## What changed
- Store the shared `GuardianReviewSessionManager` in thread extension data and let the Guardian extension spawn and fork reviewers through `ThreadManager`, independently of async scorer startup.
- Preserve reviewer reuse, concurrent forks, cancellation, inherited environments, and user instructions. Gate managed reviewer startup on parent registration and remove terminated reviewers from the manager.
- Retain the `guardian` subagent identity in saved conversations. Reject resume of live Guardian reviewers and reject client archive or delete of live owner-managed workers with JSON-RPC error `-32600`; allow normal access after the owner releases them.
- Keep standalone reviewer support for inline delegates and remove duplicated extension prompt and configuration code.
## Testing
Add app-server tests covering reviewer reuse and concurrent forks, inherited instructions and prompt cache keys, live resume and removal rejection, saved reviewer discovery and resume after parent shutdown, and strict Guardian assessment inside an inline review.
GitOrigin-RevId: 4f9893c1ade151eacb4c11ffeae3d9e9ec019187
## What changed
Delete `codex-rs/app-server/README.md` and remove references to it from `AGENTS.md`, while retaining the requirement to update app-server docs and examples when API behavior changes.
GitOrigin-RevId: 664f38c4939a9784b1241225e5101b97ec4ae9e6
## Why
Device-authenticated verification needs an app response outside automated approval and review. Previously, MCP user-verification requests were always cancelled.
## What changed
- Add typed `openai/userVerification` elicitations carrying a title, description, and challenge through core and app-server.
- Route verification to one connection enabled by trusted host activation. Restrict responses to that owner, exclude requests from replay, and cancel on disconnect or authentication changes, including account switches away and back.
- Return proofs in `content`, discard response metadata, and cancel malformed acceptances. Suppress verification response logging and analytics, and send only a generic verification notice to realtime.
- Keep the mode experimental and exclude it from stable schema exports. Capability advertisement remains disabled, and the TUI cancels verification requests.
## Testing
Add coverage for owner isolation, disconnect and authentication races, proof response handling, automated-review bypass, inactive-host cancellation, stable schema filtering, and realtime payload exclusion. Update the MCP integration test to verify that an activated request holds the tool until the client responds.
GitOrigin-RevId: c8c7b6691a3f7756682bbcca9def1df0d1feb906
## What changed
Add `userVerification/status`, `userVerification/enroll`, `userVerification/delete`, and `userVerification/verify` behind the `experimentalApi` capability. Define request, response, proof, and typed error contracts, export their schemas, and document the API.
All four methods currently return `unavailable` with reason `providerUnavailable`; native verification operations are not implemented by this change.
## Testing
Add tests for experimental opt-in, typed provider unavailability, readiness serialization, and rejection of mismatched error reasons and native diagnostic payloads.
GitOrigin-RevId: a858ab41523c5acec7dbf3cfa7fcab693ac44a8c
## Why
Calling `app/installed` with `threadId` and `forceRefresh: true` refreshed a separate runtime snapshot without updating the thread's tools for subsequent turns.
## What changed
Use the thread's current configuration and refresh its live app tools when a thread is specified. Account for the refreshed snapshot's model-visible tools when reporting `callable`. Requests without `threadId` continue to use a separate runtime for refreshes.
## Testing
Add integration coverage verifying that refreshed tools replace previous tools in subsequent model requests and can be called, and that a failed refresh preserves the last working tools. Extend thread configuration coverage to include forced refreshes.
GitOrigin-RevId: fc13e28a59da00af470cf25c0cde356504e1575b
## Why
Reverting a paginated thread can remove the turn context that records its resolved multi-agent version. Preserve that version so a model-selected V2 thread keeps its collaboration tools after reload or a server restart.
## What changed
Pass the live thread's `multi_agent_version` into the thread store and persist it in the replacement rollout's session metadata. When no live version is supplied, retain the existing metadata value. Document this guarantee for `thread/revert`.
## Testing
Add regression tests for model-selected V2 across live reload and cold resume, plus metadata preservation for `V1`, `V2`, and `Disabled` across repeated reverts.
GitOrigin-RevId: bd7d4d76a50d23da16caa2a0631acf10bfa49629
## Why
Clients need a per-thread Daybreak toggle that survives restarts and can be
restored on resume without changing the access program of an active or future
turn.
