## What changed
- Publish `install.sh` and `install.ps1` from stable release assets to the
mutable `codex/install.sh` and `codex/install.ps1` R2 keys.
- Require both installer assets and verify each uploaded object's size,
SHA-256 metadata, and CRC64 checksum before completing publication.
- Leave prerelease publication unchanged.
GitOrigin-RevId: 869f5fcd6c5f5d7fa4dc39c5216b31409d595fc9
## Why
Startup prewarms and Guardian review sessions do not need workspace Git metadata. Collecting it for those requests performs redundant work, while user turns still need a fresh view of the repository.
## What changed
- Add a per-session Git enrichment policy.
- Skip enrichment for startup prewarm, preview, and Guardian review turns.
- Keep fresh enrichment enabled for regular sessions and one-shot delegated turns.
## Testing
- Cover prewarm and Guardian requests omitting workspace metadata while subsequent user turns observe repository changes.
- Cover concurrent repositories and worktrees retaining distinct metadata.
- Verify concurrent enrichment is coalesced and canceled enrichment can be retried.
GitOrigin-RevId: 4a68615288bb568c75f2e487d9c0776e3e80f191
## What changed
- Treat output-task closure as the signal that trailing output is complete, drain any remaining chunks before publishing command completion, and retain the grace period as a fallback.
- Wait for deferred network-denial classification before emitting the final command result.
- Serialize `write_stdin` interaction and completion events so an interaction that exits a process is published first, and avoid pruning processes while their terminal events are being finalized.
## Testing
- Add coverage for late output, missing output-close signals, late network denials, interaction/completion ordering, cross-platform aggregated output, and pruning during finalization.
GitOrigin-RevId: 46a118552bb1a4658b78aa5a5ca76eb8c5fba571
## What changed
- Use `McpConnectionSet` as the primary name for the collection of active MCP
server connections throughout `codex-mcp` and its callers.
- Keep `McpConnectionManager` as a backward-compatible type alias.
GitOrigin-RevId: 9753838b4fd0a0b6429a9c4af0c077137616f388
## What changed
- Add the action-risk review prompt template and default generic security policy to the `codex-auto-review` catalog entry.
- Define its `never` approval and `danger_full_access`, `workspace_write`, and `read_only` permission messages.
GitOrigin-RevId: 025bb609c12ae9d5235054747267a1ee46d118ef
## What changed
- Include the Codex `session-id` and `thread-id` headers when starting realtime conversations over WebSocket or WebRTC.
- Add coverage confirming that WebRTC call creation forwards both identifiers while preserving the existing realtime request metadata and SDP payload.
GitOrigin-RevId: 668bee9a7d4797ad0a396e9ca4dc56b2c379cba7
## What changed
- Use the configured route-aware HTTP client pool for LM Studio server requests.
- Add connection-timeout support to `HttpClientBuilder` and route-aware pools, and keep LM Studio's five-second limit scoped to connection establishment.
- Verify that LM Studio accepts a response that arrives after the connection timeout has elapsed once the connection is established.
GitOrigin-RevId: c4300f4b5d37c4418822783ab09cb50d506ee423
## What changed
- Document `codex-http-client` as the owner of direct `reqwest` integration and shared outbound request policies.
- Explain how to select outbound proxy policies, retain clients for connection reuse, and use route-aware pooling for multi-URL and redirecting traffic.
- Add examples for constructing policy-aware clients and transports, plus guidance for direct routing and sensitive request data.
GitOrigin-RevId: 892db4be92af5ec42eced8d7dec4651c9f464689
## Why
Forking a persisted thread could lose its approvals reviewer and fall back to
configuration defaults.
## What changed
- Restore the latest persisted approvals reviewer from the full source history
when creating a fork, while continuing to honor explicit overrides.
- Keep boundary-based history truncation independent from reviewer restoration,
so a fork at an earlier turn retains the source thread's latest setting.
## Testing
- Add an app-server test that sets auto-review, forks at an earlier turn, and
verifies the fork reports auto-review.
GitOrigin-RevId: 41c515755de7de600f71c1259f96908f2d169ca7
## Why
ChatGPT token refresh requests need to follow the same configured routing policy as other authentication traffic, including environments that use the system proxy.
## What changed
- Require an `AuthRouteConfig` throughout login, logout, token refresh, personal access token, and agent identity flows.
