## What changed
Keep MCP namespace descriptions when publishing tool definitions to the
process-scoped catalog cache. Cached definitions now expose the server
instructions to the model before a lazily started MCP connection finishes
initializing.
## Testing
Update the cached MCP startup integration test to verify that cached namespace
descriptions retain the originating server instructions.
GitOrigin-RevId: d1b73381852fd43c6b54a7c22a599474c774dc20
## Why
Code-mode tool failure messages larger than 64 KiB were truncated before they
reached the host.
## What changed
- Remove the tool error size limit from the gRPC protocol and host validation.
- Forward failed tool completion messages without truncation.
## Testing
- Verify that a multibyte error larger than 64 KiB is preserved exactly.
GitOrigin-RevId: 264ae4ba4adea5c19b669e4f41ccfd41a0c30fb5
## What changed
- Add model-catalog messages for root and subagent roles, explicit delegation, and delegation hints.
- Resolve role instructions in config, catalog, then bundled-default order, while preserving empty values as an explicit way to suppress fallback text.
- Refresh catalog-provided role and mode instructions when the model changes, and give full-history forks the selected child model's subagent role without retaining the parent's role guidance.
- Keep existing config overrides and reasoning-effort behavior, including proactive delegation for ultra reasoning effort.
## Testing
- Cover message deserialization and preservation through model overrides.
- Cover precedence, empty overrides, model switches, resumed sessions, and full-history subagent forks.
GitOrigin-RevId: 4625cf7c6a5490176adddfaa0fb99100707daea9
## What changed
- Include the resolved Guardian security policy in the v2 classifier's developer instructions.
- Prefer an explicit `guardian_policy_config`, then the reviewer model's catalog policy, and finally the bundled policy.
- Limit the combined classifier instructions and policy to 10,000 tokens.
## Testing
- Cover configured and catalog policies, policy truncation, and the bundled-policy fallback.
GitOrigin-RevId: 1b84d70081dd924e214636b4b470d57a63d7cb88
## What changed
Group Amazon Bedrock Runtime models by routing variant so every Global model
appears before the US cross-region models, while preserving the base model order
within each group. Update catalog priorities and tests to match the new order.
GitOrigin-RevId: e5a55d61163404172a418cb794b25f3b27f83618
## What changed
- Bypass extension approval contributors when an approval request includes a retry reason, ensuring the retry is reviewed by Guardian.
- Add coverage showing that Guardian can deny an escalated retry even when an extension contributor would approve it, and that the retry reason is included in the review request.
GitOrigin-RevId: c8f556623f26fea605898d4b8e89679cebd63e65
## What changed
Stop rejecting code-mode execute requests solely because `enabled_tools`
contains more than 1,024 definitions. Continue validating each tool definition
while converting the request.
GitOrigin-RevId: da83b61c5f659e6aa221ed663821edcdfc29d3f1
## Why
Concurrent Guardian samples can finish out of order. A stale result rejected by
the thread's latest-score update could still be appended to the rollout.
## What changed
Return without persisting a risk score when `insert_if` rejects it as older than
the score already stored on the thread.
GitOrigin-RevId: 7b2c895742753a19dfe48fd7f8ecd912d3cd3af6
## Why
Remote exec-server registry requests need to refresh managed credentials before sending a request. Static auth-header resolution cannot perform the asynchronous token exchange required by workload identity.
## What changed
- Add asynchronous auth-header resolution to `AuthProvider`, with the existing static-header behavior as the default.
- Resolve fresh managed credentials for each remote environment registry request while preserving the expected account and workspace identity.
- Load the cloud configuration bundle during remote exec-server startup when workload identity is selected.
## Testing
- Update the managed-auth and environment-registry auth tests to exercise asynchronous header resolution.
GitOrigin-RevId: 5d60f1127467aaacdb5d1a8f3d92278bc4bf2e29
Import `ThreadHistoryMode` where the resume picker uses it for session
selection state and history mode tracking.
