## Why
Transcript content can contain forged role headers, transcript boundaries, or claims of user approval. Guardian needs to distinguish that content from host-assigned authorship metadata.
## What changed
- Add `features.guardianv2.transcript_mode` with `line` (the default) and `json` options for synchronous review and asynchronous scoring.
- Render JSON transcript entries with host-assigned metadata and escaped `text`, and prepend matching provenance instructions to reviewer and classifier prompts.
- Preserve JSON metadata when budget recovery shortens historical text, and keep provenance instructions outside the configured classifier prompt limit.
## Testing
Add coverage for forged roles and approvals remaining within their original entries, JSON metadata surviving budget recovery, and provenance instructions surviving prompt limits. Extend review and scoring integration tests to verify JSON evidence and matching instructions.
GitOrigin-RevId: 81a3580390d3c4d1a664e554976cda5f1adc9a2c
## Why
Fast mode previously gated both Fast and Ultra Fast, preventing policies from allowing one while disabling the other.
## What changed
- Add the default-enabled `features.ultrafast_mode` flag and enforce it independently of `features.fast_mode` in service-tier selection, requests, and agent prewarming.
- Filter TUI service-tier commands and selections by the corresponding policy and model catalog support.
- Report `supportsIndependentSpeedModes: true` from `configRequirements/read` and update the protocol schemas and generated bindings. Retain the shared Fast gate when connecting to older servers that omit this capability.
- Preserve legacy cloud speed denials by translating `rbac-fast-mode` fragments with `fast_mode = false` into a denial of both modes, while retaining higher-priority enterprise overrides.
## Testing
Add coverage for all four Fast/Ultra Fast policy combinations in requirements responses and request routing, agent prewarm inheritance, TUI command visibility and saved selections, and legacy cloud denial normalization and override precedence.
GitOrigin-RevId: 147e08524c4b228ea9d46b25a9f8aa64c359e169
## What changed
- Add the default-disabled `code_mode_tool_search` feature to expose `await tools.tool_search({query: "...", limit: 8})` in code mode when the model supports tool search.
- Return BM25-ranked deferred tools as `{tools: [{name, description}]}`, including callable names and TypeScript declarations for use in later code cells.
- Filter results through the current step's nested-tool policy before applying the limit, preserving namespace restrictions, normalized identities, description prefixes, and schema budgets.
- Add ranked-search guidance while retaining `ALL_TOOLS` catalog discovery and description overrides.
## Testing
Add coverage for feature and model-capability gating, namespace restrictions, argument validation, schema budgets, and discovery followed by deferred MCP and dynamic tool calls. Extend the scenario snapshot to cover search, invocation, yielding, and completion through `wait`.
GitOrigin-RevId: 092a29dd5f0773c518f53a001b9cafb917422f13
## What changed
Add `features.cli_daybreak`, disabled by default, to gate Daybreak controls and automatic access-program selection in the TUI and `codex exec`. Apply the gate to resumed sessions and background task turns, and hide `/daybreak` when disabled. Explicit `--cyber-access-program` overrides remain available.
## Testing
Extend tests to cover disabled controls, history replay, foreground and background turn requests, exec resume/fork behavior, and explicit access-program overrides with the feature disabled.
GitOrigin-RevId: ae96a4a8c7ab97c619716b9f39ea9f295df6e5a6
## What changed
Add the default-off `stable_environment_tools` feature flag. When enabled, advertise environment-backed tools before an executor is ready, keep environment selectors stable as readiness changes, and include the `shell` and `login` parameters. Execution still requires a usable environment and its policy.
When disabled, expose environment-backed tools only when a usable environment exists, derive selectors from usable environments, and condition shell parameters on the execution configuration. Restore tool-specific unavailable-environment errors and skip the environment readiness check for `write_stdin`.
## Testing
Parameterize the empty-environment tool availability test for both flag states, check that commands require a ready transport by default, and explicitly opt tests that rely on stable tool exposure into the feature.
GitOrigin-RevId: 68c6240fb3adf85d7f9b407804d4823c515abfdc
## Why
Command Center previously reset to project grouping on startup, losing the user's selected grouping.
## What changed
Save grouping changes to `tui.agents_overview_grouping` in the client’s user configuration and restore the saved choice at startup. Support `project`, `status`, and `model`, with `project` as the default. Report save failures in Command Center while keeping the selected grouping active.
## Testing
Add tests for cycling through and persisting all grouping modes, preserving unrelated settings in a custom configuration file, displaying save errors, and restoring saved grouping during startup.
GitOrigin-RevId: fd56dfecb4b79cfa8439f54420ce58cc0ed66ec7
## Why
Third-party exposure settings can eagerly expose tool schemas or exclude tools from `exec`. Keeping eligible tools deferred lets MCP catalogs change between turns without changing the model's eager tool prefix.
