## What changed
- Update `rustls-webpki` from `0.103.15` to `0.103.16`.
- Update `webpki-roots` from `1.0.5` to `1.0.10`.
- Refresh the corresponding entries in `codex-rs/Cargo.lock` and `MODULE.bazel.lock`.
GitOrigin-RevId: c73d2afb6ce9f8bd8756d3cbe6f8114edc461262
## Why
Synchronous auth header construction could silently return no credentials when managed authentication became unavailable. Callers need an error to avoid sending requests with missing or partial authentication.
## What changed
- Make `AuthProvider::add_auth_headers`, `to_auth_headers`, and auth header telemetry fallible, and propagate failures through request and WebSocket setup.
- Return a transient error when managed authentication is unavailable, and preserve network policy denials through auth error conversion.
- Retry transient MCP authentication errors while treating build errors and policy denials as terminal.
- Cancel local MCP event streams before resolving authentication so cleanup still works when credentials become unavailable.
## Testing
Add regression coverage for rejected partial authentication, async header resolution, terminal auth errors without sending requests, managed account changes, MCP retry classification, and local stream cancellation after authentication becomes unavailable.
GitOrigin-RevId: 39d981e232cba1e302de502a2fa6239101114ed1
Move context prefixing and request extraction into `user_prompt`, and update
IDE context injection, thread routing, thread titles, transcript export, and
user message rendering to use the shared helpers. Preserve the request
delimiter, text element byte offsets, and input ordering.
Move the existing last-delimiter extraction test alongside the shared helpers.
GitOrigin-RevId: 3ee350506a536a6dba9575e8311188bc92fed584
## What changed
Prefer frequently selected entries in the TUI's `$` picker within exact, prefix, and fuzzy match tiers, keeping stronger match tiers ahead of usage preferences.
Track the last 50 confirmed selections and persist them in `mention_usage.json` under `CODEX_HOME` when history persistence is enabled. Preserve in-memory preferences across compatible chat widget replacements, including when history persistence is disabled. Serialize background writes, merge updates under a bounded file lock, and flush pending writes on shutdown.
## Testing
Add coverage for picker ordering, preference handoff and persistence, history-disabled widget replacement, selection expiry, malformed history, and lock contention.
GitOrigin-RevId: 7efa8c1c365e23000fcda10dbbc2a7e90f4e777c
Remove the exception that allowed clients without a package identity to connect
when the provisioning service had one. Keep the debug foreground-mode exception.
GitOrigin-RevId: def2d22a91575477d73e3d8c6ac14808a2ff3b2b
## What changed
Record `codex.guardian.turn.blocking_ms` when a turn completes or aborts, with an `outcome` label. Count overlapping approval waits once, exclude idle gaps, and split pending reviews across the active turns they span. Use each turn's telemetry so samples retain the servicing turn's model attribution.
## Testing
Add unit coverage for overlapping waits, idle gaps, late turn completion, and duplicate stops. Extend integration coverage to verify attribution across turns and model changes for yielded command reviews and MCP elicitation, including aborted turns.
GitOrigin-RevId: a3e6a0c32a06fe58ea93119ecd941076100fb82c
## What changed
Expose `PromptCacheKey` through `StartThreadOptions` with three policies: retain the default session-derived key, send a custom key, or omit `prompt_cache_key` from model requests. Keep session identity headers independent of this policy.
Propagate the policy to child agents, delegated sessions, and guardian review sessions. Hosts must reapply the policy when resuming a thread from storage.
## Testing
Add coverage for all three policies across turns, including unchanged session and thread headers. Extend subagent coverage to verify inheritance of the default and omitted-key policies.
GitOrigin-RevId: f9e8ab31fcf568636f9712726760e4e9a4672428
## Why
Polling a failed background compaction consumes the closed oneshot receiver.
Keeping that receiver in session state can cause a later await to panic instead
of falling back to foreground compaction.
## What changed
Remove the receiver from session state before polling it, restoring it only when
its result is still pending. Discard closed receivers so compaction can fall back
normally.
