## Why
Updating a CRLF file with `apply_patch` previously normalized its line endings to LF unless preservation was explicitly enabled. Preserve the file's existing line endings without requiring an opt-in.
## What changed
- Use line-ending-preserving updates for both tool calls and standalone `apply_patch` invocations, removing the legacy normalization mode.
- Mark `apply_patch_preserve_line_endings` as removed.
- Always set `CODEX_APPLY_PATCH_PRESERVE_LINE_ENDINGS=1` in child environments for compatibility with older patch executables, overriding stale values.
## Testing
Update CLI, tool-call, shell-heredoc, and app-server tests to check CRLF preservation by default. Keep coverage for overriding stale compatibility environment values.
GitOrigin-RevId: 96d0b0e5350faa3fc7a45d63627a132657b44523
## What changed
Add the default-off `stable_environment_tools` feature flag. When enabled, advertise environment-backed tools before an executor is ready, keep environment selectors stable as readiness changes, and include the `shell` and `login` parameters. Execution still requires a usable environment and its policy.
When disabled, expose environment-backed tools only when a usable environment exists, derive selectors from usable environments, and condition shell parameters on the execution configuration. Restore tool-specific unavailable-environment errors and skip the environment readiness check for `write_stdin`.
## Testing
Parameterize the empty-environment tool availability test for both flag states, check that commands require a ready transport by default, and explicitly opt tests that rely on stable tool exposure into the feature.
GitOrigin-RevId: 68c6240fb3adf85d7f9b407804d4823c515abfdc
## Why
Third-party exposure settings can eagerly expose tool schemas or exclude tools from `exec`. Keeping eligible tools deferred lets MCP catalogs change between turns without changing the model's eager tool prefix.
## What changed
Add the disabled-by-default `code_mode_only_strict_3p_tools` feature, applied only when the effective model tool mode is Code Mode Only.
- Defer eligible MCP, app, and client-supplied dynamic tools while keeping them discoverable and callable through `exec`.
- Override `deferLoading`, MCP/app `omit_tools_from`, and direct-only or excluded namespace settings. Log conflicts without adding prompt warnings.
- Preserve disabled, app-only, policy-denied, and over-budget tool restrictions. Keep built-in tool exposure unchanged, including when a dynamic tool has the same name.
## Testing
Add unit and integration coverage for exposure overrides, effective model modes, tool eligibility, and app discovery and dispatch. Add an MCP refresh scenario that verifies the eager tool prefix stays unchanged as tools are added, replaced, and removed while `exec` tracks the current catalog.
GitOrigin-RevId: a6a8e401214119bb02ea4711473c8fa3ec85c81a
Register `incremental_tools` as an under-development feature that is disabled by default, and expose it in the configuration schema for top-level and profile feature settings.
GitOrigin-RevId: 9579822c745e9fce598085bdc5ef8da6aabb06d7
## What changed
Add the disabled-by-default `guardianv2_decisions_comparison` feature to run Decisions alongside Guardian V2 snapshot classification using the same policy and evidence. Initialize the comparison sampler with `CODEX_GUARDIAN_DECISIONS_API_KEY`.
Publish the baseline score before awaiting comparison results, and keep comparison results and failures from changing approvals. Apply Guardian's input token budget, skip conversation evidence, and cancel comparison work when the baseline classification is superseded. Record success, failure, and skip outcomes with bounded diagnostic reasons, including setup failures.
## Testing
Add lifecycle tests covering disabled comparison, disagreeing classifications, backend failures, unchanged published scores, matching policy and evidence, and rejection of over-budget requests before either backend sends them.
GitOrigin-RevId: 743d34c8ee440362da94f001058366027b39bd11
## Why
Subagents spawned without forked history do not receive their parent's client-defined dynamic tools, preventing them from using those tools for delegated work.
## What changed
Add the disabled-by-default `multi_agent_v2_dynamic_tools` feature flag. When enabled, fresh V2 subagents inherit the parent's dynamic tool definitions and persist them in session metadata.
## Testing
Add coverage for V1 and V2 feature gating, tool persistence, and a fresh V2 subagent calling an inherited tool and receiving its result without inheriting parent history. Update TUI assertions and a snapshot to reflect blank-line separation and question text in recovered answers.
GitOrigin-RevId: a17a16bf5570f54ce922c1521cffb883022354f2
## What changed
- Mark `api_key_model_discovery` as stable and enable it by default, while preserving explicit user opt-outs and provider catalog requirements.
- Fall back to bundled models when discovery is disabled at runtime, including when a remote catalog has already been loaded.
