## What changed
- Track failed `exec` attempts whose handler ran for each active goal.
- Mark the goal as blocked after three qualifying failure turns.
- Reset the failure streak when any tool succeeds, and keep failures from carrying over to a replacement goal.
## Testing
- Cover failure classification, streak resets, goal replacement, and end-to-end goal blocking through the app server.
GitOrigin-RevId: 14dac7f4eb35507f12df3b2a82ab97bdafe7b897
## What changed
- Add a positive `output_token_limit` setting to each entry under an MCP server's `tools` configuration.
- Apply the most restrictive limit when plugin and user policies overlap, while keeping approval policy independent.
- Carry the effective MCP output budget in conversation history so tool output, post-tool hook responses, and resumed sessions use the same truncation limit.
## Testing
- Cover configuration parsing, serialization, schema validation, and plugin policy merging.
- Cover MCP output below and above the configured limit, post-tool hook responses, and session resume.
GitOrigin-RevId: d0beb4fca9ba6055d9e1d31c137373b465d50d61
## What changed
- Generate a UUIDv7 turn ID for each Guardian classification and preserve it across retries.
- Record the owning turn as `parent_turn_id` and propagate its trusted `root_turn_id` when known, including through the tool lifecycle extension API.
- Omit ambiguous or unknown root lineage and keep classification identities distinct when reusing Guardian sessions and WebSocket connections.
## Testing
- Cover classification metadata across retries, connection reuse, concurrent samples, auth refresh, and consecutive owning turns.
GitOrigin-RevId: 78757f2ad031844e4b545802f634c678a9ee2298
## What changed
- Assign type-prefixed IDs to Guardian classifier input items before sending the request, preserving existing IDs and reusing generated IDs across WebSocket retries.
- Add a prefixed ID to the memory phase-one user message.
## Testing
- Verify retried Guardian requests contain the same unique, prefixed item IDs.
- Verify the memory phase-one request includes a prefixed user-message ID.
GitOrigin-RevId: e01da49d9a661b6bfd2088f091a3ddf69d601e40
## Why
After switching a thread to a model that requires automatic review, a
standard-scope approval could reuse a cached low-risk score for an action that
skipped classification. This allowed the action to bypass the required full
review.
## What changed
Check the thread's current model requirements before making a fast Guardian
decision. Defer required models to the full review path instead of approving
from cached scoring state.
## Testing
Add coverage for switching to a required model and reviewing a sandboxed
command without running another classification.
GitOrigin-RevId: e79e6a5df19c46acd5c4176f522a859793177639
## What changed
- Convert history backend `images` into `input_image` function-call output items alongside encrypted or plaintext history content.
- Keep image data out of logged output and post-tool-use hook responses.
- Reject malformed image attachments instead of silently dropping them.
## Testing
- Cover encrypted and plaintext outputs, supported image detail values, malformed attachments, and propagation into the next model request.
GitOrigin-RevId: a8eee10eb09c637bcfb06a759dd6313caf707e51
## Why
History and notes results are already limited by the backend using the requested
output budget before encryption. Applying another client-side limit can reject
or truncate an already bounded response.
## What changed
- Return encrypted history and notes results without an additional size check.
- Preserve fallback JSON results instead of truncating them again when building
the tool response.
GitOrigin-RevId: 97e7a59a13e8d485cc3c613d0fdf8073f6eb67ab
## What changed
Return consistent `Unable to perform operation:` messages for provider,
authentication, request construction, transport, and response parsing failures.
Do not include the underlying error details in these user-facing messages.
GitOrigin-RevId: c23fe7713f9d61e5f013ef217e1c0bdc2b824d83
## What changed
- Add `ToolLifecycleContributor::on_mcp_tool_result` with access to the
executed MCP tool context, rewritten arguments, extension data stores, and
mutable server result.
- Run contributors before publishing MCP completion and before preparing the
result for the model, so extensions can inspect or replace successful and
error results.
## Testing
- Cover unchanged, replaced, and error results for direct MCP calls, plus
replaced and error results through Code Mode.
- Verify completion waits for result processing and the processed result flows
to both completion events and subsequent model input.
