## Why
A steer creates a new instruction boundary without creating a new turn ID. Retained `request_user_input` answers that share that turn ID must not all be discarded when only the later steer is rolled back.
## What changed
- Associate retained answers with their originating function call and instruction boundary.
- Keep answers whose source calls survive rollback, including through compaction, resume, and rollout migration.
- Remove answers whose source calls belong to the rolled-back instruction.
## Testing
- Cover live rollback and resume with answers before and after a steer.
- Cover rollout migration when delayed answers share a turn ID but originate from different calls.
GitOrigin-RevId: 225e7eb7b6a3ae5a5e7fa6fcb80cb7d259db90d0
## Why
Compaction replaces the model history window, but host-verified user answers may
still be needed for the rest of the owning thread.
## What changed
- Add bounded, model-invisible retained context for verified
`request_user_input` answers.
- Persist retained context in rollout events and compaction checkpoints, and
restore it when a thread resumes.
- Remove answers when their source turns are rolled back, and prevent
parent-local answers from being inherited by child forks.
## Testing
Add lifecycle coverage for deduplication and size limits, compaction and resume,
rollback, rollout migration, and child forks.
GitOrigin-RevId: c32900d3e8120a9899b71f0576683acd67a4b898
## What changed
- Extend the app-server integration test to cover both synchronous and asynchronous Guardian reviews across compaction, server restart, and thread resume.
- Verify that compatible asynchronous review models receive the parent compaction checkpoint while incompatible models fall back to retained evidence; synchronous reviews continue to receive the checkpoint.
- Check that partial rollback removes only the rolled-back input and that rolling back past compaction removes the retained evidence and checkpoint.
- Confirm that the compaction request includes the original user restriction and MCP tool output.
GitOrigin-RevId: 41c377fa12dfde9ee1a73a65d08bfdf87f66a788
## What changed
Patch `rules_rs` to download its pinned `aarch64` and `x86_64` Linux zlib
packages from the dated Ubuntu snapshot. Keep the package versions and SHA-256
checksums unchanged.
GitOrigin-RevId: ec9d48827e08a87a7f93029bc22611b8fd41cc82
## Why
Another process sharing `CODEX_HOME` can replace an installed plugin version
without invalidating the current process's caches. This could leave skill
listings tied to stale plugin paths and retain obsolete plugin generations.
## What changed
- Reject cached plugin loads when their roots no longer match the active
installation, so skills are reloaded after upgrades or rollbacks.
- Keep the 32 most recently used configuration-based skill snapshots while
allowing callers to continue using snapshots that have been evicted.
## Testing
- Cover external plugin upgrades and rollbacks through `skills/list`, including
a subsequent warm-cache read.
- Cover cache eviction, reuse, and the lifetime of caller-held snapshots.
GitOrigin-RevId: ca00f9539c01461e3945d340bf63f8436665220b
## Why
Clients need the executor's release version to make version-based compatibility decisions.
## What changed
- Add `executorVersion` to `EnvironmentInfo` and return it from both `initialize` and `environment/info`.
- Resolve the package release version at process startup so the advertised value remains stable for the server's lifetime.
- Use `0.0.0` when the version is unknown or omitted by a legacy executor.
## Testing
- Cover packaged and source-build initialization, startup caching, protocol serialization, and client-side metadata caching.
GitOrigin-RevId: a0c7f0b701a8e7e50345cd5fb1b5c5d2d38ff3b1
## What changed
- Skip Guardian prewarming and asynchronous scoring when `approvalsReviewer` is
`"user"`, including when the reviewer changes during an active turn.
- Automatically accept ordinary `node_repl.js` execution confirmations in this
mode while continuing to surface sensitive-action checks and requests for user
input.
- Cover transitions between User approval, automatic review, and Full Access in
the app-server integration tests.
GitOrigin-RevId: 599c8ebb672728b9bf3d64c34377ddec230325f8
## What changed
- Emit a `codex_thread_hint_status` analytics event for each native history-notes thread hint attempt.
- Report whether retrieval was successful or failed along with thread context and timing, without including hint contents.
- Treat valid empty responses as successful retrievals while continuing to omit them from the context window.
## Testing
- Extend the app-server history-notes tests to verify success, empty-result success, and backend failure statuses.
