## Why
Transcript content can contain forged role headers, transcript boundaries, or claims of user approval. Guardian needs to distinguish that content from host-assigned authorship metadata.
## What changed
- Add `features.guardianv2.transcript_mode` with `line` (the default) and `json` options for synchronous review and asynchronous scoring.
- Render JSON transcript entries with host-assigned metadata and escaped `text`, and prepend matching provenance instructions to reviewer and classifier prompts.
- Preserve JSON metadata when budget recovery shortens historical text, and keep provenance instructions outside the configured classifier prompt limit.
## Testing
Add coverage for forged roles and approvals remaining within their original entries, JSON metadata surviving budget recovery, and provenance instructions surviving prompt limits. Extend review and scoring integration tests to verify JSON evidence and matching instructions.
GitOrigin-RevId: 81a3580390d3c4d1a664e554976cda5f1adc9a2c
## What changed
Add `model` and `reasoningEffort` to `subAgentActivity` items for multi-agent v2 spawns. Capture startup settings before the child begins its turn and resolve the reported effort against model metadata, including model defaults, while preserving the child's configured effort.
Carry these fields through live notifications, persisted activity, thread history, and legacy rollout migration. Update the JSON schemas and generated TypeScript and Python types. Older records and other activity kinds retain null values.
## Testing
Add coverage for resolved spawn settings matching the child's request across legacy and paginated history, preserving configured effort, forwarding metadata through events and history, and reading and migrating older records without the new fields.
GitOrigin-RevId: a9e4241ae21bb8db1ead293f78ffba8257cca0ae
Use `TurnEnvironmentRequests` and the executor environment's `request()` in the MCP turn metadata test to match `ThreadSettingsOverrides`. Allow additional fields when matching `TurnInputSubmission::Started` in the pending input test.
GitOrigin-RevId: 6f7f7c60511d999274079f715ba2a68163e69caf
## Why
WebSocket rate-limit and overload errors ignored `Retry-After` advice and ended turns even when the server supplied a retry delay.
## What changed
Extract retry advice from nested `error.headers`, falling back to top-level `headers` when nested advice is missing or invalid. Use the shared HTTP header validation and retry-delay parser, and preserve the delay when mapping WebSocket errors.
## Testing
Add coverage for nested-header precedence, malformed headers, HTTP header validation, and recovery after an advised rate limit. Verify that overloads retry only while advice is present, without falling back to HTTP, and that headerless rate limits, usage limits, and `flex_unavailable` errors remain terminal.
GitOrigin-RevId: 61add0c36197e10402d6d3c325332aac72a5a521
## Why
An interrupt or turn replacement can invalidate a pending-work wakeup while its turn context is being constructed. Task startup could then recreate a turn whose reservation was no longer active.
## What changed
- Recheck that the wakeup still owns the active turn reservation immediately before calling `start_task`, and return if it does not.
- Allow the remote-control re-enrollment test up to 45 seconds for the connection following reconnect backoff.
## Testing
Add a regression test that pauses wakeup context construction, processes an interrupt, and then resumes construction. It verifies that no additional turn starts and only the initial model request is sent.
GitOrigin-RevId: c857fdd9f0fac3790d35a95a1f21a6d41977bb29
## What changed
Add `TurnEnvironmentRequests` to carry environment requests together with their fallback working directory. Update thread settings overrides and active turn settings to accept requests, constructing `TurnEnvironmentSelection` values in the receiving thread before validation and runtime use.
Adapt app-server callers, reviewer settings, and existing tests to supply requests or explicitly convert runtime selections back into requests.
GitOrigin-RevId: 8028f804bebe3fde553f57bb450f6dca3970cc4a
## What changed
Add the turn's `root_turn_id` to `_codex_apps` request metadata for host-owned Apps MCP calls. Remove any tool-supplied value before populating it from turn metadata, and omit the field for user-configured or extension-owned Apps servers.
## Testing
Extend unit coverage to verify that host-owned Apps calls replace an untrusted `root_turn_id` and user-configured Apps calls omit it. Update integration assertions for default and explicitly supplied root turn IDs, including approval flows, and verify that extension-owned calls omit the field.