## What changed
- Add experimental `daybreakEnabled` support to `thread/metadata/update` and
expose the saved value on thread responses.
- Store the preference in SQLite, including for threads without a first turn,
and preserve it through reads, resumes, reconciliation, and restarts.
- Copy the preference when forking a thread while keeping subsequent updates
independent.
- Keep `daybreakEnabled` separate from the per-turn `cyberAccessProgram` field;
app-server does not derive one from the other.
## Testing
- Cover persistence across restarts, cold reads, reconciliation, and forks.
- Verify metadata updates do not alter the access program of active or later
turns.
GitOrigin-RevId: bcf987a9fcd7b0ac8a88b1c8f0df06b33ed8ad6e
## What changed
- Parse the optional `[browser_use].allow_webmcp` boolean from managed requirements and preserve requirement-layer precedence.
- Return the policy as `browserUse.allowWebmcp` from `configRequirements/read`, including explicit `true`, explicit `false`, and `null` when omitted.
- Update the generated JSON and TypeScript protocol schemas.
## Testing
- Cover parsing, invalid values, layered overrides, and app-server response serialization.
GitOrigin-RevId: a3fd7d1a6f838bb3ab0ac2a644409101a2338ca6
## Why
Cold `thread/resume` configuration loading can call back into the host. Holding the global metadata permit during that work blocks unrelated thread metadata updates and MCP requests.
## What changed
- Release the metadata permit while loading configuration for a cold resume.
- Reacquire the permit and reload the resolved thread history before startup.
- Reload configuration when persisted metadata, settings, or the history working directory changed during the unlocked interval.
- Rejoin a thread that another request resumed concurrently, and avoid reopening threads that were archived or deleted.
## Testing
Add coverage for unrelated metadata and MCP requests during a blocked config load, concurrent resume mutations, and the extra history read required for non-local thread stores.
GitOrigin-RevId: 8cbd3868eeff84968765b1e3dbc7590ebe5fa892
## What changed
- Emit a connection-scoped `deprecationNotice` when `review/start` uses
`delivery: "detached"`, including when validation later rejects the request.
- Preserve detached review behavior while directing callers to use `thread/start`
followed by an inline review for a separate review thread.
- Document the deprecation and migration options in the app-server protocol and
README.
## Testing
- Cover the notice for accepted and rejected detached reviews.
- Verify that omitted, null, and inline delivery do not emit the notice.
GitOrigin-RevId: 4234a09d2bb7ef8053091580175dc8cbe8d7512c
## Why
An empty tool map does not distinguish a successfully returned empty catalog from a server whose startup or tool discovery failed.
## What changed
- Add nullable `toolsError` to each `mcpServerStatus/list` entry when no catalog is available because startup or tool discovery failed.
- Keep `toolsError` null for returned catalogs, including cached and empty catalogs, and continue returning healthy servers when another server fails.
- Update the protocol schemas and generated TypeScript type.
## Testing
- Extend the app-server status integration test with a broken MCP server and verify its error without losing the healthy server's inventory.
GitOrigin-RevId: 30b4ca4d9a45cec6998f5f626d3fddbee90a525d
## Why
Loaded threads can retain their previous configuration after a local plugin is
installed, preventing the plugin's bundled MCP servers and pending user-config
changes from taking effect in the current session.
## What changed
- Reload user configuration for loaded threads after installing a local plugin.
- Refresh MCP and hook runtimes only after the new configuration is applied.
- Keep installation successful if configuration reload fails, while logging the
failure.
## Testing
- Verify an installed plugin's MCP tool can be called from a thread that was
started before installation.
- Update the hook runtime test to verify installation applies a staged hook
configuration change to the loaded session.
GitOrigin-RevId: 63f5a5c7f16303e51cf940e8d9dc3b45c50ae2a9
## What changed
- Add the creation-time `originator` to app-server thread responses and `thread/started` notifications.
- Persist originators in thread metadata and preserve the first recorded value across list, read, resume, rollout, and SQLite paths.
- Add an `originators` allowlist to `thread/list` for hosted backends. The local app-server accepts omitted or empty values but rejects nonempty filters.
