## What changed
Extract MCP approval elicitation parsing and review-decision response conversion from `core/src/session/mcp.rs` into `codex-guardian-reviewer`. Export the helpers and `GuardianElicitationReview` for the session code to use, while keeping session lookup, provenance checks, and approval enforcement in the host.
## Testing
Move the existing elicitation tests into the reviewer crate, retaining coverage for request construction, opt-in requirements, unsupported forms, decision mapping, and model-specific timeout instructions.
GitOrigin-RevId: fb745fa0e49a29f015bbda16c14b5fc2b12278b9
## What changed
Move review evidence storage, authorization snapshots, sender exchange selection,
and bounded Node REPL evidence into `codex-guardian-reviewer`. Update core to
call or re-export these APIs while retaining host-specific context rendering and
capture-mode selection.
Move the existing Node REPL evidence and text truncation tests alongside their
implementations in the reviewer crate.
GitOrigin-RevId: d851cd353cf9f31eb47ce13f43f6f935dc2f5d93
## What changed
Move `GuardianContextMode`, parent compaction checkpoint policy, and reviewer instruction assembly into `codex-guardian-reviewer`. Export the conversation-history prompt and follow-up reminder from the same crate, and update core to use these shared definitions.
Keep session-specific authorization version lookup in core while preserving existing context selection, checkpoint validation, and prompt behavior.
GitOrigin-RevId: a4cadb6c8ad95e756467316b7d8658e8cd527b24
## What changed
Move review state, fork history, checkpoint recovery bookkeeping, and Node REPL evidence admission into `codex-guardian-reviewer`. Expose helpers for session initialization and snapshot publication, and update core to delegate to them while preserving the existing review logic.
GitOrigin-RevId: 56d6a0124301a3c70908614d4bc3bfe970ac1c85
## What changed
`review/start` now supports only inline reviews on the supplied thread and returns that thread's id as `reviewThreadId`. Clients can omit `delivery`, send `null`, or specify `"inline"`; `"detached"` is no longer supported.
For a separate review thread, call `thread/start` followed by `review/start`. To preserve conversation history with custom review instructions, use `thread/fork` followed by `turn/start`.
Remove detached review execution and its app-server dependency on `codex-agent-extension`, and update the protocol schemas and generated clients. Preserve `ReviewDelivery.inline` as a Python enum member.
## Testing
Add a Python regression test verifying that inline review delivery parses as `ReviewDelivery.inline` and round-trips to the original JSON.
GitOrigin-RevId: ed16c5271c3315ae3afcb3ee78883ed421394b4d
## Why
Managed OpenTelemetry requirements could not specify span attributes or tracestate metadata.
## What changed
- Accept `otel.span_attributes` and `otel.tracestate` in requirements, merge them by attribute or member field, and expose them through app-server configuration and requirements reads.
- Protect required entries and their ancestors from configuration writes while preserving unmanaged sibling values and their origins. For example, requiring `otel.tracestate.vendor.tenant` leaves `vendor.region` writable. Empty metadata maps impose no requirements.
- Select Rustls when configuring an OTLP HTTP client certificate and private key so PEM client identities are accepted.
## Testing
Add coverage for metadata precedence, effective configuration, field-level write protection, and preservation of unmanaged values. Add blocking and asynchronous HTTP client construction tests using generated PEM certificates and keys.
GitOrigin-RevId: ada6000cc5e575b9a33451ec4aa58b6686dc20f7
## What changed
- Allow `requirements.toml` to manage OpenTelemetry logging flags, tool-result byte limits, environment, and log, trace, and metrics exporters.
- Apply higher-priority managed values over user configuration, replacing exporters atomically and warning when configured values conflict. Preserve unmanaged settings, including `span_attributes` and `tracestate`.
- Expose managed `otel` settings through `configRequirements/read`, apply them in `config/read` without ordinary field origins, and reject configuration writes that overlap managed fields.
- Distinguish omitted tool-result limits from explicit values while preserving the runtime default.
## Testing
Add coverage for requirement precedence, relative TLS paths, override warnings, managed write protection, effective configuration reads, and exporter serialization through the app-server API.
GitOrigin-RevId: 6a3343563bd3acb53a366ea6723684e3d0a4a01d
## Why
Pre-generated bindings can disagree with native V8 layouts, including CppGC member storage and the inline typed-array size. Source archives need bindings generated with the same headers, defines, and target configuration.
