## Why
MCP servers discovered on different executors can share a name. Resolving them by name alone exposes only one server and prevents tools and resources from being addressed independently.
## What changed
- Add the disabled-by-default `multi_environment_mcp` feature to expose environment-scoped servers, including multiple installations of the same plugin.
- Carry exact `McpServerKey` identities through catalogs, connections, tool calls, resources, and approval tracking. Give environment-scoped tools stable namespaces derived from their environment.
- Include `environment_id` in scoped resource listings and accept it in resource requests. Require it for environment-owned servers when multiple environments are selected.
- Preserve server ownership through hooks and use the owning environment's permissions for scoped elicitation review.
## Testing
Add coverage for same-named servers across environments, independent calls and approvals, resource selection, plugin discovery, and rejection of hook changes to the tool environment.
GitOrigin-RevId: 5593372b06a15c16aa3220faa3b19f5d3b20e67e
## What changed
- Replace free-form `AgentMessageDisplay` actions with a version `1` contract using `show`, `hide`, and `block` modes, with typed annotations, replacements, block reasons, and trusted-contact handling.
- Discard invalid or unsupported display instructions and set `moderated` to `true` when reading moderation data in Rust and the Python SDK.
- Update generated JSON schemas, TypeScript types, and Python SDK models to match the contract.
## Testing
Add coverage for display variants, tolerance of extra fields, and unsupported-version or unknown-mode fallback. Update the final-answer moderation test and add Python coverage for thread history and item notifications.
GitOrigin-RevId: ec64070002da67e8e377dccb3728806ac8b290e7
## Why
The root metadata test copies the sandbox executable into an isolated root, which also needs access to the bundled bubblewrap fallback.
## What changed
Copy the discovered bundled binary into the fixture's `codex-resources/bwrap`. Allow the system binary as a fallback when `CODEX_BWRAP_SHA256` is absent or all zeros; require a matching bundle for digest-verified builds.
GitOrigin-RevId: 6d61fa212d8ecfd05f482a219dfc4f1c5911e08c
## What changed
Replace the issue labeler's Codex action with a Python script that calls the Responses API with tools disabled and a strict JSON schema. Preserve the label catalog while validating one issue type, an optional product, and known area labels before applying them.
Retry transient API failures and timeouts, honor `Retry-After`, and reject redirects. Pass validated labels directly to `gh issue edit`, surface label application failures, and allow trigger-label cleanup after suggestion failures.
GitOrigin-RevId: 2bfe301468808b4d15aa8b5fe8ddd98c1ed844c6
Keep a `NoSubscriber` dispatch alive while the cancellation-before-admission
test runs so untraced parallel workers registering the callsite do not
interfere with timing log capture.
GitOrigin-RevId: 11bc60e3e4633d3ccf426823aeb271875affa39a
## What changed
- Use `std::fs::rename` for atomic file replacement to support overlapping readers on Windows, retaining temporary-file cleanup if publication fails.
- Replace PowerShell fixtures in legacy sandbox capture and ConPTY lifecycle tests with native subprocesses. Keep child markers and output in writable workspaces, prevent inherited capture handles, and use asynchronous waits in ConPTY tests.
- Update the Bazel `rules_rs` Linux zlib package pins and mirrors.
- Temporarily exempt four `hickory-proto` advisories in `cargo-audit` and `cargo-deny`, with removal tied to upgrading Rust to 1.96+ and Rama to use `hickory-proto` 0.26.2 or later.
GitOrigin-RevId: 23d10a023014cc16c100480d1e8bfc2ec87085e3
## Why
An immediate request after `start` could compete with the pending `initialized`
notification for channel capacity and fail with `WouldBlock`.
## What changed
Wait for an acknowledgment that `initialized` has been processed before returning
from `start`. Shut down the runtime if sending the notification or receiving its
acknowledgment fails. Ordinary notifications remain fire-and-forget.