## What changed
Add the disabled-by-default `code_mode_only_strict_3p_tools` feature, applied only when the effective model tool mode is Code Mode Only.
- Defer eligible MCP, app, and client-supplied dynamic tools while keeping them discoverable and callable through `exec`.
- Override `deferLoading`, MCP/app `omit_tools_from`, and direct-only or excluded namespace settings. Log conflicts without adding prompt warnings.
- Preserve disabled, app-only, policy-denied, and over-budget tool restrictions. Keep built-in tool exposure unchanged, including when a dynamic tool has the same name.
## Testing
Add unit and integration coverage for exposure overrides, effective model modes, tool eligibility, and app discovery and dispatch. Add an MCP refresh scenario that verifies the eager tool prefix stays unchanged as tools are added, replaced, and removed while `exec` tracks the current catalog.
GitOrigin-RevId: a6a8e401214119bb02ea4711473c8fa3ec85c81a
Register `incremental_tools` as an under-development feature that is disabled by default, and expose it in the configuration schema for top-level and profile feature settings.
GitOrigin-RevId: 9579822c745e9fce598085bdc5ef8da6aabb06d7
## What changed
Allow Responses-compatible providers to configure live web access and remote compaction under `model_providers.<id>.capabilities`:
```toml
[model_providers.custom.capabilities]
external_web_access = false
remote_compaction = "v2"
```
`external_web_access = false` keeps hosted web search from accessing the live web. `remote_compaction` accepts `v2` to send `compaction_trigger` items through the Responses endpoint, or `unsupported` to use local compaction. Omitted capabilities retain existing provider defaults.
## Testing
Add unit coverage for preserving unspecified defaults and a request-snapshot scenario verifying cached web search and V2 compaction for a custom provider.
GitOrigin-RevId: fbcc4870aa51c112af575d711679a3941d1e7878
## What changed
Add `tui.mouse_scroll_speed` as a finite positive multiplier for transcript mouse wheel scrolling, including transcript overlays and session previews. Change the default from three rows to one row per wheel event; set the multiplier to `3.0` to retain the previous speed.
Fractional values accumulate movement across events and discard the remainder when direction reverses. For example, `0.5` scrolls one row every two events. Following the latest output pauses only when a whole row moves.
## Testing
Add tests for configuration validation, integer and fractional scroll speeds, direction changes, decimal accumulation, and following behavior. Extend local settings coverage to include a command-line override for the new setting.
GitOrigin-RevId: d355e246fd943415f0ce5a6affe849f77f3615e6
## What changed
Add the disabled-by-default `guardianv2_decisions_comparison` feature to run Decisions alongside Guardian V2 snapshot classification using the same policy and evidence. Initialize the comparison sampler with `CODEX_GUARDIAN_DECISIONS_API_KEY`.
Publish the baseline score before awaiting comparison results, and keep comparison results and failures from changing approvals. Apply Guardian's input token budget, skip conversation evidence, and cancel comparison work when the baseline classification is superseded. Record success, failure, and skip outcomes with bounded diagnostic reasons, including setup failures.
## Testing
Add lifecycle tests covering disabled comparison, disagreeing classifications, backend failures, unchanged published scores, matching policy and evidence, and rejection of over-budget requests before either backend sends them.
GitOrigin-RevId: 743d34c8ee440362da94f001058366027b39bd11
## Why
Subagents spawned without forked history do not receive their parent's client-defined dynamic tools, preventing them from using those tools for delegated work.
## What changed
Add the disabled-by-default `multi_agent_v2_dynamic_tools` feature flag. When enabled, fresh V2 subagents inherit the parent's dynamic tool definitions and persist them in session metadata.
## Testing
Add coverage for V1 and V2 feature gating, tool persistence, and a fresh V2 subagent calling an inherited tool and receiving its result without inheriting parent history. Update TUI assertions and a snapshot to reflect blank-line separation and question text in recovered answers.
GitOrigin-RevId: a17a16bf5570f54ce922c1521cffb883022354f2
## What changed
- Add the `daybreak` configuration key, defaulting to `false`, with per-invocation overrides such as `-c daybreak=true`.
- Resolve access programs from the model catalog, preferring `daybreak_blue` over `daybreak_red` when enabled and selecting advertised `standard` access when disabled for signed-in ChatGPT accounts. Require the OpenAI provider, a signed-in ChatGPT account, and a compatible model to enable Daybreak.
- Save the choice for new persistent threads and inherit it on resume and fork, including ephemeral forks. Explicit CLI overrides apply only to the current invocation.
## Testing
Add protocol tests for advertised-program selection and exec integration tests for account and provider restrictions, saved choices, ephemeral forks, and invocation-only overrides.
