## What changed
- Treat enabled plugins from `claude-code-plugins` as coming from
`anthropics/claude-code` when no marketplace source is already known.
- Preserve an explicitly discovered source instead of replacing it with the
inferred source.
## Testing
- Add a migration test covering inference from `enabledPlugins`.
GitOrigin-RevId: f061963356493027968e282a51538866d2bf31f4
## Why
With system-proxy-aware routing, `RouteAwareClientPool` handles redirects itself so each hop can resolve its own route. That manual path must also respect clients configured not to follow redirects.
## What changed
- Add no-redirect constructors for standard and ChatGPT Cloudflare-cookie route-aware client pools.
- Skip manual redirect handling when the underlying client builder has redirects disabled, returning the redirect response to the caller.
## Testing
- Cover both outbound proxy policies and verify that a no-redirect pool returns the initial `302 Found` response after one request.
GitOrigin-RevId: 7eec73f21f506a46e5d4b82f425ddbc9761ca61c
## What changed
- Mark `clock.sleep` as `DirectModelOnly` so it remains directly callable in
code-mode-only sessions without appearing in the nested code-mode tool surface.
- Cover both code mode configurations with a tool-plan test that verifies the
sleep tool's exposure and visibility.
GitOrigin-RevId: 7ef67bea0678f27fdb17d88004368e5f1d475125
Keep the `McpConnectionSet` test constructors and accessors alongside the
connection manager tests instead of defining test-only helpers in the
production module.
GitOrigin-RevId: 925392f8b7d903b131ef1b49afd7e50f41226b1f
## Why
Relative local marketplace paths can contain `@`, but source parsing treated it as a Git ref separator.
## What changed
- Skip `@` ref parsing when the marketplace source has local path syntax.
- Cover adding a local marketplace from `./alice@example.com/marketplace` through the app-server API.
GitOrigin-RevId: aa55c8cd9838908e15b6a17f8d6058e95aa13ba5
## Why
MCP connection reconciliation can otherwise reuse a client after its service or
underlying transport has stopped.
## What changed
- Add `RmcpClient::is_closed` to report closed client, service, and transport
states.
- Exclude closed clients when selecting a reusable MCP connection so
reconciliation starts a replacement.
## Testing
- Add a reconciliation test that disconnects an in-process MCP transport and
verifies that its connection is replaced.
GitOrigin-RevId: 366a85c9959dbe1763923d7e33a4ecf52d9c3c6a
## Why
Refreshing MCP runtime state should not restart an unchanged, ready server or
relist its tools.
## What changed
- Reconcile refreshed MCP configuration against the published connection set
and reuse connections whose transport, environment, authentication, OAuth
credentials, and client capabilities are unchanged.
- Keep tool filters, timeouts, metadata, and plugin provenance in the published
server view so those settings can change without reconnecting.
- Update elicitation authority in place for reused connections, and reconnect
when connection-defining inputs or live OAuth credentials change.
## Testing
Added coverage for unchanged-server reuse, view-only and elicitation-policy
updates, connection identity changes, OAuth credential changes, and avoiding
redundant tool listing.
GitOrigin-RevId: f04f5db5fbdde127b6a14f6aa9673112c0b557e7
## What changed
- Treat batch writes containing only `model`, `model_reasoning_effort`,
`plan_mode_reasoning_effort`, `service_tier`, or `personality` as defaults for
future sessions, even when `reloadUserConfig` is requested.
- Keep runtime config reloads and skill/plugin cache invalidation for other
config changes, and document which settings remain session-static.
- Preserve cached skill listings after session-default writes until a forced
reload, with test coverage for each supported default.
GitOrigin-RevId: 6d988014cf4758ceb9422a11f7c2bd5fc6b9f90a
## Why
Amazon Bedrock configurations can operate without Codex auth, so auth mode alone
cannot determine which curated plugin marketplace to expose.
## What changed
- Pass the resolved model provider into plugin configuration.
- Select `openai-api-curated` when the resolved provider is `amazon-bedrock`,
while retaining API-key auth as a selection signal.
- Cover provider overrides and app-server plugin listing without an `auth.json`
file.