GitOrigin-RevId: 754a642c2fff36a866b8cffa9fb3e161f232de08
## Why
Queue-only agent mail can wake a sleeping session without starting a new task. The wake turn needs to retain the previous turn's attribution so delegated work reports completion to the initiating agent, including after a reload.
## What changed
Capture the previous turn's attribution while reserving the pending-work turn. Reuse its trigger, parent and root turn IDs, and initiating agent path for queue-only wakes. Mail that explicitly starts a new task continues to supply its own attribution.
## Testing
Extend regression coverage for live and reloaded sleep wakes, delegated and unknown attribution, settings changes while asleep, and subsequent task-triggering mail. Verify that a reloaded sleeping worker routes completion to the initiating turn.
GitOrigin-RevId: 28e38474028bdbf35a0538c1202165f056bb3dc3
## Why
Clients starting delegated work need to attribute descendant turns to the original turn and retain that attribution through completion and history reads.
## What changed
- Accept optional `parentTurnId` and `rootTurnId` in `turn/start`, and expose `rootTurnId` on returned turns and lifecycle notifications.
- Default new turns to their own root when none is supplied. Preserve the active turn's root when steering, ignoring incoming lineage fields.
- Carry root IDs through completion, interruption, recovery, and fork boundaries, and persist them for paginated history reads. Leave unknown roots null in older history.
- Update protocol schemas and generated TypeScript and Python bindings.
## Testing
Extend coverage for default and explicit roots, steering without changing lineage, interrupted and recovered turns, history reads after restart in both history modes, nested fork pagination, and compatibility with older database writers.
GitOrigin-RevId: f1a570a12bd11742929fd2e8b017e5d35aa07dcb
## Why
Recovering an interrupted turn replaced its original trigger with `retry` and restored only its root lineage from model context. Turns suspended before that context was written could lose their attribution entirely.
## What changed
- Persist regular-turn attribution in `TurnStartedEvent` and compaction resume metadata, including the trigger, parent and root turn IDs, and initiating agent path.
- Restore matching attribution during recovery, keep unknown triggers absent, and retain the model-context root fallback for older records.
- Reconstruct attribution from surviving turns across rollback and late completion or abort events, and clear inherited attribution when spawning a forked agent.
## Testing
Add coverage for repeated cold recovery, suspension before context persistence, legacy rollouts, fresh attribution on subsequent turns, compaction checkpoints, rollback, and late terminal events.
GitOrigin-RevId: 85b5763e8fbd48a1ea2c07cfda8196e63c2cd33a
## What changed
Add `codex.shell_snapshot.command` and `codex.shell_snapshot.wait_ms` metrics for eligible command preparations in the unified exec runtime and exec server. Tag observations with snapshot version, availability state, and whether replay was selected (`used`) or normal shell startup was used (`fallback`). Exclude background prewarming from command observations; `used` measures replay selection, not successful restoration or command completion.
## Testing
Extend snapshot retry tests to verify command counts and wait observations across fallback and recovery, excluding prewarm captures. Extend credential-broker approval tests to verify one `protected` snapshot observation for login-shell commands.
GitOrigin-RevId: d3d9f370b6bbba6dfc930a44044ce09373841799
Refresh the ranked tool catalog and partial-answer fork snapshots to reflect instructions requiring `fork_turns: "none"` when overriding the model or reasoning effort. Update the affected collaboration tool and message hashes.
GitOrigin-RevId: 5c3cbdd734f57eaefee0b0412e555e3882b1472e
## What changed
- Limit multi-agent V2 `fork_turns` guidance to `all` and `none`. Accept legacy positive integer strings as full-history forks instead of truncating parent history.
- Remove partial-history fork handling and telemetry, and direct model override usage to `fork_turns: "none"`.
- Strip inherited `multi_agent.role_instructions` and `multi_agent.usage_hint` content by kind, including persisted hints whose wording predates the current bundled instructions.
## Testing
Update regression coverage for legacy `"1"` and `"3"` values inheriting full history, invalid and zero values being rejected, and stale parent hints being removed from compacted history with both marked and unmarked instructions.
GitOrigin-RevId: 8f6017dc66ad8deefd7745399ef76e1bb1435bb2
## Why
Messages with the `partial_answer` phase contain answer text without declaring a terminal answer. They should remain searchable and speakable without being treated as final messages.
