## Why
Trusting a directory enables project-local config, hooks, and exec policies, which can increase exposure to prompt injection. Require an explicit decision instead of automatically trusting projects whose trust level is unset.
## What changed
- Add a directory-trust step to TUI onboarding, with options to trust and continue or quit.
- Apply trust to the Git repository root when starting from a subdirectory, persist the decision, and reload config before continuing.
- Keep the prompt active and show the config error when trust cannot be persisted. Skip the prompt for remote workspaces and projects with an explicit trust level.
## Testing
- Cover trust-screen rendering, keyboard selection, persistence failures, and prompt visibility for explicit trust and Windows sandbox states.
GitOrigin-RevId: 850e6f54aec84d584cd161348ecdb1da89aaabd4
## What changed
- Return connector candidates found in detected external agent sessions, aggregating session counts by connector name.
- Resolve connector names from both cached plugin manifests and project MCP server metadata.
- Persist detected connector clues in the session import ledger and merge them into completed imports without case-insensitive duplicates.
## Testing
- Add coverage for project MCP metadata detection and for accumulating detected and imported connector candidates.
GitOrigin-RevId: 97a7dfe4a61599686b2222cddd9595acec8b4501
## Why
Image resize notices describe the history item immediately before them, so
remote compaction must not preserve or discard them independently of that item.
## What changed
- Group recognized `image_resize_notice` developer messages with their source
history items when filtering compacted history.
- Account for each group together when trimming or truncating history to a token
budget, preserving the notice only when its source is retained.
## Testing
- Extend the remote compaction v2 follow-up test to verify that a retained user
image keeps its resize notice, while notices for discarded items and
unrecognized developer notices are omitted.
GitOrigin-RevId: 82bb70a46eb68b07b4601e7fb345921d0789f442
## What changed
- Add `features.tool_registry.error_on_tool_collisions`, defaulting to `false`, to the TOML model, generated schema, and resolved runtime configuration.
- Treat `tool_registry` as structured configuration rather than a feature toggle, including in strict config validation and profile configuration.
- Preserve the resolved collision policy in session config lockfiles when it is enabled or explicitly configured.
## Testing
- Cover deserialization, strict validation, default and enabled resolution, feature materialization, and config lockfile serialization.
GitOrigin-RevId: 2c27109dcf2a3d1e51064cc60088703e36a0f85a
## What changed
- Add a storage-neutral `QueueStore` interface backed by a dedicated SQLite
database for ordered, thread-scoped user submissions.
- Support enqueueing, paginated listing, editing, deletion, and atomic
reordering, with a limit of 100 pending items per thread.
- Remove queued submissions when their thread is deleted.
## Testing
- Cover concurrent inserts, ordering and pagination, edits, deletion,
cross-thread isolation, queue limits, and thread cleanup.
GitOrigin-RevId: 0a8e95ac71137afc6f3a039d4b5fc8603110c891
## What changed
- Keep paginated resume, transcript, and fork workflows on bounded turn and item page requests, while preserving the legacy full-history fallback.
- Refill underfilled terminal scrollback from older pages and show a transcript shortcut when earlier history is unloaded or truncated by the row cap.
- Preserve a successfully created fork if its initial history hydration fails, keep side forks bounded, and retain the correct history boundary for nested forks and subagents.
## Testing
- Add coverage for scrollback refill and truncation notices, bounded paginated requests, fork hydration failures, nested forks, and inherited subagent history filtering.
GitOrigin-RevId: 10ba952ffb2f69717fbc71aa03cac7685f7dcf78
## What changed
- Load older transcript items in bounded pages as users scroll upward, and let `Home` continue fetching until the start of the thread.
- Show loading, partial-history, retry, and complete states in the transcript overlay while preserving the visible scroll position as pages are prepended.
- Use paginated history for resume, fork, retry, and prompt-edit flows, while falling back to legacy history requests when the app server does not support pagination.