GitOrigin-RevId: 972a22e19c41490d8b19d989da052302dc30e8f2
## What changed
- Make `McpRuntime` own the published MCP configuration, connections, elicitation routing, and selected capability roots for a thread.
- Capture immutable MCP bindings for model steps and tool calls so in-flight work keeps a consistent connection set and approval authority while refreshed state is published atomically.
- Mark MCP state dirty when relevant configuration, plugins, environments, authentication, or elicitation capabilities change, then rebuild it before the next sampling request or out-of-band MCP operation.
- Separate config reloads from server invalidation: `ReloadMcpConfig` applies resolved MCP inputs, while `RefreshMcpServers` requests reinitialization from the thread's latest state.
## Testing
- Cover refreshed state visibility for existing turns, stable step bindings, current approval authority, cancelled refresh retries, resource-client reconciliation, and Apps recovery between sampling requests.
GitOrigin-RevId: 59eabb1aa8dc083426bd18ef4d3630508f376401
## What changed
- Add a default-on `features.multi_agent_v2.wait_agent_enabled` setting.
- Omit `collaboration.wait_agent` from the tool plan when the setting is disabled, independently of `features.current_time_reminder.sleep_tool`.
## Testing
- Cover configuration parsing and tool exposure with both clock sleep states.
GitOrigin-RevId: c2f34c5edd5bc191d6a5ac41d7bbb80708da1202
## What changed
- Send `codex-mcp-client/<version>` as the default user agent for streamable HTTP and OAuth requests.
- Preserve user agents supplied through configured HTTP headers.
## Testing
- Verify the default user agent on OAuth discovery, token refresh, and MCP initialization requests.
- Verify that a configured user agent overrides the default.
GitOrigin-RevId: 659ef8f126df97b3c1b4d01e9e542a673b5ef42b
## What changed
- Make `plugin/list` requests with `forceRefetch: true` wait for configured
local plugin caches to finish reconciling before building the response.
- Track marketplace plugin sources when deduplicating refreshes so source
changes can trigger a reinstall even when the plugin version is unchanged.
- Notify effective-plugin consumers when the awaited refresh changes the cache.
## Testing
Added coverage showing that a forced local plugin listing returns an upgraded
plugin from the same marketplace path only after the new version is installed
and the superseded cache entry is removed.
GitOrigin-RevId: c1b59f3be6cc19dac8db39aaea548ddf8e342f1d
## Why
An idle thread with an outstanding durable sleep must resume when agent work
arrives, even when that message would normally remain queued without triggering a
turn.
## What changed
- Treat any pending mailbox message as wake-up work while a durable sleep is
attached to the thread.
- Keep requiring `trigger_turn` for idle threads that are not durably asleep.
- Cover waking a sleeping root thread from queue-only agent mail and persisting
the message in thread history.
GitOrigin-RevId: e361ac1b104436d4d63aebfe5e2422691a1cc139
## What changed
- Load app metadata for plugin read and install responses through the authenticated batch API, splitting requests into batches of 100 and retaining cached metadata if a batch fails.
- Preserve every declared app in plugin responses, using its ID as the fallback name and retaining categories from the plugin declaration when metadata is unavailable.
- Add `isEnabled`, `disabledReason`, and `isReadOnly` to `AppToolSummary`, with defaults that keep legacy responses compatible.
## Testing
- Cover plugin reads with more than 100 apps, partial batch failures, install-time authentication results, tool-state propagation, and legacy tool summaries.
GitOrigin-RevId: 14000df9c5c94dde781358e292a8bef741c5dd23
## What changed
Skip registering the standalone `image_generation` tool when cached
authentication identifies the account plan as Free. Leave the existing
feature, provider capability, model modality, and authorization checks intact
for other account plans.
GitOrigin-RevId: 54d3b73dc610e508db7e281c4d7a8e72961e35a6
## What changed
- Cache global, user, and workspace remote plugin catalogs on disk with a three-hour TTL and scope- and account-specific keys.
- Serve cached catalogs from `plugin/list`, refresh stale entries in the background, and warm existing caches at app-server startup without blocking list requests.
