## Why
An in-flight `ThreadList` request can block the cloud worker from processing subsequent requests even after its caller drops it.
## What changed
Skip queued `ThreadList` requests whose response receiver is closed, and cancel in-flight list handling when the receiver closes. Thread listing has no conversation state to commit, so the worker can safely move on to the next command.
## Testing
Add a regression test that holds a list RPC open, drops the caller's request, and verifies that a subsequent `GetAccount` request completes before the list RPC is released.
GitOrigin-RevId: 7c74e3305d58b85224d9882ea7e24b1ae791ec52
## What changed
- Add the disabled-by-default `safe_image_decoder` feature to decode and re-encode prompt images without source metadata, with byte and decoded-pixel limits.
- Apply JPEG orientation and supported ICC color conversion to sRGB, emitting PNG for PNG/GIF inputs and JPEG for JPEG/WebP inputs.
- Use the selected decoder for image preparation, `view_image` validation, and MCP image validation. Include the decoder in image cache keys.
- Preserve original inline images in history metadata so resume and fork can regenerate prepared images without repeated JPEG encoding changing their bytes.
## Testing
Add regression tests for identical JPEG replay after history serialization and for preventing legacy cache entries from bypassing sanitization.
GitOrigin-RevId: 718cd83d0a233e2eb8efd1a64c14d8944e44c350
## What changed
- Add `SessionModelIdStore` with SQLite and in-memory implementations for looking up and assigning aliases by session, namespace, and external key.
- Commit SQLite assignments before returning them, and recheck under a write transaction so concurrent writers reuse the same alias.
- Support snapshotting and initializing alias maps from generator state and ordered keys, and remove mappings when their thread is deleted.
- Expose alias stores through `ThreadStore` and add distinct types for registered environment IDs and model-facing `env` aliases.
## Testing
Add a test using two SQLite runtime instances to verify that concurrent assignments return the same alias, different keys receive different aliases, and lookups and snapshots preserve the assignments.
GitOrigin-RevId: 2668f605251ca76d4891f70f94bfb4151ba8142c
## Why
Inferring wait targets from request arguments can abort trace replay on malformed arguments and link waits to cells the host never resolved.
## What changed
Record an explicit `CodeCellWaitTargetResolved` event when the host confirms a live cell, and expose its runtime handle as `resolved_wait_runtime_cell_id` on the tool call. Build cell wait links from these observations, preserving links while cell source is pending and preventing late confirmations from linking to recycled handles after thread resume.
Older traces no longer infer wait links from request arguments, so an empty `wait_tool_call_ids` list does not establish that nobody waited on a cell.
## Testing
Extend dispatch and replay tests to cover live, missing, and invalid wait targets, pending cell source, legacy traces, and runtime handle reuse across threads and resume.
GitOrigin-RevId: 0f13b291c197c5487258b6ce36276cf1f19e2b6d
## What changed
Add `NetworkProxy::start_managed` and use it in core and exec-server to share proxy construction, startup, and error context. Keep approval-policy selection in core and pass the active decider and blocked-request observer to the shared helper.
## Testing
Expand session coverage for a full-access to workspace-write profile change: verify decider calls with approvals enabled, approvals disabled, and a final managed allowlist, and verify blocked-request notifications in each case.
GitOrigin-RevId: 97abdaa9af698166f46d74e0f231ec557d346200
## What changed
- Add `marketplaces.<name>.auto_update` to the configuration type and schema, defaulting to `false`.
- Preserve `auto_update` when re-adding a marketplace with the same source type and source, including equivalent normalized local paths. Drop it when the source changes.
- Preserve existing marketplace entries when converting an inline `marketplaces` table for editing.
## Testing
Add regression tests for re-adding the same Git source, replacing it with another source, and re-adding an equivalent local path.
GitOrigin-RevId: 8a4108f1c8fc5a20a8564ead5baeef57e7ccfa19
## What changed
- Make `McpManager::runtime_config` accept `McpServerContributionContext` and honor its originator, selected environments, and disabled plugin IDs.
- Add `McpServerContributionContext::for_host` to carry thread initialization data, originator, and session source without live extension state or discovery.
- Pass explicit global contexts from threadless discovery and control paths.
## Testing
Extend the thread manager test to cover host-only contribution identity, originator headers, and server restrictions for disabled plugins and pending environments.