## What changed
- Generate bindings through Bazel using the archive's C++ compilation metadata, and include them in Darwin and Linux release pairs and source builds.
- Select native Windows MSVC archives and matching bindings together with `--//:rusty_v8_from_source=true`, and generate target-specific Windows GNU bindings.
- Pin a corrected `rusty_v8` revision for Cargo and Bazel, and track native Windows LLVM tools and resources as action inputs so pin changes invalidate cached actions.
- Run release and canary Cargo smoke tests with explicit target triples, required Linux linkers, and `--include-ignored`.
## Testing
Add `codex-v8-poc` coverage for CppGC member size, alignment, tracing, and weak references; typed-array contents and backing-store promotion; and microtask queues across garbage collection and context reassignment. Enable the otherwise ignored CppGC ABI checks for Bazel source builds and staged release smoke tests.
GitOrigin-RevId: 9edfa057a0ef2e323543bb8132c070d336ded1b2
## Why
Model catalog refreshes need to use the same registered actor and credential owner as model requests when runtime authentication is enabled.
## What changed
- Add `ProviderAuthContext` to carry credentials and optional runtime authentication into model providers and catalog clients.
- Select runtime authentication independently for inference and catalog destinations. Reject unsupported OpenAI origins while preserving provider authentication for other destinations.
- Include API organization and project selectors in runtime registration. Reuse registered runtimes across projects within an organization and replace them when the organization changes.
- Preserve transport restrictions and account bindings, and strip sensitive headers on cross-origin redirects.
- Apply the catalog timeout to authentication and fetching while allowing credential refresh and registration to finish safely.
## Testing
Add coverage for runtime-authenticated catalogs, provider isolation, resource selection, gateway authentication, cross-origin redirects, and timeout recovery that preserves registration and refreshed tokens.
GitOrigin-RevId: c14f1a02159031ea0af1f9b26ea890f8dca7d6ad
## Why
Repeated repository skill discovery performs remote metadata requests even when no `.agents/skills` directories exist. Reuse verified empty results to avoid those round trips while watching for changes that require a new scan.
## What changed
- Add the Linux executor capability `fs_watch_missing`, the `fs/watchMissing` request, and `fs/missingChanged` notifications.
- Register watches in the background and reuse empty results only after the executor acknowledges coverage. Key reuse by filesystem, working directory, and project root markers.
- Invalidate observations on relevant filesystem or mount changes, watch supersession, or connection loss. Clear cached observations on forced reloads and cache resets.
- Retain live discovery while registration is pending or watching is unsupported, unavailable, or cannot verify the observation.
## Testing
Add tests for empty-result reuse and invalidation, skill directory creation before watch acknowledgement, unsupported executors, idle WebSocket notifications, reconnection, case aliases, and bind mounts and unmounts. Include an ignored manual latency comparison for repeated empty remote scans.
GitOrigin-RevId: 3ad499decefb184a99c068afa01d0dcdd8605c7f
## What changed
Extract executor startup into `codex-exec-server-cli`, shared by `codex exec-server` and the new standalone binary. Preserve executor arguments, authentication, configuration overrides, and sandbox helper dispatch across both entry points.
Build the standalone binary with `cargo build -p codex-exec-server-cli --bin codex-exec-server` and run it with `codex-exec-server --listen stdio`.
## Testing
Add standalone CLI parsing and help coverage, plus an integration test for version reporting, stdio initialization, filesystem reads, process execution, and sandbox helper re-execution when supported.
GitOrigin-RevId: ab3a81c6b91b6f45e4d72d8add2e01af8372e97f
## What changed
- Add `--codex-ui-plugin-process` to `codex-code-mode-host` and a typed protocol for initializing, invoking, and closing UI plugin isolates.
- Support persistent module state and string results from synchronous or promise-based exports across up to 32 isolates in one helper process.
- Require sandbox-enabled V8 with JIT disabled, restrict executable loading and globals, and enforce execution deadlines and per-instance queue, source, result, and promise limits.
- Close affected isolates on script failures, cancellation, or overload, and return bounded script diagnostics.
- Bump the helper handshake to version 3 and increase the maximum frame size to 1 MiB.
