## What changed
Use `resolve_for_enforcement` when preparing Windows restricted-token and elevated sandbox overrides, preserving read-only carveouts at volume roots. Expand deny-read ACL targets from the resolved permissions.
Use the same resolution in MXC policy preparation when volume roots do not require materialization, while retaining special handling for symbolic root denies.
## Testing
Add regression coverage for read-only carveouts in a volume-root workspace. Extend the Windows package smoke test to verify that a helper-created log matching a deny glob cannot be read while a neighboring allowed file remains readable.
GitOrigin-RevId: cee0834444464b3a7b0c8dbeecb8abcd5828b4b0
Add a macOS platform condition to apply `-Wno-pragma-clang-attribute` and
`-Wno-thread-safety-analysis` when compiling V8's libc++ library.
GitOrigin-RevId: daa5355a081e819818ada1f86833159cfa4cf555
## What changed
- Resolve Linux sandbox test binaries with `cargo_bin` and canonicalize the helper path used by the managed proxy filesystem policy so Bubblewrap can re-execute it.
- Restrict the rollout ownership test to supplementary groups mapped in the Linux user namespace, skipping when no alternate group is available.
- Exclude `gstcoreelements.dll` from the Windows startup-only voice fixture so handshakes succeed while runtime initialization still fails for missing plugins.
GitOrigin-RevId: 618376705c49d6ee3eea09f0d089b2eff4623fd2
## What changed
Map provider `budget_reached` errors to `SessionBudgetExceeded` for HTTP 400 responses and streaming failures. End SSE streams immediately on this error, ignoring retry headers and later completion events, and display `budget reached` in the TUI.
## Testing
Add coverage for HTTP error classification, immediate SSE termination without retries, WebSocket error delivery and subsequent request recovery, and TUI error rendering and task-state cleanup.
GitOrigin-RevId: 6a62d699cdb9cb446214cacfacd0c9ed68bf21a6
## Why
Redirecting stderr on `exec` while closing the lock descriptor suppressed subsequent installer warnings, including the warning that an existing npm-managed Codex installation remains installed.
## What changed
Remove the stderr redirection from `release_install_lock` when closing file descriptor 9. Add a regression test asserting that a noninteractive install succeeds and emits the existing npm installation warning.
GitOrigin-RevId: 5a35ccd9bf62afb99cc949892ec724a01e2d9eee
## Why
Parent input can change authorization while a Guardian assessment is in flight. A denial based on stale context must be retried, just as an approval is, so newly granted authorization can take effect.
## What changed
Revalidate both verdicts before publishing reviewer checkpoints or recording failed-review records. Discard invalidated assessments so they do not persist in reviewer history or count toward the denial limit.
## Testing
Extend authorization-refresh regression coverage for approval arriving during a denial and repeated stale denials. Verify refreshed reviews omit invalidated assessments and stale denials produce neither denial-limit errors nor failed-review records.
GitOrigin-RevId: c699178bc3b5e2d8b075279b00967a4e09fc533c
## What changed
Configure `zstd-sys` to depend on `@zstd` and disable its Cargo build script. Upgrade the Bazel `zstd` dependency to `1.5.7.bcr.2`, update the lockfile, and remove the unused Windows MSVC include-directory patch.
GitOrigin-RevId: 723b1a0245ea9e1789a95960bf99100038a03c45
Update the reviewer configuration test to call
`ManagedFeatures::from_configured_with_warnings` and pass
`parent_config.startup_warnings`, avoiding the crate-private
`from_configured` constructor.
GitOrigin-RevId: 2ba41ba6918e1007b3af013b7146940d919e4560
## What changed
- Add configurable `focus_main_composer` and `focus_sidebar_content` actions, with default `leader c` and `leader s` bindings in workspace mode.
- Let users return to the main composer while keeping the side pane open, or focus the side conversation and hide it when already focused.
- Clear transcript search, selection, and activity focus when returning to the main composer, including when hiding the side pane.