GitOrigin-RevId: ece7acfe9c5eed4778cb78a29c3ffd06a74e1bcf
Expand Windows deny-read globs robustly across protected directories while preserving filesystem enforcement. Preserve structured MCP tool and resource errors through app-server responses. Bind cached Guardian classifications to current local and root authorization state so stale scores cannot approve actions.
Add regression coverage for the sandbox resolver, structured protocol errors, and authorization changes.
GitOrigin-RevId: 4b80ed724d869afeca79204222d8465fa99d3a24
## Why
Guardian tests could continue after a WebSocket handshake but before the
connection entered the idle pool. The shared request waiter could also miss a
notification delivered between checking the request log and registering its
wait.
## What changed
- Wait for Guardian prewarming to populate the idle connection pool instead of
treating completed handshakes as sufficient.
- Use two initial Guardian connections in tests while retaining eight in
non-test builds.
- Register for request-log notifications before inspecting the log to avoid a
lost wakeup.
GitOrigin-RevId: 88f6a22c5401e03c24e6e114f2563fc641bfef80
## What changed
- Roll token usage from spawned descendants, including nested subagents, into the root goal's usage.
- Apply descendant usage during active and idle progress accounting so it contributes to token budgets.
- Reset descendant accounting baselines when the active goal changes and preserve usage recorded concurrently with a checkpoint.
## Testing
- Cover child and grandchild usage, budget exhaustion, unloaded parent runtimes, goal replacement, idle accounting, and concurrent checkpoints.
GitOrigin-RevId: 8f97ec6778c55b9adf94b887b5fd03999ed0eb94
## What changed
- Lower the default `max_tool_call_lag` from three tool calls to two, causing
older async risk scores to fall back to strict review sooner.
- Update the async scorer integration test to verify score expiration using the
default lag instead of a test-specific override.
GitOrigin-RevId: a07cae3634428a1e64745674eced92fb770f441a
## Why
Guardian classification must not proceed after silently dropping a parent
compaction that cannot fit within its configured size limit.
## What changed
- Distinguish an absent or unusable parent compaction from serialization and
size-limit failures.
- Record a fail-closed score and failed classification when the latest encrypted
parent compaction cannot be serialized or exceeds the complete-item byte
budget.
- Preserve omission of compactions with missing or empty encrypted content
without falling back to older context.
## Testing
Cover compactions at the exact byte limit, one byte over it, and oversized
passthrough metadata.
GitOrigin-RevId: 8e607c88f10003cdfab273963bc73c848b09c821
## What changed
- Move bounded planned-action JSON rendering from the Guardian V2 extension implementation into a dedicated `async_scorer::action` module.
- Keep the structural size-limit tests alongside the extracted implementation.
GitOrigin-RevId: 9292b164588ba0119b4c5ff81056bf7416352d69
## What changed
- Store per-turn trusted skill paths directly in a `BTreeSet` instead of a
mutex-protected set.
- Mutably record paths and consume the collection when producing the final
ordered path list.
- Strengthen the bounded-deduplication test to verify the exact collected paths.
GitOrigin-RevId: 69e87fc7783738d85ed204f18a3968d0837c3693
## What changed
Represent completed and superseded Guardian V2 classifications with a dedicated
`ClassificationOutcome` enum. Map the typed outcome to the existing metrics
status and emit truncation metrics only for scored classifications.
GitOrigin-RevId: b00d345cb0162ed3fc7f53632630b631f18820e7
## Why
Guardian reviews for delegated workers need to recognize skills explicitly
invoked by the user on the root turn.
## What changed
- Record verified user-owned skill paths as bounded, turn-matched Guardian
evidence.
- Include trusted paths from the current worker and its root snapshot when
building review context.
- Exclude skill trust from later root turns so stale authorization is not
inherited.
## Testing
- Add an app-server lifecycle test covering inheritance of a root-invoked
skill by a delegated worker and its removal on the next root turn.
GitOrigin-RevId: aa28f485edb7a447e51d51de8dc89b959fd63d40
## Why
Plugin MCP trust decisions must describe the exact host-discovered server
registration. Looking up a plugin again by ID can resolve a different root.
## What changed
- Retain the host plugin root in MCP catalog attribution and connection identity.
- Reconnect an MCP server when its attributed plugin root changes.