## Testing
- Cover originator persistence across server restarts and list, read, and resume requests.
- Verify local `thread/list` handling for nonempty, omitted, null, and empty originator filters.
- Heap-allocate large TUI dispatcher futures in affected tests to keep them within the Windows test-thread stack.
GitOrigin-RevId: 73ad6e61b8fdd2d93a22d1f971723a19ec7be3fc
## What changed
- Add `application.network` managed requirements with exact-domain allow/deny
rules, default-enabled behavior, domain normalization, and normal managed TOML
precedence.
- Return the policy separately from agent network requirements through the
experimental `configRequirements/read` API. The endpoint reports the policy
but does not enforce it.
- Export the new protocol types and schemas, and document the TOML format.
## Testing
- Cover parsing, validation, normalization, layered precedence, and cloud
requirement composition.
- Verify app-server responses, defaults, separation from agent policy, and
rejection of invalid domains.
GitOrigin-RevId: 563eeed296d9748430b819797204a44a8db92f3b
## Why
The managed app-server daemon and automatic TUI attachment were limited to
Unix, so Windows users could not share a background server across Codex
sessions.
## What changed
- Enable daemon lifecycle commands, `codex agents` startup, and AF_UNIX daemon
discovery on Windows.
- Require Windows daemons to start non-elevated and verify the discovered
socket directory and peer before connecting.
- Preflight detached process support, preserve path-based environment settings,
and keep daemon processes out of the launching project's working directory.
- Fall back to an embedded server when an implicitly discovered daemon cannot
connect, while preserving errors for explicit remote endpoints and bypassing
daemon reuse when `CODEX_EXEC_SERVER_URL` is set.
## Testing
Add coverage for Windows launch restrictions and socket validation, implicit
connection fallback, executor selection, daemon discovery, and the agents
dashboard startup result.
GitOrigin-RevId: e7fd63cf8690bcca8b5155266416f31f2f792aa2
## What changed
- Add the experimental `Thread.environments` field with each selected environment's ID, working directory, and runtime workspace roots.
- Populate the field from live thread state in start, resume, read, list, and unarchive responses. Use `null` for unloaded threads and an empty list when a loaded thread has no environment selection.
- Document that the field reports selection rather than connection status and does not affect executor selection or resume behavior.
## Testing
- Cover selection updates, unloaded and resumed threads, loaded pathless unarchives, and clients that subscribe after environment connection notifications.
GitOrigin-RevId: a6daa06aff7089d7c5a1e4c7d03109b41f12fa3c
## What changed
- Remove the per-thread `RealtimeConversation` feature check when starting a realtime session.
- Retain `features.realtime_conversation` as a removed compatibility setting that has no effect, even when set to `false`.
- Document the always-available behavior for `thread/realtime/start`.
## Testing
- Cover realtime startup on forked and cold-resumed threads with the legacy setting absent, disabled, or enabled.
GitOrigin-RevId: d9cd9aa3898d1c2efb9414a8f40c86be8951e210
## Why
When ordinary included usage is exhausted, eligible users need a way to keep working with the backend-provided Luna Reserve quota and return to their previous model once ordinary usage recovers.
## What changed
- Automatically switch eligible TUI tasks to Luna Reserve after an authoritative account usage read, preserving the prior model and reasoning effort per task.
- Restrict model selection while on Reserve to its supported reasoning levels, keep queued turns on the accepted model, and restore the saved model after a fresh read confirms recovery.
- Surface Reserve usage in the composer and `/status`, and expose `normalModelSlug` in app-server rate-limit snapshots so clients can use the associated model's display metadata without changing the request model.
- Poll account limits more frequently near exhaustion and retain compatibility with app servers that only accept the legacy null request parameters.
## Testing
- Added coverage for Reserve entry, queued-turn handling, task reconstruction, recovery authorization, account changes, model selection, usage rendering, and banner dismissal.
GitOrigin-RevId: 46a435e9531051f8cec3f6a46c4b9f7cfa479747
## What changed
- Accept optional `account/rateLimits/read` capabilities for Luna Reserve support
and lightweight background polling while preserving omitted and `null` params.
- Forward the Luna Reserve capability only for eligible ChatGPT sessions, and let
lightweight polls skip the separate reset-credit detail request.