GitOrigin-RevId: b9462f312847e8c871ed2be0c8cf8df0928a7fdd
## What changed
- Add an x64 and ARM64 MSVC runtime preparer that uses `dumpbin` to validate
PE32+ DLL metadata, selects the declared GStreamer plugins and dependency
closure, and copies them unchanged into a private `bin/` directory.
- Reject malformed or unsupported PE metadata, path-bearing imports, delayed
imports, managed DLLs, forwarded exports, undeclared dependencies, and
case-insensitive DLL identity conflicts.
- Keep `third_party/voice/sources.json` line endings stable across Windows
checkouts so native build receipts remain valid.
## Testing
Add native Windows tests for relocated DLL loading with a restricted search
path, receipt and digest failures, duplicate identities, malformed PE headers,
unsupported loader features, and cleanup after failed preparation.
GitOrigin-RevId: 5375f21fc54f5d597f3d4e5f8fbca3df307fa2a8
## Why
Native voice libraries need package-relative loader paths so a prepared runtime
can be moved without retaining references to its build prefix.
## What changed
- Configure CMake and GNU Linux Meson builds with relative runtime paths, while
also setting relocatable install names and paths for CMake libraries on macOS.
- Add a GNU Linux runtime preparer for x64 and ARM64 that validates bounded ELF64
metadata, selects the declared GStreamer plugins and dependency closure, and
preserves the `lib/gstreamer-1.0/` layout.
- Reject malformed ELF metadata, path-bearing imports, unsupported loader
dependencies, and native outputs that still contain incompatible runtime
paths.
## Testing
Add native tests for relative build paths, relocated library loading, dependency
and digest failures, malformed ELF inputs, and cleanup after failed preparation.
GitOrigin-RevId: ed94819b07d20214b56363446b64f765e08d75fa
## Why
An app-server thread can still be closing when the TUI reconnects. Its
`thread/resume` request then uses the same `-32600` error code as an unavailable
thread, even though the thread can be resumed once closing finishes.
## What changed
Treat the thread-specific "is closing" response as a transient reconnect error
so the existing reconnect loop retries instead of marking the conversation
unavailable.
## Testing
Extend the active reconnect and end-to-end reconnect tests to cover a closing
thread that resumes successfully on the next attempt.
GitOrigin-RevId: 30ce232b8894065fef346a86128b3ff9bf36ba1f
## What changed
- Add a shared runtime preparer that validates native build receipts, source and
file digests, dependency closure, and output containment before copying the
required voice plugins and libraries.
- Add macOS-specific Mach-O inspection and relocation that removes build-time
runpaths, rewrites non-system dependencies relative to each loader, applies
development ad-hoc signatures, and records the resulting payload in
`runtime.json`.
- Close the state runtime explicitly in the clear-memories CLI test.
## Testing
- Add macOS tests covering relocation after the source prefix is removed and
fail-closed handling of invalid receipts, changed inputs, unsafe paths,
dependency conflicts, malformed Mach-O metadata, and failed transforms.
GitOrigin-RevId: 3be7a6fabf0135a57036cbb0a9a3e597096930fd
## Why
TUI preferences and persistence paths belong to the local client, while thread
configuration and account requirements may come from the active app server.
Keeping both in the same resolved `Config` can replace live local preferences
when a thread is resumed, forked, reconnected, or switched.
## What changed
- Add `LocalSettings` as the TUI-owned source for UI, history, notice, and local
persistence settings, and preserve it across session lifecycle transitions.
- Write preference changes to the selected user config file and reload local
settings from disk when changing roots.
- Use the app server's account response for authentication-dependent onboarding
and status UI instead of the local model-provider configuration.
- Retain platform family and OS metadata reported by remote app servers.
## Testing
- Cover local setting defaults, overrides, persistence destinations, reloads,
and preservation across widget replacement and root switching.
- Cover remote platform metadata and server-controlled authentication UI.
GitOrigin-RevId: dbc2965fb1d6cbecb3f973f6133f3dcd4467b753
## What changed
- Centralize app-level keymap actions in a shared dispatcher, including raw-output and external-editor chords.
- Move read-only transcript input handling into its own module while preserving prompt backtracking and older-history loading.
