## What changed
Represent denied read paths and globs with `PermissionContext` and render them through a sync-only section in `codex-guardian-context`. Keep policy resolution in the host and preserve the existing permission warning in Guardian review prompts.
## Testing
Extend registry tests to verify permission sections appear only for synchronous reviews. Extend the session reuse test to check that resolved denied paths and globs appear in both the initial review request and the next review's delta.
GitOrigin-RevId: a966a14b367f1eedb5a577f7ed74a869559ae646
## Why
A code-mode `exec` wrapper and its nested tool calls each advance Guardian's score lag. Counting the unscored wrapper against its own nested approval can trigger a synchronous review sooner than needed.
## What changed
Track originating response items and approval tool-call IDs so cached approvals discount their own wrapper when it is newer than the latest score. Preserve wrapper identity across yields and waits, and retain the full lag when provenance is missing or evicted. Other wrappers and scoring failures still count.
Use the current `write_stdin` call's identity for approval freshness, and omit tool-call identity for `execve` intercepts that only retain the launch ID.
## Testing
Add coverage for wrapper-specific discounts, already-scored wrappers, missing and evicted provenance, identity across code-mode resumes, and approval identities for stdin writes and `execve` intercepts.
GitOrigin-RevId: 4002a06d64c4e1e0a13c072303503d6ddfacad09
## Why
Concurrent parent compaction can remove evidence between Guardian checkpoint selection and prompt construction. New user instructions or answers received during a review can also invalidate an approval based on earlier authorization.
## What changed
- With `GuardianThreadContext` enabled, use the same parent history snapshot for checkpoint selection and prompt evidence.
- Cancel completed allow decisions if the owning session's user-message revision or root authorization version changed during the review, even without cacheable review evidence.
## Testing
Add regression coverage for evidence preservation during concurrent compaction and aborted approvals after new user instructions or verified answers. Extend reviewer context rollover coverage to exercise `GuardianThreadContext`.
GitOrigin-RevId: 1c2c82197a27c0d3d45b6fe08d200a835d80cc30
## What changed
- Let approval extensions choose between cached approval, synchronous review, and a user prompt for tool and permission requests, while core enforces mandatory Guardian and fresh-review requirements.
- Carry an optional `review_reason` on Guardian assessment events and use it to trigger strict-review notifications, retaining the fallback for older events.
- Require synchronous review when cached evidence has an unusable encrypted parent compaction.
## Testing
Add regression coverage for manual prompts and cached approvals with non-UTF-8 working directories. Update approval contributors in existing tests to use the decision API.
GitOrigin-RevId: a4e66416070bdaa881daa41429c49021629f44c1
## What changed
Capture the ID from `response.created` and pass it as `parent_response_id` in Guardian review and classifier request metadata. Clear the current response ID before sampling retries so tool reviews cannot inherit a failed response's ID.
Request Guardian credits with `guardian_credits_requested` on eligible parent requests. Remove the ticket protocol, transport attachment, and ticket-specific body redaction. Keep ordinary app-server client `parent_response_id` values inside `x-codex-turn-metadata` rather than promoting them to Guardian request metadata.
## Testing
Update coverage for HTTP fallback, WebSocket review reuse, missing response IDs, classifier transport retries, and code-mode yield/resume attribution. Extend app-server tests to verify client metadata placement over HTTP and WebSocket.
GitOrigin-RevId: c1665e56382ecec8d260fc2ca0ecd5e20b0b2391
## Why
Guardian approval actions can contain paths from a remote executor whose path convention differs from the host, such as Windows paths reviewed on a POSIX host. Converting those paths to host-native absolute paths prevents the action from being reviewed.
## What changed
- Render command working directories using the executor's reported path convention, and preserve URI-backed paths for attribution.
- Carry foreign command and patch paths through Guardian events and app-server schemas as legacy path strings.
- Bound remote plugin attribution within the overall review deadline and reject Guardian action payloads that exceed the review byte limit.
## Testing
- Cover Windows and POSIX executor path rendering, foreign patch paths, protocol round trips, oversized payload rejection, and remote Guardian review context.
GitOrigin-RevId: 38be0fcdac897139519e74e077eb5cb4f8f8017e
## What changed
- Request and parse server-issued Guardian tickets for eligible Codex backend responses.
- Scope each ticket to the response that produced a Guardian review or classifier request, including HTTP and WebSocket retries, without adding it to model-visible or persisted context.