## Testing
Extend tests for focus switching, blocked thread switches, offline composer focus, key capture, and binding conflicts.
GitOrigin-RevId: da624ce7e00a63c4f13870e55c4bc95f09b32cc4
## What changed
Expose `add_user_message` for plain-text input using the existing thread configuration, with explicit `StartIfIdle`, `Steer`, and `Queue` modes and typed admission outcomes. Expose `interrupt_turn` to interrupt a specific turn without removing queued input.
Distinguish local validation failures from unknown remote outcomes, require successful final gRPC status, and avoid automatic retries. Preserve client message identity and raw admission payloads; report duplicate admissions by original turn ID without implying current lifecycle status.
Document reconciliation requirements and extend the attach example to submit an optional message while draining events.
## Testing
Add wire-fixture tests for admission variants, request encoding, malformed responses, local validation, redacted diagnostics, uncertain RPC outcomes, final gRPC status requirements, and dropping pending submissions without retrying or interrupting.
GitOrigin-RevId: 1def92de3fc5ca8c1f89431b7ea29b9b80d64600
## What changed
Add `SavedDaybreakChoice` and `ModelAccessPrograms::select_saved` to resolve an optional saved preference. Enabled selects an advertised Daybreak program, disabled selects an advertised standard program, and unset or unsupported choices return `None`.
## Testing
Extend selection tests to cover enabled, disabled, and unset preferences across advertised program combinations, preserving the preference for Daybreak Blue over Red.
GitOrigin-RevId: 1c7ab3fe1d3a48ad64519bfedfe27de90838516c
## What changed
- Share a lazily registered runtime across threads, model discovery, and extension clients when `runtime_agent_instances` is enabled, while honoring each thread's authentication mode and credential owner.
- Bind model catalogs to the effective provider and authentication context while preserving cache policy and live API-key discovery settings.
- Resolve credentials, routing, and transport policy together for each request. Preserve proxy and TLS settings, validate runtime account selectors, and prevent pooled connections from crossing runtime identities.
- Accept supported ChatGPT subdomains when selecting the registration environment.
## Testing
Add integration coverage for shared runtime registration, dual-header and assertion-only modes, disabled and third-party providers, credential replacement, subagents, and delegated review. Add coverage for catalog cache policy and runtime-aware connection reuse.
GitOrigin-RevId: 99dd9d987c29c93597a648f6586f98ac6a932c3c
## What changed
Move permanent agent message board deletion from `codex-core` into the app server's thread-store cleanup callback. Keep board cleanup active when the board feature is disabled, and run it before optional Guardian evidence-board cleanup.
Remove the message board extension dependency from `codex-core` and retain `codex-message-board` only as a development dependency. Update the core test harness to install the app server's cleanup callback.
GitOrigin-RevId: 61813bbdcd8b57073b8c249e1f771e3fb0ea061e
## What changed
Move the board host adapter and `install_agent_message_board` from `codex-core` to `codex-app-server`, using public core runtime interfaces. Update extension registration, test callers, dependencies, and installation documentation to use the new location.
Format `CHANNEL_POST` notification payloads in the host adapter and retain recognition of legacy board notices in core. Expose `MULTI_AGENT_V2_NAMESPACE_DESCRIPTION` for host extensions to share with native tools.
GitOrigin-RevId: 679b5751de102bff80e6b9d4b0728a84fbdedd85
## What changed
- Move approval-request and prompt-composition tests from `core` to `guardian-reviewer`.
- Move transcript collection, budgeting, and approval-reason truncation tests to `guardian-context`, removing the test-only rendering helper from `core`.
- Move the managed-feature reviewer configuration test to `guardian-v2`.
GitOrigin-RevId: 1886a10cd6aba07b7ca2bcce28d45e0a698111a6
## What changed
- Add `CodexThread` methods for reading the registration source, resolving agent references, and reading the configured clock.
- Replace the board-specific thread lookup with public `ThreadManager::get_thread_with_extension`, which requires matching typed extension data and never loads a missing runtime.