## Testing
- Cover multi-page transcript loading, page-boundary prompt reconciliation, legacy-server fallback, bounded retry history, and transcript history-state rendering.
GitOrigin-RevId: cc6b764bc4185d079b2f68bedf235c1d08278dfb
## Why
Paginated sessions can have visible messages beyond the first item page, so
bounded hydration could leave resumed history or transcript previews empty and
the transcript viewer incomplete.
## What changed
- Scan paginated history until the configured rendered-row budget is filled,
while retaining the configured scrollback beyond the visible viewport.
- Fully hydrate transcripts opened from the resume picker and build previews
from bounded item pages, including when non-visible items precede messages.
- Stop pagination on repeated cursors and let `Esc` cancel an in-flight
transcript load.
- Replay restored token usage for cold metadata-only resumes when its stored
turn can be identified.
## Testing
- Add coverage for paginated and legacy transcript loading, bounded resume
hydration, repeated cursors, transcript cancellation, and resize reflow.
GitOrigin-RevId: 2ce69f7d5eae88e2b09a27c333b00b1830ff17bf
## Why
Paginated threads should not require the TUI to load and render their entire
history when a session is resumed.
## What changed
- Hydrate a bounded initial history page for paginated resumes and forks,
respecting the configured terminal reflow row budget.
- Load older transcript items in the background as users navigate upward, while
preserving the viewport, live output, and backtrack selection.
- Reconcile review-mode prompts across page boundaries and keep restored token
usage hidden until it can be attributed to a persisted turn.
## Testing
- Added coverage for paginated resume and fork hydration, older-page merging,
transcript prepending, backtrack behavior, review prompt filtering, and token
usage restoration.
GitOrigin-RevId: 42160b943a9f6a1ba0cfe4b195c24ddf410b747d
## What changed
- Generalize `CodexThread::try_start_turn_if_idle` to accept exported
`TurnInput` values, preserving user content and client IDs in the first model
request.
- Allow non-empty user input to start an idle turn in Plan mode while retaining
the Plan-mode rejection for automatic response items and empty user input.
- Process idle user input through the normal user-turn path so connector
selections are cleared, prompt telemetry is recorded, and referenced skill
instructions are included.
## Testing
- Cover idle user input in Default and Plan modes, response-item mailbox
merging, empty-input rejection, and skill instruction injection.
GitOrigin-RevId: 116667d160d4464b525d9e4c7e8cc05d23a94008
## What changed
- Move config-layer, user, system, plugin, extra, and repository skill-root
resolution from `core-skills` into the host skills extension.
- Keep the core loader focused on loading explicit `SkillRoot` values.
- Relocate and expand tests for root precedence, deduplication, repository
ancestry, plugin metadata, and concurrent probing.
GitOrigin-RevId: 3b95cf28101b8b4d64d54079d202154dad560aab
## Why
Reviews may use a different model from their parent turn. They need current
thread settings without inheriting defaults resolved for the parent model.
## What changed
- Build review configuration from the parent turn context while preserving
explicitly configured token-budget overrides.
- Use the review model's token-budget defaults and select a supported reasoning
effort when switching models.
- Carry the session's resolved service tier and current environment,
permissions, and approval settings into the review thread.
## Testing
Expanded review coverage for updated thread settings, model-specific
token-budget defaults, service tiers, and reasoning effort selection.
GitOrigin-RevId: cefa0f22cd9b9e28047d94e1d2d49ff83eded43e
## Why
Guardian reviews received sandbox retry reasons, but not the execution-policy reason that triggered an initial approval request.
## What changed
- Propagate approval and retry reasons through the tool approval flow and include the applicable reason in the Guardian prompt.
- Prefer a sandbox retry reason when both are available.
- Truncate approval context to 512 tokens while preserving the start and end of the reason.
## Testing
Added prompt and integration coverage for policy reasons, retry precedence, and truncation.
