## Why
Amazon Bedrock configurations can operate without Codex auth, so auth mode alone
cannot determine which curated plugin marketplace to expose.
## What changed
- Pass the resolved model provider into plugin configuration.
- Select `openai-api-curated` when the resolved provider is `amazon-bedrock`,
while retaining API-key auth as a selection signal.
- Cover provider overrides and app-server plugin listing without an `auth.json`
file.
GitOrigin-RevId: 972a22e19c41490d8b19d989da052302dc30e8f2
## What changed
- Make `McpRuntime` own the published MCP configuration, connections, elicitation routing, and selected capability roots for a thread.
- Capture immutable MCP bindings for model steps and tool calls so in-flight work keeps a consistent connection set and approval authority while refreshed state is published atomically.
- Mark MCP state dirty when relevant configuration, plugins, environments, authentication, or elicitation capabilities change, then rebuild it before the next sampling request or out-of-band MCP operation.
- Separate config reloads from server invalidation: `ReloadMcpConfig` applies resolved MCP inputs, while `RefreshMcpServers` requests reinitialization from the thread's latest state.
## Testing
- Cover refreshed state visibility for existing turns, stable step bindings, current approval authority, cancelled refresh retries, resource-client reconciliation, and Apps recovery between sampling requests.
GitOrigin-RevId: 59eabb1aa8dc083426bd18ef4d3630508f376401
## What changed
- Add a default-on `features.multi_agent_v2.wait_agent_enabled` setting.
- Omit `collaboration.wait_agent` from the tool plan when the setting is disabled, independently of `features.current_time_reminder.sleep_tool`.
## Testing
- Cover configuration parsing and tool exposure with both clock sleep states.
GitOrigin-RevId: c2f34c5edd5bc191d6a5ac41d7bbb80708da1202
## Why
An idle thread with an outstanding durable sleep must resume when agent work
arrives, even when that message would normally remain queued without triggering a
turn.
## What changed
- Treat any pending mailbox message as wake-up work while a durable sleep is
attached to the thread.
- Keep requiring `trigger_turn` for idle threads that are not durably asleep.
- Cover waking a sleeping root thread from queue-only agent mail and persisting
the message in thread history.
GitOrigin-RevId: e361ac1b104436d4d63aebfe5e2422691a1cc139
## What changed
Skip registering the standalone `image_generation` tool when cached
authentication identifies the account plan as Free. Leave the existing
feature, provider capability, model modality, and authorization checks intact
for other account plans.
GitOrigin-RevId: 54d3b73dc610e508db7e281c4d7a8e72961e35a6
## Why
Parent context-window and auto-compaction overrides may describe a different
model than the one selected for Guardian review.
## What changed
- Clear `model_context_window` and `model_auto_compact_token_limit` when the
effective Guardian model differs from the parent model, allowing the review
model's own limits to apply.
- Preserve those overrides when Guardian uses the same effective model.
## Testing
Add unit coverage for both model-selection paths and verify that a Guardian
rollout records the selected review model's context window.
GitOrigin-RevId: ebc399f4eba37c7f279fd0d258154c00d45e2d00
## What changed
- Add the `supports_standalone_web_search` model-provider setting, defaulting to `false`, and preserve it in remote thread configuration.
- Enable the standalone `web.run` tool for opted-in custom Responses providers when web search is enabled and the runtime provider supports it.
- Send standalone search requests through the custom provider's endpoint and authentication.
## Testing
- Cover opt-in, default-off, disabled-search, and unsupported-provider behavior.
- Verify custom-provider search request routing and authorization through the app server.
GitOrigin-RevId: 7c5f96b0ce924ad2b9715c45bfc635e89fc39cff
## Why
Multi-agent mode instructions are durable model context and need to survive
history changes without re-emitting unrelated setup hints.
## What changed
- Add a `multi_agent_mode` world-state section that diffs, retains, and restores
the effective mode instructions.