## Testing
Extend model-list coverage for default enablement, app overrides, and user configuration precedence. Add a regression assertion that runtime opt-outs hide loaded catalogs without additional fetches, and update daemon compatibility tests for the new default.
GitOrigin-RevId: feaf732757792cc58063f21a5327d0e633f079f4
## What changed
- Add `features.guardianv2.async_classifier_mode` with `snapshot` and `conversation` modes. Local configuration overrides model defaults; snapshots remain the fallback.
- Retain completed classifier requests and responses in conversation mode, appending transcript deltas without repeating previously delivered user instructions.
- Rebuild retained history when authorization, classifier instructions, or parent compaction changes, after an incomplete response, or when the next request exceeds the configured token limit. Add `async_classifier_conversation_token_limit`, defaulting to 100,000 tokens, while preserving the model's input limit for fresh requests.
- Serialize conversation requests in observation order, bound outstanding work, and reject stale work after authorization changes or thread shutdown. Record retained and new input token costs.
## Testing
Add tests for configuration precedence, history reuse and resets, ordered admission, queue overflow, and stale or stopped requests. Exercise the approval matrix in both modes, including resume, fork, mandatory review, authorization changes, and stream failure after an early score.
GitOrigin-RevId: 35b9800104648cde4f467086e678dee12458c3e5
## What changed
Register `browser_annotation_api` as a stable, default-enabled feature intended for requirements rather than user configuration. It controls websites opening and customizing annotation tools in desktop apps, independently of ordinary user-driven annotation.
Add the key to the configuration schema, extending the browser requirements support introduced in https://github.com/openai/codex/pull/18956.
## Testing
Extend `browser_feature_requirements_are_valid` to verify that enterprise requirements setting `browser_annotation_api = false` disable the feature.
GitOrigin-RevId: 8c7bb65932e08560040958b4472fe45f6d1c916f
## What changed
Register `in_app_voice` as a stable, default-enabled feature and add it to the configuration schema. The gate is intended for managed requirements to control permission for voice in desktop apps; permission does not establish voice availability or provider support.
## Testing
Add app-server coverage for reporting `in_app_voice = false` from `requirements.toml` in both requirements and feature-list responses. Extend the CLI feature-list test to verify that cloud-managed requirements disable the gate despite a user-configured `true` value, without rewriting the user configuration.
GitOrigin-RevId: 6ec3bc0176fdb3e1714b0136bf812bd56591f6a1
## Why
Refreshing available model descriptions changes the `spawn_agent` tool schema. Keep model choices current while preserving tool definitions and earlier conversation input.
## What changed
- Add the disabled-by-default `model_catalog_in_context` feature for multi-agent V1 and V2. When enabled and model overrides are available, move model listings from tool descriptions into developer `<model_catalog>` messages.
- Include picker-visible, compatible models with descriptions, reasoning efforts, and service tiers in a listing bounded to 1,000 bytes. Point `spawn_agent` guidance to the latest catalog.
- Append updated listings only when their rendered content changes, restore missing listings, and invalidate retained catalogs when they no longer apply.
## Testing
Extend integration coverage for V1 and V2 with the feature enabled and disabled. Verify that catalog refreshes preserve tool definitions and prior input when enabled, append the updated listing once, and retain the existing tool-description behavior when disabled. Add a request-history snapshot for the V1 opt-in path.
GitOrigin-RevId: 67b11b4ad6c35f00d0e29edf6343bb0b4804d797
## What changed
Forward explicit `cyberAccessProgram` selections for the built-in OpenAI provider when both `api_key_cyber_access_programs` and `api_key_model_discovery` are enabled. The new feature defaults to disabled and can be toggled through the app server's experimental feature enablement API.
Reject explicit selections in OpenAI API-key sessions when either feature is disabled, instead of silently omitting the program. Leave entitlement and model restrictions to the server, and preserve the requested program when a server rejection triggers transport retries.
## Testing
Add app-server coverage for both feature gates, forwarding all three program values, and server rejection without fallback. Update core coverage for API-key resumes with disabled features and custom-provider omission.
GitOrigin-RevId: aa639afb841aa651b28f6f3f61198299372baa2d
## What changed
Register `login_shell_package_path` as a disabled-by-default experimental feature and add it to the configuration schema. Expose it in `/experimental` as “Bundled tools in login shells,” with a description explaining its intended use when login shell startup resets `PATH`.
## Testing
Extend the experimental feature metadata snapshot test to cover the new feature's label, description, and unchecked default state.