GitOrigin-RevId: ae8b30ad959c872d35eb2a38d514e67ecf1275f1
## What changed
- Scan legacy and paginated transcript items newest-first and stop after collecting the six newest nonblank preview lines.
- Keep paging through bounded paginated history when newer items do not produce visible preview text, while preserving chronological display order and assistant markdown rewrites.
- Move transcript preview loading into a focused module and add coverage for reverse scanning, legacy/paginated parity, and paging past invisible items.
GitOrigin-RevId: 576afe37d034b32db363691bd4f401815fffaea7
## Why
Resuming a known legacy rollout with `excludeTurns` first requires the TUI to
retry after the app server rejects paginated history loading.
## What changed
- Carry the history mode reported by the session picker into the resume flow.
- For embedded app-server sessions, resume a legacy rollout with its turns when
the rollout is still legacy and background migration cannot race the check.
- Keep requesting paginated history when the picker metadata may be stale,
migration is enabled or active, or the app server is remote.
## Testing
Added coverage for picker server replacement, background migration, maintenance
lock contention, stale history metadata, and paginated resume requests.
GitOrigin-RevId: 2300d1ad93a817eeeeb8f8ed60b073400ddf7106
## What changed
- Start Guardian reviewer delegates with an empty extension registry while preserving extension inheritance for other delegates.
- Disable `GuardianV2` in the reviewer session configuration so reviews do not trigger nested Guardian processing.
- Cover both the reviewer isolation and continued delivery of parent-session tool lifecycle events.
GitOrigin-RevId: 858b3e23d1c06177e443fb0779fcf06cc5294fc2
## What changed
- Add the stable, default-enabled `unbounded_connection_retries` feature.
- Require the feature for unbounded sampling retries after connection failures.
When disabled, connection failures use the existing bounded retry and
transport fallback path.
- Expose the feature in the generated configuration schema.
GitOrigin-RevId: bd80d02ef065ba924f805c29b639752fc817ed64
## What changed
- Add `codex-guardian-v2` to the app server's dependencies.
- Install its feature-gated thread, approval-review, and tool lifecycle contributors with access to authentication and thread management.
GitOrigin-RevId: 25672032ccb541138c8c87c9f27f2a7423b2eee0
## What changed
- Expand the Guardian sampling pool from 8 to 16 WebSocket connections.
- When the pool is full, supersede the oldest request that has already produced a score before replacing an unfinished classification. Treat superseded classifications as a no-op in the extension.
- Stop response WebSocket work when its event consumer is dropped, including while waiting for the connection lock or draining a completed sample.
- Allow retries across both initially warmed connections for retryable stream failures.
## Testing
- Add a concurrent sampler test that fills the pool and verifies scored drains are replaced before an unfinished classification.
GitOrigin-RevId: 9e4df7b01516094726ff3e11878f8ca742d21b03
## What changed
- Give approval review contributors the first opportunity to resolve an action when automatic review is not required for the model.
- Return an extension's decision directly and fall back to Guardian when no extension claims the review.
- Update Guardian V2 to approve actions below its risk threshold through the review contributor API, and remove the extension approval-policy API.
## Testing
- Verify that an extension approval bypasses both the Guardian model call and the user approval prompt.
- Cover Guardian V2 review decisions for low-risk, high-risk, and disabled threads.
GitOrigin-RevId: 5be56941143aff6f358b75b5f8101b7c047147ae
## Why
Oversized tool arguments could make Guardian V2's model-visible action unbounded.
## What changed
- Cap serialized actions at 10,000 tokens while preserving the trusted tool name and `call_id`.
- Truncate nested string values evenly across the available budget.
- Omit lower-priority fields when the JSON structure alone exceeds the limit, while retaining useful action fields when they fit.
## Testing
Add coverage for oversized nested strings, arrays, and object keys, including spoofed identity fields and omission-marker collisions.