GitOrigin-RevId: 04ea2c8951187d9014867f0020223b6a7dd94d8d
## What changed
Remove `SandboxDirectSpawnTransformRequest` and `transform_for_direct_spawn` in favor of `SandboxManager::for_file_system_helpers().transform()`. Keep Windows wrapper preparation specific to filesystem helpers, and return `SandboxUnavailable` when a Windows token sandbox is requested for a filesystem helper on a non-Windows executor.
Record the helper permission entry count during launch policy preparation, before adding runtime read grants.
## Testing
Cover Windows helper executable read access and explicit workspace write grants, including empty workspace roots. Verify rejection of non-native policy working directories and Windows token helper sandboxes on Unix. Extend the helper isolation test to exercise sandboxed writes as well as reads.
GitOrigin-RevId: f95bb94e12d8d7c6e5c773644abb7b59b47ffc4a
Initialize `environment_id` to `None` for statusline MCP inventory and resource-read requests, preserving existing server selection. Update request assertions to expect `environmentId: null`.
GitOrigin-RevId: 3ed5dde0de5ab69aa1349da7d829cc5e335db5c7
## What changed
Enable the `gzip` and `zstd` features on `reqwest` in `codex-rs/http-client/Cargo.toml` and update the Cargo and Bazel lockfiles with the compression dependencies.
GitOrigin-RevId: 2904dd2d634fd4aca0d27979aa3bb52a8105b8d1
## What changed
- Read response window metadata through `current_window_from_state` with an explicit session state lock, releasing it before assembling response metadata.
- Name the token budget feature check used when restoring a forked child window.
- Pass an explicit `TestEnv` into the async compaction test helper and build with `build_with_environment`.
GitOrigin-RevId: 7ad852dbd65689e814f62cad645330ac5dac80f4
## What changed
Allow ERS-issued tunnel JWTs with numeric `ver` values of `1` or `2` at startup and during credential renewal. Update the validation error to reflect both supported versions.
## Testing
Add coverage for all v1/v2 startup and renewal combinations, bearer modes accepting both versions, and rejection of unsupported versions, malformed claims, missing or empty signatures, and extra JWT segments.
GitOrigin-RevId: 597089de7cf9511d29095d87f36251eb7319f631
## Why
An unset voice preference should use the call destination's default. Changed or cleared preferences should also take effect on the next V3 call, even when the thread retains an older setting.
## What changed
- Use `gpt-live-1.1-codex` as the default V3 realtime model.
- Preserve an unset voice until request serialization, defaulting V3 API calls to `marin` and ChatGPT calls to `cove`, while honoring explicit voice selections.
- Reload current voice settings when starting a new V3 call through the app server, including cleared preferences.
- Populate the TUI voice picker from the V3 catalog, add `marin` to that catalog, and remove voice-catalog lookups from call startup and preference saving.
## Testing
Add regression coverage for API and ChatGPT voice defaults, explicit overrides, changed and cleared settings, and TUI call requests and voice selection.
GitOrigin-RevId: d0dd4dcd4bcad9ab869d7bf524e7095a88ffcfaa
## Why
MCP servers registered under the same name in different environments need distinct inventory, routing, and status reporting.
## What changed
- Keep MCP inventory and runtime status keyed by registration scope so same-named servers remain separate.
- Add optional `environmentId` selectors for status lookup, tool calls, resource reads, and OAuth login. Omitting the selector preserves existing name-only routing.
- Carry environment identity through startup notifications, elicitation requests, and tool-call history, and display it in the TUI.
- Support `/mcp login <name> --environment <id>` and update generated protocol schemas and SDK types.
## Testing
Add integration coverage for two environments with identically named MCP servers, tools, and resource URIs. Verify separate inventory, explicit environment routing, legacy routing when the selector is omitted, and errors for unknown environments. Update protocol and TUI tests for environment identity.
GitOrigin-RevId: 074a3db10549438cb6aff33eb7bed10791adae4d
## Why
`request_key` can invoke host helpers that make network requests outside the sandbox's network namespace and proxy policy.
## What changed
Deny `request_key` with `EPERM` in the `Restricted` and `ProxyRouted` seccomp modes, leaving `VmSocketRestricted` unchanged.
## Testing
Add a threaded syscall regression test covering all three modes. Install a baseline filter returning `ENOSYS` so the probe cannot invoke host helpers and inherited `EPERM` filters cannot hide regressions.
