## Why
Messages with the `partial_answer` phase contain answer text without declaring a terminal answer. They should remain searchable and speakable without being treated as final messages.
## What changed
- Preserve explicit `partial_answer` phases in streamed and completed realtime handoffs, bypassing legacy channel-prefix parsing and routing them to the `speakable` channel.
- Treat partial answers as nonterminal in V1 handoffs and omit the final-message prefix.
- Include partial answers in thread occurrence searches and normalize them to the final conversation channel in rollout traces.
## Testing
Extend coverage for realtime phase routing, streamed and completed handoffs, partial-answer search results, and rollout normalization. Verify that turn summaries still exclude nonterminal messages.
GitOrigin-RevId: aa183da783f6e7e0b78ddd51073cba533297e121
## Why
Fast mode previously gated both Fast and Ultra Fast, preventing policies from allowing one while disabling the other.
## What changed
- Add the default-enabled `features.ultrafast_mode` flag and enforce it independently of `features.fast_mode` in service-tier selection, requests, and agent prewarming.
- Filter TUI service-tier commands and selections by the corresponding policy and model catalog support.
- Report `supportsIndependentSpeedModes: true` from `configRequirements/read` and update the protocol schemas and generated bindings. Retain the shared Fast gate when connecting to older servers that omit this capability.
- Preserve legacy cloud speed denials by translating `rbac-fast-mode` fragments with `fast_mode = false` into a denial of both modes, while retaining higher-priority enterprise overrides.
## Testing
Add coverage for all four Fast/Ultra Fast policy combinations in requirements responses and request routing, agent prewarm inheritance, TUI command visibility and saved selections, and legacy cloud denial normalization and override precedence.
GitOrigin-RevId: 147e08524c4b228ea9d46b25a9f8aa64c359e169
## Why
Assistant answer text may be followed by more output or tools. A distinct `partial_answer` phase lets callers represent this separately from commentary and a terminal `final_answer`.
## What changed
- Add `MessagePhase::PartialAnswer` and expose `partial_answer` in the app-server schemas and generated TypeScript and Python types.
- Keep the TUI working indicator visible after partial answers and exclude them from the thread history's final-answer summary field.
- Route partial answers to the speakable channel in realtime V3 BEM-tag mode.
## Testing
Add coverage for phase preservation through serialization, input-message conversion, and SSE item start/completion events. Extend TUI snapshot coverage to verify that partial answers keep the working indicator visible while final answers hide it.
GitOrigin-RevId: 1ae3ad9264b6e36ae1cbe6b93df3d345ab4460e6
## What changed
- Carry opaque `review_target` values through misalignment errors and expose optional `reviewTarget` in the app-server protocol and generated clients. Preserve the value verbatim and redact it from debug output.
- Keep target-based `misalignment_override` metadata on turn requests, preserve it across steering updates, and exclude it from compaction and external MCP metadata. Reject overrides from global Responses metadata while retaining legacy timestamp behavior for per-turn overrides.
## Testing
Extend coverage for error propagation, debug and rollout redaction, steering preservation, and metadata filtering. Verify that automatic compaction omits the review target while turn requests before and after compaction retain it.
GitOrigin-RevId: 8c1abb076a206ff5927a4acc31bd25e3efc2bff9
## What changed
Support `browser_use.extension.request_headers` as a list of `name`/`value` pairs and expose it through `config/requirements/read` as `browserUse.extension.requestHeaders`. Update the generated JSON schemas, TypeScript types, and Python models.
Preserve header values, including template strings, verbatim. Higher-priority requirement layers replace the entire header list, including with an explicit empty list. Redact header values in Rust debug output while retaining them in API serialization.
## Testing
Add coverage for parsing and malformed entries, extension scoping, empty-list overrides, API mapping and read responses, and debug redaction without changing serialized values.
GitOrigin-RevId: 02299e82a91aa863966d0277091bc5e8cc1ebe07
## What changed
- Accept per-environment `skills.required` lists through `environment/add` and `environments.toml`.
- Before inference, require each named skill to be enabled and supplied by the selected environment. Missing skills fail the turn before a model request, including when environment setup fails.
- Stop applying an environment's requirements after it is deselected. Exempt isolated Guardian reviewers, which have no skill catalog.
## Testing
Add tests for available, missing, disabled, and wrong-environment skills, failed environment setup, recovery after deselection, and propagation of TOML requirements to the correct environment.
GitOrigin-RevId: 302ced4774697d2f414f745fe0535e71f747eda2
## What changed
- Remove `namespace_tools` from `ProviderCapabilities` and `namespaceTools` from `ModelProviderCapabilitiesReadResponse`, updating generated schemas and SDK types.
- Preserve tool namespaces and configured collaboration tool namespaces without a provider capability check, and always use Responses Lite tool serialization for Responses Lite requests.