- Make `forceRefetch: true` bypass cached catalog data and replace an entry only after a successful fetch.
- Invalidate user and workspace catalog caches after remote plugin sharing changes.
## Testing
- Cover cache freshness, scope isolation, legacy global cache compatibility, identity requirements for private catalogs, forced refetches, and non-blocking startup refreshes.
GitOrigin-RevId: 7844e9dfb72e43b26d749b4afd16fd9c1793caba
## Why
Parent context-window and auto-compaction overrides may describe a different
model than the one selected for Guardian review.
## What changed
- Clear `model_context_window` and `model_auto_compact_token_limit` when the
effective Guardian model differs from the parent model, allowing the review
model's own limits to apply.
- Preserve those overrides when Guardian uses the same effective model.
## Testing
Add unit coverage for both model-selection paths and verify that a Guardian
rollout records the selected review model's context window.
GitOrigin-RevId: ebc399f4eba37c7f279fd0d258154c00d45e2d00
## What changed
- Add the `supports_standalone_web_search` model-provider setting, defaulting to `false`, and preserve it in remote thread configuration.
- Enable the standalone `web.run` tool for opted-in custom Responses providers when web search is enabled and the runtime provider supports it.
- Send standalone search requests through the custom provider's endpoint and authentication.
## Testing
- Cover opt-in, default-off, disabled-search, and unsupported-provider behavior.
- Verify custom-provider search request routing and authorization through the app server.
GitOrigin-RevId: 7c5f96b0ce924ad2b9715c45bfc635e89fc39cff
## Why
Multi-agent mode instructions are durable model context and need to survive
history changes without re-emitting unrelated setup hints.
## What changed
- Add a `multi_agent_mode` world-state section that diffs, retains, and restores
the effective mode instructions.
- Persist mode changes in world-state snapshots while keeping the legacy
`TurnContextItem.multi_agent_mode` field for reading older rollouts.
- Keep initial mode instructions after the root-agent usage hint so the active
mode takes precedence, and bound custom mode text before snapshotting it.
## Testing
- Add snapshot coverage for mode transitions, retained history, and custom-text
truncation.
- Verify live mode changes preserve instruction ordering, avoid duplicating the
usage hint, and record both modes in world state.
GitOrigin-RevId: 96b9964d6e5299b07a011c559b68e3d948a49226
## What changed
Remove `first_party_type` from connector app metadata and the app-server v2
protocol. Update metadata conversion and merge paths, generated JSON and
TypeScript schemas, and affected test fixtures to match.
GitOrigin-RevId: 3f2e56eca68352360d8c0d99d48486ae65d664c1
## What changed
- Add `isPinned` to thread responses and allow `thread/metadata/update` to pin or unpin stored threads.
- Add an `isPinned` filter to `thread/list`, including cursor-based pagination and combinations with relationship filters.
- Persist pin state in SQLite without modifying rollout files, default existing threads to unpinned, and preserve pins through reconciliation and archive transitions.
## Testing
- Cover protocol serialization, database migration and indexing, pin updates, filtered pagination, rollout reconciliation, and archive/unarchive behavior.
GitOrigin-RevId: c2eacabd6dae465e2ae6ce8a169e00740960cdb7
## Why
Interrupting a turn while MCP tools were still starting could abort before the
submitted user input was recorded in conversation history.
## What changed
- Build and retain the MCP tool list and tool router as part of each step
snapshot, using the turn cancellation token during tool discovery.
- Record turn hooks and submitted input when cancellation occurs during startup
prewarming, pre-sampling compaction, or first-step capture.
- Reuse the captured router for sampling, compaction, and prompt debugging so
advertised and executable tools share the same request-scoped view.
## Testing
Add coverage that interrupts each affected MCP startup phase and verifies that
the user prompt remains in history before the turn-aborted marker.
GitOrigin-RevId: 6e96c6814357a55545d69b580e28f35933cfadf7
## What changed
- Add `compaction_ms` to turn profile facts and turn analytics events.
- Measure manual and automatic compaction as an exclusive profile phase instead of including it in surrounding idle time.
