## What changed
- Add optional `guardian_v2` model-message defaults for classifier instructions,
review thresholds, reasoning effort, transcript selection and limits, and
action and compaction token limits.
- Apply those defaults when Guardian v2 samples a tool call, while preserving
explicit `[features.guardianv2]` settings over catalog values.
- Preserve the new catalog configuration when applying model overrides.
## Testing
- Cover model-catalog serialization and model override behavior.
- Verify that sampling uses catalog defaults while retaining local overrides.
GitOrigin-RevId: 4ae9ec235c647acbca05a20b7c4b87a4e1331161
## What changed
- Add `[skills].max_context_tokens` to override the token budget used to render the available-skills catalog.
- Require a positive value and cap configured budgets at 10,000 tokens.
- Preserve the existing default of 2% of the model context window when the option is unset.
## Testing
- Cover configuration parsing, override behavior, the 10,000-token cap, and catalog rendering within the configured budget.
GitOrigin-RevId: f29ddcb57fc2d800c0006d03e1c33cbe3ab6272d
## What changed
- Add an optional restrictive execution policy to `EnvironmentConfig` and merge it over the active command policy for shell execution and approval decisions.
- Reject environment policies that contain allow rules, so environment configuration can only tighten command access.
- Include the environment policy fingerprint in cached approval keys so policy changes require fresh session approvals.
## Testing
- Cover restrictions overriding saved prefix approvals, policy changes invalidating session approvals, and environment overlays remaining effective when model-specific prefix filtering is active.
GitOrigin-RevId: e94f877549ed5e0f577b8cb52f3c1872c58f029d
## Why
Permission profiles written before the rename to `:workspace_roots` can still
contain `:project_roots`. Treating that token as unknown ignores its entries and
can drop filesystem restrictions.
## What changed
- Parse `:project_roots` as an alias for `:workspace_roots`.
- Cover deny rules and read-only subpath carveouts in legacy profiles.
GitOrigin-RevId: 10aafc9e15372d1a8bcc2dbcf3ad7cc987f4e67e
## What changed
- Carry `ShellEnvironmentPolicy` in each resolved `EnvironmentConfig` and use
the selected turn environment's policy for shell commands, user shell tasks,
and unified exec.
- Infer the policy from the thread configuration when an environment does not
provide its own resolved configuration.
- Redact the policy from `EnvironmentConfig` debug output because it can contain
explicit environment variable values.
## Testing
- Verify shell handlers and unified exec filter inherited variables according
to the selected environment while preserving its explicit overrides.
GitOrigin-RevId: 9f6a52aa4af60e5f17251a0e1b11e1926b779055
## Why
Callers need to associate host-owned state with a thread before Core starts it.
## What changed
- Add `ThreadManager::reserve_thread_id` and allow new threads to start with the reserved ID. Reject reserved IDs when resuming an existing thread.
- Let thread stores stage metadata for a reserved ID. The local store merges staged values into the first successful metadata update and then removes them.
- Clear staged metadata when an unmaterialized thread shuts down or is discarded, and require the state database for staging.
## Testing
- Cover reserved ID generation and resume validation.
- Cover metadata persistence, merging, rollout-compatible updates, cleanup, and invalid staging requests.
GitOrigin-RevId: 3f9bc48f0f7764011cc90ea01349e497dda0a9e3
## Why
Thread settings can change while a turn is still active, including between sampling requests. Those updates should apply to the next turn instead of changing the model configuration partway through the current turn.
## What changed
- Snapshot the model, reasoning settings, service tier, approval settings, and model-attributed telemetry in `StepContext`.
- Build prompts, model requests, world state, tracing, and startup prewarms from that step-scoped snapshot.
- Share immutable model metadata between turn and step contexts.
## Testing
Added an integration test that pauses an active turn, updates its thread settings, and verifies that all requests in the active turn retain the original settings while the next turn uses the updates.
GitOrigin-RevId: c51352218e463dcc9b7338566d16742292c49fbf
## What changed
- Discover synchronous `mcp_tool` hook handlers and invoke their configured MCP server and tool through a supplied executor.
- Expand nested hook-event placeholders in MCP tool inputs while preserving JSON types, and process tool output through the existing hook output contract.
- Represent hook details as handler-specific metadata in `hooks/list`, including MCP server and tool fields, and show those details in the TUI hooks browser.