GitOrigin-RevId: ac955f08b5a891e720cfc5f67fabb7b0f6d32bb8
## Why
Mixing every input on a multichannel audio device can include playback channels in microphone capture. Selecting only microphone inputs keeps those playback channels out of the captured audio.
## What changed
- Add `audio.microphone_channel` with one-based channel numbers, accepting a single value or an array such as `[1, 2]`. Leaving it unset preserves mixing of all inputs.
- Add an input-channel picker for the selected microphone when it has at least three channels. Require a nonempty selection and save it locally for the next voice conversation.
- Average only the selected channels, deduplicate selections, and reject empty or unavailable selections without falling back to other inputs.
- Clear saved channel selections when saving an input device and report configuration overrides that prevent the reset from taking effect.
## Testing
Add regression coverage for excluding playback channels, sample conversion, subset mixing, invalid selections, configuration loading, local persistence and overrides, and picker selection and cancellation. Update UI snapshots and verify channel selections are passed to the voice helper.
GitOrigin-RevId: 99960dcfa7b10cf38270768a90bb84a4be95a406
## What changed
- Add `features.guardianv2.async_classifier_mode` with `snapshot` and `conversation` modes. Local configuration overrides model defaults; snapshots remain the fallback.
- Retain completed classifier requests and responses in conversation mode, appending transcript deltas without repeating previously delivered user instructions.
- Rebuild retained history when authorization, classifier instructions, or parent compaction changes, after an incomplete response, or when the next request exceeds the configured token limit. Add `async_classifier_conversation_token_limit`, defaulting to 100,000 tokens, while preserving the model's input limit for fresh requests.
- Serialize conversation requests in observation order, bound outstanding work, and reject stale work after authorization changes or thread shutdown. Record retained and new input token costs.
## Testing
Add tests for configuration precedence, history reuse and resets, ordered admission, queue overflow, and stale or stopped requests. Exercise the approval matrix in both modes, including resume, fork, mandatory review, authorization changes, and stream failure after an early score.
GitOrigin-RevId: 35b9800104648cde4f467086e678dee12458c3e5
## What changed
Register `browser_annotation_api` as a stable, default-enabled feature intended for requirements rather than user configuration. It controls websites opening and customizing annotation tools in desktop apps, independently of ordinary user-driven annotation.
Add the key to the configuration schema, extending the browser requirements support introduced in https://github.com/openai/codex/pull/18956.
## Testing
Extend `browser_feature_requirements_are_valid` to verify that enterprise requirements setting `browser_annotation_api = false` disable the feature.
GitOrigin-RevId: 8c7bb65932e08560040958b4472fe45f6d1c916f
## What changed
Register `in_app_voice` as a stable, default-enabled feature and add it to the configuration schema. The gate is intended for managed requirements to control permission for voice in desktop apps; permission does not establish voice availability or provider support.
## Testing
Add app-server coverage for reporting `in_app_voice = false` from `requirements.toml` in both requirements and feature-list responses. Extend the CLI feature-list test to verify that cloud-managed requirements disable the gate despite a user-configured `true` value, without rewriting the user configuration.
GitOrigin-RevId: 6ec3bc0176fdb3e1714b0136bf812bd56591f6a1
## Why
Refreshing available model descriptions changes the `spawn_agent` tool schema. Keep model choices current while preserving tool definitions and earlier conversation input.
## What changed
- Add the disabled-by-default `model_catalog_in_context` feature for multi-agent V1 and V2. When enabled and model overrides are available, move model listings from tool descriptions into developer `<model_catalog>` messages.
- Include picker-visible, compatible models with descriptions, reasoning efforts, and service tiers in a listing bounded to 1,000 bytes. Point `spawn_agent` guidance to the latest catalog.
- Append updated listings only when their rendered content changes, restore missing listings, and invalidate retained catalogs when they no longer apply.
## Testing
Extend integration coverage for V1 and V2 with the feature enabled and disabled. Verify that catalog refreshes preserve tool definitions and prior input when enabled, append the updated listing once, and retain the existing tool-description behavior when disabled. Add a request-history snapshot for the V1 opt-in path.
GitOrigin-RevId: 67b11b4ad6c35f00d0e29edf6343bb0b4804d797
## What changed
- Fork the selected conversation and open the new session with `f`, configurable through `agents.fork` in the TUI keymap.
- Move the default search shortcuts to `F3` and `/`, preserving unshadowed defaults when custom bindings conflict.
- Keep queued input on the source conversation while attaching and forking, and require closing an open side conversation before forking another task.
- Expose the fork action in command-center help and the keymap picker.
## Testing
Add regression coverage for queued-input preservation, side-conversation protection, configurable fork shortcuts, metadata editing, disconnected actions, and search fallback bindings. Update help and keymap snapshots.