- Pass the retained root through tool lifecycle attribution and use it directly
when building trusted tool context.
## Testing
Add coverage for catalog identity, connection reconciliation, lifecycle
attribution, and rejecting a different root associated with the same plugin ID.
GitOrigin-RevId: bc92743dd40ab44065a07c3ea972b4956ef8351f
## What changed
Define a shared 30-second timeout for Guardian V2 async tests and use it
for classifier requests, score updates, and authentication refresh waits.
GitOrigin-RevId: fa0e63e5e4c2b9ba0e3a09f0c8758886a867e546
## What changed
- Record classified risk levels in `codex.guardian_v2.classification.risk`.
- Record fast approval outcomes and their reasons in
`codex.guardian_v2.fast_decision`, including low-risk approvals and deferred
decisions caused by missing, stale, failed, out-of-scope, or elevated-risk
scores.
- Cover the new metric labels across approval and failure paths.
GitOrigin-RevId: e180054e0b3796e479a706157dd9ea7c9f03c001
## What changed
- Serialize each history and notes request's output truncation policy into the
`x-openai-tool-output-truncation-policy` header.
- Forward the invoking tool call's policy for tool requests and use the thread
hint byte limit for context-contributor requests.
GitOrigin-RevId: 9d4e61480397b325efdb033861893e88c708de3b
## What changed
- Mark history and notes search queries, appended note text, and replacement note text as encrypted in their tool schemas.
- Send `x-openai-encrypted-tool-arguments: true` for the corresponding backend routes without changing the JSON request body.
## Testing
- Cover encrypted schema fields and backend headers for history search, notes search, append, and write calls.
- Verify unrelated history and notes requests do not receive the encrypted-arguments header.
GitOrigin-RevId: 58263cff832c979b436ddb4013b5c27218aca678
## What changed
- Add callback lifetimes to extension `ToolCall`, `ToolEnvironment`, turn-input context, and skill-read request types.
- Require extension tool executors to handle calls for any invocation lifetime and tie their returned futures to that lifetime.
- Update built-in extensions, adapters, and tests to use the lifetime-scoped APIs without retaining host-owned environment capabilities.
GitOrigin-RevId: aca9ce3a1b6870df550bc84ec9308cc65533f161
## Why
Repeated skill locator roots can make catalog prompts larger even when the
catalog fits within its metadata budget.
## What changed
Evaluate aliased catalogs regardless of budget pressure and select them when
they preserve skill inclusion and description content while reducing prompt
size. Apply the same selection to combined host, executor, and orchestrator
catalogs.
## Testing
Add coverage for alias selection in full host-only catalogs and update skill,
symlink, and orchestrator resource tests to expect shortened locators and their
root mappings.
GitOrigin-RevId: ccedd3f3f6c7efaa1e5177a2d8c3d81d59239f52
## Why
Guardian treated all skill instructions as untrusted, so it could not use the
invocation of a user-owned skill as authorization evidence.
## What changed
- Record explicit and implicit skill invocations through extension contributors.
- Send Guardian a bounded, deduplicated list of canonical skill paths only when
they resolve under the user's Codex or `.agents` skill directories.
- Keep repository skills and symlinks that escape trusted roots untrusted, and
send only verified paths rather than skill contents to the classifier.
- Avoid recording host skill prompts that were superseded by core skill
injection.
## Testing
- Added unit coverage for trusted roots, symlink escapes, deduplication, and
size limits.
- Added integration coverage showing that Guardian trusts invoked user skills
while rejecting a forged repository skill.
GitOrigin-RevId: 1cc0be230f7e6649110201c23c3de8f26447ff36
## Why
Opening Guardian's initial WebSocket connections can be delayed, but thread startup and resume do not need to wait for those connections.
## What changed
- Install the Guardian sampler and related thread state before opening its initial connections.
- Prewarm the sampler's WebSocket pool in a background task while retaining the existing on-demand connection behavior.
## Testing
- Verify extension startup returns before a delayed WebSocket handshake completes, then warms the full initial connection pool.
- Verify resuming a thread likewise returns before Guardian's delayed handshake completes.
GitOrigin-RevId: 58c91cf045b223f917c67d7e8dc82eac529db4ce
## What changed
- Add a bounded developer context fragment identifying the MCP server or connector and the user-owned configuration that declared it.
