## What changed
Set the app server's unload delay to zero for ephemeral threads whose `thread_source` is `composer_predictions`, excluding subagent sessions. These threads unload once they are idle and have no subscribers, while active turns continue to completion.
## Testing
Extend integration coverage to check immediate unloading after an active prediction turn finishes and after unsubscribing from a fork that inherits the prediction configuration. Verify that persistent threads and ephemeral threads without the prediction source retain the configured delay.
GitOrigin-RevId: 04a0e405b666c689ccf6f482055d24692b18ead0
## What changed
- Add `PreModelRequest` and `PostModelRequest` hooks around model request attempts, including retries. Pass model, session, turn, and optional subagent context; report completion, failure, or cancellation with errors and token usage when available.
- Treat hook output as diagnostic data without allowing it to veto requests or alter model context. Wait for synchronous post-request hooks before dispatching tools, while asynchronous hooks allow streaming tool dispatch to continue.
- Apply memory-consolidation hook filtering and expose the new events through configuration, protocol schemas, generated clients, and the hooks browser.
## Testing
Add integration coverage for failures and retries, ignored control directives, cancellation, synchronous and asynchronous tool ordering, interrupted-turn resume and token accounting, and memory-consolidation filtering. Update hook schema fixtures and hooks browser snapshots.
GitOrigin-RevId: 6ed7b39fc8bb94cf467e350d07d97fcc729c21ce
## What changed
Add `features.app_server_websocket_compression`, disabled by default. TCP WebSocket and Unix-domain socket listeners now negotiate zstd compression only when the feature is enabled and the client offers the supported protocol. Otherwise, connections use plain text messages.
Include the feature in the configuration schema and allow its override during TUI daemon startup.
## Testing
Extend transport tests to cover enabled and disabled compression with supported, unsupported, and absent client offers on both transports. Add an app-server integration test that verifies startup configuration controls negotiation and the message format used for initialization responses.
GitOrigin-RevId: 6001d65f66f9c48f099b85380c2cad8ffee04de7
## What changed
Add the `multi_env_copy_file` feature flag, disabled by default and marked as under development, to the feature registry and configuration schema. Install the file-copy extension in app-server threads and CLI debug prompt construction when the flag is enabled.
GitOrigin-RevId: 6d8b4c7479974f4b70c39f52333491c13d60d2a2
## Why
MCP tool discovery discarded response-level `_meta`, leaving server-status clients unable to inspect metadata associated with the tool catalog.
## What changed
- Preserve opaque `_meta` from the first `tools/list` page through catalog refreshes and caches.
- Expose it as `toolListMeta` in `McpServerStatus`, with `null` when unavailable, and update generated schemas and bindings.
- Scope cached Apps catalog metadata to discovery settings, including client capabilities and extensions, while retaining tools from older caches without metadata.
- Restrict server capabilities in status snapshots to the selected servers.
## Testing
Add regression coverage for listing legacy cached Apps tools during failed startup, and update protocol serialization expectations for nullable `toolListMeta`.
GitOrigin-RevId: 62335e2fd8c482067a7a78a7612b58c3eaa9fb55
## Why
MCP tool calls reported every aborted approval as "user cancelled MCP tool call", including interrupted requests and automatic cancellations in `exec` mode.
## What changed
Carry `user`, `interrupted`, or `non_interactive` cancellation reasons through MCP approval metadata and resolution. Mark explicit TUI cancellations as user actions, interrupted requests as interruptions, and automatic `exec` cancellations as non-interactive.
Use the reason to report when a call was cancelled before approval or because interactive approval is unavailable in `exec` mode. Preserve the existing cancellation message for clients that omit the reason.
## Testing
Update tests to verify that a closed approval response carries the interruption reason and that `exec` cancellation responses include the non-interactive reason.
GitOrigin-RevId: be2a5f7fef539b5db2add53b46aea27e2b8a66fc
## What changed
Add `ThreadStoreError::Retryable` for transient failures known to be safe to retry and `ThreadStoreError::OutcomeUnknown` for writes that may already have committed. Recovery remains the operation owner's responsibility; neither category automatically triggers retries.
Preserve existing app-server error mappings and fatal session startup behavior, and report the new categories in shutdown diagnostics without exposing raw error payloads.
## Testing
Add coverage for conservative SQLx error classification, mutation error mappings, session initialization categories, and shutdown diagnostics that omit raw error payloads.
