## Why
Installing a plugin without connector tools must still refresh a cached cloud skill catalog so its skills are visible to the next inference.
## What changed
- Rely on step preparation for cloud plugin and skill discovery, removing their turn-start callbacks and the `requires_mcp_runtime` lifecycle hook.
- Request an MCP runtime refresh after every completed plugin install, including skills-only installs.
## Testing
Add regression coverage for skills becoming visible immediately after a connector-free install. Update lifecycle tests to cover discovery after MCP reconciliation, prewarm skipping discovery, cancellation allowing subsequent preparation, and reuse of unchanged connections. Use deterministic DNS lookups in network proxy authorization tests.
GitOrigin-RevId: 76036bd29253fb8987e606c3c28411c689590fc4
## What changed
Enable `incremental_tools_legacy` by default so both Amazon Bedrock providers publish tool declarations through `additional_tools` input items. Users can still opt out by setting `incremental_tools_legacy = false`.
## Testing
Update the incremental tool scenarios to cover the default behavior and explicit opt-out for both Bedrock providers. Adjust the Bedrock multi-agent test to verify collaboration tools in `additional_tools` declarations.
GitOrigin-RevId: 7a54aed24039d178f9b7d7f5a3f49fe4d588ffa7
## What changed
- Add configurable `pager.mark_markdown`, bound to the leader followed by `v`, to mark the table cell under the selection caret.
- Use arrows or `hjkl` to extend a rectangular cell selection, `o` to swap corners, and `y` to copy. Press `v` to select text within the active cell without including neighboring cells, including across wrapped lines.
- Show table-specific footer hints and route the marking chord in both the main transcript and transcript overlays.
## Testing
Add coverage for cell rectangles, header-only selections, empty cells, wrapped text, Unicode and escaped pipes, Markdown copying, search cancellation, mouse takeover, and chord routing with remapped find and leader keys.
GitOrigin-RevId: 81ed9e52092bba3c7ef064e95043d2c070df0f4c
## Why
Model lookups through the startup catalog can use the wrong provider's capabilities or instructions after a default provider switch or when a thread has its own catalog.
## What changed
- Resolve model metadata for sampling, prediction forks, and memory writes through the owning thread's catalog.
- Make the thread's models manager available to extensions before startup callbacks and use it for guardian sampler configuration.
- Import external sessions using the destination provider and originator's catalog, loading its offline cache only when no refreshed catalog is available.
## Testing
Add regression coverage for sampling after a default provider switch, parent-specific prediction fork capabilities, thread-scoped model lookups, and imported sessions retaining destination provider instructions and originator.
GitOrigin-RevId: c86081b9e55c5e2b42a7f082966485d7fb5139d4
## What changed
- Keep partial cloud skill and plugin catalogs, and catalogs with warnings, usable while retrying discovery with exponential backoff. Start retries after 5 seconds and cap the delay at 5 minutes; clear backoff after a complete, warning-free result.
- Replace previous catalog entries with each accepted result, including partial results, and clear cached cloud skill resources when publishing a replacement.
- Check catalog freshness across turns and steps using auth and resource identity. Auth or resource changes bypass retry cooldowns, including within the same turn.
## Testing
Add and update tests for retry delays and recovery, concurrent refreshes, auth and resource invalidation, partial catalog replacement, and cloud skill read-cache replacement.
GitOrigin-RevId: 0ce5a9d5596e8a73d7084abbbaeb4fb8cda84aa0
## Why
When an Apps `tools/list` response supplies connector names and descriptions in shared `openai/apps` metadata, tools need those fields restored to expose the correct namespaces and descriptions to the model.
## What changed
Match tools to shared connector metadata by `connector_id` on each response page and copy nonempty names and descriptions into tool metadata before conversion. Restrict this handling to Codex Apps; regular MCP servers use the standard tool listing path.
## Testing
Add a regression test with two tool pages that verifies both connectors' namespaces and descriptions appear in the model's tools state.
