## Why
Session commands with `--remote` should use the selected server's authentication and execution environment, even when the caller has workload identity configured and cannot read its identity token.
## What changed
Connect `queue`, `archive`, `unarchive`, and `delete` directly to the explicit remote app server after validating configuration. Skip caller credential and runtime initialization, use remote thread parameters, and preserve the caller's working-directory override.
## Testing
Add end-to-end coverage with an unreadable caller identity token to verify queued turns use the server's API key and remote archive, unarchive, and deletion operate on the selected server. Add configuration-validation coverage for all four commands and `--no-daemon` rejection coverage for remote unarchive and delete.
GitOrigin-RevId: 5da7abbb40506cd754a8863e1a9d8fad9b1f09a9
## Why
Resuming a thread rereads persisted history even when a preloaded snapshot is unchanged. Reusing that snapshot must still account for writes committed before writer ownership is acquired.
## What changed
- Carry optional, non-serialized revisions from stored history and model context through thread and agent resume paths.
- Validate the revision under writer ownership and reuse the shared snapshot when it matches. Reload stored history when the revision is missing or changed, while preserving explicit history overrides.
- Resolve the selected rollout before loading context, validate compressed snapshots before materialization, and enforce archived-thread restrictions on canonical paths.
## Testing
Extend coverage for snapshot reuse and late-write refresh in legacy and paginated histories, compressed rollout reuse, archived rollout symlinks, and cold child restoration that includes edits made after preloading history.
GitOrigin-RevId: e1fd7aee6ef2b30f41951e6b7e6b01c3e1420cab
## Why
A stored history snapshot can become stale before a resumed thread acquires writer ownership. Resume must include writes committed before that acquisition.
## What changed
Make `ThreadStore::resume_thread` return the replay context and use it for session restoration and metadata initialization. The local store refreshes stored snapshots while holding writer ownership, reads through the installed writer to honor explicit rollout paths, and releases the writer if loading context fails. Explicit histories without a canonical session header retain their override semantics.
## Testing
Extend resume tests to cover edits made after the initial snapshot in both legacy and paginated history modes, stale SQLite rollout paths, and preservation of explicitly supplied history.
GitOrigin-RevId: 2361f524d324c859f5dfcf2863320e2045736c2e
## Why
User goal edits and clears need to reach the model as user instructions, including when a thread is unloaded or history is being compacted. Automatic goal lifecycle updates must not supply user authorization.
## What changed
- Add optional `origin` values of `user` and `automatic` to `thread/goal/set` and `thread/goal/clear`, and mark TUI goal requests as user actions. Omitted origins do not supply user authorization.
- Persist explicit user objective, status, and clear instructions before changing goal state. Recording failures leave goal state unchanged.
- Coordinate goal edits with thread resume, reload stored history under writer ownership, and preserve edits accepted after the compaction input snapshot.
- Update generated protocol schemas and TypeScript and Python bindings.
## Testing
Add coverage for user edits and clears on loaded and unloaded threads, concurrent path-based resume, exclusion of automatic goals from user instructions, preservation of edits during compaction, and recording failures that leave goal state unchanged.
GitOrigin-RevId: d779d7c678a0c32a6ef76975dbe5b1400d1df245
## Why
Guardian and parent requests can arrive in either order after a command yields. A shared response sequence can let parent requests consume Guardian review decisions.
## What changed
Match Guardian responses separately and drive parent responses from the latest tool output in the strict automatic network review test. Poll running sessions with `write_stdin` until the process exits, and assert that the command and network request each receive Guardian review.
GitOrigin-RevId: 21300abd65a3b2d439e8c1ea04e4429d5bd528dd
## Why
Guardian does not consume skills, but host skill discovery can block its startup or turn creation when the primary executor is offline.
## What changed
Skip plugin and skill warmup during Guardian session initialization, and use an empty host skills snapshot when building Guardian turn contexts.
## Testing
Add a regression test that discovers skills for the parent session, disconnects its primary executor, and verifies that Guardian still reviews and denies a network permission request.
GitOrigin-RevId: 3c12129721c82cb78a3fa618d6b05faea631966a
## Why
Copying a rendered local file target such as `repo/foo_bar!` should preserve the selected path without adding Markdown escapes.
## What changed
Treat selections contained within rendered file targets as plain text, including partial selections and targets in tables. Coalesce adjacent file targets and inline code into literal ranges while preserving Markdown escaping when the selection includes surrounding content.