GitOrigin-RevId: 259a9bfaa6ff3cbfa2ee61a01a1f1e744c90f118
## Why
A plugin's scripts can change without changing its hook declaration. Declaration-only approval therefore lets changed plugin code run under an existing hook approval.
## What changed
- Fingerprint plugin bundle contents and include the content hash in the approval value returned by `hooks/list`. Persist it as `trusted_content_hash`, keeping `trusted_hash` compatible with older clients.
- Verify contents before each command or MCP hook execution, within the hook's timeout, and require renewed approval when approved contents change.
- Migrate legacy declaration-only approvals to a shared, immutable content baseline per plugin and config home.
- Exclude generated Python bytecode, `.venv`, and `.egg-info` entries from fingerprints. Run app-server hook listing on blocking tasks.
## Testing
Extend integration coverage for plugin upgrades and rollbacks requiring approval, same-turn script changes preventing further hook execution, shared legacy approval baselines, and generated Python artifacts preserving trust.
GitOrigin-RevId: faaf7658210d8adb2534ddd614c72ec993920840
## Why
Explicitly selecting the default daemon socket previously classified the TUI connection as remote, changing how local configuration and thread parameters were handled. A socket at that path may also be an SSH forward, so the path alone cannot establish that the daemon is local.
## What changed
- Verify the default daemon endpoint before classifying an explicit connection as local. On Unix, check the expected symlink target and the private socket directory's ownership and permissions, then connect to the protected endpoint directly.
- Preserve local workspace behavior and local thread parameters for verified attachments while keeping directly bound Unix sockets classified as remote.
- Report a missing explicitly requested socket, disable embedded fallback for explicit attachments, and restrict daemon auto-start to implicit connections.
## Testing
Extend tests to cover explicit and implicit local target selection, verified socket resolution, and rejection of a directly bound socket as a local daemon endpoint.
GitOrigin-RevId: ac2226ca1c5f60b26aad9571f945e3325d3bebfa
## What changed
Add optional `inputImages` metadata containing each referenced local image's path and SHA-256 hash of the bytes read before normalization. Compute the hash from the same bytes used to prepare the edit request.
Preserve this metadata through completion events, persisted thread history, resume, and legacy rollout migration. Update app-server schemas and generated TypeScript and Python types; older items continue to deserialize without the field.
## Testing
Add coverage for input ordering, changed contents at the same path, unreadable or invalid references, serialization, persisted history and resume, and legacy migration.
GitOrigin-RevId: 522be8ec1e39c9b2bbe5b9ccb37ea67d17f0e21a
## What changed
- Upload generated images to the attachment store and expose `fileId` in image-generation items when available, with inline `result` fallback on upload or decoding failure.
- Preserve file references through legacy events, persisted rollouts, thread history, and task output summaries. Keep model-facing image preparation separate.
- Add attachment request tags and mark generated-image uploads with `usage=image_gen`, preserving the thread's ephemeral setting.
- Update public schemas and SDK types to accept either image representation, retain the Python `ImageGenerationThreadItem` alias, and prefer `fileId` when reading records containing both fields.
## Testing
Add coverage for file-backed generation and rollout persistence, legacy history replay, inline and transitional serialization, task output visibility, and Python SDK alias compatibility.
GitOrigin-RevId: f7a2bb5707e2f277348a547a988bc33c8e96d891
## Why
Trimming interleaved realtime transcripts by utterance order can discard the latest speech from an earlier utterance. Evicting after each delta can also drop one speaker before the other speaker's delta from the same frame arrives, losing recent instructions at handoff.
## What changed
Use raw frame recency to trim timed frameless bidirectional transcripts within the 8 KiB budget. Defer eviction until the frame advances or the transcript is consumed, and retain both speakers' suffixes when they share the newest frame. Preserve conversation order and fall back to FIFO eviction when timing is unavailable.
Track trimmed prefixes so final transcripts can extend retained speech without making delayed finals appear newer.
## Testing
Add regression coverage for frame recency, same-frame event ordering, UTF-8 truncation, delayed finals, and untimed fallback. Add an app-server handoff test verifying that both speakers' recent speech and the latest user instruction survive while live transcript notifications remain unchanged.