GitOrigin-RevId: 196de45ea4da3e40d2f2264ff88ed10d3e5bcdda
## What changed
Configure V8's `pip.parse` in `MODULE.bazel` to expand `PIP_INDEX_URL` and pass it as `--index-url`, defaulting to `https://pypi.org/simple` when unset or empty. Keep `--require-hashes` enabled.
GitOrigin-RevId: b049056e98bf525906a727d8932178f0a0528cd2
## What changed
- Use the Bazel coreutils toolchain's `sha256sum` to generate `CODEX_BWRAP_SHA256` for bubblewrap.
- Add the running Python interpreter's directory to `PATH` for Unix native voice builds so GLib generators using `env python3` can find it.
## Testing
Add a regression test verifying that a Unix generator using `env python3` runs with the recipe's interpreter.
GitOrigin-RevId: 52694cc09c92db27bc117217d3833a35524ff304
## Why
Recording inference starts synchronously serializes prompts and writes trace payloads before model work can proceed. Defer that work so inference dispatch can continue while the trace is recorded.
## What changed
- Use one worker per trace bundle to write events in submission order, with up to eight pending jobs.
- Share prepared prompts and encoded requests with the worker, and build remote compaction snapshots there. Write payloads before publishing events that reference them.
- Add `TraceWriter::flush` and `ThreadTraceContext::flush` for live reads. Drain accepted jobs and seal the bundle on shutdown; suppress the closing marker after a recording failure.
## Testing
Add tests for deferred prompt serialization, ordered start and completion events, shutdown draining, and serialization failures that preserve earlier evidence without publishing a closing marker. Verify compaction snapshots are built on the worker and skipped when tracing is disabled.
GitOrigin-RevId: 32fd787bb1d281f1814df2f08c73b667628f8add
## What changed
- Introduce `Request`, `Backend`, `Handle`, and `ToolResponse` traits so backends can choose input types, response schemas, output rendering, and tool exposure.
- Consolidate tool names, request types, catalog keys, and parallel-call settings in one registration macro, with HTTP routes derived from request metadata.
- Move trusted session and agent context into `HttpBackend`, preserving opaque JSON arguments and catalog overrides for the HTTP proxy.
## Testing
Extend the extension integration test to verify that an unknown `future_catalog_parameter` is forwarded to the HTTP endpoint alongside trusted context. Adapt the bundled tool contract snapshot test to use the new registration path.
GitOrigin-RevId: 4ebfb9f6aa9395f9a27bd7fbe6cf131c0a06d8d7
## What changed
Add a statusline provider discovery stream that publishes the first inventory or named lookup result for each MCP server. Give global inventory a two-second head start, then probe known servers with at most four concurrent lookups while continuing to discover servers from inventory pages. Completed inventory triggers probes for missing known servers immediately.
Bound each refresh and each selected-provider lookup to five seconds, with independent deadlines. Report server and inventory failures separately, and cancel outstanding discovery waits when the stream is dropped.
## Testing
Add tests with controlled app-server replies and paused time covering inventory/probe races, concurrency limits, timeouts, cancellation and reopening, missing servers, and repeated pagination cursors.
GitOrigin-RevId: e2e1af9789bb67236afdbc76ec2d8ee1648d6ac4
## What changed
- Parse statusline entrypoints from MCP tool metadata, requiring exactly one valid `ui://` resource URI per tool.
- Resolve saved or discovered providers against the displayed thread's tool catalog, checking global advertisement, plugin ownership, and connection status. Reject providers whose effective server, plugin, or marketplace registration includes project configuration.
- Read the resolved resource on the displayed thread, forwarding the statusline snapshot in `com.openai/codex-statusline-state` metadata.
## Testing
Add tests for malformed and ambiguous entrypoints, thread-specific resource reads, configuration precedence, project overrides, ownership mismatches, and unavailable providers.
GitOrigin-RevId: 5a43212177704f546e5d53be53f8979fe3bb8d8a
## What changed
Add a TUI module for reading MCP server identities and tool catalogs from the connected app server's global inventory. Support paginated discovery and targeted server lookup through `mcpServerStatus/list`.
Retain plugin identities and tool errors, filter entries to those with an explicit null `httpOrigin`, and reject repeated pagination cursors or mismatched targeted responses. This adds inventory infrastructure without enabling provider discovery yet.