## What changed
- Preserve explicit `partial_answer` phases in streamed and completed realtime handoffs, bypassing legacy channel-prefix parsing and routing them to the `speakable` channel.
- Treat partial answers as nonterminal in V1 handoffs and omit the final-message prefix.
- Include partial answers in thread occurrence searches and normalize them to the final conversation channel in rollout traces.
## Testing
Extend coverage for realtime phase routing, streamed and completed handoffs, partial-answer search results, and rollout normalization. Verify that turn summaries still exclude nonterminal messages.
GitOrigin-RevId: aa183da783f6e7e0b78ddd51073cba533297e121
## Why
Fast mode previously gated both Fast and Ultra Fast, preventing policies from allowing one while disabling the other.
## What changed
- Add the default-enabled `features.ultrafast_mode` flag and enforce it independently of `features.fast_mode` in service-tier selection, requests, and agent prewarming.
- Filter TUI service-tier commands and selections by the corresponding policy and model catalog support.
- Report `supportsIndependentSpeedModes: true` from `configRequirements/read` and update the protocol schemas and generated bindings. Retain the shared Fast gate when connecting to older servers that omit this capability.
- Preserve legacy cloud speed denials by translating `rbac-fast-mode` fragments with `fast_mode = false` into a denial of both modes, while retaining higher-priority enterprise overrides.
## Testing
Add coverage for all four Fast/Ultra Fast policy combinations in requirements responses and request routing, agent prewarm inheritance, TUI command visibility and saved selections, and legacy cloud denial normalization and override precedence.
GitOrigin-RevId: 147e08524c4b228ea9d46b25a9f8aa64c359e169
## Why
Partial answers contain answer fragments while a turn is still in progress. Treating them as final answers defers mailbox delivery and can count empty fragments as empty final responses; filtering them from forked histories and guardian transcripts loses answer content.
## What changed
- Allow mailbox preemption after `partial_answer` messages and keep mailbox delivery open.
- Preserve partial answers in forked agent histories and include them as protected assistant entries in guardian transcripts.
- Exclude empty partial answers from empty-final-response accounting for goals.
## Testing
Add regression coverage for partial-answer phases in live events, sampling continuations, follow-up requests, and forked child requests, plus mailbox preemption, goal accounting, and guardian transcript inclusion.
GitOrigin-RevId: 208c8933e211b42b6c2d0bec6952527b8c9c120e
## What changed
- Remove `instructions_variables`, its protocol type, and unused personality templates. Continue accepting older catalogs by ignoring their legacy variables.
- Report `supports_personality` as `false` in app-server model listings and TUI model presets.
- Preserve pinned model metadata and base instructions when only personality settings change. Reuse Guardian review sessions across friendly and pragmatic settings, while keeping the `none` opt-out distinct.
## Testing
Update coverage for legacy catalog deserialization, personality override notifications, opt-out behavior during model switches, and preservation of instructions and history on resume.
GitOrigin-RevId: bee8a263ef84046301888d02347f43929ececce9
## What changed
Introduce `TurnEnvironmentRequest` for caller-supplied environment input and construct `TurnEnvironmentSelection` at session startup and app-server settings boundaries. Update thread startup, default environments, and inherited environment handoffs to use requests, with explicit conversions when reusing runtime selections.
Move the environment types into `protocol::environment` while retaining their `protocol` re-exports. Update test fixtures and existing tests to build request inputs separately from runtime selections.
GitOrigin-RevId: 12e7daaece95aae136afae8b055b4dbaebdffc75
## What changed
- Carry opaque `review_target` values through misalignment errors and expose optional `reviewTarget` in the app-server protocol and generated clients. Preserve the value verbatim and redact it from debug output.
- Keep target-based `misalignment_override` metadata on turn requests, preserve it across steering updates, and exclude it from compaction and external MCP metadata. Reject overrides from global Responses metadata while retaining legacy timestamp behavior for per-turn overrides.
## Testing
Extend coverage for error propagation, debug and rollout redaction, steering preservation, and metadata filtering. Verify that automatic compaction omits the review target while turn requests before and after compaction retain it.
GitOrigin-RevId: 8c1abb076a206ff5927a4acc31bd25e3efc2bff9
## What changed
- Add the default-disabled `code_mode_tool_search` feature to expose `await tools.tool_search({query: "...", limit: 8})` in code mode when the model supports tool search.
