## What changed
Add `install_global_metrics` as the public entry point for installing an
externally managed, non-Statsig `MetricsClient` during single-threaded startup.
The returned handle retains ownership of the installed exporter so callers can
flush and shut it down.
GitOrigin-RevId: 1108a0468588046e5cc8266d2af6143f14456d82
## What changed
- Emit a connection-scoped `deprecationNotice` when `review/start` uses
`delivery: "detached"`, including when validation later rejects the request.
- Preserve detached review behavior while directing callers to use `thread/start`
followed by an inline review for a separate review thread.
- Document the deprecation and migration options in the app-server protocol and
README.
## Testing
- Cover the notice for accepted and rejected detached reviews.
- Verify that omitted, null, and inline delivery do not emit the notice.
GitOrigin-RevId: 4234a09d2bb7ef8053091580175dc8cbe8d7512c
## Why
An empty tool map does not distinguish a successfully returned empty catalog from a server whose startup or tool discovery failed.
## What changed
- Add nullable `toolsError` to each `mcpServerStatus/list` entry when no catalog is available because startup or tool discovery failed.
- Keep `toolsError` null for returned catalogs, including cached and empty catalogs, and continue returning healthy servers when another server fails.
- Update the protocol schemas and generated TypeScript type.
## Testing
- Extend the app-server status integration test with a broken MCP server and verify its error without losing the healthy server's inventory.
GitOrigin-RevId: 30b4ca4d9a45cec6998f5f626d3fddbee90a525d
## What changed
Increment the `codex.windows_sandbox.private_desktop` counter when preparing a
Windows restricted-token sandbox execution, tagging it with whether private
desktop isolation is enabled.
GitOrigin-RevId: 1eb5e183b57e19753dc133dbe152eabe23dd2a23
## Why
Loaded threads can retain their previous configuration after a local plugin is
installed, preventing the plugin's bundled MCP servers and pending user-config
changes from taking effect in the current session.
## What changed
- Reload user configuration for loaded threads after installing a local plugin.
- Refresh MCP and hook runtimes only after the new configuration is applied.
- Keep installation successful if configuration reload fails, while logging the
failure.
## Testing
- Verify an installed plugin's MCP tool can be called from a thread that was
started before installation.
- Update the hook runtime test to verify installation applies a staged hook
configuration change to the loaded session.
GitOrigin-RevId: 63f5a5c7f16303e51cf940e8d9dc3b45c50ae2a9
## Why
Sandboxed commands inherit the user's controlling terminal. Without an explicit
restriction, a child can use `TIOCSTI` to queue input for the unsandboxed shell
that resumes after Codex exits.
## What changed
Append a `file-ioctl` denial for `TIOCSTI` after the shared Seatbelt policy
allowances used by `codex sandbox`.
## Testing
Add a macOS PTY integration test that first proves terminal input injection
works without the sandbox, then verifies Seatbelt rejects it with `EPERM`.
GitOrigin-RevId: 5a8b0a5b4fd980cc406ad184d04ceae9b0ea90e4
## Why
Guardian can reuse an opaque parent compaction only when the checkpoint's
recorded producer hash matches the scoring model. Missing or incompatible
provenance must not allow an asynchronous score or cached approval to omit
compacted context.
## What changed
- Record the producing model's compatibility hash on compaction history items
and expose the latest checkpoint hash through conversation snapshots.
- In thread-owned context mode, fail closed and require synchronous review when
checkpoint reuse is enabled but the latest checkpoint is incompatible or has
unknown provenance.
- Reject incompatible checkpoints in the sampler while preserving the legacy
context behavior.
## Testing
Add coverage for local, remote, resumed, compacted, and rolled-back histories,
including matching, mismatched, missing, and empty compatibility hashes.
GitOrigin-RevId: 1ce959cb276edc602fd7dfa442133c7fe5e53857
## Why
Legacy terminals encode `Alt` plus a character the same way as `Esc` followed
by that character. In Vim insert or replace mode, typing a command immediately
after `Esc` could therefore leave the composer in the wrong mode.
## What changed
Recover ambiguous input as separate `Esc` and character events when Vim mode
can consume the escape. Preserve active `Alt` bindings, key chords, image
paste, agent navigation, enhanced-key terminals, and AltGr input.