- Update the local message board host to use these APIs and thread startup metadata instead of accessing session internals directly.
GitOrigin-RevId: 143b798cc710e079e20be59a84d05738a3bc6a0b
## Why
Board notifications were skipped when recipients had no active turn accepting mailbox delivery. Queue them through the ordinary agent-message path so idle recipients can receive them in a later turn.
## What changed
- Submit board notices as `Op::InterAgentCommunication` with `trigger_turn` disabled, preserving normal mailbox scheduling without reopening finalized answers.
- Hold a residency guard through dispatch of submitted agent messages to coordinate delivery with agent eviction.
- Update board tool descriptions to describe the host's notification queueing and wake policy.
## Testing
Update local and HTTP board scenarios to cover queued idle notices, delivery after a finalized answer, and mailbox delivery before a pending tool call. Extend residency coverage to verify that submission waits for the eviction gate and queued messages survive eviction.
GitOrigin-RevId: a77137fc40932f5903852e14742483844e07c9bc
## What changed
Introduce `GuardianReviewResponse` to retain both the parsed assessment and the original response text. Reuse the stored result for authorization checks, denial reconsideration, review record capture, and final assessment extraction instead of reparsing the response.
Preserve raw text for review records and keep invalid responses as completed turns so history and session reuse remain unchanged.
## Testing
Extend review record coverage to wrapped denials and invalid responses, and verify that invalid assessments remain retryable while missing assessments do not.
GitOrigin-RevId: 50c19e788a8d57f951c6140d66306b3538515adc
## What changed
- Replace `unwrap()` calls with descriptive `expect()` messages in rollout budget and web search scenario tests.
- Add a targeted `clippy::expect_used` exemption in `BackendSessions::set_preference_key`, documenting that preference keys are assigned only after backend registration.
GitOrigin-RevId: 5ff63e9abb4ea728371874ed121043e9e00438a0
## What changed
Add `tui.keymap.global.hide_pane`, defaulting to `leader -` in workspace mode. Hiding a focused side conversation returns to its parent while retaining the conversation, drafts, and view state for reopening.
Expose the action in the workspace keymap picker, validate binding conflicts, and suppress held shortcut keys after switching focus.
## Testing
Add coverage for hiding and reopening at split-pane and narrow widths, preserving conversation state, shortcut availability, key capture, and repeat/release handling.
GitOrigin-RevId: 6897c34b208041e6f90ae0e18c781eebd62566bd
Replace `unwrap()` with descriptive `expect()` messages when enabling denial reconsideration and setting the read-only permission profile in Guardian tests.
GitOrigin-RevId: 9e5e32ac94889e063d5a721fa6fde8e5c871747d
## Why
Setting granular `sandbox_approval` to `false` also blocked approval requests for dangerous commands such as `rm -f`, even when they requested no additional permissions. Reviewing a dangerous command should remain possible within the existing permission profile.
## What changed
Allow heuristic dangerous-command approval requests with `sandbox_approval = false` when execution stays within current permissions. Do not propose reusable execution-policy amendments for these approvals, since reusable allow rules can bypass the sandbox on later calls.
Keep escalation requests, explicit policy rules, and Windows execution without required sandbox protection subject to their existing approval restrictions. Clarify the meaning of `sandbox_approval` in the protocol and generated schemas.
## Testing
Add coverage for POSIX and Windows approval decisions, approval and denial of deletion commands, preservation of read-only restrictions, and separate dangerous-command approval after turn-scoped or session-scoped write grants.
GitOrigin-RevId: 90adc137c7b7d3f3ee68efb1f6bea531229e7834
## Why
A timeout during denial reconsideration replaced an already completed Guardian denial with a timeout outcome, losing the original assessment.
## What changed
Keep the original denial when reconsideration times out, including its risk level, user authorization, and rationale. Discard the review session while preserving cancellation behavior.
## Testing
Add a reconsideration timeout scenario that verifies the original assessment and denial rationale are preserved and the requested file write remains blocked.