## Testing
Add wire-level integration tests and runtime unit tests covering promise settlement, cancellation, loading restrictions, diagnostics, failure isolation, capacity reuse, transport bounds, and watchdog synchronization. Add CLI tests for argument validation before helper startup.
GitOrigin-RevId: bad6a57c84d9197c1fd76a78cf060502c5bc8bb8
## What changed
Move approval-request assessment and analytics mappings, target item lookup, and turn ID selection into `codex-guardian-reviewer`. Export the helpers from the crate and re-export them in core, preserving existing behavior.
## Testing
Move the apply-patch serialization test into the reviewer crate. It checks that Windows paths are preserved and patch text is omitted from the assessment action.
GitOrigin-RevId: 3a011db0bc51c653bb0877c4b0cb52eb61c63244
## What changed
Export `GuardianApprovalRequest`, `GuardianNetworkAccessTrigger`, and
`GuardianMcpAnnotations` from `codex-guardian-reviewer` and re-export them in
core. Move environment lookup and scope classification with the request type,
preserving existing classification and credential-safe debug output.
GitOrigin-RevId: 5253a5124d5e370a1230b46aa7dc48b24b1c902e
## What changed
- Add `codex-plugin-host` to launch a helper with a cleared environment, verify its readiness handshake, and expose framed stdin/stdout pipes with a 256 KiB frame limit and write backpressure.
- Support startup cancellation and process-group cleanup, retaining exit status and the last 16 KiB of stderr while omitting raw diagnostics from `Debug` output.
- Extend the Bazel crate macro to support test-only binaries and fixture entry points outside `src/`.
## Testing
Add process integration tests for framed communication, startup cancellation, helper and descendant cleanup, repeated close calls, and bounded diagnostics from startup and runtime failures.
GitOrigin-RevId: ed539e7899af06ee83a0d8c2d0ea8cec10f19afb
## What changed
Remove the `i18n-config` Git patch and its `cargo-deny` Git source allowance. Update the Cargo and Bazel lockfiles to use the crates.io release of `i18n-config` `0.4.8`, restoring its `basic-toml` dependency and adjusting the locked TOML dependencies.
GitOrigin-RevId: 4d4f6c52dddf79d2006e170432347ab79280da51
## What changed
- Add optional `omitted_paths` and `denied_reads` fields to catalog permission messages. The latter requires exactly one `{{ denied_reads }}` placeholder.
- Preserve mandatory denial and no-bypass warnings, path/glob facts, and existing path selection limits. Limit each override to 500 UTF-8 bytes and fall back independently to bundled wording for invalid overrides.
- Pin `i18n-config` to an upstream revision that removes the unmaintained `basic-toml` dependency, updating Cargo and Bazel lockfiles.
## Testing
Add serialization and rendering coverage for sparse values, invalid templates, byte limits, and preserved policy facts. Extend model-switch scenarios to verify that warning wording follows the selected model while preserving request history and permission annotations.
GitOrigin-RevId: f5fa1a978abe07d90917f552c64e7c8fc257c061
## Why
NFS database migration rejected files with group or other access. Allow accessible databases to migrate while making the effects on file access explicit.
## What changed
- Preserve file mode bits during migration while requiring owner read and write permissions on replacement files.
- Before CLI consent, disclose that replacements belong to the current user and do not copy the original owner, group, or extended ACLs. Require explicit confirmation for files with permissions other than `0600`.
- Warn at Linux TUI startup when NFS databases need migration and permission confirmation. Inspect journal mode without accessing WAL shared memory or releasing another connection's locks.
- Allow five seconds to acquire the exclusive database lock during migration.
## Testing
Add CLI coverage for consent, access disclosures, and migration of `0644` files. Extend state tests for permission preservation, rejection of missing owner access, and interrupted migration recovery; snapshot the startup warning.
GitOrigin-RevId: 2d9c3663172c3e631a787dc1dc76db95c39e6aa1
## Why
Existing databases retain their journal mode, so selecting `DELETE` for new NFS databases leaves existing WAL databases unchanged.
## What changed
- Add the managed `unsafe_enforce_sqlite_journal_mode` requirement to migrate existing NFS databases before opening writable pools and require `DELETE` on each connection.
