preparation.
GitOrigin-RevId: 9042ee3fe60ebd455f6656b4008efb2acc44ac3d
## What changed
- Move plugin install and uninstall errors and telemetry classification helpers into `codex-rs/core-plugins/src/manager_errors.rs`, preserving the existing public re-exports and error classifications.
- Box the realtime text routing future to bound the handoff future's size while retaining the admission permit across the await.
GitOrigin-RevId: ccf0c3bb93a8c69a0a618b96cd1525da87003176
## What changed
Keep inherited incremental tool declarations in MCP-disabled prediction forks and `thread/sample` requests, and append a developer notice that MCP tools are unavailable. Skip tool declaration updates within the inherited context window; new windows still declare the current tools.
Add the default-enabled `prediction_preserve_parent_tools` feature flag and its configuration schema entries.
## Testing
Update core snapshots and app-server tests to cover inherited declarations, the MCP-unavailable notice, preservation across MCP refresh, and continued parent tool availability.
GitOrigin-RevId: 3adf96c7d0e0093986dbdbd540bd47674a2c105c
## What changed
Accept `[network_proxy]` in `requirements.toml`, retaining `[experimental_network]` as a compatibility alias. Reject both names in a single layer and normalize them before merging across layers so precedence and source tracking are preserved.
Honor the new spelling during credential broker project discovery, display `network_proxy` in debug configuration, and update diagnostics and documentation. Document the distinction between managed requirements, proxy feature configuration, and permission profiles. Policy publishers must keep using `[experimental_network]` until all clients and policy validation layers support the new spelling.
## Testing
Add coverage for alias equivalence, duplicate rejection, cross-layer precedence and sources, and broker project discovery. Exercise both spellings in proxy configuration, network approval routing, app-server requirements responses, and Windows machine policy validation.
GitOrigin-RevId: 5c5bb82bd4b6b1431aa97f27248775820eae6302
## Why
MCP completion events can truncate large results and omit content removed for model consumption. Rollout traces need the original response, including content and metadata, as well as results for calls denied before reaching the backend.
## What changed
- Record MCP runtime results before callbacks, content filtering, and UI truncation, and record skipped calls as failures.
- Stop deriving MCP runtime completion records from protocol events to avoid duplicate records.
- Treat MCP runtime payloads as opaque results when reducing agent interactions.
- Buffer JSON trace writes and explicitly flush them.
## Testing
Extend app-server tests to verify that traces retain oversized MCP text, audio, structured content, and metadata while UI results remain truncated, and that denied calls produce exactly one failed runtime result with the denial reason.
GitOrigin-RevId: 57880770545eb5869420d7dc6fa4a15e481cae9d
## What changed
When `features.untrusted_as_tool_output` is enabled, emit untrusted additional context as `function_call_output` items in the `agent` namespace before user input. Use the explicit context name when supplied; otherwise derive a bounded name from the source key, falling back to `untrusted_content`.
Deduplicate these outputs by name and truncated value so name changes are emitted while changes confined to truncated content are ignored. Application context remains in developer messages, and disabling the feature preserves the existing message format.
## Testing
Extend core and app-server tests and add request-history snapshots covering both formats, turn start and steering, derived names, truncation, and deduplication.
GitOrigin-RevId: cd5e2f4b3121714acb7f4baf5607f3c27d408cae
## What changed
- Separate native child spawn preparation from submission and move forked-history loading and filtering into `agent::history`.
- Group resolved session startup dependencies in `ThreadStartupContext` and extract helpers for effective spawn configuration and inherited environment requests.
- Share loaded-recipient message submission and capture only the content needed for communication logging, avoiding a clone of the full message.
GitOrigin-RevId: 4417ba6ca35e9f293064600f0a54932de514636f
## What changed
Add `WorldStateSectionContribution::with_window_prefix()` to render extension developer fragments as separate messages before retained history when building a context window, including after compaction. Updates within an existing window still append to history. Ignore fragments with other roles for sections that opt in.
## Testing
Add a unit test for prefix placement and duplicate avoidance, plus local and remote compaction scenarios covering live updates, persisted replacement history, and rejection of non-developer fragments.