GitOrigin-RevId: 13f7dc93da3761db18a34087225196318a3b8098
## What changed
- Load configuration for `codex features list` through the shared cloud-aware
loader so managed feature requirements are reflected in the reported state.
- Reuse that loader for MCP commands.
## Testing
- Add an integration test showing that a cloud-managed requirement can disable
`fast_mode` in `codex features list` without rewriting the user's
`config.toml`.
GitOrigin-RevId: 2bdbc76dfa40ceb29e8293556f4b56cabbd2c43f
## Why
Concurrent Guardian samples can finish out of order, allowing an older sample to
replace the thread's newer in-memory security risk score.
## What changed
- Record when each `SecurityRiskScore` sample starts while preserving compatibility
with records that have no timestamp.
- Add `ExtensionData::insert_if` so checking and replacing a typed attachment happen
under the same lock.
- Update Guardian V2 to replace the thread's risk score only when the completed sample
is newer than the stored one.
## Testing
- Verify concurrent conditional inserts retain the newest value.
- Verify Guardian-generated risk scores include a sampling timestamp.
GitOrigin-RevId: 6543a4e5497da4c623331050789e91613f931c4b
## What changed
Measure thread storage before and after `codex migrate-rollouts --apply` and
include the formatted sizes in the human-readable migration report. The total
includes active and archived rollout files, the thread history database, and
its WAL and shared-memory sidecars.
Keep dry-run and JSON output unchanged, and omit the storage summary if either
measurement fails.
GitOrigin-RevId: 1775c0b6849570a814becd94e196dd05908667a1
## What changed
- Add a thread-scoped extension API for requesting automatic review, resolving
multiple contributors to the strongest requirement.
- Have Guardian v2 request automatic review when it is enabled and the latest
`action_risk` score is at least `0.8`.
- Honor extension review requirements across tool approvals, MCP elicitation,
and remote execution while preserving host configuration and managed-policy
constraints.
## Testing
- Cover contributor registration and requirement resolution.
- Verify Guardian v2 requests review at the threshold, returns to the default
below it, and does not affect threads where the extension is disabled.
- Exercise extension-requested strict review with a remote model override.
GitOrigin-RevId: 6329fc23585d5cc7173c39bb9952c3109ec3884b
## What changed
- Invoke `ToolLifecycleContributor::on_tool_start` only after pre-tool hooks
have finalized the invocation.
- Pass hook-rewritten arguments and the post-hook conversation snapshot to the
callback.
- Skip the start callback when a hook denies execution or supplies input that
cannot be applied.
## Testing
Add lifecycle tests covering rewritten input, hook-added context, denied tool
calls, and invalid rewritten input.
GitOrigin-RevId: 936efaf4a8c35321f9982ff2a33bb8bece1ebf39
## What changed
- Replace the single `category` and `score` fields in `SecurityRiskScore` with a
deterministic map of category names to scores.
- Validate the full Guardian V2 classifier response before storing it as one
thread extension value and, for non-ephemeral threads, one rollout item.
- Cover serialization and rollout loading with snapshots containing multiple
score categories.
GitOrigin-RevId: 24525de691f96bd34ccfe04acab2f01aca309837
## Why
Guardian V2 classification requests should retain compacted conversation context only when the parent and classifier model configurations can share the encrypted compaction.
## What changed
- Resolve the classifier model's compaction compatibility hash when initializing its sampler.
- Add the latest encrypted parent compaction to classification input when both models have the same non-empty compatibility hash.
- Ignore missing, empty, or unidentified compactions, and omit parent context when compatibility cannot be established.
## Testing
- Cover latest-compaction selection and invalid compaction data.
- Cover matching, mismatched, missing, empty, and changed compatibility hashes.
GitOrigin-RevId: f0fcb09fd028cd2f397fdbc3d541b4bc464b0beb
## Why
Filesystem helpers only need access to their own executables. Granting access to
the containing directories also makes unrelated sibling files readable.