- Share migration code between startup and `codex migrate-nfs-db`, preserving WAL backups and resuming interrupted replacements, including lazily opened databases.
- Hold the migration lock through pool initialization and keep migration failures out of automatic corruption recovery.
- Preserve local logs behavior and skip legacy NFS logs cleanup when enforcement is enabled.
## Testing
Add coverage for requirement precedence, database settings, data and backup preservation across restarts, interrupted replacement recovery, refusal of active WAL databases, migration lock waiting, and local logs remaining in WAL mode.
GitOrigin-RevId: da41ec1b58b1ee8092591cdf8b358280928ff9d4
## What changed
Advertise `zstd-stream-v1` compression for WebSocket and Unix socket connections and use the negotiated codec for JSON-RPC messages. Retain compression history for the connection and keep plain-text messaging when compression is not negotiated.
Fragment compressed writes to respect the server's advertised frame limit, reject text messages in compressed sessions, and stop using the connection after a failed write to avoid mismatched compression history.
## Testing
Add an integration test covering compression negotiation, fragmentation, retained codec history, request/response handling, and disconnection on an uncompressed text message.
GitOrigin-RevId: 510073444ea49376a116c05214bcb79bd0bc3b50
## What changed
- Configure the code-mode host to send zstd-compressed responses when clients advertise support, and enable both client transports to accept them.
- Preserve uncompressed responses for clients that do not advertise zstd support.
- Patch `tonic` in Bazel builds to use zstd compression level 1, favoring response latency over compression ratio.
## Testing
Extend the TCP session integration test to check response encoding and successful session opening for both zstd-capable and uncompressed-only clients.
GitOrigin-RevId: b6cf0da51dd30fc2ac9a1b0af11bec26555c559d
## What changed
Add the default-disabled `critical_path_timing` feature to capture dependency paths for root-agent turns. Connect direct tool dispatch, execution-lock handoffs, and completed tool batches to turn timing so overlapping work shares its common history without double counting.
Omit captures for unsupported dependencies, including CodeMode, agent communication, approval review, and user waits. Settle aborted tasks before freezing timing, invalidate captures on forced teardown, and apply runtime feature changes only to future turns.
## Testing
Add coverage for serial and overlapping tool dispatch, execution-lock dependency handoffs, cancellation, unsupported paths, frozen timing after completion, and configuration refresh boundaries.
GitOrigin-RevId: 71458b654b1c4a05799886928b449c948ea33109
## What changed
- Add opt-in runtime authentication through `ModelClient::with_runtime_auth`, requiring the provider and runtime manager to share the selected OpenAI credentials.
- Keep runtime identity, credentials, routing, and transport selection consistent for each request and its retries, signing a fresh assertion for each attempt.
- Apply authentication asynchronously to WebSocket handshakes, replace stale authentication headers, and reconnect when the runtime changes.
- Reject account, organization, or project selectors that conflict with the registered runtime, and preserve gateway OAuth composition.
## Testing
Add coverage for dual-header and assertion-only authentication, HTTP retries, runtime replacement and account switches, stale WebSocket headers, selector mismatches, gateway OAuth failures, transport revocation, and Realtime compatibility.
GitOrigin-RevId: 45b9efc2c80481406a0f6f6396a8cdd21d933c12
## What changed
Move `HeadTailBuffer` and `format_output_omission_marker` into the new
`codex-utils-head-tail-buffer` crate, exposing the buffer API with an explicit
const-generic byte budget. Update core callers to use the crate and add Cargo
and Bazel definitions.
Move the existing buffer tests alongside the implementation, preserving the
prefix/suffix retention and omission-marker behavior.
GitOrigin-RevId: ff488d0a0a62c39c0e11c11ebb539166cc4c6e74
## What changed
Apply the 512-token approval reason cap in `guardian-context` when composing synchronous full and delta reviews, before request budget enforcement. Remove truncation from the requesting host and preserve exact action JSON.
## Testing
Extend the planned-action budget test to cover long approval reasons in both synchronous presentations, verifying that optional tool descriptions can be omitted without changing action arguments.
GitOrigin-RevId: 8cdb6aadd5f50194f63ebd2402193e69bed127cc
## What changed
Add the `codex-guardian-v3` crate to the Cargo workspace with a Bazel target. Expose helpers to configure the `guardian` storage namespace and construct a `LocalBoard` for the owning main thread's session ID.