GitOrigin-RevId: 8621457c6eec17f1585ca8e6fa154b1bf3257330
## What changed
Collect REPL evidence as shared immutable response records, then select and render it during synchronous context preparation. Share response selection logic between text and multimodal layouts while preserving rendering limits, omission markers, and image order.
Use the shared `NodeReplResponse` type in core evidence storage and preserve existing snapshots through copy-on-write image eviction.
## Testing
Extend tests to verify shared response identity during collection, unchanged rendering after preparation, and snapshot stability when storage pressure evicts images.
GitOrigin-RevId: 8564d3732faa5adf01a66bca523d4c03cfbe1822
## What changed
Add session options for client- or server-owned output truncation and optional `max_output_tokens` budgets for wait and terminate observations. Introduce `TerminateRequest` and update session implementations and callers to use it.
Extend the stdio and gRPC schemas with optional truncation settings and budgets, and define the `bounded-output-v1` capability. Existing sessions retain client-side truncation; providers reject server mode by default. This change defines the contracts without enabling server-side truncation.
## Testing
Extend protocol serialization coverage for `outputTruncation: "server"` while preserving existing wire shapes when optional fields are absent.
GitOrigin-RevId: 22145897ea16d385c5ba9e7549109f7a669fceb4
## What changed
Extract patch parsing, verification, and permission assessment into request preparation helpers used by the tool handler and intercepted shell patches. Execute the prepared `ApplyPatchRequest` through the existing runtime and derive auto-approval status from its approval requirement.
Move approval action construction onto `ApplyPatchRequest` and update the existing approval tests to use the new helpers.
GitOrigin-RevId: 7f07d38f0dbf2a971c94b897281651b7a174fd05
## What changed
Introduce `PreparedPermissionRequest` to encapsulate argument parsing, path resolution, permission normalization, and approval action construction. Pass the prepared request, including the selected environment ID, into session permission handling.
## Testing
Extend the selected-environment path resolution test to assert that the prepared approval action carries the expected environment, reason, and resolved permissions, matching the emitted permission request.
GitOrigin-RevId: ebd34fad0e5d4c9f98330d17a6254325526b8c78
## Why
Tool suggestions loaded and cloned the cached connector directory even when no candidates remained after excluding accessible apps.
## What changed
- Filter out accessible connectors before loading the directory, skipping the lookup when no candidates remain.
- Share cached directory entries through `Arc<[AppInfo]>` and clone only matching entries for suggestions.
- Preserve placeholder suggestions for candidate connectors missing from the directory.
## Testing
Add coverage for skipping directory lookups with no remaining candidates, sharing cached storage, and preserving directory metadata and missing-connector fallbacks while excluding accessible apps, including disabled ones.
GitOrigin-RevId: acaf3e1564fb4e2b4f805cffe1d7db8e40d5fe3d
Replace the fixed 200 ms sleep in
`reusing_completed_process_returns_unknown_process` with polling until
`write_stdin` reports no process ID, bounded by a 10-second timeout. This
ensures the shell has completed before asserting that reusing its process
ID returns `UnknownProcessId`.
GitOrigin-RevId: c752e9c2c0a419fa5a06ba957bee49dcaeb5d6d2
## What changed
Change the default `thread_unload_delay_secs` from 1800 to 60 seconds. App-server threads become eligible for unloading after one minute with no subscribers and no activity. Update the configuration documentation, schema, and thread manager sample to match.
## Testing
Update the configuration test to cover the 60-second default, zero for immediate unloading, and an explicit 1800-second override.
GitOrigin-RevId: 0da8454eb25a6ef4b7e3665601982d2e0c183f7c
## Why
Commands that fall back without using a shell snapshot should remain associated with their configured snapshot mode in telemetry.
## What changed
Add a `shell_snapshot_mode` telemetry tag to `exec_command` with values `disabled`, `v1`, or `v2`. Give `v2` precedence when enabled. The tag records configuration, not whether a command actually used a snapshot.
## Testing
Add parameterized coverage for all four combinations of snapshot feature flags using a non-login command, which cannot use V2 snapshots.
GitOrigin-RevId: 2dd9e79b9e02448938166254ea1b988034a81b5e
## Why
Existing databases retain their journal mode, so selecting `DELETE` for new NFS databases leaves existing WAL databases unchanged.
