## What changed
- Add `rejection_instructions` and `timeout_instructions` to catalog-provided auto-review messages.
- Use the acting model's instructions for denied and timed-out reviews across tool approvals, shell escalation, and MCP elicitation responses.
- Fall back to the existing instructions only when a catalog value is absent, while preserving explicit empty-string overrides.
## Testing
- Cover catalog overrides, legacy fallbacks, empty values, and separation between acting-model and reviewer-model messages.
GitOrigin-RevId: c5b2c2dbdaefd45d1d658651dd1abaeb6d8c93da
## What changed
- Add `max_tool_call_lag`, `reuse_parent_compaction`, and transcript
`include_images` to the Guardian model configuration.
- Inherit these settings from model defaults while preserving explicit local
overrides.
- Enable image capture for Node REPL review evidence when transcript images are
included.
## Testing
- Cover inheritance and local override precedence for the new settings.
- Verify that enabling transcript images initializes review-evidence capture.
GitOrigin-RevId: 7c1965c2ec00a78a0436fa916b630be0004dbb51
## What changed
- Create remote plugin metrics directories through the standard executor filesystem API.
- Remove the `private` directory-creation protocol option and its platform-specific handling.
- Update the executor temporary-directory documentation to describe child-visible sidecars without an owner-private guarantee.
GitOrigin-RevId: 9a8532403a3ad2bf998281735be0b668893918c9
## Why
A newly started thread may not have materialized its rollout before the TUI
receives `ThreadStarted`. Trying to infer session state from that path can wait
through rollout reader retries even when a lifecycle response already provided
the authoritative session.
## What changed
- Preserve session state already stored for a known thread instead of inferring
it again from `ThreadStarted`.
- Continue updating agent-picker metadata from the notification.
- Restrict fallback session inference to newly observed `ThreadStarted`
notifications that do not already have session state.
## Testing
Added a startup test that verifies a known thread routes `ThreadStarted`
immediately, retains its configured session, buffers the notification, and
updates agent metadata when the rollout does not exist yet.
GitOrigin-RevId: 7ed98fb46df17566c4a61ac677f60fc8d94f7321
## What changed
Box `dialer::connect` before awaiting it in `WebSocketConnector::connect`,
erasing the dialer's concrete future type at the connector boundary.
GitOrigin-RevId: 617a2e4fd5bd61a408281973452e7b71b104bff2
## What changed
- Emit started and completed collaboration tool events for multi-agent v2
`spawn_agent` calls, including failed invocations.
- Record execution duration and successful child-agent configuration metadata
without including the spawn prompt.
- Deduplicate collaboration and subagent activity items by call ID when
calculating per-turn subagent tool counts.
## Testing
- Extend the app-server multi-agent v2 integration test to cover successful
and failed spawn telemetry, duration, prompt omission, and turn counts.
GitOrigin-RevId: c1c2fb9cc2a1a9b0f63ef68509ad36d11a92d1e5
## What changed
- Add `in_app_browser.allow_external_browser_settings_import` to managed requirements, preserving explicit Boolean values through layered composition while leaving an omitted value unset.
- Return the policy as `inAppBrowser.allowExternalBrowserSettingsImport` from `configRequirements/read` and include it in the generated protocol schemas.
- Keep the import policy independent from the in-app browser feature flag and agent Browser Use requirements.
## Testing
- Cover parsing, managed-layer precedence, invalid values, user and session override resistance, and app-server response serialization.
GitOrigin-RevId: efa2621d2b1cf503f1bee2505d9914cb4fb7221d
## What changed
Set `persist-credentials: false` for the V8 canary repository checkout and
for the `rusty_v8` checkouts in both the canary and release workflows.
GitOrigin-RevId: b4ccca7c7edf4e038b7b84c83f83d1416f655f65
## Why
Embedding reusable-workflow inputs directly in shell scripts can cause their
contents to be interpreted as shell syntax.
## What changed
- Export the Rust nextest target, profile, and test-thread inputs as environment
variables before using them in Bash commands and paths.
- Pass the MSVC target and host architecture to PowerShell through environment
variables.