## Testing
Add regression coverage for partial paths, adjacent literal spans, styled links, table cells, special characters, and mixed selections at narrow and wide rendering widths.
GitOrigin-RevId: 94bcdacf14b013f9198cb84adfdb237eb644dd48
## Why
Refreshing available model descriptions changes the `spawn_agent` tool schema. Keep model choices current while preserving tool definitions and earlier conversation input.
## What changed
- Add the disabled-by-default `model_catalog_in_context` feature for multi-agent V1 and V2. When enabled and model overrides are available, move model listings from tool descriptions into developer `<model_catalog>` messages.
- Include picker-visible, compatible models with descriptions, reasoning efforts, and service tiers in a listing bounded to 1,000 bytes. Point `spawn_agent` guidance to the latest catalog.
- Append updated listings only when their rendered content changes, restore missing listings, and invalidate retained catalogs when they no longer apply.
## Testing
Extend integration coverage for V1 and V2 with the feature enabled and disabled. Verify that catalog refreshes preserve tool definitions and prior input when enabled, append the updated listing once, and retain the existing tool-description behavior when disabled. Add a request-history snapshot for the V1 opt-in path.
GitOrigin-RevId: 67b11b4ad6c35f00d0e29edf6343bb0b4804d797
## What changed
- Fork the selected conversation and open the new session with `f`, configurable through `agents.fork` in the TUI keymap.
- Move the default search shortcuts to `F3` and `/`, preserving unshadowed defaults when custom bindings conflict.
- Keep queued input on the source conversation while attaching and forking, and require closing an open side conversation before forking another task.
- Expose the fork action in command-center help and the keymap picker.
## Testing
Add regression coverage for queued-input preservation, side-conversation protection, configurable fork shortcuts, metadata editing, disconnected actions, and search fallback bindings. Update help and keymap snapshots.
GitOrigin-RevId: b11ae21ef6a2053609b31ce97c646104f18806a3
## What changed
Add a debug-only analytics test that switches accounts after the first isolated event request. Assert that only the first request reaches the server and carries the original account's credentials, so subsequent batches do not send stale credentials after the switch.
Remove an unused `ToolCallSource` import.
GitOrigin-RevId: e66904c7a7176f1eaa37662b836132586328884a
## What changed
Define `thread/prediction/request` with `threadId` and `sourceTurnId`, and `thread/prediction/updated` with a `completed` result containing optional text or a `failed` result.
Update generated JSON schemas, TypeScript types, and Python notification models. Route prediction notifications to their thread in the TUI and ignore them in the chat widget.
The request remains unimplemented and returns a method-not-found error.
GitOrigin-RevId: 09922f583d5c56f808d018121c651dcd92734515
## What changed
Add `exchange_ema_auth_token` to discover and validate the MCP resource's authorization server before resolving enterprise identity credentials and performing the ID-JAG token exchange. Keep the lower-level exchange primitive private.
- Probe `server/discover` with the enterprise-managed authorization extension, support recognized legacy discovery rejections, and follow protected-resource metadata challenges or well-known fallbacks.
- Match configured resource and issuer constraints, require advertised public-client JWT bearer support, and validate token endpoint metadata without requiring an authorization endpoint.
- Bound discovery with a shared timeout, redirect and authorization-server limits, reject cross-origin metadata redirects, and restrict private authorization-server destinations while allowing local loopback discovery.
## Testing
Add tests covering resource and issuer mismatches before identity access, metadata capability validation, query preservation, modern challenges, JSON and SSE legacy fallback behavior, cross-origin redirect rejection, and private or malformed issuer destinations.
GitOrigin-RevId: 9a55233a20ff42c293f9bd8175e01141ac2d8576
## Why
`TurnAborted` could be emitted before extension abort callbacks finished, allowing consumers to observe a terminal event while lifecycle cleanup was still pending.
## What changed
Await `on_turn_abort` within task abort handling before emitting `TurnAborted`, retaining callback delivery for already-cancelled tasks. Document that `on_turn_stop` and `on_turn_abort` complete before their corresponding terminal events, if emitted.
## Testing
Add regression coverage for interrupt, conditional interrupt, and shutdown. Hold the abort callback open to verify that `TurnAborted` waits for completion, then verify that the callback runs exactly once with the expected turn ID and abort reason.