## Testing
Require the first request after startup to succeed without retries with channel
capacities of zero (clamped to one) and one.
GitOrigin-RevId: 119a9a4375109f6b85aee0a9a4f8398a69269567
## Why
A pending token refresh must not overwrite a newer login or recreate credentials after logout. Legacy file entries also need to retain their stored identity across refreshes.
## What changed
- Lock and revalidate stored credentials before persisting changed authorization-manager credentials, requiring authorization again if storage has changed.
- Update file-backed refreshes only when the matched entry still contains the expected credentials, preserving its key, server name, and ownership. Compare only fields the file format can persist.
- Remove matching legacy file entries when saving login credentials or deleting credentials, while preserving unrelated entries and profile-scoped enterprise credentials' separate local entries.
## Testing
Add regression coverage for newer logins and logout during pending persistence, repeated refreshes of legacy and escaped-name entries, and cleanup that preserves unrelated credentials. Update guard-retention and telemetry assertions for the validation path.
GitOrigin-RevId: 3d7c603950afcff72f0bcd943edae5ecfbcb5bd2
## What changed
- Add the stable `incremental_tools_legacy_gcp` feature, enabled by default, to control incremental tool declarations on regular GCP Responses independently of Amazon Bedrock.
- Mark `incremental_tools_legacy` stable and keep it disabled by default for Amazon Bedrock.
- Expose the new flag in the configuration schema.
## Testing
Update integration coverage for GCP defaults and opt-out, independent provider flags, and incremental tool declarations during remote compaction.
GitOrigin-RevId: 7acf085789d44122fd2a5da97932a8b9e93e240e
## Why
Normalizing whitespace before matching prevents thread search from producing snippets for queries containing repeated spaces, newlines, or tabs.
## What changed
Match against the original conversation text and select the surrounding excerpt before normalizing whitespace for display.
## Testing
Extend `thread_search_matches_json_escaped_content` to cover repeated spaces, newlines, and tabs alongside quotes and backslashes, and assert that the returned snippet has normalized whitespace.
GitOrigin-RevId: fffdcc8d246e7603a52c32bb5239b9873f8179fc
## Why
Repeated or nested search roots can cause the same path to consume multiple result slots and inflate the total match count.
## What changed
Skip duplicate walk roots and deduplicate paths within overlapping subtrees before sending them to the matcher. Keep separate walks for nested roots so their ignore rules can still expose different entries.
## Testing
Add a regression test covering repeated parent and child roots in both orders, verifying that two distinct matching files fill a two-result limit and produce a total match count of two.
GitOrigin-RevId: 86483e572cb3d4dd69ec335fc2d27916301e1332
## Why
Threads need a visible title while automatic generation is pending or fails. Hidden title-generation requests must also stay out of the foreground conversation, including during skill installation prompts.
## What changed
- Immediately display a Markdown-stripped, single-line excerpt of the first message, capped at 60 characters. Replace it with the generated title, or save the excerpt if generation fails or returns an invalid title.
- Give title threads explicit read-only permissions and request the `never` approval policy, subject to managed policy constraints. Keep blocking input requests on the hidden thread until timeout.
- Interrupt timed-out temporary structured turns before detaching them.
## Testing
Add coverage for provisional title replacement, fallback persistence, managed permission and approval policies, and hidden input requests. Add a terminal integration test that verifies title generation after choosing “Continue anyway” on a skill installation prompt.
GitOrigin-RevId: f408f3061e5e7f0d9d6bc1f2f9674303e9e68400
## Why
Requests that exceed the server's advertised WebSocket message size limit can fall back to HTTP without first uploading the oversized message.
## What changed
Read `x-codex-websocket-max-message-bytes` from the handshake response and check the serialized request's byte length before sending. Route oversized requests through the existing HTTP fallback. Ignore missing or invalid limits, and remove the close-code-specific wording from the size-limit error.
## Testing
Add a fallback test that advertises a one-byte limit and verifies zero WebSocket generation requests and one HTTP request.