## Testing
Add coverage for recovered Vim commands and for each shortcut and terminal
case that must retain its existing behavior.
GitOrigin-RevId: 3d8464d805f95f677cce5c46ae00338e611d776a
## Why
Guardian authorization reviews need host-verified `request_user_input` answers to
remain aligned with thread history across compaction, resume, and rollback.
## What changed
- Record verified question-and-answer pairs in retained thread context when
`GuardianThreadContext` is enabled, and source both local and delegated Guardian
review evidence from that context.
- Preserve complete answer records within the evidence budget. Mark authorization
context incomplete when records are unavailable or oversized, and defer cached
fast approvals in that case.
- Keep the existing runtime-only answer path for threads that do not enable the
thread-owned context.
## Testing
- Cover answer retention through compaction and resume, removal after rollback,
source-call eviction, oversized answers, delegated review evidence, and legacy
behavior.
GitOrigin-RevId: 01f6f4541515434a0d00fdde318ff59f2f8bd2eb
## What changed
- Pass the selected executor's `PathUri` through user command approval requests instead of converting the working directory to a host-native path.
- Make native-path permission helpers explicitly local and require executor-aware permission transforms to receive a `FileSystemSandboxPolicyContext`.
- Cover approved remote commands to verify that the approval request reports the selected remote working directory and execution resumes after approval.
GitOrigin-RevId: 0aa3042f2d7594af6c7d0abf31d7f99cf67d5556
## Why
When silent OAuth refresh cannot recover a rejected MCP tool call, the caller
needs the server's authentication challenge to initiate interactive login. The
rejected call must not be replayed automatically after refresh has failed.
## What changed
- Convert `401 Unauthorized` responses with `WWW-Authenticate` headers into an
MCP tool error containing `mcp/www_authenticate` metadata.
- Preserve multiple authentication challenges by combining all
`WWW-Authenticate` header values.
- Keep successful silent refresh behavior while avoiding replay when refresh
fails.
## Testing
Added coverage for successful and failed refresh, multiple authentication
headers, propagation through agent tool-call events, and no-replay behavior.
GitOrigin-RevId: c560cff6286d7ab09b1f5c6cf3618d4650cde47d
## What changed
- Add the disabled, under-development `guardian_thread_context` feature flag for selecting thread-owned context for Guardian reviewers.
- Expose the boolean setting in the generated configuration schema.
- Verify default, base configuration, and profile override resolution.
GitOrigin-RevId: c4878be96d12f4ccd84356df15d3e55f13ac141f
## What changed
- Add the creation-time `originator` to app-server thread responses and `thread/started` notifications.
- Persist originators in thread metadata and preserve the first recorded value across list, read, resume, rollout, and SQLite paths.
- Add an `originators` allowlist to `thread/list` for hosted backends. The local app-server accepts omitted or empty values but rejects nonempty filters.
## Testing
- Cover originator persistence across server restarts and list, read, and resume requests.
- Verify local `thread/list` handling for nonempty, omitted, null, and empty originator filters.
- Heap-allocate large TUI dispatcher futures in affected tests to keep them within the Windows test-thread stack.
GitOrigin-RevId: 73ad6e61b8fdd2d93a22d1f971723a19ec7be3fc
## What changed
- Add bounded detail previews for the selected task, including pending approval or user-input requests, live reasoning headings, and the latest agent message.
- Prefer the most urgent child task with useful detail while keeping the task list compact.
- Populate historical last messages from existing thread reads and update live details from already-delivered events without attaching to additional threads.
- Clear stale previews after reverts, event-stream gaps, reconnects, and thread lifecycle changes.
## Testing
- Add coverage and snapshots for attention requests, live activity, historical messages, stale refreshes, and attachment changes.
GitOrigin-RevId: 5de4b8aa3bc5bf9653a40c44b827f7aa85c8cf89
## Why
The permissions menu needs to reflect the profiles and configuration requirements available in the active app-server scope, including remote workspaces.
## What changed
- Load permission profiles and configuration requirements asynchronously when opening the permissions menu, using the active thread working directory.
- Render loading, retry, empty-catalog, and unsupported-server states, and fall back to the legacy permissions menu when explicit profiles are not configured.