- Persist mode changes in world-state snapshots while keeping the legacy
`TurnContextItem.multi_agent_mode` field for reading older rollouts.
- Keep initial mode instructions after the root-agent usage hint so the active
mode takes precedence, and bound custom mode text before snapshotting it.
## Testing
- Add snapshot coverage for mode transitions, retained history, and custom-text
truncation.
- Verify live mode changes preserve instruction ordering, avoid duplicating the
usage hint, and record both modes in world state.
GitOrigin-RevId: 96b9964d6e5299b07a011c559b68e3d948a49226
## What changed
- Add `isPinned` to thread responses and allow `thread/metadata/update` to pin or unpin stored threads.
- Add an `isPinned` filter to `thread/list`, including cursor-based pagination and combinations with relationship filters.
- Persist pin state in SQLite without modifying rollout files, default existing threads to unpinned, and preserve pins through reconciliation and archive transitions.
## Testing
- Cover protocol serialization, database migration and indexing, pin updates, filtered pagination, rollout reconciliation, and archive/unarchive behavior.
GitOrigin-RevId: c2eacabd6dae465e2ae6ce8a169e00740960cdb7
## Why
Interrupting a turn while MCP tools were still starting could abort before the
submitted user input was recorded in conversation history.
## What changed
- Build and retain the MCP tool list and tool router as part of each step
snapshot, using the turn cancellation token during tool discovery.
- Record turn hooks and submitted input when cancellation occurs during startup
prewarming, pre-sampling compaction, or first-step capture.
- Reuse the captured router for sampling, compaction, and prompt debugging so
advertised and executable tools share the same request-scoped view.
## Testing
Add coverage that interrupts each affected MCP startup phase and verifies that
the user prompt remains in history before the turn-aborted marker.
GitOrigin-RevId: 6e96c6814357a55545d69b580e28f35933cfadf7
## What changed
- Add `compaction_ms` to turn profile facts and turn analytics events.
- Measure manual and automatic compaction as an exclusive profile phase instead of including it in surrounding idle time.
- Complete the profile and total turn duration from the same instant so their elapsed times remain consistent.
## Testing
- Cover compaction phase accounting and profile-duration consistency.
- Update turn event serialization coverage for `compaction_ms`.
GitOrigin-RevId: 50f0e1cf19789a807f9f56c2ef763c620a5d641c
## Why
Preparing Responses API requests rebuilt tool definitions as a generic JSON
tree, and incremental WebSocket requests cloned their full item prefix for
comparison.
## What changed
- Serialize tool definitions into shared raw JSON that can be embedded directly
in HTTP and WebSocket requests.
- Compare incremental request prefixes in place while still ignoring internal
message metadata.
## Testing
- Verify raw tool JSON matches the existing value encoding.
- Preserve the serialized WebSocket request payload.
GitOrigin-RevId: 66e2921792c332e8904954dafa597f6d39abcf29
## What changed
- Store the spawned session's working directory as a `PathUri` in
`GuardianReviewSessionReuseKey` so reuse comparisons use its canonical URI
representation.
- Assert that the reuse key contains the converted working directory.
GitOrigin-RevId: 68d440a37ebb310c610dabbb3373ed0ceff88dfa
## What changed
- Install the git attribution extension in the app server, MCP server, and `codex debug prompt-input` so authenticated workspace policy controls the commit and pull request attribution instructions sent to the model.
- Resolve attribution settings from the process-level ChatGPT base URL, independent of per-thread or per-tool configuration overrides.
- Treat git attribution as contextual developer content when mapping model events.
## Testing
- Cover policy fetch retries, workspace switches, rollbacks, cold thread resumes with legacy instructions, MCP tool calls, and prompt-debug output.
GitOrigin-RevId: 57d182c432c20d7c1c6c429057b6163c9f32088d
## What changed
- Route realtime V3 `bemTags` handoffs using `[ANALYSIS]`, `[COMMENTARY]`, and `[FINAL]` prefixes by default.