GitOrigin-RevId: b11ae21ef6a2053609b31ce97c646104f18806a3
## What changed
Forward explicit `cyberAccessProgram` selections for the built-in OpenAI provider when both `api_key_cyber_access_programs` and `api_key_model_discovery` are enabled. The new feature defaults to disabled and can be toggled through the app server's experimental feature enablement API.
Reject explicit selections in OpenAI API-key sessions when either feature is disabled, instead of silently omitting the program. Leave entitlement and model restrictions to the server, and preserve the requested program when a server rejection triggers transport retries.
## Testing
Add app-server coverage for both feature gates, forwarding all three program values, and server rejection without fallback. Update core coverage for API-key resumes with disabled features and custom-provider omission.
GitOrigin-RevId: aa639afb841aa651b28f6f3f61198299372baa2d
## What changed
Register `login_shell_package_path` as a disabled-by-default experimental feature and add it to the configuration schema. Expose it in `/experimental` as “Bundled tools in login shells,” with a description explaining its intended use when login shell startup resets `PATH`.
## Testing
Extend the experimental feature metadata snapshot test to cover the new feature's label, description, and unchecked default state.
GitOrigin-RevId: dc110486ccd8d2d76ac788ba5a413a1374699ff8
## What changed
Add `features.multi_agent_v2.message_board_remote` with a board URL and a bearer token supplied directly or through an environment variable. When configured, use the remote board in preference to local or in-memory storage, including in ephemeral sessions, while preserving the existing board tools and session identity.
Ignore remote board settings in project-local configuration and use the runtime HTTP client and clock for remote requests.
## Testing
Add a mock-server integration test and snapshot covering an ephemeral session posting through the existing tool, with the expected bearer authentication, session identity, timestamp, and returned post.
GitOrigin-RevId: 263413d90a1ee4c0bdba8c1b08ba9f68bdd7a986
## Why
Configuration reloads must honor current managed restrictions without granting new enterprise MCP authority to existing sessions or overwriting newer configuration with stale snapshots.
## What changed
- Allow enterprise managed authentication only for configured MCP servers. Remove plugin `ema_auth` overlays from the schema and disable servers that still use them.
- Refresh ordinary MCP settings while preserving session settings and initially admitted enterprise registrations. Disable enterprise MCP when its registration changes, policy revokes access, or configuration loading or resolution fails; require a new session to restore enterprise authority.
- Publish refreshes only when their captured configuration is still current, with bounded retries in app-server reloads. Preserve updated managed restrictions even when a refresh is rejected.
- Finish processing other thread refreshes before `config/mcpServer/reload` reports a rejection, and document that an error can accompany partially applied changes.
## Testing
Add regression coverage for stale refreshes, bounded retries, managed-policy revocation, persistent enterprise disablement, ordinary MCP transport changes, and rejection of plugin enterprise authentication. Verify that denied enterprise servers receive no requests.
GitOrigin-RevId: 34429cd339c1ec152a2ee8697cb29f0cff5d9e5f
Clarify in the `requires_openai_auth` field documentation and configuration schema that credentials use the backend selected by `cli_auth_credentials_store`, rather than always being stored in `auth.json`. Also clarify that `env_key` specifies the environment variable containing the API key.
GitOrigin-RevId: e65753a72258e43b24c4e40b51ff26830c5b3756
## What changed
Add the disabled-by-default `guardian_root_handoff_context` feature to select worker-specific root evidence for Guardian reviews. Use recorded `spawn_agent`, `send_message`, and `followup_task` calls targeting a worker or its ancestors to select the three preceding root messages per handoff, plus the three latest root messages so recent cancellations remain visible before another handoff.
Preserve verified tool answers and evidence without known ordering, and retain the existing shared message cap. Fall back to the existing root context when no usable handoff window remains or the latest authorization message is a heartbeat. Update the review context revision when the selection changes.
## Testing
Add a delegation scenario and Guardian request snapshot covering ancestor handoffs, separate worker branches, cancellation visibility, and fallback after compaction removes handoff calls. Extend heartbeat coverage to exercise the new feature and verify that the latest turn's trusted skills are retained.
GitOrigin-RevId: 87dc39158f78b2b7e9f4f2e4afc653257ea12025
## Why
The transcript supplied to Guardian may omit earlier user instructions, restrictions, or revoked permissions. History retrieval lets the reviewer check relevant authorization before approving actions with side effects.
## What changed
- Add the disabled-by-default `guardian_conversation_history_tools` feature. With Apps enabled, expose `user_message.search_messages` and `user_message.read_messages` through the parent's live Apps connection and conversation identity.
- Recheck the parent's current app and tool policy on each call, rejecting disabled tools and calls requiring approval.