## Testing
Add a regression scenario where background compaction fails before the next
checkpoint and automatic compaction falls back successfully.
GitOrigin-RevId: 1461bb403f4b0b8b7e171d1b3cba41411f2014b4
## What changed
Default `features.multi_agent_v2.preserve_fork_prefix` to `true`, so full-history forks retain the parent's model-visible history and append child instructions. Keep `preserve_fork_prefix = false` as an explicit opt-out for instruction filtering, and update the configuration schema documentation.
## Testing
Update coverage to verify inherited prefixes across child and grandchild forks, child instruction ordering after compaction, and explicit filtering opt-outs.
GitOrigin-RevId: f14eae5b924cdeac555d112d0aba3fbbb063b0ea
`codex-secrets` pulls in unmaintained `basic-toml` 0.1.10 through the localization dependencies of `age` 0.12.1, and no patched release is available.
Add `RUSTSEC-2026-0374` to the `cargo audit` and `cargo deny` ignore lists. Document that the exception should be removed when the localization dependencies of `age` migrate off `basic-toml`.
GitOrigin-RevId: 92f31b687e91a73620e6f7f9a1b7c94790d9149d
## What changed
- Expose `AccountOAuthGrantLease` to prevent this auth manager's token refreshes from rotating account credentials during an identity-provider exchange. Releasing the lease returns an `AccountOAuthGrant` that callers can recheck before accepting asynchronous results.
- Validate grants against cached login ownership and persisted credentials, requiring OAuth provenance and complete account identity. Reject stale grants and propagate storage failures, including unavailable keyrings in `Auto` mode.
- Track `login_generation` separately from account ownership and use it to invalidate enterprise MCP authentication. Losing login metadata invalidates the login while preserving same-account network policy; a new login to the same account advances both generations.
## Testing
Extend auth refresh coverage to verify refresh blocking and wakeup on lease release, invalidation after token rotation or persisted login replacement, metadata loss and restoration, and logout while a lease is held.
GitOrigin-RevId: f51b3cd526d7ee94d5dffa16681f8ca332245ce3
## Why
Undecodable compressed rollouts need diagnostic details and their original bytes preserved for investigation.
## What changed
- Log compressed file size, first-frame content size, decoded byte count, and whether the open file changed when a compressed rollout read fails. Limit warnings to once per process per minute and exclude paths and contents.
- Allow diagnostic reports to attach the raw `.jsonl.zst` archive after a decoding failure when no preferred plain rollout exists. Retain attachment size limits and append `.zst` to filename overrides when needed.
## Testing
Add coverage for truncated streams, incomplete trailing frame headers, files truncated after opening, and diagnostic uploads that preserve undecodable archives with size limits and filename overrides.
GitOrigin-RevId: 76f7ee466f9bebdab5a91ce1894f4361749edc5b
## What changed
Split retained conversation scoring into `Reservation::prepare` and `PreparedConversation::run`, exposing the complete admitted input before model execution. Keep the history fork and capacity permit owned by the prepared conversation, and recheck authorization, score expiry, and backend generation before execution.
## Testing
Extend conversation tests to verify that preparation sends no model request, execution uses the prepared input, dropping a prepared conversation releases capacity, and stale prepared reviews cannot start model execution.
GitOrigin-RevId: c96cc6fac69179a78ecd7bcdb8e5a4b3087aa6e6
## Why
The maintenance-lock test relied on a 50 ms timeout to assume startup migration had encountered contention, and its completion timeout included the production retry delay.
## What changed
Add a per-store, test-only retry gate to observe lock contention and explicitly resume migration after releasing the maintenance lock. Verify that rollout metadata stays in `Legacy` mode while the lock is held and becomes `Paginated` after migration completes.
GitOrigin-RevId: 657fa6ec6f9494d9e66976560c8158fde8ffb495
## What changed
- Record executor handshake rejections and pending-validation resets in promptly completed diagnostic spans, with classified reasons and registry HTTP status when available. Normalize stream IDs as UUIDs and cap diagnostics at 100 per minute per relay connection, followed by a suppression marker.