- Return BM25-ranked deferred tools as `{tools: [{name, description}]}`, including callable names and TypeScript declarations for use in later code cells.
- Filter results through the current step's nested-tool policy before applying the limit, preserving namespace restrictions, normalized identities, description prefixes, and schema budgets.
- Add ranked-search guidance while retaining `ALL_TOOLS` catalog discovery and description overrides.
## Testing
Add coverage for feature and model-capability gating, namespace restrictions, argument validation, schema budgets, and discovery followed by deferred MCP and dynamic tool calls. Extend the scenario snapshot to cover search, invocation, yielding, and completion through `wait`.
GitOrigin-RevId: 092a29dd5f0773c518f53a001b9cafb917422f13
## Why
Reloaded subagent threads did not emit initialization analytics, and subagent initialization events always reported `new`.
## What changed
Emit initialization events for resumed spawned subagents before notifying thread listeners. Inherit parent client metadata before reserving a residency slot can evict the parent, preserve the thread's original `created_at`, and report `initialization_mode` as `resumed`. Refresh stored analytics metadata when a subagent resumes; newly created subagents continue to report `new`.
## Testing
Extend the cold-resume integration test to verify a single worker initialization event with the expected session, parent, source, resume mode, and original creation timestamp. Update serialization and session tests to check initialization modes.
GitOrigin-RevId: e78b0c4d88b6ddbe993ca7e1fe7717b6f74bf3d9
## Why
Updating a CRLF file with `apply_patch` previously normalized its line endings to LF unless preservation was explicitly enabled. Preserve the file's existing line endings without requiring an opt-in.
## What changed
- Use line-ending-preserving updates for both tool calls and standalone `apply_patch` invocations, removing the legacy normalization mode.
- Mark `apply_patch_preserve_line_endings` as removed.
- Always set `CODEX_APPLY_PATCH_PRESERVE_LINE_ENDINGS=1` in child environments for compatibility with older patch executables, overriding stale values.
## Testing
Update CLI, tool-call, shell-heredoc, and app-server tests to check CRLF preservation by default. Keep coverage for overriding stale compatibility environment values.
GitOrigin-RevId: 96d0b0e5350faa3fc7a45d63627a132657b44523
## Why
Removing a whole namespace previously listed both the namespace and every member as unavailable tools.
## What changed
Emit separate namespace and individual-tool sections in one removal notice for Responses Lite. A removed namespace subsumes its members, with instructions allowing tools declared in a later update to become available again. Keep individual removal notices for tools in surviving namespaces and for built-ins.
## Testing
Expand unit tests and snapshots to cover mixed removals, empty catalogs, restoration, and replacing a namespace with a built-in of the same name. Extend the MCP refresh scenario to verify namespace removal and restoration, successful calls after restoration, preserved request history, and no repeated updates on unchanged turns.
GitOrigin-RevId: 66aa43a41db956cb5458121ea1db8c673a7ce948
## What changed
- Record nonempty base instructions as a developer message after tool declarations at the start of each incremental tool context window, and omit the request-level `instructions` field.
- Preserve this prefix when rebuilding history after local or remote compaction, while keeping the compaction summary last.
- Count recorded base instructions once when estimating context usage and trimming tool outputs.
## Testing
Add regression coverage for instruction placement, omission of request-level instructions, compaction ordering, and token accounting. Exercise remote compaction trimming with both request-level and recorded base instructions.
GitOrigin-RevId: 6a6fda92c5c6eb33852a77b38d34c028cf78b164
## Why
Thread-owned Guardian context is always enabled, and `guardianv2.thread_context` is deprecated and ignored.
## What changed
Remove explicit `GuardianThreadContext` enables from retained-context and heartbeat tests. Parameterize the heartbeat skill-context test with optional feature lists so it covers the default behavior and `GuardianRootHandoffContext`, each with one or three heartbeats.
GitOrigin-RevId: 78e3159832bff08b79c7977d876d9acb587e9c71
## What changed
- Accept per-environment `skills.required` lists through `environment/add` and `environments.toml`.
- Before inference, require each named skill to be enabled and supplied by the selected environment. Missing skills fail the turn before a model request, including when environment setup fails.
