## Why
Retained output from failed responses or responses without usage data can be omitted from context token estimates, delaying automatic compaction even as reasoning accumulates.
## What changed
Track the history boundary covered by the last usable usage report and estimate all items added after it. Spending-only updates preserve that boundary, while successful usage reports cover the request input even when the response contains no output items. Avoid counting unreported reasoning twice and align recomputed context counts and remote compaction estimates with the boundary.
## Testing
Add unit coverage for initial input, empty responses, spending-only updates, and reasoning accounting. Add regression coverage verifying that accumulated unreported reasoning triggers compaction for incomplete responses with or without usage and completed responses without usage.
GitOrigin-RevId: 80c0b800c7236ff40ae53fdd18320e0d06e026ab
## What changed
Expose `McpToolRequestMetaHook` and `McpToolRequestMetaProvider` so hosts can supply a per-invocation `_meta` value using the thread, turn, and call IDs. Apply the hook before dispatch only when the tool, server name, source, and full transport configuration match the selected local MCP registration.
Reject metadata key collisions and propagate provider errors to the tool caller without dispatching the call.
## Testing
Add integration coverage for matching registrations, different contributors and routing headers, unrelated tools and servers, provider failures, and existing metadata keys.
GitOrigin-RevId: 2bf51c375a04617d61b24ca1cbbcaa810fb06720
## What changed
Replace `PreparedThreadSpawn` with `PreparedChildContext`. `CodexThread::prepare_child` now captures parent inputs from a live tool invocation without requiring a child request. Hosts choose the child's name, role, and history, bind destination services, and apply child settings.
Expose captured instructions, environments, permissions, approval settings, disabled plugins, current inheritable dynamic tools, and an execution-policy snapshot with its original managed requirements. Retain those requirements across MCP configuration refreshes so hosts can assess policy-source compatibility.
Remove `ThreadManager::create_prepared_child`; `CodexThread::create_child` handles reserved child startup on the parent's manager with invocation-bound cancellation and cleanup.
## Testing
Add coverage for execution-policy snapshots and managed requirements after MCP refresh. Update child-spawn tests to verify captured instructions and permissions, current dynamic-tool declarations, and fresh versus forked history.
GitOrigin-RevId: f15b595b44997fa70cd0c9be0e92f470e1f333e1
## What changed
Add `AgentMcpMetadataRecipient` as a thread extension that lets the host select which MCP plugin registration receives `x-codex-root-turn-id` and `x-codex-cyber-access-program` in tool-call metadata.
Require an exact match on the plugin ID, installed root, server name, and transport configuration in the `local` MCP environment. Omit both keys without host opt-in or when the registration does not match, including same-name user overrides. Send JSON null for unset values on matching registrations.
## Testing
Add unit tests for registration matching and integration coverage for host opt-in, same-name user overrides, and an unset access program.
GitOrigin-RevId: eaa44e17b29aa0bdec6f6ed9faa86b8fc931faad
## Why
Direct Guardian review checked recorded `exec_command` calls without applying `PreToolUse` hooks, so approval decisions could miss hook rewrites or denials.
## What changed
Run the shared `PreToolUse` hook handling before evaluating approval requirements. Use the rewritten arguments for policy checks and the Guardian approval request, and return an error when a hook blocks the call, even if policy would otherwise skip review.
## Testing
Add regression tests covering rewritten commands that require approval and hook denials for policy-allowed commands. Verify the rewritten approval request, hook events and recorded denial context, and that reviewed commands are not executed.
GitOrigin-RevId: 3ec7700f695e422ac59c903c285acc0cf633b915
## What changed
Return `CatalogModel` from model lookups, keeping metadata together with its `Bundled`, `Provider`, `ExplicitConfig`, or `Synthetic` origin through config overrides and runtime snapshots. Replace `used_fallback_model_metadata` checks with explicit `Synthetic` origin checks.
Share the underlying `Arc<ModelInfo>` with extension stores and use copy-on-write for metadata changes. Keep origin tracking outside serialized model metadata.
## Testing
Extend coverage for origin retention across cache reloads, namespaced model lookups, catalog fallback, and config overrides. Verify that step snapshots and extension stores share the same model metadata allocation.