GitOrigin-RevId: f96bbeeb7b556022e4bdea9db384a88f925050bf
## What changed
- Accept borrowed byte slices when appending output chunks, avoiding clones before
forwarding those chunks to streaming consumers.
- Merge drained head-tail buffers by reusing their owned storage while preserving
the retained prefix, latest suffix, and omitted-byte count.
- Make unified exec output handles capacity-generic so bounded-output tests can
exercise repeated drains with small buffers.
## Testing
- Update head-tail buffer and process manager tests to cover chunk retention,
omission accounting, and repeated output drains with the new APIs.
GitOrigin-RevId: caa9813d3c9d9921cff28888263a212def381640
## Why
The TUI session logger is meant to record only the variant for unhandled app
events. Parsing `Debug` output removed tuple payloads but retained fields from
struct variants.
## What changed
Derive `IntoStaticStr` for `AppEvent` and use that conversion when recording
fallback `app_event` entries, so the `variant` field consistently contains only
the enum variant name.
GitOrigin-RevId: 5b539f414269c6b001e69cf9496db5b49aceb759
## Why
Resolving attacker-mutable path components while preparing a Seatbelt profile can let a writable root be rebound to a different location before the sandbox is applied. File roots also need to remain confined to the file itself rather than granting access to descendants after replacement.
## What changed
- Preserve mutable components of writable-root paths until Seatbelt binds them, while still normalizing trusted top-level aliases such as `/tmp`.
- Use literal grants for existing file and device roots, and subpath grants for directories and missing roots.
- Exclude both logical and resolved forms of protected subpaths so symlinked metadata directories remain read-only.
## Testing
Add coverage for ancestor rebinding, file-root symlink and directory replacement, missing directory roots, top-level aliases, and symlinked metadata carveouts.
GitOrigin-RevId: 63c00e44dd30766e873b8acdad09d6657657fad9
## What changed
Replace the core integration test for allowed `globalThis` properties with an
in-process code-mode runtime test. The test continues to fail when the runtime
exposes a global outside the allowlist without requiring the core network test
harness.
GitOrigin-RevId: f33846ae2bb35e6779b5bec0a3f0ba5729eb707d
## What changed
Use the shared `wait_for_event` helper to wait for `TurnComplete` from initial
and reloaded worker threads before checking their requests. This replaces
manual polling of `AgentStatus` with two-second deadlines.
GitOrigin-RevId: 862884afae9969aacf0f53c5c24cf8b72f8d078a
## Why
Unsupported untrusted approval policies must remain startup errors even when
app-server is allowed to fall back from other invalid configuration. Likewise,
compound command summaries must not discard a `sed` stage that can edit files
in place.
## What changed
- Propagate `UnsupportedUntrustedApprovalPolicyError` from both app-server
configuration loads instead of replacing it with default configuration.
- Parse `sed` options through `--`, option arguments, combined short flags, and
backup suffixes so `-i`/`--in-place` commands remain unknown actions.
- Keep non-mutating `sed` operands after `--` from being mistaken for flags.
## Testing
Added parser coverage for in-place `sed` variants in compound commands and for
dash-prefixed operands after `--`.
GitOrigin-RevId: 112ead912e10fcb6c7dd0ede4bf84e390af82da8
## What changed
Add named tracing spans for MCP dirty-state refreshes and time spent waiting
to acquire the refresh semaphore.
GitOrigin-RevId: 1dbb3572d2061581beb83b3de098d6ec91791104
## What changed
- Use `statx` for no-follow metadata on Linux so `created_at_ms` includes the birth time when the filesystem provides it, with a fallback for unavailable or blocked `statx` calls.
- Mark files and directories for deletion explicitly on Windows after opening them without traversing reparse points.
- Cover create, write, metadata, remove, and link-rejection behavior for local and remote filesystems, including sandboxed execution on Linux and Windows.
## Testing
- Add Linux coverage for preserving birth time in no-follow metadata.
- Add cross-platform coverage for sandboxed no-follow operations and removal of files and empty directories.