- Add elapsed time and connection identifiers to harness handshake diagnostics, including initialization timeouts, and classify WebSocket read failures from typed errors.
- Forward valid stream UUIDs to harness key validation requests through the `x-codex-noise-stream-id` header.
## Testing
Extend tests to cover diagnostic rate limits, timeout correlation, prompt span export, typed WebSocket error classification, and optional stream ID headers. Verify that diagnostic output excludes authorization secrets, registry response text, reset reasons, and invalid stream IDs.
GitOrigin-RevId: 2c224e2d2828b300164868b10806add410e148b2
## What changed
Add `experimentalDisablePredictionMcp` to `thread/fork` and `disableMcp` to `thread/sample`. Disable MCP servers when requested and the inherited history contains incremental tools on Responses Lite. The fork option requires `experimentalPredictionMode: true`.
Apply disablement through a thread-local policy that excludes configured MCP servers and runtime contributions, including after MCP refresh. Preserve the inherited history prefix and append tool-removal instructions without changing the parent's tools.
## Testing
Add coverage for prediction forks with legacy and paginated history, flag validation, conditional disablement, MCP refresh, and sample/fork request parity. Add a request-history snapshot covering preserved history, tool removal across child turns, and unchanged parent tools.
GitOrigin-RevId: e31d602480e6550ed130d8152f538b8668280fa0
## What changed
Read `RequirementsPath` from the 64-bit registry view of `HKLM\SOFTWARE\Policies\OpenAI\Codex` to select the system requirements file on Windows. Require an absolute path and return an error for relative values. If the registry key or value cannot be read, retain the default `OpenAI\Codex\requirements.toml` location under ProgramData.
## Testing
Expand absolute-path validation tests to cover empty, drive-relative, and root-relative paths. Update the Windows default-directory test to remain independent of registry overrides.
GitOrigin-RevId: c31045d749e32cf266b389245ae4db2440156e8e
## Why
A fixed feature allowlist excluded other boolean feature overrides from daemon use. Feature mismatches could also silently fall back to embedded mode, while automatic startup could persist enabled overrides without confirmation.
## What changed
- Allow boolean feature overrides without a fixed allowlist and compare explicit overrides with the daemon's reported settings. Ignore removed features, treat unreported features as disabled, and include only mismatches in restart settings.
- Preserve saved daemon settings during automatic startup. Prompt on feature mismatches even when embedded fallback is allowed, letting users run without the daemon, confirm a managed-daemon restart, or cancel.
- Detect managed daemons during recovery, mark available restarts as recommended, and limit the displayed feature list to three entries plus a remaining count.
## Testing
Update compatibility tests for mixed overrides, removed and unreported features, unreachable daemons, and required versus optional attachment. Update recovery snapshots and the TUI integration test to exercise explicit embedded-mode selection.
GitOrigin-RevId: 9204620f168ff80aaef312c88e681b754908a431
## What changed
Add the experimental `thread/sample/cancel` request with a `requestId` identifying a `thread/sample` request on the same connection. Cancellation returns an empty response, stops the matching sample with `sample canceled`, and cleans up its ephemeral fork. Repeated cancellation and unknown request IDs are harmless no-ops; other request types are unaffected.
## Testing
Add coverage for connection and request ID isolation, request type filtering, and repeated cancellation. Extend the sample integration test to verify cancellation keeps the parent responsive and reclaims the child thread.
GitOrigin-RevId: 92d12e5c0190e1d3b06cb482543615a3ec77bdc8
## What changed
Add `RuntimeAuthManager` to share one registered runtime per credential source and return request-scoped `RuntimeAuth` values that pair the runtime with its credentials and HTTP client factory.
- Preserve registration keys and idempotency IDs across retryable failures and refreshes that retain the credential source.