GitOrigin-RevId: f34d7e94d04c02544178dc445b85abc65a6ce499
## What changed
Upgrade `rmcp` to a pinned Git revision of version `3.3.0` and enable `auth-enterprise-managed`. Delegate the two-stage ID-JAG exchange and token validation to the SDK, replacing the local implementation while retaining Codex HTTP routing and credential lifecycle policy.
Map SDK errors by exchange stage so `invalid_grant` distinguishes enterprise identity failures from resource authorization failures, and preserve handling of `insufficient_user_authentication`.
## Testing
Update exchange tests to verify rejection of unsupported `authorization_details` and malformed signed scopes. Exercise errors from both token endpoints to check credential policy, prevent credential reflection in diagnostics, and ensure rejected grants are not retried.
GitOrigin-RevId: a56034aa3fd70002754ea552fd2da70bdcd85b31
## Why
Client permission definitions and constraints can differ from those on the connected app server. Accepted permission changes also need to survive task transitions before their settings notifications arrive.
## What changed
- Discover permission profiles and availability from the connected server and apply selections through `thread/settings/update`, including custom profiles.
- Adopt the server's effective permission settings instead of reapplying local definitions or constraints.
- Retain accepted selections and effective approval settings across new tasks, forks, side conversations, directory changes, reconnects, and safety retries without blocking navigation on a settings notification.
- Recognize the current built-in permission preset when the server supplies an unnamed profile.
## Testing
Add regression coverage for conflicting client/server profile definitions, rejected and unchanged selections, consecutive requests with omitted approval settings, and permission carryover before confirmation. Extend discovery and menu tests to verify server-provided availability and unnamed-profile highlighting.
GitOrigin-RevId: bcd767b58dc92dc4f945189078e51e6e5fce6d24
## Why
Login shell startup can reset `PATH`, preventing commands and their children from finding bundled tools such as `rg` in executor-reported directories.
## What changed
When `login_shell_package_path` is enabled, prepend missing executor-reported directories to `PATH` inside the POSIX login shell before running the requested command. Preserve existing entries and the order of newly added directories, and export `PATH` for child commands.
Respect explicit `PATH` overrides and preserve the requested login mode when directories are unusable or `PATH` is read-only. Keep shell diagnostics and `$LINENO` aligned with the original script, including when directory names contain newlines. The feature remains disabled by default.
## Testing
Add shell tests for nested tool lookup, existing entries, quoting, line numbers, and read-only `PATH`. Extend remote execution tests to cover feature gating, explicit overrides, unusable directories, and preservation of the original command in execution events.
GitOrigin-RevId: 301aa34e72cc6292293693250e190c19903f390a
Replace the byte-by-byte reverse newline search with `memchr::memrchr` and add `memchr` as a dependency of `codex-rollout`.
GitOrigin-RevId: b07e42e15efb0d63d7b00ee9a2ee29c446f4cf59
## Why
Responses overload and exhausted-request errors could terminate despite server retry advice, and WebSocket-to-HTTP fallback could issue a request before the advised deadline.
## What changed
- Allow `ServerOverloaded` and `RetryLimit` errors to retry when server advice is present, within the configured retry budgets.
- Preserve `Retry-After` headers from rejected WebSocket upgrades and wait for the server deadline before falling back to HTTP.
- Keep quota, usage-limit, and policy failures terminal even when they include retry advice.
## Testing
Add coverage for HTTP overload and rate-limit recovery, WebSocket upgrade rejection and fallback timing, retry deadline preservation through error mapping, and retry limits for sampling and manual and automatic compaction.
GitOrigin-RevId: 72d30a9f078652664754dfa971fd7dc7a78f20e8
## Why
Voice conversations previously opened the system-default microphone and speaker. Users need to choose which local devices to use, including when connected to a remote app server.
## What changed
- Add input and output device pickers alongside voice selection, with back navigation and a System default option.
- Persist selections as `audio.microphone` and `audio.speaker` on the TUI's machine, excluding project configuration layers. Apply them to the next voice conversation.
- Enumerate devices without opening audio streams and pass the selected names to the voice helper at startup.
- Disable ambiguous device names in the picker and use the same eligibility filtering for discovery and named-device startup.
## Testing
Add tests for device preference persistence across project and remote transitions, picker navigation and duplicate names, discovery without capture, and forwarding selected devices to the helper.