GitOrigin-RevId: d4c8b44007773ff65d3e366669ee5c705a480cb1
## What changed
- Remove `Config::legacy_sandbox_policy` and `Permissions::legacy_sandbox_policy`.
- Update core and TUI tests to use permission profiles and filesystem/network policies directly, with explicit conversion where legacy wire formats are required.
- Report the active sandbox label in app-server resume override mismatch diagnostics.
GitOrigin-RevId: cbc5417944e23404523e69dc5516d66d6bfafefe
## What changed
- Add the disabled-by-default `file_backed_tool_audio` feature to prepare fresh function and custom tool audio through the attachment store before persistence. Store returned file IDs in history and preserve them on replay without uploading again.
- Validate and budget mixed text and audio output before uploading retained clips, preserving audio token charges and producer limits. Resolve tool audio durations before continuation compaction checks.
- Keep inline audio on backend upload failures and use text placeholders for invalid or rejected clips. Replace unavailable tool audio files with placeholders in prompts while retaining the original history, so restored files can be used again.
- Treat file-backed tool audio as a competing source when attributing audio or unknown-file errors to user uploads.
## Testing
Add coverage for direct tool and Code Mode audio across follow-up turns, file expiration, restoration, and resume in both legacy and paginated history. Extend tests for truncation before upload, upload failure handling, bounded error placeholders, and error attribution.
GitOrigin-RevId: 66c1e7699c7d92f98c3a2d0f5cecbbd63147eb6c
## What changed
Add `release_id: Option<String>` to `PluginSourceLocation::Cloud` to carry the opaque release ID selected by the cloud catalog for a plugin declaration. Update catalog and discovery test fixtures to supply the new field, including a populated release ID in catalog reconciliation tests.
GitOrigin-RevId: 1d60e25bd5fb8efd84e6e825305ad68b847fc1ee
## Why
Managed network requirements support both legacy tables and `permissions.network`. Equivalent declarations in one source should be accepted, while older runtime clients still need the top-level network field.
## What changed
- Normalize `network_proxy` and `experimental_network` into `permissions.network` before merging requirements, preserving source attribution and explicit empty allowlist replacements.
- Accept legacy and nested declarations in one source when they describe the same policy, comparing domain and review selectors by their canonical identities. Continue rejecting mixed surfaces across sources.
- Populate the legacy output field for compatibility and preserve legacy selector text when both forms are supplied.
- Include contributing requirement sources in cloud bundle errors without exposing submitted TOML.
## Testing
Add coverage for equivalent and conflicting declarations, empty allowlist overrides, loader compatibility, and debug output. Add a proxy regression test verifying that a saved grant cannot bypass managed loopback restrictions.
GitOrigin-RevId: e0d2a600f5c7c6c07a665ccc0e18a72ff172fd6d
## Why
Compaction can drop active client context while deduplication prevents unchanged values from being sent again on subsequent turns.
## What changed
Track additional context by history item ID and restore active items when installing complete or prefix compaction results. Preserve their history order, refresh retained items with their original bounded payloads, and leave queued updates to arrive with their input.
## Testing
Add regression coverage for local compaction with message context and remote compaction with tool-output context. Verify that current context survives exactly once, stale values are absent, and restored context precedes the preserved user prompt.
GitOrigin-RevId: a3114f387c6a4ae1a2d1651993d0f7a101be7dd5
## Why
The bounded submission channel reserves all slots at session startup, including space for a full `Submission` in each slot.
## What changed
Send `Box<Submission>` through the channel so each slot reserves only pointer-sized payload storage, allocating full submissions as needed. Update submission producers, delegate forwarding, and test helpers to pass boxed submissions, and unbox them in the submission loop.
GitOrigin-RevId: d8d9c613683076d74fcb3e2f2cb6244c5857bca2
## Why
Cached recommendations can keep offering a plugin after installation. Refreshing the shared catalog during step preparation can also leave the recommendation prompt and install handler with different candidates.