GitOrigin-RevId: dc110486ccd8d2d76ac788ba5a413a1374699ff8
## What changed
Add `features.multi_agent_v2.message_board_remote` with a board URL and a bearer token supplied directly or through an environment variable. When configured, use the remote board in preference to local or in-memory storage, including in ephemeral sessions, while preserving the existing board tools and session identity.
Ignore remote board settings in project-local configuration and use the runtime HTTP client and clock for remote requests.
## Testing
Add a mock-server integration test and snapshot covering an ephemeral session posting through the existing tool, with the expected bearer authentication, session identity, timestamp, and returned post.
GitOrigin-RevId: 263413d90a1ee4c0bdba8c1b08ba9f68bdd7a986
## What changed
Add the disabled-by-default `guardian_root_handoff_context` feature to select worker-specific root evidence for Guardian reviews. Use recorded `spawn_agent`, `send_message`, and `followup_task` calls targeting a worker or its ancestors to select the three preceding root messages per handoff, plus the three latest root messages so recent cancellations remain visible before another handoff.
Preserve verified tool answers and evidence without known ordering, and retain the existing shared message cap. Fall back to the existing root context when no usable handoff window remains or the latest authorization message is a heartbeat. Update the review context revision when the selection changes.
## Testing
Add a delegation scenario and Guardian request snapshot covering ancestor handoffs, separate worker branches, cancellation visibility, and fallback after compaction removes handoff calls. Extend heartbeat coverage to exercise the new feature and verify that the latest turn's trusted skills are retained.
GitOrigin-RevId: 87dc39158f78b2b7e9f4f2e4afc653257ea12025
## Why
The transcript supplied to Guardian may omit earlier user instructions, restrictions, or revoked permissions. History retrieval lets the reviewer check relevant authorization before approving actions with side effects.
## What changed
- Add the disabled-by-default `guardian_conversation_history_tools` feature. With Apps enabled, expose `user_message.search_messages` and `user_message.read_messages` through the parent's live Apps connection and conversation identity.
- Recheck the parent's current app and tool policy on each call, rejecting disabled tools and calls requiring approval.
- Add retrieval instructions that distinguish user authorization from assistant context and account for later revocations and incomplete results. Allow overrides through `auto_review.experimental_conversation_history_prompt`.
- Limit history responses to an estimated 4,000 tokens by default, configurable through `auto_review.conversation_history_max_output_tokens`, while preserving stricter parent and reviewer limits.
- Allow explicit extension registries for isolated sessions and prevent those sessions from inheriting the implicit Apps connection.
## Testing
Add scenarios covering history tool exposure, parent connection and identity reuse, custom prompts, output truncation, stricter reviewer budgets, and live permission changes on a reused reviewer. Extend configuration coverage for blank prompt overrides.
GitOrigin-RevId: 055a69b113c8548bd58e7d5618ea026ba6d1ffb1
## What changed
- Add `CodexThread::prewarm_with_history()` to prepare a WebSocket response with existing conversation history and executed-tool metadata using `generate: false`. The next turn can reuse the prepared response when its prompt extends that history and request settings match.
- Keep startup prewarming and `prewarm()` on the existing empty-input path, and skip preparation when the cached WebSocket is ready.
- Label prewarm telemetry by input mode and WebSocket continuation metrics with `after_prewarm`.
- Rename `persistent_mode_enabled` to `persistent_execution_enabled` without changing its behavior.
## Testing
Extend WebSocket coverage to check history preservation during reconnect prewarming, reuse of the prepared response on the next turn, and omission of `previous_response_id` for a non-prefix prompt.
GitOrigin-RevId: c7731541b11b2e6668027a47f37f696213268c66
## Why
Guardian reviews need to retain original evidence across parent compaction when checkpoint reuse is disabled, including after resume and rollback.
## What changed
- Make disabling `guardian_reuse_parent_compaction` select a bounded, independent review transcript while preserving thread-owned authorization.
- Keep synchronous reviews and asynchronous scoring independent of parent checkpoints, and allow reviewer sessions to continue using transcript deltas across parent compaction.
- Persist transcript entries with rollback provenance while remaining compatible with older checkpoint readers and metadata-free checkpoints.
- Exclude compaction output from the transcript and synthetic summaries from rollback turn boundaries. Use acceptance ordering to remove rolled-back evidence even when persistence order differs.
## Testing
Add regression coverage for reviewer continuity, evidence retention across compaction and resume, rollback after local and remote compaction, and checkpoint serialization compatibility.