- Validate ticket shape, reserve its metadata keys, redact it from debug and request-body logging, and attach it only at the Guardian transport boundary.
## Testing
- Cover ticket parsing, endpoint and authentication routing, retry scoping, classifier retries, and redaction for compressed and uncompressed requests.
GitOrigin-RevId: 6219dd15c9f19ed3387de516aac1b8e7c9cdb0e3
## What changed
- Add the hidden `gpt-6-astra` model definition, including its reasoning levels,
tool capabilities, context limits, agent instructions, and review policies.
- Reorder existing model priorities around the new catalog entry and provide the
browser-use policy to the bundled auto-review model.
- Keep TUI snapshots pinned to `gpt-5.6-sol` and make Guardian coverage read the
policy from the model selected by each test case.
- Allow the expanded `models.json` through the repository blob-size check.
GitOrigin-RevId: 039b224b91ca35c8d894cf6d23568bc6dc18ceeb
## Why
Directly deserializing the flattened `RolloutLine` envelope can reject nested
decimal values, preventing affected paginated sessions from resuming.
## What changed
- Add canonical string, byte, and reverse-scanner helpers that decode rollout
records through `serde_json::Value` before decoding the flattened item.
- Route rollout readers across session discovery, history, migration, search,
thread storage, and transcript previews through those helpers.
- Remove `Deserialize` from `RolloutLine` so new readers cannot bypass the
canonical persistence decoder.
## Testing
Add coverage that resumes a paginated rollout after a token-count record with
a decimal rate-limit value and verifies that ordinal sequencing continues.
GitOrigin-RevId: 49abac1e0751c073daa5a93a840d8a483fd2d013
## Why
Reports from a large thread tree can exceed the rollout attachment limit, making
the threads involved in a failed Guardian review harder to diagnose.
## What changed
- Prioritize descendants with retained failed reviews when selecting bounded
report rollouts, while always preserving the reported thread.
- Include each selected thread's available Guardian trunk rollout alongside its
conversation rollout.
- Add a thread index attachment with selected filenames, bounded omission details,
retained failure threads, and the process-wide discarded-record count.
- Link failed-review records to their reviewed turn and target item when available.
## Testing
- Cover failed-review prioritization, bounded omission metadata, discarded-record
accounting, and turn/item linkage in Guardian report records.
GitOrigin-RevId: ae7916c27a3c279e899cd5a6ead8a4b7e0cc26a1
## What changed
- Retain bounded, process-local records for failed Guardian reviews, including the reviewed action, decision, status, model, instructions, and reviewer history.
- Add recent records from the reported thread and its descendants to log-enabled report uploads as `auto-review-failures.jsonl`.
- Preserve the action and decision while omitting oversized reviewer context, and exclude successful, ephemeral, and capture-disabled reviews.
## Testing
- Cover denied and invalid decisions, cleaned-up ephemeral reviewers, descendant-thread selection, record count and byte limits, and oversized-context fallback.
GitOrigin-RevId: 5f12f7605041c3c84e826e6bac1cf06b1518ab24
## What changed
- Add `auto_review.node_repl_policy` to model messages for `node_repl` and `cua_repl` reviews.
- Use the reviewer model's configured policy, falling back to the bundled policy when the field is absent and skipping injection when it is explicitly empty.
- Include the effective policy in Guardian session reuse checks and reject unsafe parent-model fallback transitions that would change it.
## Testing
- Cover catalog, bundled, and explicitly empty policies across Node and CUA review paths.
- Verify that policy changes invalidate cached reviewer sessions and incompatible fallback transitions.
GitOrigin-RevId: 51c0bdfed9b464091b6eb47d91ca5a0990d7a315
## Why
Environment-backed stdio MCP servers have no host-local working-directory
fallback, so their test fixtures must provide a workspace explicitly.
## What changed
- Set the fixture workspace as `cwd` for environment-backed MCP servers across
the core integration tests.
- Reuse the same test environment when configuring MCP servers and building
fixtures that need an explicit working directory.
GitOrigin-RevId: e38f2029e01fc1377cdc34d01a392ad310419766
## Why
The `core` and `tui` Bazel targets treated nearly their entire crate trees as
compile-time data, mixing embedded runtime resources with source files and test
fixtures.