GitOrigin-RevId: d48fb3a09fa9b982a408f5a7c96bdd81776af21d
## Why
Embedded app-server configuration discovery must remain available after login and workspace changes, while content access granted to the previous account must be revoked.
## What changed
Give `AuthRouteConfig` a separate application network policy and bind embedded bootstrap authentication to the effective application policy. Use that policy for account-owned content clients and invalidate it when the authenticated owner changes, preserving the local, endpoint-restricted bootstrap policy.
## Testing
Add a regression test covering bootstrap discovery across login, workspace changes, and sign-out; revocation of previous account clients and permits; and continued enforcement of bootstrap endpoint restrictions and local requirements.
GitOrigin-RevId: 083933e69508224f8232349ba3750c02329af06a
## Why
Daemon-launched app servers should use the same analytics default as first-party clients while honoring explicit user opt-outs.
## What changed
Pass `--analytics-default-enabled` when the PID backend launches an app server, with or without remote control. Users can still disable analytics with `analytics.enabled = false` in `config.toml`.
## Testing
Update argument assertions for both remote-control modes and the daemon start/restart test to expect the analytics flag alongside launch feature overrides.
GitOrigin-RevId: 8a222a00fc56737f5fe2b0385abf59466d1a6671
## Why
Startup-only cleanup leaves expired logs in long-running sessions, and age-based retention alone does not limit database usage.
## What changed
Run cleanup in the background immediately after initialization and every 30 minutes. Start with the existing 10-day retention window, then halve it until occupied SQLite pages fit within a 64 MiB budget or the window reaches one second. Preserve logs within that final second even when they exceed the budget.
Exclude free pages from the budget so SQLite can reuse them, and retain the passive checkpoint after the first sweep. Stop the task when the runtime is dropped or the log pool is closed.
## Testing
Add tests for the 10-day boundary, repeated retention-window halving, free-page accounting, the one-second retention floor, immediate startup cleanup, and periodic cleanup without new writes or a restart. Update existing log tests to use current timestamps so background retention does not remove their fixtures.
GitOrigin-RevId: c6eeb5ec13006d4a03354e08322827429be53ce8
## Why
`LegacyAppPathString` treated `//server/share/project` as POSIX, losing its UNC interpretation when inferring a `PathUri`.
## What changed
Infer Windows syntax whenever an API path starts with two separators, including forward and mixed slashes, independently of the host. For example, `//server/share/project` now converts to `file://server/share/project`. Double-slash POSIX paths require an explicit `PathConvention::Posix`; inferred paths still undergo validation.
## Testing
Add regression tests for UNC and namespace paths, mixed separators, URI serialization round trips, explicit POSIX conversion, convention mismatches, and malformed UNC paths.
GitOrigin-RevId: 720893de517addb7a938e6784d1ed0f05df3ec0d
## Why
`ansi_escape_line` logged the rendered contents of every line when given multiline input, allowing large payloads to inflate warning logs.
## What changed
Replace line contents in the warning with structured `input_bytes` and `line_count` fields. Preserve the existing behavior of returning the styled first line.
## Testing
Enable unit tests for `codex-ansi-escape` and add coverage with small and 128 KiB tails, asserting the exact warning fields and preservation of first-line styling.
GitOrigin-RevId: 4be985b4442eaa12f7fdee8a583d6e9714c618d8
## What changed
Use `derive_more::Debug` for `ContentItem` and `UserInput` to limit debug formatting of `ContentItem::InputText` and `UserInput::Text` to a prefix of at most 512 bytes, ending at a UTF-8 character boundary. Append the full text length in bytes to each preview.
GitOrigin-RevId: ca711dde8f0e3ba7047103415dbc1836f6401e61
## What changed
Set the default SQLite log filter to `DEBUG` for `tokio_graceful::guard` and `tokio_graceful::trigger`, dropping their `TRACE` events while retaining debug and higher-level diagnostics.
## Testing
Extend the SQLite sink filter test to verify that guard and trigger traces are dropped, their debug events are retained, and `tokio_graceful::shutdown` trace events remain available.
GitOrigin-RevId: c98495c834db35f3d8799ab4f0a1f7a82a53c8ef
## What changed
Update the replay assertion in the recorder refresh test to compare `executed_tool_call_metadata()` instead of entire response items. This keeps the assertion focused on preserving recorded tool call metadata across a configuration refresh.