GitOrigin-RevId: fea0852cc5537372854f4a34bacb6bfda6d13e88
## What changed
Add `Features::persistent_mode_enabled` and use it for persistent instructions and current-time reminder defaults. Enablement still requires `ReasoningEffort::Persistent`.
Change `PersistentModeState::new` to accept an explicit enablement boolean, separating instruction rendering from reasoning-effort selection.
## Testing
Update persistent-context tests to use boolean enablement while preserving coverage for instruction replacement, removal, deduplication, and retained history without a snapshot.
GitOrigin-RevId: f412b90d783438d1526956a56c11b9e66385ee0e
## Why
With `instant_interrupt` enabled, new user input should reach the model without waiting for an unfinished response or stream retry backoff.
## What changed
- Interrupt request setup, response streaming, and retry backoff when user input arrives, then continue the turn with the queued input.
- Reset the WebSocket connection and continuation state after preemption so the next request sends full history.
- Drain pending input after a preempted step even when compaction leaves the estimated context above the token limit.
## Testing
Add regression coverage for WebSocket reconnection with full history, interrupted retry backoff, input queued during compaction, and yielding running code-mode calls. Add a streaming scenario that preserves completed commentary while excluding unfinished assistant text from the replacement request.
GitOrigin-RevId: b7e42b6afffbf87da15af05e0850af8579d1353f
## Why
User input queued during a long-running code-mode `exec` or `wait` can remain pending until the call returns. Allow these calls to yield early so Codex can receive the new input while the cell continues running.
## What changed
- Add the `instant_interrupt` feature flag, disabled by default.
- Watch queued user input for each sampling request and pass a shared preemption signal to code-mode `exec` and `wait` calls, including calls received later in the same response.
- Yield running cell IDs without stopping the cells, allowing subsequent `wait` calls to collect their results.
## Testing
Add integration coverage for enabled and disabled behavior, repeated steering during `exec` and `wait`, input deferred during compaction, and later calls in the same response. Verify that direct tool results and queued user messages are preserved, and add a scenario snapshot showing continuation after a cell yields.
GitOrigin-RevId: e33466a980d98e113bfb6c6a45c59de0cc7b3c1d
## Why
Ephemeral sessions cannot use the SQLite-backed agent message board. An in-memory backend lets agents share discussions without creating durable board storage.
## What changed
- Add the opt-in `message_board_in_memory` setting to the multi-agent v2 configuration, allowing the board to run in ephemeral sessions when both required features are enabled.
- Share board state across agents in the same tree and release it when the last handle is dropped.
- Implement channels, posts, subscriptions, notifications, search, and paginated reads through the existing `AgentMessageBoard` interface, including request deduplication.
## Testing
Add coverage for shared handles, concurrent request deduplication, tree isolation, and state release. Run existing query and tool test cases against both backends, and extend the parent/child scenario to verify ephemeral board sharing without creating a board database.
GitOrigin-RevId: d0b2083f8ea5b1c5a3a70f258ef738b87ea74cef
## Why
Fixed schema budgets can strip parameter descriptions from large MCP tools or render their Code Mode input types as `unknown`. Allow larger budgets to preserve that guidance.
## What changed
- Add `mcp_servers.<name>.tool_input_schema_max_bytes` to configure the UTF-8 byte threshold for best-effort input schema compaction, retaining the 5,000-byte default.
- Add `features.code_mode.tool_input_schema_max_bytes` for rendered input types. Use the largest of the 16,000-byte default, the Code Mode setting, and the ordinary MCP server's explicit setting.
- Apply rendering budgets to prompt declarations and the runtime tool catalog, and avoid reusing cached declarations after the Code Mode budget changes.
## Testing
Add coverage for UTF-8 compaction thresholds, budget precedence, configuration round trips, and preservation of parameter guidance in both the Code Mode prompt and `ALL_TOOLS`.
GitOrigin-RevId: 0ef2823a614d4794e636f518b09c0b03a5239b45
## Why
Agent messages arriving during a response can interrupt sampling at reasoning or commentary boundaries, cutting off remaining tool calls.
## What changed
Add the disabled-by-default `defer_mailbox_preemption` feature flag. When enabled, sampling continues past these boundaries and queued agent messages reach the next model request alongside completed tool results.
## Testing
Add streaming scenarios and snapshots for reasoning and commentary boundaries with deferral enabled and disabled. Verify that deferral preserves the planned tool call and that both queued messages arrive in order in the next request.
GitOrigin-RevId: d6846dd73b3afb47e7293f3b1aa2abcd04e37853
## What changed
Promote `write_stdin_approval` to stable and enable it by default.