- Disable profiles rejected by server requirements or unavailable in the catalog. Remote custom profiles remain visible but cannot yet be selected.
- Bound pagination and request time, reject malformed catalogs, and ignore responses made stale by account, thread, or modal changes.
## Testing
- Cover local, session-only, remote, legacy, empty, unsupported, pagination, malformed-response, and timeout discovery paths.
- Add TUI tests for loading, failures, retries, empty results, remote catalogs, stale responses, and working-directory changes.
GitOrigin-RevId: 3e2ab53a4eae1179587d064f9a4c605765ea7880
## Why
Completion receipts for identical user messages could acknowledge the wrong
pending steer. When the receipt arrived while another thread was displayed,
the stale pending state could later be restored and resubmitted.
## What changed
- Assign each TUI submission a client message ID and pass it through turn start
and steer requests.
- Preserve pending steer IDs across thread input snapshots and match completion
receipts by ID, while retaining content-based matching for older app servers
that do not echo IDs.
- Acknowledge matching receipts for inactive threads before their notifications
can be discarded, including threads stored in the agents overview.
## Testing
Added coverage for identical steer receipts and for switching within and
between tasks before interrupting an active turn.
GitOrigin-RevId: 28bd80a735ff86cd7bf836f24b448e7499f0a902
## What changed
- Add `originator` to plugin measurement inputs and emitted analytics events.
- Populate it from the turn originator when recording plugin measurements.
- Extend analytics tests to verify the originator is preserved in event payloads.
GitOrigin-RevId: 9998f829760222fc690dc8a10324794b5da27220
## What changed
- Replace the command center's single-line new-task input with the shared chat composer, including multiline editing, paste handling, Vim mode, configured keybindings, cursor behavior, and input validation.
- Keep task drafts and editor state across dashboard refreshes and reconnects while separating composer focus from list, search, and rename actions.
- Preserve whitespace in dispatched task prompts, block submission while offline, and restore unsent prompts after dispatch failures when the composer is still available.
## Testing
- Add coverage for focus routing, draft retention, multiline pastes, custom keybindings, Vim mode, offline editing, failed-dispatch recovery, and responsive rendering.
GitOrigin-RevId: a609ae95d497cbae0ebcac4cdcc50fe49d74832a
## What changed
- Load the `/experimental` catalog from the running server for the active thread, with loading, empty, and failure states in the popup.
- Show beta features in server order and preserve server-reported names, descriptions, and configured values. Mark features as read-only when the local config writer cannot safely update them.
- Persist only changed, writable feature flags. Bound discovery with page-size and page-count limits, repeated-cursor detection, deduplication, cancellation, and a timeout.
## Testing
- Cover paginated discovery, malformed or unresponsive servers, popup cancellation, read-only controls, selective writes, and the new popup states.
GitOrigin-RevId: 1f49eb961c8ab220a466e15f032c1dc61ed86d38
## Why
Computer-use-only Guardian scoring should follow the active model's REPL
auto-review requirement, including when the model changes within a live thread.
## What changed
- Run computer-use scoring and fast approval decisions only when the active
model sets `node_repl_auto_review_required`.
- Invalidate prior or in-flight scores when a model switch skips scoring, so
switching back to a reviewed model cannot revive a stale decision.
## Testing
- Cover model switches for both `node_repl` and `cua_repl` MCP servers.
- Verify skipped scoring and stale-score rejection across requirement changes.
GitOrigin-RevId: 46aec4d017bea8f135b435bcd769b87369b8ce95
## What changed
- Add a configurable `agents.resume` action, bound to `Ctrl+O` by default, that opens the session resume picker from the agent command center.
- Preserve command-center state when the picker is cancelled, and preserve per-thread composer and queued-input state when switching sessions.
- Keep resume failures within the command-center flow and wrap footer shortcuts on narrow terminals.
## Testing
- Add coverage for picker cancellation, active-session selection, resume failures, per-thread input restoration, custom keybindings, and narrow footer layout.
GitOrigin-RevId: 59159f838a0c642200cd164e3af45b0971d29bf8
## What changed
- Add `application.network` managed requirements with exact-domain allow/deny
rules, default-enabled behavior, domain normalization, and normal managed TOML
precedence.