- Stop applying an environment's requirements after it is deselected. Exempt isolated Guardian reviewers, which have no skill catalog.
## Testing
Add tests for available, missing, disabled, and wrong-environment skills, failed environment setup, recovery after deselection, and propagation of TOML requirements to the correct environment.
GitOrigin-RevId: 302ced4774697d2f414f745fe0535e71f747eda2
## What changed
Move base instructions from the top-level `instructions` field into a prefixed `developer` message in `input` for standard Responses requests, matching Responses Lite. Remove the field from HTTP and WebSocket request types and assign instruction messages stable IDs derived from the thread and instruction text.
## Testing
Extend standard and Responses Lite tests to cover instruction message serialization, stable IDs, and resume consistency. Update WebSocket tests to verify that changed instructions trigger a full request without `previous_response_id`.
GitOrigin-RevId: e2de4b8e30a9339377fac133ceda981abd1a112b
## Why
Reviewer compaction can invalidate previously admitted transcript evidence. When a parent checkpoint is available, restarting from that checkpoint preserves the captured parent context instead of relying on a lossy reviewer summary.
## What changed
- Restart an invalidated reviewer once from the action-time parent checkpoint, within the original review deadline.
- Preserve fresh checkpoints during startup and fit review input using the existing budget selection.
- Select transcript evidence from the checkpoint actually loaded by the reviewer. Track the transcript source so cursors remain valid across legacy-history eviction and reset when the source changes.
- Resume transcript deltas after successful recovery, including authorization added after the parent checkpoint.
## Testing
Add regression coverage for checkpoint recovery, post-checkpoint authorization, resumed deltas, and stopping after one restart. Extend history tests to cover both legacy retention and parent-checkpoint reuse, and update the checkpoint-migration snapshot.
GitOrigin-RevId: bc20fb9489afaad963303beff1c79f62fa5023f7
## What changed
Expose two JavaScript globals for consuming results as inputs settle:
- `as_settled(promises)` returns an async iterator of fulfilled and rejected records in settlement order, preserving queued results while the consumer is busy.
- `stream_settled(promises, emit)` delivers those records to a callback, awaiting each invocation and propagating callback errors.
Records include an `index`, a `status`, and either a `value` or a `reason`. Iterable inputs use positional indices; `Map` inputs retain their keys. Both helpers accept promises, thenables, and plain values.
## Testing
Add runtime coverage for ordering, input types, object identity, callback behavior, early iteration exit, and termination. Add stdio and gRPC host tests for partial results across waits, plus a scenario snapshot verifying fulfilled and rejected records reach the model.
GitOrigin-RevId: cddc9f3679ae04f2421e154caa0417afb15f550d
## Why
Incremental namespace declarations contain only changed or added tools. Their descriptions need to make clear that previously declared tools remain available unless explicitly marked unavailable, and that redefinitions replace earlier definitions.
## What changed
Append this guidance to updates of existing namespaces, preserving any namespace description. Leave initial declarations and catalog hashes unchanged.
## Testing
Extend unit and request-history coverage for the namespace hint, unchanged turns that append no tool definitions, and MCP tool removals that append a standalone notice without rewriting history or repeating the notice on the next turn.
GitOrigin-RevId: e32f3c9948efb44a1253868fe67967f117cc21e8
## Why
Manual, pre-turn, and post-turn compaction previously deferred rebuilding initial context until the next turn. Their saved replacement history could omit refreshed instructions and skill catalogs.
## What changed
- Install initial context during local and remote compaction, before the last real user message or summary, keeping the compaction summary last.
- Persist matching full world-state and turn-context baselines with every replacement instead of retaining only partial extension metadata.
- Build replacement context and recompute token usage for the current model even when the previous model performs compaction. Reuse that captured context for eligible current-model retries.
- Capture manual compaction context centrally and propagate preparation errors to the task runner.
## Testing
Update assertions and snapshots for context ordering, refreshed instructions, resume and fork history, current-model checkpoint baselines, and cloud skill catalog retention across compaction and resume.
GitOrigin-RevId: 8572a76c31c6884a3c580b3bbb350d49af876bd1
## Why
MCP elicitation reviews used turn-start context, which could omit remote environments that became ready before the tool invocation and use stale environment permissions.