GitOrigin-RevId: 1bc531669839bf5d033aa4a215220ed1cc5f63d5
## What changed
Add macOS-only integration coverage that runs commands under the production
Seatbelt policy and verifies:
- deny globs protect matching files, directory ancestors, symlink aliases, and
paths created after policy application;
- protected directories cannot be moved, replaced, or exchanged across
writable roots; and
- standard read-only and workspace-write profiles continue to allow expected
filesystem operations.
GitOrigin-RevId: 1f666835ee402bedd1d32e87f1082eaaf7b7bf6a
## Why
Plugin imports persist user-global enabled state. Repository-controlled settings
must not be allowed to select executable plugin content for installation.
## What changed
- Detect plugin migrations only from home-scoped external agent settings.
- Reject plugin imports with a non-empty project `cwd` before loading Codex
configuration, while continuing to treat an empty `cwd` as home scope.
## Testing
- Cover repository-scoped detection with remote, installed, and project-relative
marketplaces.
- Verify that forged project-scoped imports fail without writing `config.toml`.
GitOrigin-RevId: 53cb46ae049cb49283187312d475d40cf42e35ab
## What changed
- Add `max` and `ultra` to the TypeScript `ModelReasoningEffort` type.
- Add matching Python `ReasoningEffort` members and preserve them when SDK artifacts are regenerated.
- Update the Python model-selection examples to rank the new effort levels.
## Testing
- Cover serialization of both new Python enum members while continuing to accept unknown future values.
GitOrigin-RevId: 1412b77bdbb2530f5d38921cdea971dd34458353
## What changed
- Add the configurable `vim_normal.replace_char` action, bound to `r` by default, to replace the grapheme under the cursor while remaining in normal mode.
- Support change-operator motions such as `cw`, `c$`, `cj`, and `ck`, plus the repeated `cc` command for changing the current line.
- Let `Esc` cancel a pending replacement before it reaches composer-level handling.
- Preserve existing custom Vim bindings and chord prefixes when introducing the new default.
## Testing
- Cover replacement, grapheme boundaries, remapping and unbinding, change motions, cancellation, keymap conflicts, and keymap picker snapshots.
GitOrigin-RevId: 98feb4eeb57142c37adb73abfe58d1f703b9270d
## Why
An `apply_patch` path can be replaced with a symlink after verification, allowing an unsandboxed patch operation to reach a different file than the one that was approved.
## What changed
- Add `follow_symlinks` options to executor filesystem reads, writes, metadata lookups, directory creation, and removal, including the corresponding `followSymlinks` protocol fields.
- Implement no-follow filesystem operations on Unix and Windows that reject links in any path component and restrict file access to regular files.
- Run `apply_patch` with symlink traversal disabled when an otherwise-required sandbox is bypassed, while retaining the existing follow-symlink default for standalone callers.
## Testing
- Cover leaf and ancestor symlinks across patch add, update, delete, and move operations, including a path swap after verification.
- Exercise local and remote no-follow filesystem behavior, concurrent directory creation, special-file rejection, and Windows reparse points.
GitOrigin-RevId: 43fd479084891493ce13564fbd894b98f329c6dd
## What changed
- Allow the Guardian V2 approval monitor to handle reviews for models that require automatic review.
- Preserve full Guardian review when Guardian V2 is disabled by configuration or managed requirements.
- Cover required-model routing for low- and high-risk actions, plus both Guardian V2 disable paths.
GitOrigin-RevId: d1201cc3dbd7c4a07de633388b14f17ada9feb39
## What changed
Print a warning to standard error when `codex mcp-server` is invoked, noting
that the command is deprecated and will be removed in a future release. The
server continues to launch after the warning.
GitOrigin-RevId: 0fefa2579a420a2fad85ef3afe373204f9836869
## What changed
- Add Linux-specific install and launch guidance to the generic and paid tooltip pools when `DISPLAY` or `WAYLAND_DISPLAY` is set.
- Keep the Linux tooltip hidden in WSL and headless sessions, and preserve platform-specific macOS and Windows behavior.
## Testing
- Add coverage for native graphical Linux, WSL, headless Linux, macOS, and Windows tooltip selection.
GitOrigin-RevId: cbe9435db064d5718a591db363dcb7cc1429d5ee
## What changed
- Run local and remote compaction test turns with approvals disabled and an unrestricted permission profile.