- Add regression coverage for transcript draft isolation, backtrack selection, global chords, and cached history when a thread is unavailable.
GitOrigin-RevId: a1465942d1ea6c57c2f54e5e313025aceb9f8510
## What changed
- Add `WorktreeManager::create` to create detached, Desktop-compatible worktrees from `HEAD` or an explicit base while preserving the source working-directory path.
- Isolate worktree Git operations from inherited repository selectors, hooks, filesystem monitors, and configured content filters.
- Validate the destination working directory and roll back incomplete worktrees and empty allocation buckets on failure.
## Testing
- Cover layout, base selection, annotated tags, nested working directories, Git environment isolation, filter suppression, source checkout preservation, unsafe symlinks, and creation rollback.
GitOrigin-RevId: bf172c3ff4268dab603d00a1d547485fcd0de368
## What changed
- Add Vim Replace mode, entered with `R`, which overwrites graphemes and appends at the end of a line.
- Restore overwritten text with Backspace and record replace edits for undo and dot-repeat.
- Preserve composer behavior for attachments, completions, paste bursts, history previews, and external editor imports while replacing text.
- Expose `vim_normal.enter_replace_mode` in the configurable TUI keymap.
## Testing
- Add coverage for grapheme replacement, Backspace recovery, dot-repeat, custom bindings, atomic attachments, completions, paste handling, and history interactions.
GitOrigin-RevId: cb04e3adcce013c1eb7b82c994b00e944310c481
## What changed
- Extend the macOS MCP launcher to use native spawning for bare command names as well as relative executable paths.
- Resolve bare commands against the child's configured `PATH`, including empty entries and the default path when `PATH` is unset, while preserving `argv[0]` and script spelling.
- Fall back to the existing command launcher for failed searches and executable text without a shebang so its errors and shell behavior remain unchanged.
## Testing
Add macOS coverage for child `PATH` resolution, default-path lookup, launch errors, and shebang-free executable fallback.
GitOrigin-RevId: 06e76bf8dbd515331b588da797eb57cb765a546d
## What changed
- Replace `send_user_message_async` with `request_user_input_async`, accepting one or more questions with optional suggested answers while allowing the turn to continue.
- Attach structured question metadata to asynchronous agent messages while retaining readable fallback text, and preserve it through app-server events, thread history, and generated schemas.
- Continue enabling the new tool for model catalogs that advertise either the old or new tool name.
## Testing
- Cover tool registration, question validation, emitted items, continued turn execution, history preservation, and backwards-compatible deserialization.
GitOrigin-RevId: ffc49aebde2e854c3c50a122aa52805fec3fc6b3
## What changed
- Add a `schema_bundle` rule that generates stable and experimental app-server
schema directories as declared Bazel actions.
- Include the pinned `zstd` executable in the bundle so consumers can normalize
generated JSON without a separate `bazel run` invocation.
- Expose the app-server protocol test binary as the schema generator and add the
manual `//bazel/schema:public-schema-bundle` target.
GitOrigin-RevId: 0a7ce47258d297dbf20db78626f2843145ee1b49
## What changed
- Parse `experimental_network.header_injections` rules with host, method, path-prefix, and header mappings and carry them into `NetworkConstraints`.
- Export the rule type from `codex_config`.
- Summarize configured rule counts and hosts in the TUI debug configuration without exposing header values.
## Testing
- Cover managed configuration parsing and redaction of header values from debug output.
GitOrigin-RevId: 623b047e6c6111a9f2ccbe79c9ace054631a3c67
## What changed
- Add per-tool `analytics_result_source` requirements, with support for the
`detailed_message_search_v1` format and normal configuration precedence.
- Attach host-generated source IDs from accepted app tool results to recorded
executed tool calls for both direct and Code Mode invocations.
- Bound and deduplicate source metadata, reject caller-supplied values, and
shed optional source data before dropping tool-call or completion metadata.
- Preserve source updates across waits and retries while preventing stale or
compacted records from overwriting accepted metadata.
## Testing
Add coverage for requirement parsing and merging, trusted source snapshots,
metadata budgets, retries, waits, and compaction.