## What changed
- Add the managed `unsafe_enforce_sqlite_journal_mode` requirement to migrate existing NFS databases before opening writable pools and require `DELETE` on each connection.
- Share migration code between startup and `codex migrate-nfs-db`, preserving WAL backups and resuming interrupted replacements, including lazily opened databases.
- Hold the migration lock through pool initialization and keep migration failures out of automatic corruption recovery.
- Preserve local logs behavior and skip legacy NFS logs cleanup when enforcement is enabled.
## Testing
Add coverage for requirement precedence, database settings, data and backup preservation across restarts, interrupted replacement recovery, refusal of active WAL databases, migration lock waiting, and local logs remaining in WAL mode.
GitOrigin-RevId: da41ec1b58b1ee8092591cdf8b358280928ff9d4
## What changed
Extend `mcp_connection_sharing` to pool compatible local stdio connections that negotiate MCP `2026-07-28`. Keep legacy servers and servers that request input during startup private.
Preserve each chat's tool catalog and route input requests to the calling chat. Release connections independently for each chat, shutting down the shared server after the final release, and retire pooled connections on forced refresh without interrupting other chats.
## Testing
Add pool, runtime, app-server, and core scenario tests covering protocol gating, startup cancellation, refresh, final-release shutdown, and separate tool visibility and simultaneous input responses across chats sharing one process.
GitOrigin-RevId: 896b107267a20ec1bffccdefca6c40fe2945a022
## Why
Stdio servers without `CODEX_MCP_PROTOCOL_VERSION` use the legacy handshake, even when they support MCP `2026-07-28`.
## What changed
- Add the disabled-by-default `mcp_connection_sharing` feature to enable discovery for eligible local stdio servers.
- Recover from failed or late discovery with a fresh handshake when needed, waiting for the previous helper to release resources before restarting.
- Retain a working legacy connection when an upgrade attempt fails for the same account, except on authentication errors.
- Keep tool catalogs separate by protocol and invalidate legacy catalogs when discovery negotiates the modern protocol.
## Testing
Add regression coverage for failed and late discovery, legacy fallback, protocol-specific catalog reuse, message limits, and Windows descendant cleanup.
GitOrigin-RevId: 36c675ef3b81d32fccf06ccbddda2312cfe602c9
## What changed
Include critical-path capture status and duration totals in `codex_turn_event`, with categories for inference, auto review, user wait, tools, overhead, and unknown time. Count sampling and compaction as inference.
Distinguish `disabled`, `incomplete`, and `complete` capture. Emit null durations for disabled or incomplete capture so missing measurements are not reported as zero. Freeze the completion timestamp so repeated terminal notifications preserve the original measurement window.
## Testing
Add core and analytics tests for capture status, duration reporting, rounding, and repeated completion. Add app-server integration coverage for completed and interrupted turns with default, enabled, and disabled capture.
GitOrigin-RevId: c6c867120ee563ac48584c2f4b12df23acbabe06
## Why
Automatic reviews and user prompts previously invalidated critical-path captures even when their owning tool invocation was known.
## What changed
Record automatic review time as `auto_review` and waits for approvals, permission requests, and user input as `user_wait` when `CriticalPathTiming` is enabled. Bind timing to the owning invocation before asynchronous work begins, and use the triggering tool's identity for network approvals. Continue invalidating captures when a wait cannot be attributed.
## Testing
Add coverage for cancellation, reused call IDs, network ownership, and disabled capture. Update the automatic review integration test to verify attributed review duration.
GitOrigin-RevId: 0a1f5feebd0c4f5ed67dc058e832ec5f8818db02
## Why
`PermissionRequest` and `PostToolUse` hook inputs could report the turn's working directory instead of the local command's execution directory. This also affected commands whose results were collected in a later turn after the working directory changed.
## What changed
- Report the local command's execution directory in hook input `cwd`, consistent with `PreToolUse`.
- Preserve the original directory through `write_stdin` approvals and delayed completion, including network permission requests.
- Retain the host directory for remote commands and keep hook process working directories unchanged.
## Testing
Add coverage for relative and absolute workdirs, approval denials, command rewrites, completion and stdin approval across turns, remote command fallback, network approvals, and Unix and Windows path formatting.