- Gate tool search on `supports_search_tool` and retain the existing image generation and web search checks without requiring a namespace capability.
GitOrigin-RevId: ae1843563736765a40e03a02c41ff5e470018a93
## Why
`additional_tools` response items were excluded from rollout persistence, dropping their tool definitions from saved history.
## What changed
- Persist `additional_tools` items in both legacy and paginated history modes.
- Expose the variant in generated JSON schemas, TypeScript types, and Python models, with an optional `id`, a `role`, and arbitrary JSON tool definitions.
## Testing
Add a recorder round-trip test that verifies tool definitions survive recording and loading in both history modes without parse errors.
GitOrigin-RevId: 0e7c7b1c10401ec6513fb744de642a1cf9e461d7
## What changed
- Remove `stdout`, `stderr`, and `formatted_output` from `CommandExecutionItem` and `ExecCommandEndEvent`, retaining `aggregated_output` as the output field.
- Update command event producers, legacy conversion, rollout traces, and the precomputed schema. Use aggregated output for terminal trace results.
- Clear `interaction_input` in emitted and migrated command completion items.
## Testing
Update command execution and trace tests to use aggregated output, and assert that legacy rollout migration preserves `aggregatedOutput`.
GitOrigin-RevId: ed59827d4a5ec9a767084ee4feac72c2042440f2
## What changed
Remove `initial_messages` from `SessionConfiguredEvent` and the corresponding schema. Stop attaching replay history to startup events for resumed or rejoined threads, and remove `InitialHistory::get_event_msgs`.
## Testing
Update the MCP resume test to verify persisted tool events through `load_history`, and retain coverage that resumed requests include prior conversation items.
GitOrigin-RevId: 54b72bc44423c9b1ef2051891ef392c0ede32fe5
## Why
`thread/attachment/list` lists attachments for a known thread. Clients also need to find the threads associated with a given attachment identity.
## What changed
Add `thread/attachmentOwner/list` to return owning thread IDs and archive status for an exact `attachmentType` and `identityKey`. Support cursor pagination and an optional `archived` filter, including both archived and non-archived threads by default.
Wire the request through the thread store and update documentation, protocol schemas, and generated TypeScript and Python types. The lookup is limited to the configured thread store and reports current membership, not an atomic resource-cleanup check.
## Testing
Extend app-server integration tests to cover exact type-and-key matching, multiple owners, archive filtering, and invalid cursor rejection.
GitOrigin-RevId: 30f4a20e00243d0023246d465a9b95213b3adeb6
## What changed
Add the experimental `account/bedrock/checkGovCloudRequirements` RPC so clients can check the active Bedrock configuration after login or setup. It returns `isGovCloud` and `shouldWarn`, warning for GovCloud when managed requirements lack API-only login or enabled application network restrictions with an explicit allow entry for the active endpoint domain.
Reload configuration and requirements on each check while preserving the current session's authentication. Official Bedrock endpoint hostnames determine the region; otherwise, resolve it using the current authentication state. Non-Bedrock providers and commercial regions return both fields as `false`; configuration and region resolution failures return RPC errors. The check is advisory and does not block login or certify the entire network configuration.
## Testing
Add integration coverage for configuration and requirements updates without a restart, login changes, unreadable saved credentials, Mantle and Runtime endpoints, custom proxies, official endpoint region precedence, and invalid requirements.
GitOrigin-RevId: 24bfa91326cf5c73ada176c47351445de91b60a0
## Why
New error variants should not prevent older clients from handling app-server errors.
## What changed
- Deserialize unknown `CodexErrorInfo` strings and objects as `Other` in Rust, while preserving known variants and the `"other"` serialization.
- Allow arbitrary strings and objects in the exported JSON schemas and TypeScript type.
- Update Python SDK generation and generated models to accept unknown error strings and object payloads.
## Testing
Add Rust tests for `"other"` round trips, unknown string and object fallbacks, known structured variants, and rejection of null, boolean, numeric, and array values.
GitOrigin-RevId: 40c17896019924b2ef7970ee2205ea0154d0d1b3
## Why
Guardian review continuations can repeat retained-instruction omission notices even when availability has not changed. When retained context becomes complete, earlier notices also need to be superseded explicitly.
## What changed
Track delivered user-instruction and assistant-context omission states in host metadata scoped to the retained-instructions section. Suppress redundant notice-only sections when the state is unchanged, and emit an availability-change notice when an earlier omission clears, including when no retained originals remain.
Treat missing delivery metadata as unknown. Matching notice text in coalesced tool output cannot establish host delivery, and incomplete history entries discard omission delivery proof.
## Testing
Add coverage for repeated notices, independent histories, availability recovery, and matching notice text in multimodal REPL output. Extend app-server review-continuation tests to assert that each effective classifier context contains the retained user-instruction omission notice exactly once.