- Skip unsupported `SessionEnd` MCP hooks and runtimes without MCP invocation support with startup warnings.
## Testing
- Cover argument expansion, missing placeholders, MCP invocation and hook decisions, discovery warnings, `hooks/list` metadata, and TUI rendering.
GitOrigin-RevId: 295b845471fe92bd7ad7cd272fbcd2c3713912e0
## What changed
- Rebuild hook runtimes for loaded sessions when effective plugins change or a marketplace upgrade installs new plugin content.
- Refresh plugin-related caches and MCP runtimes alongside hooks after plugin mutations.
- Preserve each loaded session's current configuration while rebuilding its hooks.
## Testing
- Cover direct plugin upgrades, including subsequent turn and session-end hooks.
- Cover automatic marketplace upgrades for an already loaded session.
GitOrigin-RevId: fef64c68d652f300c7f3d88e81c5017459aa9a18
## What changed
- Represent `request_permissions` calls as shared approval actions and convert them into Guardian permission requests through the common approval path.
- Preserve turn cancellation while an automatic permission review is pending.
- Cover Guardian allow and deny decisions, cancellation without a user-approval fallback, and clean follow-up turns.
GitOrigin-RevId: 95d0df0288e232f32b162756aa7d64a30df7efa5
## Why
An environment connection can be available before its owner has supplied the
configuration for a particular thread attachment. Threads need to start without
blocking while ensuring turns do not use that attachment prematurely.
## What changed
- Accept `Pending` environment configuration and resolve each attachment only
after both its shared executor connection and owner configuration are ready.
- Add a `Failed` configuration state and `environment_failed` callback so an
owner can fail one thread's attachment without affecting other threads.
- Keep pending and failed attachments out of capability-root inspection and turn
environments, and allow failed attachments to recover through a ready update.
- Apply owner configuration before waking a waiting turn so its permission
profile, login-shell policy, capability roots, and tools are immediately
consistent.
## Testing
Add an integration test covering non-blocking thread startup, independent ready
and failed callbacks, waiting-turn resumption, installed capability and tool
configuration, and recovery from failure.
GitOrigin-RevId: d587e2025d584c867d782d470b18bf5a1a27b76c
## Why
Responses WebSocket fallback is session-scoped. A delegated session created
after its parent switched to HTTP could otherwise make another WebSocket
connection attempt.
## What changed
Disable WebSocket support for a delegated session when the parent session has
already fallen back to HTTP.
## Testing
Add a guardian review regression test that verifies only the parent's initial
WebSocket attempt occurs and the guardian request uses the HTTP response path.
GitOrigin-RevId: 1345f8fe739f55975aef432045348eae5a9278d6
## Why
Environment attachments can either inherit configuration from their thread or
provide their own. Later thread setting updates must refresh inherited
configuration without overwriting attachment-owned permissions and capability
roots.
## What changed
- Resolve each attachment's configuration when it is selected and retain
whether it came from the thread or the attachment owner.
- Apply subsequent thread configuration updates only to thread-owned
attachments, while preserving ownership across snapshots and child threads.
- Keep the resolved configuration with the environment selection so runtime
consumers use a single canonical value.
## Testing
- Extend remote-environment coverage to verify that thread-owned permissions
follow thread updates while owner-provided read-only permissions remain in
effect.
- Cover configuration inheritance, attachment replacement, and owner-configured
capability roots.
GitOrigin-RevId: fe70c4be5f151432b69bf4b141e316faa89036ae
## What changed
- Add a resolved `permission_profile` to each `EnvironmentConfig` and use the
complete attachment config for execution and capability-root selection.
- Let `Ready` environment configurations override thread permissions while
`FromThread` selections continue to inherit them.
- Restrict inherited Guardian environment profiles to read-only permissions.
## Testing
- Add coverage proving that a read-only environment blocks writes even when
the thread permits workspace writes.
- Update environment inheritance, Guardian review, and capability-root tests
for the resolved attachment configuration.
GitOrigin-RevId: 1a313b9e4892b1a579a0e880e322a782b4f6c0a7
## Why
Windows sandbox requests must preserve managed filesystem deny rules across every execution path and setup refresh. Unsupported policies should fail closed instead of allowing a command to run without the requested protection.
## What changed
- Resolve Windows filesystem overrides while constructing each sandbox execution request so both `shell_command` and `exec_command` enforce exact-path and glob deny-read entries.