- Add `codexResponseHandoffChannelPrefixes` to realtime start requests so clients can replace the accepted prefixes for individual channels. Each channel may accept multiple prefixes, and omitted channels retain their defaults.
- Apply the configured prefixes to both complete and streamed handoff messages, without treating empty prefixes as matches.
## Testing
- Cover request deserialization, default and custom routing, partial streamed prefixes, empty-prefix handling, and end-to-end V3 handoffs.
GitOrigin-RevId: d0aef50aa71362a5beef2c6f6d28b8633da4e529
## What changed
- Add `StartThreadOptions::new` to provide the standard configuration for a new thread.
- Make `ThreadManager::start_thread` the single thread-start entry point and migrate callers from the previous convenience methods.
- Derive default environment selections when `environments` is `None`, while preserving explicit selections, including an empty list.
GitOrigin-RevId: 8977dc11aed54c5e1215a81eaed2b2cf5fc6087a
## What changed
- Add `SqliteConfig` to own the resolved SQLite home, runtime database paths,
and shared read/write and read-only pool settings.
- Pass the configuration through state and local thread-store consumers,
replacing standalone path helpers and duplicated connection setup.
GitOrigin-RevId: 7351b08da94b5c8b6c0bbe492f86aeeca0699d3c
## What changed
- Store the shell approval key's `cwd` as a `PathUri`, matching the URI representation used by approval actions.
- Extend the approval-key test to verify both the URI-based working directory and environment scoping.
## Testing
- Added `approval_key_uses_path_uri_and_includes_environment_id`.
GitOrigin-RevId: 4d7ba1a2e652f4ffe317242f52beb33513b01e6a
## Why
The post-sampling trace calculated an estimated token count even when only the
always-on diagnostic and state log sinks were listening, adding unnecessary work
after every sample.
## What changed
- Move the estimate to a dedicated trace target and calculate it only when that
event is enabled.
- Disable the target for the always-on diagnostic and state log sinks while
keeping it available to explicitly configured subscribers.
## Testing
- Verify that the combined always-on subscribers do not enable the estimate
event.
GitOrigin-RevId: ea572584597dda313e7719897d0ab1fdf7362745
## What changed
- Require the parent thread to be live before forking its history.
- Read the history mode and multi-agent usage hints from that live parent so
the fork loads and filters history using the active configuration.
- Verify that forking a legacy parent keeps the child in legacy history mode.
GitOrigin-RevId: 79416b78544467a1801f21300d3fe8db4fef59df
## What changed
- Remove the step-scoped `ExtensionData` argument from context, turn-input, and tool contributors.
- Pass the host's optional `McpResourceClient` through `ThreadStartInput` so extensions can retain session capabilities explicitly.
- Keep the MCP resource client in skills-owned session state for catalog loading and skill tools.
GitOrigin-RevId: bafa77bcd998aff408d6a396c5fd9ac268c4cce4
## Why
Startup prewarms and Guardian review sessions do not need workspace Git metadata. Collecting it for those requests performs redundant work, while user turns still need a fresh view of the repository.
## What changed
- Add a per-session Git enrichment policy.
- Skip enrichment for startup prewarm, preview, and Guardian review turns.
- Keep fresh enrichment enabled for regular sessions and one-shot delegated turns.
## Testing
- Cover prewarm and Guardian requests omitting workspace metadata while subsequent user turns observe repository changes.
- Cover concurrent repositories and worktrees retaining distinct metadata.
- Verify concurrent enrichment is coalesced and canceled enrichment can be retried.
GitOrigin-RevId: 4a68615288bb568c75f2e487d9c0776e3e80f191
## What changed
- Treat output-task closure as the signal that trailing output is complete, drain any remaining chunks before publishing command completion, and retain the grace period as a fallback.
- Wait for deferred network-denial classification before emitting the final command result.
- Serialize `write_stdin` interaction and completion events so an interaction that exits a process is published first, and avoid pruning processes while their terminal events are being finalized.