- Emit the fragment only when the effective entry matches the user configuration or an active plugin declaration resolves inside the Codex home directory.
- Keep tool descriptions, outputs, and unrelated tools untrusted, and reject unsupported sources or paths that escape through symlinks.
## Testing
- Cover user-configured servers and connectors, plugin-provided capabilities, token truncation, symlink escapes, and app-server request integration.
GitOrigin-RevId: 0bfe2a2f3a48334d1d5faad692b5d36452febb68
## What changed
- Add optional `McpToolContext` metadata to `ToolStartInput`, exposing the
model-visible MCP tool details and its source classification without exposing
the executable client.
- Classify MCP calls as connectors, configured servers, plugin servers,
executor-selected plugins, or other registrations based on the prepared call.
- Prepare each MCP call before notifying tool lifecycle contributors and reuse
that same call for execution so the callback describes the call that runs.
## Testing
- Cover host-owned connector calls and extension-owned Apps server calls,
including their distinct provenance and executed tool names.
GitOrigin-RevId: efd23f511b1045ffdd96349d621ad62365569b2b
## Why
Models that require automatic review previously skipped Guardian v2 risk scoring
entirely, even when Guardian was limited to computer-use tools. That scope cannot
use a low-risk result to approve unrelated tools, so the blanket skip is
unnecessary.
## What changed
- Retain Guardian v2 risk scoring for required-review models in
`ComputerUseOnly` scope while continuing to skip it in standard scope.
- Preserve strict automatic approval review for Node REPL-backed tools, including
when classification fails.
## Testing
Added coverage for low-risk, high-risk, and invalid classifications across the
Node REPL and computer-use REPL paths, plus an unrelated MCP tool.
GitOrigin-RevId: ee38fabf82e196df0ae13b4216b5892be9b799cf
## What changed
- Add a synchronous reviewer prompt builder that combines root authorization,
trusted user answers, bounded conversation history, parent environment and
permission context, retained REPL evidence, and the proposed action.
- Select text or image REPL evidence from Guardian feature and transcript
settings while respecting the reviewer model's supported modalities and
shared image limits.
- Render network access requests with trigger-specific guidance and bound
approval reasons and nested action strings before including them.
## Testing
- Add a prompt test covering root authorization, untrusted transcript framing,
retry reasons, denied-read restrictions, and action serialization.
GitOrigin-RevId: d1cf886c2e30f7abbf94cce977cef14439ef3f2e
## What changed
- Classify `response.failed` events with the `rate_limit_exceeded` code as a distinct retryable error while preserving any parsed retry delay.
- Expose the error as `rateLimitExceeded` through the core protocol and app-server schemas after stream retries are exhausted.
- Preserve the upstream message for TUI display while keeping it out of telemetry summaries.
## Testing
- Cover SSE classification, retry metadata, protocol conversion and serialization, exhausted stream retries, telemetry redaction, and TUI rendering.
GitOrigin-RevId: 02dab4d3477dcd7653a58c49c4bd38687a616579
## What changed
- Add effective workspace roots to `EnvironmentConfig` and use them when
materializing permission profiles and filesystem context.
- Preserve selection roots for thread-owned configurations while allowing a
ready environment attachment to supply its resolved roots.
- Propagate resolved roots to child environments and validate both command and
`apply_patch` writes in owner-provided secondary workspaces.
GitOrigin-RevId: 1832c168ce1fc37fa67efc2a472998ab4f448c70
## What changed
- Add the `features.guardianv2.persist_scores` configuration option for debugging.
- Default the option to `false`, so Guardian V2 reviewed actions and risk scores are only written to rollout files when explicitly enabled and the session is not ephemeral.
## Testing
- Cover configuration deserialization, default non-persistence, and opt-in persistence for nested code-mode actions.
GitOrigin-RevId: 452af99ef14553d45140340ececc2913389124d0
## What changed
- Add optional `call_id` and `action` fields to `SecurityRiskScore` so a persisted score identifies the tool call and bounded action that produced it.
- Populate the fields after Guardian V2 classifies an action while leaving fail-closed and legacy scores without provenance.