GitOrigin-RevId: 5b0f4e1c40b792b031bc8f7b31685a61d12b8d92
## Why
Amazon Bedrock supports hosted text web search, but it rejects the
`search_content_types` field used for multimodal search and does not support
external live or indexed web access.
## What changed
- Advertise hosted web search for Amazon Bedrock while marking external web
access as unsupported.
- Resolve unsupported live and indexed modes to cached search, or disable the
tool when cached search is prohibited by managed requirements.
- Normalize built-in and configured Bedrock model catalogs to text-only web
search, and retain the runtime provider in session configuration so turn
setup can apply its capabilities.
## Testing
- Cover cached fallback, managed-mode restrictions, text-only tool payloads,
provider capabilities, and catalog normalization.
GitOrigin-RevId: 310473849257401654388a4ebb42920e03aa3228
## What changed
- Replace the TUI directory-trust prompt with automatic trust for local projects whose trust level is unset. Keep explicit trust settings and remote workspaces unchanged.
- Persist trust for the resolved Git or configured project root, then reload configuration so project-local settings take effect.
- Fall back to an in-memory trust override and an embedded app server when the config update cannot be persisted.
## Testing
- Cover persisted and in-memory trust, custom project-root markers, and the working directories selected by resume and fork flows.
GitOrigin-RevId: 8fd51eb4cd88267073324bfd7dc4106a56d7c745
## What changed
- Remove the cached permission profile from `TurnContext` and derive the
effective profile, filesystem policy, network policy, and legacy sandbox
policy from `config.permissions`.
- Update sandbox consumers and tests to use the current turn configuration.
- Verify that role-based agent spawning reapplies runtime permissions and that
cold-resumed agents retain their disabled permission profile.
GitOrigin-RevId: d67c5d2bcbe6dc76f15b56defb485b155fd1f138
## Why
A repository can contain a tracked directory that Git implicitly treats as a bare
repository. Its configuration may select helpers such as `core.fsmonitor`, causing
Codex Git operations in that directory to execute repository-controlled code.
## What changed
- Pass `-c safe.bareRepository=explicit` to Codex-managed Git commands so they
reject implicitly discovered bare repositories.
- Continue to support repositories explicitly selected with `--git-dir` or
`GIT_DIR`.
## Testing
Add a regression test that clones a repository containing a tracked embedded Git
repository and verifies that guarded Git inspection rejects it without running
its configured filesystem monitor.
GitOrigin-RevId: 344b5bc1e0ffa94f2a1b788488aa653222da10f3
## What changed
- Move host skill discovery, snapshot caching, and configuration handling from
`codex-core-skills` to `codex-skills-extension`.
- Rename `SkillsService` and `SkillsLoadInput` to `HostSkillsService` and
`HostSkillsLoadInput` to distinguish the host implementation from other skill
providers.
- Keep shared loading primitives and skill outcome modeling in
`codex-core-skills`.
GitOrigin-RevId: d81a21791d2ef8c066e157e7e538b8cb7ee4c24b
## What changed
- Discover plugins from configured and repository marketplaces using the request's `cwds`, and merge up to 100 ranked local matches into the first remote result page.
- Match local plugin names, display names, and keywords without case or punctuation sensitivity, while applying global, personal, and workspace scope semantics.
- Deduplicate local and remote copies, preserve local installation metadata on the remote result, and treat the remote global catalog as authoritative over the local curated marketplace.
- Keep local search available for API-key authentication and when `remote_plugin` is disabled, and consistently report `enabled: false` because search results describe discovery rather than effective activation.
## Testing
- Add coverage for merged pagination and ranking, API-key local search, scope and feature behavior, deduplication, installed state, and explicit disabled-state reporting.
GitOrigin-RevId: 63696a00d16166dfdd86e0cc456769c583ebe9a7
## What changed
Expand the ChatGPT dual-surface plugin integration test to cover both enabled
and disabled app configurations. Verify that plugin app guidance and searchable
app tools follow `apps.calendar.enabled`, while plugin MCP guidance and tools
remain suppressed.