## What changed
- Check `tooling_changed_at` before reusing recommendations, with a one-second reuse window and a 250 ms deadline that includes authentication. Refresh the catalog when the marker changes, preserving cached recommendations on failure and retrying on a later poll.
- Scope recommendation and featured-plugin caches by product, backend, and account identity, and share concurrent recommendation refreshes.
- Use the same recommendation snapshot for a step's prompt and install handler, while allowing later steps to observe updated recommendations.
## Testing
Add coverage for marker changes, missing markers, refresh failures, concurrent and cancelled requests, and the authentication deadline. Extend integration tests to verify consistent step candidates and stop offering an installed plugin while preserving the original recommendation block in conversation history.
GitOrigin-RevId: 44fa6723a623d9604f0c768118bc6889d2d3b693
## Why
Cloud plugin discovery previously ran each turn even when authentication and Apps resources were unchanged.
## What changed
- Reuse complete, warning-free catalogs across turns, including empty catalogs, while authentication and the Apps resource cache key match.
- Retry partial catalogs and catalogs with warnings on subsequent turns, preserving failure backoff.
- Reject discovery results if authentication or Apps resources changed while discovery was in flight. Hosts must invalidate Apps resources when the remote plugin catalog changes.
## Testing
Extend lifecycle tests to cover populated and empty cache reuse, resource and auth invalidation during discovery, and reuse of the empty catalog after plugin revocation.
GitOrigin-RevId: f0f0f4fd5a83179d722ba3cb917deec7eef18458
## What changed
- Add `code_mode.heartbeat_interval_s` to configure heartbeats after inactivity on session-event and tool-call streams. The default value of `0` disables heartbeats.
- Pass the interval through session options and gRPC requests, preserving provider defaults when overriding it.
- Ignore heartbeat messages in the client without admitting tool callbacks, and reject tool-call heartbeats that carry invocation data.
## Testing
Add coverage for disabled heartbeats, repeated idle heartbeats and timer resets after traffic, callback handling, and configuration loading. Extend TCP integration tests to verify heartbeats on both streams and continued session operation after idle periods.
GitOrigin-RevId: bf0b6d3081b5541837d07f35931e0dd3e5472c3b
## What changed
- Make `TimeProvider::current_time` and `CodexThread::current_time` synchronous, with clock reads required to avoid yielding or calling back into the session.
- Remove the experimental `currentTime/read` app-server request and its client-backed clock and sleep polling implementation.
- Require a host-provided `TimeProvider` for external clocks. App-server thread startup now fails when `features.current_time_reminder.clock_source = "external"` has no provider.
## Testing
Add coverage for external provider selection and rejection of app-server thread startup without an external provider.
GitOrigin-RevId: 09479d6eb28453b343dee78b3673092e73ae5d73
## What changed
Request plugin suggestions with `includeInstalled=false` and use the endpoint results without filtering against loaded plugins or the local installed-plugin cache. Retain disabled-tool and client eligibility filtering, and remove plugin loading that was only needed for recommendation filtering.
## Testing
Update tests to verify the query parameter and confirm that endpoint recommendations survive local installed-cache filtering while disabled tools remain excluded.
GitOrigin-RevId: a1b199f9ac8da7dae40abe46b6ccfaf1d8230a5c
## What changed
- Derive sampling diagnostic and rollout trace labels directly from permission profiles instead of constructing legacy sandbox policies. Rename the trace metadata field from `sandbox_policy` to `permissions_profile`.
- Extract `with_workspace_write_cwd` to share default workspace metadata protections between legacy policy conversion and the TUI's sandbox-mode compatibility check. Build the check's workspace-write profile from filesystem and network permissions directly.
## Testing
Add a regression test confirming that the sandbox-mode compatibility check accepts standard workspace metadata protections and rejects a profile with an additional writable `.git` root.
GitOrigin-RevId: f20d23afd80dff6347865df3d6a94d6f5e90e1e0
## What changed
Add `CodexThread::reproject_mcp_on_next_turn()` to request an MCP reprojection after `TurnStarted` and before tools are bound. Repeated requests coalesce, and idle reconciliation or prewarming leaves the request pending until the next regular turn.