- Add retrieval instructions that distinguish user authorization from assistant context and account for later revocations and incomplete results. Allow overrides through `auto_review.experimental_conversation_history_prompt`.
- Limit history responses to an estimated 4,000 tokens by default, configurable through `auto_review.conversation_history_max_output_tokens`, while preserving stricter parent and reviewer limits.
- Allow explicit extension registries for isolated sessions and prevent those sessions from inheriting the implicit Apps connection.
## Testing
Add scenarios covering history tool exposure, parent connection and identity reuse, custom prompts, output truncation, stricter reviewer budgets, and live permission changes on a reused reviewer. Extend configuration coverage for blank prompt overrides.
GitOrigin-RevId: 055a69b113c8548bd58e7d5618ea026ba6d1ffb1
## Why
Guardian denial-limit interruptions lack a structured error identifying the cause. Make this opt-in because older clients may not recognize the new error in shared history.
## What changed
- Add `auto_review.circuit_break_action = "strict"` to attach `TooManyDenials` to the interrupted turn. The default leaves the error unset.
- Expose `turn.error.codexErrorInfo = "tooManyDenials"` in app-server notifications and saved history, and update protocol schemas and generated types.
- Preserve the warning, denial limit, and interrupted status without emitting a separate error notification.
## Testing
Add an integration test covering omitted, `default`, and `strict` settings, checking warnings, live turn errors, the absence of separate error notifications, and persisted turn errors after restart.
GitOrigin-RevId: cb5d379e64728d4d7b9daf834c13756e4a70db31
## What changed
Remove automatic next-message generation after successful turns, suggestion rendering in the composer, and the associated Tab acceptance and Escape dismissal handling. Remove the `tui.prompt_suggestions` configuration option and its schema entry, along with suggestion-specific tests and snapshots.
GitOrigin-RevId: 63bf6f2ca85da6ece502c86e2a805d000bf34210
## What changed
Make `tui.copy_on_select = "auto"` copy on mouse release unless a direct terminal is known to forward its native copy shortcut: Ghostty with a parsed version at least `1.2.0`, Kitty on macOS, Windows Terminal, or VS Code on Windows.
Unknown terminals and Ghostty with older, missing, or unrecognized versions now default to copying. Keep copying enabled under tmux/Zellij and preserve explicit `always` and `never` overrides. Update the configuration documentation and schema to describe these defaults.
## Testing
Expand the existing configuration test matrix to cover more terminals, Ghostty versions (including `1.2.0-dev`), platform-specific defaults, and multiplexer behavior alongside configuration and launch overrides.
GitOrigin-RevId: 410abfa580156454b0f88e0bf4ed977fb8c81b1e
## Why
User input queued during a long-running code-mode `exec` or `wait` can remain pending until the call returns. Allow these calls to yield early so Codex can receive the new input while the cell continues running.
## What changed
- Add the `instant_interrupt` feature flag, disabled by default.
- Watch queued user input for each sampling request and pass a shared preemption signal to code-mode `exec` and `wait` calls, including calls received later in the same response.
- Yield running cell IDs without stopping the cells, allowing subsequent `wait` calls to collect their results.
## Testing
Add integration coverage for enabled and disabled behavior, repeated steering during `exec` and `wait`, input deferred during compaction, and later calls in the same response. Verify that direct tool results and queued user messages are preserved, and add a scenario snapshot showing continuation after a cell yields.
GitOrigin-RevId: e33466a980d98e113bfb6c6a45c59de0cc7b3c1d
## What changed
- Add `tui.right_click_paste` with `auto`, `on`, and `off` modes. The default `auto` enables the fallback on Windows and Linux, including WSL when terminal detection is conclusive. `on` also enables macOS. Both modes skip SSH sessions and recognized VS Code terminals.
- Paste clipboard text through the normal composer input path when no selection, search, or blocking view takes precedence. Discard pending results after intervening input, focus loss, or changes to the target thread, draft, or cursor.
- Read text asynchronously through the shared clipboard worker, with a five-second deadline and the message size limit. Read the Windows clipboard through PowerShell on WSL and reject overlapping clipboard operations.
## Testing
Add coverage for platform and terminal policy, normal paste delivery, stale reads, overlapping clipboard operations, read timeouts, oversized text, and large command output.
GitOrigin-RevId: 0a7b6d445c09928da6c5335841ba2a9a66cc7e4b
## Why
Ephemeral sessions cannot use the SQLite-backed agent message board. An in-memory backend lets agents share discussions without creating durable board storage.
## What changed
- Add the opt-in `message_board_in_memory` setting to the multi-agent v2 configuration, allowing the board to run in ephemeral sessions when both required features are enabled.
- Share board state across agents in the same tree and release it when the last handle is dropped.
- Implement channels, posts, subscriptions, notifications, search, and paginated reads through the existing `AgentMessageBoard` interface, including request deduplication.
