## Why
Plugin install failures need stable, low-cardinality details that distinguish
actionable causes without relying on error messages.
## What changed
- Add HTTP status subtypes for remote catalog, mutation, and bundle download
failures, including specific common statuses and a general `http_5xx` bucket.
- Emit failure analytics when a remote plugin is disabled by an administrator or
unavailable under its install policy.
- Preserve marketplace I/O, configuration, and task failure subtypes, including
failures that occur before a plugin ID can be resolved.
## Testing
Add app-server coverage for catalog and install HTTP failures, unavailable
remote plugins, unreadable marketplace files, and oversized bundle error
responses.
GitOrigin-RevId: 71a4888c492d1806bf4ff92bebc48f40cfb89300
## What changed
- Represent configured handlers by handler kind and route execution through the
hooks engine, while preserving command hook behavior.
- Reject MCP tool inputs containing values such as `null` that cannot be
represented in TOML for trust hashing.
## Testing
- Add coverage for rejecting `null` at the top level and within nested MCP tool
input objects and arrays.
GitOrigin-RevId: 3854a349c2a721691450467592f99cf57e6260ef
## What changed
Read `allow_prefix_rules` from the turn attached to the active step context
when selecting the exec policy and constructing unified exec approval requests.
GitOrigin-RevId: d2d26e88b9cefa28bb2df5b9f71aa7b30b7ea331
## Why
Prompt editing looks up the selected user message in the thread's turns, but
new live turns may still exist only in the replay buffer.
## What changed
Reconstruct buffered turns from turn and item notifications before locating
the prompt to edit. Preserve completion metadata and avoid duplicating turns
or items already present in the snapshot.
## Testing
Extend the prompt-edit fork test to cover a selected turn supplied through the
replay buffer and verify that the source thread remains unchanged.
GitOrigin-RevId: e357098085a4def871f3df65b6721a31e07b737f
## Why
Deferred environments can become ready after a turn starts. Guardian approval
reviews must use the environment selected for the current step so their working
directory and permission context are not taken from the stale turn snapshot.
## What changed
- Carry `StepContext` through tool execution and approval handling.
- Add a Guardian review context that pairs the parent turn with the current
step's environment snapshot.
- Use that snapshot for Guardian prompts, reviewer sessions, and delegated
reviewer threads while retaining turn-level fallbacks for callers without a
step context.
## Testing
Added an integration test that makes a deferred remote environment ready before
an escalated command and verifies Guardian receives that environment's working
directory and denied-read policy instead of the initial local environment's.
GitOrigin-RevId: 779096bc7d0e0c7453a009c02141029714b9b407
## What changed
- Add the `codex-workload-identity` crate for exchanging a file-backed JWT assertion and federation rule ID for short-lived ChatGPT credentials.
- Cache valid access tokens, refresh them before expiry or after rejection, and coalesce concurrent exchanges. Continue using a still-valid cached token when a proactive refresh fails transiently.
- Validate assertion files, token endpoints, and exchange responses; honor outbound proxy policy for HTTPS endpoints and redact access tokens from debug output.
## Testing
- Cover request encoding, assertion rotation, caching, concurrent refreshes, transient-failure fallback, configuration validation, and malformed inputs and responses.
GitOrigin-RevId: 5496851683c2dcf6aaad6840053b97f7c0be076e
## Why
Model-reachable child processes should not inherit Codex launch context.
## What changed
- Treat `OPENAI_FEDERATION_RULE_ID` and `OPENAI_IDENTITY_TOKEN_FILE` as non-inheritable environment variables, with case-insensitive matching.
- Remove them after shell environment policy overrides and before spawning commands across execution, MCP, hooks, Git helpers, and remote helper processes.
## Testing
- Cover inherited and explicitly configured variants, including mixed-case names.
- Verify the variables are absent from real child environments and app-server command and process execution.
GitOrigin-RevId: 2535527893985fef0995617f4c5b2462bea7c136
## What changed
- Add `executionMode` to `HookMetadata` returned by `hooks/list`, with `sync` as the default for compatibility.
- Propagate each discovered hook's `sync` or `async` mode through the app-server protocol and generated schemas.
- Show the execution mode in the TUI hooks browser.
## Testing
- Cover async and default-sync modes in `hooks/list` tests and TUI snapshots.