- Return the backend's `ordinaryUsageAllowed` decision only when its account and
user identity match the active session.
## Testing
- Cover capability defaults, eligible and restricted authentication modes,
lightweight polling, identity filtering, and backend permission handling.
GitOrigin-RevId: f407a3ae1e70e411fdf245f072a16e453f59cd87
## What changed
- Add the default-off `windows_sandbox_service` feature and expose it through
app-server experimental feature enablement.
- When enabled, attempt service provisioning during elevated Windows sandbox
setup, using the effective network proxy ports and listener roles. Continue
through the existing setup path when the service is unavailable or the
configuration is unsupported.
- Report unsupported Codex home drives as service unavailability so the client
can fall back to the elevated helper.
## Testing
- Add a Windows-only unit test covering HTTP and SOCKS listener derivation from
the effective proxy configuration.
GitOrigin-RevId: 40b119cf51f84e5d0e94d6a0a8d5b506d1123526
## Why
Reasoning configuration changes need to retain their position and trusted provenance when model history is persisted and replayed. Client-injected history must not be able to forge these controls.
## What changed
- Add a typed `configuration_update` response item carrying reasoning effort, including custom model-defined values.
- Persist harness-authored updates with provenance and preserve them across history reconstruction, thread resume, raw response notifications, and agent forks.
- Exclude untrusted configuration updates from model history, strip client-supplied provenance metadata, and reject configuration updates supplied as turn input.
- Export the new item through the JSON and TypeScript app-server schemas and classify it in telemetry and persistence metrics.
## Testing
- Cover serialization, provenance persistence, history filtering and rollback, resume reconstruction, and injection attempts before and after restart.
GitOrigin-RevId: eb5559d2b52b7a931621e7c9812f009ff9fb8939
## Why
Windows control sockets need a rendezvous directory that cannot be accessed or
replaced by another user while the listener is active.
## What changed
- Create socket directories with a protected, inheritable, current-user-only
DACL, and reject existing directories with broader permissions.
- Validate socket paths without following a junction at the rendezvous
directory, and pin the directory through listener cleanup to prevent
replacement after validation.
- Add a Windows peer check that verifies the kernel-reported peer process uses
the current user's non-elevated token.
- Document the Windows requirements for custom control socket paths.
## Testing
Add Windows coverage for ACL inheritance and rejection, junction and volume-root
rejection, extended-length paths, directory pinning, and elevated peer rejection.
GitOrigin-RevId: cc8dd76e5732c288f6346cfd6138051188533bfa
## What changed
- Add the top-level `thread_unload_delay_secs` configuration key for the
app-server, with a 60-second default instead of the previous 30-minute
fixed delay.
- Allow zero-delay unloading and reject values that cannot fit in a
monotonic-clock deadline.
- Reset the unload countdown when a thread gains a subscriber or becomes
active, and preserve active turns even when the configured delay is zero.
- Document that unloading ephemeral threads discards their in-memory state.
## Testing
- Cover configuration parsing, defaults, overrides, and overflow rejection.
- Cover unsubscribe, resubscribe, delayed and immediate unloading,
notifications, persisted-thread resume, and WebSocket disconnect behavior.
GitOrigin-RevId: edd46f6b49bbdafbf606bff74378e8f569e95977
## What changed
- Skip Guardian prewarming and asynchronous scoring when `approvalsReviewer` is
`"user"`, including when the reviewer changes during an active turn.
- Automatically accept ordinary `node_repl.js` execution confirmations in this
mode while continuing to surface sensitive-action checks and requests for user
input.
- Cover transitions between User approval, automatic review, and Full Access in
the app-server integration tests.
GitOrigin-RevId: 599c8ebb672728b9bf3d64c34377ddec230325f8
## What changed
- Replace `send_user_message_async` with `request_user_input_async`, accepting one or more questions with optional suggested answers while allowing the turn to continue.
- Attach structured question metadata to asynchronous agent messages while retaining readable fallback text, and preserve it through app-server events, thread history, and generated schemas.
- Continue enabling the new tool for model catalogs that advertise either the old or new tool name.
## Testing
- Cover tool registration, question validation, emitted items, continued turn execution, history preservation, and backwards-compatible deserialization.