## Testing
Update the stdin approval suite to rely on the default feature setting. Adjust the background network approval test to account for terminal input review before network access and explicitly wait for the network assessment.
GitOrigin-RevId: 1bb449f6d9ecf4ee451e84f95f839a6744877e8b
## What changed
- Move `Provider` and `RetryConfig` into `codex-client`, retaining re-exports from `codex-api`, and switch `codex-model-provider-info` to depend on `codex-client`.
- Move feature-state metric emission into `codex-core`, preserving its behavior while removing the `codex-features` dependency on `codex-otel`.
- Explicitly enable TLS features for `tonic` in `codex-config` and `reqwest` in `codex-http-client`.
- Enable `png`'s `zlib-rs` feature directly in `codex-utils-image` to keep encoded PNG bytes stable when WebSocket dependencies are absent.
GitOrigin-RevId: 91fd63ab01b55d516b3e80e3644d06af8d5a01f6
## What changed
Remove the session-level capture mode and make thread-owned retained context the default throughout history management. Simplify input ordering, compaction identity preservation, fork handling, and approval freshness checks by removing legacy capture branches.
Keep checkpoint compatibility review separate: unknown or incompatible checkpoints can still use legacy review while retaining user evidence. Set the already-removed `guardianv2.thread_context` feature's default to false and remove redundant opt-out test variants.
## Testing
Update checkpoint tests to exercise legacy review through restored checkpoint data. Adapt existing compaction, resume, rollback, and fork tests to use unconditional context capture.
GitOrigin-RevId: ab23a0d7aca71d5a103458cff8b0c68137dd9708
## What changed
- Deprecate and ignore `features.guardianv2.thread_context`, including profile overrides, with a migration notice. Ignore managed requirements for the removed flag with a warning.
- Preserve surviving legacy root instructions across compaction and resume when retained instructions are incomplete. Include unmatched instructions in worker authorization context with an explicit unknown-ordering notice, without replacing newer retained facts or expanding the reviewer's model window.
- Use surviving source calls to roll back verified answers from older checkpoints that lack acceptance-order metadata.
## Testing
Add regression coverage for legacy instruction recovery, compaction and resume, source matching, and answer rollback around same-turn user input. Update configuration and Guardian review tests to verify that the deprecated opt-out still uses thread-owned context and rejects incompatible compaction evidence.
GitOrigin-RevId: a65936c9e0b912e7667d1385a2ec53df726565de
## What changed
Add `features.multi_agent_v2.disable_direct_message`, defaulting to `false`. When enabled, omit `send_message` and `followup_task` while preserving spawning, automatic child results, and the remaining agent management tools.
Require an available message-board `post` tool when this option is enabled for sessions using multi-agent v2 collaboration tools, exempting internal worker sessions.
## Testing
Extend configuration parsing tests and run the message-board subscription/resume scenario with direct messaging both enabled and disabled. Verify post search, subscription behavior, and which collaboration tools are exposed.
GitOrigin-RevId: 72ec22ef0b92fa81e02cdeb058d8b4f93aca3be6
## What changed
Add the default-off `features.prefer_mxc` flag to select MXC for local Windows execution when native support is available and effective network settings do not explicitly forbid local binding. Otherwise, retain the configured backend and legacy setup behavior.
Resolve the preference during config loading and use the effective local backend for execution, network proxy setup, sandbox diagnostics, and `windowsSandbox/readiness`. Preserve the configured backend for remote executors and `config/read`. Explicit `windows.sandbox = "mxc"` remains strict, and command failures do not trigger backend fallback.
## Testing
Add coverage for preference resolution, startup readiness without rewriting configuration, local and remote backend selection across environment updates and child threads, and workspace-write permission context in an agent turn.
GitOrigin-RevId: b51178f0371d38ebb58e41af54a068fca67fa316
## What changed
Mark `guardianv2.thread_context` as stable and enable it by default for synchronous and asynchronous Guardian reviews. Keep it independent of the Guardian v2 `enabled` toggle and preserve explicit configuration and profile overrides. Update the configuration schema documentation to match.
## Testing
Update coverage for default configuration and sender user messages, review prompt snapshots, history retention across compaction, and checkpoint provenance. Assert that later user input invalidates an in-flight review's authorization. Keep legacy transcript budgeting coverage by explicitly disabling thread context in that test.
GitOrigin-RevId: 19afd34d7bfc0ee36bbf878089c68b732a21bc6a
## What changed
Promote `daemon_auto_start` to stable and enable it by default for eligible interactive launches. Remove its entry from `/experimental`.