GitOrigin-RevId: b01b729d8bdd4acb26e0385442ce40819355deac
## Why
The app server retained its startup model provider for catalog requests, so signing in or out could leave `model/list` using stale provider settings or requiring a restart after managed provider requirements changed.
## What changed
- Invalidate the catalog after successful login and logout, then reload the effective configuration on the next model list or background refresh. Rebuild the models manager when the provider or catalog changes, while preserving existing threads' routes.
- Retain the original project context and the TUI's `--oss` provider selection across reloads. Retry configuration loading after falling back to defaults so temporary failures do not pin the fallback catalog.
- Keep provider policy checks for cached catalogs and apply runtime `api_key_model_discovery` toggles to the active catalog manager.
## Testing
Add and extend tests for provider selection and definition changes after login, catalog reloads after logout, OAuth gateway transitions, fallback recovery, project context, and runtime model discovery toggles.
GitOrigin-RevId: bce2e23ff567e1a52eac2b6ad736a6e63ff61e2b
## Why
Native extensions need configured Responses metadata for request attribution, but extension calls used the MCP metadata template, which omits it. Image requests also did not forward the turn metadata to the backend.
## What changed
Use the Responses metadata template for native extension calls while continuing to exclude tool inventory. Forward the resulting metadata in the `x-codex-turn-metadata` header on image generation and edit requests.
## Testing
Extend metadata tests to cover configured values in extension calls and app-server tests to verify `display_name` and `turn_trigger` on image generation and edit requests, including a Unicode display name.
GitOrigin-RevId: a2ffaa4d15259c662917612391b8717ee34b9c6c
## Why
Clients need a way to update individual turn metadata entries without replacing the existing client metadata map.
## What changed
Add the experimental `responsesapiClientMetadataPatch` field to `turn/start` and `turn/steer`. Patches add or overwrite entries while retaining other keys and apply after `responsesapiClientMetadata` when both are supplied. The existing field retains replacement semantics, including clearing unprotected entries with an empty map.
Continue protecting reserved metadata keys and preserving targeted `misalignment_override` continuations across updates.
## Testing
Extend the app-server metadata integration test to cover replacement and patch steering, patch precedence at turn start, preservation of unrelated entries during patches, and protection of targeted continuations.
GitOrigin-RevId: 8c4da3ba1b87329da20b5295846bdcf3a88126de
## Why
Compression replaces `.jsonl` rollout files with `.jsonl.zst` files, so checking only the original path can skip existing sessions. Compression can also replace a file between path lookup and canonicalization.
## What changed
- Resolve compressed rollout alternatives when selecting the latest local session.
- Retry rollout path resolution when files disappear during lookup or canonicalization.
## Testing
Extend coverage to verify latest-session filtering after startup compression and resuming a compressed rollout through its original relative `.jsonl` path with preserved turns.
GitOrigin-RevId: a4d5c399567ab4c7cd8aaa8b5f38821ee8b8d802
## Why
Message roles and content classifications do not identify who supplied each context part. Source attribution needs to survive prompt assembly and history truncation, including messages that combine text from different producers.
## What changed
- Add per-part `ContentItemMetadata` for user input, developer instructions, `AGENTS.md`, skills, harness context, command hooks, and tool context with optional callable namespaces.
- Carry attribution alongside content and classifications through contextual fragments, extension prompts, hook output, and agent messages. Keep tool-provided context-window hints separate from harness text.
- Preserve the source of retained text slices during compaction and attribute generated truncation notices to the harness. Default missing historical attribution to unknown.
- Attribute host MCP calls using cached tool namespaces only when catalog revisions remain stable, without starting servers or refreshing catalogs for attribution.
- Send the new metadata to Responses Lite and strip it from requests to endpoints that do not support it.
## Testing
Extend compaction tests to cover mixed sources, missing or extra metadata entries, and discarded media. Update Responses Lite request assertions to verify endpoint-specific attribution handling.
GitOrigin-RevId: b0ebc929b7c60f3ec49d1affbf897312d63edcc8
## Why
Workspace routing reported generic requirements load and reload failures, hiding the cause. Raw configuration errors can contain secrets, so exposing their messages directly is unsafe.
## What changed
Include a safe reason in configuration load and reload errors: file locations or non-file line and column numbers, cloud error categories and HTTP status codes, known network policy denials, or OS error details. Exclude raw parser messages, configuration contents, and backend-supplied policy names and IDs.