GitOrigin-RevId: ffc49aebde2e854c3c50a122aa52805fec3fc6b3
## What changed
- Add nullable `model` and `reasoningEffort` fields to the shared app-server `Thread` object and generated schemas.
- Report current settings for loaded threads and the latest persisted settings for unloaded threads across thread read, list, start, resume, rollback, metadata update, and notification paths.
- Keep unavailable legacy or filesystem-only settings nullable, and allow metadata reads without loading a thread or dispatching queued work.
## Testing
- Cover live-setting precedence, persisted settings after restart, null legacy values, and model metadata returned by thread lifecycle operations.
GitOrigin-RevId: 22ebe8a8d1910a820d90a97730d812a00d8c1372
## Why
Configured Git marketplaces may be defined outside the user config, but those definitions could not download or update their snapshots.
## What changed
- Select marketplace source, ref, and sparse-path settings from the effective merged configuration for startup synchronization and explicit upgrades.
- Preserve the initiating operation's configuration loader and overrides when reloading before activation.
- Roll back activation if the marketplace definition changed or configuration can no longer be loaded, without copying settings into the user config.
## Testing
- Cover system-defined marketplaces, CLI overrides, startup fallback after invalid user configuration, and rollback after configuration changes.
GitOrigin-RevId: 53d1eecf68a91ce2aa8430e5749d78697bfcd821
## Why
Full Access already combines `approvalPolicy: "never"` with unrestricted
permissions, so confirmation-only actions do not require a model review.
## What changed
- Detect Full Access consistently across the thread and every selected
environment. Pending, failed, or restricted environments are not treated as
Full Access.
- Approve confirmation-only Guardian and MCP requests without synchronous
review, sampler prewarming, or background scoring. Cancellation, explicit
denials, and forms that require user input keep their existing behavior.
- Re-evaluate the active permission state on each turn so an existing thread
can enter or leave Full Access safely.
## Testing
Added coverage for switching approval modes, strict sensitive MCP
confirmations, failed and pending environments, and suppression of Guardian
requests and background-scoring connections.
GitOrigin-RevId: 089ab4296dde473b8e33ab8324be79c5446c46f6
## What changed
- Add `approvalsReviewer` to the experimental `turn/settings/update` API.
- Apply reviewer changes to subsequently captured steps and new background approval requests while preserving pending approvals and future-thread defaults.
- Allow reviewer-only updates without `step_model_switching`, while continuing to enforce managed reviewer restrictions and model-required auto review.
- Use an explicit live reviewer update for MCP approvals while retaining refreshed thread defaults for clients that have not set one.
## Testing
- Cover switching between user and automatic review during a live turn, future-turn isolation, and managed-authority rejection.
GitOrigin-RevId: e1216b09c6a7972c2c9eaf4955d8d57d60604ca1
## Why
When the remote Sites plugin is installed and its local bundle is available, exposing the bundled copy as well creates duplicate catalog entries and can load the wrong skills.
## What changed
- Persist an account- and backend-scoped exclusion for `sites@openai-bundled` once the remote replacement is installed and loadable.
- Apply the exclusion to plugin catalogs, search, direct reads and installs, runtime loading, hooks, and skill caches while preserving the remote plugin's server-owned enabled state.
- Restore the bundled fallback when the remote plugin is absent or its local files are unavailable, and throttle repeated availability checks for 60 seconds.
## Testing
- Added manager tests for persistence across restarts, account/backend isolation, fallback restoration, concurrent checks, and refresh throttling.
- Added app-server and agent-turn tests confirming that catalog, search, and skill loading prefer remote Sites.
GitOrigin-RevId: bc1154f79d3107910fee9fa27389a0ddb48ce6cf
## What changed
- Add `apps.<app_id>.links.<link_id>` configuration for overriding
`approvals_reviewer` and `default_tools_approval_mode` per connected account.
- Expose link settings through the app-server protocol and generated JSON and
TypeScript schemas.
## Testing
- Extend `config/read` coverage for populated, empty, and absent `links`
sections.
GitOrigin-RevId: 43004d2722439060fdadc5e5cd9ed3108774ecaf
## Why
Reports from a large thread tree can exceed the rollout attachment limit, making
the threads involved in a failed Guardian review harder to diagnose.