## Testing
Update daemon startup, `--no-daemon`, and startup failure tests to exercise the default without explicitly enabling the feature. Disable daemon startup in unrelated TUI and path-safety test fixtures.
GitOrigin-RevId: 107d71108b96d09431148d7d61f10c6381929e05
## What changed
- Register the existing message-board tools with the app server through a lifecycle extension, gated on `agent_message_board`, multi-agent v2, and non-ephemeral sessions. The new feature flag is disabled by default.
- Bind tools to each agent's identity and share the SQLite-backed board across the agent tree and runtime resumes.
- Use the runtime clock for posts and deliver ID-only notifications to running agents, with tools to retrieve post contents. Skip inactive recipients without starting them or queuing notices.
- Emit a warning and leave board tools unavailable if initialization fails.
## Testing
Add runtime scenarios and a context snapshot covering feature gating without creating storage, posting and searching, active-only notifications, sharing with child agents, persistence across resume, and clock failure without channel creation.
GitOrigin-RevId: a81bd85cd372b0d122ba375ed1a1bfd3ba3a3b7c
## What changed
Use `tui.fullscreen_transcript` to opt into the fullscreen transcript, including scrolling, selection, and search. It defaults to `false`; `--no-alt-screen` and `tui.alternate_screen = "never"` still take precedence.
The new preference controls both the first frame and application startup. Boolean CLI overrides for it are allowed during daemon startup. The old `features.transcript_v2` flag is deprecated and ignored, with a notice directing users to the new setting; it does not migrate into or override the preference.
## Testing
Add coverage for default terminal scrollback, fullscreen persistence through startup, alternate-screen restrictions, daemon override validation, and independence from the deprecated flag. Update existing history and activity tests to use the new preference.
GitOrigin-RevId: 4117bf1ee548fa8d101a594f9506673d87c74c15
## Why
Login and enterprise configuration bootstrap can fail when their endpoints are reachable only through the system proxy, before cloud configuration can enable `respect_system_proxy`.
## What changed
- Enable `features.system_proxy_fallback` by default, honor managed feature requirements, and prevent project configuration from changing it.
- Retry account discovery and cloud configuration GETs through the system proxy after connection failures or timeouts, bounding the initial request and body read to five seconds.
- Retry OAuth authorization-code exchange only on connection failures before any redirect, with a ten-second connection timeout. Reuse the successful client for the subsequent API-key exchange to avoid changing routes.
- Increase workspace discovery and cloud configuration timeouts to 15 and 20 seconds, respectively, to accommodate fallback.
## Testing
Add coverage for proxy-only browser login through the first completed turn, including cloud configuration enabling `respect_system_proxy` without a restart. Cover stalled GET bodies, preserved request headers, disabled fallback, managed requirements, and project configuration restrictions. Verify that OAuth HTTP errors, redirects followed by connection failures, and failures after sending the POST do not trigger proxy retries, while successful redirects remain supported.
GitOrigin-RevId: 854eeeac186bb4865218ce645019c1e4bff85425
## Why
MXC's native host-loopback access is bidirectional, so it cannot enforce `allow_local_binding = false`. Treating an omitted setting as `false` prevents managed networking from working with the default configuration.
## What changed
- Preserve an omitted `allow_local_binding` until the executor's sandbox policy is known. Default to `true` for Windows MXC and `false` elsewhere, including remote execution.
- Reject an effective `false` for MXC managed networking after applying policy restrictions, without enabling disabled networking.
- Use the executor's resolved value for remote network approval decisions while preserving explicit controller restrictions.
- Document that local binding permits local servers and direct host-loopback connections and skips additional private-network destination checks; proxy domain rules still apply.
## Testing
Add coverage for per-executor defaults, explicit values, MXC rejection of `false`, and remote network review cleanup with the resolved policy.
GitOrigin-RevId: 0fa7c1eaec68bebada2b8f7af45688315eea70a9
## What changed
Promote `guardian_reuse_parent_compaction` to stable and enable it by default, allowing Guardian to reuse encrypted parent compaction when restarting review sessions.
## Testing
Update Guardian tests to rely on the default setting, including evidence retention after compaction and resume. Adjust cache-key assertions to verify that parent-history changes invalidate cached review sessions by default, while explicitly disabling reuse preserves the previous behavior.
GitOrigin-RevId: 196aff1e91d022490b3782f6c7b5f168907efab9
## Why
Code-mode responses show host duration without exposing time spent outside the host, including app-server waiting.