GitOrigin-RevId: c6d52dd1dafb284af34b46174aecc7c8cc9b8404
## Why
Retained Guardian classifier conversations already contain previously delivered synchronous reviews. Appending those reviews again repeats evidence and consumes input budget.
## What changed
Track each review completion with a stable identity in host-only history metadata. Filter already delivered reviews before composing and budgeting continuation input, while preserving distinct completions even when their text is identical.
Fresh conversations receive the review evidence again, and shortened messages no longer count as complete delivery. Delivery metadata stays out of model requests.
## Testing
Add coverage for delivering retained reviews once, appending newly completed reviews, restoring evidence after failed streams, and retaining reviews when history lacks complete delivery metadata.
GitOrigin-RevId: b8d58ffdd7d9c484676af707c65fa50020aae73c
## Why
User goal edits and clears need to reach the model as user instructions, including when a thread is unloaded or history is being compacted. Automatic goal lifecycle updates must not supply user authorization.
## What changed
- Add optional `origin` values of `user` and `automatic` to `thread/goal/set` and `thread/goal/clear`, and mark TUI goal requests as user actions. Omitted origins do not supply user authorization.
- Persist explicit user objective, status, and clear instructions before changing goal state. Recording failures leave goal state unchanged.
- Coordinate goal edits with thread resume, reload stored history under writer ownership, and preserve edits accepted after the compaction input snapshot.
- Update generated protocol schemas and TypeScript and Python bindings.
## Testing
Add coverage for user edits and clears on loaded and unloaded threads, concurrent path-based resume, exclusion of automatic goals from user instructions, preservation of edits during compaction, and recording failures that leave goal state unchanged.
GitOrigin-RevId: d779d7c678a0c32a6ef76975dbe5b1400d1df245
## What changed
Define `thread/prediction/request` with `threadId` and `sourceTurnId`, and `thread/prediction/updated` with a `completed` result containing optional text or a `failed` result.
Update generated JSON schemas, TypeScript types, and Python notification models. Route prediction notifications to their thread in the TUI and ignore them in the chat widget.
The request remains unimplemented and returns a method-not-found error.
GitOrigin-RevId: 09922f583d5c56f808d018121c651dcd92734515
## What changed
Forward explicit `cyberAccessProgram` selections for the built-in OpenAI provider when both `api_key_cyber_access_programs` and `api_key_model_discovery` are enabled. The new feature defaults to disabled and can be toggled through the app server's experimental feature enablement API.
Reject explicit selections in OpenAI API-key sessions when either feature is disabled, instead of silently omitting the program. Leave entitlement and model restrictions to the server, and preserve the requested program when a server rejection triggers transport retries.
## Testing
Add app-server coverage for both feature gates, forwarding all three program values, and server rejection without fallback. Update core coverage for API-key resumes with disabled features and custom-provider omission.
GitOrigin-RevId: aa639afb841aa651b28f6f3f61198299372baa2d
## Why
The app server previously rejected OAuth login for enterprise-managed MCP servers. These servers need an explicit sign-in flow that ties saved authorization to the active Codex user and workspace and prevents canceled or superseded attempts from saving credentials.
## What changed
- Enable enterprise sign-in through `mcpServer/oauth/login` for configured servers with a connected thread, trusted IdP registration, and `features.use_xaa` enabled. Scope shared enterprise credentials by user, workspace, issuer, and client ID.
- Add `loginId` to MCP OAuth login responses and completion notifications, preserving compatibility with older servers that omit it.
- Support enterprise login replacement and `account/login/cancel`, wait for callback listener shutdown before replacement, and recheck account and configuration before saving grants. Fence stale attempts across processes and account changes.
- Remove shared enterprise authorization during account logout and `codex mcp logout`, including when the feature is disabled. Continue account logout if enterprise cleanup fails, and invalidate MCP runtimes on account changes.
Start a fresh session after successful enterprise sign-in to use the saved grant.
## Testing
Add regression coverage for login replacement and cancellation, callback port reuse, account changes during setup, cross-process logout invalidation, persisted workspace policy selection, cleanup failures, and responses from older servers without `loginId`.
GitOrigin-RevId: 7ed4caaab4659ed1e67064262cf5cee48e3a26ac
## Why
Guardian denial-limit interruptions lack a structured error identifying the cause. Make this opt-in because older clients may not recognize the new error in shared history.
## What changed
- Add `auto_review.circuit_break_action = "strict"` to attach `TooManyDenials` to the interrupted turn. The default leaves the error unset.
- Expose `turn.error.codexErrorInfo = "tooManyDenials"` in app-server notifications and saved history, and update protocol schemas and generated types.
- Preserve the warning, denial limit, and interrupted status without emitting a separate error notification.