## What changed
- Prioritize descendants with retained failed reviews when selecting bounded
report rollouts, while always preserving the reported thread.
- Include each selected thread's available Guardian trunk rollout alongside its
conversation rollout.
- Add a thread index attachment with selected filenames, bounded omission details,
retained failure threads, and the process-wide discarded-record count.
- Link failed-review records to their reviewed turn and target item when available.
## Testing
- Cover failed-review prioritization, bounded omission metadata, discarded-record
accounting, and turn/item linkage in Guardian report records.
GitOrigin-RevId: ae7916c27a3c279e899cd5a6ead8a4b7e0cc26a1
## What changed
- Add the `plugin/reconcile` JSON-RPC method to synchronize installed remote plugin bundles and wait for required hook updates.
- Return affected plugin IDs with MCP, Apps, hooks, and skills refresh hints, plus remote update and materialization failures.
- Refresh loaded hook runtimes after relevant updates and return an empty result when plugins or backend authentication are unavailable.
## Testing
- Cover workspace and global bundle installs, unchanged passes, enablement changes, updates, removals, materialization failures, hook refreshes, and disabled plugins.
GitOrigin-RevId: 45c02518d71990d13eb09d56ed51505c91c66956
## What changed
- Retain bounded, process-local records for failed Guardian reviews, including the reviewed action, decision, status, model, instructions, and reviewer history.
- Add recent records from the reported thread and its descendants to log-enabled report uploads as `auto-review-failures.jsonl`.
- Preserve the action and decision while omitting oversized reviewer context, and exclude successful, ephemeral, and capture-disabled reviews.
## Testing
- Cover denied and invalid decisions, cleaned-up ephemeral reviewers, descendant-thread selection, record count and byte limits, and oversized-context fallback.
GitOrigin-RevId: 5f12f7605041c3c84e826e6bac1cf06b1518ab24
## Why
Realtime history should be recorded consistently for every Core host, including
when no app-server event listener is attached.
## What changed
- Move transcript segmentation, session boundaries, and backing-agent artifact
promotion into Core for paginated threads.
- Persist canonical realtime items through the thread store in event order and
emit dedicated history lifecycle events for hosts to present.
- Translate those Core events into the existing app-server realtime item
notifications without app-server persisting the items a second time.
## Testing
- Cover Core-only persistence across repeated sessions, ephemeral sessions,
accepted and rejected steering, typed input ordering, and artifact promotion.
- Verify app-server notifications correspond to the persisted timeline.
GitOrigin-RevId: 7cbef14129d77f6d6d7099b733be91f5279c55f5
## What changed
- Carry optional backend-owned banner and account identity data through
`account/rateLimits/read`, filtering banners that do not match the authenticated
account and user.
- Render supported rate-limit notices above the composer with actions for usage,
credits, resets, owner notifications, and plan management while preserving the
existing fallback UI for absent or unsupported banners.
- Refresh usage after limit errors, reject stale responses, and keep queued input
paused until recovery completes. When instructed by the banner, switch to the
first available fallback model without changing unrelated thread settings.
## Testing
- Add protocol, banner parsing and rendering, CTA, identity filtering, refresh
ordering, fallback-model, account-change, and queued-input recovery coverage.
GitOrigin-RevId: e03d75a82e425deb87f4b120a71cf2286c0ef6cc
## Why
Resuming a thread without an explicit `cwd` should restore that thread's latest
retained setting. Forked history can contain settings copied from another
thread, while compaction can move the latest setting outside the replay window.
## What changed
- Record the owning thread ID on new settings snapshots and only use snapshots
owned by the resumed thread when restoring `cwd`. Older snapshots without an
owner remain readable but do not override the startup `cwd`.
- Checkpoint the current settings after compaction and serialize checkpoints
with settings updates so the retained history contains an accepted, current
snapshot.
- Cover resume behavior across compaction, forks, reverts, legacy histories,
and concurrent settings updates.
GitOrigin-RevId: 1efc9cf55472d6b88c465c4efe44672a232dbf64
## What changed
- Advertise `openai/elicitation` form support when the client declares an
object-valued `form` capability, without deriving it from the legacy
`openai/form` capability.