- Return the policy separately from agent network requirements through the
experimental `configRequirements/read` API. The endpoint reports the policy
but does not enforce it.
- Export the new protocol types and schemas, and document the TOML format.
## Testing
- Cover parsing, validation, normalization, layered precedence, and cloud
requirement composition.
- Verify app-server responses, defaults, separation from agent policy, and
rejection of invalid domains.
GitOrigin-RevId: 563eeed296d9748430b819797204a44a8db92f3b
## What changed
- Honor `McpOAuthRefreshMode::Coordinated` for streamable HTTP MCP connections by letting RMCP refresh and persist credentials through the pinned credential store.
- Reread credentials while holding the refresh lock, persist refreshed tokens before retrying requests, and serialize login and logout writes with in-flight refreshes.
- Keep OAuth preparation outside MCP operation and handshake deadlines, and allow refresh persistence to finish if the initiating caller is cancelled.
## Testing
- Cover coordinated startup refresh, concurrent refreshes, `401` retries, credential mutation races, provider timeouts, and caller cancellation.
GitOrigin-RevId: 100ae788048087be23e26bb43f868b1fcebb007a
## Why
Misalignment policy failures pause the current chat. When the server provides findings and a continuation request, users should be able to inspect them and explicitly decide whether to proceed.
## What changed
- Add a `Review findings` flow that shows the detailed explanation and quoted continuation request in an overlay.
- Require explicit acknowledgement before starting a continuation turn, while preserving the active approval and sandbox settings.
- Keep ordinary input blocked and reject stale, replaced, invalid, or duplicate continuation attempts.
- Label the overlay shortcut as `q close` to match its behavior.
## Testing
- Add TUI tests covering findings review, explicit confirmation, successful and failed continuation, stale findings, duplicate events, and invalid continuation data.
GitOrigin-RevId: 36a738adf272f95db92eaee5712fb00061d0fa52
## What changed
- Keep `!`, `/`, and `?` prefixes literal in plain-text composers instead of activating command modes or shortcuts.
- Preserve buffered characters when changing Vim mode, cancelling a draft, or pressing Enter during a paste burst.
- Show over-limit errors in embedded composer footers, retain the rejected draft, and schedule redraws when the message expires.
- Clear stale validation errors when replacing a draft or switching form fields.
## Testing
- Add coverage for literal prefixes, buffered typing, single-character paste lines, retained over-limit drafts, and clearing validation errors between fields.
GitOrigin-RevId: ed9d5b2c087abdfefd92d93033ea1c20211d56d7
## Why
Selected plugin MCP servers may be skipped after the optional startup grace
period. When a user explicitly mentions a plugin or MCP server, the turn should
continue waiting so the requested tools are available to the model.
## What changed
- Track explicitly mentioned plugin IDs and MCP servers across later samples,
steered input, and same-turn restarts.
- Require matching selected-plugin MCP servers to finish startup before
capturing the tool catalog, while leaving unmentioned servers optional.
- Match `plugin://` identities independently of display names and ignore
targeting query parameters such as `app` and `browserFamily`.
## Testing
Added coverage for linked and structured plugin mentions, direct and batched
capability discovery, delayed environment attachment, steering, and same-turn
restarts.
GitOrigin-RevId: c509ef8df45df1a7edb0da6afdb2682dc53a4de8
## Why
The managed app-server daemon and automatic TUI attachment were limited to
Unix, so Windows users could not share a background server across Codex
sessions.
## What changed
- Enable daemon lifecycle commands, `codex agents` startup, and AF_UNIX daemon
discovery on Windows.
- Require Windows daemons to start non-elevated and verify the discovered
socket directory and peer before connecting.
- Preflight detached process support, preserve path-based environment settings,
and keep daemon processes out of the launching project's working directory.
- Fall back to an embedded server when an implicitly discovered daemon cannot
connect, while preserving errors for explicit remote endpoints and bypassing
daemon reuse when `CODEX_EXEC_SERVER_URL` is set.
## Testing
Add coverage for Windows launch restrictions and socket validation, implicit
connection fallback, executor selection, daemon discovery, and the agents
dashboard startup result.