- Keep the full test harness available where compaction turns need the configured model and working directory.
- Enable the Windows sandbox for managed-network unified exec process-event coverage.
- Update request snapshots to reflect the resulting `danger-full-access` sandbox metadata.
GitOrigin-RevId: 38eb46ca6ab28246d738e31eab900b2825072c7d
## Why
Project instructions must respect the selected environment's filesystem read
permissions. Tightening those permissions for a later turn must not allow
previously cached instructions to reach the model.
## What changed
- Apply each environment's filesystem sandbox while discovering and reading
`AGENTS.md` files.
- Fail thread or turn setup when sandboxing blocks a discovered instruction
file, while allowing a restricted project with no instructions to start.
- Clear cached instructions before refresh and include the Windows sandbox
level in the cache key.
- Ignore inaccessible ancestor marker probes so readable instructions in the
selected working directory can still load.
## Testing
Added coverage for restricted projects, denied instruction files, cache
invalidation after permissions tighten, and unreadable ancestor markers.
GitOrigin-RevId: 6ea1a27b9c873a6260e4f87d42ae1317a6a4ae4b
## Why
Installer `bin` directories can be junctions, so looking for bundled helpers
relative to the apparent executable path can miss the package's
`codex-resources` directory.
## What changed
Retry bundled executable lookup from the canonical executable path when lookup
from the original path fails.
## Testing
Add a Windows regression test that creates a `bin` junction and verifies that
the sandbox setup helper is resolved from the package resources directory.
GitOrigin-RevId: f2f20ce1ccfa95ae65171a03a986d10e2560e696
## What changed
Run both branches of the heuristically safe command policy test with the
Windows sandbox level set to `RestrictedToken`.
GitOrigin-RevId: ae5d754ec4a51d73a8e5f9d844f94a91f795fb72
## Why
Model provider configuration could override the residency header required by
`enforce_residency`, so provider-backed requests did not reliably honor the
managed setting.
## What changed
- Apply the managed residency header after building a provider, making it
authoritative for model requests and model discovery.
- Warn when a provider configures the residency header through
`http_headers` or `env_http_headers`, while preserving the original provider
configuration and unrelated headers.
- Cover HTTP and WebSocket requests, model discovery, and case-insensitive
header detection with targeted tests.
GitOrigin-RevId: 461ef8989d5bd06ffdea694aee4265e392e07590
## Why
Developer messages can contain both inherited agent policy and unrelated context. Full-history forks need to replace the parent policy without dropping the unrelated content that shares its message.
## What changed
- Filter fork-specific developer instructions by content item instead of excluding an entire developer message.
- Remove inherited multi-agent mode instructions before applying the child agent's current mode.
- Preserve unrelated content items and discard developer messages only when filtering leaves them empty.
## Testing
Extend agent-control and subagent notification tests to cover compound compacted messages, multi-agent mode instructions, and proactive-to-explicit mode transitions.
GitOrigin-RevId: 028834e237d8636c13b17a724574bc8eb09a55ba
## Why
Starting an archived session with `codex resume` or `codex fork` stopped with
guidance to run a separate `codex unarchive` command first.
## What changed
- Detect archived-session startup failures and offer to unarchive and retry the
requested operation.
- Allow the user to cancel without modifying the archived session.
- Render the confirmation in the alternate screen when available and preserve
inline terminal context when `--no-alt-screen` is set.
- Preserve `--no-alt-screen` whether it appears before or after the `resume` or
`fork` subcommand.
## Testing
- Cover confirmation, cancellation, retry behavior, and unrelated startup
failures for both resume and fork.
- Add prompt interaction and terminal rendering coverage, including narrow and
inline viewports.
GitOrigin-RevId: 382cdbd15b5d12c091e554d6d3a2f9b3589654f4
## Why
OAuth token endpoints can report an unusable refresh token with the standard
`invalid_grant` error instead of a legacy expired, reused, or revoked subtype.
## What changed
- Classify `400 Bad Request` responses with an `invalid_grant` error code as
permanent refresh failures, preserving the generic failure reason.
- Cache that failure so subsequent refresh attempts do not repeat the request.