GitOrigin-RevId: 7d5e394219eb33e0ab7b6db3f039138a78569d17
## What changed
- Move schema types, traversal helpers, and large-schema compaction into
dedicated `json_schema` submodules.
- Keep the public schema types re-exported from the existing module and
colocate focused unit tests with their implementations.
GitOrigin-RevId: 953b96c28ae3880f601b588eb016fa126c438852
## What changed
- Add nullable `model` and `reasoningEffort` fields to the shared app-server `Thread` object and generated schemas.
- Report current settings for loaded threads and the latest persisted settings for unloaded threads across thread read, list, start, resume, rollback, metadata update, and notification paths.
- Keep unavailable legacy or filesystem-only settings nullable, and allow metadata reads without loading a thread or dispatching queued work.
## Testing
- Cover live-setting precedence, persisted settings after restart, null legacy values, and model metadata returned by thread lifecycle operations.
GitOrigin-RevId: 22ebe8a8d1910a820d90a97730d812a00d8c1372
## What changed
- Include remote catalog entries in `codex plugin list`, including their source,
version, install policy, and authentication policy in JSON output.
- Support adding and removing remote plugins through the existing plugin CLI.
- Cache remote catalogs by scope and collection. Prefer fresh cached results, and
refetch once when an add request misses a plugin in the cache.
- Preserve the local curated catalog when an unfiltered remote listing fails,
while surfacing errors for explicitly selected remote marketplaces.
## Testing
- Cover remote listing, installation, removal, catalog fallback, cache refresh,
collection isolation, and install failure behavior.
GitOrigin-RevId: 09796b2c393d102e00ba9289f784d78a2e166a54
## Why
Configured Git marketplaces may be defined outside the user config, but those definitions could not download or update their snapshots.
## What changed
- Select marketplace source, ref, and sparse-path settings from the effective merged configuration for startup synchronization and explicit upgrades.
- Preserve the initiating operation's configuration loader and overrides when reloading before activation.
- Roll back activation if the marketplace definition changed or configuration can no longer be loaded, without copying settings into the user config.
## Testing
- Cover system-defined marketplaces, CLI overrides, startup fallback after invalid user configuration, and rollback after configuration changes.
GitOrigin-RevId: 53d1eecf68a91ce2aa8430e5749d78697bfcd821
## Why
Full Access already combines `approvalPolicy: "never"` with unrestricted
permissions, so confirmation-only actions do not require a model review.
## What changed
- Detect Full Access consistently across the thread and every selected
environment. Pending, failed, or restricted environments are not treated as
Full Access.
- Approve confirmation-only Guardian and MCP requests without synchronous
review, sampler prewarming, or background scoring. Cancellation, explicit
denials, and forms that require user input keep their existing behavior.
- Re-evaluate the active permission state on each turn so an existing thread
can enter or leave Full Access safely.
## Testing
Added coverage for switching approval modes, strict sensitive MCP
confirmations, failed and pending environments, and suppression of Guardian
requests and background-scoring connections.
GitOrigin-RevId: 089ab4296dde473b8e33ab8324be79c5446c46f6
## Why
`request_permissions` paths and grants need to be evaluated against the selected executor environment, including its path convention, home directory, workspace roots, and temporary directories.
## What changed
- Resolve relative and home-relative permission paths using the executor context, reject mismatched path conventions and lossy paths, and support legacy `read` and `write` path lists.
- Move grant intersection into core so requested and granted permissions use the originating environment's sandbox context. Preserve deny entries conservatively when a special path cannot be resolved.
- Keep the full originating environment with pending permission requests so delayed responses are normalized against the same context.
## Testing
- Cover POSIX, Windows, UNC, relative, and home-relative path resolution and invalid path contexts.
- Verify end-to-end app-server grants are limited to the requested workspace scope and unresolved temporary-directory denies are preserved.
GitOrigin-RevId: 730a2aacd391262e92a6314f3a5b6c262e3dca10
## What changed
- Emit `codex_guardian_v2_classification` events with the outcome, risk
level, duration, model, and thread attribution.
- Emit `codex_guardian_v2_fast_decision` events when Guardian V2 approves an
action without a full review.
- Add `guardian_v2_enabled` to turn analytics, accounting for review scope
and model requirements.