GitOrigin-RevId: 03b42012ca77d6b046e937fef8e6335d855a1c10
## Why
A WebSocket close with code `1009` before any text arrives indicates that the request exceeds the peer's message size limit. Retrying the request over another WebSocket does not address that limit.
## What changed
- Classify these early size rejections as requiring HTTP fallback and switch transports without exhausting WebSocket retries, including during prewarming.
- Preserve ordinary stream retry behavior for size closes after any text frame and for other close codes.
## Testing
Add integration coverage for early size rejections during generation and prewarming, size closes after metadata, rate limits, or response creation, and ordinary closes.
GitOrigin-RevId: 4550d289bb414fec1faae2a195bcc635d394117b
## Why
Replaying delivered assistant messages allocates new retained-source revisions instead of preserving those captured in live history.
## What changed
- Capture retained sources when recording assistant deliveries, persist them in rollout metadata, and reuse their revisions during replay.
- Add optional `next_item_ordinal` compaction metadata and a `next_model_id_ordinals` helper to recover item and window allocation positions from checkpoints and subsequent records. Ignore allocation metadata that refers to other threads.
## Testing
Extend tests to compare live and replayed delivery sources, preserve revisions through an older reader's rewrite, and verify ordinal recovery from checkpoints and subsequent local items.
GitOrigin-RevId: cfdeebe8e13b1700b34b9c98696880a90a99ace5
Share reviewer lookup and deferred configuration resolution through
`select_synchronous_reviewer` in isolated assessments and approval reviews.
Keep configuration resolution within each caller's review deadline.
GitOrigin-RevId: 77f9a77a3d7a859f5c8012e4d22b68c8def7d81b
## Why
A subagent can use a different model from its parent, with different supported access programs. Saved Daybreak choices need to resolve against the subagent's model and remain consistent throughout its turn, including compaction.
## What changed
- Resolve saved choices before native subagent turns start, preserving explicit turn overrides and applying saved toggles on later turns.
- Distinguish inherited parent programs from explicit child selections. Adapt inherited Daybreak Blue/Red selections to the child model while retaining the saved choice as the default for later turns and nested subagents.
- Validate the account associated with automatic selections and reject incompatible saved choices before sending model requests, while retaining rejected user input in conversation history.
- Require model changes to wait until the next turn when a saved Daybreak choice is present.
## Testing
Add coverage for both multi-agent spawn versions, model-specific selection, automatic compaction, WebSocket response reuse, account changes, unsupported choices, and rejected-input persistence across resume.
GitOrigin-RevId: 11971138d656600d9878187225e4d33217e68ad4
## Why
Restoring model-facing ID sequences requires allocation ordinals alongside the rendered IDs. Responses API payloads still require string IDs.
## What changed
- Add allocation metadata to `ResponseItemId` while keeping equality, hashing, and ordering based on the rendered ID.
- Preserve optional `id_allocation` metadata in rollout items, inter-agent messages, compaction replacement history, and Guardian checkpoints. Continue accepting legacy string IDs.
- Support structured context-window allocations alongside UUIDv7 strings, validate the `window` salt on restoration, and keep request metadata IDs as strings.
## Testing
Add tests for allocation round trips, legacy ID compatibility, string-only raw response item IDs, and context-window allocation validation.
GitOrigin-RevId: ce1fd964bde9a4e7c527432be99aea87ada30169
## What changed
Replace handwritten JSON schemas with Rust request types using `serde` and
`schemars`. Derive tool descriptions from doc comments and retain explicit
nullability, numeric bounds, enum values, and `encrypted` annotations.
Keep forwarding the original JSON arguments to the HTTP backend so catalog
parameters can evolve independently of the request types.