GitOrigin-RevId: 9c9f2890798fe417face76c15847616b2dea9db4
## Why
Hook configurations can mark command handlers as asynchronous, but Codex previously skipped those handlers outside `SessionEnd`.
## What changed
- Run asynchronous command hooks in the background with a per-session concurrency limit, while keeping `SessionEnd` hooks synchronous.
- Prevent asynchronous hooks from blocking, stopping, rewriting, or otherwise controlling the operation that launched them.
- Deliver warnings and additional context at safe turn boundaries: inject results into an active turn after sampling, or buffer them ahead of the next user prompt when the session is idle.
- Preserve in-flight hooks across configuration reloads, scope spilled output to the thread, and abort outstanding work during session shutdown.
## Testing
Add unit and integration coverage for background scheduling, concurrency, output parsing, active and idle result delivery, configuration reloads, and shutdown cleanup.
GitOrigin-RevId: 8094552e4afe7b47b09a61bb575bb20f4e491d8d
## What changed
- Export `GrpcCodeModeHost` as a transport-independent implementation of the
code-mode gRPC API.
- Support leased sessions, execution and wait lifecycle operations, filtered
nested tool-call subscriptions, tool completions, and notification
acknowledgements.
- Share host-wide request and active-cell limits across the existing and gRPC
transports, and bound identifiers, metadata, subscriptions, and pending
callbacks.
## Testing
- Add coverage for request conversion, ordered callback routing, cancellation,
session cleanup, backpressure, malformed input, and resource-limit handling.
GitOrigin-RevId: f146ba7e6fe4e4aa02f25dd3f961120980516d0e
## Why
External agent detection can spend time reading session transcripts. Sharing the
configuration serialization queue causes unrelated configuration requests to
wait for detection to finish.
## What changed
- Give `externalAgentConfig/detect` its own global serialization queue.
- Keep configuration reads, requirements reads, writes, and external agent
imports responsive while detection is still running.
## Testing
Add a Unix app-server test that blocks transcript detection on a FIFO and
verifies the unrelated requests complete before detection is released.
GitOrigin-RevId: d2764dcdb0e96d810c790c570c48fa45690a3dc1
## Why
Timing out a command hook can leave descendant processes running after the hook itself is stopped.
## What changed
- Run hook commands in a process group on Unix and a job object on Windows.
- Terminate the full process tree when hook execution is cancelled or fails, with `taskkill` as a Windows fallback.
- Preserve descendants when a hook completes successfully so intentionally detached helpers can continue running.
GitOrigin-RevId: 1a18653d34c6f1685ef8c4f8e8546663b276292a
## What changed
- Filter saved `allow` prefix rules from the execution policy for cyber-specialized models and models listed in `auto_review.ignore_rules`, while preserving prompt, forbidden, network, and host-executable policy entries.
- Apply the filtered policy consistently to permission instructions, shell commands, unified exec, and the zsh-fork backend.
- Limit cyber-model command approvals to one-time decisions without proposing reusable policy amendments. General models continue to honor saved prefixes, including after switching models within a thread.
## Testing
- Add policy-level coverage for filtering allow-prefix rules while retaining restrictive and network rules.
- Add end-to-end coverage across shell and unified exec paths, zsh-fork execution, user and automatic review, and model switching.
GitOrigin-RevId: f3bd3872424291b12354ec415f33986ec369a368
## What changed
- Add the under-development `guardian_reuse_parent_compaction` feature.
- Restart Guardian review sessions after parent history rewrites and seed them with the latest encrypted compaction that has a response item ID.
- Keep the existing reviewer when a rewritten history has no reusable compaction, preserving authorization and restriction context held by that session.
## Testing
- Cover reuse-key invalidation and compaction eligibility.
- Verify review-session behavior across parent compaction and a subsequent summary-free history reset.
GitOrigin-RevId: 891805d3c3dca34ddda6e3bfc5097be4ff164267
## What changed
- Add the managed `auto_review.required_on_models` requirement, unioning model slugs across requirement layers and exposing the result through `configRequirements/read`.
- Force listed models to use `on-request` approvals with the `auto_review` reviewer. Downgrade Full Access to workspace-write when starting a protected session, and reject incompatible runtime overrides or use when automatic review is disabled.
- Preserve these protections across thread starts, resumes, forks, model changes, turn overrides, MCP approvals, and TUI session attachment.
## Testing
- Add coverage for layered model requirements and exact provider-alias matching.