## What changed
- Add `features.code_mode.experimental_show_cell_overhead`, disabled by default, to show handler duration, host duration, and their difference in `exec` and `wait` response headers.
- Reuse the completed handler measurement from tool-call logging, excluding dispatch waiting, and capture it even when logging is disabled.
- Preserve the existing timing format when the option is disabled or host timing is unavailable, and preserve boolean feature toggles when merging nested code-mode configuration.
## Testing
Add coverage for timing headers, zero and missing host measurements, negative rounding differences, content preservation, and configuration merging. Extend app-server tests across gRPC and stdio to verify timing includes post-host elicitation waiting, and add a response snapshot for successful execution and a failed wait.
GitOrigin-RevId: 929b84784d9c6077cf2b5927a90bd2d5f3870078
## What changed
- Add `features.daemon_auto_start`, disabled by default and available through `/experimental`, to start the shared local server for eligible new, resumed, and forked sessions. Changes take effect on the next launch, and disabling the feature persists an explicit `false`.
- Require successful daemon startup and connection when auto-start applies. On failure, show guidance to rerun the same command with `--no-daemon` instead of silently falling back to an embedded server.
- Preserve embedded mode for excluded launches, including Bedrock sign-in, and carry exclusion warnings through resume and fork pickers. Honor `--no-daemon` without an exclusion warning.
- Update `/import` guidance to recommend restarting with `codex --no-daemon`.
## Testing
Add CLI and TUI coverage for automatic daemon attachment, startup and connection failures, `--no-daemon`, picker warning persistence, and Bedrock onboarding with and without a running daemon. Add snapshots and configuration-write assertions for the experimental toggle.
GitOrigin-RevId: 2e8eb163bc7ddd268a86c7546c05a85356c1e9ee
## Why
Clock provider failures can abort a turn while preparing time context or running clock tools. Allow turns to continue with an explicit indication that the current time is unavailable.
## What changed
- Add `features.nonfatal_clock_read_errors`, disabled by default, to report clock failures to the model without failing the turn.
- Emit a generic `failed to read current time` notice for context reads and tool errors, without exposing provider error details. Deduplicate context notices per turn and compaction window, and remove inherited notices from forked subagent context.
- Omit unavailable environment dates and explicitly clear previously visible dates with `<current_date status="unavailable" />`.
- Return external sleep clock failures to the model when the feature is enabled, preserving sleep item completion notifications.
## Testing
Add coverage for continued inference after clock failures, notice deduplication across compaction, subagent notice filtering, environment date removal and recovery, and sleep failures during initial and polling reads.
GitOrigin-RevId: a39c3723c06a6f786d8ad59d667e8b9f626c973e
## What changed
- Accept and ignore `features.personality` in user configuration, profiles, and managed requirements.
- Remove feature gating from `personality = "none"`, which strips the literal `# Personality` section when preparing model catalog instructions. Preserve explicit base instructions and existing thread instructions.
- Document deprecated personality fields in configuration, app-server schemas, and the Python SDK: `friendly` and `pragmatic` no longer select a style, and `supportsPersonality` is always `false`.
## Testing
Add regression coverage for ignored legacy flag values and managed requirements, personality opt-out behavior with the flag absent or set to either value, role overrides, and preservation of explicit base instructions, including empty strings.
GitOrigin-RevId: 4e12c66b42bfc59d6f151a5b3c28fadc6654ae99
## What changed
- Expose `analytics_plan_history` in the experimental features menu for previewing consumer five-hour and weekly allowance history in `/analytics`. Keep it disabled by default.
- Add `h` and `l` as left/right navigation aliases in analytics, preserving explicit bindings and honoring remapped or unbound arrows.
- Use terminal-aware footer key colors to keep analytics shortcuts readable on light backgrounds.
## Testing
Add navigation tests for arrow equivalence, custom bindings, modifiers, and key repeat. Extend light-background contrast assertions and update style snapshots. Add a snapshot for the plan history experimental feature entry.
GitOrigin-RevId: 310e64a43a7dd08c8a3fd1efed6985805f7dd580
## What changed
- Add consumer plan usage history behind `analytics_plan_history`, disabled by default, fetching seven days of five-hour and weekly allowance periods.
- Show period usage percentages with expandable breakdowns by feature, model, surface, or turn start, plus snapshot freshness and incomplete coverage indicators.
- Preserve unknown usage separately from zero and handle an unavailable history endpoint without blocking other analytics reports.
## Testing
Add backend and TUI tests for unavailable endpoints, response validation, feature and account gating, account changes during requests, period navigation, snapshot resets, and narrow and wide layouts.