- Build auth HTTP clients directly from that configuration instead of falling back to a default HTTP client when routing configuration is absent.
## Testing
- Add an integration test that refreshes a token through a cached system-proxy route and verifies the proxy receives the expected request.
GitOrigin-RevId: 7d54ab3219939a49921c51faf08cd4c2eabca51c
## Why
Turn diffs need to render paths from remote environments whose path convention may differ from the Codex host.
## What changed
- Preserve `PathUri` values through applied patch deltas, display-root discovery, and turn-diff tracking.
- Add host-independent relative-path rendering and normalize Windows drive-letter case in `PathUri`.
- Render paths relative to each environment's repository root while keeping Git diff headers slash-separated.
## Testing
- Cover POSIX, Windows, UNC, encoded-separator, and opaque URI relative paths.
- Verify an applied patch in a remote Windows working directory emits a portable unified diff.
GitOrigin-RevId: 526f70ae36a40627de5496d375310d12295b69bb
## What changed
- Send the streaming SSE request-body drain test through `HttpClientFactory`.
- Replace the test-support crate's direct `reqwest` dependency with
`codex-http-client`.
- Remove `core_test_support` from the temporary direct-`reqwest` exceptions.
GitOrigin-RevId: 16ea4309d0b575592c2e59991eb6dce18d9467ed
## Why
Auth managers should use the application's resolved HTTP client factory instead
of silently falling back to the transport's default proxy behavior.
## What changed
- Make `AuthRouteConfig` required when constructing an `AuthManager` or
`AuthConfig`.
- Pass each production caller's resolved routing configuration through without
wrapping it in an optional value.
- Add a test helper that explicitly selects the transport-default proxy policy
for callers that do not exercise custom routing.
GitOrigin-RevId: d89a3b1f8b5d4007650cdac0aae241c94d598580
## Why
Auth routing represented the default proxy policy as an absent configuration,
leaving consumers to reconstruct the fallback HTTP client independently. Carry
the application's resolved policy explicitly so auth and related requests use
the same client configuration.
## What changed
- Build `AuthRouteConfig` from the resolved `HttpClientFactory` for both
`ReqwestDefault` and `RespectSystemProxy` policies.
- Pass that route configuration through login, auth, cloud task, and cloud
configuration flows, and reuse its factory when loading cloud configuration.
- Log cloud-task configuration load failures before falling back to the
transport-default proxy policy.
## Testing
Extended configuration tests to verify that effective and bootstrap auth routes
select the expected proxy policy when system-proxy support is enabled or
disabled by feature requirements.
GitOrigin-RevId: d03802e2660f5cf6d940e8e718ec5c82ede7eab1
## What changed
- Assign IDs to client-created response items in every session, including streamed items, forked history, compaction results, and non-OpenAI provider requests.
- Preserve server-provided IDs and stable generated IDs across persisted and resumed conversations while continuing to omit unprefixed server IDs from outbound requests.
- Retire `features.item_ids` as a configurable feature. Existing configuration and CLI toggles remain accepted as compatibility no-ops.
## Testing
- Cover default ID assignment, persistence and resume behavior, remote compaction, provider requests, WebSocket requests, and removed-feature compatibility.
GitOrigin-RevId: 7a09e2d07d2606c2ef1e8e2283d36cb555557eae
## Why
Git can interpret a requested commit SHA as a branch name when the remote's
default branch has the same name. This can cause a marketplace plugin source
to materialize a different commit than the one it pinned.
## What changed
Resolve `HEAD` after checking out a SHA-pinned Git plugin source and reject the
source when the resolved commit does not exactly match the requested SHA.
Ref-name checkouts retain their existing behavior.
## Testing
Add a regression test with a default branch named after another commit's SHA
and verify that materialization rejects the mismatched checkout.
GitOrigin-RevId: c19cbd98ee6167dad7b2ee72e283b3bd30b59713
## Why
`codex-http-client` is the intended owner of direct `reqwest` usage.
## What changed
- Build Codex's default and route-aware clients with `HttpClientBuilder`, and return `HttpClient` directly to API, model discovery, auth, remote control, skills, and extension callers.
- Preserve custom CA, proxy, Cloudflare cookie, sandbox, and request-logging policies while removing `codex-login`'s direct `reqwest` dependency.
- Use shared HTTP types for auth headers, status codes, transport errors, and login-server tests.
## Testing
- Add a Linux integration test verifying that a regular Responses API turn traverses the configured system proxy.