## Testing
Add regression coverage for configuration locations, cloud failures, and network policy denials. Verify that malformed local and cloud configuration reports useful errors without exposing secret values or policy identifiers, and still prevents workspace routing from falling back to startup configuration.
GitOrigin-RevId: a71484c700d32662ced9e19041dbedda5d1da8a5
## What changed
Add optional `voiceSessionId` to realtime start parameters and forward it as the `voice-session-id` header for WebSocket, WebRTC, and existing-call transports. Keep this client-generated voice session identifier distinct from `realtimeSessionId`, which uses `x-session-id`.
## Testing
Extend serialization tests and add coverage for distinct session ID headers, WebRTC request forwarding, and existing-call handshake forwarding.
GitOrigin-RevId: cb558dbb9d438f2d34e281199a7e81fe5d33b879
## What changed
Use `conversation` when neither a local `async_classifier_mode` override nor a model default specifies a mode. Keep `snapshot` available as an explicit override and update the configuration documentation and schema to describe the new fallback.
## Testing
Expand configuration tests to cover all local override and model default combinations. Update app-server approval tests to exercise conversation mode without an explicit override, and explicitly select snapshot mode in tests that depend on it.
GitOrigin-RevId: a62479a3f6454bf28d589373a236d8b0ab5023b9
## Why
Rewriting source agent names and instruction filenames inside URLs and email addresses can change their destinations when importing external agent content.
## What changed
Use `linkify` to preserve recognized URLs and email addresses while rewriting surrounding text, including Markdown link labels and titles. Continue migrating instruction filename references to `AGENTS.md`, including relative links and references with line or column suffixes.
## Testing
Add rewrite coverage for URLs, email addresses, Markdown links, and surrounding Unicode text. Extend skill import and app-server configuration import tests to verify that link labels migrate while URL destinations remain unchanged.
GitOrigin-RevId: c4d210a287c99b6440438c99527364d379c568bd
## Why
Prediction forks need to retain their parent's context even when it exceeds the automatic compaction threshold. Compaction or context resets can otherwise replace the history used for the prediction.
## What changed
- Apply a thread-local `AutoCompactionDisabled` policy to experimental prediction forks without changing model or skill budgets.
- Skip automatic compaction before, during, and after turns, including context-limit recovery, and suppress new token-budget reminders.
- Reject `new_context` requests for these threads and report context-limit failures without compacting their history.
## Testing
Add regression tests for legacy and paginated prediction forks across compaction thresholds, unchanged parent compaction and skill/tool inputs, context-limit failures, and rejected context resets. Add a request-history snapshot verifying inherited context and reminders survive without compaction or additional reminders after a tool call.
GitOrigin-RevId: 7df374287f4142f776981bb6c22e5caa564d74a5
## What changed
Add a Linux app-server integration test that resumes a saved read-only thread after the default permissions change to `:danger-full-access`. Verify that the live network proxy honors restored grants, requests approval for a new host, persists the approved rule, and reuses it without another approval.
The test also verifies that proxied requests succeed while direct access remains blocked.
GitOrigin-RevId: 08f63efb8752d738df0ee97e4e98c3366ae54f56
## Why
Restoring unnamed thread permissions after configuration loading leaves network proxy initialization and permission validation using the configured default. A saved read-only thread should also resume when that default is incompatible with current managed requirements.
## What changed
Apply eligible saved permission profiles during configuration loading, before network preparation and final validation. Keep explicit permission overrides and managed requirements authoritative, preserve managed deny-read restrictions, and reject saved external enforcement or materialized filesystem grants. Include the saved profile in the app-server's prepared resume configuration state.
## Testing
Add regression coverage for resuming saved read-only permissions with an incompatible full-access default and for retaining managed, remembered, and newly approved network domains in the restored profile's proxy allowlist.
GitOrigin-RevId: 73e32b0a31ac678fd3f60a8ccf8fa9df627f16c3
## Why
Cold resume can replace saved unnamed permissions with current configuration defaults or recover an executor's permissions from turn context. A first-turn context can also predate an acknowledged settings update.
## What changed
- Restore eligible unnamed permission profiles from settings snapshots owned by the resumed thread, honoring explicit caller overrides and current managed requirements.
- Use owned snapshots as the authority for named permission profiles and reapply workspace permissions for the resumed workspace roots.