GitOrigin-RevId: 40c51fbc075e07a8b03b5c520f5c46e360f71ceb
## What changed
- Add `AppToolPolicyEvaluator::apply_app_enabled_state` and use it when
presenting app lists, building plugin context, and deciding whether app
instructions are available.
- Preserve each app's source state unless local or managed configuration
explicitly overrides it.
- Keep connector discovery and post-install refresh checks based on raw
accessibility rather than configured enablement.
## Testing
- Cover default enablement, per-app overrides, managed disablement, and
preservation of unconfigured source state.
GitOrigin-RevId: f1a62d55e7cc48b37113848e3baa0d69d8d9c8a8
## What changed
- Move `resolve_disabled_skill_paths` into `codex-skills` and expose it from the crate.
- Re-export the resolver from `core-skills` to preserve existing callers.
- Split config-layer and policy-resolution coverage into focused unit tests, including ordered path and name overrides.
GitOrigin-RevId: 6528ff99285925132bf80eb33eafb1b62118e033
## Why
Thread settings can update the approval policy after a turn context is created.
Keeping a separate copy on `TurnContext` could leave tool approval checks using
the previous policy.
## What changed
- Remove the duplicated approval-policy field from `TurnContext`.
- Resolve the policy through the turn's current configuration everywhere it is
needed, including tool execution, Guardian routing, MCP handling, and
permission requests.
## Testing
- Update the shell escalation test to apply a thread-level policy override and
verify that the next turn rejects an escalation using the updated policy.
GitOrigin-RevId: e5966ba08f179d53fd76871ad904762958c0f5ea
## Why
App-server clients need to advertise structured MCP extension settings, including supported MCP App UI MIME types, rather than only opting into OpenAI form elicitation with a boolean.
## What changed
- Add an `extensions` map to initialize capabilities and preserve `mcpServerOpenaiFormElicitation` as a legacy alias for `openai/form`.
- Capture the declared extension profile when a thread is started, resumed, or forked, propagate it to subagents, and advertise it to downstream MCP servers during initialization.
- Keep the profile stable for the lifetime of the loaded session instead of changing it on later turns or direct tool calls.
## Testing
- Cover extension conversion, downstream MCP initialization, session isolation, legacy form support, and subagent inheritance.
GitOrigin-RevId: fbcedbb74ce788e574b0f884a4c45c4cedb9de54
## Why
Bearer credentials can contain characters outside the previous token pattern or
start with another recognized key prefix. This could leave part of the
credential visible after redaction.
## What changed
- Recognize bearer tokens containing URL-safe and base64-style characters,
optional padding, and horizontal whitespace after the scheme.
- Redact bearer credentials before matching narrower OpenAI and AWS key forms so
the whole credential is replaced.
- Preserve delimiters following the credential and avoid matching short tokens,
joined scheme names, or tokens separated by vertical or non-ASCII whitespace.
## Testing
Added focused positive and negative cases for the supported token forms and
false-positive boundaries.
GitOrigin-RevId: 1e5b10685281dc91d232d619b938bacbadaa47f9
## Why
Reloading an unloaded v2 agent could inherit the model provider from the
agent that triggered the reload, even though the worker's model was restored
from its persisted thread state.
## What changed
- Restore both the model and model provider from the stored thread when
reloading a v2 agent.
- Return an invalid-request error if the stored provider is no longer present
in the configured provider map.
## Testing
Extend the v2 agent reload test to trigger the reload with a different sender
provider and verify that the worker retains its stored provider.
GitOrigin-RevId: 6401d9f0d1c116e9954e3bd193d016f04da5f223
## What changed
- Persist `rmcp` and `codex_rmcp_client` events only at `INFO` level or above.
- Cover nested targets from both namespaces in the SQLite log filter test.