## What changed
- Move embedded resources for `core` and `tui` into dedicated `assets/`
directories and update their `include_str!` paths.
- Restrict Bazel compile data to explicit asset and frame directories.
- Move test-only prompts into `tests/fixtures`, resolve the core prompt through
`find_resource!`, and reuse the integration-test file glob when assembling
Bazel test data.
GitOrigin-RevId: eee9b0e41df77ea2604215a7f7333a6fe8317bfa
## What changed
- Generate a UUIDv7 turn ID for each Guardian classification and preserve it across retries.
- Record the owning turn as `parent_turn_id` and propagate its trusted `root_turn_id` when known, including through the tool lifecycle extension API.
- Omit ambiguous or unknown root lineage and keep classification identities distinct when reusing Guardian sessions and WebSocket connections.
## Testing
- Cover classification metadata across retries, connection reuse, concurrent samples, auth refresh, and consecutive owning turns.
GitOrigin-RevId: 78757f2ad031844e4b545802f634c678a9ee2298
## Why
Long-lived Guardian sessions can exhaust the review model's context window. After
a rollover, a transcript delta is insufficient because the new window no longer
contains the original transcript or persistent review instructions.
## What changed
- Compact an exhausted Guardian session before submitting the next review while
respecting the review model's token-budget configuration.
- Detect whether the full transcript remains in the reviewer history. If it does
not, reset transcript and Node REPL evidence cursors so the next review replays
the complete transcript and associated image evidence.
- Restore the follow-up reminder and Node REPL policy when compaction removes
them.
## Testing
- Cover rollover both when the reviewer window is already exhausted and when a
follow-up reminder crosses the limit.
- Verify that multimodal reviews preserve the fallback buffer and replay browser
evidence after rollover.
GitOrigin-RevId: f2a02a84e1f25d15c6e2b8eddb93e2d1805449f5
## Why
Trusted Guardian reviewer sessions can emit events without an app-server listener, leaving their turns and tool usage absent from analytics.
## What changed
- Translate Guardian session lifecycle and canonical tool item events into analytics notifications while excluding messages, reasoning, and review content.
- Preserve Guardian lineage during prewarming even when inherited client metadata is not yet available, without emitting an incomplete thread initialization event.
- Limit direct session tracking to trusted Guardian children so resumed threads that have an app-server listener do not report duplicate events.
## Testing
- Cover completed, failed, and interrupted Guardian turns, tool counts and timing, lineage, content exclusion, prewarmed lineage, and resumed-thread deduplication.
GitOrigin-RevId: 70ace5f7ed30a7e3b6a9d6097c8b2a6a326dc4f7
## What changed
- Add effective workspace roots to `EnvironmentConfig` and use them when
materializing permission profiles and filesystem context.
- Preserve selection roots for thread-owned configurations while allowing a
ready environment attachment to supply its resolved roots.
- Propagate resolved roots to child environments and validate both command and
`apply_patch` writes in owner-provided secondary workspaces.
GitOrigin-RevId: 1832c168ce1fc37fa67efc2a472998ab4f448c70
## What changed
- Add the opt-in `features.guardianv2.free_guardian` setting to route eligible
Guardian reviews to `/guardian` and asynchronous classifications to
`/guardian-classifier`.
- Support endpoint selection for both HTTP and WebSocket Responses clients,
including endpoint-aware connection reuse.
- Keep `/responses` for API-key authentication, custom provider URLs,
non-Guardian models, and configurations where the option is disabled.
- Omit routing hints and `service_tier` from requests sent to the dedicated
Guardian endpoints.
## Testing
- Cover route selection across authentication modes, provider URLs, HTTP
fallback, WebSocket review sessions, and classifier sampling.
GitOrigin-RevId: 9c88673c710d009e0239559b9245a4e6c4f4befc
## What changed
- Add Windows sandbox mode, private-desktop behavior, and legacy Landlock selection to each `EnvironmentConfig`.
- Centralize sandbox context construction on `TurnEnvironment`, preserving environment-owned permissions, paths, and backend settings while applying additional permission grants.
- Use the environment-derived context for project instructions, capability discovery, file uploads, and filesystem-oriented tools.
## Testing
- Verify capability discovery uses the selected environment's permission profile and sandbox backends when they differ from the thread defaults.
GitOrigin-RevId: 7ae2fed90c8ada950f2e8431e571e9b2c793c291
## What changed
- Split the approval review contributor into a `fast_decision` path for existing evidence and a `full_review` path for structured reviews.