- Handle `openai/elicitation/create` requests in `form` mode and forward their
metadata and opaque schema through app-server as `openaiForm`, preserving
`x-openai-*` annotations.
- Keep legacy form handling independent and have the TUI automatically decline
the new form requests it cannot render.
## Testing
- Add an app-server round-trip test for capability negotiation, request
forwarding, and accepted responses.
- Extend MCP capability filtering coverage for `openai/elicitation.form`.
GitOrigin-RevId: 88f39257bffafe4ee98a9c910e38507843cd7eeb
## What changed
- Add an optional `timeoutMs` parameter to `thread/shellCommand` and propagate it to user shell execution.
- Preserve the one-hour default when the parameter is omitted or `null`, allow longer deadlines, and treat `0` as an immediate timeout.
- Reject negative or otherwise invalid values before execution. Timing out an auxiliary shell command leaves its active turn running.
## Testing
- Cover default, extended, immediate, invalid, standalone, active-turn, and interruption behavior.
GitOrigin-RevId: d72f67793d9766b7383f28d30140270a4a76a495
## Why
An existing terminal keeps the sandbox, network settings, and grants it had at launch. Later `write_stdin` calls must account for that retained authority, including when permissions change between turns.
## What changed
- Capture each terminal's effective launch permissions and compare them with the current environment before accepting non-empty input.
- Request approval when the terminal bypassed the sandbox, retains additional grants, strict auto-review is active, or its sandbox or network settings differ from the current policy.
- Reject input when current denied-read or environment-owned network restrictions cannot be enforced by the existing terminal, while keeping empty polls and non-TTY interrupts available without review.
- Include the effective sandbox mode and user-visible additional grants in `write_stdin` approval actions without exposing host-owned grant paths.
## Testing
Added unit and end-to-end coverage for retained cross-turn grants, strict auto-review, sandbox and network policy changes, denied reads, Windows sandbox backends, and private grant redaction.
GitOrigin-RevId: e2d71daf9358474c885998786c4928069100711c
## What changed
- Emit turn-scoped authentication recovery started and completed events when a model provider refreshes expired credentials.
- Add stable `modelProvider/authRecoveryStarted` and `modelProvider/authRecoveryCompleted` app-server notifications with the thread, turn, provider, and user-facing message.
- Show recovery progress in the TUI and `codex exec`, including Amazon Bedrock session reauthentication.
## Testing
- Cover provider recovery success and failure events, app-server routing, client rendering, and Amazon Bedrock credential refresh.
GitOrigin-RevId: 3010c38d0676f18bced27761cf86dd38344d09f9
## What changed
- Include `recencyAt`, derived from the newest non-archived assigned thread, in project responses.
- Let `project/list` sort by `position` or `recencyAt` in either direction, with recency as the default descending order for that key and projects without activity placed last.
- Encode the sort key, direction, and millisecond-precision anchor in new cursors while retaining existing ascending-position cursors.
- Add an index for project recency lookups and document the API's sorting and pagination behavior.
## Testing
- Cover recency updates when threads are assigned, archived, unarchived, or deleted.
- Cover ordering, null handling, tie-breaking, cursor pagination, invalid sort combinations, and cursor mismatches.
GitOrigin-RevId: 6165e2b9976b0b45cfa16bcd42978b67811f6df5
## What changed
- Load the effective plugin configuration for every requested `cwd` in
`plugin/list` and `plugin/installed`.
- Combine local marketplaces in request order, keeping the first source for
duplicates while merging installed and enabled state across repositories.
- Report invalid project configurations through `marketplaceLoadErrors` without
dropping valid local catalogs or globally enabled remote catalogs.
- Use the combined marketplace context for forced and background cache refreshes,
while keeping remote plugin feature gating request-wide.
## Testing
- Cover distinct and duplicate marketplaces, cross-repository enabled state,
invalid project configuration, local cache refresh, and global versus
project-local feature flags.
GitOrigin-RevId: 53c8e0e9c760dc2b969ab10d0e63fb439673c230
Expand Windows deny-read globs robustly across protected directories while preserving filesystem enforcement. Preserve structured MCP tool and resource errors through app-server responses. Bind cached Guardian classifications to current local and root authorization state so stale scores cannot approve actions.