GitOrigin-RevId: ef5dad2a0634dda9edb2f841ef4fe49ae0d1187d
## What changed
Instrument the returned tool runtime future with the same dispatch span as the spawned dispatch task, keeping completion and cancellation handling in that span.
## Testing
Extend the detached code-mode callback test to assert that the router's `dispatch_tool_call_with_state` span has `dispatch_tool_call_with_code_mode_result` as its parent.
GitOrigin-RevId: e4d4bef26563554bf703b3e4f05490e25d8eb0ad
## What changed
Add the default-disabled `critical_path_timing` feature to capture dependency paths for root-agent turns. Connect direct tool dispatch, execution-lock handoffs, and completed tool batches to turn timing so overlapping work shares its common history without double counting.
Omit captures for unsupported dependencies, including CodeMode, agent communication, approval review, and user waits. Settle aborted tasks before freezing timing, invalidate captures on forced teardown, and apply runtime feature changes only to future turns.
## Testing
Add coverage for serial and overlapping tool dispatch, execution-lock dependency handoffs, cancellation, unsupported paths, frozen timing after completion, and configuration refresh boundaries.
GitOrigin-RevId: 71458b654b1c4a05799886928b449c948ea33109
## Why
`PreToolUse` hooks receive the host working directory even when a local
`exec_command` call specifies a different `workdir`. This prevents hooks from
seeing the directory in which the command will execute.
## What changed
- Share working-directory resolution between command execution and hook input,
using the selected environment and the command's `workdir`.
- Report the resolved local directory in the hook input's `cwd`. Keep hook
processes in the host directory and retain the host `cwd` for remote commands.
- Reject invalid environment selections or paths before running hooks and record
failures in tool-result telemetry.
## Testing
Add unit and integration coverage for default, empty, relative, and absolute
working directories; Windows path conventions; remote commands; hook denial and
input rewriting; and invalid arguments that fail without running hooks.
GitOrigin-RevId: 97f71f6d3e21a5d95a7abf5384f06f4993241797
## Why
Executors older than `0.164.0` can advertise V2 discovery support without implementing the final contract. Enabling V2 also suppressed V1 discovery for incompatible executors, hiding selected capability roots and skills.
## What changed
Require both the V2 capability flag and an executor version of at least `0.164.0` before issuing `capabilities/discoverV2`. Share this compatibility check between session discovery and the exec-server client. Fall back to V1 when incompatible executors provide no V2 snapshots, clearing any previously stored V2 inventory.
## Testing
Add coverage for version boundaries, prereleases, missing and malformed versions, and transport recovery for compatible executors. Verify that an older executor retains selected plugins and skill instructions through V1 with V2 enabled.
GitOrigin-RevId: 93adf52fc91f02b58fd14f8ff3b093712b3346b8
## What changed
Consume local stdout and stderr receivers directly with `tokio::select!`, removing the intermediate broadcast channel and its lag-related chunk skipping. Drain both streams until they close.
Pass `ExecOutputStream` through local and remote output collection to `OutputBuffers::push_chunk`, while retaining combined output buffers.
## Testing
Update output-buffer tests for the stream argument and exercise stderr chunks in pushed-event and replay test fixtures.
GitOrigin-RevId: be7804fd30cefeb812e372454665923ba051ddb4
## What changed
Add `features.rollout_budget.enforce_limit`, defaulting to `true`. Setting it to `false` keeps shared usage accounting and budget reminders active while allowing turns to continue after the budget is exhausted.
## Testing
Extend coverage to check enforced and advisory budgets on the current and subsequent turns, including a zero-remaining-budget reminder in advisory mode. Verify that configuration defaults to enforcing the limit.
GitOrigin-RevId: deeac8dae5714cc7c10d030cade6f3bfbfc8d3a7
## What changed
Introduce `CapturedStream` to keep retained output text and omitted-byte counts together. Use its shared renderer for unified exec logs and model-facing output, preserving omission markers and truncation notices.
GitOrigin-RevId: 045d925df1e31945755196dafed5f78ed507b33b
## What changed
- Add an optional `name` to `AdditionalContextEntry` across the protocol, app-server schemas, and generated clients.
- Accept names matching `[a-z][a-z0-9_]{0,63}` only for `untrusted` context. Reject invalid names and names on `application` context before admitting turn input, returning invalid-request errors from `turn/start` and `turn/steer`.