GitOrigin-RevId: 448a6d2d1e779c58076091384fe1215b8c02bde2
## Why
Waking an evicted worker from a sibling should preserve the worker's effective permissions, including runtime grants, denials, and network restrictions that a profile name alone cannot reconstruct.
## What changed
Retain the worker's effective configuration during eviction. On sender-driven reloads, restore its permissions and approvals reviewer while keeping the current wake configuration for other settings.
## Testing
Add regression coverage comparing loaded and reloaded workers with read-only, named, and legacy permission settings. Verify that worker permissions, active profiles, and network policies survive sibling wakeups and that parent and sender permissions remain unchanged.
GitOrigin-RevId: ffc353154535362cfbfbbe2b7fc43e08b42cf9b9
## Why
Existing chats can retain reasoning effort and service tier selections that a refreshed provider catalog no longer supports.
## What changed
- Apply fresh provider catalogs to saved settings in open and resumed chats, and normalize incoming settings before capturing the next turn.
- Replace unsupported ranked reasoning efforts with the highest supported level at or below the selection. For unsupported `ultra` or `persistent` selections, use the model's supported default when available. Reset unsupported `priority` and `ultrafast` service tiers to `default`.
- Retire incompatible reasoning effort pins using each step's captured model metadata, preserving running steps and the live pin during compaction.
- Publish catalog updates only from successful provider responses for the current identity, and refresh retained originator catalogs through the periodic refresh worker.
## Testing
Add coverage for setting correction, reasoning effort pins, resumed chats, stale queued settings, retained history, refresh failures, identity changes, and isolated originator notifications.
GitOrigin-RevId: 2ef4605c4acba98db3fe9d0328e2752084e900a2
## What changed
Add the disabled-by-default `guardian_denial_reconsideration` feature to reconsider a synchronous Guardian denial once before publishing the final decision. The follow-up uses the same review session, evidence, model settings, and original deadline, without compacting the retained context.
Only a valid second assessment replaces the denial. Invalid or failed follow-ups keep the original denial and discard the review session; cancellation and timeout retain their normal outcomes.
Allow a custom developer message through `auto_review.experimental_denial_reconsideration_prompt`, limited to 1,000 UTF-8 bytes. Omitted or blank values use the built-in prompt, which grants no new authorization and preserves the security policy.
## Testing
Add scenario coverage for feature gating, unchanged approvals, reconsidered approvals and denials, invalid assessments, failed follow-ups, custom prompts, and retained context. Extend cancellation coverage to reconsideration and config tests to prompt normalization and byte-limit validation.
GitOrigin-RevId: 61c45d5a948e3e5684c4b4048d6e90fd3f1f2476
## What changed
Add a shared command builder for `codex-voice-host` integration tests. On Windows MSVC builds with Bazel runfiles available, locate the architecture-specific voice runtime and prepend its `bin` directory to the helper's `PATH`.
Use the builder for lifecycle helper launches and build-identity queries in the lifecycle, installed-client, and packaged-runtime tests.
GitOrigin-RevId: c9fbd0769842eb4ee20742e126a9c4173dd7e128
## Why
`Attach` delivers live events only. Clients also need access to stored turn metadata and item content.
## What changed
- Add `Client::list_turns` and `Client::list_items` using native gRPC history endpoints, with optional turn filtering for items.
- Expose page limits, sort order, access mode, and forward/backward cursors. Each call returns one page in server order without automatic pagination or retries.
- Preserve raw response and row payloads alongside typed summaries and item timestamps. Retain unknown item variants and command sources without typed summaries.
- Document cursor reuse and history/live overlap: history pages do not provide an atomic boundary with `Attach`, and coordinated reconciliation still requires caller-managed state.
## Testing
Add wire-fixture tests for request encoding, explicit pagination, raw payload preservation, unknown data, malformed rows, empty pages, RPC errors without retries, and diagnostic redaction.
GitOrigin-RevId: f507530b8e431236bc7e19d867517af56f74644f
## What changed
- Gate GIF output behind `features.image_generation_animation`, disabled by default.