GitOrigin-RevId: dfeeec302a9562f533a09a735b392d202c1f7801
## What changed
- Move skill interface validation and asset-path resolution into `codex-skills` so both skill loaders share the same behavior.
- Populate host-loaded skills with validated display metadata, prompts, brand colors, and local icons from `agents/openai.yaml`.
- Allow plugin skills to reference icons under the plugin's shared `assets` directory while rejecting absolute paths and paths that escape permitted asset roots.
## Testing
- Add resolver tests for valid, invalid, local, and plugin-shared interface assets.
- Add host loader coverage for interface fields and asset-path restrictions.
GitOrigin-RevId: 3f316191752eeebd15d11ac0bee82201574320ec
## What changed
- Apply the session's current approval policy whenever per-turn configuration is built.
- Have review threads inherit the parent turn's full permission settings and approval reviewer.
- Add coverage for settings updated after session startup, including the approval policy, permission profile, and approval reviewer.
GitOrigin-RevId: bff050c6de157dd65d62f7b49651bef3f426ee3f
## What changed
- Gate Codex Apps MCP tool registration on whether apps are enabled instead of requiring each tool's connector to appear in the accessible connector list.
- Continue enforcing model-visibility and app-tool policy checks, including the requirement for connector metadata.
- Use the merged connector catalog for tool-suggestion discovery.
## Testing
- Cover app-tool registration from catalog metadata, including synthetic links, source ordering, and the apps-disabled case.
GitOrigin-RevId: eef4eb03da9738d3a165dd6cfda0d3c1844d51e7
## What changed
- Reuse directory-entry file types in local memory listing while continuing to
exclude symlinks, and reuse rollout metadata when reading modification times.
- Avoid following non-symlinks twice in direct filesystem metadata and directory
listing operations while preserving target classification for valid symlinks.
## Testing
- Cover symlink handling in local memory listing and search.
- Extend Unix filesystem tests for followed file and directory symlinks and
dangling metadata links.
GitOrigin-RevId: e4e24576e2e9db704f9da54727928e121f81dc86
## Why
MCP startup status delivery can lag. Treating a server that is still starting or
has not reported yet as cancelled produces a misleading interruption warning and
can hide its eventual terminal result.
## What changed
- Only report an interrupted startup when a server explicitly enters the
cancelled state.
- Allow a complete set of terminal updates received after the lag timeout to be
promoted and reported, including failures and cancellations.
## Testing
Added TUI tests covering unresolved servers at the lag timeout and late failure
and cancellation updates.
GitOrigin-RevId: 555f3d13ac87bda6e9b0bf72335a1c04851ac25a
## Why
Client-facing command execution items can include recognizable secrets in the
rendered command or parsed command actions.
## What changed
- Redact secrets in `commandExecution.command` and `commandActions` for live
items, completed items, and replayed thread history.
- Keep command approval requests backed by the original executable command and
parsed actions while using the redacted representation for display items.
- Document that execution item commands are redacted display values rather than
executable commands.
## Testing
- Cover redaction for command conversion, parsed search actions, legacy replay,
approval flows, completion notifications, and rejected commands.
GitOrigin-RevId: 2ad056f21882bf5166182ad1a4ff0bf6471d9c0e
## What changed
- Allow multi-agent v2 parents to spawn any visible model that has not explicitly disabled multi-agent support.
- Expose collaboration tools to child agents only when their selected model supports multi-agent v2, keeping legacy models as leaf workers.
- Preserve a worker's selected model when reloading it into residency.
- Propagate multi-agent capability metadata to Amazon Bedrock model entries so delegation is gated consistently.
## Testing
- Cover model selection, leaf-worker tool visibility, Bedrock capability handling, and model preservation after reload.
GitOrigin-RevId: 1457adb1a09806d1f0621311d5a42a6815b9dd4e
## What changed
- Add a loader that discovers skills from canonical host roots and preserves their `SkillScope`.
- Skip hidden directories, follow directory symlinks for user, repo, and admin scopes, and ignore them for system skills.