## What changed
Capture the issuing step's Guardian review context with each live MCP invocation and reuse it for elicitation reviews. Fall back to turn context when no matching live invocation is available, and preserve the captured context for in-flight actions.
## Testing
Extend the deferred-executor regression test to cover MCP elicitations, checking that Guardian receives the newly ready remote environment and its denied paths, excludes stale local denied paths, and returns the denial to the parent model.
GitOrigin-RevId: 0cc58b8f30543a9af87d53e1a90f574a8e6a2f84
## What changed
Add the default-off `stable_environment_tools` feature flag. When enabled, advertise environment-backed tools before an executor is ready, keep environment selectors stable as readiness changes, and include the `shell` and `login` parameters. Execution still requires a usable environment and its policy.
When disabled, expose environment-backed tools only when a usable environment exists, derive selectors from usable environments, and condition shell parameters on the execution configuration. Restore tool-specific unavailable-environment errors and skip the environment readiness check for `write_stdin`.
## Testing
Parameterize the empty-environment tool availability test for both flag states, check that commands require a ready transport by default, and explicitly opt tests that rely on stable tool exposure into the feature.
GitOrigin-RevId: 68c6240fb3adf85d7f9b407804d4823c515abfdc
## Why
Malformed `deny_read_acl_state.json` previously caused deny-read ACL reconciliation to fail. Recovery must restore bookkeeping without removing unknown existing restrictions or modifying a linked file's contents.
## What changed
- Retry malformed reads for up to two seconds, then rebuild bookkeeping only after excluding active writers and successfully applying current deny-read ACLs. Preserve unknown historical denies and continue propagating I/O errors.
- Validate the opened state file before reading or writing, rejecting reparse points and files with multiple hard links.
- Write state in place without truncating before validation, preserving file identity and permissions. Retry sharing violations during writes while preventing replacement through delete access.
## Testing
Add Windows tests for corrupt-state recovery, linked-file rejection, concurrent writer and delete-handle behavior, file identity and ACL preservation, and subsequent permission-profile changes. Extend the elevated sandbox integration test to verify that denied reads remain blocked after recovery while allowed writes and deletes succeed.
GitOrigin-RevId: 4aca32df00d015df3763fdc447ffdfbe3fd6cec0
## Why
A review can fail before the UI receives the event that enters review mode. Failed-turn completion also needs to preserve the running indicator when a queued `/review` has already been submitted and is awaiting startup.
## What changed
- Emit the review-entry lifecycle before starting the review task, after aborting existing tasks and clearing connector selection.
- When a live failed-turn completion repeats an already handled error, refresh task state only if no user turn is pending startup, and continue processing queued input.
## Testing
Add regression tests for lifecycle ordering on a server-overload response and for preserving the running indicator while a queued review awaits startup after a failed turn.
GitOrigin-RevId: 0f91d3d1a1a983542c54c2686630de9c232321b1
## Why
Environment readiness previously changed which tools and command parameters were advertised to the model, even when the selected environments stayed the same.
## What changed
- Keep enabled command, patch, image, and permission tools exposed when environments are absent, starting, or failed.
- Return a consistent message asking the model to wait when no usable execution environment is available, while preserving distinct errors for unknown environment IDs.
- Derive environment selectors from all selected environments rather than only ready ones.
- Always advertise `exec_command`'s `shell` and `login` parameters while continuing to enforce login policy at execution time.
## Testing
Expand integration coverage for empty, pending, failed, ready, and recovered environments, including stable command parameters and login-policy rejection. Update subagent and skill-catalog snapshots, with separate Windows expectations.
GitOrigin-RevId: bb08084066896a9f14b3b568c081c3eaac981db7
## Why
Third-party exposure settings can eagerly expose tool schemas or exclude tools from `exec`. Keeping eligible tools deferred lets MCP catalogs change between turns without changing the model's eager tool prefix.
## What changed
Add the disabled-by-default `code_mode_only_strict_3p_tools` feature, applied only when the effective model tool mode is Code Mode Only.
- Defer eligible MCP, app, and client-supplied dynamic tools while keeping them discoverable and callable through `exec`.
- Override `deferLoading`, MCP/app `omit_tools_from`, and direct-only or excluded namespace settings. Log conflicts without adding prompt warnings.