## Testing
Add coverage for deferred requests surviving prewarm and idle reconciliation, coalescing into one reprojection, and exposing refreshed tools in the turn's first model request. Verify that discovery starts after `TurnStarted`.
GitOrigin-RevId: 260b2381013291a47eb9a7f736c129de76c5897f
## What changed
- Use the `rules_rs` 0.2.3 registry release instead of an archive override, and upgrade `platforms` to 1.1.0.
- Disable root crate alias targets and migrate explicit dependencies to package labels such as `@crates//tokio`. Disable root crate data for the argument comment linter's crate repository.
- Refresh the retained `rules_rs` patches, remove the zlib snapshot URL backport, and drop extra dependency declarations from `exec-server` and `v8-poc`.
GitOrigin-RevId: c354413a19b45964104457063c613028f5325bc0
## What changed
Set `DENO_CERT` and `CLOUDSDK_CORE_CUSTOM_CA_CERTS_FILE` to the managed proxy CA bundle when unset, preserving explicit values, including empty strings. Keep these client settings separate from the CA roots imported into the proxy trust bundle.
Preserve shell startup overrides when replaying snapshots, regenerate managed CA defaults instead of capturing them, and allow sandboxed processes to read the managed bundle referenced by these variables.
## Testing
Extend regression coverage for default CA settings, explicit overrides, trust-root selection, shell snapshots, and restricted sandbox access to the generated CA bundle.
GitOrigin-RevId: 2761706b54e0bb230c37bd4c515204c6eba0c650
## Why
Trusted classifier evidence needs to fit configured entry limits while preserving complete records and metadata that reflects only delivered reviews.
## What changed
Apply elastic caps before rendering trusted tools, trusted skills, and previous reviews into developer messages. Omit oversized tool attestations and review fragments whole, retain only complete skill paths that fit, and record omissions for the request's omission notice. Keep review IDs aligned with retained fragments and preserve fixed-budget behavior.
## Testing
Add coverage for whole-record omissions, retained review IDs, and omission notices. Exercise orchestrator connector evidence with both fixed budgeting and an elastic tool entry cap.
GitOrigin-RevId: 729db452026f93b59765a3936730b9b6dddfcf9a
## What changed
- Add `async_elastic_budgeting` and `async_elastic_sections` under `[features.guardianv2]`, independently of synchronous budgeting and disabled by default.
- Apply section limits and elastic allocation to new classifier evidence after accounting for setup and retained conversation history. Preserve the configured elastic policy when applying model defaults.
- Keep permission context whole during elastic allocation and record truncation observations when image preparation rejects an image.
## Testing
Add coverage for configuration validation, fixed and elastic conversation budgeting, retained history and cursor preservation, and complete classifier requests that retain evidence beyond the fixed entry limit.
GitOrigin-RevId: 2955f0482f7c3e18325e296fc2ccb6592ffcb73a
## What changed
Allow `thread/inject_items` to accept wrapped items with `retention: "default"` or `retention: "always"`, while preserving support for raw response items. Persist explicit policies separately from legacy client-authored metadata.
Carry explicitly retained items through local and remote compaction, context-window changes, and child-agent creation, subject to retention budgets. Preserve history order and keep retained tool exchanges together; require matching calls and outputs to be adjacent in the injection request and both marked `always`.
Update Quinn dependencies and record exceptions for additional Hickory DNSSEC advisories where DNSSEC is disabled.
## Testing
Update injection tests for explicit retention metadata and extend the compaction scenario to cover a retained tool exchange across repeated compaction and restart.
GitOrigin-RevId: 1195a4ed62dc162a62e58bc2ad733262fbabea27
## What changed
- Add the disabled-by-default `safe_image_decoder` feature to decode and re-encode prompt images without source metadata, with byte and decoded-pixel limits.
- Apply JPEG orientation and supported ICC color conversion to sRGB, emitting PNG for PNG/GIF inputs and JPEG for JPEG/WebP inputs.