GitOrigin-RevId: e5268de27c2cb929153127b1c7376c7a9cac07e7
## What changed
Make “Yes, clear context and implement” save the approved plan as an app-server attachment and submit a short prompt referencing it. Add the experimental `thread/prepareApprovedPlan` request to verify that the fresh thread's executor can read the file and that its contents match the approved plan.
If the attachment cannot be written or read, inject the complete plan as `proposed_plan` tool output within the model's context and truncation limits. If the complete plan cannot fit, report an error and keep the current session. Clear the UI and switch threads only after plan preparation succeeds.
## Testing
Add TUI tests covering a large plan read from its attachment, complete fallback context when attachment writes or reads fail, and preservation of the original session when the fallback is too large. Snapshot the fresh thread's initial request.
GitOrigin-RevId: b717f30359256994c6efb3f4fe7f87aabe8936af
## Why
Lowercasing alone misses caseless matches such as Greek sigma variants and `ss` matching `ß` in `thread/searchOccurrences`.
## What changed
Use Unicode default case folding after lowercasing both search terms and text. Map folded matches back to source character boundaries so snippets highlight the original text correctly, including characters that expand during folding.
## Testing
Extend the app-server search integration test to cover sigma variants, `ss` matching `ß`, newer Unicode case mappings, and UTF-16 match ranges in text containing an emoji.
GitOrigin-RevId: 6c4937d475daf51d3cd7784b48f5f4a8ce5fa82a
## What changed
Carry `ContextWindowId` through session metadata, compaction checkpoints, rollout recording, and thread creation instead of converting IDs to strings. Add deserialization and JSON schema support while preserving the serialized string format and legacy numeric compaction IDs.
Validate deserialized IDs as UUIDv7 values before restoring context windows, preserving the existing handling of unsupported IDs.
GitOrigin-RevId: fda329d0654f438171a955c9f75550817c32c047
## What changed
Add a `bundled_tool_contracts` test that snapshots the serialized default tool specifications for all nine history and notes actions. Include the snapshot files in Bazel test data.
GitOrigin-RevId: dc82dcd48a002ca69bf5fac5280731823fc7f241
## What changed
Add the disabled-by-default `daybreak_program_propagation` feature to capture a parent's saved Daybreak choice when spawning native helpers. Retain the choice and account identity for helper turns and nested spawns, while preserving explicit `cyber_access_program` overrides. A helper's own saved preference takes precedence on later turns.
Read pending metadata before persisted metadata so preferences survive thread materialization, with stored choices taking precedence. Share this resolution logic with `thread/read` and support refreshing the feature through user configuration.
## Testing
Add coverage for saved and pending preferences, unset choices, explicit overrides, failed metadata reads, nested spawns, parent unloading, feature withdrawal, and preference changes between helper turns.
GitOrigin-RevId: b3b349da8cb3d48154cddf058890587385efcda2
## What changed
Add the hidden `codex git-credential` command to supply an existing file-backed ChatGPT login as an ephemeral Bearer credential through Git's `authtype` protocol.
Restrict credentials to HTTPS requests under `backend-api/codex/sites/git/` on `chatgpt.com` or `chatgpt-staging.com`, matching the configured origin. Check managed workspace policy and reject expired or changed logins before returning credentials. Ignore repository configuration when selecting authentication settings.
The helper does not refresh tokens or modify the saved login; `store` and `erase` are no-ops. Return `quit=true` when authentication is unavailable or fails so Git does not fall back to prompting.
## Testing
Add coverage for capability advertisement before login, reading only the first credential record, and declining personal access tokens without an authentication API lookup.
GitOrigin-RevId: 2f96af1eeb7d05e3d893367137103a7adbc02742
## Why
Converting message content to tool output previously reduced file-backed audio to a text file ID, losing its audio type.
## What changed
- Allow `input_audio` tool output items to carry either `audio_url` or `file_id`, preserving both forms during content conversion.
- Account for file-backed tool audio in history estimates and output truncation, and prepare only inline audio data.
- Reject uploaded audio in raw function and custom tool output injection, extending the existing requirement to submit uploaded audio through typed turn input.