- Carry resolved deny-read paths into Windows sandbox setup refreshes, including workspace-relative entries.
- Reject unelevated restricted-token requests that cannot enforce deny-read rules.
- Reject recursive globs rooted at a filesystem root unless `glob_scan_max_depth` bounds their expansion.
## Testing
Added coverage for deny-read enforcement through both command runtimes, setup refresh resolution, restricted-token failure, and bounded root-level glob scans.
GitOrigin-RevId: 33dfa4d1a45b14850cbf58f9173717e3e707d9bf
## What changed
- Define `PermissionProfileSnapshot` as a protocol model and re-export it from
`core-api`.
- Store snapshots directly in core permission state while continuing to apply
constraints to their concrete `PermissionProfile`.
- Preserve active profile identity and profile-declared workspace roots without
the core-only resolved profile variants.
GitOrigin-RevId: cc5e03908e62054cde5de691faa47e471f2e1af5
## What changed
- Add `LoaderOverrides::ignore_project_config` to bypass project-root discovery and all project configuration layers.
- Keep other configuration sources, including session overrides and cloud configuration, active when the override is set.
## Testing
- Add a config loader test that verifies project configuration is not loaded or parsed while session and cloud values remain effective.
GitOrigin-RevId: b9aa44de526354fad6b900d6ae8d9b5fb8f700bb
## What changed
- Add model-catalog messages for root and subagent roles, explicit delegation, and delegation hints.
- Resolve role instructions in config, catalog, then bundled-default order, while preserving empty values as an explicit way to suppress fallback text.
- Refresh catalog-provided role and mode instructions when the model changes, and give full-history forks the selected child model's subagent role without retaining the parent's role guidance.
- Keep existing config overrides and reasoning-effort behavior, including proactive delegation for ultra reasoning effort.
## Testing
- Cover message deserialization and preservation through model overrides.
- Cover precedence, empty overrides, model switches, resumed sessions, and full-history subagent forks.
GitOrigin-RevId: 4625cf7c6a5490176adddfaa0fb99100707daea9
## What changed
- Include the resolved Guardian security policy in the v2 classifier's developer instructions.
- Prefer an explicit `guardian_policy_config`, then the reviewer model's catalog policy, and finally the bundled policy.
- Limit the combined classifier instructions and policy to 10,000 tokens.
## Testing
- Cover configured and catalog policies, policy truncation, and the bundled-policy fallback.
GitOrigin-RevId: 1b84d70081dd924e214636b4b470d57a63d7cb88
## What changed
- Bypass extension approval contributors when an approval request includes a retry reason, ensuring the retry is reviewed by Guardian.
- Add coverage showing that Guardian can deny an escalated retry even when an extension contributor would approve it, and that the retry reason is included in the review request.
GitOrigin-RevId: c8f556623f26fea605898d4b8e89679cebd63e65
## What changed
- Start Guardian reviewer delegates with an empty extension registry while preserving extension inheritance for other delegates.
- Disable `GuardianV2` in the reviewer session configuration so reviews do not trigger nested Guardian processing.
- Cover both the reviewer isolation and continued delivery of parent-session tool lifecycle events.
GitOrigin-RevId: 858b3e23d1c06177e443fb0779fcf06cc5294fc2
## What changed
- Add the stable, default-enabled `unbounded_connection_retries` feature.
- Require the feature for unbounded sampling retries after connection failures.
When disabled, connection failures use the existing bounded retry and
transport fallback path.
- Expose the feature in the generated configuration schema.
GitOrigin-RevId: bd80d02ef065ba924f805c29b639752fc817ed64
## What changed
- Give approval review contributors the first opportunity to resolve an action when automatic review is not required for the model.
- Return an extension's decision directly and fall back to Guardian when no extension claims the review.
- Update Guardian V2 to approve actions below its risk threshold through the review contributor API, and remove the extension approval-policy API.
## Testing
- Verify that an extension approval bypasses both the Guardian model call and the user approval prompt.
- Cover Guardian V2 review decisions for low-risk, high-risk, and disabled threads.
GitOrigin-RevId: 5be56941143aff6f358b75b5f8101b7c047147ae
## Why
Concurrent Guardian samples can finish out of order, allowing an older sample to
replace the thread's newer in-memory security risk score.
## What changed
- Record when each `SecurityRiskScore` sample starts while preserving compatibility
with records that have no timestamp.