GitOrigin-RevId: e7fd63cf8690bcca8b5155266416f31f2f792aa2
## Why
Pipe output chunks can split one protocol frame or contain several frames. A
timed-out read must also retain any partial frame it already consumed so the next
exchange can continue decoding it.
## What changed
Add a stateful `MessageReader` that buffers partial input, preserves unread bytes
from coalesced chunks, and validates frame bounds before reading the payload. Use
it for voice helper handshake and shutdown responses.
## Testing
Add async tests for fragmented and coalesced frames, cancelled reads, oversized
headers, truncated and malformed input, and invalid pipe chunk sizes.
GitOrigin-RevId: 274d9698e05f2de2147235b6e4e1bd38dbb7c23b
## What changed
- Add `Environment::last_ready_info()` to return a snapshot of the most recently accepted `EnvironmentReadyInfo`.
- Preserve the distinction between no accepted report and an accepted report with no capability roots.
## Testing
- Cover pending, ordinary, failed, recovered, replaced, empty, and invalid readiness reports.
- Verify that previously returned snapshots remain unchanged after later reports.
GitOrigin-RevId: cd051a56e7ad54a673c851eb58238c5837335c03
## What changed
- Fetch `collaborationMode/list` during TUI startup and reconnect, and use the
returned catalog for visible collaboration-mode selection.
- Keep collaboration-mode discovery optional with a two-second timeout so an
unavailable, invalid, or unsupported response does not block bootstrap.
- Preserve discovered modes when the model catalog refreshes, clear restored
developer-instruction overrides when selecting a server mode, and retain a
`/plan` draft when plan mode is unavailable.
## Testing
- Cover optional discovery failures and catalog refresh on reconnect.
- Cover server mode selection, model refreshes, restored settings, and
unavailable plan mode.
GitOrigin-RevId: a6e35c14aab2e38526606164091ac64c500151bb
## Why
Replaying a thread after a later turn has continued can treat an earlier
misalignment policy violation as still active, clearing the restored draft and
queued follow-up input.
## What changed
- Track the latest turn independently of the bounded replay buffer.
- Omit misalignment errors from older turns during snapshot and stored-turn
replay while preserving an error on the latest turn.
- Keep interrupted tool calls from the older turn visible in history.
## Testing
Added buffered replay coverage for restored drafts and queued messages, buffer
eviction, current-turn violations, and interrupted tool rendering.
GitOrigin-RevId: d6c223d9c5a1905fe1b48dc5f9514a7ccbf61d92
## What changed
- Move `AgentsOverviewView` rendering and cursor placement into
`agents_overview_render.rs`.
- Extract paste-burst Enter handling from the main chat composer into the
reconnect module while preserving the existing submission behavior.
GitOrigin-RevId: 641daf9ad6cba79d805a9ae100f63ef81470757d
## What changed
- Set `CODEX_VERSION` to the running package version in user shell and unified
exec environments, overriding stale shell-policy or snapshot values.
- Add the reserved `codex_version` field to MCP turn metadata.
## Testing
- Cover version propagation through shell policies, shell snapshots, unified
exec, and MCP metadata.
GitOrigin-RevId: 7846c70d668176530b1f467293b749dc9ddd79a0
## What changed
- Run the daemon update loop on Windows using the non-interactive PowerShell installer.
- Restart the managed app server after updates and hand updater ownership to a changed managed executable through a readiness handshake.
- Contain installer descendants in a Windows job while allowing app-server and successor updater processes to break away.
- Preserve or restore PID ownership when successor startup fails, without terminating a process that reused the PID.
## Testing
- Cover non-interactive installer success and script failure on Windows.
- Cover updater handoff, readiness, rollback, inaccessible processes, and PID reuse.
GitOrigin-RevId: 5178c01124b4dd86b507b53f5093ec9a9d48e12c
## Why
Patch targets can use a different path convention from the Codex host, so
host-native path conversion can misclassify writable roots and requested
permissions.
## What changed
- Evaluate patch targets as `PathUri` values with the active filesystem policy
context, including workspace roots and the executor's path convention.
- Distinguish executor-managed sandboxing from local platform sandboxing when
deciding whether a patch can be auto-approved and how to normalize additional
write permissions.
- Make full-disk and special-path policy checks honor the selected executor's
Windows or POSIX convention.