## Testing
Add tests for global inventory independence from startup project overrides, preservation of tool catalogs and errors across pages, transport filtering, and rejection of a targeted response naming another server.
GitOrigin-RevId: f429991deed38eb106641b1780f24c701626b4e1
## Why
MXC launch errors omit the native Windows error code, while the SDK diagnostics can contain command, environment, and working-directory data.
## What changed
Extract the numeric error code from recognized `CreateProcessW` failures and append it to the launch error without exposing the remaining SDK diagnostics. Preserve the existing error message when no code can be extracted.
## Testing
Add unit tests for extracting the code without trailing diagnostics and rejecting nonnumeric codes and errors from other APIs.
GitOrigin-RevId: ddfa6635ab4fe9293ab4d31f9fcd7cfe563d4928
## What changed
Augment managed runtime package registration failures with `appx_event_ids` from error-level events in `Microsoft-Windows-AppXDeploymentServer/Operational` that match the deployment activity ID. Report numeric event IDs in sorted, deduplicated order without including free-form event text.
Skip the lookup when the activity ID is unavailable or zero, and leave the registration result unchanged when event diagnostics are unavailable.
GitOrigin-RevId: 50167f3ffed1d07936594ef4b04f5adf2972be8e
## What changed
- Replace individual JSON payload files with numbered Zstandard shards in trace schema v3. Add `PayloadReader` to resolve payload references, cache decoded shards, and validate payloads during replay.
- Capture exact outgoing HTTP bodies and WebSocket messages alongside prepared prompts. Preserve full formatted context for continuations from unrecorded WebSocket warmups while retaining the actual incremental request.
- Flush payload records before publishing references and seal the final shard before recording completion. Replace `recording_complete` with `recording_status` to distinguish unclosed recordings, closed recordings with partial payloads, and complete recordings.
Reduce trace bundles with the binary that recorded them.
## Testing
Add coverage for shard rotation, oversized records, live reads, cache eviction, and malformed or corrupt payloads. Extend HTTP and WebSocket integration assertions to verify captured requests and prepared prompts, including warmup continuations.
GitOrigin-RevId: 40ce3c11383f48e08f52e7120b706c61a449df9c
## Why
The npm wrapper's spawn fallback stopped forwarding signals after the first one, preventing a second signal from interrupting a child's graceful shutdown.
## What changed
Remove the `child.killed` guard so the wrapper continues forwarding `SIGINT`, `SIGTERM`, and `SIGHUP` until the child exits.
## Testing
Add a regression test that forces the spawn fallback and verifies a running child receives a second `SIGTERM` and its numeric exit status is preserved.
GitOrigin-RevId: be96e784e2e4f419c43a5897d264f55fcdfd625f
## Why
Concurrent Apps startups with equivalent discovery inputs each issue a `tools/list` request even though they share a live tool catalog.
## What changed
Share successful tool listings across overlapping startups in the same discovery scope while keeping each client's MCP connection independent. Later startups and explicit refreshes still fetch from the server.
Include time spent waiting for a shared listing in the configured startup timeout. If a listing fails or is cancelled, let a waiting startup retry using its own connection. Preserve separate catalogs for different scopes and honor servers that opt out of catalog sharing.
## Testing
Add tests for shared startup listings with independent connections, waiting timeouts, cancellation recovery, and catalog isolation across discovery scopes.
GitOrigin-RevId: cb626f6cb9c38e27b3d75a8da55bda584aaef6f4
## What changed
Track whether a thread is being viewed without a live attachment. Hide the status line and context usage for saved history and unavailable conversations, even when token usage updates arrive. Restore these displays when the thread resumes interactively, including sessions using read-only permissions.
Avoid a leading separator before the Vim mode indicator when context usage is hidden.
## Testing
Add regression coverage for history viewing, token updates, and interactive resume. Update unavailable-conversation snapshots to omit the status line.
GitOrigin-RevId: 14dfd2ee0f232001814b7fc45a5ac8a5d755669b
## Why
Saved side chats with `attached_to_thread_id` set could appear as root sessions in the agents overview.
## What changed
Exclude attached threads alongside ephemeral threads when building the overview. Reuse the same root eligibility check for history discovery, pinned threads, and refill accounting so attached threads do not count as overview roots.
## Testing
Extend `shared_overview_shows_only_root_sessions` with a saved side chat attached to a root thread, verifying that it stays out of the overview snapshot.