- Use the selected decoder for image preparation, `view_image` validation, and MCP image validation. Include the decoder in image cache keys.
- Preserve original inline images in history metadata so resume and fork can regenerate prepared images without repeated JPEG encoding changing their bytes.
## Testing
Add regression tests for identical JPEG replay after history serialization and for preventing legacy cache entries from bypassing sanitization.
GitOrigin-RevId: 718cd83d0a233e2eb8efd1a64c14d8944e44c350
## Why
Inferring wait targets from request arguments can abort trace replay on malformed arguments and link waits to cells the host never resolved.
## What changed
Record an explicit `CodeCellWaitTargetResolved` event when the host confirms a live cell, and expose its runtime handle as `resolved_wait_runtime_cell_id` on the tool call. Build cell wait links from these observations, preserving links while cell source is pending and preventing late confirmations from linking to recycled handles after thread resume.
Older traces no longer infer wait links from request arguments, so an empty `wait_tool_call_ids` list does not establish that nobody waited on a cell.
## Testing
Extend dispatch and replay tests to cover live, missing, and invalid wait targets, pending cell source, legacy traces, and runtime handle reuse across threads and resume.
GitOrigin-RevId: 0f13b291c197c5487258b6ce36276cf1f19e2b6d
## What changed
Add `NetworkProxy::start_managed` and use it in core and exec-server to share proxy construction, startup, and error context. Keep approval-policy selection in core and pass the active decider and blocked-request observer to the shared helper.
## Testing
Expand session coverage for a full-access to workspace-write profile change: verify decider calls with approvals enabled, approvals disabled, and a final managed allowlist, and verify blocked-request notifications in each case.
GitOrigin-RevId: 97abdaa9af698166f46d74e0f231ec557d346200
## What changed
- Add `marketplaces.<name>.auto_update` to the configuration type and schema, defaulting to `false`.
- Preserve `auto_update` when re-adding a marketplace with the same source type and source, including equivalent normalized local paths. Drop it when the source changes.
- Preserve existing marketplace entries when converting an inline `marketplaces` table for editing.
## Testing
Add regression tests for re-adding the same Git source, replacing it with another source, and re-adding an equivalent local path.
GitOrigin-RevId: 8a4108f1c8fc5a20a8564ead5baeef57e7ccfa19
## What changed
- Make `McpManager::runtime_config` accept `McpServerContributionContext` and honor its originator, selected environments, and disabled plugin IDs.
- Add `McpServerContributionContext::for_host` to carry thread initialization data, originator, and session source without live extension state or discovery.
- Pass explicit global contexts from threadless discovery and control paths.
## Testing
Extend the thread manager test to cover host-only contribution identity, originator headers, and server restrictions for disabled plugins and pending environments.
GitOrigin-RevId: 04ea2c8951187d9014867f0020223b6a7dd94d8d
## What changed
Remove `SandboxDirectSpawnTransformRequest` and `transform_for_direct_spawn` in favor of `SandboxManager::for_file_system_helpers().transform()`. Keep Windows wrapper preparation specific to filesystem helpers, and return `SandboxUnavailable` when a Windows token sandbox is requested for a filesystem helper on a non-Windows executor.
Record the helper permission entry count during launch policy preparation, before adding runtime read grants.
## Testing
Cover Windows helper executable read access and explicit workspace write grants, including empty workspace roots. Verify rejection of non-native policy working directories and Windows token helper sandboxes on Unix. Extend the helper isolation test to exercise sandboxed writes as well as reads.
GitOrigin-RevId: f95bb94e12d8d7c6e5c773644abb7b59b47ffc4a
## What changed
- Read response window metadata through `current_window_from_state` with an explicit session state lock, releasing it before assembling response metadata.
- Name the token budget feature check used when restoring a forked child window.
- Pass an explicit `TestEnv` into the async compaction test helper and build with `build_with_environment`.