- Preserve disabled, app-only, policy-denied, and over-budget tool restrictions. Keep built-in tool exposure unchanged, including when a dynamic tool has the same name.
## Testing
Add unit and integration coverage for exposure overrides, effective model modes, tool eligibility, and app discovery and dispatch. Add an MCP refresh scenario that verifies the eager tool prefix stays unchanged as tools are added, replaced, and removed while `exec` tracks the current catalog.
GitOrigin-RevId: a6a8e401214119bb02ea4711473c8fa3ec85c81a
## Why
Tool availability can change between calls. Conditioning discovery guidance on whether deferred tools are currently present changes the `exec` description when the catalog changes.
## What changed
Always include the configured discovery guidance in the Code Mode `exec` description, even when no deferred tools are present. The default guidance explains how to find tools in `ALL_TOOLS` and notes that availability can change between calls. Custom guidance and explicit empty overrides remain supported.
## Testing
Add regression coverage for stable guidance with empty and populated deferred tool catalogs in both Code Mode configurations, including custom and empty overrides. Update tool-description assertions and request snapshots.
GitOrigin-RevId: 086ea19a48e3c51ec8c429a619676a936d658721
## Why
In `CodeModeOnly`, MCP resource helper definitions changed when the first server was added or the last server was removed.
## What changed
Always register `list_mcp_resources`, `list_mcp_resource_templates`, and `read_mcp_resource` in `CodeModeOnly`, even without configured MCP servers. This keeps their definitions stable across server configuration changes.
## Testing
Add a regression scenario that calls all three helpers before adding a server, with a server registered, and after removing it. Assert identical tool definitions across requests, empty resource and template lists, and the expected error when reading from an unknown server.
GitOrigin-RevId: c5777efac250b83dd4bb1c9100a6b6169470556f
## What changed
When `IncrementalTools` is enabled for Responses Lite, track tool definitions in world state and conversation history. Send the initial catalog once, then append only added or changed definitions while preserving earlier request history. Emit developer notices for removed tools and namespace instruction changes.
Use history-supplied definitions for normal requests and remote compaction, and omit empty `additional_tools` prefixes. Keep the existing tool delivery behavior for the Responses API and when the feature is disabled.
## Testing
Add unit and snapshot coverage for catalog and namespace transitions, empty catalogs, and stable hashing across JSON object key order. Add a request-history scenario covering unchanged tools, a model switch that changes one definition, persisted catalog hashes, and Responses API behavior.
GitOrigin-RevId: 76bde175973b81f8ad23873919da3c8ddcdf6065
## Why
Changing a deferred tool's output schema could add or remove the shared MCP type preamble from the `exec` description.
## What changed
Include the default or configured MCP TypeScript preamble whenever `code_mode_only` is enabled, regardless of the available tools' output schemas. Preserve an empty preamble override as a way to omit the section.
## Testing
Add a regression test that checks description stability when a deferred tool gains an MCP output schema, covering default, custom, and empty preambles. Update description expectations, request snapshots, and two Guardian context-budget test thresholds for the added preamble.
GitOrigin-RevId: 725035d6159e9da3c4beff5482c426c082e768b4
## Why
When `flush_transcript_tail_on_session_end` is enabled, remaining speech must be available in thread history as soon as realtime closure is reported, even while a model response is still running. Saving that transcript should not trigger another model request.
## What changed
Record the transcript tail directly in model and client history, attaching it to the active turn or creating a completed history turn when idle. Flush persistence before emitting `RealtimeConversationClosed`, and keep realtime context active until recording finishes so the return to text instructions follow the transcript.
## Testing
Extend core and app-server tests to cover immediate history visibility in paginated and legacy modes, idle and active turns, closure without extra inference, transcript reuse in subsequent text turns, and interruption after closure.
GitOrigin-RevId: ae323b711f22aa88db1432e24ad4bb3eb3f08f6b
## What changed
Add a scenario test and snapshot covering the request before remote `/compact`, the compaction request, the persisted replacement history, and the first subsequent user turn.
Capture the replacement history before the next turn can update its context, and assert that the compaction request contains one `compaction_trigger` and the next request includes the returned encrypted checkpoint.