## Testing
- Add coverage for late output, missing output-close signals, late network denials, interaction/completion ordering, cross-platform aggregated output, and pruning during finalization.
GitOrigin-RevId: 46a118552bb1a4658b78aa5a5ca76eb8c5fba571
## What changed
- Use `McpConnectionSet` as the primary name for the collection of active MCP
server connections throughout `codex-mcp` and its callers.
- Keep `McpConnectionManager` as a backward-compatible type alias.
GitOrigin-RevId: 9753838b4fd0a0b6429a9c4af0c077137616f388
## What changed
- Include the Codex `session-id` and `thread-id` headers when starting realtime conversations over WebSocket or WebRTC.
- Add coverage confirming that WebRTC call creation forwards both identifiers while preserving the existing realtime request metadata and SDP payload.
GitOrigin-RevId: 668bee9a7d4797ad0a396e9ca4dc56b2c379cba7
## Why
Turn diffs need to render paths from remote environments whose path convention may differ from the Codex host.
## What changed
- Preserve `PathUri` values through applied patch deltas, display-root discovery, and turn-diff tracking.
- Add host-independent relative-path rendering and normalize Windows drive-letter case in `PathUri`.
- Render paths relative to each environment's repository root while keeping Git diff headers slash-separated.
## Testing
- Cover POSIX, Windows, UNC, encoded-separator, and opaque URI relative paths.
- Verify an applied patch in a remote Windows working directory emits a portable unified diff.
GitOrigin-RevId: 526f70ae36a40627de5496d375310d12295b69bb
## Why
Auth managers should use the application's resolved HTTP client factory instead
of silently falling back to the transport's default proxy behavior.
## What changed
- Make `AuthRouteConfig` required when constructing an `AuthManager` or
`AuthConfig`.
- Pass each production caller's resolved routing configuration through without
wrapping it in an optional value.
- Add a test helper that explicitly selects the transport-default proxy policy
for callers that do not exercise custom routing.
GitOrigin-RevId: d89a3b1f8b5d4007650cdac0aae241c94d598580
## Why
Auth routing represented the default proxy policy as an absent configuration,
leaving consumers to reconstruct the fallback HTTP client independently. Carry
the application's resolved policy explicitly so auth and related requests use
the same client configuration.
## What changed
- Build `AuthRouteConfig` from the resolved `HttpClientFactory` for both
`ReqwestDefault` and `RespectSystemProxy` policies.
- Pass that route configuration through login, auth, cloud task, and cloud
configuration flows, and reuse its factory when loading cloud configuration.
- Log cloud-task configuration load failures before falling back to the
transport-default proxy policy.
## Testing
Extended configuration tests to verify that effective and bootstrap auth routes
select the expected proxy policy when system-proxy support is enabled or
disabled by feature requirements.
GitOrigin-RevId: d03802e2660f5cf6d940e8e718ec5c82ede7eab1
## What changed
- Assign IDs to client-created response items in every session, including streamed items, forked history, compaction results, and non-OpenAI provider requests.
- Preserve server-provided IDs and stable generated IDs across persisted and resumed conversations while continuing to omit unprefixed server IDs from outbound requests.
- Retire `features.item_ids` as a configurable feature. Existing configuration and CLI toggles remain accepted as compatibility no-ops.
## Testing
- Cover default ID assignment, persistence and resume behavior, remote compaction, provider requests, WebSocket requests, and removed-feature compatibility.
GitOrigin-RevId: 7a09e2d07d2606c2ef1e8e2283d36cb555557eae
## Why
`codex-http-client` is the intended owner of direct `reqwest` usage.
## What changed
- Build Codex's default and route-aware clients with `HttpClientBuilder`, and return `HttpClient` directly to API, model discovery, auth, remote control, skills, and extension callers.
- Preserve custom CA, proxy, Cloudflare cookie, sandbox, and request-logging policies while removing `codex-login`'s direct `reqwest` dependency.
- Use shared HTTP types for auth headers, status codes, transport errors, and login-server tests.