GitOrigin-RevId: 3314711475a7024380a3f0beb8f5ddfc4ff19723
## Why
Repeated image outputs in different request payloads could fail replay with a call ID reuse error even when their content was unchanged.
## What changed
- Hash canonical JSON for non-text content parts and compare their `content_sha256` values independently of payload location.
- Preserve empty content arrays as empty bodies so they also match across snapshots.
## Testing
Add a regression test verifying that repeated image and empty tool outputs reuse conversation items, while changed image content with the same call and item IDs still fails replay.
GitOrigin-RevId: 07699312675764079f679fd2c12ba6679332d709
## What changed
- Add loaders that select `config_server` when configured and otherwise use the existing ChatGPT bundle source. Fetch custom bundles from `<base_url>/codex/config/bundle` without redirects or request logging.
- Support optional OAuth sessions without interactive login during bundle fetches, recover credentials after a `401`, and scope cached bundles to the endpoint and authorization identity.
- Restrict bootstrap network access to configuration and OAuth endpoints using local administrator rules when available.
- Return generic bundle validation errors so invalid TOML, requirements, and provider settings do not expose configuration contents.
## Testing
Add tests for missing configuration-server sign-in, replacement OAuth credentials, endpoint-specific cache reuse, and validation errors that omit sensitive values while preserving cached bundles.
GitOrigin-RevId: 56590a9e66340540666ca21590bef46c495e0e33
## What changed
- Read optional tool descriptions and parameter schemas for `history`, `notes`, `new_context`, and `get_context_remaining` from the acting model's catalog messages.
- Support catalog namespace descriptions for history and notes, preserving explicit empty and whitespace descriptions.
- Share catalog override handling across native tools and MCP resource helpers. Keep bundled schemas when overrides are invalid, preserve encrypted parameters, and leave tool identity and transport fields unchanged.
## Testing
Add coverage for sparse catalog serialization, schema fallback and encryption preservation, per-step tool definitions, and context tool updates when switching models. Extend outgoing-request tests to verify history and notes overrides while retaining history image attachments.
GitOrigin-RevId: 1adac8b5009f95c91adba491f20a4e2e2dc91475
## Why
Model output alone does not establish that an item entered conversation history. Treating every response item as accepted can include discarded attempts, while relying on a later request misses accepted final output when a turn ends or is interrupted.
## What changed
- Record `HistoryItemAccepted` events and retain Responses item IDs, generating missing IDs consistently across item events.
- Build thread conversation history from request inputs, compaction checkpoints, and explicit acceptance. Keep unaccepted output accessible through its inference call.
- Preserve inference provenance across retries and late response records without overwriting newer request or compaction snapshots.
- Mark turns with errors as failed. Bump trace schemas to version 2 and reject incompatible bundles and event schemas during replay.
## Testing
Add reducer coverage for discarded attempts with identical text, late responses, compaction, inherited context, and legacy bundle rejection. Add CLI integration tests that run `debug trace-reduce` after success, stream failure, and interruption followed by shutdown, including responses without provider item IDs.
GitOrigin-RevId: 8e387a91d9b3f704df82847d630e6f0b08f998b3
## What changed
Add an optional `NetworkPolicyMetadataProvider` to the MCP runtime. Advertise `codex/network-policy-meta` only to trusted ChatGPT origins when a provider is available, and attach policy metadata only when the sending session also advertises support.
Strip caller-supplied policy metadata and derive restrictions from the call's captured permission profile and server environment. Resolve metadata against each session's capabilities, including after recovery, while retaining one policy snapshot per call. Fail the call before sending if policy resolution fails. Existing runtime callers leave the provider unset.
## Testing
Add tests for capability negotiation, trusted-origin restrictions, forged metadata removal, both tool dispatch paths, and policy snapshot reuse. Add HTTP session-recovery coverage for changing capabilities and policy-resolution failures while preserving caller metadata and read-only restrictions.
GitOrigin-RevId: 4b978f986abc0475fc67659be98fc01a2d6ce7cd
## Why
Allow workloads to make AWS requests with placeholder credentials while keeping real AWS credentials in the trusted proxy process.
## What changed
- Add an `aws_sigv4` hook action with a placeholder access key ID, region, service, HTTPS port, and credential sources from proxy environment variables or files.