GitOrigin-RevId: 7bea87a3407730b18040d7dda7e7dd0afe67fb2e
## What changed
- Replace dedicated Guardian endpoints with `/responses`, sending `x-codex-guardian: reviewer` or `x-codex-guardian: classifier` for eligible Codex backend requests over HTTP and WebSocket.
- Add model-scoped thread headers, recheck backend authentication on each request attempt, and reconnect WebSockets when the applicable headers change.
- Retain `features.guardianv2.free_guardian` for configuration compatibility while removing its routing gate; the backend now controls Guardian billing.
## Testing
Update tests for reviewer and classifier headers, model and authentication scoping, HTTP fallback, WebSocket reuse, and parent-response metadata across retries.
GitOrigin-RevId: 1c2b3c458ab77fb40aae4ee6784f6d827c60e76c
## What changed
- Mark `guardian_ext` as a removed compatibility flag.
- Remove `InternalSessionSpawner`, `InternalSessionSpawnFuture`, `ApprovalReviewInput`, and `ApprovalReviewError` from the extension API, along with the spawner test.
- Remove `NodeReplReviewEvidence::review_inputs` and make the core re-exports of `NodeReplReviewEvidenceMode` crate-private.
GitOrigin-RevId: 1c532bc57264644cf521ef8077285a9b8ed67391
## What changed
Add the disabled-by-default `send_message_to_user_async` feature flag so root agents can use the tool without model catalog support. Preserve catalog-based opt-in and keep the tool unavailable to subagents. Register the flag as under development and expose it in the configuration schema.
## Testing
Extend integration tests to cover feature and catalog opt-ins, deduplication when both are enabled, subagent exclusion, and the retired `send_async_message` flag. Check that either opt-in allows messages to be emitted without ending the turn.
GitOrigin-RevId: 3f53181ab074b0432c795550de73a9b1da7caf15
## What changed
Promote `realtime_conversation` to stable and enable it by default, removing its experimental announcement. Update popup and tooltip tests to use explicit experimental voice fixtures now that the feature is stable.
GitOrigin-RevId: 4e947189f41de465d1f343e95100b26d6200db24
## What changed
- Mark `worktrees` stable and enable it by default, removing it from `/experimental`. Point users who explicitly disable it to their Codex configuration.
- When a local daemon lacks `thread/backgroundTerminals/list`, block worktree creation and `/cd` with guidance to run `codex app-server daemon update` and restart Codex.
## Testing
Add regression coverage for unsupported local daemon methods, unrelated errors, embedded servers, and empty background terminal lists. Update feature-gating tests to disable worktrees explicitly and remove worktrees from the experimental menu snapshot.
GitOrigin-RevId: 3f21d0ebaa02da11a6aaa2e1ac615b4518fc98d8
## Why
Enterprise MCP authorization must remain controlled by host, user, or managed configuration. Project settings and plugin declarations must not redirect enterprise credentials or downgrade the selected authentication mode.
## What changed
- Add `auth = "ema_auth"`, shared `mcp_enterprise_managed_auth` IdP configuration, and per-plugin enterprise registration settings.
- Require enterprise registrations to come from one non-project configuration layer, preserve managed IdP precedence, and reject project overrides that change authorization or re-enable disabled enterprise servers.
- Add the disabled-by-default `use_xaa` feature flag and require non-project opt-in or a managed requirement.
- Reject plugin declarations that select `ema_auth`. Keep EMA connections unsupported and block ordinary MCP OAuth login and credential fallback for this mode.
- Extend the configuration schema and serialization for the new settings.
## Testing
Add coverage for IdP precedence, incomplete registrations, alternate credential validation, project-only opt-in, plugin self-declaration rejection, configuration round-tripping, and trusted-project attempts to downgrade enterprise auth to OAuth or ChatGPT auth.
GitOrigin-RevId: f193bdfda74208c98e496a23bf2916955b131a1c
## What changed
Add the default-off `api_key_model_discovery` feature and expose it through app-server experimental feature enablement, respecting user configuration overrides.
When enabled, fetch OpenAI API-key model metadata from the Codex backend, honoring explicit provider base URLs. Treat remote catalogs containing visible models as authoritative. When disabled at startup, skip discovery requests and cached catalogs and retain bundled models.
## Testing
Add coverage for feature enablement and user overrides, cached catalogs across sessions, provider routing, and API-key `model/list` results. Extend coverage for remote instructions and auth-specific cache isolation.
GitOrigin-RevId: 4b189c37c615a7f808cb6ff5f0858a9a55f36ebc
Charlie Marsh