GitOrigin-RevId: 763173a918f4e0bc79c3c04466453cafb9629775
## Why
A stuck transport can fill the outbound queue, leaving an `environment/info` request blocked while sending. The timeout must cover sending as well as waiting for a response.
## What changed
Wrap the live metadata RPC in a 30-second timeout. On timeout, close the probed connection and request session recovery, returning the timeout error without retrying the failed request. Document the experimental `environment/info` endpoint and its timeout behavior.
## Testing
Extend the WebSocket session recovery test to cover an unanswered `environment/info` request, checking that it times out, closes the connection, and resumes the same session while retaining the client instance.
GitOrigin-RevId: 9035d2edab3626e780d8bd40ebcdf0ca327bfddb
## What changed
Forward explicit `cyberAccessProgram` selections for the built-in OpenAI provider when both `api_key_cyber_access_programs` and `api_key_model_discovery` are enabled. The new feature defaults to disabled and can be toggled through the app server's experimental feature enablement API.
Reject explicit selections in OpenAI API-key sessions when either feature is disabled, instead of silently omitting the program. Leave entitlement and model restrictions to the server, and preserve the requested program when a server rejection triggers transport retries.
## Testing
Add app-server coverage for both feature gates, forwarding all three program values, and server rejection without fallback. Update core coverage for API-key resumes with disabled features and custom-provider omission.
GitOrigin-RevId: aa639afb841aa651b28f6f3f61198299372baa2d
## What changed
Register `login_shell_package_path` as a disabled-by-default experimental feature and add it to the configuration schema. Expose it in `/experimental` as “Bundled tools in login shells,” with a description explaining its intended use when login shell startup resets `PATH`.
## Testing
Extend the experimental feature metadata snapshot test to cover the new feature's label, description, and unchecked default state.
GitOrigin-RevId: dc110486ccd8d2d76ac788ba5a413a1374699ff8
## Why
Persistence and aggregate metadata budgets can omit tool-call observations that are still relevant to the current request, including tool result metadata needed during compaction.
## What changed
- Retain live direct-call observations separately from bounded persisted outputs, keyed by response item ID so reused call IDs cannot mix results.
- Restore those observations for sampling and compaction, pruning them only when sampling confirms they have left the history window. Preserve observations across shortened compaction retries.
- Remove aggregate prompt metadata caps while retaining per-call argument limits and the outgoing message size limit. Invalidate cell completeness when argument normalization truncates a recorded call.
## Testing
Add regression coverage for exhausted persistence budgets, reused call IDs and reversed completion order, shortened compaction retries, and completeness after argument truncation. Extend integration coverage for large Code Mode metadata, provider metadata support, and fork/resume behavior.
GitOrigin-RevId: 004082b69bff9cc8b05f36d1052057f163c67f07
## What changed
Remove startup greeting phrases and the shared greeting state from startup drafts, session headers, and the empty-state animation. Raw session headers now consistently include `model:` and `directory:` fields.
## Testing
Update startup and fresh-thread snapshots to omit greetings, and adjust raw-header assertions to check model and directory fields.
GitOrigin-RevId: 531b5ba42d7a88f86b1c7f69030f3560abc25198
## What changed
- Instrument MCP OAuth loads, saves, deletes, fallback cleanup, and refresh persistence with credential-free storage metrics, distinguishing configured policy from operations on a pinned store.
- Retain the originating client across background tasks, blocking storage operations, and session recovery, including recovery after startup found no credentials.
- Preserve typed keyring and lock error categories for metrics and remove raw error details from storage warnings.
## Testing
Add tests for policy and pinned-store outcomes, best-effort cleanup failures, wrapped lock errors, and successful or failed refresh persistence without duplicate observations. Add recovery tests that verify client attribution after anonymous startup and across threads with different originators.
GitOrigin-RevId: 5ea4528bcdcf500c8ffdf1d9c7008ea52112c726
## Why
Elevated sandbox tests share machine-local Windows accounts. Concurrent setup can rotate account passwords between another test's setup and logon.
## What changed
- Add a shared file-lock guard for elevated sandbox tests in `codex-core`, `codex-exec-server`, and `codex-windows-sandbox`, held through sandbox commands and cleanup.
- Queue these tests in a single-threaded Nextest group before their timeouts start, while retaining the file lock to coordinate other test processes.
- Limit account locking to tests that use elevated accounts and remove the sandbox crate's blanket Bazel `exclusive-if-local` tag.