- Add host-owned full-review inputs with action evidence, conversation history, thread and turn identifiers, approval context, and extension data.
- Add structured assessment and error types, and resolve full reviews using the first contributor that claims the request.
## Testing
- Cover full-review input propagation, first-claim ordering, and short-circuit behavior in the extension registry tests.
GitOrigin-RevId: 6f763d874af8c0b66a0d760b7b7c7dfe32251c9e
## What changed
- Recognize `cua_repl` alongside `node_repl` when collecting Guardian review evidence, applying computer-use policy, and capturing transcript images.
- Render `cua_repl.js` results with the compact REPL history and transcript views.
- Preserve failed MCP call status and result content when replaying app-server history.
## Testing
- Cover both REPL server names across Guardian policy, evidence, image capture, history rendering, and failed-call replay tests.
GitOrigin-RevId: 8c13a721f718add403b07e727c1634b59203c51a
## Why
Guardian reviews were reported with the generic `subagent` thread source, making them indistinguishable from other delegated threads in persisted metadata and analytics.
## What changed
- Add the `guardian_review` thread source to the core protocol and app-server schema.
- Assign it to Guardian reviewer sessions and propagate the configured source through turn metadata, rollouts, and analytics.
- Continue treating Guardian reviews like subagents for paginated history and trusted-provenance checks.
## Testing
- Cover protocol round trips, delegate source selection, emitted analytics, request metadata, and persisted rollout metadata.
GitOrigin-RevId: 07480c122715812874c9d3b48bb39fc5c86b2367
## Why
Commands requesting `sandbox_permissions=require_escalated` need a full Guardian review even when they are not marked as retries.
## What changed
- Treat escalated command requests, along with retries, as requiring synchronous Guardian review.
- Bypass extension approval and Guardian V2 shortcuts for these requests.
## Testing
Add an integration test that installs an auto-approving extension and verifies that an escalated command still reaches Guardian and honors its denial.
GitOrigin-RevId: 30eed273460f3c3c6b24d1ce2d29889e34513afd
## What changed
- Add `rejection_instructions` and `timeout_instructions` to catalog-provided auto-review messages.
- Use the acting model's instructions for denied and timed-out reviews across tool approvals, shell escalation, and MCP elicitation responses.
- Fall back to the existing instructions only when a catalog value is absent, while preserving explicit empty-string overrides.
## Testing
- Cover catalog overrides, legacy fallbacks, empty values, and separation between acting-model and reviewer-model messages.
GitOrigin-RevId: c5b2c2dbdaefd45d1d658651dd1abaeb6d8c93da
## Why
An `apply_patch` path can be replaced with a symlink after verification, allowing an unsandboxed patch operation to reach a different file than the one that was approved.
## What changed
- Add `follow_symlinks` options to executor filesystem reads, writes, metadata lookups, directory creation, and removal, including the corresponding `followSymlinks` protocol fields.
- Implement no-follow filesystem operations on Unix and Windows that reject links in any path component and restrict file access to regular files.
- Run `apply_patch` with symlink traversal disabled when an otherwise-required sandbox is bypassed, while retaining the existing follow-symlink default for standalone callers.
## Testing
- Cover leaf and ancestor symlinks across patch add, update, delete, and move operations, including a path swap after verification.
- Exercise local and remote no-follow filesystem behavior, concurrent directory creation, special-file rejection, and Windows reparse points.
GitOrigin-RevId: 43fd479084891493ce13564fbd894b98f329c6dd
## What changed
- Add environment-provided MCP restrictions for configured and plugin-provided servers.
- Disable attachment-scoped servers while their environment configuration is pending, failed, or unselected, while preserving selected-plugin access and the controller-owned Apps server.
- Apply the resolved policy to runtime startup, model tool exposure, telemetry, OAuth flows, and skill dependency installation.
## Testing
- Cover policy filtering for configured and plugin servers, environment state transitions, Apps ownership, and managed OAuth rejection.
GitOrigin-RevId: 7ca5d4dda14068e758497f88835d5cba685e159e
## What changed
- Add a dedicated developer policy for Guardian reviews of Node REPL browser and computer-use actions.
- Inject the policy once before the first eligible Node REPL approval and retain it when the reviewer session is reused.