- Regenerate app-server schemas and TypeScript/Python types while preserving the Python inline audio class name.
## Testing
Add coverage for tool audio wire-format round trips, repeated file audio sharing text and audio output budgets, and rejection of raw uploaded audio injection across messages and tool outputs. Extend Python SDK coverage for the inline tool audio shape.
GitOrigin-RevId: f4704466e6151662d2c8b8dc3f5ca2ab2f5710a2
## Why
Resuming an ID sequence from a persisted ID requires its allocation position before shuffling. Previously, IDs stored only their salt and shuffled value.
## What changed
- Store the allocation `ordinal` in `ModelFacingId`, expose `salt()` and `ordinal()`, and derive `JsonSchema`.
- Add `ModelFacingIdGenerator::starting_at()` and `next_ordinal()` so callers can resume with the original seed and salt at the next allocation position without a generator snapshot.
## Testing
Update serialization coverage for the allocation fields and add a test that resumes from a serialized ID across the three-digit pool boundary, matching the uninterrupted sequence.
GitOrigin-RevId: 6cbb725c0bd08356c0dc5458021b9bf58a489522
## Why
MCP config refreshes previously retained session app overrides, leaving connector approval changes unapplied in existing sessions.
## What changed
- Refresh explicit session `apps` overrides alongside `plugins`, allowing updated link approval settings to take effect on the next turn.
- Preserve overrides for omitted sections and restore inheritance when a section is an empty table.
- Validate app overrides and the effective app configuration, rejecting refreshes that expose invalid inherited settings.
## Testing
Add coverage for independent and combined app/plugin updates, clearing overrides, and rejecting invalid inherited app settings. Add an integration test verifying that changing a link's approval mode from `approve` to `prompt` requests approval before executing the next turn's tool call.
GitOrigin-RevId: 3fa36744a9ccd9e735e4cda7f061ccff1cf2a269
## Why
Background plugin cache refreshes fetched recommendations even when plugin recommendations were disabled.
## What changed
Pass the effective recommendation feature state into `PluginsConfigInput` and skip recommendation cache warming unless apps, plugins, and either `tool_suggest` or `recommended_plugins` are enabled. Installed-plugin cache refreshes continue independently.
Disable `tool_suggest` and `recommended_plugins` by default in core and app-server test helpers, with explicit overrides for recommendation tests.
## Testing
Update cache-warming and external-login recommendation tests to opt in explicitly. Update config RPC assertions to verify the test helpers' session flag overrides.
GitOrigin-RevId: dc04e2847c94e2b15842fcd95cc0cf1f104e1fac
## What changed
- Canonicalize home paths before sending sandbox provisioning and desktop registration requests.
- Resolve saved junction paths when restoring the sandbox owner, holding the setup lock and pinning target directories while validating existing sandbox accounts. Skip migration for retiring runtimes.
- Persist the resolved home and clear desktop home ownership so uninstall cannot delete a historical junction's target.
## Testing
Add a Windows junction test verifying that a saved alias resolves to its physical target and an already canonical path needs no migration.
GitOrigin-RevId: 9bac672273694e5a0353fec72a6bcba120e57255
## What changed
Move permission selection into `codex-config` with a shared `PermissionConfig` representation for legacy sandbox settings and named profiles. Resolve selectors using config layer precedence while preserving explicit session profile selection and sandbox mode overrides.
Share legacy permission translation between config derivation and core loading, preserving merged workspace roots, network access, temporary-directory exclusions, and platform sandbox availability without modifying source layers or field origins.
## Testing
Add coverage for mixed selector precedence, merged legacy settings, unchanged source metadata, and the Windows read-only fallback. Extend the managed preferences loader test to verify settings merged across layers and the absence of an active named profile for legacy permissions.
GitOrigin-RevId: a435be7af38424ac33711e6a7557f52b9b672577
## Why
An aborted turn could remain active, and a late abort for an unknown turn could interrupt a different turn with an explicit ID.