GitOrigin-RevId: bb6130c94a7a795aa168ee24664a1dd453579fba
## What changed
Move hook execution and input updates into `apply_pre_tool_use`, with distinct errors for blocked calls, failures, and cancellation. Preserve dispatch error reporting and clear the serving assessment when a hook changes the invocation payload.
GitOrigin-RevId: d3c5b37692970b739393cb0c998f6cff0ff39af2
## Why
Plugin and skill catalog reads currently wait for the Apps server's initial `tools/list` to finish, even after its MCP transport is initialized.
## What changed
Add the disabled-by-default `features.apps_early_resource_discovery` flag. When enabled, host-owned Apps requests for `mcp/plugin` and `mcp/skill` resources can use the initialized transport while the initial tool inventory is pending. Server readiness still waits for the inventory to complete, and retries use normal readiness.
Bound early client acquisition by the configured startup timeout, propagate startup failures and cancellation, and reject pages if the connection, authentication scope, or resource cache generation changes during discovery.
## Testing
Add coverage for gated discovery, concurrent plugin and skill reads, startup timeouts and failures, cancellation, cache invalidation, and account switches. Verify that early discovery reuses a single handshake and tool inventory, including with the newer MCP protocol and connection sharing enabled.
GitOrigin-RevId: 955b1f6d43b733bdf9763c1caf2ce6913c686c81
## Why
Concurrent executions accessing the same endpoint can produce duplicate network approval prompts before a session decision is recorded.
## What changed
- Queue manual prompts by environment, host, protocol, and port while keeping execution decisions separate.
- After a one-time approval or denial, let the next execution prompt. Reuse committed session grants and deny rules without another prompt.
- Keep tool results paused while requests are queued and attribute the wait to the triggering tool call.
## Testing
Extend coverage for concurrent requests, one-time and session decisions, independent ports, queued cancellation and timing, and isolation between local and remote environments.
GitOrigin-RevId: ebf580dddc39a9a9dc3b0d1acfa21438fbc6e100
## Why
A network request can disappear while its approval prompt is still pending. Leaving that prompt active allows a late cancellation to interrupt the turn even though the request no longer needs approval.
## What changed
- Track network prompt lifetimes in core and notify the app server when a prompt is resolved or withdrawn.
- Cancel the corresponding server request, emit `serverRequest/resolved`, and release its permission guard. Resolve outstanding network prompts during thread shutdown as well.
- Claim a live pending approval and validate its originating turn before applying a decision, so stale responses cannot interrupt a turn or persist policy changes.
- Distinguish network approvals that require the originating turn from proxy approvals that can be serviced by a later active turn.
## Testing
Extend regression coverage for disconnected network requests, late cancellation responses, turn completion during review, shutdown cleanup, mismatched turn IDs, and command approvals from background code running during a later turn.
GitOrigin-RevId: 78f656d92607ec21ddd0c5d781ed0947588cb2eb
## Why
Long realtime conversations could lose speech when active transcripts and handoff transcript fields were truncated.
## What changed
- Record completed V3 transcript chunks in model and client history once the active transcript exceeds 4 KiB, without triggering inference.
- Keep unfinished utterances pending to preserve conversation order, and persist completed chunks before subsequent handoffs.
- Preserve full V3 transcript text at handoff and session-end tail flush, and avoid adding handoff input already recorded in transcript history.
## Testing
Add integration coverage for long transcripts, XML escaping, recording before handoff without inference, repeated handoff input, and both session-end tail flush settings.
GitOrigin-RevId: 62218b811809c4cf5b16fb0247a335eb474f9ab9
## What changed
- Add a non-inlined `TryFrom<toml::Value>` implementation for `ConfigToml` and route callers through it to share the generated deserializer in `codex-config`.
- Reuse the ignored-field deserialization helper for strict validation, returning path-aware errors while preserving existing fallbacks for CLI validation and ignored-config warnings.
GitOrigin-RevId: 0208b314416ad4d3d7fbf3a30560a0c8c4035abd
## Why
Cyber access program selection was restricted to the `openai` provider ID, preventing custom providers from accepting explicit program selections.
## What changed
- Add `capabilities.cyber_access_programs` to provider configuration and preserve it through remote thread configuration. Default to enabled for `openai` and disabled for other provider IDs, with explicit overrides taking precedence.