- Include Node REPL policy eligibility in the reviewer reuse key so sessions are not reused across incompatible model settings.
- Keep the approval request itself on the generic planned-action format.
## Testing
- Cover first-action injection, reuse after a shell review, repeated Node REPL reviews, and ineligible parent models through the production approval path.
GitOrigin-RevId: bfce190ff8599788aa85e388cc6a959d27fb489c
## Why
Filesystem permission paths can use a convention that differs from the host
running Codex. Converting them immediately to native absolute paths can change
the meaning of ambiguous paths such as `/C:/secret` or Windows UNC paths.
## What changed
- Store literal filesystem permission paths as `PathUri` values through the
runtime policy and execution protocol.
- Keep legacy string-based serialization at explicit protocol boundaries and
reject conversions that cannot be represented losslessly.
- Encode native paths as opaque URIs when a normal file URI would imply the
wrong path convention.
## Testing
Added coverage for cross-platform and ambiguous path round trips, UNC path
variants, permission-profile serialization, and deny-policy enforcement.
GitOrigin-RevId: 5247713796d1f2bb4e02f94eb9fc82d4698060f0
## What changed
- Add `EnvironmentNetworkPolicy` as a serializable view of portable domain,
Unix-socket, upstream-proxy, and local-binding restrictions without exposing
controller-owned proxy runtime settings.
- Add an optional `network_policy` field to `EnvironmentConfig` and re-export
the policy and related permission types through the core APIs.
- Reject owner-provided network policies during environment preview and
readiness until runtime enforcement is implemented, while preserving the
existing controller policy when the field is absent.
## Testing
- Cover rejection through both environment preview and readiness, including
preservation of the existing environment selection.
GitOrigin-RevId: 80ad4cf4d4a45632daa7a823e6cf568eb0e8bb80
## What changed
- Add an optional restrictive execution policy to `EnvironmentConfig` and merge it over the active command policy for shell execution and approval decisions.
- Reject environment policies that contain allow rules, so environment configuration can only tighten command access.
- Include the environment policy fingerprint in cached approval keys so policy changes require fresh session approvals.
## Testing
- Cover restrictions overriding saved prefix approvals, policy changes invalidating session approvals, and environment overlays remaining effective when model-specific prefix filtering is active.
GitOrigin-RevId: e94f877549ed5e0f577b8cb52f3c1872c58f029d
## What changed
- Carry `ShellEnvironmentPolicy` in each resolved `EnvironmentConfig` and use
the selected turn environment's policy for shell commands, user shell tasks,
and unified exec.
- Infer the policy from the thread configuration when an environment does not
provide its own resolved configuration.
- Redact the policy from `EnvironmentConfig` debug output because it can contain
explicit environment variable values.
## Testing
- Verify shell handlers and unified exec filter inherited variables according
to the selected environment while preserving its explicit overrides.
GitOrigin-RevId: 9f6a52aa4af60e5f17251a0e1b11e1926b779055
## Why
Responses WebSocket fallback is session-scoped. A delegated session created
after its parent switched to HTTP could otherwise make another WebSocket
connection attempt.
## What changed
Disable WebSocket support for a delegated session when the parent session has
already fallen back to HTTP.
## Testing
Add a guardian review regression test that verifies only the parent's initial
WebSocket attempt occurs and the guardian request uses the HTTP response path.
GitOrigin-RevId: 1345f8fe739f55975aef432045348eae5a9278d6
## What changed
- Add a resolved `permission_profile` to each `EnvironmentConfig` and use the
complete attachment config for execution and capability-root selection.
- Let `Ready` environment configurations override thread permissions while
`FromThread` selections continue to inherit them.
- Restrict inherited Guardian environment profiles to read-only permissions.
## Testing
- Add coverage proving that a read-only environment blocks writes even when
the thread permits workspace writes.
- Update environment inheritance, Guardian review, and capability-root tests
for the resolved attachment configuration.
GitOrigin-RevId: 1a313b9e4892b1a579a0e880e322a782b4f6c0a7
## What changed
- Start Guardian reviewer delegates with an empty extension registry while preserving extension inheritance for other delegates.
- Disable `GuardianV2` in the reviewer session configuration so reviews do not trigger nested Guardian processing.
- Cover both the reviewer isolation and continued delivery of parent-session tool lifecycle events.