- Accept `gif` options for generation and editing, with optional `frame_count` and `frame_duration_ms` controls. Use `gif: {}` for API defaults.
- Preserve animated output with `.gif` filenames and `image/gif` data URLs while providing a still preview to the model.
- Add guidance for simple animations and spritesheet-based GIF edits.
## Testing
Add integration coverage for GIF generation and editing, explicit frame controls and API defaults, saved animation bytes, and still-preview replay across follow-up turns.
GitOrigin-RevId: 08afa0316ae3675921652157836191a649f563cf
## What changed
Restore `code_mode_only_strict_3p_tools` as an opt-in feature under development. When the effective tool mode is Code Mode Only, keep eligible MCP/app and client-supplied dynamic tools deferred and callable through `exec`, regardless of `deferLoading`, `omit_tools_from`, or namespace exclusion and direct-only settings.
Preserve hidden tools, tool policy restrictions, and built-in tool classification. Log conflicting exposure settings without adding warnings to the model prompt. Leave other effective tool modes unaffected.
## Testing
Add coverage for exposure overrides, model mode overrides, built-in name collisions, and hidden or denied tools. Update integration coverage for app access restrictions and MCP catalog refreshes that preserve the cached prompt prefix while `exec` uses the current tools.
GitOrigin-RevId: 0cb085ba9d23bebc48dbc3fa298b982de0a66c47
## Why
Bedrock onboarding previously forced an embedded server and was unavailable when connected to a local daemon. Credential discovery uses the server environment, which can differ from the launching shell.
## What changed
- Allow the Bedrock setup wizard to use the local daemon while keeping GCP onboarding on the embedded server.
- Clarify that detected AWS credentials come from the server environment.
- Direct users who export AWS credentials in their shell to run `codex --no-daemon` in that shell.
## Testing
Update wizard eligibility tests and onboarding snapshots, and extend daemon startup coverage to verify discovery of a Bedrock API key available only to an already running daemon.
GitOrigin-RevId: 9502ffaa59250210e8f8bc8db6f82b0803cb6cac
## What changed
Decode live item start and completion notifications as `TranscriptUpdate::ItemStarted` and `TranscriptUpdate::ItemCompleted`, with turn identity, lifecycle timestamps, and summaries for user messages, agent messages, reasoning, commands, and file changes.
Preserve structured agent questions even when message text is empty, optional command output and exit details, and command or patch status independently of lifecycle completion. Keep unsupported or incomplete items as opaque notifications and redact summary fields in debug output.
## Testing
Add fixtures covering lifecycle ordering alongside deltas, identity and timestamps, status and optional-field preservation, structured questions, opaque fallback, malformed payloads, thread ownership, and debug redaction.
GitOrigin-RevId: d6bf2d25ee85be17d895726c5072850a9851b55f
## What changed
Add a `failure_reason` tag to failed TUI auto-start events in `codex.daemon.start`, distinguishing `install`, `spawn`, `early_child_exit`, `readiness_timeout`, and `other` failures. Preserve the original error diagnostics through a classified startup API.
Detect managed child exits during process identity recording and distinguish exits before readiness from readiness timeouts.
## Testing
Extend daemon tests to assert classification of installation failures, spawn failures, early child exits, and readiness timeouts.
GitOrigin-RevId: 7c626f278e9e7f2ecd61b3fd1a90829a113eb232
## Why
MCP checks recommended setting missing environment variables even when the problem was an invalid server configuration or an unreachable URL.
## What changed
Separate configuration errors from missing environment variables and build remediation guidance from all detected issue types. Include server reachability advice for failed HTTP probes, while retaining the option to disable affected servers.
## Testing
Add remediation snapshots for unreachable optional HTTP servers, missing required stdio commands, and a required HTTP server with both a missing token and an unreachable URL.
GitOrigin-RevId: 8e8eb743414297561793be51cf3a25e5bd664f27
## What changed
- Remove automatic BuildBuddy configuration and credential forwarding from Bazel CI, release, SDK, and voice builds. Strip remote execution CI configs in the shared wrapper while retaining explicit remote configurations for local use.