## Testing
Add an integration test covering omitted, `default`, and `strict` settings, checking warnings, live turn errors, the absence of separate error notifications, and persisted turn errors after restart.
GitOrigin-RevId: cb5d379e64728d4d7b9daf834c13756e4a70db31
## Why
Inspecting one MCP server should not require full-inventory discovery or a separate connection when a thread already has one.
## What changed
- Add optional `serverName` to `mcpServerStatus/list` and update generated schemas and bindings.
- With `threadId`, apply any pending runtime refresh and reuse the thread's current connection and tool catalog, waiting only for the selected server during discovery.
- Without `threadId`, create a discovery connection for only the selected server. Unknown names return an empty page; omitting `serverName` preserves full-inventory discovery.
## Testing
Add a regression test covering both status detail modes, checking that tool metadata is preserved and that status reads do not repeat `initialize` or `tools/list` requests.
GitOrigin-RevId: 1b361b67a993ab45cae493e88c146f50cfaf753a
## Why
Guardian reviews need to retain original evidence across parent compaction when checkpoint reuse is disabled, including after resume and rollback.
## What changed
- Make disabling `guardian_reuse_parent_compaction` select a bounded, independent review transcript while preserving thread-owned authorization.
- Keep synchronous reviews and asynchronous scoring independent of parent checkpoints, and allow reviewer sessions to continue using transcript deltas across parent compaction.
- Persist transcript entries with rollback provenance while remaining compatible with older checkpoint readers and metadata-free checkpoints.
- Exclude compaction output from the transcript and synthetic summaries from rollback turn boundaries. Use acceptance ordering to remove rolled-back evidence even when persistence order differs.
## Testing
Add regression coverage for reviewer continuity, evidence retention across compaction and resume, rollback after local and remote compaction, and checkpoint serialization compatibility.
GitOrigin-RevId: fea0852cc5537372854f4a34bacb6bfda6d13e88
## Why
Guardian needs the assistant's delivered question to interpret a user's reply. Messages sent through nested Code Mode tools must remain available as review context, and approvals based on earlier context must become stale when a new delivery is confirmed. Assistant messages do not themselves grant authorization.
## What changed
- Capture successful hosted User Messaging sends after input rewriting and before result callbacks or post-tool hooks.
- Retain bounded delivery text in acceptance order, persist it through cancellation and shutdown, and preserve it across compaction and resume with an older-client-compatible rollout encoding.
- Track assistant review context separately from user authorization, invalidating pending and cached approvals for both local and worker reviews when that context changes.
- Associate retained deliveries with the correct instruction or communication boundary during rollback.
## Testing
Add coverage for nested messaging review context, fast replies and communication ordering, shutdown persistence, stale local and worker approvals, rollout compatibility, and rollback retention.
GitOrigin-RevId: 1bc1ec9e8947560b99f4b39a42ddb9f2099f519b
## Why
Compaction using the previous model can inherit the current turn's access program, producing a model/program pair that the server rejects.
## What changed
- Persist `cyber_access_program` in previous-turn settings and restore it during rollout reconstruction.
- Use the previous turn's access program when compacting with its model, preserving an absent program instead of inheriting the current selection.
- Pass the selected access program into local compaction prompts.
## Testing
Add regression coverage for local and remote compaction after model switches, including resume, fork, rollback, and compaction checkpoints. Verify fallback and subsequent sampling use the current model/program pair, and API-key sessions do not inherit access-program authorization.
GitOrigin-RevId: eaa7162e8711446dc9eb1bfff194e711abd54d7e
## What changed
Allow `cursor` to accept an item anchor such as `{"type":"item","itemId":"item-123"}` with a non-empty `turnId`. Ascending pagination returns items after the anchor; descending pagination returns items before it. The anchor itself is excluded, and subsequent pages use the returned opaque string cursor.
Resolve anchors within the requested turn's visible history, including inherited fork history. Reject missing turn IDs and empty, unknown, or out-of-scope item IDs with invalid params (`-32602`). Preserve existing string and null cursor behavior, and update the protocol schemas, TypeScript and Python types, and API documentation.
## Testing
Add protocol round-trip and invalid-shape tests, app-server coverage for anchored pagination and errors, and thread-store coverage for growing turns, reverse pagination, page boundaries, fork visibility, and anchor scope validation.
GitOrigin-RevId: a74cea190d3ff1b44865429f8b0650b793eb688d
## Why
Synchronous Guardian reviews can include the same user instruction in both the retained instructions section and the conversation transcript. Avoid this duplication while preserving complete authorization evidence and its original acceptance order.
## What changed
- Carry retained source metadata into transcript rendering. Omit a retained instruction when the transcript delivers its complete matching source revision.