- Add app-server tests for protected thread lifecycle operations, unsafe setting overrides, legacy thread upgrades, disabled automatic review, and requirements API output.
GitOrigin-RevId: c4b1d52c3b5b75e86880725412b8f0812e0dfcd9
## What changed
- Add the `codex.code_mode.v1` protobuf API for managing code-mode sessions, executions, waits, tool callbacks, notifications, and content results.
- Generate and export the Rust client/server bindings with `tonic` under Cargo.
- Add Bazel protobuf targets and a `prost` toolchain that uses the workspace's Rust runtime versions.
GitOrigin-RevId: 51d9d044e01dab2f4d25ab79aa7a52585485eee3
## What changed
- Add the effective permission profile as `sandbox_mode` in turn metadata for regular, prewarm, compaction, and detached memory requests.
- Reserve `sandbox_mode` so client-provided metadata cannot override the computed value.
## Testing
- Cover metadata headers and request bodies for read-only and danger-full-access modes.
GitOrigin-RevId: 13c690cc99bc2691023f281ca527af049bb1286f
## What changed
- Move `SkillLoadOutcome` and its implicit-path indexing into
`codex-skills-extension`.
- Import shared skill types directly from `codex-skills` and keep the skill
prompt size limit with the extension renderer that uses it.
- Remove `codex-core-skills` from the Cargo workspace and dependent crates.
GitOrigin-RevId: 4e9e84909fa2f692bcc94af990bb4671affd776f
## Why
Code-mode WebSocket connections are latency-sensitive, so buffering small TCP
writes can delay request and response traffic.
## What changed
- Enable `TCP_NODELAY` on outbound remote-session WebSocket connections.
- Enable `TCP_NODELAY` on sockets accepted by the code-mode host, logging a
warning if the socket option cannot be set.
## Testing
- Add a listener test that connects to the host and verifies the accepted
socket has `TCP_NODELAY` enabled.
GitOrigin-RevId: e51c781c4b47c6a4ae1c32c93cd79768719a68d9
## What changed
- Add `HostSkillsSnapshot::load_skill_prompts` so the skills extension owns reading and rendering selected host skills.
- Keep explicit invocation telemetry, unreadable-skill warnings, plugin prompt ordering, and suppression of host prompts superseded by provider prompts.
- Remove the legacy prompt injection and fragment implementation from `codex-core-skills`.
## Testing
- Cover prompt truncation without an installed skills extension, skill/plugin ordering, selective provider supersession, unreadable skills, and contextual fragment detection.
GitOrigin-RevId: 9c8b84ad54b90d174abc287ab49cc5a231e9e1aa
## What changed
- Stop adding `code_mode_tool_names` to Responses Lite turn metadata.
- Keep `code_mode_tool_names` reserved so client metadata cannot reintroduce the removed, unbounded inventory.
- Use the opt-in `tool_namespaces_info` metadata, including each function's `code_mode_name`, when authoritative tool details are requested.
## Testing
- Update Responses Lite and code-mode tests to verify the opt-in namespace metadata and normalized code-mode names.
GitOrigin-RevId: cbfb9af984de71c7cc175d0cd47ae799a5275309
## Why
Aborting the child waiter during termination can leave an exited PTY child
unreaped and prevent the session from recording its exit status.
## What changed
- Detach the child waiter instead of aborting it when terminating or dropping a
`ProcessHandle`, while continuing to abort the I/O helper tasks.
- Cover explicit termination and handle drops for pipe processes, plus queued
PTY waiters and PTY process-group termination on Unix.
GitOrigin-RevId: 313787f4edec80b30cf5a78f0cc6733f1520d9a4
## Why
High-volume request and streamed-response payloads can overwhelm the SQLite log database and diagnostic ring buffer used for reports.
## What changed
- Limit HTTP transport, SSE, and WebSocket diagnostics to `DEBUG` in persistent log sinks while leaving unrelated trace diagnostics available.
- Log known unhandled response events and delta events at `TRACE`, and surface unexpected event kinds at `DEBUG` without including their payloads.
- Report structured parse-error metadata instead of logging an unparseable SSE payload.
## Testing
- Cover filtering for transport, SSE, WebSocket, and unrelated trace records in both report and SQLite log sinks.
- Cover unknown and unsupported delta response events.
GitOrigin-RevId: 6d9121e093ddadf6834da394df544d9c09d8aeb9
## What changed
- Expose hosted Plugin Runtime event definitions through `McpResourceClient::list_events`.