GitOrigin-RevId: 26d4606cb1fdcac65926d29835bed4eac04c19c0
## Why
Opaque Windows paths encoded as UTF-16LE could be mistaken for POSIX paths when they began with `/`, or fail Windows convention inference when their leading separators mixed `/` and `\`. This prevented them from retaining the Windows path convention across URI serialization.
## What changed
Distinguish a UTF-16LE slash from a POSIX root and recognize either Windows separator in both positions of an opaque UNC prefix.
## Testing
Add round-trip coverage for Windows drive, UNC, device, and namespace paths, including forward and mixed separators. Cover JSON serialization, absolute-path joins, relative-path separator handling, and Windows-only host-native conversions.
GitOrigin-RevId: d4e8a40a314cfc030c30fa8c124bfdd1e565076d
## Why
Successful file fallback can hide a secure-store failure. Storage diagnostics need to distinguish that fallback from explicit file storage while keeping credential values out of error output.
## What changed
- Record credential load, save, delete, and fallback-file cleanup outcomes, including secure-store failures and fallback reasons.
- Preserve the initiating client's attribution across app-server requests, login tasks, sessions, turns, and blocking token persistence.
- Preserve storage error context and typed causes while redacting credential JSON data errors and payload-bearing keyring errors.
- Include sanitized fallback completion warnings in the default `codex login` file logs.
## Testing
Add coverage for storage policy and metric attribution, credential redaction, login diagnostics, concurrent app-server clients, device-code login, and token refresh during a turn.
GitOrigin-RevId: 6d5651c1718d184016fa77befa02aa528750b2ae
## Why
Hook dispatch recompiles regex matchers for each input even though discovery already validates them.
## What changed
Store compiled `HookMatcher` values on configured handlers and reuse them during dispatch. Preserve match-all, exact-name, pipe-alternative, and regex matching semantics, along with the original pattern spelling for configuration equality. Invalid regexes continue to be rejected during discovery.
GitOrigin-RevId: 117a8a19c7bc0e55ccbedcd5940b806a17ebba10
Update the runtime catalog test expectations for `global.openai.gpt-6-sol`
and `us.openai.gpt-6-sol` from `MultiAgentVersion::V1` to
`MultiAgentVersion::V2`.
GitOrigin-RevId: 1b038ab988cae221a641ee54002bffc25109f45c
## Why
Credentials can use a keyring backend, so describing all login and logout operations as reads or writes to `auth.json` is misleading.
## What changed
- Remove the API-key onboarding claim that keys are stored in `auth.json`.
- Describe authentication storage and credential-removal errors in terms of stored credentials and the selected backend.
- Label the doctor output's auth-file path as the file backend or fallback, and document why startup checks also consider `config.toml` when credentials may be in a keyring.
## Testing
Add API-key entry snapshots for terminal widths of 80 and 40 columns.
GitOrigin-RevId: 87189f422448b88721ea2d7448930ece63102803
## What changed
- Carry the selected shell and login mode through unified exec using `ShellInvocation`. Use this metadata for shell snapshots and credential brokerage instead of inferring it from command arguments.
- Add `prependPathDirs` to exec-server environment metadata, populated from the executor's package PATH directory. Default to an empty list for older servers and omit empty lists from serialized output.
## Testing
Extend environment metadata round-trip coverage for `prependPathDirs` and the remote exec-server integration test to verify the packaged `codex-path` directory is reported.
GitOrigin-RevId: c571c068effcb305d196a701ad9a335ec7a3f5a2
## Why
Pasting multiple lines into a blockquote previously left subsequent lines unquoted.
## What changed
- Continue the current line's `> ` prefix across pasted lines, including blank and trailing lines, in the TUI composer and embedded answer fields.
- Append two unquoted newlines so typing resumes in the next Markdown block. Preserve quoting when large paste placeholders expand on submission.
- Use a shared edit target for paste context and insertion so selection replacement uses the prefix at the replacement start.
- Keep shell input and provisional startup pastes literal.
## Testing
Add unit tests and rendering snapshots for blockquote pastes, embedded answers, cursor placement, selection replacement, and large-paste expansion. Add textarea tests for forward and backward selections, adjacent elements, and Vim Replace backspace recovery.
GitOrigin-RevId: 525a7951aa16a25d49cc3be98822d0dd0709de97
## Why
Denied-read policies previously kept explicitly approved commands within their original filesystem restrictions, preventing operations that need broader write access, such as updating Git metadata.