- Label qualifying transcript entries with retained source order and protect them from budget truncation. Keep separate retained instructions when source metadata is missing or incomplete.
- Track delivery of source-order guidance so it remains available even when all retained instructions are delivered through the transcript. Invalidate that delivery proof when messages are shortened.
## Testing
Add coverage for complete-source deduplication, missing or incomplete metadata, budget protection, guidance redelivery, and source metadata preservation across resume. Update Guardian review assertions and snapshots to verify instructions are delivered once.
GitOrigin-RevId: 20ad0304501fa49f1596c4cfaf3ef89d64815753
## Why
User messages could fill the root context limit before assistant questions were considered, while commentary could displace relevant conversational context. Guardian needs that context to interpret user authorization when reviewing subagent actions.
## What changed
- Select recent user and assistant evidence together under a shared message limit, discarding assistants with unknown ordering first.
- Exclude explicit assistant commentary and retain message phases across compaction. For older retained records, check available source messages for commentary phases.
- Mark missing instructions or assistant context when the shared limit removes corresponding evidence, and use remaining space for legacy instructions.
## Testing
Update Guardian authorization tests to cover shared message limits, commentary filtering across compaction and resume, and preservation of ordered replies when legacy assistant context has unknown ordering.
GitOrigin-RevId: c369a2760917cba9d7dfca37fb5e85a7ec49012f
## Why
Reused Guardian sessions already contain previously delivered instructions. Follow-up reviews can avoid repeating that evidence, but must deliver it again if it changes or compaction removes it.
## What changed
- Track retained source identity, revision, and completeness in host-owned history metadata, preserving revisions during replay.
- Omit retained instructions from synchronous review inputs only when the same complete revision remains in reviewer history.
- Restore missing evidence after reviewer compaction, enforcing the request budget before persisting additions. Classify restored evidence as context rather than new user authorization.
- Keep source-order labels stable across eviction and retain full delivery for legacy records without reliable provenance.
## Testing
Add coverage for consecutive-review deduplication, changed revisions, missing or incomplete metadata, and restoring compacted evidence exactly once. Extend compaction and resume coverage to verify retained revisions.
GitOrigin-RevId: e90fca16cde0a0970da36dd873af2ca1dbaaf4d3
## What changed
- Stop sending `includeExtensions=true` when fetching installed plugins and remove extension metadata from remote plugin models.
- Remove `PluginSummary.extensions` and the associated extension declaration types from the app-server protocol.
- Update generated JSON schemas, TypeScript and Python bindings, and precomputed protocol exports to match.
GitOrigin-RevId: 56509437b6bdf58d99badff68e86bcf7f09fe036
## What changed
- Recognize `promax` in authentication, account responses, and backend rate limits; update generated schemas and client types.
- Display `prolite` as “Pro”, `pro` as “Pro (More)”, and `promax` as “Pro (Max)” in account labels, status, and analytics.
- Include Pro Max in experimental context eligibility, paid-plan tooltips, and usage-limit guidance for purchasing credits.
## Testing
Extend coverage for Pro Max plan parsing, account and rate-limit responses, experimental context eligibility, and plan display names. Update the login token test to expect “Pro (More)”.
GitOrigin-RevId: 197e00fa7a99cbce125c8f1d43a451ec1ed5c1fb
## What changed
- Recognize `flex_unavailable` in HTTP 429 responses and streamed `error` and `response.failed` events. End normal turns without retries and report `Flex capacity unavailable.`
- Expose `flexUnavailable` through the core and app-server protocols and generated schemas and SDK types.
- Keep Flex capacity failures eligible for Guardian review and sampler retries, with a distinct telemetry classification.
- Map unexpected HTTP responses to `HttpConnectionFailed`, preserving their status codes.
## Testing
Add regression coverage for terminal Flex failures over HTTP, SSE, and WebSocket, HTTP 504 status preservation after a stream retry, and protocol serialization. Update Guardian retry and sampler recovery tests to cover Flex failures.
GitOrigin-RevId: f2e03a6d2d36a6d9748c35952e40397f8670d121
## Why
The `attribution_error` status does not explain why MCP attribution is incomplete. Preserve a diagnostic reason so callers can distinguish history and recorder errors from request serialization failures.
## What changed
- Add optional `error_reason` diagnostics to `McpAttribution`, retaining the first recorder error through checkpoints, compaction, resume, and fork.
- Identify missing or invalid checkpoints, conflicting sources, invalid sources, and poisoned recorder state. Use `restored_error_unknown` for older error checkpoints without a reason.
- Distinguish `payload_too_large` from `serialization_failed` in request metadata fallbacks.
- Tolerate missing, unknown, or malformed diagnostic reasons when reading history, without letting diagnostics determine attribution status.
## Testing
Add coverage for reason preservation, recorder poisoning, backward-compatible checkpoint decoding, resume and cold-fork restoration, and request metadata serialization, including oversized payloads.