- Re-sign matching requests after network and hook authorization and header transformations, using the configured credentials and optional session token.
- Support empty payloads and explicitly unsigned payloads, including streaming unsigned S3 uploads. Reject selected requests with incompatible credential scopes, presigned URLs, unsupported streaming signatures, or ambiguous framing through the hook denial path.
- Mark generated credential headers as sensitive and suppress signing SDK trace events that could expose credentials.
## Testing
Add tests for the published AWS IAM signature vector, unsigned S3 uploads with a session token, and rejection of invalid transport, credential scopes, signing inputs, and unsupported bodies.
GitOrigin-RevId: ab4fbbc00ba40a5bb309add521fea6ee2ff6e79e
## Why
Local administrators need to require managed configuration from a specific customer-hosted server before a session can start.
## What changed
- Add a local managed `config_server` requirement with an HTTPS base URL and optional OAuth settings. Validate endpoints and derive the bundle route as `codex/config/bundle` beneath the base URL.
- Replace the entire `config_server` block when a higher-priority requirements layer supplies one, keeping the endpoint and OAuth settings together. Reject this setting in fetched policy.
- Track the applied server through configuration snapshots, role overrides, and refreshes. Reject session startup and managed refreshes when the applied server does not match the requirement; user refreshes retain the session's managed configuration.
## Testing
Add coverage for missing, mismatched, and matching server configuration at session startup, whole-block replacement, rejection of server settings in fetched policy, and preservation across role overrides and refreshes.
GitOrigin-RevId: 51e8a1738dabdb117ae858120f6fb09ae2ff1261
## What changed
- Add `OAuthSessionRequest` to pair access tokens with their authorization identity and retain rejected-token recovery across transient failures and retries. New sign-ins receive an identity that survives token refresh.
- Expose explicit login, logout, and authorization identity lookup, plus a per-manager option to disable automatic browser login while allowing credential reuse and refresh.
- Move serializable `OAuthSessionConfig` into `codex-model-provider-info`, add an optional `device_authorization_url` field, and share endpoint URL validation through `codex-http-client`.
- Distinguish permission failures, transient token endpoint failures, and invalid responses using `io::ErrorKind`.
## Testing
Add coverage for sign-in identity preservation through refresh retries, removal of saved and cached credentials on logout, and suppression of automatic browser login. Extend token endpoint error classification coverage.
GitOrigin-RevId: ae9f72e787171e179fe139a3b840a9f7e1e46506
## What changed
Add the `codex-direct-tool-timing` crate to record tool execution, automated reviews, human waits, and dependency paths. Human waits take precedence over overlapping reviews, and dependency waits with unavailable history are recorded as unknown time.
Invocation guards complete each call once, explicitly or on drop. Separate invocation identities prevent late review or wait guards from affecting calls that reuse an ID; duplicate active IDs disable ambiguous path attribution. Batch timing exposes the last-finishing invocation's path once all calls complete.
## Testing
Add unit tests for parallel batch completion, duplicate and reused call IDs, cancellation, missing dependency history, overlapping reviews and human waits, and nested wait guards.
GitOrigin-RevId: 8b251f51a0c52342657f2d244524b562a371bd8e
## What changed
Expose `connect_windows_proxy` for callers handling a CONNECT `407` response. Use libcurl with the signed-in Windows user's Negotiate or NTLM credentials, then return the authenticated connection with buffered data preserved.
Support HTTP and HTTPS proxies, with default or caller-provided TLS configuration. HTTPS proxies requiring authentication tokens bound to their TLS connection are unsupported.
Enable libcurl's NTLM support in Cargo and Bazel builds.
## Testing
Add a Windows-only test asserting that libcurl provides NTLM, SPNEGO, and SSPI support.
GitOrigin-RevId: 4ed7d2208766404b6125ce2f4b5f91de5616a37f
## What changed
- Store `logs_2.sqlite` in `log_dir` when explicitly configured, unless a managed `sqlite_home` requirement applies. Keep other databases in `sqlite_home` and preserve the existing SQLite log location when `log_dir` is unset.
- Initialize and lock the selected log directory only when opening its database, so an unavailable directory does not prevent authentication commands from loading configuration. Share the cleanup lock across configuration clones and allow failed initialization to be retried.