- Use the capability when forwarding `access_programs.cyber` and determining Daybreak availability in exec and the TUI. Refresh TUI eligibility when the server changes the selected provider.
- Preserve authentication, API-key feature gates, and catalog access checks; the capability does not grant program access.
## Testing
Add coverage for capability defaults and overrides, configuration round trips, custom-provider requests with both authentication types, API-key feature gating, compaction, WebSocket response reuse, exec selection, and TUI provider changes.
GitOrigin-RevId: 579f7c33c9e857ff5fedd08311aa8e3129740c1f
## Why
Standalone web search must use the same permission mode as hosted search. Permission changes during a turn should take effect on the next turn, without changing web access for searches in the active turn.
## What changed
Pass the turn's `WebSearchMode` to the web search extension and use it to determine tool availability and `external_web_access`, while retaining provider support checks and thread-level search settings.
## Testing
Add an app-server regression test that switches from cached search to Full Access while a turn is paused. Searches before and after the update keep `external_web_access` disabled in that turn; the next turn enables it.
GitOrigin-RevId: 9e3b8598f2e491388b7e7d4840c849155ae95e88
## What changed
Allow shared network constraints in `[permissions.network]` in `requirements.toml`, alongside `[permissions.filesystem]`. Apply them throughout configuration loading, network approvals, Windows sandbox policy validation, and `configRequirements/read`, and show their source in `/debug-config`.
Retain `[network_proxy]` and `[experimental_network]`, but reject mixing either with `[permissions.network]`, even across requirements layers. Preserve independent network and filesystem precedence and source attribution, and report unknown nested network fields.
Reserve `network` as a managed requirements table name and reject empty or profile-shaped tables with migration guidance. Profiles named `network` remain valid in `config.toml`. Document that policy publishers must keep using `[experimental_network]` until all readers support the chosen replacement.
## Testing
Add coverage for layered constraints and source attribution, conflicting spellings, profile-name migration errors, unknown-field diagnostics, and cloud validation. Extend API, project discovery, network approval, and Windows policy tests to cover `[permissions.network]`, and verify managed proxy settings remain independent of disabled feature configuration.
GitOrigin-RevId: 994dfca9abf5a7aea914276c0ded8b40d7ed0372
## Why
The SIGTERM cleanup test depends on the OS scheduling the shell within the production grace period. Tracing tests also need fixture creation and cleanup to use the appropriate subscriber.
## What changed
- Pause Tokio time while waiting for the shell's cleanup marker, keeping the cancellation future runnable to prevent automatic clock advancement, then resume time after execution.
- Adjust subscriber setup and fixture lifetimes in session and tool dispatch tests so instrumented resources are created and dropped under the appropriate subscriber.
GitOrigin-RevId: 12c654a031a8a4e61fc66488a5f687852f5ca099
## Why
Enabled rollout tracing could silently fail to initialize, and a terminal task status did not establish whether all recording had finished. Trace consumers need to distinguish a complete recording from a partial bundle, including when a task is interrupted.
## What changed
- Fail thread startup or resume if an enabled recorder cannot initialize, while cleaning up session resources.
- Stop recording after the first write or serialization failure and preserve that failure across shared producers.
- Append a closing record when the last writer handle is released without recording errors. Expose `recording_complete` in `state.json` independently of task success, and mark submission-channel closure as an aborted rollout.
- Reject replay logs with missing or reordered events, mismatched rollout IDs, events after completion, or missing or invalid JSON payloads. Valid prefixes remain replayable with `recording_complete` set to `false`.
## Testing
Add coverage for startup failure and recovery, shared-writer failures, finalization after child handles close, incomplete logs, and missing or malformed payloads. Extend session and CLI tests to check recording completion after shutdown, interruption, stream failure, and submission-channel closure.
GitOrigin-RevId: 30d62fa95912fb0442ad1199776d110884066c30
## What changed
Include `tool_name` in MCP tool approval elicitation metadata and forward available `readOnlyHint`, `destructiveHint`, `idempotentHint`, and `openWorldHint` values under `tool_annotations`. Omit unspecified hints and the annotation title.
Reuse the stored tool approval metadata when available so annotation hints reach the approval request.