GitOrigin-RevId: 389b9446fae119f793978f3e7e4a926677e84d8c
## Why
Unchanged scheduled heartbeat instructions should not become fresh authorization evidence that supersedes a later human override or floods Guardian review context.
## What changed
- Capture heartbeat provenance per input, including when steering an active turn, and persist it in history and retained context.
- Coalesce unchanged instructions for each automation at their original acceptance order. Preserve changed instruction versions and ordinary human messages.
- Represent repeated heartbeats as references to earlier instructions in Guardian transcripts, while tracking the latest input turn separately for trusted skill selection.
- Limit coalescing to recognized, bounded heartbeat envelopes with host-provided provenance.
## Testing
Add regression coverage for human overrides across repeated and steered heartbeats, instruction changes, checkpoint restoration, transcript references, envelope parsing, and latest-turn trusted skills in delegated reviews.
GitOrigin-RevId: 31e444ddb685a1a618be26d3cc32fb562296946b
## Why
App-server clients need a way to connect to executors that require bearer authentication through `environment/add` and `environments.toml`.
## What changed
- Add optional `authBearerToken` to `environment/add` and `auth_bearer_token` to URL entries in `environments.toml`.
- Send the token as an `Authorization: Bearer` header on initial connections and reconnects, without automatic refresh. Require `wss://` or a loopback destination when a token is supplied.
- Redact tokens in debug output, mark connection headers sensitive, and omit source text from TOML parse errors.
- Preserve unauthenticated behavior when tokens are omitted, including requests with a null `authBearerToken`.
## Testing
Add integration coverage for authenticated and unauthenticated executors through both RPC and TOML configuration, including missing, null, incorrect, and malformed RPC tokens. Extend tests for reconnect authorization headers, token redaction, URL-only token configuration, and timeout preservation.
GitOrigin-RevId: 2a5d48a1846df1720e4a9b295968348378c287c6
## Why
Ordinary user replies can depend on preceding assistant messages. Losing those messages during compaction can leave Guardian without the context needed to interpret a reply's scope.
## What changed
- Retain original assistant messages, including commentary, with their recorded order across checkpoints and resume. Exclude compaction output from this evidence.
- Include assistant context in local and delegated reviews as untrusted context, with separate storage limits and lower budget priority than user instructions.
- Prefer assistant context preceding ordinary replies when selecting bounded root evidence, and report unavailable context without inferring what a reply refers to.
- Preserve inherited context scope and remove assistant evidence beyond rollback boundaries, including during rollout migration.
## Testing
Extend coverage for compaction and resume, checkpoint migration, queued-input ordering and rollback, role labeling, and evidence budgets that preserve user restrictions while dropping assistant context.
GitOrigin-RevId: 886189b0be29ffc3d324b56f5d0b673d6b8d84da
## What changed
Add `backend_reasoning_status`, disabled by default, to relay public reasoning summaries during active, server-managed realtime V3 delegations.
Use the last non-empty summary from each completed reasoning item, truncate it to 256 bytes at a character boundary, and append it as `[STATUS]` context on the `commentary` channel. Discard queued updates if their delegation is no longer active.
## Testing
Add an integration test covering enabled and disabled behavior, selection of the latest non-empty summary, exclusion of raw reasoning and partial summaries, and delivery without triggering `response.create` or changing the model's reasoning-summary setting.
GitOrigin-RevId: 75ce87dbbbab15a6d9d0ad0b23737738837192fd
## Why
`invalid_prompt` responses were classified as generic invalid requests, losing the server's specific error classification.
## What changed
Add `InvalidPrompt` variants to the API and core error types and serialize the core protocol classification as `invalid_prompt`. Recognize the code in HTTP 400 responses, wrapped WebSocket errors, and SSE `response.failed` events while preserving server messages and keeping the error non-retryable. Map it to `other` in the app-server v2 protocol.
## Testing
Extend coverage for typed error mapping, missing and blank messages, protocol conversion, and guardian retry handling. Exercise HTTP and SSE failures in core integration tests, asserting the error message, serialized classification, and a single request without retry.
GitOrigin-RevId: 5d9a299a013b06158a4dc27a4054f3dbc5fd0f4d
## Why
Compaction companion records do not represent all resume state, including the last started turn and previous turn settings. The selected multi-agent runtime also needs a persisted value when no companion turn context is present.
## What changed
- Add optional `resume_metadata` to `CompactedItem`, recording the multi-agent version, last started turn ID, and previous turn settings. Preserve the distinction between absent metadata and explicitly empty values while retaining compatibility with older records.
- Capture this metadata under the settings persistence lock alongside the compaction checkpoint.
- Rewrite inherited metadata to use the child agent's runtime, and clear previous turn settings when the child must rebuild context.