GitOrigin-RevId: 7ad852dbd65689e814f62cad645330ac5dac80f4
## Why
An unset voice preference should use the call destination's default. Changed or cleared preferences should also take effect on the next V3 call, even when the thread retains an older setting.
## What changed
- Use `gpt-live-1.1-codex` as the default V3 realtime model.
- Preserve an unset voice until request serialization, defaulting V3 API calls to `marin` and ChatGPT calls to `cove`, while honoring explicit voice selections.
- Reload current voice settings when starting a new V3 call through the app server, including cleared preferences.
- Populate the TUI voice picker from the V3 catalog, add `marin` to that catalog, and remove voice-catalog lookups from call startup and preference saving.
## Testing
Add regression coverage for API and ChatGPT voice defaults, explicit overrides, changed and cleared settings, and TUI call requests and voice selection.
GitOrigin-RevId: d0dd4dcd4bcad9ab869d7bf524e7095a88ffcfaa
## Why
MCP servers registered under the same name in different environments need distinct inventory, routing, and status reporting.
## What changed
- Keep MCP inventory and runtime status keyed by registration scope so same-named servers remain separate.
- Add optional `environmentId` selectors for status lookup, tool calls, resource reads, and OAuth login. Omitting the selector preserves existing name-only routing.
- Carry environment identity through startup notifications, elicitation requests, and tool-call history, and display it in the TUI.
- Support `/mcp login <name> --environment <id>` and update generated protocol schemas and SDK types.
## Testing
Add integration coverage for two environments with identically named MCP servers, tools, and resource URIs. Verify separate inventory, explicit environment routing, legacy routing when the selector is omitted, and errors for unknown environments. Update protocol and TUI tests for environment identity.
GitOrigin-RevId: 074a3db10549438cb6aff33eb7bed10791adae4d
## Why
Recording inference starts synchronously serializes prompts and writes trace payloads before model work can proceed. Defer that work so inference dispatch can continue while the trace is recorded.
## What changed
- Use one worker per trace bundle to write events in submission order, with up to eight pending jobs.
- Share prepared prompts and encoded requests with the worker, and build remote compaction snapshots there. Write payloads before publishing events that reference them.
- Add `TraceWriter::flush` and `ThreadTraceContext::flush` for live reads. Drain accepted jobs and seal the bundle on shutdown; suppress the closing marker after a recording failure.
## Testing
Add tests for deferred prompt serialization, ordered start and completion events, shutdown draining, and serialization failures that preserve earlier evidence without publishing a closing marker. Verify compaction snapshots are built on the worker and skipped when tracing is disabled.
GitOrigin-RevId: 32fd787bb1d281f1814df2f08c73b667628f8add
## What changed
- Replace individual JSON payload files with numbered Zstandard shards in trace schema v3. Add `PayloadReader` to resolve payload references, cache decoded shards, and validate payloads during replay.
- Capture exact outgoing HTTP bodies and WebSocket messages alongside prepared prompts. Preserve full formatted context for continuations from unrecorded WebSocket warmups while retaining the actual incremental request.
- Flush payload records before publishing references and seal the final shard before recording completion. Replace `recording_complete` with `recording_status` to distinguish unclosed recordings, closed recordings with partial payloads, and complete recordings.
Reduce trace bundles with the binary that recorded them.
## Testing
Add coverage for shard rotation, oversized records, live reads, cache eviction, and malformed or corrupt payloads. Extend HTTP and WebSocket integration assertions to verify captured requests and prepared prompts, including warmup continuations.
GitOrigin-RevId: 40ce3c11383f48e08f52e7120b706c61a449df9c
## What changed
Capture `codex_app_used_dictation` as per-input metadata, with patches taking precedence over replacements, and remove the key from metadata forwarded to Responses. Record attribution when user-origin input is accepted into turn history.
Add `used_dictation` to turn analytics: report `true` if any accepted input used dictation, `false` only when every accepted input has known non-dictation attribution, and omit the field otherwise.
## Testing
Add coverage for per-input extraction, patch precedence, and turn-level aggregation. Extend the app-server steering test to verify that dictation attribution reaches analytics while the metadata key is excluded from Responses requests.