## What changed
- Allow filesystem helpers to read the Codex and Linux sandbox executables
directly instead of their parent directories.
- Give macOS filesystem helpers a narrower Seatbelt profile that omits the
normal process sandbox's `/Applications` read access.
- Preserve the existing platform defaults for normal sandboxed processes.
## Testing
Add unit and integration coverage for direct and symlinked sibling-file access,
sandboxed copies, allowed workspace reads, and the macOS-specific Seatbelt
profiles.
GitOrigin-RevId: 9380c6868a695bdf2275baa74bd5e8a30a64ba1b
## What changed
- Replace the single byte limit with token-derived per-entry and separate message and tool transcript budgets.
- Preserve the first and latest user messages, then fill the remaining budgets with recent user, assistant, and tool context while limiting retained non-user entries.
- Truncate oversized entries in the middle without splitting UTF-8 characters, and report the approximate omitted token count.
- Exclude reasoning from the default transcript sources while retaining support when it is explicitly configured.
## Testing
- Cover oversized message and tool-result truncation, user-message retention, separate tool budgeting, configured reasoning, and the resulting Guardian sampling request.
GitOrigin-RevId: aaeaa5fb5d902b5a1581a8a819bf34724bde794b
## What changed
- Represent Guardian sampling input as an ordered list of text entries.
- Send each transcript entry and approval-request delimiter as a separate input
content item while preserving the existing transcript byte limit.
## Testing
- Update transcript and sampler tests to verify entry boundaries, multi-item
request serialization, and bounded transcript behavior.
GitOrigin-RevId: 433e2e6ca18ce9288025715f5956295bfe852e98
## What changed
- Register Guardian V2 for thread startup as well as tool-call lifecycle events.
- When `guardianv2` is enabled, create and store a thread-local Luna sampler using the thread's model provider, authentication policy, session metadata, originator, and service tier.
- Emit a warning if sampler initialization fails, and skip tool classification when the thread has no sampler.
## Testing
- Update the extension test to enable `guardianv2`, run thread startup, and verify tool-call sampling through the initialized connection.
GitOrigin-RevId: 5ab732e85c9827495c67f57117eb5be450a7f90e
## What changed
- Parse and validate the structured risk scores returned for each classified tool call.
- Publish each score through thread extension data and persist it in rollout history for non-ephemeral threads.
- Report parsing, thread lookup, validation, and persistence failures through the extension warning sink.
## Testing
- Extend the Guardian V2 tool-classification test to verify that the sampled `action_risk` score is available from thread extension data and written to rollout history.
GitOrigin-RevId: 46614fe0d686736dfb1f09398c6fcd848c7d8b2c
## What changed
- Opt Guardian V2 Luna sampler WebSocket connections into responses lite.
- Send `reasoning.context` as `all_turns` on sampling requests.
## Testing
- Extend sampler and extension tests to verify the connection header and reasoning context.
GitOrigin-RevId: 4b0263c01b8259ed5268c222dcf7559912baba8c
## What changed
- Add `EnvironmentConfigState` to `TurnEnvironmentSelection` so each environment attachment can inherit thread configuration or carry ready configuration for its login-shell policy and selected capability roots.
- Apply ready configuration during thread creation and thread-settings updates while reusing the existing environment connection.
- Validate selection configuration before applying settings, rejecting unsupported pending state and invalid capability roots.
## Testing
- Cover attachment-scoped capability roots, ready configuration at thread startup and turn updates, and rejection of invalid selections without changing existing settings.
GitOrigin-RevId: 86cf8f2148fdaa746ea0dd12890ab7b1577d7587
## What changed
- Set `parallel_tool_calls` for regular and remote compaction prompts without consulting model metadata.
- Remove `supports_parallel_tool_calls` from `ModelInfo`, the bundled model catalog, and related fixtures.