- Clear pending continuation state before delivering acceptance of standalone settings updates, while holding the persistence lock.
## Testing
Add coverage for metadata round trips with empty values, legacy reader compatibility, checkpoint companion records, inherited fork metadata, and continuation invalidation while settings event delivery is blocked.
GitOrigin-RevId: f30b7feaa7e2fdb5b65fc3c53b37fd7a7fe27903
## What changed
- Request installed-plugin metadata with `includeExtensions=true` and carry optional `extensions` through the cache into `PluginSummary`.
- Add typed declarations for global, settings, thread, and file entrypoints, quick actions, settings tools, icons, and search mention providers. Update JSON schemas and TypeScript and Python bindings.
- Accept supported snake_case aliases and emit camelCase fields. Discard incompatible extension declarations without invalidating the installed-plugin inventory.
## Testing
Add an integration test covering extension metadata preservation, field normalization, and unknown entrypoint and quick-action types across live and cached `plugin/installed` reads. Update pagination assertions to require `includeExtensions=true`.
GitOrigin-RevId: b73b0d13c151a30dc1fb9cda70b5cd6d7e3e2441
## What changed
Allow `mcpServer/resource/read` to specify `target: {connectorId, linkId}` for direct hosted app reads without tool discovery, when supported by the backend. Require an explicit `linkId`: a string selects an account, while `null` requests no-auth access subject to backend policy.
Restrict direct targets to `codex_apps` and reject empty connector IDs, empty link IDs, and synthetic link IDs. Preserve originating app/account scope when `originCallId` and `threadId` are supplied, and retain discovery when `target` is omitted.
Update protocol schemas and TypeScript and Python models, preserving required-but-nullable `linkId` semantics in Python code generation.
## Testing
Extend resource-read tests to check target metadata with and without a thread, including explicit no-auth targets and omitted targets. Add Python model tests for string and null `linkId` values and rejection of a missing `linkId`.
GitOrigin-RevId: 8cf5595fbdd937193aeb529901fc95299f6e18ad
## Why
Clients with a gateway sign-in UI need to control when browser authorization starts and inspect credential readiness before making authenticated requests.
## What changed
- Add `initialize.capabilities.explicitGatewayOauth` to require explicit login while allowing existing credentials to refresh. Preserve automatic authorization for clients that omit the capability, and prevent later connections from undoing explicit opt-in.
- Add `account/gatewayOAuth/read`, `account/gatewayOAuth/login`, and `account/gatewayOAuth/cancel`, plus `account/gatewayOAuth/changed` notifications. Send the authorization URL only to the initiating connection and cancel its login on disconnect.
- Check gateway authentication before returning cached results from `model/list`, with restart guidance when provider settings have changed.
- Update protocol schemas, TypeScript and Python bindings, and document capability probing and the sign-in lifecycle.
## Testing
Add tests for passive readiness reads, credential reuse after login, token exchange failures, cancellation and immediate retry, connection ownership, legacy versus explicit login, and model-list authentication checks.
GitOrigin-RevId: a26e116a62c9f3db84dc238a40b7f4e816eb1594
## What changed
Add nullable `httpOrigin` to `McpServerStatus`, derived from the effective configured endpoint for both configured and plugin-provided servers. Return only the HTTP(S) origin, excluding credentials, path, query, and fragment; return `null` for stdio transports, invalid URLs, and non-HTTP(S) schemes. Update the generated protocol schemas and TypeScript and Python types.
## Testing
Extend status integration tests to cover configured and plugin-provided HTTP servers, verify that endpoint paths and query parameters are omitted, and assert `null` for a stdio server. Update protocol tests to check null serialization and compatibility with older inventory responses.
GitOrigin-RevId: 033ebdeefe829e3a48b2d4ab7d8866dac4cda5c5
## What changed
- Persist producer-recorded item start and completion times in thread history, preserving existing non-null values on updates.
- Return nullable `startedAtMs` and `completedAtMs` Unix millisecond timestamps from `thread/items/list`, and update the generated schemas and TypeScript and Python types.
- Leave timestamps unknown for existing rows and older writers.
## Testing
Add coverage for exact timestamp persistence, protocol round trips with present and missing timestamps, paginated item responses, and compatibility with older database writers.
GitOrigin-RevId: 894853481085782ff54db1704799e41446d15e51
## What changed
- Capture optional `creator_user_id` and `creator_account_id` from authentication when creating a thread, including forks.
- Carry these fields through thread storage, rollout metadata, and a SQLite migration. Leave them absent when unavailable or when reading older threads.
- Preserve recorded creator values across resume and metadata updates. On revert, recover missing rollout values from SQLite before writing replacement metadata.