GitOrigin-RevId: 858b3e23d1c06177e443fb0779fcf06cc5294fc2
## Why
Guardian review sessions must not gain access to paths that the parent turn is
not allowed to read.
## What changed
- Derive Guardian permissions by intersecting managed parent filesystem rules
with read-only access, preserving denied paths and restricting network access.
- Offer Guardian execution tools only when a managed sandbox can enforce those
rules.
- Include the selected environment IDs in the review-session reuse key so a
session is not reused across different environment sets.
## Testing
Update the Guardian reuse integration test to verify that a review cannot read
a parent-denied file or write a local file while consecutive reviews still
reuse the same session.
GitOrigin-RevId: 20f17a6c379f1eda651e8508459d642a51e4ce94
## What changed
- Add `TurnInputRequest` and typed submission results for atomically starting a turn, steering the active turn, or declining input with a specific reason.
- Expose `start_or_steer_turn`, `start_turn_if_idle`, and `steer_turn` on `CodexThread`, and migrate Core consumers to these APIs.
- Make app-server `turn/start` steer an active regular turn and return that turn's ID. Reject incompatible output schemas and non-steerable turns without applying settings or enqueueing input.
## Testing
- Cover concurrent start-or-steer submissions, accepted and rejected settings updates, output-schema compatibility, idle-start rejection, and app-server steering.
GitOrigin-RevId: dd9b5528d76ec650c019e97af420bc13190ea86a
## Why
`parent_turn_id` identifies the immediate caller of a nested request, but not the
top-level turn that initiated a multi-level chain of work.
## What changed
- Add `root_turn_id` to turn state, submissions, and Responses API metadata.
- Propagate the root through spawned agents, delegated work, review sessions, and
turn-triggering inter-agent messages.
- Omit the root when background work has no user turn or combined input makes the
root ambiguous.
## Testing
Added coverage for nested agent resumes, reviews, mailbox delivery, steered input,
and reserved metadata handling.
GitOrigin-RevId: 60057db2ee81f4efefa946a9f63c74ff98b93929
## What changed
Add integration coverage verifying that Guardian receives both the user prompt
and the outer code mode `exec` source when reviewing a nested escalated
`exec_command` call.
GitOrigin-RevId: e78e9d4d69e7ebccc935c548565a07600659f65a
## What changed
- Add `codex-history` for model-history and persisted-rollout domain types, including `RolloutItem`, `RolloutLine`, `CompactedItem`, and initial/resumed history state.
- Re-export the persisted types from `codex-rollout` and update consumers to use the new crate boundary instead of `codex-protocol`.
- Preserve existing rollout serialization, including legacy numeric compacted-window IDs.
## Testing
- Add `codex-history` tests for rollout JSON round trips, compacted-history compatibility, persisted history modes, and multi-agent version selection.
GitOrigin-RevId: 944daa9297ddd231d3aebbdcb05fff4adf8b4e1b
## What changed
- Add a Guardian circuit-breaker policy for models whose catalog specialty is
`cyber`.
- Interrupt those models after the first Guardian denial while retaining the
existing denial thresholds for other models.
- Centralize the `cyber` model-specialty identifier for use across core,
protocol, app-server, and TUI code.
## Testing
- Cover the cyber-specific threshold in the circuit-breaker unit tests.
- Verify end to end that a denied command is not executed and the turn is
interrupted after one denial.
GitOrigin-RevId: fad24c9e7aa280432580db1f0e39d13535779710
## What changed
- Select `gpt-5.6-luna` for Guardian approval reviews authenticated with an API key, while retaining `codex-auto-review` for ChatGPT authentication.
- Exercise API-key reviews through Responses Lite and fall back to the bundled Guardian policy when the selected model has no catalog-provided review policy.
- Refine the bundled policy's handling of trusted authorization, sensitive-data egress, credential probing, destructive command targets, and post-denial approval.
## Testing
- Cover provider model selection for API-key and ChatGPT authentication.
- Verify Guardian prewarming and review reuse with both Responses Lite and standard Responses requests.
GitOrigin-RevId: e35c43e1692fd643ab8faad1444c0d6a869b3e0c
## Why
Guardian reviews received sandbox retry reasons, but not the execution-policy reason that triggered an initial approval request.
## What changed
- Propagate approval and retry reasons through the tool approval flow and include the applicable reason in the Guardian prompt.
- Prefer a sandbox retry reason when both are available.
- Truncate approval context to 512 tokens while preserving the start and end of the reason.