- Add cancellable `events/stream` subscriptions that route lifecycle notifications to the matching request and cancel when the stream is dropped.
- Bound event notification and queue sizes, time out stalled response headers, and close streamable HTTP responses locally on cancellation.
## Testing
- Add streamable HTTP integration coverage for isolated concurrent subscriptions, local cancellation, and stalled response-header timeouts.
GitOrigin-RevId: 98c6fffa8f004eb2638c1b0705f659222cbbdfdb
## What changed
- Add opt-in `tool_namespaces_info` metadata for Responses Lite turns when
`tool_registry.turn_metadata_includes_tool_info` is enabled.
- Describe each model-visible function's namespace, direct and deferred
exposure, Code Mode name, and harness or MCP ownership.
- Reject visible namespaces shared by different owners when strict collision
checking and tool inventory metadata are enabled.
- Keep tool inventories out of compatibility headers and metadata sent to MCP
servers.
## Testing
- Cover opt-in behavior, MCP exposure details, namespace ownership collisions,
reserved metadata handling, and Responses Lite request serialization.
GitOrigin-RevId: 6a6965d2ba98e29444fdfbb4ccec6aafcf0391e6
## Why
Long executor and orchestrator resource identifiers can consume enough of the
skills context budget to omit otherwise available skills.
## What changed
- Add source-aware root aliases for executor, orchestrator, and host skill
catalogs, including catalogs with a single shared root.
- Select the best combination of aliased catalogs under the shared metadata
budget while accounting for root tables and alias usage instructions.
- Explain how to expand shortened `skill://` locators and accept the resulting
description-shortening warning in app-server coverage.
## Testing
- Add rendering and production-turn coverage for singleton, executor,
orchestrator, host, and combined catalog aliases.
GitOrigin-RevId: c1bc1f3d371eae9526232674060235272cc28f16
## What changed
- Compact executor and orchestrator skill locators under metadata pressure, using provider-specific `e` and `o` aliases alongside host `r` aliases.
- Derive alias roots from executor discovery paths and orchestrator namespaces while preserving host plugin root handling.
- Centralize alias ordering, deduplication, and longest-prefix matching across skill providers.
## Testing
- Cover alias planning, cross-platform executor roots, and host plugin discovery.
GitOrigin-RevId: e7d15bd3891c08ae20170e96c4ad45c76d353707
## What changed
- Add lifecycle-backed gauges for in-flight and queued app requests, pending server requests and mailbox messages, active turns, and live MCP connections.
- Register each gauge on first use and decrement it when the tracked work or resource is dropped.
- Document the new `server/diagnostics` gauge names and account for the diagnostics request itself in the response example and test.
GitOrigin-RevId: 4bb82a3918af0b502d149b5d761ad669b2083f39
## What changed
- Classify HTTP connection failures separately from other network errors without exposing request URLs.
- For sampling requests, retry connection failures with exponential delays from 5 to 60 seconds and show a `Reconnecting... waiting for network` stream error.
- Preserve the normal stream retry budget while waiting for the provider to become reachable. Keep the existing bounded retry behavior for other retryable errors.
## Testing
- Verify connection errors are classified without leaking URL contents.
- Verify a turn recovers after its provider becomes reachable and still applies the configured retry limit to a subsequent incomplete stream.
GitOrigin-RevId: 646553290c865a1332abd30c4a64ed9266bbfc6f
## Why
Interrupting a turn should also stop code-mode work that the turn left running.
## What changed
- Add the disabled-by-default `code_mode_interrupt` feature.
- When an interrupted turn has the feature enabled, terminate all active code-mode cells and propagate cancellation through nested tool calls.
- Keep the reusable code-mode session alive so its stored state remains available to later turns.
## Testing
Add an integration test that interrupts a long-running nested tool, verifies that active and background cells are removed, and confirms that session state is preserved.
GitOrigin-RevId: 2b8634776a89b636318a39b9e9ad2eefc07cead8
## What changed
- Preserve executor-native working directories, workspace roots, and permission profiles when preparing remote `exec_command` requests instead of resolving them through the host platform.
- Send sandbox intent to the remote executor, including a restricted-token default for Windows executors and `-NoProfile` for elevated PowerShell commands.
- Reject intercepted cross-platform `apply_patch` commands when filesystem writes are restricted, while continuing to allow them for unsandboxed or full-disk-write profiles.