- Persist a thread-owned settings checkpoint after the first turn's context, serialized with settings updates so older checkpoints cannot supersede newer settings.
## Testing
Extend regression coverage for cold resume with changed defaults, managed permission restrictions, workspace-root overrides, foreign snapshots, and settings updates during first-turn processing.
GitOrigin-RevId: e411d9fd3d586a4162498c9c77c4184459071bd1
## What changed
- Update the pinned `rmcp` dependency and Cargo/Bazel lockfiles, and migrate MCP handlers and fixtures to `ClientConfig` and `ServerConfig`.
- Stop requiring responses for cancelled elicitation requests in cancellation tests while retaining checks for cleanup and continued connection usability.
- Handle client disconnects during WebSocket writes in the TUI test server, use an asynchronous HTTP mock for loopback proxy testing, and improve remote executor test diagnostics and the Windows subprocess fixture.
- Use `invalid_prompt` for the memory worker failure fixture.
## Testing
Add a regression test covering transport EOF during both form elicitation and user verification. Keep the client alive while checking that pending response channels close, the timeout pause clears, and the service exits with `QuitReason::Closed`.
GitOrigin-RevId: c0166b83fab3b59d84a5207c6630cb6adcf3b230
The initial user item seals realtime transcript segments, so starting speech before it completes can split the segment under test. Wait for its `item/completed` notification and assert that it is a `ThreadItem::UserMessage` before triggering speech, so only the steering under test can split that segment.
GitOrigin-RevId: 932443f4a0d6c4284cf95f44e64912506769a180
## What changed
- Add the disabled-by-default `output_token_replay` feature to request `output.encrypted_content` from OpenAI providers.
- Preserve encrypted message and tool-call output, message and function-call status, and output-text `annotations` and `logprobs` through history and replay. Update the generated protocol schemas and SDK types.
- Strip output ciphertext from requests to other providers while retaining it in stored history, including after replay is disabled. Remove encrypted content from memory extraction inputs.
## Testing
Add integration coverage for the feature/provider combinations, metadata replay across follow-up requests, and history preservation when resuming with replay disabled.
GitOrigin-RevId: 77729a021b6771933402aebe74ece8eb39c057e2
## Why
Graceful shutdown rejects new sessions with an invalid-request error. Give clients a structured shutdown reason and show command center users why session creation is paused.
## What changed
- Add `data: {"reason":"serverShuttingDown"}` to app-server shutdown admission errors while retaining JSON-RPC code `-32600`.
- Show a dedicated shutdown message explaining the wait for active turns and automatic reconnection for non-embedded servers. Recognize older servers by their exact draining message only when error data is absent, and preserve retained-worktree cleanup guidance.
- Keep the command center reconnect presentation when a shutdown error covers the initial overview and no conversation is open.
## Testing
Extend admission and WebSocket shutdown assertions, add embedded and daemon shutdown message snapshots, and cover reconnection with a shutdown error over the initial command center.
GitOrigin-RevId: f167144c0ddc77872afdf3daac8bb1c89f3425b4
## What changed
Pass the parent turn's `cyber_access_program` to Guardian reviewers and asynchronous classifiers. Use `daybreak_blue` for either Daybreak selection, preserve `standard`, and omit `access_programs` when no program is selected.
Capture the selection with the owning turn so asynchronous observations retain it across later turns. Resolve classifier programs using current authentication and the same provider and API-key feature policy as ordinary model requests.
## Testing
Add regression tests for program changes across reused reviewer sessions with API-key and ChatGPT authentication, snapshot and conversation classifiers at low and high risk, and enabled, disabled, and unsupported-provider API-key policies. Verify parent requests retain their selected program.
GitOrigin-RevId: 447f306df3a6bd6805464b819950690c751b04b4
## What changed
Add an optional `retain` flag to `TurnToolOutput` for `turn/start`. When set to `true`, pass the output to the core with a retention annotation to request retention in the thread's model history. The flag defaults to `false`, preserving existing behavior.
Update the generated JSON schemas, TypeScript types, and Python bindings to expose the flag.
## Testing
Add an integration test verifying that a retained tool output reaches the model and preserves client-authored sender metadata in persisted history, including the receiver message ID.
GitOrigin-RevId: 52893a8fcb308f26e77ba8f0bee9990073b26d54
## Why
Interrupted automatic goal continuations reset the empty-response counter, allowing repeated interruptions without activity to keep a goal running indefinitely.