GitOrigin-RevId: 714695fb80762d2083e2f7a6414183e2b3b63854
## What changed
- Make the generated Linux proxy socket directory readable inside restricted
`bubblewrap` sandboxes so the proxy bridge can connect.
- Route `WS_PROXY` and `WSS_PROXY` through the Linux managed proxy bridge.
- Remove inherited proxy attribution tokens from unscoped executions while
continuing to replace them with the current token for scoped executions.
## Testing
- Exercise `WSS_PROXY` routing with a minimal filesystem policy.
- Cover attribution-token removal and replacement during environment setup.
GitOrigin-RevId: 2f14ddb26baab0147a786bc354d93eb5aad059f3
## Why
The PTY and pipe spawn helpers now require callers to specify which file
descriptors should be inherited, following
https://github.com/openai/codex/pull/13644.
## What changed
Pass empty inherited-FD slices from the Windows process-tree tests, which do
not need to preserve any file descriptors.
GitOrigin-RevId: 5e578df34e195251490608a163f8aaee0a6e681c
## What changed
- Apply root and scoped project instructions using the established precedence for `AGENTS.override.md`, `AGENTS.md`, and configured fallback files.
- Treat findings as rule-supported only when repository guidance adds material, repository-specific context beyond generic correctness advice.
- Deduplicate findings without losing their supporting rules, and cite the applicable instruction file and smallest relevant line range in each rule-supported finding.
- Continue reporting ordinary findings independently of whether repository rules apply.
GitOrigin-RevId: 64b26555d92c0baa7e8e005130a7fb032b91d170
## What changed
- Handle app-server `turn/start` rejections for pending user turns as turn
errors instead of exiting the TUI.
- Finalize the pending turn, display the failure in the transcript, and resume
queued input handling.
- Add coverage that submits a turn to a missing thread and verifies that the
error is shown while the app continues running.
GitOrigin-RevId: 6d291ba62b9e50d49dd4e3d7c429e98c1f754680
## Why
`codex-http-client` is the intended owner of direct `reqwest` usage.
## What changed
- Route agent identity registration, task registration, and JWKS requests through `HttpClient`.
- Preserve retry classification using `HttpError` and `http::StatusCode`.
- Remove `codex-agent-identity` from the temporary direct-`reqwest` dependency exceptions.
GitOrigin-RevId: 7445c9f2521e6d8ef0969a1483c81f797bf91316
## What changed
- Add `HttpClientBuilder` for configuring default headers, redirects, the
Cloudflare cookie store, and request diagnostics without exposing the
underlying transport.
- Provide factory-backed construction for fixed destinations that respects
outbound proxy policy, alongside explicit direct and legacy
transport-default construction paths.
- Preserve the request-logging setting in `ReqwestTransport`, so disabling
diagnostics also suppresses transport-level URL and request-body traces.
- Add `HEAD`, `DELETE`, and query-parameter helpers to the shared client
wrappers.
## Testing
- Verify builder configuration survives policy-aware construction and custom
CA fallback.
- Verify disabled request logging omits request URLs and bodies from transport
traces.
GitOrigin-RevId: 529c33abefeb88f38ff9a0ead374d29fcc872e6a
## What changed
- Check writable-root permissions for the sandbox group and root capability SID from a single DACL snapshot, and refresh the ACL when either SID is missing the required access or has a stale explicit delete-child grant.
- Start the command runner without loading a user profile and poll more frequently while waiting for it to become ready.
- Make the Windows sandbox binaries available to Bazel tests.
## Testing
- Add coverage that verifies ACL refresh checks every requested SID.
- Add an elevated non-TTY command test that verifies environment forwarding, stdout, and exit-code propagation.
GitOrigin-RevId: 657ed9dc906039299f9ffa4772e0926c47066a73
## Why
A fixed character limit does not account for the different context-window sizes supported by models.
## What changed
- Budget extension-rendered skill metadata at 2% of the resolved model context window, capped at 4,000 tokens.
- Keep the existing 8,000-character fallback when model context metadata is unavailable.
- Include the omission marker in the budget and still emit it when no skill entry fits.
- Apply the same resolved budget to executor and host skill catalogs assembled for a turn.
## Testing
- Cover proportional and capped budgets, multibyte fallback accounting, and omission-marker behavior.
- Verify through the production turn path that larger model context windows include more catalog entries without exceeding the computed budget.