## Testing
Extend unit tests to cover tool names, annotation hints, and omission of unspecified hints. Update integration coverage to verify that the approval tool name matches the executed MCP call and that `readOnlyHint` is preserved.
GitOrigin-RevId: f082fe7fd87fde9f4895149e09210c7cb9d1e582
## What changed
Add the disabled-by-default `code_mode_host_output_truncation` feature flag. When enabled, Core requests server-side output truncation for its built-in code-mode session providers over both stdio and gRPC. Injected providers retain control of their session settings, and explicit session options pass through unchanged.
## Testing
Add coverage for both transports verifying that the host's output-limit notice survives a zero-token observation budget. Extend the shared-provider test to exercise an injected provider with the new flag enabled.
GitOrigin-RevId: edbb65e930bf544e3d2f8384767037a6fb82d451
## What changed
Add `codex.additional_context` to count submitted entries, including unchanged entries, and `codex.additional_context.value_bytes` to measure UTF-8 value sizes before and after the existing truncation limit. Sizes exclude message wrappers and include the truncation marker after truncation.
Tag metrics with context kind, truncation status, and an explicitly supplied name when present; never use opaque source keys as tags. Record metrics through the current turn's telemetry.
## Testing
Add integration coverage for message and tool-output formats, repeated submissions, truncation boundaries, empty and multibyte values, optional name tags, and turn-specific model attribution.
GitOrigin-RevId: 463f257af27be58c372970fac853b85fde495dd5
## Why
Creating child history before persisting its parent-child relationship can leave history that parent subtree deletion cannot discover, especially when fork startup copies history. A relationship write failure must reject the spawn before child storage is created.
## What changed
- Reserve the child thread ID and persist its spawn edge before starting the child. Propagate persistence failures to the caller.
- Keep pending relationship writes owned through caller cancellation, and wait for them to finish before closing the edge during cleanup, including when a write commits but reports an error.
- Skip edge cleanup when publication was skipped, and reject IDs belonging to running threads before publication.
## Testing
Add regression coverage for cancellation before commit or acknowledgement, errors after commit, skipped publication, and duplicate child IDs. Integration tests cover fresh children and full-history forks, verifying that failed publication leaves no child history, execution, or creation notification and preserves unrelated history during parent deletion.
GitOrigin-RevId: 6e2e3f32d9558091312651ab47aa845d7d13b4ca
## Why
Host-side truncation can bound Code Mode output before it crosses the transport, including script errors that would otherwise exceed the frame limit.
## What changed
- Negotiate server-side output truncation for stdio and gRPC sessions, with client-side fallback for older hosts.
- Forward output budgets for execution, waiting, and termination when server-side truncation is selected. Avoid truncating host-formatted output or appending script errors a second time.
- Preserve the negotiated mode across reconnects and reject hosts that cannot maintain it.
## Testing
Add transport and integration coverage for output budgets, oversized script errors, reconnect compatibility, and preservation of output-limit notices with a zero-token budget.
GitOrigin-RevId: 2075101e4845eca64f45491c27a3b326788645c8
## What changed
Move the model client's request-preparation loop into the shared `prepare_provider_request` helper and add `RequestAuthChange` to classify auth state changes. For managed auth, retry preparation when credentials change and reject account changes, including when the provider starts or stops exposing an auth manager during setup.
Capture the auth owner and credential generations together and pass them into the preparation callback so the resulting client setup records the state used for that attempt.
## Testing
Add a test verifying that an explicit provider bearer token survives a workspace switch during setup without retrying preparation.
GitOrigin-RevId: ed8710d1c344b48ebf6182e25e6269214dd2d3fe
## What changed
- Match final serving assessments to their response and output item, then retain them with tool invocations and code cells across waits.
- Use matching assessments instead of asynchronous scoring for adaptive review: low-risk actions can skip synchronous review, while elevated-risk actions require it.
- Revalidate captured authorization and policy before approval. Require fresh review for stale or incomplete authorization, preserve explicit review requirements, and discard assessments when hooks rewrite tool input.
- Keep asynchronous scoring as the fallback when an assessment is missing or does not match.
## Testing
Add integration coverage for direct and nested tool calls, hook rewrites, explicit escalation, interrupted responses, catalog-driven policy, incomplete authorization, and assessment retention across code-cell yields and waits.