## Testing
Added prompt and integration coverage for policy reasons, retry precedence, and truncation.
GitOrigin-RevId: 5b0f4e1c40b792b031bc8f7b31685a61d12b8d92
## Testing
- Verify consecutive tool reviews reuse the same Guardian session without
prewarming and execute both approved commands.
- Verify interrupting a pending Guardian review prevents command execution and
records an aborted tool result for the next turn.
GitOrigin-RevId: b8371ae82b4fef206857012589668f890f9305bf
## Why
The `<current_date>` in environment context could diverge from the clock used by current-time features, especially when a host provides an external clock.
## What changed
- Read the current time from the session's time provider whenever world state is built, and render its local date in environment context.
- Use each session's own thread ID for clock reads, including guardian sessions.
- Propagate clock-read failures through turn error events and stop before model inference.
## Testing
- Cover date updates across turns and app-server requests.
- Verify guardian clock reads use the corresponding root or guardian thread ID and do not run during prewarm.
- Verify clock failures emit an error without sending an inference request.
GitOrigin-RevId: bb7f32ccc0229b7bc6f14d7356db00bcce78066d
## Why
Parent context-window and auto-compaction overrides may describe a different
model than the one selected for Guardian review.
## What changed
- Clear `model_context_window` and `model_auto_compact_token_limit` when the
effective Guardian model differs from the parent model, allowing the review
model's own limits to apply.
- Preserve those overrides when Guardian uses the same effective model.
## Testing
Add unit coverage for both model-selection paths and verify that a Guardian
rollout records the selected review model's context window.
GitOrigin-RevId: ebc399f4eba37c7f279fd0d258154c00d45e2d00
## What changed
- Add an optional `policy_template` field to auto-review model messages.
- Build Guardian instructions from the catalog template when present, while
preserving the existing precedence for managed and catalog policy content.
- Fall back independently to the bundled template and bundled policy, and
preserve explicit empty catalog values.
## Testing
- Cover missing and empty template deserialization, policy precedence, bundled
fallbacks, and Guardian prewarm instructions.
GitOrigin-RevId: 93116dadbc9bf40527882844a428caed4159fff6
## What changed
- Add an `auto_review.policy` field to model catalog messages.
- Use the selected Guardian model's catalog policy for review-session instructions, while preserving the precedence of `guardian_policy_config` and falling back to the built-in policy when neither is present.
- Preserve auto-review messages when model instruction overrides remove catalog instruction templates.
## Testing
- Cover configured-policy precedence, explicit empty catalog policies, catalog-message preservation, and propagation of the catalog policy into a prewarmed Guardian session.
GitOrigin-RevId: 26b61ae2958ea8325a64834dcf91f47e140d74b3
## Summary
As part of our effort to start simplifying approvals code, this PR
extracts Guardian approvals logic from shell tool calls, and replaces it
with the ApprovalAction abstraction instead. This way, tools don't need
to know about Guardian at all.
## Testing
- [x] Adds integration test
## Why
The first auto-review currently creates its Guardian child session on
demand, adding avoidable latency before the review can begin. Creating
the ordinary Guardian child during parent-session initialization lets
that child use the existing session startup WebSocket prewarm before the
first escalation. This does not introduce a Guardian-specific prewarm
mechanism.
## What changed
- initialize the existing Guardian review-session manager owned by
`Session` when a thread starts with auto-review enabled and an approval
policy that routes to Guardian
- use the standard Guardian child-session construction and the existing
session startup WebSocket prewarm
- preserve the existing reuse-key invalidation and lazy creation
fallback when startup initialization fails or the effective review
configuration changes
- add an integration test that verifies normal root-session startup
emits a Guardian `generate=false` prewarm request
## Benchmark
I compared release builds against main. Each prompt first ran a
non-escalated `sleep 3`, then requested an escalated marker command.
| binary | count | avg Guardian duration | median Guardian duration |
avg Guardian TTFT |
|---|---:|---:|---:|---:|
| origin-main | 10 | 4008.7 ms | 3949.5 ms | 3746.5 ms |
| session-fix | 10 | 2865.0 ms | 2594.0 ms | 2492.7 ms |
Guardian duration fell by 28.5% and Guardian TTFT fell by 33.5%. These
measurements cover Guardian review latency; they do not measure parent
thread-start latency.
felixxia-oai