## What changed
Finalize the active turn after applying an abort. Only fall back to the active turn when the abort lacks a turn ID or the active turn has a generated ID.
## Testing
Extend regression coverage to verify that a late abort preserves a review turn's ID and completed status, and that repeating `turn/interrupt` returns `no active turn to interrupt`.
GitOrigin-RevId: 73072dda7879bd50b1013f4a0bbf1b68546f2619
## Why
MCP request metadata could forward a client-supplied `product_sku` to unrelated servers and connectors.
## What changed
Remove `product_sku` from turn metadata before forwarding it. For Node REPL-backed servers and the browser connector, populate it from the turn's `apps_mcp_product_sku` configuration, mapping unrecognized values to `other` and omitting empty or missing values.
## Testing
Add regression coverage for configured REPL and browser attribution, unrelated servers and connectors, unrecognized or absent configuration, and spoofed client metadata.
GitOrigin-RevId: bc24062526048ea1c1621099e609053cf167602f
## What changed
Allow `APPLE_NOTARIZATION_BACKEND=signer-service` to sign Apple notarization JWTs through `grpcurl`, using GitHub OIDC authentication. Validate the returned signing key and algorithm, and redact transport and signing failure details.
Keep Azure Key Vault as the default backend and skip its configuration requirements when Signer Service is selected.
## Testing
Add coverage for JWT refresh with fresh OIDC tokens and for the binary wrapper running without Azure configuration. All six notarization tests pass.
GitOrigin-RevId: e38ea90e94639d87c11ab075c999d85b61b37c17
## Why
Narrow composer footers can clip hints or crowd out mode indicators and actions.
## What changed
Use a shared layout for navigation, actions, mode indicators, context, and warnings. Shorten or drop whole labels in priority order instead of clipping them. Add a second row when input modes and queue or active side-conversation actions fit separately but not together, keeping navigation and modes above actions.
## Testing
Add coverage for fullscreen and scrollback layouts, narrow Plan mode hints, active side-conversation actions, oversized goal indicators, and warning hit areas.
GitOrigin-RevId: 849a53d45ef1b36b40c52282e329b48ec7d7d12e
## Why
Long built-in status lines were truncated to a single row even when the footer had room for more content.
## What changed
- Wrap status text to the available width and row budget, preserving styles and hyperlink targets across rows.
- Show an unlinked ellipsis when content exceeds the available space.
- Refresh wrapped content when the status text, agent label, or width changes.
- Keep reasoning-effort transitions on one row and restore wrapping after the final animation frame.
## Testing
Add coverage for wrapping and hyperlink boundaries across footer layouts, content and agent-label updates, resizing, and wrapping restoration after an effort transition. Update transcript and startup snapshots for multiline status text.
GitOrigin-RevId: 30e0795c473efd62fc4d0dca4deb6029b625a9e8
## Why
Status content and footer hints need to fit within the composer's height budget while preserving room for editing and active search controls.
## What changed
- Share row allocation between composer measurement and rendering. Cap status and hints at two rows in inline scrollback, and scale the fullscreen cap from two to four rows with the available budget.
- Reserve space for active footer controls, give suggestions and image previews priority over additional status rows, and avoid reserving an empty hints row when status is enabled.
- Keep textarea row counts and scroll offsets as `usize`, saturating only the terminal height so very tall drafts remain scrollable with a visible caret.
## Testing
Add layout and snapshot coverage for constrained height budgets, status and hints, image previews, slash suggestions, and transcript search cursors. Add a regression test for rendering a draft beyond the `u16` row limit.
GitOrigin-RevId: 20fb0384ffc976dfd12e648004763feff0597dda
## Why
Composer hints could replace configured status content, and mode indicators and warnings reduced the width available to status extensions.
## What changed
- Give enabled status content a dedicated area below the composer in both inline and fullscreen layouts, preserving it during transient hint states.