## Testing
- Verify scores preserve action details for direct tool calls and nested code-mode calls.
- Verify rollout serialization retains the new fields.
GitOrigin-RevId: fce69af37f368cecf1d9bce42bfc38a969e969b7
## What changed
- Add the opt-in `features.guardianv2.free_guardian` setting to route eligible
Guardian reviews to `/guardian` and asynchronous classifications to
`/guardian-classifier`.
- Support endpoint selection for both HTTP and WebSocket Responses clients,
including endpoint-aware connection reuse.
- Keep `/responses` for API-key authentication, custom provider URLs,
non-Guardian models, and configurations where the option is disabled.
- Omit routing hints and `service_tier` from requests sent to the dedicated
Guardian endpoints.
## Testing
- Cover route selection across authentication modes, provider URLs, HTTP
fallback, WebSocket review sessions, and classifier sampling.
GitOrigin-RevId: 9c88673c710d009e0239559b9245a4e6c4f4befc
## What changed
- Append accepted Guardian V2 classification results to rollout history for non-ephemeral threads.
- Keep resumed and forked threads from restoring a persisted score into active Guardian state.
## Testing
- Verify that asynchronous scoring records the resulting `SecurityRiskScore` rollout item.
- Seed resume and fork tests with a persisted score and verify that approvals ignore it.
GitOrigin-RevId: 40d63a2ea7e7cf6398402c6aed7d5e5727dc9d68
## What changed
- Default Guardian v2's review scope to computer-use tools. Set
`features.guardianv2.review_scope.computer_use_only = false` to retain the
broader tool review scope.
- Include images in Guardian transcripts by default. Set
`features.guardianv2.transcript.include_images = false` to disable them.
## Testing
- Update configuration and app-server coverage for the new defaults and
explicit broader-scope overrides.
GitOrigin-RevId: 88c3cfe6dd2a96df052111794ad59c5c9ea39b78
## What changed
- Evaluate recent unknown-authorization or critical-risk actions over the last five actions instead of ten.
- Flag predicted high- or critical-risk actions when they are credibly expected within the next two actions, rather than treating any potential risk within ten actions as high.
- Remove privileged or broad access as a standalone high-risk condition and classify a trajectory as low when none of the explicit high-risk conditions apply.
- Clarify the user-authorization and reviewer terminology in the classifier instructions.
GitOrigin-RevId: 1eaf63c3327f57a9c8560df085e1fe0afad99cd4
## What changed
- Express nullable history and notes arguments with `anyOf` and remove unsupported schema constraints.
- Forward valid JSON object arguments to the backend without enforcing client-side limits.
- Clarify history ID, ordering, cross-agent path, and consistency semantics in the tool descriptions.
## Testing
- Cover forwarding previously restricted argument values for every history and notes tool.
- Verify app-server requests expose the Bridge-compatible schemas and still reject non-object arguments locally.
GitOrigin-RevId: 28809fe9da5099944fd04962b5e71ffda4163eea
## What changed
- Add a policy prompt and output contract for synchronous Guardian reviews.
- Build reviewer thread options with a preferred review model, low reasoning effort when supported, and a fallback to the parent model and effective effort.
- Isolate reviewer sessions from parent instructions, MCP servers, optional features, and write access while preserving read restrictions, resolved environments, managed network constraints, and rollout persistence.
- Mark prepared threads as internal Guardian review sessions for later host-managed startup.
## Testing
- Cover reviewer isolation, read-only environment inheritance, review-model overrides, and parent-model fallback behavior.
GitOrigin-RevId: 5133be99674b64e06e19e7f2dbc86439e1678790
## What changed
- Add `plugin_id`, `model_slug`, and `reasoning_effort` dimensions to
`codex.skill.injected` metrics for explicit and implicit skill invocations.
- Propagate plugin IDs from orchestrator skill metadata so resource-backed skill
invocations can emit the same attribution.
- Record `codex.skill.turn.duration_seconds` once per plugin used in a turn,
tagged with the model, reasoning effort, and completed, aborted, or error
status.
GitOrigin-RevId: d249a9c4e85682b1106ac49d9e598535c6cbb06d
## What changed
- Read `x-codex-imagegen-request-id` from image generation and edit responses.