GitOrigin-RevId: 4667293f1594de4dd605b32b9fa4255d26772c0f
## Why
Crossterm's Windows event backend expects Win32 input records. When the console
inherits virtual terminal input mode, or another console client restores it,
navigation keys instead arrive as literal escape bytes.
## What changed
- Keep the Windows console in input-record mode while the event stream is
polled, and disable focus-change reporting on Windows.
- Preserve and restore the console's original virtual terminal input setting
when the TUI shuts down.
## Testing
- Add unit coverage for clearing and restoring the virtual terminal input bit.
GitOrigin-RevId: 792b99e354fce357d51810a6c3b437e972ad11ce
## Why
Terminating a Windows execution session must also stop child processes, while a
normal root-process exit must continue to allow background descendants to run.
## What changed
- Assign Windows pipe, ConPTY, and sandbox processes to job objects and terminate
the job when a session is cancelled, times out, or is explicitly stopped.
- Preserve descendants when the root process exits normally.
- Attach ConPTY and sandbox processes to their jobs atomically at creation; keep
root-process termination as a fallback where job setup is unavailable.
## Testing
Added Windows coverage for descendant termination and preservation across pipe,
ConPTY, capture, cancellation, and legacy sandbox execution paths.
GitOrigin-RevId: 8f831f2fc4caaa7b79ce842a3ed7192bd02dd3b4
## What changed
- Resolve the full rollout lineage when loading model context for paginated threads.
- Reverse-scan each lineage segment up to its recorded byte boundary, stopping at segment metadata and preserving the requested thread's canonical session metadata.
- Add a bounded reverse-scanner constructor for scanning a frozen JSONL prefix.
## Testing
- Cover frozen-prefix reverse scans and nested lineages whose root rollout has been archived.
GitOrigin-RevId: 8b97da43a263b7bd09cb7883450bb19eba5f195f
## What changed
- Define the `network/policyRequest` RPC payloads for associating a network request with a process and returning an `allow`, `deny`, or `ask` decision.
- Cover HTTP, HTTPS CONNECT, and SOCKS5 TCP/UDP requests, with shared size limits for callback fields.
- Add the backward-compatible `requestPolicyDecisions` remote proxy option so executors can opt in to sending policy decisions to clients.
- Re-export the new protocol types from `codex-exec-server`.
## Testing
- Verify the request and decision JSON shapes.
- Verify that the proxy opt-in is omitted and defaults to `false` for legacy configurations, while an enabled value round-trips.
GitOrigin-RevId: 65b0a0723d1abb6e4f504a41d3a0dd41f5f21bf7
## What changed
Set `missing_path_behavior` to `None` for the minimal and project-root
filesystem entries in the custom-`arg0` exec-server test.
GitOrigin-RevId: c1d8df7b5ca8dcf6c89c314b92747bfeae80286e
## Why
Elevated Windows sandboxes need stable managed-proxy ports while preserving the network policy and environment attribution of each sandboxed process.
## What changed
- Keep shared HTTP and SOCKS5 loopback ingress listeners alive across managed-proxy instances.
- Add a per-route restricting SID to elevated sandbox tokens and dispatch incoming connections to the matching proxy policy after attributing the client process.
- Reject connections without exactly one registered route, remove routes when their proxy handle is dropped, and keep unsandboxed Windows launches off the managed ingress.
- Provision the elevated sandbox with the configured proxy ports and local-binding setting, honoring the selected profile and CLI overrides.
## Testing
- Add Windows unit tests for TCP ownership attribution, route selection, restricting-token propagation, and setup settings.
- Add an end-to-end Windows test covering stable ports, isolated environment policies, HTTP and SOCKS5 routing, and route teardown.
GitOrigin-RevId: 783fac6e0f904dc9bb1955b75d4a5895e8bb9690
## What changed
Redirect stdin to null when launching:
- `codex doctor --json` for uploaded diagnostic reports
- Git commands used by `codex doctor`
- ripgrep searches over rollout files
- the Windows sandbox setup refresh helper
This keeps these non-interactive subprocesses from reading Codex's inherited
input stream.
GitOrigin-RevId: 063d191b0b1b849d74b55a7d6ff2f0b3d5212c86
## What changed
- Parameterize skill catalog rendering with explicit core- and extension-compatible description policies.
- Use full skill descriptions for core-compatible output, while extension-compatible output prefers `short_description` and falls back to the full description.