## What changed
Count interrupted automatic continuations without activity toward the existing three-turn limit that marks a goal as `blocked`. Defer evaluation until the thread is idle and serialize it with turn-start accounting. Activity and user turns still reset the counter.
## Testing
Extend accounting tests to cover interrupted and mixed empty continuations, including resets after tool activity or user turns. Add an app-server regression case where a `PreCompact` hook repeatedly interrupts automatic continuations and verify the `thread/goal/updated` notification reports `blocked`.
GitOrigin-RevId: 4c34e3ed1ae612e97cf067c2aa76836b10c50ef5
## What changed
Add `thread/items/read` to retrieve persisted items by `threadId`, `turnId`, and 1–100 `itemIds`. Return matching items in canonical stored order, omitting missing IDs and items outside the requested turn.
Add item ID filtering to the thread store while preserving inherited history and fork cutoffs. Require the experimental API capability for the new endpoint.
## Testing
Add coverage for stored ordering, turn scoping, missing IDs, request size limits, experimental capability gating, and inherited items across fork cutoffs.
GitOrigin-RevId: 9b243dd87577bd4fe36900c388a386b2e26ff2e0
## Why
Background workspace routing reads reload configuration even when signed out or using an API key, although routing requires ChatGPT authentication.
## What changed
Check cached authentication before reading accounts for workspace routing at app-server startup and connection initialization. Skip these background reads without ChatGPT authentication, while preserving configuration reloads for explicit `account/read` requests.
## Testing
Add regression tests covering signed-out and API-key startup and connection initialization, explicit `account/read` configuration reloads, and routing after ChatGPT sign-in, including propagation of configuration errors.
GitOrigin-RevId: 8b90ee609ed24f8618cd21f160eb7001703b8bd1
## Why
Clients need to mark threads read or unread without overwriting unseen results or another window's explicit mark.
## What changed
Add `thread/readState/update` for eligible durable local threads, gated by `initialize.capabilities.experimentalApi`. Requests include `threadId`, `expectedRevision`, and an operation of `{type:"read"}` or `{type:"unread"}`.
Marking read clears `firstUnread`; marking unread sets it to `threadStart`. Successful updates return the read state and notify subscribers through `thread/readState/changed`. Both operations require an exact revision match. Stale requests return `-32600` with `readStateConflict` and the current read state, requiring a fresh user action rather than a blind retry. Updates do not change thread recency.
## Testing
Add app-server coverage for experimental capability gating, explicit unread marks and notifications, conflicts for both stale operations, and marking read with a fresh revision.
GitOrigin-RevId: 775f6e9584dc91bd3c2ee9a309144b5baf0edffa
## What changed
Add the experimental `thread/readState/changed` notification with `threadId` and the committed `readState` receipt. Send it to existing thread subscribers when terminal activity updates read state or a revert clears a removed unread position. Emit terminal read-state updates before `turn/completed` so completion remains the last notification for that result.
Expose the notification in generated JSON schemas, TypeScript types, and Python SDK models. Document experimental capability gating, subscription lifetime, notification opt-out, and refreshing receipts when concurrent responses disagree.
## Testing
Extend the read-state integration test to assert that the notification receipt matches the receipt returned by `thread/read` after terminal activity.
GitOrigin-RevId: 28935352a881b7a5e2e7f629173c3b2061bd7941
## Why
Realtime v3 voice validation used the v1 voice list, limiting the available voice choices.
## What changed
- Add a dedicated `v3` voice list containing the v1 voices and 16 additional voices, and use it to validate v3 requests.
- Expose `v3` in `RealtimeVoicesList`, defaulting to an empty list when omitted during deserialization.
- Update the configuration and app-server schemas, generated TypeScript and Python types, and voice-list test expectations.
GitOrigin-RevId: 7fc8060fe01d840f28eb92c3dfe49c5878c3c258
## What changed
- Add experimental `readState` to `thread/read` and a thread-ID-keyed `readStates` map to `thread/list` for eligible durable local user threads. Each receipt contains `firstUnread` and an opaque `revision`.
- Publish new visible terminal results before `turn/completed`, after flushing the rollout. Reading snapshots leaves activity unread; replayed history does not publish new activity.
