## What changed
- Retain captured root conversation sources until synchronous preparation applies request limits. Keep asynchronous snapshots limited to the bounded messages.
- Move approval-reason truncation and tool-description escaping and truncation from composition into preparation.
- Extract synchronous image preparation and admission into `guardian-context`, preserving the prompt token cap and model context-window checks.
GitOrigin-RevId: d3a864c77d8f16bd3e77df436d80c4d2738c43cc
## What changed
Move approval request serialization and model-visible action formatting from `codex-core` into `codex-guardian-reviewer`, expose both helpers publicly, and re-export them from core. Preserve the existing JSON shapes and formatting.
## Testing
Move the MCP tool-call and network-access trigger serialization tests into the reviewer crate, retaining coverage for omitted optional fields and Windows path rendering.
GitOrigin-RevId: c0093c023b2f4c1be16bac481f1173a5da6ac25c
## What changed
Export `GuardianPromptItems` and `compose_guardian_prompt` from `codex-guardian-reviewer`, and delegate prompt composition from core to the new helper. Core continues to collect context sections and choose the history version.
Preserve full and delta transcript selection, empty-transcript placeholders, cursor accounting, and Node REPL evidence sequencing.
GitOrigin-RevId: e3e2b2a87a42709ddb5441f47cbb7461b0130579
## Why
Migrating selected threads reads rollout headers even for unrelated threads. Use the state database to skip files whose indexed owner and canonical filename agree that they belong to an unselected thread.
## What changed
- Read thread IDs and rollout paths without creating or migrating the state database, and fall back to header inspection if the index cannot be read immediately.
- Keep inspecting selected, unindexed, misnamed, and conflicting paths so rollout headers still determine ownership.
- Recognize stable thread IDs in reverted rollout filenames and match plain and compressed paths when filtering.
## Testing
Add a regression test covering pruning of unrelated indexed rollouts, including archived and compressed files, while retaining header inspection for selected and ambiguously named files.
GitOrigin-RevId: d76827174c00f5bc9e38ad9b69dadeee91f4415f
## What changed
Export `GuardianApprovalRequest`, `GuardianNetworkAccessTrigger`, and
`GuardianMcpAnnotations` from `codex-guardian-reviewer` and re-export them in
core. Move environment lookup and scope classification with the request type,
preserving existing classification and credential-safe debug output.
GitOrigin-RevId: 5253a5124d5e370a1230b46aa7dc48b24b1c902e
## What changed
Move Guardian session-source detection, the reviewer name constant, and parent-thread prompt cache key generation into `codex-guardian-reviewer`. Re-export them from core, preserving existing behavior.
## Testing
Move the existing prompt cache key test into the reviewer crate, retaining coverage for parent-thread scoping, key length, and missing or inapplicable inputs.
GitOrigin-RevId: c14b3c030ba93676a0799aba56b23a676dbbc56d
## What changed
Extend the incremental Guardian review scenario with historical encrypted `send_message` calls in the default and custom tool namespaces. Add snapshots and assertions that both reviews retain each call and parent reply exactly once, in order, preserving call IDs, namespaces, and encryption metadata with a paired evidence-only output.
Verify that successive reviews reuse the same thread and append to the previous input. The scenarios use mocked ciphertext and decisions to check transport behavior, not backend decryption or authorization outcomes.
GitOrigin-RevId: a0927531b6cdae496fefa2a7f35032f7413807b6
## What changed
Add mock guardian approvals for setup handoffs in `handoff_scenario` when native multi-agent history is enabled. Match only the trailing `function_call_output` so historical handoffs cannot consume the final command's separate denial response.
Require five approval requests with native history enabled and none with it disabled.
GitOrigin-RevId: 7b14c97aa85adc63c4d3bf95014c44831eae1c85
## What changed
Make tool descriptions precede namespace descriptions in Code Mode execution and tool search. Mark `code_mode_tool_description_first` as removed and simplify cached definitions to depend only on the input schema budget.
## Testing
Update Code Mode integration assertions and catalog snapshots to expect tool descriptions before namespace descriptions.
GitOrigin-RevId: 1344d4c264d1d2b18ee0388a064b6813ca81f770
## What changed
Export `token_usage_delta` from `codex-guardian-reviewer` and use it in the core review session. Preserve the existing calculation, including clamping negative deltas to zero.
## Testing
Move the existing nonnegative token usage delta test alongside the helper in the reviewer crate.