## Testing
Add coverage for shared handles, concurrent request deduplication, tree isolation, and state release. Run existing query and tool test cases against both backends, and extend the parent/child scenario to verify ephemeral board sharing without creating a board database.
GitOrigin-RevId: d0b2083f8ea5b1c5a3a70f258ef738b87ea74cef
## Why
Fixed schema budgets can strip parameter descriptions from large MCP tools or render their Code Mode input types as `unknown`. Allow larger budgets to preserve that guidance.
## What changed
- Add `mcp_servers.<name>.tool_input_schema_max_bytes` to configure the UTF-8 byte threshold for best-effort input schema compaction, retaining the 5,000-byte default.
- Add `features.code_mode.tool_input_schema_max_bytes` for rendered input types. Use the largest of the 16,000-byte default, the Code Mode setting, and the ordinary MCP server's explicit setting.
- Apply rendering budgets to prompt declarations and the runtime tool catalog, and avoid reusing cached declarations after the Code Mode budget changes.
## Testing
Add coverage for UTF-8 compaction thresholds, budget precedence, configuration round trips, and preservation of parameter guidance in both the Code Mode prompt and `ALL_TOOLS`.
GitOrigin-RevId: 0ef2823a614d4794e636f518b09c0b03a5239b45
## Why
Required MCP servers can block startup while establishing a live connection even when a usable tool catalog is already cached.
## What changed
- Add per-server `startup_readiness = "catalog"` to expose cached tools while the connection starts, retaining `"connection"` as the default.
- Allow an eligible cached catalog to satisfy required-server startup validation and model binding capture. Explicit server or plugin requirements still wait for a live connection, and tool execution still requires the current connection.
- Check tool filters and model visibility when accepting cached catalogs, and preserve cached catalog revisions for binding reuse.
- Serialize the new setting, expose it in the configuration schema, and trace startup readiness at validation and model binding gates.
GitOrigin-RevId: a1cbdf1757ebb5824cffe2cc56408be49711c422
## Why
Agent messages arriving during a response can interrupt sampling at reasoning or commentary boundaries, cutting off remaining tool calls.
## What changed
Add the disabled-by-default `defer_mailbox_preemption` feature flag. When enabled, sampling continues past these boundaries and queued agent messages reach the next model request alongside completed tool results.
## Testing
Add streaming scenarios and snapshots for reasoning and commentary boundaries with deferral enabled and disabled. Verify that deferral preserves the planned tool call and that both queued messages arrive in order in the next request.
GitOrigin-RevId: d6846dd73b3afb47e7293f3b1aa2abcd04e37853
## What changed
Add `tui.prompt_suggestions`, defaulting to `false`, along with suggestion request state, a generation prompt, and strict parsing of single-line suggestions up to 240 characters. Suggestion generation is not connected yet.
Keep suggestions outside the draft and render them dimly in an empty, focused composer. `Tab` accepts a suggestion for editing, a separate `Enter` submits, and `Escape` cancels pending suggestions. Respect active key bindings, popups, attachments, paste bursts, and interactive transcript footers; ignore stale results and cancel suggestions when a task starts.
## Testing
Add parser tests, composer interaction tests, and snapshots covering acceptance, dismissal, stale results, input precedence, wrapping, and transcript search layout.
GitOrigin-RevId: 868001a0fc3e6fd8c11ef1650aabc477fa36e03d
## Why
MCP OAuth configuration supported a pre-registered client ID but could not supply a client secret for token exchange or refresh.
## What changed
- Add `oauth.client_secret` and `codex mcp add --oauth-client-secret`, requiring a nonempty secret and client ID. Persist the secret in server configuration and accept `clientSecret` in plugin configuration.
- Pass configured credentials through CLI, app-server, and plugin login flows and token refresh. Require a new login when a configured confidential client's ID differs from stored credentials.
- Redact secrets in debug output and keep them out of authorization URLs and persisted OAuth token records.
- Invalidate cached OAuth connections when the configured client ID or secret changes.
## Testing
Add coverage for configuration validation and round trips, CLI argument redaction and subsequent login, app-server login, connection invalidation, and refresh with `client_secret_basic` and `client_secret_post` in both refresh modes. Verify secret exclusion from token records and reject mismatched client IDs before contacting the provider.
GitOrigin-RevId: 85bb0e410e9e68e6cd68eb6359badfc7eac78147
## What changed
Add `otel.log_guardian_assessments`, disabled by default and requiring an OTLP HTTP or gRPC log exporter. Emit `codex.guardian_assessment` when a synchronous Guardian review finishes, including review identifiers, status, risk level, user authorization, and rationale. Include `allow` or `deny` outcomes only for completed model assessments, not review errors, timeouts, or cancellations.