GitOrigin-RevId: 0a55687a7dd61f00e9b188f89810e52bd941490b
## What changed
- Add the disabled-by-default `catalog_apps_instructions` feature to use the selected model's `model_messages.apps.usage_instructions`, subject to existing Apps availability and model gates.
- Preserve valid catalog text literally, allow an empty string to clear guidance, and fall back to bundled instructions for missing, whitespace-only, or oversized values. Overrides are limited to 800 UTF-8 bytes.
- Reconcile guidance with the latest retained Apps fragment, emitting replacement or removal notices when needed and avoiding repeated updates across resumes. Preserve compatibility with bundled guidance and legacy checkpoints.
- Recognize catalog Apps fragments as contextual developer messages in event mapping and rollout rollback.
## Testing
Add resolver, world-state, client, and scenario coverage for literal text and byte limits, feature and availability gates, model switches, clearing guidance, resumes, and legacy history recovery.
GitOrigin-RevId: 6240d407ada8f22fa101753ff3ddb338632ae283
## What changed
- Add a TUI helper that saves `tui.status_line_provider` to the active local user configuration, supporting `"default"` and MCP server/tool selections.
- Update the app and chat widget selections only after the write succeeds.
- Return an error when `ConfigEdit::SetPath` cannot insert a value at the requested path.
## Testing
Add tests covering active local profile writes during remote sessions, preservation of unrelated settings and configuration files, CLI override reloading, and failed writes that leave the file and live selection unchanged.
GitOrigin-RevId: 08008f58d7a467bb0c9129b7c198b4d224262ff1
## What changed
Add `tui.status_line_provider` to select `"default"` or an MCP provider identified by `server` and `tool`. Replace provider identities as a unit across configuration layers so partial overrides cannot inherit half an identity.
Ignore this setting from project configuration and packaged defaults when computing effective values and origins, while retaining strict validation. Preserve relative path resolution when an ignored provider value is malformed.
Carry the selection into TUI local settings and refresh it on configuration reload. Use the client's configuration home when rebuilding settings for remote sessions.
## Testing
Add coverage for provider precedence, incomplete profile overrides, malformed values and diagnostics, relative path resolution, and local preference preservation when resuming remote sessions.
GitOrigin-RevId: 0777d754d46cf009569ff0c90fd7426f8b7650bf
## What changed
- Update the workspace, Bazel toolchain and lockfile, CI and release workflows, and Windows setup script from Rust `1.95.0` to `1.99.1`.
- Adapt Rust code to the updated toolchain and Clippy lints, including `try_update` for atomics, `as_chunks` for fixed-size slices, and targeted allowances for generated tonic services.
- Refresh the halfwidth sound mark rendering snapshot to use literal characters in debug output.
GitOrigin-RevId: 5852029f687436dc814c2bca68141ee1f4a67d49
## Why
Suspending a locally controlled agent tree must preserve unfinished turns and child results that arrive during teardown so they remain available after recovery.
## What changed
- Add `ThreadManager::suspend_agent_tree` to stop durable trees, close their writers, and return unfinished root and named V2 child turn IDs plus any pending root wake.
- Persist terminal child results before suspension succeeds, including results queued for evicted parents. Report failed or unconfirmed writes.
- Add `load_suspended_agent` to restore named V2 descendants through their recorded ancestors without starting model turns.
- Allow empty `continue_turn_if_idle` input to wake on saved results, guarded by the preceding turn ID. Keep mail queued until task registration so suspension can preserve it.
## Testing
Add coverage for completion and wake races, child errors, parent writer failures, evicted parents, descendant restoration, repeated suspension after caller cancellation, and ephemeral roots remaining active.
GitOrigin-RevId: 3041791f51bff2555210f6b2d2443f9f05f68330
Describe remote board connection settings, host ownership, and configured
clocks in general terms. Update the remote board test credential to match
that terminology.