- Preserve the existing Responses Lite behavior that disables parallel tool calls at request construction.
GitOrigin-RevId: 49552bdf97e71fa57325abb49f8adc0c88f1401a
## Why
Bazel builds did not embed the SHA-256 digest used to verify the bundled
`bwrap` binary at launch.
## What changed
- Strip the Bazel-built `bwrap`, generate its SHA-256 digest, and pass that
digest to `codex-linux-sandbox` through a compiler environment file.
- Report digest verification failures with exit code `8` instead of panicking.
- Add a Bazel integration test that accepts the original bundled binary and
rejects a tampered copy.
GitOrigin-RevId: 224eeb6ae3d1bfb100e048b296f75fd8ba109581
## Why
MCP runtime reconciliation can occur while an unchanged server is still
starting, such as when capability roots become available. Reconciliation
should neither wait for that startup nor initialize the same server again.
## What changed
- Reuse an active, uncancelled pending MCP connection when its identity,
catalog limit, and protocol mode still match.
- Publish the shared startup result through the reconciled server view while
applying its updated tool filter.
- Preserve cancellation when a reused pending server is subsequently removed.
## Testing
Added coverage for filtered-tool publication, disabling a reused pending
server, and capability-root reconciliation during Codex Apps startup.
GitOrigin-RevId: 690cf8695e75b341d097d7d22b5da6993b24e787
## What changed
- Route MCP tool calls through the automatic reviewer when strict auto-review is enabled, even when the approval policy, tool annotations, or a remembered session decision would otherwise skip review.
- Pass the strict auto-review flag into the MCP approval request so reviewer selection follows the turn setting.
- Update MCP approval and turn-metadata tests to cover the forced review path and confirm that it does not request user input.
GitOrigin-RevId: 2c0b5f4dc1a15cb2fb827e4b21e69167fdcf3e56
## What changed
- When an explicitly selected plugin has apps available, instruct the model to use `tool_search` to discover relevant tools before falling back to unrelated or built-in tools.
- Scope the guidance to the request that selected the plugin and omit it for plugins without available apps.
## Testing
- Cover app-specific rendering, non-app plugins, bounded instruction output, and app enablement in dual-surface plugin requests.
GitOrigin-RevId: 1b9501cc403d2817334a9307e683e99c140a794a
## What changed
- Add the canonical agent path as `agent_name` in Responses API turn metadata.
- Fall back to `/root` when a session has no canonical agent path.
- Reserve `agent_name` from client metadata overrides and omit it from MCP request metadata.
## Testing
- Cover root, named subagent, legacy subagent, MCP, and client metadata merge cases.
GitOrigin-RevId: a9adcc079a51beae7d621aba24bcd759ceaa408e
## What changed
- Add `SkillModelDelegationInstruction` for skills that request Luna while running on Sol or Terra.
- Resolve Luna only when it is available in the current provider namespace.
- Bound and validate model identifiers, skill names, and the rendered instruction before exposing it to callers.
## Testing
- Cover supported parent models, provider namespace matching, unavailable or unsafe targets, instruction rendering, and size limits.
GitOrigin-RevId: 188a88c36ca32689cbf1e53465283dff4137cb15
## What changed
- Replace accepted-line fingerprint generation with diff-based added and deleted line counts.
- Keep `line_fingerprints` in the analytics payload as a statically empty field for schema compatibility.
- Remove the fingerprint types and public parsing API that are no longer used.
## Testing
- Update diff parsing tests to cover accepted-line counts without generating fingerprints.
GitOrigin-RevId: 4247c76c7b56b1a323f70f960823937352b84f7b
## What changed
- Add the built-in `amazon-bedrock-runtime` provider for regional
`bedrock-runtime` OpenAI-compatible endpoints.
- Use endpoint-specific SigV4 service configuration while preserving bearer
token auth and per-provider AWS profile, region, and transport overrides.