- Add `ExtensionData::insert_if` so checking and replacing a typed attachment happen
under the same lock.
- Update Guardian V2 to replace the thread's risk score only when the completed sample
is newer than the stored one.
## Testing
- Verify concurrent conditional inserts retain the newest value.
- Verify Guardian-generated risk scores include a sampling timestamp.
GitOrigin-RevId: 6543a4e5497da4c623331050789e91613f931c4b
## What changed
- Add a thread-scoped extension API for requesting automatic review, resolving
multiple contributors to the strongest requirement.
- Have Guardian v2 request automatic review when it is enabled and the latest
`action_risk` score is at least `0.8`.
- Honor extension review requirements across tool approvals, MCP elicitation,
and remote execution while preserving host configuration and managed-policy
constraints.
## Testing
- Cover contributor registration and requirement resolution.
- Verify Guardian v2 requests review at the threshold, returns to the default
below it, and does not affect threads where the extension is disabled.
- Exercise extension-requested strict review with a remote model override.
GitOrigin-RevId: 6329fc23585d5cc7173c39bb9952c3109ec3884b
## What changed
- Invoke `ToolLifecycleContributor::on_tool_start` only after pre-tool hooks
have finalized the invocation.
- Pass hook-rewritten arguments and the post-hook conversation snapshot to the
callback.
- Skip the start callback when a hook denies execution or supplies input that
cannot be applied.
## Testing
Add lifecycle tests covering rewritten input, hook-added context, denied tool
calls, and invalid rewritten input.
GitOrigin-RevId: 936efaf4a8c35321f9982ff2a33bb8bece1ebf39
## What changed
- Replace the single `category` and `score` fields in `SecurityRiskScore` with a
deterministic map of category names to scores.
- Validate the full Guardian V2 classifier response before storing it as one
thread extension value and, for non-ephemeral threads, one rollout item.
- Cover serialization and rollout loading with snapshots containing multiple
score categories.
GitOrigin-RevId: 24525de691f96bd34ccfe04acab2f01aca309837
## What changed
- Add `EnvironmentConfigState` to `TurnEnvironmentSelection` so each environment attachment can inherit thread configuration or carry ready configuration for its login-shell policy and selected capability roots.
- Apply ready configuration during thread creation and thread-settings updates while reusing the existing environment connection.
- Validate selection configuration before applying settings, rejecting unsupported pending state and invalid capability roots.
## Testing
- Cover attachment-scoped capability roots, ready configuration at thread startup and turn updates, and rejection of invalid selections without changing existing settings.
GitOrigin-RevId: 86cf8f2148fdaa746ea0dd12890ab7b1577d7587
## What changed
- Set `parallel_tool_calls` for regular and remote compaction prompts without consulting model metadata.
- Remove `supports_parallel_tool_calls` from `ModelInfo`, the bundled model catalog, and related fixtures.
- Preserve the existing Responses Lite behavior that disables parallel tool calls at request construction.
GitOrigin-RevId: 49552bdf97e71fa57325abb49f8adc0c88f1401a
## What changed
- Route MCP tool calls through the automatic reviewer when strict auto-review is enabled, even when the approval policy, tool annotations, or a remembered session decision would otherwise skip review.
- Pass the strict auto-review flag into the MCP approval request so reviewer selection follows the turn setting.
- Update MCP approval and turn-metadata tests to cover the forced review path and confirm that it does not request user input.
GitOrigin-RevId: 2c0b5f4dc1a15cb2fb827e4b21e69167fdcf3e56
## What changed
- When an explicitly selected plugin has apps available, instruct the model to use `tool_search` to discover relevant tools before falling back to unrelated or built-in tools.
- Scope the guidance to the request that selected the plugin and omit it for plugins without available apps.
## Testing
- Cover app-specific rendering, non-app plugins, bounded instruction output, and app enablement in dual-surface plugin requests.
GitOrigin-RevId: 1b9501cc403d2817334a9307e683e99c140a794a
## What changed
- Add the canonical agent path as `agent_name` in Responses API turn metadata.
- Fall back to `/root` when a session has no canonical agent path.
- Reserve `agent_name` from client metadata overrides and omit it from MCP request metadata.
## Testing
- Cover root, named subagent, legacy subagent, MCP, and client metadata merge cases.