- Keep extension prompt and world-state rendering on the extension-compatible policy.
## Testing
- Add a renderer test covering description selection and fallback for both policies.
GitOrigin-RevId: 5382075f88c25a49a715feb0702a9ab888ec0123
## What changed
- Accept an optional session name after `/new` or `/clear`.
- Set the requested name through the app server when starting the new thread and update the attached session with that name.
- Report naming failures in the chat while still attaching the newly created thread.
## Testing
- Cover named `/new` and `/clear` dispatch, app-server name persistence, and the existing unnamed `/clear` behavior.
GitOrigin-RevId: 570886abb4af522123f0693ce05d2415e1c0d902
## Why
With `allow_local_binding = false`, proxy-aware clients bypassed the managed
proxy for loopback and private IP targets. This prevented explicit local IP and
`localhost` allowlist entries from taking effect.
## What changed
- Route local targets through the managed proxy when local binding is disabled,
while preserving direct access when it is enabled.
- Allow a non-public connection only when its requested IP literal or
`localhost` target is explicitly permitted. Continue blocking private
addresses reached through unrelated hostnames.
- Bypass inherited upstream proxies for non-public targets so Codex applies the
local-target policy directly.
## Testing
Added connector, upstream proxy, environment override, and Linux sandbox
coverage for explicitly allowlisted loopback access.
GitOrigin-RevId: 35e0d73633d5051816e096bc5aa8d586aec5eea4
## Why
Skill names may contain characters that are not valid in metric tag values.
## What changed
Pass skill names through `sanitize_metric_tag_value` before using them as the
`skill` tag on `codex.skill.injected` counters for both explicit and implicit
skill invocations.
GitOrigin-RevId: 0ed633fbd468739acc30193b566d830e20bc7860
## Why
Default read-only protections for project metadata should apply when paths such
as `.git`, `.agents`, and `.codex` exist, without causing sandbox setup to
materialize missing paths as ACL targets.
## What changed
- Add an optional `missing_path_behavior` to filesystem sandbox entries and
mark default project-metadata protections with `skip`.
- Preserve the behavior through permission transforms and exec/MCP protocol
serialization while keeping existing path wire variants stable.
- Ignore skip-missing entries when projecting configuration or Windows sandbox
overrides, while retaining explicit metadata carveouts.
## Testing
- Cover protocol round trips for path and special-path entries.
- Verify default metadata protections and Windows explicit carveout handling.
GitOrigin-RevId: 6df13dadacdd131c44aab9f15a967c81051355c1
## What changed
- Apply managed values for `sqlite_home`, `log_dir`, `model_catalog_json`,
`check_for_update_on_startup`, `allow_login_shell`, the report-submission
opt-in, and `windows.sandbox_private_desktop` to the runtime configuration,
with source-aware warnings when they override configured values.
- Expose these values through `configRequirements/read`, return them from
`config/read`, include them in session config locks, and show their sources in
the TUI config debug view.
- Reject app-server writes that overlap an exact managed requirement with
`configRequirementReadonly` while leaving unrelated sibling keys writable.
## Testing
- Cover runtime overrides, requirement API mapping, config reads and writes,
session lock serialization, cross-platform path URIs, and debug output.
GitOrigin-RevId: d4e23b6fd7775c1a6dfe2eab313cdcee50b07081
## What changed
- Add `shell_environment_policy.filters`, mapping environment-variable patterns to `include` or `exclude`, while continuing to accept the legacy `exclude` and `include_only` arrays.
- Merge filter keys case-insensitively across config layers so higher-precedence entries can override individual patterns. Switching representations replaces the other representation instead of combining them.
- Reject mixed, duplicate, or malformed filter definitions in enabled layers, config writes, and reloads, while retaining the previous session configuration when a reload is invalid.
- Make config-manager reads and writes representation-aware and preserve existing formatting when updating individual policy values.
## Testing
Add coverage for parsing, schema constraints, layered merging, validation and diagnostics, config writes, override metadata, and invalid session reloads.
GitOrigin-RevId: e15464bca53e6e7ef31fcc97537fda60ed5d670a
## Why
An MCP connection or tool catalog can change after a model step captures its
available tools. Calls from that step must not be rerouted to a replacement
client or run against a catalog revision the model did not see.
## What changed
- Add `McpBinding` to capture the ready clients, visible tools, resources, and
server metadata for one sampling request.