GitOrigin-RevId: fcfce24b8d50a63dcd1122a4204939bc6750feda
## What changed
Add `GuardianScope::for_multi_agent_tool` and use it for both tool review requirements and asynchronous scoring. Classify `spawn_agent`, `send_message`, `followup_task`, and `interrupt_agent` as native tools when they match the configured namespace, accepting default namespace spellings when none is configured. Keep review enablement checks at each call site.
GitOrigin-RevId: 9180ccdc629532f6c171d899dc5881e15b447141
## What changed
- Recognize `policy_capacity_unavailable` in HTTP and streaming API errors and expose it as `policyCapacityUnavailable` through the app-server protocol and generated bindings.
- Display “Policy-restricted capacity is unavailable. Please try again later.” while preserving overload retry behavior based on `Retry-After`.
- Handle the new error in TUI overload rendering, reviewer retries, and error telemetry.
## Testing
Add coverage for HTTP and streaming error classification, retry advice, WebSocket terminal error attribution, protocol serialization, and TUI rendering with and without an upstream message.
GitOrigin-RevId: 1b9536fba1e11cc891dcf689aee35410d82f5412
## What changed
When `GuardianNativeMultiAgentHistory` is enabled, require Guardian review for wrapped Multi-Agent V2 calls to `spawn_agent`, `send_message`, `followup_task`, and `interrupt_agent`.
Include these calls in Guardian's asynchronous native-tool scoring scope, honoring the configured multi-agent namespace and preserving that configuration across overrides.
## Testing
Extend the incremental-review scenario with an encrypted, namespaced `send_message` call. Verify that the encrypted parent reply remains present exactly once in both Guardian reviews and the subsequent agent request, and update the snapshot to cover native tool-call review evidence.
GitOrigin-RevId: 2af9561b0d69af4a8f878fa32365ce845368e02d
## Why
Native multi-agent calls must stay intact for backend decryption during Guardian review.
## What changed
When `guardian_native_multi_agent_history` is enabled for multi-agent v2, preserve `spawn_agent`, `send_message`, `followup_task`, and `interrupt_agent` function calls in the configured tool namespace as native transcript items. Use `functions` when no namespace is configured.
Include the paired evidence-only output in token accounting, and omit native evidence whole when limits require it.
## Testing
Extend transcript tests to cover native call ordering, paired-output budgeting, and whole-item omission. Add a native-history snapshot alongside the existing text-history delegation handoff scenario.
GitOrigin-RevId: e7d9b4f5ea772890bf14b79fdb53b0f9d0a842e4
## What changed
Register `guardian_native_multi_agent_history` as an under-development feature,
disabled by default, and expose it in the configuration schema.
GitOrigin-RevId: d434750c1aa0cc78b36d1d661a4df0def5426f02
## Why
Custom OpenAI base URLs caused Codex backend authentication to lose Responses headers and Guardian metadata when the URL did not match a recognized backend route.
## What changed
Apply model-scoped Responses headers, Guardian reviewer and classifier markers, and eligible ChatGPT parent credit requests based on the OpenAI provider and authentication configuration, regardless of the base URL. Keep API-key requests and other providers excluded from this behavior.
## Testing
Extend coverage for custom `/v1` URLs and direct `/api/codex` endpoints with ChatGPT, header-based, and API-key authentication, including HTTP fallback and WebSocket requests.
GitOrigin-RevId: cc4bb5b4a1a6596904ecf8965237c7a4f09e112b
## What changed
Pass `PreparedExecCommand` through the process manager and runtime instead of copying command, shell, environment, and permission fields into separate request structs. Move approval requirement evaluation and approval action construction onto the prepared command, and use it for shell snapshots and launch failure events.
GitOrigin-RevId: 3e9f87e0974218fea6fffc0f7740616d696b9800
## What changed
Move argument parsing, working-directory and shell resolution, permission validation, and command lifetime setup into `unified_exec::preparation` with crate-visible parsed and prepared command types.
Update `ExecCommandHandler` to use the extracted preparation flow, preserving implicit skill event emission between parsing and preparation.
GitOrigin-RevId: 79e9be5d87c1b0ab905afdf1e343ac141fb7d4c6
## What changed
- Add `CoreToolRuntime::requires_guardian_review` to review opted-in function calls before dispatch and stop execution when review rejects the call.
- Deliver proposed calls as native review evidence, preserving encrypted argument metadata. When hooks rewrite arguments, review the updated arguments and discard the original encrypted replay content.
- Deduplicate native call evidence against reviewer history and include paired evidence outputs in input budgets.