## Testing
Extended remote unified-exec coverage for foreign Windows workspaces, elevated PowerShell, sandbox metadata, and restricted and unrestricted intercepted patches.
GitOrigin-RevId: 9fd328879fa2c15594fd58e40b6b32e8ba0847e7
## What changed
- Add optional `temporaryDirectories` file URIs to `EnvironmentInfo` so clients can resolve `:tmpdir` against executor-local defaults.
- Populate local environment info from `TMPDIR` on Unix and `TEMP`/`TMP` on Windows, resolving relative Unix paths against the working directory and removing duplicates.
- Cover protocol round trips, platform environment discovery, relative Unix paths, and the exec-server response.
GitOrigin-RevId: a41580f783b004011c064c7a4f9fdc7adf4fba10
## Why
Windows runs the state crate's database-heavy Rust tests serially within each
shard.
## What changed
Configure `state-unit-tests` to run across four Bazel shards.
GitOrigin-RevId: f540f3c157734a2b9944bae9af554ad9dbc4a69b
## What changed
- Add the tool call ID to `_meta.callId` for every MCP tool request.
- Rename `features.tool_registry.include_tool_metadata` to
`features.tool_registry.turn_metadata_includes_tool_info` to clarify that the
setting controls authoritative tool information in per-turn metadata.
- Update config parsing, schema generation, and session config locking for the
renamed setting.
## Testing
- Cover `callId` metadata for custom, plugin, and Codex Apps MCP calls.
- Update strict-config, config-loading, feature-config, and config-lock tests for
the renamed setting.
GitOrigin-RevId: ac0e58c489b03bd9b55a356f545de86c8ecaf865
## What changed
- Add the experimental `server/diagnostics` request, returning the app-server process ID, resident memory, platform-dependent physical footprint, and registered diagnostic gauges.
- Export the new protocol types in the generated JSON and TypeScript schemas and document the request.
## Testing
- Verify the response includes process measurements and the registered live-thread gauge.
- Verify the request is rejected unless `capabilities.experimentalApi` is enabled.
GitOrigin-RevId: 099d60a9c421a74ff1a72fe524e0dfeb89cf1057
## What changed
- Define skill config selectors, ordered rules, and layer-stack parsing in `codex-config`.
- Resolve disabled skill paths from generic skill name/path pairs, so configuration logic no longer depends on `SkillMetadata`.
- Update plugin and host skill consumers to use the `codex-config` API and consolidate the rule tests with the skill config tests.
GitOrigin-RevId: 3fe67869708df2652befe28d58cdeba933256f84
## What changed
- Remove the unused `core-skills` client for listing and exporting remote
skills.
- Remove its `codex-core-skills` and `codex-core` exports and dependencies that
are no longer needed.
GitOrigin-RevId: 747f760dc97da3d4dea10d619a2341f43410d0bf
## What changed
- Use `HostSkillRoot` throughout host root resolution and loading, including plugin roots.
- Remove the duplicate loader, root snapshot, and product-filtering implementation from `core-skills` now that loading is owned by the skills extension.
- Move and expand loader coverage for discovery, namespaces, filesystem routing, root merging, symlinks, and frontmatter parsing.
## Testing
- Added focused unit and integration tests under `ext/skills` and `skills` for the consolidated loader behavior.
GitOrigin-RevId: 214d06d59bf3033ee0f220ea5959ee4feff66782
## What changed
- Route plugin inventory loading and capability summaries through the injected
`SkillRootLoader`.
- Preserve recursive discovery for legacy plugins while restricting agent-plugin
skill discovery to direct children of the skills root.
## Testing
- Verify `plugin/read` excludes nested agent-plugin skills.
- Verify installed agent-plugin telemetry reports skills only for portable,
direct-child layouts.
GitOrigin-RevId: 9e78dd0c70a632d510c780963a6ceb3ad4bc2522
## Why
Plugin suggestions should report skills only when the plugin has an enabled skill.
## What changed
- Load suggestion metadata through the shared plugin skill-root loader.
- Apply skill configuration when setting `has_skills` on suggestion candidates.
## Testing
Added coverage for local plugin suggestions with the plugin skill both enabled and disabled.
GitOrigin-RevId: bceb14528c9042b474eaad6efaf919bef72e0ca4
## Why
Persisted base instructions need to retain whether they were explicitly customized or generated from a model template. Without that distinction, forks and config-lock replays can treat model-generated instructions as custom and keep the wrong template after a model or personality change.