- Clear unread positions removed by a paginated thread revert while preserving explicit thread-start marks and concurrent receipt updates.
## Testing
Add an integration test covering completed-turn receipts, repeated reads without acknowledgement, matching list receipts, and revert cleanup with a changed revision.
GitOrigin-RevId: e7f6ddfbb1fc2fa95d1ef2876d7f0f7b9f99ff65
## What changed
- Remove `ContentItemMetadata`, provenance and namespace types, and the `content_item_metadata` protocol field while retaining `content_item_kinds` classifications.
- Simplify context fragments, extension contributions, and hook output to carry content without source attribution. Return MCP tool results directly without an attribution wrapper.
- Render context-window hints together in a single text fragment.
## Testing
Update Responses and Responses Lite request assertions to expect content-kind classifications without per-content attribution, and adapt context, hook, and extension tests to the simplified types.
GitOrigin-RevId: 201894cd4c93c6d4b4c41c845e7a9af1dd3c95ca
## What changed
Add `history_initialization` to `x-codex-turn-metadata`, distinguishing `new`, `cleared`, `cold_resume`, `warm_fork`, `cold_fork`, and `supplied_history`.
Classify forks by whether the source runtime is loaded and has not shut down. Preserve the classification for the runtime's lifetime, including warm resumes and compaction. This records how history was initialized; it does not establish whether tool metadata is missing. Reserve the field against client-supplied overrides.
## Testing
Extend coverage for warm and cold forks, cold resumes, warm reconnects, supplied history, WebSocket metadata serialization, and reserved-field filtering.
GitOrigin-RevId: 468153512a84d0f4d4ea742198a29e0fa3873a72
## Why
Durable remote-control RPC changes need to update the managed daemon's launch settings so future launches use the saved preference.
## What changed
- Save non-ephemeral `remoteControl/enable` and `remoteControl/disable` requests to `remoteControlEnabled` in `app-server-daemon/settings.json` for managed daemons.
- Preserve other settings and write updates atomically. Skip persistence when `daemon.lock` is held so concurrent lifecycle operations take precedence without blocking the RPC.
- Leave daemon settings untouched for ephemeral requests and unmanaged servers.
## Testing
Add integration coverage for durable enable and disable, ephemeral requests, and lock contention. Extend the unmanaged-server test to verify that no daemon settings file is created.
GitOrigin-RevId: 2baf261ed62f7c7ad87c9779ffb91c59e923f0f8
## Why
Disabling OpenAI analytics also disabled explicitly configured OTLP metrics collectors. Users should be able to export metrics to their own collectors independently of `analytics.enabled`.
## What changed
Apply the analytics preference only to the built-in `statsig` metrics exporter. Keep custom OTLP HTTP and gRPC exporters enabled regardless of that preference, and use `otel.metrics_exporter = "none"` to disable metrics export. Clarify these settings in config documentation and the schema.
## Testing
Cover exporter selection across explicit and default analytics preferences. Update app-server and daemon telemetry tests to verify custom metrics export with analytics disabled, and worktree tests to disable metrics through the exporter setting.
GitOrigin-RevId: 0c61f0f01e2b694db642ac7e7fd1dac9965c7d96
## What changed
- Reformat Markdown tables and lists, login pages, inline visualization HTML, and sample JavaScript scripts.
- Escape union-type pipes in Python SDK API tables so they render within their cells.
- Keep the formatting-recipe test focused on the working directory and formatter commands by removing assertions on comment text.
GitOrigin-RevId: ae46d5b40fd013553de8b5ccf2c41d76be65aba8
## What changed
Add the disabled-by-default `guardian_trust_orchestrator_connectors` feature flag. When enabled, Guardian V2 accepts connectors with nonblank IDs from the host-owned plugin service orchestrator as a trusted source without requiring a matching user configuration declaration.
Distinguish orchestrator provenance from user configuration in trusted-tool context. Trust remains scoped to the exact server or connector identity and source; descriptions, outputs, other tools, and other connectors remain untrusted.
## Testing
Add coverage for host-owned connector context, rejection of extension-owned Apps lookalikes and blank connector IDs, source-specific trust metadata, and context token limits. Snapshot the connector approval request history.
GitOrigin-RevId: fbd87dd71110ca7b2b92d50eef02e1e739a74a02
## Why
Subagents should retain the spawning turn's selected skills and plugin choices whether `fork_turns` is `none` or `all`. Capability selection should not depend on copied conversation metadata.