- Leave existing logs in place. Read legacy logs for diagnostic submissions when the current query returns no logs, attaching them as `codex-logs-legacy.log`. Continue retention cleanup and page reclamation for both locations, with independent maintenance locks and filesystem checks.
## Testing
Add coverage for configuration routing and managed requirements, deferred initialization and lock lifetimes, authentication with an unavailable log directory, legacy log attachments, and cleanup of current and legacy databases.
GitOrigin-RevId: 48216694596d738eff1b3c5eef6c4e7ada6d0137
## What changed
Add `codex migrate-nfs-db` to replace configured SQLite WAL databases in place with validated copies in `DELETE` journal mode, retaining the originals and their sidecar files in backup directories. Stage conversion locally, check database integrity before installation, and support resuming an interrupted replacement.
Require confirmation and exclusive access, with all Codex instances stopped on every host until migration succeeds. The NFS mount must support cross-client POSIX locks. Reject unsupported file permissions and ACLs, and serialize migrations with a migration lock.
Support configuration overrides, `--profile`, and `--staging-dir`. Skip the logs database when `log_dir` is explicitly configured and leave databases already in `DELETE` mode unchanged. Reject remote mode.
GitOrigin-RevId: 7b48cc3a713113a3c09a2243e49b54258bef609d
## What changed
Move the message-board API, types, permissions, storage backends, and tool implementations into the new `codex-message-board` crate. Keep extension registration in `codex-agent-message-board-extension`, and update core and the remote client to use the shared crate directly.
Move the existing board tests with the implementation and add the crate to the Cargo workspace and Bazel build.
GitOrigin-RevId: 33ce527c2bef7f862eba55cb9b32222902ccf4ad
## What changed
Add a save RPC that accepts the existing report options and an absolute `savePath` on the server host. Save the report, selected attachments, and a manifest without uploading, and return `savedPath`, `threadId`, and `promptHash`. Local exports remain available when uploads are disabled by configuration.
Publish archives atomically without replacing existing files. Bound uncompressed contents to 200 MiB and attachments to 128, preserve duplicate attachment names safely, and fail without publishing a partial ZIP when a selected file cannot be read. Honor `includeLogs` and omit automatic rollouts for untouched threads without materializing them.
Update protocol schemas and generated TypeScript and Python types.
## Testing
Add coverage for local-only saves, disabled uploads, path validation, overwrite protection, log consent, archive budgets, duplicate names, missing files, and rollout selection before materialization and after writer shutdown.
GitOrigin-RevId: 222c0fe7ab923904de9c8a9f12ad27f7a0104875
## Why
Managed stderr logs previously retained a tail only before a new launch, allowing logs to grow during a long-running process. Direct stderr writes could also block lifecycle operations on disk I/O.
## What changed
- Route managed app-server and updater logs through a shared nonblocking worker with a bounded queue. Drop records when the queue is full or a record exceeds 16 KiB, and avoid waiting for the worker at shutdown.
- Prune live logs when they exceed 1 MiB, preserving the latest 256 KiB in `.log.previous` before truncating the current file. Keep inherited stderr handles usable after truncation.
- Pause predecessor pruning during Windows updater handoff and resume it after a failed handoff only when ownership has been restored.
- Keep ordinary stderr output when managed logging has not been initialized.
## Testing
Add regression tests for stalled workers and queue overflow, tail retention, inherited append and nonappend handles, and pruning exclusion during updater handoff.
GitOrigin-RevId: b6301962b1180fa6cdb231a56edce2429dc20b54
## What changed
Add `codex-utils-critical-path` to track shared dependency paths and attribute time to inference, automatic review, user waits, tools, overhead, and unknown work. Parallel joins retain the later-finishing branch, preserving its full history without double-counting overlapping work.
Clip attribution to the requested interval and count unrecorded gaps as overhead. Bound retained history by collapsing it into unknown work at the depth limit, with nonrecursive destruction and bounded debug output.
## Testing
Add unit tests for parallel joins, nested dependencies, ties, user waits, interval clipping, overlapping segments, history exhaustion, and safe formatting and concurrent release on small stacks.