Cap exported rationales at 64 KiB on a UTF-8 character boundary and record their original byte length and truncation status. Use the log-only route to exclude assessment payloads from trace export, local state logs, and bug-report log buffers. Cached V2 approvals are not included.
## Testing
Add coverage for configuration gating, enabled and disabled denial logging, terminal statuses and outcomes, UTF-8 rationale truncation, export routing, and bug-report log buffer exclusion.
GitOrigin-RevId: dcbb5b429c8726a5a5c80ff82f9d625e81796ede
## What changed
- Deprecate and ignore `features.guardianv2.thread_context`, including profile overrides, with a migration notice. Ignore managed requirements for the removed flag with a warning.
- Preserve surviving legacy root instructions across compaction and resume when retained instructions are incomplete. Include unmatched instructions in worker authorization context with an explicit unknown-ordering notice, without replacing newer retained facts or expanding the reviewer's model window.
- Use surviving source calls to roll back verified answers from older checkpoints that lack acceptance-order metadata.
## Testing
Add regression coverage for legacy instruction recovery, compaction and resume, source matching, and answer rollback around same-turn user input. Update configuration and Guardian review tests to verify that the deprecated opt-out still uses thread-owned context and rejects incompatible compaction evidence.
GitOrigin-RevId: a65936c9e0b912e7667d1385a2ec53df726565de
## What changed
Add `otel.log_agent_responses`, disabled by default and requiring an OTLP HTTP or gRPC log exporter. Emit `codex.agent_response` for completed `final_answer` messages from main agents and spawned task agents, with session, turn, item, and available parent/root attribution.
Strip memory citations from exported text, preserve the stored answer, and cap responses at 64 KiB on a UTF-8 character boundary. Include the original byte length and a truncation flag, and suppress duplicate item completions within each turn. Exclude commentary and non-task agents.
## Testing
Extend configuration tests for default-off and explicit opt-in behavior, the agent execution test for main/subagent response attribution, and the log-buffer test for response-event exclusion.
GitOrigin-RevId: eacda1150de2e6bac2c667d71b57214b0a086f1a
## What changed
- Add `tui.copy_on_select` with `auto` (default), `always`, and `never` modes, and apply it to the fullscreen transcript, transcript overlay, and resume/fork previews.
- Enable `auto` in tmux and Zellij, and in direct macOS terminals except Ghostty and Kitty. On other platforms, enable it in direct terminals identified as iTerm2 or Terminal.app.
- Copy nonempty mouse selections on release, including word and line selections, while retaining their highlight. Preserve link activation and ignore empty selections.
- Clear composer selections after confirmed keyboard copies, matching right-click copies, while preserving the draft and cursor. Keep selections when copying fails or delivery is unconfirmed.
## Testing
Add coverage for terminal defaults and configuration overrides, copying on release, retained highlights, repeated clicks, link activation, and empty drags. Extend composer coverage to verify selection clearing for `Cmd-C`, `Ctrl-C`, and right-click across clipboard outcomes.
GitOrigin-RevId: 24e6f9e267ef3ab249c5356db736e094127f68b8
## What changed
Add `features.multi_agent_v2.disable_direct_message`, defaulting to `false`. When enabled, omit `send_message` and `followup_task` while preserving spawning, automatic child results, and the remaining agent management tools.
Require an available message-board `post` tool when this option is enabled for sessions using multi-agent v2 collaboration tools, exempting internal worker sessions.
## Testing
Extend configuration parsing tests and run the message-board subscription/resume scenario with direct messaging both enabled and disabled. Verify post search, subscription behavior, and which collaboration tools are exposed.
GitOrigin-RevId: 72ec22ef0b92fa81e02cdeb058d8b4f93aca3be6
## What changed
Add the default-off `features.prefer_mxc` flag to select MXC for local Windows execution when native support is available and effective network settings do not explicitly forbid local binding. Otherwise, retain the configured backend and legacy setup behavior.
Resolve the preference during config loading and use the effective local backend for execution, network proxy setup, sandbox diagnostics, and `windowsSandbox/readiness`. Preserve the configured backend for remote executors and `config/read`. Explicit `windows.sandbox = "mxc"` remains strict, and command failures do not trigger backend fallback.
## Testing
Add coverage for preference resolution, startup readiness without rewriting configuration, local and remote backend selection across environment updates and child threads, and workspace-write permission context in an agent turn.
GitOrigin-RevId: b51178f0371d38ebb58e41af54a068fca67fa316
## What changed
Render unordered bullets as `•` and task markers as `☐` or `☑`, preserving ordered numbering and continuation indentation in streaming and completed Markdown. Add `tui.rendering.lists`, enabled by default; setting it to `false` retains hyphen bullets and textual task markers.