- Keep review accounting and metrics for native calls without emitting action-specific client assessment events, and omit approval payloads from debug output.
## Testing
Extend regression coverage for rewritten native calls across review retries, denied calls that never execute their handlers, oversized native evidence, and review metrics without client events.
GitOrigin-RevId: c3b22c0220344581c2b38f233001abaed49cba34
## What changed
Add a parameterized app-server test that sets a paused goal after a worker has spawned and completed its first Guardian review, then asks the worker to check again.
Verify that a user-origin goal appears in the subsequent review's root authorization context as user-set, while an automatic-origin goal is excluded. Also assert that the initial review does not contain the later goal.
GitOrigin-RevId: 1d67c4a5481a717eac706b64ee714e7da2fc5511
## Why
Verified answers omitted because of request-size limits must be marked as missing. Legacy checkpoint messages also need to match retained excerpts after truncation so workers receive only one copy.
## What changed
Move root message preparation into `codex-guardian-context::prepare_root_context`, including handoff selection, shared message limits, legacy matching, and incomplete-context markers. Pass original legacy text into preparation and mark verified answers incomplete when oversized records are excluded.
## Testing
Add a handoff regression scenario for an ID-less checkpoint with a retained excerpt and an oversized verified answer. Assert that the worker receives one capped user message, both incomplete-evidence markers, and an incomplete authorization version.
GitOrigin-RevId: bd3f5fe164ae2fddba440e9269fd63b52e8b12f8
## Why
Older servers can omit thread item timestamps. The TypeScript contract should accept those responses while still allowing explicit `null` values.
## What changed
Mark `ThreadItem.startedAtMs` and `ThreadItem.completedAtMs` as optional nullable fields. Update the generated TypeScript and precomputed stable and experimental exports, and allow these fields in the optional-nullable export check.
GitOrigin-RevId: 186be7aa45a3e7c65f133b1e320809a9912ff1f3
## What changed
- Add `account/gcp/setup` to configure the built-in Vertex AI provider with a project, optional location (defaulting to `global`), and optional credential file. Omitting the file clears the active user override and uses Application Default Credentials.
- Validate configuration and obtain an access token before saving, return structured credential failure reasons, and reload the model catalog on the next `model/list` request.
- Share configuration previews and version-checked writes with Bedrock setup to reject conflicting settings and concurrent configuration changes.
## Testing
Add tests for credential selection and ADC fallback, catalog refresh, invalid credentials, policy and endpoint conflicts, cancellation when network permission is revoked, and configuration version conflicts.
GitOrigin-RevId: 6f411a85893f8da49581427451e0180529955b16
## What changed
- Stack integral limits above and below the integral in top-level display math, while keeping compact limits in lists and blockquotes.
- Render `pmatrix` environments with centered cells and scalable Unicode parentheses, aligning surrounding math to the matrix midpoint.
- Require spatial layouts, including single-row matrices, to fit the available width; preserve the source when they cannot fit or appear in nested Markdown.
## Testing
Add snapshots for integral limits and matrices, narrow-width fallback assertions, and rejection tests for ragged matrices and mismatched environment endings.
GitOrigin-RevId: 73b589c4422568b90d15f55bf7c9dddec0dccc97
## Why
Terminal reports still in flight when Codex exits can leak into the parent shell's input.
## What changed
Pause terminal event polling during shutdown and flush pending input before restoring normal terminal input mode. On Unix, use a primary device attributes (DA1) reply to wait for outstanding reports after disabling reporting, with a two-second timeout when startup detected DA1 support. During panic unwinding, flush queued input without locking the event reader.
## Testing
Extend PTY tests to cover mouse-report bursts with a split DA1 reply, clean shell input after exit, and queued input cleanup during panic unwinding.
GitOrigin-RevId: 304859b654fb2b2c8882e6cac4cb6522fe05475c
## What changed
- Replace Rust `1.99.1` pins with `1.95.0` across Cargo, Bazel, CI, release workflows, and Windows setup, and update the Bazel lockfile.
- Adjust Rust APIs, borrowing, and lint-related code for the pinned toolchain, and box MCP tool dispatch to bound compiler async-layout query depth.
- Update the halfwidth sound mark snapshot and allow optional symbol hash suffixes in the code mode host package smoke test.
GitOrigin-RevId: 75460c3d0465dc601811e619bce373a4f7ff2912
## What changed
- Return the selected workspace's display name as `workspaceName` in ChatGPT account responses, caching it alongside workspace routing and updating generated schemas and bindings.