- Keep shortcuts, queue hints, mode indicators, and warnings in the hint row.
- Measure extension status content at the full available width, allowing up to four rows while yielding space to the composer when height is limited.
- Suppress composer hints behind centered dialogs.
## Testing
Update layout assertions and snapshots for status persistence, extension resizing and clipping, warning placement, and reasoning-effort transitions.
GitOrigin-RevId: f11c2e4fb53c35b69c2fbdbe80cef31bb28faca4
## Why
A live parent thread continues receiving lifecycle notifications while its side chat has focus, so returning to it does not need another liveness read.
## What changed
- Skip the parent liveness read when returning from a side chat while the parent is still attached and online. Keep the read when reattachment is needed.
- Stop scheduling a deferred screen clear when handling a transcript reset that preserves the screen.
## Testing
Add regression coverage for parent `thread/read` requests with and without reattachment, and assert that side-chat navigation leaves no deferred screen clear.
GitOrigin-RevId: a07f161ec86b0ae51250c5a0156402d328c42bdf
## Why
An accepted agent message may never appear in a later inference request or compaction snapshot. Rollout traces need to retain the delivery and its interaction edge even when the receiving agent makes no further request.
## What changed
Capture agent message payloads in `HistoryItemAccepted` events and create conversation items when those receipts are replayed. Reuse each item's ID when it later appears in a request or checkpoint, updating its body to the model-visible representation. Repeated receipts preserve that representation without duplicating the item.
## Testing
Extend the spawn-edge regression test to cover delivery before any child inference, stable item IDs across a later request, and preservation of trimmed content after a repeated receipt.
GitOrigin-RevId: c193d691e8240645800ce004c11f21e3f1c82915
## What changed
- Add a `sign-only` operation to sign macOS CLI packages without notarization.
- Validate the configured signing certificate before signing both standard and provisioned packages.
- Require the configured team ID for every executable during verification and extend leaf certificate fingerprint checks to standard packages.
## Testing
Add coverage for signing a standard package without notarization and rejecting unexpected signing certificates in both standard and provisioned packages.
GitOrigin-RevId: 0794c7666abfe981b59b47311e3a9108223b8f57
## What changed
Expose history initialization and the effective history mode to thread-ready contributors. Add `EvidenceCursor::at_thread_ready` with paginated-history validation:
- Start new or cleared threads at position zero without requiring an existing rollout.
- Start resumed, forked, or supplied-history threads at the durable tail to avoid backfilling existing evidence.
- Skip the initial `SessionMeta` header when capturing evidence from position zero.
## Testing
Extend evidence tests to cover initialization before a rollout exists, capture of the first original record, rejection of resume without a rollout, and exclusion of existing records on resume.
GitOrigin-RevId: 32aa8e2afb71eb4e882b5f1fb107ac8616b33c8e
## Why
Submodule worktree scans can execute clean filters selected by task-writable Git configuration.
## What changed
Pass `--ignore-submodules=dirty` to `git status` in `get_has_changes_in_repo` to skip uncommitted submodule contents while retaining gitlink changes.
## Testing
Add a regression test that configures a submodule clean filter and verifies the repository change check does not execute it. The test also confirms that `git status` without the option executes the filter.
GitOrigin-RevId: 5330402f0354c3bf9613358575f8bedc9f312886
## Why
Code Mode needs a way to forward mixed MCP tool results while preserving their content types and order.
## What changed
Add `content(block)` and `content(iterable)` so callers can forward tool output with `content(result.content)`. Text, image, and audio blocks become their corresponding output items; resource links and embedded resources are serialized as text. Invalid blocks and encrypted text are rejected, and iterators are closed when a block is rejected.
Share MCP block conversion and image detail types with the protocol layer, while preserving existing `image()` and `audio()` input handling.