- Replace the runtime when the credential source changes, preserve existing request snapshots, and reject late registration responses for a previous source.
- Use bounded credential recovery for registration `401` responses and cache `403` denials until the credential source changes.
- Expose authenticated actor and agent host information on `RuntimeAgentInstance`.
## Testing
Add tests for concurrent registration sharing, retry identity preservation, network policy recovery, credential refresh and replacement, bounded recovery, cached denials, and credential changes during registration.
GitOrigin-RevId: ea1e6e10a5939e8c3f7c0c317ccf8a83522c635f
## What changed
Render async question titles with the Markdown renderer so emphasis, fenced code blocks, and labeled links display with their intended formatting. Remove blanket bold styling and wrap overwide tokens while preserving hyperlink destinations and accurate row counts.
## Testing
Update rendering snapshots and extend the question rendering test to cover Markdown formatting, link destinations, selective bold styling, and equivalent LF and CRLF rendering at narrow and wide widths.
GitOrigin-RevId: b3e8a94a04433c2d9e5d11e66f83cbd16959d8ed
## Why
A new OAuth login can belong to the same account as an earlier session, while token refreshes can change credentials within one session. Auth consumers need to distinguish these cases when deciding whether a runtime can be reused.
## What changed
- Add `source_generation` to `AuthChangeState` and expose `AuthManager::auth_change_state_for` to check whether selected credentials still match the manager's current source.
- Preserve source continuity across OAuth refreshes only when session, issuer, and identity claims match. Advance the source revision for new sessions, credential replacements, and logout.
- Keep agent identity persistence from replacing cached credentials with credentials read from disk; credential publication remains managed by `AuthManager`.
## Testing
Add tests for refresh continuity, new logins, identity and workspace changes, sessionless tokens, API key replacement, logout, and identity persistence followed by an explicit credential reload.
GitOrigin-RevId: 56eddb7edb9c5f8854b18fd50ce917c0b27e75d6
## Why
A remote server can refuse the initial `thread/start` while shutting down. An explicit refusal establishes that no thread was created, allowing the TUI to retry without risking duplicate startup submissions.
## What changed
- Wait for the draining connection to close, reconnect within a shared two-minute deadline, and retry startup once.
- Preserve the initial prompt, confirmed draft, model, and reasoning effort across recovery. Keep drafts editable and allow cancellation of a pending submission.
- Restore input without submitting if recovery fails or startup is refused again. Continue treating a lost startup reply as uncertain and avoid automatic resubmission.
## Testing
Add regression coverage for successful reconnection with exactly one prompt submission, repeated refusal, disconnect event ordering, and draft cancellation, editing, and paste provenance during recovery.
GitOrigin-RevId: 85b756e14f29c239c4774af2b32215fe251530ac
## Why
Saving an API key does not validate it. Login and status messages should make clear that authentication is checked when a request is sent.
## What changed
Report `API key saved` after API key login and `API key configured` in `login status`. Both messages now explain when authentication is checked.
## Testing
Update the API key login integration test with snapshots for login and status output, while retaining assertions that the key is saved to `auth.json`.
GitOrigin-RevId: 2f36ebb270a48771be25060a596cf9731e8d0325
## Why
The handshake readiness channel only signals success, so a dropped sender does not explain why the handshake failed.
## What changed
Emit structured `codex.exec_server.noise_handshake_failed` warnings before harness handshake failures drop the readiness sender, including a failure reason and environment, executor registration, and stream identifiers. Emit the same event on handshake timeout with `timeout_ms`.
Preserve the current tracing span when the `noise_relay.stream` debug span is disabled so the relay task retains its trace context.
GitOrigin-RevId: 0b1314d5237b7c77a854c2c0a966391bf856e75d
## What changed
Extend `codex-runtime-agent-instance` with a registration client and an in-memory assertion signer. Pending registrations retain their signing key and idempotency key across caller-driven retries; registered runtimes generate fresh versioned assertions with a timestamp and unique ID.