GitOrigin-RevId: 3417d444cfde7fc034c07ec124ba72cbf64b0ef6
## Why
Resuming another session must keep drafts, queued follow-ups, and interrupted steer retries with their original thread. Submitted input whose delivery is still uncertain must wait for matching receipts before the queue can advance.
## What changed
- Pause submissions while draining outgoing events, then capture input before switching threads or backends.
- Restore saved input through a shared resume path, reconcile receipts from resumed history and buffered events, preserve active-turn state, and dispatch eligible queued input when the resumed thread is idle.
- Preserve whether a draft's leading `!` is literal text or a shell command.
- Reject `!` shell commands in Cloud conversations with an error and clear the pending submission so the next prompt can proceed.
## Testing
Add regression coverage for session round trips with buffered completion and interruption events, receipt reconciliation across read-only and writable resumes, draft shell mode, and submitting a prompt after a rejected Cloud shell command.
GitOrigin-RevId: 9a823a398a371e689b8ae743de494323ae95ef57
## What changed
Capture `codex_app_used_dictation` as per-input metadata, with patches taking precedence over replacements, and remove the key from metadata forwarded to Responses. Record attribution when user-origin input is accepted into turn history.
Add `used_dictation` to turn analytics: report `true` if any accepted input used dictation, `false` only when every accepted input has known non-dictation attribution, and omit the field otherwise.
## Testing
Add coverage for per-input extraction, patch precedence, and turn-level aggregation. Extend the app-server steering test to verify that dictation attribution reaches analytics while the metadata key is excluded from Responses requests.
GitOrigin-RevId: 0a55687a7dd61f00e9b188f89810e52bd941490b
## What changed
- Add the disabled-by-default `catalog_apps_instructions` feature to use the selected model's `model_messages.apps.usage_instructions`, subject to existing Apps availability and model gates.
- Preserve valid catalog text literally, allow an empty string to clear guidance, and fall back to bundled instructions for missing, whitespace-only, or oversized values. Overrides are limited to 800 UTF-8 bytes.
- Reconcile guidance with the latest retained Apps fragment, emitting replacement or removal notices when needed and avoiding repeated updates across resumes. Preserve compatibility with bundled guidance and legacy checkpoints.
- Recognize catalog Apps fragments as contextual developer messages in event mapping and rollout rollback.
## Testing
Add resolver, world-state, client, and scenario coverage for literal text and byte limits, feature and availability gates, model switches, clearing guidance, resumes, and legacy history recovery.
GitOrigin-RevId: 6240d407ada8f22fa101753ff3ddb338632ae283
## What changed
- Add a TUI helper that saves `tui.status_line_provider` to the active local user configuration, supporting `"default"` and MCP server/tool selections.
- Update the app and chat widget selections only after the write succeeds.
- Return an error when `ConfigEdit::SetPath` cannot insert a value at the requested path.
## Testing
Add tests covering active local profile writes during remote sessions, preservation of unrelated settings and configuration files, CLI override reloading, and failed writes that leave the file and live selection unchanged.
GitOrigin-RevId: 08008f58d7a467bb0c9129b7c198b4d224262ff1
## What changed
Add `tui.status_line_provider` to select `"default"` or an MCP provider identified by `server` and `tool`. Replace provider identities as a unit across configuration layers so partial overrides cannot inherit half an identity.
Ignore this setting from project configuration and packaged defaults when computing effective values and origins, while retaining strict validation. Preserve relative path resolution when an ignored provider value is malformed.
Carry the selection into TUI local settings and refresh it on configuration reload. Use the client's configuration home when rebuilding settings for remote sessions.
## Testing
Add coverage for provider precedence, incomplete profile overrides, malformed values and diagnostics, relative path resolution, and local preference preservation when resuming remote sessions.
GitOrigin-RevId: 0777d754d46cf009569ff0c90fd7426f8b7650bf
## What changed
Set `retain: true` on tool outputs submitted when TUI dynamic tools start a turn, requesting retention of delegation prompts in the thread's model history.
## Testing
Update session lifecycle assertions to require `retain: true` for both `create_thread` and `send_message_to_thread` requests.
GitOrigin-RevId: 095d0f6f687a67fbf0b5ffd98539f764d32e2acc
## What changed
Allow Unix workloads to acquire assertions directly from the SPIFFE Workload API for the existing OpenAI token exchange. Select this source with `OPENAI_IDENTITY_TOKEN_SOURCE=spiffe`, alongside `OPENAI_FEDERATION_RULE_ID`, `SPIFFE_ENDPOINT_SOCKET`, and `OPENAI_SPIFFE_AUDIENCE`. Optionally select an identity with `OPENAI_SPIFFE_ID`.