- Preserve existing model-input rendering and deduplicate context when only its name changes.
## Testing
Add coverage for valid name boundaries, callers that omit `name`, invalid-name rejection without admitting input, and deduplication across name changes.
GitOrigin-RevId: 2caffa6fddd40ddb178733b335f520f317239edd
## Why
API keys with FedRAMP issuance markers previously used commercial endpoint defaults without a FedRAMP request header.
## What changed
- Recognize `sk-proj-fedramp-` and `sk-svcacct-fedramp-` prefixes as routing hints and send `X-OpenAI-Fedramp: true`, preserving the complete key for authentication.
- Select `https://gov.api.openai.com/v1` for default OpenAI API routing and `https://gov.chatgpt.com/backend-api/` for default ChatGPT backend requests, including model discovery and analytics.
- Preserve explicit endpoint overrides, including an explicitly configured commercial default URL.
- Resolve provider routing and authentication from the same credential snapshot, and apply key-dependent routing to realtime WebSocket startup.
## Testing
Add regression coverage for prefix recognition, unchanged key storage and authorization, provider credential precedence, endpoint overrides, credential rotation, model discovery, analytics routing, and realtime request preparation.
GitOrigin-RevId: a62576ce205c34e067532b8e6c0e431f87a157e2
## What changed
Preserve complete Node REPL tool outputs during synchronous transcript collection and apply the configured output token limit during prompt preparation, after full or delta transcript selection.
## Testing
Update transcript assertions to verify that oversized Node REPL outputs remain intact during collection and are truncated to the selected token cap when rendered.
GitOrigin-RevId: 30ced935c04db456a277f7e58281d45e0e2047dd
## What changed
- Add `body_secret_substitution` actions to version 2 MITM configuration, replacing exact opaque placeholders with secrets from environment variables or files within the matching hook's scope.
- Bound body size, expansion, replacement count, and search work. Reject overlapping matches, compressed payloads, trailers, and supplied payload-integrity headers.
- Recompute `Content-Length` and substitute before SigV4 signing so signatures cover the transmitted body.
## Testing
Add coverage for markers split across chunks, expansion limits, invalid payloads, overlapping bindings, secret redaction, and search limits. Add a TLS forwarding test that verifies hook scope and independently checks the signature of the substituted body.
GitOrigin-RevId: fa95c9ae0c8fc8f695e03c0e87a0a4875d8418fd
## What changed
- Add nullable `startedAtMs` and `completedAtMs` fields to `ThreadItem` in live notifications and turn history. Values are Unix milliseconds when recorded.
- Preserve recorded item times through history reconstruction, pagination, and resume, including command start times recorded during approval.
- Separate the Rust item payload into `ThreadItemPayload` while keeping the JSON payload flat, and update consumers, schemas, and generated TypeScript and Python types.
## Testing
Extend coverage for timestamp serialization, history reconstruction, paginated reads and resume, and persisted Python SDK items.
GitOrigin-RevId: ecbcee95af52db7c807b46a6e9deb30e5fba1f80
## What changed
- Add opt-in runtime authentication through `ModelClient::with_runtime_auth`, requiring the provider and runtime manager to share the selected OpenAI credentials.
- Keep runtime identity, credentials, routing, and transport selection consistent for each request and its retries, signing a fresh assertion for each attempt.
- Apply authentication asynchronously to WebSocket handshakes, replace stale authentication headers, and reconnect when the runtime changes.
- Reject account, organization, or project selectors that conflict with the registered runtime, and preserve gateway OAuth composition.
## Testing
Add coverage for dual-header and assertion-only authentication, HTTP retries, runtime replacement and account switches, stale WebSocket headers, selector mismatches, gateway OAuth failures, transport revocation, and Realtime compatibility.
GitOrigin-RevId: 45b9efc2c80481406a0f6f6396a8cdd21d933c12
## Why
Deriving a Vertex AI endpoint previously required environment variables. Allow the project and location to be specified directly in GCP provider configuration.
## What changed
- Add `model_providers.gcp.project_id` and `model_providers.gcp.location`, with each taking precedence over its corresponding environment variable. Keep `global` as the default location and preserve explicit `base_url` overrides.