- Use native Windows host tools and audio dependencies for Windows Bazel actions, forwarding the required toolchain and environment settings.
- Initialize message-board MCP servers through a per-session `OnceCell` so server startup does not hold the shared registry lock across an await.
- Expose the message-board test helper to the core Bazel package and update the runtime-auth test call for the `reauth` argument.
GitOrigin-RevId: 5d5c1f4d71fa841090dea8eec8006380981fb65b
## Why
Removing an executor must detach its selection even when older turn snapshots still reference it. Connection events queued for a removed attachment must not leak into a later selection of the same executor.
## What changed
- Introduce `EnvironmentAttachment` with a detach signal shared by turn snapshots and a guard owned by the selection.
- Preserve attachments across workspace and configuration changes, while giving reselections and child threads independent attachment lifetimes.
- Stop forwarding connection events on detach and discard buffered events from detached attachments.
- Activate initial attachments after `SessionConfigured`, using configured bindings for startup discovery.
## Testing
Add coverage for discarding buffered connection events on reselection and extend snapshot tests to verify immediate detachment, fresh attachments on reselection, and independent parent and child lifetimes.
GitOrigin-RevId: 6cf882e0d17a296030c13d80c6e2866c80e04638
## What changed
Add optional `contentTokenCount` metadata to `item/completed` notifications, carrying the producer-supplied token count for each completed assistant message in default and plan modes. Counts include any sampled footer and are `null` when unavailable.
Keep this telemetry separate from stored thread items and omit it from subsequent model requests. Update the protocol schemas and generated TypeScript and Python types.
## Testing
Add coverage for per-message counts, including zero, in default and plan modes; missing and malformed metadata; backward-compatible notification decoding; and exclusion from subsequent model requests.
GitOrigin-RevId: 35973037a42650fa2d7569da8e88cb81215cf971
## Why
Search discovery must account for the active model's supported tools while honoring host search restrictions. Automatic fallback must also preserve the provider that owns existing browsing references.
## What changed
- Resolve search from model metadata, client configuration, and managed requirements, exposing the selected provider's tools.
- Discover hosted search with the model's supported tools and carry the discovered invocation context into calls.
- Allow native fallback for eligible discovery failures only when search policy permits it and hosted search has not already been used. Do not replay failed hosted invocations through native search.
- Keep native fallback references on native search across later turns, discovery recovery, and resume. Release unused fallback offers and coordinate background calls to prevent conflicting provider use.
## Testing
Add app-server and core scenario coverage for provider selection, discovery failures, search restrictions, reference continuity, resume, and concurrent background search. Include a snapshot covering discovery and call history across a model switch.
GitOrigin-RevId: 0f22605722daaa424c4fa34660654cde5a6db049
## What changed
Add `McpBinding` APIs to discover the model's Search tool profile through an already authorized, host-owned Apps connection. Discovery sends turn metadata, paginates `tools/list`, and returns a scoped binding with the refreshed declaration and connector-provided invocation context.
Require a visible Search tool and an object-valued invocation context. Preserve the context only for calls using the same client, while allowing normal dispatch to recheck visibility, account selection, and approval policy.
Bound discovery to five seconds and distinguish critical timeout, transport, and server errors from unavailability. Expose the existing retryable transport error classifier for this distinction.
## Testing
Add coverage for opaque invocation context extraction and extend transport error classification coverage to HTTP 503 and 403 responses, exercising the exported classifier through a contextual error.
GitOrigin-RevId: 9848d4adb91e3fb2b9406349c31d1fd5c5c47a33
## What changed
- Add optional `ModelInfo.web_search_provider` metadata with `standalone` and `search_mcp` values.
- Add `tools.client_search_provider` and expose its value as `client_search_provider` in app-server configuration responses, with updated JSON schemas, TypeScript types, and Python bindings.
- Register the `hosted_search_policy` feature flag as under development and disabled by default.