Bound registration requests and responses, reject unsafe endpoints, disable redirects and request logging, and preserve network policy errors. Report server rejections using only the status and recognized error codes.
## Testing
Add HTTP-backed tests for retry stability, assertion signatures and freshness, policy revocation, endpoint and response validation, redirect refusal, and error redaction.
GitOrigin-RevId: a6dab0900459dfb75f72652a0a2ee1e4b65ca322
## Why
A temporary exec-server transport loss could emit a thread environment disconnect notification while the session was still recovering.
## What changed
- Add `EnvironmentConnectionState::Recovering` for interrupted transports and pending session recovery.
- Suppress thread lifecycle notifications during recovery, emit a connected notification after successful recovery, and report disconnection when recovery fails.
- Ignore recovery callbacks from retired clients so they cannot overwrite the connection state during refresh.
## Testing
Add coverage for fast and near-deadline recovery, recovery timeout, rejected session resume, and retired-client callbacks. Extend app-server coverage to verify one lifecycle notification per selected thread and usable `environment/info` after recovery.
GitOrigin-RevId: d6dce5cc5264af29b6f993daa209b93102122e40
## What changed
Add `codex-runtime-agent-instance` with serializable registration requests and deserializable responses. Requests support OAuth, personal access tokens, and platform API keys, along with an installation ID, public key, harness metadata, and runtime role. Responses include runtime and host IDs plus ChatGPT or platform actor context.
Use `RedactedString` for credentials to keep secrets out of debug output.
## Testing
Add tests covering request serialization for all three credential types, debug redaction, response decoding for both actor types, and rejection of responses missing required fields.
GitOrigin-RevId: f33bae734fdd1402144dee407e5b868f5eef1d37
## Why
Token refresh needs the issuer and client ID used at login. Unverified token claims cannot establish that authority, and OAuth error bodies may echo credentials.
## What changed
- Save `oauth_provenance` and a new `login_owner_id` on browser and device-code login. Preserve the login identifier through token rotation.
- Refresh using the recorded issuer and client ID, retaining the existing endpoint override and fallback behavior for legacy records. Clear provenance when an override changes the endpoint or when a response without token rotation encounters a concurrently replaced refresh token.
- Keep both metadata fields optional for older records without inferring provenance from token claims.
- Remove backend token error details from structured logs and refresh error messages.
- Box large futures in token refresh, MCP initialization, and embedded app-server test startup to reduce surrounding async frame sizes.
## Testing
Add coverage for legacy record compatibility and metadata round trips, browser and device-code login persistence, refresh using recorded OAuth settings, metadata preservation through rotation, and provenance clearing for a superseded refresh token.
GitOrigin-RevId: b6b5d2fcbe2a284a171a242c1a17128af55f1024
## Why
Resolving a history page's rollout lineage performs a separate filesystem lookup for each ancestor. Ancestors stored alongside the current rollout can share a lookup traversal.
## What changed
- Prefetch paths for up to 64 sibling rollout IDs belonging to the same thread when listing history turns or items.
- Resolve candidates in the normal lookup order to preserve first-match selection for duplicate rollout IDs.
- Validate prefetched paths before use and fall back to normal lookup for missing or stale paths. Treat prefetch failures as optional and continue with normal resolution.
## Testing
Add a regression test verifying that sibling prefetch selects the same first match for a duplicate rollout ID as normal lookup.
GitOrigin-RevId: 5d86c9643562a82a53af78b20f70322c1506c6e1
## Why
Cancelled or timed-out Guardian reviews can admit transcript evidence without completing a review. Reusing that session can leave subsequent reviews without the evidence they need.
## What changed
Mark interrupted reviews for rollback to the last completed review instead of reusing their live context. Preserve committed review history and replay pending evidence on the next review.
## Testing
Add cancellation and timeout regression coverage that verifies encrypted evidence appears exactly once in the next review, the last completed review survives rollback, and interrupted or denied commands do not execute. Update session disposition assertions and make the program-change session reuse test wait for review completion before releasing the classifier result.