- Complete the profile and total turn duration from the same instant so their elapsed times remain consistent.
## Testing
- Cover compaction phase accounting and profile-duration consistency.
- Update turn event serialization coverage for `compaction_ms`.
GitOrigin-RevId: 50f0e1cf19789a807f9f56c2ef763c620a5d641c
## Why
The in-process app server can shut down while analytics for a completed turn are
still queued, preventing the completed-turn and accepted-line events from being
delivered.
## What changed
- Add a bounded analytics queue flush that waits for all preceding facts to be
processed.
- Flush analytics after the in-process runtime drains its outbound work and
before acknowledging shutdown.
- Extend the in-process shutdown timeout budgets to cover runtime draining and
the best-effort analytics flush.
## Testing
- Verify that the flush waits for preceding facts and is a no-op when analytics
is disabled.
- Verify that shutdown waits for delayed analytics delivery, including the
completed-turn and accepted-line events produced by a file change.
GitOrigin-RevId: 57ca24e535e5e2f3f3202b2e5498f075676c910a
## Why
Preparing Responses API requests rebuilt tool definitions as a generic JSON
tree, and incremental WebSocket requests cloned their full item prefix for
comparison.
## What changed
- Serialize tool definitions into shared raw JSON that can be embedded directly
in HTTP and WebSocket requests.
- Compare incremental request prefixes in place while still ignoring internal
message metadata.
## Testing
- Verify raw tool JSON matches the existing value encoding.
- Preserve the serialized WebSocket request payload.
GitOrigin-RevId: 66e2921792c332e8904954dafa597f6d39abcf29
## What changed
- Store the spawned session's working directory as a `PathUri` in
`GuardianReviewSessionReuseKey` so reuse comparisons use its canonical URI
representation.
- Assert that the reuse key contains the converted working directory.
GitOrigin-RevId: 68d440a37ebb310c610dabbb3373ed0ceff88dfa
## What changed
- Install the git attribution extension in the app server, MCP server, and `codex debug prompt-input` so authenticated workspace policy controls the commit and pull request attribution instructions sent to the model.
- Resolve attribution settings from the process-level ChatGPT base URL, independent of per-thread or per-tool configuration overrides.
- Treat git attribution as contextual developer content when mapping model events.
## Testing
- Cover policy fetch retries, workspace switches, rollbacks, cold thread resumes with legacy instructions, MCP tool calls, and prompt-debug output.
GitOrigin-RevId: 57d182c432c20d7c1c6c429057b6163c9f32088d
## What changed
- Route realtime V3 `bemTags` handoffs using `[ANALYSIS]`, `[COMMENTARY]`, and `[FINAL]` prefixes by default.
- Add `codexResponseHandoffChannelPrefixes` to realtime start requests so clients can replace the accepted prefixes for individual channels. Each channel may accept multiple prefixes, and omitted channels retain their defaults.
- Apply the configured prefixes to both complete and streamed handoff messages, without treating empty prefixes as matches.
## Testing
- Cover request deserialization, default and custom routing, partial streamed prefixes, empty-prefix handling, and end-to-end V3 handoffs.
GitOrigin-RevId: d0aef50aa71362a5beef2c6f6d28b8633da4e529
## What changed
- Add `StartThreadOptions::new` to provide the standard configuration for a new thread.
- Make `ThreadManager::start_thread` the single thread-start entry point and migrate callers from the previous convenience methods.
- Derive default environment selections when `environments` is `None`, while preserving explicit selections, including an empty list.
GitOrigin-RevId: 8977dc11aed54c5e1215a81eaed2b2cf5fc6087a
## What changed
Use the supported `{{ network_access }}` placeholder syntax in the built-in
`danger-full-access`, `read-only`, and `workspace-write` sandbox templates so
permission instructions render the active network access state.
GitOrigin-RevId: 9f8d851016bd7fbedcfc4a9479236b46aca470e8
## What changed
- Add `SqliteConfig` to own the resolved SQLite home, runtime database paths,
and shared read/write and read-only pool settings.
- Pass the configuration through state and local thread-store consumers,
replacing standalone path helpers and duplicated connection setup.