- Validate configured endpoint fields and preserve them through thread configuration serialization.
- Apply built-in GCP defaults, including default command authentication, when checking managed provider requirements so unchanged requirements are accepted.
## Testing
Add coverage for endpoint precedence, invalid explicit configuration, provider construction, thread configuration round trips, and managed GCP requirement checks, including repeated model listing.
GitOrigin-RevId: c3704bcc0b7d4872374e2cae623fd24d75fb02b4
## What changed
- Always use the retained conversation backend for asynchronous classification; keep snapshot sampling test-only.
- Accept legacy `async_classifier_mode` values in configuration and model metadata but ignore them. Emit a startup warning when `[features.guardianv2].async_classifier_mode` is configured.
- Ignore legacy classifier mode differences when checking model-switch compatibility, and fail closed if the conversation backend is missing.
## Testing
Update coverage for legacy configuration warnings, model-switch compatibility, retained approval-review context, and conversation-based scoring.
GitOrigin-RevId: 5e8bb7e4e6e7d1589572f38bfe2498c9fa6825a0
## What changed
- Expose `aws_sigv4` actions in version 2 MITM permissions configuration and the config schema, rejecting multiple signing actions per hook.
- Give local managed commands placeholder AWS credentials for the selected signing pair, and mask configured credentials in environment values and protected shell snapshots.
- Set `AWS_CA_BUNDLE` to the managed proxy CA bundle when unset, and require `features.credential_masking` for local AWS signing hooks.
- Validate placeholders against every configured signing pair to prevent overlap with real credentials.
## Testing
Extend configuration, signing, and TLS forwarding tests to cover action resolution, invalid signing configuration, credential masking, CA trust, snapshot protection, and exclusion of local AWS defaults from remote environments.
GitOrigin-RevId: 81dfdea30ebde74829882b38891ea41e9737058a
## Why
Listing hooks by working directory alone omits hooks supplied by a thread's selected execution environments, including hooks that can block a turn.
## What changed
- Add `threadId` to `hooks/list` to return a loaded thread's current hook inventory, including selected, ready environments. Reject requests that also specify `cwds`.
- Expose `environmentId` in hook metadata and have the TUI hooks browser query the current thread and label environment-owned hooks. Keep working-directory lookup for startup review.
- Represent environment hook source paths with `PathUri` and use `LegacyAppPathString` in hook run summaries to preserve native path conventions.
## Testing
Add coverage for listing a blocking environment hook and removing it after environment failure, delivering prompt input and reporting exit status in PowerShell and Bash, and running `PreToolUse` hooks only on the command's owning executor. Extend remote network tests to verify that environment hooks use the command's network policy while retaining their filesystem access.
GitOrigin-RevId: 97229e22793df51f4bd502c1f9e19f0c52fb2305
## What changed
Move `HeadTailBuffer` and `format_output_omission_marker` into the new
`codex-utils-head-tail-buffer` crate, exposing the buffer API with an explicit
const-generic byte budget. Update core callers to use the crate and add Cargo
and Bazel definitions.
Move the existing buffer tests alongside the implementation, preserving the
prefix/suffix retention and omission-marker behavior.
GitOrigin-RevId: ff488d0a0a62c39c0e11c11ebb539166cc4c6e74
## What changed
Preserve tool outputs during sync transcript collection and apply the profile's `tool_tokens` limit during transcript preparation, matching tool-call handling. Keep async and Node REPL output truncation unchanged.
GitOrigin-RevId: cf1594bcf25553c08d53b86bee1dd151e4c5db64
## What changed
- Emit `codex.turn_profile` events with finalized sampling request and retry counts when turns complete or abort, and preserve the caller's tracing span for detached extension interrupts.
- Add conversation and turn identifiers to turn and tool dispatch spans, identify tool sources, and include dispatch-to-result-ready duration on tool completion events.
- Emit `codex.skill_read.source_selected` before cache or provider access, recording the selected cloud or executor source, skill and plugin identity, resource kind, and continuation status.
## Testing
Add regression coverage for trace correlation, tool completion timing, turn profile counters on completion and interruption, detached interrupt span propagation, and skill source attribution including cached cloud reads.
GitOrigin-RevId: db78aa270bbcb8dc9e4558d202c109ad54141811
swastik-oai