- Keep other `400 Bad Request` errors transient and retryable.
## Testing
Added refresh tests covering terminal `invalid_grant` responses and retryable
`invalid_request` responses.
GitOrigin-RevId: 513d34b514a7e4118a70c76e9d0fe779c006d5d8
## What changed
- Render `StrictReviewRequired` notifications as warning history cells that explain tool calls may take extra time.
- Preserve the active command and task-running state when the notification arrives.
## Testing
- Add a TUI snapshot test covering the warning and continued command output.
GitOrigin-RevId: bf01b612a22b537b247b6df6818080fc73b5414d
## What changed
- Add `Config::resolve_permission_profile` to resolve named profiles from the
effective configuration and managed requirements.
- Make active-profile network proxy lookup public and re-export
`CodexThreadSettingsOverrides` from `codex-core-api`.
- Cover configured and managed profile inheritance, duplicate-name rejection,
and preservation of managed network settings.
GitOrigin-RevId: ffb5f54a932ef1a4b624677b5f051ecdcd1134b8
## What changed
- Exclude sandboxed `exec_command` and `shell_command` calls from Guardian v2 classification by default while continuing to classify calls that request `require_escalated` permissions.
- Add `guardianv2.review_scope.sandboxed_exec_commands` to opt sandboxed shell commands back into classification.
- Keep other tools and namespaced shell tools in scope, and advance tool-call progress when a call is skipped.
## Testing
- Cover the default and configured review scopes, tool namespaces, permission modes, and skipped-call progress tracking.
GitOrigin-RevId: 32fb540c69959b9a82569f0f2fc76b5517496e6b
## What changed
- Remove `untrusted` from the CLI, configuration schema, and MCP tool interface. Explicit `approval_policy = "untrusted"` settings now fail with an actionable error.
- Remove the known-safe command allowlist. Projects marked untrusted now request approval for every command unless an explicit exec policy rule allows it.
- Keep command parsing conservative by treating in-place `sed` forms as mutating and ignoring unrecognized commands when recording memory usage.
## Testing
- Cover rejection of the retired configuration value and approval requests for commands in untrusted projects.
GitOrigin-RevId: d6bf425edddfffbb325eee6acf383434af5fd33b
## Why
The Linux sandbox represents missing protected metadata paths such as `.git`
with empty read-only directories. Repository and project discovery treated any
`.git` directory as a checkout root, so this synthetic directory could hide a
real parent repository and its trust configuration.
## What changed
- Treat a `.git` directory as repository metadata only when it contains
`HEAD`, while continuing to recognize file-based `.git` entries.
- Protect missing `.git` paths with the same read-only synthetic mounts as
other workspace metadata without disrupting parent-repository discovery.
- Canonicalize and read-only bind the synthetic-mount registry into the
sandbox, and make protected-path cleanup handle read-only directory trees.
## Testing
Added coverage for repository, project-root, trust, synthetic-mount, and
Landlock behavior, including nested incomplete `.git` directories and a
redirected `TMPDIR`.
GitOrigin-RevId: 0724c54d56531143bb28011e4ca414cd3b0212be
## What changed
- Add the opt-in `cwd_relative_turn_diffs` feature.
- When enabled, render turn diff paths relative to each selected environment's
working directory instead of the detected Git root.
- Preserve repository-root-relative paths when the feature is disabled.
## Testing
- Cover enabled and disabled behavior for nested working directories across
supported originators.
GitOrigin-RevId: 8b4908706a82b01f33ccd035b0945f9a29fce26f
## Why
Renaming a writable directory could move protected descendants outside the
paths covered by their read-only or unreadable policy entries.
## What changed
- Deny unlink-style writes to directory ancestors of protected paths, placing
these rules after broader write allowances in the generated Seatbelt policy.
- Apply full write denies to unreadable glob matches and protect their directory
ancestors against renames.
- Support brace alternation and backslash escapes when translating filesystem
globs into Seatbelt regular expressions.
## Testing
Add coverage for ancestor rename attempts across explicit read-only and deny
entries, multiple glob forms, canonicalized glob paths, and the new glob syntax.