- Prepare calls against the captured client and reject them if the tool catalog
changes before call preparation and execution finish.
- Keep resource access and cache identity tied to the binding's exact connection
set, and omit servers that do not have a ready client.
- Preserve each client's unfiltered tool catalog so bindings can apply the
current filter consistently.
## Testing
Add coverage for connection replacement, stale catalog rejection, serialized
call preparation and refresh, ready-client capture, and binding-scoped resource
identity.
GitOrigin-RevId: a25da4d2c7f5ed06c41caa0c6d15c464c1698314
## What changed
- Add a bounded `routing_card_exact_v1` selector that ranks normalized exact
matches across skill names, tool dependencies, short descriptions, and full
descriptions, with stronger weights for routing-specific fields.
- Run the selector in the shadow selection experiment and include catalog entry
dependencies in selection documents.
- Report a selection as `selected` when an exact-name match succeeds even if
the query contains no searchable terms.
## Testing
- Cover dependency ranking, stop-word skill names, exact-term matching, and
input bounds.
GitOrigin-RevId: dfb0b668d726f64ae5da3b3ce2d8c9b23a664ac0
Compile `tui::restore` only on Unix, matching its use by the Unix job-control
suspension path.
GitOrigin-RevId: d0ce03def8905e94376ec7f5acf8d083d5dde05b
## What changed
- Add the optional `forceRefetch` boolean to `PluginListParams` and generated schemas.
- Accept both omitted and enabled values without changing `plugin/list` behavior yet.
- Cover deserialization of the enabled value in the protocol tests.
GitOrigin-RevId: fd4145161e9779638bc0bf18118d5ab5b8478745
## What changed
- Map `.cu` and `.cuh` extensions to the C++ syntax definition so CUDA source
and header files receive syntax highlighting.
- Extend syntax lookup and rendered-diff tests to cover both extensions.
GitOrigin-RevId: 5484ea9e30f9e4df788b0079596ec0239e8ef8d5
## Why
Paginated forks can retain a `history_base` pointer to another rollout. Deleting or compressing either side of that relationship can leave the fork without the rollout history it references.
## What changed
- Add a rollout reference index that scans active, archived, and compressed rollout metadata.
- Reject deletion when a rollout is still referenced by a fork outside the requested deletion set.
- Delete spawned thread subtrees as one store operation so internal references do not block deleting the complete subtree, while external references preflight the request before any files are removed.
- Skip referenced rollouts, fork-pointer rollouts, and rollouts with unreadable metadata during background compression.
## Testing
- Cover reference indexing across active, archived, compressed, duplicate, and self-referencing rollouts.
- Verify deletion rejects external references without partially deleting a subtree and permits batch deletion of internally referenced threads.
- Verify compression preserves fork pointer chains and continues past unreadable metadata.
GitOrigin-RevId: a8672727f8706e743d7fb3ca895a1d9ceac98a3c
## What changed
- Resolve a thread's rollout lineage when listing paginated turns and items.
- Page across parent, child, and nested fork segments in either direction while respecting each segment's ordinal bounds.
- Encode the physical segment in history cursors and reject cursors that belong to another requested thread or fall outside its lineage.
- Load turn summaries and filtered items from inherited segments.
## Testing
- Added coverage for forward and backward pagination across parent and child history, inherited summary and filtered items, cursor isolation, and nested forks.
GitOrigin-RevId: b803fff781fcb6e21d0e151189290148fc8d8b18
## What changed
- Store the starting byte offset and terminal ordinal and byte offset for each turn projected into SQLite.
- Advance offsets across blank and rejected physical lines while leaving incomplete trailing lines for the next materialization pass.
- Stop later rollout records from changing a turn after it reaches a terminal state.
## Testing
- Cover active and completed turn positions, trailing partial lines, skipped invalid lines, subagent history prefixes, and records received after terminal state.
GitOrigin-RevId: a7da2f0b00c0bf47b841db874c79a0d495c18acd
## What changed
- Add `McpBindingClients` to hold the ready MCP clients captured for a model step.
- Move concurrent, paginated resource and resource-template listing into the new helper.
- Keep server filtering in `McpConnectionManager` while preserving per-client timeouts, duplicate-cursor detection, and warning behavior.
GitOrigin-RevId: 0e3f8f135126b17d73058ca84e98493a27543ca0
zsol-openai