GitOrigin-RevId: 4346a227204137f018c03c34b302d6f1e9592c96
Set `native_call` to `None` in the `ToolCall` and `ToolInvocation` fixtures used by the agent host invocation and spawn tests.
GitOrigin-RevId: 2a6f9ccb95d99297085a2861bb44e5ce7599715c
## Why
Managed command policies need to require a human decision independently of automatic review, hook allowances, and saved approvals.
## What changed
- Support `decision = "prompt-user"` in managed `requirements.toml` prefix rules, requiring a fresh, one-time human decision for matching commands.
- Add experimental `humanCommand` approval requests for clients advertising both `experimentalApi` and `requiredHumanApproval`. Accept only `accept`, `decline`, or `cancel`; reject commands when no capable client is available.
- Restrict responses to capable clients that received the request, and replay pending prompts to compatible clients on reconnect.
- Enable the capability in the TUI and update protocol schemas and client bindings.
## Testing
Add coverage for fresh decisions overriding saved allowances, hook allowances, and automatic review, plus child-thread approval routing and rejection of responses from incompatible or unrelated clients.
GitOrigin-RevId: 0b95ff6aab7f8a04b7298c8a4329d1fddf6a603e
## Why
Guardian review needs the original function-call metadata even when the call is no longer in live conversation history. Looking it up in history can lose the evidence needed to review encrypted multi-agent messages.
## What changed
Capture native-review policy in the tool registry and retain the original call through dispatch for multi-agent tools that require review. Use that retained call for Guardian review, applying hook-rewritten arguments while preserving encrypted-argument metadata and clearing stale replay content. Limit `ToolCall` debug output to the tool name and call ID.
## Testing
Add coverage for selective call retention across review settings and namespaces. Extend Guardian tests to cover calls absent from live history and hook rewrites that preserve call identity and encrypted-argument metadata across incremental reviews.
GitOrigin-RevId: 0e49833741c09c29228440bddd2e12695ae99583
## What changed
Add `otel.log_sse_deltas`, enabled by default. Setting it to `false` suppresses successful SSE event logs whose kind ends in `.delta` while preserving errors, completion events, and metrics.
Apply the setting to session and memory telemetry, support managed requirements, and expose it in the app-server configuration requirements API and generated schemas and bindings.
## Testing
Add coverage for delta log suppression with errors, completion logs, event counts, and duration metrics preserved. Extend configuration and app-server tests to cover defaults, overrides, and managed requirements.
GitOrigin-RevId: 751c7f357c41f51848b025c838246a733eb92e2f
## What changed
Add `CodexThread::guardian_review` to assess the final injected `exec_command` call against recorded history without executing the command. Reuse command preparation and approval policy, returning the call ID and an optional assessment when approval is required.
Reject active threads, unsupported calls, commands intercepted by `apply_patch`, and histories containing `request_permissions`. Honor cancellation and the configured review timeout.
## Testing
Add a scenario test and request snapshot verifying that direct review matches live Guardian input, leaves commands unexecuted, skips assessment for explicitly allowed commands, and rejects trailing tool output and recorded permission grants.
GitOrigin-RevId: 704f8dc77bbb991c231fce03cfda1c238c4e0b02
## What changed
Allow `refresh_mcp_config` to replace explicit session `plugins` overrides while preserving other session overrides and user settings. Omitting session plugins retains the current overrides; supplying an empty map clears them and restores inheritance from lower configuration layers.
## Testing
Add coverage for replacing and clearing plugin overrides, preserving unrelated settings, rejecting stale refreshes, revoking and restoring plugin tools and hooks, and retaining refreshed plugin policy when a deferred executor becomes ready.
GitOrigin-RevId: 26913fac0f8ae9590b39bdc037a78c9be86abb67
## Why
A transient environment startup failure persisted across turns when the selected environment and workspace were unchanged, preventing commands from recovering after the executor became available.
## What changed
Retry failed environment resolution at the start of a new turn when the error is retryable and the workspace remains selected. Reuse healthy or pending resolutions and preserve provisioning failures until the selection is updated.
## Testing
Add coverage for command execution recovering on an unchanged next turn after endpoint availability is restored. Extend provisioning failure tests to verify that subsequent turns receive the original error without restarting resolution.