## Testing
Add coverage for Windows executor URIs, full-disk policy aliases, remote patch
permission requests, sandbox availability, and owner-provided workspace roots.
GitOrigin-RevId: 1a054ea443efd342623c67432762f85c53d20c15
## What changed
- Allow a valid Ready report to replace a deferred environment's provisioning failure while preserving the same environment instance.
- Treat provisioning failures as retryable and reconnect when a completed or concurrently publishing startup attempt contains a stale failure.
- Report provisioning failures from `status()` without starting a connection, and retain Ready state when a late failure arrives.
## Testing
- Cover recovery after failed and invalid provisioning reports, capability-root resolution after recovery, and the race between Ready and publication of an earlier startup failure.
GitOrigin-RevId: cce419403248168da81bc5a6ab20f919aed81142
## What changed
- Add the experimental `Thread.environments` field with each selected environment's ID, working directory, and runtime workspace roots.
- Populate the field from live thread state in start, resume, read, list, and unarchive responses. Use `null` for unloaded threads and an empty list when a loaded thread has no environment selection.
- Document that the field reports selection rather than connection status and does not affect executor selection or resume behavior.
## Testing
- Cover selection updates, unloaded and resumed threads, loaded pathless unarchives, and clients that subscribe after environment connection notifications.
GitOrigin-RevId: a6daa06aff7089d7c5a1e4c7d03109b41f12fa3c
## What changed
- Add the under-development `features.context_management.experimental_mode` configuration and schema.
- For eligible ChatGPT Plus, Pro, and Pro Lite sessions using the Codex backend, enable token-budget context, history notes, and the `new_context` tool when experimental context management is configured.
- Keep the feature disabled for custom providers, provider credentials, non-Codex endpoints, and temporary structured threads.
## Testing
- Cover subscription eligibility, backend restrictions, configuration resolution, token-budget guidance, and temporary-thread overrides.
GitOrigin-RevId: 19402af19c4d69e09a7cdb3687ee7d233f6a562a
## What changed
- Add a test-only `CredentialStore` adapter that maps RMCP refreshes onto Codex's pinned OAuth credential backend.
- Require refresh transaction guards for mutations, preserve the pinned backend, and update the runtime credential snapshot only after persistence succeeds.
- Preserve scopes and token expiry metadata while rejecting credentials that no longer match the connection's client or issuer.
## Testing
- Cover guarded save and clear operations, persistence failures, pinned-store read failures, replacement and removal handling, and expiry round trips.
GitOrigin-RevId: eb1b98024322c03af94f5ab2e88c7dc4ae54893a
## What changed
- Upgrade `rmcp` and `rmcp-macros` from 3.1.3 to 3.2.0.
- Refresh the Cargo and Bazel lockfiles for the new versions.
GitOrigin-RevId: a1d7696eafe6a150c6e09c3cc9c3663a8fd68679
## Why
The PID-managed app-server lifecycle previously supported Unix only, leaving Windows unable to start and stop the managed daemon.
## What changed
- Launch the Windows daemon as a detached process and fail clearly when the host Job Object prevents detachment.
- Add Windows file locking and process creation-time checks so stale or reused PIDs cannot cause an unrelated process to be terminated.
- Request graceful shutdown through a shutdown file, then terminate the verified process after the grace period.
- Prepare private daemon state directories consistently and pin the executable path across installer junction updates.
## Testing
Add Windows tests for process-query permissions, reused and inaccessible PIDs, and stale-record cleanup.
GitOrigin-RevId: 5ea579a7c3dc8bb6122ec3a02513836ccaacc41c
## What changed
- Show a confirmation before stopping a safety-buffered attempt and retrying
with the server-selected faster model.
- Explain that the retry starts a new thread, preserves actions already taken,
and may use a less capable model; allow the user to keep waiting instead.
- Dismiss the buffering or confirmation view when the response starts or the
turn is no longer eligible for retry.
- Refresh the buffering copy and wrap confirmation text correctly in narrow
terminals.
## Testing
- Cover retry confirmation, cancellation, turn completion, response startup,
stale updates, and narrow-terminal rendering.
GitOrigin-RevId: 013bc47174811dd104b421774577c2808c732bfa
## Why
Directly deserializing the flattened `RolloutLine` envelope can reject nested
decimal values, preventing affected paginated sessions from resuming.