- Display a `ChatGPT workspace` row with the name and account ID, falling back to the ID when the name is unavailable or invalid. Refresh workspace details with account identity updates and hide the row for providers that do not use ChatGPT authentication.
## Testing
Update account-response tests to cover workspace names and null values, add workspace details to the status snapshot, and verify that switching to a custom API-key provider hides the workspace row.
GitOrigin-RevId: 4b30ab8a39e1fa7ad1ba7367c5295544be8f6001
## What changed
- Show selectable safer follow-ups alongside safety-block explanations, with an option to enable Daybreak when disabled.
- Submit the selected rewrite in a verified fork before the blocked turn, preserving the original chat's draft and current model settings. Mark the new turn with `safety_recourse_follow_up`.
- Filter suggestions that could invoke commands, skills, apps, or plugins, and suppress recourse for unsupported servers and non-primary threads.
## Testing
Extend coverage for fork history, draft preservation, model selection, turn metadata, suggestion filtering, and the Daybreak picker.
GitOrigin-RevId: 49052df6301b6bfbba07262d40b007dcf97bb7c9
## What changed
- Handle `TurnModerationMetadata` for the active turn, showing a temporary block notice while an explanation is pending.
- Validate safety recourse metadata and render topic-specific explanations with safer ways to continue for biological and cybersecurity policy blocks. Apply the explanation only when the terminal policy error matches its domain; otherwise retain the existing error handling.
- Queue input while recourse is pending and preserve prepared images when queued messages are submitted.
## Testing
Add an integration test covering biological and cybersecurity blocks, the loading notice, and fallback for a mismatched policy error, plus a snapshot of the cybersecurity explanation. Extend queued-image coverage to verify submission succeeds after the original image file is removed.
GitOrigin-RevId: dd9ca57cf3b2d842e3deb8aff5d7c3c73a92e14d
## Why
Contention on the writer coordination lock can block writer cleanup indefinitely, preventing idle threads from unloading.
## What changed
Retry coordination lock acquisition every 50 ms and return `io::ErrorKind::TimedOut` after 30 seconds of contention. This lets cleanup release writer ownership and idle unloading finish even while another process holds coordination.
## Testing
Extend writer lock coverage to check the timeout error. Update the idle unload regression test to verify that the thread closes while coordination remains locked and can resume with its persisted turn after the lock is released.
GitOrigin-RevId: 513117fdaf3890283e7acdd149ce9abb66075b63
## Why
The process-local mutex cannot coordinate session name appends and removals from multiple Codex processes sharing the same home directory.
## What changed
- Guard index mutations with a persistent `session_index.jsonl.lock` file, retaining the lock until the blocking worker finishes even if its caller is cancelled.
- Return a timeout error after 30 seconds of lock contention without modifying the index.
- Rewrite removals through a unique temporary file while preserving index permissions, and skip removal when the index is absent.
## Testing
Update regression tests to check lock retention after cancellation, timeout without writing, successful writes after contention clears, and removal with a missing home directory. Retain coverage for cancelled queued updates preserving the next write.
GitOrigin-RevId: 5231c9ff85c6b34de5ee92931d119b6f46bd583b
## Why
`codex migrate-nfs-db` reported a successful migration when the database directory existed but contained no databases.
## What changed
Count databases that were migrated or already use DELETE journal mode. If none are found, print `No databases found.` instead of the migration success message.
## Testing
Extend the CLI integration test to cover an empty directory, a failure on a corrupt logs database after an earlier conversion, and a successful rerun that recognizes the converted database as already in DELETE mode.
GitOrigin-RevId: 16b109645925164f3af5d35a909417872cfa004f
## Why
MXC's `normalize_object_conflicts` can reject otherwise usable Windows policies when a network share does not support `FileIdInfo` or a protected deny path cannot be opened for metadata.
## What changed
Remove object-conflict normalization before and after volume-root expansion. Send explicit path grants directly to BaseContainer, which enforces path and symlink/junction alias precedence.
Document the resulting limitations:
- Hard-link names retain independent permissions, so an allowed name can access the same file through a less restrictive grant.
- Volume roots expand using their declared access without first reconciling aliases. A writable root can therefore generate more-specific writable grants that override a read-only root alias.
GitOrigin-RevId: de0b2d7b5b98eaa358a97156c02e9f7f85860335
## Why
The npm wrapper can exit successfully after its native child is terminated by a signal if Node ignores the re-emitted signal or a forwarding handler intercepts it.