- Propagate the ID to `codex_image_generation_event` analytics.
- Keep the ID in process only, excluding it from extension item serialization, generated types, app-server wire data, and rollout history.
## Testing
- Cover response-header extraction and missing-header behavior in the images client.
- Verify end-to-end analytics emission and the unchanged image-generation item wire shape.
GitOrigin-RevId: 9b8e09b7d655c0c2faa84f0eee99aabae583668d
## What changed
Rename the `UserInstructions` type to `Instructions` across the extension API,
its core API re-export, and all consumers. This keeps loading behavior and the
`LoadedUserInstructions` provider interface unchanged.
GitOrigin-RevId: 1ac236b34c31718e7aa38ff5eae5e9b179aeedd8
## What changed
- Add the experimental `turn/start.cyberAccessProgram` option with `standard`,
`daybreakBlue`, and `daybreakRed` values.
- Forward the selection as `access_programs.cyber` on Responses, WebSocket,
and remote-compaction requests made with ChatGPT authentication, while
omitting it for API-key and custom-provider requests.
- Preserve the per-turn selection across recovery, compaction, and child-agent
turns without making it a persistent thread setting.
## Testing
- Cover app-server forwarding, authentication boundaries, WebSocket reuse,
turn recovery, compaction, and child-agent inheritance.
GitOrigin-RevId: d2eb468f365b2214c5099bc21741cf30f8bd2eb5
## What changed
- Add an optional `turnTrigger` field to app-server `turn/start` requests and
expose it in the generated protocol schemas.
- Propagate non-empty trigger values to Responses request metadata as the
reserved `turn_trigger` field, while preserving the original value when a
request steers an active turn.
- Classify turns started by queue dispatch, goal continuation, retry recovery,
and realtime handoff.
## Testing
- Cover HTTP and WebSocket metadata forwarding, steering behavior, reserved
metadata handling, and the built-in trigger classifications.
GitOrigin-RevId: c12fe2c522286db21b76081ae6154fbf6bfb3639
## Why
Selected executor plugin roots could still expose capabilities when managed
requirements disabled the `plugins` feature.
## What changed
- Suppress MCP servers, skills, apps, and connectors from selected executor
plugins when `plugins` is disabled, while preserving the selected-root
identity used to filter those capabilities.
- Apply the policy consistently to direct selected-root discovery and batched
executor capability discovery.
## Testing
- Add contributor-level and app-server coverage that verifies disabled plugin
capabilities are absent and their MCP servers never start.
GitOrigin-RevId: e30bd8a936c4b0e083908b89a65f4d02e01747de
## What changed
- Add the under-development `skip_host_skill_discovery` feature to bypass host
skill snapshots during session warmup and turn setup.
- Let skill invocation contributors declare whether they require host-owned
skills. Preserve host discovery when no contributors are registered or any
contributor requires it.
- Keep executor and orchestrator skill catalogs and instruction loading
available when host discovery is skipped.
## Testing
- Cover executor-only, orchestrator, mixed-contributor, and legacy host-skill
behavior.
GitOrigin-RevId: 48169403090b234e1a304c6523633fd867df454a
## What changed
- Teach goal continuations to distinguish concrete progress, verified waits on live handles, and turns that made no progress.
- Re-poll live work after observation timeouts instead of treating the work as terminal or restarting it, and carry equivalent blockers through the existing blocked audit.
- Remove the duplicate goal prompt renderers and templates from `codex-prompts`; goal steering remains owned by the goal extension.
GitOrigin-RevId: 4ec64721164743e879ae946a2dd024bba5869fbe
## Why
Answers collected by `request_user_input` can change what the user authorizes, but post-tool hooks may replace or reject the tool output that Guardian normally sees.
## What changed
- Record bounded, host-observed answers before post-tool hooks run and provide them as trusted evidence to synchronous and asynchronous Guardian reviews.
- Include root-thread answers in worker review context.
- Count successful answers as authorization changes so earlier review evidence becomes stale, while ignoring empty or unrelated answers.
## Testing
Add coverage for allowed and denied stale reviews, empty and oversized answers, hook-modified output, and root-to-worker propagation.
GitOrigin-RevId: 970c52e40338ecd057c7cd2a69d04b06e97cd068