GitOrigin-RevId: b80af60990f30d277804160c9c39c286024c7667
## What changed
- Add the disabled-by-default `interrupt_on_cancel` feature to interrupt upstream inference when a Responses Lite turn is canceled, with a one-second cleanup deadline.
- Detach canceled WebSocket responses so replacement requests can open a new connection without waiting for cleanup.
- Add an optional `interrupt_on_cancel` override for thread samples, inheriting the parent setting when omitted.
## Testing
Add coverage for cancellation during inference and steering, replacement turns proceeding before cleanup finishes, and prompt cancellation of model response interceptors.
GitOrigin-RevId: 501368746fc04fd3fdbd45c1f34c75ce57f4e955
## What changed
- Add `GetProcessMetrics` and provider sampling APIs for process ID, start time, cumulative CPU time, and resident memory, exposed through `ThreadManager` without creating a thread or session.
- Distinguish unsupported collection, a locally absent host, and sampling failures. Process-owned providers never start or replace a host when sampling.
- Bound gRPC sampling to one second without retries or explicit connection resets. Run optional collectors on a detached worker with at most one collection in flight, so stalled collection cannot block the HTTP/2 driver or runtime shutdown.
## Testing
Add coverage for snapshots, collector errors and panics, deadlines, overload, and shutdown with a stuck collector. Extend lifecycle tests to check that sampling preserves session state and keepalive behavior without starting or restarting local hosts.
GitOrigin-RevId: eeafe275891d0464636f28a29345a87aed1a12dc
## Why
Existing chats retain their provider configuration when the selected provider changes. Reject resume and input until the configured provider matches the chat, while keeping history readable and allowing recovery after configuration is restored.
## What changed
- Validate saved providers before applying resume overrides, preserving the provider when only model or reasoning settings change.
- Check the current provider selection, including profiles and launch overrides, before accepting input. Reject input when configuration cannot be loaded.
- Return structured `ModelProviderError` data for provider mismatches, missing definitions, and policy conflicts, with generated JSON Schema, TypeScript, and Python types.
## Testing
Add coverage for override bypass prevention, provider restoration, readable history after rejection, and blocked requests sending no inference traffic. Verify schema fields and Python round trips match the error wire format.
GitOrigin-RevId: 051f97c3815c547d8411c71b770df30eae969f68
## Why
Resuming or forking a thread loses the session flag indicating that reported token usage already includes retained reasoning. Counting that reasoning again can trigger automatic compaction too early.
## What changed
Persist `last_usage_includes_reasoning` with `TokenUsageInfo` and use it when estimating context usage. Record the flag with completed sampling and compaction usage, and mark local estimates as including reasoning. Older records without the field retain the existing accounting behavior.
## Testing
Add coverage for saved inclusive, exclusive, and legacy token counts. Extend the encrypted-reasoning compaction test to verify the compaction threshold for live, forked, and cold-resumed threads.
GitOrigin-RevId: 9f22262a693111ec0406dce11804eb4844ad8983
Replace `join_all` with a buffered stream in `replace_unresolvable_image_files` so at most eight distinct image file IDs are checked concurrently. Collect unavailable IDs as checks complete before replacing their image content with placeholders.
GitOrigin-RevId: 2a9ed8742fbb6157c99c69a15f212df3ed88810c
## What changed
Add `ReviewInput` to bundle an approval request with its captured parent history and review context. Its `assess_isolated` method runs a fresh reviewer without publishing a live approval, honors deadlines and cancellation, and returns a `GuardianAssessment` or review error.
Share review parameter construction with the live review path and extract assessment parsing and error conversion into `GuardianReviewSessionOutcome::into_assessment`.
## Testing
Add a mock-backed test that verifies the isolated assessment is returned and the reviewer receives the captured history without instructions added after capture.
GitOrigin-RevId: 10dd5fddf5fc58bfab124f5962a6b7f45d435c83
## Why
Stopping a sideband observer should close its WebSocket while preserving the frontend-owned realtime session. The existing frameless session close also sends `session.close`, so observer shutdown needs a transport-only close.
## What changed
- Add `close_transport()` to send a normal WebSocket close without `session.close`.