## What changed
Set a fallback exit status of `128 + signal number` and remove listeners for the terminating signal before re-emitting it, preserving signal termination where supported.
## Testing
Add a non-Windows integration test using a built Codex binary to cover numeric argument-error exits, forwarded `SIGHUP` termination, and the fallback exit status for `SIGXFSZ`, which Node ignores by default.
GitOrigin-RevId: cad18a47aa50fd78517c367f8d8aae83bbbf7843
## What changed
Split saved-thread resume into preparation and activation. Preparation resolves configuration and attaches to the destination thread before activation replaces the displayed conversation.
Keep stored-backend configuration and local settings separate from active settings during preparation, while retaining the existing eager settings refresh for active-backend resumes. Use the destination backend for working-directory, permission, and directory-trust checks.
Carry the backend identity in the prepared result and reject activation through a different backend before changing the active conversation or composer.
## Testing
Extend coverage for preserving active settings and composer drafts during preparation, rejecting activation through another backend, applying destination remote-permission checks, and retaining active-backend settings refresh behavior.
GitOrigin-RevId: 7171f1abcf4bdd62793c21232a8b895bb809cf70
## What changed
Add optional `approvals.granular` catalog fields for the policy introduction and prompted and rejected category lists. Preserve template strings verbatim in `GranularApprovalMessages`, leaving validation and rendering to consumers.
Document the 500-byte template limit, required `{{ policy }}` and `{{ categories }}` markers, and fallback rules.
## Testing
Extend serialization tests to cover null, empty, and populated granular templates, and verify their preservation through model responses and base instruction overrides.
GitOrigin-RevId: ce32e41a9b37e2e7c45ac9b079708a640c99326c
## What changed
Add the `features.simplified_selection_hints` flag, disabled by default. When enabled, replace detailed plugin capability instructions with a concise developer message identifying the selected plugin and directing the model to use its available skills and tools.
Continue omitting hints for plugins without available capabilities and bounding hint length. Preserve the existing detailed instructions when the flag is disabled.
## Testing
Cover plugin refresh in an existing thread with the flag enabled and disabled. Verify that explicit skill prompts precede the simplified plugin hint and that the hint uses the developer role.
GitOrigin-RevId: 64fc3347bd49fffe675f343a4733ced1b4e5e88c
## Why
A subagent failure ends its work without requiring user action, but the agent command center treated it as needing attention and promoted its parent task into the `Needs you` group.
## What changed
Classify failed subagents as inactive when computing task groups and selecting details. Recognize subagents by either a parent thread or a subagent session source, including background workers without a parent.
Keep approval and user-input requests from descendants actionable, even beneath a failed agent. Show these requests as `Needs input` rather than `Error` when the displayed task is a failed subagent. Errors in non-subagent tasks continue to require attention.
## Testing
Add and update regression tests and a snapshot covering stable ordering after subagent failures, idle parents staying ready, failed background workers, and pending requests beneath failed agents.
GitOrigin-RevId: 1a06d5d00c08bb77c9ed36aadffd5e0514f0b2c6
## Why
Rust formatting should include source files that Cargo cannot discover, while keeping command lines within Windows limits.
## What changed
- Update `scripts/format.py` to discover tracked and non-ignored untracked Rust files with Git and invoke `rustfmt` in batches of 64 files. Use the workspace configuration and skip recursive child-module formatting.
- Pass `SystemDrive` and `LOCALAPPDATA` to Windows Bazel tests.
- Extend the spelling allowlist, remove a manifest feature exception, and clean up an unused import, an empty MCP scenario module, and its snapshot.
GitOrigin-RevId: c0d625fda9290ead6a63919325d65f7352abfa40
## What changed
Allow omitting `gateway_oauth.delivery` to send the gateway token as `Authorization: Bearer …`. Custom headers and cookies remain available when a provider also needs its own credentials.
Reject conflicting provider authentication and duplicate delivery headers with actionable errors. For gateway bearer delivery, require `model_catalog_url` to share the scheme, host, and port of `base_url`. Consistently reject request header collisions across auth application methods.
## Testing
Add coverage for omitted delivery, provider credential conflicts, and model catalog origin validation. Update inference tests to verify gateway-only authentication while signed in and combined ChatGPT and gateway credentials in separate headers.
GitOrigin-RevId: 8564d3998511b3f6c55f3b65a01ed9056a90417e
## Why
Tool calls can emit multiple outputs, and compaction can trim output content while retaining the same call and item IDs. The trace reducer rejected these versions as conflicting content. Late tool and code-cell events could also link outputs in map-key order instead of conversation order.