## Testing
- Extend the Guardian V2 app-server coverage to verify event payloads,
attribution, enablement state, and scoped event emission.
GitOrigin-RevId: 0805975f8e8f9d954aa1058ea8c60545a090ae74
## What changed
- Warn Plus and Team users when they have less than 50% of an approximately five-hour usage window remaining.
- Preserve the existing 75%, 90%, and 95% usage thresholds for other plans and window lengths.
- Continue deduplicating warnings across rolling rate-limit updates.
## Testing
- Cover eligible and ineligible plan and window combinations, retained plan metadata, and warning deduplication.
GitOrigin-RevId: b221def052b979c91490e7878829db2478c6e264
## What changed
- Add a bounded redo stack for complete composer drafts, including paste payloads and image attachments. `Ctrl+R` now reapplies the last undone edit in Vim normal mode, while new edits clear stale redo history.
- Add the configurable `vim_normal.redo` action to the keymap schema and picker. Preserve reverse prompt-history search in Vim insert mode and non-Vim mode, and honor explicitly configured bindings.
- Keep pending edit snapshots outside the shared undo/redo byte budget so canceled commands cannot evict committed history.
## Testing
- Cover grouped edits, Vim searches, direct draft changes, history limits, empty redo stacks, and custom or unbound shortcuts.
GitOrigin-RevId: 0cf5bb376ff865ddc0a77705dcb322ef6b57b3a3
## Why
Shell Snapshot V2 previously captured the login-shell environment lazily when a
command started, adding that work to the command path.
## What changed
- Start one asynchronous snapshot capture after turn hooks accept the turn, so
eligible local `exec_command` calls can reuse it without blocking the model.
- Use the turn's resolved tools, permissions, sandbox, environment, and shell
configuration, and skip prewarming for unsupported or network-managed cases.
- Cancel outstanding prewarming during shutdown. Keep failed speculative
captures retryable by real commands without consuming their retry budget.
## Testing
Added coverage for non-blocking capture and reuse, failure recovery, sandbox and
permission isolation, shutdown cancellation, hook-stopped turns, eligibility
gates, and concurrent capture retries.
GitOrigin-RevId: ff24a4f0328c06653e09d03fd0a3db1eccd65030
## Why
Forking a resumed paginated thread failed when the managed `sessions` directory was a symlink, even though the rollout remained under that managed root.
## What changed
- Validate rollout lineage references against the canonical `sessions` and `archived_sessions` roots.
- Accept rollouts beneath symlinked managed roots while rejecting nested symlinks that escape those roots.
## Testing
- Cover forking a resumed rollout under a symlinked `sessions` root.
- Cover rejection of rollout lineage paths that escape through a nested symlink.
GitOrigin-RevId: 0128ecde7087120ef510baa3ed62cdbb33073117
## What changed
- Preserve the selected app account `link_id` when building native MCP tool
approval requests.
- Add `link_id` and `link_is_implicit` to the elicitation metadata, recognizing
IDs with the reserved `implicit_link::` prefix as implicit links.
## Testing
- Extend the app link policy integration test to verify elicitation metadata
for default, explicitly selected, and implicit account links.
GitOrigin-RevId: a76731d9f5f3640318187511ccdc0dc82967a9c5
## Why
Remembering an app tool approval by connector and tool alone could reuse an
approval when the same tool was called with a different selected account.
## What changed
Include the app `link_id` in MCP tool approval keys so remembered session
approvals apply only to the account link that was approved. Calls for another
link, or calls without a link selector, request their own approval.
## Testing
Add an integration test covering calls across two link IDs and the legacy
no-selector case.
GitOrigin-RevId: 7dd88330b75de312469020d5892dfb2fa5d5fada
## Why
Git root discovery is optional metadata work, but filesystem probes can block. They should not exhaust Tokio's blocking pool, delay runtime shutdown, or prevent later turns from observing repository changes.
## What changed
- Add a shared `GitRootDiscovery` service that coalesces concurrent lookups for the same working directory and limits probes across directories.
- Run probes on detached threads, retain in-flight work across caller cancellation, and discard completed results instead of caching them.
- Use the service for turn and memory metadata enrichment, abort unused turn enrichment when its state is dropped, and limit memory metadata waits to one second.