## What changed
- Add canonical string, byte, and reverse-scanner helpers that decode rollout
records through `serde_json::Value` before decoding the flattened item.
- Route rollout readers across session discovery, history, migration, search,
thread storage, and transcript previews through those helpers.
- Remove `Deserialize` from `RolloutLine` so new readers cannot bypass the
canonical persistence decoder.
## Testing
Add coverage that resumes a paginated rollout after a token-count record with
a decimal rate-limit value and verifies that ordinal sequencing continues.
GitOrigin-RevId: 49abac1e0751c073daa5a93a840d8a483fd2d013
## What changed
- Remove the per-thread `RealtimeConversation` feature check when starting a realtime session.
- Retain `features.realtime_conversation` as a removed compatibility setting that has no effect, even when set to `false`.
- Document the always-available behavior for `thread/realtime/start`.
## Testing
- Cover realtime startup on forked and cold-resumed threads with the legacy setting absent, disabled, or enabled.
GitOrigin-RevId: d9cd9aa3898d1c2efb9414a8f40c86be8951e210
## What changed
- Record the authenticated sandbox owner and observe package uninstall events across service restarts and session changes.
- During uninstall, serialize setup and cleanup, disable sandbox accounts, stop their processes, and remove sandbox directories, firewall and WFP rules, hidden-user entries, accounts, and the sandbox group.
- Restrict desktop-owned directory cleanup to pinned paths and perform it while impersonating the authenticated owner.
- Detect missing or disabled sandbox accounts after interrupted cleanup and reprovision them before restoring network access.
GitOrigin-RevId: 7d63fff7ddcff3eb01d018653146df12044bd277
## What changed
Move Unix detached-process launch and PID publication from `pid.rs` into
`pid_start.rs`, keeping PID reservation and lifecycle behavior unchanged.
GitOrigin-RevId: acacb33953a66adc15377294ccc46d0677cc61c4
## Why
Exec-server process and network-policy events need stable attribution to the
launching tool call and executor without recording process payloads.
## What changed
- Add optional `ExecMetadata` to `ExecParams` and propagate the thread and tool
call IDs from unified exec.
- Emit bounded OpenTelemetry events for process start, spawn failure, sandbox
denial, and exit. Correlate them with the launch trace and registry-issued
executor identity while excluding arguments, paths, environment values,
output, and error text.
- Preserve launch attribution across long-running processes and reconnects, and
attach the same metadata to network-policy audit events.
- Keep the protocol backward compatible when metadata is omitted, and prevent
invalid trace headers from inheriting an unrelated active span.
## Testing
Add coverage for metadata serialization and propagation, lifecycle event
fields, trace relationships, reconnect behavior, spawn failures, sandbox
denials, and network-policy attribution.
GitOrigin-RevId: 7aa480a7289c73cb95e2c124c35500bb6f0d5084
## Why
When ordinary included usage is exhausted, eligible users need a way to keep working with the backend-provided Luna Reserve quota and return to their previous model once ordinary usage recovers.
## What changed
- Automatically switch eligible TUI tasks to Luna Reserve after an authoritative account usage read, preserving the prior model and reasoning effort per task.
- Restrict model selection while on Reserve to its supported reasoning levels, keep queued turns on the accepted model, and restore the saved model after a fresh read confirms recovery.
- Surface Reserve usage in the composer and `/status`, and expose `normalModelSlug` in app-server rate-limit snapshots so clients can use the associated model's display metadata without changing the request model.
- Poll account limits more frequently near exhaustion and retain compatibility with app servers that only accept the legacy null request parameters.
## Testing
- Added coverage for Reserve entry, queued-turn handling, task reconstruction, recovery authorization, account changes, model selection, usage rendering, and banner dismissal.
GitOrigin-RevId: 46a435e9531051f8cec3f6a46c4b9f7cfa479747
## What changed
- Log failed MCP server startup outcomes once per startup attempt, including failures during discovery that do not emit startup notifications.
- Preserve the full error chain when converting startup failures into cloneable outcome errors.
GitOrigin-RevId: 54bbf2abaf3329d9828b2d2bc5d877fddc2917e1