- Load dependencies and policy from optional `agents/openai.yaml` metadata without rejecting a skill when that metadata is missing or invalid.
- Resolve plugin and symlink namespaces while retaining host paths and reporting per-skill errors outside system scope.
## Testing
Add coverage for frontmatter and metadata loading, invalid optional metadata, hidden directories, plugin namespaces, and scope-specific symlink discovery.
GitOrigin-RevId: ac436d93b5943b7eaae32143e43367921dd1c350
## What changed
- Keep complete MCP namespace descriptions in tool-search source metadata.
- Raise the namespace tool-spec description limit from 1,000 bytes to 512 KiB,
truncating at a UTF-8 character boundary only when the new limit is exceeded.
## Testing
- Cover descriptions beyond the former limit and multibyte truncation at 512 KiB.
- Update SSE and stdio MCP tests to verify that complete server instructions are
preserved without hiding tools.
GitOrigin-RevId: 000bfcafb3df348065ae451685bfbf978a0e3248
## What changed
- Add extension-owned discovery and namespace resolution for skills loaded directly through an `ExecutorFileSystem`.
- Preserve hidden and symlinked skills, nested plugin namespaces, optional `agents/openai.yaml` metadata, product restrictions, and deterministic ordering.
- Reuse the filesystem walk inventory and bound concurrent skill, metadata, and manifest reads.
- Route direct executor catalog loading through the new extension loader.
## Testing
- Cover namespace lookup, metadata probing, walk reuse, concurrent reads, and parity with the existing environment loader.
GitOrigin-RevId: 4e0b821eb84d03f0dc1c2dee7b2b9a072ee3fd44
## What changed
- Move parsing of pre-discovered executor skill bundles from `core-skills` to
the skills extension.
- Expose shared `SKILL.md` frontmatter parsing from `codex-skills` so direct
and pre-discovered loading use the same validation and repair behavior.
## Testing
- Add parity coverage for direct and pre-discovered executor skill catalogs,
including plugin namespaces, metadata, product policy, and warnings.
- Add a snapshot for the resulting pre-discovered executor catalog.
GitOrigin-RevId: c5f888226fa5600bd8b90f5682400da39a5db5ff
## What changed
- Add `ThreadSpawnRequest` to carry thread options, authentication, agent
control, fork metadata, inherited state, and shell overrides.
- Route new, resumed, and forked threads through one `spawn_thread` path.
- Centralize default session-source and environment selection when the request
is consumed.
GitOrigin-RevId: 8fd1a8531a212000c7430218c2200aa4a047cb9a
## What changed
- Allow namespace tool specs to contain custom freeform tools alongside function tools.
- Include namespaced custom tools in deferred tool search and expose them to code mode with names such as `editor__apply_patch`.
- Route custom payloads to matching extension tools while preserving function-only payload validation.
## Testing
- Add serialization, tool search, code-mode definition, and end-to-end dispatch coverage for namespaced custom tools.
GitOrigin-RevId: be64d35f6ae54685c5a9fcf45a732320742ea7e5
## What changed
- Add optional `defer_loading` support to freeform Responses API tool definitions.
- Omit the field when it is unset so existing eager tool definitions retain their wire shape.
## Testing
- Verify legacy freeform tool deserialization and eager and deferred serialization shapes.
GitOrigin-RevId: 50e8658a54ac5b6ae0c1dbfe65f7bb62efef561d
## What changed
- Treat `codex.api_request` and `codex.api_request.duration_ms` as runtime-only metrics for Statsig exporters, matching the existing tool-call metric behavior.
- Keep both metrics available through other OTLP exporters.
## Testing
- Extend the Statsig filtering test to cover both API request metrics.
- Verify the OTLP HTTP exporter still sends the API request count and duration.
GitOrigin-RevId: f0f800ade7979e4da72ae59641bf42aa8a3ebd5a
## Why
Ghostty can leak release events for shortcuts that the terminal consumes.