Fetch a JWT-SVID over a Unix socket for each exchange, reconnecting on refresh and bounding acquisition to ten seconds. Reject ambiguous responses and mismatched subject or audience claims, and retain only the gRPC status code from agent errors. Signature and lifetime verification remain the token endpoint's responsibility.
Keep file acquisition as the default, reject conflicting source settings, and exclude the new OpenAI-specific settings from model-launched environments. Document configuration and deployment constraints.
## Testing
Add local-socket tests for token exchange and refresh after agent restart, concurrent refreshes, JWT-SVIDs without key IDs, identity selection, error redaction, and timeouts. Add configuration tests for explicit source selection, invalid or conflicting settings, unsupported platforms, and session consistency.
GitOrigin-RevId: 9d88438ff41cd8f0b7356c512ec451455ed7c399
## Why
The x32 ABI shares the x86-64 audit architecture, so the architecture check alone does not enforce syscall restrictions for x32 callers.
## What changed
Apply existing syscall denials and socket-family conditions to x32 syscall numbers on x86-64, including separate x32 numbers and legacy aliases supported before Linux 5.4.
## Testing
Add probes across all three network seccomp modes to verify that restricted native and x32 calls return `EPERM`, allowed calls preserve their behavior, and socket-family restrictions apply to both ABIs.
GitOrigin-RevId: fa38138d6b6c7b26dfafd6c931880ee1265a1b94
## What changed
- Update the workspace, Bazel toolchain and lockfile, CI and release workflows, and Windows setup script from Rust `1.95.0` to `1.99.1`.
- Adapt Rust code to the updated toolchain and Clippy lints, including `try_update` for atomics, `as_chunks` for fixed-size slices, and targeted allowances for generated tonic services.
- Refresh the halfwidth sound mark rendering snapshot to use literal characters in debug output.
GitOrigin-RevId: 5852029f687436dc814c2bca68141ee1f4a67d49
## What changed
- Store `CodexErr` in a `Box` within `ImageBackendError` while preserving its accessor.
- Terminate `bail!` calls with semicolons in the cloud client and TUI.
- Share a body-prefix length constant across OTLP loopback assertions and remove redundant borrows of diagnostic strings.
GitOrigin-RevId: 40aee7d4d03b17fc8dbd9295e0853c811852c177
## What changed
- Replace `FooterContent` and the separate layout cache with a `StatusLine` that owns native or extension content and caches its layout by bounds.
- Move footer padding into the caller's layout and retain cached wrapping for unchanged agent-labeled status lines.
- Remove extension-to-single-line conversion and render prepared UI trees directly within their allotted rectangles.
## Testing
Extend composer coverage to verify that replacing measured extension content updates the displayed rows. Adapt status-line and UI-tree tests to exercise direct rendering, clipping, hyperlinks, and viewport bounds.
GitOrigin-RevId: 72273c87d689b8b59748ab243793a9e2a45f4884
## Why
Raw trace events and payloads are implementation details of the recording executable. Matching release or schema versions do not establish compatibility with another binary.
## What changed
- Document that bundles must be reduced by the exact executable that recorded them, with `state.json` as the consumer API and `manifest.json` for discovery and identity.
- Require explicit thread IDs on code-cell runtime events and use structured agent-message metadata instead of parsing legacy assistant-message JSON.
- Include expected schema versions and guidance to use the recording executable in schema mismatch errors.
- Update agent-delivery test fixtures to use structured `agent_message` inputs and check manifest schema rejection directly.
GitOrigin-RevId: 67206fa554f1ba9c1bf9bfdad54840b5d86c5a77
## Why
Suspending a locally controlled agent tree must preserve unfinished turns and child results that arrive during teardown so they remain available after recovery.
## What changed
- Add `ThreadManager::suspend_agent_tree` to stop durable trees, close their writers, and return unfinished root and named V2 child turn IDs plus any pending root wake.
- Persist terminal child results before suspension succeeds, including results queued for evicted parents. Report failed or unconfirmed writes.
- Add `load_suspended_agent` to restore named V2 descendants through their recorded ancestors without starting model turns.