## What changed
- Preserve distinct tool output versions while retaining consistency checks for tool invocations.
- Link tool and code-cell outputs in thread history order, and resolve pending code cells after the entire event has been reduced.
- Prevent snapshot reconciliation from reusing the same conversation item twice when identical items move within history.
## Testing
Extend reducer regression tests for trimmed outputs, changed images and metadata, reordered identical messages, and late tool and code-cell events spanning the item-ID ordering boundary.
GitOrigin-RevId: eb4242d6a2d32d61c3caab9d3cc3cf6b374ce799
## Why
When workspace discovery receives a 401 and token refresh is permanently rejected, the generic discovery error hides the guidance to sign in again.
## What changed
Propagate cached permanent refresh-token failures for the current credentials through workspace routing and model-provider resolution as `CodexErr::RefreshTokenFailed`. Preserve account-change checks and only surface the cached rejection when external authentication is absent and the auth generation is unchanged.
## Testing
Add an app-server regression test that simulates `refresh_token_reused` during workspace discovery and verifies that the turn fails with `Unauthorized` and tells the user to sign in again.
GitOrigin-RevId: cf89c71fd6a2103e56d637838b0cb34d58b3cc32
## What changed
Collect original retained instructions, assistant context, and verified answers before applying synchronous request limits in `guardian-context` preparation. Carry original record sizes through collection, preserving whole-record omission notices, source ordering, and host assistant-context framing.
Apply retained transcript source size checks during synchronous transcript preparation as well.
## Testing
Extend regression assertions for synchronous/asynchronous retained-context parity and equivalent verified-answer omissions when oversized records are filtered during preparation.
GitOrigin-RevId: 9042ee3fe60ebd455f6656b4008efb2acc44ac3d
## What changed
- Move plugin install and uninstall errors and telemetry classification helpers into `codex-rs/core-plugins/src/manager_errors.rs`, preserving the existing public re-exports and error classifications.
- Box the realtime text routing future to bound the handoff future's size while retaining the admission permit across the await.
GitOrigin-RevId: ccf0c3bb93a8c69a0a618b96cd1525da87003176
## What changed
- Add `gpt-6.1-terra` to the bundled catalog and GCP Vertex model picker.
- Add `openai.gpt-6.1-terra` to Amazon Bedrock catalogs, including Global and US cross-region runtime variants.
- Use `gpt-6.1-terra` as GCP's preferred memory consolidation model.
## Testing
Extend catalog, model picker, thread startup, and Vertex request tests to cover GPT-6.1 Terra.
GitOrigin-RevId: edb3be3c4286c191349cdee742005ed3c67029e8
## Why
Async question replies appeared as plain user text, leaving Markdown formatting literal and repeating the full question above each answer.
## What changed
- Accent question titles with a `?` prefix while preserving Markdown in titles and suggestions.
- Render replies with a `↪ Re:` question caption and a Markdown answer. Limit captions to two rows with an ellipsis on overflow, while keeping answers complete.
- Apply the same rendering to live messages and loaded transcripts, preserving inline styles, hyperlinks, and Markdown when copying selections.
## Testing
Add snapshots and assertions for matching live and loaded transcript rendering, plus tests for caption clipping, hyperlink bounds, Markdown copying, partial selections, and whitespace-only or nonprinting answers.
GitOrigin-RevId: 0290d8a2ebfb42bd5d7374c7037cde5ae8a13b5d
## What changed
Replace `UserHistoryCell`'s `spoken` boolean with `UserMessagePresentation`, defaulting to `Plain` and using `Spoken` for speech transcripts. Route rendering checks through `is_spoken()`, preserving the existing prompt styling and whitespace handling.
GitOrigin-RevId: d0683a2b536a7d71f68fd9a089e6839d0ab0cc65
## What changed
- Add `codex-plugin-host` to launch a helper with a cleared environment, verify its readiness handshake, and expose framed stdin/stdout pipes with a 256 KiB frame limit and write backpressure.
- Support startup cancellation and process-group cleanup, retaining exit status and the last 16 KiB of stderr while omitting raw diagnostics from `Debug` output.
- Extend the Bazel crate macro to support test-only binaries and fixture entry points outside `src/`.
## Testing
Add process integration tests for framed communication, startup cancellation, helper and descendant cleanup, repeated close calls, and bounded diagnostics from startup and runtime failures.
GitOrigin-RevId: ed539e7899af06ee83a0d8c2d0ea8cec10f19afb
ioanbudea-OAI