GitOrigin-RevId: f39552b24db5309cffddd9eda97280256be3e97b
## Why
Enterprise-managed MCP authentication requires the thread's admitted connection. Bulk `mcpServerStatus/list` requests need to use that connection to report the enterprise server's catalog consistently with single-server requests.
## What changed
- Read enterprise server metadata from the thread runtime when listing all MCP servers, preserving ordinary server discovery.
- Check the expected server registration before discovery so edited or disabled registrations cannot reuse an old connection's catalog.
## Testing
Add coverage for bulk and single-server status consistency, catalog metadata, and registration changes. Extend enterprise authentication lifecycle tests to cover bearer renewal, grant replacement, and logout during a pending exchange. Add a scenario asserting that enterprise sign-in failure preserves ordinary MCP tool schemas, calls, and model history.
GitOrigin-RevId: 3bf3bd672511d0c753cd95ec777892f72bd6eb89
## Why
Full-transcript fallback can select encrypted agent messages already present in the reviewer's history. These duplicates should not consume the input budget or displace new evidence.
## What changed
- Reconcile native agent messages with the effective reviewer history and earlier messages in the pending input before budgeting, including after compaction.
- Deduplicate messages with nonempty IDs while preserving messages without IDs. Allow delivery again when the prior copy is absent from the current history.
- Reject conflicting authors, recipients, or content under the same ID without modifying the pending context.
## Testing
Add coverage for duplicate admission, conflicting payloads, redelivery after history removal, and retained reviewer requests. Extend the history eviction regression to verify that full-transcript fallback reuses the reviewer and preserves a single encrypted agent message.
GitOrigin-RevId: 97e90f6359a7cf5a75d1c5967fc98cd885afb4e4
## What changed
Mark the no-op `transcript_v2` feature as removed and drop it from the daemon startup override allowlist. Use `tui.fullscreen_transcript` to control the transcript preference.
## Testing
Update local settings coverage to assert that `features.transcript_v2` does not override the fullscreen transcript preference. Use a generic deprecated option in the deprecation notification test and snapshot.
GitOrigin-RevId: 78f832b9603cedc2a6509404a45509e47e845752
## What changed
- Recognize `sci` and `sci_plus` in authentication, account responses, rate limits, and generated client schemas.
- Treat both plans as workspace accounts eligible for cloud configuration, and use business analytics routes.
- Display “Academic Researchers” and “Academic Researchers Plus” in the TUI and direct users to their admin when usage limits are reached.
## Testing
Add coverage for plan parsing, workspace classification, account and rate-limit responses, cloud configuration eligibility, analytics routing, TUI labels, and usage-limit guidance. Exercise installed-app refresh and listing with `sci_plus` authentication.
GitOrigin-RevId: b51c5df03029b8bc249d44f11b353a7755e7dd04
## Why
A read-only executable target does not make its lookup path trustworthy: a symlink or ancestor directory may still be replaceable through writes allowed by the filesystem policy.
## What changed
Check the original lookup path, resolved parent aliases, and canonical target before selecting a pre-sandbox executable such as `bwrap`. Account for sticky directory ownership when deciding whether a child can be replaced, while preserving read-only mount carveouts.
Resolve `PATH` entries individually, including relative entries when the working directory contains a colon.
## Testing
Add regression tests for writable symlinks to read-only executables and symlinked search directories into writable roots. Extend search-path coverage to relative entries and a working directory containing a colon, and update the protected system installation test to use a direct executable path.
GitOrigin-RevId: 18d0cb6e809e5abd1313315670d4e2ff91dcfb30
## What changed
Add a `BackendSessions` collection to own app-server sessions and poll their events fairly with cancellation-safe receives. Track listening state per backend so pausing or closing one stream leaves the others available, and resume polling after reconnect. Shut down all registered sessions on exit.
Ignore background backend disconnect, lag, account, and rate-limit events that would otherwise update the displayed conversation's UI.