- Allow empty `continue_turn_if_idle` input to wake on saved results, guarded by the preceding turn ID. Keep mail queued until task registration so suspension can preserve it.
## Testing
Add coverage for completion and wake races, child errors, parent writer failures, evicted parents, descendant restoration, repeated suspension after caller cancellation, and ephemeral roots remaining active.
GitOrigin-RevId: 3041791f51bff2555210f6b2d2443f9f05f68330
Describe remote board connection settings, host ownership, and configured
clocks in general terms. Update the remote board test credential to match
that terminology.
GitOrigin-RevId: c2c32808c98afad849f6e4f59f75d8d204f51694
## Why
Inline image previews can leave stale pixels in terminal history when streamed output scrolls their rows.
## What changed
Clear retained previews before inserting history that could move them, then let the next frame redraw them while preserving the draft text. Keep direct Kitty previews when standard history insertion scrolls only above an unchanged, bottom-aligned viewport.
## Testing
Add regression coverage for clearing previews before scrolling, preserving unsent draft text, redrawing file-backed previews, and retaining or repainting direct Kitty previews as appropriate.
GitOrigin-RevId: 683d1313349b1ac707499b021092fc390e21530d
## What changed
Stop rebuilding permission profiles through the legacy sandbox policy when only the working directory changes. Preserve the profile, its active selection, and profile workspace roots while updating runtime workspace roots for the new directory.
## Testing
Extend regression coverage to check that directory-only updates preserve the permission profile snapshot and expected thread settings. Verify that workspace-write permissions allow ordinary files in the new workspace while denying writes to `.git/config` and the previous workspace.
GitOrigin-RevId: a4f4b2dc4ffa16cbf33ddb124eed4b759b2aae78
## What changed
Remove `PermissionProfile::from_legacy_sandbox_policy` and the filesystem helpers for materializing workspace roots and adding legacy writable roots. Keep legacy template conversion self-contained and update round-trip tests to use the conversion that accepts a working directory.
## Testing
Update preset tests to compare converted legacy policies, and move extra-root metadata protection coverage to `FileSystemSandboxPolicy::workspace_write`.
GitOrigin-RevId: d545b329c13b2f09609fd2cbf42f0adbbda5386a
## What changed
- Authenticate eligible protected `main` runs and Rust release tags with GitHub OIDC. Allow cache uploads only on `main` pushes; use read-only access for manual runs and release tags, and leave pull requests without GCS credentials.
- Rename the shared wrapper to `.github/scripts/run_bazel.py` and route Bazel callers through it. Disable the disk cache in GitHub Actions and default macOS GCS connections to 20 while respecting explicit limits.
- Gate additional Bazel release artifacts on `CODEX_BAZEL_RELEASES` and cache configuration, sharing the selected build systems across building, signing, and packaging. Keep Cargo as the default and prepare native Windows dependencies for Bazel releases.
- Add a `Bazel result` check for the full workflow and extend Bazel job timeouts.
## Testing
Add wrapper tests for cache access by event, argument preservation, and macOS connection limits. The wrapper test suite passes.
GitOrigin-RevId: d85edbd083acfaa8bafaa8fd5241daed3e9ef871
## Why
Plan items used a single ID derived from the turn ID, so multiple completed plans within one turn shared an ID across retries or tool continuations.
## What changed
Generate UUIDv7 plan item IDs and carry an unfinished plan's ID across model requests within a turn. Once a plan completes, assign a fresh ID to the next plan.
## Testing
Add unit and integration coverage for unfinished retries, retries after plan completion, and tool continuations, including matching streamed events to saved completions. Update the app-server test to check plan IDs against the start notification.
GitOrigin-RevId: 87b4b3e6bd74224ea96f4308f739bcd2efb62299
## What changed
Preserve original root conversation evidence, retained instructions, assistant context, and verified answers until request preparation. Apply shared section preparation to both synchronous and asynchronous reviews, preserving fixed limits and omission notices while allowing elastic preparation to use the originals. Cache the fixed root view for reuse.
Split classifier setup from final input assembly and normalize new images before deduplication and token accounting, preserving committed history.
## Testing
Extend tests for fixed and elastic preparation across both review profiles, original root evidence after handoff, and image normalization during retained-request preparation.
GitOrigin-RevId: 86c83384c1f5be3707622d675fc54b4c8e1ddc0a
Benjamin Carlsson