- Close the sideband transport on cancellation or when the call becomes inactive, including an existing connection awaiting adoption by the input task. Bound the close attempt to five seconds.
- Thread an optional sideband base URL through realtime start processing and allow nested thread ID fields in request serialization scopes.
## Testing
Add WebSocket and core conversation regression tests covering observer detachment for both realtime parsers and conversation versions. Verify that explicit frameless session close still sends `session.close`.
GitOrigin-RevId: 874a8980b0fcd45058e976b00c0d968f5b4b2404
## What changed
- Separate evidence collection from prompt preparation and pass reviewer history, model limits, and image preparation policy through shared `guardian-context` APIs.
- Detect captured images before composition and measure reviewer history tokens only when images and a valid context window require it.
- Share instruction and native-message delivery filtering across budget checks, including restoration of retained evidence after history changes.
GitOrigin-RevId: 65ef53cf0bc22e1bde9abfb7a9ffce65cfab6f1c
## Why
When `codex-auto-review` is missing from the model catalog, Guardian falls back to the parent model. Refresh the catalog before accepting that fallback so reviews and checkpoint compatibility checks can use the default reviewer when it becomes available.
## What changed
- Share one refresh attempt per parent session, preserving it across cancelled waiters and retaining the parent fallback if recovery fails.
- Respect explicit reviewer overrides and custom catalogs, and skip recovery for basic sessions.
- Resolve reviewers from the in-memory catalog so a failed disk cache write does not discard a recovered reviewer.
- Apply review deadlines and cancellation to configuration setup, and avoid reviewer resolution during history replay unless checkpoint compatibility requires it.
## Testing
Add coverage for recovery, failed fetches and cache writes, overrides and custom catalogs, checkpoint compatibility, cancelled prewarming, review deadlines, and interruption.
GitOrigin-RevId: 87ae285713afde518a12bc2daba006a043b13bc5
## Why
A thread runtime can shut down while listener setup is awaiting I/O, and a cold resume can start before the previous listener forwards `ShutdownComplete`. Listener replacement must preserve those buffered terminal events.
## What changed
- Coordinate listener installation and connection subscriptions with pending unloads, and reject closing or replaced runtimes.
- Allow a newly created runtime that has already shut down to drain its queued events, while enforcing one event reader per runtime.
- Track shutdown draining with a shared watch channel so cold resume and runtime replacement wait for terminal events to be processed.
- Serialize idle unloading with goal edits and cold resume, and recheck thread state after acquiring the lock.
GitOrigin-RevId: d05e348b0a81bddb2defa963d0cfd3fde08dbd03
## Why
Automatic gRPC reconnection could spawn a replacement host while dispatching an RPC for an existing session. Host loss must remain visible so recovery can report lost state without replaying execution or completed external effects.
## What changed
- Bind each local host channel to one child process and allow only `OpenSession` to replace a dead host.
- Add caller-owned transport support to `GrpcCodeModeSessionProvider` and map local transport failures to `Unavailable` so initial connection failures use the existing bounded admission retries.
## Testing
Add regression coverage for child exit during initial connection and between channel selection and dispatch, concurrent session recovery, and child reaping after teardown. An integration test kills the host after a command completes and verifies that recovery reports the reset, clears stored state, and leaves the command's external effect unchanged.
Increase the remote MCP stalled-handshake test's initialization timeout and mock response delay to let requests reach the server on loaded CI workers.
GitOrigin-RevId: 4ffd810e4cfcfb7a56e606816aa867bc206a09b6
## Why
A bundled reviewer entry does not establish that a custom gateway offers that model. Guardian should fall back to the parent model when the reviewer is neither advertised by the provider nor explicitly configured.
## What changed
Track model metadata origins as `Bundled`, `Provider`, or `ExplicitConfig`, including across catalog merges and cache reloads. Exclude bundled entries from Guardian reviewer selection unless `auto_review_model_override` is set. Continue selecting reviewers from provider and explicitly configured catalogs.
## Testing
Add coverage for gateway reviewer selection with each catalog origin, plus origin tracking across cache reloads, empty provider responses, and authentication changes.
GitOrigin-RevId: f8bf865d406e56ee0ade90087b55f2e33b98181e
## Why
Guardian's `write_stdin` approval requests lacked the command used to launch the receiving terminal, leaving reviews without that context.