GitOrigin-RevId: c2c32808c98afad849f6e4f59f75d8d204f51694
## What changed
Stop rebuilding permission profiles through the legacy sandbox policy when only the working directory changes. Preserve the profile, its active selection, and profile workspace roots while updating runtime workspace roots for the new directory.
## Testing
Extend regression coverage to check that directory-only updates preserve the permission profile snapshot and expected thread settings. Verify that workspace-write permissions allow ordinary files in the new workspace while denying writes to `.git/config` and the previous workspace.
GitOrigin-RevId: a4f4b2dc4ffa16cbf33ddb124eed4b759b2aae78
## Why
Plan items used a single ID derived from the turn ID, so multiple completed plans within one turn shared an ID across retries or tool continuations.
## What changed
Generate UUIDv7 plan item IDs and carry an unfinished plan's ID across model requests within a turn. Once a plan completes, assign a fresh ID to the next plan.
## Testing
Add unit and integration coverage for unfinished retries, retries after plan completion, and tool continuations, including matching streamed events to saved completions. Update the app-server test to check plan IDs against the start notification.
GitOrigin-RevId: 87b4b3e6bd74224ea96f4308f739bcd2efb62299
## What changed
Preserve original root conversation evidence, retained instructions, assistant context, and verified answers until request preparation. Apply shared section preparation to both synchronous and asynchronous reviews, preserving fixed limits and omission notices while allowing elastic preparation to use the originals. Cache the fixed root view for reuse.
Split classifier setup from final input assembly and normalize new images before deduplication and token accounting, preserving committed history.
## Testing
Extend tests for fixed and elastic preparation across both review profiles, original root evidence after handoff, and image normalization during retained-request preparation.
GitOrigin-RevId: 86c83384c1f5be3707622d675fc54b4c8e1ddc0a
## What changed
- Create WebRTC calls using the TUI's local provider and credentials, then attach the app server through `existingCall` with the returned call ID.
- Preserve the effective voice preference and share realtime prompt preparation and thread headers between call creation and the backend observer.
- Run negotiation asynchronously, cancel pending startup when voice stops, and ignore results from stale startup attempts.
## Testing
Update voice request and handoff tests for client-created calls. Add coverage ensuring that canceling and restarting voice attaches only the new attempt, including when an earlier result is already queued.
GitOrigin-RevId: b704976f4918dddd24a17fbaa868a7c62e81885b
## What changed
Route direct reviews through the reusable Guardian session so sequential `thread/guardianReview` calls on the same loaded thread can share review history with live approvals. Keep the reviewer conversation separate from the actor and follow the parent thread's persistence settings. Retries reassess the final call under the current policy.
## Testing
Extend app-server coverage to verify history reuse within a parent thread and isolation between parents. Extend the core scenario and snapshot to cover sequential direct reviews without executing the recorded commands.
GitOrigin-RevId: 5f10a04aec43a9351e38575265cb6b5ff06530a5
## What changed
- Remove `Config::set_legacy_sandbox_policy` and update session, approval, and Guardian test setup to set permission profiles and workspace roots explicitly.
- Reuse `PermissionProfile::from_legacy_sandbox_policy_for_cwd` for legacy policy validation and updates in `Permissions`.
GitOrigin-RevId: 5ee92c46290ee6a3d7e2d2db7b02641e80bdc44f
## What changed
Move permission normalization into `Session::apply_session_settings`, leaving `SessionConfiguration::apply` to install the normalized snapshot. Preserve existing deny-read restrictions and infer active profile identity before merging those restrictions.
Convert legacy `sandbox_policy` updates into permission profiles using the updated working directory, clearing active profile identity and profile workspace roots. Normalize a copy so previews preserve the original compatibility input for subsequent admission.
## Testing
Extend session tests to cover deny-read preservation for both update forms, Git metadata protection when changing the working directory, and preview/commit behavior for legacy updates and active profile identity.
GitOrigin-RevId: 8b3a0f630ab56aca6ad75cf16ad432f7fdc08255
Anthony Tafoya