## What changed
- Apply broader filesystem permissions after approval of explicit escalation while retaining the sandbox, denied reads, and network policy. Command allow rules alone do not widen filesystem access.
- Reject escalation when the required local sandbox is unavailable or a remote exec server lacks support for preserving the restrictions.
- Track escalated terminal access so subsequent `write_stdin` calls still require review when stdin approval is enabled.
## Testing
Add coverage for approved and denied escalation, allow rules, remote server compatibility, and stdin approval before input delivery. Add a Windows integration test verifying that an approved `git pull` updates Git metadata while exact-path and glob-based read denials remain enforced. Serialize Windows sandbox integration tests across processes to protect shared test account credentials.
GitOrigin-RevId: 5dce6d41487ee4d39bd795c8d086398ab9794d5b
## What changed
Preserve catalog `multi_agent_version` values instead of forcing V1, allowing models that declare V2 to use it by default. Retain Ultra in supported reasoning levels so it appears in the Astra advanced reasoning picker for Bedrock Mantle and Runtime.
## Testing
Add coverage for preserving configured multi-agent versions, selecting V2 and exposing `collaboration.spawn_agent` and `collaboration.followup_task` without the V2 feature flag, and displaying and selecting Ultra in both Bedrock reasoning pickers.
GitOrigin-RevId: 4fb1336c79b3f86ce12fa5ea81fe2237a300840d
## What changed
Add `openai.gpt-6.1-sol` to the Bedrock Mantle catalog and its `global.` and `us.` variants to the Bedrock Runtime catalog. Make GPT-6.1 Sol the default and provider fallback model, preferring the global variant for Runtime. Keep existing models available.
## Testing
Update catalog and provider assertions, thread-start fallback tests, and TUI model-picker snapshots to cover GPT-6.1 Sol and the new defaults.
GitOrigin-RevId: ec65744ff9409980474cc1faf516beed0b2430da
## Why
Canceled RPC calls could leave entries in the pending request map until further traffic or disconnect. Cleanup should happen when the call is dropped, even if no response arrives.
## What changed
Use a `PendingRequestGuard` to remove each registration when its call completes or is canceled. Protect the pending map with a synchronous mutex so cleanup can run in `Drop`, replacing opportunistic pruning and explicit error-path removals.
## Testing
Add a regression test that drops an in-flight call and verifies that the pending request count immediately reaches zero without further traffic.
GitOrigin-RevId: 82c0629f37a2f4bb89b8d10e167e2a09765b26eb
## Why
Reaching the reconnect backoff cap reset the attempt counter, restarting fast retries during sustained failures such as HTTP 409 responses indicating that the remote app server is already online.
## What changed
Keep the reconnect delay at the 30-second cap and stop advancing the backoff exponent once capped. Successful connections and auth changes still reset backoff. Remove logging for the obsolete reset-at-cap behavior.
## Testing
Add regression tests for long failure streaks and repeated HTTP 409 handshakes, with and without a subscribe cursor. Verify capped retry intervals, recovery after a successful handshake, backoff reset on success, and preservation of enrollment and cursor state.
GitOrigin-RevId: 56e3f10ec5ceeced5a71397a99ca22b75dd5ef52
## Why
`CreateProcessWithLogonW` failures with `ERROR_SERVICE_ALREADY_RUNNING` (1056) previously aborted sandbox startup without retrying. At this stage, neither the runner nor the user command has started, so retrying does not replay the command.
## What changed
Retry runner creation once with the same sandbox credentials when logon returns error 1056. Propagate a second failure without refreshing credentials, and keep child startup errors with the same code ineligible for this retry.
## Testing
Add regression tests for recovery, the two-attempt limit, and exclusion of child startup failures. Add a unified exec test that injects a logon failure, verifies that the retry preserves the original request and credentials, and checks that the command runs exactly once.
GitOrigin-RevId: 78def6cdb93bf32f9b4a3e398cd16de83286fec4
Add `gpt-6.1-sol` to the bundled model catalog with its capabilities,
reasoning levels, and availability message. Give it the highest catalog
priority and update older Sol descriptions to reflect their generations.
Update startup, model picker, and tool catalog snapshots to reflect the
new default and catalog contents.
GitOrigin-RevId: 1092a0524c6d1813ddd600c31c4fd0e708294ae9
cooper-oai