## Testing
- Add a Linux integration test verifying that a regular Responses API turn traverses the configured system proxy.
GitOrigin-RevId: 714695fb80762d2083e2f7a6414183e2b3b63854
## Why
Elevated Windows sandboxes need stable managed-proxy ports while preserving the network policy and environment attribution of each sandboxed process.
## What changed
- Keep shared HTTP and SOCKS5 loopback ingress listeners alive across managed-proxy instances.
- Add a per-route restricting SID to elevated sandbox tokens and dispatch incoming connections to the matching proxy policy after attributing the client process.
- Reject connections without exactly one registered route, remove routes when their proxy handle is dropped, and keep unsandboxed Windows launches off the managed ingress.
- Provision the elevated sandbox with the configured proxy ports and local-binding setting, honoring the selected profile and CLI overrides.
## Testing
- Add Windows unit tests for TCP ownership attribution, route selection, restricting-token propagation, and setup settings.
- Add an end-to-end Windows test covering stable ports, isolated environment policies, HTTP and SOCKS5 routing, and route teardown.
GitOrigin-RevId: 783fac6e0f904dc9bb1955b75d4a5895e8bb9690
## Why
Skill names may contain characters that are not valid in metric tag values.
## What changed
Pass skill names through `sanitize_metric_tag_value` before using them as the
`skill` tag on `codex.skill.injected` counters for both explicit and implicit
skill invocations.
GitOrigin-RevId: 0ed633fbd468739acc30193b566d830e20bc7860
## Why
Default read-only protections for project metadata should apply when paths such
as `.git`, `.agents`, and `.codex` exist, without causing sandbox setup to
materialize missing paths as ACL targets.
## What changed
- Add an optional `missing_path_behavior` to filesystem sandbox entries and
mark default project-metadata protections with `skip`.
- Preserve the behavior through permission transforms and exec/MCP protocol
serialization while keeping existing path wire variants stable.
- Ignore skip-missing entries when projecting configuration or Windows sandbox
overrides, while retaining explicit metadata carveouts.
## Testing
- Cover protocol round trips for path and special-path entries.
- Verify default metadata protections and Windows explicit carveout handling.
GitOrigin-RevId: 6df13dadacdd131c44aab9f15a967c81051355c1
## What changed
- Apply managed values for `sqlite_home`, `log_dir`, `model_catalog_json`,
`check_for_update_on_startup`, `allow_login_shell`, the report-submission
opt-in, and `windows.sandbox_private_desktop` to the runtime configuration,
with source-aware warnings when they override configured values.
- Expose these values through `configRequirements/read`, return them from
`config/read`, include them in session config locks, and show their sources in
the TUI config debug view.
- Reject app-server writes that overlap an exact managed requirement with
`configRequirementReadonly` while leaving unrelated sibling keys writable.
## Testing
- Cover runtime overrides, requirement API mapping, config reads and writes,
session lock serialization, cross-platform path URIs, and debug output.
GitOrigin-RevId: d4e23b6fd7775c1a6dfe2eab313cdcee50b07081
## What changed
- Add `shell_environment_policy.filters`, mapping environment-variable patterns to `include` or `exclude`, while continuing to accept the legacy `exclude` and `include_only` arrays.
- Merge filter keys case-insensitively across config layers so higher-precedence entries can override individual patterns. Switching representations replaces the other representation instead of combining them.
- Reject mixed, duplicate, or malformed filter definitions in enabled layers, config writes, and reloads, while retaining the previous session configuration when a reload is invalid.
- Make config-manager reads and writes representation-aware and preserve existing formatting when updating individual policy values.
## Testing
Add coverage for parsing, schema constraints, layered merging, validation and diagnostics, config writes, override metadata, and invalid session reloads.
GitOrigin-RevId: e15464bca53e6e7ef31fcc97537fda60ed5d670a
## What changed
- Pass only compaction message and window metadata into
`Session::replace_compacted_history`.