## Testing
Add coverage for polling three sessions, paused and closed stream isolation, cancellation, and session replacement after reconnect. Extend event ownership coverage to verify that background lifecycle and account events leave the displayed connection and rate-limit state untouched.
GitOrigin-RevId: 9ed82abc77aaf4bfeb86eb72161ad90fe20177ad
## Why
A live thread can have updated SQLite metadata before its rollout file exists.
Reading metadata from the missing file loses creation details such as fork and
parent relationships and triggers unnecessary filesystem discovery and retries.
## What changed
- Read deferred `SessionMeta` through the rollout writer, ordered with persistence.
Return no in-memory metadata once the rollout is materialized or resumed.
- Combine that creation metadata with SQLite metadata for reads that exclude
history, and use it to determine the canonical history mode during updates.
- Keep untouched threads without a stored record unavailable for fork and resume.
## Testing
Add coverage for metadata reads and updates before persistence in both legacy and
paginated history modes, including equality with metadata read after persistence.
Verify the recorder exposes creation metadata only while deferred, and expand
fork/resume rejection tests across history modes and resume turn inclusion.
GitOrigin-RevId: 8d293cc8f87156409f195130437d93858a4099b9
## Why
Response body reads could outlive the manual download timeout or fail outside the existing fallback and retry handlers.
## What changed
- Read successful manual response bodies within the fetch timeout and transport fallback so stalled or failed reads fall back to `curl`. Leave `HEAD` responses unconsumed.
- Await model metadata response bodies inside the retry handler so read failures use the existing three-attempt retry loop.
## Testing
Add regression tests for manual body timeouts and truncated bodies falling back to `curl` before caching, plus model metadata body failures succeeding on retry or stopping after three attempts. All four tests pass with `node --test codex-rs/skills/tests/openai_docs_downloads.test.mjs`.
GitOrigin-RevId: 528595307ef86ad2522dc8ae488baadc001ad961
## What changed
- Replace the separate MXC crates with `mxc-sdk` and adapt request construction to its policy and optional environment fields.
- Preserve the native availability probe by caching successful process security environment creation and startup attribute initialization without launching a process.
- Use the SDK's native denied-path support check and configure Bazel resource compilation for Windows GNU targets.
## Testing
Extend the request construction test to verify that nonempty environments use `Some` and empty environments use `None`.
GitOrigin-RevId: 2765c8fd19ee60661b0ce7cb3cba51acadda201a
## Why
Temporary environment attachments for a parent turn should not become a
subagent's persistent environments. Children also need to retain their
configured executor bindings when their runtime is evicted and reloaded.
## What changed
- Add the disabled-by-default `subagent_thread_environments` feature flag.
When enabled, both subagent implementations inherit configured thread
environments captured with the invoking step, excluding turn-only attachments.
- Track configured bindings separately from active turn attachments, preserving
pending configuration ownership and sharing completed executor startup.
- Retain configured selections and bindings across idle eviction. Reload children
using retained bindings when the parent changes workspace, while continuing to
validate current parent roots and permissions for matching workspaces.
## Testing
Extend regression coverage for configured, empty, forked, pending, and legacy
inheritance; temporary attachment removal across eviction; and reload behavior
with changed workspaces, deferred startup, and restricted permissions.
GitOrigin-RevId: 15692ecd99deb38002014b44fd859d793bd54373
## Why
Command-line initial prompts bypass the composer and were missing from local recall history, so pressing Up could skip them and retrieve cross-session history instead.
## What changed
Record accepted initial prompts in local recall history with their draft metadata. Add image placeholders where needed so recalled local attachments survive resubmission. Leave synchronously rejected prompts out of recall history.
## Testing
Add regression tests for recall order before cross-session history, ordering after transcript replay, queued prompts appearing once, rejected submissions, and image attachment recall and resubmission. Add a snapshot of the recalled initial prompt.
GitOrigin-RevId: 0a12221ae285f01bff4b5860e546c8f7ee3c71e3
## What changed
Mark `incremental_tools` as stable and enable it by default. Responses Lite sessions now append tool catalog updates to request history without requiring an explicit feature opt-in.