GitOrigin-RevId: e22e12f16bdb11b1296e81a2e0ffd5f70e560ff6
## Why
Bedrock catalogs cleared all service-tier metadata, and requests omitted every selected tier. This prevented users from selecting `ultrafast` or using tiers defined in custom catalogs.
## What changed
- Advertise `ultrafast` for `openai.gpt-6-astra` on Mantle and the `global.openai.gpt-6-astra` and `us.openai.gpt-6-astra` Runtime variants, while retaining the implicit default tier unless users select otherwise.
- Preserve custom catalog speed tiers, service-tier definitions, and defaults while continuing to normalize Bedrock web search compatibility.
- Send selected service tiers only when the Bedrock model advertises them, including `flex`.
## Testing
Add coverage for `model/list` tier discovery, custom catalog preservation, configured and per-turn HTTP request tiers, and TUI slash-command selection, toggling, and model switching.
GitOrigin-RevId: 4793e7af7b9f604a6b7812611030da6adb8acd35
## What changed
Allow Responses-compatible providers to configure live web access and remote compaction under `model_providers.<id>.capabilities`:
```toml
[model_providers.custom.capabilities]
external_web_access = false
remote_compaction = "v2"
```
`external_web_access = false` keeps hosted web search from accessing the live web. `remote_compaction` accepts `v2` to send `compaction_trigger` items through the Responses endpoint, or `unsupported` to use local compaction. Omitted capabilities retain existing provider defaults.
## Testing
Add unit coverage for preserving unspecified defaults and a request-snapshot scenario verifying cached web search and V2 compaction for a custom provider.
GitOrigin-RevId: fbcc4870aa51c112af575d711679a3941d1e7878
## Why
Streamed `response.failed` events can carry retry advice in `response.error.headers`. Ignoring it loses server-provided delays or uses a conflicting delay from a rate-limit message.
## What changed
- Parse nested `Retry-After` headers using the existing HTTP header validation and retry parser, and preserve them for rate-limit, overload, and generic retryable failures.
- Prefer valid headers over rate-limit message advice, falling back to the message when the header is absent or invalid. Keep terminal error classifications unchanged.
- Reject unrepresentable plaintext retry durations without panicking.
## Testing
Add regression coverage for header precedence, validation, and terminal errors, plus retry-loop coverage for SSE sampling, remote compaction, and WebSocket failures.
GitOrigin-RevId: 46433c2e9e6d5e804211ef96950fadd70e322b49
## What changed
- Remove `stdout`, `stderr`, and `formatted_output` from `CommandExecutionItem` and `ExecCommandEndEvent`, retaining `aggregated_output` as the output field.
- Update command event producers, legacy conversion, rollout traces, and the precomputed schema. Use aggregated output for terminal trace results.
- Clear `interaction_input` in emitted and migrated command completion items.
## Testing
Update command execution and trace tests to use aggregated output, and assert that legacy rollout migration preserves `aggregatedOutput`.
GitOrigin-RevId: ed59827d4a5ec9a767084ee4feac72c2042440f2
## What changed
Remove `initial_messages` from `SessionConfiguredEvent` and the corresponding schema. Stop attaching replay history to startup events for resumed or rejoined threads, and remove `InitialHistory::get_event_msgs`.
## Testing
Update the MCP resume test to verify persisted tool events through `load_history`, and retain coverage that resumed requests include prior conversation items.
GitOrigin-RevId: 54b72bc44423c9b1ef2051891ef392c0ede32fe5
## What changed
Add an MCP integration test that forwards sandbox state from tool-call metadata unchanged to `codex sandbox --sandbox-state-json` and runs a real subprocess.
Verify that workspace writes succeed, overwriting an existing file outside the workspace fails and preserves its contents, and relative paths resolve against `sandboxCwd` rather than the MCP server's working directory.
GitOrigin-RevId: 768513c74679010e806a62dffdde6b7cccbfb41f
## What changed
Add `CodexThread::current_turn_model` to return the model slug selected for the named running turn's next step, independently of settings for future turns. Return `None` when the turn ID does not match, the task is cancelled, or the turn is no longer running.
## Testing
Extend the step-settings test to verify that the accessor ignores model changes for future turns, reflects active-turn model updates, and returns `None` for a mismatched ID or a completed turn.
GitOrigin-RevId: 2cae7c07fa761ed4d64befaa3419a2f9bce4b161
felixxia-oai