- Build the persisted `CompactedItem` there after assigning any missing response
item IDs, so its replacement history matches the live history without callers
cloning or assembling it themselves.
GitOrigin-RevId: a6106c33b6d3eef39ac0b563a50e17f6782970dc
## What changed
- Add an `ExtensionData` store to each `StepContext`.
- Pass the step store to context, world-state, turn-input, and tool contributors so extensions can use capabilities bound to the current sampling step.
- Preserve the captured step context when rebuilding initial context during compaction.
GitOrigin-RevId: 51f3105d3a793f60534f122f9be8247c131c2ca5
## Why
Remote plugin requests did not use Codex's effective outbound proxy policy, so
they could bypass configured system proxy and PAC routing.
## What changed
- Route remote plugin catalog, mutation, sharing, upload, and bundle download
requests through the configured route-aware HTTP client.
- Select routes using the complete request URL, including encoded query
parameters and backend-provided signed upload or download URLs.
- Preserve standard Codex headers and suppress diagnostics for URLs or headers
that may contain credentials.
## Testing
Add coverage for route selection of catalog queries, workspace plugin uploads,
and backend-provided bundle download URLs.
GitOrigin-RevId: 106936659e21decf145b6ab4d4be84992e386861
## Why
The curated plugin startup sync can fall back from Git to HTTP, but those
requests did not use Codex's effective outbound proxy policy.
## What changed
- Thread the configured HTTP client factory into curated plugin sync.
- Route GitHub API, zipball, backup metadata, and returned download URLs
through the route-aware client when system proxy support is enabled.
- Preserve the existing default HTTP client behavior, including its custom CA
fallback, when system proxy support is disabled.
- Apply the standard Codex headers to startup-sync HTTP requests.
## Testing
Add coverage that records route selection for repository, archive, metadata,
and backend-supplied download URLs, and verifies standard headers are sent.
GitOrigin-RevId: e1ea13bdab58a84c9948a2c8b82a5ec5c964ea99
## Why
Goal-first and forked threads could create rollouts without recording their
effective thread settings. Resuming those threads after a restart could then
use current configuration instead of the settings selected when the thread was
created.
## What changed
- Persist a `thread_settings_applied` item when a goal first materializes a
rollout, including a follow-up snapshot if settings changed concurrently.
- Append each fork's effective settings after its copied history so they take
precedence over inherited settings during resume.
- Centralize conversion from `ThreadConfigSnapshot` to
`ThreadSettingsSnapshot`.
## Testing
Added coverage that restarts the app server and verifies goal-first and forked
threads retain their respective `approvals_reviewer` settings.
GitOrigin-RevId: 6cb9aaae73bbe9ca432831cff7e826f95ffd6d01
## What changed
- Add the experimental `code_mode_buffered_exec` feature.
- When enabled, default code-mode `exec` calls without an explicit
`yield_time_ms` to 30 seconds instead of 10 seconds.
- Report the effective default in the model-visible `exec` tool description.
## Testing
- Verify that the generated tool description advertises the 30-second default
when the feature is enabled.
GitOrigin-RevId: 0eea4d0105137f09050ce31aad18c25c79df6b2a
## Why
Permission profiles defined by `requirements.toml` can be selected as active,
but their network configuration was not included when resolving the network
proxy specification for that selection.
## What changed
Merge managed permission profiles from `requirements.toml` with configured
profiles before looking up the active profile's network proxy settings.
## Testing
- Verify config loading retains the proxy settings of an active managed
profile.
- Verify `turn/start` accepts a managed profile with network settings.
GitOrigin-RevId: 3374f82a8fb0ce8f338fa2cea77c28ea2eb89636
## What changed
- Add model-catalog approval message variants for `never` and `unless_trusted`.
- Select the catalog message that matches the active approval policy, while retaining the existing built-in text when that variant is absent.
- Treat an explicitly empty variant as an instruction to suppress the built-in approval text, consistent with `on_request` messages.