Add regression coverage for the sandbox resolver, structured protocol errors, and authorization changes.
GitOrigin-RevId: 4b80ed724d869afeca79204222d8465fa99d3a24
## Why
Reviewing a shortened `write_stdin` action while sending the complete input could allow unreviewed bytes to reach an escalated terminal.
## What changed
- Require the fully formatted action and approval reason to fit within 8,000 bytes.
- Reject truncated or oversized actions before requesting approval or writing any bytes to the terminal.
- Document the reviewed stdin size limit in the app-server protocol.
## Testing
Add an integration test that uses JSON escaping to push a formatted action over the limit and verifies that it is neither offered for approval nor executed, while a subsequent valid write still succeeds.
GitOrigin-RevId: f6c96a78a65a136366c8119a7d242dfc2ec05fe6
## What changed
- Add an optional `toolOutput` to `turn/start` for starting or steering a turn with a named function-call output instead of user input.
- Emit standalone outputs as `functionCallOutput` thread items, persist them in durable history, and include them in resumed threads.
- Validate that tool outputs have a name, are not combined with nonempty `input`, satisfy the text-size limit, and use supported image URLs.
## Testing
- Cover standalone tool-output notifications, model input, and resumed history in both legacy and paginated history modes.
- Cover the text-size limit for structured tool output.
GitOrigin-RevId: a1eeec7b9b7de67b1a1c5e829a54552b85ec118b
## What changed
- Add the `write_stdin_approval` feature flag, disabled by default, to require a fresh approval before sending non-empty input to an escalated unified-exec terminal.
- Route these reviews through hooks, Guardian, app-server, and the TUI as `writeStdin` approvals while keeping the parent command item unchanged.
- Preserve the terminal environment, launch directory, and escalation state across turns, and revalidate the process identity after approval before writing input.
## Testing
- Cover approval routing, policy decisions, process reuse, terminal identity preservation, app-server events, analytics, and TUI rendering.
GitOrigin-RevId: 4ba29eaae6208e934737ba078c96e589c7c2164d
## What changed
- Resolve plugin activation, MCP server policy, and marketplace definitions from the effective configuration stack, including system settings and trusted project overrides.
- Load plugin skills independently for each working directory passed to `skills/list`.
- Exclude project configuration from catalog requests whose `cwds` are omitted or empty.
- Cache up to eight loaded plugin configurations with least-recently-used eviction so requests for different working directories can reuse their results.
## Testing
- Cover layered plugin and MCP policy across trusted and untrusted projects.
- Cover per-directory skill and plugin catalog results, cache reuse and eviction, and system-defined marketplaces.
GitOrigin-RevId: cb68b2b1bdab1da48e05ca7562bc05014431fc71
## Why
App-server clients need the explanation and steering instruction returned with a
misalignment policy violation to offer a user-confirmed continuation. Missing or
incomplete details must continue to behave as a terminal block.
## What changed
- Parse optional misalignment classification, explanation, and steering details
from streamed and HTTP Responses errors and propagate them through core errors.
- Include the details in live app-server `error` and `turn/completed` payloads and
export the corresponding protocol schemas and TypeScript types.
- Keep explanations and steering messages out of serialized rollout events and
redact them from debug output.
- Document how clients can resume with `turn/start` after user confirmation.
## Testing
- Cover streamed, HTTP, and WebSocket-wrapped errors, including malformed and
classification-only details.
- Verify live app-server notifications expose resumable details without writing
the explanation or steering message to the rollout.
GitOrigin-RevId: 329258a444c2cd91d0c57ab1720830b33ddcfac5
## What changed
- Classify `response.failed` events with the `rate_limit_exceeded` code as a distinct retryable error while preserving any parsed retry delay.
- Expose the error as `rateLimitExceeded` through the core protocol and app-server schemas after stream retries are exhausted.
- Preserve the upstream message for TUI display while keeping it out of telemetry summaries.
## Testing
- Cover SSE classification, retry metadata, protocol conversion and serialization, exhausted stream retries, telemetry redaction, and TUI rendering.
GitOrigin-RevId: 02dab4d3477dcd7653a58c49c4bd38687a616579