## Testing
Add coverage for probe sharing, capacity limits, cancellation, fresh discovery, runtime shutdown, memory timeouts, and repositories restored after startup prewarming.
GitOrigin-RevId: bca46fc263e7a12a2f69146d8a0b3e7c7e0846cb
## What changed
- Add the under-development `mcp_oauth_refresh_coordination` feature and pin its selected refresh mode to each MCP connection.
- Treat the refresh mode as part of OAuth connection identity so runtime and MCP configuration refreshes reconnect when the mode changes.
- Keep legacy refresh behavior in builds where coordination is unavailable and emit a warning when coordinated mode is selected.
## Testing
- Cover connection replacement when the feature is toggled through both runtime and MCP configuration refresh paths.
GitOrigin-RevId: 89596150f0338e6ede0e712badecea4450831766
## What changed
Restrict cached remote plugin catalog test helpers to `.json` files when
reading plugin IDs or rewriting `fetched_at` timestamps.
GitOrigin-RevId: a144f44a8adc26a8d0aa0d85e95c8fe0366e8aa0
## What changed
- Render descriptive Markdown labels alongside canonical local file targets instead of discarding them.
- Collapse labels that resolve to the same path, accounting for relative and absolute forms, `file://` URLs, percent encoding, case, separators, and location suffixes.
- Preserve `~/` destinations for display and keep absolute paths unless they can be shortened relative to the session working directory.
## Testing
- Add unit and snapshot coverage for descriptive and path-equivalent labels, invalid percent encoding, trailing separators, Unix and Windows paths, UNC paths, `file://` URLs, and table wrapping.
GitOrigin-RevId: 636bf4485b2899d96c6273be3f3b7f38728c9013
## What changed
- Add `approvalsReviewer` to the experimental `turn/settings/update` API.
- Apply reviewer changes to subsequently captured steps and new background approval requests while preserving pending approvals and future-thread defaults.
- Allow reviewer-only updates without `step_model_switching`, while continuing to enforce managed reviewer restrictions and model-required auto review.
- Use an explicit live reviewer update for MCP approvals while retaining refreshed thread defaults for clients that have not set one.
## Testing
- Cover switching between user and automatic review during a live turn, future-turn isolation, and managed-authority rejection.
GitOrigin-RevId: e1216b09c6a7972c2c9eaf4955d8d57d60604ca1
## What changed
- Show revealed running hooks in the bottom activity area instead of the conversation viewport or transcript overlay. Fold the hook message into the active status row when space permits and reflow it below the row without displacing background-process controls or status details.
- Keep fast hooks hidden, collapse concurrent hooks to a shared summary when needed, and support hook activity outside an active agent turn.
- Simplify durable hook output into user-facing messages and actionable failure, block, and stop states. Suppress model-facing context and quiet successful completions from all TUI history surfaces.
## Testing
- Add lifecycle, layout, narrow-width, multi-width Unicode, transcript, restart, and completion-output coverage for hook status and history rendering.
GitOrigin-RevId: 4c52b7a736e9e466e109107eb3c04a39d089597f
## Why
Rust falls back to `fork` when a macOS command combines a relative executable
path with a working directory, due to a historical `posix_spawnp` issue. This
can make local MCP server startup less reliable.
## What changed
- Spawn relative macOS MCP executables directly with `posix_spawn`, preserving
the configured path, `argv[0]`, working directory, environment, stdio, and
process group.
- Keep the existing launcher for `PATH` lookup and executable text files without
a shebang.
- Use one local child wrapper for legacy and 2026-07-28 protocol framing, with
cancellation-safe waiting and cleanup that kills and reaps dropped children.
## Testing
Add macOS regression coverage for relative scripts, argument and descriptor
preservation, launch errors, cancelled waits, and cleanup after runtime shutdown.
GitOrigin-RevId: 1cbc6b90aed6f67e0a38f551964d80496ebc4471
## What changed
- Move remote plugin install and uninstall orchestration from the app server into shared `PluginsManager` APIs.
- Keep cache and backend mutations coordinated by the installed-plugin sync gate, and retain install outcomes long enough to protect newly materialized bundles during downstream setup.
- Return structured operation errors and outcomes so callers can preserve JSON-RPC error mapping, telemetry, cache refreshes, and OAuth setup.