## What changed
- Carry `original_command` from the terminal's launch command into the approval request and Guardian action JSON. This describes the original launch, not the terminal's current state.
- Exclude `original_command` from the 8,000-byte stdin approval size check so launch context does not consume the budget for input, permission details, and the approval reason. Launch context remains subject to Guardian's normal request budget.
## Testing
Extend serialization coverage to check `original_command` and the strict stdin review integration test to verify that a launch command longer than 8,000 bytes reaches Guardian intact.
GitOrigin-RevId: cc765a6bf80d080baf94c959eafa6227b2889e1f
## What changed
Decode `response.metadata` Guardian assessments into typed `GuardianAssessment` events over SSE and WebSocket, carrying `response_id`, `item_id`, and `requires_review`. Ignore assessments with missing, empty, or incorrectly typed required fields while preserving independent delivery of other metadata.
Expose the assessment type to request-scoped extension interceptors. Keep assessments out of conversation history; they do not authorize tool execution.
## Testing
Add SSE coverage for assessment ordering, malformed metadata, and mixed metadata delivery. Extend model request tests to cover SSE and WebSocket interceptor delivery and exclusion from subsequent model input.
GitOrigin-RevId: 282b8817ee97346d76b40bcb412eef023df60ff1
## What changed
Extract MCP approval elicitation parsing and review-decision response conversion from `core/src/session/mcp.rs` into `codex-guardian-reviewer`. Export the helpers and `GuardianElicitationReview` for the session code to use, while keeping session lookup, provenance checks, and approval enforcement in the host.
## Testing
Move the existing elicitation tests into the reviewer crate, retaining coverage for request construction, opt-in requirements, unsupported forms, decision mapping, and model-specific timeout instructions.
GitOrigin-RevId: fb745fa0e49a29f015bbda16c14b5fc2b12278b9
## What changed
Export `ReviewAction` and its conversion from `GuardianApprovalRequest` from
`codex-guardian-reviewer`. Keep host-specific approval preparation and environment
validation in core as standalone functions, and update callers accordingly.
## Testing
Move the `write_stdin` serialization and tool-call provenance test into the
reviewer crate, preserving coverage for input, Windows working directories, and
sandbox permission modes.
GitOrigin-RevId: 9a1caf9bbb67ba017e4950a2da9ef2543b013007
## Why
Shared routing cookies can change after a parent connection is established. Guardian reviews need the routing affinity captured with their parent response so unrelated traffic does not replace that hint.
## What changed
- Capture `__oailb` and `__cflb` cookies from successful ChatGPT WebSocket handshakes and pair them with the parent response ID.
- Retain the snapshot throughout a review and its retries, and apply it only to Guardian requests with the matching parent response. Reconnect cached reviewer sockets when the parent affinity changes.
- Preserve cookie expiry and restrict reuse to the original secure origin and endpoint path. Replace routing cookies while retaining unrelated cookies, and keep the captured affinity out of prompts, history, and serialized metadata.
## Testing
Add coverage for cookie scope, expiry, duplicate rejection, and merging; replaying a captured pin after shared cookies change or are deleted; and retaining the matching parent snapshot through compaction without exposing cookies in review prompts or metadata.
GitOrigin-RevId: d180679e6265b612a3617f20ca1f5dec89e73aa8
## What changed
Move review evidence storage, authorization snapshots, sender exchange selection,
and bounded Node REPL evidence into `codex-guardian-reviewer`. Update core to
call or re-export these APIs while retaining host-specific context rendering and
capture-mode selection.
Move the existing Node REPL evidence and text truncation tests alongside their
implementations in the reviewer crate.
GitOrigin-RevId: d851cd353cf9f31eb47ce13f43f6f935dc2f5d93
## What changed
Move `GuardianContextMode`, parent compaction checkpoint policy, and reviewer instruction assembly into `codex-guardian-reviewer`. Export the conversation-history prompt and follow-up reminder from the same crate, and update core to use these shared definitions.
Keep session-specific authorization version lookup in core while preserving existing context selection, checkpoint validation, and prompt behavior.
GitOrigin-RevId: a4cadb6c8ad95e756467316b7d8658e8cd527b24
Dmitriy Kovalenko