GitOrigin-RevId: 7351b08da94b5c8b6c0bbe492f86aeeca0699d3c
## What changed
- Store the shell approval key's `cwd` as a `PathUri`, matching the URI representation used by approval actions.
- Extend the approval-key test to verify both the URI-based working directory and environment scoping.
## Testing
- Added `approval_key_uses_path_uri_and_includes_environment_id`.
GitOrigin-RevId: 4d7ba1a2e652f4ffe317242f52beb33513b01e6a
## Why
Core-compatible skill catalog output should match the core renderer when the
metadata budget omits entries.
## What changed
- Emit the bounded-catalog omission notice only for `ExtensionCompatible`
rendering.
- Continue tracking omitted entries in `SkillRenderReport` for both policies,
even when `CoreCompatible` produces no fragment because every entry is
omitted.
## Testing
Cover policy-specific omission notices and the case where no minimum skill line
fits within the metadata budget.
GitOrigin-RevId: 79883c15a49c02ff83444ddc272030cb4ddb53c0
## Why
Very long individual lines can make syntax highlighting consume excessive CPU or memory even when the overall input remains below the existing size and line-count limits.
## What changed
- Fall back to plain, unstyled text when any input line exceeds 4 KiB.
- Keep the existing 512 KiB total-size and 10,000-line guardrails.
## Testing
- Cover highlighting fallback and text preservation for a long single-line Bash command.
- Snapshot rendering of a command that exceeds the per-line limit.
GitOrigin-RevId: ba02997331a294d8a32ca89ee06acb12dd3bbd83
Update the git attribution test helper to construct
`WorldStateContributionInput` without the removed `step_store` field.
GitOrigin-RevId: 396b5508f05798f0b43d93f7d02838acdbf97c9b
## Why
The post-sampling trace calculated an estimated token count even when only the
always-on diagnostic and state log sinks were listening, adding unnecessary work
after every sample.
## What changed
- Move the estimate to a dedicated trace target and calculate it only when that
event is enabled.
- Disable the target for the always-on diagnostic and state log sinks while
keeping it available to explicitly configured subscribers.
## Testing
- Verify that the combined always-on subscribers do not enable the estimate
event.
GitOrigin-RevId: ea572584597dda313e7719897d0ab1fdf7362745
## What changed
- Add typed helpers for initialized app-server instances, JSON-RPC requests,
responses, notifications, and thread startup.
- Add a composable `MockResponsesConfig` builder while preserving the existing
mock config writers.
- Migrate the app-server integration suite to the shared helpers, removing
repeated request ID management, deserialization, initialization, and config
assembly.
## Testing
- Add unit coverage for composing mock provider, feature, and extra config, and
for compatibility of the existing mock config writer.
GitOrigin-RevId: 62da177c1d6e8299400de64bd6766567bf1ba3d8
## What changed
- Return a `SkillRenderReport` with total, included, and omitted skill counts,
plus truncated description counts and character totals.
- Keep fragment construction separate from rendering so callers can inspect the
report even when the metadata budget is too small to emit a fragment.
## Testing
- Cover partial description truncation, fully omitted entries, and catalogs
whose omission marker does not fit the budget.
GitOrigin-RevId: e73fdbcf77ac73c7209100ff6c9b5862b6a59a54
## Why
`local` identifies the environment owned by `EnvironmentManager`, but dynamic
remote environment registration previously allowed that ID to be replaced.
## What changed
Reject `local` in the shared environment ID validator used by dynamic remote
environment registration.
GitOrigin-RevId: 2622551f78989c16c432e6dd3d7da9bd8b0527c5
## What changed
- Upgrade `rules_rs` from `0.0.58` to `0.0.96` and LLVM from `0.7.9` to
`0.8.11`, updating extension paths, platform constraints, and compatibility
patches for the current APIs.
- Add native `windows-gnullvm` execution support for the argument-comment lint
toolchain while retaining MSVC execution for existing cross-target builds.
- Build `aws-lc-sys` through the Bazel Central Registry `aws-lc` module and
`rules_rs` integration, removing the replaced crate-specific patches.