## Testing
- Add regression coverage that verifies uninstall holds the mutation gate, preserves the local cache when the backend operation fails, and refreshes installed state after a successful uninstall.
GitOrigin-RevId: de39f19a4e61c6e9c76ddc2c65d2ac130a4b7f88
## Why
Unified exec can run commands on an OS that differs from the Codex host. Using
host path and shell semantics for approval checks can therefore miss dangerous
Windows and PowerShell commands sent to a remote executor.
## What changed
- Thread the executor platform through command parsing, executable-name
normalization, and dangerous-command classification. Legacy executors fall
back to the host platform, while unknown reported platforms use Windows rules
conservatively.
- Bound model-facing `exec_command` rejection messages and avoid echoing the
rejected command into the error.
- Keep deterministic process IDs reserved after release so rejected test
commands cannot reuse an earlier ID.
## Testing
- Add coverage that a long dangerous PowerShell command targeting a remote
Windows executor is rejected with a bounded response.
- Verify deterministic process IDs advance after release.
GitOrigin-RevId: a26b4a63ea3d6df7140032b88b3e7aec0b85b948
## What changed
- Centralize the allowlist for bundled MCP cleanup hooks and use it for both local and executor-discovered plugins, including `unified-computer-use` cleanup through `cua_repl`.
- Mark matching cleanup hooks as trusted built-ins so they run without saved hook trust and remain active when regular hooks or their per-hook state are disabled. Plugin enablement and managed-only policy still apply.
- Hide built-in cleanup hooks from hook listings and lifecycle notifications while retaining their metrics. Keep the built-in classification out of serialized protocol data.
## Testing
- Cover allowlist boundaries, trust and enablement behavior, inline and file-based hook declarations, MCP success and error responses, hook listing, lifecycle notifications, metrics, and protocol serialization.
GitOrigin-RevId: f93b7bc99f4ed9694f529def8ec383b45f31430e
## Why
The root Python formatting pass only covered `scripts/`, leaving Python utilities elsewhere in the repository outside `just fmt` and `just fmt-check`.
## What changed
- Run the scripts Ruff formatter from the repository root.
- Exclude `sdk/python`, which has its own formatter pass, and `codex-rs/vendor`.
- Apply Ruff formatting to the newly covered Python files and update the formatter coverage test.
GitOrigin-RevId: 73ac82b8bb9c713d589724f6c4f926399febb513
## What changed
- Render complete patch contents directly in TUI history cells.
- Render all input sent to background terminals inline.
- Remove the preview row and byte limits and their transcript hints so inline and transcript views contain the same content.
## Testing
Update snapshots to cover patches and terminal input longer than the former 12-row preview limit.
GitOrigin-RevId: 9960818a9b51fc0c7f84d9def77b9b1bd8acad6c
## Why
The agent command center only listed sessions currently loaded by the app server, so completed or otherwise unloaded tasks could not be revisited from the overview.
## What changed
- Seed the overview with up to 20 recent root sessions in addition to loaded sessions, retain discovered sessions for the lifetime of the TUI, and update rows from thread lifecycle notifications.
- Allow unloaded sessions to be resumed from the overview using the normal working-directory selection and configuration rebuild flow. Explicit runtime permission choices carry across a cold resume, while settings inherited from the previously selected task do not.
- Fall back from `recency_at` to `updated_at` when connected to an older server, and continue showing loaded sessions when recent-history listing is unavailable.
## Testing
Added coverage for recent-session discovery and retention, notification races, legacy and failed listing fallbacks, cold-resume working-directory and permission handling, reconnect behavior, and unloaded-session rendering and selection.
GitOrigin-RevId: 668068b1594eb24b2ea7faccd0327804b8cd22ef
## What changed
- Add `codex-otel-trace-websocket` with a `TraceWebSocket` API that owns the
loopback OTLP receiver and WebSocket listener.
- Bind both listeners during startup, expose the exporter and bound listener
addresses, and surface listener failures through a single lifecycle method.
- Update `codex-code-mode-host` to use the new crate and shut down the bridge
after flushing its trace provider.
GitOrigin-RevId: ec5ca4c4369b6b3b1232875c2699730eb748ab1c