## What changed
- Record custom or model provenance with base instructions in rollouts and config locks.
- Preserve custom instructions across model changes, while allowing model-generated instructions to follow the selected model and personality.
- Keep legacy rollouts without provenance compatible and propagate provenance through forks and spawned agents.
## Testing
- Cover provenance serialization and legacy rollout decoding.
- Cover role personality changes, forked model changes, config-lock replay, and multi-agent configuration.
GitOrigin-RevId: 801c26559835f558027ce5112700c0cd31fcb21b
## What changed
- Inject the host skill loader into `PluginsManager` so plugin discovery and agent turns use the same loading and product-policy behavior.
- Share plugin skill snapshots across those paths, preserving a consistent view of skills across workspaces.
- Apply migrated-command precedence after product filtering, allowing an eligible migrated command to replace a filtered native skill with the same name.
## Testing
- Add coverage for product-restricted plugin skills, native-versus-migrated command precedence, and the skills exposed to agent turns.
GitOrigin-RevId: f5ef0d0766ebeeb30d73ffaf044d003c2906ea4d
## What changed
- Add `SkillRootLoader` and its request/result types to `codex-skills` so skill roots can be loaded through a shared, object-safe interface.
- Add owner-managed snapshot cache handles that support reuse and use cache allocation identity for equality and hashing.
- Move `SkillError` into `codex-skills` and re-export the new loading API.
## Testing
- Verify snapshot sharing and identity semantics.
- Verify loaders can be used as shared trait objects.
GitOrigin-RevId: a26a8101008a6c862824a7346cdbe6d05f4bcc01
## What changed
- Add a `codex-diagnostics` crate that snapshots the process ID, available
resident-memory measurements, and registered process-wide gauges.
- Provide guards that update gauges for the lifetime of measured objects.
- Track live `CodexThread` instances with the `core.threads.live` gauge.
## Testing
- Add unit coverage for gauge registration, guard lifetimes, process memory
snapshots, and live-thread reporting.
GitOrigin-RevId: 3236b086bd4ebe31ed4768ab87a5fa288b0891b0
## What changed
- Add nullable `multiAgentVersion` metadata to v2 `model/list` responses.
- Represent supported values as `disabled`, `v1`, or `v2` in the Rust API and generated JSON Schema and TypeScript exports.
- Forward the value from model catalog presets through app-server responses.
## Testing
- Extend the remote model catalog test fixture with a `v2` multi-agent version.
GitOrigin-RevId: bd3b2bbe0a3b562b4d1f03df7da2a73a35713978
## Why
Applying `project_doc_max_bytes` independently to every selected environment
allows the total project instruction payload to grow with the number of
environments.
## What changed
Treat `project_doc_max_bytes` as one shared byte budget. Consume it in selected
environment order, truncate the entry that reaches the remaining limit, and
skip later environments once the budget is exhausted.
Update the configuration descriptions to document the aggregate limit.
## Testing
Add unit and integration coverage for partial and exhausted budgets across
multiple environments.
GitOrigin-RevId: 4664bdf1f23b66986349d503f44cf51560b9024f
## What changed
- Add the `environmentConfig/read` RPC for selecting literal TOML paths from executor-local config and requirements layers.
- Return layer precedence, cloud insertion points, source and base-directory metadata, and executor home and hostname context without normalizing path-bearing values.
- Expose the operation through both remote clients and local `Environment` instances, with invalid selectors reported as invalid parameters.
## Testing
- Cover projected remote config reads and rejection of empty selectors.
GitOrigin-RevId: fee15bf833de6bcb2058d405ed5b1d5d928d7218
## What changed
- Add `load_local_config_layers` to return raw configuration and requirements layers with their sources, base directories, precedence order, and cloud insertion positions.
- Support projecting layer stacks to selected TOML paths while preserving non-table override blockers and adjusting cloud insertion positions when empty layers are removed.
- Reuse project discovery and trust handling for local reads, including linked-worktree hooks, without resolving relative paths or including profiles, session flags, thread layers, or cloud-provided values.
## Testing
- Cover layer ordering, raw relative paths, legacy requirements, trust filtering, projection semantics, and untrusted linked-worktree hook handling.
GitOrigin-RevId: a1098af5650ac44e5a230ba9a5fe918927986d05