## What changed
- Use a shared child startup path for fresh and history-forked agents, inheriting selected capability roots from the spawning environment snapshot.
- Pass the spawning turn's `disabled_plugin_ids` through both spawn handlers. When omitted, inherit the parent's current choices; explicit lists, including an empty list, override them.
- Resolve the parent before startup so inherited client MCP settings apply even when only the session source identifies the parent.
- Carry plugin choices into delegates with inherited isolation and preserve saved capability roots when resuming a child.
## Testing
Add regression coverage for executor skill listing and reading, plugin MCP registration with both history modes, plugin overrides, capability-root precedence and isolation, and restoring saved child settings after parent settings change.
GitOrigin-RevId: 2a6891a9bc6372fd2d1f30add2b5611f96b60594
## What changed
- Add optional `websocketRequestId` to `environment/add` and send it as `X-Request-ID` on direct WebSocket upgrades, including reconnects. It requires a secure transport or a loopback destination.
- Echo a supplied `X-Request-ID` in the exec-server WebSocket upgrade response.
## Testing
Add coverage for `websocketRequestId` serialization and for handshake header forwarding and echoing, both with and without a request ID.
GitOrigin-RevId: 235303ff7e1150405b7e1158d6024223144e0cc3
## What changed
Support `plugins._default.enabled` with explicit per-plugin `enabled` overrides. Omission preserves existing source and account enablement; configuration cannot activate a plugin disabled at its source. Plugin settings such as remembered tool approvals inherit the default unless `enabled` is explicitly set.
Apply the policy to plugin skills, MCP servers, Apps, and hooks, including selected executor roots and runtime configuration refreshes. Preserve the latest plugin policy when adding MCP dependencies and rebuild hooks when concurrent configuration updates replace their inputs.
Report effective enablement in `plugin/list`, `plugin/installed`, `plugin/read`, and `plugin/share/list`. Remote installation still installs disabled packages, but skips MCP and Apps authentication setup without writing an enablement override.
## Testing
Add regression coverage for default inheritance and explicit overrides, source-disabled plugins, policy refreshes during active turns, disabled or malformed selected plugin roots, and remote installation authentication behavior.
GitOrigin-RevId: 83b70c5b47fc95474fec292f248683f1f887221e
## What changed
- Add `ContentItemMetadata` to distinguish user input, developer instructions, `AGENTS.md`, skills, harness context, and tool-supplied context independently of message role and content classification.
- Keep attribution attached to content through prompt assembly, history processing, and hook-output spilling. Distinguish command hooks from MCP hooks and retain tool namespaces when known.
- Treat missing historical attribution as unknown and send per-content metadata only to Responses Lite.
## Testing
Update request and history assertions to cover attribution persistence and Responses Lite metadata handling.
GitOrigin-RevId: 24e56005f5bdb98bf82f2b3943f29c4c81f3d587
## What changed
Add `windows.require_mxc` to managed requirements. When set to `true` on Windows, reject configurations whose effective local sandbox backend is not MXC without changing the selected backend.
Validate after cloud configuration loads and outside startup recovery fallbacks. Apply the check to app-server startup and configuration loads, in-process bootstrap, session creation, sandbox debugging, and runtime configuration refreshes.
## Testing
Extend configuration tests to cover required and optional MXC selection, separately loaded policy requirements, and runtime refresh validation. Expand app-server startup tests to cover local and cloud MXC requirements, cloud preference selection, and failures without default-config recovery.
GitOrigin-RevId: 16456611bfd9df77e7f959b52515f1885b59ac75
## What changed
- Use the standard shell executor and remove the zsh fork escalation runtime, `codex-execve-wrapper`, and `shell-escalation` crate.
- Ignore `shell_zsh_fork` and `unified_exec_zsh_fork`, emit migration notices for legacy configuration, and warn when ignoring managed requirements for these flags.
- Keep the active session's `apply_patch` alias directory readable under restricted filesystem permissions.
## Testing
Add coverage for legacy configuration startup and shell execution, migration notice rendering, active alias directory selection, and nested `apply_patch` execution while other files in `CODEX_HOME` remain unreadable.
GitOrigin-RevId: 43af461fea32b4980550ee7237effd2bc0646ed8
jif