GitOrigin-RevId: edfda9d4c2bc7ba2ecd6b67744446871e526084f
## What changed
- Use `ExecutorFileSystem::read_file_stream` for capability files and executor skill resources regardless of whether filesystem sandboxing is active.
- Enforce per-file and bundle size limits incrementally as chunks arrive.
- Preserve the existing error for Windows resources when the required filesystem sandbox is unavailable.
GitOrigin-RevId: 1a40602a8f913588ec9a6ad7edd2d62eb82436e1
## Why
Windows Terminal can discard rows scrolled through a partial DEC scroll region instead of retaining them in terminal scrollback.
## What changed
- Detect Windows Terminal, including via `WT_SESSION`, and use full-screen scrolling for inline viewport growth and history insertion.
- Keep the existing terminal-wrapped history behavior for Zellij while centralizing terminal-specific scrollback selection.
## Testing
Add VT100-backed tests covering strategy selection and preservation of scrollback during history insertion and viewport growth.
GitOrigin-RevId: 209a7a8053a1fcf911d6e0aee764e563b8725bd1
## What changed
- Initialize custom text prompts with the main composer's editor keybindings and Vim setting.
- Support Vim mode transitions, operator sequences, cursor styles, keymap contexts, and mode-aware footer hints in these prompts.
- Start Vim prompts in insert mode, use the first `Esc` to enter normal mode, and preserve `Esc` cancellation outside Vim.
## Testing
- Cover remapped editor and Vim commands, mode and context transitions, paste handling, cancellation, and footer rendering at different widths.
GitOrigin-RevId: 7a678310639dafb938084197df23d6d2a080a051
## Why
A checkout could point its `.git` file at a trusted repository's worktree
directory without proving that the repository had registered that checkout.
This could cause project configuration from an unrelated checkout to be treated
as trusted.
## What changed
- Verify the linked worktree's `gitdir` backlink, `commondir`, registered
checkout, and main checkout ownership before resolving the main repository's
trust key.
- Reject missing, oversized, symlinked, mismatched, or swapped Git metadata.
- Preserve valid linked worktrees that use path aliases, separate Git
directories, or non-UTF-8 POSIX paths.
## Testing
Add resolver and config-loading coverage for forged worktrees, metadata races,
case-sensitive paths, moved worktrees, and host MCP startup from project config.
GitOrigin-RevId: 6052a7d10ad2d613436f20175c356abdef8c758e
## Why
An authorization server discovered for an MCP server can change. A stored refresh token must not be sent to a different issuer than the one that originally granted it.
## What changed
- Persist the discovered authorization server issuer with new OAuth credentials and preserve it across refreshes.
- Validate that issuer against a single pinned metadata snapshot before refreshing or adopting stored refresh credentials.
- Require reauthentication when refresh credentials have no issuer or the issuer changed. An unexpired access token can still be used without exposing its refresh token.
## Testing
Add coverage for issuer persistence, missing and changed issuers, metadata changes during startup, and refresh-token preservation.
GitOrigin-RevId: 07e48ba892f627428a28bbed5cca4ad703e2a5fd
## Why
Deriving permissions from the parent of an already-writable patch target can
unnecessarily grant write access outside the intended workspace.
## What changed
Skip targets already covered by the active filesystem sandbox policy before
deriving additional parent-directory permissions. Targets outside the writable
area continue to request the required parent access.
## Testing
Added unit and CLI regression coverage for workspace-directory targets,
already-writable parents, and symlink escapes outside the workspace.
GitOrigin-RevId: 187109ff0b56a1a399cb8a9981b7e822977025d5
## Why
The fallback file contains OAuth credentials, so it must be private from the
moment it is created and writes must not follow links to another path.
## What changed
- Create the fallback file with mode `0600` on Unix before writing credentials.
- Reject symlinks and other non-regular files on Unix and Windows, including
Windows reparse points.
- Truncate and update an existing regular file through the validated file
handle, restoring private Unix permissions when needed.
## Testing
Added coverage for creation under a permissive umask, updates through an
existing hard link, permission restoration, and symlink rejection.
GitOrigin-RevId: d3e4be52e8f4cebb66c59d496a7f77a952a2d0d9