## Testing
Add coverage for mixed content ordering, iterator behavior and cleanup, invalid blocks, image metadata, short audio clips, and output suppression after exit. Add an integration scenario verifying that MCP text and image blocks reach the model in order.
GitOrigin-RevId: 83832ec6c530dd35ea1e3373680627997c6e13c1
## Why
Remote commands can use workspace paths from a different operating system. Preparing them on the client should preserve those paths and command arguments for the execution host.
## What changed
- Build exec-server requests directly, carrying the native command and sandbox context without applying the client's sandbox transform.
- Resolve workspace permissions and runtime read access in `SandboxManager` on the execution host, including helper binaries and validated managed-network CA bundles.
- Add explicit backend selection and required platform sandbox selection, rejecting launches when the required sandbox is unavailable.
## Testing
Extend request tests to cover foreign workspace paths, Unicode arguments, and empty arguments. Extend the remote process test on Unix to verify that restricted reads allow the sandbox helper and validated CA bundle while denying an untrusted certificate file.
GitOrigin-RevId: 5fc02ac4208912ecefb80a212742389afc14ac05
## Why
Gateway sign-in needs a way to complete authentication over SSH or when no local browser is available.
## What changed
- Prefer device authentication for gateways that support it in SSH sessions, headless Linux environments, or when no browser handler is available.
- Check the selected session's provider and complete required gateway sign-in before requesting models, including when resuming a thread.
- Display the verification URL, one-time code, and cancellation instructions. Handle sign-in results, cancellation, and connection failures while the prompt is open.
- Skip device login for older servers that do not support it while preserving errors from current servers.
## Testing
Add protocol tests for early sign-in completion, connection loss, provider selection, resumed threads, and legacy-server compatibility, plus snapshots of the device prompt and gateway sign-in loading text.
GitOrigin-RevId: 4f3675ab2fc7fccafbad17796c72a7736ebb86b5
## What changed
Add experimental `environments` fields to `turn/settings/update` and `thread/settings/update`. Turn updates apply to later steps of the running turn; thread updates apply to future turns. Omission or `null` preserves the selection, while `[]` clears it. Providing `cwd` in a thread update without an environment list selects the defaults for that directory.
Include the ordered environment selection in `thread/settings/updated`. Wait for Core to accept thread settings updates before returning success, and return rejections as request errors.
## Testing
Add integration coverage for attaching, replacing, preserving, and clearing environments; rejected updates; and the distinction between later steps and future turns.
GitOrigin-RevId: bfebeda57c676be94427aeb0c567c0b94fd9c387
## Why
Cloud conversations previously used the model returned on activation without exposing model discovery or supporting model changes from the TUI.
## What changed
- Fetch the account-scoped Cloud catalog on demand through `/v2/models`, independently of the submission and attachment queue.
- Let users stage a supported model and reasoning effort for the next new turn in the current conversation. Send these settings with the user message and show acceptance after successful admission.
- Show a loading picker when the catalog is empty, preserve compatibility with Cloud servers that lack discovery, and discard stale catalog results and selections when the account changes.
## Testing
Add coverage for catalog request parameters and queue bypass, deferred discovery and compatibility, model and effort serialization, admission outcomes, account invalidation, and opening the picker after discovery.
GitOrigin-RevId: 2cd0e7fe5f760d4da9258eefe9f0dcbcd23f9b07
## Why
When a workspace has an unreadable ancestor, PowerShell can start with `$PWD` unset and its filesystem drive at the root, breaking relative paths.
## What changed
Prefix PowerShell commands in the MXC sandbox with a guarded workaround that restores the location from the process working directory when `$PWD` is unset. Preserve locations already initialized by startup or a profile.
## Testing
Extend the MXC PowerShell integration test to cover an unreadable ancestor, checking that `$PWD` matches the process working directory, relative file access works, and the parent and sibling file remain inaccessible.
GitOrigin-RevId: 4fb067db52a7f3c6e819169016fe6bd104a277a1
sayan-oai