## Testing
Add snapshot coverage for nested, ordered, quoted, and wrapped task lists, plus code and escaped markers. Add character-by-character streaming tests that compare incremental and emitted output with full rendering, with list rendering enabled and disabled.
GitOrigin-RevId: df9209d8c42f277dd2a2d7073ea19a6feb7dd706
## What changed
Mark `guardianv2.thread_context` as stable and enable it by default for synchronous and asynchronous Guardian reviews. Keep it independent of the Guardian v2 `enabled` toggle and preserve explicit configuration and profile overrides. Update the configuration schema documentation to match.
## Testing
Update coverage for default configuration and sender user messages, review prompt snapshots, history retention across compaction, and checkpoint provenance. Assert that later user input invalidates an in-flight review's authorization. Keep legacy transcript budgeting coverage by explicitly disabling thread context in that test.
GitOrigin-RevId: 19afd34d7bfc0ee36bbf878089c68b732a21bc6a
## What changed
Default `tui.fullscreen_transcript` to `true`, including when the `[tui]`
section is absent, and apply the same default to the first frame. Update the
configuration schema to match. Alternate-screen restrictions still take
precedence, and `tui.fullscreen_transcript=false` restores terminal scrollback.
## Testing
Update configuration and startup tests for the new default, including an empty
`[tui]` section and `--no-alt-screen`. Adjust PTY tests to cover default fullscreen
entry and explicit opt-out to terminal scrollback.
GitOrigin-RevId: e460dcd058d52c50da2abc5113bbb678e845d5fc
## What changed
- Add `auto_review.extra_policy` and the managed `guardian_extra_policy` requirement to supply policy text alongside the resolved tenant policy. Nonblank managed values take precedence; blank values are ignored.
- Render the additional text through `{{ extra_policy }}` in Guardian reviewer templates and append it to the tenant policy for Guardian v2 classification before truncation.
- Preserve placeholder-like text inside supplied policies literally.
## Testing
Add coverage for configuration precedence, blank values, template substitution, and classifier prompts, plus a scenario verifying that managed tenant and extra policies reach the Guardian reviewer together.
GitOrigin-RevId: 180d8d716c63fe96a92ec5bfbd22db4ddccd4f1f
## What changed
- Replace the built-in orchestrator skill provider with a host-supplied cloud provider, using `cloud` authority and `c` root aliases in skill tools and prompts.
- Add `cloud.skills.enabled`, defaulting to true but requiring a supplied provider. Keep `orchestrator.skills` accepted as a legacy no-op setting, and remove the app server's automatic orchestrator provider registration.
- Discover cloud skills once per turn during cancellable startup. Serve catalog snapshots to prompts and tools without triggering discovery or retries.
- Scope cached catalogs and resources to authentication state. Preserve them on refresh failures within the same scope, invalidate them when that scope changes, and reject late discovery or read results from replaced cache generations.
- Reuse executor discovery catalogs only when successful discovery inputs and bundled-skill settings match.
## Testing
Add coverage for per-turn refresh, skill removal, same-account failures and reconnects, authentication changes, and stale in-flight results. Update configuration and tool tests for cloud authority, provider gating, and resource reads without an executor.
GitOrigin-RevId: c57e38ec7dcc880c0d4c8a2995adfd3e28301079
## What changed
- Register the existing message-board tools with the app server through a lifecycle extension, gated on `agent_message_board`, multi-agent v2, and non-ephemeral sessions. The new feature flag is disabled by default.
- Bind tools to each agent's identity and share the SQLite-backed board across the agent tree and runtime resumes.
- Use the runtime clock for posts and deliver ID-only notifications to running agents, with tools to retrieve post contents. Skip inactive recipients without starting them or queuing notices.
- Emit a warning and leave board tools unavailable if initialization fails.
## Testing
Add runtime scenarios and a context snapshot covering feature gating without creating storage, posting and searching, active-only notifications, sharing with child agents, persistence across resume, and clock failure without channel creation.
GitOrigin-RevId: a81bd85cd372b0d122ba375ed1a1bfd3ba3a3b7c
## What changed
Add `tui.rendering.mermaid`, `tui.rendering.math`, and `tui.rendering.tables`, all enabled by default and independent of animation settings. Disable individual renderers to display their source instead of diagrams, Unicode math, or formatted tables.
Apply preferences to streaming and completed responses, startup previews, and session changes. When table rendering is disabled, preserve pipe syntax, cell markup, and enclosing Markdown fences. Keep HTML clipboard formatting independent of terminal rendering preferences.
## Testing
Add coverage for individual defaults, source preservation, nested table fences, session settings, and clipboard behavior. Verify incremental rendering and emitted output match completed rendering across all eight toggle combinations.
GitOrigin-RevId: 48d765eac20a82881eed94f186bf5b025ff4f0db
felixxia-oai