## Testing
- Cover variant selection, fallback and empty-message behavior, catalog deserialization, and the initial permissions message sent to the model.
GitOrigin-RevId: a0f8d41a08645f39b80093be53f200eeee18ca25
## Why
Remote compaction can process large histories. Repeatedly estimating and replacing the full history, and cloning it when tracing is disabled, adds avoidable CPU and memory overhead.
## What changed
- Estimate each history item's token count once, update the total as trailing tool outputs are rewritten, and replace history only after all rewrites are selected.
- Preserve unclamped token totals while calculating removed tokens so saturated estimates do not hide overflow.
- Snapshot compaction input history only when rollout tracing is enabled.
- Reuse the v2 request input instead of cloning it before adding the compaction trigger.
## Testing
- Cover enabled and disabled compaction trace contexts through `is_enabled()` assertions.
GitOrigin-RevId: 8de9c9704ba29532fba05430eb204bbae2e8bf83
## What changed
- Define and export skill metadata, policy, dependency, interface, and configuration rule types from `codex-skills`.
- Update core, plugin, and extension consumers to use the shared models while retaining compatibility re-exports from `codex-core-skills`.
- Share product-restriction handling between host and environment skill metadata.
## Testing
- Add unit coverage for default and explicit implicit-invocation and product policies.
GitOrigin-RevId: 9093469f8fff8e2d902dc9781235f64709827a87
## Why
Sandboxed process launch through the exec server was unsupported on Windows.
## What changed
- Add a shared native process launcher that selects the Windows sandbox session backend when required and otherwise launches PTY or pipe-based processes.
- Pass Windows permission, workspace-root, proxy, filesystem-override, and desktop settings through exec-server process preparation.
- Preserve piped stdin and inherited file descriptors across the shared launch path.
## Testing
- Verify that a remote Windows sandbox process accepts stdin while blocking a write under a read-only policy.
- Enable workspace-root sandbox tests on native Windows while continuing to skip environments that cannot emulate Windows sandbox semantics.
GitOrigin-RevId: 6719ccbe87ad0d5a57af56503e3f23f894c60a71
## What changed
- Remove the `spawn_agents_on_csv` and `report_agent_job_result` tools and their agent-job runtime and state models.
- Drop the legacy `agent_jobs` and `agent_job_items` tables during state database migration.
- Keep `features.enable_fanout` and `agents.job_max_runtime_seconds` accepted as no-op compatibility settings while omitting them from the generated configuration schema.
## Testing
- Verify upgrades remove both legacy agent-job tables.
- Verify the removed feature and configuration keys still parse without taking effect.
GitOrigin-RevId: 8cc3337da78c67162229f02f40a747f503542646
## What changed
- Make the MCP connection manager's event sender optional.
- Skip startup notifications when a caller has no session event stream.
- Decline interactive MCP elicitations in that mode while allowing the
underlying operation to continue.
- Update threadless resource reads, status snapshots, and connector discovery
to use the channel-free path.
## Testing
- Extend the app-server MCP resource test to verify that a threadless resource
read declines an elicitation and still returns the resource contents.
GitOrigin-RevId: 65fea152adbc02a78e09a40cae4134b6dccffd34
## What changed
- Assert truncated audio history through `ContextManager::raw_items()`.
- Initialize `additional_context_limit` in the quoted Windows hook command test.
GitOrigin-RevId: 43c19804e558b7a11fc17590506ec6ec7f3a9897
## What changed
- Change `ReviewDecision::Denied` to carry a rejection string and update the generated protocol schemas.
- Preserve specific rejection reasons through command, patch, network, MCP, delegated, and automatic approval flows so tool results can return them to the model.
- Distinguish invalid approval responses from user declines and truncate oversized rejection messages before adding them to model context.
## Testing
- Add coverage for denial serialization, invalid app-server approval responses, dropped automatic reviews, network rejection propagation, and rejection-message truncation.
GitOrigin-RevId: d48a55643aa03c7ecfa08a8e4b669913eec5464a