- Provide global and US cross-region GPT-5.6 model variants, prefer global
routing for fallback and background tasks, and disable unsupported web search.
## Testing
- Cover provider configuration and capabilities, endpoint and auth selection,
runtime catalog ordering, model fallback, and web search omission.
GitOrigin-RevId: d158ab74a5768e1b4c61063365a0c06735313322
## What changed
- Add an optional `model` field to parsed and loaded skill metadata.
- Recognize `model: luna` while ignoring unsupported model values without
preventing the rest of the skill metadata from loading.
## Testing
- Cover supported, absent, unsupported, and repaired frontmatter model values.
GitOrigin-RevId: 376b65555e81d29a5eae93cc4c2633aacf7cd7c8
## Why
The connection that requested `thread/revert` may close while the thread is
being reloaded, but the replacement listener still needs to serve the thread's
existing subscriptions.
## What changed
Restart the listener task from the preserved thread state after a paginated
thread reload instead of attaching it through the requesting connection.
GitOrigin-RevId: 603ec3331c59bdde48faa2f4cb0fd1032ec8dbd8
## What changed
- Store `TurnEnvironmentSelection` directly on each resolved `TurnEnvironment`
instead of copying its environment ID, working directory, and workspace roots
into separate fields.
- Update environment resolution, tool execution, approvals, and related tests to
access selection state through the retained value.
GitOrigin-RevId: ab723d21e112b8af5bcaf1f772a5e376553312bc
## What changed
Implement `From<AbsolutePathBuf>` for `FileSystemPath` and use the conversion
when constructing concrete filesystem permission paths.
GitOrigin-RevId: 244bcbd0c3f76cd87cc1240458fcac6c9ef0a8e3
## What changed
- Add experimental `thread/queue/add`, `list`, `update`, `delete`, `reorder`, and `start` requests for persistent queued user submissions.
- Automatically dispatch queued submissions in FIFO order after completed or failed turns, while leaving the queue paused after interruption.
- Emit `thread/queue/changed` notifications and expose paginated queue contents with stable submission and client message IDs.
- Export the new protocol types through the generated JSON Schema and TypeScript bindings.
## Testing
- Add app-server integration coverage for capability gating, CRUD, pagination, capacity limits, notifications, automatic dispatch, cold-thread resume, interruption, and explicit queue starts.
GitOrigin-RevId: 89caf5577192199bda77cf6c372a59d26cdd910e
## What changed
- Preserve valid image content from completed `node_repl` Code Mode responses alongside text evidence for Guardian reviews.
- Enable multimodal evidence for models that require automatic `node_repl` review, or when both `guardian_enhanced_node_repl_transcripts` and `guardian_node_repl_transcript_images` are enabled.
- Bound retained and rendered evidence, deduplicate images already present in review history, and fall back to text-only evidence when the reviewer lacks image support or prompt capacity.
- Keep review evidence out of the parent turn input.
## Testing
- Cover feature gating, mixed text and image ordering, truncation and eviction, unsupported reviewers, prompt pressure, image detail normalization, and reused review sessions.
GitOrigin-RevId: a3e482402f7b3484401b231dadc662e6e3504fdf
## Why
`rules_rust` drops the build script's per-binary linker directives, so Bazel
builds can omit the `asInvoker` manifest from the Windows sandbox setup helper.
## What changed
- Add per-binary compile data and Rust flags to `codex_rust_crate` so linker
inputs remain scoped to the setup helper.
- Embed the manifest directly for MSVC builds and compile it into a resource
with hermetic LLVM tooling for GNU/LLVM cross-builds.
- Disable the redundant build script under Bazel and avoid duplicating binary
runfiles in integration test data.
## Testing
Add a Windows integration test that loads the setup executable's manifest
resource and verifies that it requests `asInvoker` execution with UI access
disabled.
GitOrigin-RevId: a77e7e627ee43810f5eaf7701bb4909bf855216b