GitOrigin-RevId: 2df7453162491d3ae97bf4bee942730c8a4d5e5c
## What changed
- Update Cargo and Bazel toolchain pins, CI and release workflows, and Windows setup from Rust `1.95.0` to `1.99.1`.
- Adapt Rust code to updated APIs and lint requirements, including `try_update` and `as_chunks`, and refresh the halfwidth sound marks snapshot.
- Update `webpki-root-certs` from `1.0.5` to `1.0.10` in the Cargo and Bazel lockfiles.
GitOrigin-RevId: e1aaed63b7e72bb8c8bbe25b32c6329c9a37b6c3
## What changed
Collect compressed rollout paths and scan them in up to four concurrent batches, reusing compiled search patterns within each batch. Preserve match snippets, plain rollout path keys, and per-file error handling.
## Testing
Extend the regression test to verify matches across seven compressed rollouts while skipping a corrupt file, and retain coverage for oversized search patterns and missing files.
GitOrigin-RevId: 522403654ab8577499f8f8043ccc017590c4833e
## What changed
Add `RuntimeAuthProvider` to resolve request authentication through the runtime auth manager. Support `dual_header` mode, which sends a bearer credential alongside `x-openai-agent-assertion`, and `assertion_only` mode, which uses `Authorization: AgentAssertion …`.
Replace stale authentication headers and sign a fresh assertion for each request attempt. Propagate registration failures without falling back to credential-only authentication, preserving policy errors and classifying transport failures, rate limits, and server errors as transient.
Add the disabled-by-default `features.runtime_agent_instances` configuration with independent `enabled` and `mode` settings, schema support, and structured override merging. Selecting a mode alone does not enable the feature.
## Testing
Add coverage for both modes with API key and ChatGPT credentials, stale header replacement, fresh assertions, credential refresh without runtime replacement, registration failures, and configuration parsing and merging.
GitOrigin-RevId: 9e93d25762600f0ff592c5248fe4c8c2c8182c8d
## What changed
- Update `rustls-webpki` from `0.103.15` to `0.103.16`.
- Update `webpki-roots` from `1.0.5` to `1.0.10`.
- Refresh the corresponding entries in `codex-rs/Cargo.lock` and `MODULE.bazel.lock`.
GitOrigin-RevId: c73d2afb6ce9f8bd8756d3cbe6f8114edc461262
## What changed
Read `RequirementsPath` from the 64-bit registry view of `HKLM\SOFTWARE\Policies\OpenAI\Codex` to select the system requirements file on Windows. Require an absolute path and return an error for relative values. If the registry key or value cannot be read, retain the default `OpenAI\Codex\requirements.toml` location under ProgramData.
## Testing
Expand absolute-path validation tests to cover empty, drive-relative, and root-relative paths. Update the Windows default-directory test to remain independent of registry overrides.
GitOrigin-RevId: c31045d749e32cf266b389245ae4db2440156e8e
## What changed
Add `RuntimeAuthManager` to share one registered runtime per credential source and return request-scoped `RuntimeAuth` values that pair the runtime with its credentials and HTTP client factory.
- Preserve registration keys and idempotency IDs across retryable failures and refreshes that retain the credential source.
- Replace the runtime when the credential source changes, preserve existing request snapshots, and reject late registration responses for a previous source.
- Use bounded credential recovery for registration `401` responses and cache `403` denials until the credential source changes.
- Expose authenticated actor and agent host information on `RuntimeAgentInstance`.
## Testing
Add tests for concurrent registration sharing, retry identity preservation, network policy recovery, credential refresh and replacement, bounded recovery, cached denials, and credential changes during registration.
GitOrigin-RevId: ea1e6e10a5939e8c3f7c0c317ccf8a83522c635f
## What changed
Extend `codex-runtime-agent-instance` with a registration client and an in-memory assertion signer. Pending registrations retain their signing key and idempotency key across caller-driven retries; registered runtimes generate fresh versioned assertions with a timestamp and unique ID.
Bound registration requests and responses, reject unsafe endpoints, disable redirects and request logging, and preserve network policy errors. Report server rejections using only the status and recognized error codes.
## Testing
Add HTTP-backed tests for retry stability, assertion signatures and freshness, policy revocation, endpoint and response validation, redirect refusal, and error redaction.
GitOrigin-RevId: a6dab0900459dfb75f72652a0a2ee1e4b65ca322
jif