GitOrigin-RevId: a9adcc079a51beae7d621aba24bcd759ceaa408e
## What changed
- Store `TurnEnvironmentSelection` directly on each resolved `TurnEnvironment`
instead of copying its environment ID, working directory, and workspace roots
into separate fields.
- Update environment resolution, tool execution, approvals, and related tests to
access selection state through the retained value.
GitOrigin-RevId: ab723d21e112b8af5bcaf1f772a5e376553312bc
## What changed
Implement `From<AbsolutePathBuf>` for `FileSystemPath` and use the conversion
when constructing concrete filesystem permission paths.
GitOrigin-RevId: 244bcbd0c3f76cd87cc1240458fcac6c9ef0a8e3
## What changed
- Add experimental `thread/queue/add`, `list`, `update`, `delete`, `reorder`, and `start` requests for persistent queued user submissions.
- Automatically dispatch queued submissions in FIFO order after completed or failed turns, while leaving the queue paused after interruption.
- Emit `thread/queue/changed` notifications and expose paginated queue contents with stable submission and client message IDs.
- Export the new protocol types through the generated JSON Schema and TypeScript bindings.
## Testing
- Add app-server integration coverage for capability gating, CRUD, pagination, capacity limits, notifications, automatic dispatch, cold-thread resume, interruption, and explicit queue starts.
GitOrigin-RevId: 89caf5577192199bda77cf6c372a59d26cdd910e
## What changed
- Preserve valid image content from completed `node_repl` Code Mode responses alongside text evidence for Guardian reviews.
- Enable multimodal evidence for models that require automatic `node_repl` review, or when both `guardian_enhanced_node_repl_transcripts` and `guardian_node_repl_transcript_images` are enabled.
- Bound retained and rendered evidence, deduplicate images already present in review history, and fall back to text-only evidence when the reviewer lacks image support or prompt capacity.
- Keep review evidence out of the parent turn input.
## Testing
- Cover feature gating, mixed text and image ordering, truncation and eviction, unsupported reviewers, prompt pressure, image detail normalization, and reused review sessions.
GitOrigin-RevId: a3e482402f7b3484401b231dadc662e6e3504fdf
## What changed
- Add `oauth.callback_port` to MCP server configuration and preserve it when
serializing configuration edits.
- Accept `oauth.callbackPort` from plugin MCP declarations and skill dependency
metadata.
- Prefer the server-specific callback port over `mcp_oauth_callback_port` for
CLI login, app-server, plugin installation, executor, and skill dependency
OAuth flows.
## Testing
- Cover configuration parsing, serialization, and fallback behavior.
- Verify plugin, executor, and skill OAuth registrations use their configured
callback ports instead of the global port.
GitOrigin-RevId: 7f65e5e7869358307e49779f1b75e8672b607736
## What changed
- Exclude current-time reminder developer messages when copying parent history into a full-history subagent.
- Keep the child's newly generated reminder, preventing inherited reminders from accumulating while preserving the rest of the forked context.
## Testing
- Extend the full-history V2 spawn test to verify that two reminders in the parent become one fresh reminder in the child request.
GitOrigin-RevId: fb61c72f7f0d61d1068f2c599a8b8caf1788b7e2
## Why
Client-authored developer instructions should remain available after a context
window is compacted when `retain_client_developer_messages` is enabled.
## What changed
- Preserve annotated client-authored developer messages during remote compaction
v2 and local token-budget context resets.
- Apply the existing retained-message token budget when carrying those messages
into the new context window.
## Testing
- Cover enabled and disabled retention for remote compaction v2, manual
token-budget compaction, and mid-turn automatic compaction.
GitOrigin-RevId: 4cb3782cb86ef46458413a17a3255d0016fd675f
## What changed
- Wrap injected current time reminders in `<current_time_reminder>` tags.
- Keep direct `clock.curr_time` tool output and log previews as plain text.
## Testing
- Update core and app-server coverage for tagged reminders and untagged tool output.
GitOrigin-RevId: ad27f1fa10cca7f83d1ac731e01255320bb60f47
## Why
Guardian V2 needs the requested action and its conversation context to assess
risk; a tool name and call ID alone do not describe what the tool will do.
## What changed
- Expose the original, pre-hook `ToolPayload` to tool lifecycle contributors.
- Build Guardian V2 classifier input from the bounded conversation transcript
and a structured planned-action object containing the tool name and arguments.
- Warn and skip classification if the planned action cannot be serialized.