## What changed
- Detect Ghostty when `TERM` is `xterm-ghostty`, including when `TERM_PROGRAM` is unavailable.
- Omit `REPORT_EVENT_TYPES` from keyboard enhancement flags for Ghostty while retaining alternate-key and escape-code disambiguation reporting.
## Testing
- Cover Ghostty detection through `TERM` and its keyboard enhancement flags.
GitOrigin-RevId: d865a6cdd1373aad4b78099e821d1ebaeb6cfdff
## Why
Code-mode `wait` and `terminate` requests can remain pending when the host
transport stalls.
## What changed
- Add a 60-second transport allowance to the runtime timeout for `wait`, and
apply the same transport deadline to `terminate`.
- Return a model-visible timeout error and invalidate the connection when the
deadline expires, so the next execution reconnects to the host.
## Testing
- Cover queued `wait` and `terminate` requests that exceed their deadlines.
- Verify that a timed-out `wait` reports the error and reconnects on the next
code-mode execution.
GitOrigin-RevId: 5d772e5a6f3793aa8865a1160639b851fd4824fb
## What changed
Add the tool name to `ApprovalCtx` and use the context's call ID and session
telemetry when recording approval decisions. This removes redundant `ToolCtx`
and telemetry parameters from `resolve_tool_approval`.
GitOrigin-RevId: 238a6f708f83993d64606bfaa74df344b0b46178
Rename `resolve_tool_apporval` to `resolve_tool_approval` and update its
call sites in the tool orchestrator.
GitOrigin-RevId: bc7d9ae675b45dd5b6b5b5643fd75e532f6314ca
## What changed
- Replace the thread ID in `<context_window>` metadata with the session's canonical agent path.
- Default sessions without an agent path to `/root`.
- Verify that root sessions emit `/root` and subagent sessions emit their own path, such as `/root/worker`.
GitOrigin-RevId: bcf057842ed31f93d554b7de063b6c03403a2594
## Why
Large nested-tool callbacks can occupy a WebSocket and delay unrelated session
operations on the same code-mode connection.
## What changed
- Negotiate the optional `dual-websocket-v1` capability and pair a second,
token-scoped WebSocket with the control connection.
- Route nested-tool callbacks and their results over the bulk socket while
keeping session operations, notifications, and execution responses on the
control socket. Reject messages sent on the wrong lane.
- Preserve the single-connection transport when the capability is unavailable,
and bound pairing, queued callbacks, and deferred cross-socket messages.
- Defer callbacks that arrive before their execution-started response, and
return delegate errors without disconnecting the connection.
## Testing
Add protocol, transport, driver, and WebSocket integration coverage for
capability negotiation, lane routing, pairing failures, out-of-order messages,
and progress during large concurrent tool results.
GitOrigin-RevId: fa4504653e7cbf3c4ec930ae57aa0a41345bad66
## What changed
- Store the effective `allow_login_shell` setting on each turn environment, including inherited environments whose child thread has a different policy.
- Expose the `login` argument for shell tools when any selected environment permits login shells.
- Validate each command against the policy of its selected environment instead of the turn-wide configuration.
## Testing
- Cover tool schema generation for single and multiple environments.
- Cover login-shell rejection by both the command handler and the unified exec integration.
GitOrigin-RevId: 5a93149a5c86f4087f2b92d663ebc33feff8a57c
## Why
Successful `codex exec resume --last` lookups should not need to audit every rollout file.
## What changed
- Query the state database first when it is available and treat the first usable matching entry as authoritative.
- Verify that an indexed rollout's session ID matches the indexed thread ID before resuming it.
- Fall back to scanning rollouts after a complete database miss, allowing the existing backfill path to repair missing entries.
## Testing
Added integration coverage for missing database entries, usable indexed candidates, and mismatched indexed rollout paths.
GitOrigin-RevId: 9959dacbc908e97f1073118142f276b470aa8e06