## Testing
Add coverage for ChatGPT and API-key sessions, resume under another account, forks using current authentication, metadata extraction and upserts, and repeated reverts after creator fields are removed from a rollout.
GitOrigin-RevId: 9839fa42f9392f12226002e2c27d05d5656f5695
## What changed
- Record each MCP source and its first turn, including connector and plugin identifiers when available. Cover direct and Code Mode calls, including returned errors and results that are not printed.
- Persist cumulative attribution checkpoints and restore them across compaction, resume, and forks, including forks limited to recent turns.
- Attach fresh attribution to Responses API `client_metadata` under `mcp_attribution`, outside model-visible content. Restrict transmission to allowed OpenAI HTTPS destinations for both HTTP and WebSocket requests.
- Report `attribution_error` for legacy history without checkpoints, malformed or conflicting attribution, and serialized attribution exceeding 16 KiB.
## Testing
Add coverage for source deduplication, checkpoint persistence and restoration, recent-turn forks, direct and Code Mode calls, destination filtering, and the serialized size limit.
GitOrigin-RevId: fd285e152ca9e24bfa000debb20013709d67a86e
## Why
Guardian's retained root context appended assistant messages after user evidence and omitted questions sent through User Messaging. This could leave subagent authorization reviews with missing or misplaced conversational context.
## What changed
- Record assistant messages and function calls in the same order sequence as accepted user inputs, then merge retained review context by recorded position while prioritizing user evidence within the message budget.
- Capture bounded User Messaging text after input hooks when a send succeeds, and match it to the original call for assistant context.
- Label assistant context without a recorded position explicitly and clear parent assistant and tool positions when forking agent history.
- Clarify that recorded order does not establish delivery order or pair ordinary replies with questions; assistant messages remain untrusted context.
## Testing
Add coverage for hook-rewritten messages, failed or unconfirmed sends, queued replies with delayed tool results, ordering across resume, and removal of inherited assistant positions from forked history.
GitOrigin-RevId: ac717cf0f5efe4b05c18f2d8370dd48453ac4e35
## Why
Native `openai/userVerification` requests need to carry optional `_meta` to clients for extension-specific presentation.
## What changed
- Accept optional metadata objects with the same validation as MCP elicitation.
- Restore metadata from the MCP request context, excluding `progressToken`, and forward it through `mcpServer/elicitation/request`.
- Update protocol types, schemas, and documentation while retaining support for requests without metadata. Challenge bytes and acceptance proofs remain unchanged.
## Testing
Add coverage for metadata validation, transport context restoration, and protocol round trips. Extend MCP integration tests to check that verification metadata reaches the client.
GitOrigin-RevId: 5d04004244cf33effac675c19e543157c48d1504
## What changed
- Remove the private-desktop opt-out from elevated and unelevated Windows sandbox launches.
- Remove `windows.sandbox_private_desktop` and its managed requirement and API fields. Warn users to remove the obsolete setting.
- Require a private desktop name when launching through the Windows sandbox wrapper and command runner.
## Testing
Add coverage for the obsolete-setting migration warning and update wrapper tests to verify a live private desktop is passed and a missing desktop name is rejected.
GitOrigin-RevId: c7135f8d211aac8d812180691c2c1e433d77cde4
## What changed
Add an optional `onboardingSkill` summary to `plugin/read` responses and update the generated schemas, TypeScript types, and Python models.
- Resolve local declarations from `extensions["com.openai"].onboardingSkill`, accepting relative paths with or without `./`. Require the resolved path to stay within the plugin root and match a loaded skill.
- Match remote release metadata's `onboarding_skill_name` against the plugin's skills.
- Return the summary only when the plugin and matching visible skill are enabled; remote plugins must also be available. Otherwise, return `null`.
## Testing
Add parameterized local and remote `plugin/read` tests covering matching, missing, and unmatched declarations, disabled plugins and skills, and unavailable remote plugins.
GitOrigin-RevId: 88cabdfddbecba5efba756617da0cb1ff064bdf7
## Why
Streaming `bio_policy` failures were classified as generic invalid requests, losing their policy-specific classification.
## What changed
- Add `BioPolicy` errors across the API and core protocol, recognizing streaming failures and HTTP 400 responses, including wrapped WebSocket errors.
- Preserve server messages and use a biological-risk fallback when the message is missing or blank.
- Treat bio policy errors as non-retryable in core and guardian handling, and classify them in diagnostics and telemetry.
- Map `BioPolicy` to `other` in the app-server v2 protocol.
## Testing
Add coverage for error classification, message preservation and fallbacks, HTTP and wrapped WebSocket responses, guardian retry decisions, and app-server conversion. Extend the core integration test to verify that bio policy failures emit a typed error and complete the turn after a single request.
GitOrigin-RevId: 78c2647e8fc8f80297cb8a23fff06ab141099632
rb-oai