GitOrigin-RevId: 263c3f81a61b50f8bb53ff338b9de8186db316e0
## Why
An MCP server's environment permissions can change after a tool step captures its context. Guardian reviews of direct MCP calls could therefore miss denied paths present in the permissions used to prepare the call.
## What changed
Pass the prepared server environment's sandbox context through MCP approvals and use it to build Guardian's permission evidence, including denied paths and globs resolved for that environment. Keep the sandbox context out of serialized approval actions.
## Testing
Add a regression test that updates a remote MCP owner's permissions after the step starts and verifies that Guardian sees the owner's denied temporary directory. Extend the approval JSON test to verify that supplying sandbox context preserves the serialized action shape.
GitOrigin-RevId: cab0d7c60112a97adf98e5548cdc066b260bb073
## What changed
Mark `code_mode_only_strict_3p_tools` as removed and stop overriding MCP/app and dynamic tool exposure settings. Code Mode Only now honors `omit_tools_from`, namespace exclusions, direct-only namespaces, and dynamic tool deferral settings without strict-mode exceptions.
## Testing
Update coverage for exposure settings, hidden and policy-denied tools, app access restrictions, and deferred MCP catalog refreshes that preserve the cached prefix while `exec` uses the current tools.
GitOrigin-RevId: 356ccd572f952b5a80ff9a0c31085330b9fe6e8b
## Why
Resolving an existing installation ID takes an exclusive file lock, unnecessarily serializing readers.
## What changed
Read `installation_id` under a shared lock. If its contents are missing or invalid, acquire an exclusive lock and reread the file before generating a UUID, so an ID initialized by another process is reused.
## Testing
Extend the existing UUID reuse test to verify that resolution completes while another shared lock is held on Unix and still restores file permissions to `0o644`.
GitOrigin-RevId: e787d775eddb4d05653d42e809816be9536a94a3
## Why
MCP permission profiles need the directory context used to interpret them. Prepared calls must retain that context alongside their captured permissions across runtime refreshes.
## What changed
- Store each server's permission source as thread permissions or a captured environment `FileSystemSandboxContext`.
- Capture environment working directories, home and temporary directories, and materialized workspace roots. Retain the host working directory for thread permissions.
- Expose the captured source through `PreparedMcpCall::permission_source()`, while keeping hosted Apps on thread permissions even when a local environment is attached.
## Testing
Extend binding tests to verify that prepared calls retain environment sandbox paths across refreshes and expose the host working directory for thread permissions. Update elicitation coverage to include hosted Apps with an attached local environment.
GitOrigin-RevId: 87e94605daece324786eebc07b62a507d35e5ced
## What changed
- Record connection attempts and durations as `codex.websocket.connect` and `codex.websocket.connect.duration_ms`, labeled with `success`, `reauth`, and the configured `product_sku` when present.
- Detect reauthentication by comparing the current auth revision with the last successful connection, preserving that revision across connection resets. Include `auth.reauth` in connection logs and traces.
- Populate session telemetry with the configured product SKU.
## Testing
Extend tests to check reauthentication labels after account switches, product SKU labels for restored sessions, and failed-handshake counts, durations, and labels.
GitOrigin-RevId: 53a38b4460ab9021058dfe2fe104d0441993b18a
## Why
A failed memory-mode update could leave other metadata changes applied. Failed observed metadata writes for paginated threads also need to remain pending so persistence can retry them.
## What changed
- Apply observed metadata, memory mode, and optional recency advancement in one SQLite upsert, preserving monotonic recency.
- Require successful SQLite writes for paginated thread metadata when a state runtime is configured, retaining failed writes for retry.
- Use SQLite busy-retry helpers for read-state writes and immediate transactions.
## Testing
Add regression tests that reject SQLite writes to verify pending metadata survives a failed persist and a rejected memory-mode update leaves existing metadata unchanged. Both tests verify a subsequent retry succeeds.
GitOrigin-RevId: 652bf6ebee0197976852aaf9f096b907697fd590
viyatb-oai