## Testing
- Verify lifecycle contributors receive tool arguments.
- Verify Guardian V2 sends transcript history and planned-action JSON to the
classifier.
GitOrigin-RevId: 28266ef7c1d2267ba705fcfbd9be4ef48e64e104
## What changed
- Add the experimental `thread/revert` request, which replaces a loaded paginated thread's durable history with the prefix before `beforeTurnId` while preserving the thread ID.
- Interrupt any active turn, reload the replacement history without unloading the thread, preserve mutable thread settings, and emit `thread/reverted`.
- Return backward pagination cursors for the retained turns and items, reject stale rollout paths after a revert, and document that local file changes are unaffected.
## Testing
- Cover history replacement, pagination, stale paths, missing turns, subsequent turns, active-turn interruption, and preserved thread settings.
GitOrigin-RevId: 435a8163ad4f310cc47219b436f6bdde21f2b83a
## What changed
- Keep the configured `approvalPolicy` when a model in
`auto_review.required_on_models` selects the `auto_review` reviewer.
- Continue downgrading full-access sessions to workspace-write and rejecting
incompatible reviewer overrides.
## Testing
- Cover supported approval policies across thread start, settings updates,
turn-time model switches, resume, and fork flows.
GitOrigin-RevId: 2bd3e2dcd46f3cadeb2fad20222cf8917c267208
## What changed
- Use the specialized Node REPL approval guidance only when the parent turn's
model sets `node_repl_auto_review_required`.
- Keep Node REPL JavaScript requests on the generic approval prompt otherwise.
- Cover both prompt paths in the Guardian tests.
GitOrigin-RevId: e3eb89a59cc74fe2b53bb1c3f29a30d450e173de
## Why
The model provider does not reliably identify which curated plugin catalog is
available. ChatGPT authentication can be used with a custom provider, while an
unauthenticated session should use the API-compatible catalog regardless of its
provider.
## What changed
- Select the ChatGPT curated catalog only for authentication modes that use the
Codex backend; use the API curated catalog for API-key and unauthenticated
sessions.
- Initialize standalone plugin managers with the current authentication mode
across CLI, app-server, MCP, and external-agent migration paths.
- Preserve authentication mode while detecting and importing migrated plugins.
## Testing
- Cover catalog and skill routing across ChatGPT, API-key, unauthenticated,
Bedrock, and custom-provider configurations.
- Verify authenticated plugin migration uses the ChatGPT curated marketplace.
GitOrigin-RevId: 660a339ee8891c33aad961078d3a979242a6a166
## Why
JavaScript executed through the Node REPL can invoke connected MCP, browser,
or computer-use tools, so reviewing only the outer tool call does not capture
its immediate effects.
## What changed
- Add dedicated Guardian review guidance for `node_repl` `js` requests that
evaluates nested calls, authorization boundaries, staged data, and concrete
side effects.
- Keep the existing generic approval prompt for other MCP tools and shell
requests.
## Testing
- Cover the dedicated Node REPL prompt, retry reasons, serialized request data,
and the generic fallback behavior.
GitOrigin-RevId: bf8d49d7e3dc3d36aa41b6b56ff8a0eb02da3e53
## What changed
- Treat workload identity environment markers as an explicit authentication selection, even when another process credential is present.
- Return initialization errors from `AuthManager` and propagate them through commands and services instead of continuing with an unusable authentication state.
- Make `codex login status` validate workload identity, keep the TUI on an embedded app server for local workload identity, and reject workload identity in `codex mcp-server`, where it is unsupported.
## Testing
- Cover workload identity precedence and partial configuration errors.
- Verify login status reports an unreadable identity assertion and app-server routing enforces the supported workload identity topology.
GitOrigin-RevId: efc6b6b4cd4d61652617de82aaa3d7ffc75d6618
## What changed
- Make `ThreadEnvironments` the source of truth for live environment selections and use it when building configuration snapshots, permission profiles, per-turn configuration, and MCP refresh inputs.
- Keep settings previews side-effect free while applying accepted environment updates consistently to subsequent turns.
- Move `EnvironmentConfig` into `codex-protocol` so environment ownership no longer depends on a core-only type.
## Testing
- Cover environment previews and snapshots, accepted and rejected steer updates, and active-turn environment stability.
GitOrigin-RevId: 7bcf8fb5df1215f720e4e9c419541a51a871aa5e