GitOrigin-RevId: 9829bcdb6ac74e846b713568aac38ea2fa3c42a2
## What changed
- Require the parent thread to be live before forking its history.
- Read the history mode and multi-agent usage hints from that live parent so
the fork loads and filters history using the active configuration.
- Verify that forking a legacy parent keeps the child in legacy history mode.
GitOrigin-RevId: 79416b78544467a1801f21300d3fe8db4fef59df
## What changed
- Track adjacent cells with the same OSC 8 destination and emit a single
hyperlink around their visible text.
- Close active hyperlinks before non-link content and at the end of a draw.
- Cover a production-length browser authentication URL at narrow terminal
width, including the remote-login guidance and cancellation footer.
GitOrigin-RevId: 9b87166ce78578137dfd2bf19db359ac83a908ee
## Why
Streamed message deltas can be dropped when the transport is saturated, leaving
clients with a truncated final response.
## What changed
- Include the last non-empty final agent message in successful `turn/completed`
notifications and mark the items as a summary.
- Treat completed message content as authoritative in the TUI, repairing an
incomplete stream while avoiding duplicate messages when `item/completed` was
already received.
- Continue backfilling full turn items for persisted `codex exec` threads when a
completion contains only the summary view.
## Testing
Added coverage for completion summaries, dropped stream deltas, duplicate item
handling, and directive-only responses.
GitOrigin-RevId: ffe9d36d683d6b6690e4a468ff68aa9189fe6ab7
## Why
Session header rows can exceed the available inner width when the terminal is
narrow, causing the bordered header to render wider than its requested width.
## What changed
Truncate each session header row to the available inner width and append an
ellipsis when content overflows.
## Testing
Add a snapshot test for a 44-column session header and assert that every
rendered line matches the requested width.
GitOrigin-RevId: 7cf0ea48aa95a6f1ddd1a9dbb7c7fb70bdbcb5a3
## What changed
Apply the existing whitespace-only line normalization to both streaming and
finalized agent Markdown. Blank lines now discard indentation and stale
hyperlinks while preserving their line style.
GitOrigin-RevId: f6150190b02f8cd8c853220cae1a2dcd2f4578a5
## What changed
- Size the unified mention popup from its filtered row count, while keeping a one-row minimum and the existing maximum.
- Update composer snapshots to cover the compact layout when only one mention result is visible.
GitOrigin-RevId: 7cd30a5c53c7e81cf7158a6b3dda3c09bd024f29
## What changed
- Let `exec-server` issue JSON-RPC requests to its client and correlate responses, with bounded concurrency, timeouts, and connection cleanup.
- When `request_policy_decisions` is enabled, forward proxy policy requests with the process ID and network destination, then apply the client's allow, deny, or ask decision.
- Fail closed for invalid inputs, unavailable or malformed responses, timeouts, process shutdown, and disconnects. Keep callbacks active while inherited process streams keep the proxy alive.
## Testing
- Cover response correlation, request limits, timeouts, disconnect cleanup, validation boundaries, decision forwarding, and process lifecycle behavior.
GitOrigin-RevId: 60e658102c50036589ca9de844760a8bffaa53b0
## What changed
- Add a `codex-git-attribution` context contributor that resolves the workspace's `commit_attribution_enabled` setting and supplies matching commit and pull request instructions through World State.
- Cache resolved policy by authentication generation, recover from unauthorized responses, and fail disabled on timeouts or settings errors with deferred retries.
- Handle enabled, disabled, and legacy attribution fragments so policy changes replace stale instructions without duplicating attribution.
## Testing
- Cover World State transitions, policy resolution after unauthorized responses, and authentication changes during an in-flight settings request.
GitOrigin-RevId: 6f733e708b5c960ba5e90751110910a03d1ba2df
## What changed
- Use `ClientRequest::method_name()` directly when preparing typed request
diagnostics for in-process and remote clients.
- Allocate the owned method name only when constructing an error.
- Remove the serialization-based method lookup and the redundant allocating
`ClientRequest::method()` helper.
GitOrigin-RevId: 93859e512a4f20204e0db4f929a2baebe4374ec5