## Testing
Run the incremental catalog scenario with the default configuration. Update assertions and snapshots for empty Responses Lite prewarm input, tool declarations on the first turn, preserved compaction history, and tool changes across model switches and child agents.
GitOrigin-RevId: 27aa6b8499d76ab12167470748452f47e14dd900
## What changed
Add `approved_prefixes` to catalog permission messages, with `{{ approved_prefixes }}` substitution for the approved command list. An empty template suppresses the section; missing or null values retain the bundled template.
For `on-request` approvals, append an explicitly supplied prefix template even when the catalog also supplies approval instructions. Use the template for bundled `on-request` and granular approval instructions as well.
## Testing
Extend the remote model catalog integration test to cover custom prefix rendering alongside catalog approval instructions and suppression with an empty template.
GitOrigin-RevId: 82dd6f83caa56cab0a2f6343bf912efe2cb97d64
## Why
Backgrounding a Claude session creates a continuation that includes its history. Offering both sessions for import duplicates that history.
## What changed
Skip sessions containing a `continued-in` record with a nonblank `continuedInSessionId` during import detection, leaving the continuation available for import.
## Testing
Add detection and app-server regression tests covering continuation-only detection, importing the full history into one thread, and no remaining import candidates afterward.
GitOrigin-RevId: bf8383faadce984ae3c41a0b8e8b3072680fd4b2
## What changed
Export `LocalLogsDir` from `codex-file-system` to create a caller-selected diagnostic directory and retain a shared directory lock on Unix. Clones share the lock so callers can keep it held until all log connections close.
New directories use mode `0700` on Unix; existing permissions are preserved. Initialization checks that the locked directory still matches the selected path and returns an error if it changed.
GitOrigin-RevId: fc870d7ee0997d67ba1a23f72ba4ac3cf89fd31a
## Why
Skill tools depended on World State rendering to initialize their catalogs and could return `skill catalog is not ready for this step` before rendering completed.
## What changed
- Add an asynchronous `ToolContributor::prepare_for_step` hook and await all contributors before constructing tools.
- Prepare immutable skill catalogs, aliases, plugin policy, and configuration for each step. Tools, invocation detection, and World State rendering consume the prepared state without relying on rendering to perform discovery.
- Apply configuration reloads to subsequent steps while preserving live authorization checks for skill reads.
## Testing
Add coverage for preparation completing before tool construction and World State rendering, skill tools working before rendering, catalogs remaining stable across steps, and configuration reloads during discovery.
GitOrigin-RevId: 1fb95c58c412488353f3bd4403824d6d1476d3d0
## What changed
Stop emitting the warning about long threads and repeated compactions after successful context compaction. Update compaction, resume/fork, and window-header tests to wait for turn completion without expecting the warning.
GitOrigin-RevId: 707dc2dd21765ec46522276715c96cf7a112654d
## What changed
Reuse the matcher column for ASCII paths instead of storing a separate full path for every indexed entry. Store the selected search root and entry type alongside each entry so snapshots can build results without resolving the root again.
Retain the original relative path for Unicode entries because matcher columns keep only one code point per grapheme.
GitOrigin-RevId: 1e931482c9a656970e2eeaaade02f19063464f12
## What changed
- Record review attempt counts and final outcomes with a `retried` tag.
- Measure retry waits by failure reason and whether the wait ends in a retry, cancellation, or deadline; count retries only when another attempt will run.
- Count required synchronous reviews with the `required_sync` route.
- Use the originating turn's telemetry for Guardian reviews so metrics retain that turn's model attribution.
## Testing
Add metric assertions for attempt counts, retry outcomes, and waits interrupted by cancellation or deadlines. Extend the delayed cached-score integration test to verify route and retry-wait metrics use the originating turn's model after a model override.
GitOrigin-RevId: 681a719ad5dd9e4436cb37b6f5f972cb11a5c890
jif